@cedarjs/auth-dbauth-api 7.1.0 → 7.1.1-next.468

package/dist/DbAuthHandler.d.ts

@@ -1,6 +1,7 @@
-import type { AuthenticationResponseJSON, RegistrationResponseJSON } from '@simplewebauthn/types';
+import type { AuthenticationResponseJSON, RegistrationResponseJSON } from '@simplewebauthn/server';
 import type { APIGatewayProxyEvent, Context as LambdaContext } from 'aws-lambda';
 import type { CorsConfig, CorsContext, PartialRequest } from '@cedarjs/api';
+import type { DbAuthCookieConfig } from './session.js';
 interface SignupFlowOptions<TUserAttributes = Record<string, unknown>> {
     /**
      * Allow users to sign up. Defaults to true.
@@ -96,6 +97,33 @@ interface ResetPasswordFlowOptions<TUser = UserType> {
         flowNotEnabled?: string;
     };
 }
+interface ChangePasswordFlowOptions<TUser = UserType> {
+    /**
+     * Allow logged in users to change their password by providing their current
+     * one. Defaults to true.
+     * Needs to be explicitly set to false to disable the flow
+     */
+    enabled?: boolean;
+    /**
+     * Invoked after the new password has been saved. This is where you can
+     * notify the user that their password was changed. Returning anything
+     * truthy keeps the user logged in. Returning anything falsy logs them out.
+     */
+    handler: (user: TUser) => boolean | Promise<boolean>;
+    /**
+     * If `false` (the default) the new password MUST be different from the
+     * current one
+     */
+    allowReusedPassword?: boolean;
+    errors?: {
+        currentPasswordRequired?: string;
+        newPasswordRequired?: string;
+        incorrectCurrentPassword?: string;
+        passwordNotSet?: string;
+        reusedPassword?: string;
+        flowNotEnabled?: string;
+    };
+}
 interface WebAuthnFlowOptions {
     enabled: boolean;
     expires: number;
@@ -168,35 +196,15 @@ export interface DbAuthHandlerOptions<TUser = UserType, TUserAttributes = Record
         challenge?: string;
     };
     /**
-     * Object containing cookie config options
+     * Object containing change password options
      */
-    cookie?: {
-        /** @deprecated set this option in `cookie.attributes` */
-        Path?: string;
-        /** @deprecated set this option in `cookie.attributes` */
-        HttpOnly?: boolean;
-        /** @deprecated set this option in `cookie.attributes` */
-        Secure?: boolean;
-        /** @deprecated set this option in `cookie.attributes` */
-        SameSite?: string;
-        /** @deprecated set this option in `cookie.attributes` */
-        Domain?: string;
-        attributes?: {
-            Path?: string;
-            HttpOnly?: boolean;
-            Secure?: boolean;
-            SameSite?: string;
-            Domain?: string;
-        };
-        /**
-         * The name of the cookie that dbAuth sets
-         *
-         * %port% will be replaced with the port the api server is running on.
-         * If you have multiple RW apps running on the same host, you'll need to
-         * make sure they all use unique cookie names
-         */
-        name?: string;
+    changePassword: ChangePasswordFlowOptions<TUser> | {
+        enabled: false;
     };
+    /**
+     * Object containing cookie config options
+     */
+    cookie?: DbAuthCookieConfig;
     /**
      * Object containing forgot password options
      */
@@ -249,11 +257,13 @@ export interface SignupHandlerOptions<TUserAttributes> {
     salt: string;
     userAttributes?: TUserAttributes;
 }
-export type AuthMethodNames = 'forgotPassword' | 'getToken' | 'login' | 'logout' | 'resetPassword' | 'signup' | 'webAuthnAuthenticate' | 'webAuthnAuthOptions' | 'webAuthnRegOptions' | 'webAuthnRegister' | 'validateResetToken';
+export type AuthMethodNames = 'changePassword' | 'forgotPassword' | 'getToken' | 'login' | 'logout' | 'resetPassword' | 'signup' | 'webAuthnAuthenticate' | 'webAuthnAuthOptions' | 'webAuthnRegOptions' | 'webAuthnRegister' | 'validateResetToken';
 type Params = AuthenticationResponseJSON & RegistrationResponseJSON & {
     username?: string;
     password?: string;
     resetToken?: string;
+    currentPassword?: string;
+    newPassword?: string;
     method: AuthMethodNames;
     [key: string]: any;
 } & {
@@ -290,6 +300,7 @@ export declare class DbAuthHandler<TUser extends UserType, TUserAttributes = Rec
     get normalizedRequest(): PartialRequest<Params>;
     static get METHODS(): AuthMethodNames[];
     static get VERBS(): {
+        changePassword: string;
         forgotPassword: string;
         getToken: string;
         login: string;
@@ -325,6 +336,7 @@ export declare class DbAuthHandler<TUser extends UserType, TUserAttributes = Rec
     }>;
     _requestHost(): string | null;
     _requestProtocol(): string | null;
+    changePassword(): Promise<AuthMethodOutput>;
     forgotPassword(): Promise<AuthMethodOutput>;
     getToken(): Promise<AuthMethodOutput>;
     login(): Promise<AuthMethodOutput>;
@@ -339,25 +351,24 @@ export declare class DbAuthHandler<TUser extends UserType, TUserAttributes = Rec
     _validateOptions(): void;
     _saveChallenge(userId: string | number, value: string | null): Promise<void>;
     _webAuthnCookie(id: string, expires: string): string;
-    _sanitizeUser(user: Record<string, unknown>): any;
+    _sanitizeUser(user: Record<string, unknown>): Record<string, unknown>;
     _decodeEvent(): void;
     _cookieAttributes({ expires, options, }: {
         expires?: 'now' | string;
         options?: DbAuthHandlerOptions['cookie'];
-    }): (string | null)[];
+    }): string[];
     _createAuthProviderCookieString(): string;
     _createSessionCookieString<TIdType = any>(data: DbAuthSession<TIdType>, csrfToken: string): string;
     _findUserByToken(token: string): Promise<any>;
     _clearResetToken(user: Record<string, unknown>): Promise<void>;
     _verifyUser(username: string | undefined, password: string | undefined): Promise<any>;
     _verifyPassword(user: Record<string, unknown>, password: string): Promise<Record<string, unknown>>;
+    _passwordMatches(user: Record<string, unknown>, password: string): boolean;
     _getCurrentUser(): Promise<any>;
     _createUser(): Promise<any>;
     _getAuthMethod(): Promise<AuthMethodNames>;
     _validateField(name: string, value: string | undefined): value is string;
-    _loginResponse(user: Record<string, any>, statusCode?: number): [{
-        id: string;
-    }, Headers, {
+    _loginResponse(user: Record<string, any>, statusCode?: number): [Record<string, any>, Headers, {
         statusCode: number;
     }];
     _logoutResponse(response?: Record<string, unknown>): AuthMethodOutput;

