@crossauth/sveltekit 0.0.36 → 0.0.37

package/dist/index.js

@@ -1,6 +1,6 @@
 import { minimatch as I } from "minimatch";
-import { ApiKeyManager as K, KeyStorage as $, toCookieSerializeOptions as R, Crypto as F, OAuthAuthorizationServer as Z, setParameter as y, ParamType as E, DoubleSubmitCsrfToken as ee, OAuthClientManager as B, OAuthClientBackend as re, OAuthResourceServer as se, OAuthTokenConsumer as te, TokenEmailer as oe, SessionManager as ie } from "@crossauth/backend";
-import { CrossauthError as n, ErrorCode as u, CrossauthLogger as l, j as f, OAuthFlows as _, UserState as N, httpStatus as q } from "@crossauth/common";
+import { ApiKeyManager as K, KeyStorage as $, toCookieSerializeOptions as R, Crypto as F, OAuthAuthorizationServer as Z, setParameter as y, ParamType as _, DoubleSubmitCsrfToken as ee, OAuthClientManager as B, OAuthClientBackend as re, OAuthResourceServer as se, OAuthTokenConsumer as te, TokenEmailer as oe, SessionManager as ie } from "@crossauth/backend";
+import { CrossauthError as n, ErrorCode as u, CrossauthLogger as l, j as f, OAuthFlows as E, UserState as N, httpStatus as q } from "@crossauth/common";
 import { json as v, redirect as Q, error as Y } from "@sveltejs/kit";
 import "cookie";
 import { jwtDecode as M } from "jwt-decode";
@@ -189,7 +189,7 @@ class ce {
     }, this.authorizeEndpoint = {
       load: async (i) => {
         var w, S;
-        if (!(this.authServer.validFlows.includes(_.AuthorizationCode) || this.authServer.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(_.OidcAuthorizationCode)))
+        if (!(this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode)))
           throw this.error(401, "authorize cannot be called because the authorization code flows are not supported");
         if (!i.locals.user) return this.redirect(
           302,
@@ -329,7 +329,7 @@ class ce {
       post: async (i) => {
         let c;
         try {
-          if (!(this.authServer.validFlows.includes(_.AuthorizationCode) || this.authServer.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(_.OidcAuthorizationCode) || this.authServer.validFlows.includes(_.ClientCredentials) || this.authServer.validFlows.includes(_.RefreshToken) || this.authServer.validFlows.includes(_.Password) || this.authServer.validFlows.includes(_.PasswordMfa || this.authServer.validFlows.includes(_.DeviceCode))))
+          if (!(this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode) || this.authServer.validFlows.includes(E.ClientCredentials) || this.authServer.validFlows.includes(E.RefreshToken) || this.authServer.validFlows.includes(E.Password) || this.authServer.validFlows.includes(E.PasswordMfa || this.authServer.validFlows.includes(E.DeviceCode))))
             return v({
               ok: !1,
               error: "invalid_request",
@@ -439,7 +439,7 @@ class ce {
       post: async (i) => {
         let c;
         try {
-          if (!this.authServer.validFlows.includes(_.DeviceCode))
+          if (!this.authServer.validFlows.includes(E.DeviceCode))
             return v({
               ok: !1,
               error: "invalid_request",
@@ -475,7 +475,7 @@ class ce {
       }
     }, this.deviceEndpoint = {
       load: async (i) => {
-        if (!this.authServer.validFlows.includes(_.DeviceCode))
+        if (!this.authServer.validFlows.includes(E.DeviceCode))
           throw this.error(401, "device cannot be called because the device code flow is not supported");
         if (!i.locals.user) return this.redirect(
           302,
@@ -563,7 +563,7 @@ class ce {
       s,
       e,
       t
