@cedarjs/auth-dbauth-api 7.0.1-next.467 → 7.1.0-rc.34

package/dist/DbAuthHandler.d.ts

@@ -1,7 +1,6 @@
-import type { AuthenticationResponseJSON, RegistrationResponseJSON } from '@simplewebauthn/server';
+import type { AuthenticationResponseJSON, RegistrationResponseJSON } from '@simplewebauthn/types';
 import type { APIGatewayProxyEvent, Context as LambdaContext } from 'aws-lambda';
 import type { CorsConfig, CorsContext, PartialRequest } from '@cedarjs/api';
-import type { DbAuthCookieConfig } from './session.js';
 interface SignupFlowOptions<TUserAttributes = Record<string, unknown>> {
     /**
      * Allow users to sign up. Defaults to true.
@@ -97,33 +96,6 @@ interface ResetPasswordFlowOptions<TUser = UserType> {
         flowNotEnabled?: string;
     };
 }
-interface ChangePasswordFlowOptions<TUser = UserType> {
-    /**
-     * Allow logged in users to change their password by providing their current
-     * one. Defaults to true.
-     * Needs to be explicitly set to false to disable the flow
-     */
-    enabled?: boolean;
-    /**
-     * Invoked after the new password has been saved. This is where you can
-     * notify the user that their password was changed. Returning anything
-     * truthy keeps the user logged in. Returning anything falsy logs them out.
-     */
-    handler: (user: TUser) => boolean | Promise<boolean>;
-    /**
-     * If `false` (the default) the new password MUST be different from the
-     * current one
-     */
-    allowReusedPassword?: boolean;
-    errors?: {
-        currentPasswordRequired?: string;
-        newPasswordRequired?: string;
-        incorrectCurrentPassword?: string;
-        passwordNotSet?: string;
-        reusedPassword?: string;
-        flowNotEnabled?: string;
-    };
-}
 interface WebAuthnFlowOptions {
     enabled: boolean;
     expires: number;
@@ -195,16 +167,36 @@ export interface DbAuthHandlerOptions<TUser = UserType, TUserAttributes = Record
         resetTokenExpiresAt: string;
         challenge?: string;
     };
-    /**
-     * Object containing change password options
-     */
-    changePassword: ChangePasswordFlowOptions<TUser> | {
-        enabled: false;
-    };
     /**
      * Object containing cookie config options
      */
-    cookie?: DbAuthCookieConfig;
+    cookie?: {
+        /** @deprecated set this option in `cookie.attributes` */
+        Path?: string;
+        /** @deprecated set this option in `cookie.attributes` */
+        HttpOnly?: boolean;
+        /** @deprecated set this option in `cookie.attributes` */
+        Secure?: boolean;
+        /** @deprecated set this option in `cookie.attributes` */
+        SameSite?: string;
+        /** @deprecated set this option in `cookie.attributes` */
+        Domain?: string;
+        attributes?: {
+            Path?: string;
+            HttpOnly?: boolean;
+            Secure?: boolean;
+            SameSite?: string;
+            Domain?: string;
+        };
+        /**
+         * The name of the cookie that dbAuth sets
+         *
+         * %port% will be replaced with the port the api server is running on.
+         * If you have multiple RW apps running on the same host, you'll need to
+         * make sure they all use unique cookie names
+         */
+        name?: string;
+    };
     /**
      * Object containing forgot password options
      */
@@ -257,13 +249,11 @@ export interface SignupHandlerOptions<TUserAttributes> {
     salt: string;
     userAttributes?: TUserAttributes;
 }
-export type AuthMethodNames = 'changePassword' | 'forgotPassword' | 'getToken' | 'login' | 'logout' | 'resetPassword' | 'signup' | 'webAuthnAuthenticate' | 'webAuthnAuthOptions' | 'webAuthnRegOptions' | 'webAuthnRegister' | 'validateResetToken';
+export type AuthMethodNames = 'forgotPassword' | 'getToken' | 'login' | 'logout' | 'resetPassword' | 'signup' | 'webAuthnAuthenticate' | 'webAuthnAuthOptions' | 'webAuthnRegOptions' | 'webAuthnRegister' | 'validateResetToken';
 type Params = AuthenticationResponseJSON & RegistrationResponseJSON & {
     username?: string;
     password?: string;
     resetToken?: string;
-    currentPassword?: string;
-    newPassword?: string;
     method: AuthMethodNames;
     [key: string]: any;
 } & {
@@ -300,7 +290,6 @@ export declare class DbAuthHandler<TUser extends UserType, TUserAttributes = Rec
     get normalizedRequest(): PartialRequest<Params>;
     static get METHODS(): AuthMethodNames[];
     static get VERBS(): {
-        changePassword: string;
         forgotPassword: string;
         getToken: string;
         login: string;
@@ -336,7 +325,6 @@ export declare class DbAuthHandler<TUser extends UserType, TUserAttributes = Rec
     }>;
     _requestHost(): string | null;
     _requestProtocol(): string | null;
-    changePassword(): Promise<AuthMethodOutput>;
     forgotPassword(): Promise<AuthMethodOutput>;
     getToken(): Promise<AuthMethodOutput>;
     login(): Promise<AuthMethodOutput>;
@@ -351,24 +339,25 @@ export declare class DbAuthHandler<TUser extends UserType, TUserAttributes = Rec
     _validateOptions(): void;
     _saveChallenge(userId: string | number, value: string | null): Promise<void>;
     _webAuthnCookie(id: string, expires: string): string;
-    _sanitizeUser(user: Record<string, unknown>): Record<string, unknown>;
+    _sanitizeUser(user: Record<string, unknown>): any;
     _decodeEvent(): void;
     _cookieAttributes({ expires, options, }: {
         expires?: 'now' | string;
         options?: DbAuthHandlerOptions['cookie'];
-    }): string[];
+    }): (string | null)[];
     _createAuthProviderCookieString(): string;
     _createSessionCookieString<TIdType = any>(data: DbAuthSession<TIdType>, csrfToken: string): string;
     _findUserByToken(token: string): Promise<any>;
     _clearResetToken(user: Record<string, unknown>): Promise<void>;
     _verifyUser(username: string | undefined, password: string | undefined): Promise<any>;
     _verifyPassword(user: Record<string, unknown>, password: string): Promise<Record<string, unknown>>;
-    _passwordMatches(user: Record<string, unknown>, password: string): boolean;
     _getCurrentUser(): Promise<any>;
     _createUser(): Promise<any>;
     _getAuthMethod(): Promise<AuthMethodNames>;
     _validateField(name: string, value: string | undefined): value is string;
-    _loginResponse(user: Record<string, any>, statusCode?: number): [Record<string, any>, Headers, {
+    _loginResponse(user: Record<string, any>, statusCode?: number): [{
+        id: string;
+    }, Headers, {
         statusCode: number;
     }];
     _logoutResponse(response?: Record<string, unknown>): AuthMethodOutput;

