@authyon/server 0.2.0-beta.5 → 0.2.0-beta.8

package/dist/bff.js

@@ -0,0 +1,791 @@
+import {
+  AuthyonError,
+  DEFAULT_BASE_URL,
+  JsonHttpClient,
+  createSharedTransport
+} from "./chunk-56H66KLG.js";
+import "./chunk-77J4NURK.js";
+
+// src/bff/contracts.ts
+var BffSessionError = class extends Error {
+  constructor(code, status, clearCookie = false) {
+    super(code);
+    this.code = code;
+    this.status = status;
+    this.clearCookie = clearCookie;
+    this.name = "BffSessionError";
+  }
+};
+
+// src/bff/http.ts
+var MAX_BODY_BYTES = 16384;
+var SESSION_ID = /^[a-f0-9]{64}$/;
+function createBffHttp(options) {
+  const url = new URL(options.origin);
+  const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  const insecure = url.protocol === "http:" && loopback && options.allowInsecureLocalhost === true;
+  if (!insecure && url.protocol !== "https:" || url.origin !== options.origin) {
+    throw new Error("Authyon BFF: origin must be an HTTPS origin, without path or credentials");
+  }
+  const cookieName = insecure ? "authyon.session" : "__Host-authyon.session";
+  const attributes = `Path=/; HttpOnly; SameSite=Lax${insecure ? "" : "; Secure"}`;
+  function assertRequest(request) {
+    if (new URL(request.url).origin !== options.origin)
+      throw new BffSessionError("request.origin_denied", 403);
+    const origin = request.headers.get("origin");
+    if (origin && origin !== options.origin || request.headers.get("sec-fetch-site") === "cross-site") {
+      throw new BffSessionError("request.origin_denied", 403);
+    }
+    if (!["GET", "HEAD"].includes(request.method)) {
+      if (origin !== options.origin || request.headers.get("x-authyon-csrf") !== "1") {
+        throw new BffSessionError("request.csrf_denied", 403);
+      }
+    }
+  }
+  function sessionId(request) {
+    const matches = (request.headers.get("cookie") ?? "").split(";").map((part) => part.trim()).filter((part) => part.startsWith(`${cookieName}=`));
+    if (matches.length > 1) throw new BffSessionError("session.ambiguous_cookie", 401, true);
+    const value = matches[0]?.slice(cookieName.length + 1);
+    return value && SESSION_ID.test(value) ? value : null;
+  }
+  function response(body, init = {}) {
+    const headers = new Headers({
+      "cache-control": "no-store",
+      pragma: "no-cache",
+      vary: "Cookie",
+      "x-content-type-options": "nosniff"
+    });
+    if (init.cookie) headers.set("set-cookie", init.cookie);
+    if (body !== null) headers.set("content-type", "application/json");
+    return new Response(body === null ? null : JSON.stringify(body), {
+      status: init.status ?? 200,
+      headers
+    });
+  }
+  function expireCookie() {
+    return `${cookieName}=; ${attributes}; Max-Age=0`;
+  }
+  function errorResponse(error) {
+    if (error instanceof BffSessionError) {
+      return response(
+        { error: { code: error.code } },
+        { status: error.status, cookie: error.clearCookie ? expireCookie() : void 0 }
+      );
+    }
+    if (error instanceof AuthyonError) {
+      const status = [400, 401, 403, 429].includes(error.status) ? error.status : 503;
+      const result = response(
+        { error: { code: status === 503 ? "provider.unavailable" : "provider.rejected" } },
+        { status }
+      );
+      if (error.retryAfter !== void 0)
+        result.headers.set("retry-after", String(error.retryAfter));
+      return result;
+    }
+    return response({ error: { code: "session.unavailable" } }, { status: 503 });
+  }
+  return {
+    assertRequest,
+    sessionId,
+    response,
+    expireCookie,
+    errorResponse,
+    cookie(id, expiresAt) {
+      return `${cookieName}=${id}; ${attributes}; Max-Age=${Math.max(0, Math.floor((expiresAt - Date.now()) / 1e3))}`;
+    }
+  };
+}
+async function readBffBody(request) {
+  if (request.headers.get("content-type")?.split(";")[0].trim().toLowerCase() !== "application/json") {
+    throw new BffSessionError("request.json_required", 415);
+  }
+  if (!request.body) throw new BffSessionError("request.invalid_body", 400);
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_BODY_BYTES) {
+        await reader.cancel();
+        throw new BffSessionError("request.body_too_large", 413);
+      }