-    ), y("loginUrl", E.String, this, t, "LOGIN_URL"), y("refreshTokenType", E.String, this, t, "OAUTH_REFRESH_TOKEN_TYPE"), y("refreshTokenCookieName", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), y("refreshTokenCookieDomain", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), y("refreshTokenCookieHttpOnly", E.Boolean, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), y("refreshTokenCookiePath", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), y("refreshTokenCookieSecure", E.Boolean, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), y("refreshTokenCookieSameSite", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), y("authorizeEndpointUrl", E.String, this, t, "OAUTH_AUTHORIZE_ENDPOINT"), y("tokenEndpointUrl", E.String, this, t, "OAUTH_TOKEN_ENDPOINT"), y("jwksEndpointUrl", E.String, this, t, "OAUTH_JWKS_ENDPOINT"), this.refreshTokenType != "json" && (((a = this.svelteKitServer.sessionServer) == null ? void 0 : a.enableCsrfProtection) == !0 ? this.csrfTokens = this.svelteKitServer.sessionServer.sessionManager.csrfTokens : this.csrfTokens = new ee(t.doubleSubmitCookieOptions));
+    ), y("loginUrl", _.String, this, t, "LOGIN_URL"), y("refreshTokenType", _.String, this, t, "OAUTH_REFRESH_TOKEN_TYPE"), y("refreshTokenCookieName", _.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), y("refreshTokenCookieDomain", _.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), y("refreshTokenCookieHttpOnly", _.Boolean, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), y("refreshTokenCookiePath", _.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), y("refreshTokenCookieSecure", _.Boolean, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), y("refreshTokenCookieSameSite", _.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), y("authorizeEndpointUrl", _.String, this, t, "OAUTH_AUTHORIZE_ENDPOINT"), y("tokenEndpointUrl", _.String, this, t, "OAUTH_TOKEN_ENDPOINT"), y("jwksEndpointUrl", _.String, this, t, "OAUTH_JWKS_ENDPOINT"), this.refreshTokenType != "json" && (((a = this.svelteKitServer.sessionServer) == null ? void 0 : a.enableCsrfProtection) == !0 ? this.csrfTokens = this.svelteKitServer.sessionServer.sessionManager.csrfTokens : this.csrfTokens = new ee(t.doubleSubmitCookieOptions));
   }
   /**
    * Returns this server's OIDC configuration.  Just wraps
@@ -1048,14 +1048,14 @@ class G extends re {
    * @param options See {@link SvelteKitOAuthClientOptions}
    */
   constructor(r, o, s) {
-    if (super(o, s), this.sessionDataName = "oauth", this.receiveTokenFn = J, this.errorFn = W, this.loginUrl = "/login", this.validFlows = [_.All], this.authorizedUrl = "", this.autoRefreshActive = {}, this.loginProtectedFlows = [], this.tokenResponseType = "sendJson", this.errorResponseType = "sendJson", this.bffEndpoints = [], this.bffEndpointName = "bff", this.tokenEndpoints = [], this.bffMaxTries = 1, this.bffSleepMilliseconds = 500, this.jwtTokens = ["access", "id", "refresh"], this.testMiddleware = !1, this.testEvent = void 0, this.authorizationCodeFlowEndpoint = {
+    if (super(o, s), this.sessionDataName = "oauth", this.receiveTokenFn = J, this.errorFn = W, this.loginUrl = "/login", this.validFlows = [E.All], this.authorizedUrl = "", this.autoRefreshActive = {}, this.loginProtectedFlows = [], this.tokenResponseType = "sendJson", this.errorResponseType = "sendJson", this.bffEndpoints = [], this.bffEndpointName = "bff", this.tokenEndpoints = [], this.bffMaxTries = 1, this.bffSleepMilliseconds = 500, this.jwtTokens = ["access", "id", "refresh"], this.testMiddleware = !1, this.testEvent = void 0, this.authorizationCodeFlowEndpoint = {
       get: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
           const t = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
           return this.errorFn(this.server, e, t);
         }
         try {
-          if (!this.validFlows.includes(_.AuthorizationCode)) {
+          if (!this.validFlows.includes(E.AuthorizationCode)) {
             const g = new n(u.Unauthorized, "Authorization flow is not supported");
             return this.errorFn(this.server, e, g);
           }
@@ -1095,7 +1095,7 @@ class G extends re {
           };
         }
         try {
-          if (!this.validFlows.includes(_.AuthorizationCode)) {
+          if (!this.validFlows.includes(E.AuthorizationCode)) {
             const g = new n(u.Unauthorized, "Authorization flow is not supported");
             return {
               ok: !1,
@@ -1141,7 +1141,7 @@ class G extends re {
           return this.errorFn(this.server, e, t);
