@better-forge/auth 0.0.0-stage → 0.1.0

package/dist/oidcSettingsRoutes.js

@@ -0,0 +1,133 @@
+import { oidcSettings } from './tables.js';
+import { requestIdentity } from './middleware.js';
+export function createOidcSettingsRoutes(ctx, parts) {
+    const { db, audit, secretBox } = ctx;
+    const { confirmIdentity } = parts.identityConfirmation;
+    const { readOidcTestResult, storeOidcTestResult, testOidcDiscovery } = parts.oidc;
+    const { getOidcConfig, getOidcSettingsRow, getOidcTestConfig, oidcConfigFromRow } = parts.oidcSettings;
+    const { buildOidcConfig, defaultOidcRedirectUri } = parts.resolver;
+    const { startOidcFlow } = parts;
+    function publicView(row) {
+        return {
+            enabled: !!row?.enabled,
+            issuer: row?.issuer ?? '',
+            clientId: row?.clientId ?? '',
+            hasClientSecret: !!row?.clientSecret,
+            scopes: row?.scopes ?? '',
+            redirectUri: row?.redirectUri ?? '',
+            buttonLabel: row?.buttonLabel ?? '',
+            allowUnverifiedEmail: !!row?.allowUnverifiedEmail,
+            disablePasswordLogin: !!row?.disablePasswordLogin,
+        };
+    }
+    /** Fields that appear in the audit diff; the secret is only recorded as changed, never its value. */
+    function auditView(row, secretChanged = false) {
+        const { hasClientSecret: _has, ...rest } = publicView(row);
+        return { ...rest, clientSecretChanged: secretChanged };
+    }
+    async function discoveryError(config) {
+        try {
+            await testOidcDiscovery(config);
+            return null;
+        }
+        catch (error) {
+            return error instanceof Error ? error.message : 'Discovery failed';
+        }
+    }
+    async function oidcSettingsRoutes(app) {
+        app.get('/', async () => {
+            const [row, active] = await Promise.all([getOidcSettingsRow(), getOidcConfig()]);
+            return {
+                source: active.source,
+                envManaged: active.source === 'env',
+                defaultRedirectUri: defaultOidcRedirectUri(),
+                settings: publicView(row),
+            };
+        });
+        app.put('/', { config: { rateLimit: ctx.rateLimits.sensitiveAction } }, async (req, reply) => {
+            if ((await getOidcConfig()).source === 'env') {
+                return reply.code(409).send({ error: 'OIDC is configured through environment variables and cannot be changed here' });
+            }
+            const body = req.body ?? {};
+            const identity = requestIdentity(req);
+            if (!await confirmIdentity(identity, body.currentPassword, reply))
+                return reply;
+            const previous = await getOidcSettingsRow();
+            const secretChanged = !!body.clientSecret?.trim();
+            // The stored secret is sent to the issuer's token endpoint, so it must not follow a changed target.
+            if (previous?.clientSecret && !secretChanged && ((body.issuer ?? '').trim() !== previous.issuer || (body.clientId ?? '').trim() !== previous.clientId)) {
+                return reply.code(400).send({ error: 'Re-enter the client secret when changing the issuer URL or client ID' });
+            }
+            const clientSecret = secretChanged ? secretBox.encrypt(body.clientSecret.trim()) : previous?.clientSecret ?? '';
+            const next = {
+                id: 1,
+                enabled: body.enabled ? 1 : 0,
+                issuer: (body.issuer ?? '').trim(),
+                clientId: (body.clientId ?? '').trim(),
+                clientSecret,
+                scopes: (body.scopes ?? '').trim(),
+                redirectUri: (body.redirectUri ?? '').trim(),
+                buttonLabel: (body.buttonLabel ?? '').trim(),
+                allowUnverifiedEmail: body.allowUnverifiedEmail ? 1 : 0,
+                disablePasswordLogin: body.disablePasswordLogin ? 1 : 0,
+                updatedAt: Date.now(),
+            };
+            if (next.enabled) {
+                const config = oidcConfigFromRow(next);
+                if (!config) {
+                    return reply.code(400).send({ error: 'Issuer URL, client ID and a redirect URI (or PUBLIC_URL) are required and must be valid http(s) URLs' });
+                }
+                // Never persist a setup that could lock everyone out: with password login off, the IdP must be reachable.
+                if (config.disablePasswordLogin) {
+                    const failure = await discoveryError(config);
+                    if (failure)
+                        return reply.code(400).send({ error: `Password sign-in can only be disabled after OIDC discovery succeeds: ${failure}` });
+                }
+            }
+            else {
+                next.disablePasswordLogin = 0;
+            }
+            await db.insert(oidcSettings).values(next).onConflictDoUpdate({ target: oidcSettings.id, set: { ...next } });
+            await audit.write(audit.actor(identity), previous ? 'update' : 'create', 'oidc_settings', 1, 'OIDC sign-in', audit.diffObjects(auditView(previous), auditView(next, secretChanged)));
+            return publicView(next);
+        });
+        // Opened in a new tab: runs the real sign-in with the saved settings and shows the outcome instead of signing in.
+        app.get('/test-sign-in', { config: { rateLimit: ctx.rateLimits.sensitiveAction } }, async (req, reply) => {
+            const cfg = await getOidcTestConfig();
+            if (!cfg)
+                return reply.code(400).send({ error: 'Save a valid issuer URL, client ID and redirect URI first' });
+            try {
+                return await startOidcFlow(app, reply, cfg, { purpose: 'oidc-test', adminUserId: requestIdentity(req).userId });
+            }
+            catch (error) {
+                const result = {
+                    issuer: cfg.issuer, testedAt: Date.now(), claims: null, outcome: 'deny', user: null,
+                    denial: { code: 'discovery_failed', reason: `OIDC discovery against the issuer failed: ${error instanceof Error ? error.message : String(error)}` },
+                };
+                return reply.redirect(`${ctx.urls.ssoTest}?result=${storeOidcTestResult(requestIdentity(req).userId, result)}`);
+            }
+        });
+        app.get('/test-sign-in/:id', async (req, reply) => {
+            const result = readOidcTestResult(req.params.id, requestIdentity(req).userId);
+            if (!result)
+                return reply.code(404).send({ error: 'The test result has expired. Run the test sign-in again.' });
+            return result;
+        });
+        app.post('/test', { config: { rateLimit: ctx.rateLimits.sensitiveAction } }, async (req, reply) => {
+            const body = req.body ?? {};
+            const config = buildOidcConfig({
+                issuer: body.issuer,
+                clientId: body.clientId,
+                redirectUri: body.redirectUri,
+            });
+            if (!config)
+                return reply.code(400).send({ error: 'Enter a valid issuer URL, client ID and a redirect URI (or set PUBLIC_URL)' });
+            const failure = await discoveryError(config);
+            if (failure)
+                return reply.code(400).send({ error: `Discovery failed: ${failure}` });
+            return { ok: true, ...(await testOidcDiscovery(config)) };
+        });
+    }
+    return { oidcSettingsRoutes };
+}
+//# sourceMappingURL=oidcSettingsRoutes.js.map

