@c9up/warden 0.1.18 → 0.1.19

package/dist/strategies/SessionStrategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionStrategy.d.ts","sourceRoot":"","sources":["../../src/strategies/SessionStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACX,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAGN,KAAK,qBAAqB,EAE1B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,YAAY;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;OAMG;IACH,UAAU,IAAI,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC/D;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAKD,qBAAa,eAAgB,YAAW,YAAY;;IACnD,IAAI,SAAa;gBAIL,MAAM,EAAE,qBAAqB;IAKzC,mDAAmD;IACnD,IAAI,oBAAoB,IAAI,MAAM,CAEjC;IAED,mDAAmD;IACnD,IAAI,oBAAoB,IAAI,OAAO,CAElC;IAMD;;;OAGG;IACG,oBAAoB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQrE;;;;;;;OAOG;IACG,8BAA8B,CACnC,WAAW,EAAE,OAAO,GAClB,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAiB7D;;;OAGG;IACG,qBAAqB,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhE,mEAAmE;IAC7D,YAAY,CACjB,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EACjD,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,YAAY,CAAA;KAAE,GACnC,OAAO,CAAC,UAAU,CAAC;IAgBtB,8DAA8D;IACxD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAQjD,2EAA2E;IACrE,iBAAiB,CACtB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,YAAY,CAAA;KAAE,GAClC,OAAO,CAAC,UAAU,CAAC;IAWtB;;;;;;;;;OASG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpE;;;;;;OAMG;IACH,oBAAoB,CAAC,IAAI,EAAE,WAAW,GAAG,kBAAkB;IAI3D;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAGlD"}
+{"version":3,"file":"SessionStrategy.d.ts","sourceRoot":"","sources":["../../src/strategies/SessionStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACX,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAGN,KAAK,qBAAqB,EAE1B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,YAAY;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;OAMG;IACH,UAAU,IAAI,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC/D;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAKD,qBAAa,eAAgB,YAAW,YAAY;;IACnD,IAAI,SAAa;gBAOL,MAAM,EAAE,qBAAqB;IAKzC,mDAAmD;IACnD,IAAI,oBAAoB,IAAI,MAAM,CAEjC;IAED,mDAAmD;IACnD,IAAI,oBAAoB,IAAI,OAAO,CAElC;IAED;;;;;;;;OAQG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;;OAGG;IACH,IAAI,oBAAoB,IAAI,OAAO,CAElC;IAED;;;;;OAKG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,+EAA+E;IAC/E,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,2FAA2F;IAC3F,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAMD;;;OAGG;IACG,oBAAoB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQrE;;;;;;;OAOG;IACG,8BAA8B,CACnC,WAAW,EAAE,OAAO,GAClB,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAmB7D;;;OAGG;IACG,qBAAqB,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhE,mEAAmE;IAC7D,YAAY,CACjB,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EACjD,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,YAAY,CAAA;KAAE,GACnC,OAAO,CAAC,UAAU,CAAC;IAgBtB,8DAA8D;IACxD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAQjD,2EAA2E;IACrE,iBAAiB,CACtB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,YAAY,CAAA;KAAE,GAClC,OAAO,CAAC,UAAU,CAAC;IAWtB;;;;;;;;;OASG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpE;;;;;;OAMG;IACH,oBAAoB,CAAC,IAAI,EAAE,WAAW,GAAG,kBAAkB;IAI3D;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlD"}