         }
         try {
-          if (!this.validFlows.includes(_.AuthorizationCodeWithPKCE)) {
+          if (!this.validFlows.includes(E.AuthorizationCodeWithPKCE)) {
             const w = new n(u.Unauthorized, "Authorization flow is not supported");
             return this.errorFn(this.server, e, w);
           }
@@ -1184,7 +1184,7 @@ class G extends re {
           };
         }
         try {
-          if (!this.validFlows.includes(_.AuthorizationCodeWithPKCE)) {
+          if (!this.validFlows.includes(E.AuthorizationCodeWithPKCE)) {
             const w = new n(u.Unauthorized, "Authorization flow is not supported");
             return {
               ok: !1,
@@ -1231,7 +1231,7 @@ class G extends re {
           return this.errorFn(this.server, e, a);
         }
         try {
-          if (!(this.validFlows.includes(_.AuthorizationCode) || this.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.validFlows.includes(_.OidcAuthorizationCode))) {
+          if (!(this.validFlows.includes(E.AuthorizationCode) || this.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.validFlows.includes(E.OidcAuthorizationCode))) {
             const p = new n(u.Unauthorized, "Authorization flows are not supported");
             return this.errorFn(this.server, e, p);
           }
@@ -1285,7 +1285,7 @@ class G extends re {
           };
         }
         try {
-          if (!(this.validFlows.includes(_.AuthorizationCode) || this.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.validFlows.includes(_.OidcAuthorizationCode))) {
+          if (!(this.validFlows.includes(E.AuthorizationCode) || this.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.validFlows.includes(E.OidcAuthorizationCode))) {
             const w = new n(u.Unauthorized, "Authorization flows are not supported");
             return {
               ok: !1,
@@ -1359,7 +1359,7 @@ class G extends re {
         }
         let t;
         try {
-          if (!this.validFlows.includes(_.ClientCredentials)) {
+          if (!this.validFlows.includes(E.ClientCredentials)) {
             const d = new n(u.Unauthorized, "Client credentials flow is not supported");
             return this.errorFn(this.server, e, d);
           }
@@ -1400,7 +1400,7 @@ class G extends re {
             throw new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
           let t;
           try {
-            if (!this.validFlows.includes(_.ClientCredentials))
+            if (!this.validFlows.includes(E.ClientCredentials))
               throw new n(u.Unauthorized, "Client credentials flow is not supported");
             var a = new b();
             await a.loadData(e), t = a.toObject();
@@ -1436,7 +1436,7 @@ class G extends re {
         }
         let t;
         try {
-          if (!this.validFlows.includes(_.RefreshToken)) {
+          if (!this.validFlows.includes(E.RefreshToken)) {
             const h = new n(u.Unauthorized, "Refresh token flow is not supported");
             return this.errorFn(this.server, e, h);
           }
@@ -1493,7 +1493,7 @@ class G extends re {
             throw new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
           let t;
           try {
-            if (!this.validFlows.includes(_.RefreshToken)) {
+            if (!this.validFlows.includes(E.RefreshToken)) {
               const h = new n(u.Unauthorized, "Refresh token flow is not supported");
               return this.errorFn(this.server, e, h);
             }
@@ -1720,9 +1720,9 @@ class G extends re {
       actions: {
         default: async (e) => await this.tokens(e, this.tokenEndpoints)
       }
