@crossauth/fastify 0.0.2

package/dist/fastifysession.d.ts

@@ -0,0 +1,767 @@
+import { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
+import { Server, IncomingMessage, ServerResponse } from 'http';
+import { CrossauthError, User, Key, UserInputFields, OAuthClient } from '@crossauth/common';
+import { UserStorage, KeyStorage, OAuthClientStorage, Authenticator, SessionManager, SessionManagerOptions, OAuthClientManagerOptions } from '@crossauth/backend';
+import { UpdateUserBodyType } from './fastifyuserendpoints';
+import { FastifySessionAdapter } from './fastifysessionadapter';
+
+/**
+ * Options for {@link FastifySessionServer }.
+ */
+export interface FastifySessionServerOptions extends SessionManagerOptions, OAuthClientManagerOptions {
+    /**
+     * If enabling user login, must provide the user storage
+     */
+    userStorage?: UserStorage;
+    /**
+     * Factor 1 and 2 authenticators.
+     *
+     * The key is what appears in the `factor1` and `factor2` filed in the
+     * Users table.
+     */
+    authenticators?: {
+        [key: string]: Authenticator;
+    };
+    /** All endpoint URLs will be prefixed with this.  Default `/` */
+    prefix?: string;
+    /** Admin URLs will be prefixed with `this  Default `admin/` */
+    adminPrefix?: string;
+    /** List of endpoints to add to the server ("login", "api/login", etc,
+     *  prefixed by the `prefix` parameter.  Empty for allMinusOAuth.  Default allMinusOAuth. */
+    endpoints?: string[];
+    /** Page to redirect to after successful login, default "/" */
+    loginRedirect?: string;
+    /** Page to redirect to after successful logout, default "/" */
+    logoutRedirect?: string;
+    /** Function that throws a {@link @crossauth/common!CrossauthError}
+     *  with {@link @crossauth/common!ErrorCode} `FormEnty` if the user
+     * doesn't confirm to local rules.  Doesn't validate passwords  */
+    validateUserFn?: (user: UserInputFields) => string[];
+    /** Function that creates a user from form fields.
+     * Default one takes fields that begin with `user_`, removing the `user_`
+     * prefix and filtering out anything not in the userEditableFields list in
+     * the user storage.
+      */
+    createUserFn?: (request: FastifyRequest<{
+        Body: SignupBodyType;
+    }>, userEditableFields: string[]) => UserInputFields;
+    /** Function that updates a user from form fields.
+     * Default one takes fields that begin with `user_`, removing the `user_`
+     *  prefix and filtering out anything not in the userEditableFields list in
+     * the user storage.
+      */
+    updateUserFn?: (user: User, request: FastifyRequest<{
+        Body: UpdateUserBodyType;
+    }>, userEditableFields: string[]) => User;
+    /** Called when a new session token is going to be saved
+     *  Add additional fields to your session storage here.  Return a map of
+     * keys to values  */
+    addToSession?: (request: FastifyRequest) => {
+        [key: string]: string | number | boolean | Date | undefined;
+    };
+    /** Called after the session ID is validated.
+     * Use this to add additional checks based on the request.
+     * Throw an exception if cecks fail
+     */
+    validateSession?: (session: Key, user: User | undefined, request: FastifyRequest) => void;
+    /** Template file containing the login page (with without error messages).
+     * See the class documentation for {@link FastifyServer} for more info.
+     * Defaults to "login.njk".
+     */
+    loginPage?: string;
+    /** Template file containing the page for getting the 2nd factor for 2FA
+     * protected pages.  See the class documentation for {@link FastifyServer}
+     * for more info.  Defaults to "factor2.njk".
+     */
+    factor2Page?: string;
+    /** Template file containing the signup page (with without error messages).
+     * See the class documentation for {@link FastifyServer} for more info.
+     *  Defaults to "signup.njk".
+     * Signup form should contain at least `username` and `password` and may
+     * also contain `repeatPassword`.  If you have additional
+     * fields in your user table you want to pass from your form, prefix
+     * them with `user_`, eg `user_email`.
+     * If you want to enable email verification, set `enableEmailVerification`
+     * and set `checkEmailVerified` on the user storage.
