@connextar/house 0.17.0 → 0.19.0

package/dist/admin/second-factor.d.ts

@@ -0,0 +1,156 @@
+import { type AdminAuditEvent, type AdminAuditScope, type AdminSignInMethod } from "./audit.js";
+/**
+ * Which administrators' sessions were made with a second factor — one Better Auth plugin for the six apps that each
+ * wrote their own (AltEd's `admin-second-factor.ts`, Quickie's `operator-access.ts`, and `second-factor-session.ts` in
+ * PharmaLine, PM Tool, senco and FB Web).
+ *
+ * Nothing on a Better Auth session says how it was made, so the plugin writes it down at the one moment it is known —
+ * Better Auth's own `session.create` database hook, which runs inside the endpoint creating the session — as a row in
+ * the `verification` table: `<recordPrefix><session id>`, the user's id as its value, expiring with the session as it
+ * was issued (not with its rolling extensions, so an administrator proves the factor again at least once a session
+ * lifetime). No request can write one. `adminAccess` reads it back.
+ *
+ * A session made by one of these proves the second factor, for an administrator:
+ *
+ * - `/two-factor/verify-totp` and `/two-factor/verify-backup-code` — the code at sign-in, after a password, an email
+ *   link or a social sign-in (`secondFactorEverywhere()`); and the code that ends enrolment, which replaces the
+ *   enrolling session with a new one;
+ * - `/passkey/verify-authentication` — possession of a device, and phishing-resistant;
+ * - `/sign-in/email` for an account with two-factor on (`trustedDeviceCounts`, default on — AltEd's rule): the
+ *   two-factor plugin deletes that session straight after it is made unless the browser carries the trusted-device
+ *   cookie, which only a correct code issues. A record for a deleted session matches nothing;
+ * - `/change-password` **inherits** the proof of the session it replaces (the request's own), and never outlives it.
+ *
+ * Anything else proves nothing — `/two-factor/verify-otp` (an emailed code is no second factor where email is already
+ * a way in), an email link or social sign-in on a trusted device, `/verify-email`, and any sign-in route a later
+ * Better Auth adds. Fail-closed by construction: no record, no administration.
+ *
+ * **Only `/change-password` inherits.** Every other route that mints a session for a signed-in account —
+ * `/passkey/verify-registration` with `createSession: true` (1.7), `/two-factor/disable`, `/two-factor/enable` with
+ * `skipVerificationOnEnable`, a social or email-link sign-in on a trusted device — proves nothing. FB Web's plugin
+ * let any of them inherit with a fresh lifetime, and a passkey registration's new session opened its admin tools.
+ *
+ * **A revoked session is refused on the factor-change routes, for everyone (401).** The routes' own checks believe the
+ * five-minute cookie cache, so a signed-out administrator's kept cookies could read the authenticator's secret.
+ *
+ * **The back door.** From a session without the record, an administrator's factors cannot change: re-keying two-factor
+ * (`/two-factor/enable` once it is on), reading its key (`/two-factor/get-totp-uri`), new backup codes, turning it off,
+ * or adding a passkey. Each would hand whoever holds a Google account or a mailbox — and the password — a factor that
+ * then writes the record. Turning two-factor on for the first time stays open, or nobody could get out of the
+ * refusal. An administrator adds a passkey only from a recorded session, so with two-factor still off, only after a
+ * passkey sign-in. `stepUp()` still applies on top, to everybody; either refusal stops a registration.
+ *
+ * **Order**: list it after `twoFactor()` and `secondFactorEverywhere()` — `onAdminSignedIn` must see the session
+ * their hooks leave standing, and `init` refuses to start otherwise — and before `nextCookies()`.
+ */
+export interface AdminSecondFactorSessionsOptions {
+    /** Whether this account is an administrator now — from the database, never the session payload. */
+    isAdmin: (userId: string) => boolean | null | undefined | Promise<boolean | null | undefined>;
+    /** The record's prefix. Default `admin-second-factor:`. An adopting app passes its own, so its records keep counting. */
+    recordPrefix?: string;
+    /** A password sign-in that a trusted device let skip the code counts, for an account with two-factor on. Default true. */
+    trustedDeviceCounts?: boolean;
+    /**
+     * Called for each session an administrator signs in with — proven or not — that is still standing when the response
+     * leaves; never for a password change or a two-factor change rotating the session. Cannot fail the sign-in: an error
+     * is logged. Runs in the background with Better Auth's `advanced.backgroundTasks`.
