@atlasauth/backend 0.23.0 → 0.25.0

package/dist/migration-presets.js

@@ -0,0 +1,536 @@
+"use strict";
+/**
+ * ZERO-LOGOUT BRIDGE PRESETS — per vendor, how an old session is recognised.
+ *
+ * Shared by the Atlas API (which verifies the token and resolves the user) and
+ * the SDK middleware (which knows which cookie / header carries it), so both
+ * read one table. Pure data plus a few string templates: safe on every runtime.
+ *
+ * Three modes:
+ *   - `jwt`: the vendor's session (or a token inside it) is a JWT. Atlas
+ *     verifies it against the vendor's issuer and keys (JWKS, or an X.509 map
+ *     like Firebase session cookies use), maps `claims.subject` to the imported
+ *     user (`external_id` = the source user id), and spends `claims.sessionKey`
+ *     (`jti` / `sid`, falling back to the whole token) in the single-use ledger.
+ *   - `session_table`: an opaque token; Atlas looks up sha256(token) among the
+ *     sessions imported in the migration bundle.
+ *   - `remote`: the vendor's session can only be checked by asking the vendor
+ *     with the user's own token (Appwrite, PocketBase): Atlas calls
+ *     `remote.url` with the token filled into `{token}` and reads the subject
+ *     (and profile) from the JSON answer by dot path.
+ *
+ * Templates use `{var}` placeholders filled from the bridge settings'
+ * `preset_vars` (e.g. `{domain}`, `{region}`); {@link resolveMigrationBridgePreset}
+ * refuses a template with a missing variable.
+ *
+ * Vendor tracks register their preset (or refine the starter below) with
+ * {@link registerMigrationBridgePreset}; a test checks every preset resolves.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PresetVariableError = void 0;
+exports.registerMigrationBridgePreset = registerMigrationBridgePreset;
+exports.getMigrationBridgePreset = getMigrationBridgePreset;
+exports.listMigrationBridgePresets = listMigrationBridgePresets;
+exports.resolveMigrationBridgePreset = resolveMigrationBridgePreset;
+exports.cookieNameMatches = cookieNameMatches;
+const OIDC_ALGS = ['RS256', 'RS384', 'RS512', 'PS256', 'ES256', 'ES384', 'EdDSA'];
+const presets = new Map();
+function registerMigrationBridgePreset(preset, options = {}) {
+    if (!/^[a-z0-9_]+$/.test(preset.id))
+        throw new Error(`Invalid bridge preset id "${preset.id}".`);
+    if (presets.has(preset.id) && !options.replace)
+        throw new Error(`Bridge preset "${preset.id}" is already registered.`);
+    if (preset.mode === 'jwt' && !preset.jwt)
+        throw new Error(`Bridge preset "${preset.id}" is mode jwt but has no jwt settings.`);
+    if (preset.mode === 'remote' && !preset.remote)
+        throw new Error(`Bridge preset "${preset.id}" is mode remote but has no remote settings.`);
+    presets.set(preset.id, preset);
+}
+function getMigrationBridgePreset(id) {
+    return presets.get(id);
+}
+function listMigrationBridgePresets() {
+    return [...presets.values()];
+}
+class PresetVariableError extends Error {
+    variable;
+    constructor(variable, message) {
+        super(message);
+        this.variable = variable;
+        this.name = 'PresetVariableError';
+    }
+}
+exports.PresetVariableError = PresetVariableError;
+/** A preset variable must be a plain value: no scheme, path tricks or whitespace sneak into a URL. */
+const VAR_VALUE = /^[A-Za-z0-9._:\-/]{1,253}$/;
+function fill(template, vars) {
+    return template.replace(/\{([a-z_]+)\}/g, (match, name) => {
+        // `{token}` is the presented session token, filled by the server at call time.
+        if (name === 'token')
+            return match;
+        const v = vars[name];
+        if (v === undefined || v === '')
+            throw new PresetVariableError(name, `The preset needs "${name}".`);
+        return v;
+    });
+}
+/**
+ * Fill a preset's templates. Throws {@link PresetVariableError} for a missing or
+ * malformed variable. Values are trimmed; a trailing slash on a URL-ish value
+ * is removed (`https://example.com/` → `https://example.com`).
+ */
+function resolveMigrationBridgePreset(id, rawVars = {}) {
+    const p = presets.get(id);
+    if (!p)
+        throw new PresetVariableError('preset', `Unknown bridge preset "${id}".`);
+    const vars = { ...(p.defaults ?? {}) };
+    for (const [k, v] of Object.entries(rawVars)) {
+        if (typeof v !== 'string')
+            continue;
+        const value = v.trim().replace(/\/+$/, '');
+        if (!value)
+            continue;
+        // Base URLs (`base_url`, `issuer`, `*_url`) keep their https scheme; every
+        // other variable is a bare value (a pasted `https://` is dropped, so
+        // `https://{domain}/` never doubles it).
