@cauthyhq/node 1.0.0 → 1.2.0

package/dist/testing.js

@@ -21,9 +21,297 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var testing_exports = {};
 __export(testing_exports, {
   Browser: () => Browser,
-  FakeCauthy: () => FakeCauthy
+  FakeCauthy: () => FakeCauthy,
+  serveFakeCauthy: () => serveFakeCauthy
 });
 module.exports = __toCommonJS(testing_exports);
+var import_node_http = require("http");
+
+// src/sha256.ts
+var K = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+function sha256(data) {
+  const h = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+  const len = data.length;
+  const padded = new Uint8Array(len + 9 + 63 >> 6 << 6);
+  padded.set(data);
+  padded[len] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padded.length - 8, Math.floor(len / 536870912));
+  view.setUint32(padded.length - 4, len << 3 >>> 0);
+  const w = new Uint32Array(64);
+  const rotr = (x, n) => x >>> n | x << 32 - n;
+  for (let off = 0; off < padded.length; off += 64) {
+    for (let i = 0; i < 16; i++) w[i] = view.getUint32(off + i * 4);
+    for (let i = 16; i < 64; i++) {
+      const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ w[i - 15] >>> 3;
+      const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ w[i - 2] >>> 10;
+      w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
+    }
+    let [a, b, c, d, e, f, g, hh] = h;
+    for (let i = 0; i < 64; i++) {
+      const t1 = hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[i] + w[i] >>> 0;
+      const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+      hh = g;
+      g = f;
+      f = e;
+      e = d + t1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = t1 + t2 >>> 0;
+    }
+    h[0] += a;
+    h[1] += b;
+    h[2] += c;
+    h[3] += d;
+    h[4] += e;
+    h[5] += f;
+    h[6] += g;
+    h[7] += hh;
+  }
+  const out = new Uint8Array(32);
+  const ov = new DataView(out.buffer);
+  for (let i = 0; i < 8; i++) ov.setUint32(i * 4, h[i]);
+  return out;
+}
+
+// src/types.ts
+var CauthyConfigError = class extends Error {
+  constructor(message) {
+    super(`@cauthyhq/node: ${message}`);
+    this.name = "CauthyConfigError";
+  }
+};
+var CauthyKeyError = class extends CauthyConfigError {
+  constructor(reason, message) {
+    super(`CAUTHY_KEY: ${message} (${reason})`);
+    this.reason = reason;
+    this.name = "CauthyKeyError";
+  }
+  reason;
+};
+
+// src/cauthykey.ts
+var KEY_PREFIX = "cauthy1";
+var MAX_LEN = 512;
+var enc = new TextEncoder();
+var dec = new TextDecoder("utf-8", { fatal: true });
+function b64uEncode(b) {
+  let bin = "";
+  for (const x of b) bin += String.fromCharCode(x);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function b64uDecode(s) {
+  if (!/^[A-Za-z0-9_-]*$/.test(s) || s.length % 4 === 1) return null;
+  const bin = atob(s.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - s.length % 4) % 4));
+  const out = Uint8Array.from(bin, (c) => c.charCodeAt(0));
+  return b64uEncode(out) === s ? out : null;
+}
+function checksum(body) {
+  return b64uEncode(sha256(enc.encode(body)).slice(0, 6));
+}
+function printableAscii(s) {
+  return /^[\x21-\x7e]*$/.test(s);
+}
+function validIssuer(s) {
+  if (s === "" || !printableAscii(s)) return false;
+  let u;
+  try {
+    u = new URL(s);
+  } catch {
+    return false;
+  }
+  if (u.origin !== s) return false;
+  if (/^\[::ffff:/i.test(u.host)) return false;
+  if (u.protocol === "https:") return true;
+  return u.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname);
+}
+var fail = (reason, message) => {
+  throw new CauthyKeyError(reason, message);
+};
+var NOT_A_KEY = "not a Cauthy key (copy it again from the dashboard)";
+function parseKey(text) {
