@crossauth/sveltekit 0.0.15 → 0.0.16

package/dist/index.js

@@ -1,9 +1,9 @@
 import { minimatch as P } from "minimatch";
-import { ApiKeyManager as K, KeyStorage as X, toCookieSerializeOptions as R, Crypto as U, OAuthAuthorizationServer as Z, setParameter as y, ParamType as _, DoubleSubmitCsrfToken as ee, OAuthClientManager as B, OAuthClientBackend as re, OAuthResourceServer as se, OAuthTokenConsumer as te, TokenEmailer as oe, SessionManager as ie } from "@crossauth/backend";
-import { CrossauthError as c, ErrorCode as u, CrossauthLogger as d, j as f, OAuthFlows as E, UserState as I, httpStatus as M } from "@crossauth/common";
-import { json as v, redirect as G, error as Q } from "@sveltejs/kit";
+import { ApiKeyManager as M, KeyStorage as X, toCookieSerializeOptions as R, Crypto as A, OAuthAuthorizationServer as Z, setParameter as y, ParamType as _, DoubleSubmitCsrfToken as ee, OAuthClientManager as x, OAuthClientBackend as re, OAuthResourceServer as se, OAuthTokenConsumer as te, TokenEmailer as oe, SessionManager as ie } from "@crossauth/backend";
+import { CrossauthError as c, ErrorCode as u, CrossauthLogger as d, j as f, OAuthFlows as E, UserState as I, httpStatus as q } from "@crossauth/common";
+import { json as v, redirect as Q, error as Y } from "@sveltejs/kit";
 import "cookie";
-import { jwtDecode as z } from "jwt-decode";
+import { jwtDecode as K } from "jwt-decode";
 import ae from "qrcode";
 class V {
   constructor(s) {
@@ -84,7 +84,7 @@ class ne {
    * @param options See {@link SvelteKitApiKeyServerOptions}
    */
   constructor(s, o, t = {}) {
-    this.userStorage = s, this.apiKeyManager = new K(o, t), this.hook = async ({ event: e }) => {
+    this.userStorage = s, this.apiKeyManager = new M(o, t), this.hook = async ({ event: e }) => {
       d.logger.debug("APIKey hook");
       const r = e.request.headers.get("authorization");
       if (r)
@@ -97,7 +97,7 @@ class ne {
           );
           d.logger.debug(f({
             msg: "Valid API key",
-            hahedApiKey: K.hashSignedApiKeyValue(a.value)
+            hahedApiKey: M.hashSignedApiKeyValue(a.value)
           }));
           const i = X.decodeData(a.data);
           if (e.locals.apiKey = { ...a, ...i }, "scope" in i && Array.isArray(i.scope)) {
@@ -109,9 +109,9 @@ class ne {
           if (a.userid)
             try {
               const { user: n } = await this.userStorage.getUserById(a.userid);
-              e.locals.user = n, e.locals.authType = "apiKey", d.logger.debug(f({ msg: "API key is for user", userid: n.id, user: n.username, hahedApiKey: K.hashSignedApiKeyValue(a.value) }));
+              e.locals.user = n, e.locals.authType = "apiKey", d.logger.debug(f({ msg: "API key is for user", userid: n.id, user: n.username, hahedApiKey: M.hashSignedApiKeyValue(a.value) }));
             } catch (n) {
-              d.logger.error(f({ msg: "API key has invalid user", userid: a.userid, hashedApiKey: K.hashSignedApiKeyValue(a.value) })), d.logger.debug(f({ err: n }));
+              d.logger.error(f({ msg: "API key has invalid user", userid: a.userid, hashedApiKey: M.hashSignedApiKeyValue(a.value) })), d.logger.debug(f({ err: n }));
             }
         } catch (a) {
           d.logger.error(f({ msg: "Invalid authorization header received", header: r })), d.logger.debug(f({ err: a }));
@@ -176,7 +176,7 @@ class ce {
           return d.logger.error(f({
             msg: "getcsrftoken failure",
             user: (l = i.locals.user) == null ? void 0 : l.username,
-            hashedCsrfCookie: U.hash(n.split(".")[0]),
+            hashedCsrfCookie: A.hash(n.split(".")[0]),
             error: g.code,
             errorCodeName: g.codeName
           })), d.logger.debug(f({ err: h })), d.logger.error({ cerr: h }), v({
@@ -286,32 +286,32 @@ class ce {
           try {
             var l = new b();
             await l.loadData(i), n = l.toObject();
-            const g = l.getAsBoolean("authorized"), m = n.response_type, p = n.client_id, S = n.redirect_uri, C = n.scope, T = n.state, N = n.code_challenge, A = n.code_challenge_method;
-            let F;
-            if (g == null && (F = "authorized"), m ? p ? S ? T || (F = "state") : F = "redirect_uri" : F = "client_id" : F = "response_type", F)
+            const g = l.getAsBoolean("authorized"), m = n.response_type, p = n.client_id, S = n.redirect_uri, C = n.scope, T = n.state, N = n.code_challenge, F = n.code_challenge_method;
+            let U;
+            if (g == null && (U = "authorized"), m ? p ? S ? T || (U = "state") : U = "redirect_uri" : U = "client_id" : U = "response_type", U)
               return {
                 ok: !1,
                 error: "invalid_request",
-                error_description: "Invalid form: does not contain " + F + " parameter"
+                error_description: "Invalid form: does not contain " + U + " parameter"
               };
             if (!i.locals.user) return this.redirect(
               302,
               this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
             );
             if ((h = this.svelteKitServer.sessionServer) != null && h.enableCsrfProtection && !i.locals.csrfToken) throw new c(u.InvalidCsrf);
-            const D = await this.authorize(i, g ?? !1, {
+            const z = await this.authorize(i, g ?? !1, {
               responseType: m,
               client_id: p,
               redirect_uri: S,
               scope: C,
               state: T,
               codeChallenge: N,
-              codeChallengeMethod: A
+              codeChallengeMethod: F
             });
             return {
               ok: !1,
-              error: D.error ?? "server_error",