+        const bare = value.replace(/^https:\/\//, '');
+        if (!VAR_VALUE.test(bare) || bare.includes('..') || bare.includes('//'))
+            throw new PresetVariableError(k, `"${k}" has characters a ${p.label} value never has.`);
+        const keepsScheme = k === 'issuer' || k.endsWith('url');
+        if (keepsScheme && !value.startsWith('https://'))
+            throw new PresetVariableError(k, `"${k}" must be an https URL.`);
+        vars[k] = keepsScheme ? value : bare;
+    }
+    const jwt = p.jwt;
+    return {
+        preset: p.id,
+        mode: p.mode,
+        issuer: jwt ? fill(jwt.issuer, vars) : null,
+        keysUrl: jwt?.keysUrl ? fill(jwt.keysUrl, vars) : null,
+        keysFormat: jwt?.keysFormat ?? 'jwks',
+        audience: jwt?.audience?.length ? jwt.audience.map((a) => fill(a, vars)) : null,
+        algorithms: jwt?.algorithms ?? [],
+        claims: jwt?.claims ?? { subject: 'sub' },
+        expiredGraceSeconds: jwt?.expiredGraceSeconds ?? 0,
+        cookies: p.cookies.map((c) => fill(c, vars)),
+        tokenFormat: p.tokenFormat ?? 'raw',
+        bearer: p.bearer === true,
+        clearCookies: (p.clearCookies ?? p.cookies).map((c) => fill(c, vars)),
+        sharesAtlasCookie: p.sharesAtlasCookie === true,
+        remote: p.remote
+            ? {
+                ...p.remote,
+                url: fill(p.remote.url, vars),
+                ...(p.remote.headers ? { headers: Object.fromEntries(Object.entries(p.remote.headers).map(([k, v]) => [k, fill(v, vars)])) } : {}),
+                ...(p.remote.body !== undefined ? { body: fill(p.remote.body, vars) } : {}),
+            }
+            : null,
+    };
+}
+// ── the starter presets ─────────────────────────────────────────────────────
+const OIDC_CLAIMS = { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'jti', mfa: 'amr:mfa' };
+for (const preset of [
+    {
+        id: 'oidc',
+        label: 'Any OpenID Connect provider',
+        mode: 'jwt',
+        vars: { issuer: 'The issuer URL (keys are found by OIDC discovery)' },
+        jwt: { issuer: '{issuer}', algorithms: OIDC_ALGS, claims: OIDC_CLAIMS },
+        cookies: [],
+        bearer: true,
+    },
+    {
+        id: 'auth0',
+        label: 'Auth0',
+        mode: 'jwt',
+        vars: {
+            domain: 'Your Auth0 domain (tenant.us.auth0.com, or the custom domain your tokens are issued from)',
+            client_id: 'The application client id (the ID token audience)',
+        },
+        defaults: {},
+        jwt: {
+            issuer: 'https://{domain}/',
+            keysUrl: 'https://{domain}/.well-known/jwks.json',
+            // The bridge exchanges the ID token from the app session: its audience is the client id.
+            audience: ['{client_id}'],
+            algorithms: ['RS256', 'PS256'],
+            claims: { ...OIDC_CLAIMS, sessionKey: 'sid' },
+            // ID tokens live 10 hours by default while the app session rolls for days;
+            // nothing renews the ID token once Auth0's SDK stops running.
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        cookies: ['__session', 'appSession'],
+        // nextjs-auth0 v4 chunks a large session as __session__0, __session__1; v3 and
+        // express-openid-connect as appSession.0, appSession.1.
+        clearCookies: ['__session', '__session__*', 'appSession', 'appSession.*', 'auth_verification', '__txn_*'],
+        sharesAtlasCookie: true,
+        bearer: true,
+        notes: 'The nextjs-auth0 / express-openid-connect session cookie is encrypted with your AUTH0_SECRET: use auth0SessionTokenExtractor({ secret }) from @atlasauth/backend as the middleware extractToken so it is opened on your server and its ID token exchanged.',
+    },
+    {
+        id: 'clerk',
+        label: 'Clerk',
+        mode: 'jwt',
+        vars: { frontend_api: 'Your Clerk Frontend API host (clerk.example.com or xxx.clerk.accounts.dev — the host your publishable key encodes)' },
+        jwt: {
+            issuer: 'https://{frontend_api}',
+            keysUrl: 'https://{frontend_api}/.well-known/jwks.json',
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', sessionKey: 'sid', email: 'email' },
+            // Clerk session tokens live 60 seconds and are refreshed by clerk-js, which no longer runs after the switch.
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        cookies: ['__session'],
+        // Clerk also sets suffixed copies (__session_<suffix>, __client_uat_<suffix>) on newer SDKs.
