@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/esm/domain/refresh.js

@@ -0,0 +1,91 @@
+// src/domain/refresh.ts
+import { authError } from "../types/error";
+import { err, isErr } from "../types/result";
+import { safeAudit } from "./audit";
+import { verifyClientCredentials } from "./client-auth";
+import { mintTokens } from "./token";
+async function refreshTokens(req, deps) {
+  const peek = await deps.tokenStore.peekRefresh(req.refreshToken);
+  if (isErr(peek))
+    return err(peek.error);
+  const peekedPayload = peek.value;
+  const tenantCfg = await deps.configStore.getTenantConfig(peekedPayload.tenantId);
+  if (isErr(tenantCfg))
+    return err(tenantCfg.error);
+  const INVALID_REFRESH_DESC = "refresh token is invalid";
+  const client = tenantCfg.value.clients.find((c) => c.id === peekedPayload.clientId);
+  if (!client) {
+    return err(authError.invalidGrant(INVALID_REFRESH_DESC));
+  }
+  if (req.clientId !== undefined) {
+    const presenting = tenantCfg.value.clients.find((c) => c.id === req.clientId);
+    if (!presenting) {
+      return err(authError.invalidGrant(INVALID_REFRESH_DESC));
+    }
+    const authErr = await verifyClientCredentials(presenting, req.clientSecret);
+    if (authErr)
+      return err(authError.invalidGrant(INVALID_REFRESH_DESC));
+    if (req.clientId !== peekedPayload.clientId) {
+      return err(authError.invalidGrant(INVALID_REFRESH_DESC));
+    }
+  } else if (client.type === "confidential") {
+    return err(authError.invalidGrant(INVALID_REFRESH_DESC));
+  }
+  const consumed = await deps.tokenStore.consumeRefresh(req.refreshToken, {
+    reuseWindowMs: deps.reuseWindowMs
+  });
+  if (isErr(consumed)) {
+    if (consumed.error.code === "invalid_grant" && consumed.error.reuseSignal) {
+      const signal = consumed.error.reuseSignal;
+      await safeAudit(deps, {
+        kind: "refresh_reuse_detected",
+        tenantId: peekedPayload.tenantId,
+        clientId: peekedPayload.clientId,
+        family: signal.family,
+        timestamp: deps.clock()
+      });
+    }
+    return err(consumed.error);
+  }
+  const payload = consumed.value;
+  const requestedScopes = req.scope ? req.scope.split(" ").filter(Boolean) : payload.scopes;
+  for (const s of requestedScopes) {
+    if (!payload.scopes.includes(s)) {
+      return err(authError.invalidScope(`requested scope "${s}" not granted by original refresh token`));
+    }
+  }
+  const tenant = {
+    id: payload.tenantId,
+    config: tenantCfg.value,
+    request: { raw: new Request("about:blank"), custom: {} }
+  };
+  return mintTokens({
+    tenant,
+    claim: payload.claim,
+    payload: {
+      tenantId: payload.tenantId,
+      clientId: payload.clientId,
+      methodId: payload.methodId,
+      methodKind: payload.methodKind,
+      scopes: requestedScopes,
+      audience: payload.audience
+    },
+    family: payload.family,
+    deps
+  }).then(async (result) => {
+    if (result.ok) {
+      await safeAudit(deps, {
+        kind: "token_refreshed",
+        tenantId: payload.tenantId,
+        clientId: payload.clientId,
+        subjectId: payload.subjectId,
+        family: payload.family,
+        timestamp: deps.clock()
+      });
+    }
+    return result;
+  });
+}
+export {
+  refreshTokens
+};

