@c9up/warden 0.1.21 → 0.1.23

package/src/index.ts

@@ -44,7 +44,10 @@ export type {
 	BouncerEmitter,
 	PolicyContainerResolver,
 } from "./bouncer/types.js";
-export type { GuardFactory, WardenConfig } from "./config.js";
+export type {
+	GuardFactory,
+	WardenConfig,
+} from "./config.js";
 export {
 	apiKeyGuard,
 	basicAuthGuard,
@@ -58,15 +61,6 @@ export {
 	E_UNAUTHORIZED_ACCESS,
 	WardenError,
 } from "./errors.js";
-export { GitHubDriver } from "./firstcontact/drivers/GitHubDriver.js";
-export { GoogleDriver } from "./firstcontact/drivers/GoogleDriver.js";
-export { FirstContactManager } from "./firstcontact/FirstContactManager.js";
-export type {
-	FirstContactDriver,
-	OAuthConfig,
-	OAuthToken,
-	OAuthUser,
-} from "./firstcontact/types.js";
 export {
 	Guard,
 	getGuardMetadata,
@@ -178,9 +172,13 @@ export {
 export type { JwtClaims, JwtStrategyConfig } from "./strategies/JwtStrategy.js";
 export { generateJwtSecret, JwtStrategy } from "./strategies/JwtStrategy.js";
 export type {
+	SessionGuardState,
 	SessionStore,
 	SessionStrategyConfig,
 } from "./strategies/SessionStrategy.js";
-export { SessionStrategy } from "./strategies/SessionStrategy.js";
+export {
+	createSessionGuardState,
+	SessionStrategy,
+} from "./strategies/SessionStrategy.js";
 export type { BlacklistDriver } from "./TokenBlacklist.js";
 export { MemoryBlacklistDriver, TokenBlacklist } from "./TokenBlacklist.js";

package/src/middleware.ts

@@ -101,6 +101,8 @@ export interface WardenContext {
 	request: {
 		/** Ream's `HttpContext` exposes headers as a METHOD, not a property. */
 		headers(): Record<string, string>;
+		/** Read the encrypted remember-me cookie back. Optional, like its writer. */
+		encryptedCookie?: (name: string) => string | null;
 	};
 	/**
 	 * Per-request IoC resolver (Ream's `ctx.containerResolver`). Warden resolves
@@ -111,6 +113,21 @@ export interface WardenContext {
 	response: {
 		status: (code: number) => unknown;
 		json: (data: unknown) => void;
+		/**
+		 * Write an ENCRYPTED cookie, for the remember-me token. Optional: a
+		 * host without it simply cannot offer "keep me signed in", and
+		 * `login(user, true)` says so rather than pretending.
+		 *
+		 * Encrypted and not merely signed, because the value IS the credential
+		 * — anyone who reads it can present it.
+		 */
+		encryptedCookie?: (
+			name: string,
+			value: string,
+			options?: Record<string, unknown>,
+		) => unknown;
+		/** Drop a cookie (used to clear the remember-me one). */
+		clearCookie?: (name: string, options?: Record<string, unknown>) => unknown;
 		/**
 		 * Redirect the response (Ream's `ctx.response.redirect`). Optional so a
 		 * minimal host without it still gets the 401 JSON fallback — Warden does

package/src/native/generated.ts

@@ -0,0 +1,23 @@
+// GENERATED FROM THE RUST — do not edit.
+//
+// Produced by scripts/generate-napi-types.mjs from napi-derive's type-def
+// output. Editing this file by hand puts it back where it started: a
+// description that can disagree with the code it describes.
+
+export declare function jwtSign(payload: string, secret: string): string;
+
+export declare function jwtVerify(token: string, secret: string): string;
+
+export declare function constantTimeEq(a: string, b: string): boolean;
+
+export declare function hmacSign(data: string, secret: string): string;
+
+export declare function hmacVerify(
+	data: string,
+	signature: string,
+	secret: string,
+): boolean;
+
+export declare function randomBytes(len: number): string;
+
+export declare function randomHex(len: number): string;

package/src/native.ts

@@ -21,15 +21,14 @@ const platformMap: Record<string, string> = {
 	"win32-x64": "win32-x64-msvc",
 };
 
