@absolutejs/auth 0.30.0 → 0.31.0

package/dist/index.js

@@ -3184,6 +3184,184 @@ var protectPermissionPlugin = ({
 // src/compliance/routes.ts
 import { Elysia as Elysia4, t as t4 } from "elysia";
 
+// src/utils.ts
+var defineAuthConfig = (configuration) => configuration;
+var defineAuthHtmxConfig = (htmxConfig) => htmxConfig;
+var defineAuthSettings = (settings) => settings;
+var defineProvidersConfiguration = (providersConfiguration) => providersConfiguration;
+var getStatus = async (session, user_session_id) => {
+  if (user_session_id === undefined) {
+    return {
+      error: {
+        code: "Bad Request",
+        message: "Cookies are missing"
+      },
+      user: null
+    };
+  }
+  const userSession = validateSession({ session, user_session_id });
+  const user = userSession?.user ?? null;
+  return {
+    error: null,
+    user
+  };
+};
+var instantiateUserSession = async ({
+  authProvider,
+  cookieSecure,
+  session,
+  user_session_id,
+  unregisteredSession,
+  tokenResponse,
+  providerInstance,
+  getUser,
+  onNewUser,
+  resolvedAuthorization,
+  sessionDurationMs = MILLISECONDS_IN_A_DAY,
+  unregisteredSessionDurationMs = MILLISECONDS_IN_AN_HOUR
+}) => {
+  const authorization = resolvedAuthorization ?? await resolveOAuthAuthorization({
+    authProvider,
+    providerInstance,
+    tokenResponse
+  });
+  const { accessToken, refreshToken, userIdentity } = authorization;
+  const userSession = validateSession({ session, user_session_id });
+  const userSessionId = getUserSessionId({
+    cookieSecure,
+    session,
+    unregisteredSession,
+    user_session_id
+  });
+  let user = userSession?.user ?? await getUser(userIdentity);
+  const response = user ?? await onNewUser(userIdentity);
+  const isRedirectOrStatus = response instanceof Response || isStatusResponse(response);
+  if (!isRedirectOrStatus) {
+    user = response;
+    session[userSessionId] = {
+      accessToken,
+      authenticatedAt: Date.now(),
+      expiresAt: Date.now() + sessionDurationMs,
+      refreshToken,
+      user
+    };
+    return;
+  }
+  const existingUnregistered = unregisteredSession[userSessionId];
+  if (existingUnregistered) {
+    existingUnregistered.accessToken = accessToken;
+    existingUnregistered.expiresAt = Date.now() + unregisteredSessionDurationMs;
+    existingUnregistered.refreshToken = refreshToken;
+    existingUnregistered.userIdentity = userIdentity;
+    return response;
+  }
+  unregisteredSession[userSessionId] = {
+    accessToken,
+    expiresAt: Date.now() + unregisteredSessionDurationMs,
+    refreshToken,
+    userIdentity
+  };
+  return response;
+};
+var resolveCookieSecure = (override) => override ?? false;
+var resolveOAuthAuthorization = async ({
+  authProvider,
+  providerInstance,
+  tokenResponse,
+  now = Date.now()
+}) => {
+  let userIdentity;
+  let accessToken = tokenResponse.access_token;
+  let refreshToken = tokenResponse.refresh_token;
+  if (tokenResponse.id_token) {
+    userIdentity = normalizeProviderIdentity({
+      identity: decodeJWT(tokenResponse.id_token),
+      providerConfiguration: providers[authProvider],
+      source: "idToken"
+    });
+  } else if (authProvider === "withings") {
+    userIdentity = { userid: tokenResponse.body.userid };
+    accessToken = tokenResponse.body.access_token;
+    refreshToken = tokenResponse.body.refresh_token;
+  } else {
+    userIdentity = normalizeProviderIdentity({
+      identity: await providerInstance.fetchUserProfile(tokenResponse.access_token),
+      providerConfiguration: providers[authProvider],
+      source: "profile"
+    });
+  }
+  const tokenType = Reflect.get(tokenResponse, "token_type");
+  return {
+    accessToken,
+    expiresAt: resolveOAuthTokenExpiresAt(tokenResponse, now),
+    refreshToken,
+    tokenType: typeof tokenType === "string" ? tokenType : undefined,
+    userIdentity