package/dist/esm/domain/revoke.js

@@ -0,0 +1,81 @@
+// src/domain/revoke.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { safeAudit } from "./audit";
+import { verifyClientCredentials } from "./client-auth";
+async function revokeToken(req, deps) {
+  if (req.tokenTypeHint === "access_token") {
+    return ok(undefined);
+  }
+  const peek = await deps.tokenStore.peekRefresh(req.token);
+  if (isErr(peek)) {
+    return ok(undefined);
+  }
+  const payload = peek.value;
+  const tenantCfg = await deps.configStore.getTenantConfig(payload.tenantId);
+  if (isErr(tenantCfg)) {
+    return ok(undefined);
+  }
+  const client = tenantCfg.value.clients.find((c) => c.id === payload.clientId);
+  if (!client) {
+    return ok(undefined);
+  }
+  if (client.type === "confidential") {
+    if (!req.clientId || !req.clientSecret) {
+      return err(authError.invalidClient("confidential client must authenticate to revoke its tokens"));
+    }
+  }
+  if (req.clientId !== undefined && req.clientId !== payload.clientId) {
+    await safeAudit(deps, {
+      kind: "custom",
+      type: "revoke_wrong_client_attempt",
+      tenantId: payload.tenantId,
+      data: {
+        presentedClientId: req.clientId,
+        tokenClientId: payload.clientId,
+        subjectId: payload.subjectId
+      },
+      timestamp: deps.clock()
+    });
+    return ok(undefined);
+  }
+  if (req.clientId !== undefined) {
+    const authErr = await verifyClientCredentials(client, req.clientSecret);
+    if (authErr)
+      return err(authErr);
+  }
+  const consumed = await deps.tokenStore.consumeRefresh(req.token, {
+    reuseWindowMs: 0
+  });
+  if (isErr(consumed)) {
+    return ok(undefined);
+  }
+  await safeAudit(deps, {
+    kind: "token_revoked",
+    tenantId: payload.tenantId,
+    clientId: payload.clientId,
+    subjectId: payload.subjectId,
+    family: payload.family,
+    reason: "client_revoke",
+    timestamp: deps.clock()
+  });
+  return ok(undefined);
+}
+async function revokeAllForSubject(tenantId, subjectId, deps) {
+  const res = await deps.tokenStore.revokeBySubject(tenantId, subjectId);
+  if (isErr(res))
+    return err(res.error);
+  await safeAudit(deps, {
+    kind: "token_revoked",
+    tenantId,
+    clientId: null,
+    subjectId,
+    reason: "subject_revoke",
+    timestamp: deps.clock()
+  });
+  return ok(undefined);
+}
+export {
+  revokeToken,
+  revokeAllForSubject
+};

package/dist/esm/domain/state-envelope.js

@@ -0,0 +1,80 @@
+// src/domain/state-envelope.ts
+import { authError } from "../types/error";
+import { err, ok } from "../types/result";
+import { asTenantId } from "../types/tenant";
+import { base64url, hmacSign, hmacVerify, importHmacKey, utf8 } from "./crypto";
+function canonicalize(env) {
+  return JSON.stringify({
+    tenantId: env.tenantId,
+    flowId: env.flowId,
+    nonce: env.nonce,
+    kid: env.kid
+  });
+}
+async function mintStateEnvelope(envelope, keyRing) {
+  const active = keyRing.active;
+  const stamped = { ...envelope, kid: active.kid };
+  const payloadBytes = utf8.encode(canonicalize(stamped));
+  const key = await importHmacKey(active.key, ["sign"]);
+  const sig = await hmacSign(key, payloadBytes);
+  return `${base64url.encode(payloadBytes)}.${base64url.encode(sig)}`;
+}
+async function verifyStateEnvelope(state, keyRing) {
+  if (typeof state !== "string" || !state.includes(".")) {
+    return err(authError.unknownState("malformed state"));
+  }
+  const dotIdx = state.indexOf(".");
+  const headerB64u = state.slice(0, dotIdx);
+  const sigB64u = state.slice(dotIdx + 1);
+  if (!headerB64u || !sigB64u || sigB64u.includes(".")) {
+    return err(authError.unknownState("malformed state"));
+  }
+  let payloadBytes;
+  let sigBytes;
+  try {
+    payloadBytes = base64url.decode(headerB64u);
+    sigBytes = base64url.decode(sigB64u);
+  } catch {
+    return err(authError.unknownState("malformed state encoding"));
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(utf8.decode(payloadBytes));
+  } catch {
+    return err(authError.unknownState("malformed state payload"));
+  }
+  if (!isEnvelopeShape(parsed)) {
+    return err(authError.unknownState("state payload missing fields"));
+  }
+  const candidate = findKey(keyRing, parsed.kid);
+  if (!candidate) {
+    return err(authError.unknownState(`unknown state kid "${parsed.kid}"`));
+  }
+  const key = await importHmacKey(candidate.key, ["verify"]);
+  const okSig = await hmacVerify(key, sigBytes, payloadBytes);
+  if (!okSig) {
+    return err(authError.unknownState("state signature mismatch"));
+  }
+  if (parsed.kid !== candidate.kid) {
+    return err(authError.unknownState("state kid drift"));
+  }
+  return ok({
+    tenantId: asTenantId(parsed.tenantId),
+    flowId: parsed.flowId,
+    nonce: parsed.nonce,
+    kid: parsed.kid
+  });
+}
+function findKey(ring, kid) {
+  return ring.verify.find((k) => k.kid === kid);
+}
+function isEnvelopeShape(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const v = value;
+  return typeof v.tenantId === "string" && typeof v.flowId === "string" && typeof v.nonce === "string" && typeof v.kid === "string";
+}
+export {
+  verifyStateEnvelope,
+  mintStateEnvelope
+};

