@chidchanun/bcp 0.2.16 → 0.2.18

package/packages/client/src/auth.mjs

@@ -0,0 +1,1391 @@
+// packages/server/src/auth.ts
+import {
+  randomUUID
+} from "node:crypto";
+
+// packages/server/src/session.ts
+import {
+  createHmac,
+  timingSafeEqual
+} from "node:crypto";
+
+// packages/server/src/request-context.ts
+import {
+  AsyncLocalStorage
+} from "node:async_hooks";
+var requestStorage = new AsyncLocalStorage();
+async function requestUrl() {
+  const context = getRequestContext();
+  return new URL(
+    context.url.href
+  );
+}
+async function cookies() {
+  const context = getRequestContext();
+  return context.cookies;
+}
+function getRequestContext() {
+  const context = requestStorage.getStore();
+  if (!context) {
+    throw new Error(
+      "BCP Framework: server request APIs can only be used while handling a request."
+    );
+  }
+  return context;
+}
+
+// packages/server/src/session.ts
+var DEFAULT_COOKIE_NAME = "bcp_session";
+var DEFAULT_EXPIRES_IN = 60 * 60 * 12;
+var MAX_TOKEN_LENGTH = 16 * 1024;
+var MINIMUM_SECRET_BYTES = 32;
+async function createSessionToken(payload, options = {}) {
+  assertPayload(
+    payload
+  );
+  const secret = resolveSessionSecret(
+    options.secret
+  );
+  const expiresIn = resolveExpiresIn(
+    options.expiresIn
+  );
+  const issuer = resolveOptionalIssuer(
+    options.issuer
+  );
+  const audience = options.audience === void 0 ? void 0 : normalizeAudience(
+    options.audience
+  );
+  const now = Math.floor(
+    Date.now() / 1e3
+  );
+  const header = {
+    alg: "HS256",
+    typ: "JWT"
+  };
+  const claims = {
+    ...payload,
+    iat: now,
+    exp: now + expiresIn
+  };
+  if (issuer !== void 0) {
+    claims.iss = issuer;
+  }
+  if (audience !== void 0) {
+    claims.aud = audience;
+  }
+  const encodedHeader = encodeJson(
+    header
+  );
+  const encodedPayload = encodeJson(
+    claims
+  );
+  const signingInput = `${encodedHeader}.${encodedPayload}`;
+  const signature = signHs256(
+    signingInput,
+    secret
+  );
+  return `${signingInput}.${signature}`;
+}
+async function verifySessionToken(token, options = {}) {
+  const secret = resolveSessionSecret(
+    options.secret
+  );
+  const issuer = resolveOptionalIssuer(
+    options.issuer
+  );
+  const audience = options.audience === void 0 ? void 0 : normalizeAudience(
+    options.audience
+  );
+  try {
+    if (typeof token !== "string" || token.length === 0 || token.length > MAX_TOKEN_LENGTH) {
+      return null;
+    }
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+      return null;
+    }
+    const [
+      encodedHeader,
+      encodedPayload,
+      signature
+    ] = parts;
+    const header = decodeJson(
+      encodedHeader
+    );
+    if (header.alg !== "HS256" || header.typ !== void 0 && header.typ !== "JWT") {
+      return null;
+    }
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    const expectedSignature = signHs256(
+      signingInput,
+      secret
+    );
+    if (!safeEqual(
+      signature,
+      expectedSignature
+    )) {
+      return null;
+    }
+    const claims = decodeJson(
+      encodedPayload
+    );
+    const now = Math.floor(
+      Date.now() / 1e3
+    );
+    if (typeof claims.iat !== "number" || !Number.isFinite(
+      claims.iat
+    ) || typeof claims.exp !== "number" || !Number.isFinite(
+      claims.exp
+    ) || claims.exp <= now) {
+      return null;
+    }
+    if (claims.nbf !== void 0) {
+      if (typeof claims.nbf !== "number" || !Number.isFinite(
+        claims.nbf
+      ) || claims.nbf > now) {
