@crossauth/sveltekit 0.0.10 → 0.0.12

package/dist/index.js

@@ -1,6 +1,6 @@
 import { minimatch as P } from "minimatch";
-import { ApiKeyManager as q, KeyStorage as Z, toCookieSerializeOptions as I, Crypto as A, OAuthAuthorizationServer as X, setParameter as y, ParamType as _, DoubleSubmitCsrfToken as ee, OAuthClientManager as B, OAuthClientBackend as re, OAuthResourceServer as se, OAuthTokenConsumer as te, TokenEmailer as oe, SessionManager as ie } from "@crossauth/backend";
-import { CrossauthError as n, ErrorCode as h, CrossauthLogger as d, j as u, OAuthFlows as E, UserState as R, httpStatus as K } from "@crossauth/common";
+import { ApiKeyManager as q, KeyStorage as X, toCookieSerializeOptions as I, Crypto as A, OAuthAuthorizationServer as Z, setParameter as y, ParamType as E, DoubleSubmitCsrfToken as ee, OAuthClientManager as B, OAuthClientBackend as re, OAuthResourceServer as se, OAuthTokenConsumer as te, TokenEmailer as oe, SessionManager as ie } from "@crossauth/backend";
+import { CrossauthError as n, ErrorCode as h, CrossauthLogger as d, j as u, OAuthFlows as _, UserState as R, httpStatus as K } from "@crossauth/common";
 import { json as v, redirect as G, error as Q } from "@sveltejs/kit";
 import "cookie";
 import { jwtDecode as z } from "jwt-decode";
@@ -100,7 +100,7 @@ class ne {
             msg: "Valid API key",
             hahedApiKey: q.hashSignedApiKeyValue(a.value)
           }));
-          const i = Z.decodeData(a.data);
+          const i = X.decodeData(a.data);
           if (e.locals.apiKey = { ...a, ...i }, "scope" in i && Array.isArray(i.scope)) {
             let c = [];
             for (let l of i.scope)
@@ -190,7 +190,7 @@ class ce {
     }, this.authorizeEndpoint = {
       load: async (i) => {
         var p, S;
-        if (!(this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode)))
+        if (!(this.authServer.validFlows.includes(_.AuthorizationCode) || this.authServer.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(_.OidcAuthorizationCode)))
           throw this.error(401, "authorize cannot be called because the authorization code flows are not supported");
         if (!i.locals.user) return this.redirect(
           302,
@@ -270,8 +270,8 @@ class ce {
               ...this.baseEndpoint
             };
           } catch (C) {
-            const F = C;
-            return d.logger.debug(u({ err: F })), {
+            const T = C;
+            return d.logger.debug(u({ err: T })), {
               ok: !1,
               error: "unauthorized_client",
               error_description: "Not a valid client"
@@ -287,13 +287,13 @@ class ce {
           try {
             var l = new b();
             await l.loadData(i), c = l.toObject();
-            const g = l.getAsBoolean("authorized"), m = c.response_type, p = c.client_id, S = c.redirect_uri, C = c.scope, F = c.state, N = c.code_challenge, T = c.code_challenge_method;
-            let U;
-            if (g == null && (U = "authorized"), m ? p ? S ? F || (U = "state") : U = "redirect_uri" : U = "client_id" : U = "response_type", U)
+            const g = l.getAsBoolean("authorized"), m = c.response_type, p = c.client_id, S = c.redirect_uri, C = c.scope, T = c.state, N = c.code_challenge, U = c.code_challenge_method;
+            let F;
+            if (g == null && (F = "authorized"), m ? p ? S ? T || (F = "state") : F = "redirect_uri" : F = "client_id" : F = "response_type", F)
               return {
                 ok: !1,
                 error: "invalid_request",
-                error_description: "Invalid form: does not contain " + U + " parameter"
+                error_description: "Invalid form: does not contain " + F + " parameter"
               };
             if (!i.locals.user) return this.redirect(
               302,
@@ -305,9 +305,9 @@ class ce {
               client_id: p,
               redirect_uri: S,
               scope: C,
-              state: F,
+              state: T,
               codeChallenge: N,
-              codeChallengeMethod: T
+              codeChallengeMethod: U
             });
             return {
               ok: !1,
@@ -330,7 +330,7 @@ class ce {
       post: async (i) => {
         let c;
         try {
-          if (!(this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode) || this.authServer.validFlows.includes(E.ClientCredentials) || this.authServer.validFlows.includes(E.RefreshToken) || this.authServer.validFlows.includes(E.Password) || this.authServer.validFlows.includes(E.PasswordMfa || this.authServer.validFlows.includes(E.DeviceCode))))
+          if (!(this.authServer.validFlows.includes(_.AuthorizationCode) || this.authServer.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(_.OidcAuthorizationCode) || this.authServer.validFlows.includes(_.ClientCredentials) || this.authServer.validFlows.includes(_.RefreshToken) || this.authServer.validFlows.includes(_.Password) || this.authServer.validFlows.includes(_.PasswordMfa || this.authServer.validFlows.includes(_.DeviceCode))))
             return v({
               ok: !1,
               error: "invalid_request",
@@ -342,15 +342,15 @@ class ce {
           let m = c.refresh_token, p = i.cookies.get(this.refreshTokenCookieName);
           if ((this.refreshTokenType == "cookie" && p || this.refreshTokenType == "both" && p && m == null) && this.csrfTokens) {