+     */
+    signupPage?: string;
+    /** Page to set up 2FA after sign up */
+    configureFactor2Page?: string;
+    /** Confirm deleting a user */
+    deleteUserPage?: string;
+    /** Confirm deleting an OAuth client */
+    deleteClientPage?: string;
+    /** Page to render error messages, including failed login.
+     * See the class documentation for {@link FastifyServer} for more info.
+     * Defaults to "error.njk".
+     */
+    errorPage?: string;
+    /** Page to render for password changing.
+     * See the class documentation for {@link FastifyServer} for more info.
+     * Defaults to "changepassword.njk".
+     */
+    changePasswordPage?: string;
+    /** Page to render for selecting a different 2FA.
+     * See the class documentation for {@link FastifyServer} for more info.
+     * Defaults to "changepassword.njk".
+     */
+    changeFactor2Page?: string;
+    /** Page to render for updating user details.
+     * See the class documentation for {@link FastifyServer} for more info.
+     * Defaults to "updateuser.njk".
+     */
+    updateUserPage?: string;
+    /** Page to ask user for email and reset his/her password.
+     * See the class documentation for {@link FastifyServer} for more info.
+     * Defaults to "requestpasswordreset.njk".
+     */
+    requestResetPasswordPage?: string;
+    /** Page to render for password reset, after the emailed token has been
+     * validated.
+     * See the class documentation for {@link FastifyServer} for more info.
+     * Defaults to "resetpassword.njk".
+     */
+    resetPasswordPage?: string;
+    /**
+     * Turns on email verification.  This will cause the verification tokens to
+     * be sent when the account
+     * is activated and when email is changed.  Default false.
+     */
+    enableEmailVerification?: boolean;
+    /** Page to render for to confirm email has been verified.  Only created
+     * if `enableEmailVerification` is true.
+     * See the class documentation for {@link FastifyServer} for more info.
+     * Defaults to "emailverified.njk"
+     */
+    emailVerifiedPage?: string;
+    /**
+     * These page endpoints need the second factor to be entered.  Visiting
+     * the page redirects the user to the factor2 page.
+     *
+     * You probably want to do this for things like changing password.  The
+     * default is
+     *   `/requestpasswordreset`,
+     *   `/updateuser`,
+     *   `/changepassword`,
+     *   `/resetpassword`,
+     *   `/changefactor2`,
+     */
+    factor2ProtectedPageEndpoints?: string[];
+    /**
+     * These page endpoints need the second factor to be entered.  Making
+     * a call to these endpoints results in a response of
+     * `{"ok": true, "factor2Required": true `}.  The user should then
+     * make a call to `/api/factor2`.   If the credetials are correct, the
+     * response will be that of the original request.
+     *
+     * You probably want to do this for things like changing password.  The
+     * default is
+     *   `/api/requestpasswordreset`,
+     *   `/api/updateuser`,
+     *   `/api/changepassword`,
+     *   `/api/resetpassword`,
+     *   `/api/changefactor2`,
+     */
+    factor2ProtectedApiEndpoints?: string[];
+    /**
+     * This parameter affects users who are not logged in with a session ID
+     * but with an OAuth access token.  Such users can only update their user
+     * record if the scoped named in this variable has been authorized by
+     * that user for the client.
+     *
+     * By default, no scopes are authorized to edit the user.
+     */
+    editUserScope?: string;
+    /**
+     * If true, all administrator endpoints will be enabled.
+     *
+     * If you explicitly name which endpoints to enable with the `endpoints`
+     * option, this is ignored.
+     *
+     * Default false.
+     *
+     */
+    enableAdminEndpoints?: boolean;
+    /**
+     * If true, all endpoints for managing OAuth clients (including
+     * the admin ones if `enableAdminEndpoints` is also true).
+     *
+     * If you explicitly name which endpoints to enable with the `endpoints`
+     * option, this is ignored.
+     *
+     * Default false
+     */
+    enableOAuthClientManagement?: boolean;
+    /**
+     * The temaplte file for the admin create user page.
+     *
+     * Default `admin/createuser.njk`
+     */
+    adminCreateUserPage?: string;
+    /**
+     * The temaplte file for the admin selecting a user.
