@baseplate-dev/plugin-auth 1.0.7 → 1.0.8

package/dist/local-auth/core/generators/auth-module/generated/typed-templates.d.ts

@@ -22,9 +22,7 @@ export declare const moduleGroup: {
         pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             builder: {};
         }>>;
-    }, {
-        userSessionService: {};
-    }>;
+    }, Record<never, Record<never, never>>>;
     schemaUserSessionPayloadObjectType: import("@baseplate-dev/core-generators").TsTemplateFile<{
         TPL_PRISMA_USER: {};
         TPL_USER_OBJECT_TYPE: {};
@@ -69,6 +67,18 @@ export declare const moduleGroup: {
                 isTypeOnly: true;
             };
         }>>;
+        errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            BadRequestError: {};
+            ForbiddenError: {};
+            handleZodRequestValidationError: {};
+            HttpError: {};
+            InternalServerError: {};
+            logError: {};
+            NotFoundError: {};
+            throwIfPrismaNotFound: {};
+            TooManyRequestsError: {};
+            UnauthorizedError: {};
+        }>>;
         prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             PrismaClient: {};
             Prisma: {};
@@ -84,7 +94,8 @@ export declare const utilsGroup: {
     cookieSigner: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
     sessionCookie: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            config: {};
+            getConfig: {};
+            isDevelopment: {};
         }>>;
     }, Record<never, Record<never, never>>>;
     verifyRequestOrigin: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
@@ -114,9 +125,7 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
             pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 builder: {};
             }>>;
-        }, {
-            userSessionService: {};
-        }>;
+        }, Record<never, Record<never, never>>>;
         schemaUserSessionPayloadObjectType: import("@baseplate-dev/core-generators").TsTemplateFile<{
             TPL_PRISMA_USER: {};
             TPL_USER_OBJECT_TYPE: {};
@@ -161,6 +170,18 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
                     isTypeOnly: true;
                 };
             }>>;
+            errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                BadRequestError: {};
+                ForbiddenError: {};
+                handleZodRequestValidationError: {};
+                HttpError: {};
+                InternalServerError: {};
+                logError: {};
+                NotFoundError: {};
+                throwIfPrismaNotFound: {};
+                TooManyRequestsError: {};
+                UnauthorizedError: {};
+            }>>;
             prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 PrismaClient: {};
                 Prisma: {};
@@ -173,10 +194,116 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
         }, Record<never, Record<never, never>>>;
     };
     queuesCleanupAuthVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
-        queueServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            createQueue: {};
+        queuesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            bindQueueHandler: {};
+            DEFAULT_QUEUE_CONCURRENCY: {};
+            defineQueue: {};
+            EnqueueOptions: {
+                isTypeOnly: true;
+            };
+            QueueHandlerBinding: {
+                isTypeOnly: true;
+            };
+            QueueHandlerBindingConfig: {
+                isTypeOnly: true;
+            };
+            QueueHandlerBindingInput: {
+                isTypeOnly: true;
+            };
+            QueueInfo: {
+                isTypeOnly: true;
+            };
+            QueueIntrospection: {
+                isTypeOnly: true;
+            };
+            QueueJob: {
+                isTypeOnly: true;
+            };
+            QueueJobHandler: {
+                isTypeOnly: true;
+            };
+            QueuePolicyFixPlan: {
+                isTypeOnly: true;
+            };
+            QueuePolicyFixResult: {
+                isTypeOnly: true;
+            };
+            QueueRuntime: {
+                isTypeOnly: true;
+            };
+            QueueService: {
+                isTypeOnly: true;
+            };
+            QueueToken: {
+                isTypeOnly: true;
+            };
+            QueueWorkers: {
+                isTypeOnly: true;
+            };
+            RepeatableConfig: {
+                isTypeOnly: true;
+            };
+            ScheduledJob: {
+                isTypeOnly: true;
+            };
+        }>>;
+    }, Record<never, Record<never, never>>>;
+    queuesCleanupAuthVerificationWorker: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
+        queuesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            bindQueueHandler: {};
+            DEFAULT_QUEUE_CONCURRENCY: {};
+            defineQueue: {};
+            EnqueueOptions: {
+                isTypeOnly: true;
+            };
+            QueueHandlerBinding: {
+                isTypeOnly: true;
+            };
+            QueueHandlerBindingConfig: {
+                isTypeOnly: true;
+            };
+            QueueHandlerBindingInput: {
+                isTypeOnly: true;
+            };
+            QueueInfo: {
+                isTypeOnly: true;
+            };
+            QueueIntrospection: {
+                isTypeOnly: true;
+            };
+            QueueJob: {
+                isTypeOnly: true;
+            };
+            QueueJobHandler: {
+                isTypeOnly: true;
+            };
+            QueuePolicyFixPlan: {
+                isTypeOnly: true;
+            };
+            QueuePolicyFixResult: {
+                isTypeOnly: true;
+            };
+            QueueRuntime: {
+                isTypeOnly: true;
+            };
+            QueueService: {
+                isTypeOnly: true;
+            };
+            QueueToken: {
+                isTypeOnly: true;
+            };
+            QueueWorkers: {
+                isTypeOnly: true;
+            };
+            RepeatableConfig: {
+                isTypeOnly: true;
+            };
+            ScheduledJob: {
+                isTypeOnly: true;
+            };
         }>>;
     }, {
+        queuesCleanupAuthVerification: {};
         servicesAuthVerification: {};
     }>;
     servicesAuthVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
@@ -220,7 +347,8 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
             };
         }>>;
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            config: {};
+            getConfig: {};
+            isDevelopment: {};
         }>>;
         errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             BadRequestError: {};
@@ -230,6 +358,7 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
             InternalServerError: {};
             logError: {};
             NotFoundError: {};
+            throwIfPrismaNotFound: {};
             TooManyRequestsError: {};
             UnauthorizedError: {};
         }>>;
@@ -241,6 +370,9 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
             RequestServiceContext: {
                 isTypeOnly: true;
             };
+            RequestServiceContextWith: {
+                isTypeOnly: true;
+            };
         }>>;
         userSessionTypesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             UserSessionPayload: {
@@ -260,7 +392,8 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
         cookieSigner: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
         sessionCookie: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
             configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                config: {};
+                getConfig: {};
+                isDevelopment: {};
             }>>;
         }, Record<never, Record<never, never>>>;
         verifyRequestOrigin: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;