-    }, this.server = r, y("sessionDataName", E.String, this, s, "OAUTH_SESSION_DATA_NAME"), y("tokenResponseType", E.String, this, s, "OAUTH_TOKEN_RESPONSE_TYPE"), y("errorResponseType", E.String, this, s, "OAUTH_ERROR_RESPONSE_TYPE"), y("loginUrl", E.String, this, s, "LOGIN_URL"), y("bffEndpointName", E.String, this, s, "OAUTH_BFF_ENDPOINT_NAME"), y("bffBaseUrl", E.String, this, s, "OAUTH_BFF_BASEURL"), y("redirect_uri", E.String, this, s, "OAUTH_REDIRECTURI", !0), y("authorizedUrl", E.String, this, s, "AUTHORIZED_URL", !1), y("validFlows", E.JsonArray, this, s, "OAUTH_validFlows"), y("bffMaxTries", E.Number, this, s, "OAUTH_BFF_MAX_RETRIES"), y("bffSleepMilliseconds", E.Number, this, s, "OAUTH_BFF_SLEEP_MILLISECONDS"), y("jwtTokens", E.JsonArray, this, s, "OAUTH_JWT_TOKENS"), this.bffEndpointName && !this.bffEndpointName.startsWith("/") && (this.bffEndpointName = "/" + this.bffEndpointName), this.bffEndpointName && this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), this.bffBaseUrl && this.bffBaseUrl.endsWith("/") && (this.bffBaseUrl = this.bffBaseUrl.substring(0, this.bffBaseUrl.length - 1)), s.redirect && (this.redirect = s.redirect), s.error && (this.error = s.error), this.validFlows.length == 1 && this.validFlows[0] == _.All)
-      this.validFlows = _.allFlows();
-    else if (!_.areAllValidFlows(this.validFlows))
+    }, this.server = r, y("sessionDataName", _.String, this, s, "OAUTH_SESSION_DATA_NAME"), y("tokenResponseType", _.String, this, s, "OAUTH_TOKEN_RESPONSE_TYPE"), y("errorResponseType", _.String, this, s, "OAUTH_ERROR_RESPONSE_TYPE"), y("loginUrl", _.String, this, s, "LOGIN_URL"), y("bffEndpointName", _.String, this, s, "OAUTH_BFF_ENDPOINT_NAME"), y("bffBaseUrl", _.String, this, s, "OAUTH_BFF_BASEURL"), y("redirect_uri", _.String, this, s, "OAUTH_REDIRECTURI", !0), y("authorizedUrl", _.String, this, s, "AUTHORIZED_URL", !1), y("validFlows", _.JsonArray, this, s, "OAUTH_validFlows"), y("bffMaxTries", _.Number, this, s, "OAUTH_BFF_MAX_RETRIES"), y("bffSleepMilliseconds", _.Number, this, s, "OAUTH_BFF_SLEEP_MILLISECONDS"), y("jwtTokens", _.JsonArray, this, s, "OAUTH_JWT_TOKENS"), this.bffEndpointName && !this.bffEndpointName.startsWith("/") && (this.bffEndpointName = "/" + this.bffEndpointName), this.bffEndpointName && this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), this.bffBaseUrl && this.bffBaseUrl.endsWith("/") && (this.bffBaseUrl = this.bffBaseUrl.substring(0, this.bffBaseUrl.length - 1)), s.redirect && (this.redirect = s.redirect), s.error && (this.error = s.error), this.validFlows.length == 1 && this.validFlows[0] == E.All)
+      this.validFlows = E.allFlows();
+    else if (!E.areAllValidFlows(this.validFlows))
       throw new n(u.Configuration, "Invalid flows specificied in " + this.validFlows.join(","));
     try {
       new URL(this.redirect_uri ?? "");
@@ -1732,9 +1732,9 @@ class G extends re {
     if (s.tokenEndpoints && (this.tokenEndpoints = s.tokenEndpoints), this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), s.bffEndpoints && (this.bffEndpoints = s.bffEndpoints.map((e) => ({ ...e, methodsString: e.methods.map((t) => t) }))), this.bffEndpoints)
       for (let e of this.bffEndpoints)
         e.url.startsWith("/") || (e.url = "/" + e.url);
-    if (this.loginProtectedFlows.length == 1 && this.loginProtectedFlows[0] == _.All)
+    if (this.loginProtectedFlows.length == 1 && this.loginProtectedFlows[0] == E.All)
       this.loginProtectedFlows = this.validFlows;
-    else if (!_.areAllValidFlows(this.loginProtectedFlows))
+    else if (!E.areAllValidFlows(this.loginProtectedFlows))
       throw new n(
         u.Configuration,
         "Invalid flows specificied in " + this.loginProtectedFlows.join(",")
@@ -1798,7 +1798,7 @@ class G extends re {
         o.password,
         o.scope
       );
-      if (e.error == "mfa_required" && e.mfa_token && this.validFlows.includes(_.PasswordMfa)) {
+      if (e.error == "mfa_required" && e.mfa_token && this.validFlows.includes(E.PasswordMfa)) {
         const t = e.mfa_token;
         let a = o.scope;
         if (a == "" && (a = void 0), e = this.errorIfIdTokenInvalid(await this.passwordMfa(
@@ -2063,7 +2063,7 @@ class G extends re {
     }
     let s;
     try {
-      if (!(this.validFlows.includes(_.Password) || this.validFlows.includes(_.PasswordMfa))) {
+      if (!(this.validFlows.includes(E.Password) || this.validFlows.includes(E.PasswordMfa))) {
         const i = new n(u.Unauthorized, "Password flow is not supported");