package/dist/DbAuthHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DbAuthHandler.d.ts","sourceRoot":"","sources":["../src/DbAuthHandler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAG1B,wBAAwB,EAKzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,YAAY,CAAA;AAIhF,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAyB3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAetD,UAAU,iBAAiB,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,eAAe,CAAC,KAAK,GAAG,CAAA;IAE7E;;;OAGG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IAED;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,yBAAyB,CAAC,KAAK,GAAG,QAAQ;IAClD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAA;IAC5C,MAAM,CAAC,EAAE;QACP,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,UAAU,gBAAgB,CAAC,KAAK,GAAG,QAAQ;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,GAAG,CAAA;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,yBAAyB,CAAC,EAAE,MAAM,CAAA;QAClC,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,wBAAwB,CAAC,KAAK,GAAG,QAAQ;IACjD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpD,mBAAmB,EAAE,OAAO,CAAA;IAC5B,MAAM,CAAC,EAAE;QACP,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED,UAAU,yBAAyB,CAAC,KAAK,GAAG,QAAQ;IAClD;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpD;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,MAAM,CAAC,EAAE;QACP,uBAAuB,CAAC,EAAE,MAAM,CAAA;QAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;QAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAA;QACjC,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,gBAAgB,CAAA;IAC3C,gBAAgB,EAAE;QAChB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAA;AAEnD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;IACnC,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;KAC/B,CAAA;IACD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAC,CAAA;AAEF,KAAK,gBAAgB,GAAG;IACtB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,GAAG,SAAS;IAClD,OAAO,CAAC;IACR;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACxB,CAAA;AAED,MAAM,WAAW,oBAAoB,CACnC,KAAK,GAAG,QAAQ,EAChB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C;;;;;;;OAOG;IACH,EAAE,EAAE,GAAG,CAAA;IACP;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,CAAA;IAC5B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,CAAA;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD;;OAEG;IACH,cAAc,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACrE;;OAEG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAA;IAC3B;;OAEG;IACH,cAAc,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACrE;;OAEG;IACH,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnD;;OAEG;IACH,aAAa,EAAE,wBAAwB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnE;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAC,eAAe,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAE/D;;OAEG;IACH,QAAQ,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAEnD;;OAEG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;IAEjB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,oBAAoB,CAAC,eAAe;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC;AAED,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,gBAAgB,GAChB,UAAU,GACV,OAAO,GACP,QAAQ,GACR,eAAe,GACf,QAAQ,GACR,sBAAsB,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,CAAA;AAExB,KAAK,MAAM,GAAG,0BAA0B,GACtC,wBAAwB,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,eAAe,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB,GAAG;IACF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAEH,KAAK,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AACnD,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAEzC,qBAAa,aAAa,CACxB,KAAK,SAAS,QAAQ,EACtB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAA;IACrC,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACtD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,GAAG,CAAA;IACP,UAAU,EAAE,GAAG,CAAA;IACf,oBAAoB,EAAE,GAAG,CAAA;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,OAAO,EAAE,aAAa,GAAG,SAAS,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAA;IACpC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAO;IACtC,cAAc,EAAE,CACd,QAAQ,EAAE;QACR,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,EACD,WAAW,EAAE,WAAW,KACrB;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IAED,IAAW,iBAAiB,2BAS3B;IAGD,MAAM,KAAK,OAAO,IAAI,eAAe,EAAE,CAetC;IAGD,MAAM,KAAK,KAAK;;;;;;;;;;;;;MAef;IAGD,MAAM,KAAK,iBAAiB,WAE3B;IAGD,MAAM,KAAK,UAAU,WAEpB;IAED,MAAM,KAAK,6BAA6B,aAEvC;IAED;;;;;;;;OAQG;IACH,IAAI,oBAAoB,IAAI,OAAO,CAmBlC;gBAGC,KAAK,EAAE,oBAAoB,GAAG,OAAO,EACrC,QAAQ,EAAE,aAAa,EAAE,SAAS;IAClC,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC;IA0DtD,IAAI;IAUJ,MAAM;iBAvKD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;eACnC,MAAM,GAAG,SAAS;oBACb,MAAM;;IAoPpB,YAAY,IAAI,MAAM,GAAG,IAAI;IAU7B,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAO3B,cAAc,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAkH3C,cAAc,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2E3C,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAqBrC,KAAK,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAuBxC,MAAM,IAAI,gBAAgB;IAIpB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA0E1C,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA6BnC,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAgB/C,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA+FjD,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAkEhD,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAiD/C,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2EnD,gBAAgB;IA4EV,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAYlE,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAY3C,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAK3C,YAAY;IAMZ,iBAAiB,CAAC,EAChB,OAAe,EACf,OAAY,GACb,EAAE;QACD,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;QACxB,OAAO,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAA;KACzC;IAQD,+BAA+B,IAAI,MAAM;IASzC,0BAA0B,CAAC,OAAO,GAAG,GAAG,EACtC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAC5B,SAAS,EAAE,MAAM,GAChB,MAAM;IASH,gBAAgB,CAAC,KAAK,EAAE,MAAM;IAoC9B,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAiB9C,WAAW,CACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS;IA6CxB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM;IA+CrE,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM;IAa1D,eAAe;IAqCf,WAAW;IAqCX,cAAc;IAqBpB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM;IAYxE,cAAc,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,UAAU,SAAM,GACf,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IASzD,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB;IAIrE,GAAG,CACD,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5D,OAAO,UAAgB,EACvB,OAAO;;KAAsB;;;;;IAW/B,SAAS;;;IAMT,WAAW,CAAC,OAAO,EAAE,MAAM;;;;;IAQ3B,UAAU,CAAC,OAAO,EAAE,MAAM;;;;;IAQ1B,4BAA4B,CAC1B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,GAAG,SAAS;;;;;;;;CAgB9C"}
