@adonis-agora/durable 1.0.0-rc.0 → 1.0.0-rc.10

package/dist/src/dashboard/auth.d.ts

@@ -1,134 +0,0 @@
-import { type DashboardSession, type DashboardSessionUser } from './session_cookie.js';
-/**
- * Framework-light `dashboardAuth` mechanism for the durable dashboard — config resolution, the
- * open-redirect guard, the login decision, and session verification. NO AdonisJS types leak in
- * (mirroring {@link file://./handlers.ts handlers.ts}), so every branch is unit-testable against a
- * plain object with no HTTP server. The provider (`providers/dashboard_provider.ts`) adapts an
- * `HttpContext` to these functions and owns the cookie read/write via AdonisJS's native cookie API.
- *
- * When configured it gates BOTH the dashboard HTML shell (a full-page navigation redirected `302`
- * to a server-rendered login page) and the JSON API (a plain `401`) behind a signed session cookie.
- * When left unconfigured the dashboard behaves exactly as before (no login/logout routes, no
- * session guard).
- */
-/** Host hook validating submitted credentials from the built-in login page (Mode B — standalone). */
-export type LoginHook = (username: string, password: string) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
-/**
- * Host hook validating the HOST APP's own auth off the raw request (Mode A — SSO / "open from your
- * app"). Receives the underlying platform request object (an AdonisJS `Request['request']`, i.e. the
- * raw Node `IncomingMessage`) rather than an AdonisJS type, so this module stays framework-light and
- * unit-testable with no `HttpContext` — the provider passes it through untouched. Mirrors the NestJS
- * sibling console's `SessionHook` byte-for-byte (same two-mode split).
- */
-export type SessionHook = (request: unknown) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
-/**
- * Author-facing `dashboardAuth` option on `config/durable_dashboard.ts`. Gates the dashboard behind
- * a signed session cookie, minted by whichever mode(s) are configured:
- *
- * - Mode B (`login`) — the built-in server-rendered login page (`GET <path>/login`), for a
- *   standalone console with its own credentials.
- * - Mode A (`session`) — `POST <path>/session`, for a host app that's already authenticated the
- *   operator itself and wants a one-shot "open the console" button (see `client/console-session.ts`).
- *
- * Both may be configured together; at least one is required. The bundled dashboard SPA is unaware of
- * which mode(s) are active — it only reacts to a 401's `{ auth: { modes } }` body (see
- * `durable-client.ts`).
- *
- * Nest needed a `forRootAsync` to reach app services from these hooks; AdonisJS does not — the config
- * module is a plain file and each hook is just a function that may be `async` and close over
- * `app.container`/services (import them at the top of `config/durable_dashboard.ts`), so there is
- * nothing extra to build for the async case.
- */
-export interface DashboardAuthOptions {
-    /** REQUIRED HMAC-SHA256 signing key. Missing/empty => boot error (fail closed). */
-    secret: string;
-    /** Cookie TTL as a duration string (`'8h'`, `'30m'`, `'7d'`). Default `'8h'`. */
-    ttl?: string;
-    /** Validates submitted username/password; return the session user, or `null` to deny. Thrown
-     *  errors are treated as a denial (logged once, never surfaced to the client). May be async. */
-    login?: LoginHook;
-    /** Validates the host app's own auth off the raw request; return the session user, or `null` to
-     *  deny. Thrown errors are treated as a denial. May be async. */
-    session?: SessionHook;
-}
-/** Which auth surface(s) are active — carried on an API 401's `{ auth: { modes } }` body so the SPA
- *  knows whether to offer the login page or just report "not authenticated". */
-export type AuthMode = 'session' | 'login';
-/** Resolved, validated `dashboardAuth` config shared by the guard, the login/session handlers, and
- *  the page. */
-export interface ResolvedDashboardAuth {
-    secret: string;
-    ttlMs: number;
-    modes: AuthMode[];
-    login?: LoginHook;
-    session?: SessionHook;
-}
-/** Cookie name carrying the signed dashboard session. */
-export declare const SESSION_COOKIE_NAME = "durable_dashboard_session";
-/**
- * Validate + resolve the `dashboardAuth` option. Returns `null` when unconfigured (today's
- * unauthenticated behavior, unchanged). Throws at boot (fail closed) when configured but missing a
- * secret, or neither `login` nor `session` is a function — the host learns immediately rather than
- * shipping an un-mintable gate.
- */
-export declare function resolveDashboardAuth(options: DashboardAuthOptions | undefined): ResolvedDashboardAuth | null;
-/**
- * Guard a client-supplied redirect target against an open redirect: it must be a same-origin,
- * root-relative path (`/durable/foo`), never a protocol-relative (`//evil.com`) or absolute
- * (`https://evil.com`) URL. Falls back to `fallback` (the dashboard's own `basePath`) for anything
- * else, including a missing/non-string value.
- */
-export declare function sanitizeReturnTo(candidate: unknown, fallback: string): string;
-/**
- * The framework-light outcome of a login attempt, mapped to HTTP by the provider:
- * - `ok`       → set `cookieValue` as the session cookie, reply `200 { redirectTo }`.
- * - `bad-request` → `400` (body missing string `username`/`password`).
- * - `unauthorized` → uniform `401 { error }` for EVERY credential failure (unknown user, wrong
- *   password, or a throwing hook) — no user-enumeration. `hookError` is set only when the hook
- *   threw, so the provider can warn-log it once without changing the client-visible response.
- */
-export type LoginOutcome = {
-    kind: 'ok';
-    cookieValue: string;
-    redirectTo: string;
-} | {
-    kind: 'bad-request';
-    message: string;
-} | {
-    kind: 'unauthorized';
-    message: string;
-    hookError?: unknown;
-};
-/**
- * Decide a login attempt end-to-end (validate body → run hook → mint cookie) with no HTTP types.
- * On success returns the signed cookie value to set plus the sanitized `redirectTo`; the password
- * is forwarded to the hook AS-IS (empty string when blank), so the hook alone decides whether a
- * password is required. `404`-worthy (Mode B not configured) is the provider's call, not this
- * function's — it only runs once the provider has confirmed `auth.login` exists.
- */
-export declare function performLogin(auth: ResolvedDashboardAuth, body: unknown, basePath: string, now?: number): Promise<LoginOutcome>;
-/**
- * The framework-light outcome of a Mode A session-mint attempt (`POST <path>/session`), mapped to
- * HTTP by the provider: `ok` → set the cookie, reply `204`; `unauthorized` → uniform `401` (the
- * `session` hook returned/threw a denial).
- */
-export type SessionOutcome = {
-    kind: 'ok';
-    cookieValue: string;
-} | {
-    kind: 'unauthorized';
-    hookError?: unknown;
-};
-/**
- * Decide a Mode A session-mint attempt end-to-end: run the host's `session` hook against the raw
- * platform request, and mint the cookie on success. No body to validate — the hook reads whatever it
- * needs directly off `request` (its own cookie/JWT/header).
- */
-export declare function performSession(auth: ResolvedDashboardAuth, request: unknown, now?: number): Promise<SessionOutcome>;
-/**
- * Read + verify a session cookie value, returning the session or `null` when absent, tampered, or
- * expired. Thin wrapper over {@link verifySessionCookie} so the provider never touches crypto.
- */
-export declare function readSession(auth: ResolvedDashboardAuth, cookieValue: string | undefined, now?: number): DashboardSession | null;
-export type { DashboardSession, DashboardSessionUser } from './session_cookie.js';
-//# sourceMappingURL=auth.d.ts.map

