@cedarjs/auth-dbauth-api 9.0.0-canary.1784 → 9.0.0-canary.3124

package/dist/errors.js

@@ -1,56 +1,3 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var errors_exports = {};
-__export(errors_exports, {
-  CsrfTokenMismatchError: () => CsrfTokenMismatchError,
-  DuplicateUsernameError: () => DuplicateUsernameError,
-  FieldRequiredError: () => FieldRequiredError,
-  FlowNotEnabledError: () => FlowNotEnabledError,
-  GenericError: () => GenericError,
-  IncorrectPasswordError: () => IncorrectPasswordError,
-  MissingWebAuthnConfigError: () => MissingWebAuthnConfigError,
-  NoForgotPasswordHandlerError: () => NoForgotPasswordHandlerError,
-  NoLoginHandlerError: () => NoLoginHandlerError,
-  NoResetPasswordHandlerError: () => NoResetPasswordHandlerError,
-  NoSessionExpirationError: () => NoSessionExpirationError,
-  NoSessionSecretError: () => NoSessionSecretError,
-  NoSignupHandlerError: () => NoSignupHandlerError,
-  NoUserIdError: () => NoUserIdError,
-  NoWebAuthnConfigError: () => NoWebAuthnConfigError,
-  NoWebAuthnSessionError: () => NoWebAuthnSessionError,
-  NotLoggedInError: () => NotLoggedInError,
-  PasswordRequiredError: () => PasswordRequiredError,
-  PasswordValidationError: () => PasswordValidationError,
-  ResetTokenExpiredError: () => ResetTokenExpiredError,
-  ResetTokenInvalidError: () => ResetTokenInvalidError,
-  ResetTokenRequiredError: () => ResetTokenRequiredError,
-  ReusedPasswordError: () => ReusedPasswordError,
-  SessionDecryptionError: () => SessionDecryptionError,
-  UnknownAuthMethodError: () => UnknownAuthMethodError,
-  UserNotFoundError: () => UserNotFoundError,
-  UsernameAndPasswordRequiredError: () => UsernameAndPasswordRequiredError,
-  UsernameNotFoundError: () => UsernameNotFoundError,
-  UsernameRequiredError: () => UsernameRequiredError,
-  WebAuthnError: () => WebAuthnError,
-  WrongVerbError: () => WrongVerbError
-});
-module.exports = __toCommonJS(errors_exports);
 class NoSessionSecretError extends Error {
   constructor() {
     super(
@@ -165,10 +112,10 @@ class IncorrectPasswordError extends Error {
     this.name = "IncorrectPasswordError";
   }
 }
-class CsrfTokenMismatchError extends Error {
-  constructor() {
-    super(`CSRF token mismatch`);
-    this.name = "CsrfTokenMismatchError";
+class UntrustedOriginError extends Error {
+  constructor(message = "Request origin is not trusted") {
+    super(message);
+    this.name = "UntrustedOriginError";
   }
 }
 class SessionDecryptionError extends Error {
@@ -249,9 +196,7 @@ class NoWebAuthnSessionError extends WebAuthnError {
     this.name = "NoWebAuthnSessionError";
   }
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  CsrfTokenMismatchError,
+export {
   DuplicateUsernameError,
   FieldRequiredError,
   FlowNotEnabledError,
@@ -276,10 +221,11 @@ class NoWebAuthnSessionError extends WebAuthnError {
   ReusedPasswordError,
   SessionDecryptionError,
   UnknownAuthMethodError,
+  UntrustedOriginError,
   UserNotFoundError,
   UsernameAndPasswordRequiredError,
   UsernameNotFoundError,
   UsernameRequiredError,
   WebAuthnError,
   WrongVerbError
-});
+};

package/dist/index.d.ts

@@ -1,5 +1,7 @@
-export * from './DbAuthHandler';
-export { PasswordValidationError } from './errors';
-export * from './shared';
-export { authDecoder, createAuthDecoder } from './decoder';
+export * from './DbAuthHandler.js';
+export { PasswordValidationError } from './errors.js';
+export * from './session.js';
+export * from './shared.js';
+export { authDecoder, createAuthDecoder } from './decoder.js';
+export * from './originValidation.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,cAAc,UAAU,CAAA;AACxB,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC7D,cAAc,uBAAuB,CAAA"}

