@cedarjs/auth-dbauth-api 9.0.0-canary.1784 → 9.0.0-canary.3124

package/dist/DbAuthHandler.js

@@ -1,43 +1,41 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var DbAuthHandler_exports = {};
-__export(DbAuthHandler_exports, {
-  DbAuthHandler: () => DbAuthHandler
-});
-module.exports = __toCommonJS(DbAuthHandler_exports);
-var import_base64url = __toESM(require("base64url"));
-var import_md5 = __toESM(require("md5"));
-var import_uuid = require("uuid");
-var import_api = require("@cedarjs/api");
-var DbAuthError = __toESM(require("./errors"));
-var import_shared = require("./shared");
-const DEFAULT_ALLOWED_USER_FIELDS = ["id", "email"];
+import md5 from "md5";
+import { v4 as uuidv4 } from "uuid";
+import {
+  createCorsContext,
+  isFetchApiRequest,
+  normalizeRequest
+} from "@cedarjs/api";
+import * as DbAuthError from "./errors.js";
+import {
+  isProxiedRequest,
+  isRequestOriginTrusted,
+  requiresOriginValidation,
+  resolveRequestHost,
+  resolveRequestProtocol
+} from "./originValidation.js";
+import {
+  buildCookieAttributes,
+  createAuthProviderCookieString,
+  createCsrfToken,
+  createExpiresAtDate,
+  createLoginResponse,
+  createSessionCookieString,
+  DEFAULT_ALLOWED_USER_FIELDS,
+  sanitizeUser
+} from "./session.js";
+import {
+  decryptSession,
+  extractCookie,
+  extractHashingOptions,
+  generateCookieName,
+  getDbAuthResponseBuilder,
+  getSession,
+  hashPassword,
+  hashToken,
+  isLegacySession,
+  legacyHashPassword,
+  webAuthnSession
+} from "./shared.js";
 class DbAuthHandler {
   event;
   _normalizedRequest;
@@ -102,7 +100,7 @@ class DbAuthHandler {
   }
   // generate a new token (standard UUID)
   static get CSRF_TOKEN() {
-    return (0, import_uuid.v4)();
+    return createCsrfToken();
   }
   static get AVAILABLE_WEBAUTHN_TRANSPORTS() {
     return ["usb", "ble", "nfc", "internal"];
@@ -121,7 +119,7 @@ class DbAuthHandler {
     deleteHeaders.append(
       "set-cookie",
       [
-        `${(0, import_shared.generateCookieName)(this.options.cookie?.name)}=`,
+        `${generateCookieName(this.options.cookie?.name)}=`,
         ...this._cookieAttributes({ expires: "now" })
       ].join(";")
     );
@@ -136,31 +134,29 @@ class DbAuthHandler {
   constructor(event, _context, options) {
     this.options = options;
     this.event = event;
-    this.httpMethod = (0, import_api.isFetchApiRequest)(event) ? event.method : event.httpMethod;
-    this.cookie = (0, import_shared.extractCookie)(event) || "";
-    this.createResponse = (0, import_shared.getDbAuthResponseBuilder)(event);
+    this.httpMethod = isFetchApiRequest(event) ? event.method : event.httpMethod;
+    this.cookie = extractCookie(event) || "";
+    this.createResponse = getDbAuthResponseBuilder(event);
     this._validateOptions();
     this.db = this.options.db;
     this.dbAccessor = this.db[this.options.authModelAccessor];
     this.dbCredentialAccessor = this.options.credentialModelAccessor ? this.db[this.options.credentialModelAccessor] : null;
     this.hasInvalidSession = false;
     this.allowedUserFields = this.options.allowedUserFields || DEFAULT_ALLOWED_USER_FIELDS;
-    const sessionExpiresAt = /* @__PURE__ */ new Date();
-    sessionExpiresAt.setSeconds(
-      sessionExpiresAt.getSeconds() + this.options.login.expires
+    this.sessionExpiresDate = createExpiresAtDate(
+      this.options.login.expires
     );
-    this.sessionExpiresDate = sessionExpiresAt.toUTCString();
     const webAuthnExpiresAt = /* @__PURE__ */ new Date();
     webAuthnExpiresAt.setSeconds(
       webAuthnExpiresAt.getSeconds() + (this.options?.webAuthn?.expires || 0)
     );
     this.webAuthnExpiresDate = webAuthnExpiresAt.toUTCString();
     if (options.cors) {
-      this.corsContext = (0, import_api.createCorsContext)(options.cors);
+      this.corsContext = createCorsContext(options.cors);
     }
     try {
-      this.encryptedSession = (0, import_shared.getSession)(this.cookie, this.options.cookie?.name);
-      const [session, csrfToken] = (0, import_shared.decryptSession)(this.encryptedSession);
+      this.encryptedSession = getSession(this.cookie, this.options.cookie?.name);
+      const [session, csrfToken] = decryptSession(this.encryptedSession);
       this.session = session;
       this.sessionCsrfToken = csrfToken;
     } catch (e) {
@@ -175,7 +171,7 @@ class DbAuthHandler {