+        return null;
+      }
+    }
+    if (issuer !== void 0 && claims.iss !== issuer) {
+      return null;
+    }
+    if (audience !== void 0 && !audienceMatches(
+      claims.aud,
+      audience
+    )) {
+      return null;
+    }
+    return claims;
+  } catch {
+    return null;
+  }
+}
+async function createSession(payload, options = {}) {
+  const expiresIn = resolveExpiresIn(
+    options.expiresIn
+  );
+  const token = await createSessionToken(
+    payload,
+    {
+      secret: options.secret,
+      expiresIn,
+      issuer: options.issuer,
+      audience: options.audience
+    }
+  );
+  const cookieStore = await cookies();
+  cookieStore.set(
+    resolveCookieName(
+      options.cookieName
+    ),
+    token,
+    {
+      httpOnly: options.httpOnly ?? true,
+      secure: options.secure ?? process.env.NODE_ENV === "production",
+      sameSite: options.sameSite ?? "lax",
+      path: options.path ?? "/",
+      domain: options.domain,
+      maxAge: expiresIn
+    }
+  );
+  return token;
+}
+async function getSession(options = {}) {
+  const cookieStore = await cookies();
+  const token = cookieStore.get(
+    resolveCookieName(
+      options.cookieName
+    )
+  )?.value;
+  if (!token) {
+    return null;
+  }
+  return verifySessionToken(
+    token,
+    {
+      secret: options.secret,
+      issuer: options.issuer,
+      audience: options.audience
+    }
+  );
+}
+async function destroySession(options = {}) {
+  const cookieStore = await cookies();
+  cookieStore.delete(
+    resolveCookieName(
+      options.cookieName
+    ),
+    {
+      path: options.path ?? "/",
+      domain: options.domain
+    }
+  );
+}
+function resolveSessionSecret(explicitSecret) {
+  const secret = explicitSecret ?? process.env.BCP_SESSION_SECRET;
+  if (!secret) {
+    throw new Error(
+      "BCP Framework: BCP_SESSION_SECRET is required for session tokens."
+    );
+  }
+  if (Buffer.byteLength(
+    secret,
+    "utf8"
+  ) < MINIMUM_SECRET_BYTES) {
+    throw new Error(
+      `BCP Framework: session secret must be at least ${MINIMUM_SECRET_BYTES} bytes.`
+    );
+  }
+  return secret;
+}
+function resolveExpiresIn(value) {
+  const expiresIn = value ?? DEFAULT_EXPIRES_IN;
+  if (!Number.isFinite(
+    expiresIn
+  ) || expiresIn <= 0) {
+    throw new Error(
+      "BCP Framework: session expiresIn must be a positive finite number of seconds."
+    );
+  }
+  return Math.floor(
+    expiresIn
+  );
+}
+function resolveCookieName(value) {
+  const cookieName = value ?? DEFAULT_COOKIE_NAME;
+  assertNonEmptyString(
+    cookieName,
+    "cookieName"
+  );
+  return cookieName;
+}
+function resolveOptionalIssuer(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  assertNonEmptyString(
+    value,
+    "issuer"
+  );
+  return value;
+}
+function assertPayload(payload) {
+  if (payload === null || typeof payload !== "object" || Array.isArray(
+    payload
+  )) {
+    throw new Error(
+      "BCP Framework: session payload must be a plain object."
+    );
+  }
+}
+function assertNonEmptyString(value, label) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new Error(
+      `BCP Framework: session ${label} must be a non-empty string.`
+    );
+  }
+}
+function normalizeAudience(value) {
+  if (typeof value === "string") {
+    assertNonEmptyString(
+      value,
+      "audience"
+    );
+    return value;
+  }
+  if (!Array.isArray(
+    value
+  ) || value.length === 0) {
+    throw new Error(
+      "BCP Framework: session audience must contain at least one value."