package/dist/strategies/SessionStrategy.js

@@ -14,6 +14,9 @@ export class SessionStrategy {
     name = "session";
     #config;
     #sessionKey;
+    #viaRemember = false;
+    #loggedOut = false;
+    #attemptedViaRemember = false;
     constructor(config) {
         this.#config = config;
         this.#sessionKey = config.sessionKey ?? "auth_user_id";
@@ -26,6 +29,42 @@ export class SessionStrategy {
     get usesRememberMeTokens() {
         return this.#config.rememberMeTokens !== undefined;
     }
+    /**
+     * Whether the current user was revived from a remember-me cookie rather
+     * than signing in (AdonisJS `viaRemember`).
+     *
+     * This is the distinction that lets an app demand the password again before
+     * something sensitive — changing an email, spending money, deleting an
+     * account. Nothing reported it, so a session restored from a cookie looked
+     * exactly like one where the user had just typed their password.
+     */
+    get viaRemember() {
+        return this.#viaRemember;
+    }
+    /**
+     * Whether a remember-me token was even tried on this request (AdonisJS
+     * `attemptedViaRemember`) — true whether or not it worked.
+     */
+    get attemptedViaRemember() {
+        return this.#attemptedViaRemember;
+    }
+    /**
+     * Whether `logout()` ran on this guard (AdonisJS `isLoggedOut`).
+     *
+     * A handler that logs out and then keeps working — clearing a cart, writing
+     * an audit line — could not tell that the session was already gone.
+     */
+    get isLoggedOut() {
+        return this.#loggedOut;
+    }
+    /** The session key the user id is stored under (AdonisJS `sessionKeyName`). */
+    get sessionKeyName() {
+        return this.#sessionKey;
+    }
+    /** The cookie key the remember-me token is stored under (AdonisJS `rememberMeKeyName`). */
+    get rememberMeKeyName() {
+        return this.rememberMeCookieName;
+    }
     #rememberMeAge() {
         return this.#config.rememberMeAge ?? DEFAULT_REMEMBER_AGE_SECONDS;
     }
@@ -53,12 +92,14 @@ export class SessionStrategy {
         const driver = this.#config.rememberMeTokens;
         if (!driver)
             return null;
+        this.#attemptedViaRemember = true;
         const recycled = await verifyAndRecycleRememberMeToken(driver, cookieValue, this.#rememberMeAge());
         if (!recycled)
             return null;
         const user = await this.#config.findUser(recycled.userId);
         if (!user)
             return null;
+        this.#viaRemember = true;
         return { user, cookieValue: recycled.value };
     }
     /**
@@ -120,6 +161,11 @@ export class SessionStrategy {
     async login(user, session) {
         session.regenerate();
         session.put(this.#sessionKey, user.id);
+        this.#loggedOut = false;
+        // A password was typed: this session is no longer "via remember", even
+        // if a cookie was tried earlier in the same request. Without the reset
+        // the flag would stay true and a re-auth prompt would never fire.
+        this.#viaRemember = false;
     }
     /**
      * The session entry a test client needs to be `user` (AdonisJS
@@ -139,6 +185,9 @@ export class SessionStrategy {
      */
     async logout(session) {
         session.forget(this.#sessionKey);
+        this.#viaRemember = false;
+        this.#attemptedViaRemember = false;
+        this.#loggedOut = true;
     }
 }
 //# sourceMappingURL=SessionStrategy.js.map

