@cedarjs/auth-dbauth-api 7.0.0-canary.3073 → 7.0.0-canary.3075

package/dist/DbAuthHandler.d.ts

@@ -1,6 +1,7 @@
 import type { AuthenticationResponseJSON, RegistrationResponseJSON } from '@simplewebauthn/server';
 import type { APIGatewayProxyEvent, Context as LambdaContext } from 'aws-lambda';
 import type { CorsConfig, CorsContext, PartialRequest } from '@cedarjs/api';
+import type { DbAuthCookieConfig } from './session.js';
 interface SignupFlowOptions<TUserAttributes = Record<string, unknown>> {
     /**
      * Allow users to sign up. Defaults to true.
@@ -170,33 +171,7 @@ export interface DbAuthHandlerOptions<TUser = UserType, TUserAttributes = Record
     /**
      * Object containing cookie config options
      */
-    cookie?: {
-        /** @deprecated set this option in `cookie.attributes` */
-        Path?: string;
-        /** @deprecated set this option in `cookie.attributes` */
-        HttpOnly?: boolean;
-        /** @deprecated set this option in `cookie.attributes` */
-        Secure?: boolean;
-        /** @deprecated set this option in `cookie.attributes` */
-        SameSite?: string;
-        /** @deprecated set this option in `cookie.attributes` */
-        Domain?: string;
-        attributes?: {
-            Path?: string;
-            HttpOnly?: boolean;
-            Secure?: boolean;
-            SameSite?: string;
-            Domain?: string;
-        };
-        /**
-         * The name of the cookie that dbAuth sets
-         *
-         * %port% will be replaced with the port the api server is running on.
-         * If you have multiple RW apps running on the same host, you'll need to
-         * make sure they all use unique cookie names
-         */
-        name?: string;
-    };
+    cookie?: DbAuthCookieConfig;
     /**
      * Object containing forgot password options
      */
@@ -231,6 +206,17 @@ export interface DbAuthHandlerOptions<TUser = UserType, TUserAttributes = Record
      * CORS settings, same as in createGraphqlHandler
      */
     cors?: CorsConfig;
+    /**
+     * Extra origins that are trusted for state-changing (non-GET) requests,
+     * on top of the request's own host and any origins already listed in
+     * `cors.origin`.
+     *
+     * Needed when the web side and API are on different origins and
+     * `cors.origin` isn't set to those origins, or when `cors.origin` is set
+     * to `true` -- reflecting any request origin is never treated as trust,
+     * so that combination requires listing trusted origins here explicitly.
+     */
+    trustedOrigins?: string | string[];
 }
 export interface SignupHandlerOptions<TUserAttributes> {
     username: string;
@@ -312,6 +298,8 @@ export declare class DbAuthHandler<TUser extends UserType, TUserAttributes = Rec
         body?: string | undefined;
         statusCode: number;
     }>;
+    _requestHost(): string | null;
+    _requestProtocol(): string | null;
     forgotPassword(): Promise<AuthMethodOutput>;
     getToken(): Promise<AuthMethodOutput>;
     login(): Promise<AuthMethodOutput>;
@@ -326,15 +314,14 @@ export declare class DbAuthHandler<TUser extends UserType, TUserAttributes = Rec
     _validateOptions(): void;
     _saveChallenge(userId: string | number, value: string | null): Promise<void>;
     _webAuthnCookie(id: string, expires: string): string;
-    _sanitizeUser(user: Record<string, unknown>): any;
+    _sanitizeUser(user: Record<string, unknown>): Record<string, unknown>;
     _decodeEvent(): void;
     _cookieAttributes({ expires, options, }: {
         expires?: 'now' | string;
         options?: DbAuthHandlerOptions['cookie'];
-    }): (string | null)[];
+    }): string[];
     _createAuthProviderCookieString(): string;
     _createSessionCookieString<TIdType = any>(data: DbAuthSession<TIdType>, csrfToken: string): string;
-    _validateCsrf(): Promise<boolean>;
     _findUserByToken(token: string): Promise<any>;
     _clearResetToken(user: Record<string, unknown>): Promise<void>;
     _verifyUser(username: string | undefined, password: string | undefined): Promise<any>;
@@ -343,9 +330,7 @@ export declare class DbAuthHandler<TUser extends UserType, TUserAttributes = Rec
     _createUser(): Promise<any>;
     _getAuthMethod(): Promise<AuthMethodNames>;
     _validateField(name: string, value: string | undefined): value is string;
-    _loginResponse(user: Record<string, any>, statusCode?: number): [{
-        id: string;
-    }, Headers, {
+    _loginResponse(user: Record<string, any>, statusCode?: number): [Record<string, any>, Headers, {
         statusCode: number;
     }];
     _logoutResponse(response?: Record<string, unknown>): AuthMethodOutput;
@@ -364,6 +349,11 @@ export declare class DbAuthHandler<TUser extends UserType, TUserAttributes = Rec
         body: string;
         headers: Headers;
     };
+    _forbidden(message: string): {
+        statusCode: number;
+        body: string;
+        headers: Headers;
+    };
     _getUserMatchCriteriaOptions(username: string, usernameMatchFlowOption: string | undefined): {
         [x: string]: string;
     } | {

