@crossauth/sveltekit 0.0.14 → 0.0.16

package/dist/sveltekitadminclientendpoints.d.ts

@@ -11,7 +11,7 @@ import { SvelteKitSharedClientEndpoints, SearchClientsPageData, UpdateClientPage
  * **Endpoints**
  *
  * These endpoints can only be called if an admin user is logged in, as defined
- * by the {@link SveltekitSessionServer.isAdminFn}.  If the user does not
+ * by the {@link SvelteKitServer.isAdminFn}.  If the user does not
  * have this permission, a 401 error is raised.
  *
  * | Name                       | Description                                                 | PageData (returned by load)                                                      | ActionData (return by actions)                                   | Form fields expected by actions                                  | URL param |
@@ -21,14 +21,14 @@ import { SvelteKitSharedClientEndpoints, SearchClientsPageData, UpdateClientPage
  * | -------------------------- | ----------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------- | --------- |
  * | searchClientsEndpoint      | Returns a paginated set of clients or those matching search | See {@link SearchClientsPageData}                                                | *Not provided*                                                   |                                                                  |           |
  * | -------------------------- | ----------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------- | --------- |
- * | updateClientEndpoint       | Updates a client                                            | See {@link UpdateClientsPageData}                                                | `default`:                                                       |                                                                  |           |
- * |                            |                                                             |                                                                                  | See {@link UpdateClientsFormData}                                | See {@link SvelteKitSharedClientEndpoints.updateClient_internal} | client_id  |
+ * | updateClientEndpoint       | Updates a client                                            | See {@link UpdateClientPageData}                                                | `default`:                                                       |                                                                  |           |
+ * |                            |                                                             |                                                                                  | See {@link UpdateClientFormData}                                | See {@link SvelteKitSharedClientEndpoints.updateClient_internal} | client_id  |
  * | -------------------------- | ----------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------- | --------- |
- * | createClientEndpoint       | Creates a new client                                        | See {@link CreateClientsPageData}                                                | `default`:                                                       |                                                                  |           |
- * |                            |                                                             |                                                                                  | See {@link CreateClientsFormData}                                | See {@link SvelteKitSharedClientEndpoints.createClient_internal} | client_id  |
+ * | createClientEndpoint       | Creates a new client                                        | See {@link CreateClientPageData}                                                | `default`:                                                       |                                                                  |           |
+ * |                            |                                                             |                                                                                  | See {@link CreateClientFormData}                                | See {@link SvelteKitSharedClientEndpoints.createClient_internal} | client_id  |
  * | -------------------------- | ----------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------- | --------- |
- * | deleteClientEndpoint       | Deletes a client                                            | See {@link DeleteClientsPageData}                                                | `default`:                                                       |                                                                  |           |
- * |                            |                                                             |                                                                                  | See {@link DeleteClientsFormData}                                | See {@link SvelteKitSharedClientEndpoints.deleteClient_internal} | client_id  |
+ * | deleteClientEndpoint       | Deletes a client                                            | See {@link DeleteClientPageData}                                                | `default`:                                                       |                                                                  |           |
+ * |                            |                                                             |                                                                                  | See {@link DeleteClientFormData}                                | See {@link SvelteKitSharedClientEndpoints.deleteClient_internal} | client_id  |
  * | -------------------------- | ----------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------- | --------- |
  */
 export declare class SvelteKitAdminClientEndpoints extends SvelteKitSharedClientEndpoints {

package/dist/sveltekitadminendpoints.d.ts

@@ -94,8 +94,8 @@ export type SearchUsersReturn = {
  * Provides endpoints for users to login, logout and maintain their
  * own account.
  *
- * This is created automatically when {@link SveltekitServer} is instantiated.
- * The endpoints are available through `SveltekitServer.sessionServer.adminEndpoints`.
+ * This is created automatically when {@link SvelteKitServer} is instantiated.
+ * The endpoints are available through `SvelteKitServer.sessionServer.adminEndpoints`.
  *
  * The methods in this class are designed to be used in
  * `+*_server.ts` files in the `load` and `actions` exports.  You can
@@ -109,13 +109,13 @@ export type SearchUsersReturn = {
  * ```
  * The `?? crossauth.dummyLoad` and `?? crossauth.dummyActions` is to stop
  * typescript complaining as the `sessionServer` member of the
- * {@link @crossauth/sveltekit/SveltekitServer} object may be undefined, because
+ * {@link SvelteKitServer} object may be undefined, because
  * some application do not have a session server.