package/dist/esm/domain/token-exchange.js

@@ -0,0 +1,101 @@
+// src/domain/token-exchange.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { safeAudit } from "./audit";
+import { verifyClientCredentials } from "./client-auth";
+import { randomId } from "./crypto";
+import { verifyAccessToken } from "./jwt";
+import { mintTokens } from "./token";
+async function exchangeToken(req, deps) {
+  if (!deps.exchangeAudience) {
+    return err(authError.unsupportedGrantType("token-exchange is not configured on this IdP"));
+  }
+  const keysRes = await deps.keyStore.signingKeys();
+  if (isErr(keysRes))
+    return err(keysRes.error);
+  let subjectClaims;
+  try {
+    subjectClaims = await verifyAccessToken(req.subjectToken, keysRes.value, {
+      issuer: deps.issuerUrl
+    });
+  } catch (e) {
+    return err(authError.invalidGrant(`subject_token verification failed: ${e instanceof Error ? e.message : "unknown"}`));
+  }
+  if (!subjectClaims.claim) {
+    return err(authError.invalidGrant("subject_token does not carry a SubjectClaim — was it issued by this IdP?"));
+  }
+  const fromTenantId = subjectClaims.tid;
+  const fromTenantCfg = await deps.configStore.getTenantConfig(fromTenantId);
+  if (isErr(fromTenantCfg))
+    return err(fromTenantCfg.error);
+  const callerClientId = req.clientId ?? subjectClaims.aud;
+  const callerClient = fromTenantCfg.value.clients.find((c) => c.id === callerClientId);
+  if (!callerClient) {
+    return err(authError.invalidClient(`unknown client "${callerClientId}"`));
+  }
+  const authErr = await verifyClientCredentials(callerClient, req.clientSecret);
+  if (authErr)
+    return err(authErr);
+  const subjectScopes = (subjectClaims.scope ?? "").split(" ").filter((s) => s.length > 0);
+  const requestedScopes = req.scope ? req.scope.split(" ").filter((s) => s.length > 0) : subjectScopes;
+  for (const s of requestedScopes) {
+    if (!subjectScopes.includes(s)) {
+      return err(authError.invalidScope(`requested scope "${s}" not granted by subject_token`));
+    }
+  }
+  const audienceClaim = await deps.exchangeAudience(subjectClaims.claim, {
+    audience: req.audience,
+    ...req.scope !== undefined ? { requestedScopes } : {},
+    clientId: callerClient.id,
+    fromTenantId
+  });
+  if (typeof audienceClaim.code === "string" && typeof audienceClaim.description === "string") {
+    return err(audienceClaim);
+  }
+  const newClaim = audienceClaim;
+  const targetTenantId = req.audience;
+  const targetTenantCfg = await deps.configStore.getTenantConfig(targetTenantId);
+  if (isErr(targetTenantCfg))
+    return err(targetTenantCfg.error);
+  const targetClient = targetTenantCfg.value.clients.find((c) => c.id === callerClient.id);
+  if (!targetClient) {
+    return err(authError.invalidTarget(`client "${callerClient.id}" is not registered in target tenant "${targetTenantId}"`));
+  }
+  const targetTenant = {
+    id: targetTenantId,
+    config: targetTenantCfg.value,
+    request: { raw: new Request("about:blank"), custom: {} }
+  };
+  const minted = await mintTokens({
+    tenant: targetTenant,
+    claim: newClaim,
+    payload: {
+      tenantId: targetTenantId,
+      clientId: callerClient.id,
+      methodId: subjectClaims.mid ?? "token_exchange",
+      methodKind: subjectClaims.mkind ?? "token_exchange",
+      scopes: requestedScopes,
+      ...subjectClaims.aud !== undefined && subjectClaims.aud !== callerClient.id ? { audience: subjectClaims.aud } : {}
+    },
+    family: (deps.newRefreshFamily ?? randomId)(),
+    deps
+  });
+  if (isErr(minted))
+    return err(minted.error);
+  await safeAudit(deps, {
+    kind: "token_exchanged",
+    tenantId: targetTenantId,
+    fromTenantId,
+    clientId: callerClient.id,
+    subjectId: subjectClaims.sub,
+    family: "exchanged",
+    timestamp: deps.clock()
+  });
+  return ok({
+    ...minted.value,
+    issued_token_type: "urn:ietf:params:oauth:token-type:access_token"
+  });
+}
+export {
+  exchangeToken
+};