             const C = i.cookies.get(this.csrfTokens.cookieName);
-            let F = i.request.headers.get(this.csrfTokens.headerName.toLowerCase());
-            if (Array.isArray(F) && (F = F[0]), !C || !F)
+            let T = i.request.headers.get(this.csrfTokens.headerName.toLowerCase());
+            if (Array.isArray(T) && (T = T[0]), !C || !T)
               return v({
                 ok: !1,
                 error: "access_denied",
                 error_description: "Invalid csrf token"
               }, { status: 401 });
             try {
-              this.csrfTokens.validateDoubleSubmitCsrfToken(C, F);
+              this.csrfTokens.validateDoubleSubmitCsrfToken(C, T);
             } catch (N) {
               return d.logger.debug(u({ err: N })), d.logger.warn(u({ cerr: N, msg: "Invalid csrf token", client_id: c.client_id })), v({
                 ok: !1,
@@ -379,9 +379,9 @@ class ce {
           if (S.refresh_token && this.refreshTokenType != "json" && this.setRefreshTokenCookie(i, S.refresh_token, S.expires_in), S.error == "authorization_pending")
             return v(S);
           if (S.error || !S.access_token) {
-            let C = "server_error", F = "Neither code nor error received when requestoing authorization";
-            S.error && (C = S.error), S.error_description && (F = S.error_description);
-            const N = n.fromOAuthError(C, F);
+            let C = "server_error", T = "Neither code nor error received when requestoing authorization";
+            S.error && (C = S.error), S.error_description && (T = S.error_description);
+            const N = n.fromOAuthError(C, T);
             return d.logger.error(u({ cerr: N })), v(S, { status: N.httpStatus });
           }
           return v(S);
@@ -440,7 +440,7 @@ class ce {
       post: async (i) => {
         let c;
         try {
-          if (!this.authServer.validFlows.includes(E.DeviceCode))
+          if (!this.authServer.validFlows.includes(_.DeviceCode))
             return v({
               ok: !1,
               error: "invalid_request",
@@ -476,7 +476,7 @@ class ce {
       }
     }, this.deviceEndpoint = {
       load: async (i) => {
-        if (!this.authServer.validFlows.includes(E.DeviceCode))
+        if (!this.authServer.validFlows.includes(_.DeviceCode))
           throw this.error(401, "device cannot be called because the device code flow is not supported");
         if (!i.locals.user) return this.redirect(
           302,
@@ -559,12 +559,12 @@ class ce {
           }
         }
       }
-    }, this.svelteKitServer = s, this.clientStorage = o, r.redirect && (this.redirect = r.redirect), r.error && (this.error = r.error), this.authServer = new X(
+    }, this.svelteKitServer = s, this.clientStorage = o, r.redirect && (this.redirect = r.redirect), r.error && (this.error = r.error), this.authServer = new Z(
       this.clientStorage,
       t,
       e,
       r
-    ), y("loginUrl", _.String, this, r, "LOGIN_URL"), y("refreshTokenType", _.String, this, r, "OAUTH_REFRESH_TOKEN_TYPE"), y("refreshTokenCookieName", _.String, this, r, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), y("refreshTokenCookieDomain", _.String, this, r, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), y("refreshTokenCookieHttpOnly", _.Boolean, this, r, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), y("refreshTokenCookiePath", _.String, this, r, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), y("refreshTokenCookieSecure", _.Boolean, this, r, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), y("refreshTokenCookieSameSite", _.String, this, r, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), y("authorizeEndpointUrl", _.String, this, r, "OAUTH_AUTHORIZE_ENDPOINT"), y("tokenEndpointUrl", _.String, this, r, "OAUTH_TOKEN_ENDPOINT"), y("jwksEndpointUrl", _.String, this, r, "OAUTH_JWKS_ENDPOINT"), this.refreshTokenType != "json" && (((a = this.svelteKitServer.sessionServer) == null ? void 0 : a.enableCsrfProtection) == !0 ? this.csrfTokens = this.svelteKitServer.sessionServer.sessionManager.csrfTokens : this.csrfTokens = new ee(r.doubleSubmitCookieOptions));
+    ), y("loginUrl", E.String, this, r, "LOGIN_URL"), y("refreshTokenType", E.String, this, r, "OAUTH_REFRESH_TOKEN_TYPE"), y("refreshTokenCookieName", E.String, this, r, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), y("refreshTokenCookieDomain", E.String, this, r, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), y("refreshTokenCookieHttpOnly", E.Boolean, this, r, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), y("refreshTokenCookiePath", E.String, this, r, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), y("refreshTokenCookieSecure", E.Boolean, this, r, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), y("refreshTokenCookieSameSite", E.String, this, r, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), y("authorizeEndpointUrl", E.String, this, r, "OAUTH_AUTHORIZE_ENDPOINT"), y("tokenEndpointUrl", E.String, this, r, "OAUTH_TOKEN_ENDPOINT"), y("jwksEndpointUrl", E.String, this, r, "OAUTH_JWKS_ENDPOINT"), this.refreshTokenType != "json" && (((a = this.svelteKitServer.sessionServer) == null ? void 0 : a.enableCsrfProtection) == !0 ? this.csrfTokens = this.svelteKitServer.sessionServer.sessionManager.csrfTokens : this.csrfTokens = new ee(r.doubleSubmitCookieOptions));
