@c9up/warden 0.1.22 → 0.1.23

package/src/Authenticator.ts

@@ -23,7 +23,11 @@ import type {
 import { E_UNAUTHORIZED_ACCESS, WardenError } from "./errors.js";
 import type { WardenContext } from "./middleware.js";
 import { sanitizePayload } from "./sanitize.js";
-import type { SessionStore } from "./strategies/SessionStrategy.js";
+import {
+	createSessionGuardState,
+	type SessionGuardState,
+	type SessionStore,
+} from "./strategies/SessionStrategy.js";
 
 /**
  * Guard names Warden accepts for the API-key / access-tokens driver. AdonisJS
@@ -39,6 +43,66 @@ interface StrategyWithContext extends AuthStrategy {
 	verifyWithContext(token: string, ctx: unknown): Promise<AuthResult>;
 }
 
+/**
+ * The strategy behind a guard name, or `undefined` when nothing is registered
+ * under it.
+ *
+ * `getStrategy()` throws for an unknown name — correct when an application
+ * asks for a guard by name, wrong here: this is a capability probe across a
+ * list, and a name that resolves to nothing simply is not a session guard.
+ */
+function strategyOrUndefined(
+	auth: AuthManager,
+	name: string,
+): AuthStrategy | undefined {
+	try {
+		return auth.getStrategy(name);
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * A guard that can keep a user signed in: mint a token, name its cookie, read
+ * one back, and seat the session that follows.
+ */
+interface RememberMeIssuer {
+	issueRememberMeToken(user: UserPayload): Promise<string | null>;
+	authenticateViaRememberMeToken(
+		cookieValue: unknown,
+		state?: SessionGuardState,
+	): Promise<{ user: UserPayload; cookieValue: string } | null>;
+	seatSession(user: UserPayload, session: SessionStore): void;
+	revokeRememberMeToken(cookieValue: unknown): Promise<void>;
+	readonly rememberMeCookieName: string;
+	readonly rememberMeAgeSeconds: number;
+}
+
+/**
+ * Structural, like every other capability probe here: a guard an application
+ * wrote itself, carrying the same three members, keeps users signed in just as
+ * well as the one shipped with the package.
+ */
+function isRememberMeIssuer(
+	strategy: AuthStrategy,
+): strategy is AuthStrategy & RememberMeIssuer {
+	return (
+		typeof Reflect.get(strategy, "issueRememberMeToken") === "function" &&
+		typeof Reflect.get(strategy, "authenticateViaRememberMeToken") ===
+			"function" &&
+		typeof Reflect.get(strategy, "seatSession") === "function" &&
+		typeof Reflect.get(strategy, "revokeRememberMeToken") === "function" &&
+		typeof Reflect.get(strategy, "rememberMeCookieName") === "string" &&
+		typeof Reflect.get(strategy, "rememberMeAgeSeconds") === "number"
+	);
+}
+
+/** Whether the guard behind `name` authenticates from the request context. */
+function isSessionGuard(auth: AuthManager, name: string): boolean {
+	const strategy = strategyOrUndefined(auth, name);
+	return strategy !== undefined && hasVerifyWithContext(strategy);
+}
+
 function hasVerifyWithContext(
 	strategy: AuthStrategy,
 ): strategy is StrategyWithContext {
@@ -115,7 +179,6 @@ export async function tryAuthenticate(
 		bearerToken: string;
 		apiKey: string;
 		session: SessionStore | undefined;
-		hasSessionStrategy: boolean;
 	},
 ): Promise<AuthAttempt> {
 	const { bearerToken, apiKey, session } = creds;
@@ -126,21 +189,22 @@ export async function tryAuthenticate(
 	for (const strategyName of strategies) {
 		try {
 			let r: AuthResult;
-			if (strategyName === "session") {
-				const strategy = auth.getStrategy(strategyName);
-				const verifyWithContext =
-					strategy && hasVerifyWithContext(strategy)
-						? strategy.verifyWithContext
-						: undefined;
-				if (verifyWithContext) {
-					attemptCount++;
-					r = await verifyWithContext.call(strategy, "", { session });
-					// The session path bypasses AuthManager.verify(), so apply the
-					// same prototype-pollution guard JWT / api-key users get there.
-					if (r.user) sanitizePayload(r.user);
-				} else {
-					continue;
-				}
+			// A session guard is one that can verify FROM THE REQUEST CONTEXT,
+			// not one registered under a particular name. `guards: { web:
+			// sessionGuard(...) }` is the documented config shape, and matching
+			// on the literal "session" sent it down the bearer-token path — so
+			// `auth.use('web').authenticate()` never read the session at all.
+			const strategy = strategyOrUndefined(auth, strategyName);
+			const verifyWithContext =
+				strategy && hasVerifyWithContext(strategy)
+					? strategy.verifyWithContext
+					: undefined;
+			if (verifyWithContext !== undefined) {
+				attemptCount++;
+				r = await verifyWithContext.call(strategy, "", { session });
+				// The session path bypasses AuthManager.verify(), so apply the
+				// same prototype-pollution guard JWT / api-key users get there.
+				if (r.user) sanitizePayload(r.user);
 			} else {
 				// Native-first credential, other transport as fallback so a
 				// single-credential client still authenticates (and an invalid
@@ -185,6 +249,12 @@ export class GuardAccessor {
 	readonly #auth: AuthManager;
 	readonly #name: string;
 	readonly #parent: Authenticator;
+	/**
+	 * The session-guard flags for THIS request. They live on the accessor —
+	 * which the Authenticator builds and caches per request — and never on the
+	 * strategy, which is built once from config and shared by every request.
+	 */
+	readonly #state: SessionGuardState = createSessionGuardState();
 