         return this.errorFn(this.server, r, i);
       }
@@ -2106,7 +2106,7 @@ class G extends re {
       throw new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
     let s;
     try {
-      if (!(this.validFlows.includes(_.Password) || this.validFlows.includes(_.PasswordMfa))) {
+      if (!(this.validFlows.includes(E.Password) || this.validFlows.includes(E.PasswordMfa))) {
         const i = new n(u.Unauthorized, "Password and Password MFA flows are not supported");
         return this.errorFn(this.server, r, i);
       }
@@ -2126,7 +2126,7 @@ class G extends re {
           ...t
         };
       if (t.challenge_type) {
-        if (!this.validFlows.includes(_.PasswordMfa)) {
+        if (!this.validFlows.includes(E.PasswordMfa)) {
           const i = new n(u.Unauthorized, "Password MFA flow is not supported");
           return this.errorFn(this.server, r, i);
         }
@@ -2341,7 +2341,7 @@ class G extends re {
   async startDeviceCodeFlow_internal(r) {
     let o;
     try {
-      if (!this.validFlows.includes(_.DeviceCode))
+      if (!this.validFlows.includes(E.DeviceCode))
         throw new n(u.Unauthorized, "Device code flow is not supported");
       var s = new b();
       if (await s.loadData(r), o = s.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
@@ -2374,7 +2374,7 @@ class G extends re {
   async pollDeviceCodeFlow_internal(r) {
     let o;
     try {
-      if (!this.validFlows.includes(_.DeviceCode))
+      if (!this.validFlows.includes(E.DeviceCode))
         throw new n(u.Unauthorized, "Device code flow is not supported");
       var s = new b();
       if (await s.loadData(r), o = s.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
@@ -2455,7 +2455,7 @@ class ge extends se {
    * @param options See {@link SvelteKitOAuthResourceServerOptions}
    */
   constructor(r, o = {}) {
-    if (super(r, o), this.errorBody = {}, this.protectedEndpoints = {}, this.protectedEndpointPrefixes = [], this.sessionDataName = "oauth", this.tokenLocations = ["header"], y("errorBody", E.Json, this, o, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), y("tokenLocations", E.JsonArray, this, o, "OAUTH_TOKEN_LOCATIONS"), y("sessionDataName", E.String, this, o, "OAUTH_SESSION_DATA_NAME"), this.userStorage = o.userStorage, this.sessionAdapter = o.sessionAdapter, o.protectedEndpoints) {
+    if (super(r, o), this.errorBody = {}, this.protectedEndpoints = {}, this.protectedEndpointPrefixes = [], this.sessionDataName = "oauth", this.tokenLocations = ["header"], y("errorBody", _.Json, this, o, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), y("tokenLocations", _.JsonArray, this, o, "OAUTH_TOKEN_LOCATIONS"), y("sessionDataName", _.String, this, o, "OAUTH_SESSION_DATA_NAME"), this.userStorage = o.userStorage, this.sessionAdapter = o.sessionAdapter, o.protectedEndpoints) {
       const s = /^[!#\$%&'\(\)\*\+,\.\/a-zA-Z\[\]\^_`-]+/;
       for (const [e, t] of Object.entries(o.protectedEndpoints)) {
         if (!e.startsWith("/"))
@@ -2676,7 +2676,7 @@ const D = class D {
     oAuthResServer: i,
     options: c
   }) {
-    this.loginUrl = "/login", this.audience = "", this.dummyLoad = async (h) => ({}), this.dummyActions = {}, this.dummyBff = async (h) => ({ status: 500, body: { error: "Unimplemented" } }), c || (c = {}), y("loginUrl", E.String, this, c, "LOGIN_URL", !1), c.isAdminFn && (D.isAdminFn = c.isAdminFn);
+    this.loginUrl = "/login", this.audience = "", this.dummyLoad = async (h) => ({}), this.dummyActions = {}, this.dummyBff = async (h) => ({ status: 500, body: { error: "Unimplemented" } }), c || (c = {}), y("loginUrl", _.String, this, c, "LOGIN_URL", !1), c.isAdminFn && (D.isAdminFn = c.isAdminFn);
     let d = {};
     if (c.authenticators && (d = c.authenticators), this.userStorage = c.userStorage, r) {
       if (!d)
@@ -2721,7 +2721,7 @@ const D = class D {
           )
         );
     }
-    i && (y("audience", E.String, this, c, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new ge(