+  };
+};
+var parseExpiresInSeconds = (expiresIn) => {
+  if (typeof expiresIn === "number") {
+    return expiresIn;
+  }
+  if (typeof expiresIn === "string" && expiresIn.trim().length > 0) {
+    return Number(expiresIn);
+  }
+  return Number.NaN;
+};
+var resolveOAuthTokenExpiresAt = (tokenResponse, now = Date.now()) => {
+  const expiresIn = Reflect.get(tokenResponse, "expires_in");
+  const expiresInSeconds = parseExpiresInSeconds(expiresIn);
+  if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {
+    return;
+  }
+  return now + expiresInSeconds * 1000;
+};
+var validateSession = ({
+  user_session_id,
+  session
+}) => {
+  const userSessionId = user_session_id.value;
+  if (!userSessionId) {
+    return;
+  }
+  const userSession = session[userSessionId];
+  if (!userSession) {
+    return;
+  }
+  const isExpired = userSession.expiresAt < Date.now();
+  if (isExpired) {
+    delete session[userSessionId];
+    user_session_id.remove();
+    return;
+  }
+  return userSession;
+};
+var clearExistingSession = (existingId, session, unregisteredSession) => {
+  if (session)
+    delete session[existingId];
+  if (unregisteredSession)
+    delete unregisteredSession[existingId];
+};
+var getUserSessionId = ({
+  cookieSecure,
+  user_session_id,
+  session,
+  unregisteredSession
+}) => {
+  const existingId = user_session_id?.value;
+  if (isNonEmptyString(existingId)) {
+    clearExistingSession(existingId, session, unregisteredSession);
+  }
+  const userSessionId = crypto.randomUUID();
+  user_session_id.set({
+    httpOnly: true,
+    sameSite: "lax",
+    secure: resolveCookieSecure(cookieSecure),
+    value: userSessionId
+  });
+  return userSessionId;
+};
+
 // src/session/promote.ts
 var clearSession = async ({
   authSessionStore,
@@ -3216,6 +3394,7 @@ var promoteToSession = async ({
   anonymous,
   authSessionStore,
   cookie,
+  cookieSecure,
   impersonator,
   inMemorySession,
   samlLogout,
@@ -3243,7 +3422,7 @@ var promoteToSession = async ({
   cookie.set({
     httpOnly: true,
     sameSite: "lax",
-    secure: true,
+    secure: resolveCookieSecure(cookieSecure),
     value: userSessionId
   });
   if (authSessionStore) {
@@ -3549,6 +3728,7 @@ var isPasswordCompromised = (password) => isPasswordBreached(password);
 var credentialsLogin = ({
   authSessionStore,
   checkBreachesOnLogin,
+  cookieSecure,
   credentialStore,
   getUserByEmail,
   isMfaRequired,
@@ -3620,7 +3800,7 @@ var credentialsLogin = ({
     user_session_id.set({
       httpOnly: true,
       sameSite: "lax",
-      secure: true,
+      secure: resolveCookieSecure(cookieSecure),
       value: pendingSessionId
     });
     await persistWhen(authSessionStore !== undefined, compatibilityLayer.persist);
@@ -3630,6 +3810,7 @@ var credentialsLogin = ({
   const userSessionId = await promoteToSession({
     authSessionStore,
     cookie: user_session_id,
+    cookieSecure,
     inMemorySession: session,
     sessionDurationMs,
     user
@@ -3703,6 +3884,7 @@ var credentialsPasswordReset = ({
 import { Elysia as Elysia8, t as t8 } from "elysia";
 var credentialsRegister = ({
   authSessionStore,
+  cookieSecure,
   credentialStore,
   onCreateCredentialUser,
   onCredentialsLoginSuccess,
@@ -3773,6 +3955,7 @@ var credentialsRegister = ({
   const userSessionId = await promoteToSession({
     authSessionStore,
     cookie: user_session_id,
+    cookieSecure,
     inMemorySession: session,
     sessionDurationMs,
     user: created
@@ -4041,6 +4224,7 @@ var encryptTotpSecret = (secret, encryptionKey) => encryptionKey ? encryptSecret
 var mfaChallenge = ({
   authSessionStore,
   challengeRoute = "/auth/mfa/challenge",
+  cookieSecure,
   encryptionKey,
   getChallengeUser,
   getUserId,
@@ -4098,7 +4282,7 @@ var mfaChallenge = ({
   user_session_id.set({
     httpOnly: true,
     sameSite: "lax",
-    secure: true,