package/dist/index.js

@@ -1,38 +1,11 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var src_exports = {};
-__export(src_exports, {
-  PasswordValidationError: () => import_errors.PasswordValidationError,
-  authDecoder: () => import_decoder.authDecoder,
-  createAuthDecoder: () => import_decoder.createAuthDecoder
-});
-module.exports = __toCommonJS(src_exports);
-__reExport(src_exports, require("./DbAuthHandler"), module.exports);
-var import_errors = require("./errors");
-__reExport(src_exports, require("./shared"), module.exports);
-var import_decoder = require("./decoder");
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
+export * from "./DbAuthHandler.js";
+import { PasswordValidationError } from "./errors.js";
+export * from "./session.js";
+export * from "./shared.js";
+import { authDecoder, createAuthDecoder } from "./decoder.js";
+export * from "./originValidation.js";
+export {
   PasswordValidationError,
   authDecoder,
-  createAuthDecoder,
-  ...require("./DbAuthHandler"),
-  ...require("./shared")
-});
+  createAuthDecoder
+};

package/dist/originValidation.d.ts

@@ -0,0 +1,131 @@
+import type { CorsConfig } from '@cedarjs/api';
+/**
+ * Minimal, transport-agnostic shape of an incoming request needed to decide
+ * whether its `Origin` header should be trusted for a state-changing
+ * request. Deliberately decoupled from any specific request/event type (no
+ * `DbAuthHandler` coupling) so this helper can be reused by other handler
+ * packages.
+ */
+export interface OriginValidationRequest {
+    /**
+     * HTTP method of the request, e.g. `GET`, `POST`. Used by
+     * {@link requiresOriginValidation} to decide whether a request needs to be
+     * checked at all.
+     */
+    method: string;
+    /**
+     * Request headers, including `origin` if the browser sent one.
+     */
+    headers: Headers;
+    /**
+     * Host (and port, if non-default) the request was sent to, resolved with
+     * {@link resolveRequestHost}. Used to allow same-origin requests through
+     * with no extra configuration, which covers the standard Cedar setup
+     * where the web side proxies API requests through its own origin. Pass
+     * `null` when the host can't be determined.
+     */
+    host?: string | null;
+    /**
+     * Scheme (`http`/`https`) the request is considered to have arrived
+     * over, resolved with {@link resolveRequestProtocol}, when it can be
+     * determined reliably. Used as an extra check alongside `host` when
+     * deciding whether the `Origin` header matches the request's own
+     * origin. Pass `null`/`undefined` when it can't be determined -- in that
+     * case only the host is compared, unless `proxied` narrows that further
+     * (see {@link isProxiedRequest}).
+     */
+    protocol?: string | null;
+    /**
+     * Whether the request declares itself as arriving through a forwarding
+     * proxy, resolved with {@link isProxiedRequest}. Scopes the
+     * unknown-scheme same-host restriction to requests a proxy actually
+     * touched -- see `isSameOrigin`.
+     */
+    proxied?: boolean;
+}
+export interface OriginValidationConfig {
+    /**
+     * Extra origins that are always trusted for state-changing requests, on
+     * top of the request's own host and any origins already listed in
+     * `cors.origin`.
+     */
+    trustedOrigins?: string | string[];
+    /**
+     * The `origin` value from a handler's `cors` config (same shape as passed
+     * to `createCorsContext`). String and array values are treated as
+     * trusted origins.
+     *
+     * `true` (reflect any request origin back in
+     * `Access-Control-Allow-Origin`) is intentionally NOT treated as trust --
+     * combined with `credentials: true` that is the exact misconfiguration
+     * this check protects against. Apps that need to accept requests from an
+     * arbitrary set of origins must list them explicitly in `trustedOrigins`
+     * instead.
+     */
+    corsOrigin?: CorsConfig['origin'];
+}
+/**
+ * HTTP methods that can change server-side state and therefore need their
+ * `Origin` validated. `GET` and `HEAD` requests are read-only and are never
+ * checked.
+ */
+export declare function requiresOriginValidation(method: string): boolean;
+/**
+ * Resolves the host a request should be considered as having arrived at,
+ * preferring a forwarding proxy's advertised host over the connection-level
+ * one.
+ *
+ * A proxy in front of the api side (this framework's own `cedar serve
+ * --ud`, or an external nginx/CDN) terminates the browser's connection and
+ * opens a new one to the api server, so the request's own URL/`Host` header
+ * reflects that internal hop rather than the origin-facing host the
+ * browser actually targeted. `X-Forwarded-Host` carries the origin-facing
+ * host instead.
+ *
+ * Trusting `X-Forwarded-Host` here is safe for CSRF purposes: a cross-site
+ * HTML form can't set arbitrary request headers, and a cross-origin
+ * `fetch()` that sets a custom header triggers a CORS preflight, so an
+ * attacker can't forge it without already having crossed the browser's
+ * CORS checks.
+ *
+ * @param url - The request's own URL (Fetch API requests only), used as a
+ * fallback when neither `X-Forwarded-Host` nor `Host` is present.
+ */
+export declare function resolveRequestHost(headers: Headers, url?: string | null): string | null;
+/**
+ * Resolves the scheme (`http`/`https`) a request should be considered as
+ * having arrived over, mirroring {@link resolveRequestHost}.
+ *
+ * The request's own URL is only used as a fallback when no
+ * `X-Forwarded-Host` is present -- once a proxy has declared itself by
+ * setting that header, the request's own URL reflects the internal hop to
+ * the proxy, and its scheme can't be assumed to match what the browser
+ * actually used unless the proxy also set `X-Forwarded-Proto`.
+ *
+ * @param url - The request's own URL (Fetch API requests only).
+ */
+export declare function resolveRequestProtocol(headers: Headers, url?: string | null): string | null;
+/**
+ * Whether a request declares itself as arriving through a forwarding
+ * proxy, i.e. carries an `X-Forwarded-Host` header.
+ *
+ * Used to scope the unknown-scheme same-host restriction (see
+ * `isSameOrigin`) to requests a proxy actually touched. A request with no
+ * forwarding headers at all is a direct connection -- the normal case for
+ * dev servers, classic `cedar serve`, and most self-hosts -- not evidence
+ * of a proxy.
+ */
+export declare function isProxiedRequest(headers: Headers): boolean;
+/**
+ * Decides whether a request's `Origin` header should be trusted.
+ *
+ * Requests with no `Origin` header are always trusted: non-browser clients
+ * (server-to-server calls, CLIs, mobile apps) don't send one and don't carry
+ * ambient browser cookies, so they aren't CSRF vectors.
+ *
+ * When an `Origin` header is present, it's trusted when it matches the
+ * request's own host, is listed in `trustedOrigins`, or is listed in
+ * `corsOrigin`. Everything else is untrusted.
+ */
+export declare function isRequestOriginTrusted(request: OriginValidationRequest, config: OriginValidationConfig): boolean;
+//# sourceMappingURL=originValidation.d.ts.map

