@crossauth/backend 0.0.8 → 0.0.10

package/dist/index.js

@@ -1,10 +1,10 @@
 var Ae = Object.defineProperty;
 var Ie = (S, s, e) => s in S ? Ae(S, s, { enumerable: !0, configurable: !0, writable: !0, value: e }) : S[s] = e;
 var h = (S, s, e) => Ie(S, typeof s != "symbol" ? s + "" : s, e);
-import { CrossauthError as o, ErrorCode as l, UserState as b, CrossauthLogger as u, j as f, OAuthFlows as E, KeyPrefix as U, OAuthTokenConsumerBase as Pe, OAuthClientBase as Ke } from "@crossauth/common";
+import { CrossauthError as o, ErrorCode as l, UserState as E, CrossauthLogger as u, j as f, OAuthFlows as b, KeyPrefix as U, OAuthTokenConsumerBase as Pe, OAuthClientBase as Ke } from "@crossauth/common";
 import { PrismaClient as oe, Prisma as X } from "@prisma/client";
 import ge from "ldapjs";
-import { timingSafeEqual as me, randomBytes as ce, randomUUID as Oe, createHash as Fe, pbkdf2 as Ne, createHmac as we, createCipheriv as De, createDecipheriv as Re, randomInt as ee } from "node:crypto";
+import { timingSafeEqual as me, randomBytes as ce, randomUUID as Fe, createHash as Oe, pbkdf2 as Ne, createHmac as we, createCipheriv as Re, createDecipheriv as De, randomInt as ee } from "node:crypto";
 import { promisify as xe } from "node:util";
 import W from "nunjucks";
 import Ee from "nodemailer";
@@ -198,17 +198,17 @@ class G extends H {
       i = new o(l.UserNotExist);
     }
     if (this.prismaClient || (i = new o(l.Connection)), i) throw i;
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == b.awaitingTwoFactorSetup)
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.awaitingTwoFactorSetup)
       throw u.logger.debug(f({ msg: "2FA setup is not complete" })), new o(l.TwoFactorIncomplete);
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == b.disabled)
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.disabled)
       throw u.logger.debug(f({ msg: "User is deactivated" })), new o(l.UserNotActive);
-    if ((r == null ? void 0 : r.skipEmailVerifiedCheck) != !0 && a.state == b.awaitingEmailVerification)
+    if ((r == null ? void 0 : r.skipEmailVerifiedCheck) != !0 && a.state == E.awaitingEmailVerification)
       throw u.logger.debug(f({ msg: "User has not verified email" })), new o(l.EmailNotVerified);
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == b.passwordChangeNeeded)
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.passwordChangeNeeded)
       throw u.logger.debug(f({ msg: "User must change password" })), new o(l.PasswordChangeNeeded);
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && (a.state == b.passwordResetNeeded || a.state == b.passwordAndFactor2ResetNeeded))
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && (a.state == E.passwordResetNeeded || a.state == E.passwordAndFactor2ResetNeeded))
       throw u.logger.debug(f({ msg: "User must reset password" })), new o(l.PasswordResetNeeded);
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == b.factor2ResetNeeded)
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.factor2ResetNeeded)
       throw u.logger.debug(f({ msg: "2FA reset required" })), new o(l.Factor2ResetNeeded);
     const n = a.secrets || {};
     return a.secrets && (delete n[this.useridForeignKeyColumn], delete a.secrets), { user: { ...a, id: a[this.idColumn] }, secrets: { userid: a[this.idColumn], ...n } };
@@ -767,7 +767,7 @@ class Tt extends ue {
       }
     if (i) {
       for (let d = 0; d < i.length; ++d)
-        if (!E.isValidFlow(i[d])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[d]);
+        if (!b.isValidFlow(i[d])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[d]);
     }
     try {
       c = await t[this.clientTable].create({
@@ -854,7 +854,7 @@ class Tt extends ue {
       }
     if (i) {
       for (let a = 0; a < i.length; ++a)
-        if (!E.isValidFlow(i[a])) throw new o(l.InvalidOAuthFlow, "Redirect Uri's may not contain page fragments");
+        if (!b.isValidFlow(i[a])) throw new o(l.InvalidOAuthFlow, "Redirect Uri's may not contain page fragments");
     }
     try {
       let a = { ...e };
@@ -1037,17 +1037,17 @@ class kt extends H {
     if (r in this.usersByUsername) {
       const i = this.usersByUsername[r];
       if (!i) throw new o(l.UserNotExist);
-      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == b.passwordChangeNeeded)
+      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == E.passwordChangeNeeded)
         throw u.logger.debug(f({ msg: "Password change required" })), new o(l.PasswordChangeNeeded);
-      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && (i.state == b.passwordResetNeeded || i.state == b.passwordAndFactor2ResetNeeded))
+      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && (i.state == E.passwordResetNeeded || i.state == E.passwordAndFactor2ResetNeeded))
         throw u.logger.debug(f({ msg: "Password reset required" })), new o(l.PasswordResetNeeded);
-      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == b.factor2ResetNeeded)
+      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == E.factor2ResetNeeded)
         throw u.logger.debug(f({ msg: "2FA reset required" })), new o(l.Factor2ResetNeeded);
-      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == b.awaitingTwoFactorSetup)
+      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == E.awaitingTwoFactorSetup)
         throw u.logger.debug(f({ msg: "2FA setup is not complete" })), new o(l.TwoFactorIncomplete);
-      if ((t == null ? void 0 : t.skipEmailVerifiedCheck) != !0 && i.state == b.awaitingEmailVerification)
+      if ((t == null ? void 0 : t.skipEmailVerifiedCheck) != !0 && i.state == E.awaitingEmailVerification)
         throw u.logger.debug(f({ msg: "User email not verified" })), new o(l.EmailNotVerified);