+    secure: resolveCookieSecure(cookieSecure),
     value: userSessionId
   });
   await persistWhen(authSessionStore !== undefined, compatibilityLayer.persist);
@@ -6480,6 +6664,7 @@ var generateOtpCode = (length) => {
 };
 var passwordlessRoutes = ({
   authSessionStore,
+  cookieSecure,
   emit,
   getUserByEmail,
   getUserId,
@@ -6505,6 +6690,7 @@ var passwordlessRoutes = ({
     const userSessionId = await promoteToSession({
       authSessionStore,
       cookie: userSessionCookie,
+      cookieSecure,
       inMemorySession: session,
       sessionDurationMs,
       user
@@ -7072,132 +7258,136 @@ var parseReferer = (headerReferer) => {
 var authorize = ({
   clientProviders,
   authorizeRoute = "/oauth2/:provider/authorization",
+  cookieSecure,
   onAuthorizeSuccess,
   onAuthorizeError
-}) => new Elysia20().get(authorizeRoute, async ({
-  status,
-  redirect,
-  cookie: {
-    state,
-    code_verifier,
-    auth_provider,
-    auth_client,
-    auth_intent,
-    origin_url
-  },
-  params: { provider },
-  query: { client, intent },
-  headers
 }) => {
-  if (auth_provider === undefined || auth_client === undefined || auth_intent === undefined || origin_url === undefined || state === undefined || code_verifier === undefined)
-    return status("Bad Request", "Cookies are missing");
-  if (provider === undefined)
-    return status("Bad Request", "Provider is required");
-  const resolvedProvider = resolveClientProviderEntry({
-    clientName: client,
-    clientProviders,
-    providerName: provider
-  });
-  if ("error" in resolvedProvider) {
-    return status("Unauthorized", resolvedProvider.error);
-  }
-  const { clientName, providerInstance, scope, searchParams } = resolvedProvider.entry;
-  const referer = parseReferer(headers["referer"]);
-  const authIntent = isAuthIntent(intent) ? intent : undefined;
-  origin_url.set({
-    httpOnly: true,
-    maxAge: COOKIE_DURATION,
-    path: "/",
-    sameSite: "lax",
-    secure: true,
-    value: referer
-  });
-  auth_provider.set({
-    httpOnly: true,
-    maxAge: COOKIE_DURATION,
-    path: "/",
-    sameSite: "lax",
-    secure: true,
-    value: provider
-  });
-  auth_client.set({
-    httpOnly: true,
-    maxAge: COOKIE_DURATION,
-    path: "/",
-    sameSite: "lax",
-    secure: true,
-    value: clientName ?? ""
-  });
-  if (authIntent !== undefined) {
-    auth_intent.set({
+  const secure = resolveCookieSecure(cookieSecure);
+  return new Elysia20().get(authorizeRoute, async ({
+    status,
+    redirect,
+    cookie: {
+      state,
+      code_verifier,
+      auth_provider,
+      auth_client,
+      auth_intent,
+      origin_url
+    },
+    params: { provider },
+    query: { client, intent },
+    headers
+  }) => {
+    if (auth_provider === undefined || auth_client === undefined || auth_intent === undefined || origin_url === undefined || state === undefined || code_verifier === undefined)
+      return status("Bad Request", "Cookies are missing");
+    if (provider === undefined)
+      return status("Bad Request", "Provider is required");
+    const resolvedProvider = resolveClientProviderEntry({
+      clientName: client,
+      clientProviders,
+      providerName: provider
+    });
+    if ("error" in resolvedProvider) {
+      return status("Unauthorized", resolvedProvider.error);
+    }
+    const { clientName, providerInstance, scope, searchParams } = resolvedProvider.entry;
+    const referer = parseReferer(headers["referer"]);
+    const authIntent = isAuthIntent(intent) ? intent : undefined;
+    origin_url.set({
       httpOnly: true,
       maxAge: COOKIE_DURATION,
       path: "/",
       sameSite: "lax",
-      secure: true,
-      value: authIntent
+      secure,
+      value: referer
     });
-  } else {
-    auth_intent.remove();
-  }
-  const currentState = generateState();
-  state.set({
-    httpOnly: true,