package/dist/src/dashboard/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/dashboard/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAG1B,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;GAWG;AAEH,qGAAqG;AACrG,MAAM,MAAM,SAAS,GAAG,CACtB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,oBAAoB,GAAG,IAAI,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,oBAAoB,GAAG,IAAI,CAAC;AAExE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;oGACgG;IAChG,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;qEACiE;IACjE,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED;gFACgF;AAChF,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3C;gBACgB;AAChB,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAoB/D;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,oBAAoB,GAAG,SAAS,GACxC,qBAAqB,GAAG,IAAI,CA0B9B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAS7E;AAaD;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAoBnE;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,CAAC,CAuBvB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAElD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,qBAAqB,EAC3B,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,cAAc,CAAC,CAezB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,qBAAqB,EAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,GAAG,CAAC,EAAE,MAAM,GACX,gBAAgB,GAAG,IAAI,CAMzB;AAED,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/src/dashboard/auth.js

@@ -1,156 +0,0 @@
-import { signSessionCookie, verifySessionCookie, } from './session_cookie.js';
-/** Cookie name carrying the signed dashboard session. */
-export const SESSION_COOKIE_NAME = 'durable_dashboard_session';
-const DEFAULT_TTL = '8h';
-const DEFAULT_TTL_MS = 8 * 60 * 60 * 1000;
-const DURATION_UNITS = {
-    s: 1000,
-    m: 60 * 1000,
-    h: 60 * 60 * 1000,
-    d: 24 * 60 * 60 * 1000,
-};
-/** Parse a `'<number><s|m|h|d>'` duration to ms; falls back to the 8h default on a bad value. */
-function durationToMs(ttl) {
-    const match = /^(\d+)([smhd])$/.exec(ttl.trim());
-    if (!match)
-        return DEFAULT_TTL_MS;
-    const unit = DURATION_UNITS[match[2] ?? ''];
-    if (unit === undefined)
-        return DEFAULT_TTL_MS;
-    return Number(match[1]) * unit;
-}
-/**
- * Validate + resolve the `dashboardAuth` option. Returns `null` when unconfigured (today's
- * unauthenticated behavior, unchanged). Throws at boot (fail closed) when configured but missing a
- * secret, or neither `login` nor `session` is a function — the host learns immediately rather than
- * shipping an un-mintable gate.
- */
-export function resolveDashboardAuth(options) {
-    if (options === undefined)
-        return null;
-    if (typeof options.secret !== 'string' || options.secret === '') {
-        throw new Error('durable_dashboard: dashboardAuth.secret is required and must be a non-empty string ' +
-            '(HMAC-SHA256 signing key, 32+ bytes recommended). Failing closed.');
-    }
-    const hasLogin = typeof options.login === 'function';
-    const hasSession = typeof options.session === 'function';
-    if (!hasLogin && !hasSession) {
-        throw new Error('durable_dashboard: dashboardAuth needs at least one of `login` or `session` (a login hook or ' +
-            'a host-session hook).');
-    }
-    const modes = [];
-    if (hasSession)
-        modes.push('session');
-    if (hasLogin)
-        modes.push('login');
-    return {
-        secret: options.secret,
-        ttlMs: durationToMs(options.ttl ?? DEFAULT_TTL),
-        modes,
-        ...(hasLogin ? { login: options.login } : {}),
-        ...(hasSession ? { session: options.session } : {}),
-    };
-}
-/**
- * Guard a client-supplied redirect target against an open redirect: it must be a same-origin,
- * root-relative path (`/durable/foo`), never a protocol-relative (`//evil.com`) or absolute
- * (`https://evil.com`) URL. Falls back to `fallback` (the dashboard's own `basePath`) for anything
- * else, including a missing/non-string value.
- */