-      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == b.disabled)
+      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == E.disabled)
         throw u.logger.debug(f({ msg: "User is deactivated" })), new o(l.UserNotActive);
       const a = this.secretsByUsername[r];
       return { user: { ...i }, secrets: { userid: i.id, ...a } };
@@ -1672,17 +1672,17 @@ class Y extends H {
       if (c = `select * from ${this.userSecretsTable} where ${this.useridForeignKeyColumn} = $1`, d = await i.execute(c, [a.id]), d.length == 0)
         throw new o(l.UserNotExist);
       if (d.length > 0 ? n = { userid: a.id, ...d[0] } : n = { userid: a.id }, !n) throw new o(l.UserNotExist);
-      if (this.useridForeignKeyColumn != "userid" && this.useridForeignKeyColumn in n && delete n[this.useridForeignKeyColumn], await i.commit(), (r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == b.awaitingTwoFactorSetup)
+      if (this.useridForeignKeyColumn != "userid" && this.useridForeignKeyColumn in n && delete n[this.useridForeignKeyColumn], await i.commit(), (r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.awaitingTwoFactorSetup)
         throw u.logger.debug(f({ msg: "2FA setup is not complete" })), new o(l.TwoFactorIncomplete);
-      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == b.disabled)
+      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.disabled)
         throw u.logger.debug(f({ msg: "User is deactivated" })), new o(l.UserNotActive);
-      if ((r == null ? void 0 : r.skipEmailVerifiedCheck) != !0 && a.state == b.awaitingEmailVerification)
+      if ((r == null ? void 0 : r.skipEmailVerifiedCheck) != !0 && a.state == E.awaitingEmailVerification)
         throw u.logger.debug(f({ msg: "User has not verified email" })), new o(l.EmailNotVerified);
-      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == b.passwordChangeNeeded)
+      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.passwordChangeNeeded)
         throw u.logger.debug(f({ msg: "User must change password" })), new o(l.PasswordChangeNeeded);
-      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && (a.state == b.passwordResetNeeded || a.state == b.passwordAndFactor2ResetNeeded))
+      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && (a.state == E.passwordResetNeeded || a.state == E.passwordAndFactor2ResetNeeded))
         throw u.logger.debug(f({ msg: "User must reset password" })), new o(l.PasswordResetNeeded);
-      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == b.factor2ResetNeeded)
+      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && a.state == E.factor2ResetNeeded)
         throw u.logger.debug(f({ msg: "2FA reset required" })), new o(l.Factor2ResetNeeded);
       return { user: a, secrets: n };
     } catch (c) {
@@ -2200,7 +2200,7 @@ class We extends ue {
       }
     if (i) {
       for (let C = 0; C < i.length; ++C)
-        if (!E.isValidFlow(i[C])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[C]);
+        if (!b.isValidFlow(i[C])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[C]);
     }
     let c = [], d = [], w = [], y = this.dbPool.parameters();
     try {
@@ -2285,7 +2285,7 @@ class We extends ue {
       }
     if (i) {
       for (let v = 0; v < i.length; ++v)
-        if (!E.isValidFlow(i[v])) throw new o(l.InvalidOAuthFlow, "Redirect Uri's may not contain page fragments");
+        if (!b.isValidFlow(i[v])) throw new o(l.InvalidOAuthFlow, "Redirect Uri's may not contain page fragments");
     }
     if (!t.client_id) throw new o(l.InvalidClientId, "No client ig given");
     let { client_id: a, redirect_uri: n, valid_flow: c, ...d } = t;
@@ -2626,7 +2626,7 @@ const pe = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * Creates a UUID
    */
   static uuid() {
-    return Oe();
+    return Fe();
   }
   /**
    * Standard hash using SHA256 (not PBKDF2 or HMAC)
@@ -2644,7 +2644,7 @@ const pe = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
    * @returns the string containing the hash 
    */
   static sha256(s) {
-    return Fe("sha256").update(s).digest("base64url");
+    return Oe("sha256").update(s).digest("base64url");
   }
   /**
    * Hashes a password and returns it as a base64 or base64url encoded string
@@ -2746,7 +2746,7 @@ const pe = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
   static symmetricEncrypt(s, e, t = void 0) {
     t || (t = ce(16));
     let r = Buffer.from(e, "base64url");
-    var i = De("aes-256-cbc", r, t);
+    var i = Re("aes-256-cbc", r, t);
     let a = i.update(s);
     return a = Buffer.concat([a, i.final()]), t.toString("base64url") + "." + a.toString("base64url");
   }
@@ -2762,7 +2762,7 @@ const pe = process.env.PBKDF2_DIGEST || "sha256", Ce = Number(process.env.PBKDF2
     const r = s.split(".");
     if (r.length != 2) throw new o(l.InvalidHash, "Not AES-256-CBC ciphertext");
     let i = Buffer.from(r[0], "base64url"), a = Buffer.from(r[1], "base64url");
-    var n = Re("aes-256-cbc", t, i);
+    var n = De("aes-256-cbc", t, i);
     let c = n.update(a);
     return c = Buffer.concat([c, n.final()]), c.toString();
   }
@@ -3382,7 +3382,7 @@ class Ue extends Q {
     return (await Be(this.accountSid, this.authToken).messages.create(r)).sid;
   }
 }
-class Ot extends re {
+class Ft extends re {
   /**
    * Constructor
    * 
@@ -3545,7 +3545,7 @@ class Ot extends re {
     return Array(+(r > 0 && r)).join("0") + e;
   }
 }
-class Ft extends be {
+class Ot extends be {
   /**
    * Create a new authenticator.
    * 
@@ -3819,7 +3819,7 @@ class Nt extends re {
   }
 }
 const se = 16;
-class R {
+class D {
   /**
    * Construct a new EmailVerifier.