package/dist/oidcSettingsRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcSettingsRoutes.js","sourceRoot":"","sources":["../src/oidcSettingsRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAqBjD,MAAM,UAAU,wBAAwB,CAAC,GAAgB,EAAE,KAM1D;IACC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,CAAA;IACpC,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC,oBAAoB,CAAA;IACtD,MAAM,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC,IAAI,CAAA;IACjF,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC,YAAY,CAAA;IACtG,MAAM,EAAE,eAAe,EAAE,sBAAsB,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAA;IAClE,MAAM,EAAE,aAAa,EAAE,GAAG,KAAK,CAAA;IAE/B,SAAS,UAAU,CAAC,GAA2B;QAC7C,OAAO;YACL,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO;YACvB,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,EAAE;YACzB,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,EAAE;YAC7B,eAAe,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY;YACpC,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,EAAE;YACzB,WAAW,EAAE,GAAG,EAAE,WAAW,IAAI,EAAE;YACnC,WAAW,EAAE,GAAG,EAAE,WAAW,IAAI,EAAE;YACnC,oBAAoB,EAAE,CAAC,CAAC,GAAG,EAAE,oBAAoB;YACjD,oBAAoB,EAAE,CAAC,CAAC,GAAG,EAAE,oBAAoB;SAClD,CAAA;IACH,CAAC;IAED,qGAAqG;IACrG,SAAS,SAAS,CAAC,GAA2B,EAAE,aAAa,GAAG,KAAK;QACnE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC1D,OAAO,EAAE,GAAG,IAAI,EAAE,mBAAmB,EAAE,aAAa,EAAE,CAAA;IACxD,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,MAAkB;QAC9C,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAA;YAC/B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAA;QACpE,CAAC;IACH,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,GAAoB;QACpD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YACtB,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,kBAAkB,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;YAChF,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,MAAM,KAAK,KAAK;gBACnC,kBAAkB,EAAE,sBAAsB,EAAE;gBAC5C,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC;aAC1B,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,GAAG,CAAyB,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnH,IAAI,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6EAA6E,EAAE,CAAC,CAAA;YACvH,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;YAC3B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YAE/E,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAA;YAC3C,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAA;YACjD,oGAAoG;YACpG,IAAI,QAAQ,EAAE,YAAY,IAAI,CAAC,aAAa,IAAI,CAC9C,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,QAAQ,CACrG,EAAE,CAAC;gBACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sEAAsE,EAAE,CAAC,CAAA;YAChH,CAAC;YACD,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,YAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAA;YAChH,MAAM,IAAI,GAAoB;gBAC5B,EAAE,EAAE,CAAC;gBACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7B,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBAClC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBACtC,YAAY;gBACZ,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBAClC,WAAW,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBAC5C,WAAW,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBAC5C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAA;YAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;gBACtC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sGAAsG,EAAE,CAAC,CAAA;gBAChJ,CAAC;gBACD,0GAA0G;gBAC1G,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;oBAChC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAA;oBAC5C,IAAI,OAAO;wBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wEAAwE,OAAO,EAAE,EAAE,CAAC,CAAA;gBACxI,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,oBAAoB,GAAG,CAAC,CAAA;YAC/B,CAAC;YAED,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,CAAA;YAC5G,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,EAAE,cAAc,EACzG,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAA;YACzE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC,CAAC,CAAA;QAEF,kHAAkH;QAClH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACvG,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAA;YACrC,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC,CAAA;YAC7G,IAAI,CAAC;gBACH,OAAO,MAAM,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;YACjH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG;oBACb,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI;oBAC5F,MAAM,EAAE,EAAE,IAAI,EAAE,kBAA2B,EAAE,MAAM,EAAE,6CAA6C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;iBAC7J,CAAA;gBACD,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,WAAW,mBAAmB,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;YACjH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,GAAG,CAA6B,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAA;YAC7E,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC,CAAA;YAC/G,OAAO,MAAM,CAAA;QACf,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,IAAI,CAAyB,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACxH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;YAC3B,MAAM,MAAM,GAAG,eAAe,CAAC;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAA;YACF,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4EAA4E,EAAE,CAAC,CAAA;YACjI,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAA;YAC5C,IAAI,OAAO;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,OAAO,EAAE,EAAE,CAAC,CAAA;YACnF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;QAC3D,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,CAAA;AAC/B,CAAC"}