   }
   /**
    * Returns this server's OIDC configuration.  Just wraps
@@ -1025,14 +1025,14 @@ class J extends re {
    * @param options See {@link FastifyOAuthClientOptions}
    */
   constructor(s, o, t) {
-    if (super(o, t), this.sessionDataName = "oauth", this.receiveTokenFn = x, this.errorFn = W, this.loginUrl = "/login", this.validFlows = [E.All], this.authorizedUrl = "", this.autoRefreshActive = {}, this.loginProtectedFlows = [], this.tokenResponseType = "sendJson", this.errorResponseType = "sendJson", this.bffEndpoints = [], this.bffEndpointName = "bff", this.tokenEndpoints = [], this.bffMaxTries = 1, this.bffSleepMilliseconds = 500, this.authorizationCodeFlowEndpoint = {
+    if (super(o, t), this.sessionDataName = "oauth", this.receiveTokenFn = x, this.errorFn = W, this.loginUrl = "/login", this.validFlows = [_.All], this.authorizedUrl = "", this.autoRefreshActive = {}, this.loginProtectedFlows = [], this.tokenResponseType = "sendJson", this.errorResponseType = "sendJson", this.bffEndpoints = [], this.bffEndpointName = "bff", this.tokenEndpoints = [], this.bffMaxTries = 1, this.bffSleepMilliseconds = 500, this.authorizationCodeFlowEndpoint = {
       get: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
           const r = new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
           return this.errorFn(this.server, e, r);
         }
         try {
-          if (!this.validFlows.includes(E.AuthorizationCode)) {
+          if (!this.validFlows.includes(_.AuthorizationCode)) {
             const l = new n(h.Unauthorized, "Authorization flow is not supported");
             return this.errorFn(this.server, e, l);
           }
@@ -1069,7 +1069,7 @@ class J extends re {
           };
         }
         try {
-          if (!this.validFlows.includes(E.AuthorizationCode)) {
+          if (!this.validFlows.includes(_.AuthorizationCode)) {
             const l = new n(h.Unauthorized, "Authorization flow is not supported");
             return {
               ok: !1,
@@ -1112,7 +1112,7 @@ class J extends re {
           return this.errorFn(this.server, e, r);
         }
         try {
-          if (!this.validFlows.includes(E.AuthorizationCodeWithPKCE)) {
+          if (!this.validFlows.includes(_.AuthorizationCodeWithPKCE)) {
             const l = new n(h.Unauthorized, "Authorization flow is not supported");
             return this.errorFn(this.server, e, l);
           }
@@ -1152,7 +1152,7 @@ class J extends re {
           };
         }
         try {
-          if (!this.validFlows.includes(E.AuthorizationCodeWithPKCE)) {
+          if (!this.validFlows.includes(_.AuthorizationCodeWithPKCE)) {
             const l = new n(h.Unauthorized, "Authorization flow is not supported");
             return {
               ok: !1,
@@ -1195,7 +1195,7 @@ class J extends re {
           return this.errorFn(this.server, e, r);
         }
         try {
-          if (!(this.validFlows.includes(E.AuthorizationCode) || this.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.validFlows.includes(E.OidcAuthorizationCode))) {
+          if (!(this.validFlows.includes(_.AuthorizationCode) || this.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.validFlows.includes(_.OidcAuthorizationCode))) {
             const f = new n(h.Unauthorized, "Authorization flows are not supported");
             return this.errorFn(this.server, e, f);
           }
@@ -1237,7 +1237,7 @@ class J extends re {
           };
         }
         try {
-          if (!(this.validFlows.includes(E.AuthorizationCode) || this.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.validFlows.includes(E.OidcAuthorizationCode))) {
+          if (!(this.validFlows.includes(_.AuthorizationCode) || this.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.validFlows.includes(_.OidcAuthorizationCode))) {
             const g = new n(h.Unauthorized, "Authorization flows are not supported");
             return {
               ok: !1,
@@ -1301,7 +1301,7 @@ class J extends re {
         }
         let r;
         try {
-          if (!this.validFlows.includes(E.ClientCredentials)) {
+          if (!this.validFlows.includes(_.ClientCredentials)) {
             const l = new n(h.Unauthorized, "Client credentials flow is not supported");
             return this.errorFn(this.server, e, l);
           }
@@ -1336,7 +1336,7 @@ class J extends re {
             throw new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
           let r;
           try {
-            if (!this.validFlows.includes(E.ClientCredentials))
+            if (!this.validFlows.includes(_.ClientCredentials))
               throw new n(h.Unauthorized, "Client credentials flow is not supported");
             var a = new b();
             await a.loadData(e), r = a.toObject();
@@ -1366,7 +1366,7 @@ class J extends re {
         }
         let r;
         try {
-          if (!this.validFlows.includes(E.RefreshToken)) {
+          if (!this.validFlows.includes(_.RefreshToken)) {
             const f = new n(h.Unauthorized, "Refresh token flow is not supported");
             return this.errorFn(this.server, e, f);
           }
@@ -1417,7 +1417,7 @@ class J extends re {
             throw new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
