or3-provider-basic-auth 0.0.9 → 0.0.10

package/README.md

@@ -51,6 +51,7 @@ Optional:
 - `OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD`
 - `OR3_BASIC_AUTH_RATE_LIMIT_BACKEND` (`sqlite` default; `memory` is per-process and intended for single-instance development only)
 - `OR3_BASIC_AUTH_ALLOW_INSECURE_DEV` (`true` in non-production to start with missing secrets instead of failing)
+- `OR3_PLUGIN_DEV_COOKIE_SCOPE` (set by the isolated plugin development launcher to keep browser sessions separate across local hosts)
 
 Registration mode is a core-auth policy, not a provider setting:
 
@@ -72,6 +73,7 @@ Strict-mode behavior:
 - Access JWTs are short-lived and validated by `basicAuthProvider.getSession(event)`.
 - Refresh tokens are rotated and hashed at rest; replay attempts revoke active sessions.
 - The refresh cookie is scoped to `/api` so `/api/auth/session` can transparently rotate expired access tokens during session resolution.
+- Sign-out never refreshes the session: the user is resolved without rotation, and revoking a token also revokes the sessions it was rotated into and clears their rotation grace, so a replayed predecessor cannot recover a successor after logout.
 - The SQLite DB file and directory are hardened to mode `0600`/`0700`; the DB uses WAL journaling.
 
 ## Runtime entrypoints
@@ -90,6 +92,8 @@ Strict-mode behavior:
 | `src/runtime/plugins/auth-status.client.ts` | Client auth-status resolver + silent-refresh recovery |
 | `src/runtime/components/*.client.vue` | Provider-owned auth UI (modals, user menu, sidebar button, lock page) |
 
+New passwords must be at least eight characters and no more than 72 UTF-8 bytes, matching bcrypt's input limit. Existing account hashes remain verifiable, including passwords created before this limit was enforced.
+
 The registered sidebar auth adapter accepts `layout="rail"` (default) and
 `layout="more-sheet"`. In the More sheet it renders Account/Login with the
 host's shared full-width `.more-row` structure, while keeping the existing
@@ -134,3 +138,19 @@ bun run type-check
 bun run test
 bun run build
 ```
+
+
+### Testing local changes in OR3 Chat
+
+With this repository beside `or3-chat`, run `bun install` here once, then
+`bun run dev:ssr` from Chat. Chat's dev wrapper rebuilds the local provider and
+prints its selected path; restart it after provider edits. Missing repositories
+or failed builds fall back to installed packages with a warning.
+`OR3_LOCAL_PROVIDERS=false` disables local selection. Production builds use the
+installed package, so local development does not publish these changes.
+
+Basic Auth's database always uses `better-sqlite3`, independently of the sync
+provider's SQLite driver. If the source launcher selects Bun for sync, this
+native binding must also work under the project-pinned Bun version. The launcher
+checks it in that runtime before starting Nuxt and reports incompatible bindings
+or runtime crashes. Managed Cloud uses Node with `better-sqlite3`.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "or3-provider-basic-auth",
   "configKey": "or3-provider-basic-auth",
-  "version": "0.0.9",
+  "version": "0.0.10",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/components/BasicAuthChangePasswordModal.client.vue

@@ -31,7 +31,7 @@
 
           <USeparator />
 
-          <UFormField label="New Password" name="newPassword">
+          <UFormField label="New Password" name="newPassword" hint="At least 8 characters; at most 72 UTF-8 bytes">
             <UInput
               v-model="state.newPassword"
               type="password"
@@ -83,6 +83,7 @@
 
 <script setup>
 import { computed, reactive, ref } from "vue";
+import { newPasswordFitsBcrypt } from "../password-policy";
 const modalUi = {
   overlay: "basic-auth-modal-overlay",
   content: "basic-auth-modal-content sm:max-w-[400px]"
@@ -108,6 +109,14 @@ function close() {