package/dist/strategies/SessionStrategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionStrategy.js","sourceRoot":"","sources":["../../src/strategies/SessionStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACN,gBAAgB,EAChB,mBAAmB,EAEnB,+BAA+B,GAC/B,MAAM,uBAAuB,CAAC;AA2C/B,wDAAwD;AACxD,MAAM,4BAA4B,GAAG,UAAU,CAAC;AAEhD,MAAM,OAAO,eAAe;IAC3B,IAAI,GAAG,SAAS,CAAC;IACjB,OAAO,CAAwB;IAC/B,WAAW,CAAS;IAEpB,YAAY,MAA6B;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,IAAI,cAAc,CAAC;IACxD,CAAC;IAED,mDAAmD;IACnD,IAAI,oBAAoB;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,cAAc,CAAC;IAC5D,CAAC;IAED,mDAAmD;IACnD,IAAI,oBAAoB;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC;IACpD,CAAC;IAED,cAAc;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAiB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,8BAA8B,CACnC,WAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACrD,MAAM,EACN,WAAW,EACX,IAAI,CAAC,cAAc,EAAE,CACrB,CAAC;QACF,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,WAAoB;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,YAAY,CACjB,YAAiD,EACjD,QAAqC;QAErC,sEAAsE;QACtE,wEAAwE;QACxE,mEAAmE;QACnE,sEAAsE;QACtE,kEAAkE;QAClE,sCAAsC;QACtC,MAAM,IAAI,WAAW,CACpB,WAAW,EACX,6KAA6K,EAC7K;YACC,IAAI,EAAE,yKAAyK;SAC/K,CACD,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,MAAM,CAAC,MAAc;QAC1B,OAAO;YACN,aAAa,EAAE,KAAK;YACpB,KAAK,EACJ,qEAAqE;SACtE,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,iBAAiB,CACtB,MAAc,EACd,OAAoC;QAEpC,IAAI,CAAC,OAAO,EAAE,OAAO;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACvE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;YAC3D,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QACpE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,KAAK,CAAC,IAAiB,EAAE,OAAqB;QACnD,OAAO,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,IAAiB;QACrC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,OAAqB;QACjC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;CACD"}
+{"version":3,"file":"SessionStrategy.js","sourceRoot":"","sources":["../../src/strategies/SessionStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACN,gBAAgB,EAChB,mBAAmB,EAEnB,+BAA+B,GAC/B,MAAM,uBAAuB,CAAC;AA2C/B,wDAAwD;AACxD,MAAM,4BAA4B,GAAG,UAAU,CAAC;AAEhD,MAAM,OAAO,eAAe;IAC3B,IAAI,GAAG,SAAS,CAAC;IACjB,OAAO,CAAwB;IAC/B,WAAW,CAAS;IACpB,YAAY,GAAG,KAAK,CAAC;IACrB,UAAU,GAAG,KAAK,CAAC;IACnB,qBAAqB,GAAG,KAAK,CAAC;IAE9B,YAAY,MAA6B;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,IAAI,cAAc,CAAC;IACxD,CAAC;IAED,mDAAmD;IACnD,IAAI,oBAAoB;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,cAAc,CAAC;IAC5D,CAAC;IAED,mDAAmD;IACnD,IAAI,oBAAoB;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC;IACpD,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI,WAAW;QACd,OAAO,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,IAAI,oBAAoB;QACvB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,IAAI,WAAW;QACd,OAAO,IAAI,CAAC,UAAU,CAAC;IACxB,CAAC;IAED,+EAA+E;IAC/E,IAAI,cAAc;QACjB,OAAO,IAAI,CAAC,WAAW,CAAC;IACzB,CAAC;IAED,2FAA2F;IAC3F,IAAI,iBAAiB;QACpB,OAAO,IAAI,CAAC,oBAAoB,CAAC;IAClC,CAAC;IAED,cAAc;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAiB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,8BAA8B,CACnC,WAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;QAElC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACrD,MAAM,EACN,WAAW,EACX,IAAI,CAAC,cAAc,EAAE,CACrB,CAAC;QACF,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,WAAoB;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,YAAY,CACjB,YAAiD,EACjD,QAAqC;QAErC,sEAAsE;QACtE,wEAAwE;QACxE,mEAAmE;QACnE,sEAAsE;QACtE,kEAAkE;QAClE,sCAAsC;QACtC,MAAM,IAAI,WAAW,CACpB,WAAW,EACX,6KAA6K,EAC7K;YACC,IAAI,EAAE,yKAAyK;SAC/K,CACD,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,MAAM,CAAC,MAAc;QAC1B,OAAO;YACN,aAAa,EAAE,KAAK;YACpB,KAAK,EACJ,qEAAqE;SACtE,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,iBAAiB,CACtB,MAAc,EACd,OAAoC;QAEpC,IAAI,CAAC,OAAO,EAAE,OAAO;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACvE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;YAC3D,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QACpE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,KAAK,CAAC,IAAiB,EAAE,OAAqB;QACnD,OAAO,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QACxB,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,IAAiB;QACrC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,OAAqB;QACjC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACxB,CAAC;CACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/warden",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "description": "Warden — Authentication & authorization for the Ream framework",
   "license": "MIT",
   "type": "module",