           let r;
           try {
-            if (!this.validFlows.includes(E.RefreshToken)) {
+            if (!this.validFlows.includes(_.RefreshToken)) {
               const f = new n(h.Unauthorized, "Refresh token flow is not supported");
               return this.errorFn(this.server, e, f);
             }
@@ -1638,9 +1638,9 @@ class J extends re {
       actions: {
         default: async (e) => await this.tokens(e, this.tokenEndpoints)
       }
-    }, this.server = s, y("sessionDataName", _.String, this, t, "OAUTH_SESSION_DATA_NAME"), y("tokenResponseType", _.String, this, t, "OAUTH_TOKEN_RESPONSE_TYPE"), y("errorResponseType", _.String, this, t, "OAUTH_ERROR_RESPONSE_TYPE"), y("loginUrl", _.String, this, t, "LOGIN_URL"), y("bffEndpointName", _.String, this, t, "OAUTH_BFF_ENDPOINT_NAME"), y("bffBaseUrl", _.String, this, t, "OAUTH_BFF_BASEURL"), y("redirect_uri", _.String, this, t, "OAUTH_REDIRECTURI", !0), y("authorizedUrl", _.String, this, t, "AUTHORIZED_URL", !1), y("validFlows", _.JsonArray, this, t, "OAUTH_validFlows"), y("bffMaxTries", _.Number, this, t, "OAUTH_BFF_MAX_RETRIES"), y("bffSleepMilliseconds", _.Number, this, t, "OAUTH_BFF_SLEEP_MILLISECONDS"), this.bffEndpointName && !this.bffEndpointName.startsWith("/") && (this.bffEndpointName = "/" + this.bffEndpointName), this.bffEndpointName && this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), this.bffBaseUrl && this.bffBaseUrl.endsWith("/") && (this.bffBaseUrl = this.bffBaseUrl.substring(0, this.bffBaseUrl.length - 1)), t.redirect && (this.redirect = t.redirect), t.error && (this.error = t.error), this.validFlows.length == 1 && this.validFlows[0] == E.All)
-      this.validFlows = E.allFlows();
-    else if (!E.areAllValidFlows(this.validFlows))
+    }, this.server = s, y("sessionDataName", E.String, this, t, "OAUTH_SESSION_DATA_NAME"), y("tokenResponseType", E.String, this, t, "OAUTH_TOKEN_RESPONSE_TYPE"), y("errorResponseType", E.String, this, t, "OAUTH_ERROR_RESPONSE_TYPE"), y("loginUrl", E.String, this, t, "LOGIN_URL"), y("bffEndpointName", E.String, this, t, "OAUTH_BFF_ENDPOINT_NAME"), y("bffBaseUrl", E.String, this, t, "OAUTH_BFF_BASEURL"), y("redirect_uri", E.String, this, t, "OAUTH_REDIRECTURI", !0), y("authorizedUrl", E.String, this, t, "AUTHORIZED_URL", !1), y("validFlows", E.JsonArray, this, t, "OAUTH_validFlows"), y("bffMaxTries", E.Number, this, t, "OAUTH_BFF_MAX_RETRIES"), y("bffSleepMilliseconds", E.Number, this, t, "OAUTH_BFF_SLEEP_MILLISECONDS"), this.bffEndpointName && !this.bffEndpointName.startsWith("/") && (this.bffEndpointName = "/" + this.bffEndpointName), this.bffEndpointName && this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), this.bffBaseUrl && this.bffBaseUrl.endsWith("/") && (this.bffBaseUrl = this.bffBaseUrl.substring(0, this.bffBaseUrl.length - 1)), t.redirect && (this.redirect = t.redirect), t.error && (this.error = t.error), this.validFlows.length == 1 && this.validFlows[0] == _.All)
+      this.validFlows = _.allFlows();
+    else if (!_.areAllValidFlows(this.validFlows))
       throw new n(h.Configuration, "Invalid flows specificied in " + this.validFlows.join(","));
     try {
       new URL(this.redirect_uri ?? "");
@@ -1650,9 +1650,9 @@ class J extends re {
     if (t.tokenEndpoints && (this.tokenEndpoints = t.tokenEndpoints), this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), t.bffEndpoints && (this.bffEndpoints = t.bffEndpoints.map((e) => ({ ...e, methodsString: e.methods.map((r) => r) }))), this.bffEndpoints)
       for (let e of this.bffEndpoints)
         e.url.startsWith("/") || (e.url = "/" + e.url);
-    if (this.loginProtectedFlows.length == 1 && this.loginProtectedFlows[0] == E.All)
+    if (this.loginProtectedFlows.length == 1 && this.loginProtectedFlows[0] == _.All)
       this.loginProtectedFlows = this.validFlows;
-    else if (!E.areAllValidFlows(this.loginProtectedFlows))
+    else if (!_.areAllValidFlows(this.loginProtectedFlows))
       throw new n(
         h.Configuration,
         "Invalid flows specificied in " + this.loginProtectedFlows.join(",")
@@ -1687,7 +1687,7 @@ class J extends re {
         o.password,
         o.scope
       );
-      if (e.error == "mfa_required" && e.mfa_token && this.validFlows.includes(E.PasswordMfa)) {
+      if (e.error == "mfa_required" && e.mfa_token && this.validFlows.includes(_.PasswordMfa)) {
         const r = e.mfa_token;
         let a = o.scope;
         if (a == "" && (a = void 0), e = await this.passwordMfa(
@@ -1944,7 +1944,7 @@ class J extends re {
     }
     let t;
     try {
-      if (!(this.validFlows.includes(E.Password) || this.validFlows.includes(E.PasswordMfa))) {
+      if (!(this.validFlows.includes(_.Password) || this.validFlows.includes(_.PasswordMfa))) {
         const i = new n(h.Unauthorized, "Password flow is not supported");
         return this.errorFn(this.server, s, i);
       }
@@ -1981,7 +1981,7 @@ class J extends re {
       throw new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
     let t;
     try {
-      if (!(this.validFlows.includes(E.Password) || this.validFlows.includes(E.PasswordMfa))) {
+      if (!(this.validFlows.includes(_.Password) || this.validFlows.includes(_.PasswordMfa))) {
         const i = new n(h.Unauthorized, "Password and Password MFA flows are not supported");
         return this.errorFn(this.server, s, i);