-              error_description: D.error_description ?? "An unexpected error occurred"
+              error: z.error ?? "server_error",
+              error_description: z.error_description ?? "An unexpected error occurred"
             };
           } catch (g) {
             if (w.isSvelteKitError(g) || w.isSvelteKitRedirect(g)) throw g;
@@ -629,7 +629,7 @@ class ce {
         errorCodeName: p.codeName
       }));
       try {
-        throw B.validateUri(r), this.redirect(302, r + "?error=access_denied&error_description=" + encodeURIComponent("Access was not granted"));
+        throw x.validateUri(r), this.redirect(302, r + "?error=access_denied&error_description=" + encodeURIComponent("Access was not granted"));
       } catch (S) {
         if (w.isSvelteKitError(S) || w.isSvelteKitRedirect(S)) throw S;
         return d.logger.error(f({
@@ -755,7 +755,7 @@ class ce {
       let a, i;
       const n = r.split(" ");
       if (n.length == 2 && n[0].toLocaleLowerCase() == "basic") {
-        const h = U.base64Decode(n[1]).split(":", 2);
+        const h = A.base64Decode(n[1]).split(":", 2);
         h.length == 2 && (a = h[0], i = h[1]);
       }
       a == null || i == null ? d.logger.warn(f({
@@ -777,7 +777,7 @@ class ce {
           error_description: i.error_description
         };
       if (!i.client_id)
-        return d.logger.error(f({ msg: "No client id found for user code", userCodeHash: U.hash(s), ip: o.request.referrer, username: (e = o.locals.user) == null ? void 0 : e.username })), {
+        return d.logger.error(f({ msg: "No client id found for user code", userCodeHash: A.hash(s), ip: o.request.referrer, username: (e = o.locals.user) == null ? void 0 : e.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
@@ -785,7 +785,7 @@ class ce {
           error_description: "No client id found for user code"
         };
       if (i.error == "access_denied")
-        return d.logger.error(f({ msg: "Incorrect user code given", userCodeHash: U.hash(s), ip: o.request.referrer, username: (r = o.locals.user) == null ? void 0 : r.username })), this.authServer.userCodeThrottle > 0 && await ((h) => new Promise((g) => setTimeout(g, h)))(this.authServer.userCodeThrottle), {
+        return d.logger.error(f({ msg: "Incorrect user code given", userCodeHash: A.hash(s), ip: o.request.referrer, username: (r = o.locals.user) == null ? void 0 : r.username })), this.authServer.userCodeThrottle > 0 && await ((h) => new Promise((g) => setTimeout(g, h)))(this.authServer.userCodeThrottle), {
           ok: !1,
           completed: !1,
           retryAllowed: !0,
@@ -793,7 +793,7 @@ class ce {
           error_description: i.error_description
         };
       if (i.error == "expired_token")
-        return d.logger.error(f({ msg: "Expired user code", userCodeHash: U.hash(s), ip: o.request.referrer, username: (a = o.locals.user) == null ? void 0 : a.username })), {
+        return d.logger.error(f({ msg: "Expired user code", userCodeHash: A.hash(s), ip: o.request.referrer, username: (a = o.locals.user) == null ? void 0 : a.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
@@ -866,26 +866,26 @@ async function le(k, s, o) {
   var t;
   throw (t = k.oAuthClient) == null ? void 0 : t.error(o.httpStatus, o.message);
 }
-function x(k) {
+function O(k) {
   let s;
   if (k)
     try {
-      s = JSON.parse(U.base64Decode(k.split(".")[1]));
+      s = JSON.parse(A.base64Decode(k.split(".")[1]));
     } catch {
       d.logger.error(f({ msg: "Couldn't decode id token" }));
     }
   return s;
 }
-async function j(k, s, o, t) {
-  let e = { ok: !0, ...k };
-  return s.jwtTokens.includes("id") && (e.id_payload = x(k.id_token)), v(e);
+async function J(k, s, o, t, e) {
+  let r = { ok: !0, ...k };
+  return s.jwtTokens.includes("id") && (r.id_payload = O(k.id_token)), v(r);
 }
-function H(k, s) {
+function L(k, s) {
   var o, t, e;
   if (k.access_token)
     try {
       if (k.access_token && s.includes("access")) {
-        const r = (o = z(k.access_token)) == null ? void 0 : o.jti, a = r ? U.hash(r) : void 0;
+        const r = (o = K(k.access_token)) == null ? void 0 : o.jti, a = r ? A.hash(r) : void 0;
         d.logger.debug(f({
           msg: "Got access token",
           accessTokenHash: a
@@ -897,7 +897,7 @@ function H(k, s) {
   if (k.id_token)
     try {
       if (k.id_token && s.includes("id")) {
-        const r = (t = z(k.id_token)) == null ? void 0 : t.jti, a = r ? U.hash(r) : void 0;
+        const r = (t = K(k.id_token)) == null ? void 0 : t.jti, a = r ? A.hash(r) : void 0;
         d.logger.debug(f({
           msg: "Got id token",
           idTokenHash: a
@@ -909,7 +909,7 @@ function H(k, s) {
   if (k.refresh_token && s.includes("refresh"))
     try {
       if (k.refresh_token) {
-        const r = (e = z(k.refresh_token)) == null ? void 0 : e.jti, a = r ? U.hash(r) : void 0;
+        const r = (e = K(k.refresh_token)) == null ? void 0 : e.jti, a = r ? A.hash(r) : void 0;
         d.logger.debug(f({
           msg: "Got refresh token",
           refreshTokenHash: a
@@ -919,7 +919,7 @@ function H(k, s) {
       d.logger.debug(f({ err: r }));
     }
 }
-async function Y(k, s, o) {
+async function j(k, s, o) {
   var a, i, n, l;
   if (!s.server.sessionAdapter)
     throw new c(
@@ -928,7 +928,7 @@ async function Y(k, s, o) {
     );
   let t = k.expires_in;
   if (!t && k.access_token && s.jwtTokens.includes("access")) {
-    const h = z(k.access_token);
+    const h = K(k.access_token);
     h.exp && (t = h.exp);
   }
   if (!t)
@@ -939,7 +939,7 @@ async function Y(k, s, o) {
   const e = Date.now() + t * 1e3;
   let r = { ...k, expires_at: e };