-    maxAge: COOKIE_DURATION,
-    path: "/",
-    sameSite: "lax",
-    secure: true,
-    value: currentState
-  });
-  const codeVerifier = isPKCEProviderOption(provider) ? generateCodeVerifier() : undefined;
-  if (codeVerifier) {
-    code_verifier.set({
+    auth_provider.set({
       httpOnly: true,
       maxAge: COOKIE_DURATION,
       path: "/",
       sameSite: "lax",
-      secure: true,
-      value: codeVerifier
-    });
-  }
-  try {
-    const authorizationURL = await providerInstance.createAuthorizationUrl(codeVerifier ? { codeVerifier, scope, state: currentState } : { scope, state: currentState });
-    searchParams?.forEach(([key, value]) => authorizationURL.searchParams.set(key, value));
-    await onAuthorizeSuccess?.({
-      authClient: clientName,
-      authIntent,
-      authorizationUrl: authorizationURL,
-      authProvider: provider
+      secure,
+      value: provider
     });
-    return redirect(authorizationURL.toString());
-  } catch (err) {
-    console.error("[authorize] Failed to create authorization URL:", {
-      authClient: clientName,
-      error: err instanceof Error ? err.message : err,
-      provider,
-      stack: err instanceof Error ? err.stack : undefined
+    auth_client.set({
+      httpOnly: true,
+      maxAge: COOKIE_DURATION,
+      path: "/",
+      sameSite: "lax",
+      secure,
+      value: clientName ?? ""
     });
-    await onAuthorizeError?.({
-      authClient: clientName,
-      authProvider: provider,
-      error: err
+    if (authIntent !== undefined) {
+      auth_intent.set({
+        httpOnly: true,
+        maxAge: COOKIE_DURATION,
+        path: "/",
+        sameSite: "lax",
+        secure,
+        value: authIntent
+      });
+    } else {
+      auth_intent.remove();
+    }
+    const currentState = generateState();
+    state.set({
+      httpOnly: true,
+      maxAge: COOKIE_DURATION,
+      path: "/",
+      sameSite: "lax",
+      secure,
+      value: currentState
     });
-    return status("Internal Server Error", "Failed to create authorization URL");
-  }
-}, {
-  cookie: t17.Cookie({
-    auth_client: authClientOption,
-    auth_intent: authIntentOption,
-    auth_provider: t17.Optional(authProviderOption)
-  }),
-  params: t17.Object({
-    provider: authProviderOption
-  }),
-  query: t17.Object({
-    client: authClientOption,
-    intent: authIntentOption
-  })
-});
+    const codeVerifier = isPKCEProviderOption(provider) ? generateCodeVerifier() : undefined;
+    if (codeVerifier) {
+      code_verifier.set({
+        httpOnly: true,
+        maxAge: COOKIE_DURATION,
+        path: "/",
+        sameSite: "lax",
+        secure,
+        value: codeVerifier
+      });
+    }
+    try {
+      const authorizationURL = await providerInstance.createAuthorizationUrl(codeVerifier ? { codeVerifier, scope, state: currentState } : { scope, state: currentState });
+      searchParams?.forEach(([key, value]) => authorizationURL.searchParams.set(key, value));
+      await onAuthorizeSuccess?.({
+        authClient: clientName,
+        authIntent,
+        authorizationUrl: authorizationURL,
+        authProvider: provider
+      });
+      return redirect(authorizationURL.toString());
+    } catch (err) {
+      console.error("[authorize] Failed to create authorization URL:", {
+        authClient: clientName,
+        error: err instanceof Error ? err.message : err,
+        provider,
+        stack: err instanceof Error ? err.stack : undefined
+      });
+      await onAuthorizeError?.({
+        authClient: clientName,
+        authProvider: provider,
+        error: err
+      });
+      return status("Internal Server Error", "Failed to create authorization URL");
+    }
+  }, {
+    cookie: t17.Cookie({
+      auth_client: authClientOption,
+      auth_intent: authIntentOption,
+      auth_provider: t17.Optional(authProviderOption)