package/dist/roles.d.ts

@@ -0,0 +1,25 @@
+/** The role that may do everything; it exists in every application. */
+export declare const ADMIN_ROLE = "admin";
+export interface RoleRegistry {
+    /**
+     * Adds the application's roles to `admin`. `fallback` is what a stored value that is not a role normalises to,
+     * and `defaultForNewUsers` is the role an account gets when none is asked for.
+     */
+    register(roles: readonly string[], options: {
+        fallback: string;
+        defaultForNewUsers: string;
+    }): void;
+    /** Normalizes a stored role value, including the legacy JSON-array format. */
+    normalize(raw: string): string;
+    isValid(role: string): boolean;
+    /** Every role, `admin` first, in the order they were registered. */
+    list(): readonly string[];
+    readonly defaultForNewUsers: string;
+    /**
+     * Called by createAuth: after this, registering throws, so the set of roles cannot change under a running app.
+     * It also throws when the application never registered its roles, because the fallback would then be `admin`.
+     */
+    freeze(): void;
+}
+export declare function createRoleRegistry(): RoleRegistry;
+//# sourceMappingURL=roles.d.ts.map

package/dist/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../src/roles.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,eAAO,MAAM,UAAU,UAAU,CAAA;AAEjC,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACnG,8EAA8E;IAC9E,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;IAC9B,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC9B,oEAAoE;IACpE,IAAI,IAAI,SAAS,MAAM,EAAE,CAAA;IACzB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC;;;OAGG;IACH,MAAM,IAAI,IAAI,CAAA;CACf;AAED,wBAAgB,kBAAkB,IAAI,YAAY,CAqCjD"}

package/dist/roles.js

@@ -0,0 +1,44 @@
+/** The role that may do everything; it exists in every application. */
+export const ADMIN_ROLE = 'admin';
+export function createRoleRegistry() {
+    const roles = [ADMIN_ROLE];
+    let fallback = ADMIN_ROLE;
+    let defaultForNewUsers = ADMIN_ROLE;
+    let frozen = false;
+    let registered = false;
+    const isValid = (role) => roles.includes(role);
+    return {
+        register(added, options) {
+            if (frozen)
+                throw new Error('Roles cannot be registered after the auth module was created');
+            for (const role of added)
+                if (!roles.includes(role))
+                    roles.push(role);
+            if (!roles.includes(options.fallback) || !roles.includes(options.defaultForNewUsers)) {
+                throw new Error('The fallback and the default role for new users must be registered roles');
+            }
+            fallback = options.fallback;
+            defaultForNewUsers = options.defaultForNewUsers;
+            registered = true;
+        },
+        normalize(raw) {
+            try {
+                const parsed = JSON.parse(raw);
+                const role = Array.isArray(parsed) ? parsed[0] : raw;
+                return typeof role === 'string' && isValid(role) ? role : fallback;
+            }
+            catch {
+                return isValid(raw) ? raw : fallback;
+            }
+        },
+        isValid,
+        list: () => roles,
+        get defaultForNewUsers() { return defaultForNewUsers; },
+        freeze() {
+            if (!registered)
+                throw new Error('Register the application roles before creating the auth module: without them every unknown role would be an administrator');
+            frozen = true;
+        },
+    };
+}
+//# sourceMappingURL=roles.js.map