package/dist/DbAuthHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DbAuthHandler.d.ts","sourceRoot":"","sources":["../src/DbAuthHandler.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACzB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,YAAY,CAAA;AAIhF,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AA8B3E,UAAU,iBAAiB,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,eAAe,CAAC,KAAK,GAAG,CAAA;IAE7E;;;OAGG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IAED;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,yBAAyB,CAAC,KAAK,GAAG,QAAQ;IAClD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAA;IAC5C,MAAM,CAAC,EAAE;QACP,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,UAAU,gBAAgB,CAAC,KAAK,GAAG,QAAQ;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,GAAG,CAAA;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,yBAAyB,CAAC,EAAE,MAAM,CAAA;QAClC,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,wBAAwB,CAAC,KAAK,GAAG,QAAQ;IACjD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpD,mBAAmB,EAAE,OAAO,CAAA;IAC5B,MAAM,CAAC,EAAE;QACP,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,gBAAgB,CAAA;IAC3C,gBAAgB,EAAE;QAChB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAA;AAEnD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;IACnC,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;KAC/B,CAAA;IACD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAC,CAAA;AAEF,KAAK,gBAAgB,GAAG;IACtB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,GAAG,SAAS;IAClD,OAAO,CAAC;IACR;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACxB,CAAA;AAED,MAAM,WAAW,oBAAoB,CACnC,KAAK,GAAG,QAAQ,EAChB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C;;;;;;;OAOG;IACH,EAAE,EAAE,GAAG,CAAA;IACP;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,CAAA;IAC5B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,CAAA;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,yDAAyD;QACzD,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,yDAAyD;QACzD,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,yDAAyD;QACzD,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,yDAAyD;QACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,yDAAyD;QACzD,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE;YACX,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,QAAQ,CAAC,EAAE,OAAO,CAAA;YAClB,MAAM,CAAC,EAAE,OAAO,CAAA;YAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;YACjB,MAAM,CAAC,EAAE,MAAM,CAAA;SAChB,CAAA;QACD;;;;;;WAMG;QACH,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;IACD;;OAEG;IACH,cAAc,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACrE;;OAEG;IACH,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnD;;OAEG;IACH,aAAa,EAAE,wBAAwB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnE;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAC,eAAe,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAE/D;;OAEG;IACH,QAAQ,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAEnD;;OAEG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;IAEjB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,oBAAoB,CAAC,eAAe;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC;AAED,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,UAAU,GACV,OAAO,GACP,QAAQ,GACR,eAAe,GACf,QAAQ,GACR,sBAAsB,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,CAAA;AAExB,KAAK,MAAM,GAAG,0BAA0B,GACtC,wBAAwB,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,eAAe,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB,GAAG;IACF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAEH,KAAK,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AACnD,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAIzC,qBAAa,aAAa,CACxB,KAAK,SAAS,QAAQ,EACtB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAA;IACrC,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACtD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,GAAG,CAAA;IACP,UAAU,EAAE,GAAG,CAAA;IACf,oBAAoB,EAAE,GAAG,CAAA;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,OAAO,EAAE,aAAa,GAAG,SAAS,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAA;IACpC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAO;IACtC,cAAc,EAAE,CACd,QAAQ,EAAE;QACR,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,EACD,WAAW,EAAE,WAAW,KACrB;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IAED,IAAW,iBAAiB,2BAS3B;IAGD,MAAM,KAAK,OAAO,IAAI,eAAe,EAAE,CActC;IAGD,MAAM,KAAK,KAAK;;;;;;;;;;;;MAcf;IAGD,MAAM,KAAK,iBAAiB,WAE3B;IAGD,MAAM,KAAK,UAAU,WAEpB;IAED,MAAM,KAAK,6BAA6B,aAEvC;IAED;;;;;;;;OAQG;IACH,IAAI,oBAAoB,IAAI,OAAO,CAmBlC;gBAGC,KAAK,EAAE,oBAAoB,GAAG,OAAO,EACrC,QAAQ,EAAE,aAAa,EAAE,SAAS;IAClC,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC;IA6DtD,IAAI;IAUJ,MAAM;iBAxKD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;eACnC,MAAM,GAAG,SAAS;oBACb,MAAM;;IAqPpB,YAAY,IAAI,MAAM,GAAG,IAAI;IAU7B,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAO3B,cAAc,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2E3C,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAqBrC,KAAK,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAuBxC,MAAM,IAAI,gBAAgB;IAIpB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA0E1C,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA6BnC,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAgB/C,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAgGjD,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAkEhD,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAiD/C,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAuEnD,gBAAgB;IAkEV,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAYlE,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAY3C,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAa3C,YAAY;IAMZ,iBAAiB,CAAC,EAChB,OAAe,EACf,OAAY,GACb,EAAE;QACD,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;QACxB,OAAO,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAA;KACzC;IAmCD,+BAA+B,IAAI,MAAM;IASzC,0BAA0B,CAAC,OAAO,GAAG,GAAG,EACtC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAC5B,SAAS,EAAE,MAAM,GAChB,MAAM;IAWH,gBAAgB,CAAC,KAAK,EAAE,MAAM;IAoC9B,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAiB9C,WAAW,CACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS;IA6CxB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM;IA6C/D,eAAe;IAqCf,WAAW;IAqCX,cAAc;IAqBpB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM;IAYxE,cAAc,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,UAAU,SAAM,GACf,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAkBpD,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB;IAIrE,GAAG,CACD,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5D,OAAO,UAAgB,EACvB,OAAO;;KAAsB;;;;;IAW/B,SAAS;;;IAMT,WAAW,CAAC,OAAO,EAAE,MAAM;;;;;IAQ3B,UAAU,CAAC,OAAO,EAAE,MAAM;;;;;IAQ1B,4BAA4B,CAC1B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,GAAG,SAAS;;;;;;;;CAgB9C"}
