@alxia/react-router 0.12.1 → 0.14.0

package/dist/session/cookies.d.ts

@@ -0,0 +1,60 @@
+export interface SessionCookiesOptions {
+    /**
+     * The base name of the session cookie, e.g. `'my-app_session'`. With
+     * `secure`, the cookie is named `__Host-my-app_session`.
+     */
+    readonly session: string;
+    /**
+     * The base name of the second-factor challenge's cookie. With `secure`, it
+     * is named `__Secure-<name>`.
+     */
+    readonly challenge: string;
+    /**
+     * The app is served over HTTPS. Required, and never read from the
+     * environment: pass `!import.meta.env.DEV`. `false` drops `Secure` and the
+     * prefixes (Safari drops a `Secure` cookie over `http://localhost`).
+     */
+    readonly secure: boolean;
+    /** Where the browser sends the challenge. `'/sign-in'` by default. */
+    readonly challengePath?: string | undefined;
+    /** The most the challenge lives. 300, `@nxgt/janus`'s lifetime, by default. */
+    readonly challengeSeconds?: number | undefined;
+}
+/** What the session cookie holds: the token, and the expiry (ms) it was last set to. */
+export interface CookieSession {
+    readonly token: string;
+    readonly expiresAt: number;
+}
+export interface SessionCookies {
+    /** The names as sent, prefixes included. */
+    readonly names: {
+        readonly session: string;
+        readonly challenge: string;
+    };
+    /** The session cookie of the request; `null` when absent or not `<ms>.<token>`. */
+    read(request: Request): CookieSession | null;
+    /** The session token of the request, or `null`. */
+    token(request: Request): string | null;
+    /** A `Set-Cookie` value keeping `token` until `expiresAt`. */
+    commit(token: string, expiresAt: string | Date, now?: number): string;
+    /** A `Set-Cookie` value removing the session cookie. */
+    destroy(): string;
+    /** The `Set-Cookie` header that keeps the cookie as long as the session lives; empty when the expiry did not move, or is absent or not a date. */
+    refreshed(session: CookieSession, expiresAt: string | Date | null): HeadersInit;
+    /** The challenge cookie of the request, or `null`. */
+    challengeOf(request: Request): string | null;
+    /** A `Set-Cookie` value keeping the challenge for the code page. */
+    commitChallenge(challenge: string, expiresAt?: string | Date | null, now?: number): string;
+    /** A `Set-Cookie` value removing the challenge. */
+    destroyChallenge(): string;
+    /**
+     * What a signed-out visit of the sign-in page sets: the challenge cleared
+     * blind (a client navigation fetches `/sign-in.data`, which the cookie's
+     * path does not match, so the request never shows it), and a dead
+     * session's cookie when `deadSession`.
+     */
+    signInPageHeaders(deadSession: boolean): Headers;
+}
+/** The cookies of a BFF's session and of its second-factor challenge. */
+export declare function sessionCookies(options: SessionCookiesOptions): SessionCookies;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/session/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/session/cookies.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,qBAAqB;IACrC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,+EAA+E;IAC/E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AAED,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC9B,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE,mFAAmF;IACnF,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAAC;IAC7C,mDAAmD;IACnD,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,8DAA8D;IAC9D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACtE,wDAAwD;IACxD,OAAO,IAAI,MAAM,CAAC;IAClB,kJAAkJ;IAClJ,SAAS,CACR,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,GAC7B,WAAW,CAAC;IACf,sDAAsD;IACtD,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;IAC7C,oEAAoE;IACpE,eAAe,CACd,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,EAChC,GAAG,CAAC,EAAE,MAAM,GACV,MAAM,CAAC;IACV,mDAAmD;IACnD,gBAAgB,IAAI,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,iBAAiB,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC;CACjD;AAiBD,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CA6E7E"}

package/dist/session/flow-types.d.ts

@@ -0,0 +1,178 @@
+import type { data } from 'react-router';
+import type { ApiErrorLike } from '../errors/api-error';
+import type { ApiErrors } from '../errors/api-errors';
+import type { JsonActions } from '../errors/json-actions';
+import type { SessionCookies } from './cookies';
+import type { SecondFactorKind, SignInPaths, SignInStatus } from './model';
+/**
+ * What a sign-in step answers, in `@nxgt/janus`'s words. An app maps its
+ * API's enums to it, once: `SIGNED_IN` to `signedIn`, `SECOND_FACTOR` to
+ * `secondFactor`, and anything else (such as a `LINKED`) to `other`.
+ */
+export type SignInAnswer = {
+    readonly status: 'signedIn';
+    readonly token: string;
+    readonly expiresAt: string | Date;
+} | {
+    readonly status: 'secondFactor';
+    /** A secret: it goes in the challenge cookie, never in a URL. */
+    readonly challenge: string;
+    readonly expiresAt?: string | Date | null | undefined;
+} | {
+    readonly status: 'other';
+};
+/** What a sign-in form's action answers when it stays on the page. */
+export type SignInFormError<T = object> = T & {
+    formError: string;
+};
+/** The codes the flow tells apart; `@nxgt/janus`'s by default. */
+export interface SignInCodes {
+    /** A wrong code that may leave tries (`'CODE_INVALID'`). */
+    readonly invalidCode?: string | undefined;
+    /** The codes that end the challenge (`TOKEN_UNKNOWN`, `TOKEN_SPENT`, `TOKEN_EXPIRED`). */
+    readonly challengeOver?: readonly string[] | undefined;
+}
+export interface SignInFlowOptions<L extends string> {
+    readonly cookies: SessionCookies;
+    /** The app's `createApiErrors` instance. */
+    readonly errors: ApiErrors<L>;
+    /** The app's `jsonActions({ origin })`, so a body is read with the same CSRF check. */
+    readonly json: JsonActions;
+    /** Ends a session at the API (the app's sign-out mutation); a failure is ignored. */
+    revoke(token: string, request: Request): Promise<unknown>;
+    /** A refused code's tries left, worded ("3 tries left"). */
+    attemptsLeft(count: number, language: L): string;
+    /** The sign-in pages' paths; `SIGN_IN_PATHS` by default. */
+    readonly paths?: Partial<SignInPaths> | undefined;
+    /**
+     * `Set-Cookie` values a new session and a sign-out also clear, such as an
+     * app's per-account preferences.
+     */
+    readonly clear?: (() => readonly string[]) | undefined;
+    /** What a sign-in says when the API cannot be reached; `errors.unavailableMessage` by default. */
+    readonly unavailable?: ((language: L) => string) | undefined;
+    readonly codes?: SignInCodes | undefined;
+    /**
+     * The query key a sign-in redirect adds (as `?expired=1`) when the request
+     * carried a session cookie, to say the session ended. Off by default.
+     */
+    readonly endedParam?: string | undefined;
+}
+/** A form step's answer when it stays on the page: the form's message, with a status. */
+export type SignInStayed<T extends object> = ReturnType<typeof data<SignInFormError<T>>>;
+export interface SignInFlow<L extends string> {
+    /** The cookies the flow was built with. */
+    readonly cookies: SessionCookies;
+    /** The `createApiErrors` instance the flow was built with. */
+    readonly errors: ApiErrors<L>;
+    /** The `jsonActions` instance the flow was built with. */
+    readonly json: JsonActions;
+    /** A refused code's tries left, worded (the `attemptsLeft` option). */
+    attemptsLeft(count: number, language: L): string;
+    /**
+     * The guard every step of the flow that signs in, out, spends or mails
+     * runs first, for an app's own step (a passkey's): a native form post is
+     * redirected back to its page, and a JSON post from another site is a 403
+     * (`Origin` and `Sec-Fetch-Site`, as `readJson` reads them). It reads
+     * headers only. Call it in a POST action, never in a GET callback, which
+     * carries no JSON content type and would be redirected to itself.
+     */
+    guard(request: Request): void;
+    /** What a sign-in says when the API cannot be reached: the `unavailable` option, else `errors.unavailableMessage`. */
+    unavailable(language: L): string;
+    /** The `Set-Cookie` values a new session and a sign-out also clear (the `clear` option); none by default. */
+    clear(): readonly string[];
+    /** The `next` a sign-in page was opened with, safe to redirect to. */
+    nextParam(request: Request): string;
+    /** The sign-in page, coming back to this request's page, with the session cookie cleared. */
+    signInRedirect(request: Request): Response;
+    /**
+     * Where an answer leads: signed in, to `next` with the session cookie and
+     * the challenge cleared; a second factor, to its page with the challenge
+     * in its cookie. `null` for any other answer.
+     */
+    landing(answer: SignInAnswer, next: string): Response | null;
+    /**
+     * `landing`, ending the session the browser held first, when the answer's
+     * status is in `revokeOn` (a new session only, by default).
+     */
+    landReplacing(answer: SignInAnswer, next: string, options: {
+        readonly request: Request;
+        readonly revokeOn?: readonly SignInStatus[] | undefined;
+    }): Promise<Response | null>;
+    /**
+     * Runs a sign-in step and redirects where its answer leads. An API
+     * refusal is the form's message with its status; an API it cannot reach
+     * says `unavailable` with a 503.
+     */
+    signInStep<T extends object>(run: () => Promise<SignInAnswer>, options: {
+        readonly request: Request;
+        readonly language: L;
+        readonly next: string;
+        /** Fields every refusal carries. */
+        readonly extra: T;
+        /** Answers an error before the default message: a redirect, a richer message. */
+        readonly refused?: ((error: ApiErrorLike) => Response | string | undefined) | undefined;
+    }): Promise<Response | SignInStayed<T>>;
+    /**
+     * A refused code's message with the tries left; `undefined` when the
+     * challenge is over (sign in again). With no try left, `whenNone` is
+     * added to the message instead, when given.
+     */
+    codeRefusal(error: ApiErrorLike, language: L, whenNone?: string): string | undefined;
+    /** The code a second-factor page posted, with how it is given; a 400 otherwise. */
+    readCodeInput(request: Request): Promise<{
+        kind: SecondFactorKind;
+        code: string;
+    }>;
+    /** The code against the challenge: `confirm` for an issued code, `recover` for a recovery code. */
+    codeStep(input: {
+        readonly kind: SecondFactorKind;
+        readonly code: string;
+    }, challenge: string, steps: {
+        confirm(challenge: string, code: string): Promise<SignInAnswer>;
+        recover(challenge: string, code: string): Promise<SignInAnswer>;
+    }): Promise<SignInAnswer>;
+    /** Ends the request's session at the API; true when it carried one. */
+    revokeSession(request: Request): Promise<boolean>;
+    /**
+     * Revokes the session, clears its cookies and redirects (to the sign-in
+     * page with `?signed-out=1` by default; `to` goes through `safeNext`). It
+     * reads the body as JSON first, so another site cannot sign anyone out.
+     */
+    signOut(request: Request, options?: {
+        readonly to?: string | undefined;
+    }): Promise<Response>;
+    /**
+     * The viewer `read` finds for the session cookie's token (or `token`):
+     * `null` when the API refuses it with a 401, `undefined` without a cookie
+     * or when the API cannot tell.
+     */
+    viewer<V>(request: Request, read: (token: string) => Promise<V | null>, token?: string): Promise<V | null | undefined>;
+    /**
+     * The signed-in viewer, else the sign-in redirect (thrown): no cookie, a
+     * 401, or no viewer. Any other failure is thrown through `routeError`.
+     * `headers` set the cookie again when the API moved the session's end.
+     */
+    requireViewer<V>(request: Request, read: (token: string) => Promise<V | null>, expiresAt: (viewer: V) => string | null): Promise<{
+        viewer: V;
+        headers: HeadersInit;
+    }>;
+}
+/** The options once resolved, as the flow's functions take them. */
+export interface FlowContext<L extends string> {
+    readonly options: SignInFlowOptions<L>;
+    readonly paths: SignInPaths;
+    readonly invalidCode: string;
+    readonly challengeOver: readonly string[];
+}
+/**
+ * What `codeRefusal` reads of the flow: the wording, and the codes it tells
+ * apart. A `FlowContext` is one; so is what `stepUpSteps` builds.
+ */
+export interface CodeWording<L extends string> {
+    readonly options: Pick<SignInFlowOptions<L>, 'errors' | 'attemptsLeft'>;
+    readonly invalidCode: string;
+    readonly challengeOver: readonly string[];
+}
+//# sourceMappingURL=flow-types.d.ts.map