+    }),
+    params: t17.Object({
+      provider: authProviderOption
+    }),
+    query: t17.Object({
+      client: authClientOption,
+      intent: authIntentOption
+    })
+  });
+};
 
 // src/routes/callback.ts
 import { Elysia as Elysia21, t as t18 } from "elysia";
@@ -8470,13 +8660,13 @@ var ssoDiscoveryRoute = ({
 
 // src/sso/oidcRoutes.ts
 import { Elysia as Elysia32, t as t28 } from "elysia";
-var ssoCookieOptions = {
+var makeSsoCookieOptions = (secure) => ({
   httpOnly: true,
   maxAge: COOKIE_DURATION,
   path: "/",
   sameSite: "lax",
-  secure: true
-};
+  secure
+});
 var ssoCookieSchema = t28.Cookie({
   sso_nonce: t28.Optional(t28.String()),
   sso_organization: t28.Optional(t28.String()),
@@ -8497,6 +8687,7 @@ var parseReferer2 = (referer) => {
 };
 var oidcSsoRoutes = ({
   authSessionStore,
+  cookieSecure,
   getSsoUser,
   onSsoCallbackError,
   onSsoCallbackSuccess,
@@ -8504,6 +8695,7 @@ var oidcSsoRoutes = ({
   ssoConnectionStore,
   ssoRoute = DEFAULT_SSO_ROUTE
 }) => {
+  const ssoCookieOptions = makeSsoCookieOptions(resolveCookieSecure(cookieSecure));
   const authorizeRoute = `${ssoRoute}/oidc/:organizationId/authorize`;
   const callbackRoute = `${ssoRoute}/oidc/:organizationId/callback`;
   return new Elysia32().use(sessionStore()).get(authorizeRoute, async ({
@@ -8606,6 +8798,7 @@ var oidcSsoRoutes = ({
       const userSessionId = await promoteToSession({
         authSessionStore,
         cookie: user_session_id,
+        cookieSecure,
         inMemorySession: session,
         sessionDurationMs,
         user
@@ -8655,6 +8848,7 @@ var settle = async (work) => {
 };
 var samlSsoRoutes = ({
   authSessionStore,
+  cookieSecure,
   getSsoUser,
   onSsoCallbackError,
   onSsoCallbackSuccess,
@@ -8730,6 +8924,7 @@ var samlSsoRoutes = ({
       const userSessionId = await promoteToSession({
         authSessionStore,
         cookie: user_session_id,
+        cookieSecure,
         inMemorySession: session,
         samlLogout: {
           connectionId: connection.connectionId,
@@ -8897,6 +9092,7 @@ var WEBAUTHN_CHALLENGE_COOKIE = "webauthn_challenge";
 var webauthnRoutes = ({
   authSessionStore,
   challengeDurationMs = DEFAULT_WEBAUTHN_CHALLENGE_TTL_MS,
+  cookieSecure,
   credentialStore,
   emit,
   getUserDisplayName,
@@ -8912,6 +9108,7 @@ var webauthnRoutes = ({
   webauthnAdapter,
   webauthnRoute = DEFAULT_WEBAUTHN_ROUTE
 }) => {
+  const secure = resolveCookieSecure(cookieSecure);
   const challengeCookie = t30.Cookie({
     user_session_id: t30.Optional(userSessionIdTypebox),
     webauthn_challenge: t30.Optional(t30.String())
@@ -8920,7 +9117,7 @@ var webauthnRoutes = ({
     httpOnly: true,
     maxAge: Math.floor(challengeDurationMs / MILLISECONDS_IN_A_SECOND),
     sameSite: "lax",
-    secure: true,
+    secure,
     value: challenge
   });
   return new Elysia34().use(sessionStore()).post(`${webauthnRoute}/register/options`, async ({
@@ -9052,6 +9249,7 @@ var webauthnRoutes = ({
     const userSessionId = await promoteToSession({
       authSessionStore,
       cookie: user_session_id,
+      cookieSecure,
       inMemorySession: session,
       sessionDurationMs,
       user
@@ -19549,7 +19747,7 @@ var getGrantedScopes = (scopeValue, fallbackScopes) => {
   }
   return [...new Set(fallbackScopes.filter(Boolean))];
 };
-var parseExpiresInSeconds = (expiresIn) => {
+var parseExpiresInSeconds2 = (expiresIn) => {
   if (typeof expiresIn === "number") {
     return expiresIn;
   }
@@ -19559,7 +19757,7 @@ var parseExpiresInSeconds = (expiresIn) => {
   return Number.NaN;
 };
 var getExpiresAt = (tokenResponse2) => {
-  const expiresInSeconds = parseExpiresInSeconds(tokenResponse2.expires_in);
+  const expiresInSeconds = parseExpiresInSeconds2(tokenResponse2.expires_in);
   if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {
     return;
   }