+     *
+     * Default `admin/selectuser.njk`
+     */
+    adminSelectUserPage?: string;
+    /**
+     * The temaplte file for the admin creating a user.
+     *
+     * Default `admin/createuser.njk`
+     */
+    adminCreateClientPage?: string;
+    /**
+     * Admin pages provide functionality for searching for users.  By
+     * default the search string must exactly match a username or
+     * email address (depending on the storage, after normalizing
+     * and lowercasing).  Override this behaviour with this function
+     * @param searchTerm the search term
+     * @param userStorage the user storage to search
+     * @returns array of matching users
+     */
+    userSearchFn?: (searchTerm: string, userStorage: UserStorage) => Promise<User[]>;
+    /**
+     * Admin pages provide functionality for searching for OAuth clients.  By
+     * default the search string must exactly match the `client_name`.
+     * Override this behaviour with this function
+     * @param searchTerm the search term
+     * @param clientStorage the client storage to search
+     * @param userid if defined and non null, only clients owned by that
+     *        user ID will be returned.  If `null`, only clients not owned
+     *        by a user will be returned.  If undefined, all matching clients
+     *        will be returned
+     * @returns array of matching clients
+     */
+    clientSearchFn?: (searchTerm: string, clientStorage: OAuthClientStorage, userid?: string | number | null) => Promise<OAuthClient[]>;
+}
+/**
+ * When not overriding which endpoints to enable, all of these will be.
+ */
+export declare const SessionPageEndpoints: string[];
+/**
+ * When not overriding which endpoints to enable,
+ * and with `enableAdminEndpoints` enabled, all of these will be.
+ */
+export declare const SessionAdminPageEndpoints: string[];
+/**
+ * When not overriding which endpoints to enable, and with
+ * both `enableAdminEndpoints` and `enableAdminClientManagement` enabled,
+ * all these will be.
+ */
+export declare const SessionAdminClientPageEndpoints: string[];
+/**
+ * When not overriding which endpoints to enable, and with
+ * `enableAdminClientManagement` enabled,
+ * all these will be.
+ */
+export declare const SessionClientPageEndpoints: string[];
+/**
+ * When not overriding which endpoints to enable, all of these will be.
+ */
+export declare const SessionApiEndpoints: string[];
+/**
+ * When not overriding which endpoints to enable,
+ * and with `enableAdminEndpoints` enabled, all of these will be.
+ */
+export declare const SessionAdminApiEndpoints: string[];
+/**
+ * When not overriding which endpoints to enable, and with
+ * both `enableAdminEndpoints` and `enableAdminClientManagement` enabled,
+ * all these will be.
+ */
+export declare const SessionAdminClientApiEndpoints: string[];
+/**
+ * When not overriding which endpoints to enable, and with
+ * `enableAdminClientManagement` enabled,
+ * all these will be.
+ */
+export declare const SessionClientApiEndpoints: string[];
+/**
+ * API (JSON) endpoints that depend on 2FA being enabled.
+ *
+ * If not overriding which endpoints to enable with `endpoints`,
+ * and if any 2FA factors are enabled, then this endpoints will be added.
+ */
+export declare const Factor2ApiEndpoints: string[];
+/**
+ * Page endpoints that depend on email verification being enabled.
+ *
+ * If not overriding which endpoints to enable with `endpoints`,
+ * and if email verification is enabled, then this endpoints will be added.
+ */
+export declare const EmailVerificationPageEndpoints: string[];
+/**
+ * API (JSON) endpoints that depend on email verification.
+ *
+ * If not overriding which endpoints to enable with `endpoints`,
+ * and if email verification is enabled, then this endpoints will be added.
+ */
+export declare const EmailVerificationApiEndpoints: string[];
+/**
+ * Page endpoints that depend on password reset being enabled
+ *
+ * If not overriding which endpoints to enable with `endpoints`,
+ * and if password reset is enabled, then this endpoints will be added.
+ */
+export declare const PasswordResetPageEndpoints: string[];
+/**
+ * API (JSON) endpoints that depend on password reset being enabled
+ *
+ * If not overriding which endpoints to enable with `endpoints`,
+ * and if password reset is enabled, then this endpoints will be added.
+ */
+export declare const PasswordResetApiEndpoints: string[];
+/**
+ * Endpoints for signing a user up that display HTML
+ *
+ * When not overriding which endpoints to enable, all of these will be.