package/dist/DbAuthHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DbAuthHandler.d.ts","sourceRoot":"","sources":["../src/DbAuthHandler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAG1B,wBAAwB,EAKzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,YAAY,CAAA;AAIhF,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAuB3E,UAAU,iBAAiB,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,eAAe,CAAC,KAAK,GAAG,CAAA;IAE7E;;;OAGG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IAED;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,yBAAyB,CAAC,KAAK,GAAG,QAAQ;IAClD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAA;IAC5C,MAAM,CAAC,EAAE;QACP,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,UAAU,gBAAgB,CAAC,KAAK,GAAG,QAAQ;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,GAAG,CAAA;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,yBAAyB,CAAC,EAAE,MAAM,CAAA;QAClC,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,wBAAwB,CAAC,KAAK,GAAG,QAAQ;IACjD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpD,mBAAmB,EAAE,OAAO,CAAA;IAC5B,MAAM,CAAC,EAAE;QACP,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,gBAAgB,CAAA;IAC3C,gBAAgB,EAAE;QAChB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAA;AAEnD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;IACnC,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;KAC/B,CAAA;IACD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAC,CAAA;AAEF,KAAK,gBAAgB,GAAG;IACtB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,GAAG,SAAS;IAClD,OAAO,CAAC;IACR;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACxB,CAAA;AAED,MAAM,WAAW,oBAAoB,CACnC,KAAK,GAAG,QAAQ,EAChB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C;;;;;;;OAOG;IACH,EAAE,EAAE,GAAG,CAAA;IACP;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,CAAA;IAC5B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,CAAA;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,yDAAyD;QACzD,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,yDAAyD;QACzD,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,yDAAyD;QACzD,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,yDAAyD;QACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,yDAAyD;QACzD,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE;YACX,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,QAAQ,CAAC,EAAE,OAAO,CAAA;YAClB,MAAM,CAAC,EAAE,OAAO,CAAA;YAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;YACjB,MAAM,CAAC,EAAE,MAAM,CAAA;SAChB,CAAA;QACD;;;;;;WAMG;QACH,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;IACD;;OAEG;IACH,cAAc,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACrE;;OAEG;IACH,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnD;;OAEG;IACH,aAAa,EAAE,wBAAwB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnE;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAC,eAAe,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAE/D;;OAEG;IACH,QAAQ,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAEnD;;OAEG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB,CAAC,eAAe;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC;AAED,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,UAAU,GACV,OAAO,GACP,QAAQ,GACR,eAAe,GACf,QAAQ,GACR,sBAAsB,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,CAAA;AAExB,KAAK,MAAM,GAAG,0BAA0B,GACtC,wBAAwB,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,eAAe,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB,GAAG;IACF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAEH,KAAK,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AACnD,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAIzC,qBAAa,aAAa,CACxB,KAAK,SAAS,QAAQ,EACtB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAA;IACrC,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACtD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,GAAG,CAAA;IACP,UAAU,EAAE,GAAG,CAAA;IACf,oBAAoB,EAAE,GAAG,CAAA;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,OAAO,EAAE,aAAa,GAAG,SAAS,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAA;IACpC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAO;IACtC,cAAc,EAAE,CACd,QAAQ,EAAE;QACR,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,EACD,WAAW,EAAE,WAAW,KACrB;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IAED,IAAW,iBAAiB,2BAS3B;IAGD,MAAM,KAAK,OAAO,IAAI,eAAe,EAAE,CActC;IAGD,MAAM,KAAK,KAAK;;;;;;;;;;;;MAcf;IAGD,MAAM,KAAK,iBAAiB,WAE3B;IAGD,MAAM,KAAK,UAAU,WAEpB;IAED,MAAM,KAAK,6BAA6B,aAEvC;IAED;;;;;;;;OAQG;IACH,IAAI,oBAAoB,IAAI,OAAO,CAmBlC;gBAGC,KAAK,EAAE,oBAAoB,GAAG,OAAO,EACrC,QAAQ,EAAE,aAAa,EAAE,SAAS;IAClC,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC;IA6DtD,IAAI;IAUJ,MAAM;iBAxKD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;eACnC,MAAM,GAAG,SAAS;oBACb,MAAM;;IAwNd,cAAc,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2E3C,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAqBrC,KAAK,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAuBxC,MAAM,IAAI,gBAAgB;IAIpB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA0E1C,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA6BnC,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAgB/C,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA+FjD,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAkEhD,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAiD/C,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2EnD,gBAAgB;IAkEV,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAYlE,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAY3C,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAa3C,YAAY;IAMZ,iBAAiB,CAAC,EAChB,OAAe,EACf,OAAY,GACb,EAAE;QACD,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;QACxB,OAAO,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAA;KACzC;IAmCD,+BAA+B,IAAI,MAAM;IASzC,0BAA0B,CAAC,OAAO,GAAG,GAAG,EACtC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAC5B,SAAS,EAAE,MAAM,GAChB,MAAM;IAaH,aAAa;IASb,gBAAgB,CAAC,KAAK,EAAE,MAAM;IAoC9B,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAiB9C,WAAW,CACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS;IA6CxB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM;IA6C/D,eAAe;IAqCf,WAAW;IAqCX,cAAc;IAqBpB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM;IAYxE,cAAc,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,UAAU,SAAM,GACf,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAkBpD,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB;IAIrE,GAAG,CACD,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5D,OAAO,UAAgB,EACvB,OAAO;;KAAsB;;;;;IAW/B,SAAS;;;IAMT,WAAW,CAAC,OAAO,EAAE,MAAM;;;;;IAQ3B,4BAA4B,CAC1B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,GAAG,SAAS;;;;;;;;CAgB9C"}