@@ -19898,6 +20096,7 @@ var DEFAULT_IMPERSONATION_TTL_MS = MILLISECONDS_IN_AN_HOUR;
 var endImpersonation = async ({
   authSessionStore,
   cookie,
+  cookieSecure,
   emit,
   inMemorySession
 }) => {
@@ -19930,7 +20129,7 @@ var endImpersonation = async ({
     cookie.set({
       httpOnly: true,
       sameSite: "lax",
-      secure: true,
+      secure: resolveCookieSecure(cookieSecure),
       value: returnTo
     });
     return { restored: true };
@@ -19942,6 +20141,7 @@ var isImpersonating = (session) => session?.impersonator !== undefined;
 var startImpersonation = async ({
   authSessionStore,
   cookie,
+  cookieSecure,
   emit,
   getUserId,
   impersonator,
@@ -19959,6 +20159,7 @@ var startImpersonation = async ({
   const sessionId = await promoteToSession({
     authSessionStore,
     cookie,
+    cookieSecure,
     impersonator: stamp,
     inMemorySession,
     sessionDurationMs,
@@ -19977,6 +20178,7 @@ var DEFAULT_GUEST_TTL_MS = MILLISECONDS_IN_A_DAY;
 var createAnonymousSession = async ({
   authSessionStore,
   cookie,
+  cookieSecure,
   guestUser,
   inMemorySession,
   sessionDurationMs = DEFAULT_GUEST_TTL_MS
@@ -19984,6 +20186,7 @@ var createAnonymousSession = async ({
   anonymous: true,
   authSessionStore,
   cookie,
+  cookieSecure,
   inMemorySession,
   sessionDurationMs,
   user: guestUser
@@ -19991,14 +20194,14 @@ var createAnonymousSession = async ({
 var isAnonymousSession = (session) => session?.anonymous === true;
 // src/session/multiSession.ts
 var SEPARATOR = " ";
-var writeRing = (ring, ids) => ring.set({
+var writeRing = (ring, ids, cookieSecure) => ring.set({
   httpOnly: true,
   sameSite: "lax",
-  secure: true,
+  secure: resolveCookieSecure(cookieSecure),
   value: ids.join(SEPARATOR)
 });
 var readRing = (ring) => (ring.value ?? "").split(SEPARATOR).filter((entry) => isUserSessionId(entry));
-var addToSessionRing = (ring, sessionId) => writeRing(ring, [...new Set([...readRing(ring), sessionId])]);
+var addToSessionRing = (ring, sessionId, cookieSecure) => writeRing(ring, [...new Set([...readRing(ring), sessionId])], cookieSecure);
 var listRingSessions = async ({
   authSessionStore,
   inMemorySession,
@@ -20018,12 +20221,13 @@ var readSessionRing = (ring) => readRing(ring);
 var removeFromSessionRing = async ({
   activeCookie,
   authSessionStore,
+  cookieSecure,
   inMemorySession,
   ring,
   sessionId
 }) => {
   const remaining = readRing(ring).filter((id) => id !== sessionId);
-  writeRing(ring, remaining);
+  writeRing(ring, remaining, cookieSecure);
   if (authSessionStore)
     await authSessionStore.removeSession(sessionId);
   else if (inMemorySession)
@@ -20037,12 +20241,13 @@ var removeFromSessionRing = async ({
     activeCookie.set({
       httpOnly: true,
       sameSite: "lax",
-      secure: true,
+      secure: resolveCookieSecure(cookieSecure),
       value: fallback
     });
 };
 var switchActiveSession = ({
   activeCookie,
+  cookieSecure,
   ring,
   sessionId
 }) => {
@@ -20051,184 +20256,11 @@ var switchActiveSession = ({
   activeCookie.set({
     httpOnly: true,
     sameSite: "lax",
-    secure: true,
+    secure: resolveCookieSecure(cookieSecure),
     value: sessionId
   });
   return true;
 };
-// src/utils.ts
-var defineAuthConfig = (configuration) => configuration;
-var defineAuthHtmxConfig = (htmxConfig) => htmxConfig;
-var defineAuthSettings = (settings) => settings;
-var defineProvidersConfiguration = (providersConfiguration) => providersConfiguration;
-var getStatus = async (session, user_session_id) => {
-  if (user_session_id === undefined) {
-    return {
-      error: {
-        code: "Bad Request",
-        message: "Cookies are missing"
-      },
-      user: null
-    };
-  }
-  const userSession = validateSession({ session, user_session_id });
-  const user = userSession?.user ?? null;
-  return {
-    error: null,
-    user