   if ("id_token" in k) {
-    let h = x(k.id_token);
+    let h = O(k.id_token);
     h && (r.id_token = h);
   }
   if (s.server.sessionServer) {
@@ -959,55 +959,89 @@ async function Y(k, s, o) {
       r
     ));
 }
-async function de(k, s, o, t) {
+async function de(k, s, o, t, e) {
   if (k.error) {
-    const e = c.fromOAuthError(
+    const r = c.fromOAuthError(
       k.error,
       k.error_description
     );
-    return s.errorFn(s.server, o, e);
+    return s.errorFn(s.server, o, r);
   }
-  H(k, s.jwtTokens);
+  L(k, s.jwtTokens);
   try {
-    if ((k.access_token || k.id_token || k.refresh_token) && await Y(k, s, o), !t) return s.redirect(302, s.authorizedUrl);
-  } catch (e) {
-    if (w.isSvelteKitError(e) || w.isSvelteKitRedirect(e)) throw e;
-    const r = c.asCrossauthError(e);
-    return d.logger.debug(f({ err: r })), d.logger.debug(f({ cerr: r, msg: "Error receiving tokens" })), s.errorFn(s.server, o, r);
+    if (k.access_token || k.id_token || k.refresh_token) {
+      await j(k, s, o);
+      const r = O(k.id_token);
+      r && await e(o, r);
+    }
+    if (!t) return s.redirect(302, s.authorizedUrl);
+  } catch (r) {
+    if (w.isSvelteKitError(r) || w.isSvelteKitRedirect(r)) throw r;
+    const a = c.asCrossauthError(r);
+    return d.logger.debug(f({ err: a })), d.logger.debug(f({ cerr: a, msg: "Error receiving tokens" })), s.errorFn(s.server, o, a);
   }
 }
-async function he(k, s, o, t) {
+async function he(k, s, o, t, e) {
   if (k.error) {
-    const e = c.fromOAuthError(
+    const r = c.fromOAuthError(
       k.error,
       k.error_description
     );
-    return s.errorFn(s.server, o, e);
+    return s.errorFn(s.server, o, r);
   }
-  H(k, s.jwtTokens);
+  L(k, s.jwtTokens);
   try {
-    return (k.access_token || k.id_token || k.refresh_token) && await Y(k, s, o), v({ ok: !0, ...k });
-    if (!t) return s.redirect(302, s.authorizedUrl);
-  } catch (e) {
-    if (w.isSvelteKitError(e) || w.isSvelteKitRedirect(e)) throw e;
-    const r = c.asCrossauthError(e);
-    return d.logger.debug(f({ err: r })), d.logger.debug(f({ cerr: r, msg: "Error receiving tokens" })), s.errorFn(s.server, o, r);
+    if (k.access_token || k.id_token || k.refresh_token) {
+      await j(k, s, o);
+      const r = O(k.id_token);
+      r && await e(o, r);
+    }
+    return v({ ok: !0, ...k });
+  } catch (r) {
+    if (w.isSvelteKitError(r) || w.isSvelteKitRedirect(r)) throw r;
+    const a = c.asCrossauthError(r);
+    return d.logger.debug(f({ err: a })), d.logger.debug(f({ cerr: a, msg: "Error receiving tokens" })), s.errorFn(s.server, o, a);
   }
 }
-async function ue(k, s, o, t) {
+async function ue(k, s, o, t, e) {
   if (k.error)
     return {
       ok: !1,
       error: k.error,
       error_description: k.error_description
     };
-  H(k, s.jwtTokens);
+  L(k, s.jwtTokens);
+  try {
+    (k.access_token || k.id_token || k.refresh_token) && await j(k, s, o);
+    let r = {
+      ok: !0,
+      ...k
+    };
+    return s.jwtTokens.includes("id") && (r.id_payload = O(k.id_token)), r.id_payload && await e(o, r.id_payload), r;
+  } catch (r) {
+    if (w.isSvelteKitError(r) || w.isSvelteKitRedirect(r)) throw r;
+    const a = c.asCrossauthError(r);
+    return d.logger.debug(f({ err: a })), d.logger.debug(f({ cerr: a, msg: "Error receiving tokens" })), {
+      ok: !1,
+      error: a.oauthErrorCode,
+      error_description: a.message
+    };
+  }
+}
+async function fe(k, s, o, t) {
+  if (k.error)
+    return {
+      ok: !1,
+      error: k.error,
+      error_description: k.error_description
+    };
+  L(k, s.jwtTokens);
   try {
     let e = {
       ok: !0,
       ...k
     };
-    return s.jwtTokens.includes("id") && (e.id_payload = x(k.id_token)), e;
+    return s.jwtTokens.includes("id") && (e.id_payload = O(k.id_token)), e;
   } catch (e) {
     if (w.isSvelteKitError(e) || w.isSvelteKitRedirect(e)) throw e;
     const r = c.asCrossauthError(e);
@@ -1018,7 +1052,7 @@ async function ue(k, s, o, t) {
     };
   }
 }
-class J extends re {
+class G extends re {
   /**
    * Constructor
    * @param server the {@link SvelteKitServer} instance
@@ -1026,7 +1060,7 @@ class J extends re {
    * @param options See {@link SvelteKitOAuthClientOptions}
    */
   constructor(s, o, t) {
-    if (super(o, t), this.sessionDataName = "oauth", this.receiveTokenFn = j, this.errorFn = W, this.loginUrl = "/login", this.validFlows = [E.All], this.authorizedUrl = "", this.autoRefreshActive = {}, this.loginProtectedFlows = [], this.tokenResponseType = "sendJson", this.errorResponseType = "sendJson", this.bffEndpoints = [], this.bffEndpointName = "bff", this.tokenEndpoints = [], this.bffMaxTries = 1, this.bffSleepMilliseconds = 500, this.jwtTokens = ["access", "id", "refresh"], this.testMiddleware = !1, this.testEvent = void 0, this.authorizationCodeFlowEndpoint = {
+    if (super(o, t), this.sessionDataName = "oauth", this.receiveTokenFn = J, this.errorFn = W, this.loginUrl = "/login", this.validFlows = [E.All], this.authorizedUrl = "", this.autoRefreshActive = {}, this.loginProtectedFlows = [], this.tokenResponseType = "sendJson", this.errorResponseType = "sendJson", this.bffEndpoints = [], this.bffEndpointName = "bff", this.tokenEndpoints = [], this.bffMaxTries = 1, this.bffSleepMilliseconds = 500, this.jwtTokens = ["access", "id", "refresh"], this.testMiddleware = !1, this.testEvent = void 0, this.authorizationCodeFlowEndpoint = {
       get: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
           const r = new c(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
@@ -1218,7 +1252,13 @@ class J extends re {
               h
             );
           }