+        clearCookies: ['__session', '__session_*', '__client_uat', '__client_uat_*', '__clerk_db_jwt', '__clerk_db_jwt_*', '__refresh_*'],
+        sharesAtlasCookie: true,
+        bearer: true,
+        notes: 'Clerk session tokens are exchanged up to 7 days after they expire (each one once): run the bridge from the day you switch. Clerk\'s __client cookie lives on the Frontend API domain and is never readable by your app.',
+    },
+    {
+        id: 'cognito',
+        label: 'Amazon Cognito',
+        mode: 'jwt',
+        vars: { region: 'AWS region (us-east-1)', user_pool_id: 'User pool id (us-east-1_AbCdEf)', client_id: 'App client id' },
+        jwt: {
+            issuer: 'https://cognito-idp.{region}.amazonaws.com/{user_pool_id}',
+            keysUrl: 'https://cognito-idp.{region}.amazonaws.com/{user_pool_id}/.well-known/jwks.json',
+            audience: ['{client_id}'],
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'origin_jti' },
+        },
+        cookies: ['CognitoIdentityServiceProvider.{client_id}.*.idToken'],
+        clearCookies: ['CognitoIdentityServiceProvider.{client_id}.*'],
+        bearer: true,
+    },
+    {
+        id: 'firebase',
+        label: 'Firebase Authentication',
+        mode: 'jwt',
+        vars: { project_id: 'Firebase project id' },
+        jwt: {
+            issuer: 'https://securetoken.google.com/{project_id}',
+            keysUrl: 'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com',
+            audience: ['{project_id}'],
+            algorithms: ['RS256'],
+            claims: { subject: 'user_id', email: 'email', emailVerified: 'email_verified', name: 'name', sessionKey: 'jti' },
+        },
+        cookies: ['__session'],
+        sharesAtlasCookie: true,
+        bearer: true,
+    },
+    {
+        id: 'firebase_session_cookie',
+        label: 'Firebase session cookies',
+        mode: 'jwt',
+        vars: { project_id: 'Firebase project id' },
+        jwt: {
+            issuer: 'https://session.firebase.google.com/{project_id}',
+            keysUrl: 'https://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys',
+            keysFormat: 'x509',
+            audience: ['{project_id}'],
+            algorithms: ['RS256'],
+            claims: { subject: 'user_id', email: 'email', emailVerified: 'email_verified', name: 'name' },
+        },
+        cookies: ['__session', 'session'],
+        sharesAtlasCookie: true,
+    },
+    {
+        id: 'supabase',
+        label: 'Supabase Auth',
+        mode: 'jwt',
+        vars: { project_ref: 'Project ref (the subdomain of <ref>.supabase.co)' },
+        jwt: {
+            issuer: 'https://{project_ref}.supabase.co/auth/v1',
+            keysUrl: 'https://{project_ref}.supabase.co/auth/v1/.well-known/jwks.json',
+            audience: ['authenticated'],
+            algorithms: ['ES256', 'RS256', 'HS256'],
+            claims: { subject: 'sub', email: 'email', sessionKey: 'session_id', mfa: 'claim:aal2' },
+            // The access token lives an hour; supabase-js refreshes it, which no longer happens after the switch.
+            expiredGraceSeconds: 7 * 24 * 3600,
+            allowSharedSecret: true,
+        },
+        cookies: ['sb-{project_ref}-auth-token'],
+        tokenFormat: 'supabase',
+        clearCookies: ['sb-{project_ref}-auth-token', 'sb-{project_ref}-auth-token.*'],
+        bearer: true,
+    },
+    {
+        id: 'workos',
+        label: 'WorkOS AuthKit',
+        mode: 'jwt',
+        vars: { client_id: 'WorkOS client id (client_…)' },
+        // api.workos.com, or your custom authentication domain when the environment has one.
+        defaults: { api_host: 'api.workos.com' },
+        jwt: {
+            issuer: 'https://{api_host}/user_management/{client_id}',
+            keysUrl: 'https://{api_host}/sso/jwks/{client_id}',
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', sessionKey: 'sid' },
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        cookies: ['wos-session'],
+        clearCookies: ['wos-session'],
+        bearer: true,
+        notes: 'The wos-session cookie is sealed with your WORKOS_COOKIE_PASSWORD: pass the middleware workosSessionTokenExtractor({ password }) from @atlasauth/backend, which unseals it on your server and returns the access token. With a custom authentication domain set api_host to it. AuthKit access tokens are short-lived and signed RS256 by WorkOS; the issuer is https://{api_host}/user_management/{client_id}.',
+    },
+    {
+        id: 'okta',
+        label: 'Okta',
+        mode: 'jwt',
+        vars: { domain: 'Your Okta domain (example.okta.com)' },
+        defaults: { auth_server: 'default', audience: 'api://default' },
+        jwt: {
+            // A custom authorization server: org-server access tokens are opaque to anyone but Okta.
+            issuer: 'https://{domain}/oauth2/{auth_server}',
+            keysUrl: 'https://{domain}/oauth2/{auth_server}/v1/keys',
+            audience: ['{audience}'],
+            algorithms: ['RS256'],
+            // Access tokens carry the login in `sub` and the Okta user id in `uid`.