+ */
+export declare const SignupPageEndpoints: string[];
+/**
+ * API (JSON) endpoints for signing a user up that display HTML
+ *
+ * When not overriding which endpoints to enable, all of these will be.
+ */
+export declare const SignupApiEndpoints: string[];
+/**
+ * Endpoints for signing a user up that display HTML
+ */
+export declare const Factor2PageEndpoints: string[];
+/**
+ * These are the endpoints created ig `endpoints` is set to `allMinusOAuth`
+ */
+export declare const AllEndpointsMinusOAuth: string[];
+/**
+ * These are all the endpoints
+ */
+export declare const AllEndpoints: string[];
+/**
+ * Fastify body type for optionally passing a CSRF token in the body.
+ */
+export interface CsrfBodyType {
+    csrfToken?: string;
+}
+/**
+ * Fastify body type for passing any body parameter
+ */
+export interface ArbitraryBodyType {
+    [key: string]: string;
+}
+/**
+ * Body parameters for the /login URL
+ */
+export interface LoginBodyType extends CsrfBodyType {
+    username: string;
+    password: string;
+    persist?: boolean;
+    next?: string;
+}
+/**
+ * Body parameters for the /loginfactor2 URL
+ */
+export interface LoginFactor2BodyType extends CsrfBodyType {
+    persist?: boolean;
+    next?: string;
+    otp?: string;
+    token?: string;
+}
+/**
+ * Fastidy body type for users signing up
+ */
+export interface SignupBodyType extends LoginBodyType {
+    repeatPassword?: string;
+    email?: string;
+    factor2?: string;
+    [key: string]: string | number | Date | boolean | undefined;
+}
+/**
+ * Fastidy query type for users logging in (just a parameter for next page to load)
+ */
+export interface LoginQueryType {
+    next?: string;
+}
+/**
+ * For passing authenticator details to page templates.
+ */
+export interface AuthenticatorDetails {
+    name: string;
+    friendlyName: string;
+    hasSecrets: boolean;
+}
+/**
+ * This class adds user endpoints to the Fastidfy session server.
+ *
+ * You shouldn't have create create this directly - it is created by
+ * {@link FastifyServer}.
+ *
+ * **Endpoints that can be activated**
+ *
+ * All page POST methods are passed user, csrfToken, errorCode, errorCodeName, errorMessage, errorMessages, urlPrefix,
+ * errorMessages is an array, errorMessage is a single value or concatenation of errorMessages.
+ *
+ * All JSON responses have ok, errorMessage, errorMEssages, errorCode, errorCodeName, other than OAuth endpoints.
+ *
+ * | METHOD | ENDPOINT                   | PATH PARAMS | GET/BODY PARAMS                                                      | VARIABLES PASSED/RESPONSE JSON                                                                         | FILE                     |
+ * | ------ | -------------------------- | ----------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ------------------------ |
+ * | GET    | /login                     |             | next                                                                 | next                                                                                                   | loginPage                |
+ * | POST   | /login                     |             | next, username, password                                             | request params, next, persist, username | loginPage                                                    | loginPage                |
+ * | POST   | /api/login                 |             | username, password                                                   |                                                                                                        |                          |
+ * | POST   | /logout                    |             | next                                                                 |                                                                                                        |                          |
+ * | POST   | /api/logout                |             |                                                                      |                                                                                                        |                          |
+ * | GET    | /signup                    |             | next                                                                 |                                                                                                        | signupPage               |
+ * | POST   | /signup                    |             | next, persist, username, password, repeat_password, factor2, user_*  | message, next, persist, username, factor2, allowedFactor2                                              | signupPage               |
+ * | POST   | /api/signup                |             | username, password, repeat_password, factor2, user_*                 | message, next, persist, username, factor2, allowedFactor2                                              | signupPage               |
+ * | GET    | /changepassword            |             | next, required                                                       | next, required                                                                                         | changePasswordPage       |
+ * | POST   | /changepassword            |             | next, required, old_password, new_password, repeat_password          | message, next, required                                                                                | changePasswordPage       |
+ * | POST   | /api/changepassword        |             | old_password, new_password, repeat_password                          |                                                                                                        |                          |
+ * | GET    | /changefactor2             |             | next, required, factor2                                              | next, required, allowedFactor2                                                                         | changeFactor2Page        |
+ * | POST   | /changefactor2             |             | next, required, factor2                                              | next, required, allowedFactor2                                                                         | changeFactor2Page        |
+ * | POST   | /api/changefactor2         |             | factor2                                                              |                                                                                                        |                          |
+ * | GET    | /configurefactor2          |             | next                                                                 | next, (userData from authenticator)                                                                    | configureFactor2Page     |
+ * | POST   | /configurefactor2          |             | next, otp, token, (any)                                              | next, (userData from authenticator)                                                                    | configureFactor2Page     |
+ * | GET    | /api/configurefactor2      |             |                                                                      | (userData from authenticator)                                                                          |                          |