    * 
@@ -3879,11 +3879,11 @@ class R {
     let r = 0;
     const i = /* @__PURE__ */ new Date(), a = new Date(i.getTime() + 1e3 * this.verifyEmailExpires);
     for (; r < 10; ) {
-      let n = T.randomValue(se), c = R.hashEmailVerificationToken(n);
+      let n = T.randomValue(se), c = D.hashEmailVerificationToken(n);
       try {
         return await this.keyStorage.saveKey(s, c, i, a, e), n;
       } catch {
-        n = T.randomValue(se), c = R.hashEmailVerificationToken(n), r++;
+        n = T.randomValue(se), c = D.hashEmailVerificationToken(n), r++;
       }
     }
     throw new o(l.Connection, "failed creating a unique key");
@@ -3924,7 +3924,7 @@ class R {
         "Either emailVerificationTextBody or emailVerificationHtmlBody must be set to send email verification emails"
       );
     let { user: r } = await this.userStorage.getUserById(s, { skipEmailVerifiedCheck: !0 }), i = e;
-    i != "" ? R.validateEmail(i) : (i = r.email ?? r.username, i || (i = r.username), R.validateEmail(i)), R.validateEmail(i);
+    i != "" ? D.validateEmail(i) : (i = r.email ?? r.username, i || (i = r.username), D.validateEmail(i)), D.validateEmail(i);
     const a = await this.createAndSaveEmailVerificationToken(s, e), n = await this._sendEmailVerificationToken(a, i, t);
     u.logger.info(f({ msg: "Sent email verification email", emailMessageId: n, email: i }));
   }
@@ -3944,20 +3944,20 @@ class R {
    *          address the user is validating
    */
   async verifyEmailVerificationToken(s) {
-    const e = R.hashEmailVerificationToken(s);
+    const e = D.hashEmailVerificationToken(s);
     let t = await this.keyStorage.getKey(e);
     try {
       if (!t.userid || !t.expires) throw new o(l.InvalidKey);
       const { user: r } = await this.userStorage.getUserById(t.userid, { skipEmailVerifiedCheck: !0 });
       let i = (r.email ?? r.username).toLowerCase();
-      if (i || (i = r.username.toLowerCase()), R.validateEmail(i), (/* @__PURE__ */ new Date()).getTime() > t.expires.getTime()) throw new o(l.Expired);
+      if (i || (i = r.username.toLowerCase()), D.validateEmail(i), (/* @__PURE__ */ new Date()).getTime() > t.expires.getTime()) throw new o(l.Expired);
       return { userid: t.userid, newEmail: t.data ?? "" };
     } finally {
     }
   }
   async deleteEmailVerificationToken(s) {
     try {
-      const e = R.hashEmailVerificationToken(s);
+      const e = D.hashEmailVerificationToken(s);
       await this.keyStorage.deleteKey(e);
     } catch (e) {
       const t = o.asCrossauthError(e);
@@ -3968,11 +3968,11 @@ class R {
     let t = 0;
     const r = /* @__PURE__ */ new Date(), i = new Date(r.getTime() + 1e3 * this.passwordResetExpires);
     for (; t < 10; ) {
-      let a = T.randomValue(se), n = R.hashPasswordResetToken(a);
+      let a = T.randomValue(se), n = D.hashPasswordResetToken(a);
       try {
         return await this.keyStorage.saveKey(s, n, r, i), a;
       } catch {
-        a = T.randomValue(se), n = R.hashPasswordResetToken(a), t++;
+        a = T.randomValue(se), n = D.hashPasswordResetToken(a), t++;
       }
     }
     throw new o(l.Connection, "failed creating a unique key");
@@ -3992,7 +3992,7 @@ class R {
    * @returns the user that the token is for
    */
   async verifyPasswordResetToken(s) {
-    const e = R.hashPasswordResetToken(s);
+    const e = D.hashPasswordResetToken(s);
     u.logger.debug("verifyPasswordResetToken " + s + " " + e);
     let t = await this.keyStorage.getKey(e);
     if (!t.userid) throw new o(l.InvalidKey);
@@ -4001,7 +4001,7 @@ class R {
       t.userid,
       { skipActiveCheck: !0 }
     );
-    if (r.state != b.active && r.state != b.passwordResetNeeded && r.state != b.passwordAndFactor2ResetNeeded)
+    if (r.state != E.active && r.state != E.passwordResetNeeded && r.state != E.passwordAndFactor2ResetNeeded)
       throw new o(l.UserNotActive);
     if ((/* @__PURE__ */ new Date()).getTime() > t.expires.getTime()) throw new o(l.Expired);
     return r;
@@ -4029,21 +4029,21 @@ class R {
    * @param extraData : these extra variables will be passed to the Nunjucks 
    *        templates
    */
-  async sendPasswordResetToken(s, e = {}) {
+  async sendPasswordResetToken(s, e = {}, t = !1) {
     if (!this.passwordResetTextBody && !this.passwordResetHtmlBody)
       throw new o(
         l.Configuration,
         "Either passwordResetTextBody or passwordResetTextBody must be set to send email verification emails"
       );
-    let { user: t } = await this.userStorage.getUserById(s, {
+    let { user: r } = await this.userStorage.getUserById(s, {
       skipActiveCheck: !0
     });
-    if (t.state != b.active && t.state != b.passwordResetNeeded && t.state != b.passwordAndFactor2ResetNeeded)
+    if (!t && r.state != E.active && r.state != E.passwordResetNeeded && r.state != E.passwordAndFactor2ResetNeeded)
       throw new o(l.UserNotActive);
-    let r = (t.email ?? t.username).toLowerCase();
-    r || (r = t.username.toLowerCase()), R.validateEmail(r);
-    const i = await this.createAndSavePasswordResetToken(s), a = await this._sendPasswordResetToken(i, r, e);
-    u.logger.info(f({ msg: "Sent password reset email", emailMessageId: a, email: r }));
+    let i = (r.email ?? r.username).toLowerCase();
+    i || (i = r.username.toLowerCase()), D.validateEmail(i);
+    const a = await this.createAndSavePasswordResetToken(s), n = await this._sendPasswordResetToken(a, i, e);
+    u.logger.info(f({ msg: "Sent password reset email", emailMessageId: n, email: i }));
   }
   /**
    * Returns true if the given email has a valid format, false otherwise.