+{"version":3,"file":"DbAuthHandler.d.ts","sourceRoot":"","sources":["../src/DbAuthHandler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAG1B,wBAAwB,EAKzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,YAAY,CAAA;AAIhF,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAyB3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAetD,UAAU,iBAAiB,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,eAAe,CAAC,KAAK,GAAG,CAAA;IAE7E;;;OAGG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IAED;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,yBAAyB,CAAC,KAAK,GAAG,QAAQ;IAClD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAA;IAC5C,MAAM,CAAC,EAAE;QACP,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,UAAU,gBAAgB,CAAC,KAAK,GAAG,QAAQ;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,GAAG,CAAA;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,yBAAyB,CAAC,EAAE,MAAM,CAAA;QAClC,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,wBAAwB,CAAC,KAAK,GAAG,QAAQ;IACjD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpD,mBAAmB,EAAE,OAAO,CAAA;IAC5B,MAAM,CAAC,EAAE;QACP,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,gBAAgB,CAAA;IAC3C,gBAAgB,EAAE;QAChB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAA;AAEnD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;IACnC,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;KAC/B,CAAA;IACD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAC,CAAA;AAEF,KAAK,gBAAgB,GAAG;IACtB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,GAAG,SAAS;IAClD,OAAO,CAAC;IACR;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACxB,CAAA;AAED,MAAM,WAAW,oBAAoB,CACnC,KAAK,GAAG,QAAQ,EAChB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C;;;;;;;OAOG;IACH,EAAE,EAAE,GAAG,CAAA;IACP;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,CAAA;IAC5B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,CAAA;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD;;OAEG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAA;IAC3B;;OAEG;IACH,cAAc,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACrE;;OAEG;IACH,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnD;;OAEG;IACH,aAAa,EAAE,wBAAwB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnE;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAC,eAAe,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAE/D;;OAEG;IACH,QAAQ,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAEnD;;OAEG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;IAEjB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,oBAAoB,CAAC,eAAe;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC;AAED,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,UAAU,GACV,OAAO,GACP,QAAQ,GACR,eAAe,GACf,QAAQ,GACR,sBAAsB,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,CAAA;AAExB,KAAK,MAAM,GAAG,0BAA0B,GACtC,wBAAwB,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,eAAe,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB,GAAG;IACF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAEH,KAAK,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AACnD,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAEzC,qBAAa,aAAa,CACxB,KAAK,SAAS,QAAQ,EACtB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAA;IACrC,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACtD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,GAAG,CAAA;IACP,UAAU,EAAE,GAAG,CAAA;IACf,oBAAoB,EAAE,GAAG,CAAA;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,OAAO,EAAE,aAAa,GAAG,SAAS,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAA;IACpC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAO;IACtC,cAAc,EAAE,CACd,QAAQ,EAAE;QACR,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,EACD,WAAW,EAAE,WAAW,KACrB;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IAED,IAAW,iBAAiB,2BAS3B;IAGD,MAAM,KAAK,OAAO,IAAI,eAAe,EAAE,CActC;IAGD,MAAM,KAAK,KAAK;;;;;;;;;;;;MAcf;IAGD,MAAM,KAAK,iBAAiB,WAE3B;IAGD,MAAM,KAAK,UAAU,WAEpB;IAED,MAAM,KAAK,6BAA6B,aAEvC;IAED;;;;;;;;OAQG;IACH,IAAI,oBAAoB,IAAI,OAAO,CAmBlC;gBAGC,KAAK,EAAE,oBAAoB,GAAG,OAAO,EACrC,QAAQ,EAAE,aAAa,EAAE,SAAS;IAClC,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC;IA0DtD,IAAI;IAUJ,MAAM;iBArKD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;eACnC,MAAM,GAAG,SAAS;oBACb,MAAM;;IAkPpB,YAAY,IAAI,MAAM,GAAG,IAAI;IAU7B,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAO3B,cAAc,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2E3C,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAqBrC,KAAK,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAuBxC,MAAM,IAAI,gBAAgB;IAIpB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA0E1C,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA6BnC,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAgB/C,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA+FjD,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAkEhD,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAiD/C,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2EnD,gBAAgB;IAkEV,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAYlE,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAY3C,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAK3C,YAAY;IAMZ,iBAAiB,CAAC,EAChB,OAAe,EACf,OAAY,GACb,EAAE;QACD,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;QACxB,OAAO,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAA;KACzC;IAQD,+BAA+B,IAAI,MAAM;IASzC,0BAA0B,CAAC,OAAO,GAAG,GAAG,EACtC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAC5B,SAAS,EAAE,MAAM,GAChB,MAAM;IASH,gBAAgB,CAAC,KAAK,EAAE,MAAM;IAoC9B,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAiB9C,WAAW,CACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS;IA6CxB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM;IA6C/D,eAAe;IAqCf,WAAW;IAqCX,cAAc;IAqBpB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM;IAYxE,cAAc,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,UAAU,SAAM,GACf,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IASzD,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB;IAIrE,GAAG,CACD,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5D,OAAO,UAAgB,EACvB,OAAO;;KAAsB;;;;;IAW/B,SAAS;;;IAMT,WAAW,CAAC,OAAO,EAAE,MAAM;;;;;IAQ3B,UAAU,CAAC,OAAO,EAAE,MAAM;;;;;IAQ1B,4BAA4B,CAC1B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,GAAG,SAAS;;;;;;;;CAgB9C"}