package/dist/local-auth/core/generators/auth-module/generated/typed-templates.js

@@ -1,6 +1,6 @@
 import { createTsTemplateFile } from '@baseplate-dev/core-generators';
 import { authContextImportsProvider, authRolesImportsProvider, configServiceImportsProvider, errorHandlerServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
-import { queueServiceImportsProvider } from '@baseplate-dev/plugin-queue';
+import { queuesImportsProvider } from '@baseplate-dev/plugin-queue';
 import path from 'node:path';
 const userSessionConstants = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
@@ -32,7 +32,6 @@ const schemaUserSessionMutations = createTsTemplateFile({
     group: 'module',
     importMapProviders: { pothosImports: pothosImportsProvider },
     name: 'schema-user-session-mutations',
-    referencedGeneratorTemplates: { userSessionService: {} },
     source: {
         path: path.join(import.meta.dirname, '../templates/module/schema/user-session.mutations.ts'),
     },
@@ -81,6 +80,7 @@ const userRolesService = createTsTemplateFile({
     group: 'module',
     importMapProviders: {
         authRolesImports: authRolesImportsProvider,
+        errorHandlerServiceImports: errorHandlerServiceImportsProvider,
         prismaGeneratedImports: prismaGeneratedImportsProvider,
         prismaImports: prismaImportsProvider,
     },
@@ -101,14 +101,28 @@ export const moduleGroup = {
 };
 const queuesCleanupAuthVerification = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
-    importMapProviders: { queueServiceImports: queueServiceImportsProvider },
+    importMapProviders: { queuesImports: queuesImportsProvider },
     name: 'queues-cleanup-auth-verification',
-    referencedGeneratorTemplates: { servicesAuthVerification: {} },
+    projectExports: { cleanupAuthVerificationQueue: { isTypeOnly: false } },
     source: {
         path: path.join(import.meta.dirname, '../templates/module/queues/cleanup-auth-verification.queue.ts'),
     },
     variables: {},
 });
+const queuesCleanupAuthVerificationWorker = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: { queuesImports: queuesImportsProvider },
+    name: 'queues-cleanup-auth-verification-worker',
+    projectExports: { cleanupAuthVerificationWorker: { isTypeOnly: false } },
+    referencedGeneratorTemplates: {
+        queuesCleanupAuthVerification: {},
+        servicesAuthVerification: {},
+    },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/queues/cleanup-auth-verification.worker.ts'),
+    },
+    variables: {},
+});
 const servicesAuthVerification = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     importMapProviders: {
@@ -138,7 +152,7 @@ const userSessionService = createTsTemplateFile({
         userSessionTypesImports: userSessionTypesImportsProvider,
     },
     name: 'user-session-service',
-    projectExports: { userSessionService: {} },
+    projectExports: { CookieUserSessionService: { isTypeOnly: false } },
     referencedGeneratorTemplates: {
         cookieSigner: {},
         sessionCookie: {},
@@ -185,6 +199,7 @@ export const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES = {
     constantsGroup,
     moduleGroup,
     queuesCleanupAuthVerification,
+    queuesCleanupAuthVerificationWorker,
     servicesAuthVerification,
     userSessionService,
     utilsGroup,