       }
@@ -2001,7 +2001,7 @@ class J extends re {
           ...r
         };
       if (r.challenge_type) {
-        if (!this.validFlows.includes(E.PasswordMfa)) {
+        if (!this.validFlows.includes(_.PasswordMfa)) {
           const i = new n(h.Unauthorized, "Password MFA flow is not supported");
           return this.errorFn(this.server, s, i);
         }
@@ -2210,7 +2210,7 @@ class J extends re {
   async startDeviceCodeFlow_internal(s) {
     let o;
     try {
-      if (!this.validFlows.includes(E.DeviceCode))
+      if (!this.validFlows.includes(_.DeviceCode))
         throw new n(h.Unauthorized, "Device code flow is not supported");
       var t = new b();
       if (await t.loadData(s), o = t.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
@@ -2243,7 +2243,7 @@ class J extends re {
   async pollDeviceCodeFlow_internal(s) {
     let o;
     try {
-      if (!this.validFlows.includes(E.DeviceCode))
+      if (!this.validFlows.includes(_.DeviceCode))
         throw new n(h.Unauthorized, "Device code flow is not supported");
       var t = new b();
       if (await t.loadData(s), o = t.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
@@ -2294,7 +2294,7 @@ class fe extends se {
    * @param options See {@link SvelteKitOAuthResourceServerOptions}
    */
   constructor(s, o = {}) {
-    if (super(s, o), this.errorBody = {}, this.protectedEndpoints = {}, y("errorBody", _.Json, this, o, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), this.userStorage = o.userStorage, o.protectedEndpoints) {
+    if (super(s, o), this.errorBody = {}, this.protectedEndpoints = {}, y("errorBody", E.Json, this, o, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), this.userStorage = o.userStorage, o.protectedEndpoints) {
       const t = /^[!#\$%&'\(\)\*\+,\.\/a-zA-Z\[\]\^_`-]+/;
       for (const [e, r] of Object.entries(o.protectedEndpoints)) {
         if (!e.startsWith("/"))
@@ -2478,7 +2478,7 @@ const O = class O {
     oAuthResServer: i,
     options: c
   }) {
-    this.loginUrl = "/login", this.dummyLoad = async (f) => ({}), this.dummyActions = {}, this.dummyBff = async (f) => ({ status: 500, body: { error: "Unimplemented" } }), c || (c = {}), y("loginUrl", _.String, this, c, "LOGIN_URL", !1), c.isAdminFn && (O.isAdminFn = c.isAdminFn);
+    this.loginUrl = "/login", this.dummyLoad = async (f) => ({}), this.dummyActions = {}, this.dummyBff = async (f) => ({ status: 500, body: { error: "Unimplemented" } }), c || (c = {}), y("loginUrl", E.String, this, c, "LOGIN_URL", !1), c.isAdminFn && (O.isAdminFn = c.isAdminFn);
     let l = {};
     if (c.authenticators && (l = c.authenticators), this.userStorage = c.userStorage, s) {
       if (!l)
@@ -2754,7 +2754,7 @@ class pe {
           ...e
         };
       }
-    }, this.sessionServer = s, y("changePasswordUrl", _.String, this, o, "CHANGE_PASSWORD_URL"), y("requestPasswordResetUrl", _.String, this, o, "REQUEST_PASSWORD_RESET_URL"), y("changeFactor2Url", _.String, this, o, "CHANGE_FACTOR2_URL"), y("loginRedirectUrl", _.JsonArray, this, o, "LOGIN_REDIRECT_URL"), y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.addToSession && (this.addToSession = o.addToSession);
+    }, this.sessionServer = s, y("changePasswordUrl", E.String, this, o, "CHANGE_PASSWORD_URL"), y("requestPasswordResetUrl", E.String, this, o, "REQUEST_PASSWORD_RESET_URL"), y("changeFactor2Url", E.String, this, o, "CHANGE_FACTOR2_URL"), y("loginRedirectUrl", E.JsonArray, this, o, "LOGIN_REDIRECT_URL"), y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.addToSession && (this.addToSession = o.addToSession);
   }
   /** Returns whether there is a user logged in with a cookie-based session
    */
@@ -4347,7 +4347,7 @@ class $ {
    * @param options See {@link SvelteKitSessionServerOptions}
    */
   constructor(s, o) {
-    this.loginUrl = "/login", this.clientSearchFn = ke, this.validFlows = ["all"], this.sessionServer = s, y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect ?? G, this.error = o.error ?? Q, y("validFlows", _.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == E.All && (this.validFlows = E.allFlows()), this.valid_flowNames = E.flowNames(this.validFlows), o.clientStorage && (this.clientManager = new B(o)), this.clientStorage = o.clientStorage;
+    this.loginUrl = "/login", this.clientSearchFn = ke, this.validFlows = ["all"], this.sessionServer = s, y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect ?? G, this.error = o.error ?? Q, y("validFlows", E.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == _.All && (this.validFlows = _.allFlows()), this.valid_flowNames = _.flowNames(this.validFlows), o.clientStorage && (this.clientManager = new B(o)), this.clientStorage = o.clientStorage;
   }
   ///////////////////////////////////////////////////////////////////
   // Functions callable from apps
@@ -4518,8 +4518,8 @@ class $ {
       for (let C of c)
         try {
           B.validateUri(C);
-        } catch (F) {
-          d.logger.error(u({ err: F })), l.push("[" + C + "]");
+        } catch (T) {
+          d.logger.error(u({ err: T })), l.push("[" + C + "]");
         }
       if (l.length > 0)
         throw new n(
@@ -4533,8 +4533,8 @@ class $ {
       if (g.client_name = t.client_name, g.confidential = e.getAsBoolean("confidential") ?? !1, g.valid_flow = f, g.redirect_uri = c, o) {
         let C = t.userid ?? void 0;
         if (C && ((r = this.sessionServer) != null && r.userStorage)) {
-          const { user: F } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
-          C = F.id;
+          const { user: T } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
+          C = T.id;
         }
         g.userid = t.userid ? Number(t.userid) : null;
       }
@@ -4581,13 +4581,13 @@ class $ {
       if (o) {
         const S = s.url.searchParams.get("userid");
         if (S && ((e = this.sessionServer) != null && e.userStorage)) {
-          const { user: F } = await ((r = this.sessionServer) == null ? void 0 : r.userStorage.getUserById(S));
-          g = F.id;
+          const { user: T } = await ((r = this.sessionServer) == null ? void 0 : r.userStorage.getUserById(S));
+          g = T.id;
         }
         const C = t.get("userid");
         if (C && ((a = this.sessionServer) != null && a.userStorage)) {
-          const { user: F } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
-          g = F.id;
+          const { user: T } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
+          g = T.id;
         }
       } else {
         if (!s.locals.user) throw new n(h.Unauthorized);
@@ -4635,8 +4635,8 @@ class $ {
       if (o) {
         const C = e.get("userid");
         if (C && ((r = this.sessionServer) != null && r.userStorage)) {
-          const { user: F } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
-          l = F.id;
+          const { user: T } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
+          l = T.id;
         }
       } else {
         if (!s.locals.user) throw new n(h.Unauthorized);
@@ -4650,8 +4650,8 @@ class $ {
       for (let C of f)
         try {
           B.validateUri(C);
-        } catch (F) {
-          d.logger.error(u({ err: F })), g.push("[" + C + "]");
+        } catch (T) {
+          d.logger.error(u({ err: T })), g.push("[" + C + "]");
         }
       if (g.length > 0)
         throw new n(
@@ -4813,7 +4813,7 @@ class Se extends $ {
       actions: {
         default: async (t) => await this.deleteClient(t)
       }
-    }, this.sessionServer = s, y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
+    }, this.sessionServer = s, y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
   }
   ///////////////////////////////////////////////////////////////////
   // Functions callable from apps
@@ -4995,7 +4995,7 @@ class Ce extends $ {
       actions: {
         default: async (t) => await this.deleteClient(t)
       }
-    }, this.sessionServer = s, y("loginUrl", _.String, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
+    }, this.sessionServer = s, y("loginUrl", E.String, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
   }
   ///////////////////////////////////////////////////////////////////
   // Functions callable from apps
@@ -5061,7 +5061,7 @@ function ye(k) {
   let s = [];
   return k.username == null ? s.push("Username must be given") : k.username.length < 2 ? s.push("Username must be at least 2 characters") : k.username.length > 254 && s.push("Username must be no longer than 254 characters"), s;
 }
-function _e(k, s, o) {
+function Ee(k, s, o) {
   let e = {
     username: s.username ?? "",
     state: "active"
@@ -5073,7 +5073,7 @@ function _e(k, s, o) {
   }
   return e.factor1 = "localpassword", e.factor2 = s.factor2, e;
 }
-function Ee(k, s, o, t) {
+function _e(k, s, o, t) {
   const e = s.locals.user && w.isAdminFn(s.locals.user);
   for (let r in o) {
     let a = r.replace(/^user_/, "");
@@ -5090,9 +5090,9 @@ class L {
    * @param options See {@link SvelteKitSessionServerOptions}.
    */
   constructor(s, o, t = {}) {
-    this.validateUserFn = ye, this.createUserFn = _e, this.updateUserFn = Ee, this.allowedFactor2 = [], this.allowedFactor2Names = [], this.factor2ProtectedPageEndpoints = [], this.factor2ProtectedApiEndpoints = [], this.loginProtectedPageEndpoints = [], this.loginProtectedApiEndpoints = [], this.adminPageEndpoints = [], this.adminApiEndpoints = [], this.unauthorizedUrl = void 0, this.enableCsrfProtection = !0, this.enableEmailVerification = !1, this.enablePasswordReset = !1, this.factor2Url = "/factor2", this.loginUrl = "/login", this.keyStorage = s, this.userStorage = t.userStorage, this.clientStorage = t.clientStorage, this.authenticators = o, this.sessionManager = new ie(s, o, t), this.redirect = t.redirect ?? G, this.error = t.error ?? Q, y("factor2Url", _.String, this, t, "FACTOR2_URL"), this.factor2Url.endsWith("/") || (this.factor2Url += "/"), y("factor2ProtectedPageEndpoints", _.JsonArray, this, t, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), y("factor2ProtectedApiEndpoints", _.JsonArray, this, t, "FACTOR2_PROTECTED_API_ENDPOINTS"), y("loginProtectedPageEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_PAGE_ENDPOINTS"), y("loginProtectedApiEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_API_ENDPOINTS"), y("adminPageEndpoints", _.JsonArray, this, t, "ADMIN_PAGE_ENDPOINTS"), y("adminApiEndpoints", _.JsonArray, this, t, "ADMIN_API_ENDPOINTS"), y("loginUrl", _.JsonArray, this, t, "LOGIN_URL"), y("unauthorizedUrl", _.JsonArray, this, t, "UNAUTHORIZED_PAGE");