-export interface NativeWarden {
-	jwtSign(payload: string, secret: string): string;
-	jwtVerify(token: string, secret: string): string;
-	constantTimeEq(a: string, b: string): boolean;
-	hmacSign(data: string, secret: string): string;
-	hmacVerify(data: string, signature: string, secret: string): boolean;
-	randomBytes(len: number): string;
-	randomHex(len: number): string;
-}
+/**
+ * The engine's surface, as the Rust declares it.
+ *
+ * Derived from `./native/generated.js` — written by `pnpm build:napi-types`
+ * from napi-derive's own `type-def` output — rather than restated here, where
+ * nothing would notice a `pub fn` gaining a parameter or changing its return.
+ */
+export type NativeWarden = typeof import("./native/generated.js");
 
 let native: NativeWarden | undefined;
 

package/src/strategies/SessionStrategy.ts

@@ -65,13 +65,41 @@ export interface SessionStrategyConfig {
 /** Two years, Adonis' `rememberMeTokensAge` default. */
 const DEFAULT_REMEMBER_AGE_SECONDS = 63_072_000;
 
+/**
+ * The flags a session guard reports about THE CURRENT REQUEST — whether the
+ * user was revived from a remember-me cookie, whether one was even tried, and
+ * whether `logout()` has run.
+ *
+ * They live here, in a per-request object, and NOT on the strategy: a strategy
+ * is built once from config and shared by every request the app serves, so a
+ * flag stored on it would answer the next request with the previous one's
+ * truth — a session restored from a cookie would keep looking like one long
+ * after, and a logout would make every later request read as logged out.
+ * Upstream avoids this by building a fresh guard per request; the strategy is
+ * shared here, so the state is what moves.
+ */
+export interface SessionGuardState {
+	/** The user was revived from a remember-me cookie rather than signing in. */
+	viaRemember: boolean;
+	/** A remember-me cookie was tried at all — whether or not it worked. */
+	attemptedViaRemember: boolean;
+	/** `logout()` has run during this request. */
+	isLoggedOut: boolean;
+}
+
+/** A fresh set of per-request flags, all false. */
+export function createSessionGuardState(): SessionGuardState {
+	return {
+		viaRemember: false,
+		attemptedViaRemember: false,
+		isLoggedOut: false,
+	};
+}
+
 export class SessionStrategy implements AuthStrategy {
 	name = "session";
 	#config: SessionStrategyConfig;
 	#sessionKey: string;
-	#viaRemember = false;
-	#loggedOut = false;
-	#attemptedViaRemember = false;
 
 	constructor(config: SessionStrategyConfig) {
 		this.#config = config;
@@ -88,37 +116,6 @@ export class SessionStrategy implements AuthStrategy {
 		return this.#config.rememberMeTokens !== undefined;
 	}
 
-	/**
-	 * Whether the current user was revived from a remember-me cookie rather
-	 * than signing in (AdonisJS `viaRemember`).
-	 *
-	 * This is the distinction that lets an app demand the password again before
-	 * something sensitive — changing an email, spending money, deleting an
-	 * account. Nothing reported it, so a session restored from a cookie looked
-	 * exactly like one where the user had just typed their password.
-	 */
-	get viaRemember(): boolean {
-		return this.#viaRemember;
-	}
-
-	/**
-	 * Whether a remember-me token was even tried on this request (AdonisJS
-	 * `attemptedViaRemember`) — true whether or not it worked.
-	 */
-	get attemptedViaRemember(): boolean {
-		return this.#attemptedViaRemember;
-	}
-
-	/**
-	 * Whether `logout()` ran on this guard (AdonisJS `isLoggedOut`).
-	 *
-	 * A handler that logs out and then keeps working — clearing a cart, writing
-	 * an audit line — could not tell that the session was already gone.
-	 */
-	get isLoggedOut(): boolean {
-		return this.#loggedOut;
-	}
-
 	/** The session key the user id is stored under (AdonisJS `sessionKeyName`). */
 	get sessionKeyName(): string {
 		return this.#sessionKey;
@@ -130,6 +127,11 @@ export class SessionStrategy implements AuthStrategy {
 	}
 
 	#rememberMeAge(): number {
+		return this.rememberMeAgeSeconds;
+	}
+
+	/** How long a remember-me token lives, in SECONDS (the cookie's max-age). */
+	get rememberMeAgeSeconds(): number {
 		return this.#config.rememberMeAge ?? DEFAULT_REMEMBER_AGE_SECONDS;
 	}
 