+      chunks.push(value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    const body = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (!body || typeof body !== "object" || Array.isArray(body))
+      throw new Error("invalid JSON object");
+    return body;
+  } catch (error) {
+    if (error instanceof BffSessionError) throw error;
+    throw new BffSessionError("request.invalid_body", 400);
+  } finally {
+    reader.releaseLock();
+  }
+}
+function inputString(body, name) {
+  const value = body[name];
+  if (typeof value !== "string" || value.length === 0)
+    throw new BffSessionError("request.invalid_body", 400);
+  return value;
+}
+function sessionPersistence(body) {
+  const value = body.sessionPersistence;
+  if (value === void 0 || value === "standard") return "standard";
+  if (value === "remembered") return "remembered";
+  throw new BffSessionError("request.invalid_body", 400);
+}
+function loginInput(body) {
+  return {
+    password: inputString(body, "password"),
+    ...body.email !== void 0 ? { email: inputString(body, "email") } : { username: inputString(body, "username") },
+    ...body.organizationSlug !== void 0 ? { organizationSlug: inputString(body, "organizationSlug") } : {},
+    sessionPersistence: sessionPersistence(body)
+  };
+}
+function twoFactorInput(body) {
+  const method = inputString(body, "method");
+  const challengeToken = inputString(body, "challengeToken");
+  const persistence = sessionPersistence(body);
+  if (method !== "webauthn") {
+    return {
+      challengeToken,
+      method,
+      code: inputString(body, "code"),
+      sessionPersistence: persistence
+    };
+  }
+  const assertion = body.webAuthnAssertion;
+  if (!assertion || typeof assertion !== "object" || Array.isArray(assertion))
+    throw new BffSessionError("request.invalid_body", 400);
+  const fields = assertion;
+  return {
+    challengeToken,
+    method,
+    sessionPersistence: persistence,
+    webAuthnAssertion: {
+      ceremonyToken: inputString(fields, "ceremonyToken"),
+      assertionJson: inputString(fields, "assertionJson")
+    }
+  };
+}
+
+// src/bff/sessionRepository.ts
+import { createHash, randomBytes } from "crypto";
+var OPERATION_TIMEOUT_MS = 12e4;
+var CONTENTION_TIMEOUT_MS = 2e3;
+var CONTENTION_POLL_MS = 20;
+var newSessionSecret = () => randomBytes(32).toString("hex");
+var sessionKey = (id, origin) => createHash("sha256").update(`${origin}\0${id}`).digest("hex");
+var BffSessionRepository = class {
+  constructor(store, origin) {
+    this.store = store;
+    this.origin = origin;
+  }
+  async create(record) {
+    const id = newSessionSecret();
+    if (!await this.store.compareAndSwap(sessionKey(id, this.origin), null, record)) {
+      throw new BffSessionError("session.creation_failed", 503);
+    }
+    return id;
+  }
+  async acquire(id) {
+    const key = sessionKey(id, this.origin);
+    const deadline = Date.now() + CONTENTION_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      const record = await this.readAvailable(key, deadline);
+      const reserved = {
+        ...record,
+        revision: newSessionSecret(),
+        busyUntil: Date.now() + OPERATION_TIMEOUT_MS
+      };
+      if (await this.store.compareAndSwap(key, record.revision, reserved))
+        return { key, record: reserved };
+    }
+    throw new BffSessionError("session.busy", 503);
+  }
+  async inspect(id) {
+    const key = sessionKey(id, this.origin);
+    const record = await this.readAvailable(key, Date.now() + CONTENTION_TIMEOUT_MS);
+    return { key, record };
+  }
+  async touch(lease, idleExpiresAt) {
+    const next = {
+      ...lease.record,
+      revision: newSessionSecret(),
+      idleExpiresAt
+    };
+    return await this.store.compareAndSwap(lease.key, lease.record.revision, next) ? next : null;
+  }
+  async removeIfCurrent(lease) {
+    return this.store.compareAndSwap(lease.key, lease.record.revision, null);
+  }
+  async release(lease) {
+    if (lease.record.busyUntil === null || lease.record.busyUntil <= Date.now()) {
+      await this.remove(lease);
+      throw new BffSessionError("session.interrupted", 503, true);
+    }
+    const next = { ...lease.record, revision: newSessionSecret(), busyUntil: null };
+    if (!await this.store.compareAndSwap(lease.key, lease.record.revision, next)) {
