From a7b7802422408aec2511b2d65a2ecfb69e16675b Mon Sep 17 00:00:00 2001
From: Marsel Shaikhin <phoenix.apps@yahoo.com>
Date: Thu, 5 Sep 2024 18:36:55 +0200
Subject: [PATCH 1/4] enh: provide a demo implementation of refresh provider

---
 playground-local/app.vue                      |  4 +-
 playground-local/config/AuthRefreshHandler.ts | 17 ++++
 playground-local/nuxt.config.ts               | 14 +++-
 .../server/api/auth/login.post.ts             | 80 ++++++++++++++++---
 .../server/api/auth/refresh.post.ts           | 76 ++++++++++++++++++
 playground-local/server/api/auth/user.get.ts  | 47 ++++++-----
 6 files changed, 207 insertions(+), 31 deletions(-)
 create mode 100644 playground-local/config/AuthRefreshHandler.ts
 create mode 100644 playground-local/server/api/auth/refresh.post.ts

diff --git a/playground-local/app.vue b/playground-local/app.vue
index 6ccd27884..1f770a6f5 100644
--- a/playground-local/app.vue
+++ b/playground-local/app.vue
@@ -4,8 +4,8 @@ import { useAuth } from '#imports'
 
 const { signIn, token, refreshToken, data, status, lastRefreshedAt, signOut, getSession } = useAuth()
 
-const username = ref('')
-const password = ref('')
+const username = ref('smith')
+const password = ref('hunter2')
 </script>
 
 <template>
diff --git a/playground-local/config/AuthRefreshHandler.ts b/playground-local/config/AuthRefreshHandler.ts
new file mode 100644
index 000000000..fba813faf
--- /dev/null
+++ b/playground-local/config/AuthRefreshHandler.ts
@@ -0,0 +1,17 @@
+import type { RefreshHandler } from '../../'
+
+// You may also use a plain object with `satisfies RefreshHandler`, of course!
+class CustomRefreshHandler implements RefreshHandler {
+  init (): void {
+    console.info('Use the full power of classes to customize refreshHandler!')
+  }
+
+  destroy (): void {
+    console.info(
+      'Hover above class properties or go to their definition ' +
+      'to learn more about how to craft a refreshHandler'
+    )
+  }
+}
+
+export default new CustomRefreshHandler()
diff --git a/playground-local/nuxt.config.ts b/playground-local/nuxt.config.ts
index 3dabe1992..4f6e5c5e7 100644
--- a/playground-local/nuxt.config.ts
+++ b/playground-local/nuxt.config.ts
@@ -19,13 +19,25 @@ export default defineNuxtConfig({
       session: {
         dataType: { id: 'string', email: 'string', name: 'string', role: '\'admin\' | \'guest\' | \'account\'', subscriptions: '{ id: number, status: \'ACTIVE\' | \'INACTIVE\' }[]' },
         dataResponsePointer: '/'
+      },
+      refresh: {
+        // This is usually a static configuration `true` or `false`.
+        // We do an environment variable for E2E testing both options.
+        isEnabled: process.env.NUXT_AUTH_REFRESH_ENABLED !== 'false',
+        endpoint: { path: '/refresh', method: 'post' },
+        token: {
+          signInResponseRefreshTokenPointer: '/token/refreshToken',
+          refreshRequestTokenPointer: '/refreshToken'
+        },
       }
     },
     sessionRefresh: {
       // Whether to refresh the session every time the browser window is refocused.
       enableOnWindowFocus: true,
       // Whether to refresh the session every `X` milliseconds. Set this to `false` to turn it off. The session will only be refreshed if a session already exists.
-      enablePeriodically: 5000
+      enablePeriodically: 5000,
+      // Custom refresh handler - uncomment to use
+      // handler: './config/AuthRefreshHandler'
     },
     globalAppMiddleware: {
       isEnabled: true
diff --git a/playground-local/server/api/auth/login.post.ts b/playground-local/server/api/auth/login.post.ts
index 54cb55fd1..c03fabe6e 100644
--- a/playground-local/server/api/auth/login.post.ts
+++ b/playground-local/server/api/auth/login.post.ts
@@ -2,17 +2,61 @@ import { createError, eventHandler, readBody } from 'h3'
 import { z } from 'zod'
 import { sign } from 'jsonwebtoken'
 