+            claims: { ...OIDC_CLAIMS, subject: 'uid', sessionKey: 'jti' },
+        },
+        // okta-auth-js keeps tokens in browser storage, not cookies: API calls carry them as bearer tokens.
+        cookies: [],
+        bearer: true,
+    },
+    {
+        id: 'ping_identity',
+        label: 'Ping Identity (PingOne)',
+        mode: 'jwt',
+        vars: { environment_id: 'Your PingOne environment id (a UUID)' },
+        defaults: { region: 'com' },
+        jwt: {
+            issuer: 'https://auth.pingone.{region}/{environment_id}/as',
+            keysUrl: 'https://auth.pingone.{region}/{environment_id}/as/jwks',
+            algorithms: ['RS256', 'ES256'],
+            claims: { ...OIDC_CLAIMS, sessionKey: 'sid' },
+        },
+        // PingOne sessions live in the SPA (tokens in storage): API calls carry them as bearer tokens.
+        cookies: [],
+        bearer: true,
+    },
+    {
+        id: 'onelogin',
+        label: 'OneLogin',
+        mode: 'jwt',
+        vars: { subdomain: 'Your OneLogin subdomain (acme in acme.onelogin.com)' },
+        jwt: {
+            issuer: 'https://{subdomain}.onelogin.com/oidc/2',
+            keysUrl: 'https://{subdomain}.onelogin.com/oidc/2/certs',
+            algorithms: ['RS256', 'PS256', 'ES256'],
+            claims: { ...OIDC_CLAIMS, sessionKey: 'jti' },
+        },
+        cookies: [],
+        bearer: true,
+    },
+    {
+        id: 'stytch',
+        label: 'Stytch',
+        mode: 'jwt',
+        vars: { project_id: 'Stytch project id (project-live-…)' },
+        // api.stytch.com for live projects, test.stytch.com for test ones; jwks_path `b2b/sessions` for Stytch B2B (members), `sessions` for consumer.
+        defaults: { api_host: 'api.stytch.com', jwks_path: 'sessions' },
+        jwt: {
+            issuer: 'stytch.com/{project_id}',
+            keysUrl: 'https://{api_host}/v1/{jwks_path}/jwks/{project_id}',
+            audience: ['{project_id}'],
+            algorithms: ['RS256'],
+            // The session id sits inside the `https://stytch.com/session` object claim (dotted path).
+            claims: { subject: 'sub', sessionKey: 'https://stytch.com/session.id' },
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        cookies: ['stytch_session_jwt'],
+        clearCookies: ['stytch_session_jwt', 'stytch_session'],
+        notes: 'Stytch session JWTs last about five minutes and are signed by the project (RS256). Use jwks_path=b2b/sessions for Stytch B2B and api_host=test.stytch.com for a test project. The subject is the Stytch user id (consumer) or member id (B2B).',
+    },
+    {
+        id: 'keycloak',
+        label: 'Keycloak',
+        mode: 'jwt',
+        vars: { base_url: 'Keycloak base URL (https://sso.example.com)', realm: 'Realm name' },
+        jwt: {
+            issuer: '{base_url}/realms/{realm}',
+            keysUrl: '{base_url}/realms/{realm}/protocol/openid-connect/certs',
+            algorithms: ['RS256', 'ES256', 'PS256'],
+            claims: { ...OIDC_CLAIMS, sessionKey: 'sid', mfa: 'acr:2' },
+        },
+        cookies: [],
+        bearer: true,
+    },
+    {
+        id: 'fusionauth',
+        label: 'FusionAuth',
+        mode: 'jwt',
+        vars: { base_url: 'FusionAuth URL (https://auth.example.com)' },
+        defaults: {},
+        jwt: {
+            issuer: '{base_url}',
+            keysUrl: '{base_url}/.well-known/jwks.json',
+            algorithms: ['RS256', 'ES256'],
+            claims: { ...OIDC_CLAIMS, sessionKey: 'sid' },
+        },
+        cookies: ['app.at'],
+        clearCookies: ['app.at', 'app.rt', 'app.idt'],
+        bearer: true,
+    },
+    {
+        id: 'kinde',
+        label: 'Kinde',
+        mode: 'jwt',
+        vars: { domain: 'Your Kinde domain (example.kinde.com, or your custom domain)' },
+        jwt: {
+            issuer: 'https://{domain}',
+            keysUrl: 'https://{domain}/.well-known/jwks',
+            algorithms: ['RS256'],
+            claims: { ...OIDC_CLAIMS, sessionKey: 'jti' },
+            // The Kinde SDK refreshes its access token; nothing does after the switch.
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        // The Kinde Next.js SDK keeps the raw tokens in these cookies.