@@ -4063,11 +4063,11 @@ class R {
    * @param email the email to validate
    */
   static validateEmail(s) {
-    if (s == null || !R.isEmailValid(s)) throw new o(l.InvalidEmail);
+    if (s == null || !D.isEmailValid(s)) throw new o(l.InvalidEmail);
   }
 }
 const _e = 16, ke = 16;
-function Dt(S) {
+function Rt(S) {
   return {
     ...S,
     path: S.path ?? "/"
@@ -4377,7 +4377,7 @@ class x {
     e && (e = x.hashSessionId(e)), await this.keyStorage.deleteAllForUser(s, U.session, e);
   }
 }
-class Rt {
+class Dt {
   /**
    * Constructor
    * @param keyStorage  the {@link KeyStorage} instance to use, eg {@link PrismaKeyStorage}.
@@ -4401,7 +4401,7 @@ class Rt {
       this.authenticators[r].factorName = r;
     if (this.session = new x(this.keyStorage, { ...t == null ? void 0 : t.sessionCookieOptions, ...t ?? {} }), this.csrfTokens = new rt({ ...t == null ? void 0 : t.doubleSubmitCookieOptions, ...t ?? {} }), m("allowedFactor2", g.JsonArray, this, t, "ALLOWED_FACTOR2"), m("enableEmailVerification", g.Boolean, this, t, "ENABLE_EMAIL_VERIFICATION"), m("enablePasswordReset", g.Boolean, this, t, "ENABLE_PASSWORD_RESET"), this.emailTokenStorage = this.keyStorage, this.userStorage && (this.enableEmailVerification || this.enablePasswordReset)) {
       let r = this.keyStorage;
-      t.emailTokenStorage && (this.emailTokenStorage = t.emailTokenStorage), this.tokenEmailer = new R(this.userStorage, r, t);
+      t.emailTokenStorage && (this.emailTokenStorage = t.emailTokenStorage), this.tokenEmailer = new D(this.userStorage, r, t);
     }
   }
   /**
@@ -4466,9 +4466,9 @@ class Rt {
       await this.authenticators[i.factor1].authenticateUser(i, n, e);
     }
     let c;
-    if (i.state == b.passwordChangeNeeded)
+    if (i.state == E.passwordChangeNeeded)
       c = (await this.createAnonymousSession({ data: JSON.stringify({ passwordchange: { username: i.username } }) })).sessionCookie;
-    else if (i.state == b.factor2ResetNeeded)
+    else if (i.state == E.factor2ResetNeeded)
       c = (await this.createAnonymousSession({ data: JSON.stringify({ factor2change: { username: i.username } }) })).sessionCookie;
     else if (!a && i.factor2 && i.factor2 != "") {
       const { sessionCookie: p } = await this.initiateTwoFactorLogin(i);
@@ -4825,7 +4825,7 @@ class Rt {
     let t = !1, { user: r, key: i } = await this.session.getUserForSessionId(e, {
       skipActiveCheck: !0
     });
-    if (r && r.state != b.active && r.state != b.factor2ResetNeeded)
+    if (r && r.state != E.active && r.state != E.factor2ResetNeeded)
       throw new o(l.UserNotActive);
     if (!i) throw new o(l.InvalidKey, "Session key not found");
     let a = z.decodeData(i.data)["2fa"];
@@ -4844,7 +4844,7 @@ class Rt {
       state: !y && this.enableEmailVerification ? "awaitingemailverification" : "active",
       factor2: a.factor2
     };
-    return await this.userStorage.updateUser(p, d), !y && t && this.enableEmailVerification && this.tokenEmailer && await ((_ = this.tokenEmailer) == null ? void 0 : _.sendEmailVerificationToken(r.id, void 0)), await this.keyStorage.updateData(x.hashSessionId(i.value), "2fa", void 0), { ...r, ...p };
+    return c.secretNames().length > 0 ? await this.userStorage.updateUser(p, d) : await this.userStorage.updateUser(p), !y && t && this.enableEmailVerification && this.tokenEmailer && await ((_ = this.tokenEmailer) == null ? void 0 : _.sendEmailVerificationToken(r.id, void 0)), await this.keyStorage.updateData(x.hashSessionId(i.value), "2fa", void 0), { ...r, ...p };
   }
   /**
    * Initiates the two factor login process.
@@ -4975,7 +4975,7 @@ class Rt {
     const { user: e } = await this.userStorage.getUserByEmail(s, {
       skipActiveCheck: !0
     });
-    if (e.state != b.active && e.state != b.passwordResetNeeded && e.state != b.passwordAndFactor2ResetNeeded)
+    if (e.state != E.active && e.state != E.passwordResetNeeded && e.state != E.passwordAndFactor2ResetNeeded)
       throw new o(l.UserNotActive);
     await ((t = this.tokenEmailer) == null ? void 0 : t.sendPasswordResetToken(e.id));
   }
@@ -5037,28 +5037,31 @@ class Rt {
    * @param newUser the new user details
    * @returns true if email verification is now needed, false otherwise
    */
-  async updateUser(s, e, t = !1) {
-    var w;
-    let r;
+  async updateUser(s, e, t = !1, r = !1) {
+    var y, p;
+    let i;
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call updateUser if no user storage provided");
     if (!("id" in s) || s.id == null)
       throw new o(l.UserNotExist, "Please specify a user id");
     if (!("username" in s) || s.username == null)
       throw new o(l.UserNotExist, "Please specify a userername");
-    let { email: i, username: a, password: n, ...c } = e;
-    c.userid = s.userid;
-    let d = !1;
-    if (i)
-      r = i, R.validateEmail(r), d = !0;
-    else if (a) {
-      r = a;
+    let { email: a, username: n, password: c, ...d } = e;
+    d.userid = s.userid;
+    let w = !1;
+    if (a)
+      i = a, D.validateEmail(i), w = !0;
+    else if (n) {
+      i = n;
       try {
-        R.validateEmail(s.username), d = !0;
+        D.validateEmail(s.username), w = !0;
       } catch {
       }
-      d && R.validateEmail(r);
+      w && D.validateEmail(i);
     }
-    return !t && this.enableEmailVerification && d ? await ((w = this.tokenEmailer) == null ? void 0 : w.sendEmailVerificationToken(s.id, r)) : (i && (c.email = i), a && (c.username = a)), await this.userStorage.updateUser(c), !t && this.enableEmailVerification && d;