+  const s = text.replace(/^[ \t\r\n]+|[ \t\r\n]+$/g, "");
+  if (s === "" || s.length > MAX_LEN || !printableAscii(s)) fail("key_format", NOT_A_KEY);
+  const head = s.split(".", 1)[0];
+  if (head !== KEY_PREFIX) {
+    if (/^cauthy[0-9]+$/.test(head)) fail("key_version", `this key is for a newer SDK (${head}): update @cauthyhq/node`);
+    fail("key_format", NOT_A_KEY);
+  }
+  const parts = s.split(".");
+  if (parts.length !== 5 || parts.some((p) => p === "")) fail("key_format", NOT_A_KEY);
+  if (!constantTimeEqual(checksum(parts.slice(0, 4).join(".")), parts[4])) {
+    fail("key_checksum", "the key is damaged (part of it is missing or changed): copy it again from the dashboard");
+  }
+  const issuerBytes = b64uDecode(parts[1]);
+  let issuer = "";
+  try {
+    issuer = issuerBytes ? dec.decode(issuerBytes) : "";
+  } catch {
+    issuer = "";
+  }
+  if (!validIssuer(issuer)) fail("key_issuer", "the key names no valid Cauthy address");
+  const clientBytes = b64uDecode(parts[2]);
+  const clientId = clientBytes ? String.fromCharCode(...clientBytes) : "";
+  if (!/^[A-Za-z0-9._-]{1,128}$/.test(clientId)) fail("key_client", "the key names no valid client");
+  const secret = b64uDecode(parts[3]);
+  if (parts[3].length !== 43 || !secret || secret.length !== 32) fail("key_secret", "the key's secret is not 32 bytes");
+  return { issuer, clientId, secret: parts[3] };
+}
+function composeKey(issuer, clientId, secret) {
+  const body = `${KEY_PREFIX}.${b64uEncode(enc.encode(issuer))}.${b64uEncode(enc.encode(clientId))}.${secret}`;
+  const key = `${body}.${checksum(body)}`;
+  parseKey(key);
+  return key;
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let d = 0;
+  for (let i = 0; i < a.length; i++) d |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return d === 0;
+}
+
+// src/rootkey.ts
+var encoder = new TextEncoder();
+var MIN_ROOT_KEY = 32;
+async function derive(root, purpose) {
+  const ikm = await crypto.subtle.importKey("raw", encoder.encode(root), "HKDF", false, ["deriveBits"]);
+  const bits = await crypto.subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: encoder.encode(`pact/${purpose}/v1`) },
+    ikm,
+    256
+  );
+  return new Uint8Array(bits);
+}
+function deriveKeys(root, previous) {
+  if (root.length < MIN_ROOT_KEY) {
+    throw new CauthyConfigError(`rootKey (PACT_ROOT_KEY) must be at least ${MIN_ROOT_KEY} characters: 32 random bytes, e.g. openssl rand -base64 32`);
+  }
+  if (previous !== void 0 && previous !== "" && previous.length < MIN_ROOT_KEY) {
+    throw new CauthyConfigError(`the previous root key (PACT_ROOT_KEY_PREVIOUS) must be at least ${MIN_ROOT_KEY} characters`);
+  }
+  const roots = previous && previous !== root ? [root, previous] : [root];
+  const ring = (purpose) => Promise.all(roots.map((r) => derive(r, purpose)));
+  return { seal: ring("seal"), cookie: ring("cookie"), flow: ring("flow") };
+}
+
+// src/keyderive.ts
+var enc2 = new TextEncoder();
+var PKCS8_ED25519 = Uint8Array.from([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32]);
+var ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+async function seedOf(secret) {
+  const ikm = await crypto.subtle.importKey("raw", enc2.encode(secret), "HKDF", false, ["deriveBits"]);
+  return new Uint8Array(await crypto.subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: enc2.encode("cauthy/sign/v1") },
+    ikm,
+    256
+  ));
+}
+async function thumbprint(x) {
+  return b64uEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", enc2.encode(`{"crv":"Ed25519","kty":"OKP","x":"${x}"}`))));
+}
+async function signerOf(secret) {
+  const seed = await seedOf(secret);
+  const der = new Uint8Array(PKCS8_ED25519.length + 32);