+      throw new BffSessionError("session.changed", 401, true);
+    }
+  }
+  async remove(lease) {
+    if (!await this.removeIfCurrent(lease)) {
+      throw new BffSessionError("session.changed", 401, true);
+    }
+  }
+  async readAvailable(key, deadline) {
+    while (Date.now() < deadline) {
+      const record = await this.store.read(key);
+      if (!record) throw new BffSessionError("session.missing", 401, true);
+      if (Math.min(record.expiresAt, record.idleExpiresAt) <= Date.now()) {
+        if (await this.store.compareAndSwap(key, record.revision, null)) {
+          throw new BffSessionError("session.expired", 401, true);
+        }
+        continue;
+      }
+      if (record.busyUntil === null) return record;
+      if (record.busyUntil <= Date.now()) {
+        if (await this.store.compareAndSwap(key, record.revision, null)) {
+          throw new BffSessionError("session.interrupted", 503, true);
+        }
+        continue;
+      }
+      await new Promise((resolve) => setTimeout(resolve, CONTENTION_POLL_MS));
+    }
+    throw new BffSessionError("session.busy", 503);
+  }
+};
+
+// src/bff/sessionManager.ts
+var DEFAULT_ABSOLUTE_TIMEOUT_MS = 8 * 60 * 60 * 1e3;
+var DEFAULT_IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
+var DEFAULT_REMEMBERED_ABSOLUTE_TIMEOUT_MS = 90 * 24 * 60 * 60 * 1e3;
+var DEFAULT_REMEMBERED_IDLE_TIMEOUT_MS = 30 * 24 * 60 * 60 * 1e3;
+var DEFAULT_REFRESH_AHEAD_MS = 3e4;
+var MAX_SESSION_CHANGE_RETRIES = 2;
+function positiveDuration(value) {
+  if (!Number.isSafeInteger(value) || value <= 0)
+    throw new Error("Authyon BFF: durations must be positive integer milliseconds");
+  return value;
+}
+function rejectedCredential(error) {
+  return error instanceof AuthyonError && [401, 403].includes(error.status);
+}
+var BffSessionManager = class {
+  constructor(options) {
+    this.options = options;
+    this.repository = new BffSessionRepository(options.store, options.origin);
+    this.standardSession = this.createSessionLifetime({
+      absoluteTimeoutMs: options.absoluteTimeoutMs ?? DEFAULT_ABSOLUTE_TIMEOUT_MS,
+      idleTimeoutMs: options.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS
+    });
+    this.rememberedSession = this.createSessionLifetime({
+      absoluteTimeoutMs: options.rememberedSession?.absoluteTimeoutMs ?? DEFAULT_REMEMBERED_ABSOLUTE_TIMEOUT_MS,
+      idleTimeoutMs: options.rememberedSession?.idleTimeoutMs ?? DEFAULT_REMEMBERED_IDLE_TIMEOUT_MS
+    });
+    this.refreshAhead = positiveDuration(options.refreshAheadMs ?? DEFAULT_REFRESH_AHEAD_MS);
+  }
+  async create(tokens, organizationSlug, sessionPersistence2 = "standard") {
+    try {
+      const user = await this.verifiedProfile(tokens);
+      if (organizationSlug !== void 0 && user.organization?.slug !== organizationSlug) {
+        throw new BffSessionError("session.organization_mismatch", 502);
+      }
+      const lifetime = this.sessionLifetime(sessionPersistence2);
+      const record = {
+        tokens,
+        user,
+        revision: newSessionSecret(),
+        busyUntil: null,
+        sessionPersistence: sessionPersistence2,
+        expiresAt: Date.now() + lifetime.absoluteTimeoutMs,
+        idleExpiresAt: Date.now() + lifetime.idleTimeoutMs
+      };
+      return { id: await this.repository.create(record), record };
+    } catch (error) {
+      await this.revokeUnstoredTokens(tokens);
+      throw error;
+    }
+  }
+  async read(id) {
+    return this.readCurrent(id, 0);
+  }
+  async switchOrganization(id, slug) {
+    return this.update(id, async (lease) => {
+      const refreshed = await this.refreshIfNeeded(lease);
+      if (!refreshed && !await this.options.provider.validate(lease.record.tokens.accessToken)) {
+        throw new BffSessionError("session.revoked", 401, true);
+      }
+      await this.rotate(lease, {
+        issue: () => this.issueOrganizationTokens(lease.record.tokens.accessToken, slug),
+        accepts: (user) => user.id === lease.record.user.id && user.organization?.slug === slug
+      });
+    });
+  }
+  async logout(id) {
+    const lease = await this.repository.acquire(id);
+    await this.repository.remove(lease);
+    try {
+      await this.options.provider.logout(lease.record.tokens.refreshToken);