-export function sanitizeReturnTo(candidate, fallback) {
-    if (typeof candidate !== 'string')
-        return fallback;
-    if (!candidate.startsWith('/'))
-        return fallback;
-    if (candidate.startsWith('//'))
-        return fallback;
-    if (candidate.includes('://'))
-        return fallback;
-    // Browsers normalize backslashes to slashes in URLs, so `/\evil.com` survives every check above
-    // yet navigates to `https://evil.com` — reject any backslash outright.
-    if (candidate.includes('\\'))
-        return fallback;
-    return candidate;
-}
-function isString(value) {
-    return typeof value === 'string';
-}
-const UNAUTHORIZED_MESSAGE = 'Invalid username or password.';
-/**
- * Run a host hook (`login` or `session`) defensively: a throw is treated as a denial (uniform
- * failure) so a buggy hook never 500s the endpoint into a stack-trace leak. The thrown error is
- * surfaced on the outcome (`hookError`) so the provider can warn-log it once, but it never reaches
- * the client.
- */
-async function runHook(hook) {
-    try {
-        return { user: (await hook()) ?? null };
-    }
-    catch (error) {
-        return { user: null, error };
-    }
-}
-/**
- * Decide a login attempt end-to-end (validate body → run hook → mint cookie) with no HTTP types.
- * On success returns the signed cookie value to set plus the sanitized `redirectTo`; the password
- * is forwarded to the hook AS-IS (empty string when blank), so the hook alone decides whether a
- * password is required. `404`-worthy (Mode B not configured) is the provider's call, not this
- * function's — it only runs once the provider has confirmed `auth.login` exists.
- */
-export async function performLogin(auth, body, basePath, now) {
-    const parsed = (body ?? {});
-    if (!isString(parsed.username) || !isString(parsed.password)) {
-        return { kind: 'bad-request', message: 'Body must include string `username` and `password`.' };
-    }
-    const login = auth.login;
-    if (!login) {
-        return { kind: 'unauthorized', message: UNAUTHORIZED_MESSAGE };
-    }
-    const { user, error } = await runHook(() => login(parsed.username, parsed.password));
-    if (!user) {
-        return error !== undefined
-            ? { kind: 'unauthorized', message: UNAUTHORIZED_MESSAGE, hookError: error }
-            : { kind: 'unauthorized', message: UNAUTHORIZED_MESSAGE };
-    }
-    const cookieValue = signSessionCookie(user, {
-        secret: auth.secret,
-        ttlMs: auth.ttlMs,
-        ...(now !== undefined ? { now } : {}),
-    });
-    return { kind: 'ok', cookieValue, redirectTo: sanitizeReturnTo(parsed.returnTo, basePath) };
-}
-/**
- * Decide a Mode A session-mint attempt end-to-end: run the host's `session` hook against the raw
- * platform request, and mint the cookie on success. No body to validate — the hook reads whatever it
- * needs directly off `request` (its own cookie/JWT/header).
- */
-export async function performSession(auth, request, now) {
-    const session = auth.session;
-    if (!session)
-        return { kind: 'unauthorized' };
-    const { user, error } = await runHook(() => session(request));
-    if (!user) {
-        return error !== undefined
-            ? { kind: 'unauthorized', hookError: error }
-            : { kind: 'unauthorized' };
-    }
-    const cookieValue = signSessionCookie(user, {
-        secret: auth.secret,
-        ttlMs: auth.ttlMs,
-        ...(now !== undefined ? { now } : {}),
-    });
-    return { kind: 'ok', cookieValue };
-}
-/**
- * Read + verify a session cookie value, returning the session or `null` when absent, tampered, or
- * expired. Thin wrapper over {@link verifySessionCookie} so the provider never touches crypto.
- */
-export function readSession(auth, cookieValue, now) {
-    if (cookieValue === undefined || cookieValue === '')
-        return null;
-    return verifySessionCookie(cookieValue, {
-        secret: auth.secret,
-        ...(now !== undefined ? { now } : {}),
-    });
-}
-//# sourceMappingURL=auth.js.map