package/dist/DbAuthHandler.js

@@ -6,9 +6,25 @@ import {
   normalizeRequest
 } from "@cedarjs/api";
 import * as DbAuthError from "./errors.js";
+import {
+  isProxiedRequest,
+  isRequestOriginTrusted,
+  requiresOriginValidation,
+  resolveRequestHost,
+  resolveRequestProtocol
+} from "./originValidation.js";
+import {
+  buildCookieAttributes,
+  createAuthProviderCookieString,
+  createCsrfToken,
+  createExpiresAtDate,
+  createLoginResponse,
+  createSessionCookieString,
+  DEFAULT_ALLOWED_USER_FIELDS,
+  sanitizeUser
+} from "./session.js";
 import {
   decryptSession,
-  encryptSession,
   extractCookie,
   extractHashingOptions,
   generateCookieName,
@@ -20,7 +36,6 @@ import {
   legacyHashPassword,
   webAuthnSession
 } from "./shared.js";
-const DEFAULT_ALLOWED_USER_FIELDS = ["id", "email"];
 class DbAuthHandler {
   event;
   _normalizedRequest;
@@ -85,7 +100,7 @@ class DbAuthHandler {
   }
   // generate a new token (standard UUID)
   static get CSRF_TOKEN() {
-    return uuidv4();
+    return createCsrfToken();
   }
   static get AVAILABLE_WEBAUTHN_TRANSPORTS() {
     return ["usb", "ble", "nfc", "internal"];
@@ -128,11 +143,9 @@ class DbAuthHandler {
     this.dbCredentialAccessor = this.options.credentialModelAccessor ? this.db[this.options.credentialModelAccessor] : null;
     this.hasInvalidSession = false;
     this.allowedUserFields = this.options.allowedUserFields || DEFAULT_ALLOWED_USER_FIELDS;
-    const sessionExpiresAt = /* @__PURE__ */ new Date();
-    sessionExpiresAt.setSeconds(
-      sessionExpiresAt.getSeconds() + this.options.login.expires
+    this.sessionExpiresDate = createExpiresAtDate(
+      this.options.login.expires
     );
-    this.sessionExpiresDate = sessionExpiresAt.toUTCString();
     const webAuthnExpiresAt = /* @__PURE__ */ new Date();
     webAuthnExpiresAt.setSeconds(
       webAuthnExpiresAt.getSeconds() + (this.options?.webAuthn?.expires || 0)
@@ -188,11 +201,28 @@ class DbAuthHandler {
       if (this.httpMethod !== DbAuthHandler.VERBS[method]) {
         return this.createResponse(this._notFound(), corsHeaders);
       }
+      if (requiresOriginValidation(this.httpMethod) && !isRequestOriginTrusted(
+        {
+          method: this.httpMethod,
+          headers: this.normalizedRequest.headers,
+          host: this._requestHost(),
+          protocol: this._requestProtocol(),
+          proxied: isProxiedRequest(this.normalizedRequest.headers)
+        },
+        {
+          trustedOrigins: this.options.trustedOrigins,
+          corsOrigin: this.options.cors?.origin
+        }
+      )) {
+        throw new DbAuthError.UntrustedOriginError();
+      }
       const [body, headers, options = { statusCode: 200 }] = await this[method]();
       return this.createResponse(this._ok(body, headers, options), corsHeaders);
     } catch (e) {
       if (e instanceof DbAuthError.WrongVerbError) {
         return this.createResponse(this._notFound(), corsHeaders);
+      } else if (e instanceof DbAuthError.UntrustedOriginError) {
+        return this.createResponse(this._forbidden(e.message), corsHeaders);
       } else {
         return this.createResponse(
           this._badRequest(e.message || e),
@@ -201,6 +231,25 @@ class DbAuthHandler {
       }
     }
   }
+  // best-effort host the request was sent to, used by origin validation to
+  // allow same-origin requests through with no extra configuration. Prefers
+  // `X-Forwarded-Host` over the connection-level host/URL -- see
+  // `resolveRequestHost` for why that's safe behind a proxy
+  _requestHost() {
+    return resolveRequestHost(
+      this.normalizedRequest.headers,
+      isFetchApiRequest(this.event) ? this.event.url : void 0
+    );
+  }
+  // best-effort scheme the request arrived over, used alongside
+  // `_requestHost` for origin validation. See `resolveRequestProtocol` for
+  // when it can and can't be determined reliably
+  _requestProtocol() {
+    return resolveRequestProtocol(
+      this.normalizedRequest.headers,
+      isFetchApiRequest(this.event) ? this.event.url : void 0
+    );
+  }
   async forgotPassword() {
     const { enabled = true } = this.options.forgotPassword;
     if (!enabled) {
@@ -626,13 +675,7 @@ class DbAuthHandler {
   // removes any fields not explicitly allowed to be sent to the client before
   // sending a response over the wire
   _sanitizeUser(user) {
-    const sanitized = JSON.parse(JSON.stringify(user));
-    Object.keys(sanitized).forEach((key) => {
-      if (!this.allowedUserFields.includes(key)) {
-        delete sanitized[key];
-      }
-    });
-    return sanitized;
+    return sanitizeUser(user, this.allowedUserFields);
   }
   // Converts LambdaEvent or FetchRequest to
   _decodeEvent() {
@@ -645,49 +688,27 @@ class DbAuthHandler {
     expires = "now",
     options = {}
   }) {
-    const userCookieAttributes = this.options.cookie?.attributes ? { ...this.options.cookie?.attributes } : { ...this.options.cookie };
-    if (!this.options.cookie?.attributes) {
-      delete userCookieAttributes.name;
-    }
-    const cookieOptions = { ...userCookieAttributes, ...options };
-    const meta = Object.keys(cookieOptions).map((key) => {
-      const optionValue = cookieOptions[key];
-      if (optionValue === true) {
-        return key;
-      } else if (optionValue === false) {
-        return null;
-      } else {
-        return `${key}=${optionValue}`;
-      }
-    }).filter((v) => v);
-    const expiresAt = expires === "now" ? DbAuthHandler.PAST_EXPIRES_DATE : expires;
-    meta.push(`Expires=${expiresAt}`);
-    return meta;
+    return buildCookieAttributes({
+      cookieConfig: this.options.cookie,
+      expires,
+      overrideAttributes: options
+    });
   }
   _createAuthProviderCookieString() {
-    return [
-      `auth-provider=dbAuth`,
-      ...this._cookieAttributes({ expires: this.sessionExpiresDate })
-    ].join(";");
+    return createAuthProviderCookieString({
+      cookieConfig: this.options.cookie,
+      expiresAt: this.sessionExpiresDate
+    });
   }
   // returns the set-cookie header to be returned in the request (effectively
   // creates the session)
   _createSessionCookieString(data, csrfToken) {
-    const session = JSON.stringify(data) + ";" + csrfToken;
-    const encrypted = encryptSession(session);
-    const sessionCookieString = [
-      `${generateCookieName(this.options.cookie?.name)}=${encrypted}`,
-      ...this._cookieAttributes({ expires: this.sessionExpiresDate })
-    ].join(";");
-    return sessionCookieString;
-  }
-  // checks the CSRF token in the header against the CSRF token in the session
-  // and throw an error if they are not the same (not used yet)
-  async _validateCsrf() {
-    if (this.sessionCsrfToken !== this.normalizedRequest.headers.get("csrf-token")) {
-      throw new DbAuthError.CsrfTokenMismatchError();
-    }
-    return true;
+    return createSessionCookieString({
+      data,
+      csrfToken,
+      cookieConfig: this.options.cookie,
+      expiresAt: this.sessionExpiresDate
+    });
   }
   async _findUserByToken(token) {
     const tokenExpires = /* @__PURE__ */ new Date();
@@ -870,16 +891,12 @@ class DbAuthHandler {
     }
   }
   _loginResponse(user, statusCode = 200) {
-    const sessionData = this._sanitizeUser(user);
-    const csrfToken = DbAuthHandler.CSRF_TOKEN;
-    const headers = new Headers();
-    headers.append("csrf-token", csrfToken);
-    headers.append("set-cookie", this._createAuthProviderCookieString());
-    headers.append(
-      "set-cookie",
-      this._createSessionCookieString(sessionData, csrfToken)
-    );
-    return [sessionData, headers, { statusCode }];
+    return createLoginResponse(user, {
+      cookie: this.options.cookie,
+      allowedUserFields: this.allowedUserFields,
+      expiresAt: this.sessionExpiresDate,
+      statusCode
+    });
   }
   _logoutResponse(response) {
     return [response ? JSON.stringify(response) : "", this._deleteSessionHeader];
@@ -904,6 +921,13 @@ class DbAuthHandler {
       headers: new Headers({ "content-type": "application/json" })
     };
   }
+  _forbidden(message) {
+    return {
+      statusCode: 403,
+      body: JSON.stringify({ error: message }),
+      headers: new Headers({ "content-type": "application/json" })
+    };
+  }
   _getUserMatchCriteriaOptions(username, usernameMatchFlowOption) {
     const findUniqueUserMatchCriteriaOptions = !usernameMatchFlowOption ? { [this.options.authFields.username]: username } : {
       [this.options.authFields.username]: {

package/dist/errors.d.ts

@@ -49,8 +49,8 @@ export declare class DuplicateUsernameError extends Error {
 export declare class IncorrectPasswordError extends Error {
     constructor(username: string, message?: string | undefined);
 }
-export declare class CsrfTokenMismatchError extends Error {
-    constructor();
+export declare class UntrustedOriginError extends Error {
+    constructor(message?: string);
 }
 export declare class SessionDecryptionError extends Error {
     constructor();

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAqB,SAAQ,KAAK;;CAO9C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAO/C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;;CAOpD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,IAAI,EAAE,MAAM;CAIzB;AAED,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,UAAU,EAAE,MAAM;CAI/B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAK1C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAExC,QAAQ,GAAE,MAAM,GAAG,SAAqB,EACxC,OAAO,GAAE,MAAM,GAAG,SAA4C;CAUjE;AAED,qBAAa,gCAAiC,SAAQ,KAAK;gBAEvD,OAAO,GAAE,MAAM,GAAG,SAAqD;CAK1E;AAED,qBAAa,aAAc,SAAQ,KAAK;;CAOvC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAEzC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,GAAG,SAAkC;CAKvD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAmD;CAKxE;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAgD;CAKrE;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAwB;CAI5C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAuB;CAI3C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAA2B;CAI/C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAA+B;CAInD;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAwB;CAI5C;AAED,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,SAA2B;CAI/C;AAED,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,SAAmB;CAIvC;AAED,qBAAa,sBAAuB,SAAQ,aAAa;gBAErD,OAAO,SAAyD;CAKnE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAqB,SAAQ,KAAK;;CAO9C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAO/C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;;CAOpD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,IAAI,EAAE,MAAM;CAIzB;AAED,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,UAAU,EAAE,MAAM;CAI/B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAK1C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAExC,QAAQ,GAAE,MAAM,GAAG,SAAqB,EACxC,OAAO,GAAE,MAAM,GAAG,SAA4C;CAUjE;AAED,qBAAa,gCAAiC,SAAQ,KAAK;gBAEvD,OAAO,GAAE,MAAM,GAAG,SAAqD;CAK1E;AAED,qBAAa,aAAc,SAAQ,KAAK;;CAOvC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAEzC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,GAAG,SAAkC;CAKvD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAmD;CAKxE;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAgD;CAKrE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAAkC;CAItD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAwB;CAI5C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAuB;CAI3C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAA2B;CAI/C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAA+B;CAInD;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAwB;CAI5C;AAED,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,SAA2B;CAI/C;AAED,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,SAAmB;CAIvC;AAED,qBAAa,sBAAuB,SAAQ,aAAa;gBAErD,OAAO,SAAyD;CAKnE"}

package/dist/errors.js

@@ -112,10 +112,10 @@ class IncorrectPasswordError extends Error {
     this.name = "IncorrectPasswordError";
   }
 }
-class CsrfTokenMismatchError extends Error {
-  constructor() {
-    super(`CSRF token mismatch`);
-    this.name = "CsrfTokenMismatchError";
+class UntrustedOriginError extends Error {
+  constructor(message = "Request origin is not trusted") {
+    super(message);
+    this.name = "UntrustedOriginError";
   }
 }
 class SessionDecryptionError extends Error {
@@ -197,7 +197,6 @@ class NoWebAuthnSessionError extends WebAuthnError {
   }
 }
 export {
-  CsrfTokenMismatchError,
   DuplicateUsernameError,
   FieldRequiredError,
   FlowNotEnabledError,
@@ -222,6 +221,7 @@ export {
   ReusedPasswordError,
   SessionDecryptionError,
   UnknownAuthMethodError,
+  UntrustedOriginError,
   UserNotFoundError,
   UsernameAndPasswordRequiredError,
   UsernameNotFoundError,

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export * from './DbAuthHandler.js';
 export { PasswordValidationError } from './errors.js';
+export * from './session.js';
 export * from './shared.js';
 export { authDecoder, createAuthDecoder } from './decoder.js';
+export * from './originValidation.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC7D,cAAc,uBAAuB,CAAA"}

package/dist/index.js

@@ -1,7 +1,9 @@
 export * from "./DbAuthHandler.js";
 import { PasswordValidationError } from "./errors.js";
+export * from "./session.js";
 export * from "./shared.js";
 import { authDecoder, createAuthDecoder } from "./decoder.js";
+export * from "./originValidation.js";
 export {
   PasswordValidationError,
   authDecoder,

package/dist/originValidation.d.ts

@@ -0,0 +1,131 @@
+import type { CorsConfig } from '@cedarjs/api';
+/**
+ * Minimal, transport-agnostic shape of an incoming request needed to decide
+ * whether its `Origin` header should be trusted for a state-changing
+ * request. Deliberately decoupled from any specific request/event type (no
+ * `DbAuthHandler` coupling) so this helper can be reused by other handler
+ * packages.
+ */
+export interface OriginValidationRequest {
+    /**
+     * HTTP method of the request, e.g. `GET`, `POST`. Used by
+     * {@link requiresOriginValidation} to decide whether a request needs to be
+     * checked at all.
+     */
+    method: string;
+    /**
+     * Request headers, including `origin` if the browser sent one.
+     */
+    headers: Headers;
+    /**
+     * Host (and port, if non-default) the request was sent to, resolved with
+     * {@link resolveRequestHost}. Used to allow same-origin requests through
+     * with no extra configuration, which covers the standard Cedar setup
+     * where the web side proxies API requests through its own origin. Pass
+     * `null` when the host can't be determined.
+     */
+    host?: string | null;
+    /**
+     * Scheme (`http`/`https`) the request is considered to have arrived
+     * over, resolved with {@link resolveRequestProtocol}, when it can be
+     * determined reliably. Used as an extra check alongside `host` when
+     * deciding whether the `Origin` header matches the request's own
+     * origin. Pass `null`/`undefined` when it can't be determined -- in that
+     * case only the host is compared, unless `proxied` narrows that further
+     * (see {@link isProxiedRequest}).
+     */
+    protocol?: string | null;
+    /**
+     * Whether the request declares itself as arriving through a forwarding
+     * proxy, resolved with {@link isProxiedRequest}. Scopes the
+     * unknown-scheme same-host restriction to requests a proxy actually
+     * touched -- see `isSameOrigin`.
+     */
+    proxied?: boolean;
+}
+export interface OriginValidationConfig {
+    /**
+     * Extra origins that are always trusted for state-changing requests, on
+     * top of the request's own host and any origins already listed in
+     * `cors.origin`.
+     */
+    trustedOrigins?: string | string[];
+    /**
+     * The `origin` value from a handler's `cors` config (same shape as passed
+     * to `createCorsContext`). String and array values are treated as
+     * trusted origins.
+     *
+     * `true` (reflect any request origin back in
+     * `Access-Control-Allow-Origin`) is intentionally NOT treated as trust --
+     * combined with `credentials: true` that is the exact misconfiguration
+     * this check protects against. Apps that need to accept requests from an
+     * arbitrary set of origins must list them explicitly in `trustedOrigins`
+     * instead.
+     */
+    corsOrigin?: CorsConfig['origin'];
+}
+/**
+ * HTTP methods that can change server-side state and therefore need their
+ * `Origin` validated. `GET` and `HEAD` requests are read-only and are never
+ * checked.
+ */
+export declare function requiresOriginValidation(method: string): boolean;
+/**
+ * Resolves the host a request should be considered as having arrived at,
+ * preferring a forwarding proxy's advertised host over the connection-level
+ * one.
+ *
+ * A proxy in front of the api side (this framework's own `cedar serve
+ * --ud`, or an external nginx/CDN) terminates the browser's connection and
+ * opens a new one to the api server, so the request's own URL/`Host` header
+ * reflects that internal hop rather than the origin-facing host the
+ * browser actually targeted. `X-Forwarded-Host` carries the origin-facing
+ * host instead.
+ *
+ * Trusting `X-Forwarded-Host` here is safe for CSRF purposes: a cross-site
+ * HTML form can't set arbitrary request headers, and a cross-origin
+ * `fetch()` that sets a custom header triggers a CORS preflight, so an
+ * attacker can't forge it without already having crossed the browser's
+ * CORS checks.
+ *
+ * @param url - The request's own URL (Fetch API requests only), used as a
+ * fallback when neither `X-Forwarded-Host` nor `Host` is present.
+ */
+export declare function resolveRequestHost(headers: Headers, url?: string | null): string | null;
+/**
+ * Resolves the scheme (`http`/`https`) a request should be considered as
+ * having arrived over, mirroring {@link resolveRequestHost}.
+ *
+ * The request's own URL is only used as a fallback when no
+ * `X-Forwarded-Host` is present -- once a proxy has declared itself by
+ * setting that header, the request's own URL reflects the internal hop to
+ * the proxy, and its scheme can't be assumed to match what the browser
+ * actually used unless the proxy also set `X-Forwarded-Proto`.
+ *
+ * @param url - The request's own URL (Fetch API requests only).
+ */
+export declare function resolveRequestProtocol(headers: Headers, url?: string | null): string | null;
+/**
+ * Whether a request declares itself as arriving through a forwarding
+ * proxy, i.e. carries an `X-Forwarded-Host` header.
+ *
+ * Used to scope the unknown-scheme same-host restriction (see
+ * `isSameOrigin`) to requests a proxy actually touched. A request with no
+ * forwarding headers at all is a direct connection -- the normal case for
+ * dev servers, classic `cedar serve`, and most self-hosts -- not evidence
+ * of a proxy.
+ */
+export declare function isProxiedRequest(headers: Headers): boolean;
+/**
+ * Decides whether a request's `Origin` header should be trusted.
+ *
+ * Requests with no `Origin` header are always trusted: non-browser clients
+ * (server-to-server calls, CLIs, mobile apps) don't send one and don't carry
+ * ambient browser cookies, so they aren't CSRF vectors.
+ *
+ * When an `Origin` header is present, it's trusted when it matches the
+ * request's own host, is listed in `trustedOrigins`, or is listed in
+ * `corsOrigin`. Everything else is untrusted.
+ */
+export declare function isRequestOriginTrusted(request: OriginValidationRequest, config: OriginValidationConfig): boolean;
+//# sourceMappingURL=originValidation.d.ts.map

package/dist/originValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"originValidation.d.ts","sourceRoot":"","sources":["../src/originValidation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAClC;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;CAClC;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGhE;AAgBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,GAClB,MAAM,GAAG,IAAI,CAoBf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,GAClB,MAAM,GAAG,IAAI,CAef;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE1D;AA+CD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CA6BT"}

package/dist/originValidation.js

@@ -0,0 +1,92 @@
+function requiresOriginValidation(method) {
+  const upperMethod = method.toUpperCase();
+  return upperMethod !== "GET" && upperMethod !== "HEAD";
+}
+function toOriginList(value) {
+  if (!value) {
+    return [];
+  }
+  return Array.isArray(value) ? value : [value];
+}
+function firstForwardedValue(headerValue) {
+  return headerValue.split(",")[0].trim();
+}
+function resolveRequestHost(headers, url) {
+  const forwardedHost = headers.get("x-forwarded-host");
+  if (forwardedHost) {
+    return firstForwardedValue(forwardedHost);
+  }
+  const host = headers.get("host");
+  if (host) {
+    return host;
+  }
+  if (url) {
+    try {
+      return new URL(url).host;
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function resolveRequestProtocol(headers, url) {
+  const forwardedProto = headers.get("x-forwarded-proto");
+  if (forwardedProto) {
+    return firstForwardedValue(forwardedProto).toLowerCase();
+  }
+  if (!headers.get("x-forwarded-host") && url) {
+    try {
+      return new URL(url).protocol.replace(":", "");
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function isProxiedRequest(headers) {
+  return headers.get("x-forwarded-host") !== null;
+}
+function isSameOrigin(origin, host, protocol, proxied) {
+  try {
+    const originUrl = new URL(origin);
+    if (originUrl.host !== host) {
+      return false;
+    }
+    if (protocol) {
+      return originUrl.protocol === `${protocol}:`;
+    }
+    if (proxied) {
+      return originUrl.protocol === "https:";
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isRequestOriginTrusted(request, config) {
+  const origin = request.headers.get("origin");
+  if (!origin) {
+    return true;
+  }
+  if (request.host && isSameOrigin(origin, request.host, request.protocol, request.proxied)) {
+    return true;
+  }
+  const trustedOrigins = toOriginList(config.trustedOrigins);
+  if (trustedOrigins.includes(origin)) {
+    return true;
+  }
+  const corsOrigins = toOriginList(
+    typeof config.corsOrigin === "string" || Array.isArray(config.corsOrigin) ? config.corsOrigin : void 0
+  );
+  if (corsOrigins.includes(origin)) {
+    return true;
+  }
+  return false;
+}
+export {
+  isProxiedRequest,
+  isRequestOriginTrusted,
+  requiresOriginValidation,
+  resolveRequestHost,
+  resolveRequestProtocol
+};

package/dist/session.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Cookie attributes that can be set on a dbAuth cookie, either as
+ * `cookie.attributes` or (deprecated) directly on `cookie`.
+ */
+export interface DbAuthCookieAttributes {
+    Path?: string;
+    HttpOnly?: boolean;
+    Secure?: boolean;
+    SameSite?: string;
+    Domain?: string;
+}
+/**
+ * Configuration for the cookies dbAuth sets: the session cookie's name, and
+ * the attributes applied to every cookie dbAuth writes (the session cookie
+ * and the `auth-provider` cookie).
+ */
+export interface DbAuthCookieConfig extends DbAuthCookieAttributes {
+    attributes?: DbAuthCookieAttributes;
+    /**
+     * The name of the cookie that dbAuth sets
+     *
+     * %port% will be replaced with the port the api server is running on.
+     * If you have multiple RW apps running on the same host, you'll need to
+     * make sure they all use unique cookie names
+     */
+    name?: string;
+}
+/**
+ * Returns a UTC date string `expiresInSeconds` seconds in the future. Used as
+ * the `Expires` cookie attribute for a session that should stay valid for
+ * that long from now.
+ */
+export declare function createExpiresAtDate(expiresInSeconds: number): string;
+/**
+ * Generates a new CSRF token (a standard UUID) to pair with a session.
+ */
+export declare function createCsrfToken(): string;
+/**
+ * Removes any fields not explicitly allowed to be sent to the client before
+ * sending a user record over the wire.
+ */
+export declare function sanitizeUser(user: Record<string, unknown>, allowedUserFields: string[]): Record<string, unknown>;
+/**
+ * Builds the Set-Cookie attribute strings (`Path`, `HttpOnly`, `SameSite`,
+ * `Secure`, `Domain`, `Expires`) for a dbAuth cookie.
+ *
+ * Pass `expires: 'now'` (the default) to get the attributes needed to expire
+ * the cookie, or a UTC date string (e.g. from `createExpiresAtDate`) to set a
+ * future expiration.
+ */
+export declare function buildCookieAttributes({ cookieConfig, expires, overrideAttributes, }: {
+    cookieConfig?: DbAuthCookieConfig;
+    expires?: 'now' | string;
+    overrideAttributes?: DbAuthCookieAttributes;
+}): string[];
+/**
+ * Builds the Set-Cookie header string for the `auth-provider` cookie dbAuth
+ * sets alongside the session cookie.
+ */
+export declare function createAuthProviderCookieString({ cookieConfig, expiresAt, }: {
+    cookieConfig?: DbAuthCookieConfig;
+    expiresAt: string;
+}): string;
+/**
+ * Builds the Set-Cookie header string for the dbAuth session cookie: the
+ * `data;csrfToken` payload, encrypted, under the configured cookie name and
+ * attributes.
+ */
+export declare function createSessionCookieString<TIdType = unknown>({ data, csrfToken, cookieConfig, expiresAt, }: {
+    data: Record<string, TIdType>;
+    csrfToken: string;
+    cookieConfig?: DbAuthCookieConfig;
+    expiresAt: string;
+}): string;
+/** Fields returned from the user record when none are explicitly allowed */
+export declare const DEFAULT_ALLOWED_USER_FIELDS: string[];
+export interface CreateLoginResponseOptions {
+    /**
+     * Object containing cookie config options: the cookie name (with %port%
+     * support) and the attributes applied to it (`Path`, `HttpOnly`,
+     * `SameSite`, `Secure`, `Domain`).
+     */
+    cookie?: DbAuthCookieConfig;
+    /**
+     * The fields that are allowed to be returned from the user record.
+     * Defaults to `id` and `email`.
+     */
+    allowedUserFields?: string[];
+    /**
+     * The `Expires` cookie attribute value for the session and `auth-provider`
+     * cookies: a UTC date string in the future. Build one with
+     * `createExpiresAtDate(expiresInSeconds)`.
+     */
+    expiresAt: string;
+    /**
+     * The HTTP status code to return in the response tuple. Defaults to 200.
+     */
+    statusCode?: number;
+}
+/**
+ * Mints a dbAuth session for the given user: a CSRF token, a session cookie
+ * (the sanitized user data paired with the CSRF token, encrypted), and the
+ * `auth-provider` cookie, in the same `[body, headers, { statusCode }]` shape
+ * every dbAuth auth method returns.
+ *
+ * Callable without a `DbAuthHandler` instance, so any code that has already
+ * verified a user's identity — a WebAuthn assertion, an OAuth callback, a
+ * magic link — can issue a session the same way the built-in login flow
+ * does.
+ */
+export declare function createLoginResponse(user: Record<string, unknown>, options: CreateLoginResponseOptions): [Record<string, unknown>, Headers, {
+    statusCode: number;
+}];
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IAChE,UAAU,CAAC,EAAE,sBAAsB,CAAA;IACnC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAOD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,iBAAiB,EAAE,MAAM,EAAE,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,YAAY,EACZ,OAAe,EACf,kBAAuB,GACxB,EAAE;IACD,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACxB,kBAAkB,CAAC,EAAE,sBAAsB,CAAA;CAC5C,GAAG,MAAM,EAAE,CAiCX;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,YAAY,EACZ,SAAS,GACV,EAAE;IACD,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,CAKT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAG,OAAO,EAAE,EAC3D,IAAI,EACJ,SAAS,EACT,YAAY,EACZ,SAAS,GACV,EAAE;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,CAQT;AAED,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,UAAkB,CAAA;AAE1D,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAA;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,0BAA0B,GAClC,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CA+B5D"}