-          return await this.receiveTokenFn(l, this, e, !1);
+          return await this.receiveTokenFn(
+            l,
+            this,
+            e,
+            !1,
+            this.setEventLocalsUser
+          );
         } catch (r) {
           if (w.isSvelteKitRedirect(r) || w.isSvelteKitError(r)) throw r;
           const a = c.asCrossauthError(r);
@@ -1268,7 +1308,13 @@ class J extends re {
               error_description: g.message
             };
           }
-          const h = await this.receiveTokenFn(l, this, e, !1);
+          const h = await this.receiveTokenFn(
+            l,
+            this,
+            e,
+            !1,
+            this.setEventLocalsUser
+          );
           return h instanceof Response ? {
             ok: !1,
             error: "server_error",
@@ -1320,7 +1366,13 @@ class J extends re {
               l
             );
           }
-          const n = await this.receiveTokenFn(i, this, e, !1);
+          const n = await this.receiveTokenFn(
+            i,
+            this,
+            e,
+            !1,
+            this.setEventLocalsUser
+          );
           return n instanceof Response ? n : this.pack(n);
         } catch (i) {
           if (w.isSvelteKitRedirect(i) || w.isSvelteKitError(i)) throw i;
@@ -1347,7 +1399,13 @@ class J extends re {
                 i.error,
                 i.error_description
               );
-            return await this.receiveTokenFn(i, this, e, !1) ?? {};
+            return await this.receiveTokenFn(
+              i,
+              this,
+              e,
+              !1,
+              this.setEventLocalsUser
+            ) ?? {};
           } catch (i) {
             if (w.isSvelteKitRedirect(i) || w.isSvelteKitError(i)) throw i;
             const n = c.asCrossauthError(i);
@@ -1400,7 +1458,13 @@ class J extends re {
             );
             return this.errorFn(this.server, e, h);
           }
-          const n = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(i)), l = await this.receiveTokenFn(n, this, e, !1);
+          const n = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(i)), l = await this.receiveTokenFn(
+            n,
+            this,
+            e,
+            !1,
+            this.setEventLocalsUser
+          );
           if (n && l instanceof Response) return l;
           throw new c(u.UnknownError, "Receive token function did not return a Response");
         } catch (i) {
@@ -1445,7 +1509,13 @@ class J extends re {
                 u.BadRequest,
                 "No refresh token supplied"
               );
-            const n = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(i)), l = await this.receiveTokenFn(n, this, e, !1) ?? {};
+            const n = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(i)), l = await this.receiveTokenFn(
+              n,
+              this,
+              e,
+              !1,
+              this.setEventLocalsUser
+            ) ?? {};
             if (l instanceof Response) throw new c(u.Configuration, "Refresh token flow should return an object not Response");
             return l;
           } catch (i) {
@@ -1663,7 +1733,7 @@ class J extends re {
         u.Configuration,
         "Token response type of custom selected but receiveTokenFn not defined"
       );
-    if (this.tokenResponseType == "custom" && t.receiveTokenFn ? this.receiveTokenFn = t.receiveTokenFn : this.tokenResponseType == "sendJson" ? this.receiveTokenFn = j : this.tokenResponseType == "sendInPage" ? this.receiveTokenFn = ue : this.tokenResponseType == "saveInSessionAndLoad" ? this.receiveTokenFn = j : this.tokenResponseType == "saveInSessionAndRedirect" ? this.receiveTokenFn = de : this.tokenResponseType == "saveInSessionAndReturn" && (this.receiveTokenFn = he), (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "saveInSessionAndRedirect") && this.authorizedUrl == "")
+    if (this.tokenResponseType == "custom" && t.receiveTokenFn ? this.receiveTokenFn = t.receiveTokenFn : this.tokenResponseType == "sendJson" ? this.receiveTokenFn = J : this.tokenResponseType == "sendInPage" ? this.receiveTokenFn = fe : this.tokenResponseType == "saveInSessionAndLoad" ? this.receiveTokenFn = ue : this.tokenResponseType == "saveInSessionAndRedirect" ? this.receiveTokenFn = de : this.tokenResponseType == "saveInSessionAndReturn" && (this.receiveTokenFn = he), (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "saveInSessionAndRedirect") && this.authorizedUrl == "")
       throw new c(u.Configuration, "If tokenResponseType is" + this.tokenResponseType + ", must provide authorizedUrl");
     if ((this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "saveInSessionAndRedirect") && this.server.sessionAdapter == null)
       throw new c(u.Configuration, "If tokenResponseType is" + this.tokenResponseType + ", must activate the session server");
@@ -1684,15 +1754,31 @@ class J extends re {
       let r = await s.sessionAdapter.getSessionData(e, this.sessionDataName);
       if (r && r.id_payload) {
         let a = r.expires_at;
-        a && a > Date.now() && r.id_payload.sub && (e.locals.user = {
-          id: r.id_payload.userid ?? r.id_payload.sub,
-          username: r.id_payload.sub,
-          state: r.id_payload.state ?? "active"
-        }, e.locals.idTokenPayload = r.id_payload, e.locals.authType = "oidc");
+        a && a > Date.now() && r.id_payload.sub && await this.setEventLocalsUser(e, r.id_payload);
       }
       this.testMiddleware && (this.testEvent = e);
     };
   }
+  /**
+   * If you implement your own function to receive tokens and you use BFF,
+   * use this function to set `event.locals.user`.