+    );
+  }
+  for (const audience of value) {
+    assertNonEmptyString(
+      audience,
+      "audience"
+    );
+  }
+  return [
+    ...value
+  ];
+}
+function audienceMatches(claim, expected) {
+  const expectedValues = typeof expected === "string" ? [
+    expected
+  ] : expected;
+  const claimValues = typeof claim === "string" ? [
+    claim
+  ] : Array.isArray(
+    claim
+  ) ? claim.filter(
+    (value) => typeof value === "string"
+  ) : [];
+  return expectedValues.some(
+    (value) => claimValues.includes(
+      value
+    )
+  );
+}
+function encodeJson(value) {
+  return Buffer.from(
+    JSON.stringify(
+      value
+    ),
+    "utf8"
+  ).toString(
+    "base64url"
+  );
+}
+function decodeJson(value) {
+  const decoded = Buffer.from(
+    value,
+    "base64url"
+  ).toString(
+    "utf8"
+  );
+  return JSON.parse(
+    decoded
+  );
+}
+function signHs256(signingInput, secret) {
+  return createHmac(
+    "sha256",
+    secret
+  ).update(
+    signingInput,
+    "utf8"
+  ).digest(
+    "base64url"
+  );
+}
+function safeEqual(actual, expected) {
+  const actualBuffer = Buffer.from(
+    actual,
+    "base64url"
+  );
+  const expectedBuffer = Buffer.from(
+    expected,
+    "base64url"
+  );
+  return actualBuffer.length === expectedBuffer.length && timingSafeEqual(
+    actualBuffer,
+    expectedBuffer
+  );
+}
+
+// packages/server/src/auth.ts
+async function auth(options = {}) {
+  const session = await readSignedAuthSession(
+    toSessionCookieOptions(
+      options
+    )
+  );
+  if (!session) {
+    return null;
+  }
+  const idleTimeout = resolveIdleTimeout(
+    options.idleTimeout
+  );
+  const store = options.store;
+  if (idleTimeout !== void 0 && !store) {
+    throw new Error(
+      "BCP Auth: idleTimeout requires a server-side auth session store."
+    );
+  }
+  if (!store) {
+    return session;
+  }
+  const record = await store.get(
+    session.sid
+  );
+  if (!record) {
+    return null;
+  }
+  const now = currentUnixTime();
+  const userId = serializeAuthUserId(
+    session.user.id
+  );
+  if (record.userId !== userId || record.revokedAt !== void 0 && record.revokedAt !== null || record.expiresAt <= now) {
+    return null;
+  }
+  if (idleTimeout !== void 0 && record.lastSeenAt + idleTimeout <= now) {
+    await store.revoke(
+      session.sid,
+      now
+    );
+    return null;
+  }
+  await store.touch(
+    session.sid,
+    now
+  );
+  return session;
+}
+async function getSession2(options = {}) {
+  return auth(
+    options
+  );
+}
+async function login(user, options = {}) {
+  assertAuthUser(
+    user
+  );
+  if (options.data !== void 0 && !isPlainObject(
+    options.data
+  )) {
+    throw new TypeError(
+      "BCP Auth: session data must be a plain object."
+    );
+  }
+  const idleTimeout = resolveIdleTimeout(
+    options.idleTimeout
+  );
+  if (idleTimeout !== void 0 && !options.store) {
+    throw new Error(
+      "BCP Auth: idleTimeout requires a server-side auth session store."
+    );
+  }
+  const {
+    data
+  } = options;
+  const sessionOptions = toSessionCookieOptions(
+    options
+  );
+  const payload = {
+    sid: randomUUID(),
+    user,
+    ...data === void 0 ? {} : {
+      data
+    }
+  };
+  await createSession(
+    payload,
+    sessionOptions
+  );
+  const session = await readSignedAuthSession(
+    sessionOptions
+  );
+  if (!session) {
+    throw new Error(
+      "BCP Auth: login created a session but it could not be read back."