+{"version":3,"file":"DbAuthHandler.d.ts","sourceRoot":"","sources":["../src/DbAuthHandler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAG1B,wBAAwB,EAKzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,YAAY,CAAA;AAIhF,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAyB3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAetD,UAAU,iBAAiB,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,eAAe,CAAC,KAAK,GAAG,CAAA;IAE7E;;;OAGG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IAED;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,yBAAyB,CAAC,KAAK,GAAG,QAAQ;IAClD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAA;IAC5C,MAAM,CAAC,EAAE;QACP,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,UAAU,gBAAgB,CAAC,KAAK,GAAG,QAAQ;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,GAAG,CAAA;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,yBAAyB,CAAC,EAAE,MAAM,CAAA;QAClC,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;IACD;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,UAAU,wBAAwB,CAAC,KAAK,GAAG,QAAQ;IACjD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpD,mBAAmB,EAAE,OAAO,CAAA;IAC5B,MAAM,CAAC,EAAE;QACP,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED,UAAU,yBAAyB,CAAC,KAAK,GAAG,QAAQ;IAClD;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpD;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,MAAM,CAAC,EAAE;QACP,uBAAuB,CAAC,EAAE,MAAM,CAAA;QAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;QAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAA;QACjC,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,gBAAgB,CAAA;IAC3C,gBAAgB,EAAE;QAChB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAA;AAEnD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;IACnC,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;KAC/B,CAAA;IACD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAC,CAAA;AAEF,KAAK,gBAAgB,GAAG;IACtB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,GAAG,SAAS;IAClD,OAAO,CAAC;IACR;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACxB,CAAA;AAED,MAAM,WAAW,oBAAoB,CACnC,KAAK,GAAG,QAAQ,EAChB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C;;;;;;;OAOG;IACH,EAAE,EAAE,GAAG,CAAA;IACP;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,CAAA;IAC5B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,CAAA;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD;;OAEG;IACH,cAAc,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACrE;;OAEG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAA;IAC3B;;OAEG;IACH,cAAc,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACrE;;OAEG;IACH,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnD;;OAEG;IACH,aAAa,EAAE,wBAAwB,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IACnE;;OAEG;IACH,MAAM,EAAE,iBAAiB,CAAC,eAAe,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAE/D;;OAEG;IACH,QAAQ,CAAC,EAAE,mBAAmB,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAA;IAEnD;;OAEG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;IAEjB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,oBAAoB,CAAC,eAAe;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC;AAED,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,gBAAgB,GAChB,UAAU,GACV,OAAO,GACP,QAAQ,GACR,eAAe,GACf,QAAQ,GACR,sBAAsB,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,CAAA;AAExB,KAAK,MAAM,GAAG,0BAA0B,GACtC,wBAAwB,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,eAAe,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB,GAAG;IACF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAEH,KAAK,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AACnD,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAEzC,qBAAa,aAAa,CACxB,KAAK,SAAS,QAAQ,EACtB,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,GAAG,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE5C,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAA;IACrC,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACtD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,GAAG,CAAA;IACP,UAAU,EAAE,GAAG,CAAA;IACf,oBAAoB,EAAE,GAAG,CAAA;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,OAAO,EAAE,aAAa,GAAG,SAAS,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAA;IACpC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAO;IACtC,cAAc,EAAE,CACd,QAAQ,EAAE;QACR,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,EACD,WAAW,EAAE,WAAW,KACrB;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IAED,IAAW,iBAAiB,2BAS3B;IAGD,MAAM,KAAK,OAAO,IAAI,eAAe,EAAE,CAetC;IAGD,MAAM,KAAK,KAAK;;;;;;;;;;;;;MAef;IAGD,MAAM,KAAK,iBAAiB,WAE3B;IAGD,MAAM,KAAK,UAAU,WAEpB;IAED,MAAM,KAAK,6BAA6B,aAEvC;IAED;;;;;;;;OAQG;IACH,IAAI,oBAAoB,IAAI,OAAO,CAmBlC;gBAGC,KAAK,EAAE,oBAAoB,GAAG,OAAO,EACrC,QAAQ,EAAE,aAAa,EAAE,SAAS;IAClC,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC;IA0DtD,IAAI;IAUJ,MAAM;iBAvKD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;eACnC,MAAM,GAAG,SAAS;oBACb,MAAM;;IAoPpB,YAAY,IAAI,MAAM,GAAG,IAAI;IAU7B,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAO3B,cAAc,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAkH3C,cAAc,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2E3C,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAqBrC,KAAK,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAuBxC,MAAM,IAAI,gBAAgB;IAIpB,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA0E1C,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA6BnC,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAgB/C,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA+FjD,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAkEhD,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAiD/C,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA2EnD,gBAAgB;IA4EV,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAYlE,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAY3C,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAK3C,YAAY;IAMZ,iBAAiB,CAAC,EAChB,OAAe,EACf,OAAY,GACb,EAAE;QACD,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;QACxB,OAAO,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAA;KACzC;IAQD,+BAA+B,IAAI,MAAM;IASzC,0BAA0B,CAAC,OAAO,GAAG,GAAG,EACtC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAC5B,SAAS,EAAE,MAAM,GAChB,MAAM;IASH,gBAAgB,CAAC,KAAK,EAAE,MAAM;IAoC9B,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAiB9C,WAAW,CACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS;IA6CxB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM;IA+CrE,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM;IAa1D,eAAe;IAqCf,WAAW;IAqCX,cAAc;IAqBpB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM;IAYxE,cAAc,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,UAAU,SAAM,GACf,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IASzD,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB;IAIrE,GAAG,CACD,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5D,OAAO,UAAgB,EACvB,OAAO;;KAAsB;;;;;IAW/B,SAAS;;;IAMT,WAAW,CAAC,OAAO,EAAE,MAAM;;;;;IAQ3B,UAAU,CAAC,OAAO,EAAE,MAAM;;;;;IAQ1B,4BAA4B,CAC1B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,GAAG,SAAS;;;;;;;;CAgB9C"}