@@ -155,10 +157,11 @@ export class SessionStrategy implements AuthStrategy {
 	 */
 	async authenticateViaRememberMeToken(
 		cookieValue: unknown,
+		state?: SessionGuardState,
 	): Promise<{ user: UserPayload; cookieValue: string } | null> {
 		const driver = this.#config.rememberMeTokens;
 		if (!driver) return null;
-		this.#attemptedViaRemember = true;
+		if (state) state.attemptedViaRemember = true;
 
 		const recycled = await verifyAndRecycleRememberMeToken(
 			driver,
@@ -170,7 +173,7 @@ export class SessionStrategy implements AuthStrategy {
 		const user = await this.#config.findUser(recycled.userId);
 		if (!user) return null;
 
-		this.#viaRemember = true;
+		if (state) state.viaRemember = true;
 		return { user, cookieValue: recycled.value };
 	}
 
@@ -240,14 +243,33 @@ export class SessionStrategy implements AuthStrategy {
 	 * migration is handled by Ream's `SessionMiddleware` on the response
 	 * path — see `wasRegenerated()` there.
 	 */
-	async login(user: UserPayload, session: SessionStore): Promise<void> {
+	/**
+	 * Seat a user in the session, without deciding HOW they got there.
+	 *
+	 * Split out from {@link login} because the remember-me path needs the seat
+	 * but not the flags: `login()` means a password was typed, and resetting
+	 * `viaRemember` there would erase the very fact a cookie-revived session
+	 * exists to report.
+	 */
+	seatSession(user: UserPayload, session: SessionStore): void {
 		session.regenerate();
 		session.put(this.#sessionKey, user.id);
-		this.#loggedOut = false;
-		// A password was typed: this session is no longer "via remember", even
-		// if a cookie was tried earlier in the same request. Without the reset
-		// the flag would stay true and a re-auth prompt would never fire.
-		this.#viaRemember = false;
+	}
+
+	async login(
+		user: UserPayload,
+		session: SessionStore,
+		state?: SessionGuardState,
+	): Promise<void> {
+		this.seatSession(user, session);
+		if (state) {
+			state.isLoggedOut = false;
+			// A password was typed: this session is no longer "via remember",
+			// even if a cookie was tried earlier in the same request. Without
+			// the reset the flag would stay true and a re-auth prompt would
+			// never fire.
+			state.viaRemember = false;
+		}
 	}
 
 	/**
@@ -267,10 +289,15 @@ export class SessionStrategy implements AuthStrategy {
 	 * The remember-me token is revoked separately through
 	 * {@link revokeRememberMeToken}, because only the caller holds the cookie.
 	 */
-	async logout(session: SessionStore): Promise<void> {
+	async logout(
+		session: SessionStore,
+		state?: SessionGuardState,
+	): Promise<void> {
 		session.forget(this.#sessionKey);
-		this.#viaRemember = false;
-		this.#attemptedViaRemember = false;
-		this.#loggedOut = true;
+		if (state) {
+			state.viaRemember = false;
+			state.attemptedViaRemember = false;
+			state.isLoggedOut = true;
+		}
 	}
 }

package/dist/firstcontact/FirstContactManager.d.ts

@@ -1,25 +0,0 @@
-/**
- * FirstContactManager — OAuth2 social authentication.
- *
- * Usage:
- *   firstContact.use('google').redirectUrl()
- *   firstContact.use('google').callback(code)
- */
-import type { FirstContactDriver, OAuthToken, OAuthUser } from "./types.js";
-export declare class FirstContactManager {
-    #private;
-    use(name: string): FirstContactDriver;
-    register(name: string, driver: FirstContactDriver): void;
-    redirect(name: string, state?: string): string;
-    /**
-     * Handle the OAuth callback. Pass `state` (from the query string) and
-     * `expectedState` (from the session, stored at redirect time) for CSRF
-     * protection. Omitting `expectedState` logs a security warning.
-     */
-    callback(name: string, code: string, state?: string, expectedState?: string): Promise<{
-        user: OAuthUser;
-        token: OAuthToken;
-    }>;
-    get registeredDrivers(): string[];
-}
-//# sourceMappingURL=FirstContactManager.d.ts.map

package/dist/firstcontact/FirstContactManager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"FirstContactManager.d.ts","sourceRoot":"","sources":["../../src/firstcontact/FirstContactManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5E,qBAAa,mBAAmB;;IAG/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB;IASrC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI;IAIxD,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAI9C;;;;OAIG;IACG,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAUlD,IAAI,iBAAiB,IAAI,MAAM,EAAE,CAEhC;CACD"}