package/dist/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../src/roles.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAA;AAqBjC,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAa,CAAC,UAAU,CAAC,CAAA;IACpC,IAAI,QAAQ,GAAW,UAAU,CAAA;IACjC,IAAI,kBAAkB,GAAW,UAAU,CAAA;IAC3C,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,UAAU,GAAG,KAAK,CAAA;IAEtB,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAEtD,OAAO;QACL,QAAQ,CAAC,KAAK,EAAE,OAAO;YACrB,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;YAC3F,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACrE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACrF,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAA;YAC7F,CAAC;YACD,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;YAC3B,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAA;YAC/C,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC;QACD,SAAS,CAAC,GAAG;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBACvC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;gBACpD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAA;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAA;YACtC,CAAC;QACH,CAAC;QACD,OAAO;QACP,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK;QACjB,IAAI,kBAAkB,KAAK,OAAO,kBAAkB,CAAA,CAAC,CAAC;QACtD,MAAM;YACJ,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2HAA2H,CAAC,CAAA;YAC7J,MAAM,GAAG,IAAI,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/routeScope.d.ts

@@ -0,0 +1,34 @@
+import type { FastifyInstance } from 'fastify';
+/**
+ * Marks every route registered in `scope` as belonging to a part of the API, which is what an API token is checked
+ * against (`<part>:read` for GET, `<part>:write` otherwise). A route without a part is refused to every token.
+ */
+export declare function belongsTo(scope: FastifyInstance, part: string): void;
+/** Lets (or, with `false`, stops) the routes registered in `scope` accept an API token. Routes accept none by default. */
+export declare function acceptApiTokens(scope: FastifyInstance, accept?: boolean): void;
+type RoutePlugin = (scope: FastifyInstance) => Promise<void> | void;
+type Guard = (...args: never[]) => unknown;
+/** A group of routes that share a guard and, usually, a part of the API tokens are checked against. */
+export interface AdminRouteGroup {
+    /** The part of the API the routes belong to. Omit it for a group whose routes no token reaches. */
+    part?: string;
+    /** The group refuses API tokens even though the rest of the API accepts them. */
+    noTokens?: boolean;
+    /** Runs before every route of the group (the role the group needs). */
+    guard: Guard;
+    /** The route plugins of the group with the prefix each is mounted at. */
+    routes: ReadonlyArray<readonly [plugin: RoutePlugin, options: {
+        prefix: string;
+    }]>;
+}
+/**
+ * Registers the admin API: the scope accepts API tokens and needs a signed-in caller (`authenticate`), then every group
+ * gets its own scope with its part, its guard and its routes. A token is checked against the part of the group a route
+ * is in; a group with `noTokens` is for what a leaked token must never reach.
+ */
+export declare function registerAdminApi(adminApp: FastifyInstance, options: {
+    authenticate: Guard;
+    groups: readonly AdminRouteGroup[];
+}): Promise<void>;
+export {};
+//# sourceMappingURL=routeScope.d.ts.map

package/dist/routeScope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routeScope.d.ts","sourceRoot":"","sources":["../src/routeScope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAE9C;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAEpE;AAED,0HAA0H;AAC1H,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,UAAO,GAAG,IAAI,CAE3E;AAED,KAAK,WAAW,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AACnE,KAAK,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAA;AAE1C,uGAAuG;AACvG,MAAM,WAAW,eAAe;IAC9B,mGAAmG;IACnG,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,uEAAuE;IACvE,KAAK,EAAE,KAAK,CAAA;IACZ,yEAAyE;IACzE,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAA;CACnF;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE;IAAE,YAAY,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,GACnE,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/routeScope.js