package/dist/local-auth/core/generators/auth-module/templates/module/queues/cleanup-auth-verification.queue.d.ts

@@ -1,6 +1,2 @@
-/**
- * Periodic queue to clean up expired auth verification tokens.
- * Runs hourly to maintain database hygiene.
- */
 export declare const cleanupAuthVerificationQueue: any;
 //# sourceMappingURL=cleanup-auth-verification.queue.d.ts.map

package/dist/local-auth/core/generators/auth-module/templates/module/queues/cleanup-auth-verification.queue.js

@@ -1,17 +1,4 @@
 // @ts-nocheck
-import { cleanupExpiredAuthVerifications } from '$servicesAuthVerification';
-import { createQueue } from '%queueServiceImports';
-/**
- * Periodic queue to clean up expired auth verification tokens.
- * Runs hourly to maintain database hygiene.
- */
-export const cleanupAuthVerificationQueue = createQueue('cleanup-auth-verification', {
-    handler: async () => {
-        const result = await cleanupExpiredAuthVerifications();
-        return { deletedCount: result.deletedCount };
-    },
-    repeatable: {
-        pattern: '15 * * * *', // Every hour at minute 15
-    },
-});
+import { defineQueue } from '%queuesImports';
+export const cleanupAuthVerificationQueue = defineQueue('cleanup-auth-verification');
 //# sourceMappingURL=cleanup-auth-verification.queue.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/queues/cleanup-auth-verification.queue.ts

@@ -1,21 +1,7 @@
 // @ts-nocheck
 
-import { cleanupExpiredAuthVerifications } from '$servicesAuthVerification';
-import { createQueue } from '%queueServiceImports';
+import { defineQueue } from '%queuesImports';
 
-/**
- * Periodic queue to clean up expired auth verification tokens.
- * Runs hourly to maintain database hygiene.
- */
-export const cleanupAuthVerificationQueue = createQueue(
+export const cleanupAuthVerificationQueue = defineQueue<undefined>(
   'cleanup-auth-verification',
-  {
-    handler: async () => {
-      const result = await cleanupExpiredAuthVerifications();
-      return { deletedCount: result.deletedCount };
-    },
-    repeatable: {
-      pattern: '15 * * * *', // Every hour at minute 15
-    },
-  },
 );

package/dist/local-auth/core/generators/auth-module/templates/module/queues/cleanup-auth-verification.worker.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Periodic worker to clean up expired auth verification tokens.
+ * Runs hourly to maintain database hygiene.
+ */
+export declare const cleanupAuthVerificationWorker: any;
+//# sourceMappingURL=cleanup-auth-verification.worker.d.ts.map

package/dist/local-auth/core/generators/auth-module/templates/module/queues/cleanup-auth-verification.worker.js

@@ -0,0 +1,18 @@
+// @ts-nocheck
+import { cleanupAuthVerificationQueue } from '$queuesCleanupAuthVerification';
+import { cleanupExpiredAuthVerifications } from '$servicesAuthVerification';
+import { bindQueueHandler } from '%queuesImports';
+/**
+ * Periodic worker to clean up expired auth verification tokens.
+ * Runs hourly to maintain database hygiene.
+ */
+export const cleanupAuthVerificationWorker = bindQueueHandler(cleanupAuthVerificationQueue, {
+    handler: async () => {
+        const result = await cleanupExpiredAuthVerifications();
+        return { deletedCount: result.deletedCount };
+    },
+    repeatable: {
+        pattern: '15 * * * *', // Every hour at minute 15
+    },
+});
+//# sourceMappingURL=cleanup-auth-verification.worker.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/queues/cleanup-auth-verification.worker.ts