+ * | POST   | /api/configurefactor2      |             | otp, token, (any)                                                    | emailVerificationNeeded                                                                                |                          |
+ * | GET    | /updateuser                |             |                                                                      | user, allowedFactor2                                                                                   | updatePasswordPage       |
+ * | POST   | /updateuser                |             | user_*                                                               | message, user_*, allowedFactor2                                                                        | updatePasswordPage       |
+ * | POST   | /api/updateuser            |             | user_*                                                               | emailVerificationRequired                                                                              |                          |
+ * | GET    | /deleteuser                |             | next                                                                 | next, isAdmin, user                                                                                    | deleteUserPAge           |
+ * | POST   | /deleteuser                |             | next                                                                 | message, next, isAdmin, userid                                                                         | deleteUserPAge           |
+ * | POST   | /api/deleteuser            |             |                                                                      |                                                                                                        |                          |
+ * | GET    | /requestpasswordreset      |             | next, required                                                       | next, required                                                                                         | requestPasswordResetPage |
+ * | POST   | /requestpasswordreset      |             | email, next, required                                                | next, required, email, message                                                                         | requestPasswordResetPage |
+ * | POST   | /api/requestpasswordreset  |             | email                                                                |                                                                                                        |                          |
+ * | GET    | /resetpassword             | token       |                                                                      | token                                                                                                  | resetPasswordPage        |
+ * | POST   | /resetpassword             |             | token                                                                | token, message                                                                                         | resetPasswordPage        |
+ * | POST   | /api/resetpassword         |             | token                                                                |                                                                                                        |                          |
+ * | GET    | /verifyemail               | token       | user                                                                 |                                                                                                        | emailVerifiedPage        |
+ * | GET    | /api/verifyemail           | token       |                                                                      |                                                                                                        |                          |
+ * | GET    | /api/userforsessionkey     |             |                                                                      |                                                                                                        |                          |
+ * | GET    | /api/getcsrftoken          |             |                                                                      |                                                                                                        |                          |
+ * | GET    | /selectclient              |             | next, search, skip, take, haveNext, havePrevious                     | next, search, skip, take, haveNext, havePrevious, user, clients, isAdmin                               | selectClient             |
+ * | GET    | /createclient              |             | next                                                                 | next, validFLows, flowNames, user, isAdmin                                                             | createClientPage         |
+ * | POST   | /createclient              |             | next, client_name, confidential, redirect_uris, (flows)                | message, client, next, validFLows, flowNames, user, isAdmin                                            | createClientPage         |
+ * | POST   | /api/createclient          |             | client_name, confidential, redirect_uris, (flows)                      | client                                                                                                 |                          |
+ * | GET    | /updateclient              | client_id    | next                                                                 | next, validFLows, flowNames, selectedFlows, redirect_uris, client_id, client_name, user, isAdmin          | updateClientPage         |
+ * | POST   | /updateclient              | client_id    | next, client_name, confidential, redirect_uris, (flows), resetSecret   | message, next, validFLows, flowNames, selectedFlows, redirect_uris, client_id, client_name, user, isAdmin | updateClientPage         |
+ * | POST   | /api/updateclient          | client_id    | client_name, confidential, redirect_uris, (flows), resetSecret         | client, newSecret                                                                                      |                          |
+ * | GET    | /deleteclient              | client_id    | next, backUrl                                                        | next, backUrl, client                                                                                  | deleteClientPage         |
+ * | POST   | /deleteclient              | client_id    | next                                                                 | message, next, client_id                                                                                | deleteClientPage         |
+ * | POST   | /api/deleteclient          | client_id    |                                                                      |                                                                                                        |                          |
+ *
+ * ** Admin Endpoints **
+ *
+ * For administrator endpoints, see {@link FastifyAdminEndpoints}
+ *
+ * ** Endpoints requiring 2FA **
+ *
+ * Endpoints listed in `factor2ProtectedPageEndpoints` and
+ * `factor2ProtectedApiEndpoints` require the second factor to be entered again,
+ * if 2FA is enabled for the user.  For page endpoints, the user will
+ * be redirected to the page for entering the second factor.