-  };
-};
-var instantiateUserSession = async ({
-  authProvider,
-  session,
-  user_session_id,
-  unregisteredSession,
-  tokenResponse: tokenResponse2,
-  providerInstance,
-  getUser,
-  onNewUser,
-  resolvedAuthorization,
-  sessionDurationMs = MILLISECONDS_IN_A_DAY,
-  unregisteredSessionDurationMs = MILLISECONDS_IN_AN_HOUR
-}) => {
-  const authorization = resolvedAuthorization ?? await resolveOAuthAuthorization({
-    authProvider,
-    providerInstance,
-    tokenResponse: tokenResponse2
-  });
-  const { accessToken, refreshToken, userIdentity } = authorization;
-  const userSession = validateSession({ session, user_session_id });
-  const userSessionId = getUserSessionId({
-    session,
-    unregisteredSession,
-    user_session_id
-  });
-  let user = userSession?.user ?? await getUser(userIdentity);
-  const response = user ?? await onNewUser(userIdentity);
-  const isRedirectOrStatus = response instanceof Response || isStatusResponse(response);
-  if (!isRedirectOrStatus) {
-    user = response;
-    session[userSessionId] = {
-      accessToken,
-      authenticatedAt: Date.now(),
-      expiresAt: Date.now() + sessionDurationMs,
-      refreshToken,
-      user
-    };
-    return;
-  }
-  const existingUnregistered = unregisteredSession[userSessionId];
-  if (existingUnregistered) {
-    existingUnregistered.accessToken = accessToken;
-    existingUnregistered.expiresAt = Date.now() + unregisteredSessionDurationMs;
-    existingUnregistered.refreshToken = refreshToken;
-    existingUnregistered.userIdentity = userIdentity;
-    return response;
-  }
-  unregisteredSession[userSessionId] = {
-    accessToken,
-    expiresAt: Date.now() + unregisteredSessionDurationMs,
-    refreshToken,
-    userIdentity
-  };
-  return response;
-};
-var resolveOAuthAuthorization = async ({
-  authProvider,
-  providerInstance,
-  tokenResponse: tokenResponse2,
-  now = Date.now()
-}) => {
-  let userIdentity;
-  let accessToken = tokenResponse2.access_token;
-  let refreshToken = tokenResponse2.refresh_token;
-  if (tokenResponse2.id_token) {
-    userIdentity = normalizeProviderIdentity({
-      identity: decodeJWT(tokenResponse2.id_token),
-      providerConfiguration: providers[authProvider],
-      source: "idToken"
-    });
-  } else if (authProvider === "withings") {
-    userIdentity = { userid: tokenResponse2.body.userid };
-    accessToken = tokenResponse2.body.access_token;
-    refreshToken = tokenResponse2.body.refresh_token;
-  } else {
-    userIdentity = normalizeProviderIdentity({
-      identity: await providerInstance.fetchUserProfile(tokenResponse2.access_token),
-      providerConfiguration: providers[authProvider],
-      source: "profile"
-    });
-  }
-  const tokenType = Reflect.get(tokenResponse2, "token_type");
-  return {
-    accessToken,
-    expiresAt: resolveOAuthTokenExpiresAt(tokenResponse2, now),
-    refreshToken,
-    tokenType: typeof tokenType === "string" ? tokenType : undefined,
-    userIdentity
-  };
-};
-var parseExpiresInSeconds2 = (expiresIn) => {
-  if (typeof expiresIn === "number") {
-    return expiresIn;
-  }
-  if (typeof expiresIn === "string" && expiresIn.trim().length > 0) {
-    return Number(expiresIn);
-  }
-  return Number.NaN;
-};
-var resolveOAuthTokenExpiresAt = (tokenResponse2, now = Date.now()) => {
-  const expiresIn = Reflect.get(tokenResponse2, "expires_in");
-  const expiresInSeconds = parseExpiresInSeconds2(expiresIn);
-  if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {
-    return;
-  }
-  return now + expiresInSeconds * 1000;
-};
-var validateSession = ({
-  user_session_id,
-  session
-}) => {
-  const userSessionId = user_session_id.value;
-  if (!userSessionId) {
-    return;
-  }
-  const userSession = session[userSessionId];
-  if (!userSession) {
-    return;
-  }
-  const isExpired2 = userSession.expiresAt < Date.now();