+    this.validateUserFn = ye, this.createUserFn = Ee, this.updateUserFn = _e, this.allowedFactor2 = [], this.allowedFactor2Names = [], this.factor2ProtectedPageEndpoints = [], this.factor2ProtectedApiEndpoints = [], this.loginProtectedPageEndpoints = [], this.loginProtectedApiEndpoints = [], this.loginProtectedExceptionPageEndpoints = [], this.loginProtectedExceptionApiEndpoints = [], this.adminPageEndpoints = [], this.adminApiEndpoints = [], this.unauthorizedUrl = void 0, this.enableCsrfProtection = !0, this.enableEmailVerification = !1, this.enablePasswordReset = !1, this.factor2Url = "/factor2", this.loginUrl = "/login", this.keyStorage = s, this.userStorage = t.userStorage, this.clientStorage = t.clientStorage, this.authenticators = o, this.sessionManager = new ie(s, o, t), this.redirect = t.redirect ?? G, this.error = t.error ?? Q, y("factor2Url", E.String, this, t, "FACTOR2_URL"), this.factor2Url.endsWith("/") || (this.factor2Url += "/"), y("factor2ProtectedPageEndpoints", E.JsonArray, this, t, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), y("factor2ProtectedApiEndpoints", E.JsonArray, this, t, "FACTOR2_PROTECTED_API_ENDPOINTS"), y("loginProtectedPageEndpoints", E.JsonArray, this, t, "LOGIN_PROTECTED_PAGE_ENDPOINTS"), y("loginProtectedApiEndpoints", E.JsonArray, this, t, "LOGIN_PROTECTED_API_ENDPOINTS"), y("loginProtectedExceptionPageEndpoints", E.JsonArray, this, t, "LOGIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("loginProtectedExceptionApiEndpoints", E.JsonArray, this, t, "LOGIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("adminPageEndpoints", E.JsonArray, this, t, "ADMIN_PAGE_ENDPOINTS"), y("adminApiEndpoints", E.JsonArray, this, t, "ADMIN_API_ENDPOINTS"), y("loginUrl", E.JsonArray, this, t, "LOGIN_URL"), y("unauthorizedUrl", E.JsonArray, this, t, "UNAUTHORIZED_PAGE");
     let e = {};
-    if (y("allowedFactor2", _.JsonArray, e, t, "ALLOWED_FACTOR2"), this.allowedFactor2Names = t.allowedFactor2 ?? ["none"], e.allowedFactor2)
+    if (y("allowedFactor2", E.JsonArray, e, t, "ALLOWED_FACTOR2"), this.allowedFactor2Names = t.allowedFactor2 ?? ["none"], e.allowedFactor2)
       for (let r of e.allowedFactor2)
         r in this.authenticators ? this.allowedFactor2.push({
           name: r,
@@ -5103,7 +5103,7 @@ class L {
           friendlyName: "None",
           configurable: !1
         });
-    y("enableEmailVerification", _.Boolean, this, t, "ENABLE_EMAIL_VERIFICATION"), y("enablePasswordReset", _.Boolean, this, t, "ENABLE_PASSWORD_RESET"), y("enableCsrfProtection", _.Boolean, this, t, "ENABLE_CSRF_PROTECTION"), y("editUserScope", _.String, this, t, "EDIT_USER_SCOPE"), t.validateUserFn && (this.validateUserFn = t.validateUserFn), t.createUserFn && (this.createUserFn = t.createUserFn), t.updateUserFn && (this.updateUserFn = t.updateUserFn), t.addToSession && (this.addToSession = t.addToSession), t.validateSession && (this.validateSession = t.validateSession), this.userEndpoints = new pe(this, t), this.adminEndpoints = new me(this, t), this.userClientEndpoints = new Se(this, t), this.adminClientEndpoints = new Ce(this, t), this.sessionHook = async ({ event: r }) => {
+    y("enableEmailVerification", E.Boolean, this, t, "ENABLE_EMAIL_VERIFICATION"), y("enablePasswordReset", E.Boolean, this, t, "ENABLE_PASSWORD_RESET"), y("enableCsrfProtection", E.Boolean, this, t, "ENABLE_CSRF_PROTECTION"), y("editUserScope", E.String, this, t, "EDIT_USER_SCOPE"), t.validateUserFn && (this.validateUserFn = t.validateUserFn), t.createUserFn && (this.createUserFn = t.createUserFn), t.updateUserFn && (this.updateUserFn = t.updateUserFn), t.addToSession && (this.addToSession = t.addToSession), t.validateSession && (this.validateSession = t.validateSession), this.userEndpoints = new pe(this, t), this.adminEndpoints = new me(this, t), this.userClientEndpoints = new Se(this, t), this.adminClientEndpoints = new Ce(this, t), this.sessionHook = async ({ event: r }) => {
       var f, g;
       d.logger.debug("Session hook");
       let a = [];
@@ -5190,27 +5190,27 @@ class L {
             d.logger.debug(u({ msg: "Completing 2FA" }));
             const p = this.authenticators[m.pre2fa.factor2], S = [...p.secretNames(), ...p.transientSecretNames()];
             let C = {};
-            const F = new b();
-            await F.loadData(r);
-            for (let U of F.keys())
-              S.includes(U) && (C[U] = F.get(U) ?? "");
+            const T = new b();
+            await T.loadData(r);
+            for (let F of T.keys())
+              S.includes(F) && (C[F] = T.get(F) ?? "");
             const N = this.getSessionCookieValue(r);
             if (!N) throw new n(h.Unauthorized, "No session cookie found");
-            let T;
+            let U;
             try {
               await this.sessionManager.completeTwoFactorPageVisit(C, r.locals.sessionId ?? "");
-            } catch (U) {
-              T = n.asCrossauthError(U), d.logger.debug(u({ err: U }));
-              const D = n.asCrossauthError(U);
-              d.logger.error(u({ msg: T.message, cerr: U, user: F.get("username"), errorCode: D.code, errorCodeName: D.codeName }));
+            } catch (F) {
+              U = n.asCrossauthError(F), d.logger.debug(u({ err: F }));
+              const D = n.asCrossauthError(F);
+              d.logger.error(u({ msg: U.message, cerr: F, user: T.get("username"), errorCode: D.code, errorCodeName: D.codeName }));