+ *
+ * For API endpoints., the response will be
+ * `{"ok": true, "factor2Reqiored': true}`.  The user should then make a POST
+ * request to the same endpoint but with the 2FA field in the body instead
+ * of the original request body, eg `{"otp": 123456}`.  If the factor is
+ * valid, the JSON data from the original post will be submittd.
+ *
+ * ** Creating and updating users **
+ *
+ * If you have fields other than `id`, `username` and `password` in your user
+ * table, add them in
+ * `extraFields` when you create your {@link UserStorage} object.  In your
+ * signup and user update pages
+ * (`signupPage`, `updateUserPage`), prefix these with `user_` in field names
+ * and they will be passed
+ * into the user object when processing the form.  If there is an error
+ * processing the form, they will
+ * be back as psot parameters, again prefixed with `user_`.
+ *
+ *  **Using your own Fastify app**
+ *
+ * If you are serving other endpoints, or you want to use something other than
+ * Nunjucks, you can create
+ * and pass in your own Fastify app.
+ */
+export declare class FastifySessionServer implements FastifySessionAdapter {
+    /**
+     * The Fastify app taken from constructor args.
+     * See {@link FastifySessionServer.constructor}.
+     */
+    readonly app: FastifyInstance<Server, IncomingMessage, ServerResponse>;
+    /**
+     * The prefix taken from the options during
+     * construction or the default value.
+     * See {@link FastifySessionServerOptions}.
+     */
+    readonly prefix: string;
+    /**
+     * THe URL for the login page.  Taken from the options during
+     * construction or the default value.
+     * See {@link FastifySessionServerOptions}.
+     */
+    readonly loginUrl: string;
+    /**
+     * THe default URL to redirect to after login.  Taken from the options during
+     * construction or the default value.
+     * See {@link FastifySessionServerOptions}.
+     */
+    loginRedirect: string;
+    /**
+     * THe default URL to redirect to after logout.  Taken from the options during
+     * construction or the default value.
+     * See {@link FastifySessionServerOptions}.
+     */
+    logoutRedirect: string;
+    /**
+     * The page to show on error.  Taken from the options during
+     * construction or the default value.
+     * See {@link FastifySessionServerOptions}.
+     */
+    readonly errorPage: string;
+    /**
+     * Funtion to validate users upon creation.  Taken from the options during
+     * construction or the default value.
+     * See {@link FastifySessionServerOptions}.
+     */
+    validateUserFn: (user: UserInputFields) => string[];
+    /**
+     * Funtion to create a user record from form fields.  Taken from the options during
+     * construction or the default value.
+     * See {@link FastifySessionServerOptions}.
+     */
+    createUserFn: (request: FastifyRequest<{
+        Body: SignupBodyType;
+    }>, userEditableFields: string[]) => UserInputFields;
+    /**
+     * Funtion to update a user record from form fields.  Taken from the options during
+     * construction or the default value.
+     * See {@link FastifySessionServerOptions}.
+     */
+    updateUserFn: (user: User, request: FastifyRequest<{
+        Body: UpdateUserBodyType;
+    }>, userEditableFields: string[]) => User;
+    /**
+     * User storage taken from constructor args.
+     * See {@link FastifySessionServer.constructor}.
+     */
+    readonly userStorage?: UserStorage;
+    /**
+     * The set of authenticators taken from constructor args.
+     * See {@link FastifySessionServer.constructor}.
+     */
+    readonly authenticators: {
+        [key: string]: Authenticator;
+    };
+    /**
+     * The set of allowed authenticators taken from the options during
+     * construction.