package/src/AuthManager.ts

@@ -4,7 +4,13 @@
  * @implements FR48, FR50, FR51
  */
 
+import { Authenticator } from "./Authenticator.js";
 import { WardenError } from "./errors.js";
+import type { WardenContext } from "./middleware.js";
+import { sanitizePayload } from "./sanitize.js";
+
+export { sanitizePayload };
+
 import { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
 import { RightsResolver } from "./rights/RightsResolver.js";
 import type { EffectivePermissions, Scope } from "./rights/types.js";
@@ -47,6 +53,25 @@ export interface AuthClientResponse {
 	cookies?: Record<string, string>;
 }
 
+/**
+ * The event namespace for a guard, taken from its DRIVER.
+ *
+ * AdonisJS namespaces auth events per driver — `session_auth:*`,
+ * `access_tokens_auth:*`, `basic_auth:*` — so an app can audit session logins
+ * without also hearing about every bearer token. Warden emitted `session_auth:*`
+ * whatever authenticated, which told a session listener about JWT traffic and
+ * left no name to subscribe to for the others.
+ *
+ * Driven by the strategy's `name` rather than the guard's config key: a guard
+ * called `web` running a `SessionStrategy` is still the session driver, exactly
+ * as upstream. A driver already ending in `_auth` (`basic_auth`) keeps its name
+ * rather than growing a second suffix, which is how AdonisJS spells it.
+ */
+export function authEventPrefix(driverName: string | undefined): string {
+	if (!driverName) return "session_auth";
+	return driverName.endsWith("_auth") ? driverName : `${driverName}_auth`;
+}
+
 export interface AuthStrategy {
 	name: string;
 	authenticate(credentials: Record<string, unknown>): Promise<AuthResult>;
@@ -323,6 +348,63 @@ export class AuthManager {
 	}
 