+   * @param event the Sveltekit request event
+   * @param token the ID token
+   */
+  async setEventLocalsUser(s, o) {
+    let t;
+    s.locals.idTokenPayload = o;
+    try {
+      t = await this.userCreationFn(
+        o,
+        this.userStorage,
+        this.userMatchField,
+        this.idTokenMatchField
+      ), s.locals.user = t, s.locals.authType = t ? "oidc" : void 0;
+    } catch (e) {
+      d.logger.error(f({ cerr: e })), s.locals.user = void 0, s.locals.authType = void 0;
+    }
+  }
   async passwordPost(s, o) {
     var t;
     try {
@@ -1822,7 +1908,7 @@ class J extends re {
     return e.error ? (d.logger.warn(f({
       msg: "Error completing MFA",
       user: (r = this.server.sessionAdapter) == null ? void 0 : r.getUser(s),
-      hashedMfaToken: o.mfa_token ? U.hash(o.mfa_token) : void 0
+      hashedMfaToken: o.mfa_token ? A.hash(o.mfa_token) : void 0
     })), {
       error: e.error,
       error_description: e.error_description
@@ -1834,7 +1920,8 @@ class J extends re {
         {},
         this,
         o,
-        !0
+        !0,
+        this.setEventLocalsUser
       ) : void 0;
     if (!t || r <= Date.now()) {
       if (o.locals.sessionId && this.autoRefreshActive[o.locals.sessionId]) return;
@@ -1846,7 +1933,8 @@ class J extends re {
             a,
             this,
             o,
-            s == "silent"
+            s == "silent",
+            this.setEventLocalsUser
           );
           if (s != "silent") return l;
         }
@@ -1862,7 +1950,7 @@ class J extends re {
         }
         let i = a.expires_in;
         if (!i && a.access_token) {
-          const l = z(a.access_token);
+          const l = K(a.access_token);
           l.exp && (i = l.exp);
         }
         if (!i)
@@ -1935,7 +2023,13 @@ class J extends re {
           throw new c(u.Configuration, "Unexpected error: refresh: mode is silent but didn't receive an object");
         return { ok: !0, expires_at: r == null ? void 0 : r.expires_at };
       } else if (o == "post") {
-        if (r == null) return this.receiveTokenFn({}, this, s, !1);
+        if (r == null) return this.receiveTokenFn(
+          {},
+          this,
+          s,
+          !1,
+          this.setEventLocalsUser
+        );
         if (r != null) {
           if (r instanceof Response) return r;
           throw new c(u.Configuration, "refreshTokenFn for post should return Response not object");
@@ -1978,7 +2072,13 @@ class J extends re {
         ok: !1,
         ...r
       };
-      const a = await this.receiveTokenFn(r, this, s, !1);
+      const a = await this.receiveTokenFn(
+        r,
+        this,
+        s,
+        !1,
+        this.setEventLocalsUser
+      );
       if (r && a instanceof Response) return a;
       throw new c(u.UnknownError, "Receive token function did not return a Response");
     } catch (r) {
@@ -2021,7 +2121,13 @@ class J extends re {
         }
         return r;
       }
-      const a = await this.receiveTokenFn(r, this, s, !1) ?? {};
+      const a = await this.receiveTokenFn(
+        r,
+        this,
+        s,
+        !1,
+        this.setEventLocalsUser
+      ) ?? {};
       if (a instanceof Response) throw new c(u.Configuration, "Refresh token flow should return an object not Response");
       return a;
     } catch (r) {
@@ -2179,7 +2285,7 @@ class J extends re {
     }
   }
   tokenPayload(s, o, t, e) {
-    return s in o ? t ? { ok: !0 } : e ? x(o[s]) : o[s] : t ? { ok: !1 } : void 0;
+    return s in o ? t ? { ok: !0 } : e ? O(o[s]) : o[s] : t ? { ok: !1 } : void 0;
   }
   async tokens(s, o) {
     try {
@@ -2271,7 +2377,13 @@ class J extends re {
       if (!e) throw new c(u.BadRequest, "No device code given when polling for user authorization");
       const r = this.errorIfIdTokenInvalid(await this.pollDeviceCodeFlow(e));
       if (r.access_token && !r.error)
-        return await this.receiveTokenFn(r, this, s, !1);
+        return await this.receiveTokenFn(
+          r,
+          this,
+          s,
+          !1,
+          this.setEventLocalsUser
+        );
       {
         if (r.error == "authorization_pending") return { ok: !0, ...r };
         let a = r.error ?? "server_error", i = r.error_description ?? "Didn't receive an access token";
@@ -2307,9 +2419,9 @@ class J extends re {
     } : s;
   }
 }
-class Ne {
+class Re {
 }
-class fe extends se {
+class ge extends se {
   /**
    * Constructor
    * @param tokenConsumers the token consumers, one per issuer and audience
@@ -2476,10 +2588,10 @@ class fe extends se {
       return o.expires_at && o.expires_at < Date.now() ? void 0 : await this.accessTokenAuthorized(o.session_token);
   }
 }
-function ge(k) {
+function pe(k) {
   return k.admin == !0;
 }
-const O = class O {
+const D = class D {
   /**
    * Constructor.
    * 
@@ -2527,7 +2639,7 @@ const O = class O {
     oAuthResServer: i,
     options: n
   }) {
-    this.loginUrl = "/login", this.audience = "", this.dummyLoad = async (h) => ({}), this.dummyActions = {}, this.dummyBff = async (h) => ({ status: 500, body: { error: "Unimplemented" } }), n || (n = {}), y("loginUrl", _.String, this, n, "LOGIN_URL", !1), n.isAdminFn && (O.isAdminFn = n.isAdminFn);
+    this.loginUrl = "/login", this.audience = "", this.dummyLoad = async (h) => ({}), this.dummyActions = {}, this.dummyBff = async (h) => ({ status: 500, body: { error: "Unimplemented" } }), n || (n = {}), y("loginUrl", _.String, this, n, "LOGIN_URL", !1), n.isAdminFn && (D.isAdminFn = n.isAdminFn);
     let l = {};
     if (n.authenticators && (l = n.authenticators), this.userStorage = n.userStorage, s) {
       if (!l)
@@ -2535,7 +2647,7 @@ const O = class O {
           u.Configuration,
           "If using session management, must supply authenticators"
         );
-      this.sessionServer = new L(s.keyStorage, l, { ...s.options, ...n }), this.sessionAdapter = this.sessionServer;
+      this.sessionServer = new H(s.keyStorage, l, { ...s.options, ...n }), this.sessionAdapter = this.sessionServer;
     } else o && (this.sessionAdapter = o);
     if (t) {
       if (!this.userStorage) throw new c(u.Configuration, "Must define a user storage if using API keys");
@@ -2557,7 +2669,7 @@ const O = class O {
     }
     if (r && a)
       throw new c(u.Configuration, "Cannot specify both oAuthClient and oAuthClients");