package/dist/DbAuthHandler.js

@@ -13,9 +13,18 @@ import {
   resolveRequestHost,
   resolveRequestProtocol
 } from "./originValidation.js";
+import {
+  buildCookieAttributes,
+  createAuthProviderCookieString,
+  createCsrfToken,
+  createExpiresAtDate,
+  createLoginResponse,
+  createSessionCookieString,
+  DEFAULT_ALLOWED_USER_FIELDS,
+  sanitizeUser
+} from "./session.js";
 import {
   decryptSession,
-  encryptSession,
   extractCookie,
   extractHashingOptions,
   generateCookieName,
@@ -27,7 +36,6 @@ import {
   legacyHashPassword,
   webAuthnSession
 } from "./shared.js";
-const DEFAULT_ALLOWED_USER_FIELDS = ["id", "email"];
 class DbAuthHandler {
   event;
   _normalizedRequest;
@@ -57,6 +65,7 @@ class DbAuthHandler {
   // class constant: list of auth methods that are supported
   static get METHODS() {
     return [
+      "changePassword",
       "forgotPassword",
       "getToken",
       "login",
@@ -73,6 +82,7 @@ class DbAuthHandler {
   // class constant: maps the auth functions to their required HTTP verb for access
   static get VERBS() {
     return {
+      changePassword: "POST",
       forgotPassword: "POST",
       getToken: "GET",
       login: "POST",
@@ -92,7 +102,7 @@ class DbAuthHandler {
   }
   // generate a new token (standard UUID)
   static get CSRF_TOKEN() {
-    return uuidv4();
+    return createCsrfToken();
   }
   static get AVAILABLE_WEBAUTHN_TRANSPORTS() {
     return ["usb", "ble", "nfc", "internal"];
@@ -135,11 +145,9 @@ class DbAuthHandler {
     this.dbCredentialAccessor = this.options.credentialModelAccessor ? this.db[this.options.credentialModelAccessor] : null;
     this.hasInvalidSession = false;
     this.allowedUserFields = this.options.allowedUserFields || DEFAULT_ALLOWED_USER_FIELDS;
-    const sessionExpiresAt = /* @__PURE__ */ new Date();
-    sessionExpiresAt.setSeconds(
-      sessionExpiresAt.getSeconds() + this.options.login.expires
+    this.sessionExpiresDate = createExpiresAtDate(
+      this.options.login.expires
     );
-    this.sessionExpiresDate = sessionExpiresAt.toUTCString();
     const webAuthnExpiresAt = /* @__PURE__ */ new Date();
     webAuthnExpiresAt.setSeconds(
       webAuthnExpiresAt.getSeconds() + (this.options?.webAuthn?.expires || 0)
@@ -244,6 +252,83 @@ class DbAuthHandler {
       isFetchApiRequest(this.event) ? this.event.url : void 0
     );
   }
+  async changePassword() {
+    const options = this.options.changePassword;
+    if (!options || options.enabled === false) {
+      throw new DbAuthError.FlowNotEnabledError(
+        options?.errors?.flowNotEnabled || `Change password flow is not enabled`
+      );
+    }
+    const sessionUserId = this.session?.[this.options.authFields.id];
+    if (!sessionUserId) {
+      throw new DbAuthError.NotLoggedInError();
+    }
+    const { currentPassword, newPassword } = this.normalizedRequest.jsonBody || {};
+    if (currentPassword == null || String(currentPassword).trim() === "") {
+      throw new DbAuthError.PasswordRequiredError(
+        options.errors?.currentPasswordRequired || "Current password is required"
+      );
+    }
+    if (newPassword == null || String(newPassword).trim() === "") {
+      throw new DbAuthError.PasswordRequiredError(
+        options.errors?.newPasswordRequired || "New password is required"
+      );
+    }
+    ;
+    this.options.signup.passwordValidation?.(
+      newPassword
+    );
+    let user;
+    try {
+      user = await this.dbAccessor.findUnique({
+        where: { [this.options.authFields.id]: sessionUserId }
+      });
+    } catch {
+      throw new DbAuthError.GenericError();
+    }
+    if (!user) {
+      throw new DbAuthError.UserNotFoundError();
+    }
+    if (!user[this.options.authFields.hashedPassword]) {
+      throw new DbAuthError.PasswordNotSetError(options.errors?.passwordNotSet);
+    }
+    try {
+      await this._verifyPassword(user, currentPassword);
+    } catch (e) {
+      if (e instanceof DbAuthError.IncorrectPasswordError) {
+        throw new DbAuthError.IncorrectPasswordError(
+          user[this.options.authFields.username],
+          options.errors?.incorrectCurrentPassword || "Current password is incorrect"
+        );
+      }
+      throw e;
+    }
+    if (!options.allowReusedPassword && this._passwordMatches(user, newPassword)) {
+      throw new DbAuthError.ReusedPasswordError(options.errors?.reusedPassword);
+    }
+    const [hashedPassword, salt] = hashPassword(newPassword);
+    try {
+      user = await this.dbAccessor.update({
+        where: {
+          [this.options.authFields.id]: user[this.options.authFields.id]
+        },
+        data: {
+          [this.options.authFields.hashedPassword]: hashedPassword,
+          [this.options.authFields.salt]: salt,
+          [this.options.authFields.resetToken]: null,
+          [this.options.authFields.resetTokenExpiresAt]: null
+        }
+      });
+    } catch {
+      throw new DbAuthError.GenericError();
+    }
+    const response = await options.handler(this._sanitizeUser(user));
+    if (response) {
+      return this._loginResponse(user);
+    } else {
+      return this._logoutResponse({});
+    }
+  }
   async forgotPassword() {
     const { enabled = true } = this.options.forgotPassword;
     if (!enabled) {
@@ -442,9 +527,9 @@ class DbAuthHandler {
         expectedChallenge: user[this.options.authFields.challenge],
         expectedOrigin: webAuthnOptions.origin,
         expectedRPID: webAuthnOptions.domain,
-        authenticator: {
-          credentialID: credential[webAuthnOptions.credentialFields.id],
-          credentialPublicKey: credential[webAuthnOptions.credentialFields.publicKey],
+        credential: {
+          id: credential[webAuthnOptions.credentialFields.id],