+     */
+    readonly allowedFactor2: string[];
+    /**
+     * Session manager that was created from options during construction.
+     */
+    readonly sessionManager: SessionManager;
+    private endpoints;
+    private signupPage;
+    private loginPage;
+    private factor2Page;
+    private configureFactor2Page;
+    private addToSession?;
+    private validateSession?;
+    private userEndpoints;
+    private adminEndpoints;
+    private adminClientEndpoints?;
+    private userClientEndpoints?;
+    private enableEmailVerification;
+    private enablePasswordReset;
+    private enableAdminEndpoints?;
+    private enableOAuthClientManagement?;
+    private factor2ProtectedPageEndpoints;
+    private factor2ProtectedApiEndpoints;
+    private editUserScope?;
+    readonly enableCsrfProtection = true;
+    /**
+     * Constructor
+     *
+     * @param app the Fastify app
+     * @param keyStorage where session IDs are stored
+     * @param authenticators list of authenticators
+     * @param options See {@link FastifySessionServerOptions}.
+     */
+    constructor(app: FastifyInstance<Server, IncomingMessage, ServerResponse>, keyStorage: KeyStorage, authenticators: {
+        [key: string]: Authenticator;
+    }, options?: FastifySessionServerOptions);
+    /**
+     * Adds all endpoints enabled in the options passed to the constructor.
+     */
+    addEndpoints(): void;
+    private addLoginEndpoints;
+    private addLoginFactor2Endpoints;
+    private addFactor2Endpoints;
+    private addSignupEndpoints;
+    private addLogoutEndpoints;
+    private addApiLoginEndpoints;
+    private addApiCancelFactor2Endpoints;
+    private addApiLoginFactor2Endpoints;
+    private addApiLogoutEndpoints;
+    private addApiSignupEndpoints;
+    private addApiUserForSessionKeyEndpoints;
+    private addApiGetCsrfTokenEndpoints;
+    private login;
+    private loginFactor2;
+    private cancelFactor2;
+    /**
+     * This is called after the user has been validated to log the user in
+     */
+    loginWithUser(user: User, bypass2FA: boolean, request: FastifyRequest, reply: FastifyReply, successFn: (res: FastifyReply, user: User) => void): Promise<void>;
+    private signup;
+    private logout;
+    /**
+     * Creates an anonymous session, setting the `Set-Cookue` headers
+     * in the reply.
+     *
+     * An anonymous sessiin is a session cookie that is not associated
+     * with a user (`userid` is undefined).  It can be used to persist
+     * data between sessions just like a regular user session ID.
+     *
+     * @param request the Fastify request
+     * @param reply the Fastify reply
+     * @param data session data to save
+     * @returns the session cookie value
+     */
+    createAnonymousSession(request: FastifyRequest, reply: FastifyReply, data?: {
+        [key: string]: any;
+    }): Promise<string>;
+    /**
+     * Called by each endpoint on error.
+     *
+     * Sanitises errors to not give too much away to the user.  Logs
+     * the error (`error` level) and the stack trace (`debug` level).
+     *
+     * @param e the exceptioin that was thrown
+     * @param request the Fastify request
+     * @param reply the Fastify reply
+     * @param errorFn the error function to call to send the output to the client
+     * @param passwordInvalidOk if true, can report that the password is
+     *        incorrect.  If false, report that the username or password is
+     *        incorrect.  Default false.
+     */
+    handleError(e: any, request: FastifyRequest, reply: FastifyReply, errorFn: (reply: FastifyReply, error: CrossauthError) => void, passwordInvalidOk?: boolean): void;
+    /**
+     * Returns the session ID cookie value from the request
+     * @param request the Fastify request
+     * @returns the session cookie value
+     */
+    getSessionCookieValue(request: FastifyRequest): string | undefined;
+    /**
+     * Returns the CSRF token cookie value from the request
+     * @param request the Fastify request
+     * @returns the CSRF token cookie value
+     */
+    getCsrfCookieValue(request: FastifyRequest): string | undefined;
+    /**
+     * Returns a hash of the session ID.  Used for logging (for security,
+     * the actual session ID is not logged)
+     * @param request the Fastify request
+     * @returns hash of the session ID
+     */
+    getHashOfSessionId(request: FastifyRequest): string;
+    /**
+     * Returns a hash of the CSRF token cookie value.  Used for logging (for security,
+     * the actual CSRF token is not logged)
+     * @param request the Fastify request
+     * @returns hash of the CSRF token
+     */
+    getHashOfCsrfCookie(request: FastifyRequest): string;
+    /**
+     * Returns an error if the CSRF token in the request's cookie and
+     * either the `csrfToken` form field or `X-CROSSAUTH-CSRF` header
+     * is invalid (ie, the two do not match or the signature on the
+     * cookie is invalid).