@@ -0,0 +1,32 @@
+/**
+ * Marks every route registered in `scope` as belonging to a part of the API, which is what an API token is checked
+ * against (`<part>:read` for GET, `<part>:write` otherwise). A route without a part is refused to every token.
+ */
+export function belongsTo(scope, part) {
+    scope.addHook('onRoute', (route) => { route.config = { ...route.config, tokenScope: part }; });
+}
+/** Lets (or, with `false`, stops) the routes registered in `scope` accept an API token. Routes accept none by default. */
+export function acceptApiTokens(scope, accept = true) {
+    scope.addHook('onRoute', (route) => { route.config = { ...route.config, allowApiToken: accept }; });
+}
+/**
+ * Registers the admin API: the scope accepts API tokens and needs a signed-in caller (`authenticate`), then every group
+ * gets its own scope with its part, its guard and its routes. A token is checked against the part of the group a route
+ * is in; a group with `noTokens` is for what a leaked token must never reach.
+ */
+export async function registerAdminApi(adminApp, options) {
+    acceptApiTokens(adminApp);
+    adminApp.addHook('preHandler', options.authenticate);
+    for (const group of options.groups) {
+        await adminApp.register(async (scope) => {
+            if (group.noTokens)
+                acceptApiTokens(scope, false);
+            if (group.part !== undefined)
+                belongsTo(scope, group.part);
+            scope.addHook('preHandler', group.guard);
+            for (const [plugin, routeOptions] of group.routes)
+                await scope.register(plugin, routeOptions);
+        });
+    }
+}
+//# sourceMappingURL=routeScope.js.map

package/dist/routeScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routeScope.js","sourceRoot":"","sources":["../src/routeScope.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAsB,EAAE,IAAY;IAC5D,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;AAC/F,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,eAAe,CAAC,KAAsB,EAAE,MAAM,GAAG,IAAI;IACnE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;AACpG,CAAC;AAiBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAyB,EACzB,OAAoE;IAEpE,eAAe,CAAC,QAAQ,CAAC,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,YAAqB,CAAC,CAAA;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACtC,IAAI,KAAK,CAAC,QAAQ;gBAAE,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YACjD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;YAC1D,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,KAAc,CAAC,CAAA;YACjD,KAAK,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,KAAK,CAAC,MAAM;gBAAE,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QAC/F,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/sessions.d.ts

@@ -0,0 +1,46 @@
+import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
+import type { AuthOptions } from './context.js';
+import type { ApiTokens } from './apiTokens.js';
+export type AuthMethod = 'password' | 'oidc';
+export interface AuthIdentity {
+    userId: number;
+    email: string;
+    role: string;
+    sessionId: string;
+    mustChangePassword: boolean;
+    twoFactorEnabled: boolean;
+    authMethod: AuthMethod;
+    /**
+     * Set when the request is authenticated by an API token instead of a session. A token belongs to no user: `userId`
+     * is 0, `email` is `token: <name>` (it names the token in the audit log) and `sessionId` is a synthetic
+     * `api-token:<id>`. A token has no role: `role` is a placeholder
+     * that lets it through the role checks, and what it may do is decided by `scopes`, checked for every request in
+     * authenticateOrReject.
+     */
+    apiToken?: {
+        id: number;
+        name: string;
+        scopes: string[];
+    };
+}
+export interface AuthenticateOptions {
+    /** API tokens are only accepted on routes that opt in; everywhere else they are refused. */
+    allowApiToken?: boolean;
+}
+export declare const API_TOKEN_NOT_ACCEPTED = "API token not accepted here";
+export declare function createSessions(ctx: AuthOptions, apiTokens: ApiTokens): {
+    createAuthSession: (app: FastifyInstance, reply: FastifyReply, user: {
+        id: number;
+        email: string;
+        role: string;
+        mustChangePassword: number;
+        totpEnabled: number;
+    }, authMethod?: AuthMethod) => Promise<AuthIdentity>;
+    clearAuthCookies: (reply: FastifyReply) => void;
+    authenticateRequest: (req: FastifyRequest, options?: AuthenticateOptions) => Promise<AuthIdentity>;
+    verifyCsrf: (req: FastifyRequest, identity: AuthIdentity) => Promise<void>;
+    revokeSession: (sessionId: string) => Promise<void>;
+    revokeUserSessions: (userId: number, exceptSessionId?: string) => Promise<void>;
+};
+export type Sessions = ReturnType<typeof createSessions>;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAG5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAI/C,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,MAAM,CAAA;AAE5C,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,kBAAkB,EAAE,OAAO,CAAA;IAC3B,gBAAgB,EAAE,OAAO,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;CAC1D;AAED,MAAM,WAAW,mBAAmB;IAClC,4FAA4F;IAC5F,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,eAAO,MAAM,sBAAsB,gCAAgC,CAAA;AASnE,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS;6BA4B5D,eAAe,SACb,YAAY,QACb;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,eACtF,UAAU,KACrB,OAAO,CAAC,YAAY,CAAC;8BAwCS,YAAY,KAAG,IAAI;+BA6BZ,cAAc,YAAW,mBAAmB,KAAQ,OAAO,CAAC,YAAY,CAAC;sBAmClF,cAAc,YAAY,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC;+BAa7C,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;iCAKpB,MAAM,oBAAoB,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;EAS3F;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAA"}