@@ -0,0 +1,22 @@
+// @ts-nocheck
+
+import { cleanupAuthVerificationQueue } from '$queuesCleanupAuthVerification';
+import { cleanupExpiredAuthVerifications } from '$servicesAuthVerification';
+import { bindQueueHandler } from '%queuesImports';
+
+/**
+ * Periodic worker to clean up expired auth verification tokens.
+ * Runs hourly to maintain database hygiene.
+ */
+export const cleanupAuthVerificationWorker = bindQueueHandler(
+  cleanupAuthVerificationQueue,
+  {
+    handler: async () => {
+      const result = await cleanupExpiredAuthVerifications();
+      return { deletedCount: result.deletedCount };
+    },
+    repeatable: {
+      pattern: '15 * * * *', // Every hour at minute 15
+    },
+  },
+);

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.mutations.js

@@ -1,5 +1,4 @@
 // @ts-nocheck
-import { userSessionService } from '$userSessionService';
 import { builder } from '%pothosImports';
 builder.mutationField('logOut', (t) => t.fieldWithInputPayload({
     authorize: ['public'],
@@ -10,7 +9,7 @@ builder.mutationField('logOut', (t) => t.fieldWithInputPayload({
     },
     resolve: async (parent, args, context) => {
         if (context.auth.session?.type === 'user') {
-            await userSessionService.clearSession(context.auth.session, context);
+            await context.services.userSession.clearSession(context.auth.session, context);
         }
         return { success: true };
     },

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.mutations.ts

@@ -1,6 +1,5 @@
 // @ts-nocheck
 
-import { userSessionService } from '$userSessionService';
 import { builder } from '%pothosImports';
 
 builder.mutationField('logOut', (t) =>
@@ -13,7 +12,10 @@ builder.mutationField('logOut', (t) =>
     },
     resolve: async (parent, args, context) => {
       if (context.auth.session?.type === 'user') {
-        await userSessionService.clearSession(context.auth.session, context);
+        await context.services.userSession.clearSession(
+          context.auth.session,
+          context,
+        );
       }
 
       return { success: true };

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.js

@@ -1,5 +1,6 @@
 // @ts-nocheck
 import { AUTH_ROLE_CONFIG } from '%authRolesImports';
+import { NotFoundError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 /**
  * Updates the roles assigned to a user.
@@ -11,13 +12,13 @@ import { prisma } from '%prismaImports';
  * @returns The updated user with their roles
  */
 export async function updateUserRoles({ userId, roles, }) {
-    // Filter out built-in roles (public, user, system)
+    // Filter out auto-assigned roles (public, user, system) that cannot be manually assigned
     const validRoles = roles.filter((role) => {
         if (!(role in AUTH_ROLE_CONFIG)) {
             return false;
         }
         const roleConfig = AUTH_ROLE_CONFIG[role];
-        return !roleConfig.builtIn;
+        return !roleConfig.autoAssigned;
     });
     await prisma.$transaction([
         prisma.userRole.deleteMany({
@@ -28,8 +29,12 @@ export async function updateUserRoles({ userId, roles, }) {
             skipDuplicates: true,
         }),
     ]);
-    return prisma.user.findUnique({
+    const updatedUser = await prisma.user.findUnique({
         where: { id: userId },
     });
+    if (updatedUser === null) {
+        throw new NotFoundError('User not found', 'user-not-found');
+    }
+    return updatedUser;
 }
 //# sourceMappingURL=user-roles.service.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.ts

@@ -4,6 +4,7 @@ import type { AuthRole } from '%authRolesImports';
 import type { User } from '%prismaGeneratedImports';
 
 import { AUTH_ROLE_CONFIG } from '%authRolesImports';
+import { NotFoundError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 
 /**
@@ -22,13 +23,13 @@ export async function updateUserRoles({
   userId: string;
   roles: string[];
 }): Promise<User> {
-  // Filter out built-in roles (public, user, system)
+  // Filter out auto-assigned roles (public, user, system) that cannot be manually assigned
   const validRoles = roles.filter((role) => {
     if (!(role in AUTH_ROLE_CONFIG)) {
       return false;
     }
     const roleConfig = AUTH_ROLE_CONFIG[role as AuthRole];
-    return !roleConfig.builtIn;
+    return !roleConfig.autoAssigned;
   });
 
   await prisma.$transaction([
@@ -41,7 +42,13 @@ export async function updateUserRoles({
     }),
   ]);
 
-  return prisma.user.findUnique({
+  const updatedUser = await prisma.user.findUnique({
     where: { id: userId },
-  }) as Promise<User>;
+  });
+
+  if (updatedUser === null) {
+    throw new NotFoundError('User not found', 'user-not-found');
+  }
+
+  return updatedUser;
 }