+    );
+  }
+  if (options.store) {
+    await options.store.set(
+      createStoreRecord(
+        session
+      )
+    );
+  }
+  return session;
+}
+async function logout(options = {}) {
+  if (options.store) {
+    const current = await auth(
+      options
+    );
+    if (current) {
+      await options.store.revoke(
+        current.sid,
+        currentUnixTime()
+      );
+    }
+  }
+  await destroySession(
+    toSessionCookieOptions(
+      options
+    )
+  );
+}
+async function logoutAll(options = {}) {
+  const store = requireAuthSessionStore(
+    options.store,
+    "logoutAll"
+  );
+  const current = await auth(
+    options
+  );
+  let revoked = 0;
+  if (current) {
+    revoked = await store.revokeUser(
+      serializeAuthUserId(
+        current.user.id
+      ),
+      currentUnixTime()
+    );
+  }
+  await destroySession(
+    toSessionCookieOptions(
+      options
+    )
+  );
+  return revoked;
+}
+async function rotateSession(options = {}) {
+  const current = await auth(
+    options
+  );
+  if (!current) {
+    return null;
+  }
+  const rotated = await login(
+    current.user,
+    {
+      ...options,
+      issuer: options.issuer ?? current.iss,
+      audience: options.audience ?? current.aud,
+      ...current.data === void 0 ? {} : {
+        data: current.data
+      }
+    }
+  );
+  if (options.store) {
+    await options.store.revoke(
+      current.sid,
+      currentUnixTime()
+    );
+  }
+  return rotated;
+}
+async function revokeSession(sid, store) {
+  assertSessionId(
+    sid
+  );
+  assertAuthSessionStore(
+    store
+  );
+  return Boolean(
+    await store.revoke(
+      sid,
+      currentUnixTime()
+    )
+  );
+}
+async function revokeUserSessions(userId, store) {
+  assertAuthSessionStore(
+    store
+  );
+  return store.revokeUser(
+    serializeAuthUserId(
+      userId
+    ),
+    currentUnixTime()
+  );
+}
+function createAuth(defaults = {}) {
+  return {
+    auth: (options = {}) => auth({
+      ...defaults,
+      ...options
+    }),
+    getSession: (options = {}) => auth({
+      ...defaults,
+      ...options
+    }),
+    login: (user, options = {}) => {
+      const {
+        data,
+        ...sessionOptions
+      } = options;
+      return login(
+        user,
+        {
+          ...defaults,
+          ...sessionOptions,
+          ...data === void 0 ? {} : {
+            data
+          }
+        }
+      );
+    },
+    logout: (options = {}) => logout({
+      ...defaults,
+      ...options
+    }),
+    logoutAll: (options = {}) => logoutAll({
+      ...defaults,
+      ...options
+    }),
+    rotateSession: (options = {}) => rotateSession({
+      ...defaults,
+      ...options
+    }),
+    revokeSession: (sid) => revokeSession(
+      sid,
+      requireAuthSessionStore(
+        defaults.store,
+        "revokeSession"
+      )
+    ),
+    revokeUserSessions: (userId) => revokeUserSessions(
+      userId,
+      requireAuthSessionStore(
+        defaults.store,
+        "revokeUserSessions"
+      )
+    )
+  };
+}
+async function readSignedAuthSession(options) {
+  const session = await getSession(
+    options
+  );
+  if (!session) {
+    return null;
+  }
+  if (typeof session.sid !== "string" || session.sid.trim().length === 0 || !isAuthUser(
+    session.user
+  )) {
+    return null;
+  }
+  if (session.data !== void 0 && !isPlainObject(
+    session.data
+  )) {
+    return null;
+  }
+  return session;
+}
+function createStoreRecord(session) {
+  return {
+    sid: session.sid,
+    userId: serializeAuthUserId(
+      session.user.id
+    ),
+    createdAt: session.iat,
+    expiresAt: session.exp,
+    lastSeenAt: session.iat,
+    revokedAt: null
+  };
+}
+function toSessionCookieOptions(options) {
+  const {
+    store: _store,
+    idleTimeout: _idleTimeout,
+    ...sessionOptions
+  } = options;
+  return sessionOptions;
+}
+function serializeAuthUserId(value) {
+  if (typeof value === "string") {
+    const normalized = value.trim();
+    if (!normalized) {
+      throw new TypeError(
+        "BCP Auth: user id must not be empty."
+      );
+    }
+    return `string:${normalized}`;
+  }
+  if (!Number.isFinite(
+    value
+  )) {
+    throw new TypeError(
+      "BCP Auth: numeric user id must be finite."
+    );
+  }
+  return `number:${value}`;
+}
+function resolveIdleTimeout(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (!Number.isFinite(
+    value
+  ) || value <= 0) {
+    throw new TypeError(
+      "BCP Auth: idleTimeout must be a positive finite number of seconds."