+    i && (y("audience", _.String, this, c, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new ge(
       [new te(this.audience, c)],
       { sessionAdapter: this.sessionAdapter, ...i.options, ...c }
     )), this.hooks = async ({ event: h, resolve: g }) => {
@@ -2956,7 +2956,7 @@ class we {
           ...e
         };
       }
-    }, this.sessionServer = r, y("changePasswordUrl", E.String, this, o, "CHANGE_PASSWORD_URL"), y("requestPasswordResetUrl", E.String, this, o, "REQUEST_PASSWORD_RESET_URL"), y("changeFactor2Url", E.String, this, o, "CHANGE_FACTOR2_URL"), y("loginRedirectUrl", E.JsonArray, this, o, "LOGIN_REDIRECT_URL"), y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.addToSession && (this.addToSession = o.addToSession);
+    }, this.sessionServer = r, y("changePasswordUrl", _.String, this, o, "CHANGE_PASSWORD_URL"), y("requestPasswordResetUrl", _.String, this, o, "REQUEST_PASSWORD_RESET_URL"), y("changeFactor2Url", _.String, this, o, "CHANGE_FACTOR2_URL"), y("loginRedirectUrl", _.JsonArray, this, o, "LOGIN_REDIRECT_URL"), y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.addToSession && (this.addToSession = o.addToSession);
   }
   /** Returns whether there is a user logged in with a cookie-based session
    */
@@ -3205,7 +3205,7 @@ class we {
           u.Forbidden,
           "Illegal second factor " + o.factor2 + " requested"
         );
-      (o.factor2 == "none" || o.factor2 == "") && (o.factor2 = void 0), t = this.sessionServer.createUserFn(r, o, this.sessionServer.userStorage.userEditableFields);
+      (o.factor2 == "none" || o.factor2 == "") && (o.factor2 = void 0), t = this.sessionServer.createUserFn(r, o, this.sessionServer.userStorage.userEditableFields, this.sessionServer.userAllowedFactor1);
       let a = this.sessionServer.authenticators[t.factor1].validateSecrets(o);
       const i = this.sessionServer.authenticators[t.factor1].secretNames();
       let c = {};
@@ -4427,7 +4427,8 @@ class ke {
         {
           ...this.sessionServer.userStorage.userEditableFields,
           ...this.sessionServer.userStorage.adminEditableFields
-        }
+        },
+        this.sessionServer.adminAllowedFactor1
       );
       const a = this.sessionServer.authenticators[t.factor1].secretNames();
       let i = !0;
@@ -4552,7 +4553,7 @@ class X {
    * @param options See {@link SvelteKitSessionServerOptions}
    */
   constructor(r, o) {
-    this.loginUrl = "/login", this.clientSearchFn = Se, this.validFlows = ["all"], this.sessionServer = r, y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect ?? Q, this.error = o.error ?? Y, y("validFlows", E.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == _.All && (this.validFlows = _.allFlows()), this.valid_flowNames = _.flowNames(this.validFlows), o.clientStorage && (this.clientManager = new B(o)), this.clientStorage = o.clientStorage;
+    this.loginUrl = "/login", this.clientSearchFn = Se, this.validFlows = ["all"], this.sessionServer = r, y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect ?? Q, this.error = o.error ?? Y, y("validFlows", _.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == E.All && (this.validFlows = E.allFlows()), this.valid_flowNames = E.flowNames(this.validFlows), o.clientStorage && (this.clientManager = new B(o)), this.clientStorage = o.clientStorage;
   }
   ///////////////////////////////////////////////////////////////////
   // Functions callable from apps
@@ -5018,7 +5019,7 @@ class Ce extends X {
       actions: {
         default: async (s) => await this.deleteClient(s)
       }
-    }, this.sessionServer = r, y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
+    }, this.sessionServer = r, y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
   }
   ///////////////////////////////////////////////////////////////////
   // Functions callable from apps
@@ -5200,7 +5201,7 @@ class ye extends X {
       actions: {
         default: async (s) => await this.deleteClient(s)
       }
-    }, this.sessionServer = r, y("loginUrl", E.String, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