 	constructor(
 		ctx: WardenContext,
@@ -209,19 +279,203 @@ export class GuardAccessor {
 		return this.user !== undefined;
 	}
 
+	/**
+	 * Whether the user was revived from a remember-me cookie rather than
+	 * signing in.
+	 *
+	 * This is the distinction that lets an app demand the password again before
+	 * something sensitive — changing an email, spending money, deleting an
+	 * account.
+	 */
+	get viaRemember(): boolean {
+		return this.#state.viaRemember;
+	}
+
+	/** Whether a remember-me cookie was tried at all on this request. */
+	get attemptedViaRemember(): boolean {
+		return this.#state.attemptedViaRemember;
+	}
+
+	/**
+	 * Whether `logout()` has run during this request.
+	 *
+	 * A handler that logs out and then keeps working — clearing a cart, writing
+	 * an audit line — could not otherwise tell the session was already gone.
+	 */
+	get isLoggedOut(): boolean {
+		return this.#state.isLoggedOut;
+	}
+
+	/**
+	 * Revive the user from a remember-me cookie, recording on this request that
+	 * one was tried and whether it worked.
+	 *
+	 * The returned `cookieValue` must replace the one the browser holds: the
+	 * token is single-use and is recycled on every successful revival.
+	 */
+	authenticateViaRememberMeToken(
+		cookieValue: unknown,
+	): Promise<{ user: UserPayload; cookieValue: string } | null> {
+		return this.#auth.authenticateViaRememberMeToken(
+			cookieValue,
+			this.#name,
+			this.#state,
+		);
+	}
+
 	/** Authenticate the request using only this guard (throws on failure). */
 	authenticate(): Promise<void> {
 		return this.#parent.authenticateUsing([this.#name]);
 	}
 