+     */
+    onAdminSignedIn?: (event: AdminAuditEvent, signIn: AdminSignIn) => void | Promise<void>;
+    /** The actor's standing in the sign-in event. Default `"admin"`. */
+    standing?: string;
+    /** The sign-in event's scope. Default platform. */
+    scope?: AdminAuditScope;
+    /** The refusals' words. */
+    messages?: {
+        factorChange?: string;
+        passkeyNeedsTwoFactor?: string;
+    };
+}
+export interface AdminSignIn {
+    userId: string;
+    sessionId: string;
+    method: AdminSignInMethod;
+    proven: boolean;
+    path: string;
+    request?: Request;
+}
+export declare const ADMIN_SECOND_FACTOR_SESSIONS_ID = "admin-second-factor-sessions";
+/** Routes that create a session only after Better Auth has checked a second factor or a passkey. */
+export declare const ADMIN_PROVING_PATHS: readonly string[];
+/** Two-factor routes that change or read an administrator's factor. `enable` counts only once two-factor is on. */
+export declare const ADMIN_TWO_FACTOR_CHANGE_PATHS: readonly string[];
+export declare const ADMIN_PASSKEY_ADD_PATHS: readonly string[];
+export declare const ADMIN_SECOND_FACTOR_ERROR_CODES: {
+    readonly ADMIN_SECOND_FACTOR_REQUIRED: {
+        readonly code: "ADMIN_SECOND_FACTOR_REQUIRED";
+        readonly message: "Changing an administrator’s two-factor or passkeys needs a sign-in that used your authenticator code or a passkey. Sign out, then sign in with your email, password and code — or with a passkey — and try again.";
+    };
+    readonly ADMIN_PASSKEY_NEEDS_TWO_FACTOR: {
+        readonly code: "ADMIN_PASSKEY_NEEDS_TWO_FACTOR";
+        readonly message: "Administrators add passkeys once two-factor authentication is on. Turn it on first, then sign in with your code and add the passkey.";
+    };
+};
+interface SessionRow {
+    id: string;
+    userId: string;
+    expiresAt: Date | string;
+    ipAddress?: string | null;
+    userAgent?: string | null;
+}
+export declare function adminSecondFactorSessions(options: AdminSecondFactorSessionsOptions): {
+    id: "admin-second-factor-sessions";
+    options: {
+        recordPrefix: string;
+        trustedDeviceCounts: boolean;
+        /** Whether this account is an administrator now — from the database, never the session payload. */
+        isAdmin: (userId: string) => boolean | null | undefined | Promise<boolean | null | undefined>;
+        /**
+         * Called for each session an administrator signs in with — proven or not — that is still standing when the response
+         * leaves; never for a password change or a two-factor change rotating the session. Cannot fail the sign-in: an error
+         * is logged. Runs in the background with Better Auth's `advanced.backgroundTasks`.
+         */
+        onAdminSignedIn?: (event: AdminAuditEvent, signIn: AdminSignIn) => void | Promise<void>;
+        /** The actor's standing in the sign-in event. Default `"admin"`. */
+        standing?: string;
+        /** The sign-in event's scope. Default platform. */
+        scope?: AdminAuditScope;
+        /** The refusals' words. */
+        messages?: {
+            factorChange?: string;
+            passkeyNeedsTwoFactor?: string;
+        };
+    };
+    init(ctx: import("better-auth").AuthContext): {
+        options: {
+            databaseHooks: {
+                session: {
+                    create: {
+                        after: (session: SessionRow, endpoint: unknown) => Promise<void>;
+                    };
+                };
+            };
+        };
+    };
+    hooks: {
+        before: {
+            matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+            handler: import("better-auth/api").AuthMiddleware;
+        }[];
+        after: {
+            matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+            handler: import("better-auth/api").AuthMiddleware;
+        }[];
+    };
+    $ERROR_CODES: {
+        readonly ADMIN_SECOND_FACTOR_REQUIRED: {
+            readonly code: "ADMIN_SECOND_FACTOR_REQUIRED";
+            readonly message: "Changing an administrator’s two-factor or passkeys needs a sign-in that used your authenticator code or a passkey. Sign out, then sign in with your email, password and code — or with a passkey — and try again.";
+        };
+        readonly ADMIN_PASSKEY_NEEDS_TWO_FACTOR: {
+            readonly code: "ADMIN_PASSKEY_NEEDS_TWO_FACTOR";
+            readonly message: "Administrators add passkeys once two-factor authentication is on. Turn it on first, then sign in with your code and add the passkey.";
+        };
+    };
+};
+export {};
+//# sourceMappingURL=second-factor.d.ts.map

package/dist/admin/second-factor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"second-factor.d.ts","sourceRoot":"","sources":["../../src/admin/second-factor.ts"],"names":[],"mappings":"AASA,OAAO,EAAiB,KAAK,eAAe,EAAE,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,WAAW,gCAAgC;IAC/C,mGAAmG;IACnG,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC9F,yHAAyH;IACzH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0HAA0H;IAC1H,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,eAAO,MAAM,+BAA+B,iCAAiC,CAAC;AAE9E,oGAAoG;AACpG,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIhD,CAAC;AAMF,mHAAmH;AACnH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAK1D,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAGpD,CAAC;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;CAWlC,CAAC;AA0BX,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAiBD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gCAAgC;;;;;QAnHjF,mGAAmG;iBAC1F,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;QAK7F;;;;WAIG;0BACe,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACvF,oEAAoE;mBACzD,MAAM;QACjB,mDAAmD;gBAC3C,eAAe;QACvB,2BAA2B;mBAChB;YAAE,YAAY,CAAC,EAAE,MAAM,CAAC;YAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;SAAE;;;;;;;yCA+S/B,UAAU,YAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;EAenE"}