   emit("update:modelValue", false);
 }
 async function onSubmit() {
+  if (state.newPassword.length < 8) {
+    errorMessage.value = "New password must be at least 8 characters.";
+    return;
+  }
+  if (!newPasswordFitsBcrypt(state.newPassword)) {
+    errorMessage.value = "New password must be 72 UTF-8 bytes or fewer.";
+    return;
+  }
   if (state.newPassword !== state.confirmNewPassword) {
     errorMessage.value = "Passwords do not match";
     return;

package/dist/runtime/components/BasicAuthRegisterModal.client.vue

@@ -46,7 +46,7 @@
           <UFormField
             label="Password"
             name="password"
-            hint="At least 8 characters"
+            hint="At least 8 characters; at most 72 UTF-8 bytes"
           >
             <UInput
               v-model="state.password"
@@ -112,6 +112,7 @@
 
 <script setup>
 import { computed, reactive, ref } from "vue";
+import { newPasswordFitsBcrypt } from "../password-policy";
 const modalUi = {
   overlay: "basic-auth-modal-overlay",
   content: "basic-auth-modal-content sm:max-w-[420px]"
@@ -150,6 +151,9 @@ function validateClientSide() {
   if (state.password.length > 512) {
     return "Password is too long.";
   }
+  if (!newPasswordFitsBcrypt(state.password)) {
+    return "Password must be 72 UTF-8 bytes or fewer.";
+  }
   if (state.password !== state.confirmPassword) {
     return "Passwords must match.";
   }
@@ -186,7 +190,7 @@ async function onSubmit() {
     const statusCode = typeof error === "object" && error !== null && "statusCode" in error ? Number(error.statusCode) : null;
     const serverMessage = readFetchErrorMessage(error);
     if (statusCode === 400) {
-      errorMessage.value = serverMessage || "Please check your email and password (min 8 characters).";
+      errorMessage.value = serverMessage || "Please check your email and password (8 characters minimum; 72 UTF-8 bytes maximum).";
     } else if (statusCode === 403) {
       errorMessage.value = serverMessage || "Registration is restricted for this instance.";
     } else if (statusCode === 401) {

package/dist/runtime/password-policy.d.ts

@@ -0,0 +1,2 @@
+export declare const MAX_BCRYPT_PASSWORD_BYTES = 72;
+export declare function newPasswordFitsBcrypt(password: string): boolean;

package/dist/runtime/password-policy.js

@@ -0,0 +1,4 @@
+export const MAX_BCRYPT_PASSWORD_BYTES = 72;
+export function newPasswordFitsBcrypt(password) {
+  return new TextEncoder().encode(password).length <= MAX_BCRYPT_PASSWORD_BYTES;
+}

package/dist/runtime/server/api/basic-auth/_helpers.js

@@ -18,6 +18,9 @@ export async function parseBodyWithSchema(event, schema) {
     const firstIssue = result.error.issues[0];
     const path = firstIssue?.path?.join(".") || "input";
     const detail = firstIssue?.message || "Invalid request";
+    if (detail === "Password must be 72 UTF-8 bytes or fewer.") {
+      throw createError({ statusCode: 400, statusMessage: detail });
+    }
     if (path === "password" || path === "confirmPassword") {
       throw createError({
         statusCode: 400,

package/dist/runtime/server/api/basic-auth/change-password.post.js

@@ -11,11 +11,16 @@ import {
 import { enforceMutationOriginPolicy } from "../../lib/request-security.js";
 import { basicAuthProvider } from "../../auth/basic-auth-provider.js";
 import { assertBasicAuthReady, noStore, parseBodyWithSchema } from "./_helpers.js";
+import { newPasswordFitsBcrypt } from "../../../password-policy.js";
 const changePasswordSchema = z.object({
   // Existing accounts may have legacy short passwords; only new password is length-enforced.
   currentPassword: z.string().min(1).max(512),
-  newPassword: z.string().min(8).max(512),
-  confirmNewPassword: z.string().min(8).max(512)
+  newPassword: z.string().min(8).max(512).refine(newPasswordFitsBcrypt, {
+    message: "Password must be 72 UTF-8 bytes or fewer."