+    return !t && this.enableEmailVerification && w ? await ((y = this.tokenEmailer) == null ? void 0 : y.sendEmailVerificationToken(s.id, i)) : (a && (d.email = a), n && (d.username = n)), (e.state == E.passwordResetNeeded || e.state == E.passwordAndFactor2ResetNeeded) && await ((p = this.tokenEmailer) == null ? void 0 : p.sendPasswordResetToken(s.id, {}, r)), await this.userStorage.updateUser(d), {
+      emailVerificationTokenSent: !t && this.enableEmailVerification && w,
+      passwordResetTokenSent: e.state == E.passwordResetNeeded || e.state == E.passwordAndFactor2ResetNeeded
+    };
   }
   /**
    * Resets the secret for factor1 or 2 (eg reset password)
@@ -5076,20 +5079,20 @@ class Rt {
     if (u.logger.debug(f({ msg: "resetSecret" })), !this.tokenEmailer) throw new o(l.Configuration, "Password reset not enabled");
     const i = await this.userForPasswordResetToken(s), a = e == 1 ? i.factor1 : i.factor2;
     if (!this.tokenEmailer) throw new o(l.Configuration);
-    let n = i.state == b.passwordAndFactor2ResetNeeded ? b.factor2ResetNeeded : b.active;
+    let n = i.state == E.passwordAndFactor2ResetNeeded ? E.factor2ResetNeeded : E.active;
     await this.userStorage.updateUser(
       { id: i.id, state: n },
       await this.authenticators[a].createPersistentSecrets(i.username, t, r)
     );
     try {
-      this.emailTokenStorage.deleteAllForUser(
+      await this.emailTokenStorage.deleteAllForUser(
         i.id,
         U.passwordResetToken
       );
     } catch (c) {
       u.logger.warn(f({ msg: "Couldn't delete password reset tokens while logging in", user: i.username })), u.logger.debug(f({ err: c }));
     }
-    return i;
+    return { ...i, state: n };
   }
 }
 class he {
@@ -5231,7 +5234,7 @@ class J {
       digest: this.oauthPbkdf2Digest
     })), e.forEach((y) => {
       J.validateUri(y);
-    }), t || (t = E.allFlows());
+    }), t || (t = b.allFlows());
     const d = {
       client_id: a,
       client_secret: n,
@@ -5244,9 +5247,13 @@ class J {
     let w;
     for (let y = 0; y < 5; ++y)
       try {
-        w = await this.clientStorage.createClient(d), d.client_id = J.randomClientId();
+        w = await this.clientStorage.createClient(d);
+        break;
       } catch (p) {
-        if (o.asCrossauthError(p).code != l.ClientExists) throw p;
+        if (y == 4) {
+          if (o.asCrossauthError(p).code != l.ClientExists) throw p;
+        } else
+          d.client_id = J.randomClientId();
       }
     if (!w) throw new o(l.ClientExists);
     return w.client_secret && c && (w.client_secret = c), w;
@@ -5408,7 +5415,7 @@ class xt {
             "userCodeDashEvery must be a number or null"
           );
         }
-    if (m("deviceCodeVerificationUri", g.String, this, r, "DEVICECODE_VERIFICATION_URI"), this.validFlows.length == 1 && this.validFlows[0] == E.All && (this.validFlows = E.allFlows()), this.jwtAlgorithmChecked = at(this.jwtAlgorithm), this.jwtSecretKey || this.jwtSecretKeyFile) {
+    if (m("deviceCodeVerificationUri", g.String, this, r, "DEVICECODE_VERIFICATION_URI"), this.validFlows.length == 1 && this.validFlows[0] == b.All && (this.validFlows = b.allFlows()), this.jwtAlgorithmChecked = at(this.jwtAlgorithm), this.jwtSecretKey || this.jwtSecretKeyFile) {
       if (this.jwtPublicKey || this.jwtPublicKeyFile || this.jwtPrivateKey || this.jwtPrivateKeyFile)
         throw new o(
           l.Configuration,
@@ -5448,7 +5455,7 @@ class xt {
         l.Configuration,
         "If setting jwtPublicKey or jwtPrivate key, must also set jwtKeyType"
       );
-    if (this.opaqueAccessToken && (this.persistAccessToken = !0), (this.validFlows.includes(E.Password) || this.validFlows.includes(E.PasswordMfa)) && (!this.userStorage || Object.keys(this.authenticators).length == 0))
+    if (this.opaqueAccessToken && (this.persistAccessToken = !0), (this.validFlows.includes(b.Password) || this.validFlows.includes(b.PasswordMfa)) && (!this.userStorage || Object.keys(this.authenticators).length == 0))
       throw new o(
         l.Configuration,
         "If password flow or password MFA flow is enabled, userStorage and authenticators must be provided"
@@ -5598,21 +5605,21 @@ class xt {
   async authenticateClient(s, e, t) {
     let r = !1;
     switch (s) {
-      case E.AuthorizationCode:
-      case E.AuthorizationCodeWithPKCE:
+      case b.AuthorizationCode:
+      case b.AuthorizationCodeWithPKCE:
         r = e.confidential == !0 || e.client_secret != null || t != null;
         break;
-      case E.ClientCredentials:
+      case b.ClientCredentials:
         r = !0;
         break;
-      case E.Password:
-      case E.PasswordMfa:
+      case b.Password:
+      case b.PasswordMfa:
         r = e.confidential == !0 || e.client_secret != null || t != null;
         break;
-      case E.RefreshToken:
+      case b.RefreshToken:
         r = e.confidential == !0 || e.client_secret != null || t != null;
         break;
-      case E.DeviceCode:
+      case b.DeviceCode:
         r = e.confidential == !0 || e.client_secret != null || t != null;
         break;
     }
@@ -5672,7 +5679,7 @@ class xt {
     otp: _,
     deviceCode: C
   }) {
-    var K, F, B;
+    var K, O, B;
     const v = this.inferFlowFromPost(s, a);
     if (!v) return {
       error: "server_error",
@@ -5682,7 +5689,7 @@ class xt {
     if (!k.client) return k;
     const A = k.client, M = await this.authenticateClient(v, A, i);