+  der.set(PKCS8_ED25519);
+  der.set(seed, PKCS8_ED25519.length);
+  const readable = await crypto.subtle.importKey("pkcs8", der, { name: "Ed25519" }, true, ["sign"]);
+  const { x } = await crypto.subtle.exportKey("jwk", readable);
+  const signing = await crypto.subtle.importKey("pkcs8", der, { name: "Ed25519" }, false, ["sign"]);
+  der.fill(0);
+  seed.fill(0);
+  const publicJwk = { kty: "OKP", crv: "Ed25519", x };
+  const kid = await thumbprint(publicJwk.x);
+  const header = b64uEncode(enc2.encode(JSON.stringify({ alg: "EdDSA", kid })));
+  return {
+    kid,
+    publicJwk,
+    async assertion(clientId, tokenEndpoint, jti = crypto.randomUUID(), iat = Math.floor(Date.now() / 1e3)) {
+      const claims = { iss: clientId, sub: clientId, aud: tokenEndpoint, jti, iat, exp: iat + 120 };
+      const input = `${header}.${b64uEncode(enc2.encode(JSON.stringify(claims)))}`;
+      const sig = new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, signing, enc2.encode(input)));
+      return `${input}.${b64uEncode(sig)}`;
+    }
+  };
+}
+function deriveFromKey(key, previous) {
+  const other = previous && previous.secret !== key.secret ? previous : void 0;
+  const rings = deriveKeys(key.secret, other?.secret);
+  return {
+    cookie: rings.cookie,
+    flow: rings.flow,
+    signer: signerOf(key.secret),
+    ...other ? { previousJwk: signerOf(other.secret).then((s) => ({ ...s.publicJwk, kid: s.kid })) } : {}
+  };
+}
+
+// src/testing.ts
+var ADMIN_SETTINGS = ["allow_signup", "allow_password", "allow_magic_link", "allow_passkeys", "confirm_email", "verify_grace_days"];
 var FakeCauthy = class {
   issuer = "https://id.test";
   users = /* @__PURE__ */ new Map();
@@ -49,7 +337,26 @@ var FakeCauthy = class {
   passwords = /* @__PURE__ */ new Map();
   /** What GET /v1/auth/settings answers. */
   settings = { allow_password: true, allow_signup: false, allow_passkeys: false, persistent_sessions: false };
+  /** The bearer the admin API takes (settings, the application's client, accounts); '' refuses every admin call. */
+  adminToken = "";
+  /** The application's client, as the admin API lists it; its allow_persistent_sessions is settings.persistent_sessions. */
+  clientId = "acme-crm";
+  /** The application's registered origins, as GET /v1/connect/self answers them (app_urls). */
+  appUrls = ["http://localhost:3000"];
+  /** The application's system, as GET /v1/connect/self answers it. */
+  system = "acme-crm";
+  /** The workspace's id, as GET /v1/connect/self answers it. */
+  tenantId = "t-acme";
+  /** What GET /v1/connect/self answers as `contract`. */
+  contract = null;
+  /** Every call to the token and revoke endpoints, with its form and headers: what a test reads of how the application authenticated. */
+  oauthRequests = [];
   n = 0;
+  keys = /* @__PURE__ */ new Map();
+  jtis = /* @__PURE__ */ new Set();
+  systemTokens = /* @__PURE__ */ new Map();
+  // access token → kid
+  keyClients = /* @__PURE__ */ new Set();
   constructor() {
     this.users.set("u1", { sub: "u1", email: "ana@acme.com", name: "Ana", active: true, restricted: false });
   }
@@ -61,12 +368,83 @@ var FakeCauthy = class {
     this.codes.set(code, { sub, challenge: q.get("code_challenge") ?? "", redirectUri: q.get("redirect_uri") ?? "" });
     return `${q.get("redirect_uri")}?code=${code}&state=${q.get("state")}`;
   }
-  issue(sub) {
+  /**
+   * Makes a CAUTHY_KEY for the application's client and registers its public
+   * half, as Cauthy's dashboard does in the browser. `issuer` is the address
+   * the application will reach this Cauthy at (the served one, over HTTP).
+   * From then on that client authenticates with assertions only.