+  }),
+  confirmNewPassword: z.string().min(8).max(512).refine(newPasswordFitsBcrypt, {
+    message: "Password must be 72 UTF-8 bytes or fewer."
+  })
 }).refine((input) => input.newPassword === input.confirmNewPassword, {
   message: "Passwords must match"
 });

package/dist/runtime/server/api/basic-auth/register.post.js

@@ -23,11 +23,16 @@ import {
   getSessionMetadataFromEvent
 } from "../../lib/session-store.js";
 import { enforceMutationOriginPolicy } from "../../lib/request-security.js";
+import { newPasswordFitsBcrypt } from "../../../password-policy.js";
 import { assertBasicAuthReady, noStore, parseBodyWithSchema } from "./_helpers.js";
 const registerSchema = z.object({
   email: z.string().email().max(320),
-  password: z.string().min(8).max(512),
-  confirmPassword: z.string().min(8).max(512),
+  password: z.string().min(8).max(512).refine(newPasswordFitsBcrypt, {
+    message: "Password must be 72 UTF-8 bytes or fewer."
+  }),
+  confirmPassword: z.string().min(8).max(512).refine(newPasswordFitsBcrypt, {
+    message: "Password must be 72 UTF-8 bytes or fewer."
+  }),
   displayName: z.string().trim().min(1).max(120).optional(),
   inviteToken: z.string().trim().min(1).max(4096).optional()
 }).refine((value) => value.password === value.confirmPassword, {

package/dist/runtime/server/api/basic-auth/sign-out.post.js

@@ -1,4 +1,5 @@
 import { defineEventHandler } from "h3";
+import { revokeHostActivationsForUser } from "~~/server/utils/plugins/isolation/activation-registry";
 import { clearAuthCookies } from "../../lib/cookies.js";
 import {
   getAccessTokenFromEvent,
@@ -7,26 +8,60 @@ import {
   verifyRefreshToken
 } from "../../lib/jwt.js";
 import { enforceBasicAuthRateLimit } from "../../lib/rate-limit.js";
-import { revokeSessionById } from "../../lib/session-store.js";
+import {
+  findAccountById,
+  findUsableSessionInChain,
+  revokeSessionChain
+} from "../../lib/session-store.js";
 import { enforceMutationOriginPolicy } from "../../lib/request-security.js";
 import { assertBasicAuthReady, noStore } from "./_helpers.js";
+async function resolveSignOutUserId(event) {
+  const accessToken = getAccessTokenFromEvent(event);
+  if (accessToken) {
+    const claims = await verifyAccessToken(accessToken);
+    if (claims && findUsableSessionInChain(claims.sid)) {
+      const account = findAccountById(claims.sub);
+      if (account && account.token_version === claims.ver) {
+        return account.id;
+      }
+    }
+  }
+  const refreshToken = getRefreshTokenFromEvent(event);
+  if (refreshToken) {
+    const claims = await verifyRefreshToken(refreshToken);
+    if (claims && findUsableSessionInChain(claims.sid)) {
+      const account = findAccountById(claims.sub);
+      if (account && account.token_version === claims.ver) {
+        return account.id;
+      }
+    }
+  }
+  return null;
+}
 export async function handleSignOut(event) {
   assertBasicAuthReady(event);
   noStore(event);
   enforceMutationOriginPolicy(event);
   enforceBasicAuthRateLimit(event, "basic-auth:sign-out");
+  try {
+    const userId = await resolveSignOutUserId(event);
+    if (userId) {
+      revokeHostActivationsForUser(userId, "logout");
+    }
+  } catch {
+  }
   const refreshToken = getRefreshTokenFromEvent(event);
   if (refreshToken) {
     const refreshClaims = await verifyRefreshToken(refreshToken);
     if (refreshClaims) {
-      revokeSessionById(refreshClaims.sid);
+      revokeSessionChain(refreshClaims.sid);
     }
   }