package/dist/sessions.js

@@ -0,0 +1,159 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { and, eq, lt, ne } from 'drizzle-orm';
+import { authSessions, users } from './tables.js';
+const SESSION_SECONDS = 12 * 60 * 60;
+export const API_TOKEN_NOT_ACCEPTED = 'API token not accepted here';
+export function createSessions(ctx, apiTokens) {
+    const { db, roles } = ctx;
+    const hooks = ctx.hooks ?? {};
+    const SESSION_COOKIE = ctx.cookies.session;
+    const CSRF_COOKIE = ctx.cookies.csrf;
+    const { findUsableApiToken, isApiToken, parseScopes } = apiTokens;
+    function cookieOptions(httpOnly) {
+        return {
+            path: '/',
+            httpOnly,
+            secure: ctx.secureCookies(),
+            sameSite: 'strict',
+            maxAge: SESSION_SECONDS,
+        };
+    }
+    function hash(value) {
+        return createHash('sha256').update(value).digest('hex');
+    }
+    function equalHash(left, right) {
+        const a = Buffer.from(left);
+        const b = Buffer.from(right);
+        return a.length === b.length && timingSafeEqual(a, b);
+    }
+    async function createAuthSession(app, reply, user, authMethod = 'password') {
+        const now = Date.now();
+        const sessionId = randomUUID();
+        const csrfToken = randomBytes(32).toString('base64url');
+        const expiresAt = now + SESSION_SECONDS * 1000;
+        await db.delete(authSessions).where(lt(authSessions.expiresAt, now));
+        await db.insert(authSessions).values({
+            id: sessionId,
+            userId: user.id,
+            csrfTokenHash: hash(csrfToken),
+            createdAt: now,
+            lastSeenAt: now,
+            expiresAt,
+            authMethod,
+            verifiedAt: now,
+        });
+        const role = roles.normalize(user.role);
+        const token = app.jwt.sign({ userId: user.id, email: user.email, role, sessionId });
+        reply.setCookie(SESSION_COOKIE, token, cookieOptions(true));
+        reply.setCookie(CSRF_COOKIE, csrfToken, cookieOptions(false));
+        return {
+            userId: user.id,
+            email: user.email,
+            role,
+            sessionId,
+            mustChangePassword: mustChangePassword(user, authMethod),
+            twoFactorEnabled: !!user.totpEnabled,
+            authMethod,
+        };
+    }
+    /**
+     * A password session must replace a pending temporary password, so the one the administrator handed out stops
+     * working. An SSO session never has to: the SSO sign-in makes the temporary password unusable instead.
+     */
+    function mustChangePassword(user, authMethod) {
+        return !!user.mustChangePassword && authMethod !== 'oidc';
+    }
+    function clearAuthCookies(reply) {
+        const base = { path: '/', secure: ctx.secureCookies(), sameSite: 'strict' };
+        reply.clearCookie(SESSION_COOKIE, { ...base, httpOnly: true });
+        reply.clearCookie(CSRF_COOKIE, { ...base, httpOnly: false });
+    }
+    function requestToken(req) {
+        const authorization = req.headers.authorization;
+        if (authorization?.startsWith('Bearer '))
+            return authorization.slice(7);
+        return req.cookies[SESSION_COOKIE] ?? null;
+    }
+    async function authenticateApiToken(req, token) {
+        const found = await findUsableApiToken(token);
+        if (!found)
+            throw new Error('Invalid API token');
+        const identity = {
+            userId: 0,
+            email: `token: ${found.name}`,
+            role: 'admin',
+            sessionId: `api-token:${found.id}`,
+            mustChangePassword: false,
+            twoFactorEnabled: false,
+            authMethod: 'password',
+            apiToken: { id: found.id, name: found.name, scopes: parseScopes(found.scopes) },
+        };
+        req.user = identity;
+        return identity;
+    }
+    async function authenticateRequest(req, options = {}) {
+        const token = requestToken(req);
+        if (!token)
+            throw new Error('Missing session');
+        if (isApiToken(token)) {
+            if (!options.allowApiToken)
+                throw new Error(API_TOKEN_NOT_ACCEPTED);
+            return authenticateApiToken(req, token);
+        }
+        const claims = req.server.jwt.verify(token);
+        if (!claims.sessionId || !Number.isInteger(claims.userId))
+            throw new Error('Invalid session');
+        const now = Date.now();
+        const session = (await db.select().from(authSessions).where(eq(authSessions.id, claims.sessionId)))[0];
+        if (!session || session.userId !== claims.userId || session.expiresAt <= now) {
+            if (session)
+                await db.delete(authSessions).where(eq(authSessions.id, session.id));
+            throw new Error('Expired session');
+        }
+        const user = (await db.select().from(users).where(eq(users.id, claims.userId)))[0];
+        if (!user)
+            throw new Error('Unknown user');
+        if (now - session.lastSeenAt >= 60_000) {
+            await db.update(authSessions).set({ lastSeenAt: now }).where(eq(authSessions.id, session.id));
+        }
+        const identity = {
+            userId: user.id,
+            email: user.email,
+            role: roles.normalize(user.role),
+            sessionId: session.id,
+            mustChangePassword: mustChangePassword(user, session.authMethod),
+            twoFactorEnabled: !!user.totpEnabled,
+            authMethod: session.authMethod === 'oidc' ? 'oidc' : 'password',
+        };
+        req.user = identity;
+        return identity;
+    }
+    async function verifyCsrf(req, identity) {
+        if (req.headers.authorization?.startsWith('Bearer '))
+            return;
+        if (['GET', 'HEAD', 'OPTIONS'].includes(req.method))
+            return;
+        const cookie = req.cookies[CSRF_COOKIE];
+        const header = req.headers['x-csrf-token'];
+        if (!cookie || typeof header !== 'string' || !equalHash(hash(cookie), hash(header))) {
+            throw new Error('Invalid CSRF token');
+        }
+        const session = (await db.select({ csrfTokenHash: authSessions.csrfTokenHash })
+            .from(authSessions).where(eq(authSessions.id, identity.sessionId)))[0];
+        if (!session || !equalHash(session.csrfTokenHash, hash(header)))
+            throw new Error('Invalid CSRF token');
+    }
+    async function revokeSession(sessionId) {
+        await db.delete(authSessions).where(eq(authSessions.id, sessionId));
+        hooks.onSessionsRevoked?.({ sessionId });
+    }
+    async function revokeUserSessions(userId, exceptSessionId) {
+        const condition = exceptSessionId
+            ? and(eq(authSessions.userId, userId), ne(authSessions.id, exceptSessionId))
+            : eq(authSessions.userId, userId);
+        await db.delete(authSessions).where(condition);
+        hooks.onSessionsRevoked?.({ userId, exceptSessionId });
+    }
+    return { createAuthSession, clearAuthCookies, authenticateRequest, verifyCsrf, revokeSession, revokeUserSessions };
+}
+//# sourceMappingURL=sessions.js.map