+   */
+  async issueKey(issuer = this.issuer, options = {}) {
+    const clientId = options.clientId ?? this.clientId;
+    const key = composeKey(issuer.replace(/\/+$/, ""), clientId, b64uEncode(crypto.getRandomValues(new Uint8Array(32))));
+    const signer = await deriveFromKey(parseKey(key)).signer;
+    this.keys.set(signer.kid, { x: signer.publicJwk.x, clientId, issuer: parseKey(key).issuer, revoked: false });
+    this.keyClients.add(clientId);
+    return key;
+  }
+  /** Revokes a registered key, as the dashboard's Revoke does: refused from now on. */
+  revokeKey(kid) {
+    const k = this.keys.get(kid);
+    if (k) k.revoked = true;
+  }
+  /** The kids registered, revoked or not. */
+  registeredKids() {
+    return [...this.keys.keys()];
+  }
+  /** Checks an RFC 7523 assertion of a registered Ed25519 key: the kid it signed with, or null. */
+  async assertionOf(form) {
+    if (form.get("client_assertion_type") !== ASSERTION_TYPE) return null;
+    const jws = form.get("client_assertion") ?? "";
+    const [h, p, sig, extra] = jws.split(".");
+    if (!h || !p || !sig || extra !== void 0) return null;
+    const dec2 = new TextDecoder();
+    let header;
+    let claims;
+    try {
+      header = JSON.parse(dec2.decode(b64uDecode(h) ?? new Uint8Array()));
+      claims = JSON.parse(dec2.decode(b64uDecode(p) ?? new Uint8Array()));
+    } catch {
+      return null;
+    }
+    const kid = typeof header.kid === "string" ? header.kid : "";
+    const k = this.keys.get(kid);
+    const clientId = form.get("client_id") ?? "";
+    if (header.alg !== "EdDSA" || !k || k.revoked || k.clientId !== clientId) return null;
+    if (claims.iss !== clientId || claims.sub !== clientId || claims.aud !== `${k.issuer}/v1/oauth/token`) return null;
+    const now = Math.floor(Date.now() / 1e3);
+    if (typeof claims.exp !== "number" || claims.exp <= now || claims.exp - now > 330) return null;
+    if (typeof claims.jti !== "string" || claims.jti === "" || this.jtis.has(claims.jti)) return null;
+    const signature = b64uDecode(sig);
+    if (!signature) return null;
+    const pub = await crypto.subtle.importKey("jwk", { kty: "OKP", crv: "Ed25519", x: k.x }, { name: "Ed25519" }, false, ["verify"]);
+    if (!await crypto.subtle.verify({ name: "Ed25519" }, pub, new Uint8Array(signature), new TextEncoder().encode(`${h}.${p}`))) return null;
+    this.jtis.add(claims.jti);
+    return kid;
+  }
+  /** What GET /v1/connect/self answers for a key. */
+  identityOf(kid) {
+    const k = this.keys.get(kid);
+    return {
+      issuer: k.issuer,
+      audience: k.issuer,
+      tenant: { id: this.tenantId, slug: this.tenant },
+      system: this.system,
+      client_id: k.clientId,
+      sign_in_client_id: k.clientId,
+      app_urls: [...this.appUrls],
+      callback_path: "/api/auth/callback",
+      key: { kid, retires_at: null },
+      contract: this.contract
+    };
+  }
+  /** A token answer. `kind` is what a sign-in asked for (remember) when the client allows long sessions; `persistent` wins when set. */
+  issue(sub, kind) {
     const at = `at-${++this.n}`;
     const rt = `rt-${++this.n}`;
     this.access.set(at, sub);
     this.refresh.set(rt, sub);
-    return { access_token: at, refresh_token: rt, token_type: "Bearer", expires_in: this.expiresIn, scope: "", ...this.persistent === void 0 ? {} : { persistent: this.persistent } };
+    const persistent = this.persistent ?? kind;
+    return { access_token: at, refresh_token: rt, token_type: "Bearer", expires_in: this.expiresIn, scope: "", ...persistent === void 0 ? {} : { persistent } };
   }
   fetch = async (input, init) => {
     const url = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
@@ -75,8 +453,36 @@ var FakeCauthy = class {
     const reply = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
     const form = new URLSearchParams(init?.body instanceof URLSearchParams ? init.body : String(init?.body ?? ""));
     const bearer = new Headers(init?.headers).get("authorization")?.replace("Bearer ", "") ?? "";
+    const admin = adminAnswer(this, url, init);
+    if (admin) return admin;
     if (this.ownScreens && url.pathname.startsWith("/v1/auth/")) return this.ownScreen(url, init);
+    const oauth = url.pathname === "/v1/oauth/token" || url.pathname === "/v1/oauth/revoke";