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-session.service.d.ts

@@ -39,5 +39,4 @@ export declare class CookieUserSessionService implements UserSessionService {
      */
     getSessionInfoFromToken(req: FastifyRequest): Promise<AuthUserSessionInfo | undefined>;
 }
-export declare const userSessionService: CookieUserSessionService;
 //# sourceMappingURL=user-session.service.d.ts.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-session.service.js

@@ -5,17 +5,19 @@ import { USER_SESSION_DURATION_SEC, USER_SESSION_MAX_LIFETIME_SEC, USER_SESSION_
 import { verifyRequestOrigin } from '$verifyRequestOrigin';
 import { InvalidSessionError } from '%authContextImports';
 import { DEFAULT_USER_ROLES } from '%authRolesImports';
-import { config } from '%configServiceImports';
+import { getConfig, isDevelopment } from '%configServiceImports';
 import { ForbiddenError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 import { randomBytes } from 'node:crypto';
-const COOKIE_OPTIONS = {
-    httpOnly: true,
-    sameSite: 'lax',
-    secure: config.APP_ENVIRONMENT !== 'dev',
-    maxAge: USER_SESSION_DURATION_SEC,
-    path: '/',
-};
+function getCookieOptions() {
+    return {
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: !isDevelopment(),
+        maxAge: USER_SESSION_DURATION_SEC,
+        path: '/',
+    };
+}
 /**
  * Validates the expiry of a user session and determines if it needs to be renewed.
  *
@@ -83,8 +85,8 @@ export class CookieUserSessionService {
             ...user.roles.map((role) => role.role),
         ];
         const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-        const cookieValue = signObject({ token }, config.AUTH_SECRET);
-        context.cookieStore.set(cookieName, cookieValue, COOKIE_OPTIONS);
+        const cookieValue = signObject({ token }, getConfig().AUTH_SECRET);
+        context.cookieStore.set(cookieName, cookieValue, getCookieOptions());
         return { userId, expiresAt, roles };
     }
     /**
@@ -98,7 +100,7 @@ export class CookieUserSessionService {
             where: { id: sessionInfo.id },
         });
         const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-        context.cookieStore.clear(cookieName, COOKIE_OPTIONS);
+        context.cookieStore.clear(cookieName, getCookieOptions());
     }
     /**
      * Retrieves the user session information from the request.
@@ -120,12 +122,12 @@ export class CookieUserSessionService {
         if ((req.method !== 'GET' ||
             req.headers.upgrade?.toLowerCase() === 'websocket') &&
             req.method !== 'HEAD' &&
-            !verifyRequestOrigin(req, [req.host, ...config.ALLOWED_ORIGINS])) {
+            !verifyRequestOrigin(req, [req.host, ...getConfig().ALLOWED_ORIGINS])) {
             throw new ForbiddenError('Invalid Origin header');
         }
         try {
             // Unsign the session cookie
-            const sessionCookieResult = unsignObject(sessionCookieValue, config.AUTH_SECRET);
+            const sessionCookieResult = unsignObject(sessionCookieValue, getConfig().AUTH_SECRET);
             if (!sessionCookieResult)
                 throw new InvalidSessionError();
             const { token } = sessionCookieResult;
@@ -150,8 +152,8 @@ export class CookieUserSessionService {
                         expiresAt: sessionExpiryResult.newExpiry,
                     },
                 });
-                const newSignedCookie = signObject({ token }, config.AUTH_SECRET);
-                reply.setCookie(cookieName, newSignedCookie, COOKIE_OPTIONS);
+                const newSignedCookie = signObject({ token }, getConfig().AUTH_SECRET);
+                reply.setCookie(cookieName, newSignedCookie, getCookieOptions());
             }
             const { user } = userSession;
             const expiresAt = sessionExpiryResult.newExpiry ?? userSession.expiresAt;
@@ -169,7 +171,7 @@ export class CookieUserSessionService {
         catch (err) {
             // clear the cookie if it's invalid
             if (err instanceof InvalidSessionError && reply) {
-                reply.clearCookie(cookieName, COOKIE_OPTIONS);
+                reply.clearCookie(cookieName, getCookieOptions());
             }
             throw err;
         }
@@ -186,5 +188,4 @@ export class CookieUserSessionService {
         return this.getSessionInfoFromRequest(req, undefined);
     }
 }
-export const userSessionService = new CookieUserSessionService();
 //# sourceMappingURL=user-session.service.js.map