package/dist/admin/second-factor.js

@@ -0,0 +1,271 @@
+import { APIError, createAuthMiddleware, getAuthoritativeSessionFromCtx, getSessionFromCtx, isAPIError, } from "better-auth/api";
+import { adminSignedIn } from "./audit.js";
+import { DEFAULT_ADMIN_PROOF_PREFIX, adminProofIdentifier, isLiveProof } from "./proof.js";
+export const ADMIN_SECOND_FACTOR_SESSIONS_ID = "admin-second-factor-sessions";
+/** Routes that create a session only after Better Auth has checked a second factor or a passkey. */
+export const ADMIN_PROVING_PATHS = [
+    "/two-factor/verify-totp",
+    "/two-factor/verify-backup-code",
+    "/passkey/verify-authentication",
+];
+const PASSWORD_SIGN_IN = "/sign-in/email";
+const CHANGE_PASSWORD = "/change-password";
+const ENABLE = "/two-factor/enable";
+/** Two-factor routes that change or read an administrator's factor. `enable` counts only once two-factor is on. */
+export const ADMIN_TWO_FACTOR_CHANGE_PATHS = [
+    ENABLE,
+    "/two-factor/disable",
+    "/two-factor/get-totp-uri",
+    "/two-factor/generate-backup-codes",
+];
+export const ADMIN_PASSKEY_ADD_PATHS = [
+    "/passkey/generate-register-options",
+    "/passkey/verify-registration",
+];
+export const ADMIN_SECOND_FACTOR_ERROR_CODES = {
+    ADMIN_SECOND_FACTOR_REQUIRED: {
+        code: "ADMIN_SECOND_FACTOR_REQUIRED",
+        message: "Changing an administrator’s two-factor or passkeys needs a sign-in that used your authenticator code or a passkey. Sign out, then sign in with your email, password and code — or with a passkey — and try again.",
+    },
+    ADMIN_PASSKEY_NEEDS_TWO_FACTOR: {
+        code: "ADMIN_PASSKEY_NEEDS_TWO_FACTOR",
+        message: "Administrators add passkeys once two-factor authentication is on. Turn it on first, then sign in with your code and add the passkey.",
+    },
+};
+const SOCIAL_PATHS = new Set(["/callback/:id", "/oauth2/callback/:providerId", "/sign-in/social", "/one-tap/callback"]);
+function methodOf(path, proven) {
+    switch (path) {
+        case "/two-factor/verify-totp":
+            return "code";
+        case "/two-factor/verify-backup-code":
+            return "backup-code";
+        case "/passkey/verify-authentication":
+            return "passkey";
+        case PASSWORD_SIGN_IN:
+            return proven ? "trusted-device" : "password";
+        case "/magic-link/verify":
+            return "email-link";
+        default:
+            return SOCIAL_PATHS.has(path) ? "social" : "other";
+    }
+}
+const toDate = (value) => (value instanceof Date ? value : new Date(value));
+/** An error the route answered with. A redirect — an email link landing, an OAuth callback — is an APIError too. */
+function failed(returned) {
+    if (!isAPIError(returned))
+        return false;
+    const status = returned.statusCode ?? 500;
+    return status < 300 || status >= 400;
+}
+export function adminSecondFactorSessions(options) {
+    if (typeof options?.isAdmin !== "function") {
+        throw new Error("[admin-second-factor] adminSecondFactorSessions needs `isAdmin(userId)`.");
+    }
+    const prefix = options.recordPrefix ?? DEFAULT_ADMIN_PROOF_PREFIX;
+    const trustedDeviceCounts = options.trustedDeviceCounts !== false;
+    const standing = options.standing ?? "admin";
+    const key = (sessionId) => adminProofIdentifier(prefix, sessionId);
+    const isAdmin = async (userId) => (await options.isAdmin(userId)) === true;
+    let auth = null;
+    async function proofOf(sessionId, userId) {
+        const row = await auth.internalAdapter.findVerificationValue(key(sessionId));
+        return isLiveProof(row, userId) ? row : null;
+    }
+    /** Better Auth's `session.create.after`: write the record when the creating route proved the second factor. */
+    async function record(session, endpoint) {
+        const path = endpoint?.path;
+        if (!path || !auth)
+            return;
+        const proving = ADMIN_PROVING_PATHS.includes(path);
+        const trusted = trustedDeviceCounts && path === PASSWORD_SIGN_IN;
+        const inherits = path === CHANGE_PASSWORD;
+        if (!proving && !trusted && !inherits)
+            return;
+        try {
+            if (!(await isAdmin(session.userId)))
+                return;
+            let expiresAt = toDate(session.expiresAt);
+            if (trusted) {
+                const user = (await auth.internalAdapter.findUserById(session.userId));
+                if (user?.twoFactorEnabled !== true)
+                    return;
+            }
+            if (inherits) {
+                // The session being replaced — the request's own — is already deleted by now, so its record is what's asked,
+                // not whether it is still live. Inherited, it lasts no longer than the proof it came from.