-const refreshTokens: Record<number, Record<string, any>> = {}
+/*
+ * DISCLAIMER!
+ * This is a demo implementation, please create your own handlers
+ */
+
+/**
+ * This is a demo secret.
+ * Please ensure that your secret is properly protected.
+ */
 export const SECRET = 'dummy'
 
+/** 30 seconds */
+export const ACCESS_TOKEN_TTL = 30
+
+export interface User {
+  username: string
+  name: string
+  picture: string
+}
+
+export interface JwtPayload extends User {
+  scope: Array<'test' | 'user'>
+  exp?: number
+}
+
+interface TokensByUser {
+  access: Map<string, string>
+  refresh: Map<string, string>
+}
+
+/**
+ * Tokens storage.
+ * You will need to implement your own, connect with DB/etc.
+ */
+export const tokensByUser: Map<string, TokensByUser> = new Map()
+
+/**
+ * We use a fixed password for demo purposes.
+ * You can use any implementation fitting your usecase.
+ */
+const credentialsSchema = z.object({
+  username: z.string().min(1),
+  password: z.literal('hunter2')
+})
+
 export default eventHandler(async (event) => {
-  const result = z.object({ username: z.string().min(1), password: z.literal('hunter2') }).safeParse(await readBody(event))
+  const result = credentialsSchema.safeParse(await readBody(event))
   if (!result.success) {
-    throw createError({ statusCode: 403, statusMessage: 'Unauthorized, hint: try `hunter2` as password' })
+    throw createError({
+      statusCode: 403,
+      statusMessage: 'Unauthorized, hint: try `hunter2` as password'
+    })
   }
 
-  const expiresIn = 15
-  const refreshToken = Math.floor(Math.random() * (1000000000000000 - 1 + 1)) + 1
+  // Emulate login
   const { username } = result.data
   const user = {
     username,
@@ -20,11 +64,23 @@ export default eventHandler(async (event) => {
     name: `User ${username}`
   }
 
-  const accessToken = sign({ ...user, scope: ['test', 'user'] }, SECRET, { expiresIn })
-  refreshTokens[refreshToken] = {
-    accessToken,
-    user
+  const tokenData: JwtPayload = { ...user, scope: ['test', 'user'] }
+  const accessToken = sign(tokenData, SECRET, {
+    expiresIn: ACCESS_TOKEN_TTL
+  })
+  const refreshToken = sign(tokenData, SECRET, {
+    // 1 day
+    expiresIn: 60 * 60 * 24
+  })
+
+  // Naive implementation - please implement properly yourself!
+  const userTokens: TokensByUser = tokensByUser.get(username) ?? {
+    access: new Map(),
+    refresh: new Map()
   }
+  userTokens.access.set(accessToken, refreshToken)
+  userTokens.refresh.set(refreshToken, accessToken)
+  tokensByUser.set(username, userTokens)
 
