Session model

import { createJwtSessionModule } from '@glinr/theauth/auth'; 

export const jwtSessions = createJwtSessionModule({
  secret: process.env.SESSION_SECRET!, // HS256 by default
  issuer: 'https://auth.example.com', 
  audience: 'https://app.example.com',
  accessTokenTtl: 900, // 15 minutes
  refreshTokenTtl: 604_800, // 7 days
  customClaims: (user) => ({ email: user.email }), 
}, theauth.db);

const result = await jwtSessions.createSession({
  id: user.id,
  email: user.email,
  name: user.name,
});

if (!result.success) {
  return Response.json({ error: result.error }, { status: 500 });
}

const { accessToken, refreshToken, expiresIn } = result.data; 
// Store refreshToken in an httpOnly cookie or secure storage
// Send accessToken to the client for use in Authorization headers

const authHeader = req.headers.get('authorization') ?? '';
const token = authHeader.replace('Bearer ', '');

const result = await jwtSessions.verifySession(token); 

if (!result.success) {
  return Response.json({ error: result.error }, { status: 401 });
}

const { userId, email, claims } = result.data; 

const result = await jwtSessions.refreshSession(refreshToken); 

if (!result.success) {
  // REFRESH_TOKEN_EXPIRED, REFRESH_TOKEN_USED, REFRESH_TOKEN_NOT_FOUND
  return Response.json({ error: result.error }, { status: 401 });
}

const { accessToken, refreshToken: newRefreshToken, expiresIn } = result.data;
// Return newRefreshToken to the client to replace the old one

import { createSessionFreshnessModule } from '@glinr/theauth'; 

export const freshness = createSessionFreshnessModule({
  freshAge: 300, // 5 minutes
});

import { sessions } from '@/lib/theauth';
import { freshness } from '@/lib/freshness';

export async function POST(req: Request): Promise<Response> {
  const cookieHeader = req.headers.get('cookie') ?? '';
  const { session } = await sessions.validateSession(cookieHeader);

  if (!session) {
    return Response.json({ error: 'Not authenticated' }, { status: 401 });
  }

  const staleResponse = freshness.guard(session); 
  if (staleResponse) return staleResponse; // 403 SESSION_NOT_FRESH if too old

  // Session is fresh, safe to proceed with the sensitive operation
  // ...
}

import { generateCsrfToken, parseCookies, validateCsrfToken, validateOrigin } from '@glinr/theauth'; 

// On page load or sign-in response, set a CSRF cookie
const csrfToken = generateCsrfToken(); 
// Return it in a Set-Cookie header: SameSite=Strict, NOT httpOnly
// Also send it in the response body so the client can store it

// On each mutating request (POST, PUT, DELETE, PATCH)
const headerToken = req.headers.get('x-csrf-token') ?? '';
const cookieToken = parseCookies(req.headers.get('cookie') ?? '')['theauth_csrf'] ?? '';

// Both validators return { valid: boolean; reason?: string }, not a boolean
const csrf = validateCsrfToken(headerToken, cookieToken); 
if (!csrf.valid) {
  return Response.json(
    { error: { code: 'CSRF_INVALID', message: 'CSRF token mismatch' } },
    { status: 403 },
  );
}

// Also validate the Origin header to defend against subdomain takeover
const origin = validateOrigin(req, ['https://app.example.com']); 
if (!origin.valid) {
  return Response.json(
    { error: { code: 'ORIGIN_MISMATCH', message: 'Request origin not allowed' } },
    { status: 403 },
  );
}

const { setCookieHeader } = await sessions.createSession(userId, {
  ipAddress: req.headers.get('x-forwarded-for') ?? 'unknown', 
  userAgent: req.headers.get('user-agent') ?? 'unknown', 
  appVersion: req.headers.get('x-app-version'), 
});

const { session } = await sessions.validateSession(cookieHeader);

if (session) {
  console.log(session.metadata?.userAgent, session.metadata?.ipAddress);
}