+    } catch {
+      throw new BffSessionError("session.upstream_revocation_failed", 503, true);
+    }
+  }
+  async update(id, operation) {
+    const lease = await this.repository.acquire(id);
+    try {
+      await operation(lease);
+    } catch (error) {
+      if (rejectedCredential(error) || error instanceof BffSessionError && error.clearCookie) {
+        await this.repository.remove(lease);
+        if (error instanceof BffSessionError) throw error;
+        throw new BffSessionError("session.revoked", 401, true);
+      }
+      await this.repository.release(lease);
+      throw error;
+    }
+    lease.record.idleExpiresAt = Math.min(
+      lease.record.expiresAt,
+      Date.now() + this.sessionLifetime(lease.record.sessionPersistence).idleTimeoutMs
+    );
+    await this.repository.release(lease);
+    return lease.record;
+  }
+  async readCurrent(id, changeRetries) {
+    const lease = await this.repository.inspect(id);
+    if (this.needsRefresh(lease.record)) {
+      return this.update(id, async (reserved) => {
+        const refreshed = await this.refreshIfNeeded(reserved);
+        if (!refreshed && !await this.options.provider.validate(reserved.record.tokens.accessToken)) {
+          throw new BffSessionError("session.revoked", 401, true);
+        }
+      });
+    }
+    let valid;
+    try {
+      valid = await this.options.provider.validate(lease.record.tokens.accessToken);
+    } catch (error) {
+      if (!rejectedCredential(error)) throw error;
+      valid = false;
+    }
+    if (!valid) {
+      if (await this.repository.removeIfCurrent(lease)) {
+        throw new BffSessionError("session.revoked", 401, true);
+      }
+      if (changeRetries >= MAX_SESSION_CHANGE_RETRIES) {
+        throw new BffSessionError("session.changed", 503);
+      }
+      return this.readCurrent(id, changeRetries + 1);
+    }
+    const idleExpiresAt = Math.min(
+      lease.record.expiresAt,
+      Date.now() + this.sessionLifetime(lease.record.sessionPersistence).idleTimeoutMs
+    );
+    return await this.repository.touch(lease, idleExpiresAt) ?? lease.record;
+  }
+  createSessionLifetime(lifetime) {
+    const absoluteTimeoutMs = positiveDuration(lifetime.absoluteTimeoutMs);
+    const idleTimeoutMs = positiveDuration(lifetime.idleTimeoutMs);
+    if (idleTimeoutMs > absoluteTimeoutMs)
+      throw new Error("Authyon BFF: idle timeout must not exceed absolute timeout");
+    return { absoluteTimeoutMs, idleTimeoutMs };
+  }
+  sessionLifetime(sessionPersistence2) {
+    if (sessionPersistence2 === "remembered") return this.rememberedSession;
+    return this.standardSession;
+  }
+  needsRefresh(record) {
+    return record.tokens.expiresAt - this.refreshAhead <= Date.now();
+  }
+  async refreshIfNeeded(lease) {
+    if (!this.needsRefresh(lease.record)) return false;
+    await this.rotate(lease, {
+      issue: () => this.options.provider.refresh(lease.record.tokens.refreshToken),
+      accepts: (user) => user.id === lease.record.user.id && user.organization?.id === lease.record.user.organization?.id
+    });
+    return true;
+  }
+  async rotate(lease, operation) {
+    let tokens;
+    try {
+      tokens = await operation.issue();
+    } catch (error) {
+      if (error instanceof AuthyonError && error.status === 429) throw error;
+      if (error instanceof BffSessionError && error.code === "organization.forbidden") throw error;
+      if (rejectedCredential(error)) throw error;
+      if (error instanceof BffSessionError && error.clearCookie) throw error;
+      throw new BffSessionError("session.rotation_interrupted", 503, true);
+    }
+    try {
+      const user = await this.verifiedProfile(tokens);
+      if (!operation.accepts(user))
+        throw new BffSessionError("session.identity_changed", 502, true);
+      lease.record.tokens = tokens;
+      lease.record.user = user;
+    } catch {
+      await this.revokeUnstoredTokens(tokens);
+      throw new BffSessionError("session.rotation_interrupted", 503, true);
+    }
+  }
+  async issueOrganizationTokens(accessToken, slug) {
+    try {
+      return await this.options.provider.switchOrganization(accessToken, slug);
+    } catch (error) {
+      if (error instanceof AuthyonError && error.status === 403)