package/dist/src/dashboard/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/dashboard/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AA6E7B,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,cAAc,GAA2B;IAC7C,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,EAAE,GAAG,IAAI;IACZ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACjB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CACvB,CAAC;AAEF,iGAAiG;AACjG,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,cAAc,CAAC;IAClC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC;IAC9C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAyC;IAEzC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+FAA+F;YAC7F,uBAAuB,CAC1B,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,IAAI,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC;QAC/C,KAAK;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAkB,EAAE,QAAgB;IACnE,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,gGAAgG;IAChG,uEAAuE;IACvE,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,OAAO,SAAS,CAAC;AACnB,CAAC;AASD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AACnC,CAAC;AAeD,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAE7D;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CACpB,IAA8E;IAE9E,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAA2B,EAC3B,IAAa,EACb,QAAgB,EAChB,GAAY;IAEZ,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAc,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CACzC,KAAK,CAAC,MAAM,CAAC,QAAkB,EAAE,MAAM,CAAC,QAAkB,CAAC,CAC5D,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE;YAC3E,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,EAAE;QAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;AAC9F,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B,EAC3B,OAAgB,EAChB,GAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC9C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE;YAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,EAAE;QAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,IAA2B,EAC3B,WAA+B,EAC/B,GAAY;IAEZ,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,mBAAmB,CAAC,WAAW,EAAE;QACtC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/dashboard/login_page.d.ts