+    }, this.sessionServer = r, y("loginUrl", _.String, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
   }
   ///////////////////////////////////////////////////////////////////
   // Functions callable from apps
@@ -5262,33 +5263,33 @@ class ye extends X {
   }
 }
 const x = "X-CROSSAUTH-CSRF";
-function Ee(k) {
+function _e(k) {
   let r = [];
   return k.username == null ? r.push("Username must be given") : k.username.length < 2 ? r.push("Username must be at least 2 characters") : k.username.length > 254 && r.push("Username must be no longer than 254 characters"), r;
 }
-function _e(k, r, o) {
-  var a;
-  let e = {
+function Ee(k, r, o, s = ["localpassword"]) {
+  var i;
+  let t = {
     username: r.username ?? "",
     state: "active"
   };
-  const t = k.locals.user && m.isAdminFn(k.locals.user);
-  for (let i in r) {
-    let c = i.replace(/^user_/, "");
-    if (i.startsWith("user_") && (t || o.includes(c)))
-      if ("type_" + c in r) {
-        if (r["type_" + c] == "string")
-          e[c] = r[i];
-        else if (r["type_" + c] == "number" || r["type_" + c] == "integer" || r["type_" + c] == "float")
-          e[c] = Number(r[i]);
-        else if (r["type_" + c] == "boolean") {
-          const d = (a = r[i]) == null ? void 0 : a.toLocaleLowerCase();
-          e[c] = d == "1" || d == "y" || d == "t" || d == "yes" || d == "true";
+  const a = k.locals.user && m.isAdminFn(k.locals.user);
+  for (let c in r) {
+    let d = c.replace(/^user_/, "");
+    if (c.startsWith("user_") && (a || o.includes(d)))
+      if ("type_" + d in r) {
+        if (r["type_" + d] == "string")
+          t[d] = r[c];
+        else if (r["type_" + d] == "number" || r["type_" + d] == "integer" || r["type_" + d] == "float")
+          t[d] = Number(r[c]);
+        else if (r["type_" + d] == "boolean") {
+          const h = (i = r[c]) == null ? void 0 : i.toLocaleLowerCase();
+          t[d] = h == "1" || h == "y" || h == "t" || h == "yes" || h == "true";
         }
       } else
-        e[c] = r[i];
+        t[d] = r[c];
   }
-  return e.factor1 = "localpassword", e.factor2 = r.factor2, e;
+  return t.factor1 = "localpassword", r.factor1 && s.includes(r.factor1) && (t.factor1 = r.factor1), t.factor2 = r.factor2, t;
 }
 function ve(k, r, o, s) {
   var t;
@@ -5319,9 +5320,9 @@ class H {
    * @param options See {@link SvelteKitSessionServerOptions}.
    */
   constructor(r, o, s = {}) {
-    this.validateUserFn = Ee, this.createUserFn = _e, this.updateUserFn = ve, this.allowedFactor2 = [], this.allowedFactor2Names = [], this.factor2ProtectedPageEndpoints = [], this.factor2ProtectedApiEndpoints = [], this.loginProtectedPageEndpoints = [], this.loginProtectedApiEndpoints = [], this.loginProtectedExceptionPageEndpoints = [], this.loginProtectedExceptionApiEndpoints = [], this.adminPageEndpoints = [], this.adminApiEndpoints = [], this.adminProtectedExceptionPageEndpoints = [], this.adminProtectedExceptionApiEndpoints = [], this.unauthorizedUrl = void 0, this.enableCsrfProtection = !0, this.enableEmailVerification = !1, this.enablePasswordReset = !1, this.factor2Url = "/factor2", this.loginUrl = "/login", this.keyStorage = r, this.userStorage = s.userStorage, this.clientStorage = s.clientStorage, this.authenticators = o, this.sessionManager = new ie(r, o, s), this.redirect = s.redirect ?? Q, this.error = s.error ?? Y, y("factor2Url", E.String, this, s, "FACTOR2_URL"), this.factor2Url.endsWith("/") || (this.factor2Url += "/"), y("factor2ProtectedPageEndpoints", E.JsonArray, this, s, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), y("factor2ProtectedApiEndpoints", E.JsonArray, this, s, "FACTOR2_PROTECTED_API_ENDPOINTS"), y("loginProtectedPageEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_PAGE_ENDPOINTS"), y("loginProtectedApiEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_API_ENDPOINTS"), y("loginProtectedExceptionPageEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("loginProtectedExceptionApiEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("adminPageEndpoints", E.JsonArray, this, s, "ADMIN_PAGE_ENDPOINTS"), y("adminApiEndpoints", E.JsonArray, this, s, "ADMIN_API_ENDPOINTS"), y("adminProtectedExceptionPageEndpoints", E.JsonArray, this, s, "ADMIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("adminProtectedExceptionApiEndpoints", E.JsonArray, this, s, "ADMIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("loginUrl", E.JsonArray, this, s, "LOGIN_URL"), y("unauthorizedUrl", E.JsonArray, this, s, "UNAUTHORIZED_PAGE");