+        throw new BffSessionError("organization.forbidden", 403);
+      throw error;
+    }
+  }
+  async verifiedProfile(tokens) {
+    if (!tokens.accessToken || !tokens.refreshToken || !Number.isFinite(tokens.expiresAt) || tokens.expiresAt <= Date.now()) {
+      throw new BffSessionError("provider.invalid_tokens", 502);
+    }
+    if (!await this.options.provider.validate(tokens.accessToken))
+      throw new BffSessionError("session.revoked", 401, true);
+    const user = await this.options.provider.profile(tokens.accessToken);
+    return {
+      id: user.id,
+      email: user.email,
+      organization: user.organization ? { id: user.organization.id, slug: user.organization.slug } : null
+    };
+  }
+  async revokeUnstoredTokens(tokens) {
+    try {
+      await this.options.provider.logout(tokens.refreshToken);
+    } catch {
+      throw new BffSessionError("session.upstream_revocation_failed", 503, true);
+    }
+  }
+};
+
+// src/bff/handlers.ts
+function publicSession(record) {
+  return { authenticated: true, user: record.user, expiresAt: record.expiresAt };
+}
+function createBffSession(options) {
+  const http = createBffHttp(options);
+  const manager = new BffSessionManager(options);
+  function requiredSessionId(request) {
+    const id = http.sessionId(request);
+    if (!id) throw new BffSessionError("session.missing", 401, true);
+    return id;
+  }
+  function handler(method, action) {
+    return async (request) => {
+      try {
+        if (request.method !== method) {
+          const response = http.response(
+            { error: { code: "request.method_not_allowed" } },
+            { status: 405 }
+          );
+          response.headers.set("allow", method);
+          return response;
+        }
+        http.assertRequest(request);
+        return await action(request);
+      } catch (error) {
+        return http.errorResponse(error);
+      }
+    };
+  }
+  async function finishLogin(tokens, organizationSlug, sessionPersistence2) {
+    const { id, record } = await manager.create(tokens, organizationSlug, sessionPersistence2);
+    return http.response(publicSession(record), { cookie: http.cookie(id, record.expiresAt) });
+  }
+  async function assertSignedOut(request) {
+    const id = http.sessionId(request);
+    if (!id) return;
+    try {
+      await manager.read(id);
+    } catch (error) {
+      if (error instanceof BffSessionError && error.status === 401) return;
+      throw error;
+    }
+    throw new BffSessionError("session.already_authenticated", 409);
+  }
+  return {
+    login: handler("POST", async (request) => {
+      await assertSignedOut(request);
+      const input = loginInput(await readBffBody(request));
+      const result = await options.provider.login(input);
+      if ("twoFactorRequired" in result) {
+        return http.response({
+          twoFactorRequired: true,
+          challengeToken: result.challengeToken,
+          methods: result.methods
+        });
+      }
+      return finishLogin(result, input.organizationSlug, input.sessionPersistence);
+    }),
+    verifyTwoFactor: handler("POST", async (request) => {
+      await assertSignedOut(request);
+      const input = twoFactorInput(await readBffBody(request));
+      const tokens = await options.provider.verifyTwoFactor(input);
+      return finishLogin(tokens, void 0, input.sessionPersistence);
+    }),
+    session: handler(
+      "GET",
+      async (request) => http.response(publicSession(await manager.read(requiredSessionId(request))))
+    ),
+    switchOrganization: handler("POST", async (request) => {
+      const slug = inputString(await readBffBody(request), "organizationSlug");
+      return http.response(
+        publicSession(await manager.switchOrganization(requiredSessionId(request), slug))
+      );
+    }),
+    logout: handler("POST", async (request) => {
+      const id = http.sessionId(request);
+      if (id) {
+        try {
+          await manager.logout(id);
+        } catch (error) {
+          if (!(error instanceof BffSessionError) || error.status !== 401) throw error;
+        }
+      }
+      return http.response(null, { status: 204, cookie: http.expireCookie() });
+    }),
+    /** Server-only credential for downstream calls. Never serialize this result to the browser. */