+    if (oauth) {
+      this.oauthRequests.push({ path: url.pathname, form: Object.fromEntries(form), headers: Object.fromEntries(new Headers(init?.headers)) });
+    }
+    const asserted = oauth && form.has("client_assertion") ? await this.assertionOf(form) : null;
+    const keyClient = this.keyClients.has(form.get("client_id") ?? "");
+    if (oauth && (keyClient || form.has("client_assertion")) && asserted === null) {
+      return reply(401, { error: "invalid_client", error_description: "client authentication failed" });
+    }
+    if (url.pathname === "/v1/connect/self") {
+      const kid = this.systemTokens.get(bearer);
+      if (kid === void 0) {
+        return reply(this.access.has(bearer) ? 403 : 401, { errors: [{ code: this.access.has(bearer) ? "not_a_system_token" : "invalid_token", message: "a system token is required" }] });
+      }
+      if (this.keys.get(kid)?.revoked) return reply(401, { errors: [{ code: "invalid_token", message: "the key was revoked" }] });
+      const body = JSON.stringify({ data: this.identityOf(kid) });
+      const etag = `"${b64uEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(body)))).slice(0, 16)}"`;
+      const headers = { etag, "cache-control": "private, max-age=300" };
+      if (new Headers(init?.headers).get("if-none-match") === etag) return new Response(null, { status: 304, headers });
+      return new Response(body, { status: 200, headers: { "content-type": "application/json", ...headers } });
+    }
     if (url.pathname === "/v1/oauth/token") {
+      if (form.get("grant_type") === "client_credentials" && asserted !== null) {
+        const token = `sys-${++this.n}`;
+        this.systemTokens.set(token, asserted);
+        return reply(200, { access_token: token, token_type: "Bearer", expires_in: this.expiresIn });
+      }
       if (form.get("grant_type") === "authorization_code") {
         const c = this.codes.get(form.get("code") ?? "");
         this.codes.delete(form.get("code") ?? "");
@@ -129,13 +535,27 @@ var FakeCauthy = class {
     if (new Headers(init?.headers).get("x-tenant-key") !== this.tenant) return refuse(404, "tenant_not_found", "no such workspace");
     const method = init?.method ?? "GET";
     if (method === "POST" && url.pathname === "/v1/auth/login") {
+      if (this.settings.allow_password === false) return refuse(403, "password_disabled", "this workspace does not take passwords: sign in another way");
       const body = JSON.parse(String(init?.body ?? "{}"));
       const user = [...this.users.values()].find((u) => u.email === body.email);
       const password = body.email === void 0 ? void 0 : this.passwords.get(body.email);
       if (!user || !user.active || password === void 0 || password !== body.password) {
         return refuse(401, "invalid_credentials", "invalid email or password");
       }
-      return reply(200, { data: this.issue(user.sub) });
+      const kind = this.settings.persistent_sessions === true ? new Headers(init?.headers).get("x-cauthy-remember") === "1" : void 0;
+      return reply(200, { data: this.issue(user.sub, kind) });
+    }
+    if (method === "POST" && url.pathname === "/v1/auth/register") {
+      if (this.settings.allow_signup === false) return refuse(403, "signups_disabled", "this workspace is not accepting new accounts");
+      if (this.settings.allow_password === false) return refuse(403, "password_disabled", "this workspace does not take passwords: sign in another way");
+      const body = JSON.parse(String(init?.body ?? "{}"));
+      if (!body.email || !body.password) return refuse(400, "validation_error", "email and password are required");
+      if ([...this.users.values()].some((u) => u.email === body.email)) return refuse(409, "email_taken", "an account with this email exists");
+      const confirm = this.settings.confirm_email === true;
+      const sub = `u-${++this.n}`;
+      this.users.set(sub, { sub, email: body.email, name: body.display_name ?? "", active: !confirm, restricted: false, verified: !confirm });
+      this.passwords.set(body.email, body.password);
+      return reply(201, { data: { user_id: sub, email: body.email, ...confirm ? { verification_required: true } : {} } });
     }
     if (method === "GET" && url.pathname === "/v1/auth/settings") return reply(200, { data: this.settings });