+{"version":3,"file":"DbAuthHandler.d.ts","sourceRoot":"","sources":["../src/DbAuthHandler.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACzB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,YAAY,CAAA;AAIhF,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AA8B3E,UAAU,iBAAiB,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,eAAe,CAAC,KAAK,GAAG,CAAA;IAE7E;;;OAGG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IAED;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,yBAAyB,CAAC,KAAK,GAAG,QAAQ;IAClD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAA;IAC5C,MAAM,CAAC,EAAE;QACP,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,UAAU,gBAAgB,CAAC,KAAK,GAAG,QAAQ;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,GAAG,CAAA;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,yBAAyB,CAAC,EAAE,MAAM,CAAA;QAClC,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,wBAAwB,CAAC,KAAK,GAAG,QAAQ;IACjD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpD,mBAAmB,EAAE,OAAO,CAAA;IAC5B,MAAM,CAAC,EAAE;QACP,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,gBAAgB,CAAA;IAC3C,gBAAgB,EAAE;QAChB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAA;AAEnD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;IACnC,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;KAC/B,CAAA;IACD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAC,CAAA;AAEF,KAAK,gBAAgB,GAAG;IACtB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,GAAG,SAAS;IAClD,OAAO,CAAC;IACR;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACxB,CAAA;AAED,MAAM,WAAW,oBAAoB,CACnC,KAAK,GAAG,QAAQ,EAChB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C;;;;;;;OAOG;IACH,EAAE,EAAE,GAAG,CAAA;IACP;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,CAAA;IAC5B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,CAAA;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,yDAAyD;QACzD,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,yDAAyD;QACzD,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,yDAAyD;QACzD,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,yDAAyD;QACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,yDAAyD;QACzD,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE;YACX,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,QAAQ,CAAC,EAAE,OAAO,CAAA;YAClB,MAAM,CAAC,EAAE,OAAO,CAAA;YAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;YACjB,MAAM,CAAC,EAAE,MAAM,CAAA;SAChB,CAAA;QACD;;;;;;WAMG;QACH,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;IACD;;OAEG;IACH,cAAc,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACrE;;OAEG;IACH,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnD;;OAEG;IACH,aAAa,EAAE,wBAAwB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnE;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAC,eAAe,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAE/D;;OAEG;IACH,QAAQ,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAEnD;;OAEG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;IAEjB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,oBAAoB,CAAC,eAAe;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC;AAED,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,UAAU,GACV,OAAO,GACP,QAAQ,GACR,eAAe,GACf,QAAQ,GACR,sBAAsB,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,CAAA;AAExB,KAAK,MAAM,GAAG,0BAA0B,GACtC,wBAAwB,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,eAAe,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB,GAAG;IACF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAEH,KAAK,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AACnD,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAIzC,qBAAa,aAAa,CACxB,KAAK,SAAS,QAAQ,EACtB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAA;IACrC,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACtD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,GAAG,CAAA;IACP,UAAU,EAAE,GAAG,CAAA;IACf,oBAAoB,EAAE,GAAG,CAAA;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,OAAO,EAAE,aAAa,GAAG,SAAS,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAA;IACpC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAO;IACtC,cAAc,EAAE,CACd,QAAQ,EAAE;QACR,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,EACD,WAAW,EAAE,WAAW,KACrB;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IAED,IAAW,iBAAiB,2BAS3B;IAGD,MAAM,KAAK,OAAO,IAAI,eAAe,EAAE,CActC;IAGD,MAAM,KAAK,KAAK;;;;;;;;;;;;MAcf;IAGD,MAAM,KAAK,iBAAiB,WAE3B;IAGD,MAAM,KAAK,UAAU,WAEpB;IAED,MAAM,KAAK,6BAA6B,aAEvC;IAED;;;;;;;;OAQG;IACH,IAAI,oBAAoB,IAAI,OAAO,CAmBlC;gBAGC,KAAK,EAAE,oBAAoB,GAAG,OAAO,EACrC,QAAQ,EAAE,aAAa,EAAE,SAAS;IAClC,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC;IA6DtD,IAAI;IAUJ,MAAM;iBAxKD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;eACnC,MAAM,GAAG,SAAS;oBACb,MAAM;;IAqPpB,YAAY,IAAI,MAAM,GAAG,IAAI;IAU7B,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAO3B,cAAc,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2E3C,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAqBrC,KAAK,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAuBxC,MAAM,IAAI,gBAAgB;IAIpB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA0E1C,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA6BnC,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAgB/C,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAgGjD,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAkEhD,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAiD/C,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAuEnD,gBAAgB;IAkEV,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAYlE,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAY3C,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAa3C,YAAY;IAMZ,iBAAiB,CAAC,EAChB,OAAe,EACf,OAAY,GACb,EAAE;QACD,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;QACxB,OAAO,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAA;KACzC;IAmCD,+BAA+B,IAAI,MAAM;IASzC,0BAA0B,CAAC,OAAO,GAAG,GAAG,EACtC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAC5B,SAAS,EAAE,MAAM,GAChB,MAAM;IAWH,gBAAgB,CAAC,KAAK,EAAE,MAAM;IAoC9B,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAiB9C,WAAW,CACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS;IA6CxB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM;IA6C/D,eAAe;IAqCf,WAAW;IAqCX,cAAc;IAqBpB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM;IAYxE,cAAc,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,UAAU,SAAM,GACf,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAkBpD,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB;IAIrE,GAAG,CACD,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5D,OAAO,UAAgB,EACvB,OAAO;;KAAsB;;;;;IAW/B,SAAS;;;IAMT,WAAW,CAAC,OAAO,EAAE,MAAM;;;;;IAQ3B,UAAU,CAAC,OAAO,EAAE,MAAM;;;;;IAQ1B,4BAA4B,CAC1B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,GAAG,SAAS;;;;;;;;CAgB9C"}