             }
-            if (T)
-              if (T.code == h.Expired) {
+            if (U)
+              if (U.code == h.Expired) {
                 d.logger.debug(u({ msg: "Error - cancelling 2FA" }));
                 try {
                   await this.sessionManager.cancelTwoFactorPageVisit(N);
-                } catch (U) {
-                  d.logger.error(u({ msg: "Failed cancelling 2FA", cerr: U, user: l.username, hashedSessionCookie: this.getHashOfSessionCookie(r) })), d.logger.debug(u({ err: U }));
+                } catch (F) {
+                  d.logger.error(u({ msg: "Failed cancelling 2FA", cerr: F, user: l.username, hashedSessionCookie: this.getHashOfSessionCookie(r) })), d.logger.debug(u({ err: F }));
                 }
                 return this.error(401, { message: "Sorry, your code has expired" }), { ok: !1, twofa: !0 };
               } else
@@ -5220,20 +5220,20 @@ class L {
                   response: new Response("", {
                     status: 302,
                     statusText: K(302),
-                    headers: { Location: this.factor2Url + "?error=" + h[T.code] }
+                    headers: { Location: this.factor2Url + "?error=" + h[U.code] }
                   })
                 } : {
                   twofa: !0,
                   ok: !1,
                   response: new Response(JSON.stringify({
                     ok: !1,
-                    errorMessage: T.message,
-                    errorMessages: T.messages,
-                    errorCode: T.code,
-                    errorCodeName: h[T.code]
+                    errorMessage: U.message,
+                    errorMessages: U.messages,
+                    errorCode: U.code,
+                    errorCodeName: h[U.code]
                   }), {
-                    status: T.httpStatus,
-                    statusText: K(T.httpStatus),
+                    status: U.httpStatus,
+                    statusText: K(U.httpStatus),
                     headers: { "content-tyoe": "application/json" }
                   })
                 };
@@ -5476,17 +5476,21 @@ class L {
    * Returns whether a page being visited as part of a request event is
    * configured to be protected by login.  
    * 
-   * See {@link SvelteKitSessionServerOptions.loginProtectedPageEndpoints}.
+   * See {@link SvelteKitSessionServerOptions.loginProtectedPageEndpoints} and
+   * {@link SvelteKitSessionServerOptions.loginProtectedExceptionPageEndpoints}.
    * 
    * @param event the request event
    * @returns true or false
    */
   isLoginPageProtected(s) {
     const o = new URL(typeof s == "string" ? s : s.request.url);
-    return o.pathname == this.loginUrl ? !1 : this.loginProtectedPageEndpoints.reduce(
-      (e, r) => e || P(o.pathname, r),
+    return o.pathname == this.loginUrl ? !1 : (this.loginProtectedExceptionPageEndpoints.reduce(
+      (r, a) => r || P(o.pathname, a),
       !1
-    );
+    ), this.loginProtectedPageEndpoints.reduce(
+      (r, a) => r || P(o.pathname, a),
+      !1
+    ));
   }
   /**
    * Returns whether an API call is being visited as part of a request event is
@@ -5499,10 +5503,13 @@ class L {
    */
   isLoginApiProtected(s) {
     const o = new URL(typeof s == "string" ? s : s.request.url);
-    return this.loginProtectedApiEndpoints.reduce(
-      (e, r) => e || P(o.pathname, r),
+    return o.pathname == this.loginUrl ? !1 : (this.loginProtectedExceptionApiEndpoints.reduce(
+      (r, a) => r || P(o.pathname, a),
       !1
-    );
+    ), this.loginProtectedApiEndpoints.reduce(
+      (r, a) => r || P(o.pathname, a),
+      !1
+    ));
   }
   /**
    * Returns whether a page being visited as part of a request event is

package/dist/sveltekitsession.d.ts

@@ -153,6 +153,19 @@ export interface SvelteKitSessionServerOptions extends SessionManagerOptions {
      * The default is empty
      */
     loginProtectedApiEndpoints?: string[];
+    /**
+     * This overrides `loginProtectedPageEndpoints`
+     *
+     * The default is empty.
+     *
+     */
+    loginProtectedExceptionPageEndpoints?: string[];
+    /**
+     * This overrides `loginProtectedPageEndpoints`
+     *
+     * The default is empty
+     */
+    loginProtectedExceptionApiEndpoints?: string[];
     /**
      * See `adminPageEndpoints`
      */
@@ -346,6 +359,8 @@ export declare class SvelteKitSessionServer implements SvelteKitSessionAdapter {
     private factor2ProtectedApiEndpoints;
     private loginProtectedPageEndpoints;
     private loginProtectedApiEndpoints;
+    private loginProtectedExceptionPageEndpoints;
+    private loginProtectedExceptionApiEndpoints;
     private adminPageEndpoints;
     private adminApiEndpoints;
     readonly unauthorizedUrl: string | undefined;
@@ -508,7 +523,8 @@ export declare class SvelteKitSessionServer implements SvelteKitSessionAdapter {
      * Returns whether a page being visited as part of a request event is
      * configured to be protected by login.
      *
-     * See {@link SvelteKitSessionServerOptions.loginProtectedPageEndpoints}.
+     * See {@link SvelteKitSessionServerOptions.loginProtectedPageEndpoints} and
+     * {@link SvelteKitSessionServerOptions.loginProtectedExceptionPageEndpoints}.
      *
      * @param event the request event
      * @returns true or false