+    );
+  }
+  return Math.floor(
+    value
+  );
+}
+function requireAuthSessionStore(store, operation) {
+  if (!store) {
+    throw new Error(
+      `BCP Auth: ${operation} requires a server-side auth session store.`
+    );
+  }
+  assertAuthSessionStore(
+    store
+  );
+  return store;
+}
+function assertAuthSessionStore(store) {
+  if (!store || typeof store !== "object" || typeof store.set !== "function" || typeof store.get !== "function" || typeof store.touch !== "function" || typeof store.revoke !== "function" || typeof store.revokeUser !== "function") {
+    throw new TypeError(
+      "BCP Auth: session store must implement set, get, touch, revoke and revokeUser."
+    );
+  }
+}
+function assertSessionId(sid) {
+  if (typeof sid !== "string" || sid.trim() === "") {
+    throw new TypeError(
+      "BCP Auth: session id must be a non-empty string."
+    );
+  }
+}
+function assertAuthUser(value) {
+  if (!isAuthUser(
+    value
+  )) {
+    throw new TypeError(
+      "BCP Auth: user must be a plain object with a non-empty string or finite numeric id."
+    );
+  }
+}
+function isAuthUser(value) {
+  if (!isPlainObject(
+    value
+  )) {
+    return false;
+  }
+  const id = value.id;
+  return typeof id === "string" && id.trim().length > 0 || typeof id === "number" && Number.isFinite(
+    id
+  );
+}
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(
+    value
+  )) {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(
+    value
+  );
+  return prototype === Object.prototype || prototype === null;
+}
+function currentUnixTime() {
+  return Math.floor(
+    Date.now() / 1e3
+  );
+}
+
+// packages/server/src/auth-session-store.ts
+function createMemoryAuthSessionStore() {
+  const sessions = /* @__PURE__ */ new Map();
+  const clearExpired = (now = currentUnixTime2()) => {
+    let removed = 0;
+    for (const [
+      sid,
+      record
+    ] of sessions) {
+      if (record.expiresAt <= now) {
+        sessions.delete(
+          sid
+        );
+        removed += 1;
+      }
+    }
+    return removed;
+  };
+  return {
+    set(record) {
+      assertRecord(
+        record
+      );
+      clearExpired();
+      sessions.set(
+        record.sid,
+        cloneRecord(
+          record
+        )
+      );
+    },
+    get(sid) {
+      assertSid(
+        sid
+      );
+      clearExpired();
+      const record = sessions.get(
+        sid
+      );
+      return record ? cloneRecord(
+        record
+      ) : null;
+    },
+    touch(sid, lastSeenAt) {
+      assertSid(
+        sid
+      );
+      assertTimestamp(
+        lastSeenAt,
+        "lastSeenAt"
+      );
+      clearExpired(
+        lastSeenAt
+      );
+      const record = sessions.get(
+        sid
+      );
+      if (!record || record.revokedAt !== void 0 && record.revokedAt !== null) {
+        return;
+      }
+      record.lastSeenAt = Math.max(
+        record.lastSeenAt,
+        lastSeenAt
+      );
+    },
+    revoke(sid, revokedAt = currentUnixTime2()) {
+      assertSid(
+        sid
+      );
+      assertTimestamp(
+        revokedAt,
+        "revokedAt"
+      );
+      const record = sessions.get(
+        sid
+      );
+      if (!record) {
+        return false;
+      }
+      record.revokedAt = revokedAt;
+      return true;
+    },
+    revokeUser(userId, revokedAt = currentUnixTime2()) {
+      assertUserId(
+        userId
+      );
+      assertTimestamp(
+        revokedAt,
+        "revokedAt"
+      );
+      clearExpired(
+        revokedAt
+      );
+      let revoked = 0;
+      for (const record of sessions.values()) {
+        if (record.userId !== userId || record.revokedAt !== void 0 && record.revokedAt !== null) {
+          continue;
+        }
+        record.revokedAt = revokedAt;
+        revoked += 1;
+      }
+      return revoked;
+    },
+    clearExpired,
+    size() {
+      clearExpired();
+      return sessions.size;
+    }
+  };
+}
+function cloneRecord(record) {
+  return {
+    ...record
+  };
+}
+function assertRecord(record) {
+  if (!record || typeof record !== "object") {
+    throw new TypeError(
+      "BCP Auth Store: session record must be an object."