-	/** Log a user in through this guard (session guards). */
-	login(user: UserPayload): Promise<void> {
-		return this.#auth.login(user, this.#requireSession(), this.#name);
+	/**
+	 * Revive this request from the remember-me cookie, if the browser holds one.
+	 *
+	 * The token is single-use: a success recycles the cookie and re-seats the
+	 * session, so a stolen copy stops working the moment the real user comes
+	 * back, and the rest of the request sees an ordinary signed-in user.
+	 */
+	async tryRememberMeCookie(): Promise<UserPayload | undefined> {
+		const read = this.#ctx.request.encryptedCookie;
+		const write = this.#ctx.response.encryptedCookie;
+		const session = this.#ctx.session;
+		if (!read || !write || !session) return undefined;
+
+		const strategy = strategyOrUndefined(this.#auth, this.#name);
+		if (!strategy || !isRememberMeIssuer(strategy)) return undefined;
+
+		const cookie = read.call(this.#ctx.request, strategy.rememberMeCookieName);
+		if (!cookie) return undefined;
+
+		const revived = await strategy.authenticateViaRememberMeToken(
+			cookie,
+			this.#state,
+		);
+		if (!revived) return undefined;
+
+		write.call(
+			this.#ctx.response,
+			strategy.rememberMeCookieName,
+			revived.cookieValue,
+			{ maxAge: strategy.rememberMeAgeSeconds, httpOnly: true },
+		);
+		// Seat the session WITHOUT `login()`: that method means a password was
+		// typed, and it clears `viaRemember` — the one thing this path exists to
+		// report, and what an app checks before letting someone change an email
+		// or spend money.
+		strategy.seatSession(revived.user, session);
+		return revived.user;
+	}
+
+	/**
+	 * Log a user in through this guard (session guards).
+	 *
+	 * `remember` mints a remember-me token and writes it as an ENCRYPTED,
+	 * httpOnly cookie — the cookie IS the credential, so anyone who can read it
+	 * can present it. Without `remember`, any cookie the browser still holds is
+	 * cleared: signing in without ticking the box has to REVOKE the standing
+	 * permission, not leave it in place.
+	 */
+	async login(user: UserPayload, remember = false): Promise<void> {
+		const session = this.#requireSession();
+		const issued = remember ? await this.#issueRememberMe(user) : undefined;
+		if (!remember) this.#clearRememberMe();
+		try {
+			await this.#auth.login(user, session, this.#name, this.#state);
+		} catch (err) {
+			// The token is minted and the cookie sent before the session is
+			// seated — upstream's order, and it has to be, because the cookie
+			// belongs on the same response.
+			//
+			// NAMED DEVIATION — upstream does not roll any of this back; it has
+			// no need to, because its session write is a map assignment that
+			// cannot fail. Here `login()` also fires listeners, any of which
+			// can throw, so the window is real.
+			//
+			// And clearing the cookie is not enough: the token was PERSISTED,
+			// and its value reached the wire, where it may have been captured
+			// — a proxy log, an already-flushed response. Revoking the row is
+			// what makes a failed sign-in leave nothing usable behind.
+			if (issued !== undefined) await this.#revokeRememberMe(issued);
+			throw err;
+		}
+	}
+
+	/** Undo an issued remember-me: the stored row first, then the cookie. */
+	async #revokeRememberMe(value: string): Promise<void> {
+		const strategy = strategyOrUndefined(this.#auth, this.#name);
+		if (strategy && isRememberMeIssuer(strategy)) {
+			// Best-effort: a store that is itself down must not replace the
+			// caller's error with its own.
+			await strategy.revokeRememberMeToken(value).catch(() => undefined);
+		}
+		this.#clearRememberMe();
+	}
+
+	/**
+	 * Mint the token and put it in the browser, or say why it cannot.
+	 *
+	 * Returns the minted value so a failure further along can revoke it: a
+	 * persisted token nobody can reach is still a credential.
+	 */
+	async #issueRememberMe(user: UserPayload): Promise<string> {
+		const strategy = strategyOrUndefined(this.#auth, this.#name);
+		if (!strategy || !isRememberMeIssuer(strategy)) {
+			throw new WardenError(
+				"REMEMBER_ME_UNAVAILABLE",
+				`Guard '${this.#name}' cannot keep a user signed in: no remember-me tokens are configured.`,
+				{
+					hint: "Set `rememberMeTokens` on the session guard, or call login(user) without the remember flag.",
+				},
+			);
+		}
+		const value = await strategy.issueRememberMeToken(user);
+		if (value === null) {
+			throw new WardenError(
+				"REMEMBER_ME_UNAVAILABLE",
+				`Guard '${this.#name}' cannot keep a user signed in: no remember-me tokens are configured.`,
+				{
+					hint: "Set `rememberMeTokens` on the session guard, or call login(user) without the remember flag.",
+				},
+			);
+		}
+		const write = this.#ctx.response.encryptedCookie;
+		if (!write) {
+			throw new WardenError(
+				"REMEMBER_ME_UNAVAILABLE",
+				"This host cannot write an encrypted cookie, which is where the remember-me token lives.",
+				{
+					hint: "Use a host whose response exposes encryptedCookie(), or call login(user) without the remember flag.",
+				},
+			);
+		}
+		try {
+			write.call(this.#ctx.response, strategy.rememberMeCookieName, value, {
+				maxAge: strategy.rememberMeAgeSeconds,
+				httpOnly: true,
+			});
+		} catch (err) {
+			// The row exists and the browser will never hold it: a credential
+			// nobody can reach is still one, so it does not survive the failure.
+			await strategy.revokeRememberMeToken(value).catch(() => undefined);
+			throw err;
+		}
+		return value;
+	}
+
+	/** Drop whatever remember-me cookie the browser is still holding. */
+	#clearRememberMe(): void {
+		const strategy = strategyOrUndefined(this.#auth, this.#name);
+		if (!strategy || !isRememberMeIssuer(strategy)) return;
+		this.#ctx.response.clearCookie?.call(
+			this.#ctx.response,
+			strategy.rememberMeCookieName,
+		);
 	}
 