package/dist/DbAuthHandler.js

@@ -13,18 +13,9 @@ import {
   resolveRequestHost,
   resolveRequestProtocol
 } from "./originValidation.js";
-import {
-  buildCookieAttributes,
-  createAuthProviderCookieString,
-  createCsrfToken,
-  createExpiresAtDate,
-  createLoginResponse,
-  createSessionCookieString,
-  DEFAULT_ALLOWED_USER_FIELDS,
-  sanitizeUser
-} from "./session.js";
 import {
   decryptSession,
+  encryptSession,
   extractCookie,
   extractHashingOptions,
   generateCookieName,
@@ -36,6 +27,7 @@ import {
   legacyHashPassword,
   webAuthnSession
 } from "./shared.js";
+const DEFAULT_ALLOWED_USER_FIELDS = ["id", "email"];
 class DbAuthHandler {
   event;
   _normalizedRequest;
@@ -65,7 +57,6 @@ class DbAuthHandler {
   // class constant: list of auth methods that are supported
   static get METHODS() {
     return [
-      "changePassword",
       "forgotPassword",
       "getToken",
       "login",
@@ -82,7 +73,6 @@ class DbAuthHandler {
   // class constant: maps the auth functions to their required HTTP verb for access
   static get VERBS() {
     return {
-      changePassword: "POST",
       forgotPassword: "POST",
       getToken: "GET",
       login: "POST",
@@ -102,7 +92,7 @@ class DbAuthHandler {
   }
   // generate a new token (standard UUID)
   static get CSRF_TOKEN() {
-    return createCsrfToken();
+    return uuidv4();
   }
   static get AVAILABLE_WEBAUTHN_TRANSPORTS() {
     return ["usb", "ble", "nfc", "internal"];
@@ -145,9 +135,11 @@ class DbAuthHandler {
     this.dbCredentialAccessor = this.options.credentialModelAccessor ? this.db[this.options.credentialModelAccessor] : null;
     this.hasInvalidSession = false;
     this.allowedUserFields = this.options.allowedUserFields || DEFAULT_ALLOWED_USER_FIELDS;
-    this.sessionExpiresDate = createExpiresAtDate(
-      this.options.login.expires
+    const sessionExpiresAt = /* @__PURE__ */ new Date();
+    sessionExpiresAt.setSeconds(
+      sessionExpiresAt.getSeconds() + this.options.login.expires
     );
+    this.sessionExpiresDate = sessionExpiresAt.toUTCString();
     const webAuthnExpiresAt = /* @__PURE__ */ new Date();
     webAuthnExpiresAt.setSeconds(
       webAuthnExpiresAt.getSeconds() + (this.options?.webAuthn?.expires || 0)
@@ -252,83 +244,6 @@ class DbAuthHandler {
       isFetchApiRequest(this.event) ? this.event.url : void 0
     );
   }
-  async changePassword() {
-    const options = this.options.changePassword;
-    if (!options || options.enabled === false) {
-      throw new DbAuthError.FlowNotEnabledError(
-        options?.errors?.flowNotEnabled || `Change password flow is not enabled`
-      );
-    }
-    const sessionUserId = this.session?.[this.options.authFields.id];
-    if (!sessionUserId) {
-      throw new DbAuthError.NotLoggedInError();
-    }
-    const { currentPassword, newPassword } = this.normalizedRequest.jsonBody || {};
-    if (currentPassword == null || String(currentPassword).trim() === "") {
-      throw new DbAuthError.PasswordRequiredError(
-        options.errors?.currentPasswordRequired || "Current password is required"
-      );
-    }
-    if (newPassword == null || String(newPassword).trim() === "") {
-      throw new DbAuthError.PasswordRequiredError(
-        options.errors?.newPasswordRequired || "New password is required"
-      );
-    }
-    ;
-    this.options.signup.passwordValidation?.(
-      newPassword
-    );
-    let user;
-    try {
-      user = await this.dbAccessor.findUnique({
-        where: { [this.options.authFields.id]: sessionUserId }
-      });
-    } catch {
-      throw new DbAuthError.GenericError();
-    }
-    if (!user) {
-      throw new DbAuthError.UserNotFoundError();
-    }
-    if (!user[this.options.authFields.hashedPassword]) {
-      throw new DbAuthError.PasswordNotSetError(options.errors?.passwordNotSet);
-    }
-    try {
-      await this._verifyPassword(user, currentPassword);
-    } catch (e) {
-      if (e instanceof DbAuthError.IncorrectPasswordError) {
-        throw new DbAuthError.IncorrectPasswordError(
-          user[this.options.authFields.username],
-          options.errors?.incorrectCurrentPassword || "Current password is incorrect"
-        );
-      }
-      throw e;
-    }
-    if (!options.allowReusedPassword && this._passwordMatches(user, newPassword)) {
-      throw new DbAuthError.ReusedPasswordError(options.errors?.reusedPassword);
-    }
-    const [hashedPassword, salt] = hashPassword(newPassword);
-    try {
-      user = await this.dbAccessor.update({
-        where: {
-          [this.options.authFields.id]: user[this.options.authFields.id]
-        },
-        data: {
-          [this.options.authFields.hashedPassword]: hashedPassword,
-          [this.options.authFields.salt]: salt,
-          [this.options.authFields.resetToken]: null,
-          [this.options.authFields.resetTokenExpiresAt]: null
-        }
-      });
-    } catch {
-      throw new DbAuthError.GenericError();
-    }
-    const response = await options.handler(this._sanitizeUser(user));
-    if (response) {
-      return this._loginResponse(user);
-    } else {
-      return this._logoutResponse({});
-    }
-  }
   async forgotPassword() {
     const { enabled = true } = this.options.forgotPassword;
     if (!enabled) {
@@ -527,9 +442,9 @@ class DbAuthHandler {
         expectedChallenge: user[this.options.authFields.challenge],
         expectedOrigin: webAuthnOptions.origin,
         expectedRPID: webAuthnOptions.domain,
-        credential: {
-          id: credential[webAuthnOptions.credentialFields.id],
-          publicKey: credential[webAuthnOptions.credentialFields.publicKey],
+        authenticator: {
+          credentialID: credential[webAuthnOptions.credentialFields.id],