     if (M.error) return M;
-    if (v == E.Password && !this.validFlows.includes(v) && !this.validFlows.includes(E.PasswordMfa))
+    if (v == b.Password && !this.validFlows.includes(v) && !this.validFlows.includes(b.PasswordMfa))
       return {
         error: "access_denied",
         error_description: "Unsupported flow type " + v
@@ -5698,8 +5705,8 @@ class xt {
         error_description: "Client does not support " + v
       };
     let j = !1;
-    this.issueRefreshToken && v != E.RefreshToken && (j = !0), this.issueRefreshToken && v == E.RefreshToken && this.rollingRefreshToken && (j = !0);
-    let D;
+    this.issueRefreshToken && v != b.RefreshToken && (j = !0), this.issueRefreshToken && v == b.RefreshToken && this.rollingRefreshToken && (j = !0);
+    let R;
     if (s == "authorization_code")
       return this.requireClientSecretOrChallenge && A && A.client_secret && !i && !a ? {
         error: "access_denied",
@@ -5727,11 +5734,11 @@ class xt {
       let P;
       if (N.username)
         try {
-          const { user: O } = await ((K = this.userStorage) == null ? void 0 : K.getUserByUsername(N.username));
-          P = O;
-        } catch (O) {
+          const { user: F } = await ((K = this.userStorage) == null ? void 0 : K.getUserByUsername(N.username));
+          P = F;
+        } catch (F) {
           return u.logger.error(f({
-            err: O,
+            err: F,
             msg: "Couldn't get user for refresh token.  Doesn't exist?",
             username: N.username
           })), {
@@ -5740,11 +5747,11 @@ class xt {
           };
         }
       try {
-        const O = U.refreshToken + T.hash(n);
-        await this.keyStorage.deleteKey(O);
-      } catch (O) {
-        const I = o.asCrossauthError(O);
-        u.logger.debug(f({ err: O })), u.logger.warn(f({ msg: "Cannot delete refresh token", cerr: I }));
+        const F = U.refreshToken + T.hash(n);
+        await this.keyStorage.deleteKey(F);
+      } catch (F) {
+        const I = o.asCrossauthError(F);
+        u.logger.debug(f({ err: F })), u.logger.warn(f({ msg: "Cannot delete refresh token", cerr: I }));
       }
       return await this.makeAccessToken({
         client: A,
@@ -5758,11 +5765,11 @@ class xt {
       const {
         scopes: N,
         error: P,
-        error_description: O
+        error_description: F
       } = await this.validateAndPersistScope(e, t, void 0);
       return P ? {
         error: P,
-        error_description: O
+        error_description: F
       } : await this.makeAccessToken({
         client: A,
         client_secret: i,
@@ -5792,7 +5799,7 @@ class xt {
           I,
           $,
           { password: d }
-        ), D = I;
+        ), R = I;
       } catch (I) {
         return u.logger.debug(f({ err: I })), {
           error: "access_denied",
@@ -5802,32 +5809,32 @@ class xt {
       const {
         scopes: N,
         error: P,
-        error_description: O
-      } = await this.validateAndPersistScope(e, t, D);
+        error_description: F
+      } = await this.validateAndPersistScope(e, t, R);
       return P ? {
         error: P,
-        error_description: O
-      } : D.factor2 ? this.allowedFactor2.length > 0 && (D.state == b.factor2ResetNeeded || !this.allowedFactor2.includes(D.factor2 ? D.factor2 : "none")) ? {
+        error_description: F
+      } : R.factor2 ? this.allowedFactor2.length > 0 && (R.state == E.factor2ResetNeeded || !this.allowedFactor2.includes(R.factor2 ? R.factor2 : "none")) ? {
         error: "access_denied",
         error_description: "2FA method not allowed or needs to be reconfigured"
-      } : await this.createMfaRequest(D) : await this.makeAccessToken({
+      } : await this.createMfaRequest(R) : await this.makeAccessToken({
         client: A,
         client_secret: i,
         codeVerifier: a,
         scopes: N,
         issueRefreshToken: j,
-        user: D
+        user: R
       });
     } else if (s == "http://auth0.com/oauth/grant-type/mfa-otp") {
       const {
         scopes: N,
         error: P,
-        error_description: O
+        error_description: F
       } = await this.validateAndPersistScope(e, t, void 0);
       if (P)
         return {
           error: P,
-          error_description: O
+          error_description: F
         };
       if (!_)
         return {
@@ -5885,12 +5892,12 @@ class xt {
       const {
         scopes: N,
         error: P,
-        error_description: O
+        error_description: F
       } = await this.validateAndPersistScope(e, t, void 0);
       if (P)
         return {
           error: P,
-          error_description: O
+          error_description: F
         };
       if (!y || !p)
         return {
@@ -5928,7 +5935,7 @@ class xt {
           };
         await $.authenticateUser(
           I.user,
-          { ...L, otp: V.otp, expiry: (F = I.key.expires) == null ? void 0 : F.getTime() },
+          { ...L, otp: V.otp, expiry: (O = I.key.expires) == null ? void 0 : O.getTime() },
           { otp: p }
         );
       } catch (L) {
@@ -5964,15 +5971,15 @@ class xt {
       try {
         N = await this.keyStorage.getKey(U.deviceCode + C);
       } catch (P) {
-        const O = o.asCrossauthError(P);
-        return u.logger.debug(f({ err: O })), u.logger.error(f({ msg: "Couldn't get device code", cerr: O })), {
+        const F = o.asCrossauthError(P);
+        return u.logger.debug(f({ err: F })), u.logger.error(f({ msg: "Couldn't get device code", cerr: F })), {