package/dist/firstcontact/FirstContactManager.js

@@ -1,38 +0,0 @@
-/**
- * FirstContactManager — OAuth2 social authentication.
- *
- * Usage:
- *   firstContact.use('google').redirectUrl()
- *   firstContact.use('google').callback(code)
- */
-export class FirstContactManager {
-    #drivers = new Map();
-    use(name) {
-        const driver = this.#drivers.get(name);
-        if (!driver)
-            throw new Error(`OAuth driver '${name}' not registered. Available: ${[...this.#drivers.keys()].join(", ")}`);
-        return driver;
-    }
-    register(name, driver) {
-        this.#drivers.set(name, driver);
-    }
-    redirect(name, state) {
-        return this.use(name).redirectUrl(state);
-    }
-    /**
-     * Handle the OAuth callback. Pass `state` (from the query string) and
-     * `expectedState` (from the session, stored at redirect time) for CSRF
-     * protection. Omitting `expectedState` logs a security warning.
-     */
-    async callback(name, code, state, expectedState) {
-        if (!expectedState) {
-            throw new Error(`[warden] OAuth callback for '${name}' requires expectedState for CSRF protection. ` +
-                `Store the state from redirect() in the session and pass it here.`);
-        }
-        return this.use(name).callback(code, state, expectedState);
-    }
-    get registeredDrivers() {
-        return [...this.#drivers.keys()];
-    }
-}
-//# sourceMappingURL=FirstContactManager.js.map

package/dist/firstcontact/FirstContactManager.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"FirstContactManager.js","sourceRoot":"","sources":["../../src/firstcontact/FirstContactManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,OAAO,mBAAmB;IAC/B,QAAQ,GAAoC,IAAI,GAAG,EAAE,CAAC;IAEtD,GAAG,CAAC,IAAY;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YACV,MAAM,IAAI,KAAK,CACd,iBAAiB,IAAI,gCAAgC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;QACH,OAAO,MAAM,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,MAA0B;QAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,KAAc;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,IAAY,EACZ,KAAc,EACd,aAAsB;QAEtB,IAAI,CAAC,aAAa,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACd,gCAAgC,IAAI,gDAAgD;gBACnF,kEAAkE,CACnE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,iBAAiB;QACpB,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;CACD"}

package/dist/firstcontact/drivers/GitHubDriver.d.ts

@@ -1,14 +0,0 @@
-/**
- * GitHub OAuth2 driver for FirstContact.
- */
-import type { FirstContactDriver, OAuthConfig, OAuthToken, OAuthUser } from "../types.js";
-export declare class GitHubDriver implements FirstContactDriver {
-    private config;
-    constructor(config: OAuthConfig);
-    redirectUrl(state?: string): string;
-    callback(code: string, state?: string, expectedState?: string): Promise<{
-        user: OAuthUser;
-        token: OAuthToken;
-    }>;
-}
-//# sourceMappingURL=GitHubDriver.d.ts.map

package/dist/firstcontact/drivers/GitHubDriver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"GitHubDriver.d.ts","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GitHubDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,EACT,MAAM,aAAa,CAAC;AAGrB,qBAAa,YAAa,YAAW,kBAAkB;IAC1C,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEvC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAU7B,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;CA+ClD"}

package/dist/firstcontact/drivers/GitHubDriver.js

@@ -1,60 +0,0 @@
-/**
- * GitHub OAuth2 driver for FirstContact.
- */
-import { assertOAuthState } from "../types.js";
-export class GitHubDriver {
-    config;
-    constructor(config) {
-        this.config = config;
-    }
-    redirectUrl(state) {
-        const params = new URLSearchParams({
-            client_id: this.config.clientId,
-            redirect_uri: this.config.callbackUrl,
-            scope: (this.config.scopes ?? ["read:user", "user:email"]).join(" "),
-            ...(state ? { state } : {}),
-        });
-        return `https://github.com/login/oauth/authorize?${params}`;
-    }
-    async callback(code, state, expectedState) {
-        assertOAuthState(state, expectedState);
-        const tokenRes = await fetch("https://github.com/login/oauth/access_token", {
-            method: "POST",
-            headers: {
-                Accept: "application/json",
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify({
-                client_id: this.config.clientId,
-                client_secret: this.config.clientSecret,
-                code,
-            }),
-        });
-        if (!tokenRes.ok) {
-            throw new Error(`GitHub OAuth token exchange failed (HTTP ${tokenRes.status})`);
-        }
-        const tokens = (await tokenRes.json());
-        if (!tokens.access_token)
-            throw new Error("GitHub OAuth: no access_token in response");
-        const userRes = await fetch("https://api.github.com/user", {
-            headers: {
-                Authorization: `Bearer ${tokens.access_token}`,
-                Accept: "application/json",
-            },
-        });
-        if (!userRes.ok)
-            throw new Error(`GitHub user API failed (${userRes.status})`);
-        const raw = (await userRes.json());
-        return {
-            user: {
-                id: String(raw.id ?? ""),
-                email: String(raw.email ?? ""),
-                name: String(raw.name ?? raw.login ?? ""),
-                avatarUrl: raw.avatar_url,
-                raw,
-            },
-            token: { accessToken: String(tokens.access_token) },
-        };
-    }
-}
-//# sourceMappingURL=GitHubDriver.js.map