   // is parsed async
   async init() {
     if (!this._normalizedRequest) {
-      this._normalizedRequest = await (0, import_api.normalizeRequest)(
+      this._normalizedRequest = await normalizeRequest(
         this.event
       );
     }
@@ -205,11 +201,28 @@ class DbAuthHandler {
       if (this.httpMethod !== DbAuthHandler.VERBS[method]) {
         return this.createResponse(this._notFound(), corsHeaders);
       }
+      if (requiresOriginValidation(this.httpMethod) && !isRequestOriginTrusted(
+        {
+          method: this.httpMethod,
+          headers: this.normalizedRequest.headers,
+          host: this._requestHost(),
+          protocol: this._requestProtocol(),
+          proxied: isProxiedRequest(this.normalizedRequest.headers)
+        },
+        {
+          trustedOrigins: this.options.trustedOrigins,
+          corsOrigin: this.options.cors?.origin
+        }
+      )) {
+        throw new DbAuthError.UntrustedOriginError();
+      }
       const [body, headers, options = { statusCode: 200 }] = await this[method]();
       return this.createResponse(this._ok(body, headers, options), corsHeaders);
     } catch (e) {
       if (e instanceof DbAuthError.WrongVerbError) {
         return this.createResponse(this._notFound(), corsHeaders);
+      } else if (e instanceof DbAuthError.UntrustedOriginError) {
+        return this.createResponse(this._forbidden(e.message), corsHeaders);
       } else {
         return this.createResponse(
           this._badRequest(e.message || e),
@@ -218,6 +231,25 @@ class DbAuthHandler {
       }
     }
   }
+  // best-effort host the request was sent to, used by origin validation to
+  // allow same-origin requests through with no extra configuration. Prefers
+  // `X-Forwarded-Host` over the connection-level host/URL -- see
+  // `resolveRequestHost` for why that's safe behind a proxy
+  _requestHost() {
+    return resolveRequestHost(
+      this.normalizedRequest.headers,
+      isFetchApiRequest(this.event) ? this.event.url : void 0
+    );
+  }
+  // best-effort scheme the request arrived over, used alongside
+  // `_requestHost` for origin validation. See `resolveRequestProtocol` for
+  // when it can and can't be determined reliably
+  _requestProtocol() {
+    return resolveRequestProtocol(
+      this.normalizedRequest.headers,
+      isFetchApiRequest(this.event) ? this.event.url : void 0
+    );
+  }
   async forgotPassword() {
     const { enabled = true } = this.options.forgotPassword;
     if (!enabled) {
@@ -244,10 +276,10 @@ class DbAuthHandler {
       tokenExpires.setSeconds(
         tokenExpires.getSeconds() + this.options.forgotPassword.expires
       );
-      let token = (0, import_md5.default)((0, import_uuid.v4)());
+      let token = md5(uuidv4());
       const buffer = Buffer.from(token);
       token = buffer.toString("base64").replace("=", "").substring(0, 16);
-      const tokenHash = (0, import_shared.hashToken)(token);
+      const tokenHash = hashToken(token);
       try {
         user = await this.dbAccessor.update({
           where: {
@@ -276,7 +308,7 @@ class DbAuthHandler {
     try {
       const user = await this._getCurrentUser();
       let headers = new Headers();
-      if ((0, import_shared.isLegacySession)(this.cookie)) {
+      if (isLegacySession(this.cookie)) {
         headers = this._loginResponse(user)[1];
       }
       return [user[this.options.authFields.id], headers];
@@ -327,10 +359,10 @@ class DbAuthHandler {
     ;
     this.options.signup.passwordValidation?.(password);
     let user = await this._findUserByToken(resetToken);
-    const [hashedPassword] = (0, import_shared.hashPassword)(password, {
+    const [hashedPassword] = hashPassword(password, {
       salt: user.salt
     });
-    const [legacyHashedPassword] = (0, import_shared.legacyHashPassword)(password, user.salt);
+    const [legacyHashedPassword] = legacyHashPassword(password, user.salt);
     if (!this.options.resetPassword.allowReusedPassword && user.hashedPassword === hashedPassword || user.hashedPassword === legacyHashedPassword) {
       throw new DbAuthError.ReusedPasswordError(
         this.options.resetPassword?.errors?.reusedPassword
@@ -416,11 +448,9 @@ class DbAuthHandler {
         expectedChallenge: user[this.options.authFields.challenge],
         expectedOrigin: webAuthnOptions.origin,