+                const previous = endpoint?.context?.session?.session;
+                if (!previous?.id || previous.userId !== session.userId || previous.id === session.id)
+                    return;
+                const proof = await proofOf(previous.id, session.userId);
+                if (!proof)
+                    return;
+                const until = toDate(proof.expiresAt);
+                if (until < expiresAt)
+                    expiresAt = until;
+            }
+            await auth.internalAdapter.createVerificationValue({
+                identifier: key(session.id),
+                value: session.userId,
+                expiresAt,
+            });
+            await sweep(session.userId);
+        }
+        catch (error) {
+            // Without the record the administrator is asked to sign in again; failing the sign-in over a bookkeeping row
+            // would lock every account out instead.
+            auth.logger.error("[admin-second-factor] could not record how an administrator's session was made", error);
+        }
+    }
+    /** Sessions end on their own; their records are cleared here rather than by a job. */
+    async function sweep(userId) {
+        try {
+            await auth.adapter.deleteMany({
+                model: "verification",
+                where: [
+                    { field: "identifier", operator: "starts_with", value: prefix },
+                    { field: "value", value: userId },
+                    { field: "expiresAt", operator: "lte", value: new Date() },
+                ],
+            });
+        }
+        catch {
+            // Housekeeping only.
+        }
+    }
+    const refuseFactorChange = {
+        matcher: (ctx) => {
+            const path = ctx.path ?? "";
+            return ADMIN_TWO_FACTOR_CHANGE_PATHS.includes(path) || ADMIN_PASSKEY_ADD_PATHS.includes(path);
+        },
+        handler: createAuthMiddleware(async (ctx) => {
+            const live = (await getAuthoritativeSessionFromCtx(ctx));
+            if (!live?.session) {
+                // The routes' own session checks (`sessionMiddleware`, `freshSessionMiddleware`) believe the cookie cache for
+                // minutes after a session is revoked or signed out — long enough for kept cookies to read the authenticator's
+                // secret, mint backup codes, re-key two-factor or register a passkey. So a cookie whose session row is gone or
+                // expired is refused here, for everyone. Only a request with no session at all (a passkey-first sign-up) is
+                // left to the route's own rules.
+                const cached = await getSessionFromCtx(ctx).catch(() => null);
+                if (cached?.session) {
+                    throw new APIError("UNAUTHORIZED", { message: "Unauthorized", code: "UNAUTHORIZED" });
+                }
+                return;
+            }
+            if (!(await isAdmin(live.user.id)))
+                return;
+            const twoFactorOn = live.user.twoFactorEnabled === true;
+            const addsPasskey = ADMIN_PASSKEY_ADD_PATHS.includes(ctx.path);
+            // Turning two-factor on for the first time is how an administrator gets out of administration's refusal.
+            if (ctx.path === ENABLE && !twoFactorOn)
+                return;
+            if (await proofOf(live.session.id, live.user.id))
+                return;
+            const refusal = addsPasskey && !twoFactorOn
+                ? ADMIN_SECOND_FACTOR_ERROR_CODES.ADMIN_PASSKEY_NEEDS_TWO_FACTOR
+                : ADMIN_SECOND_FACTOR_ERROR_CODES.ADMIN_SECOND_FACTOR_REQUIRED;
+            const message = refusal.code === "ADMIN_PASSKEY_NEEDS_TWO_FACTOR"
+                ? (options.messages?.passkeyNeedsTwoFactor ?? refusal.message)
+                : (options.messages?.factorChange ?? refusal.message);
+            throw new APIError("FORBIDDEN", { code: refusal.code, message });
+        }),
+    };
+    const signedIn = {
+        matcher: () => !!options.onAdminSignedIn,
+        handler: createAuthMiddleware(async (ctx) => {
+            const notify = options.onAdminSignedIn;
+            // `newSession` is what the request leaves standing: the two-factor plugin (and `secondFactorEverywhere()`)
+            // clear it when they take the session away for the code screen.
+            const made = ctx.context.newSession;
+            if (!notify || !made?.session || failed(ctx.context.returned))
+                return;
+            const previous = ctx.context.session ?? null;
+            // A refresh keeps its id; a password or two-factor change rotates a signed-in session. Neither is a sign-in.