package/dist/originValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"originValidation.d.ts","sourceRoot":"","sources":["../src/originValidation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAClC;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;CAClC;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGhE;AAgBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,GAClB,MAAM,GAAG,IAAI,CAoBf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,GAClB,MAAM,GAAG,IAAI,CAef;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE1D;AA+CD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CA6BT"}

package/dist/originValidation.js

@@ -0,0 +1,92 @@
+function requiresOriginValidation(method) {
+  const upperMethod = method.toUpperCase();
+  return upperMethod !== "GET" && upperMethod !== "HEAD";
+}
+function toOriginList(value) {
+  if (!value) {
+    return [];
+  }
+  return Array.isArray(value) ? value : [value];
+}
+function firstForwardedValue(headerValue) {
+  return headerValue.split(",")[0].trim();
+}
+function resolveRequestHost(headers, url) {
+  const forwardedHost = headers.get("x-forwarded-host");
+  if (forwardedHost) {
+    return firstForwardedValue(forwardedHost);
+  }
+  const host = headers.get("host");
+  if (host) {
+    return host;
+  }
+  if (url) {
+    try {
+      return new URL(url).host;
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function resolveRequestProtocol(headers, url) {
+  const forwardedProto = headers.get("x-forwarded-proto");
+  if (forwardedProto) {
+    return firstForwardedValue(forwardedProto).toLowerCase();
+  }
+  if (!headers.get("x-forwarded-host") && url) {
+    try {
+      return new URL(url).protocol.replace(":", "");
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function isProxiedRequest(headers) {
+  return headers.get("x-forwarded-host") !== null;
+}
+function isSameOrigin(origin, host, protocol, proxied) {
+  try {
+    const originUrl = new URL(origin);
+    if (originUrl.host !== host) {
+      return false;
+    }
+    if (protocol) {
+      return originUrl.protocol === `${protocol}:`;
+    }
+    if (proxied) {
+      return originUrl.protocol === "https:";
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isRequestOriginTrusted(request, config) {
+  const origin = request.headers.get("origin");
+  if (!origin) {
+    return true;
+  }
+  if (request.host && isSameOrigin(origin, request.host, request.protocol, request.proxied)) {
+    return true;
+  }
+  const trustedOrigins = toOriginList(config.trustedOrigins);
+  if (trustedOrigins.includes(origin)) {
+    return true;
+  }
+  const corsOrigins = toOriginList(
+    typeof config.corsOrigin === "string" || Array.isArray(config.corsOrigin) ? config.corsOrigin : void 0
+  );
+  if (corsOrigins.includes(origin)) {
+    return true;
+  }
+  return false;
+}
+export {
+  isProxiedRequest,
+  isRequestOriginTrusted,
+  requiresOriginValidation,
+  resolveRequestHost,
+  resolveRequestProtocol
+};