         expectedRPID: webAuthnOptions.domain,
-        authenticator: {
-          credentialID: import_base64url.default.toBuffer(
-            credential[webAuthnOptions.credentialFields.id]
-          ),
-          credentialPublicKey: credential[webAuthnOptions.credentialFields.publicKey],
+        credential: {
+          id: credential[webAuthnOptions.credentialFields.id],
+          publicKey: credential[webAuthnOptions.credentialFields.publicKey],
           counter: credential[webAuthnOptions.credentialFields.counter],
           transports: credential[webAuthnOptions.credentialFields.transports] ? JSON.parse(
             credential[webAuthnOptions.credentialFields.transports]
@@ -435,16 +465,17 @@ class DbAuthHandler {
       await this._saveChallenge(user[this.options.authFields.id], null);
     }
     const { verified, authenticationInfo } = verification;
-    if (verified) {
-      await this.dbCredentialAccessor.update({
-        where: {
-          [webAuthnOptions.credentialFields.id]: credential[webAuthnOptions.credentialFields.id]
-        },
-        data: {
-          [webAuthnOptions.credentialFields.counter]: authenticationInfo.newCounter
-        }
-      });
+    if (!verified) {
+      throw new DbAuthError.WebAuthnError("Authentication failed");
     }
+    await this.dbCredentialAccessor.update({
+      where: {
+        [webAuthnOptions.credentialFields.id]: credential[webAuthnOptions.credentialFields.id]
+      },
+      data: {
+        [webAuthnOptions.credentialFields.counter]: authenticationInfo.newCounter
+      }
+    });
     const [, headers] = this._loginResponse(user);
     headers.append(
       "set-cookie",
@@ -459,7 +490,7 @@ class DbAuthHandler {
       throw new DbAuthError.WebAuthnError("WebAuthn is not enabled");
     }
     const webAuthnOptions = this.options.webAuthn;
-    const credentialId = (0, import_shared.webAuthnSession)(this.event);
+    const credentialId = webAuthnSession(this.event);
     let user;
     if (credentialId) {
       const credential = await this.dbCredentialAccessor.findUnique({
@@ -485,8 +516,7 @@ class DbAuthHandler {
     const someOptions = {
       timeout: webAuthnOptions.timeout || 6e4,
       allowCredentials: credentials.map((cred) => ({
-        id: import_base64url.default.toBuffer(cred[webAuthnOptions.credentialFields.id]),
-        type: "public-key",
+        id: cred[webAuthnOptions.credentialFields.id],
         transports: cred[webAuthnOptions.credentialFields.transports] ? JSON.parse(cred[webAuthnOptions.credentialFields.transports]) : DbAuthHandler.AVAILABLE_WEBAUTHN_TRANSPORTS
       })),
       userVerification: "required",
@@ -502,6 +532,7 @@ class DbAuthHandler {
   // get options for WebAuthn registration
   async webAuthnRegOptions() {
     const { generateRegistrationOptions } = await import("@simplewebauthn/server");
+    const { isoUint8Array } = await import("@simplewebauthn/server/helpers");
     if (!this.options?.webAuthn?.enabled) {
       throw new DbAuthError.WebAuthnError("WebAuthn is not enabled");
     }
@@ -510,8 +541,11 @@ class DbAuthHandler {
     const options = {
       rpName: webAuthnOptions.name,
       rpID: webAuthnOptions.domain,
-      userID: user[this.options.authFields.id],
+      userID: isoUint8Array.fromUTF8String(
+        String(user[this.options.authFields.id])
+      ),
       userName: user[this.options.authFields.username],
+      userDisplayName: user[this.options.authFields.username],
       timeout: webAuthnOptions?.timeout || 6e4,
       excludeCredentials: [],
       authenticatorSelection: {
@@ -555,36 +589,37 @@ class DbAuthHandler {
       throw new DbAuthError.WebAuthnError(e.message);
     }
     const { verified, registrationInfo } = verification;
-    let plainCredentialId;
-    if (verified && registrationInfo) {
-      const { credentialPublicKey, credentialID, counter } = registrationInfo;
-      plainCredentialId = import_base64url.default.encode(Buffer.from(credentialID));
-      const existingDevice = await this.dbCredentialAccessor.findFirst({
-        where: {
-          [this.options.webAuthn.credentialFields.id]: plainCredentialId,
-          [this.options.webAuthn.credentialFields.userId]: user[this.options.authFields.id]
+    if (!verified || !registrationInfo) {
+      throw new DbAuthError.WebAuthnError("Registration failed");