+        cookies: ['access_token', 'id_token'],
+        clearCookies: ['access_token', 'id_token', 'refresh_token', 'refresh_token_*', 'ac-state-key', 'user', 'post_login_redirect_url'],
+        bearer: true,
+    },
+    {
+        id: 'descope',
+        label: 'Descope',
+        mode: 'jwt',
+        vars: { project_id: 'Descope project id (P…)' },
+        defaults: { base_url: 'https://api.descope.com' },
+        jwt: {
+            // Newer projects issue `https://api.descope.com/<project id>`; older ones the
+            // bare project id (preset descope_project_issuer). Decode one DS token to check.
+            issuer: '{base_url}/{project_id}',
+            keysUrl: '{base_url}/v2/keys/{project_id}',
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', email: 'email', mfa: 'amr:mfa' },
+            // Session tokens live minutes and are renewed from the DSR refresh token by the Descope SDK.
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        cookies: ['DS'],
+        clearCookies: ['DS', 'DSR'],
+        bearer: true,
+    },
+    {
+        id: 'descope_project_issuer',
+        label: 'Descope (project-id issuer)',
+        mode: 'jwt',
+        vars: { project_id: 'Descope project id (P…)' },
+        defaults: { base_url: 'https://api.descope.com' },
+        jwt: {
+            issuer: '{project_id}',
+            keysUrl: '{base_url}/v2/keys/{project_id}',
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', email: 'email', mfa: 'amr:mfa' },
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        cookies: ['DS'],
+        clearCookies: ['DS', 'DSR'],
+        bearer: true,
+    },
+    {
+        id: 'frontegg',
+        label: 'Frontegg',
+        mode: 'jwt',
+        vars: { base_url: 'Your Frontegg domain (https://app-xxx.frontegg.com)' },
+        jwt: { issuer: '{base_url}', keysUrl: '{base_url}/.well-known/jwks.json', algorithms: ['RS256'], claims: { subject: 'sub', email: 'email', sessionKey: 'sid' } },
+        cookies: [],
+        bearer: true,
+    },
+    // ── propelauth ──
+    {
+        id: 'propelauth',
+        label: 'PropelAuth',
+        mode: 'jwt',
+        vars: { auth_url: 'Your PropelAuth auth URL (https://123456.propelauthtest.com or https://auth.example.com)' },
+        jwt: { issuer: '{auth_url}', keysUrl: '{auth_url}/.well-known/jwks.json', algorithms: ['RS256'], claims: { subject: 'user_id', email: 'email' }, expiredGraceSeconds: 7 * 24 * 3600 },
+        cookies: ['__pa_at'],
+        clearCookies: ['__pa_at', '__pa_rt'],
+        bearer: true,
+        notes: 'PropelAuth signs RS256 tokens (issuer = your auth URL, subject claim user_id) and publishes the verifier key as a PEM (Dashboard → Backend Integration, or PROPELAUTH_VERIFIER_KEY), not as a JWKS. Point the bridge at a JWKS URL that serves that key (jwks_url) before enabling it.',
+    },
+    // ── magic ──
+    {
+        id: 'magic',
+        label: 'Magic (magic.link)',
+        mode: 'jwt',
+        vars: { client_id: 'Your Magic client id (did:magic:…), the `aud` of your DID tokens' },
+        jwt: {
+            // Not an OIDC issuer: each DID token's `iss` is the user's own did:ethr. Kept for the settings' shape.
+            issuer: 'did:ethr',
+            tokenType: 'magic_did',
+            audience: ['{client_id}'],
+            algorithms: ['ES256K'],
+            claims: { subject: 'iss', sessionKey: 'tid' },
+            // DID tokens live 15 minutes by default; the app mints a fresh one whenever it asks Magic.