 	/** Log the current user out of this guard (session guards). */
 	logout(): Promise<void> {
-		return this.#auth.logout(this.#requireSession(), this.#name);
+		return this.#auth.logout(this.#requireSession(), this.#name, this.#state);
 	}
 
 	#requireSession(): SessionStore {
@@ -355,12 +609,29 @@ export class Authenticator {
 			{ guardName },
 		);
 		const creds = extractCredentials(this.#ctx, this.#auth);
-		const hasSessionStrategy = names.includes("session");
-		const { result, viaGuard, attemptCount, crashCount } =
-			await tryAuthenticate(this.#auth, names, {
-				...creds,
-				hasSessionStrategy,
-			});
+		// Same rule as the loop above: a session guard is one that verifies from
+		// the request context. Matching the literal name meant a guard called
+		// `web` never got the login redirect a browser needs.
+		const hasSessionStrategy = names.some((name) =>
+			isSessionGuard(this.#auth, name),
+		);
+		const attempt = await tryAuthenticate(this.#auth, names, creds);
+		const { attemptCount, crashCount } = attempt;
+		let result = attempt.result;
+		let viaGuard = attempt.viaGuard;
+
+		// No credential answered, but the browser may still hold a remember-me
+		// cookie — that is what "keep me signed in" means, and nothing read it.
+		if (!result?.authenticated && hasSessionStrategy) {
+			for (const name of names) {
+				const user = await this.use(name).tryRememberMeCookie();
+				if (user) {
+					result = { authenticated: true, user };
+					viaGuard = name;
+					break;
+				}
+			}
+		}
 
 		if (result?.authenticated && result.user) {
 			this.#user = result.user;

package/src/config.ts

@@ -61,7 +61,14 @@ export interface JwtConfig {
  * A guard entry in the AdonisJS-style config — an {@link AuthStrategy} instance,
  * built via {@link jwtGuard}/{@link sessionGuard}/{@link apiKeyGuard}. Named a
  * "factory" for AdonisJS symmetry (`sessionGuard({...})`), though Warden guards
- * are shared per-app instances (the per-request state lives on the Authenticator).
+ * are shared per-app instances rather than one built per request.
+ *
+ * Because the instance is shared, a guard must hold NO per-request state: the
+ * flags a request asks about — `viaRemember`, `attemptedViaRemember`,
+ * `isLoggedOut` — live on the per-request guard the Authenticator hands out
+ * (`auth.use(name)`), and a strategy method records into the state it is
+ * given. A flag stored on the strategy would answer the next request with the
+ * previous one's truth.
  */
 export type GuardFactory = AuthStrategy;
 