@@ -1,36 +0,0 @@
-/**
- * The built-in `dashboardAuth` login page (`GET <basePath>/login`). Deliberately a small,
- * dependency-free, hand-authored HTML page — NOT part of the bundled dashboard SPA — so gating the
- * dashboard shell doesn't require rebuilding or extending the bundled SPA.
- *
- * It works WITHOUT JavaScript: the markup is a classic `<form method="post">` carrying `returnTo`
- * in a hidden field, and the provider answers a form-encoded `POST` with a redirect (to `returnTo`
- * on success, back here with `?error` on failure). The inline `<script>` is progressive
- * enhancement only — it swaps the full-page round trip for a JSON `fetch` and shows the error in
- * place — and it carries the request's CSP nonce when the provider hands one over, so a host
- * running `@adonisjs/shield`'s `script-src 'self' @nonce` keeps the enhancement instead of a
- * dead form. The `<style>` takes the same nonce.
- *
- * The only per-request values interpolated are `returnTo` (already passed through
- * {@link sanitizeReturnTo}, so it is a root-relative path) and the `error` flag; both go through
- * {@link escapeHtml} (and `JSON.stringify` inside the script) so nothing in the query string can
- * break out of an attribute or the script. `basePath` is developer-controlled config.
- *
- * The visual language (dark zinc card, mono type, emerald accent) mirrors the Agora consoles so
- * they feel like one family.
- *
- * The password input has NO `required` attribute and the value is forwarded AS-IS (empty string
- * when blank): the host's `login` hook — not this page — decides whether a password matters, so an
- * email-only host (gate on username, ignore password) works with the same page as a host with real
- * passwords.
- */
-export interface LoginPageOptions {
-    /** The request's CSP nonce, applied to the inline `<style>` and `<script>`. */
-    nonce?: string;
-    /** Render the "Invalid username or password." notice (the no-JS failure round trip). */
-    error?: boolean;
-    /** Where to send the operator after a successful sign-in. Sanitized here; default `basePath`. */
-    returnTo?: unknown;
-}
-export declare function renderLoginPage(basePath: string, options?: LoginPageOptions): string;
-//# sourceMappingURL=login_page.d.ts.map

package/dist/src/dashboard/login_page.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"login_page.d.ts","sourceRoot":"","sources":["../../../src/dashboard/login_page.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAkBD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,CA2IxF"}

