@auth0/auth0-server-js 1.7.0 → 1.8.0

package/dist/index.d.cts

@@ -92,6 +92,15 @@ interface SessionData {
     tokenSets: TokenSet[];
     connectionTokenSets?: ConnectionTokenSet[];
     domain?: string;
+    /**
+     * IPSIE SL1 `session_expiry` ceiling for this session, as an absolute Unix timestamp in
+     * seconds. Present only when the user logged in through an enterprise connection configured
+     * with `id_token_session_expiry_supported: true`. When set, the SDK treats the session as
+     * expired once this time is reached (minus a small leeway) and forces re-authentication.
+     * Absent for database/social logins, connections without the option, and sessions created
+     * before this feature — those behave unchanged.
+     */
+    sessionExpiresAt?: number;
     [key: string]: unknown;
 }
 interface TransactionData {
@@ -619,6 +628,7 @@ declare class ServerClient<TStoreOptions = unknown> {
      *
      * @throws {MissingTransactionError} When no transaction was found.
      * @throws {TokenByCodeError} If there was an issue requesting the access token.
+     * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
      *
      * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).
      */
@@ -633,6 +643,7 @@ declare class ServerClient<TStoreOptions = unknown> {
      *
      * @throws {MissingSessionError} If there is no active session.
      * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.
+     * @throws {SessionExpiredError} When the session's `session_expiry` ceiling has been reached; the session is cleared and re-authentication is required.
      *
      * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.
      */
@@ -658,6 +669,7 @@ declare class ServerClient<TStoreOptions = unknown> {
      *
      * @throws {MissingSessionError} If there is no active session.
      * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.
+     * @throws {SessionExpiredError} When the session's `session_expiry` ceiling has been reached; the session is cleared and re-authentication is required.
      *
      * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.
      */
@@ -685,6 +697,7 @@ declare class ServerClient<TStoreOptions = unknown> {
      * @param storeOptions Optional options used to pass to the Transaction and State Store.
      *
      * @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.
+     * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
      *
      * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).
      */
@@ -954,8 +967,9 @@ declare abstract class AbstractSessionStore<TStoreOptions> extends AbstractState
     constructor(options: SessionConfiguration & EncryptedStoreOptions);
     /**
      * calculateMaxAge calculates the max age of the session based on createdAt and the rolling and absolute durations.
+     * When sessionExpiresAt is provided, caps the maxAge to not exceed the time until that ceiling.
      */
-    protected calculateMaxAge(createdAt: number): number;
+    protected calculateMaxAge(createdAt: number, sessionExpiresAt?: number): number;
 }
 
 interface StatefulStateStoreOptions<TStoreOptions> extends EncryptedStoreOptions {
@@ -1030,5 +1044,13 @@ declare class IssuerValidationError extends Error {
     code: string;
     constructor(message: string);
 }
+/**
+ * Error thrown when the session has passed its upstream IdP-asserted
+ * `session_expiry` ceiling (IPSIE SL1). The user must re-authenticate.
+ */
+declare class SessionExpiredError extends Error {
+    code: string;
+    constructor(message?: string);
+}
 
-export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, ServerClient, type ServerClientOptions, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, type SessionStore, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };
+export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, ServerClient, type ServerClientOptions, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };

package/dist/index.d.ts

@@ -92,6 +92,15 @@ interface SessionData {
     tokenSets: TokenSet[];
     connectionTokenSets?: ConnectionTokenSet[];
     domain?: string;
+    /**
+     * IPSIE SL1 `session_expiry` ceiling for this session, as an absolute Unix timestamp in
+     * seconds. Present only when the user logged in through an enterprise connection configured
+     * with `id_token_session_expiry_supported: true`. When set, the SDK treats the session as
+     * expired once this time is reached (minus a small leeway) and forces re-authentication.
+     * Absent for database/social logins, connections without the option, and sessions created
+     * before this feature — those behave unchanged.
+     */
+    sessionExpiresAt?: number;
     [key: string]: unknown;
 }
 interface TransactionData {
@@ -619,6 +628,7 @@ declare class ServerClient<TStoreOptions = unknown> {
      *
      * @throws {MissingTransactionError} When no transaction was found.
      * @throws {TokenByCodeError} If there was an issue requesting the access token.
+     * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
      *
      * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).
      */
@@ -633,6 +643,7 @@ declare class ServerClient<TStoreOptions = unknown> {
      *
      * @throws {MissingSessionError} If there is no active session.
      * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.
+     * @throws {SessionExpiredError} When the session's `session_expiry` ceiling has been reached; the session is cleared and re-authentication is required.
      *
      * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.
      */
@@ -658,6 +669,7 @@ declare class ServerClient<TStoreOptions = unknown> {
      *
      * @throws {MissingSessionError} If there is no active session.
      * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.
+     * @throws {SessionExpiredError} When the session's `session_expiry` ceiling has been reached; the session is cleared and re-authentication is required.
      *
      * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.
      */
@@ -685,6 +697,7 @@ declare class ServerClient<TStoreOptions = unknown> {
      * @param storeOptions Optional options used to pass to the Transaction and State Store.
      *
      * @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.
+     * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
      *
      * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).
      */
@@ -954,8 +967,9 @@ declare abstract class AbstractSessionStore<TStoreOptions> extends AbstractState
     constructor(options: SessionConfiguration & EncryptedStoreOptions);
     /**
      * calculateMaxAge calculates the max age of the session based on createdAt and the rolling and absolute durations.
+     * When sessionExpiresAt is provided, caps the maxAge to not exceed the time until that ceiling.
      */
-    protected calculateMaxAge(createdAt: number): number;
+    protected calculateMaxAge(createdAt: number, sessionExpiresAt?: number): number;
 }
 
 interface StatefulStateStoreOptions<TStoreOptions> extends EncryptedStoreOptions {
@@ -1030,5 +1044,13 @@ declare class IssuerValidationError extends Error {
     code: string;
     constructor(message: string);
 }
+/**
+ * Error thrown when the session has passed its upstream IdP-asserted
+ * `session_expiry` ceiling (IPSIE SL1). The user must re-authenticate.
+ */
+declare class SessionExpiredError extends Error {
+    code: string;
+    constructor(message?: string);
+}
 
-export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, ServerClient, type ServerClientOptions, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, type SessionStore, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };
+export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, ServerClient, type ServerClientOptions, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };

package/dist/index.js

@@ -48,14 +48,55 @@ var IssuerValidationError = class extends Error {
     this.name = "IssuerValidationError";
   }
 };
+var SessionExpiredError = class extends Error {
+  code = "session_expired";
+  constructor(message) {
+    super(
+      message ?? "The session has expired because the upstream identity provider session ceiling was reached. The user needs to re-authenticate."
+    );
+    this.name = "SessionExpiredError";
+  }
+};
 
 // src/state/utils.ts
+var SESSION_EXPIRY_LEEWAY = 30;
+var MAX_PLAUSIBLE_UNIX_SECONDS = 1e10;
+function isPlausibleUnixSeconds(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 && value < MAX_PLAUSIBLE_UNIX_SECONDS;
+}
+function extractSessionExpiry(claims) {
+  const value = claims?.session_expiry;
+  return isPlausibleUnixSeconds(value) ? value : void 0;
+}
+function isSessionExpiryReached(sessionExpiresAt, nowSeconds) {
+  if (sessionExpiresAt === void 0) {
+    return false;
+  }
+  const now = nowSeconds ?? Math.floor(Date.now() / 1e3);
+  return now >= sessionExpiresAt - SESSION_EXPIRY_LEEWAY;
+}
 var createUpdatedTokenSet = (audience, response) => ({
   audience,
   accessToken: response.accessToken,
   scope: response.scope,
   expiresAt: response.expiresAt
 });
+function isSessionExpiryInPast(sessionExpiresAt, issuedAt) {
+  if (sessionExpiresAt === void 0) {
+    return false;
+  }
+  const reference = isPlausibleUnixSeconds(issuedAt) ? issuedAt : Math.floor(Date.now() / 1e3);
+  return sessionExpiresAt <= reference + SESSION_EXPIRY_LEEWAY;
+}
+function applySessionExpiryAtLogin(stateData, claims) {
+  const sessionExpiresAt = extractSessionExpiry(claims);
+  if (isSessionExpiryInPast(sessionExpiresAt, claims?.iat)) {
+    throw new SessionExpiredError(
+      "The upstream identity provider session_expiry is at or before the issued-at time; refusing to create an already-expired session."
+    );
+  }
+  return { ...stateData, sessionExpiresAt };
+}
 function updateStateData(audience, stateData, tokenEndpointResponse, context) {
   if (stateData && tokenEndpointResponse.claims) {
     const newSub = tokenEndpointResponse.claims.sub;
@@ -163,7 +204,7 @@ function getTelemetryConfig(config) {
   return {
     enabled: true,
     name: config?.name ?? "@auth0/auth0-server-js",
-    version: config?.version ?? "1.7.0"
+    version: config?.version ?? "1.8.0"
   };
 }
 