+          publicKey: credential[webAuthnOptions.credentialFields.publicKey],
           counter: credential[webAuthnOptions.credentialFields.counter],
           transports: credential[webAuthnOptions.credentialFields.transports] ? JSON.parse(
             credential[webAuthnOptions.credentialFields.transports]
@@ -586,7 +671,11 @@ class DbAuthHandler {
     if (!verified || !registrationInfo) {
       throw new DbAuthError.WebAuthnError("Registration failed");
     }
-    const { credentialPublicKey, credentialID, counter } = registrationInfo;
+    const {
+      id: credentialID,
+      publicKey: credentialPublicKey,
+      counter
+    } = registrationInfo.credential;
     const existingDevice = await this.dbCredentialAccessor.findFirst({
       where: {
         [this.options.webAuthn.credentialFields.id]: credentialID,
@@ -634,6 +723,9 @@ class DbAuthHandler {
     if (this.options?.resetPassword?.enabled !== false && !this.options?.resetPassword?.handler) {
       throw new DbAuthError.NoResetPasswordHandlerError();
     }
+    if (this.options?.changePassword && this.options.changePassword.enabled !== false && !this.options.changePassword.handler) {
+      throw new DbAuthError.NoChangePasswordHandlerError();
+    }
     if (this.options?.credentialModelAccessor && !this.options?.webAuthn || this.options?.webAuthn && !this.options?.credentialModelAccessor) {
       throw new DbAuthError.NoWebAuthnConfigError();
     }
@@ -665,13 +757,7 @@ class DbAuthHandler {
   // removes any fields not explicitly allowed to be sent to the client before
   // sending a response over the wire
   _sanitizeUser(user) {
-    const sanitized = JSON.parse(JSON.stringify(user));
-    Object.keys(sanitized).forEach((key) => {
-      if (!this.allowedUserFields.includes(key)) {
-        delete sanitized[key];
-      }
-    });
-    return sanitized;
+    return sanitizeUser(user, this.allowedUserFields);
   }
   // Converts LambdaEvent or FetchRequest to
   _decodeEvent() {
@@ -684,41 +770,27 @@ class DbAuthHandler {
     expires = "now",
     options = {}
   }) {
-    const userCookieAttributes = this.options.cookie?.attributes ? { ...this.options.cookie?.attributes } : { ...this.options.cookie };
-    if (!this.options.cookie?.attributes) {
-      delete userCookieAttributes.name;
-    }
-    const cookieOptions = { ...userCookieAttributes, ...options };
-    const meta = Object.keys(cookieOptions).map((key) => {
-      const optionValue = cookieOptions[key];
-      if (optionValue === true) {
-        return key;
-      } else if (optionValue === false) {
-        return null;
-      } else {
-        return `${key}=${optionValue}`;
-      }
-    }).filter((v) => v);
-    const expiresAt = expires === "now" ? DbAuthHandler.PAST_EXPIRES_DATE : expires;
-    meta.push(`Expires=${expiresAt}`);
-    return meta;
+    return buildCookieAttributes({
+      cookieConfig: this.options.cookie,
+      expires,
+      overrideAttributes: options
+    });
   }
   _createAuthProviderCookieString() {
-    return [
-      `auth-provider=dbAuth`,
-      ...this._cookieAttributes({ expires: this.sessionExpiresDate })
-    ].join(";");
+    return createAuthProviderCookieString({
+      cookieConfig: this.options.cookie,
+      expiresAt: this.sessionExpiresDate
+    });
   }
   // returns the set-cookie header to be returned in the request (effectively
   // creates the session)
   _createSessionCookieString(data, csrfToken) {
-    const session = JSON.stringify(data) + ";" + csrfToken;
-    const encrypted = encryptSession(session);
-    const sessionCookieString = [
-      `${generateCookieName(this.options.cookie?.name)}=${encrypted}`,
-      ...this._cookieAttributes({ expires: this.sessionExpiresDate })
-    ].join(";");
-    return sessionCookieString;
+    return createSessionCookieString({
+      data,
+      csrfToken,
+      cookieConfig: this.options.cookie,
+      expiresAt: this.sessionExpiresDate
+    });
   }
   async _findUserByToken(token) {
     const tokenExpires = /* @__PURE__ */ new Date();
@@ -823,6 +895,16 @@ class DbAuthHandler {
       this.options.login?.errors?.incorrectPassword
     );
   }
+  // compares a plain text password with the user's stored hash, using the
+  // same algorithm and options the stored hash was created with. Unlike
+  // `_verifyPassword` this has no side effects and does not throw
+  _passwordMatches(user, password) {
+    const storedHash = user[this.options.authFields.hashedPassword];
+    const salt = user[this.options.authFields.salt];
+    const options = extractHashingOptions(storedHash);
+    const [hashedPassword] = Object.keys(options).length ? hashPassword(password, { salt, options }) : legacyHashPassword(password, salt);
+    return hashedPassword === storedHash;
+  }
   // gets the user from the database and returns only its ID
   async _getCurrentUser() {
     if (!this.session?.[this.options.authFields.id]) {
@@ -901,16 +983,12 @@ class DbAuthHandler {
     }
   }
   _loginResponse(user, statusCode = 200) {
-    const sessionData = this._sanitizeUser(user);
-    const csrfToken = DbAuthHandler.CSRF_TOKEN;
-    const headers = new Headers();
-    headers.append("csrf-token", csrfToken);
-    headers.append("set-cookie", this._createAuthProviderCookieString());
-    headers.append(
-      "set-cookie",
-      this._createSessionCookieString(sessionData, csrfToken)
-    );
-    return [sessionData, headers, { statusCode }];
+    return createLoginResponse(user, {
+      cookie: this.options.cookie,
+      allowedUserFields: this.allowedUserFields,
+      expiresAt: this.sessionExpiresDate,
+      statusCode
+    });
   }
   _logoutResponse(response) {
     return [response ? JSON.stringify(response) : "", this._deleteSessionHeader];