+            if (previous?.session?.id === made.session.id)
+                return;
+            if (previous?.user?.id === made.session.userId && !ADMIN_PROVING_PATHS.includes(ctx.path))
+                return;
+            try {
+                if (!(await isAdmin(made.session.userId)))
+                    return;
+                // By the record's own rule rather than by reading the record: Better Auth 1.6 runs database after-hooks once
+                // the endpoint has finished, after this hook. A password change, the one inheriting route, is not reported.
+                const proven = ADMIN_PROVING_PATHS.includes(ctx.path) ||
+                    (trustedDeviceCounts && ctx.path === PASSWORD_SIGN_IN && made.user.twoFactorEnabled === true);
+                const method = methodOf(ctx.path, proven);
+                const event = adminSignedIn({
+                    actor: { id: made.session.userId, name: made.user.name || made.user.email || made.session.userId, standing },
+                    sessionId: made.session.id,
+                    method,
+                    proven,
+                    ...(options.scope ? { scope: options.scope } : {}),
+                    ip: made.session.ipAddress ?? null,
+                    userAgent: made.session.userAgent ?? null,
+                });
+                const detail = {
+                    userId: made.session.userId,
+                    sessionId: made.session.id,
+                    method,
+                    proven,
+                    path: ctx.path,
+                    ...(ctx.request ? { request: ctx.request } : {}),
+                };
+                const logger = ctx.context.logger;
+                const run = (async () => {
+                    try {
+                        await notify(event, detail);
+                    }
+                    catch (error) {
+                        logger.error("[admin-second-factor] onAdminSignedIn failed; the sign-in stands", error);
+                    }
+                })();
+                await ctx.context.runInBackgroundOrAwait(run);
+            }
+            catch (error) {
+                ctx.context.logger.error("[admin-second-factor] could not describe an administrator's sign-in", error);
+            }
+        }),
+    };
+    return {
+        id: ADMIN_SECOND_FACTOR_SESSIONS_ID,
+        options: { ...options, recordPrefix: prefix, trustedDeviceCounts },
+        init(ctx) {
+            auth = ctx;
+            const plugins = ctx.options.plugins ?? [];
+            const own = plugins.findIndex((plugin) => plugin.id === ADMIN_SECOND_FACTOR_SESSIONS_ID);
+            const twoFactor = plugins.findIndex((plugin) => plugin.id === "two-factor");
+            const everywhere = plugins.findIndex((plugin) => plugin.id === "second-factor-everywhere");
+            if (twoFactor === -1) {
+                ctx.logger.warn("[admin-second-factor] no twoFactor() plugin is installed: only a passkey sign-in can prove the second factor.");
+            }
+            if (options.onAdminSignedIn &&
+                ((twoFactor !== -1 && twoFactor > own) || (everywhere !== -1 && everywhere > own))) {
+                throw new Error("[admin-second-factor] list adminSecondFactorSessions() after twoFactor() and secondFactorEverywhere(): " +
+                    "onAdminSignedIn has to see the session their hooks leave standing, or it would record a sign-in that is " +
+                    "still waiting for its code.");
+            }
+            const nextCookies = plugins.findIndex((plugin) => plugin.id === "next-cookies");
+            if (nextCookies !== -1 && nextCookies < own) {
+                ctx.logger.warn("[admin-second-factor] is listed after nextCookies(); list it before.");
+            }
+            return {
+                options: {
+                    databaseHooks: {
+                        session: {
+                            create: {
+                                after: async (session, endpoint) => {
+                                    await record(session, endpoint);
+                                },
+                            },
+                        },
+                    },
+                },
+            };
+        },
+        hooks: {
+            before: [refuseFactorChange],
+            after: [signedIn],
+        },
+        $ERROR_CODES: ADMIN_SECOND_FACTOR_ERROR_CODES,
+    };
+}
+//# sourceMappingURL=second-factor.js.map