@@ -225,9 +266,12 @@ var ServerMfaClient = class {
       this.#options.stateStoreIdentifier,
       storeOptions
     );
-    const updatedStateData = updateStateData(audience, existingStateData, tokenResponse, {
-      domain: this.#options.domain
-    });
+    const updatedStateData = applySessionExpiryAtLogin(
+      updateStateData(audience, existingStateData, tokenResponse, {
+        domain: this.#options.domain
+      }),
+      tokenResponse.claims
+    );
     await this.#options.stateStore.set(
       this.#options.stateStoreIdentifier,
       updatedStateData,
@@ -553,6 +597,7 @@ var ServerClient = class {
    *
    * @throws {MissingTransactionError} When no transaction was found.
    * @throws {TokenByCodeError} If there was an issue requesting the access token.
+   * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
    *
    * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).
    */
@@ -567,12 +612,15 @@ var ServerClient = class {
       // TransactionData.codeVerifier is optional only to accommodate magic-link transactions.
       codeVerifier: transactionData.codeVerifier
     });
+    await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
-    const stateData = updateStateData(transactionData.audience ?? "default", existingStateData, tokenEndpointResponse, {
-      domain
-    });
+    const stateData = applySessionExpiryAtLogin(
+      updateStateData(transactionData.audience ?? "default", existingStateData, tokenEndpointResponse, {
+        domain
+      }),
+      tokenEndpointResponse.claims
+    );
     await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);
-    await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);
     return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails };
   }
   /**
@@ -582,6 +630,7 @@ var ServerClient = class {
    *
    * @throws {MissingSessionError} If there is no active session.
    * @throws {BuildLinkUserUrlError} If there was an issue when building the Authorization URL.
+   * @throws {SessionExpiredError} When the session's `session_expiry` ceiling has been reached; the session is cleared and re-authentication is required.
    *
    * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.
    */
@@ -598,6 +647,10 @@ var ServerClient = class {
         throw new MissingSessionError("Session domain does not match the current domain.");
       }
     }
+    if (isSessionExpiryReached(stateData.sessionExpiresAt)) {
+      await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
+      throw new SessionExpiredError();
+    }
     const domain = this.#getSessionDomain(stateData);
     const authClient = this.#getAuthClient(domain);
     const { linkUserUrl, codeVerifier } = await authClient.buildLinkUserUrl({
@@ -641,6 +694,7 @@ var ServerClient = class {
    *
    * @throws {MissingSessionError} If there is no active session.
    * @throws {BuildUnlinkUserUrlError} If there was an issue when building the User Unlinking URL.
+   * @throws {SessionExpiredError} When the session's `session_expiry` ceiling has been reached; the session is cleared and re-authentication is required.
    *
    * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.
    */
@@ -657,6 +711,10 @@ var ServerClient = class {
         throw new MissingSessionError("Session domain does not match the current domain.");
       }
     }
+    if (isSessionExpiryReached(stateData.sessionExpiresAt)) {
+      await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
+      throw new SessionExpiredError();
+    }
     const domain = this.#getSessionDomain(stateData);
     const authClient = this.#getAuthClient(domain);
     const { unlinkUserUrl, codeVerifier } = await authClient.buildUnlinkUserUrl({
@@ -701,6 +759,7 @@ var ServerClient = class {
    * @param storeOptions Optional options used to pass to the Transaction and State Store.
    *
    * @throws {BackchannelAuthenticationError} If there was an issue when doing backchannel authentication.
+   * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
    *
    * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).
    */
@@ -717,11 +776,11 @@ var ServerClient = class {
       }
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