package/dist/firstcontact/drivers/GitHubDriver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"GitHubDriver.js","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GitHubDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,OAAO,YAAY;IACJ;IAApB,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAE3C,WAAW,CAAC,KAAc;QACzB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACpE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,4CAA4C,MAAM,EAAE,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB;QAEtB,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC3B,6CAA6C,EAC7C;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,IAAI;aACJ,CAAC;SACF,CACD,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,4CAA4C,QAAQ,CAAC,MAAM,GAAG,CAC9D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;YAC1D,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE;gBAC9C,MAAM,EAAE,kBAAkB;aAC1B;SACD,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAE9D,OAAO;YACN,IAAI,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzC,SAAS,EAAE,GAAG,CAAC,UAAgC;gBAC/C,GAAG;aACH;YACD,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE;SACnD,CAAC;IACH,CAAC;CACD"}

package/dist/firstcontact/drivers/GoogleDriver.d.ts

@@ -1,14 +0,0 @@
-/**
- * Google OAuth2 driver for FirstContact.
- */
-import type { FirstContactDriver, OAuthConfig, OAuthToken, OAuthUser } from "../types.js";
-export declare class GoogleDriver implements FirstContactDriver {
-    private config;
-    constructor(config: OAuthConfig);
-    redirectUrl(state?: string): string;
-    callback(code: string, state?: string, expectedState?: string): Promise<{
-        user: OAuthUser;
-        token: OAuthToken;
-    }>;
-}
-//# sourceMappingURL=GoogleDriver.d.ts.map

package/dist/firstcontact/drivers/GoogleDriver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"GoogleDriver.d.ts","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GoogleDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACX,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,SAAS,EACT,MAAM,aAAa,CAAC;AAGrB,qBAAa,YAAa,YAAW,kBAAkB;IAC1C,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAEvC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAY7B,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;CAgDlD"}

package/dist/firstcontact/drivers/GoogleDriver.js

@@ -1,63 +0,0 @@
-/**
- * Google OAuth2 driver for FirstContact.
- */
-import { assertOAuthState } from "../types.js";
-export class GoogleDriver {
-    config;
-    constructor(config) {
-        this.config = config;
-    }
-    redirectUrl(state) {
-        const params = new URLSearchParams({
-            client_id: this.config.clientId,
-            redirect_uri: this.config.callbackUrl,
-            response_type: "code",
-            scope: (this.config.scopes ?? ["openid", "email", "profile"]).join(" "),
-            access_type: "offline",
-            ...(state ? { state } : {}),
-        });
-        return `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
-    }
-    async callback(code, state, expectedState) {
-        // CSRF protection: validate state matches what we sent in redirectUrl().
-        assertOAuthState(state, expectedState);
-        const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
-            method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
-            body: new URLSearchParams({
-                code,
-                client_id: this.config.clientId,
-                client_secret: this.config.clientSecret,
-                redirect_uri: this.config.callbackUrl,
-                grant_type: "authorization_code",
-            }),
-        });
-        if (!tokenRes.ok) {
-            throw new Error(`Google OAuth token exchange failed (HTTP ${tokenRes.status})`);
-        }
-        const tokens = (await tokenRes.json());
-        if (!tokens.access_token)
-            throw new Error("Google OAuth: no access_token in response");
-        const userRes = await fetch("https://www.googleapis.com/oauth2/v2/userinfo", {
-            headers: { Authorization: `Bearer ${tokens.access_token}` },
-        });
-        if (!userRes.ok)
-            throw new Error(`Google userinfo failed (${userRes.status})`);
-        const raw = (await userRes.json());
-        return {
-            user: {
-                id: String(raw.id ?? ""),
-                email: String(raw.email ?? ""),
-                name: String(raw.name ?? ""),
-                avatarUrl: raw.picture,
-                raw,
-            },
-            token: {
-                accessToken: String(tokens.access_token),
-                refreshToken: tokens.refresh_token,
-                expiresIn: tokens.expires_in,
-            },
-        };
-    }
-}
-//# sourceMappingURL=GoogleDriver.js.map