 	/** Get a registered strategy by name. */
+	/**
+	 * An {@link Authenticator} bound to one request (AdonisJS
+	 * `createAuthenticator`).
+	 *
+	 * What the HTTP middleware builds per request. Exposed so anything outside
+	 * that path — a console command acting as a user, a background job — can
+	 * build one without reaching for the class.
+	 */
+	createAuthenticator(ctx: WardenContext): Authenticator {
+		return new Authenticator(ctx, this);
+	}
+
+	/**
+	 * What a test client needs to authenticate as a user (AdonisJS
+	 * `createAuthenticatorClient`).
+	 *
+	 * Delegates to the guard's own `authenticateAsClient`, so a guard with no
+	 * test seam says so instead of having one forged for it.
+	 */
+	createAuthenticatorClient(): {
+		use(guard?: string): {
+			authenticateAsClient(
+				...args: never[]
+			): Promise<AuthClientResponse> | AuthClientResponse;
+		};
+	} {
+		return {
+			use: (guard?: string) => {
+				const strategy = this.getStrategy(guard);
+				const seam = strategy.authenticateAsClient?.bind(strategy);
+				if (!seam) {
+					throw new WardenError(
+						"STRATEGY_HAS_NO_CLIENT",
+						`Auth strategy '${guard ?? this.default}' has no authenticateAsClient() — it cannot forge a client request.`,
+						{
+							hint: "Implement authenticateAsClient() on the strategy, or authenticate through a real login in the test.",
+						},
+					);
+				}
+				return { authenticateAsClient: seam };
+			},
+		};
+	}
+
+	/**
+	 * The event namespace a guard's events carry, resolved from its driver.
+	 * Falls back to `session_auth` when the guard cannot be resolved, so a
+	 * failure to look one up never becomes a second failure at emit time.
+	 */
+	eventPrefixFor(guardName?: string): string {
+		try {
+			return authEventPrefix(this.getStrategy(guardName).name);
+		} catch {
+			return authEventPrefix(undefined);
+		}
+	}
+
 	getStrategy(name?: string): AuthStrategy {
 		const strategyName = name ?? this.default;
 		const strategy = this.guards.get(strategyName);
@@ -382,12 +464,13 @@ export class AuthManager {
 				},
 			);
 		}
-		this.#emit("session_auth:login_attempted", {
+		const prefix = authEventPrefix(strategy.name);
+		this.#emit(`${prefix}:login_attempted`, {
 			guardName: strategyName ?? this.default,
 			user,
 		});
 		await strategy.login(user, session);
-		this.#emit("session_auth:login_succeeded", {
+		this.#emit(`${prefix}:login_succeeded`, {
 			guardName: strategyName ?? this.default,
 			user,
 			sessionId: undefined,
@@ -408,7 +491,7 @@ export class AuthManager {
 			);
 		}
 		await strategy.logout(session);
-		this.#emit("session_auth:logged_out", {
+		this.#emit(`${authEventPrefix(strategy.name)}:logged_out`, {
 			guardName: strategyName ?? this.default,
 			user: null,
 			error: null,
@@ -446,10 +529,3 @@ function isLoginCapable(
  * directly (not `AuthManager.verify`), so without this it would skip
  * the guard JWT / api-key users get.
  */
-export function sanitizePayload(user: UserPayload): void {
-	for (const key of ["__proto__", "constructor", "prototype"]) {
-		if (key in user) {
-			delete (user as Record<string, unknown>)[key];
-		}
-	}
-}

package/src/Authenticator.ts

@@ -14,15 +14,15 @@
  * `@c9up/ream`.
  */
 
-import {
-	type AuthManager,
-	type AuthResult,
-	type AuthStrategy,
-	sanitizePayload,
-	type UserPayload,
+import type {
+	AuthManager,
+	AuthResult,
+	AuthStrategy,
+	UserPayload,
 } from "./AuthManager.js";
 import { E_UNAUTHORIZED_ACCESS, WardenError } from "./errors.js";
 import type { WardenContext } from "./middleware.js";
+import { sanitizePayload } from "./sanitize.js";
 import type { SessionStore } from "./strategies/SessionStrategy.js";
 