package/dist/esm/domain/token.js

@@ -0,0 +1,205 @@
+// src/domain/token.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { safeAudit } from "./audit";
+import { verifyClientCredentials } from "./client-auth";
+import {
+  base64url,
+  decryptPayload,
+  encryptPayload,
+  randomId,
+  randomToken,
+  sha256,
+  utf8
+} from "./crypto";
+import { signAccessToken } from "./jwt";
+import { validatePkce } from "./pkce";
+async function saveEncryptedCode(code, payload, ttl, deps) {
+  const keyResult = await deps.keyStore.currentEncryptionKey();
+  if (isErr(keyResult))
+    return err(keyResult.error);
+  let ciphertext;
+  try {
+    ciphertext = await encryptPayload(payload, keyResult.value.kid, keyResult.value.keyRef);
+  } catch (e) {
+    return err(authError.internalError("saveEncryptedCode: encrypt failed", e));
+  }
+  return deps.tokenStore.saveCode(code, ciphertext, ttl);
+}
+var DEFAULT_ACCESS_TTL_MS = 15 * 60 * 1000;
+var DEFAULT_REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+async function exchangeCode(req, deps) {
+  const consumed = await deps.tokenStore.consumeCode(req.code);
+  if (isErr(consumed))
+    return err(consumed.error);
+  let payload;
+  try {
+    payload = await decryptPayload(consumed.value, async (kid) => {
+      const keyResult = await deps.keyStore.getEncryptionKey(kid);
+      if (isErr(keyResult)) {
+        throw new Error(`unknown encryption kid ${kid}`);
+      }
+      return keyResult.value.keyRef;
+    });
+  } catch (e) {
+    return err(authError.internalError("exchangeCode: decrypt failed", e));
+  }
+  const tenantCfg = await deps.configStore.getTenantConfig(payload.tenantId);
+  if (isErr(tenantCfg))
+    return err(tenantCfg.error);
+  const client = tenantCfg.value.clients.find((c) => c.id === payload.clientId);
+  if (!client) {
+    return err(authError.invalidClient(`unknown client "${payload.clientId}"`));
+  }
+  if (client.id !== req.clientId) {
+    return err(authError.invalidGrant("client_id mismatch with auth code"));
+  }
+  const authResult = await verifyClientCredentials(client, req.clientSecret);
+  if (authResult)
+    return err(authResult);
+  if (payload.appRedirectUri !== req.redirectUri) {
+    return err(authError.invalidGrant("redirect_uri mismatch with auth code"));
+  }
+  if (payload.clientPkce) {
+    if (!req.codeVerifier) {
+      return err(authError.invalidGrant("missing code_verifier"));
+    }
+    const pkceValid = await validatePkce(req.codeVerifier, payload.clientPkce.challenge);
+    if (!pkceValid) {
+      return err(authError.invalidGrant("PKCE verification failed"));
+    }
+  }
+  const tenant = {
+    id: payload.tenantId,
+    config: tenantCfg.value,
+    request: { raw: new Request("about:blank"), custom: {} }
+  };
+  let claim;
+  try {
+    claim = await deps.success({
+      tenant,
+      methodId: payload.methodId,
+      methodKind: payload.methodKind,
+      providerSubject: payload.providerSubject,
+      properties: payload.properties,
+      context: payload.context ?? null
+    });
+  } catch (e) {
+    return err(authError.serverError("success callback threw", e));
+  }
+  if (deps.persistUpstreamTokens) {
+    try {
+      await deps.persistUpstreamTokens({
+        tenant,
+        methodId: payload.methodId,
+        methodKind: payload.methodKind,
+        providerSubject: payload.providerSubject,