package/dist/admin/second-factor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"second-factor.js","sourceRoot":"","sources":["../../src/admin/second-factor.ts"],"names":[],"mappings":"AACA,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,8BAA8B,EAC9B,iBAAiB,EACjB,UAAU,GACX,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,aAAa,EAAsE,MAAM,YAAY,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,WAAW,EAAiB,MAAM,YAAY,CAAC;AA4E1G,MAAM,CAAC,MAAM,+BAA+B,GAAG,8BAA8B,CAAC;AAE9E,oGAAoG;AACpG,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,yBAAyB;IACzB,gCAAgC;IAChC,gCAAgC;CACjC,CAAC;AAEF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAC3C,MAAM,MAAM,GAAG,oBAAoB,CAAC;AAEpC,mHAAmH;AACnH,MAAM,CAAC,MAAM,6BAA6B,GAAsB;IAC9D,MAAM;IACN,qBAAqB;IACrB,0BAA0B;IAC1B,mCAAmC;CACpC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,oCAAoC;IACpC,8BAA8B;CAC/B,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,4BAA4B,EAAE;QAC5B,IAAI,EAAE,8BAA8B;QACpC,OAAO,EACL,mNAAmN;KACtN;IACD,8BAA8B,EAAE;QAC9B,IAAI,EAAE,gCAAgC;QACtC,OAAO,EACL,sIAAsI;KACzI;CACO,CAAC;AAEX,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAExH,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAe;IAC7C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,yBAAyB;YAC5B,OAAO,MAAM,CAAC;QAChB,KAAK,gCAAgC;YACnC,OAAO,aAAa,CAAC;QACvB,KAAK,gCAAgC;YACnC,OAAO,SAAS,CAAC;QACnB,KAAK,gBAAgB;YACnB,OAAO,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC;QAChD,KAAK,oBAAoB;YACvB,OAAO,YAAY,CAAC;QACtB;YACE,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IACvD,CAAC;AACH,CAAC;AAqBD,MAAM,MAAM,GAAG,CAAC,KAAoB,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAE3F,oHAAoH;AACpH,SAAS,MAAM,CAAC,QAAiB;IAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,MAAM,GAAI,QAAoC,CAAC,UAAU,IAAI,GAAG,CAAC;IACvE,OAAO,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAyC;IACjF,IAAI,OAAO,OAAO,EAAE,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,IAAI,0BAA0B,CAAC;IAClE,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC;IAC7C,MAAM,GAAG,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC;IAEnF,IAAI,IAAI,GAAuB,IAAI,CAAC;IAEpC,KAAK,UAAU,OAAO,CAAC,SAAiB,EAAE,MAAc;QACtD,MAAM,GAAG,GAAG,MAAM,IAAK,CAAC,eAAe,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9E,OAAO,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED,+GAA+G;IAC/G,KAAK,UAAU,MAAM,CAAC,OAAmB,EAAE,QAA6C;QACtF,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO;QAC3B,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,mBAAmB,IAAI,IAAI,KAAK,gBAAgB,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,KAAK,eAAe,CAAC;QAC1C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC9C,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAAE,OAAO;YAE7C,IAAI,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAE7D,CAAC;gBACT,IAAI,IAAI,EAAE,gBAAgB,KAAK,IAAI;oBAAE,OAAO;YAC9C,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,6GAA6G;gBAC7G,2FAA2F;gBAC3F,MAAM,QAAQ,GAAG,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;gBACrD,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE;oBAAE,OAAO;gBAC9F,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBACzD,IAAI,CAAC,KAAK;oBAAE,OAAO;gBACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACtC,IAAI,KAAK,GAAG,SAAS;oBAAE,SAAS,GAAG,KAAK,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC;gBACjD,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,KAAK,EAAE,OAAO,CAAC,MAAM;gBACrB,SAAS;aACV,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6GAA6G;YAC7G,wCAAwC;YACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gFAAgF,EAAE,KAAK,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,KAAK,UAAU,KAAK,CAAC,MAAc;QACjC,IAAI,CAAC;YACH,MAAM,IAAK,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC7B,KAAK,EAAE,cAAc;gBACrB,KAAK,EAAE;oBACL,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE;oBAC/D,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE;oBACjC,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE;iBAC3D;aACF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GAAe;QACrC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5B,OAAO,6BAA6B,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,CAAC,MAAM,8BAA8B,CAAC,GAAG,CAAC,CAG/C,CAAC;YACT,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;gBACnB,8GAA8G;gBAC9G,8GAA8G;gBAC9G,+GAA+G;gBAC/G,4GAA4G;gBAC5G,iCAAiC;gBACjC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC9D,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;oBACpB,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO;YAE3C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC;YACxD,MAAM,WAAW,GAAG,uBAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/D,yGAAyG;YACzG,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,WAAW;gBAAE,OAAO;YAChD,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,OAAO;YAEzD,MAAM,OAAO,GACX,WAAW,IAAI,CAAC,WAAW;gBACzB,CAAC,CAAC,+BAA+B,CAAC,8BAA8B;gBAChE,CAAC,CAAC,+BAA+B,CAAC,4BAA4B,CAAC;YACnE,MAAM,OAAO,GACX,OAAO,CAAC,IAAI,KAAK,gCAAgC;gBAC/C,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC;gBAC9D,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1D,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC;KACH,CAAC;IAEF,MAAM,QAAQ,GAAc;QAC1B,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe;QACxC,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;YACvC,2GAA2G;YAC3G,gEAAgE;YAChE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,UAGjB,CAAC;YACT,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO;YACtE,MAAM,QAAQ,GAAI,GAAG,CAAC,OAAO,CAAC,OAAwE,IAAI,IAAI,CAAC;YAC/G,6GAA6G;YAC7G,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,OAAO;YACtD,IAAI,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO;YAClG,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBAAE,OAAO;gBAClD,6GAA6G;gBAC7G,4GAA4G;gBAC5G,MAAM,MAAM,GACV,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtC,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC;gBAChG,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,aAAa,CAAC;oBAC1B,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE;oBAC5G,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;oBAC1B,MAAM;oBACN,MAAM;oBACN,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI;oBAClC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI;iBAC1C,CAAC,CAAC;gBACH,MAAM,MAAM,GAAgB;oBAC1B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;oBAC3B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;oBAC1B,MAAM;oBACN,MAAM;oBACN,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjD,CAAC;gBACF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;gBAClC,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE;oBACtB,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBAC9B,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,KAAK,CAAC,kEAAkE,EAAE,KAAK,CAAC,CAAC;oBAC1F,CAAC;gBACH,CAAC,CAAC,EAAE,CAAC;gBACL,MAAM,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qEAAqE,EAAE,KAAK,CAAC,CAAC;YACzG,CAAC;QACH,CAAC,CAAC;KACH,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,+BAA+B;QACnC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE;QAClE,IAAI,CAAC,GAAG;YACN,IAAI,GAAG,GAAG,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,+BAA+B,CAAC,CAAC;YACzF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;YAC5E,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,0BAA0B,CAAC,CAAC;YAC3F,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,+GAA+G,CAChH,CAAC;YACJ,CAAC;YACD,IACE,OAAO,CAAC,eAAe;gBACvB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC,IAAI,UAAU,GAAG,GAAG,CAAC,CAAC,EAClF,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,yGAAyG;oBACvG,0GAA0G;oBAC1G,6BAA6B,CAChC,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,cAAc,CAAC,CAAC;YAChF,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,WAAW,GAAG,GAAG,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO;gBACL,OAAO,EAAE;oBACP,aAAa,EAAE;wBACb,OAAO,EAAE;4BACP,MAAM,EAAE;gCACN,KAAK,EAAE,KAAK,EAAE,OAAmB,EAAE,QAAiB,EAAE,EAAE;oCACtD,MAAM,MAAM,CAAC,OAAO,EAAE,QAAmC,CAAC,CAAC;gCAC7D,CAAC;6BACF;yBACF;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;QACD,KAAK,EAAE;YACL,MAAM,EAAE,CAAC,kBAAkB,CAAC;YAC5B,KAAK,EAAE,CAAC,QAAQ,CAAC;SAClB;QACD,YAAY,EAAE,+BAA+B;KACnB,CAAC;AAC/B,CAAC"}

package/dist/admin/testing-index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `@connextar/house/admin/testing` — Node helpers for an app's own tests: the guard-coverage sweep, and a cookie store
+ * for exercising "view as". Reads the file system, so it belongs in tests and nowhere else.
+ */
+export { AdminGuardCoverageError, assertAdminGuardCoverage, checkAdminGuardCoverage, memoryCookieJar, stripComments, type AdminGuardCoverageOptions, type AdminGuardCoverageReport, } from "./testing.js";
+//# sourceMappingURL=testing-index.d.ts.map

package/dist/admin/testing-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing-index.d.ts","sourceRoot":"","sources":["../../src/admin/testing-index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,aAAa,EACb,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,cAAc,CAAC"}

package/dist/admin/testing-index.js

@@ -0,0 +1,6 @@
+/**
+ * `@connextar/house/admin/testing` — Node helpers for an app's own tests: the guard-coverage sweep, and a cookie store
+ * for exercising "view as". Reads the file system, so it belongs in tests and nowhere else.
+ */
+export { AdminGuardCoverageError, assertAdminGuardCoverage, checkAdminGuardCoverage, memoryCookieJar, stripComments, } from "./testing.js";
+//# sourceMappingURL=testing-index.js.map

package/dist/admin/testing-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing-index.js","sourceRoot":"","sources":["../../src/admin/testing-index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,aAAa,GAGd,MAAM,cAAc,CAAC"}

package/dist/admin/testing.d.ts

@@ -0,0 +1,84 @@
+import type { ViewAsCookieOptions } from "./view-as.js";
+/**
+ * The bypass sweep: every admin surface goes through the one guard — generalised from PharmaLine's
+ * `admin-guard.test.ts`, the strongest of the apps' versions, with Quickie's checks that nothing escapes it.
+ *
+ * The rule lives in one guard. A page or route that forgot to call it serves administration without it, and no type
+ * or test of the guard itself notices — so this reads every one of them, and fails the day one is added without:
+ *
+ * - **Routes:** in every `route.ts` under `apiDirs` (and under `pageDirs`), the guard is the **first `await`** of every
+ *   handler — not merely called somewhere, after a body was parsed or a row read. Handlers must be exported as
+ *   `export async function GET(…)`; `export const GET = …` or `export { x as GET }` is reported, since the sweep
+ *   cannot read it. A handler that grants nothing (stopping a "view as") goes in `exempt`, with why.