  *
  * **Endpoints**
  *
  * These endpoints can only be called if an admin user is logged in, as defined
- * by the {@link SveltekitSessionServer.isAdminFn}.  If the user does not
+ * by the {@link SvelteKitServer.isAdminFn}.  If the user does not
  * have this permission, a 401 error is raised.
  *
  * | Name                       | Description                                                | PageData (returned by load)                                                      | ActionData (return by actions)                                   | Form fields expected by actions                             | URL param |
@@ -126,16 +126,16 @@ export type SearchUsersReturn = {
  * | searchUsersEndpoint        | Returns a paginated set of users or those matchign search  | See return of {@link SvelteKitAdminEndpoints.searchUsers}                        | *Not provided*                                                   |                                                             |           |
  * | -------------------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ----------------------------------------------------------- | --------- |
  * | updateUserEndpoint         | Update a user's details                                    | - `allowedFactor2` see {@link SvelteKitAdminEndpoints}.`signupEndpoint`          | `default`:                                                       | `default`:                                                  | `id`      |
- * |                            |                                                            | - `editUser` the {@link @crossauth/common!User} being edited                     |  - see {@link SveltekitAdminEndpoint.updateUser} return          |  - see {@link SveltekitAdminEndpoint.updateUser} event      |           |
+ * |                            |                                                            | - `editUser` the {@link @crossauth/common!User} being edited                     |  - see {@link SvelteKitAdminEndpoints.updateUser} return          |  - see {@link SvelteKitAdminEndpoints.updateUser} event      |           |
  * | -------------------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ----------------------------------------------------------- | --------- |
  * | changePasswordEndpoint     | Update a user's password                                   | - `next` page to load on szccess                                                 | `default`:                                                       | `default`:                                                  | `id`      |
- * |                            |                                                            | - `editUser` the {@link @crossauth/common!User} being edited                     |  - see {@link SveltekitAdminEndpoint.changePassword} return      |  - see {@link SveltekitAdminEndpoint.changePassword} event  |           |
+ * |                            |                                                            | - `editUser` the {@link @crossauth/common!User} being edited                     |  - see {@link SvelteKitAdminEndpoints.changePassword} return      |  - see {@link SvelteKitAdminEndpoints.changePassword} event  |           |
  * | -------------------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ----------------------------------------------------------- | --------- |
  * | createUserEndpoint         | Creates a new user                                         | - `allowedFactor2` see {@link SvelteKitAdminEndpoints}.`signupEndpoint`          | `default`:                                                       | `default`:                                                  | `id`      |
- * |                            |                                                            |                                                                                  |  - see {@link SveltekitAdminEndpoint.createUser} return          |  - see {@link SveltekitAdminEndpoint.createUser} event      |           |
+ * |                            |                                                            |                                                                                  |  - see {@link SvelteKitAdminEndpoints.createUser} return          |  - see {@link SvelteKitAdminEndpoints.createUser} event      |           |
  * | -------------------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ----------------------------------------------------------- | --------- |
  * | deleteUser                 | Deletes a user                                             | - `error` error message if user ID doesn't exist                                 | `default`:                                                       | `default`:                                                  | `id`      |
- * |                            |                                                            |                                                                                  |  - see {@link SveltekitAdminEndpoint.deleteUser} return          |  - see {@link SveltekitAdminEndpoint.deleteUser} event      |           |
+ * |                            |                                                            |                                                                                  |  - see {@link SvelteKitAdminEndpoints.deleteUser} return          |  - see {@link SvelteKitAdminEndpoints.deleteUser} event      |           |
  */
 export declare class SvelteKitAdminEndpoints {
     private sessionServer;
@@ -162,7 +162,7 @@ export declare class SvelteKitAdminEndpoints {
      *      or the empty string.
      *   - `skip` the number to start returning from.  0 if not defined
      *   - `take` the maximum number to return.  10 if not defined.
-     * @param search overrides the search term from the query.
+     * @param searchTerm overrides the search term from the query.
      * @param skip overrides the skip term from the query
      * @param take overrides the take term from the query
      *
@@ -198,7 +198,7 @@ export declare class SvelteKitAdminEndpoints {
      *   - `user_*` anything prefixed with `user` that is also in
      *     the `userEditableFields` or `adminEditableFields` options
      *     passed when constructing the
-     *     user storage object will be added to the {@link @crossuath/common!User}
+     *     user storage object will be added to the {@link @crossauth/common!User}
      *     object (with `user_` removed).