package/dist/session.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Cookie attributes that can be set on a dbAuth cookie, either as
+ * `cookie.attributes` or (deprecated) directly on `cookie`.
+ */
+export interface DbAuthCookieAttributes {
+    Path?: string;
+    HttpOnly?: boolean;
+    Secure?: boolean;
+    SameSite?: string;
+    Domain?: string;
+}
+/**
+ * Configuration for the cookies dbAuth sets: the session cookie's name, and
+ * the attributes applied to every cookie dbAuth writes (the session cookie
+ * and the `auth-provider` cookie).
+ */
+export interface DbAuthCookieConfig extends DbAuthCookieAttributes {
+    attributes?: DbAuthCookieAttributes;
+    /**
+     * The name of the cookie that dbAuth sets
+     *
+     * %port% will be replaced with the port the api server is running on.
+     * If you have multiple RW apps running on the same host, you'll need to
+     * make sure they all use unique cookie names
+     */
+    name?: string;
+}
+/**
+ * Returns a UTC date string `expiresInSeconds` seconds in the future. Used as
+ * the `Expires` cookie attribute for a session that should stay valid for
+ * that long from now.
+ */
+export declare function createExpiresAtDate(expiresInSeconds: number): string;
+/**
+ * Generates a new CSRF token (a standard UUID) to pair with a session.
+ */
+export declare function createCsrfToken(): string;
+/**
+ * Removes any fields not explicitly allowed to be sent to the client before
+ * sending a user record over the wire.
+ */
+export declare function sanitizeUser(user: Record<string, unknown>, allowedUserFields: string[]): Record<string, unknown>;
+/**
+ * Builds the Set-Cookie attribute strings (`Path`, `HttpOnly`, `SameSite`,
+ * `Secure`, `Domain`, `Expires`) for a dbAuth cookie.
+ *
+ * Pass `expires: 'now'` (the default) to get the attributes needed to expire
+ * the cookie, or a UTC date string (e.g. from `createExpiresAtDate`) to set a
+ * future expiration.
+ */
+export declare function buildCookieAttributes({ cookieConfig, expires, overrideAttributes, }: {
+    cookieConfig?: DbAuthCookieConfig;
+    expires?: 'now' | string;
+    overrideAttributes?: DbAuthCookieAttributes;
+}): string[];
+/**
+ * Builds the Set-Cookie header string for the `auth-provider` cookie dbAuth
+ * sets alongside the session cookie.
+ */
+export declare function createAuthProviderCookieString({ cookieConfig, expiresAt, }: {
+    cookieConfig?: DbAuthCookieConfig;
+    expiresAt: string;
+}): string;
+/**
+ * Builds the Set-Cookie header string for the dbAuth session cookie: the
+ * `data;csrfToken` payload, encrypted, under the configured cookie name and
+ * attributes.
+ */
+export declare function createSessionCookieString<TIdType = unknown>({ data, csrfToken, cookieConfig, expiresAt, }: {
+    data: Record<string, TIdType>;
+    csrfToken: string;
+    cookieConfig?: DbAuthCookieConfig;
+    expiresAt: string;
+}): string;
+/** Fields returned from the user record when none are explicitly allowed */
+export declare const DEFAULT_ALLOWED_USER_FIELDS: string[];
+export interface CreateLoginResponseOptions {
+    /**
+     * Object containing cookie config options: the cookie name (with %port%
+     * support) and the attributes applied to it (`Path`, `HttpOnly`,
+     * `SameSite`, `Secure`, `Domain`).
+     */
+    cookie?: DbAuthCookieConfig;
+    /**
+     * The fields that are allowed to be returned from the user record.
+     * Defaults to `id` and `email`.
+     */
+    allowedUserFields?: string[];
+    /**
+     * The `Expires` cookie attribute value for the session and `auth-provider`
+     * cookies: a UTC date string in the future. Build one with
+     * `createExpiresAtDate(expiresInSeconds)`.
+     */
+    expiresAt: string;
+    /**
+     * The HTTP status code to return in the response tuple. Defaults to 200.
+     */
+    statusCode?: number;
+}
+/**
+ * Mints a dbAuth session for the given user: a CSRF token, a session cookie
+ * (the sanitized user data paired with the CSRF token, encrypted), and the
+ * `auth-provider` cookie, in the same `[body, headers, { statusCode }]` shape
+ * every dbAuth auth method returns.
+ *
+ * Callable without a `DbAuthHandler` instance, so any code that has already
+ * verified a user's identity — a WebAuthn assertion, an OAuth callback, a
+ * magic link — can issue a session the same way the built-in login flow
+ * does.
+ */
+export declare function createLoginResponse(user: Record<string, unknown>, options: CreateLoginResponseOptions): [Record<string, unknown>, Headers, {
+    statusCode: number;
+}];
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IAChE,UAAU,CAAC,EAAE,sBAAsB,CAAA;IACnC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAOD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,iBAAiB,EAAE,MAAM,EAAE,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,YAAY,EACZ,OAAe,EACf,kBAAuB,GACxB,EAAE;IACD,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACxB,kBAAkB,CAAC,EAAE,sBAAsB,CAAA;CAC5C,GAAG,MAAM,EAAE,CAiCX;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,YAAY,EACZ,SAAS,GACV,EAAE;IACD,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,CAKT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAG,OAAO,EAAE,EAC3D,IAAI,EACJ,SAAS,EACT,YAAY,EACZ,SAAS,GACV,EAAE;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,CAQT;AAED,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,UAAkB,CAAA;AAE1D,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAA;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,0BAA0B,GAClC,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CA+B5D"}