package/dist/errors.d.ts

@@ -16,6 +16,9 @@ export declare class NoForgotPasswordHandlerError extends Error {
 export declare class NoResetPasswordHandlerError extends Error {
     constructor();
 }
+export declare class NoChangePasswordHandlerError extends Error {
+    constructor();
+}
 export declare class NoWebAuthnConfigError extends Error {
     constructor();
 }
@@ -79,6 +82,9 @@ export declare class ResetTokenRequiredError extends Error {
 export declare class ReusedPasswordError extends Error {
     constructor(message?: string);
 }
+export declare class PasswordNotSetError extends Error {
+    constructor(message?: string);
+}
 export declare class PasswordValidationError extends Error {
     constructor(message?: string);
 }

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAqB,SAAQ,KAAK;;CAO9C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAO/C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;;CAOpD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,IAAI,EAAE,MAAM;CAIzB;AAED,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,UAAU,EAAE,MAAM;CAI/B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAK1C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAExC,QAAQ,GAAE,MAAM,GAAG,SAAqB,EACxC,OAAO,GAAE,MAAM,GAAG,SAA4C;CAUjE;AAED,qBAAa,gCAAiC,SAAQ,KAAK;gBAEvD,OAAO,GAAE,MAAM,GAAG,SAAqD;CAK1E;AAED,qBAAa,aAAc,SAAQ,KAAK;;CAOvC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAEzC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,GAAG,SAAkC;CAKvD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAmD;CAKxE;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAgD;CAKrE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAAkC;CAItD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAwB;CAI5C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAuB;CAI3C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAA2B;CAI/C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAA+B;CAInD;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAwB;CAI5C;AAED,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,SAA2B;CAI/C;AAED,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,SAAmB;CAIvC;AAED,qBAAa,sBAAuB,SAAQ,aAAa;gBAErD,OAAO,SAAyD;CAKnE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAqB,SAAQ,KAAK;;CAO9C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAO/C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;;CAOpD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,IAAI,EAAE,MAAM;CAIzB;AAED,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,UAAU,EAAE,MAAM;CAI/B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAK1C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAExC,QAAQ,GAAE,MAAM,GAAG,SAAqB,EACxC,OAAO,GAAE,MAAM,GAAG,SAA4C;CAUjE;AAED,qBAAa,gCAAiC,SAAQ,KAAK;gBAEvD,OAAO,GAAE,MAAM,GAAG,SAAqD;CAK1E;AAED,qBAAa,aAAc,SAAQ,KAAK;;CAOvC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAEzC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,GAAG,SAAkC;CAKvD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAmD;CAKxE;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAgD;CAKrE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAAkC;CAItD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAwB;CAI5C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAuB;CAI3C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAA2B;CAI/C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAA+B;CAInD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAE1C,OAAO,SAA4E;CAKtF;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAwB;CAI5C;AAED,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,SAA2B;CAI/C;AAED,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,SAAmB;CAIvC;AAED,qBAAa,sBAAuB,SAAQ,aAAa;gBAErD,OAAO,SAAyD;CAKnE"}

package/dist/errors.js

@@ -36,6 +36,12 @@ class NoResetPasswordHandlerError extends Error {
     this.name = "NoResetPasswordHandlerError";
   }
 }
+class NoChangePasswordHandlerError extends Error {
+  constructor() {
+    super("dbAuth requires a change password handler in order to notify user");
+    this.name = "NoChangePasswordHandlerError";
+  }
+}
 class NoWebAuthnConfigError extends Error {
   constructor() {
     super(
@@ -172,6 +178,12 @@ class ReusedPasswordError extends Error {
     this.name = "ReusedPasswordError";
   }
 }
+class PasswordNotSetError extends Error {
+  constructor(message = 'This account does not have a password. Use "Forgot password" to set one') {
+    super(message);
+    this.name = "PasswordNotSetError";
+  }
+}
 class PasswordValidationError extends Error {
   constructor(message = "Password is invalid") {
     super(message);
@@ -203,6 +215,7 @@ export {
   GenericError,
   IncorrectPasswordError,
   MissingWebAuthnConfigError,
+  NoChangePasswordHandlerError,
   NoForgotPasswordHandlerError,
   NoLoginHandlerError,
   NoResetPasswordHandlerError,
@@ -213,6 +226,7 @@ export {
   NoWebAuthnConfigError,
   NoWebAuthnSessionError,
   NotLoggedInError,
+  PasswordNotSetError,
   PasswordRequiredError,
   PasswordValidationError,
   ResetTokenExpiredError,