      *
      * @returns object with:
@@ -257,7 +257,7 @@ export declare class SvelteKitAdminEndpoints {
      *   - `repeat_`*secrets* (eg `repeat_password`)
      *   - `user_*` anything prefixed with `user` that is also in
      *   - the `userEditableFields` option passed when constructing the
-     *     user storage object will be added to the {@link @crossuath/common!User}
+     *     user storage object will be added to the {@link @crossauth/common!User}
      *     object (with `user_` removed).
      *
      * @returns object with:
@@ -282,7 +282,6 @@ export declare class SvelteKitAdminEndpoints {
     /**
      * Call this to delete the logged-in user
      *
-     * @param userid the user to delete
      * @param event the Sveltekit event.
 
      * @returns object with:

package/dist/sveltekitapikey.d.ts

@@ -4,7 +4,7 @@ import { RequestEvent, MaybePromise } from '@sveltejs/kit';
 /**
  * Options for {@link SvelteKitApiKeyServer }.
  *
- * See {@link SveltekitApiKeyServer } constructor for description of parameters
+ * See {@link SvelteKitApiKeyServer } constructor for description of parameters
  */
 export interface SvelteKitApiKeyServerOptions extends ApiKeyManagerOptions {
     /** Pass the Sveltekit redirect function */
@@ -22,7 +22,7 @@ export interface SvelteKitApiKeyServerOptions extends ApiKeyManagerOptions {
  * They can be used in place of username/password login and session cookies.
  *
  * This class adds a `preHandler` hook that sets the `user` field in the
- * Fastify request.  It also sets `scopes` in the request object if there
+ * SvelteKit request.  It also sets `scopes` in the request object if there
  * is a `scope` field in the JSON object in the `data` field in in the API
  * record in key storage.
  */
@@ -39,10 +39,9 @@ export declare class SvelteKitApiKeyServer {
     /**
      * Constructor
      *
-     * @param app the Fastify app instance
      * @param userStorage the user storage with user accounts
      * @param keyStorage the storage for finding API keys
-     * @param options See {@link FastifyApiKeyServerOptions}
+     * @param options See {@link SvelteKitApiKeyServerOptions}
      */
     constructor(userStorage: UserStorage, keyStorage: KeyStorage, options?: SvelteKitApiKeyServerOptions);
 }

package/dist/sveltekitoauthclient.d.ts

@@ -1,7 +1,7 @@
-import { CrossauthError, ErrorCode, OAuthTokenResponse, OAuthDeviceAuthorizationResponse } from '@crossauth/common';
+import { CrossauthError, ErrorCode, OAuthTokenResponse, OAuthDeviceAuthorizationResponse, User } from '@crossauth/common';
 import { OAuthClientBackend, OAuthClientOptions } from '@crossauth/backend';
 import { SvelteKitServer } from './sveltekitserver';
-import { RequestEvent } from '@sveltejs/kit';
+import { RequestEvent, MaybePromise } from '@sveltejs/kit';
 
 export type SvelteKitErrorFn = (server: SvelteKitServer, event: RequestEvent, ce: CrossauthError) => Promise<Response>;
 /**
@@ -41,7 +41,7 @@ export interface SvelteKitOAuthClientOptions extends OAuthClientOptions {
      * logged in here at the client.
      *
      * In most cases you can ignore this and use
-     * {@link SvelteKitsessionAdapterOptions.loginProtectedPageEndpoints}
+     * {@link SvelteKitSessionServerOptions.loginProtectedPageEndpoints}
      * to protect the endpoints that begin the flows.
      *
      * See {@link @crossauth/common!OAuthFlows}.
@@ -54,9 +54,13 @@ export interface SvelteKitOAuthClientOptions extends OAuthClientOptions {
      * @param client the OAuth client
      * @param event the SvelteKit request event
      * @param silent if true, don't return a Response, only JSON or undefined.