+            expiredGraceSeconds: 24 * 3600,
+        },
+        cookies: [],
+        bearer: true,
+        notes: 'Magic DID tokens travel in the Authorization header (from magic.user.getIdToken()), not a cookie, and are not JWTs: pass the middleware magicDidTokenExtractor().',
+    },
+    // ── userfront ──
+    // ── corbado ──
+    {
+        id: 'corbado',
+        label: 'Corbado',
+        mode: 'jwt',
+        vars: { project_id: 'Your Corbado project id (pro-…)' },
+        jwt: {
+            issuer: 'https://{project_id}.frontendapi.corbado.io',
+            keysUrl: 'https://{project_id}.frontendapi.corbado.io/.well-known/jwks',
+            algorithms: ['RS256'],
+            claims: { subject: 'sub', email: 'email', name: 'name' },
+            expiredGraceSeconds: 7 * 24 * 3600,
+        },
+        cookies: ['cbo_session_token', 'cbo_short_session'],
+        bearer: true,
+    },
+    {
+        id: 'better_auth',
+        label: 'Better Auth',
+        mode: 'session_table',
+        defaults: { cookie_prefix: 'better-auth' },
+        cookies: ['__Secure-{cookie_prefix}.session_token', '{cookie_prefix}.session_token'],
+        clearCookies: [
+            '__Secure-{cookie_prefix}.session_token',
+            '__Secure-{cookie_prefix}.session_data',
+            '__Secure-{cookie_prefix}.account_data',
+            '__Secure-{cookie_prefix}.dont_remember',
+            '{cookie_prefix}.session_token',
+            '{cookie_prefix}.session_data',
+            '{cookie_prefix}.account_data',
+            '{cookie_prefix}.dont_remember',
+        ],
+    },
+    {
+        id: 'authjs',
+        label: 'Auth.js (database sessions)',
+        mode: 'session_table',
+        cookies: ['__Secure-authjs.session-token', 'authjs.session-token', '__Secure-next-auth.session-token', 'next-auth.session-token'],
+        notes: 'With the JWT session strategy the cookie is encrypted with AUTH_SECRET: pass the middleware a token extractor that decrypts it locally.',
+    },
+    { id: 'lucia', label: 'Lucia', mode: 'session_table', defaults: { cookie_name: 'auth_session' }, cookies: ['{cookie_name}'] },
+    { id: 'ory', label: 'Ory (Kratos)', mode: 'session_table', cookies: ['ory_kratos_session', 'ory_session_*'], bearer: true },
+    { id: 'custom', label: 'Your own sessions', mode: 'session_table', vars: { cookie_name: 'The session cookie name' }, cookies: ['{cookie_name}'] },
+]) {
+    registerMigrationBridgePreset(preset);
+}
+/** Does a cookie name match a preset pattern (`*` = any run of characters)? */
+function cookieNameMatches(pattern, name) {
+    if (!pattern.includes('*'))
+        return pattern === name;
+    const re = new RegExp(`^${pattern.split('*').map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('.*')}$`);
+    return re.test(name);
+}
+// ── vendor-track presets ────────────────────────────────────────────────────
+// Firebase, Supabase, Cognito, Azure AD B2C, Entra External ID, Nhost (replacing the starters).
+const migration_presets_g3_1 = require("./migration-presets-g3");
+for (const preset of migration_presets_g3_1.G3_BRIDGE_PRESETS)
+    registerMigrationBridgePreset(preset, { replace: true });
+// ── open-source identity providers ─────────────────────────────────────────
+// Keycloak, Ory, ZITADEL, Logto, SuperTokens, authentik, FusionAuth, Hanko.
+const migration_presets_g4_1 = require("./migration-presets-g4");
+for (const preset of migration_presets_g4_1.G4_BRIDGE_PRESETS)
+    registerMigrationBridgePreset(preset, { replace: true });
+//# sourceMappingURL=migration-presets.js.map

package/dist/migration-presets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-presets.js","sourceRoot":"","sources":["../src/migration-presets.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AAuGH,sEAMC;AAED,4DAEC;AAED,gEAEC;AAkDD,oEA0CC;AA6YD,8CAIC;AA/fD,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAElF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;AAEzD,SAAgB,6BAA6B,CAAC,MAA6B,EAAE,UAAiC,EAAE;IAC9G,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACjG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACvH,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,wCAAwC,CAAC,CAAC;IAC/H,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,8CAA8C,CAAC,CAAC;IAC3I,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,SAAgB,wBAAwB,CAAC,EAAU;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,SAAgB,0BAA0B;IACxC,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAsBD,MAAa,mBAAoB,SAAQ,KAAK;IAEjC;IADX,YACW,QAAgB,EACzB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,aAAQ,GAAR,QAAQ,CAAQ;QAIzB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AARD,kDAQC;AAED,sGAAsG;AACtG,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C,SAAS,IAAI,CAAC,QAAgB,EAAE,IAA4B;IAC1D,OAAO,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAChE,+EAA+E;QAC/E,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,IAAI,IAAI,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,EAAU,EAAE,UAAkC,EAAE;IAC3F,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC;IAClF,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,2EAA2E;QAC3E,qEAAqE;QACrE,yCAAyC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC;QACjK,MAAM,WAAW,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,WAAW,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACnH,IAAI,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAClB,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,EAAE;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAC3C,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACtD,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,MAAM;QACrC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/E,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,EAAE;QACjC,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;QACzC,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,IAAI,CAAC;QAClD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5C,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,KAAK;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI;QACzB,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,KAAK,IAAI;QAC/C,MAAM,EAAE,CAAC,CAAC,MAAM;YACd,CAAC,CAAC;gBACE,GAAG,CAAC,CAAC,MAAM;gBACX,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;gBAC7B,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E;YACH,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,MAAM,WAAW,GAA0B,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAEhK,KAAK,MAAM,MAAM,IAAI;IACnB;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,mDAAmD,EAAE;QACrE,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE;QACvE,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE;YACJ,MAAM,EAAE,2FAA2F;YACnG,SAAS,EAAE,mDAAmD;SAC/D;QACD,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE;YACH,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,wCAAwC;YACjD,yFAAyF;YACzF,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,2EAA2E;YAC3E,8DAA8D;YAC9D,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;QACpC,+EAA+E;QAC/E,wDAAwD;QACxD,YAAY,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,SAAS,CAAC;QACzG,iBAAiB,EAAE,IAAI;QACvB,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,4PAA4P;KACpQ;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,YAAY,EAAE,oHAAoH,EAAE;QAC5I,GAAG,EAAE;YACH,MAAM,EAAE,wBAAwB;YAChC,OAAO,EAAE,8CAA8C;YACvD,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;YAC7D,6GAA6G;YAC7G,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,6FAA6F;QAC7F,YAAY,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,aAAa,CAAC;QACjI,iBAAiB,EAAE,IAAI;QACvB,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,yNAAyN;KACjO;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,YAAY,EAAE,iCAAiC,EAAE,SAAS,EAAE,eAAe,EAAE;QACvH,GAAG,EAAE;YACH,MAAM,EAAE,2DAA2D;YACnE,OAAO,EAAE,iFAAiF;YAC1F,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE;SACpH;QACD,OAAO,EAAE,CAAC,sDAAsD,CAAC;QACjE,YAAY,EAAE,CAAC,8CAA8C,CAAC;QAC9D,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,yBAAyB;QAChC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE;QAC3C,GAAG,EAAE;YACH,MAAM,EAAE,6CAA6C;YACrD,OAAO,EAAE,2FAA2F;YACpG,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE;SACjH;QACD,OAAO,EAAE,CAAC,WAAW,CAAC;QACtB,iBAAiB,EAAE,IAAI;QACvB,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE;QAC3C,GAAG,EAAE;YACH,MAAM,EAAE,kDAAkD;YAC1D,OAAO,EAAE,uEAAuE;YAChF,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE;SAC9F;QACD,OAAO,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC;QACjC,iBAAiB,EAAE,IAAI;KACxB;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE;QACzE,GAAG,EAAE;YACH,MAAM,EAAE,2CAA2C;YACnD,OAAO,EAAE,iEAAiE;YAC1E,QAAQ,EAAE,CAAC,eAAe,CAAC;YAC3B,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE;YACvF,sGAAsG;YACtG,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;YAClC,iBAAiB,EAAE,IAAI;SACxB;QACD,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACxC,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,CAAC,6BAA6B,EAAE,+BAA+B,CAAC;QAC9E,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,SAAS,EAAE,6BAA6B,EAAE;QAClD,qFAAqF;QACrF,QAAQ,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;QACxC,GAAG,EAAE;YACH,MAAM,EAAE,gDAAgD;YACxD,OAAO,EAAE,yCAAyC;YAClD,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,aAAa,CAAC;QACxB,YAAY,EAAE,CAAC,aAAa,CAAC;QAC7B,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,iZAAiZ;KACzZ;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,qCAAqC,EAAE;QACvD,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE;QAC/D,GAAG,EAAE;YACH,yFAAyF;YACzF,MAAM,EAAE,uCAAuC;YAC/C,OAAO,EAAE,+CAA+C;YACxD,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,wEAAwE;YACxE,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;SAC9D;QACD,oGAAoG;QACpG,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,yBAAyB;QAChC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,cAAc,EAAE,sCAAsC,EAAE;QAChE,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3B,GAAG,EAAE;YACH,MAAM,EAAE,mDAAmD;YAC3D,OAAO,EAAE,wDAAwD;YACjE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;SAC9C;QACD,+FAA+F;QAC/F,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,SAAS,EAAE,qDAAqD,EAAE;QAC1E,GAAG,EAAE;YACH,MAAM,EAAE,yCAAyC;YACjD,OAAO,EAAE,+CAA+C;YACxD,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;SAC9C;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE;QAC1D,+IAA+I;QAC/I,QAAQ,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE;QAC/D,GAAG,EAAE;YACH,MAAM,EAAE,yBAAyB;YACjC,OAAO,EAAE,qDAAqD;YAC9D,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,0FAA0F;YAC1F,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,+BAA+B,EAAE;YACvE,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,oBAAoB,CAAC;QAC/B,YAAY,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;QACtD,KAAK,EACH,gPAAgP;KACnP;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,6CAA6C,EAAE,KAAK,EAAE,YAAY,EAAE;QACtF,GAAG,EAAE;YACH,MAAM,EAAE,2BAA2B;YACnC,OAAO,EAAE,yDAAyD;YAClE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;SAC5D;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,2CAA2C,EAAE;QAC/D,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE;YACH,