package/dist/session.js

@@ -0,0 +1,103 @@
+import { v4 as uuidv4 } from "uuid";
+import { encryptSession, generateCookieName } from "./shared.js";
+const PAST_EXPIRES_DATE = (/* @__PURE__ */ new Date(
+  "1970-01-01T00:00:00.000+00:00"
+)).toUTCString();
+function createExpiresAtDate(expiresInSeconds) {
+  const expiresAt = /* @__PURE__ */ new Date();
+  expiresAt.setSeconds(expiresAt.getSeconds() + expiresInSeconds);
+  return expiresAt.toUTCString();
+}
+function createCsrfToken() {
+  return uuidv4();
+}
+function sanitizeUser(user, allowedUserFields) {
+  const sanitized = JSON.parse(JSON.stringify(user));
+  Object.keys(sanitized).forEach((key) => {
+    if (!allowedUserFields.includes(key)) {
+      delete sanitized[key];
+    }
+  });
+  return sanitized;
+}
+function buildCookieAttributes({
+  cookieConfig,
+  expires = "now",
+  overrideAttributes = {}
+}) {
+  const userCookieAttributes = cookieConfig?.attributes ? { ...cookieConfig.attributes } : { ...cookieConfig };
+  if (!cookieConfig?.attributes) {
+    delete userCookieAttributes.name;
+  }
+  const cookieOptions = { ...userCookieAttributes, ...overrideAttributes };
+  const meta = Object.keys(cookieOptions).map((key) => {
+    const optionValue = cookieOptions[key];
+    if (optionValue === true) {
+      return key;
+    } else if (optionValue === false) {
+      return null;
+    } else {
+      return `${key}=${optionValue}`;
+    }
+  }).filter((v) => v !== null);
+  const expiresAt = expires === "now" ? PAST_EXPIRES_DATE : expires;
+  meta.push(`Expires=${expiresAt}`);
+  return meta;
+}
+function createAuthProviderCookieString({
+  cookieConfig,
+  expiresAt
+}) {
+  return [
+    `auth-provider=dbAuth`,
+    ...buildCookieAttributes({ cookieConfig, expires: expiresAt })
+  ].join(";");
+}
+function createSessionCookieString({
+  data,
+  csrfToken,
+  cookieConfig,
+  expiresAt
+}) {
+  const session = JSON.stringify(data) + ";" + csrfToken;
+  const encrypted = encryptSession(session);
+  return [
+    `${generateCookieName(cookieConfig?.name)}=${encrypted}`,
+    ...buildCookieAttributes({ cookieConfig, expires: expiresAt })
+  ].join(";");
+}
+const DEFAULT_ALLOWED_USER_FIELDS = ["id", "email"];
+function createLoginResponse(user, options) {
+  const allowedUserFields = options.allowedUserFields ?? DEFAULT_ALLOWED_USER_FIELDS;
+  const sessionData = sanitizeUser(user, allowedUserFields);
+  const csrfToken = createCsrfToken();
+  const headers = new Headers();
+  headers.append("csrf-token", csrfToken);
+  headers.append(
+    "set-cookie",
+    createAuthProviderCookieString({
+      cookieConfig: options.cookie,
+      expiresAt: options.expiresAt
+    })
+  );
+  headers.append(
+    "set-cookie",
+    createSessionCookieString({
+      data: sessionData,
+      csrfToken,
+      cookieConfig: options.cookie,
+      expiresAt: options.expiresAt
+    })
+  );
+  return [sessionData, headers, { statusCode: options.statusCode ?? 200 }];
+}
+export {
+  DEFAULT_ALLOWED_USER_FIELDS,
+  buildCookieAttributes,
+  createAuthProviderCookieString,
+  createCsrfToken,
+  createExpiresAtDate,
+  createLoginResponse,
+  createSessionCookieString,
+  sanitizeUser
+};