+     * @param setUserFn if implementing this function you should call this
+     *        when you receive a valid ID token
      * @returns a Response, JSON or undefined
      */
-    receiveTokenFn?: (oauthResponse: OAuthTokenResponse, client: SvelteKitOAuthClient, event: RequestEvent, silent: boolean) => Promise<Response | TokenReturn | undefined>;
+    receiveTokenFn?: (oauthResponse: OAuthTokenResponse, client: SvelteKitOAuthClient, event: RequestEvent, silent: boolean, setUserFn: (event: RequestEvent, token: {
+        [key: string]: any;
+    }) => Promise<void>) => Promise<Response | TokenReturn | undefined>;
     /**
      * The function to call when there is an OAuth error and
      * {@link SvelteKitOAuthClientOptions.errorResponseType}
@@ -114,7 +118,7 @@ export interface SvelteKitOAuthClientOptions extends OAuthClientOptions {
     bffSleepMilliseconds?: number;
     /**
      * Endpoints to provide to acces tokens through the BFF mechanism,
-     * See {@link FastifyOAuthClient} class documentation for full description.
+     * See {@link SvelteKitOAuthClient} class documentation for full description.
      */
     tokenEndpoints?: ("access_token" | "refresh_token" | "id_token" | "have_access_token" | "have_refresh_token" | "have_id_token")[];
     /** Pass the Sveltekit redirect function */
@@ -130,6 +134,10 @@ export interface SvelteKitOAuthClientOptions extends OAuthClientOptions {
      * not the other, set this variable.
      */
     validFlows?: string[];
+    /**
+     * These token types will be treated as JWT.  Default all of them
+     */
+    jwtTokens?: ("access" | "id" | "refresh")[];
 }
 /**
  * Returned by the authorize endpoint
@@ -250,6 +258,18 @@ export interface RedirectUriReturn extends OAuthTokenResponse {
  * of these endpoints, eg `method`, you set `matchSubUrls` to true, then
  * `method/XXX`, `method/YYY` will match as well as `method`.
  *
+ *  **Middleware**
+ *
+ *  This class provides middleware that works with the BFF method.
+ *
+ *  If an ID token is saved in the session and it is valid, the following
+ *  state attributes are set in the request object:
+ *
+ *     - `idPayload` the payload from the ID token
+ *     - `user` a :class:`crossauth_backend.User` object created from the ID
+ *        token
+ *     - `authType` set to `oidc`
+ *
  * **Endpoints provided by this class**
  *
  * | Name                                  | Description                                                  | PageData (returned by load) or JSON returned by get/post                     | ActionData (return by actions)                                   | Form fields expected by actions or post/get input data          |
@@ -285,11 +305,11 @@ export interface RedirectUriReturn extends OAuthTokenResponse {
  * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
  * | allBffEndpoint                        | BFF resource server request.  See class documentation        | As per the corresponding resource server endpoint                            | As per the correspoinding resource server endpoint               | As per the corresponding resource server endpoint               |
  * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
- * | accessTokenEndpoint                   | For BFF only, return the access token payload or error       | JSON of the access token payload                                             | *Not provided*                                                   |                                                                 |
+ * | accessTokenEndpoint                   | For BFF only, return the access token payload or error       | JSON of the access token payload                                             | *Not provided*                                                   | `decode`, default `true`                                        |
  * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
- * | refreshTokenEndpoint                  | For BFF only, return the refresh token payload or error      | JSON of the refresh token payload                                            | *Not provided*                                                   |                                                                 |
+ * | refreshTokenEndpoint                  | For BFF only, return the refresh token payload or error      | JSON of the refresh token payload                                            | *Not provided*                                                   | `decode`, default `true`                                        |
  * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
- * | idTokenEndpoint                       | For BFF only, return the id token payload or error           | POST: JSON of the id token payload                                           | *Not provided*                                                   |                                                                 |
+ * | idTokenEndpoint                       | For BFF only, return the id token payload or error           | POST: JSON of the id token payload                                           | *Not provided*                                                   | `decode`, default `true`                                        |
  * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
  * | havAeccessTokenEndpoint               | For BFF only, return whether access token present            | POST: `ok` of false or true                                                  | *Not provided*                                                   |                                                                 |
  * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
@@ -297,7 +317,7 @@ export interface RedirectUriReturn extends OAuthTokenResponse {
  * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