package/dist/src/dashboard/login_page.js

@@ -1,158 +0,0 @@
-import { escapeHtml } from './access_denied_page.js';
-import { sanitizeReturnTo } from './auth.js';
-/**
- * JSON for embedding INSIDE an inline `<script>`: `JSON.stringify` alone leaves `</script>` (and
- * `<!--`) untouched, and the HTML parser ends the script element on the first `</script>` it sees
- * regardless of JavaScript string boundaries — so a `returnTo` of `/x</script><script>…` would run.
- * Escaping the angle brackets (and `&`, plus the two line terminators JSON allows but JS doesn't)
- * as `\uXXXX` keeps the value byte-identical once parsed and inert to the HTML parser.
- */
-function jsonForScript(value) {
-    return JSON.stringify(value)
-        .replaceAll('<', '\\u003c')
-        .replaceAll('>', '\\u003e')
-        .replaceAll('&', '\\u0026')
-        .replaceAll('\u2028', '\\u2028')
-        .replaceAll('\u2029', '\\u2029');
-}
-export function renderLoginPage(basePath, options = {}) {
-    const loginAction = `${basePath}/login`;
-    const defaultReturnTo = basePath === '' ? '/' : basePath;
-    const returnTo = sanitizeReturnTo(options.returnTo, defaultReturnTo);
-    const nonceAttr = options.nonce !== undefined ? ` nonce="${escapeHtml(options.nonce)}"` : '';
-    const errorStyle = options.error ? ' style="display:block"' : '';
-    return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<meta name="robots" content="noindex, nofollow" />
-<title>Sign in — Durable</title>
-<style${nonceAttr}>
-  :root { color-scheme: dark; }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    min-height: 100vh;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    background: #09090b;
-    color: #e4e4e7;
-    font: 14px/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    padding: 16px;
-  }
-  .card {
-    width: 100%;
-    max-width: 384px;
-    border: 1px solid #27272a;
-    background: #18181b;
-    border-radius: 8px;
-    padding: 32px;
-    box-shadow: 0 25px 50px -12px rgb(0 0 0 / 0.5);
-  }
-  .brand {
-    margin: 0 0 24px;
-    text-align: center;
-    font-size: 18px;
-    font-weight: 600;
-    color: #34d399;
-  }
-  form { display: flex; flex-direction: column; gap: 16px; }
-  label { display: flex; flex-direction: column; gap: 6px; }
-  .field-label {
-    font-size: 11px;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-    color: #71717a;
-  }
-  input {
-    border-radius: 4px;
-    border: 1px solid #3f3f46;
-    background: #09090b;
-    color: #f4f4f5;
-    padding: 8px 12px;
-    font: inherit;
-    outline: none;
-  }
-  input:focus { border-color: rgb(52 211 153 / 0.6); }
-  #error {
-    display: none;
-    margin: 0;
-    font-size: 12px;
-    color: #fb7185;
-  }
-  button {
-    margin-top: 8px;
-    border-radius: 4px;
-    border: 1px solid rgb(52 211 153 / 0.4);
-    background: rgb(52 211 153 / 0.1);
-    color: #6ee7b7;
-    padding: 8px 12px;
-    font: inherit;
-    font-size: 12px;
-    font-weight: 500;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-    cursor: pointer;
-  }
-  button:hover:not(:disabled) { background: rgb(52 211 153 / 0.2); }
-  button:disabled { opacity: 0.6; cursor: default; }
-</style>
-</head>
-<body>
-  <div class="card">
-    <p class="brand">Durable</p>
-    <form id="login-form" method="post" action="${escapeHtml(loginAction)}" autocomplete="on">
-      <input type="hidden" name="returnTo" value="${escapeHtml(returnTo)}" />
-      <label>
-        <span class="field-label">Username</span>
-        <input id="username" name="username" type="text" autocomplete="username" required autofocus />
-      </label>
-      <label>
-        <span class="field-label">Password</span>
-        <input id="password" name="password" type="password" autocomplete="current-password" />
-      </label>
-      <p id="error" role="alert"${errorStyle}>Invalid username or password.</p>
-      <button id="submit" type="submit">Sign in</button>
-    </form>
-  </div>
-<script${nonceAttr}>
-(function () {
-  var LOGIN_ACTION = ${jsonForScript(loginAction)};
-  var RETURN_TO = ${jsonForScript(returnTo)};
-  var errorBox = document.getElementById('error');
-  var form = document.getElementById('login-form');
-  var submitButton = document.getElementById('submit');
-  form.addEventListener('submit', function (event) {
-    event.preventDefault();
-    submitButton.disabled = true;
-    errorBox.style.display = 'none';
-    fetch(LOGIN_ACTION, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json', accept: 'application/json' },
-      credentials: 'same-origin',
-      body: JSON.stringify({
-        username: document.getElementById('username').value,
-        password: document.getElementById('password').value,
-        returnTo: RETURN_TO,
-      }),
-    })
-      .then(function (response) {
-        if (!response.ok) throw new Error('unauthorized');
-        return response.json();
-      })
-      .then(function (data) {
-        window.location.href = data.redirectTo || RETURN_TO;
-      })
-      .catch(function () {
-        errorBox.style.display = 'block';
-        submitButton.disabled = false;
-      });
-  });
-})();
-</script>
-</body>
-</html>`;
-}
-//# sourceMappingURL=login_page.js.map