package/src/index.ts

@@ -44,7 +44,10 @@ export type {
 	BouncerEmitter,
 	PolicyContainerResolver,
 } from "./bouncer/types.js";
-export type { GuardFactory, WardenConfig } from "./config.js";
+export type {
+	GuardFactory,
+	WardenConfig,
+} from "./config.js";
 export {
 	apiKeyGuard,
 	basicAuthGuard,
@@ -58,15 +61,6 @@ export {
 	E_UNAUTHORIZED_ACCESS,
 	WardenError,
 } from "./errors.js";
-export { GitHubDriver } from "./firstcontact/drivers/GitHubDriver.js";
-export { GoogleDriver } from "./firstcontact/drivers/GoogleDriver.js";
-export { FirstContactManager } from "./firstcontact/FirstContactManager.js";
-export type {
-	FirstContactDriver,
-	OAuthConfig,
-	OAuthToken,
-	OAuthUser,
-} from "./firstcontact/types.js";
 export {
 	Guard,
 	getGuardMetadata,
@@ -178,9 +172,13 @@ export {
 export type { JwtClaims, JwtStrategyConfig } from "./strategies/JwtStrategy.js";
 export { generateJwtSecret, JwtStrategy } from "./strategies/JwtStrategy.js";
 export type {
+	SessionGuardState,
 	SessionStore,
 	SessionStrategyConfig,
 } from "./strategies/SessionStrategy.js";
-export { SessionStrategy } from "./strategies/SessionStrategy.js";
+export {
+	createSessionGuardState,
+	SessionStrategy,
+} from "./strategies/SessionStrategy.js";
 export type { BlacklistDriver } from "./TokenBlacklist.js";
 export { MemoryBlacklistDriver, TokenBlacklist } from "./TokenBlacklist.js";

package/src/middleware.ts

@@ -101,6 +101,8 @@ export interface WardenContext {
 	request: {
 		/** Ream's `HttpContext` exposes headers as a METHOD, not a property. */
 		headers(): Record<string, string>;
+		/** Read the encrypted remember-me cookie back. Optional, like its writer. */
+		encryptedCookie?: (name: string) => string | null;
 	};
 	/**
 	 * Per-request IoC resolver (Ream's `ctx.containerResolver`). Warden resolves
@@ -111,6 +113,21 @@ export interface WardenContext {
 	response: {
 		status: (code: number) => unknown;
 		json: (data: unknown) => void;
+		/**
+		 * Write an ENCRYPTED cookie, for the remember-me token. Optional: a
+		 * host without it simply cannot offer "keep me signed in", and
+		 * `login(user, true)` says so rather than pretending.
+		 *
+		 * Encrypted and not merely signed, because the value IS the credential
+		 * — anyone who reads it can present it.
+		 */
+		encryptedCookie?: (
+			name: string,
+			value: string,
+			options?: Record<string, unknown>,
+		) => unknown;
+		/** Drop a cookie (used to clear the remember-me one). */
+		clearCookie?: (name: string, options?: Record<string, unknown>) => unknown;
 		/**
 		 * Redirect the response (Ream's `ctx.response.redirect`). Optional so a
 		 * minimal host without it still gets the 401 JSON fallback — Warden does

package/src/strategies/SessionStrategy.ts

@@ -65,13 +65,41 @@ export interface SessionStrategyConfig {
 /** Two years, Adonis' `rememberMeTokensAge` default. */
 const DEFAULT_REMEMBER_AGE_SECONDS = 63_072_000;
 