+          credentialPublicKey: credential[webAuthnOptions.credentialFields.publicKey],
           counter: credential[webAuthnOptions.credentialFields.counter],
           transports: credential[webAuthnOptions.credentialFields.transports] ? JSON.parse(
             credential[webAuthnOptions.credentialFields.transports]
@@ -671,11 +586,7 @@ class DbAuthHandler {
     if (!verified || !registrationInfo) {
       throw new DbAuthError.WebAuthnError("Registration failed");
     }
-    const {
-      id: credentialID,
-      publicKey: credentialPublicKey,
-      counter
-    } = registrationInfo.credential;
+    const { credentialPublicKey, credentialID, counter } = registrationInfo;
     const existingDevice = await this.dbCredentialAccessor.findFirst({
       where: {
         [this.options.webAuthn.credentialFields.id]: credentialID,
@@ -723,9 +634,6 @@ class DbAuthHandler {
     if (this.options?.resetPassword?.enabled !== false && !this.options?.resetPassword?.handler) {
       throw new DbAuthError.NoResetPasswordHandlerError();
     }
-    if (this.options?.changePassword && this.options.changePassword.enabled !== false && !this.options.changePassword.handler) {
-      throw new DbAuthError.NoChangePasswordHandlerError();
-    }
     if (this.options?.credentialModelAccessor && !this.options?.webAuthn || this.options?.webAuthn && !this.options?.credentialModelAccessor) {
       throw new DbAuthError.NoWebAuthnConfigError();
     }
@@ -757,7 +665,13 @@ class DbAuthHandler {
   // removes any fields not explicitly allowed to be sent to the client before
   // sending a response over the wire
   _sanitizeUser(user) {
-    return sanitizeUser(user, this.allowedUserFields);
+    const sanitized = JSON.parse(JSON.stringify(user));
+    Object.keys(sanitized).forEach((key) => {
+      if (!this.allowedUserFields.includes(key)) {
+        delete sanitized[key];
+      }
+    });
+    return sanitized;
   }
   // Converts LambdaEvent or FetchRequest to
   _decodeEvent() {
@@ -770,27 +684,41 @@ class DbAuthHandler {
     expires = "now",
     options = {}
   }) {
-    return buildCookieAttributes({
-      cookieConfig: this.options.cookie,
-      expires,
-      overrideAttributes: options
-    });
+    const userCookieAttributes = this.options.cookie?.attributes ? { ...this.options.cookie?.attributes } : { ...this.options.cookie };
+    if (!this.options.cookie?.attributes) {
+      delete userCookieAttributes.name;
+    }
+    const cookieOptions = { ...userCookieAttributes, ...options };
+    const meta = Object.keys(cookieOptions).map((key) => {
+      const optionValue = cookieOptions[key];
+      if (optionValue === true) {
+        return key;
+      } else if (optionValue === false) {
+        return null;
+      } else {
+        return `${key}=${optionValue}`;
+      }
+    }).filter((v) => v);
+    const expiresAt = expires === "now" ? DbAuthHandler.PAST_EXPIRES_DATE : expires;
+    meta.push(`Expires=${expiresAt}`);
+    return meta;
   }
   _createAuthProviderCookieString() {
-    return createAuthProviderCookieString({
-      cookieConfig: this.options.cookie,
-      expiresAt: this.sessionExpiresDate
-    });
+    return [
+      `auth-provider=dbAuth`,
+      ...this._cookieAttributes({ expires: this.sessionExpiresDate })
+    ].join(";");
   }
   // returns the set-cookie header to be returned in the request (effectively
   // creates the session)
   _createSessionCookieString(data, csrfToken) {
-    return createSessionCookieString({
-      data,
-      csrfToken,
-      cookieConfig: this.options.cookie,
-      expiresAt: this.sessionExpiresDate
-    });
+    const session = JSON.stringify(data) + ";" + csrfToken;
+    const encrypted = encryptSession(session);
+    const sessionCookieString = [
+      `${generateCookieName(this.options.cookie?.name)}=${encrypted}`,
+      ...this._cookieAttributes({ expires: this.sessionExpiresDate })
+    ].join(";");
+    return sessionCookieString;
   }
   async _findUserByToken(token) {
     const tokenExpires = /* @__PURE__ */ new Date();
@@ -895,16 +823,6 @@ class DbAuthHandler {
       this.options.login?.errors?.incorrectPassword
     );
   }
-  // compares a plain text password with the user's stored hash, using the
-  // same algorithm and options the stored hash was created with. Unlike
-  // `_verifyPassword` this has no side effects and does not throw
-  _passwordMatches(user, password) {
-    const storedHash = user[this.options.authFields.hashedPassword];
-    const salt = user[this.options.authFields.salt];
-    const options = extractHashingOptions(storedHash);
-    const [hashedPassword] = Object.keys(options).length ? hashPassword(password, { salt, options }) : legacyHashPassword(password, salt);
-    return hashedPassword === storedHash;
-  }
   // gets the user from the database and returns only its ID
   async _getCurrentUser() {
     if (!this.session?.[this.options.authFields.id]) {
@@ -983,12 +901,16 @@ class DbAuthHandler {
     }
   }
   _loginResponse(user, statusCode = 200) {
-    return createLoginResponse(user, {
-      cookie: this.options.cookie,
-      allowedUserFields: this.allowedUserFields,
-      expiresAt: this.sessionExpiresDate,
-      statusCode
-    });
+    const sessionData = this._sanitizeUser(user);
+    const csrfToken = DbAuthHandler.CSRF_TOKEN;
+    const headers = new Headers();
+    headers.append("csrf-token", csrfToken);
+    headers.append("set-cookie", this._createAuthProviderCookieString());
+    headers.append(
+      "set-cookie",
+      this._createSessionCookieString(sessionData, csrfToken)
+    );
+    return [sessionData, headers, { statusCode }];
   }
   _logoutResponse(response) {
     return [response ? JSON.stringify(response) : "", this._deleteSessionHeader];

package/dist/errors.d.ts

@@ -16,9 +16,6 @@ export declare class NoForgotPasswordHandlerError extends Error {
 export declare class NoResetPasswordHandlerError extends Error {
     constructor();
 }
-export declare class NoChangePasswordHandlerError extends Error {
-    constructor();
-}
 export declare class NoWebAuthnConfigError extends Error {
     constructor();
 }
@@ -82,9 +79,6 @@ export declare class ResetTokenRequiredError extends Error {
 export declare class ReusedPasswordError extends Error {
     constructor(message?: string);
 }
-export declare class PasswordNotSetError extends Error {
-    constructor(message?: string);
-}
 export declare class PasswordValidationError extends Error {
     constructor(message?: string);
 }

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAqB,SAAQ,KAAK;;CAO9C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAO/C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;;CAOpD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,IAAI,EAAE,MAAM;CAIzB;AAED,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,UAAU,EAAE,MAAM;CAI/B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAK1C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAExC,QAAQ,GAAE,MAAM,GAAG,SAAqB,EACxC,OAAO,GAAE,MAAM,GAAG,SAA4C;CAUjE;AAED,qBAAa,gCAAiC,SAAQ,KAAK;gBAEvD,OAAO,GAAE,MAAM,GAAG,SAAqD;CAK1E;AAED,qBAAa,aAAc,SAAQ,KAAK;;CAOvC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAEzC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,GAAG,SAAkC;CAKvD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAmD;CAKxE;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAgD;CAKrE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAAkC;CAItD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAwB;CAI5C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAuB;CAI3C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAA2B;CAI/C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAA+B;CAInD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAE1C,OAAO,SAA4E;CAKtF;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAwB;CAI5C;AAED,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,SAA2B;CAI/C;AAED,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,SAAmB;CAIvC;AAED,qBAAa,sBAAuB,SAAQ,aAAa;gBAErD,OAAO,SAAyD;CAKnE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAqB,SAAQ,KAAK;;CAO9C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAO/C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;;CAOpD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,IAAI,EAAE,MAAM;CAIzB;AAED,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,UAAU,EAAE,MAAM;CAI/B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAK1C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAExC,QAAQ,GAAE,MAAM,GAAG,SAAqB,EACxC,OAAO,GAAE,MAAM,GAAG,SAA4C;CAUjE;AAED,qBAAa,gCAAiC,SAAQ,KAAK;gBAEvD,OAAO,GAAE,MAAM,GAAG,SAAqD;CAK1E;AAED,qBAAa,aAAc,SAAQ,KAAK;;CAOvC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAEzC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,GAAG,SAAkC;CAKvD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAmD;CAKxE;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAgD;CAKrE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAAkC;CAItD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAwB;CAI5C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAuB;CAI3C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAA2B;CAI/C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAA+B;CAInD;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAwB;CAI5C;AAED,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,SAA2B;CAI/C;AAED,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,SAAmB;CAIvC;AAED,qBAAa,sBAAuB,SAAQ,aAAa;gBAErD,OAAO,SAAyD;CAKnE"}

package/dist/errors.js

@@ -36,12 +36,6 @@ class NoResetPasswordHandlerError extends Error {
     this.name = "NoResetPasswordHandlerError";
   }
 }
-class NoChangePasswordHandlerError extends Error {
-  constructor() {
-    super("dbAuth requires a change password handler in order to notify user");
-    this.name = "NoChangePasswordHandlerError";
-  }
-}
 class NoWebAuthnConfigError extends Error {
   constructor() {
     super(
@@ -178,12 +172,6 @@ class ReusedPasswordError extends Error {
     this.name = "ReusedPasswordError";
   }
 }
-class PasswordNotSetError extends Error {
-  constructor(message = 'This account does not have a password. Use "Forgot password" to set one') {
-    super(message);
-    this.name = "PasswordNotSetError";
-  }
-}
 class PasswordValidationError extends Error {
   constructor(message = "Password is invalid") {
     super(message);
@@ -215,7 +203,6 @@ export {
   GenericError,
   IncorrectPasswordError,
   MissingWebAuthnConfigError,
-  NoChangePasswordHandlerError,
   NoForgotPasswordHandlerError,
   NoLoginHandlerError,
   NoResetPasswordHandlerError,
@@ -226,7 +213,6 @@ export {
   NoWebAuthnConfigError,
   NoWebAuthnSessionError,
   NotLoggedInError,
-  PasswordNotSetError,
   PasswordRequiredError,
   PasswordValidationError,
   ResetTokenExpiredError,

package/dist/index.d.ts

@@ -1,6 +1,5 @@
 export * from './DbAuthHandler.js';
 export { PasswordValidationError } from './errors.js';
-export * from './session.js';
 export * from './shared.js';
 export { authDecoder, createAuthDecoder } from './decoder.js';
 export * from './originValidation.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC7D,cAAc,uBAAuB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC7D,cAAc,uBAAuB,CAAA"}

package/dist/index.js

@@ -1,6 +1,5 @@
 export * from "./DbAuthHandler.js";
 import { PasswordValidationError } from "./errors.js";
-export * from "./session.js";
 export * from "./shared.js";
 import { authDecoder, createAuthDecoder } from "./decoder.js";
 export * from "./originValidation.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/auth-dbauth-api",
-  "version": "7.0.1-next.467",
+  "version": "7.1.0-rc.34",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -57,29 +57,22 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/project-config": "7.0.1-next.467",
+    "@cedarjs/project-config": "7.1.0-rc.34",
     "md5": "2.3.0",
     "uuid": "11.1.1"
   },
   "devDependencies": {
-    "@cedarjs/api": "7.0.1-next.467",
-    "@cedarjs/framework-tools": "7.0.1-next.467",
-    "@simplewebauthn/server": "13.3.3",
-    "@types/aws-lambda": "8.10.164",
+    "@cedarjs/api": "7.1.0-rc.34",
+    "@cedarjs/framework-tools": "7.1.0-rc.34",
+    "@simplewebauthn/server": "10.0.1",
+    "@simplewebauthn/types": "10.0.0",
+    "@types/aws-lambda": "8.10.163",
     "@types/md5": "2.3.6",
-    "concurrently": "9.2.5",
-    "publint": "0.3.25",
+    "concurrently": "9.2.4",
+    "publint": "0.3.24",
     "typescript": "5.9.3",
     "vitest": "4.1.11"
   },
-  "peerDependencies": {
-    "@simplewebauthn/server": "^13.0.0"
-  },
-  "peerDependenciesMeta": {
-    "@simplewebauthn/server": {
-      "optional": true
-    }
-  },
   "engines": {
     "node": ">=24"
   },

package/dist/session.d.ts

@@ -1,114 +0,0 @@
-/**
- * Cookie attributes that can be set on a dbAuth cookie, either as
- * `cookie.attributes` or (deprecated) directly on `cookie`.
- */
-export interface DbAuthCookieAttributes {
-    Path?: string;
-    HttpOnly?: boolean;
-    Secure?: boolean;
-    SameSite?: string;
-    Domain?: string;
-}
-/**
- * Configuration for the cookies dbAuth sets: the session cookie's name, and
- * the attributes applied to every cookie dbAuth writes (the session cookie
- * and the `auth-provider` cookie).
- */
-export interface DbAuthCookieConfig extends DbAuthCookieAttributes {
-    attributes?: DbAuthCookieAttributes;
-    /**
-     * The name of the cookie that dbAuth sets
-     *
-     * %port% will be replaced with the port the api server is running on.
-     * If you have multiple RW apps running on the same host, you'll need to
-     * make sure they all use unique cookie names
-     */
-    name?: string;
-}
-/**
- * Returns a UTC date string `expiresInSeconds` seconds in the future. Used as
- * the `Expires` cookie attribute for a session that should stay valid for
- * that long from now.
- */
-export declare function createExpiresAtDate(expiresInSeconds: number): string;
-/**
- * Generates a new CSRF token (a standard UUID) to pair with a session.
- */
-export declare function createCsrfToken(): string;
-/**
- * Removes any fields not explicitly allowed to be sent to the client before
- * sending a user record over the wire.
- */
-export declare function sanitizeUser(user: Record<string, unknown>, allowedUserFields: string[]): Record<string, unknown>;
-/**
- * Builds the Set-Cookie attribute strings (`Path`, `HttpOnly`, `SameSite`,
- * `Secure`, `Domain`, `Expires`) for a dbAuth cookie.
- *
- * Pass `expires: 'now'` (the default) to get the attributes needed to expire
- * the cookie, or a UTC date string (e.g. from `createExpiresAtDate`) to set a
- * future expiration.
- */
-export declare function buildCookieAttributes({ cookieConfig, expires, overrideAttributes, }: {
-    cookieConfig?: DbAuthCookieConfig;
-    expires?: 'now' | string;
-    overrideAttributes?: DbAuthCookieAttributes;
-}): string[];
-/**
- * Builds the Set-Cookie header string for the `auth-provider` cookie dbAuth
- * sets alongside the session cookie.
- */
-export declare function createAuthProviderCookieString({ cookieConfig, expiresAt, }: {
-    cookieConfig?: DbAuthCookieConfig;
-    expiresAt: string;
-}): string;
-/**
- * Builds the Set-Cookie header string for the dbAuth session cookie: the
- * `data;csrfToken` payload, encrypted, under the configured cookie name and
- * attributes.
- */
-export declare function createSessionCookieString<TIdType = unknown>({ data, csrfToken, cookieConfig, expiresAt, }: {
-    data: Record<string, TIdType>;
-    csrfToken: string;
-    cookieConfig?: DbAuthCookieConfig;
-    expiresAt: string;
-}): string;
-/** Fields returned from the user record when none are explicitly allowed */
-export declare const DEFAULT_ALLOWED_USER_FIELDS: string[];
-export interface CreateLoginResponseOptions {
-    /**
-     * Object containing cookie config options: the cookie name (with %port%
-     * support) and the attributes applied to it (`Path`, `HttpOnly`,
-     * `SameSite`, `Secure`, `Domain`).
-     */
-    cookie?: DbAuthCookieConfig;
-    /**
-     * The fields that are allowed to be returned from the user record.
-     * Defaults to `id` and `email`.
-     */
-    allowedUserFields?: string[];
-    /**
-     * The `Expires` cookie attribute value for the session and `auth-provider`
-     * cookies: a UTC date string in the future. Build one with
-     * `createExpiresAtDate(expiresInSeconds)`.
-     */
-    expiresAt: string;
-    /**
-     * The HTTP status code to return in the response tuple. Defaults to 200.
-     */
-    statusCode?: number;
-}
-/**
- * Mints a dbAuth session for the given user: a CSRF token, a session cookie
- * (the sanitized user data paired with the CSRF token, encrypted), and the
- * `auth-provider` cookie, in the same `[body, headers, { statusCode }]` shape
- * every dbAuth auth method returns.
- *
- * Callable without a `DbAuthHandler` instance, so any code that has already
- * verified a user's identity — a WebAuthn assertion, an OAuth callback, a
- * magic link — can issue a session the same way the built-in login flow
- * does.
- */
-export declare function createLoginResponse(user: Record<string, unknown>, options: CreateLoginResponseOptions): [Record<string, unknown>, Headers, {
-    statusCode: number;
-}];
-//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IAChE,UAAU,CAAC,EAAE,sBAAsB,CAAA;IACnC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAOD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,iBAAiB,EAAE,MAAM,EAAE,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,YAAY,EACZ,OAAe,EACf,kBAAuB,GACxB,EAAE;IACD,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACxB,kBAAkB,CAAC,EAAE,sBAAsB,CAAA;CAC5C,GAAG,MAAM,EAAE,CAiCX;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,YAAY,EACZ,SAAS,GACV,EAAE;IACD,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,CAKT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAG,OAAO,EAAE,EAC3D,IAAI,EACJ,SAAS,EACT,YAAY,EACZ,SAAS,GACV,EAAE;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,CAQT;AAED,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,UAAkB,CAAA;AAE1D,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAA;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,0BAA0B,GAClC,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CA+B5D"}