-    if (r && (this.oAuthClient = new J(
+    if (r && (this.oAuthClient = new G(
       this,
       r.authServerBaseUrl,
       { ...n, ...r.options }
@@ -2565,14 +2677,14 @@ const O = class O {
       this.oAuthClients = [];
       for (let h of a)
         this.oAuthClients.push(
-          new J(
+          new G(
             this,
             h.authServerBaseUrl,
             { ...n, ...h.options }
           )
         );
     }
-    i && (y("audience", _.String, this, n, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new fe(
+    i && (y("audience", _.String, this, n, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new ge(
       [new te(this.audience, n)],
       { sessionAdapter: this.sessionAdapter, ...i.options, ...n }
     )), this.hooks = async ({ event: h, resolve: g }) => {
@@ -2591,9 +2703,9 @@ const O = class O {
           if (this.sessionServer.isLoginApiProtected(h))
             return this.sessionServer.error(401, "Unauthorized");
         }
-        if (!(p && p.twofa) && this.sessionServer.isAdminPageEndpoint(h) && (!h.locals.user || !O.isAdminFn(h.locals.user)))
+        if (!(p && p.twofa) && this.sessionServer.isAdminPageEndpoint(h) && (!h.locals.user || !D.isAdminFn(h.locals.user)))
           return this.sessionServer.unauthorizedUrl ? new Response(null, { status: 302, headers: { location: this.sessionServer.unauthorizedUrl } }) : this.sessionServer.error(401, "Unauthorized");
-        if (!(p && p.twofa) && this.sessionServer.isAdminApiEndpoint(h) && (!h.locals.user || !O.isAdminFn(h.locals.user)))
+        if (!(p && p.twofa) && this.sessionServer.isAdminApiEndpoint(h) && (!h.locals.user || !D.isAdminFn(h.locals.user)))
           return this.sessionServer.error(401, "Unauthorized");
         if (p != null && p.response) return p.response;
       }
@@ -2625,9 +2737,9 @@ const O = class O {
     return o ? typeof s == "object" && s != null && "status" in s && "text" in s && "message" in s && s.status == o : typeof s == "object" && s != null && "status" in s && "text" in s && "message" in s;
   }
 };
-O.isAdminFn = ge;
-let w = O;
-class pe {
+D.isAdminFn = pe;
+let w = D;
+class we {
   constructor(s, o) {
     this.changePasswordUrl = "/changepassword", this.changeFactor2Url = "/changefactor2", this.loginRedirectUrl = "/", this.loginUrl = "/login", this.signupEndpoint = {
       load: async (t) => {
@@ -3839,7 +3951,7 @@ class pe {
     };
   }
 }
-async function we(k, s, o = 0, t = 10) {
+async function me(k, s, o = 0, t = 10) {
   let e = [];
   if (o > 0) return [];
   try {
@@ -3860,9 +3972,9 @@ async function we(k, s, o = 0, t = 10) {
   }
   return e;
 }
-class me {
+class ke {
   constructor(s, o) {
-    this.userSearchFn = we, this.searchUsersEndpoint = {
+    this.userSearchFn = me, this.searchUsersEndpoint = {
       load: async (t) => {
         (!t.locals.user || !w.isAdminFn(t.locals.user)) && this.sessionServer.error(t, 401);
         const e = await this.searchUsers(t);
@@ -4367,7 +4479,7 @@ class me {
     }
   }
 }
-async function ke(k, s, o, t, e) {
+async function Se(k, s, o, t, e) {
   let r = [];
   if (o > 0) return [];
   try {
@@ -4395,7 +4507,7 @@ class $ {
    * @param options See {@link SvelteKitSessionServerOptions}
    */
   constructor(s, o) {
-    this.loginUrl = "/login", this.clientSearchFn = ke, this.validFlows = ["all"], this.sessionServer = s, y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect ?? G, this.error = o.error ?? Q, y("validFlows", _.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == E.All && (this.validFlows = E.allFlows()), this.valid_flowNames = E.flowNames(this.validFlows), o.clientStorage && (this.clientManager = new B(o)), this.clientStorage = o.clientStorage;
+    this.loginUrl = "/login", this.clientSearchFn = Se, this.validFlows = ["all"], this.sessionServer = s, y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect ?? Q, this.error = o.error ?? Y, y("validFlows", _.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == E.All && (this.validFlows = E.allFlows()), this.valid_flowNames = E.flowNames(this.validFlows), o.clientStorage && (this.clientManager = new x(o)), this.clientStorage = o.clientStorage;
   }
   ///////////////////////////////////////////////////////////////////
   // Functions callable from apps
@@ -4565,7 +4677,7 @@ class $ {
       let l = [];
       for (let C of n)
         try {
-          B.validateUri(C);
+          x.validateUri(C);
         } catch (T) {
           d.logger.error(f({ err: T })), l.push("[" + C + "]");
         }
@@ -4697,7 +4809,7 @@ class $ {
       let g = [];
       for (let C of h)
         try {
-          B.validateUri(C);
+          x.validateUri(C);
         } catch (T) {
           d.logger.error(f({ err: T })), g.push("[" + C + "]");
         }
@@ -4813,7 +4925,7 @@ class $ {
     };
   }
 }
-class Se extends $ {
+class Ce extends $ {
   /**
    * Constructor
    * @param sessionServer the session server which will have these endpoints
@@ -4989,7 +5101,7 @@ class Se extends $ {
     return this.createClient_internal(s, !1);
   }
 }
-class Ce extends $ {
+class ye extends $ {
   /**
    * Constructor
    * @param sessionServer the session server which will have these endpoints
@@ -5104,12 +5216,12 @@ class Ce extends $ {
     return this.deleteClient_internal(s, !0);
   }
 }
-const q = "X-CROSSAUTH-CSRF";
-function ye(k) {
+const B = "X-CROSSAUTH-CSRF";
+function _e(k) {
   let s = [];
   return k.username == null ? s.push("Username must be given") : k.username.length < 2 ? s.push("Username must be at least 2 characters") : k.username.length > 254 && s.push("Username must be no longer than 254 characters"), s;
 }
-function _e(k, s, o) {
+function Ee(k, s, o) {
   var a;
   let e = {
     username: s.username ?? "",
@@ -5133,7 +5245,7 @@ function _e(k, s, o) {
   }
   return e.factor1 = "localpassword", e.factor2 = s.factor2, e;
 }
-function Ee(k, s, o, t) {
+function ve(k, s, o, t) {
   var r;
   const e = s.locals.user && w.isAdminFn(s.locals.user);
   for (let a in o) {
@@ -5153,7 +5265,7 @@ function Ee(k, s, o, t) {
   }
   return k;
 }
-class L {
+class H {
   /**
    * Constructor
    * @param keyStorage where session IDs, email verification and reset tokens are stored
@@ -5162,7 +5274,7 @@ class L {
    * @param options See {@link SvelteKitSessionServerOptions}.