+    async requireSession(request) {
+      http.assertRequest(request);
+      const record = await manager.read(requiredSessionId(request));
+      return {
+        accessToken: record.tokens.accessToken,
+        user: record.user,
+        expiresAt: record.expiresAt
+      };
+    },
+    errorResponse: http.errorResponse
+  };
+}
+
+// src/bff/authyonProvider.ts
+function object(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new BffSessionError("provider.malformed_response", 502);
+  }
+  return value;
+}
+function requiredString(value) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new BffSessionError("provider.malformed_response", 502);
+  }
+  return value;
+}
+function readTokens(value) {
+  const response = object(value);
+  const tokens = object(response.tokens ?? response);
+  if (typeof tokens.expiresIn !== "number" || !Number.isFinite(tokens.expiresIn) || tokens.expiresIn <= 0) {
+    throw new BffSessionError("provider.missing_token_lifetime", 502);
+  }
+  return {
+    accessToken: requiredString(tokens.accessToken),
+    refreshToken: requiredString(tokens.refreshToken),
+    expiresAt: Date.now() + tokens.expiresIn * 1e3
+  };
+}
+function readChallenge(value) {
+  const challenge = object(value);
+  if (!Array.isArray(challenge.methods) || !challenge.methods.every((method) => typeof method === "string")) {
+    throw new BffSessionError("provider.malformed_challenge", 502);
+  }
+  return {
+    twoFactorRequired: true,
+    challengeToken: requiredString(challenge.challengeToken),
+    methods: challenge.methods
+  };
+}
+function readProfile(value) {
+  const user = object(value);
+  const activeOrganization = user.activeOrganization ?? user.tenant;
+  const organization = activeOrganization == null ? null : object(activeOrganization);
+  return {
+    id: requiredString(user.id),
+    email: requiredString(user.email),
+    organization: organization ? { id: requiredString(organization.id), slug: requiredString(organization.slug) } : null
+  };
+}
+function createAuthyonBffProvider(options) {
+  if (!options.envKey) throw new Error("Authyon BFF: envKey is required");
+  const http = new JsonHttpClient(
+    createSharedTransport({
+      ...options,
+      baseUrl: options.baseUrl ?? DEFAULT_BASE_URL
+    })
+  );
+  const headers = { "X-Authyon-Environment": options.envKey };
+  const bearer = (token) => ({ ...headers, Authorization: `Bearer ${token}` });
+  return {
+    async login(input) {
+      const credentials = { ...input };
+      delete credentials.organizationSlug;
+      delete credentials.sessionPersistence;
+      const response = object(
+        await http.request("/auth/login", {
+          method: "POST",
+          headers,
+          body: {
+            ...credentials,
+            ...input.organizationSlug ? { tenantSlug: input.organizationSlug } : {}
+          }
+        })
+      );
+      return response.twoFactor ? readChallenge(response.twoFactor) : readTokens(response);
+    },
+    async verifyTwoFactor(input) {
+      const verification = { ...input };
+      delete verification.sessionPersistence;
+      return readTokens(
+        await http.request("/auth/2fa/verify", { method: "POST", headers, body: verification })
+      );
+    },
+    async refresh(refreshToken) {
+      return readTokens(
+        await http.request("/auth/refresh", { method: "POST", headers, body: { refreshToken } })
+      );
+    },
+    async logout(refreshToken) {
+      await http.request("/auth/logout", { method: "POST", headers, body: { refreshToken } });
+    },
+    async switchOrganization(accessToken, slug) {
+      return readTokens(
+        await http.request("/auth/switch-tenant", {
+          method: "POST",
+          headers: bearer(accessToken),
+          body: { tenantSlug: slug }
+        })
+      );
+    },
+    async validate(accessToken) {
+      try {
+        const result = await options.validator.validate(accessToken);
+        return result.valid === true && result.user != null;
+      } catch (error) {
+        if (error instanceof AuthyonError)
+          throw new BffSessionError("provider.validation_unavailable", 503);
+        throw error;
+      }
+    },
+    async profile(accessToken) {