           error: "accerss_denied",
           error_description: "Invalid device code"
         };
       }
       try {
-        const P = JSON.parse(N.data ?? "{}"), O = (/* @__PURE__ */ new Date()).getTime();
-        if (N.expires && O > N.expires.getTime())
+        const P = JSON.parse(N.data ?? "{}"), F = (/* @__PURE__ */ new Date()).getTime();
+        if (N.expires && F > N.expires.getTime())
           return await this.deleteDeviceCode(C), {
             error: "expired_token",
             error_description: "Code has expired"
@@ -5994,8 +6001,8 @@ class xt {
           });
         }
       } catch (P) {
-        const O = o.asCrossauthError(P);
-        return u.logger.debug(f({ err: O })), u.logger.error(f({ msg: "Couldn't get device code", cerr: O })), await this.deleteDeviceCode(C), {
+        const F = o.asCrossauthError(P);
+        return u.logger.debug(f({ err: F })), u.logger.error(f({ msg: "Couldn't get device code", cerr: F })), await this.deleteDeviceCode(C), {
           error: "accerss_denied",
           error_description: "Invalid device code"
         };
@@ -6052,7 +6059,7 @@ class xt {
         error_description: "Invalid deviceCodeVerificationUri"
       };
     }
-    const r = E.DeviceCode, i = await this.getClientById(s);
+    const r = b.DeviceCode, i = await this.getClientById(s);
     if (!i.client) return i;
     const a = i.client, n = await this.authenticateClient(r, a, t);
     if (n.error) return n;
@@ -6417,7 +6424,7 @@ class xt {
    * @returns respond as defined by the Password MFA spec
    */
   async mfaChallengeEndpoint(s, e, t, r, i) {
-    const a = E.PasswordMfa, n = await this.getClientById(e);
+    const a = b.PasswordMfa, n = await this.getClientById(e);
     if (!n.client) return n;
     const c = n.client, d = await this.authenticateClient(a, c, t);
     if (d.error) return d;
@@ -6474,9 +6481,9 @@ class xt {
    */
   inferFlowFromGet(s, e, t) {
     if (s == "code" && !e.includes("openid"))
-      return t ? E.AuthorizationCodeWithPKCE : E.AuthorizationCode;
+      return t ? b.AuthorizationCodeWithPKCE : b.AuthorizationCode;
     if (e.includes("openid") && s == "code")
-      return t ? E.AuthorizationCodeWithPKCE : E.AuthorizationCode;
+      return t ? b.AuthorizationCodeWithPKCE : b.AuthorizationCode;
   }
   /**
    * Returns the OAuth flow type that corresonds to the given 
@@ -6487,19 +6494,19 @@ class xt {
    */
   inferFlowFromPost(s, e) {
     if (s == "authorization_code")
-      return e ? E.AuthorizationCodeWithPKCE : E.AuthorizationCode;
+      return e ? b.AuthorizationCodeWithPKCE : b.AuthorizationCode;
     if (s == "client_credentials")
-      return E.ClientCredentials;
+      return b.ClientCredentials;
     if (s == "refresh_token")
-      return E.RefreshToken;
+      return b.RefreshToken;
     if (s == "urn:ietf:params:oauth:grant-type:device_code")
-      return E.DeviceCode;
+      return b.DeviceCode;
     if (s == "password")
-      return E.Password;
+      return b.Password;
     if (s == "http://auth0.com/oauth/grant-type/mfa-otp")
-      return E.PasswordMfa;
+      return b.PasswordMfa;
     if (s == "http://auth0.com/oauth/grant-type/mfa-oob")
-      return E.PasswordMfa;
+      return b.PasswordMfa;
   }
   async getAuthorizationCode(s, e, t, r, i, a, n) {
     if (i && (a || (a = "S256"), a != "S256" && a != "plain"))
@@ -6555,8 +6562,8 @@ class xt {
         t ?? "",
         s.client_secret ?? ""
       ));
-    } catch (D) {
-      return u.logger.error(f({ err: D })), { error: "server_error", error_description: "Couldn't validate client" };
+    } catch (R) {
+      return u.logger.error(f({ err: R })), { error: "server_error", error_description: "Couldn't validate client" };
     }
     if (!c) return {
       error: "access_denied",
@@ -6564,9 +6571,9 @@ class xt {
     };
     let d = {};
     if (e) {
-      let D;
+      let R;
       try {
-        D = await this.keyStorage.getKey(U.authorizationCode + T.hash(e)), d = z.decodeData(D.data);
+        R = await this.keyStorage.getKey(U.authorizationCode + T.hash(e)), d = z.decodeData(R.data);
       } catch (K) {
         return u.logger.debug(f({ err: K })), {
           error: "access_denied",
@@ -6574,7 +6581,7 @@ class xt {
         };
       }
       try {
-        await this.keyStorage.deleteKey(D.value);
+        await this.keyStorage.deleteKey(R.value);
       } catch (K) {
         u.logger.warn(f({
           err: K,
@@ -6590,8 +6597,8 @@ class xt {
         error_description: "Invalid code challenge/code challenge method method for authorization code"
       };
     if (d.challenge) {
-      const D = d.challengeMethod == "plain" ? r ?? "" : T.sha256(r ?? "");
-      if (T.hash(D) != d.challenge)
+      const R = d.challengeMethod == "plain" ? r ?? "" : T.sha256(r ?? "");
+      if (T.hash(R) != d.challenge)
         return {
           error: "access_denied",
           error_description: "Code verifier is incorrect"
@@ -6607,13 +6614,13 @@ class xt {
       type: "access"
     };
     i && (C.scope = i), this.accessTokenExpiry != null && (C.exp = y + this.accessTokenExpiry, p = new Date(w.getTime() + this.accessTokenExpiry * 1e3 + this.clockTolerance * 1e3)), this.audience && (C.aud = this.audience);
-    const v = await new Promise((D, K) => {
+    const v = await new Promise((R, K) => {
       ie.sign(
         C,
         this.secretOrPrivateKey,
         { algorithm: this.jwtAlgorithmChecked, keyid: "1" },