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from './DbAuthHandler.js';
 export { PasswordValidationError } from './errors.js';
+export * from './session.js';
 export * from './shared.js';
 export { authDecoder, createAuthDecoder } from './decoder.js';
 export * from './originValidation.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC7D,cAAc,uBAAuB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC7D,cAAc,uBAAuB,CAAA"}

package/dist/index.js

@@ -1,5 +1,6 @@
 export * from "./DbAuthHandler.js";
 import { PasswordValidationError } from "./errors.js";
+export * from "./session.js";
 export * from "./shared.js";
 import { authDecoder, createAuthDecoder } from "./decoder.js";
 export * from "./originValidation.js";

package/dist/session.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Cookie attributes that can be set on a dbAuth cookie, either as
+ * `cookie.attributes` or (deprecated) directly on `cookie`.
+ */
+export interface DbAuthCookieAttributes {
+    Path?: string;
+    HttpOnly?: boolean;
+    Secure?: boolean;
+    SameSite?: string;
+    Domain?: string;
+}
+/**
+ * Configuration for the cookies dbAuth sets: the session cookie's name, and
+ * the attributes applied to every cookie dbAuth writes (the session cookie
+ * and the `auth-provider` cookie).
+ */
+export interface DbAuthCookieConfig extends DbAuthCookieAttributes {
+    attributes?: DbAuthCookieAttributes;
+    /**
+     * The name of the cookie that dbAuth sets
+     *
+     * %port% will be replaced with the port the api server is running on.
+     * If you have multiple RW apps running on the same host, you'll need to
+     * make sure they all use unique cookie names
+     */
+    name?: string;
+}
+/**
+ * Returns a UTC date string `expiresInSeconds` seconds in the future. Used as
+ * the `Expires` cookie attribute for a session that should stay valid for
+ * that long from now.
+ */
+export declare function createExpiresAtDate(expiresInSeconds: number): string;
+/**
+ * Generates a new CSRF token (a standard UUID) to pair with a session.
+ */
+export declare function createCsrfToken(): string;
+/**
+ * Removes any fields not explicitly allowed to be sent to the client before
+ * sending a user record over the wire.
+ */
+export declare function sanitizeUser(user: Record<string, unknown>, allowedUserFields: string[]): Record<string, unknown>;
+/**
+ * Builds the Set-Cookie attribute strings (`Path`, `HttpOnly`, `SameSite`,
+ * `Secure`, `Domain`, `Expires`) for a dbAuth cookie.
+ *
+ * Pass `expires: 'now'` (the default) to get the attributes needed to expire
+ * the cookie, or a UTC date string (e.g. from `createExpiresAtDate`) to set a
+ * future expiration.
+ */
+export declare function buildCookieAttributes({ cookieConfig, expires, overrideAttributes, }: {
+    cookieConfig?: DbAuthCookieConfig;
+    expires?: 'now' | string;
+    overrideAttributes?: DbAuthCookieAttributes;
+}): string[];
+/**
+ * Builds the Set-Cookie header string for the `auth-provider` cookie dbAuth
+ * sets alongside the session cookie.
+ */
+export declare function createAuthProviderCookieString({ cookieConfig, expiresAt, }: {
+    cookieConfig?: DbAuthCookieConfig;
+    expiresAt: string;
+}): string;
+/**
+ * Builds the Set-Cookie header string for the dbAuth session cookie: the
+ * `data;csrfToken` payload, encrypted, under the configured cookie name and
+ * attributes.
+ */
+export declare function createSessionCookieString<TIdType = unknown>({ data, csrfToken, cookieConfig, expiresAt, }: {
+    data: Record<string, TIdType>;
+    csrfToken: string;
+    cookieConfig?: DbAuthCookieConfig;
+    expiresAt: string;
+}): string;
+/** Fields returned from the user record when none are explicitly allowed */
+export declare const DEFAULT_ALLOWED_USER_FIELDS: string[];
+export interface CreateLoginResponseOptions {
+    /**
+     * Object containing cookie config options: the cookie name (with %port%
+     * support) and the attributes applied to it (`Path`, `HttpOnly`,
+     * `SameSite`, `Secure`, `Domain`).
+     */
+    cookie?: DbAuthCookieConfig;
+    /**
+     * The fields that are allowed to be returned from the user record.
+     * Defaults to `id` and `email`.
+     */
+    allowedUserFields?: string[];
+    /**
+     * The `Expires` cookie attribute value for the session and `auth-provider`
+     * cookies: a UTC date string in the future. Build one with
+     * `createExpiresAtDate(expiresInSeconds)`.
+     */
+    expiresAt: string;
+    /**
+     * The HTTP status code to return in the response tuple. Defaults to 200.
+     */
+    statusCode?: number;
+}
+/**
+ * Mints a dbAuth session for the given user: a CSRF token, a session cookie
+ * (the sanitized user data paired with the CSRF token, encrypted), and the
+ * `auth-provider` cookie, in the same `[body, headers, { statusCode }]` shape
+ * every dbAuth auth method returns.
+ *
+ * Callable without a `DbAuthHandler` instance, so any code that has already
+ * verified a user's identity — a WebAuthn assertion, an OAuth callback, a
+ * magic link — can issue a session the same way the built-in login flow
+ * does.
+ */
+export declare function createLoginResponse(user: Record<string, unknown>, options: CreateLoginResponseOptions): [Record<string, unknown>, Headers, {
+    statusCode: number;
+}];
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IAChE,UAAU,CAAC,EAAE,sBAAsB,CAAA;IACnC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAOD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,iBAAiB,EAAE,MAAM,EAAE,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,YAAY,EACZ,OAAe,EACf,kBAAuB,GACxB,EAAE;IACD,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACxB,kBAAkB,CAAC,EAAE,sBAAsB,CAAA;CAC5C,GAAG,MAAM,EAAE,CAiCX;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,YAAY,EACZ,SAAS,GACV,EAAE;IACD,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,CAKT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAG,OAAO,EAAE,EAC3D,IAAI,EACJ,SAAS,EACT,YAAY,EACZ,SAAS,GACV,EAAE;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,CAQT;AAED,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,UAAkB,CAAA;AAE1D,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAA;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,0BAA0B,GAClC,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CA+B5D"}