   const accessToken = getAccessTokenFromEvent(event);
   if (accessToken) {
     const accessClaims = await verifyAccessToken(accessToken);
     if (accessClaims) {
-      revokeSessionById(accessClaims.sid);
+      revokeSessionChain(accessClaims.sid);
     }
   }
   clearAuthCookies(event);

package/dist/runtime/server/lib/cookies.d.ts

@@ -1,4 +1,6 @@
 import { type H3Event } from 'h3';
+export declare function accessCookieName(): string;
+export declare function refreshCookieName(): string;
 export declare function setAccessCookie(event: H3Event, token: string, maxAgeSeconds: number): void;
 export declare function setRefreshCookie(event: H3Event, token: string, maxAgeSeconds: number): void;
 export declare function clearAuthCookies(event: H3Event): void;

package/dist/runtime/server/lib/cookies.js

@@ -9,6 +9,14 @@ import {
 function isProduction() {
   return process.env.NODE_ENV === "production";
 }
+export function accessCookieName() {
+  const scope = process.env.OR3_PLUGIN_DEV_COOKIE_SCOPE;
+  return scope ? `${ACCESS_COOKIE_NAME}_${scope}` : ACCESS_COOKIE_NAME;
+}
+export function refreshCookieName() {
+  const scope = process.env.OR3_PLUGIN_DEV_COOKIE_SCOPE;
+  return scope ? `${REFRESH_COOKIE_NAME}_${scope}` : REFRESH_COOKIE_NAME;
+}
 function refreshCookieBase() {
   return {
     httpOnly: true,
@@ -17,7 +25,7 @@ function refreshCookieBase() {
   };
 }
 export function setAccessCookie(event, token, maxAgeSeconds) {
-  setCookie(event, ACCESS_COOKIE_NAME, token, {
+  setCookie(event, accessCookieName(), token, {
     httpOnly: true,
     sameSite: "lax",
     secure: isProduction(),
@@ -26,28 +34,28 @@ export function setAccessCookie(event, token, maxAgeSeconds) {
   });
 }
 export function setRefreshCookie(event, token, maxAgeSeconds) {
-  deleteCookie(event, REFRESH_COOKIE_NAME, {
+  deleteCookie(event, refreshCookieName(), {
     ...refreshCookieBase(),
     path: LEGACY_REFRESH_COOKIE_PATH
   });
-  setCookie(event, REFRESH_COOKIE_NAME, token, {
+  setCookie(event, refreshCookieName(), token, {
     ...refreshCookieBase(),
     path: REFRESH_COOKIE_PATH,
     maxAge: maxAgeSeconds
   });
 }
 export function clearAuthCookies(event) {
-  deleteCookie(event, ACCESS_COOKIE_NAME, {
+  deleteCookie(event, accessCookieName(), {
     httpOnly: true,
     sameSite: "lax",
     secure: isProduction(),
     path: ACCESS_COOKIE_PATH
   });
-  deleteCookie(event, REFRESH_COOKIE_NAME, {
+  deleteCookie(event, refreshCookieName(), {
     ...refreshCookieBase(),
     path: REFRESH_COOKIE_PATH
   });
-  deleteCookie(event, REFRESH_COOKIE_NAME, {
+  deleteCookie(event, refreshCookieName(), {
     ...refreshCookieBase(),
     path: LEGACY_REFRESH_COOKIE_PATH
   });

package/dist/runtime/server/lib/jwt.js

@@ -1,7 +1,7 @@
 import { randomUUID, createHash } from "node:crypto";
 import { getCookie } from "h3";
 import jwt from "jsonwebtoken";
-import { ACCESS_COOKIE_NAME, REFRESH_COOKIE_NAME } from "../../lib/constants.js";
+import { accessCookieName, refreshCookieName } from "./cookies.js";
 import { getBasicAuthConfig } from "./config.js";
 export async function signAccessToken(input) {
   const config = getBasicAuthConfig();
@@ -67,10 +67,10 @@ export async function verifyRefreshToken(token) {
   }
 }
 export function getAccessTokenFromEvent(event) {
-  return getCookie(event, ACCESS_COOKIE_NAME) ?? null;
+  return getCookie(event, accessCookieName()) ?? null;
 }
 export function getRefreshTokenFromEvent(event) {
-  return getCookie(event, REFRESH_COOKIE_NAME) ?? null;
+  return getCookie(event, refreshCookieName()) ?? null;
 }
 export function hashRefreshToken(token) {
   return createHash("sha256").update(token).digest("hex");

package/dist/runtime/server/lib/password.js

@@ -1,6 +1,10 @@
 import bcrypt from "bcryptjs";
+import { newPasswordFitsBcrypt } from "../../password-policy.js";
 const PASSWORD_COST = 12;
 export async function hashPassword(password) {
+  if (!newPasswordFitsBcrypt(password)) {
+    throw new RangeError("New passwords must be 72 UTF-8 bytes or fewer.");
+  }
   return await bcrypt.hash(password, PASSWORD_COST);
 }
 export async function verifyPassword(password, hash) {

package/dist/runtime/server/lib/session-store.d.ts

@@ -61,6 +61,14 @@ export declare function ensureBootstrapAccount(input: CreateAccountInput): Basic
 export declare function createAuthSession(input: CreateSessionInput): BasicAuthSession;
 export declare function findSessionById(sessionId: string): BasicAuthSession | null;
 export declare function revokeSessionById(sessionId: string, revokedAtMs?: number): void;
+/**
+ * Revoke a session and every successor it was rotated into, clearing rotation
+ * grace on each. A replayed rotated refresh token therefore cannot recover its
+ * successor after sign-out.
+ */
+export declare function revokeSessionChain(sessionId: string, revokedAtMs?: number): void;
+/** First usable session walking from `sessionId` through rotation successors. */
+export declare function findUsableSessionInChain(sessionId: string): BasicAuthSession | null;
 export declare function revokeAllSessionsForAccount(accountId: string, revokedAtMs?: number): void;
 export declare function rotateSession(input: RotationInput): RotationResult;
 export declare function updatePasswordAndRevokeSessions(accountId: string, newPasswordHash: string): void;

package/dist/runtime/server/lib/session-store.js

@@ -140,6 +140,36 @@ export function revokeSessionById(sessionId, revokedAtMs = Date.now()) {
     "UPDATE basic_auth_sessions SET revoked_at = COALESCE(revoked_at, ?) WHERE id = ?"
   ).run(revokedAtMs, sessionId);
 }
+export function revokeSessionChain(sessionId, revokedAtMs = Date.now()) {
+  const db = getBasicAuthDb();
+  db.transaction(() => {
+    const visited = /* @__PURE__ */ new Set();
+    let currentId = sessionId;
+    while (currentId && !visited.has(currentId)) {
+      visited.add(currentId);
+      const session = findSessionById(currentId);
+      if (!session) break;
+      db.prepare(
+        `UPDATE basic_auth_sessions
+         SET revoked_at = COALESCE(revoked_at, ?),
+             rotation_grace_until = NULL,
+             rotation_grace_refresh_token = NULL
+         WHERE id = ?`
+      ).run(revokedAtMs, currentId);
+      currentId = session.replaced_by_session_id;
+    }
+  })();
+}
+export function findUsableSessionInChain(sessionId) {
+  const visited = /* @__PURE__ */ new Set();
+  let current = findSessionById(sessionId);
+  while (current && !visited.has(current.id)) {
+    if (isSessionUsable(current)) return current;
+    visited.add(current.id);
+    current = current.replaced_by_session_id ? findSessionById(current.replaced_by_session_id) : null;
+  }
+  return null;
+}
 export function revokeAllSessionsForAccount(accountId, revokedAtMs = Date.now()) {
   const db = getBasicAuthDb();
   db.prepare(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "or3-provider-basic-auth",
-  "version": "0.0.9",
+  "version": "0.0.10",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Saluana/or3-provider-basic-auth.git"