Skip to content

@eventuras/fides-auth-next@0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Jun 22:36
· 14 commits to main since this release
Immutable release. Only release title and notes can be modified.
@eventuras/fides-auth-next@0.4.0
968b59b

Minor Changes

  • 2468c15: Add a size guard for auth cookies. setAuthCookie now measures the cookie's
    name + value and throws a new exported CookieTooLargeError at or above the
    browser's 4096-byte per-cookie limit, instead of letting the browser silently
    drop the cookie (which manifested as a broken login). An informational log is
    emitted at 3500 bytes for visibility before the hard limit.

  • 3c72759: Split the session across two cookies to make room for large access tokens.

    The access token — typically the largest part of a session — now lives in its
    own session_at cookie, while the rest stays in session, so each gets a full
    per-cookie byte budget instead of competing for one ~4KB limit.

    The framework-agnostic encode/decode logic lives in the core package as a new
    @eventuras/fides-auth/session-cookies export (encodeSessionCookies /
    decodeSessionCookies), plus a decryptJWT helper in @eventuras/fides-auth/utils.
    @eventuras/fides-auth-next is a thin adapter that wires these to the Next.js
    cookie store. Legacy single-cookie sessions are still read transparently, and the
    "expired access token means no session" contract is preserved.

Patch Changes

  • f8c2ee3: Move the framework-agnostic cookie attributes, size limits, and size guard into
    the core package.

    The new @eventuras/fides-auth/cookies export holds CookieOptions,
    defaultSessionCookieOptions, defaultOAuthCookieOptions,
    ACCESS_TOKEN_COOKIE_NAME, the COOKIE_MAX_BYTES/COOKIE_INFO_BYTES limits,
    the CookieTooLargeError class, and pure cookieByteSize /
    assertCookieWithinLimit helpers — none of which need a framework. This makes
    them reusable by future adapters (e.g. React Router) instead of living only in
    the Next.js binding.

    @eventuras/fides-auth-next now re-exports these from the core package and keeps
    only the actual cookie I/O (via next/headers). Its public API is unchanged.

  • 01a31d1: Move the React hooks (createAuthStoreHooks, useSessionMonitor, useHeartbeat) into a new @eventuras/fides-auth-react package. fides-auth-next re-exports them, so its public API is unchanged.

  • 7453d3f: Move the framework-agnostic authentication store into a new
    @eventuras/fides-auth-store package.

    The XState-Store-based auth state (createAuthStore, initializeAuth,
    checkAuth, startSessionMonitor, configureAuthLogger, and the SessionUser
    / AuthStatus / AuthStoreContext / AuthStoreConfig / SessionMonitorConfig
    types) has no dependency on Next.js or React — the application supplies a
    checkAuthStatus callback and the store never touches cookies or a server. It
    now lives in its own package so other adapters (e.g. React Router) and plain
    JavaScript can use it directly.

    @eventuras/fides-auth-next re-exports the store from the new package, so
    @eventuras/fides-auth-next/store imports keep working unchanged. The React
    hooks (createAuthStoreHooks, useSessionMonitor, useHeartbeat) stay in this
    package for now.

  • 019f8a0: Add a framework-agnostic createHeartbeat() engine at @eventuras/fides-auth/heartbeat. fides-auth-next's useHeartbeat is now a thin wrapper over it; behaviour and API unchanged.

  • dcf1b7d: Add a framework-agnostic CookieStore interface and session persistence helpers (persistSession, readSession, refreshSessionInStore, clearSession) at @eventuras/fides-auth/server. fides-auth-next's session functions now delegate to them through a Next cookie-store adapter; public API unchanged.

  • 50f6882: Move the OIDC request handlers — handleOidcLogin, handleOidcCallback, handleHeartbeat — into @eventuras/fides-auth/server, taking a CookieStore and an optional rate-limit callback over the standard Request/Response. fides-auth-next now wraps them with its Next cookie store and rate limiters; public API unchanged.

  • 39f2cbd: Standardize MIT licensing across the workspace.

    Every package now carries a LICENSE file with a consistent
    Copyright (c) 2024 Losol AS notice, and @eventuras/fides-auth-next gains the
    license / author metadata it was missing and ships its LICENSE in the
    published tarball. @eventuras/fides-auth's existing license notice is updated
    to the same copyright holder.

  • Updated dependencies [f8c2ee3]

  • Updated dependencies [019f8a0]

  • Updated dependencies [dcf1b7d]

  • Updated dependencies [50f6882]

  • Updated dependencies [3c72759]

  • Updated dependencies [39f2cbd]

    • @eventuras/fides-auth@0.10.0
    • @eventuras/fides-auth-react@0.1.1
    • @eventuras/fides-auth-store@0.1.1
Assets 3
Loading