 /**
@@ -308,6 +308,31 @@ export class Authenticator {
 		}
 	}
 
+	/**
+	 * Try the given guards in order and report whether one succeeded, without
+	 * throwing (AdonisJS `checkUsing`).
+	 *
+	 * The non-throwing sibling of {@link authenticateUsing}: `check()` is to
+	 * `authenticate()` what this is to it. A handler that wants to branch on
+	 * "is anyone signed in through either of these" had to wrap the throwing
+	 * form in a try/catch itself.
+	 */
+	async checkUsing(
+		guards?: string[],
+		options?: { loginRoute?: string },
+	): Promise<boolean> {
+		try {
+			await this.authenticateUsing(guards, options);
+			return this.isAuthenticated;
+		} catch (err) {
+			// A credential rejection is an answer, not a failure. Anything else
+			// — a crashed strategy, a config error — is still a real problem and
+			// must not be reported as "not signed in".
+			if (err instanceof E_UNAUTHORIZED_ACCESS) return false;
+			throw err;
+		}
+	}
+
 	/**
 	 * Authenticate by trying the given guards in order (default: the default
 	 * guard). Sets the user on the first success; throws `E_UNAUTHORIZED_ACCESS`
@@ -322,11 +347,13 @@ export class Authenticator {
 		const names =
 			guards && guards.length > 0 ? guards : [this.#auth.defaultStrategyName];
 		const guardName = names[0] ?? this.#auth.defaultStrategyName;
-		// The four authentication events AdonisJS' session guard emits. An app
-		// auditing logins subscribes to exactly these names.
-		this.#auth.emitAuthEvent("session_auth:authentication_attempted", {
-			guardName,
-		});
+		// Namespaced by the guard's driver, as AdonisJS does: `session_auth:*`,
+		// `access_tokens_auth:*`, `basic_auth:*`. An app auditing session logins
+		// must not be told about bearer-token traffic under the same name.
+		this.#auth.emitAuthEvent(
+			`${this.#auth.eventPrefixFor(guardName)}:authentication_attempted`,
+			{ guardName },
+		);
 		const creds = extractCredentials(this.#ctx, this.#auth);
 		const hasSessionStrategy = names.includes("session");
 		const { result, viaGuard, attemptCount, crashCount } =
@@ -338,11 +365,13 @@ export class Authenticator {
 		if (result?.authenticated && result.user) {
 			this.#user = result.user;
 			this.#viaGuard = viaGuard;
-			this.#auth.emitAuthEvent("session_auth:authentication_succeeded", {
-				guardName: viaGuard ?? guardName,
-				user: result.user,
-				sessionId: undefined,
-			});
+			// The guard that actually answered names the event, not the one asked
+			// for first.
+			const winner = viaGuard ?? guardName;
+			this.#auth.emitAuthEvent(
+				`${this.#auth.eventPrefixFor(winner)}:authentication_succeeded`,
+				{ guardName: winner, user: result.user, sessionId: undefined },
+			);
 			return;
 		}
 		// Every attempted guard crashed → a server-side incident, not a
@@ -361,10 +390,10 @@ export class Authenticator {
 				redirectTo: hasSessionStrategy ? options?.loginRoute : undefined,
 			},
 		);
-		this.#auth.emitAuthEvent("session_auth:authentication_failed", {
-			guardName,
-			error: failure,
-		});
+		this.#auth.emitAuthEvent(
+			`${this.#auth.eventPrefixFor(guardName)}:authentication_failed`,
+			{ guardName, error: failure },
+		);
 		throw failure;
 	}
 

package/src/RememberMeToken.ts

@@ -21,6 +21,7 @@
  */
 
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { Secret } from "./Secret.js";
 