+      return readProfile(await http.request("/auth/me", { headers: bearer(accessToken) }));
+    }
+  };
+}
+
+// src/bff/memoryStore.ts
+function createMemoryBffSessionStore() {
+  const sessions = /* @__PURE__ */ new Map();
+  function read(key) {
+    const session = sessions.get(key);
+    if (!session) return null;
+    if (Math.min(session.expiresAt, session.idleExpiresAt) <= Date.now()) {
+      sessions.delete(key);
+      return null;
+    }
+    return structuredClone(session);
+  }
+  return {
+    async read(key) {
+      return read(key);
+    },
+    async compareAndSwap(key, expectedRevision, next) {
+      if ((read(key)?.revision ?? null) !== expectedRevision) return false;
+      if (next) {
+        if (expectedRevision === null) {
+          for (const sessionKey2 of sessions.keys()) read(sessionKey2);
+        }
+        sessions.set(key, structuredClone(next));
+      } else {
+        sessions.delete(key);
+      }
+      return true;
+    }
+  };
+}
+
+// src/bff/redisStore.ts
+import { EncryptJWT, jwtDecrypt } from "jose";
+var COMPARE_AND_SWAP = `
+local current = redis.call('GET', KEYS[1])
+local revision = ''
+if current then revision = cjson.decode(current).revision end
+if revision ~= ARGV[1] then return 0 end
+if ARGV[2] == '' then
+  redis.call('DEL', KEYS[1])
+else
+  redis.call('SET', KEYS[1], ARGV[2], 'PX', ARGV[3])
+end
+return 1
+`;
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+function isFiniteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+function isOrganization(value) {
+  return value === null || isObject(value) && typeof value.id === "string" && typeof value.slug === "string";
+}
+function isSessionRecord(value) {
+  if (!isObject(value) || !isObject(value.tokens) || !isObject(value.user)) return false;
+  return typeof value.revision === "string" && typeof value.tokens.accessToken === "string" && typeof value.tokens.refreshToken === "string" && isFiniteNumber(value.tokens.expiresAt) && typeof value.user.id === "string" && typeof value.user.email === "string" && isOrganization(value.user.organization) && (value.sessionPersistence === void 0 || value.sessionPersistence === "standard" || value.sessionPersistence === "remembered") && isFiniteNumber(value.expiresAt) && isFiniteNumber(value.idleExpiresAt) && (value.busyUntil === null || isFiniteNumber(value.busyUntil));
+}
+function createRedisBffSessionStore(options) {
+  if (options.encryptionKey.byteLength !== 32) {
+    throw new Error("Authyon BFF: encryptionKey must contain 32 bytes");
+  }
+  const encryptionKey = new Uint8Array(options.encryptionKey);
+  const prefix = options.prefix ?? "authyon:bff:";
+  return {
+    async read(key) {
+      const serialized = await options.client.get(prefix + key);
+      if (!serialized) return null;
+      try {
+        const envelope = JSON.parse(serialized);
+        const { payload } = await jwtDecrypt(envelope.ciphertext, encryptionKey, {
+          keyManagementAlgorithms: ["dir"],
+          contentEncryptionAlgorithms: ["A256GCM"],
+          audience: prefix + key
+        });
+        const record = payload.session;
+        if (!isSessionRecord(record) || record.revision !== envelope.revision) {
+          throw new Error("invalid session record");
+        }
+        return record;
+      } catch {
+        throw new BffSessionError("session.storage_invalid", 503);
+      }
+    },
+    async compareAndSwap(key, expectedRevision, next) {
+      const expiresAt = next ? Math.min(next.expiresAt, next.idleExpiresAt) : Date.now();
+      const ttl = Math.ceil(expiresAt - Date.now());
+      if (next && ttl <= 0) return false;
+      let serialized = "";
+      if (next) {
+        const ciphertext = await new EncryptJWT({ session: next }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setAudience(prefix + key).encrypt(encryptionKey);
+        serialized = JSON.stringify({ revision: next.revision, ciphertext });
+      }
+      const result = await options.client.eval(COMPARE_AND_SWAP, {
+        keys: [prefix + key],
+        arguments: [expectedRevision ?? "", serialized, String(ttl)]
+      });
+      return result === 1;
+    }
+  };
+}
+export {
+  BffSessionError,
+  createAuthyonBffProvider,
+  createBffSession,
+  createMemoryBffSessionStore,
+  createRedisBffSessionStore
+};