+    }
+    const {
+      id: credentialID,
+      publicKey: credentialPublicKey,
+      counter
+    } = registrationInfo.credential;
+    const existingDevice = await this.dbCredentialAccessor.findFirst({
+      where: {
+        [this.options.webAuthn.credentialFields.id]: credentialID,
+        [this.options.webAuthn.credentialFields.userId]: user[this.options.authFields.id]
+      }
+    });
+    if (!existingDevice) {
+      const { transports } = this.normalizedRequest.jsonBody || {};
+      await this.dbCredentialAccessor.create({
+        data: {
+          [this.options.webAuthn.credentialFields.id]: credentialID,
+          [this.options.webAuthn.credentialFields.userId]: user[this.options.authFields.id],
+          [this.options.webAuthn.credentialFields.publicKey]: credentialPublicKey,
+          [this.options.webAuthn.credentialFields.transports]: transports ? JSON.stringify(transports) : null,
+          [this.options.webAuthn.credentialFields.counter]: counter
         }
       });
-      if (!existingDevice) {
-        const { transports } = this.normalizedRequest.jsonBody || {};
-        await this.dbCredentialAccessor.create({
-          data: {
-            [this.options.webAuthn.credentialFields.id]: plainCredentialId,
-            [this.options.webAuthn.credentialFields.userId]: user[this.options.authFields.id],
-            [this.options.webAuthn.credentialFields.publicKey]: credentialPublicKey,
-            [this.options.webAuthn.credentialFields.transports]: transports ? JSON.stringify(transports) : null,
-            [this.options.webAuthn.credentialFields.counter]: counter
-          }
-        });
-      }
-    } else {
-      throw new DbAuthError.WebAuthnError("Registration failed");
     }
     await this._saveChallenge(user[this.options.authFields.id], null);
     const headers = new Headers([
       [
         "set-cookie",
-        this._webAuthnCookie(plainCredentialId, this.webAuthnExpiresDate)
+        this._webAuthnCookie(credentialID, this.webAuthnExpiresDate)
       ]
     ]);
     return [verified, headers];
@@ -640,13 +675,7 @@ class DbAuthHandler {
   // removes any fields not explicitly allowed to be sent to the client before
   // sending a response over the wire
   _sanitizeUser(user) {
-    const sanitized = JSON.parse(JSON.stringify(user));
-    Object.keys(sanitized).forEach((key) => {
-      if (!this.allowedUserFields.includes(key)) {
-        delete sanitized[key];
-      }
-    });
-    return sanitized;
+    return sanitizeUser(user, this.allowedUserFields);
   }
   // Converts LambdaEvent or FetchRequest to
   _decodeEvent() {
@@ -659,56 +688,34 @@ class DbAuthHandler {
     expires = "now",
     options = {}
   }) {
-    const userCookieAttributes = this.options.cookie?.attributes ? { ...this.options.cookie?.attributes } : { ...this.options.cookie };
-    if (!this.options.cookie?.attributes) {
-      delete userCookieAttributes.name;
-    }
-    const cookieOptions = { ...userCookieAttributes, ...options };
-    const meta = Object.keys(cookieOptions).map((key) => {
-      const optionValue = cookieOptions[key];
-      if (optionValue === true) {
-        return key;
-      } else if (optionValue === false) {
-        return null;
-      } else {
-        return `${key}=${optionValue}`;
-      }
-    }).filter((v) => v);
-    const expiresAt = expires === "now" ? DbAuthHandler.PAST_EXPIRES_DATE : expires;
-    meta.push(`Expires=${expiresAt}`);
-    return meta;
+    return buildCookieAttributes({
+      cookieConfig: this.options.cookie,
+      expires,
+      overrideAttributes: options
+    });
   }
   _createAuthProviderCookieString() {
-    return [
-      `auth-provider=dbAuth`,
-      ...this._cookieAttributes({ expires: this.sessionExpiresDate })
-    ].join(";");
+    return createAuthProviderCookieString({
+      cookieConfig: this.options.cookie,
+      expiresAt: this.sessionExpiresDate
+    });
   }
   // returns the set-cookie header to be returned in the request (effectively
   // creates the session)
   _createSessionCookieString(data, csrfToken) {
-    const session = JSON.stringify(data) + ";" + csrfToken;
-    const encrypted = (0, import_shared.encryptSession)(session);
-    const sessionCookieString = [
-      `${(0, import_shared.generateCookieName)(this.options.cookie?.name)}=${encrypted}`,