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,kCAAkC;YAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;SAC9C;QACD,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC7C,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,MAAM,EAAE,8DAA8D,EAAE;QAChF,GAAG,EAAE;YACH,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,mCAAmC;YAC5C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,2EAA2E;YAC3E,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,+DAA+D;QAC/D,OAAO,EAAE,CAAC,cAAc,EAAE,UAAU,CAAC;QACrC,YAAY,EAAE,CAAC,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,EAAE,yBAAyB,CAAC;QACjI,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE;QAC/C,QAAQ,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE;QACjD,GAAG,EAAE;YACH,8EAA8E;YAC9E,iFAAiF;YACjF,MAAM,EAAE,yBAAyB;YACjC,OAAO,EAAE,iCAAiC;YAC1C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;YAC1D,6FAA6F;YAC7F,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,YAAY,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;QAC3B,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE;QAC/C,QAAQ,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE;QACjD,GAAG,EAAE;YACH,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,iCAAiC;YAC1C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;YAC1D,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,YAAY,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;QAC3B,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,qDAAqD,EAAE;QACzE,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,kCAAkC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;QAChK,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;KACb;IACD,mBAAmB;IACnB;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE,0FAA0F,EAAE;QAC9G,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,kCAAkC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE;QACrL,OAAO,EAAE,CAAC,SAAS,CAAC;QACpB,YAAY,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QACpC,MAAM,EAAE,IAAI;QACZ,KAAK,EACH,wRAAwR;KAC3R;IACD,cAAc;IACd;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,SAAS,EAAE,kEAAkE,EAAE;QACvF,GAAG,EAAE;YACH,uGAAuG;YACvG,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,WAAW;YACtB,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,UAAU,EAAE,CAAC,QAAQ,CAAC;YACtB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;YAC7C,2FAA2F;YAC3F,mBAAmB,EAAE,EAAE,GAAG,IAAI;SAC/B;QACD,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,mKAAmK;KAC3K;IACD,kBAAkB;IAClB,gBAAgB;IAChB;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,UAAU,EAAE,iCAAiC,EAAE;QACvD,GAAG,EAAE;YACH,MAAM,EAAE,6CAA6C;YACrD,OAAO,EAAE,8DAA8D;YACvE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;YACxD,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;SACnC;QACD,OAAO,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;QACnD,MAAM,EAAE,IAAI;KACb;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;QAC1C,OAAO,EAAE,CAAC,wCAAwC,EAAE,+BAA+B,CAAC;QACpF,YAAY,EAAE;YACZ,wCAAwC;YACxC,uCAAuC;YACvC,uCAAuC;YACvC,wCAAwC;YACxC,+BAA+B;YAC/B,8BAA8B;YAC9B,8BAA8B;YAC9B,+BAA+B;SAChC;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,CAAC,+BAA+B,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,yBAAyB,CAAC;QACjI,KAAK,EAAE,yIAAyI;KACjJ;IACD,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE;IAC7H,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;IAC3H,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE;CAChH,EAAE,CAAC;IACpC,6BAA6B,CAAC,MAA+B,CAAC,CAAC;AACjE,CAAC;AAED,+EAA+E;AAC/E,SAAgB,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,KAAK,IAAI,CAAC;IACpD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjH,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,+EAA+E;AAC/E,gGAAgG;AAChG,iEAA2D;AAC3D,KAAK,MAAM,MAAM,IAAI,wCAAiB;IAAE,6BAA6B,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACjG,8EAA8E;AAC9E,4EAA4E;AAC5E,iEAA2D;AAC3D,KAAK,MAAM,MAAM,IAAI,wCAAiB;IAAE,6BAA6B,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/dist/request-auth.d.ts

@@ -0,0 +1,32 @@
+import { type ProtectCondition } from '@atlasauth/authz';
+import type { AtlasBackend, SessionClaims } from './verify';
+/**
+ * Framework-neutral request authentication, shared by the Koa, Hapi and GraphQL
+ * adapters: read the `__session` cookie or `Authorization: Bearer` header
+ * (the header wins), verify locally against the JWKS and return the auth state.
+ * It never throws: a missing or bad token is the signed-out state, whose
+ * `has()` is `false` and `protect()` throws.
+ */
+export interface RequestAuth {
+    userId: string | null;
+    sessionId: string | null;
+    orgId: string | null;
+    orgRole: string | null;
+    claims: SessionClaims | null;
+    isSignedIn: boolean;
+    /** The impersonator (RFC 8693 `act`) or null. */
+    actor: {
+        sub: string;
+    } | null;
+    has(condition?: ProtectCondition): boolean;
+    /** Assert a condition; returns the claims or throws `ForbiddenError`. */
+    protect(condition?: ProtectCondition): SessionClaims;
+}
+export declare function signedOutAuth(): RequestAuth;
+export declare function signedInAuth(claims: SessionClaims): RequestAuth;
+type HeaderValue = string | string[] | undefined;
+/** The raw session token a request carries (bearer header first, then the `__session` cookie), or null. */
+export declare function sessionTokenFromHeaders(headers: Record<string, HeaderValue>): string | null;
+/** Verify a request's headers into a {@link RequestAuth}. Never throws. */
+export declare function authenticateHeaders(backend: AtlasBackend, headers: Record<string, HeaderValue>): Promise<RequestAuth>;
+export {};