package/dist/firstcontact/drivers/GoogleDriver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"GoogleDriver.js","sourceRoot":"","sources":["../../../src/firstcontact/drivers/GoogleDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,OAAO,YAAY;IACJ;IAApB,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAE3C,WAAW,CAAC,KAAc;QACzB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACvE,WAAW,EAAE,SAAS;YACtB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,gDAAgD,MAAM,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB;QAEtB,yEAAyE;QACzE,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,IAAI;gBACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACrC,UAAU,EAAE,oBAAoB;aAChC,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,4CAA4C,QAAQ,CAAC,MAAM,GAAG,CAC9D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,KAAK,CAC1B,+CAA+C,EAC/C;YACC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE;SAC3D,CACD,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAE9D,OAAO;YACN,IAAI,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC5B,SAAS,EAAE,GAAG,CAAC,OAA6B;gBAC5C,GAAG;aACH;YACD,KAAK,EAAE;gBACN,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;gBACxC,YAAY,EAAE,MAAM,CAAC,aAAmC;gBACxD,SAAS,EAAE,MAAM,CAAC,UAAgC;aAClD;SACD,CAAC;IACH,CAAC;CACD"}

package/dist/firstcontact/types.d.ts

@@ -1,44 +0,0 @@
-/**
- * FirstContact — OAuth2 social authentication types.
- */
-export interface OAuthConfig {
-    clientId: string;
-    clientSecret: string;
-    callbackUrl: string;
-    scopes?: string[];
-}
-export interface OAuthUser {
-    id: string;
-    email: string;
-    name: string;
-    avatarUrl?: string;
-    raw: Record<string, unknown>;
-}
-export interface OAuthToken {
-    accessToken: string;
-    refreshToken?: string;
-    expiresIn?: number;
-}
-export interface FirstContactDriver {
-    redirectUrl(state?: string): string;
-    /**
-     * Handle the OAuth callback. `state` MUST be validated against the value
-     * originally passed to `redirectUrl()` to prevent CSRF login attacks.
-     * Throws if state is missing or mismatched.
-     */
-    callback(code: string, state?: string, expectedState?: string): Promise<{
-        user: OAuthUser;
-        token: OAuthToken;
-    }>;
-}
-/**
- * Check the OAuth `state` round-trip, failing CLOSED.
- *
- * The check used to be `if (expectedState && state !== expectedState)`, so a
- * caller that passed no expected state got NO CSRF protection and no sign that
- * it was missing. A driver used directly — without the manager, which already
- * refuses — was therefore open by default. Anything that cannot be verified is
- * refused instead.
- */
-export declare function assertOAuthState(state: string | undefined, expectedState: string | undefined): void;
-//# sourceMappingURL=types.d.ts.map

package/dist/firstcontact/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/firstcontact/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CACP,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,aAAa,EAAE,MAAM,GAAG,SAAS,GAC/B,IAAI,CAUN"}

package/dist/firstcontact/types.js

@@ -1,22 +0,0 @@
-/**
- * FirstContact — OAuth2 social authentication types.
- */
-/**
- * Check the OAuth `state` round-trip, failing CLOSED.
- *
- * The check used to be `if (expectedState && state !== expectedState)`, so a
- * caller that passed no expected state got NO CSRF protection and no sign that
- * it was missing. A driver used directly — without the manager, which already
- * refuses — was therefore open by default. Anything that cannot be verified is
- * refused instead.
- */
-export function assertOAuthState(state, expectedState) {
-    if (!expectedState) {
-        throw new Error("[warden] OAuth callback requires expectedState for CSRF protection. " +
-            "Store the state given to redirectUrl() in the session and pass it here.");
-    }
-    if (state !== expectedState) {
-        throw new Error("OAuth state mismatch — possible CSRF attack");
-    }
-}
-//# sourceMappingURL=types.js.map

package/dist/firstcontact/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/firstcontact/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAqCH;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC/B,KAAyB,EACzB,aAAiC;IAEjC,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACd,sEAAsE;YACrE,yEAAyE,CAC1E,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;AACF,CAAC"}