  * | haveIdTokenEndpoint                   | For BFF only, return whether id token present                | POST: `ok` of false or true                                                  | *Not provided*                                                   |                                                                 |
  * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
- * | tokensEndpoint                        | For BFF only, return a JSON object of all of the above       | POST: All of the above, keyed on `access_token`, `have_access_token`, etc.   | *Not provided*                                                   |                                                                 |
+ * | tokensEndpoint                        | For BFF only, return a JSON object of all of the above       | POST: All of the above, keyed on `access_token`, `have_access_token`, etc.   | *Not provided*                                                   | `decode`, default `true`                                        |
  * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
  * | deleteTokensEndpoint                  | For BFF only, deletes tokens saved for session               | POST:  `ok` of false or true                                                 | `default`: `ok` of false or true                                 | *None*                                                          |
  * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
@@ -314,7 +334,7 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
     readonly redirect: any;
     readonly error: any;
     /**
-     * See {@link FastifyOAuthClientOptions}
+     * See {@link SvelteKitOAuthClientOptions}
      */
     loginProtectedFlows: string[];
     private tokenResponseType;
@@ -325,13 +345,28 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
     private tokenEndpoints;
     private bffMaxTries;
     private bffSleepMilliseconds;
+    readonly jwtTokens: string[];
+    readonly hook: (input: {
+        event: RequestEvent;
+    }) => MaybePromise<Response | undefined>;
+    private testMiddleware;
+    private testEvent;
     /**
      * Constructor
-     * @param server the {@link FastifyServer} instance
+     * @param server the {@link SvelteKitServer} instance
      * @param authServerBaseUrl the `iss` claim in the access token must match this value
-     * @param options See {@link FastifyOAuthClientOptions}
+     * @param options See {@link SvelteKitOAuthClientOptions}
      */
     constructor(server: SvelteKitServer, authServerBaseUrl: string, options: SvelteKitOAuthClientOptions);
+    /**
+     * If you implement your own function to receive tokens and you use BFF,
+     * use this function to set `event.locals.user`.
+     * @param event the Sveltekit request event
+     * @param token the ID token
+     */
+    setEventLocalsUser(event: RequestEvent, token: {
+        [key: string]: any;
+    }): Promise<void>;
     private passwordPost;
     private passwordMfa;
     private passwordOtp;
@@ -385,7 +420,7 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
         status: number;
         body?: {
             [key: string]: any;
-        };
+        } | string;
     }>;
     tokensResponse(event: RequestEvent, token: string | string[]): Promise<Response>;
     private startDeviceCodeFlow_internal;
@@ -448,6 +483,17 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
             access_token?: string | undefined;
             refresh_token?: string | undefined;
             id_token?: string | undefined;
+            /**
+             * This function is called after successful authorization to pass the
+             * new tokens to.
+             * @param oauthResponse the response from the OAuth `token` endpoint.
+             * @param client the OAuth client
+             * @param event the SvelteKit request event
+             * @param silent if true, don't return a Response, only JSON or undefined.
+             * @param setUserFn if implementing this function you should call this
+             *        when you receive a valid ID token
+             * @returns a Response, JSON or undefined
+             */
             token_type?: string | undefined;
             expires_in?: number | undefined;
             error?: string | undefined;
@@ -472,6 +518,17 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
             access_token?: string | undefined;
             refresh_token?: string | undefined;
             id_token?: string | undefined;
+            /**
+             * This function is called after successful authorization to pass the
+             * new tokens to.
+             * @param oauthResponse the response from the OAuth `token` endpoint.
+             * @param client the OAuth client
+             * @param event the SvelteKit request event
+             * @param silent if true, don't return a Response, only JSON or undefined.
+             * @param setUserFn if implementing this function you should call this
+             *        when you receive a valid ID token
+             * @returns a Response, JSON or undefined
+             */
             token_type?: string | undefined;
             expires_in?: number | undefined;
             error?: string | undefined;
@@ -494,6 +551,17 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
             access_token?: string | undefined;
             refresh_token?: string | undefined;
             id_token?: string | undefined;
+            /**
+             * This function is called after successful authorization to pass the
+             * new tokens to.
+             * @param oauthResponse the response from the OAuth `token` endpoint.
+             * @param client the OAuth client
+             * @param event the SvelteKit request event
+             * @param silent if true, don't return a Response, only JSON or undefined.