+ * - **Pages:** every page file under `pageDirs` awaits the page guard itself — a layout is not re-rendered on every
+ *   navigation between its children, so a guard only there guards only the first page visited (PM Tool).
+ * - **No server actions** under either: a `"use server"` file is an endpoint the route sweep cannot see.
+ * - **The flag:** only allow-listed files mention the raw admin flag, each with a reason. A new reader fails until
+ *   someone has checked it goes through the guard; an entry that no longer reads it fails too, so the list stays true.
+ *
+ * Comments are ignored when looking for the guard (a comment saying `await requireAdmin()` is not a call), and kept
+ * when looking for the flag (a comment naming it is still listed, with "comment" as its reason — as PharmaLine does).
+ */
+export interface AdminGuardCoverageOptions {
+    /** The app's root. Default `process.cwd()`. */
+    root?: string;
+    /** Where the admin API routes are, relative to the root: `["app/api/admin"]`. */
+    apiDirs: readonly string[];
+    /** Where the admin pages are: `["app/dashboard/admin"]`. */
+    pageDirs: readonly string[];
+    /** The route guard's name — or names — as called: `"requirePlatformAdmin"`. */
+    apiGuard: string | readonly string[];
+    /** The page guard's name — or names: `"requirePlatformAdminPage"`. */
+    pageGuard: string | readonly string[];
+    /** Who may mention the raw admin flag. */
+    flagReaders?: {
+        pattern: RegExp;
+        /** Where to look: `["app", "components", "lib"]`. */
+        dirs: readonly string[];
+        /** Each file that may, relative to the root, and why that is safe. */
+        allowed: Record<string, string>;
+        /** Files to leave out besides tests — generated code. */
+        ignore?: (file: string) => boolean;
+    };
+    /** `"<route file> <METHOD>"` → why it needs no guard. */
+    exempt?: Record<string, string>;
+    /** Which files are pages. Default `page.tsx`, `page.ts`, `page.jsx`, `page.js`. */
+    pageFile?: RegExp;
+    /** Fewer than this many found is a problem: a moved folder would otherwise pass with nothing checked. Default 1 each. */
+    minimum?: {
+        routes?: number;
+        handlers?: number;
+        pages?: number;
+    };
+}
+export interface AdminGuardCoverageReport {
+    routes: string[];
+    /** `"<route file> <METHOD>"`, each checked. */
+    handlers: string[];
+    pages: string[];
+    flagReaders: string[];
+    problems: string[];
+}
+export declare class AdminGuardCoverageError extends Error {
+    readonly problems: string[];
+    constructor(problems: string[]);
+}
+/** Source with its comments blanked out, strings and template literals left as they are. */
+export declare function stripComments(source: string): string;
+/** The sweep, answering every problem it found rather than stopping at the first. */
+export declare function checkAdminGuardCoverage(options: AdminGuardCoverageOptions): AdminGuardCoverageReport;
+/** The sweep, throwing every problem at once. Answers what it checked, so a test can say how much. */
+export declare function assertAdminGuardCoverage(options: AdminGuardCoverageOptions): AdminGuardCoverageReport;
+/** A cookie store in memory, shaped like Next's `cookies()`, for testing an app's "view as". */
+export declare function memoryCookieJar(initial?: Record<string, string>): {
+    get(name: string): {
+        name: string;
+        value: string;
+    } | undefined;
+    set(name: string, value: string, options?: ViewAsCookieOptions): void;
+    delete(name: string): void;
+    /** What `set` was given for a cookie. */
+    options(name: string): ViewAsCookieOptions | undefined;
+    has(name: string): boolean;
+};
+//# sourceMappingURL=testing.d.ts.map

package/dist/admin/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../src/admin/testing.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAa,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,yBAAyB;IACxC,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACrC,sEAAsE;IACtE,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACtC,0CAA0C;IAC1C,WAAW,CAAC,EAAE;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,qDAAqD;QACrD,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;QACxB,sEAAsE;QACtE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,yDAAyD;QACzD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;KACpC,CAAC;IACF,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yHAAyH;IACzH,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAClE;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAEhB,QAAQ,EAAE,MAAM,EAAE;CAO/B;AAeD,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA6CpD;AAkBD,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,yBAAyB,GAAG,wBAAwB,CAyGpG;AAMD,sGAAsG;AACtG,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,wBAAwB,CAIrG;AAED,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;cAItD,MAAM;;;;cAIN,MAAM,SAAS,MAAM,YAAY,mBAAmB;iBAIjD,MAAM;IAInB,yCAAyC;kBAC3B,MAAM;cAGV,MAAM;EAKnB"}