   return {
     token: {
@@ -33,3 +89,9 @@ export default eventHandler(async (event) => {
     }
   }
 })
+
+export function extractToken(authorizationHeader: string) {
+  return authorizationHeader.startsWith('Bearer ')
+    ? authorizationHeader.slice(7)
+    : authorizationHeader
+}
diff --git a/playground-local/server/api/auth/refresh.post.ts b/playground-local/server/api/auth/refresh.post.ts
new file mode 100644
index 000000000..456402635
--- /dev/null
+++ b/playground-local/server/api/auth/refresh.post.ts
@@ -0,0 +1,76 @@
+import { createError, eventHandler, getRequestHeader, readBody } from 'h3'
+import { sign, verify } from 'jsonwebtoken'
+import { type JwtPayload, SECRET, type User, extractToken, tokensByUser } from './login.post'
+
+/*
+ * DISCLAIMER!
+ * This is a demo implementation, please create your own handlers
+ */
+
+export default eventHandler(async (event) => {
+  const body = await readBody<{ refreshToken: string }>(event)
+  const authorizationHeader = getRequestHeader(event, 'Authorization')
+  const refreshToken = body.refreshToken
+
+  if (!refreshToken || !authorizationHeader) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Unauthorized, no refreshToken or no Authorization header'
+    })
+  }
+
+  // Verify
+  const decoded = verify(refreshToken, SECRET) as JwtPayload | undefined
+  if (!decoded) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Unauthorized, refreshToken can\'t be verified'
+    })
+  }
+
+  // Get tokens
+  const userTokens = tokensByUser.get(decoded.username)
+  if (!userTokens) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Unauthorized, user is not logged in'
+    })
+  }
+
+  // Check against known token
+  const requestAccessToken = extractToken(authorizationHeader)
+  const knownAccessToken = userTokens.refresh.get(body.refreshToken)
+  if (!knownAccessToken || knownAccessToken !== requestAccessToken) {
+    console.log({
+      msg: 'Tokens mismatch',
+      knownAccessToken,
+      requestAccessToken
+    })
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Tokens mismatch - this is not good'
+    })
+  }
+
+  // Invalidate old access token
+  userTokens.access.delete(knownAccessToken)
+
+  const user: User = {
+    username: decoded.username,
+    picture: decoded.picture,
+    name: decoded.name
+  }
+
+  const accessToken = sign({ ...user, scope: ['test', 'user'] }, SECRET, {
+    expiresIn: 60 * 5 // 5 minutes
+  })
+  userTokens.refresh.set(refreshToken, accessToken)
+  userTokens.access.set(accessToken, refreshToken)
+
+  return {
+    token: {
+      accessToken,
+      refreshToken
+    }
+  }
+})
diff --git a/playground-local/server/api/auth/user.get.ts b/playground-local/server/api/auth/user.get.ts
index d64aa12fe..d2dde1bf2 100644
--- a/playground-local/server/api/auth/user.get.ts
+++ b/playground-local/server/api/auth/user.get.ts
@@ -1,32 +1,41 @@
-import type { H3Event } from 'h3'
 import { createError, eventHandler, getRequestHeader } from 'h3'
 import { verify } from 'jsonwebtoken'
-import { SECRET } from './login.post'
+import { type JwtPayload, SECRET, extractToken, tokensByUser } from './login.post'
 
-const TOKEN_TYPE = 'Bearer'
-
-function extractToken(authHeaderValue: string) {
-  const [, token] = authHeaderValue.split(`${TOKEN_TYPE} `)
-  return token
-}
-
-function ensureAuth(event: H3Event) {
-  const authHeaderValue = getRequestHeader(event, 'authorization')
-  if (typeof authHeaderValue === 'undefined') {
+export default eventHandler((event) => {
+  const authorizationHeader = getRequestHeader(event, 'Authorization')
+  if (typeof authorizationHeader === 'undefined') {
     throw createError({ statusCode: 403, statusMessage: 'Need to pass valid Bearer-authorization header to access this endpoint' })
   }
 
-  const extractedToken = extractToken(authHeaderValue)
+  const extractedToken = extractToken(authorizationHeader)
+  let decoded: JwtPayload
   try {
-    return verify(extractedToken, SECRET)
+    decoded = verify(extractedToken, SECRET) as JwtPayload
   }
   catch (error) {
-    console.error('Login failed. Here\'s the raw error:', error)
+    console.error({
+      msg: 'Login failed. Here\'s the raw error:',
+      error
+    })
     throw createError({ statusCode: 403, statusMessage: 'You must be logged in to use this endpoint' })
   }
-}
 
-export default eventHandler((event) => {
-  const user = ensureAuth(event)
-  return user
+  // Check against known token
+  const userTokens = tokensByUser.get(decoded.username)
+  if (!userTokens || !userTokens.access.has(extractedToken)) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Unauthorized, user is not logged in'
+    })
+  }
+
+  // All checks successful
+  const { username, name, picture, scope } = decoded
+  return {
+    username,
+    name,
+    picture,
+    scope
+  }
 })