+             * @param setUserFn if implementing this function you should call this
+             *        when you receive a valid ID token
+             * @returns a Response, JSON or undefined
+             */
             token_type?: string | undefined;
             expires_in?: number | undefined;
             error?: string | undefined;
@@ -523,7 +591,7 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
                 errorMessage?: undefined;
             } | {
                 ok: boolean;
-                user: import('@crossauth/common').User | undefined;
+                user: User | undefined;
                 csrfToken: string | undefined;
                 errorCode: ErrorCode;
                 errorCodeName: string;
@@ -620,14 +688,14 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
     readonly accessTokenEndpoint: {
         post: (event: RequestEvent) => Promise<{
             status: number;
-            body?: {
+            body?: string | {
                 [key: string]: any;
             } | undefined;
         }>;
         actions: {
             default: (event: RequestEvent) => Promise<{
                 status: number;
-                body?: {
+                body?: string | {
                     [key: string]: any;
                 } | undefined;
             }>;
@@ -638,7 +706,7 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
         actions: {
             default: (event: RequestEvent) => Promise<{
                 status: number;
-                body?: {
+                body?: string | {
                     [key: string]: any;
                 } | undefined;
             }>;
@@ -649,7 +717,7 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
         actions: {
             default: (event: RequestEvent) => Promise<{
                 status: number;
-                body?: {
+                body?: string | {
                     [key: string]: any;
                 } | undefined;
             }>;
@@ -660,7 +728,7 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
         actions: {
             default: (event: RequestEvent) => Promise<{
                 status: number;
-                body?: {
+                body?: string | {
                     [key: string]: any;
                 } | undefined;
             }>;
@@ -671,7 +739,7 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
         actions: {
             default: (event: RequestEvent) => Promise<{
                 status: number;
-                body?: {
+                body?: string | {
                     [key: string]: any;
                 } | undefined;
             }>;
@@ -682,7 +750,7 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
         actions: {
             default: (event: RequestEvent) => Promise<{
                 status: number;
-                body?: {
+                body?: string | {
                     [key: string]: any;
                 } | undefined;
             }>;
@@ -693,10 +761,11 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
         actions: {
             default: (event: RequestEvent) => Promise<{
                 status: number;
-                body?: {
+                body?: string | {
                     [key: string]: any;
                 } | undefined;
             }>;
         };
     };
+    private errorIfIdTokenInvalid;
 }

package/dist/sveltekitoauthserver.d.ts

@@ -22,7 +22,7 @@ export interface ReturnBase {
 }
 /**
  * Return type for {@link SvelteKitUserEndpoints.verifyEmail}
- * {@link SvelteKitUserEndpoints.verifyEmailEndpoint} action.
+ * {@link SvelteKitUserEndpoints.verifyEmailTokenEndpoint} action.
  *
  * See class documentation for {@link SvelteKitUserEndpoints} for more details.
  */

package/dist/sveltekitresserver.d.ts

@@ -1,6 +1,7 @@
 import { RequestEvent, MaybePromise } from '@sveltejs/kit';
 import { User } from '@crossauth/common';
 import { OAuthResourceServer, UserStorage, OAuthResourceServerOptions, OAuthTokenConsumer } from '@crossauth/backend';
+import { SvelteKitSessionAdapter } from './sveltekitsessionadapter';
 
 /**
  * Options for {@link SvelteKitOAuthResourceServer}
@@ -13,7 +14,7 @@ export interface SvelteKitOAuthResourceServerOptions extends OAuthResourceServer
     userStorage?: UserStorage;
     /**
      * If you enabled `protectedEndpoints` in
-     * {@link FastifyOAuthResourceServer.constructor}
+     * {@link SvelteKitOAuthResourceServer.constructor}
      * and the access token is invalid, a 401 reply will be sent before
      * your endpoint is hit.  This will be the body,  Default {}.
      */
@@ -31,6 +32,24 @@ export interface SvelteKitOAuthResourceServerOptions extends OAuthResourceServer
             acceptSessionAuthorization?: boolean;
         };
     };
+    /**
+     * Where access tokens may be found (in this order).
+     *
+     * If this contains `session`, must also provide the session adapter
+     *
+     * Default `header`
+     */
+    tokenLocations?: ("beader" | "session")[];
+    /**
+     * If tokenLocations contains `session`, tokens are keyed on this name.
+     *
+     * Default `oauth`
+     */
+    sessionDataName?: string;
+    /**
+     * If `tokenLocations` contains `session`, must provide a session adapter
+     */
+    sessionAdapter?: SvelteKitSessionAdapter;
 }
 /**
  * OAuth resource server.