+    );
+  }
+  assertSid(
+    record.sid
+  );
+  assertUserId(
+    record.userId
+  );
+  assertTimestamp(
+    record.createdAt,
+    "createdAt"
+  );
+  assertTimestamp(
+    record.expiresAt,
+    "expiresAt"
+  );
+  assertTimestamp(
+    record.lastSeenAt,
+    "lastSeenAt"
+  );
+  if (record.expiresAt <= record.createdAt) {
+    throw new TypeError(
+      "BCP Auth Store: expiresAt must be later than createdAt."
+    );
+  }
+  if (record.revokedAt !== void 0 && record.revokedAt !== null) {
+    assertTimestamp(
+      record.revokedAt,
+      "revokedAt"
+    );
+  }
+}
+function assertSid(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new TypeError(
+      "BCP Auth Store: sid must be a non-empty string."
+    );
+  }
+}
+function assertUserId(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new TypeError(
+      "BCP Auth Store: userId must be a non-empty string."
+    );
+  }
+}
+function assertTimestamp(value, label) {
+  if (!Number.isFinite(
+    value
+  ) || value < 0) {
+    throw new TypeError(
+      `BCP Auth Store: ${label} must be a non-negative finite Unix timestamp.`
+    );
+  }
+}
+function currentUnixTime2() {
+  return Math.floor(
+    Date.now() / 1e3
+  );
+}
+
+// packages/server/src/authorization.ts
+var AuthorizationError = class extends Error {
+  status = 403;
+  code = "FORBIDDEN";
+  constructor(message = "Forbidden") {
+    super(message);
+    this.name = "AuthorizationError";
+  }
+};
+function getUserPermissions(user, field = "permissions") {
+  const normalizedField = normalizeField(
+    field
+  );
+  const value = user[normalizedField];
+  if (typeof value === "string") {
+    const permission = value.trim();
+    return permission ? [permission] : [];
+  }
+  if (!Array.isArray(
+    value
+  )) {
+    return [];
+  }
+  return Array.from(
+    new Set(
+      value.filter(
+        (permission) => typeof permission === "string"
+      ).map(
+        (permission) => permission.trim()
+      ).filter(Boolean)
+    )
+  );
+}
+function hasPermission(user, required, options = {}) {
+  const requiredPermissions = normalizePermissions(
+    required
+  );
+  const assignedPermissions = getUserPermissions(
+    user,
+    options.field
+  );
+  const match = options.match ?? "any";
+  assertAuthorizationMatch(
+    match
+  );
+  return match === "all" ? requiredPermissions.every(
+    (permission) => assignedPermissions.includes(
+      permission
+    )
+  ) : requiredPermissions.some(
+    (permission) => assignedPermissions.includes(
+      permission
+    )
+  );
+}
+function assertPermission(user, required, options = {}) {
+  if (!hasPermission(
+    user,
+    required,
+    options
+  )) {
+    throw new AuthorizationError();
+  }
+}
+function defineAuthorizationPolicy(policy) {
+  if (typeof policy !== "function") {
+    throw new TypeError(
+      "BCP Authorization: policy must be a function."
+    );
+  }
+  return policy;
+}
+async function can(policy, context) {
+  assertAuthorizationContext(
+    context
+  );
+  return Boolean(
+    await policy(
+      context
+    )
+  );
+}
+async function cannot(policy, context) {
+  return !await can(
+    policy,
+    context
+  );
+}
+async function authorize(policy, context, message = "Forbidden") {
+  if (!await can(
+    policy,
+    context
+  )) {
+    throw new AuthorizationError(
+      message
+    );
+  }
+}
+function normalizePermissions(value) {
+  const permissions = typeof value === "string" ? [value] : [
+    ...value
+  ];
+  const normalized = permissions.map(
+    (permission) => permission.trim()
+  );
+  if (normalized.length === 0 || normalized.some(
+    (permission) => permission.length === 0
+  )) {
+    throw new TypeError(
+      "BCP Authorization: required permissions must contain non-empty strings."