From 5c07aeb5a08baabd5ca29d98f6d2591875559543 Mon Sep 17 00:00:00 2001
From: Marsel Shaikhin <phoenix.apps@yahoo.com>
Date: Thu, 5 Sep 2024 18:49:01 +0200
Subject: [PATCH 2/4] chore: fix lint

---
 playground-local/config/AuthRefreshHandler.ts | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/playground-local/config/AuthRefreshHandler.ts b/playground-local/config/AuthRefreshHandler.ts
index fba813faf..037cf687e 100644
--- a/playground-local/config/AuthRefreshHandler.ts
+++ b/playground-local/config/AuthRefreshHandler.ts
@@ -2,14 +2,14 @@ import type { RefreshHandler } from '../../'
 
 // You may also use a plain object with `satisfies RefreshHandler`, of course!
 class CustomRefreshHandler implements RefreshHandler {
-  init (): void {
+  init(): void {
     console.info('Use the full power of classes to customize refreshHandler!')
   }
 
-  destroy (): void {
+  destroy(): void {
     console.info(
-      'Hover above class properties or go to their definition ' +
-      'to learn more about how to craft a refreshHandler'
+      'Hover above class properties or go to their definition '
+      + 'to learn more about how to craft a refreshHandler'
     )
   }
 }

From 49d34f9db2a57d9bff9f2cb36a6c9ee9c42bd3ad Mon Sep 17 00:00:00 2001
From: Marsel Shaikhin <phoenix.apps@yahoo.com>
Date: Thu, 5 Sep 2024 18:51:20 +0200
Subject: [PATCH 3/4] chore: adjust CI to test with refresh disabled

---
 .github/workflows/ci.yaml | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index d0dd99041..b3ac99c7d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -26,7 +26,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VER }}
-          cache: 'pnpm'
+          cache: "pnpm"
 
       - name: Install deps and prepare types
         run: pnpm i && pnpm dev:prepare
@@ -56,7 +56,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VER }}
-          cache: 'pnpm'
+          cache: "pnpm"
 
       - name: Install deps and prepare types
         run: pnpm i && pnpm dev:prepare
@@ -82,7 +82,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VER }}
-          cache: 'pnpm'
+          cache: "pnpm"
 
       - name: Install deps
         run: pnpm i
@@ -93,6 +93,13 @@ jobs:
       # Check building
       - run: pnpm build
 
+      # Test with refresh disabled
+      - name: Run Playwright tests using Vitest
+        run: pnpm test:e2e
+        env:
+          NUXT_AUTH_REFRESH_ENABLED: false
+
+      # Test with refresh enabled
       - name: Run Playwright tests using Vitest
         run: pnpm test:e2e
 
@@ -113,7 +120,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VER }}
-          cache: 'pnpm'
+          cache: "pnpm"
 
       - name: Install deps
         run: pnpm i

From 038b41528ca1d734df716b80c7a0ebc50bcab945 Mon Sep 17 00:00:00 2001
From: Marsel Shaikhin <phoenix.apps@yahoo.com>
Date: Thu, 5 Sep 2024 18:54:57 +0200
Subject: [PATCH 4/4] chore: change name of step in ci

---
 .github/workflows/ci.yaml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b3ac99c7d..026adb55f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -93,14 +93,12 @@ jobs:
       # Check building
       - run: pnpm build
 
-      # Test with refresh disabled
-      - name: Run Playwright tests using Vitest
+      - name: Run Playwright tests using Vitest with refresh disabled
         run: pnpm test:e2e
         env:
           NUXT_AUTH_REFRESH_ENABLED: false
 
-      # Test with refresh enabled
-      - name: Run Playwright tests using Vitest
+      - name: Run Playwright tests using Vitest with refresh enabled
         run: pnpm test:e2e
 
   test-playground-authjs: