@atlasauth/backend 0.23.0 → 0.25.0

package/dist/framework-bridge.js

@@ -0,0 +1,264 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FRAMEWORK_BRIDGE_PRESETS = exports.BRIDGE_ASSERTION_TTL_SECONDS = void 0;
+exports.bridgeAssertionIssuer = bridgeAssertionIssuer;
+exports.signBridgeAssertion = signBridgeAssertion;
+exports.authJsExtractor = authJsExtractor;
+exports.expressSessionExtractor = expressSessionExtractor;
+exports.ironSessionExtractor = ironSessionExtractor;
+exports.deviseExtractor = deviseExtractor;
+exports.djangoSignedCookieExtractor = djangoSignedCookieExtractor;
+const jose_1 = require("jose");
+const framework_sessions_1 = require("./framework-sessions");
+const migration_presets_1 = require("./migration-presets");
+/**
+ * Zero-logout bridge for the SELF-HOSTED frameworks (Auth.js, Lucia,
+ * Passport, iron-session, Devise, Django): their presets, and the token
+ * extractors `migrationBridge({ extractToken })` takes.
+ *
+ * Two families:
+ *
+ *   - Database sessions (Auth.js database strategy, Lucia, express-session
+ *     stores, Django's database backend, Rails' activerecord-session_store):
+ *     preset mode `session_table`. The cookie carries an opaque id; Atlas finds
+ *     sha256(id) among the sessions you imported. Lucia, Auth.js and Django
+ *     cookies are read as they are; express-session's cookie is signed
+ *     (`s:<id>.<signature>`), so {@link expressSessionExtractor} pulls the id out.
+ *
+ *   - Sealed cookies (Auth.js JWT strategy, iron-session, Rails' cookie store
+ *     under Devise, Django's signed-cookie backend): there is no session row to
+ *     import — the cookie IS the session, and only your app's secret opens it.
+ *     The extractor opens it ON YOUR SERVER and hands Atlas a short-lived
+ *     BRIDGE ASSERTION instead: an HS256 JWT (`iss` = `urn:atlas:bridge:<source>`,
+ *     `sub` = the user id you exported, `jti` = the old session's id) signed
+ *     with a bridge secret you generate and store in the bridge settings
+ *     (`shared_secret`). Your AUTH_SECRET / secret_key_base / SECRET_KEY /
+ *     iron password never leave your server; Atlas verifies the assertion,
+ *     spends its `jti` once, and signs the user in.
+ */
+/** The issuer of a bridge assertion for a source. */
+function bridgeAssertionIssuer(source) {
+    return `urn:atlas:bridge:${source}`;
+}
+/** Lifetime of a bridge assertion: it is exchanged immediately, once. */
+exports.BRIDGE_ASSERTION_TTL_SECONDS = 120;
+/** Sign a bridge assertion with the bridge secret (HS256). */
+async function signBridgeAssertion(assertion, bridgeSecret, now = new Date()) {
+    if (!bridgeSecret || bridgeSecret.length < 32)
+        throw new Error('The bridge secret must be at least 32 characters (generate one with `openssl rand -base64 48`).');
+    const iat = Math.floor(now.getTime() / 1000);
+    return new jose_1.SignJWT({
+        ...(assertion.email ? { email: assertion.email } : {}),
+        ...(assertion.name ? { name: assertion.name } : {}),
+        ...(assertion.mfa ? { amr: ['pwd', 'mfa'] } : {}),
+    })
+        .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
+        .setIssuer(bridgeAssertionIssuer(assertion.source))
+        .setSubject(assertion.sub)
+        .setJti(assertion.sessionKey)
+        .setIssuedAt(iat)
+        .setExpirationTime(iat + exports.BRIDGE_ASSERTION_TTL_SECONDS)
+        .sign(new TextEncoder().encode(bridgeSecret));
+}
+async function sha256Hex(value) {
+    const d = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value)));
+    return Array.from(d, (b) => b.toString(16).padStart(2, '0')).join('');
+}
+// ── extractors ──────────────────────────────────────────────────────────────
+/**
+ * Auth.js / NextAuth, either session strategy. A database-session cookie is
+ * returned as it is (preset `authjs`); a JWT-strategy cookie is decrypted with
+ * `secret` (AUTH_SECRET / NEXTAUTH_SECRET, or the rotation list) and turned
+ * into a bridge assertion (preset `authjs_jwt`, needs `bridgeSecret`).
+ */
+function authJsExtractor(options) {
+    return async ({ cookies }) => {
+        const found = (0, framework_sessions_1.readAuthJsSessionCookie)(cookies, { cookieName: options.cookieName });
+        if (!found)
+            return undefined;
+        const kind = (0, framework_sessions_1.authJsSessionTokenKind)(found.value);
+        if (kind === 'database')
+            return decodeURIComponent(found.value);
+        if (kind !== 'jwt' || !options.secret || !options.bridgeSecret)
+            return undefined;
+        const claims = await (0, framework_sessions_1.decodeAuthJsSessionToken)(found.value, { secret: options.secret, salt: found.name });
+        if (!claims?.sub)
+            return undefined;
+        return signBridgeAssertion({
+            source: 'authjs',
+            sub: claims.sub,
+            sessionKey: typeof claims.jti === 'string' && claims.jti ? claims.jti : await sha256Hex(found.value),
+            email: claims.email ?? null,
+            name: claims.name ?? null,
+        }, options.bridgeSecret);
+    };
+}
+/**
+ * Passport / express-session: the session id out of the signed `connect.sid`
+ * cookie (preset `passport`). Pass `secrets` (your `session({ secret })`) to
+ * check the signature as express-session does.
+ */
+function expressSessionExtractor(options = {}) {
+    return async ({ cookies }) => {
+        const raw = cookies[options.cookieName ?? framework_sessions_1.EXPRESS_SESSION_COOKIE];
+        if (!raw)
+            return undefined;
+        return (await (0, framework_sessions_1.unsignExpressSessionCookie)(raw, options.secrets)) ?? undefined;
+    };
+}
+/**
+ * iron-session: unseal the cookie with your session password and assert the
+ * user at `userIdPath` (default: `userId`, then `user.id`, then `id`).
+ */
+function ironSessionExtractor(options) {
+    return async ({ cookies }) => {
+        const raw = cookies[options.cookieName];
+        if (!raw)
+            return undefined;
+        const data = await (0, framework_sessions_1.unsealIronSession)(raw, options.password);
+        if (!data)
+            return undefined;
+        const sub = options.userIdPath
+            ? (0, framework_sessions_1.sessionValueAt)(data, options.userIdPath)
+            : ((0, framework_sessions_1.sessionValueAt)(data, 'userId') ?? (0, framework_sessions_1.sessionValueAt)(data, 'user.id') ?? (0, framework_sessions_1.sessionValueAt)(data, 'id'));
+        if (!sub)
+            return undefined;
+        return signBridgeAssertion({
+            source: 'iron_session',
+            sub,
+            sessionKey: await sha256Hex(raw),
+            email: (0, framework_sessions_1.sessionValueAt)(data, options.emailPath ?? 'user.email') ?? (0, framework_sessions_1.sessionValueAt)(data, 'email'),
+        }, options.bridgeSecret);
+    };
+}
+/**
+ * Devise on Rails' cookie store: decrypt `_<app>_session` with
+ * `secret_key_base` and assert the Warden user (`scope`, default `user`).
+ */
+function deviseExtractor(options) {
+    return async ({ cookies }) => {
+        const raw = cookies[options.cookieName];
+        if (!raw)
+            return undefined;
+        const session = await (0, framework_sessions_1.decryptRailsCookie)(raw, {
+            secretKeyBase: options.secretKeyBase,
+            cookieName: options.cookieName,
+            ...(options.keyDigest ? { keyDigest: options.keyDigest } : {}),
+        });
+        const user = session ? (0, framework_sessions_1.deviseSessionUser)(session, options.scope) : null;
+        if (!user)
+            return undefined;
+        const sid = typeof session.session_id === 'string' && session.session_id ? session.session_id : await sha256Hex(raw);
+        return signBridgeAssertion({ source: 'devise', sub: user.id, sessionKey: sid }, options.bridgeSecret);
+    };
+}
+/**
+ * Django's signed-cookie session backend: verify the cookie with SECRET_KEY
+ * (then SECRET_KEY_FALLBACKS) and assert `_auth_user_id`.
+ */
+function djangoSignedCookieExtractor(options) {
+    return async ({ cookies }) => {
+        const raw = cookies[options.cookieName ?? framework_sessions_1.DJANGO_SESSION_COOKIE];
+        if (!raw)
+            return undefined;
+        const data = await (0, framework_sessions_1.decodeDjangoSignedCookie)(raw, { secretKey: options.secretKey, maxAgeSeconds: options.maxAgeSeconds ?? 1209600 });
+        const user = data ? (0, framework_sessions_1.djangoSessionUser)(data) : null;
+        if (!user)
+            return undefined;
+        return signBridgeAssertion({ source: 'django', sub: user.id, sessionKey: await sha256Hex(raw) }, options.bridgeSecret);
+    };
+}
+// ── presets ─────────────────────────────────────────────────────────────────
+const AUTHJS_COOKIES = [...framework_sessions_1.AUTHJS_SESSION_COOKIES];
+const AUTHJS_CLEAR = [
+    ...framework_sessions_1.AUTHJS_SESSION_COOKIES.map((c) => `${c}*`),
+    '__Host-authjs.csrf-token',
+    'authjs.csrf-token',
+    '__Secure-authjs.callback-url',
+    'authjs.callback-url',
+    '__Host-next-auth.csrf-token',
+    'next-auth.csrf-token',
+    '__Secure-next-auth.callback-url',
+    'next-auth.callback-url',
+];
+/** A sealed-cookie preset: Atlas verifies the bridge assertion with the stored shared secret. */
+function assertionPreset(id, source, label, cookies, extra) {
+    return {
+        id,
+        label,
+        mode: 'jwt',
+        jwt: {
+            issuer: bridgeAssertionIssuer(source),
+            algorithms: ['HS256'],
+            allowSharedSecret: true,
+            claims: { subject: 'sub', email: 'email', name: 'name', sessionKey: 'jti', mfa: 'amr:mfa' },
+        },
+        cookies,
+        ...extra,
+    };
+}
+const FRAMEWORK_PRESETS = [
+    {
+        id: 'authjs',
+        label: 'Auth.js (database sessions)',
+        mode: 'session_table',
+        cookies: AUTHJS_COOKIES,
+        clearCookies: AUTHJS_CLEAR,
+        notes: 'Database strategy: the cookie is the sessionToken your adapter stored; import the sessions table. With the JWT strategy use the authjs_jwt preset.',
+    },
+    assertionPreset('authjs_jwt', 'authjs', 'Auth.js (JWT sessions)', AUTHJS_COOKIES, {
+        clearCookies: AUTHJS_CLEAR,
+        notes: 'The cookie is a JWE encrypted with AUTH_SECRET. Pass authJsExtractor({ secret: AUTH_SECRET, bridgeSecret }) to the middleware: it decrypts the cookie on your server and sends a one-time bridge assertion signed with the bridge secret stored in these settings.',
+    }),
+    {
+        id: 'lucia',
+        label: 'Lucia',
+        mode: 'session_table',
+        defaults: { cookie_name: framework_sessions_1.LUCIA_SESSION_COOKIE },
+        cookies: ['{cookie_name}'],
+        notes: 'The cookie holds the session token; the export hashes v2/v3 session ids, and reads guide-style sessions (id = sha256 of the token) as they are.',
+    },
+    {
+        id: 'passport',
+        label: 'Passport.js (express-session)',
+        mode: 'session_table',
+        defaults: { cookie_name: framework_sessions_1.EXPRESS_SESSION_COOKIE },
+        cookies: ['{cookie_name}'],
+        notes: 'The connect.sid cookie is signed (s:<id>.<signature>): pass expressSessionExtractor() to the middleware so Atlas gets the session id. Import the sessions from your express-session store.',
+    },
+    assertionPreset('iron_session', 'iron_session', 'iron-session', ['{cookie_name}'], {
+        vars: { cookie_name: 'The iron-session cookieName' },
+        notes: 'Pass ironSessionExtractor({ cookieName, password, bridgeSecret }) to the middleware: it unseals the cookie with your session password on your server.',
+    }),
+    assertionPreset('devise', 'devise', 'Devise (Rails cookie store)', ['{cookie_name}'], {
+        vars: { cookie_name: 'The Rails session cookie (_yourapp_session)' },
+        clearCookies: ['{cookie_name}', 'remember_user_token'],
+        notes: 'Pass deviseExtractor({ cookieName, secretKeyBase, bridgeSecret }) to the middleware (Node in front of, or beside, the Rails app): it decrypts the session cookie with secret_key_base on your server. JSON cookie serializer only.',
+    }),
+    {
+        id: 'devise_active_record',
+        label: 'Devise (activerecord-session_store)',
+        mode: 'session_table',
+        vars: { cookie_name: 'The Rails session cookie (_yourapp_session)' },
+        cookies: ['{cookie_name}'],
+        clearCookies: ['{cookie_name}', 'remember_user_token'],
+        notes: 'The cookie holds the public session id; Atlas matches sha256 of it, which is the private id Rack stored.',
+    },
+    {
+        id: 'django',
+        label: 'Django (database sessions)',
+        mode: 'session_table',
+        defaults: { cookie_name: framework_sessions_1.DJANGO_SESSION_COOKIE },
+        cookies: ['{cookie_name}'],
+        notes: 'The sessionid cookie is the django_session key; import sessions.session with the export.',
+    },
+    assertionPreset('django_signed_cookies', 'django', 'Django (signed-cookie sessions)', ['{cookie_name}'], {
+        defaults: { cookie_name: framework_sessions_1.DJANGO_SESSION_COOKIE },
+        notes: 'Pass djangoSignedCookieExtractor({ secretKey: SECRET_KEY, bridgeSecret }) to the middleware: it verifies the cookie with SECRET_KEY on your server.',
+    }),
+];
+for (const preset of FRAMEWORK_PRESETS)
+    (0, migration_presets_1.registerMigrationBridgePreset)(preset, { replace: true });
+/** The preset ids this module registers (for docs and the settings UI). */
+exports.FRAMEWORK_BRIDGE_PRESETS = FRAMEWORK_PRESETS.map((p) => p.id);
+//# sourceMappingURL=framework-bridge.js.map

package/dist/framework-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-bridge.js","sourceRoot":"","sources":["../src/framework-bridge.ts"],"names":[],"mappings":";;;AA+CA,sDAEC;AAkBD,kDAeC;AAeD,0CAwBC;AAOD,0DAMC;AAMD,oDA0BC;AAMD,0CAoBC;AAMD,kEAeC;AArND,+BAA+B;AAC/B,6DAe8B;AAE9B,2DAAgG;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,qDAAqD;AACrD,SAAgB,qBAAqB,CAAC,MAAc;IAClD,OAAO,oBAAoB,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,yEAAyE;AAC5D,QAAA,4BAA4B,GAAG,GAAG,CAAC;AAchD,8DAA8D;AACvD,KAAK,UAAU,mBAAmB,CAAC,SAA0B,EAAE,YAAoB,EAAE,MAAY,IAAI,IAAI,EAAE;IAChH,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;IAClK,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,OAAO,IAAI,cAAO,CAAC;QACjB,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAChD,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;SAClD,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;SACzB,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;SAC5B,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,GAAG,oCAA4B,CAAC;SACrD,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACpC,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,OAI/B;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAAA,4CAAuB,EAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,2CAAsB,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QACjF,MAAM,MAAM,GAAG,MAAM,IAAA,6CAAwB,EAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM,EAAE,GAAG;YAAE,OAAO,SAAS,CAAC;QACnC,OAAO,mBAAmB,CACxB;YACE,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,UAAU,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YACpG,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;SAC1B,EACD,OAAO,CAAC,YAAY,CACrB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,UAAyE,EAAE;IACjH,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,2CAAsB,CAAC,CAAC;QAClE,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,CAAC,MAAM,IAAA,+CAA0B,EAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,SAAS,CAAC;IAC/E,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAMpC;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAA,sCAAiB,EAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU;YAC5B,CAAC,CAAC,IAAA,mCAAc,EAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;YAC1C,CAAC,CAAC,CAAC,IAAA,mCAAc,EAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAA,mCAAc,EAAC,IAAI,EAAE,SAAS,CAAC,IAAI,IAAA,mCAAc,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,mBAAmB,CACxB;YACE,MAAM,EAAE,cAAc;YACtB,GAAG;YACH,UAAU,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC;YAChC,KAAK,EAAE,IAAA,mCAAc,EAAC,IAAI,EAAE,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC,IAAI,IAAA,mCAAc,EAAC,IAAI,EAAE,OAAO,CAAC;SAChG,EACD,OAAO,CAAC,YAAY,CACrB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,OAM/B;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAA,uCAAkB,EAAC,GAAG,EAAE;YAC5C,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,sCAAiB,EAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,OAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,OAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACxH,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxG,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,OAM3C;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,0CAAqB,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAA,6CAAwB,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,OAAO,EAAE,CAAC,CAAC;QACpI,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAA,sCAAiB,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACzH,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,MAAM,cAAc,GAAG,CAAC,GAAG,2CAAsB,CAAC,CAAC;AACnD,MAAM,YAAY,GAAG;IACnB,GAAG,2CAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7C,0BAA0B;IAC1B,mBAAmB;IACnB,8BAA8B;IAC9B,qBAAqB;IACrB,6BAA6B;IAC7B,sBAAsB;IACtB,iCAAiC;IACjC,wBAAwB;CACzB,CAAC;AAEF,iGAAiG;AACjG,SAAS,eAAe,CAAC,EAAU,EAAE,MAAc,EAAE,KAAa,EAAE,OAAiB,EAAE,KAAqC;IAC1H,OAAO;QACL,EAAE;QACF,KAAK;QACL,IAAI,EAAE,KAAK;QACX,GAAG,EAAE;YACH,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;YACrC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,iBAAiB,EAAE,IAAI;YACvB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE;SAC5F;QACD,OAAO;QACP,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAA4B;IACjD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,cAAc;QACvB,YAAY,EAAE,YAAY;QAC1B,KAAK,EAAE,oJAAoJ;KAC5J;IACD,eAAe,CAAC,YAAY,EAAE,QAAQ,EAAE,wBAAwB,EAAE,cAAc,EAAE;QAChF,YAAY,EAAE,YAAY;QAC1B,KAAK,EACH,oQAAoQ;KACvQ,CAAC;IACF;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE,WAAW,EAAE,yCAAoB,EAAE;QAC/C,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,KAAK,EAAE,iJAAiJ;KACzJ;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,+BAA+B;QACtC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE,WAAW,EAAE,2CAAsB,EAAE;QACjD,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,KAAK,EAAE,4LAA4L;KACpM;IACD,eAAe,CAAC,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,eAAe,CAAC,EAAE;QACjF,IAAI,EAAE,EAAE,WAAW,EAAE,6BAA6B,EAAE;QACpD,KAAK,EAAE,uJAAuJ;KAC/J,CAAC;IACF,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,6BAA6B,EAAE,CAAC,eAAe,CAAC,EAAE;QACpF,IAAI,EAAE,EAAE,WAAW,EAAE,6CAA6C,EAAE;QACpE,YAAY,EAAE,CAAC,eAAe,EAAE,qBAAqB,CAAC;QACtD,KAAK,EAAE,oOAAoO;KAC5O,CAAC;IACF;QACE,EAAE,EAAE,sBAAsB;QAC1B,KAAK,EAAE,qCAAqC;QAC5C,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,EAAE,WAAW,EAAE,6CAA6C,EAAE;QACpE,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,YAAY,EAAE,CAAC,eAAe,EAAE,qBAAqB,CAAC;QACtD,KAAK,EAAE,0GAA0G;KAClH;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE,WAAW,EAAE,0CAAqB,EAAE;QAChD,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,KAAK,EAAE,0FAA0F;KAClG;IACD,eAAe,CAAC,uBAAuB,EAAE,QAAQ,EAAE,iCAAiC,EAAE,CAAC,eAAe,CAAC,EAAE;QACvG,QAAQ,EAAE,EAAE,WAAW,EAAE,0CAAqB,EAAE;QAChD,KAAK,EAAE,qJAAqJ;KAC7J,CAAC;CACH,CAAC;AAEF,KAAK,MAAM,MAAM,IAAI,iBAAiB;IAAE,IAAA,iDAA6B,EAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAEjG,2EAA2E;AAC9D,QAAA,wBAAwB,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC"}

package/dist/framework-sessions.d.ts

@@ -0,0 +1,147 @@
+/** Auth.js v5 (`@auth/core`) and NextAuth v4 session cookie names, `__Secure-` first. */
+export declare const AUTHJS_SESSION_COOKIES: readonly ["__Secure-authjs.session-token", "authjs.session-token", "__Secure-next-auth.session-token", "next-auth.session-token"];
+/**
+ * The Auth.js session cookie from a `Cookie` header, reassembled when Auth.js
+ * split it into `<name>.0`, `<name>.1`, … chunks (it does above ~4 KB). `name`
+ * is the base cookie name — the HKDF salt of a v5 JWT. `cookieName` overrides
+ * the defaults when the app set `cookies.sessionToken.name`.
+ */
+export declare function readAuthJsSessionCookie(cookieHeader: string | null | undefined | Record<string, string>, options?: {
+    cookieName?: string;
+}): {
+    name: string;
+    value: string;
+} | undefined;
+/**
+ * Which session strategy produced a cookie value: a five-part compact JWE is a
+ * JWT-strategy session; anything else is a database session token (the
+ * `sessionToken` column of the adapter's sessions table).
+ */
+export declare function authJsSessionTokenKind(value: string): 'jwt' | 'database' | null;
+/** The claims of a decrypted Auth.js session JWT (whatever the `jwt` callback put in it). */
+export interface AuthJsSessionClaims {
+    sub?: string;
+    email?: string | null;
+    name?: string | null;
+    picture?: string | null;
+    exp?: number;
+    iat?: number;
+    [claim: string]: unknown;
+}
+/**
+ * Decrypt an Auth.js JWT-strategy session cookie with the app's secret
+ * (`AUTH_SECRET` / `NEXTAUTH_SECRET`; pass every rotated secret, newest first).
+ *
+ *   - NextAuth v4: `dir` + `A256GCM`, key = HKDF-SHA256(secret, salt "", info
+ *     "NextAuth.js Generated Encryption Key", 32 bytes).
+ *   - Auth.js v5 (`@auth/core`): `dir` + `A256CBC-HS512` (or `A256GCM`), key =
+ *     HKDF-SHA256(secret, salt = the cookie name, info
+ *     "Auth.js Generated Encryption Key (<cookie name>)", 64 / 32 bytes).
+ *
+ * `salt` is the cookie the value came from (from {@link readAuthJsSessionCookie}).
+ * The JWT's `exp` is enforced with Auth.js's own 15 s tolerance.
+ */
+export declare function decodeAuthJsSessionToken(token: string, options: {
+    secret: string | readonly string[];
+    salt: string;
+    now?: Date;
+}): Promise<AuthJsSessionClaims | null>;
+/** express-session's default cookie name. */
+export declare const EXPRESS_SESSION_COOKIE = "connect.sid";
+/**
+ * The session id inside an express-session cookie (`s:<sid>.<signature>`,
+ * URL-encoded), where the signature is cookie-signature's
+ * base64(HMAC-SHA256(secret, sid)) without padding. With `secrets` (the app's
+ * `session({ secret })`, a string or the rotation array) the signature must
+ * verify against one of them; without, the id is only parsed — the session id
+ * is itself a 24-byte random bearer value, so a store lookup by id is what
+ * authenticates it either way.
+ */
+export declare function unsignExpressSessionCookie(raw: string, secrets?: string | readonly string[]): Promise<string | null>;
+/** Lucia's default session cookie name (v2 and v3). */
+export declare const LUCIA_SESSION_COOKIE = "auth_session";
+/**
+ * The id a Lucia session row is stored under, from the cookie's token. Lucia
+ * v2/v3 store the cookie value itself (`none`); the current Lucia guide's
+ * session implementation stores `hex(sha256(token))` (`sha256-hex`).
+ */
+export declare function luciaSessionId(token: string, hashing?: 'none' | 'sha256-hex'): Promise<string | null>;
+/**
+ * Open an iron-session cookie (an `@hapi/iron` `Fe26.2` seal, with iron-session
+ * v8's `~2` version suffix) with the app's `password` — a string, or the
+ * `{ id: password }` rotation map. Mirrors iron: HMAC-SHA256 integrity and
+ * AES-256-CBC, each keyed by PBKDF2-SHA1(password, the seal's salt, 1 iteration,
+ * 32 bytes); the seal's own expiry is enforced (60 s skew, as iron does).
+ * Returns the session object the app stored.
+ */
+export declare function unsealIronSession<T = Record<string, unknown>>(raw: string, password: string | Readonly<Record<string, string>>, options?: {
+    now?: Date;
+}): Promise<T | null>;
+/** Read `path` (`"user.id"`) out of a session object, as a non-empty string. */
+export declare function sessionValueAt(data: unknown, path: string): string | null;
+/**
+ * Decrypt a Rails encrypted cookie — the session cookie of a Rails app using
+ * the default cookie store, which is where Devise (through Warden) keeps the
+ * signed-in user. Rails 5.2+ authenticated encryption:
+ * `base64(ciphertext)--base64(iv)--base64(auth tag)`, AES-256-GCM, empty AAD,
+ * key = PBKDF2(secret_key_base, "authenticated encrypted cookie", 1000
+ * iterations, 32 bytes) with SHA-256 (Rails 7 default) or SHA-1 (apps that kept
+ * `key_generator_hash_digest_class = SHA1`). Both are tried unless `keyDigest`
+ * pins one. The `_rails` envelope's purpose (`cookie.<cookieName>`) and expiry
+ * are enforced; JSON-serialized cookies only (`cookies_serializer :json` or
+ * `:hybrid` — a Marshal-serialized cookie cannot be read outside Ruby).
+ */
+export declare function decryptRailsCookie(raw: string, options: {
+    secretKeyBase: string | readonly string[];
+    cookieName?: string;
+    keyDigest?: 'SHA-256' | 'SHA-1';
+    salt?: string;
+    now?: Date;
+}): Promise<Record<string, unknown> | null>;
+/**
+ * The Devise user a Rails session holds: Warden stores
+ * `warden.user.<scope>.key` = `[[id], authenticatable_salt]`, where the salt is
+ * the first 29 characters of the user's bcrypt `encrypted_password` (so a
+ * password change signs every session out — check it against the imported
+ * hash with {@link deviseSaltMatches}).
+ */
+export declare function deviseSessionUser(session: Record<string, unknown>, scope?: string): {
+    id: string;
+    salt: string | null;
+} | null;
+/** Devise's `authenticatable_salt`: the bcrypt digest's first 29 characters. */
+export declare function deviseSaltMatches(salt: string | null, encryptedPassword: string | null | undefined): boolean;
+/** Django's default session cookie name (`SESSION_COOKIE_NAME`). */
+export declare const DJANGO_SESSION_COOKIE = "sessionid";
+/**
+ * Verify and decode a value made by Django's `signing.dumps` — the session
+ * cookie of `SESSION_ENGINE = "django.contrib.sessions.backends.signed_cookies"`.
+ * Format `<payload>:<base62 timestamp>:<signature>`, payload = urlsafe base64 of
+ * the JSON (zlib-compressed when it starts with `.`), signature = urlsafe
+ * base64 of salted_hmac(salt + "signer", "<payload>:<timestamp>", SECRET_KEY)
+ * with SHA-256 (Django ≥ 3.1) or SHA-1 (older). Pass SECRET_KEY first, then
+ * SECRET_KEY_FALLBACKS. `maxAgeSeconds` is SESSION_COOKIE_AGE.
+ */
+export declare function decodeDjangoSignedCookie(raw: string, options: {
+    secretKey: string | readonly string[];
+    salt?: string;
+    maxAgeSeconds?: number;
+    algorithm?: 'sha256' | 'sha1';
+    now?: Date;
+}): Promise<Record<string, unknown> | null>;
+/**
+ * Decode a `signing.dumps` payload (the part before the timestamp) WITHOUT
+ * verifying it — for rows read out of the app's own `django_session` table.
+ */
+export declare function decodeDjangoPayload(payload: string): Promise<Record<string, unknown> | null>;
+/** The signed-in user of a Django session: `_auth_user_id` and `_auth_user_hash`. */
+export declare function djangoSessionUser(data: Record<string, unknown>): {
+    id: string;
+    hash: string | null;
+} | null;
+/**
+ * Django's session auth hash for a user's stored password hash
+ * (`AbstractBaseUser.get_session_auth_hash`): hex salted_hmac with SHA-256. A
+ * session whose `_auth_user_hash` differs was signed out by a password change.
+ */
+export declare function djangoSessionAuthHash(passwordHash: string, secretKey: string): Promise<string>;