package/dist/session.js

@@ -0,0 +1,103 @@
+import { v4 as uuidv4 } from "uuid";
+import { encryptSession, generateCookieName } from "./shared.js";
+const PAST_EXPIRES_DATE = (/* @__PURE__ */ new Date(
+  "1970-01-01T00:00:00.000+00:00"
+)).toUTCString();
+function createExpiresAtDate(expiresInSeconds) {
+  const expiresAt = /* @__PURE__ */ new Date();
+  expiresAt.setSeconds(expiresAt.getSeconds() + expiresInSeconds);
+  return expiresAt.toUTCString();
+}
+function createCsrfToken() {
+  return uuidv4();
+}
+function sanitizeUser(user, allowedUserFields) {
+  const sanitized = JSON.parse(JSON.stringify(user));
+  Object.keys(sanitized).forEach((key) => {
+    if (!allowedUserFields.includes(key)) {
+      delete sanitized[key];
+    }
+  });
+  return sanitized;
+}
+function buildCookieAttributes({
+  cookieConfig,
+  expires = "now",
+  overrideAttributes = {}
+}) {
+  const userCookieAttributes = cookieConfig?.attributes ? { ...cookieConfig.attributes } : { ...cookieConfig };
+  if (!cookieConfig?.attributes) {
+    delete userCookieAttributes.name;
+  }
+  const cookieOptions = { ...userCookieAttributes, ...overrideAttributes };
+  const meta = Object.keys(cookieOptions).map((key) => {
+    const optionValue = cookieOptions[key];
+    if (optionValue === true) {
+      return key;
+    } else if (optionValue === false) {
+      return null;
+    } else {
+      return `${key}=${optionValue}`;
+    }
+  }).filter((v) => v !== null);
+  const expiresAt = expires === "now" ? PAST_EXPIRES_DATE : expires;
+  meta.push(`Expires=${expiresAt}`);
+  return meta;
+}
+function createAuthProviderCookieString({
+  cookieConfig,
+  expiresAt
+}) {
+  return [
+    `auth-provider=dbAuth`,
+    ...buildCookieAttributes({ cookieConfig, expires: expiresAt })
+  ].join(";");
+}
+function createSessionCookieString({
+  data,
+  csrfToken,
+  cookieConfig,
+  expiresAt
+}) {
+  const session = JSON.stringify(data) + ";" + csrfToken;
+  const encrypted = encryptSession(session);
+  return [
+    `${generateCookieName(cookieConfig?.name)}=${encrypted}`,
+    ...buildCookieAttributes({ cookieConfig, expires: expiresAt })
+  ].join(";");
+}
+const DEFAULT_ALLOWED_USER_FIELDS = ["id", "email"];
+function createLoginResponse(user, options) {
+  const allowedUserFields = options.allowedUserFields ?? DEFAULT_ALLOWED_USER_FIELDS;
+  const sessionData = sanitizeUser(user, allowedUserFields);
+  const csrfToken = createCsrfToken();
+  const headers = new Headers();
+  headers.append("csrf-token", csrfToken);
+  headers.append(
+    "set-cookie",
+    createAuthProviderCookieString({
+      cookieConfig: options.cookie,
+      expiresAt: options.expiresAt
+    })
+  );
+  headers.append(
+    "set-cookie",
+    createSessionCookieString({
+      data: sessionData,
+      csrfToken,
+      cookieConfig: options.cookie,
+      expiresAt: options.expiresAt
+    })
+  );
+  return [sessionData, headers, { statusCode: options.statusCode ?? 200 }];
+}
+export {
+  DEFAULT_ALLOWED_USER_FIELDS,
+  buildCookieAttributes,
+  createAuthProviderCookieString,
+  createCsrfToken,
+  createExpiresAtDate,
+  createLoginResponse,
+  createSessionCookieString,
+  sanitizeUser
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/auth-dbauth-api",
-  "version": "7.1.0",
+  "version": "7.1.1-next.468",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -57,22 +57,29 @@
     "test:watch": "vitest watch"
   },
   "dependencies": {
-    "@cedarjs/project-config": "7.1.0",
+    "@cedarjs/project-config": "7.1.1-next.468",
     "md5": "2.3.0",
     "uuid": "11.1.1"
   },
   "devDependencies": {
-    "@cedarjs/api": "7.1.0",
-    "@cedarjs/framework-tools": "7.1.0",
-    "@simplewebauthn/server": "10.0.1",
-    "@simplewebauthn/types": "10.0.0",
-    "@types/aws-lambda": "8.10.163",
+    "@cedarjs/api": "7.1.1-next.468",
+    "@cedarjs/framework-tools": "7.1.1-next.468",
+    "@simplewebauthn/server": "13.3.3",
+    "@types/aws-lambda": "8.10.164",
     "@types/md5": "2.3.6",
-    "concurrently": "9.2.4",
-    "publint": "0.3.24",
+    "concurrently": "9.2.5",
+    "publint": "0.3.25",
     "typescript": "5.9.3",
     "vitest": "4.1.11"
   },
+  "peerDependencies": {
+    "@simplewebauthn/server": "^13.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@simplewebauthn/server": {
+      "optional": true
+    }
+  },
   "engines": {
     "node": ">=24"
   },