package/dist/session/flow-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-types.d.ts","sourceRoot":"","sources":["../../src/session/flow-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE3E;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACrB;IACA,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,GACD;IACA,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;CACrD,GACD;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AAEhC,sEAAsE;AACtE,MAAM,MAAM,eAAe,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,kEAAkE;AAClE,MAAM,WAAW,WAAW;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,0FAA0F;IAC1F,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACvD;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC,SAAS,MAAM;IAClD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,qFAAqF;IACrF,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,4DAA4D;IAC5D,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC;IACjD,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,SAAS,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC;IACvD,kGAAkG;IAClG,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAED,yFAAyF;AACzF,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,MAAM,IAAI,UAAU,CACtD,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAC/B,CAAC;AAEF,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,MAAM;IAC3C,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,uEAAuE;IACvE,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC;IACjD;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,sHAAsH;IACtH,WAAW,CAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC;IACjC,6GAA6G;IAC7G,KAAK,IAAI,SAAS,MAAM,EAAE,CAAC;IAC3B,sEAAsE;IACtE,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IACpC,6FAA6F;IAC7F,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC3C;;;;OAIG;IACH,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC7D;;;OAGG;IACH,aAAa,CACZ,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;QACR,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;KACxD,GACC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC5B;;;;OAIG;IACH,UAAU,CAAC,CAAC,SAAS,MAAM,EAC1B,GAAG,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,EAChC,OAAO,EAAE;QACR,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,oCAAoC;QACpC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAClB,iFAAiF;QACjF,QAAQ,CAAC,OAAO,CAAC,EACd,CAAC,CAAC,KAAK,EAAE,YAAY,KAAK,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC,GACxD,SAAS,CAAC;KACb,GACC,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC;;;;OAIG;IACH,WAAW,CACV,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,CAAC,EACX,QAAQ,CAAC,EAAE,MAAM,GACf,MAAM,GAAG,SAAS,CAAC;IACtB,mFAAmF;IACnF,aAAa,CACZ,OAAO,EAAE,OAAO,GACd,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD,mGAAmG;IACnG,QAAQ,CACP,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EACjE,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;QACN,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QAChE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;KAChE,GACC,OAAO,CAAC,YAAY,CAAC,CAAC;IACzB,uEAAuE;IACvE,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD;;;;OAIG;IACH,OAAO,CACN,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAC5C,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,CAAC,EACP,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,EAC1C,KAAK,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACjC;;;;OAIG;IACH,aAAa,CAAC,CAAC,EACd,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,EAC1C,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,GAAG,IAAI,GACrC,OAAO,CAAC;QAAE,MAAM,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,oEAAoE;AACpE,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,MAAM;IAC5C,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,MAAM;IAC5C,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAC,CAAC;IACxE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C"}