-        (F, B) => {
-          B ? D(B) : K(F || new o(
+        (O, B) => {
+          B ? R(B) : K(O || new o(
             l.Unauthorized,
             "Couldn't create jwt"
           ));
@@ -6631,10 +6638,10 @@ class xt {
     if (i && i.includes("openid")) {
       if (this.userStorage && d.username)
         try {
-          const { user: F } = await this.userStorage.getUserByUsername(d.username);
-          n = F;
-        } catch (F) {
-          return u.logger.error(f({ err: F })), {
+          const { user: O } = await this.userStorage.getUserByUsername(d.username);
+          n = O;
+        } catch (O) {
+          return u.logger.error(f({ err: O })), {
             error: "server_error",
             error_description: "Couldn't load user data"
           };
@@ -6647,7 +6654,7 @@ class xt {
         type: "id"
       };
       if (i.includes("email") && (n != null && n.email) && (K.email = n.email), i.includes("address") && n && "address" in n && (K.address = n.address), i.includes("phone") && n && "phone" in n && (K.phone = n.phone), i.includes("profile") && n)
-        for (let F of [
+        for (let O of [
           "name",
           "family_name",
           "given_name",
@@ -6663,33 +6670,33 @@ class xt {
           "locale",
           "updated_at"
         ])
-          K[F] = n[F];
+          K[O] = n[O];
       if (n) {
         if (i) {
-          for (let F of i)
-            if (F in this.idTokenClaims)
-              if (this.idTokenClaims[F] == "all")
+          for (let O of i)
+            if (O in this.idTokenClaims)
+              if (this.idTokenClaims[O] == "all")
                 K = {
                   ...K,
                   ...n
                 };
               else
-                for (let B in this.idTokenClaims[F])
-                  K[B] = n[this.idTokenClaims[F][B]];
+                for (let B in this.idTokenClaims[O])
+                  K[B] = n[this.idTokenClaims[O][B]];
         }
         if ("all" in this.idTokenClaims) {
-          const F = this.idTokenClaims.all;
-          if (F == "all")
+          const O = this.idTokenClaims.all;
+          if (O == "all")
             K = {
               ...K,
               ...n
             };
           else
-            for (let B in F)
-              K[B] = n[F[B]];
+            for (let B in O)
+              K[B] = n[O[B]];
         }
       }
-      K.scope = i, this.accessTokenExpiry != null && (K.exp = y + this.accessTokenExpiry), k = await new Promise((F, B) => {
+      K.scope = i, this.accessTokenExpiry != null && (K.exp = y + this.accessTokenExpiry), k = await new Promise((O, B) => {
         ie.sign(
           K,
           this.secretOrPrivateKey,
@@ -6698,7 +6705,7 @@ class xt {
             keyid: this.jwtKid
           },
           (N, P) => {
-            P ? F(P) : B(N || new o(
+            P ? O(P) : B(N || new o(
               l.Unauthorized,
               "Couldn't create jwt"
             ));
@@ -6708,11 +6715,11 @@ class xt {
     }
     let A;
     if (a) {
-      const D = {
+      const R = {
         username: d.username,
         client_id: s.client_id
       };
-      i && (D.scope = i);
+      i && (R.scope = i);
       let K;
       const B = {
         jti: T.uuid(),
@@ -6726,8 +6733,8 @@ class xt {
           B,
           this.secretOrPrivateKey,
           { algorithm: this.jwtAlgorithmChecked, keyid: "1" },
-          (O, I) => {
-            I ? N(I) : P(O || new o(
+          (F, I) => {
+            I ? N(I) : P(F || new o(
               l.Unauthorized,
               "Couldn't create jwt"
             ));
@@ -6739,7 +6746,7 @@ class xt {
         U.refreshToken + T.hash(A),
         w,
         K,
-        JSON.stringify(D)
+        JSON.stringify(R)
       ));
     }
     return {
@@ -6896,7 +6903,7 @@ class xt {
    */
   responseTypesSupported() {
     let s = [];
-    return (this.validFlows.includes(E.AuthorizationCode) || this.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.validFlows.includes(E.OidcAuthorizationCode)) && s.push("code"), s;
+    return (this.validFlows.includes(b.AuthorizationCode) || this.validFlows.includes(b.AuthorizationCodeWithPKCE) || this.validFlows.includes(b.OidcAuthorizationCode)) && s.push("code"), s;
   }
   /**
    * Returns an OIDC configuration object based on this authorization
@@ -6918,7 +6925,7 @@ class xt {
   }) {
     let i = [];
     this.validFlows.forEach((n) => {
-      const c = E.grantType(n);
+      const c = b.grantType(n);
       c && (i = [...i, ...c]);
     });
     const a = [
@@ -7191,14 +7198,14 @@ export {
   re as Authenticator,
   T as Crypto,
   rt as DoubleSubmitCsrfToken,
-  Ot as DummyFactor2Authenticator,
+  Ft as DummyFactor2Authenticator,
   Z as EmailAuthenticator,
   Et as InMemoryKeyStorage,
   Ut as InMemoryOAuthAuthorizationStorage,
   bt as InMemoryOAuthClientStorage,
   kt as InMemoryUserStorage,
   z as KeyStorage,
-  Ft as LdapAuthenticator,
+  Ot as LdapAuthenticator,
   ae as LdapUserStorage,
   Te as LocalPasswordAuthenticator,
   xt as OAuthAuthorizationServer,
@@ -7219,12 +7226,12 @@ export {
   Tt as PrismaOAuthClientStorage,
   G as PrismaUserStorage,
   x as SessionCookie,
-  Rt as SessionManager,
+  Dt as SessionManager,
   Q as SmsAuthenticator,
-  R as TokenEmailer,
+  D as TokenEmailer,
   Nt as TotpAuthenticator,
   Ue as TwilioAuthenticator,
   H as UserStorage,
   m as setParameter,
-  Dt as toCookieSerializeOptions
+  Rt as toCookieSerializeOptions
 };