+    );
+  }
+  return Array.from(
+    new Set(
+      normalized
+    )
+  );
+}
+function normalizeField(value) {
+  const field = value.trim();
+  if (!field) {
+    throw new TypeError(
+      "BCP Authorization: permission field must be a non-empty string."
+    );
+  }
+  return field;
+}
+function assertAuthorizationMatch(value) {
+  if (value !== "any" && value !== "all") {
+    throw new TypeError(
+      'BCP Authorization: match must be either "any" or "all".'
+    );
+  }
+}
+function assertAuthorizationContext(value) {
+  if (!value || typeof value !== "object" || Array.isArray(
+    value
+  ) || !("user" in value) || !value.user || typeof value.user !== "object" || Array.isArray(
+    value.user
+  )) {
+    throw new TypeError(
+      "BCP Authorization: context must contain a user object."
+    );
+  }
+}
+
+// packages/server/src/server-response.ts
+async function redirect(destination, status = 307) {
+  assertRedirectStatus(
+    status
+  );
+  const base = await requestUrl();
+  const target = destination instanceof URL ? new URL(
+    destination.href
+  ) : new URL(
+    destination,
+    base
+  );
+  if (target.protocol !== "http:" && target.protocol !== "https:") {
+    throw new Error(
+      `BCP Framework: redirect only supports http and https URLs, received "${target.protocol}".`
+    );
+  }
+  return new Response(
+    null,
+    {
+      status,
+      headers: {
+        Location: target.href
+      }
+    }
+  );
+}
+function assertRedirectStatus(status) {
+  if (status !== 301 && status !== 302 && status !== 303 && status !== 307 && status !== 308) {
+    throw new Error(
+      `BCP Framework: invalid redirect status ${status}. Use 301, 302, 303, 307 or 308.`
+    );
+  }
+}
+
+// packages/server/src/auth-guard.ts
+async function requireAuth(options = {}) {
+  const {
+    redirectTo = "/login",
+    redirectStatus = 303,
+    ...authOptions
+  } = options;
+  const session = await auth(
+    authOptions
+  );
+  if (!session) {
+    if (redirectTo === null) {
+      return new Response(
+        "Unauthorized",
+        {
+          status: 401
+        }
+      );
+    }
+    return redirect(
+      redirectTo,
+      redirectStatus
+    );
+  }
+  return {
+    auth: session
+  };
+}
+async function requireGuest(options = {}) {
+  const {
+    redirectTo = "/",
+    redirectStatus = 303,
+    ...authOptions
+  } = options;
+  const session = await auth(
+    authOptions
+  );
+  if (!session) {
+    return {};
+  }
+  if (redirectTo === null) {
+    return new Response(
+      "Already authenticated",
+      {
+        status: 409
+      }
+    );
+  }
+  return redirect(
+    redirectTo,
+    redirectStatus
+  );
+}
+async function requireRole(requiredRole, options = {}) {
+  const roles = normalizeRequiredRoles(
+    requiredRole
+  );
+  const {
+    roleField = "role",
+    match = "any",
+    forbiddenRedirectTo = null,
+    forbiddenRedirectStatus = 303,
+    ...authOptions
+  } = options;
+  const authenticated = await requireAuth(
+    authOptions
+  );
+  if (authenticated instanceof Response) {
+    return authenticated;
+  }
+  const assignedRoles = readAssignedRoles(
+    authenticated.auth.user,
+    roleField
+  );
+  const allowed = match === "all" ? roles.every(
+    (role) => assignedRoles.includes(
+      role
+    )
+  ) : roles.some(
+    (role) => assignedRoles.includes(
+      role
+    )
+  );
+  return finalizeAuthorization(
+    allowed,
+    authenticated,
+    forbiddenRedirectTo,
+    forbiddenRedirectStatus
+  );
+}
+async function requirePermission(requiredPermission, options = {}) {
+  const {
+    permissionField = "permissions",
+    match = "any",