+        properties: payload.properties,
+        subjectClaim: claim
+      });
+    } catch (e) {
+      return err(authError.serverError("persistUpstreamTokens hook threw", e));
+    }
+  }
+  const minted = await mintTokens({
+    tenant,
+    claim,
+    payload,
+    deps,
+    family: (deps.newRefreshFamily ?? randomId)()
+  });
+  return minted;
+}
+async function mintTokens(args) {
+  const { tenant, claim, payload, deps, family, skipRefresh } = args;
+  const accessTtl = tenant.config.accessTtl !== undefined ? tenant.config.accessTtl * 1000 : DEFAULT_ACCESS_TTL_MS;
+  const refreshTtl = tenant.config.refreshTtl !== undefined ? tenant.config.refreshTtl * 1000 : DEFAULT_REFRESH_TTL_MS;
+  const now = deps.clock();
+  const subjectId = await deriveSubjectId(claim);
+  const keyRes = await deps.keyStore.currentSigningKey();
+  if (isErr(keyRes))
+    return err(keyRes.error);
+  const signingKey = keyRes.value;
+  const claims = {
+    iss: deps.issuerUrl,
+    sub: subjectId,
+    aud: payload.audience ?? payload.clientId,
+    exp: Math.floor((now + accessTtl) / 1000),
+    iat: Math.floor(now / 1000),
+    tid: payload.tenantId,
+    mid: payload.methodId,
+    mkind: payload.methodKind,
+    scope: payload.scopes.join(" "),
+    claim
+  };
+  let accessToken;
+  try {
+    accessToken = await signAccessToken(claims, signingKey.privateKeyRef, signingKey.alg, signingKey.kid);
+  } catch (e) {
+    return err(authError.serverError("access token sign failed", e));
+  }
+  let refresh;
+  if (!skipRefresh) {
+    refresh = (deps.newRefreshToken ?? randomToken)();
+    const refreshPayload = {
+      tenantId: payload.tenantId,
+      clientId: payload.clientId,
+      subjectId,
+      claim,
+      scopes: payload.scopes,
+      audience: payload.audience,
+      family,
+      methodId: payload.methodId,
+      methodKind: payload.methodKind,
+      issuedAt: now,
+      expiresAt: now + refreshTtl
+    };
+    const saved = await deps.tokenStore.saveRefresh(refresh, refreshPayload);
+    if (isErr(saved))
+      return err(saved.error);
+  }
+  await safeAudit(deps, {
+    kind: "token_issued",
+    tenantId: payload.tenantId,
+    clientId: payload.clientId,
+    methodId: payload.methodId,
+    methodKind: payload.methodKind,
+    subjectId,
+    refreshTokenIdHash: refresh ? await hashTokenForAudit(refresh) : "",
+    timestamp: now
+  });
+  return ok({
+    access_token: accessToken,
+    token_type: "Bearer",
+    expires_in: Math.floor(accessTtl / 1000),
+    ...refresh !== undefined ? { refresh_token: refresh } : {},
+    scope: payload.scopes.join(" ")
+  });
+}
+async function hashClientSecret(plain) {
+  return base64url.encode(await sha256(utf8.encode(plain)));
+}
+async function deriveSubjectId(claim) {
+  const c = claim;
+  const ordered = canonicalize(c.properties);
+  return base64url.encode(await sha256(`${c.type}\x00${ordered}`)).slice(0, 22);
+}
+function canonicalize(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return JSON.stringify(value);
+  }
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalize(obj[k])}`).join(",")}}`;
+}
+async function hashTokenForAudit(token) {
+  return base64url.encode(await sha256(utf8.encode(token))).slice(0, 16);
+}
+export {
+  saveEncryptedCode,
+  mintTokens,
+  hashClientSecret,
+  exchangeCode,
+  DEFAULT_REFRESH_TTL_MS,
+  DEFAULT_ACCESS_TTL_MS
+};