-  if (isExpired2) {
-    delete session[userSessionId];
-    user_session_id.remove();
-    return;
-  }
-  return userSession;
-};
-var clearExistingSession = (existingId, session, unregisteredSession) => {
-  if (session)
-    delete session[existingId];
-  if (unregisteredSession)
-    delete unregisteredSession[existingId];
-};
-var getUserSessionId = ({
-  user_session_id,
-  session,
-  unregisteredSession
-}) => {
-  const existingId = user_session_id?.value;
-  if (isNonEmptyString(existingId)) {
-    clearExistingSession(existingId, session, unregisteredSession);
-  }
-  const userSessionId = crypto.randomUUID();
-  user_session_id.set({
-    httpOnly: true,
-    sameSite: "lax",
-    secure: true,
-    value: userSessionId
-  });
-  return userSessionId;
-};
 // src/tenancy.ts
 var hasOrganizationScope = (value) => typeof value.organizationId === "string" && value.organizationId.length > 0;
 // src/credentials/emailValidation.ts
@@ -23342,6 +23374,7 @@ var createPostgresSetupSessionStore = (db) => ({
 var auth = async ({
   providersConfiguration,
   authorizeRoute,
+  cookieSecure,
   callbackRoute,
   profileRoute,
   signoutRoute,
@@ -23389,6 +23422,7 @@ var auth = async ({
   onSessionCleanup
 }) => {
   const clientProviders = await buildClientProviders(providersConfiguration, createOAuth2Client);
+  const resolvedCookieSecure = resolveCookieSecure(cookieSecure);
   const webhookDispatch = webhooks ? createWebhookDispatcher(webhooks) : undefined;
   const auditEmit = audit || webhookDispatch ? createAuditEmitter({
     ...audit,
@@ -23432,6 +23466,7 @@ var auth = async ({
   })).use(authorize({
     authorizeRoute,
     clientProviders,
+    cookieSecure: resolvedCookieSecure,
     onAuthorizeError,
     onAuthorizeSuccess
   })).use(callback({
@@ -23452,14 +23487,25 @@ var auth = async ({
   })).use(auditedCredentials ? credentialRoutes({
     ...auditedCredentials,
     authSessionStore,
+    cookieSecure: resolvedCookieSecure,
     lockoutGuard
-  }) : new Elysia36).use(auditedMfa ? mfaRoutes({ ...auditedMfa, authSessionStore }) : new Elysia36).use(passwordless ? passwordlessRoutes({
+  }) : new Elysia36).use(auditedMfa ? mfaRoutes({
+    ...auditedMfa,
+    authSessionStore,
+    cookieSecure: resolvedCookieSecure
+  }) : new Elysia36).use(passwordless ? passwordlessRoutes({
     ...passwordless,
     authSessionStore,
+    cookieSecure: resolvedCookieSecure,
     emit: auditEmit
-  }) : new Elysia36).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia36).use(sso ? oidcSsoRoutes({ ...sso, authSessionStore }) : new Elysia36).use(sso && sso.samlAdapter ? samlSsoRoutes({
+  }) : new Elysia36).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia36).use(sso ? oidcSsoRoutes({
+    ...sso,
+    authSessionStore,
+    cookieSecure: resolvedCookieSecure
+  }) : new Elysia36).use(sso && sso.samlAdapter ? samlSsoRoutes({
     ...sso,
     authSessionStore,
+    cookieSecure: resolvedCookieSecure,
     samlAdapter: sso.samlAdapter
   }) : new Elysia36).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
     getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
@@ -23476,6 +23522,7 @@ var auth = async ({
   }) : new Elysia36).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia36).use(webauthn ? webauthnRoutes({
     ...webauthn,
     authSessionStore,
+    cookieSecure: resolvedCookieSecure,
     emit: auditEmit
   }) : new Elysia36).use(compliance ? complianceRoutes({
     ...compliance,
@@ -23556,6 +23603,7 @@ export {
   resolvePermissions,
   resolveOAuthTokenExpiresAt,
   resolveOAuthAuthorization,
+  resolveCookieSecure,
   resolveClientProviderEntry,
   resolveAuthHtmxRenderers,
   resolveApiPrincipal,
@@ -23856,5 +23904,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=B31AA1D09BAE440964756E2164756E21
+//# debugId=185BEA3393AC9BDA64756E2164756E21
 //# sourceMappingURL=index.js.map