    */
   constructor(s, o, t = {}) {
-    this.validateUserFn = ye, this.createUserFn = _e, this.updateUserFn = Ee, this.allowedFactor2 = [], this.allowedFactor2Names = [], this.factor2ProtectedPageEndpoints = [], this.factor2ProtectedApiEndpoints = [], this.loginProtectedPageEndpoints = [], this.loginProtectedApiEndpoints = [], this.loginProtectedExceptionPageEndpoints = [], this.loginProtectedExceptionApiEndpoints = [], this.adminPageEndpoints = [], this.adminApiEndpoints = [], this.unauthorizedUrl = void 0, this.enableCsrfProtection = !0, this.enableEmailVerification = !1, this.enablePasswordReset = !1, this.factor2Url = "/factor2", this.loginUrl = "/login", this.keyStorage = s, this.userStorage = t.userStorage, this.clientStorage = t.clientStorage, this.authenticators = o, this.sessionManager = new ie(s, o, t), this.redirect = t.redirect ?? G, this.error = t.error ?? Q, y("factor2Url", _.String, this, t, "FACTOR2_URL"), this.factor2Url.endsWith("/") || (this.factor2Url += "/"), y("factor2ProtectedPageEndpoints", _.JsonArray, this, t, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), y("factor2ProtectedApiEndpoints", _.JsonArray, this, t, "FACTOR2_PROTECTED_API_ENDPOINTS"), y("loginProtectedPageEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_PAGE_ENDPOINTS"), y("loginProtectedApiEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_API_ENDPOINTS"), y("loginProtectedExceptionPageEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("loginProtectedExceptionApiEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("adminPageEndpoints", _.JsonArray, this, t, "ADMIN_PAGE_ENDPOINTS"), y("adminApiEndpoints", _.JsonArray, this, t, "ADMIN_API_ENDPOINTS"), y("loginUrl", _.JsonArray, this, t, "LOGIN_URL"), y("unauthorizedUrl", _.JsonArray, this, t, "UNAUTHORIZED_PAGE");
+    this.validateUserFn = _e, this.createUserFn = Ee, this.updateUserFn = ve, this.allowedFactor2 = [], this.allowedFactor2Names = [], this.factor2ProtectedPageEndpoints = [], this.factor2ProtectedApiEndpoints = [], this.loginProtectedPageEndpoints = [], this.loginProtectedApiEndpoints = [], this.loginProtectedExceptionPageEndpoints = [], this.loginProtectedExceptionApiEndpoints = [], this.adminPageEndpoints = [], this.adminApiEndpoints = [], this.unauthorizedUrl = void 0, this.enableCsrfProtection = !0, this.enableEmailVerification = !1, this.enablePasswordReset = !1, this.factor2Url = "/factor2", this.loginUrl = "/login", this.keyStorage = s, this.userStorage = t.userStorage, this.clientStorage = t.clientStorage, this.authenticators = o, this.sessionManager = new ie(s, o, t), this.redirect = t.redirect ?? Q, this.error = t.error ?? Y, y("factor2Url", _.String, this, t, "FACTOR2_URL"), this.factor2Url.endsWith("/") || (this.factor2Url += "/"), y("factor2ProtectedPageEndpoints", _.JsonArray, this, t, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), y("factor2ProtectedApiEndpoints", _.JsonArray, this, t, "FACTOR2_PROTECTED_API_ENDPOINTS"), y("loginProtectedPageEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_PAGE_ENDPOINTS"), y("loginProtectedApiEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_API_ENDPOINTS"), y("loginProtectedExceptionPageEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("loginProtectedExceptionApiEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("adminPageEndpoints", _.JsonArray, this, t, "ADMIN_PAGE_ENDPOINTS"), y("adminApiEndpoints", _.JsonArray, this, t, "ADMIN_API_ENDPOINTS"), y("loginUrl", _.JsonArray, this, t, "LOGIN_URL"), y("unauthorizedUrl", _.JsonArray, this, t, "UNAUTHORIZED_PAGE");
     let e = {};
     if (y("allowedFactor2", _.JsonArray, e, t, "ALLOWED_FACTOR2"), this.allowedFactor2Names = t.allowedFactor2 ?? ["none"], e.allowedFactor2)
       for (let r of e.allowedFactor2)
@@ -5175,7 +5287,7 @@ class L {
           friendlyName: "None",
           configurable: !1
         });
-    y("enableEmailVerification", _.Boolean, this, t, "ENABLE_EMAIL_VERIFICATION"), y("enablePasswordReset", _.Boolean, this, t, "ENABLE_PASSWORD_RESET"), y("enableCsrfProtection", _.Boolean, this, t, "ENABLE_CSRF_PROTECTION"), y("editUserScope", _.String, this, t, "EDIT_USER_SCOPE"), t.validateUserFn && (this.validateUserFn = t.validateUserFn), t.createUserFn && (this.createUserFn = t.createUserFn), t.updateUserFn && (this.updateUserFn = t.updateUserFn), t.addToSession && (this.addToSession = t.addToSession), t.validateSession && (this.validateSession = t.validateSession), this.userEndpoints = new pe(this, t), this.adminEndpoints = new me(this, t), this.userClientEndpoints = new Se(this, t), this.adminClientEndpoints = new Ce(this, t), this.sessionHook = async ({ event: r }) => {
+    y("enableEmailVerification", _.Boolean, this, t, "ENABLE_EMAIL_VERIFICATION"), y("enablePasswordReset", _.Boolean, this, t, "ENABLE_PASSWORD_RESET"), y("enableCsrfProtection", _.Boolean, this, t, "ENABLE_CSRF_PROTECTION"), y("editUserScope", _.String, this, t, "EDIT_USER_SCOPE"), t.validateUserFn && (this.validateUserFn = t.validateUserFn), t.createUserFn && (this.createUserFn = t.createUserFn), t.updateUserFn && (this.updateUserFn = t.updateUserFn), t.addToSession && (this.addToSession = t.addToSession), t.validateSession && (this.validateSession = t.validateSession), this.userEndpoints = new we(this, t), this.adminEndpoints = new ke(this, t), this.userClientEndpoints = new Ce(this, t), this.adminClientEndpoints = new ye(this, t), this.sessionHook = async ({ event: r }) => {
       var h, g;
       d.logger.debug("Session hook");
       let a = [];
@@ -5205,7 +5317,7 @@ class L {
               const { csrfCookie: p, csrfFormOrHeaderValue: S } = await this.sessionManager.createCsrfToken();
               this.setCsrfCookie(p, r), r.locals.csrfToken = S;
             }
-            this.setHeader(q, r.locals.csrfToken, a);
+            this.setHeader(B, r.locals.csrfToken, a);
           } catch (p) {
             d.logger.error(f({ msg: "Couldn't create CSRF token", cerr: p, user: (h = r.locals.user) == null ? void 0 : h.username, hashedSessionCookie: this.getHashOfSessionCookie(r) })), d.logger.debug(f({ err: p })), this.clearCookie(i, this.sessionManager.csrfCookiePath, r), r.locals.csrfToken = void 0;
           }
@@ -5264,25 +5376,25 @@ class L {
             let C = {};
             const T = new b();
             await T.loadData(r);
-            for (let F of T.keys())
-              S.includes(F) && (C[F] = T.get(F) ?? "");
+            for (let U of T.keys())
+              S.includes(U) && (C[U] = T.get(U) ?? "");