 /** Bytes of entropy in a token secret. Adonis defaults to 40. */
 export const DEFAULT_SECRET_LENGTH = 40;
@@ -221,3 +222,136 @@ export class MemoryRememberMeTokenDriver implements RememberMeTokenDriver {
 		}
 	}
 }
+
+/**
+ * A remember-me token as an object, matching `@adonisjs/auth`'s
+ * `RememberMeToken` (modules/session_guard/remember_me_token.ts).
+ *
+ * The functions above are what warden's own guard uses and stay the primary
+ * API. This class exists because an app moving over calls
+ * `RememberMeToken.decode(...)` / `token.verify(secret)` directly — upstream
+ * exports it — and finding nothing under that name is a migration stopping at
+ * an import line. Both sit on the same encoding and the same hashing, so they
+ * cannot disagree about what a token is.
+ *
+ * Secrets come back wrapped in {@link Secret} so one cannot end up in a log by
+ * being interpolated into a string, which is what upstream does too.
+ */
+export class RememberMeToken {
+	/**
+	 * Split a public token value into its identifier and secret. Returns `null`
+	 * for anything malformed rather than throwing — a bad cookie is an ordinary
+	 * event, not an exception.
+	 */
+	static decode(
+		value: string,
+	): { identifier: string; secret: Secret<string> } | null {
+		const decoded = decodeTokenValue(value);
+		if (!decoded) return null;
+		return {
+			identifier: decoded.identifier,
+			secret: new Secret(decoded.secret),
+		};
+	}
+
+	/** A fresh secret and the hash to store for it. */
+	static seed(size: number = DEFAULT_SECRET_LENGTH): {
+		secret: Secret<string>;
+		hash: string;
+	} {
+		const secret = randomBytes(size).toString("base64url");
+		return { secret: new Secret(secret), hash: hashSecret(secret) };
+	}
+
+	/**
+	 * Everything the persistence layer needs for a new token, without deciding
+	 * how it is stored (upstream `createTransientToken`).
+	 *
+	 * `expiresIn` is in SECONDS, as everywhere else in this module. AdonisJS
+	 * also accepts a duration string there; warden takes the number, so the
+	 * unit is never ambiguous at a call site.
+	 */
+	static createTransientToken(
+		userId: string | number,
+		size: number,
+		expiresIn: number,
+	): {
+		secret: Secret<string>;
+		hash: string;
+		userId: string | number;
+		expiresAt: Date;
+	} {
+		const { secret, hash } = RememberMeToken.seed(size);
+		return {
+			secret,
+			hash,
+			userId,
+			expiresAt: new Date(Date.now() + expiresIn * 1000),
+		};
+	}
+
+	identifier: string;
+	tokenableId: string | number;
+	hash: string;
+	createdAt: Date;
+	updatedAt: Date;
+	expiresAt: Date;
+	/** The public `identifier.secret` value — only on a token just minted. */
+	value?: Secret<string>;
+
+	constructor(attributes: {
+		identifier: string;
+		tokenableId: string | number;
+		hash: string;
+		createdAt: Date;
+		updatedAt: Date;
+		expiresAt: Date;
+		secret?: Secret<string>;
+	}) {
+		this.identifier = attributes.identifier;
+		this.tokenableId = attributes.tokenableId;
+		this.hash = attributes.hash;
+		this.createdAt = attributes.createdAt;
+		this.updatedAt = attributes.updatedAt;
+		this.expiresAt = attributes.expiresAt;
+		if (attributes.secret) {
+			this.value = new Secret(
+				encodeTokenValue(attributes.identifier, attributes.secret.release()),
+			);
+		}
+	}
+
+	/** Build one from a stored row, whose timestamps are epoch milliseconds. */
+	static fromStored(stored: StoredRememberMeToken): RememberMeToken {
+		return new RememberMeToken({
+			identifier: stored.identifier,
+			tokenableId: stored.tokenableId,
+			hash: stored.hash,
+			createdAt: new Date(stored.createdAt),
+			updatedAt: new Date(stored.updatedAt),
+			expiresAt: new Date(stored.expiresAt),
+		});
+	}
+
+	/** The row to persist, in the shape {@link RememberMeTokenDriver} takes. */
+	toStored(): StoredRememberMeToken {
+		return {
+			identifier: this.identifier,
+			tokenableId: this.tokenableId,
+			hash: this.hash,
+			createdAt: this.createdAt.getTime(),
+			updatedAt: this.updatedAt.getTime(),
+			expiresAt: this.expiresAt.getTime(),
+		};
+	}
+
+	/** Whether the token is past its expiry. */
+	isExpired(): boolean {
+		return this.expiresAt.getTime() <= Date.now();
+	}
+
+	/** Constant-time check of a presented secret against the stored hash. */
+	verify(secret: Secret<string>): boolean {
+		return safeCompareHashes(this.hash, hashSecret(secret.release()));
+	}
+}