     if (method === "GET" && (url.pathname === "/v1/auth/social/providers" || url.pathname === "/v1/auth/sso/connections")) return reply(200, { data: [] });
@@ -143,6 +563,68 @@ var FakeCauthy = class {
     return refuse(404, "not_found", "not found");
   }
 };
+function adminAnswer(fake, url, init) {
+  const method = (init?.method ?? "GET").toUpperCase();
+  const route = `${method} ${url.pathname}`;
+  const client = method === "PATCH" ? url.pathname.match(/^\/v1\/oauth\/clients\/([^/]+)$/) : null;
+  const user = method === "DELETE" ? url.pathname.match(/^\/v1\/users\/([^/]+)$/) : null;
+  const known = ["GET /v1/settings/auth", "PUT /v1/settings/auth", "GET /v1/oauth/clients", "GET /v1/users"].includes(route);
+  if (!known && !client && !user) return null;
+  const reply = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+  const refuse = (status, code, message) => reply(status, { errors: [{ code, message }] });
+  const headers = new Headers(init?.headers);
+  if (fake.adminToken === "" || headers.get("authorization") !== `Bearer ${fake.adminToken}`) return refuse(401, "unauthorized", "invalid or expired token");
+  if (headers.get("x-tenant-key") !== fake.tenant) return refuse(404, "tenant_not_found", "no such workspace");
+  if (route === "GET /v1/settings/auth") return reply(200, { data: fake.settings });
+  if (route === "PUT /v1/settings/auth") {
+    const change = JSON.parse(String(init?.body ?? "{}"));
+    const next = { ...fake.settings };
+    for (const key of ADMIN_SETTINGS) if (change[key] !== void 0 && change[key] !== null) next[key] = change[key];
+    if (next.allow_password === false && next.allow_magic_link !== true && next.allow_passkeys !== true) {
+      return refuse(409, "last_method", "the change would leave no way to sign in");
+    }
+    fake.settings = next;
+    return reply(200, { data: fake.settings });
+  }
+  const persistent = () => fake.settings.persistent_sessions === true;
+  if (route === "GET /v1/oauth/clients") return reply(200, { data: [{ client_id: fake.clientId, allow_persistent_sessions: persistent() }], total_count: 1 });
+  if (client) {
+    if (decodeURIComponent(client[1]) !== fake.clientId) return refuse(404, "client_not_found", "no such client");
+    const change = JSON.parse(String(init?.body ?? "{}"));
+    if (typeof change.allow_persistent_sessions === "boolean") fake.settings = { ...fake.settings, persistent_sessions: change.allow_persistent_sessions };
+    return reply(200, { data: { client_id: fake.clientId, allow_persistent_sessions: persistent() } });
+  }
+  if (route === "GET /v1/users") {
+    const q = (url.searchParams.get("q") ?? "").toLowerCase();
+    const data = [...fake.users.values()].filter((u) => u.email.toLowerCase().includes(q)).map((u) => ({ id: u.sub, email: u.email, name: u.name }));
+    return reply(200, { data, total_count: data.length });
+  }
+  const id = decodeURIComponent(user[1]);
+  const gone = fake.users.get(id);
+  if (!gone) return refuse(404, "user_not_found", "no such user");
+  fake.users.delete(id);
+  fake.passwords.delete(gone.email);
+  return new Response(null, { status: 204 });
+}
+function serveFakeCauthy(fake, port) {
+  const server = (0, import_node_http.createServer)(async (req, res) => {
+    const chunks = [];
+    for await (const chunk of req) chunks.push(chunk);
+    const headers = new Headers();
+    for (const [k, v] of Object.entries(req.headers)) if (typeof v === "string") headers.set(k, v);
+    const answer = await fake.fetch(`${fake.issuer}${req.url ?? "/"}`, {
+      method: req.method,
+      headers,
+      ...chunks.length > 0 ? { body: Buffer.concat(chunks).toString("utf8") } : {}
+    });
+    res.writeHead(answer.status, Object.fromEntries(answer.headers));
+    res.end(Buffer.from(await answer.arrayBuffer()));
+  });
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, "127.0.0.1", () => resolve(server));
+  });
+}
 var Browser = class {
   /** `requestHeader: false`: a browser whose client sends no X-Cauthy-Request, as cauthy-auth 0.42's does not. */
   constructor(origin = "https://app.test", options = {}) {
@@ -177,6 +659,7 @@ var Browser = class {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Browser,
-  FakeCauthy
+  FakeCauthy,
+  serveFakeCauthy
 });
 //# sourceMappingURL=testing.js.map