package/dist/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../src/shared.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAM/C,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AA+ED,eAAO,MAAM,aAAa,GAAI,OAAO,oBAAoB,GAAG,OAAO,QAElE,CAAA;AAGD,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,GAAG,SAAS,YAOvD,CAAA;AAGD,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,GAAG,IAAI,UAiCjD,CAAA;AAED,eAAO,MAAM,cAAc,GAAI,YAAY,MAAM,WAWhD,CAAA;AAGD,eAAO,MAAM,UAAU,GACrB,MAAM,MAAM,GAAG,SAAS,EACxB,oBAAoB,MAAM,GAAG,SAAS,kBAkBvC,CAAA;AAKD,eAAO,MAAM,aAAa,GACxB,OAAO,oBAAoB,GAAG,OAAO,EACrC,oBAAoB,MAAM,GAAG,SAAS,QAavC,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,OAAO,oBAAoB,GAAG,OAAO,QAgBpE,CAAA;AAED,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,WAEtC,CAAA;AAMD,eAAO,MAAM,YAAY,GACvB,MAAM,MAAM,EACZ,qBAGG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,aAAa,CAAA;CAAO,aAWnD,CAAA;AAID,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,aAM7D,CAAA;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,UAK9D;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,oBAAoB,GAAG,OAAO,IAGnC,UAAU;IACR,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,EACD,aAAa,WAAW;gBAQV,MAAM;aACT,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;wBACtB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;WACrC,MAAM;EA2BlB;AAYD,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,aAYpD,CAAA"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../src/shared.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAM/C,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AA6ED,eAAO,MAAM,aAAa,GAAI,OAAO,oBAAoB,GAAG,OAAO,QAElE,CAAA;AAGD,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,GAAG,SAAS,YAOvD,CAAA;AAGD,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,GAAG,IAAI,UAiCjD,CAAA;AAED,eAAO,MAAM,cAAc,GAAI,YAAY,MAAM,WAWhD,CAAA;AAGD,eAAO,MAAM,UAAU,GACrB,MAAM,MAAM,GAAG,SAAS,EACxB,oBAAoB,MAAM,GAAG,SAAS,kBAkBvC,CAAA;AAKD,eAAO,MAAM,aAAa,GACxB,OAAO,oBAAoB,GAAG,OAAO,EACrC,oBAAoB,MAAM,GAAG,SAAS,QAavC,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,OAAO,oBAAoB,GAAG,OAAO,QAgBpE,CAAA;AAED,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,WAEtC,CAAA;AAMD,eAAO,MAAM,YAAY,GACvB,MAAM,MAAM,EACZ,qBAGG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,aAAa,CAAA;CAAO,aAWnD,CAAA;AAID,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,aAM7D,CAAA;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,UAK9D;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,oBAAoB,GAAG,OAAO,IAGnC,UAAU;IACR,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,EACD,aAAa,WAAW;gBAQV,MAAM;aACT,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;wBACtB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;WACrC,MAAM;EA2BlB;AAYD,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,aAYpD,CAAA"}