package/src/Secret.ts

@@ -0,0 +1,41 @@
+/**
+ * Wraps a sensitive value so it never leaks through a log, `JSON.stringify`, or
+ * `util.inspect`. Read it back deliberately with {@link Secret.release}.
+ *
+ * AdonisJS takes this from `@adonisjs/core/helpers`, and its `RememberMeToken`
+ * hands secrets out wrapped in one. Warden carries its own copy rather than
+ * importing `@c9up/ream`: it has no runtime dependencies and ships a standalone
+ * entry point, so reaching for a peer here would break the framework-free mode.
+ * Same reason every native package carries its own platform map.
+ */
+const REDACTED = "[redacted]";
+
+export class Secret<T> {
+	readonly #value: T;
+	readonly #keyword: string;
+
+	constructor(value: T, redactedKeyword: string = REDACTED) {
+		this.#value = value;
+		this.#keyword = redactedKeyword;
+	}
+
+	/** Redacted placeholder, so `JSON.stringify` never emits the secret. */
+	toJSON(): string {
+		return this.#keyword;
+	}
+
+	/** Redacted placeholder for string coercion and template literals. */
+	toString(): string {
+		return this.#keyword;
+	}
+
+	/** Redacted placeholder for `console.log` / `util.inspect`. */
+	[Symbol.for("nodejs.util.inspect.custom")](): string {
+		return this.#keyword;
+	}
+
+	/** Release the underlying value — the one deliberate way to read it. */
+	release(): T {
+		return this.#value;
+	}
+}

package/src/bouncer/Bouncer.ts

@@ -18,7 +18,13 @@ import type { EffectivePermissions, Scope } from "../rights/types.js";
 import { AbilitiesBuilder } from "./AbilitiesBuilder.js";
 import { AuthorizationResponse } from "./AuthorizationResponse.js";
 import type { BasePolicy } from "./BasePolicy.js";
-import { evaluate, isAction, throwAuthorizationFailure } from "./evaluate.js";
+import {
+	defaultResponseBuilder,
+	evaluate,
+	isAction,
+	type ResponseBuilder,
+	throwAuthorizationFailure,
+} from "./evaluate.js";
 import { PolicyAuthorizer } from "./PolicyAuthorizer.js";
 import { emptyPermissions } from "./policyContext.js";
 import type {
@@ -31,6 +37,20 @@ import type {
 } from "./types.js";
 
 export class Bouncer {
+	/**
+	 * How a bare boolean from an ability or a policy becomes an
+	 * {@link AuthorizationResponse} (AdonisJS `Bouncer.responseBuilder`).
+	 *
+	 * Replace it once at boot to give every `return false` a house message and
+	 * status instead of a naked 403:
+	 *
+	 * ```ts
+	 * Bouncer.responseBuilder = (value) =>
+	 *   value === false ? AuthorizationResponse.deny('Nope', 404) : normalizeResponse(value)
+	 * ```
+	 */
+	static responseBuilder: ResponseBuilder = defaultResponseBuilder;
+
 	readonly #userOrResolver: UserPayload | (() => UserPayload | null) | null;
 	/** Lazily-resolved user cache (`undefined` until `#getUser` runs). */
 	#user: UserPayload | null | undefined;
@@ -231,6 +251,7 @@ export class Bouncer {
 			this.#scope,
 			() => this.#resolvePermissions(),
 			this.#emitter,
+			Bouncer.responseBuilder,
 		);
 	}
 
@@ -245,10 +266,17 @@ export class Bouncer {
 	}
 
 	/** Emit `authorization:finished` when an emitter is wired (no-op otherwise). */
-	#emit(action: string, response: AuthorizationResponse): void {
+	#emit(
+		action: string,
+		response: AuthorizationResponse,
+		parameters: unknown[],
+	): void {
 		this.#emitter?.emit("authorization:finished", {
 			user: this.#getUser(),
 			action,
+			// What the check was ABOUT. AdonisJS carries it, and without it an
+			// audit log can say "Ada was denied editPost" but never which post.
+			parameters,
 			response,
 		});
 	}
@@ -321,8 +349,9 @@ export class Bouncer {
 			allowGuest: resolved.allowGuest,
 			run: (user) => resolved.execute(user, ...args),
 			args,
+			responseBuilder: Bouncer.responseBuilder,
 		});
-		this.#emit(action, response);
+		this.#emit(action, response, args);
 		return response;
 	}