package/dist/session/guard.d.ts

@@ -0,0 +1,10 @@
+import type { JsonActions } from '../errors/json-actions';
+/**
+ * What every step that signs in, out, spends or mails runs first: a native
+ * form post (before hydration) goes back to its page, which then posts JSON
+ * (`json.requireJsonPost`), and a request from another site is a 403 even
+ * when it is JSON (the `Origin` and `Sec-Fetch-Site` rule of `readJson`). It
+ * reads headers only, never the body.
+ */
+export declare function samesitePost(json: JsonActions, request: Request): void;
+//# sourceMappingURL=guard.d.ts.map

package/dist/session/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/session/guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAGtE"}

package/dist/session/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `@alxia/react-router/session`: the session of a BFF, the app that renders
+ * pages over a GraphQL API and keeps the API's session token in its own
+ * cookie. The subpath may import `react-router` and `/errors`' files,
+ * nothing else.
+ */
+export { CHALLENGE_OVER, INVALID_CODE, MAIL_THROTTLED } from './codes';
+export { type CookieSession, type SessionCookies, type SessionCookiesOptions, sessionCookies, } from './cookies';
+export type { SignInAnswer, SignInCodes, SignInFlow, SignInFlowOptions, SignInFormError, SignInStayed, } from './flow-types';
+export { TOKEN_PAGE_HEADERS } from './link-token';
+export type { AuthLinks, AuthLinksCodes, AuthLinksOptions, LinkStayed, RequestLinkAnswer, SpendOptions, Spent, } from './link-types';
+export { authLinks } from './links';
+export { readCookie, type SerializeOptions, secondsUntil, serializeCookie, } from './serialize';
+export { signInFlow } from './sign-in';
+export { stepUpSteps } from './step-up';
+export { STEP_UP_OVER, STEP_UP_REQUIRED } from './step-up-codes';
+export type { StepUpCall, StepUpCodes, StepUpStayed, StepUpSteps, StepUpStepsOptions, } from './step-up-types';
+//# sourceMappingURL=index.d.ts.map

package/dist/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EACN,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,cAAc,GACd,MAAM,WAAW,CAAC;AACnB,YAAY,EACX,YAAY,EACZ,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,YAAY,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,YAAY,EACX,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,KAAK,GACL,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EACN,UAAU,EACV,KAAK,gBAAgB,EACrB,YAAY,EACZ,eAAe,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACjE,YAAY,EACX,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,kBAAkB,GAClB,MAAM,iBAAiB,CAAC"}