-    const stateData = updateStateData(
-      this.#options.authorizationParams?.audience ?? "default",
-      existingStateData,
-      tokenEndpointResponse,
-      { domain }
+    const stateData = applySessionExpiryAtLogin(
+      updateStateData(this.#options.authorizationParams?.audience ?? "default", existingStateData, tokenEndpointResponse, {
+        domain
+      }),
+      tokenEndpointResponse.claims
     );
     await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);
     return {
@@ -916,6 +975,10 @@ var ServerClient = class {
         return;
       }
     }
+    if (isSessionExpiryReached(stateData.sessionExpiresAt)) {
+      await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
+      return;
+    }
     return stateData.user;
   }
   /**
@@ -932,6 +995,10 @@ var ServerClient = class {
           return;
         }
       }
+      if (isSessionExpiryReached(stateData.sessionExpiresAt)) {
+        await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
+        return;
+      }
       const { internal, ...sessionData } = stateData;
       return sessionData;
     }
@@ -948,6 +1015,7 @@ var ServerClient = class {
    * @param storeOptions Optional options used to pass to the Transaction and State Store.
    *
    * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token. When the cause is `mfa_required`, use `isMfaRequiredError(error)` to narrow the error and read `cause.mfa_token`.
+   * @throws {SessionExpiredError} When the session's `session_expiry` ceiling has been reached; the session is cleared and no refresh is attempted — the user must re-authenticate.
    *
    * @returns The Token Set, containing the access token, as well as additional information.
    */
@@ -975,6 +1043,10 @@ var ServerClient = class {
         throw new MissingSessionError("Session domain does not match the current domain.");
       }
     }
+    if (stateData && isSessionExpiryReached(stateData.sessionExpiresAt)) {
+      await this.#stateStore.delete(this.#stateStoreIdentifier, resolvedStoreOptions);
+      throw new SessionExpiredError();
+    }
     const tokenSet = stateData?.tokenSets.find(
       (tokenSet2) => tokenSet2.audience === audience && (!scope || compareScopes(tokenSet2.scope, scope))
     );
@@ -1349,14 +1421,14 @@ var AbstractSessionStore = class extends AbstractStateStore {
   }
   /**
    * calculateMaxAge calculates the max age of the session based on createdAt and the rolling and absolute durations.
+   * When sessionExpiresAt is provided, caps the maxAge to not exceed the time until that ceiling.
    */
-  calculateMaxAge(createdAt) {
-    if (!this.#rolling) {
-      return this.#absoluteDuration;
-    }
+  calculateMaxAge(createdAt, sessionExpiresAt) {
     const now = Date.now() / 1e3 | 0;
-    const expiresAt = Math.min(now + this.#inactivityDuration, createdAt + this.#absoluteDuration);
-    const maxAge = expiresAt - now;
+    let maxAge = this.#rolling ? Math.min(now + this.#inactivityDuration, createdAt + this.#absoluteDuration) - now : this.#absoluteDuration;
+    if (sessionExpiresAt !== void 0) {
+      maxAge = Math.min(maxAge, sessionExpiresAt - now);
+    }
     return maxAge > 0 ? maxAge : 0;
   }
 };
@@ -1384,7 +1456,7 @@ var StatefulStateStore = class extends AbstractSessionStore {
       sessionId = generateId();
     }
     sessionId ??= generateId();
-    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);
+    const maxAge = this.calculateMaxAge(stateData.internal.createdAt, stateData.sessionExpiresAt);
     const cookieOpts = this.#getCookieOptions({
       maxAge
     });
@@ -1449,7 +1521,7 @@ var StatelessStateStore = class extends AbstractSessionStore {
     this.#cookieHandler = cookieHandler;
   }
   async set(identifier, stateData, removeIfExists, options) {
-    const maxAge = this.calculateMaxAge(stateData.internal.createdAt);
+    const maxAge = this.calculateMaxAge(stateData.internal.createdAt, stateData.sessionExpiresAt);
     const cookieOpts = this.#getCookieOptions({
       maxAge
     });
@@ -1543,6 +1615,7 @@ export {
   ServerClient,
   ServerMfaClient,
   ServerPasskeyClient,
+  SessionExpiredError,
   StartLinkUserError,
   StatefulStateStore,
   StatelessStateStore,