package/dist/session.js

@@ -1,103 +0,0 @@
-import { v4 as uuidv4 } from "uuid";
-import { encryptSession, generateCookieName } from "./shared.js";
-const PAST_EXPIRES_DATE = (/* @__PURE__ */ new Date(
-  "1970-01-01T00:00:00.000+00:00"
-)).toUTCString();
-function createExpiresAtDate(expiresInSeconds) {
-  const expiresAt = /* @__PURE__ */ new Date();
-  expiresAt.setSeconds(expiresAt.getSeconds() + expiresInSeconds);
-  return expiresAt.toUTCString();
-}
-function createCsrfToken() {
-  return uuidv4();
-}
-function sanitizeUser(user, allowedUserFields) {
-  const sanitized = JSON.parse(JSON.stringify(user));
-  Object.keys(sanitized).forEach((key) => {
-    if (!allowedUserFields.includes(key)) {
-      delete sanitized[key];
-    }
-  });
-  return sanitized;
-}
-function buildCookieAttributes({
-  cookieConfig,
-  expires = "now",
-  overrideAttributes = {}
-}) {
-  const userCookieAttributes = cookieConfig?.attributes ? { ...cookieConfig.attributes } : { ...cookieConfig };
-  if (!cookieConfig?.attributes) {
-    delete userCookieAttributes.name;
-  }
-  const cookieOptions = { ...userCookieAttributes, ...overrideAttributes };
-  const meta = Object.keys(cookieOptions).map((key) => {
-    const optionValue = cookieOptions[key];
-    if (optionValue === true) {
-      return key;
-    } else if (optionValue === false) {
-      return null;
-    } else {
-      return `${key}=${optionValue}`;
-    }
-  }).filter((v) => v !== null);
-  const expiresAt = expires === "now" ? PAST_EXPIRES_DATE : expires;
-  meta.push(`Expires=${expiresAt}`);
-  return meta;
-}
-function createAuthProviderCookieString({
-  cookieConfig,
-  expiresAt
-}) {
-  return [
-    `auth-provider=dbAuth`,
-    ...buildCookieAttributes({ cookieConfig, expires: expiresAt })
-  ].join(";");
-}
-function createSessionCookieString({
-  data,
-  csrfToken,
-  cookieConfig,
-  expiresAt
-}) {
-  const session = JSON.stringify(data) + ";" + csrfToken;
-  const encrypted = encryptSession(session);
-  return [
-    `${generateCookieName(cookieConfig?.name)}=${encrypted}`,
-    ...buildCookieAttributes({ cookieConfig, expires: expiresAt })
-  ].join(";");
-}
-const DEFAULT_ALLOWED_USER_FIELDS = ["id", "email"];
-function createLoginResponse(user, options) {
-  const allowedUserFields = options.allowedUserFields ?? DEFAULT_ALLOWED_USER_FIELDS;
-  const sessionData = sanitizeUser(user, allowedUserFields);
-  const csrfToken = createCsrfToken();
-  const headers = new Headers();
-  headers.append("csrf-token", csrfToken);
-  headers.append(
-    "set-cookie",
-    createAuthProviderCookieString({
-      cookieConfig: options.cookie,
-      expiresAt: options.expiresAt
-    })
-  );
-  headers.append(
-    "set-cookie",
-    createSessionCookieString({
-      data: sessionData,
-      csrfToken,
-      cookieConfig: options.cookie,
-      expiresAt: options.expiresAt
-    })
-  );
-  return [sessionData, headers, { statusCode: options.statusCode ?? 200 }];
-}
-export {
-  DEFAULT_ALLOWED_USER_FIELDS,
-  buildCookieAttributes,
-  createAuthProviderCookieString,
-  createCsrfToken,
-  createExpiresAtDate,
-  createLoginResponse,
-  createSessionCookieString,
-  sanitizeUser
-};