+/**
+ * The flags a session guard reports about THE CURRENT REQUEST — whether the
+ * user was revived from a remember-me cookie, whether one was even tried, and
+ * whether `logout()` has run.
+ *
+ * They live here, in a per-request object, and NOT on the strategy: a strategy
+ * is built once from config and shared by every request the app serves, so a
+ * flag stored on it would answer the next request with the previous one's
+ * truth — a session restored from a cookie would keep looking like one long
+ * after, and a logout would make every later request read as logged out.
+ * Upstream avoids this by building a fresh guard per request; the strategy is
+ * shared here, so the state is what moves.
+ */
+export interface SessionGuardState {
+	/** The user was revived from a remember-me cookie rather than signing in. */
+	viaRemember: boolean;
+	/** A remember-me cookie was tried at all — whether or not it worked. */
+	attemptedViaRemember: boolean;
+	/** `logout()` has run during this request. */
+	isLoggedOut: boolean;
+}
+
+/** A fresh set of per-request flags, all false. */
+export function createSessionGuardState(): SessionGuardState {
+	return {
+		viaRemember: false,
+		attemptedViaRemember: false,
+		isLoggedOut: false,
+	};
+}
+
 export class SessionStrategy implements AuthStrategy {
 	name = "session";
 	#config: SessionStrategyConfig;
 	#sessionKey: string;
-	#viaRemember = false;
-	#loggedOut = false;
-	#attemptedViaRemember = false;
 
 	constructor(config: SessionStrategyConfig) {
 		this.#config = config;
@@ -88,37 +116,6 @@ export class SessionStrategy implements AuthStrategy {
 		return this.#config.rememberMeTokens !== undefined;
 	}
 
-	/**
-	 * Whether the current user was revived from a remember-me cookie rather
-	 * than signing in (AdonisJS `viaRemember`).
-	 *
-	 * This is the distinction that lets an app demand the password again before
-	 * something sensitive — changing an email, spending money, deleting an
-	 * account. Nothing reported it, so a session restored from a cookie looked
-	 * exactly like one where the user had just typed their password.
-	 */
-	get viaRemember(): boolean {
-		return this.#viaRemember;
-	}
-
-	/**
-	 * Whether a remember-me token was even tried on this request (AdonisJS
-	 * `attemptedViaRemember`) — true whether or not it worked.
-	 */
-	get attemptedViaRemember(): boolean {
-		return this.#attemptedViaRemember;
-	}
-
-	/**
-	 * Whether `logout()` ran on this guard (AdonisJS `isLoggedOut`).
-	 *
-	 * A handler that logs out and then keeps working — clearing a cart, writing
-	 * an audit line — could not tell that the session was already gone.
-	 */
-	get isLoggedOut(): boolean {
-		return this.#loggedOut;
-	}
-
 	/** The session key the user id is stored under (AdonisJS `sessionKeyName`). */
 	get sessionKeyName(): string {
 		return this.#sessionKey;
@@ -130,6 +127,11 @@ export class SessionStrategy implements AuthStrategy {
 	}
 
 	#rememberMeAge(): number {
+		return this.rememberMeAgeSeconds;
+	}
+
+	/** How long a remember-me token lives, in SECONDS (the cookie's max-age). */
+	get rememberMeAgeSeconds(): number {
 		return this.#config.rememberMeAge ?? DEFAULT_REMEMBER_AGE_SECONDS;
 	}
 
@@ -155,10 +157,11 @@ export class SessionStrategy implements AuthStrategy {
 	 */
 	async authenticateViaRememberMeToken(
 		cookieValue: unknown,
+		state?: SessionGuardState,
 	): Promise<{ user: UserPayload; cookieValue: string } | null> {
 		const driver = this.#config.rememberMeTokens;
 		if (!driver) return null;
-		this.#attemptedViaRemember = true;
+		if (state) state.attemptedViaRemember = true;
 
 		const recycled = await verifyAndRecycleRememberMeToken(
 			driver,
@@ -170,7 +173,7 @@ export class SessionStrategy implements AuthStrategy {
 		const user = await this.#config.findUser(recycled.userId);
 		if (!user) return null;
 