package/dist/src/dashboard/login_page.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"login_page.js","sourceRoot":"","sources":["../../../src/dashboard/login_page.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAqC7C;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;SAC/B,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAO,GAAqB,EAAE;IAC9E,MAAM,WAAW,GAAG,GAAG,QAAQ,QAAQ,CAAC;IACxC,MAAM,eAAe,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,OAAO;;;;;;;QAOD,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kDA2EiC,UAAU,CAAC,WAAW,CAAC;oDACrB,UAAU,CAAC,QAAQ,CAAC;;;;;;;;;kCAStC,UAAU;;;;SAInC,SAAS;;uBAEK,aAAa,CAAC,WAAW,CAAC;oBAC7B,aAAa,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiCnC,CAAC;AACT,CAAC"}

package/dist/src/dashboard/session_cookie.d.ts

@@ -1,45 +0,0 @@
-/** The validated dashboard session attached to a request once its cookie verifies. */
-export interface DashboardSession {
-    /** Stable user id (the session user's `id`). */
-    sub: string;
-    /** Optional display name. */
-    name?: string;
-    /** Role strings. The dashboard interprets ONE convention on its mutating API routes: a session
-     *  with a NON-EMPTY roles list must include `operator` (or `admin`) to retry/cancel/bulk/
-     *  fix-and-replay/signal/etc — everything else is a viewer. An EMPTY list keeps full access
-     *  (back-compat with host hooks that never set roles). */
-    roles: string[];
-    /** Issued-at, epoch milliseconds. */
-    iat: number;
-    /** Expiry, epoch milliseconds. */
-    exp: number;
-}
-/** The session user the host `login` hook returns to mint a cookie. */
-export interface DashboardSessionUser {
-    id: string;
-    name?: string;
-    roles?: string[];
-}
-export interface SignOptions {
-    secret: string;
-    ttlMs: number;
-    /** Injectable clock (epoch ms) for deterministic tests. Defaults to `Date.now()`. */
-    now?: number;
-}
-export interface VerifyOptions {
-    secret: string;
-    /** Injectable clock (epoch ms) for deterministic tests. Defaults to `Date.now()`. */
-    now?: number;
-}
-/**
- * Sign a session into the cookie value `base64url(payload).base64url(hmac)`. Stateless
- * HMAC-SHA256, no store, `node:crypto` only — no JWT dependency.
- */
-export declare function signSessionCookie(user: DashboardSessionUser, options: SignOptions): string;
-/**
- * Verify a cookie value and return the session, or `null` for anything that's tampered,
- * malformed, or expired (past `exp` + a 30s grace). Constant-time signature comparison. NEVER
- * throws — any parse failure yields `null`.
- */
-export declare function verifySessionCookie(value: string, options: VerifyOptions): DashboardSession | null;
-//# sourceMappingURL=session_cookie.d.ts.map

package/dist/src/dashboard/session_cookie.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session_cookie.d.ts","sourceRoot":"","sources":["../../../src/dashboard/session_cookie.ts"],"names":[],"mappings":"AAcA,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;8DAG0D;IAC1D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAcD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,CAY1F;AAeD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,gBAAgB,GAAG,IAAI,CA4BzB"}

