Skip to content

v0.15.0 — Headless Cookie-Backed Auth Client, RSC Core Purity & Concurrency Hardening

Choose a tag to compare

View all tags
@umesh0492 umesh0492 released this 17 Sep 18:37
· 16 commits to main since this release
v0.15.0
f399e30
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's New in v0.15.0

🆕 Headless Cookie-Backed Auth Client (@abeta.dev/auth@0.3.0)

A fully headless, framework-agnostic auth engine shipped under three clean entry points:

Entry Point Purpose
@abeta.dev/auth/core Server-safe headless engine — no React, no directives
@abeta.dev/auth/react React hooks (useAuthClient, AuthClientProvider)
@abeta.dev/auth Full bundle (components + hooks + core)

AuthClient

  • Epoch-guarded session invalidation — cross-tab coordination via invalidateFromAnotherTab() with monotonic epoch comparison; stale epochs silently discarded
  • Single-flight refresh mutex — concurrent getAccessToken() calls coalesce onto a single in-flight refreshPromise; no double-refresh thundering herd
  • Fail-closed on reauth_required — adapter errors propagate cleanly; no silent token resurrection
  • begin() lifecycle hook — caller-owned session start, safe to call from Server Actions or middleware

createAuthenticatedFetch

  • Origin enforcement — rejects cross-origin requests at call-site; no accidental credential leakage
  • Bearer injection — auto-attaches Authorization: Bearer <token> header
  • redirect: 'error' — prevents silent redirect-based auth bypasses
  • Guarded single-retry on 401 — one retry attempt per request, fail-closed thereafter

React Integration

  • AuthClientProvider — caller-owned lifecycle, StrictMode-safe (no double-init side effects)
  • useAuthClient — powered by useSyncExternalStore for tear-free concurrent rendering (React 18/19 compatible)

🛡️ RSC Core Purity

  • @abeta.dev/auth/core ships without any 'use client' directive — safe for React Server Components and Node.js middleware
  • Separate tsup configs enforce the boundary: tsup.config.ts (client bundle) vs tsup.core.config.ts (RSC-safe core)

📦 Root Package Update

  • @abeta.dev/react-libs@0.15.0 pins and re-exports @abeta.dev/auth@0.3.0 contracts
  • peerDependenciesMeta: react and react-dom marked optional — headless consumers (Node.js, Deno, Edge) do not need React installed

Performance

  • P95 render time: 264.2ms (gate: 300ms) ✅
  • 1,421 tests passing ✅
  • Bundle size within limits ✅
  • Zero type errors, zero lint warnings ✅

Migration

See MIGRATION.md for upgrade instructions from v0.14.x.

// Before (v0.14.x)
import { ... } from '@abeta.dev/auth';

// After (v0.15.0) — pick the right entry point
import { AuthClient } from '@abeta.dev/auth/core';        // RSC / Node.js
import { useAuthClient } from '@abeta.dev/auth/react';    // React hooks
import { LoginForm } from '@abeta.dev/auth';               // Full bundle
Assets 2
Loading