-      ...this._cookieAttributes({ expires: this.sessionExpiresDate })
-    ].join(";");
-    return sessionCookieString;
-  }
-  // checks the CSRF token in the header against the CSRF token in the session
-  // and throw an error if they are not the same (not used yet)
-  async _validateCsrf() {
-    if (this.sessionCsrfToken !== this.normalizedRequest.headers.get("csrf-token")) {
-      throw new DbAuthError.CsrfTokenMismatchError();
-    }
-    return true;
+    return createSessionCookieString({
+      data,
+      csrfToken,
+      cookieConfig: this.options.cookie,
+      expiresAt: this.sessionExpiresDate
+    });
   }
   async _findUserByToken(token) {
     const tokenExpires = /* @__PURE__ */ new Date();
     tokenExpires.setSeconds(
       tokenExpires.getSeconds() - this.options.forgotPassword.expires
     );
-    const tokenHash = (0, import_shared.hashToken)(token);
+    const tokenHash = hashToken(token);
     const user = await this.dbAccessor.findFirst({
       where: {
         [this.options.authFields.resetToken]: tokenHash
@@ -774,11 +781,11 @@ class DbAuthHandler {
   // with the one in the database. Falls back to the legacy CryptoJS algorihtm
   // if no options are present.
   async _verifyPassword(user, password) {
-    const options = (0, import_shared.extractHashingOptions)(
+    const options = extractHashingOptions(
       user[this.options.authFields.hashedPassword]
     );
     if (Object.keys(options).length) {
-      const [hashedPassword] = (0, import_shared.hashPassword)(password, {
+      const [hashedPassword] = hashPassword(password, {
         salt: user[this.options.authFields.salt],
         options
       });
@@ -786,12 +793,12 @@ class DbAuthHandler {
         return user;
       }
     } else {
-      const [legacyHashedPassword] = (0, import_shared.legacyHashPassword)(
+      const [legacyHashedPassword] = legacyHashPassword(
         password,
         user[this.options.authFields.salt]
       );
       if (legacyHashedPassword === user[this.options.authFields.hashedPassword]) {
-        const [newHashedPassword] = (0, import_shared.hashPassword)(password, {
+        const [newHashedPassword] = hashPassword(password, {
           salt: user[this.options.authFields.salt]
         });
         await this.dbAccessor.update({
@@ -850,7 +857,7 @@ class DbAuthHandler {
           this.options.signup?.errors?.usernameTaken
         );
       }
-      const [hashedPassword, salt] = (0, import_shared.hashPassword)(password);
+      const [hashedPassword, salt] = hashPassword(password);
       const newUser = await this.options.signup.handler({
         username,
         hashedPassword,
@@ -884,16 +891,12 @@ class DbAuthHandler {
     }
   }
   _loginResponse(user, statusCode = 200) {
-    const sessionData = this._sanitizeUser(user);
-    const csrfToken = DbAuthHandler.CSRF_TOKEN;
-    const headers = new Headers();
-    headers.append("csrf-token", csrfToken);
-    headers.append("set-cookie", this._createAuthProviderCookieString());
-    headers.append(
-      "set-cookie",
-      this._createSessionCookieString(sessionData, csrfToken)
-    );
-    return [sessionData, headers, { statusCode }];
+    return createLoginResponse(user, {
+      cookie: this.options.cookie,
+      allowedUserFields: this.allowedUserFields,
+      expiresAt: this.sessionExpiresDate,
+      statusCode
+    });
   }
   _logoutResponse(response) {
     return [response ? JSON.stringify(response) : "", this._deleteSessionHeader];
@@ -918,6 +921,13 @@ class DbAuthHandler {
       headers: new Headers({ "content-type": "application/json" })
     };
   }
+  _forbidden(message) {
+    return {
+      statusCode: 403,
+      body: JSON.stringify({ error: message }),
+      headers: new Headers({ "content-type": "application/json" })
+    };
+  }
   _getUserMatchCriteriaOptions(username, usernameMatchFlowOption) {
     const findUniqueUserMatchCriteriaOptions = !usernameMatchFlowOption ? { [this.options.authFields.username]: username } : {
       [this.options.authFields.username]: {
@@ -928,7 +938,6 @@ class DbAuthHandler {
     return findUniqueUserMatchCriteriaOptions;
   }
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
+export {
   DbAuthHandler
-});
+};

package/dist/decoder.js

@@ -1,34 +1,10 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var decoder_exports = {};