package/dist/session.js

@@ -0,0 +1,103 @@
+import { v4 as uuidv4 } from "uuid";
+import { encryptSession, generateCookieName } from "./shared.js";
+const PAST_EXPIRES_DATE = (/* @__PURE__ */ new Date(
+  "1970-01-01T00:00:00.000+00:00"
+)).toUTCString();
+function createExpiresAtDate(expiresInSeconds) {
+  const expiresAt = /* @__PURE__ */ new Date();
+  expiresAt.setSeconds(expiresAt.getSeconds() + expiresInSeconds);
+  return expiresAt.toUTCString();
+}
+function createCsrfToken() {
+  return uuidv4();
+}
+function sanitizeUser(user, allowedUserFields) {
+  const sanitized = JSON.parse(JSON.stringify(user));
+  Object.keys(sanitized).forEach((key) => {
+    if (!allowedUserFields.includes(key)) {
+      delete sanitized[key];
+    }
+  });
+  return sanitized;
+}
+function buildCookieAttributes({
+  cookieConfig,
+  expires = "now",
+  overrideAttributes = {}
+}) {
+  const userCookieAttributes = cookieConfig?.attributes ? { ...cookieConfig.attributes } : { ...cookieConfig };
+  if (!cookieConfig?.attributes) {
+    delete userCookieAttributes.name;
+  }
+  const cookieOptions = { ...userCookieAttributes, ...overrideAttributes };
+  const meta = Object.keys(cookieOptions).map((key) => {
+    const optionValue = cookieOptions[key];
+    if (optionValue === true) {
+      return key;
+    } else if (optionValue === false) {
+      return null;
+    } else {
+      return `${key}=${optionValue}`;
+    }
+  }).filter((v) => v !== null);
+  const expiresAt = expires === "now" ? PAST_EXPIRES_DATE : expires;
+  meta.push(`Expires=${expiresAt}`);
+  return meta;
+}
+function createAuthProviderCookieString({
+  cookieConfig,
+  expiresAt
+}) {
+  return [
+    `auth-provider=dbAuth`,
+    ...buildCookieAttributes({ cookieConfig, expires: expiresAt })
+  ].join(";");
+}
+function createSessionCookieString({
+  data,
+  csrfToken,
+  cookieConfig,
+  expiresAt
+}) {
+  const session = JSON.stringify(data) + ";" + csrfToken;
+  const encrypted = encryptSession(session);
+  return [
+    `${generateCookieName(cookieConfig?.name)}=${encrypted}`,
+    ...buildCookieAttributes({ cookieConfig, expires: expiresAt })
+  ].join(";");
+}
+const DEFAULT_ALLOWED_USER_FIELDS = ["id", "email"];
+function createLoginResponse(user, options) {
+  const allowedUserFields = options.allowedUserFields ?? DEFAULT_ALLOWED_USER_FIELDS;
+  const sessionData = sanitizeUser(user, allowedUserFields);
+  const csrfToken = createCsrfToken();
+  const headers = new Headers();
+  headers.append("csrf-token", csrfToken);
+  headers.append(
+    "set-cookie",
+    createAuthProviderCookieString({
+      cookieConfig: options.cookie,
+      expiresAt: options.expiresAt
+    })
+  );
+  headers.append(
+    "set-cookie",
+    createSessionCookieString({
+      data: sessionData,
+      csrfToken,
+      cookieConfig: options.cookie,
+      expiresAt: options.expiresAt
+    })
+  );
+  return [sessionData, headers, { statusCode: options.statusCode ?? 200 }];
+}
+export {
+  DEFAULT_ALLOWED_USER_FIELDS,
+  buildCookieAttributes,
+  createAuthProviderCookieString,
+  createCsrfToken,
+  createExpiresAtDate,
+  createLoginResponse,
+  createSessionCookieString,
+  sanitizeUser
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/auth-dbauth-api",
-  "version": "7.0.0-canary.3073",
+  "version": "7.0.0-canary.3075",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -57,13 +57,13 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/project-config": "7.0.0-canary.3073",
+    "@cedarjs/project-config": "7.0.0-canary.3075",
     "md5": "2.3.0",
     "uuid": "11.1.0"
   },
   "devDependencies": {
-    "@cedarjs/api": "7.0.0-canary.3073",
-    "@cedarjs/framework-tools": "7.0.0-canary.3073",
+    "@cedarjs/api": "7.0.0-canary.3075",
+    "@cedarjs/framework-tools": "7.0.0-canary.3075",
     "@simplewebauthn/server": "13.3.3",
     "@types/aws-lambda": "8.10.162",
     "@types/md5": "2.3.6",