package/dist/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAIjD,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AA2BpC,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAA;AASnE,MAAM,UAAU,cAAc,CAAC,GAAgB,EAAE,SAAoB;IACnE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,GAAG,CAAA;IACzB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAA;IAC7B,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAA;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAA;IACpC,MAAM,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,SAAS,CAAA;IAEjE,SAAS,aAAa,CAAC,QAAiB;QACtC,OAAO;YACL,IAAI,EAAE,GAAG;YACT,QAAQ;YACR,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE;YAC3B,QAAQ,EAAE,QAAiB;YAC3B,MAAM,EAAE,eAAe;SACxB,CAAA;IACH,CAAC;IAED,SAAS,IAAI,CAAC,KAAa;QACzB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACzD,CAAC;IAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;QAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACvD,CAAC;IAED,KAAK,UAAU,iBAAiB,CAC9B,GAAoB,EACpB,KAAmB,EACnB,IAAkG,EAClG,aAAyB,UAAU;QAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;QAC9B,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACvD,MAAM,SAAS,GAAG,GAAG,GAAG,eAAe,GAAG,IAAI,CAAA;QAC9C,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAA;QACpE,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;YACnC,EAAE,EAAE,SAAS;YACb,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC;YAC9B,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,GAAG;YACf,SAAS;YACT,UAAU;YACV,UAAU,EAAE,GAAG;SAChB,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QACnF,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;QAC7D,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI;YACJ,SAAS;YACT,kBAAkB,EAAE,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC;YACxD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;YACpC,UAAU;SACX,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,kBAAkB,CAAC,IAAoC,EAAE,UAAkB;QAClF,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,IAAI,UAAU,KAAK,MAAM,CAAA;IAC3D,CAAC;IAED,SAAS,gBAAgB,CAAC,KAAmB;QAC3C,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,QAAiB,EAAE,CAAA;QACpF,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9D,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,SAAS,YAAY,CAAC,GAAmB;QACvC,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAA;QAC/C,IAAI,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACvE,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,IAAI,CAAA;IAC5C,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,GAAmB,EAAE,KAAa;QACpE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAC7C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;QAChD,MAAM,QAAQ,GAAiB;YAC7B,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,UAAU,KAAK,CAAC,IAAI,EAAE;YAC7B,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,aAAa,KAAK,CAAC,EAAE,EAAE;YAClC,kBAAkB,EAAE,KAAK;YACzB,gBAAgB,EAAE,KAAK;YACvB,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;SAChF,CAAA;QACD,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAA;QACnB,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,UAAU,mBAAmB,CAAC,GAAmB,EAAE,UAA+B,EAAE;QACvF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC9C,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;YACnE,OAAO,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACzC,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAgB,KAAK,CAAC,CAAA;QAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAE7F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACtG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YAC7E,IAAI,OAAO;gBAAE,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;YACjF,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;QACpC,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAClF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;QAE1C,IAAI,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC;YACvC,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/F,CAAC;QACD,MAAM,QAAQ,GAAiB;YAC7B,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAChC,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,kBAAkB,EAAE,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;YAChE,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU;SAChE,CAAA;QACD,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAA;QACnB,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,QAAsB;QACnE,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAM;QAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAM;QAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;QACvC,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,aAAa,EAAE,CAAC;aAC5E,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACxE,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACxG,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,SAAiB;QAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAA;QACnE,KAAK,CAAC,iBAAiB,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,eAAwB;QACxE,MAAM,SAAS,GAAG,eAAe;YAC/B,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;YAC5E,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACnC,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC9C,KAAK,CAAC,iBAAiB,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAA;AACpH,CAAC"}