@@ -40,17 +59,22 @@ export interface SvelteKitOAuthResourceServerOptions extends OAuthResourceServer
  *
  * There are two way of using this class.  If you don't set
  * `protectedEndpoints` in
- * {@link SvelteKitAuthResourceServer.constructor}, then in your
+ * {@link SvelteKitOAuthResourceServer.constructor}, then in your
  * protected endpoints, call {@link SvelteKitOAuthResourceServer.authorized}
  * to check if the access token is valid and get any user credentials.
  *
  * If you do set `protectedEndpoints` in
  * {@link SvelteKitOAuthResourceServer.constructor}
  * then a hook is created.
+ *
+ * **Middleware**
  * The hook
  * hook will set the `accessTokenPayload`, `user` and `scope` fields
  * on the event locals based on the content
  * of the access token in the `Authorization` header if it is valid.
+ * If a user storage is provided,
+ * it will be used to look the user up.  Otherwise a minimal user object
+ * is created.
  * If it is not valid it will set the `authError` and `authErrorDescription`.
  * If the access token is invalid, or there is an error, a 401 or 500
  * response is sent before executing your endpoint code.  As per
@@ -61,6 +85,9 @@ export declare class SvelteKitOAuthResourceServer extends OAuthResourceServer {
     private userStorage?;
     private errorBody;
     private protectedEndpoints;
+    private sessionDataName;
+    private tokenLocations;
+    private sessionAdapter?;
     /**
      * Hook to check if the user is logged in and set data in `locals`
      * accordingly.
@@ -70,7 +97,7 @@ export declare class SvelteKitOAuthResourceServer extends OAuthResourceServer {
     }) => MaybePromise<Response | undefined>;
     /**
      * Constructor
-     * @param tokenConsumers the token consumers, one per issuer
+     * @param tokenConsumers the token consumers, one per issuer and audience
      * @param options See {@link SvelteKitOAuthResourceServerOptions}
      */
     constructor(tokenConsumers: OAuthTokenConsumer[], options?: SvelteKitOAuthResourceServerOptions);
@@ -98,4 +125,6 @@ export declare class SvelteKitOAuthResourceServer extends OAuthResourceServer {
         error?: string;
         error_description?: string;
     } | undefined>;
+    private tokenFromHeader;
+    private tokenFromSession;
 }

package/dist/sveltekitserver.d.ts

@@ -72,7 +72,7 @@ export type Resolver = (event: RequestEvent, opts?: ResolveOptions) => MaybeProm
  *                     and CSRF cookies.  See {@link SvelteKitSessionServer}.
  * - `sessionAdapter`  If you are using only the oAuthClient and don't want
  *                     to use Crossauth's session server, you can implement
- *                     a minimal {@link SveltekitSessionAdapter} instead.
+ *                     a minimal {@link SvelteKitSessionAdapter} instead.
  * - `oAuthAuthServer` OAuth authorization server.  See
  *                     {@link SvelteKitAuthorizationServer}
  * - `oAuthClient`     OAuth client.  See {@link SvelteKitOAuthClient}.
@@ -130,7 +130,7 @@ export type Resolver = (event: RequestEvent, opts?: ResolveOptions) => MaybeProm
  * **Use in Pages**
  *
  * For instructions about how to use this class in your endpoints, see
- * {@link SvelkteKitUserEndpoints} and {@link SvelteKitAdminEndpoints}
+ * {@link SvelteKitUserEndpoints} and {@link SvelteKitAdminEndpoints}
  * for cookie-based session management.
  */
 export declare class SvelteKitServer {
@@ -168,6 +168,7 @@ export declare class SvelteKitServer {
     readonly oAuthClients?: SvelteKitOAuthClient[];
     /** OAuth resource server instance */
     readonly oAuthResServer?: SvelteKitOAuthResourceServer;
+    private audience;
     /**
      * Constructor.
      *
@@ -182,7 +183,7 @@ export declare class SvelteKitServer {
      *     documentation).  The value is an object with a `keyStorage` field
      *     which must be present and should be the {@link KeyStorage} instance
      *     where API keys are stored.  A field called `options` whose
-     *     value is an {@link SveltekitApiKeyServerOptions} may also be
+     *     value is an {@link SvelteKitApiKeyServerOptions} may also be
      *     provided.
      *   - `oAuthAuthServer` if passed, instantiate the session server (see class
      *      documentation).  The value is an object with a `keyStorage` field