-__export(decoder_exports, {
-  authDecoder: () => authDecoder,
-  createAuthDecoder: () => createAuthDecoder
-});
-module.exports = __toCommonJS(decoder_exports);
-var import_shared = require("./shared");
+import { dbAuthSession } from "./shared.js";
 const createAuthDecoder = (cookieNameTemplate) => {
   return async (_token, type, req) => {
     if (type !== "dbAuth") {
       return null;
     }
-    const session = (0, import_shared.dbAuthSession)(req.event, cookieNameTemplate);
+    const session = dbAuthSession(req.event, cookieNameTemplate);
     return session;
   };
 };
@@ -36,11 +12,10 @@ const authDecoder = async (_authHeaderValue, type, req) => {
   if (type !== "dbAuth") {
     return null;
   }
-  const session = (0, import_shared.dbAuthSession)(req.event, void 0);
+  const session = dbAuthSession(req.event, void 0);
   return session;
 };
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
+export {
   authDecoder,
   createAuthDecoder
-});
+};

package/dist/errors.d.ts

@@ -49,8 +49,8 @@ export declare class DuplicateUsernameError extends Error {
 export declare class IncorrectPasswordError extends Error {
     constructor(username: string, message?: string | undefined);
 }
-export declare class CsrfTokenMismatchError extends Error {
-    constructor();
+export declare class UntrustedOriginError extends Error {
+    constructor(message?: string);
 }
 export declare class SessionDecryptionError extends Error {
     constructor();

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAqB,SAAQ,KAAK;;CAO9C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAO/C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;;CAOpD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,IAAI,EAAE,MAAM;CAIzB;AAED,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,UAAU,EAAE,MAAM;CAI/B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAK1C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAExC,QAAQ,GAAE,MAAM,GAAG,SAAqB,EACxC,OAAO,GAAE,MAAM,GAAG,SAA4C;CAUjE;AAED,qBAAa,gCAAiC,SAAQ,KAAK;gBAEvD,OAAO,GAAE,MAAM,GAAG,SAAqD;CAK1E;AAED,qBAAa,aAAc,SAAQ,KAAK;;CAOvC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAEzC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,GAAG,SAAkC;CAKvD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAmD;CAKxE;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAgD;CAKrE;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAwB;CAI5C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAuB;CAI3C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAA2B;CAI/C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAA+B;CAInD;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAwB;CAI5C;AAED,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,SAA2B;CAI/C;AAED,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,SAAmB;CAIvC;AAED,qBAAa,sBAAuB,SAAQ,aAAa;gBAErD,OAAO,SAAyD;CAKnE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAqB,SAAQ,KAAK;;CAO9C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAO/C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;;CAOpD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,IAAI,EAAE,MAAM;CAIzB;AAED,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,UAAU,EAAE,MAAM;CAI/B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAK1C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAExC,QAAQ,GAAE,MAAM,GAAG,SAAqB,EACxC,OAAO,GAAE,MAAM,GAAG,SAA4C;CAUjE;AAED,qBAAa,gCAAiC,SAAQ,KAAK;gBAEvD,OAAO,GAAE,MAAM,GAAG,SAAqD;CAK1E;AAED,qBAAa,aAAc,SAAQ,KAAK;;CAOvC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAEzC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,GAAG,SAAkC;CAKvD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAmD;CAKxE;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,SAAgD;CAKrE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAAkC;CAItD;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAwB;CAI5C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAyB;CAI7C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,SAAuB;CAI3C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAA2B;CAI/C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAA+B;CAInD;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAwB;CAI5C;AAED,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,SAA2B;CAI/C;AAED,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,SAAmB;CAIvC;AAED,qBAAa,sBAAuB,SAAQ,aAAa;gBAErD,OAAO,SAAyD;CAKnE"}