+     * @param request the Fastify request
+     * @returns the CSRF token cookie value if valid, undefined
+     *          otherwise.
+     */
+    validateCsrfToken(request: FastifyRequest<{
+        Body: CsrfBodyType;
+    }>): string | undefined;
+    /**
+     * Creates and returns a new CSRF token, setting it in the reply both
+     * as a cookue and as a `X-CROSSAUTH-CSRF` header.
+     *
+     * To mitigate against the BREACH attack, a new CSRF token is created
+     * with every request by masking it with a random value.
+     *
+     * @param request the Fastify request
+     * @param reply the Fastify reply
+     * @returns the Fastiy reply
+     */
+    csrfToken(request: FastifyRequest<{
+        Body: CsrfBodyType;
+    }>, reply: FastifyReply): string | undefined;
+    /**
+     * Sends a JSON error message
+     * @param reply the Fastify reply
+     * @param status the HTTP status to return
+     * @param error the error string to report (overrides `e`)
+     * @param e the exception that was raised
+     * @returns the Fastify reply
+     */
+    sendJsonError(reply: FastifyReply, status: number, error?: string, e?: any): FastifyReply<import('fastify').RawServerDefault, IncomingMessage, ServerResponse<IncomingMessage>, import('fastify').RouteGenericInterface, unknown, import('fastify').FastifySchema, import('fastify').FastifyTypeProviderDefault, unknown>;
+    /**
+     * Returns an appropriate HTTP status from an exception.
+     *
+     * If the exception is of type {@link @crossauth/common!CrossauthError}
+     * then the status is taken from it.  Otherwise 500 is returned.
+     * @param e the exception to try to take the status from
+     * @returns the HTTP status
+     */
+    errorStatus(e: any): any;
+    /**
+     * For each of the authenticators passed to the constructor, retruns
+     * some details about it
+     * @returns a vector of {@link AuthenticatorDetails} objects.
+     */
+    allowedFactor2Details(): AuthenticatorDetails[];
+    /** Returns whether there is a user logged in with a cookie-based session
+     */
+    isSessionUser(request: FastifyRequest): boolean;
+    /**
+     * A user can edit his or her account if they are logged in with
+     * session management, or are logged in with some other means and
+     * e`ditUserScope` has been set and is included in the user's scopes.
+     * @param request the Fastify request
+     * @returns true or false
+     */
+    canEditUser(request: FastifyRequest): boolean | "" | undefined;
+    csrfProtectionEnabled(): boolean;
+    getCsrfToken(request: FastifyRequest): string | undefined;
+    getUser(request: FastifyRequest): User | undefined;
+    /**
+     * Updates a field in the session data in the key storage record,
+     *
+     * The `data` field is assumed to be JSON.  Just the field with the given
+     * name is updated and the rest is unchanged.
+     * @param request the Fastifdy request
+     * @param name the field within `data` to update
+     * @param value the value to set it to
+     */
+    updateSessionData(request: FastifyRequest, name: string, value: any): Promise<void>;
+    updateManySessionData(request: FastifyRequest, dataArray: {
+        dataName: string;
+        value: any;
+    }[]): Promise<void>;
+    /**
+    * Deletes a field from the session data in the key storage record,
+    *
+    * The `data` field is assumed to be JSON.  Just the field with the given
+    * name is updated and the rest is unchanged.
+    * @param request the Fastifdy request
+    * @param name the field within `data` to update
+    */
+    deleteSessionData(request: FastifyRequest, name: string): Promise<void>;
+    getSessionData(request: FastifyRequest, name: string): Promise<{
+        [key: string]: any;
+    } | undefined>;
+}