package/dist/esm/domain/userinfo.js

@@ -0,0 +1,27 @@
+// src/domain/userinfo.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { verifyAccessToken } from "./jwt";
+async function userinfo(bearerToken, deps) {
+  const keysRes = await deps.keyStore.signingKeys();
+  if (isErr(keysRes))
+    return err(keysRes.error);
+  let claims;
+  try {
+    claims = await verifyAccessToken(bearerToken, keysRes.value, {
+      ...deps.issuerUrl ? { issuer: deps.issuerUrl } : {}
+    });
+  } catch {
+    return err(authError.invalidGrant("access token invalid or expired"));
+  }
+  const claim = claims.claim;
+  return ok({
+    sub: claims.sub,
+    subject_type: claim.type,
+    properties: claim.properties,
+    scope: claims.scope
+  });
+}
+export {
+  userinfo
+};

package/dist/esm/http/context.js

@@ -0,0 +1,7 @@
+// src/http/context.ts
+function initialVars(issuerUrl, cookies) {
+  return { cookies, tenant: null, recovery: null, issuerUrl };
+}
+export {
+  initialVars
+};

package/dist/esm/http/cookies.js

@@ -0,0 +1,98 @@
+// src/http/cookies.ts
+function parseCookieHeader(header) {
+  const out = new Map;
+  if (!header)
+    return out;
+  for (const part of header.split(";")) {
+    const trimmed = part.trim();
+    if (!trimmed)
+      continue;
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) {
+      out.set(trimmed, "");
+      continue;
+    }
+    const name = trimmed.slice(0, eq).trim();
+    const raw = trimmed.slice(eq + 1).trim();
+    const value = raw.startsWith('"') && raw.endsWith('"') ? raw.slice(1, -1) : raw;
+    try {
+      out.set(name, decodeURIComponent(value));
+    } catch {
+      out.set(name, value);
+    }
+  }
+  return out;
+}
+var RESERVED_PREFIX = /^(auth|idp)\./;
+var INVALID_COOKIE_NAME = /[=;,\s]/;
+function assertValidCookieName(name) {
+  if (!name || INVALID_COOKIE_NAME.test(name)) {
+    throw new TypeError(`invalid cookie name ${JSON.stringify(name)} — must be non-empty and contain no '=', ';', ',' or whitespace`);
+  }
+}
+function serializeSetCookie(cookie, defaults = {}) {
+  assertValidCookieName(cookie.name);
+  const parts = [];
+  const value = cookie.value ?? "";
+  parts.push(`${cookie.name}=${encodeURIComponent(value)}`);
+  const path = cookie.path ?? defaults.path ?? "/";
+  parts.push(`Path=${path}`);
+  const domain = cookie.domain ?? defaults.domain;
+  if (domain)
+    parts.push(`Domain=${domain}`);
+  if (cookie.value === null) {
+    parts.push("Max-Age=0");
+  } else if (cookie.maxAge !== undefined) {
+    parts.push(`Max-Age=${cookie.maxAge}`);
+  }
+  const secure = cookie.secure ?? defaults.secure ?? false;
+  if (secure)
+    parts.push("Secure");
+  const httpOnly = cookie.httpOnly ?? RESERVED_PREFIX.test(cookie.name);
+  if (httpOnly)
+    parts.push("HttpOnly");
+  const sameSite = cookie.sameSite ?? "lax";
+  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase() + sameSite.slice(1)}`);
+  return parts.join("; ");
+}
+var STRIPPED_HEADERS = [
+  "set-cookie",
+  "set-cookie2",
+  "strict-transport-security",
+  "content-security-policy",
+  "content-security-policy-report-only",
+  "x-frame-options",
+  "x-content-type-options",
+  "referrer-policy",
+  "permissions-policy",
+  "cache-control"
+];
+function applyResponsePolicy(response, opts = {}) {
+  const headers = new Headers(response.headers);
+  const stripped = [];
+  for (const h of STRIPPED_HEADERS) {
+    if (headers.has(h)) {
+      stripped.push(h);
+      headers.delete(h);
+    }
+  }
+  if (stripped.length > 0) {
+    console.warn(`[openauth] dropped method-returned header(s) ${stripped.join(", ")} — the framework owns cookie/security/cache headers; methods should return cookies via MethodResult.setCookies.`);
+  }
+  headers.set("Cache-Control", opts.cacheControl ?? "no-store");
+  if (opts.setCookies) {
+    for (const c of opts.setCookies) {
+      headers.append("Set-Cookie", serializeSetCookie(c, opts.cookieDefaults));
+    }
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+export {
+  serializeSetCookie,
+  parseCookieHeader,
+  applyResponsePolicy
+};