             const N = this.getSessionCookieValue(r);
             if (!N) throw new c(u.Unauthorized, "No session cookie found");
-            let A;
+            let F;
             try {
               await this.sessionManager.completeTwoFactorPageVisit(C, r.locals.sessionId ?? "");
-            } catch (F) {
-              A = c.asCrossauthError(F), d.logger.debug(f({ err: F }));
-              const D = c.asCrossauthError(F);
-              d.logger.error(f({ msg: A.message, cerr: F, user: T.get("username"), errorCode: D.code, errorCodeName: D.codeName }));
+            } catch (U) {
+              F = c.asCrossauthError(U), d.logger.debug(f({ err: U }));
+              const z = c.asCrossauthError(U);
+              d.logger.error(f({ msg: F.message, cerr: U, user: T.get("username"), errorCode: z.code, errorCodeName: z.codeName }));
             }
-            if (A)
-              if (A.code == u.Expired) {
+            if (F)
+              if (F.code == u.Expired) {
                 d.logger.debug(f({ msg: "Error - cancelling 2FA" }));
                 try {
                   await this.sessionManager.cancelTwoFactorPageVisit(N);
-                } catch (F) {
-                  d.logger.error(f({ msg: "Failed cancelling 2FA", cerr: F, user: l.username, hashedSessionCookie: this.getHashOfSessionCookie(r) })), d.logger.debug(f({ err: F }));
+                } catch (U) {
+                  d.logger.error(f({ msg: "Failed cancelling 2FA", cerr: U, user: l.username, hashedSessionCookie: this.getHashOfSessionCookie(r) })), d.logger.debug(f({ err: U }));
                 }
                 return this.error(401, { message: "Sorry, your code has expired" }), { ok: !1, twofa: !0 };
               } else
@@ -5291,25 +5403,25 @@ class L {
                   ok: !1,
                   response: new Response("", {
                     status: 302,
-                    statusText: M(302),
-                    headers: { Location: this.factor2Url + "?error=" + u[A.code] }
+                    statusText: q(302),
+                    headers: { Location: this.factor2Url + "?error=" + u[F.code] }
                   })
                 } : {
                   twofa: !0,
                   ok: !1,
                   response: new Response(JSON.stringify({
                     ok: !1,
-                    errorMessage: A.message,
-                    errorMessages: A.messages,
-                    errorCode: A.code,
-                    errorCodeName: u[A.code]
+                    errorMessage: F.message,
+                    errorMessages: F.messages,
+                    errorCode: F.code,
+                    errorCodeName: u[F.code]
                   }), {
-                    status: A.httpStatus,
-                    statusText: M(A.httpStatus),
+                    status: F.httpStatus,
+                    statusText: q(F.httpStatus),
                     headers: { "content-tyoe": "application/json" }
                   })
                 };
-            return L.updateRequest(r, m.pre2fa.body, m.pre2fa["content-type"]), { twofa: !0, ok: !0 };
+            return H.updateRequest(r, m.pre2fa.body, m.pre2fa["content-type"]), { twofa: !0, ok: !0 };
           } else {
             if (d.logger.debug(f({ msg: "Starting 2FA", username: l.username })), this.enableCsrfProtection && !r.locals.csrfToken) {
               const C = new c(u.Forbidden, "CSRF token missing");
@@ -5324,7 +5436,7 @@ class L {
                   errorCodeName: u[C.code]
                 }), {
                   status: C.httpStatus,
-                  statusText: M(C.httpStatus),
+                  statusText: q(C.httpStatus),
                   headers: {
                     "content-tyoe": "application/json"
                   }
@@ -5339,7 +5451,7 @@ class L {
               ok: !0,
               response: new Response("", {
                 status: 302,
-                statusText: M(302),
+                statusText: q(302),
                 headers: { Location: this.factor2Url }
               })
             } : {
@@ -5423,7 +5535,7 @@ class L {
     const o = this.getSessionCookieValue(s);
     if (!o) return "";
     try {
-      return U.hash(o);
+      return A.hash(o);
     } catch {
     }
     return "";
@@ -5440,7 +5552,7 @@ class L {
     const o = this.getCsrfCookieValue(s);
     if (!o) return "";
     try {
-      return U.hash(o);
+      return A.hash(o);
     } catch {
     }
     return "";
@@ -5459,8 +5571,8 @@ class L {
   async csrfToken(s, o) {
     var e, r, a;
     let t;
-    if (s.request.headers && s.request.headers.has(q.toLowerCase())) {
-      const i = s.request.headers.get(q.toLowerCase());
+    if (s.request.headers && s.request.headers.has(B.toLowerCase())) {
+      const i = s.request.headers.get(B.toLowerCase());
       Array.isArray(i) ? t = i[0] : i && (t = i);
     }
     if (!t) {
@@ -5478,7 +5590,7 @@ class L {
     }
     if (t)
       try {
-        this.sessionManager.validateDoubleSubmitCsrfToken(this.getCsrfCookieValue(s), t), s.locals.csrfToken = t, this.setHeader(q, t, o);
+        this.sessionManager.validateDoubleSubmitCsrfToken(this.getCsrfCookieValue(s), t), s.locals.csrfToken = t, this.setHeader(B, t, o);
       } catch {
         d.logger.warn(f({ msg: "Invalid CSRF token", hashedCsrfCookie: this.getHashOfCsrfCookie(s) })), this.clearCookie(this.sessionManager.csrfCookieName, this.sessionManager.csrfCookiePath, s), s.locals.csrfToken = void 0;
       }
@@ -5523,7 +5635,7 @@ class L {
   getHashOfSessionId(s) {
     if (!s.locals.sessionId) return "";
     try {
-      return U.hash(s.locals.sessionId);
+      return A.hash(s.locals.sessionId);
     } catch {
     }
     return "";
@@ -5771,17 +5883,17 @@ class L {
 }
 export {
   b as JsonOrFormData,
-  Ce as SvelteKitAdminClientEndpoints,
-  me as SvelteKitAdminEndpoints,
+  ye as SvelteKitAdminClientEndpoints,
+  ke as SvelteKitAdminEndpoints,
   ne as SvelteKitApiKeyServer,
   ce as SvelteKitAuthorizationServer,
-  J as SvelteKitOAuthClient,
-  fe as SvelteKitOAuthResourceServer,
+  G as SvelteKitOAuthClient,
+  ge as SvelteKitOAuthResourceServer,
   w as SvelteKitServer,
-  Ne as SvelteKitSessionAdapter,
-  L as SvelteKitSessionServer,
+  Re as SvelteKitSessionAdapter,
+  H as SvelteKitSessionServer,
   $ as SvelteKitSharedClientEndpoints,
-  Se as SvelteKitUserClientEndpoints,
-  pe as SvelteKitUserEndpoints,
-  ke as defaultClientSearchFn
+  Ce as SvelteKitUserClientEndpoints,
+  we as SvelteKitUserEndpoints,
+  Se as defaultClientSearchFn
 };