-		this.#viaRemember = true;
+		if (state) state.viaRemember = true;
 		return { user, cookieValue: recycled.value };
 	}
 
@@ -240,14 +243,33 @@ export class SessionStrategy implements AuthStrategy {
 	 * migration is handled by Ream's `SessionMiddleware` on the response
 	 * path — see `wasRegenerated()` there.
 	 */
-	async login(user: UserPayload, session: SessionStore): Promise<void> {
+	/**
+	 * Seat a user in the session, without deciding HOW they got there.
+	 *
+	 * Split out from {@link login} because the remember-me path needs the seat
+	 * but not the flags: `login()` means a password was typed, and resetting
+	 * `viaRemember` there would erase the very fact a cookie-revived session
+	 * exists to report.
+	 */
+	seatSession(user: UserPayload, session: SessionStore): void {
 		session.regenerate();
 		session.put(this.#sessionKey, user.id);
-		this.#loggedOut = false;
-		// A password was typed: this session is no longer "via remember", even
-		// if a cookie was tried earlier in the same request. Without the reset
-		// the flag would stay true and a re-auth prompt would never fire.
-		this.#viaRemember = false;
+	}
+
+	async login(
+		user: UserPayload,
+		session: SessionStore,
+		state?: SessionGuardState,
+	): Promise<void> {
+		this.seatSession(user, session);
+		if (state) {
+			state.isLoggedOut = false;
+			// A password was typed: this session is no longer "via remember",
+			// even if a cookie was tried earlier in the same request. Without
+			// the reset the flag would stay true and a re-auth prompt would
+			// never fire.
+			state.viaRemember = false;
+		}
 	}
 
 	/**
@@ -267,10 +289,15 @@ export class SessionStrategy implements AuthStrategy {
 	 * The remember-me token is revoked separately through
 	 * {@link revokeRememberMeToken}, because only the caller holds the cookie.
 	 */
-	async logout(session: SessionStore): Promise<void> {
+	async logout(
+		session: SessionStore,
+		state?: SessionGuardState,
+	): Promise<void> {
 		session.forget(this.#sessionKey);
-		this.#viaRemember = false;
-		this.#attemptedViaRemember = false;
-		this.#loggedOut = true;
+		if (state) {
+			state.viaRemember = false;
+			state.attemptedViaRemember = false;
+			state.isLoggedOut = true;
+		}
 	}
 }

package/dist/firstcontact/FirstContactManager.d.ts

@@ -1,25 +0,0 @@
-/**
- * FirstContactManager — OAuth2 social authentication.
- *
- * Usage:
- *   firstContact.use('google').redirectUrl()
- *   firstContact.use('google').callback(code)
- */
-import type { FirstContactDriver, OAuthToken, OAuthUser } from "./types.js";
-export declare class FirstContactManager {
-    #private;
-    use(name: string): FirstContactDriver;
-    register(name: string, driver: FirstContactDriver): void;
-    redirect(name: string, state?: string): string;
-    /**
-     * Handle the OAuth callback. Pass `state` (from the query string) and
-     * `expectedState` (from the session, stored at redirect time) for CSRF
-     * protection. Omitting `expectedState` logs a security warning.
-     */
-    callback(name: string, code: string, state?: string, expectedState?: string): Promise<{
-        user: OAuthUser;
-        token: OAuthToken;
-    }>;
-    get registeredDrivers(): string[];
-}
-//# sourceMappingURL=FirstContactManager.d.ts.map

package/dist/firstcontact/FirstContactManager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"FirstContactManager.d.ts","sourceRoot":"","sources":["../../src/firstcontact/FirstContactManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5E,qBAAa,mBAAmB;;IAG/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB;IASrC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI;IAIxD,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAI9C;;;;OAIG;IACG,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAUlD,IAAI,iBAAiB,IAAI,MAAM,EAAE,CAEhC;CACD"}