package/dist/src/dashboard/session_cookie.js

@@ -1,97 +0,0 @@
-import { createHmac, timingSafeEqual } from 'node:crypto';
-/**
- * Dependency-free, framework-light signed session cookie for the dashboard's
- * built-in {@link file://./auth.ts dashboardAuth} mechanism. Stateless
- * HMAC-SHA256 over `node:crypto` only (no JWT dependency, no store, no
- * AdonisJS types) — ported verbatim from `@dudousxd/nestjs-durable` so the
- * cookie format is identical across the two dashboards and this stays
- * unit-testable without an `HttpContext`.
- */
-/** Clock-skew grace applied to `exp` so a marginally-late clock doesn't bounce a valid cookie. */
-const EXP_GRACE_MS = 30_000;
-function base64urlEncode(value) {
-    return Buffer.from(value, 'utf8').toString('base64url');
-}
-function base64urlDecode(value) {
-    return Buffer.from(value, 'base64url').toString('utf8');
-}
-function hmac(secret, payload) {
-    return createHmac('sha256', secret).update(payload).digest('base64url');
-}
-/**
- * Sign a session into the cookie value `base64url(payload).base64url(hmac)`. Stateless
- * HMAC-SHA256, no store, `node:crypto` only — no JWT dependency.
- */
-export function signSessionCookie(user, options) {
-    const issuedAt = options.now ?? Date.now();
-    const session = {
-        sub: user.id,
-        ...(user.name !== undefined ? { name: user.name } : {}),
-        roles: user.roles ?? [],
-        iat: issuedAt,
-        exp: issuedAt + options.ttlMs,
-    };
-    const encodedPayload = base64urlEncode(JSON.stringify(session));
-    const signature = hmac(options.secret, encodedPayload);
-    return `${encodedPayload}.${signature}`;
-}
-/** Type guard for the decoded payload shape — defends against tampered/legacy payloads. */
-function isSessionPayload(value) {
-    if (typeof value !== 'object' || value === null)
-        return false;
-    const record = { ...value };
-    if (typeof record.sub !== 'string')
-        return false;
-    if (record.name !== undefined && typeof record.name !== 'string')
-        return false;
-    if (!Array.isArray(record.roles))
-        return false;
-    if (!record.roles.every((role) => typeof role === 'string'))
-        return false;
-    if (typeof record.iat !== 'number' || !Number.isFinite(record.iat))
-        return false;
-    if (typeof record.exp !== 'number' || !Number.isFinite(record.exp))
-        return false;
-    return true;
-}
-/**
- * Verify a cookie value and return the session, or `null` for anything that's tampered,
- * malformed, or expired (past `exp` + a 30s grace). Constant-time signature comparison. NEVER
- * throws — any parse failure yields `null`.
- */
-export function verifySessionCookie(value, options) {
-    try {
-        const dot = value.indexOf('.');
-        if (dot <= 0 || dot === value.length - 1)
-            return null;
-        const encodedPayload = value.slice(0, dot);
-        const providedSignature = value.slice(dot + 1);
-        const expectedSignature = hmac(options.secret, encodedPayload);
-        const provided = Buffer.from(providedSignature, 'base64url');
-        const expected = Buffer.from(expectedSignature, 'base64url');
-        // timingSafeEqual throws on a length mismatch — guard it so a wrong-length (tampered)
-        // signature returns null instead of throwing.
-        if (provided.length !== expected.length)
-            return null;
-        if (!timingSafeEqual(provided, expected))
-            return null;
-        const decoded = JSON.parse(base64urlDecode(encodedPayload));
-        if (!isSessionPayload(decoded))
-            return null;
-        const now = options.now ?? Date.now();
-        if (now > decoded.exp + EXP_GRACE_MS)
-            return null;
-        const session = {
-            sub: decoded.sub,
-            ...(decoded.name !== undefined ? { name: decoded.name } : {}),
-            roles: decoded.roles,
-            iat: decoded.iat,
-            exp: decoded.exp,
-        };
-        return session;
-    }
-    catch {
-        return null;
-    }
-}
-//# sourceMappingURL=session_cookie.js.map