+    forbiddenRedirectTo = null,
+    forbiddenRedirectStatus = 303,
+    ...authOptions
+  } = options;
+  const authenticated = await requireAuth(
+    authOptions
+  );
+  if (authenticated instanceof Response) {
+    return authenticated;
+  }
+  const allowed = hasPermission(
+    authenticated.auth.user,
+    requiredPermission,
+    {
+      field: permissionField,
+      match
+    }
+  );
+  return finalizeAuthorization(
+    allowed,
+    authenticated,
+    forbiddenRedirectTo,
+    forbiddenRedirectStatus
+  );
+}
+function createAuthGuard(options = {}) {
+  return () => requireAuth(
+    options
+  );
+}
+function createGuestGuard(options = {}) {
+  return () => requireGuest(
+    options
+  );
+}
+function createRoleGuard(requiredRole, options = {}) {
+  return () => requireRole(
+    requiredRole,
+    options
+  );
+}
+function createPermissionGuard(requiredPermission, options = {}) {
+  return () => requirePermission(
+    requiredPermission,
+    options
+  );
+}
+function getGuardAuth(guardData) {
+  const value = guardData.auth;
+  if (!value || typeof value !== "object" || Array.isArray(
+    value
+  )) {
+    return null;
+  }
+  const session = value;
+  if (typeof session.sid !== "string" || session.sid.trim().length === 0 || typeof session.iat !== "number" || !Number.isFinite(
+    session.iat
+  ) || typeof session.exp !== "number" || !Number.isFinite(
+    session.exp
+  ) || !isGuardAuthUser(
+    session.user
+  )) {
+    return null;
+  }
+  return value;
+}
+function finalizeAuthorization(allowed, authenticated, forbiddenRedirectTo, forbiddenRedirectStatus) {
+  if (allowed) {
+    return authenticated;
+  }
+  if (forbiddenRedirectTo !== null) {
+    return redirect(
+      forbiddenRedirectTo,
+      forbiddenRedirectStatus
+    );
+  }
+  return new Response(
+    "Forbidden",
+    {
+      status: 403
+    }
+  );
+}
+function normalizeRequiredRoles(value) {
+  const roles = typeof value === "string" ? [
+    value
+  ] : [
+    ...value
+  ];
+  const normalized = roles.map(
+    (role) => role.trim()
+  );
+  if (normalized.length === 0 || normalized.some(
+    (role) => role.length === 0
+  )) {
+    throw new TypeError(
+      "BCP Auth Guard: required roles must contain non-empty strings."
+    );
+  }
+  return Array.from(
+    new Set(
+      normalized
+    )
+  );
+}
+function readAssignedRoles(user, roleField) {
+  const field = roleField.trim();
+  if (!field) {
+    throw new TypeError(
+      "BCP Auth Guard: roleField must be a non-empty string."
+    );
+  }
+  const value = user[field];
+  if (typeof value === "string") {
+    const role = value.trim();
+    return role ? [
+      role
+    ] : [];
+  }
+  if (Array.isArray(
+    value
+  )) {
+    return value.filter(
+      (role) => typeof role === "string"
+    ).map(
+      (role) => role.trim()
+    ).filter(
+      Boolean
+    );
+  }
+  return [];
+}
+function isGuardAuthUser(value) {
+  if (!value || typeof value !== "object" || Array.isArray(
+    value
+  )) {
+    return false;
+  }
+  const id = value.id;
+  return typeof id === "string" && id.trim().length > 0 || typeof id === "number" && Number.isFinite(
+    id
+  );
+}
+export {
+  AuthorizationError,
+  assertPermission,
+  auth,
+  authorize,
+  can,
+  cannot,
+  createAuth,
+  createAuthGuard,
+  createGuestGuard,
+  createMemoryAuthSessionStore,
+  createPermissionGuard,
+  createRoleGuard,
+  defineAuthorizationPolicy,
+  getGuardAuth,
+  getSession2 as getSession,
+  getUserPermissions,
+  hasPermission,
+  login,
+  logout,
+  logoutAll,
+  requireAuth,
+  requireGuest,
+  requirePermission,
+  requireRole,
+  revokeSession,
+  revokeUserSessions,
+  rotateSession
+};