package/dist/setupRoutes.d.ts

@@ -0,0 +1,37 @@
+import type { FastifyInstance, FastifyReply } from 'fastify';
+import type { SqliteDatabase } from '@better-forge/db';
+import { users } from './tables.js';
+export interface SetupRoutesOptions<Identity extends {
+    sessionId?: string;
+}> {
+    db: SqliteDatabase;
+    /** Runs `work` so that all of it is written, or none of it. */
+    withTransaction: <T>(work: () => Promise<T>) => Promise<T>;
+    isSetupComplete: () => boolean;
+    /** Records that setup is done. Called as the last step inside the transaction: if it throws, the administrator is not kept. */
+    writeSetupComplete: () => void;
+    /** Takes the record back, when the transaction fails to commit after it was written. */
+    removeSetupMarker: () => void;
+    /** Opens the database and brings its tables up to date; called once the request has been checked. */
+    prepareDatabase: () => void;
+    /** Signs the new administrator in. */
+    createSession: (app: FastifyInstance, reply: FastifyReply, user: typeof users.$inferSelect) => Promise<Identity>;
+    /** Rate limit of `POST /complete` (the config the rate limit plugin understands). */
+    rateLimit: Record<string, unknown>;
+    /** Writes whatever else the application needs on first run, inside the same transaction as the administrator. */
+    onSetup?: () => Promise<void>;
+    /** Starts the work that runs only once the application is set up. */
+    startBackgroundServices?: () => void;
+    /** Lets setup run although accounts already exist, for an installation that is filled with accounts before its first run. Checked on each request. */
+    allowExistingUsers?: () => boolean;
+}
+/**
+ * The first-run routes: whether the application still needs setup, and the one request that creates the administrator
+ * and finishes it. Setup is refused once it is done, and only one attempt runs at a time.
+ */
+export declare function createSetupRoutes<Identity extends {
+    sessionId?: string;
+}>(options: SetupRoutesOptions<Identity>): (app: FastifyInstance, overrides?: {
+    startBackgroundServices?: () => void;
+}) => Promise<void>;
+//# sourceMappingURL=setupRoutes.d.ts.map

package/dist/setupRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupRoutes.d.ts","sourceRoot":"","sources":["../src/setupRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAG5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAEnC,MAAM,WAAW,kBAAkB,CAAC,QAAQ,SAAS;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;IACzE,EAAE,EAAE,cAAc,CAAA;IAClB,+DAA+D;IAC/D,eAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;IAC1D,eAAe,EAAE,MAAM,OAAO,CAAA;IAC9B,+HAA+H;IAC/H,kBAAkB,EAAE,MAAM,IAAI,CAAA;IAC9B,wFAAwF;IACxF,iBAAiB,EAAE,MAAM,IAAI,CAAA;IAC7B,qGAAqG;IACrG,eAAe,EAAE,MAAM,IAAI,CAAA;IAC3B,sCAAsC;IACtC,aAAa,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,KAAK,CAAC,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAChH,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,iHAAiH;IACjH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7B,qEAAqE;IACrE,uBAAuB,CAAC,EAAE,MAAM,IAAI,CAAA;IACpC,sJAAsJ;IACtJ,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAA;CACnC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,SAAS;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,IAI5E,KAAK,eAAe,EAAE,YAAW;IAAE,uBAAuB,CAAC,EAAE,MAAM,IAAI,CAAA;CAAO,mBA8DjH"}