+    this.validateUserFn = _e, this.createUserFn = Ee, this.updateUserFn = ve, this.allowedFactor2 = [], this.allowedFactor2Names = [], this.factor2ProtectedPageEndpoints = [], this.factor2ProtectedApiEndpoints = [], this.loginProtectedPageEndpoints = [], this.loginProtectedApiEndpoints = [], this.loginProtectedExceptionPageEndpoints = [], this.loginProtectedExceptionApiEndpoints = [], this.adminPageEndpoints = [], this.adminApiEndpoints = [], this.adminProtectedExceptionPageEndpoints = [], this.adminProtectedExceptionApiEndpoints = [], this.unauthorizedUrl = void 0, this.enableCsrfProtection = !0, this.enableEmailVerification = !1, this.enablePasswordReset = !1, this.factor2Url = "/factor2", this.loginUrl = "/login", this.userAllowedFactor1 = ["localpassword"], this.adminAllowedFactor1 = ["localpassword"], this.keyStorage = r, this.userStorage = s.userStorage, this.clientStorage = s.clientStorage, this.authenticators = o, this.sessionManager = new ie(r, o, s), this.redirect = s.redirect ?? Q, this.error = s.error ?? Y, y("factor2Url", _.String, this, s, "FACTOR2_URL"), this.factor2Url.endsWith("/") || (this.factor2Url += "/"), y("factor2ProtectedPageEndpoints", _.JsonArray, this, s, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), y("factor2ProtectedApiEndpoints", _.JsonArray, this, s, "FACTOR2_PROTECTED_API_ENDPOINTS"), y("loginProtectedPageEndpoints", _.JsonArray, this, s, "LOGIN_PROTECTED_PAGE_ENDPOINTS"), y("loginProtectedApiEndpoints", _.JsonArray, this, s, "LOGIN_PROTECTED_API_ENDPOINTS"), y("loginProtectedExceptionPageEndpoints", _.JsonArray, this, s, "LOGIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("loginProtectedExceptionApiEndpoints", _.JsonArray, this, s, "LOGIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("adminPageEndpoints", _.JsonArray, this, s, "ADMIN_PAGE_ENDPOINTS"), y("adminApiEndpoints", _.JsonArray, this, s, "ADMIN_API_ENDPOINTS"), y("adminProtectedExceptionPageEndpoints", _.JsonArray, this, s, "ADMIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("adminProtectedExceptionApiEndpoints", _.JsonArray, this, s, "ADMIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("loginUrl", _.JsonArray, this, s, "LOGIN_URL"), y("unauthorizedUrl", _.JsonArray, this, s, "UNAUTHORIZED_PAGE"), y("userAllowedFactor1", _.JsonArray, this, s, "USER_ALLOWED_FACTOR1"), y("adminAllowedFactor1", _.JsonArray, this, s, "ADMIN_ALLOWED_FACTOR1");
     let e = {};
-    if (y("allowedFactor2", E.JsonArray, e, s, "ALLOWED_FACTOR2"), this.allowedFactor2Names = s.allowedFactor2 ?? ["none"], e.allowedFactor2)
+    if (y("allowedFactor2", _.JsonArray, e, s, "ALLOWED_FACTOR2"), this.allowedFactor2Names = s.allowedFactor2 ?? ["none"], e.allowedFactor2)
       for (let t of e.allowedFactor2)
         t in this.authenticators ? this.allowedFactor2.push({
           name: t,
@@ -5332,7 +5333,7 @@ class H {
           friendlyName: "None",
           configurable: !1
         });
-    y("enableEmailVerification", E.Boolean, this, s, "ENABLE_EMAIL_VERIFICATION"), y("enablePasswordReset", E.Boolean, this, s, "ENABLE_PASSWORD_RESET"), y("enableCsrfProtection", E.Boolean, this, s, "ENABLE_CSRF_PROTECTION"), y("editUserScope", E.String, this, s, "EDIT_USER_SCOPE"), s.validateUserFn && (this.validateUserFn = s.validateUserFn), s.createUserFn && (this.createUserFn = s.createUserFn), s.updateUserFn && (this.updateUserFn = s.updateUserFn), s.addToSession && (this.addToSession = s.addToSession), s.validateSession && (this.validateSession = s.validateSession), this.userEndpoints = new we(this, s), this.adminEndpoints = new ke(this, s), this.userClientEndpoints = new Ce(this, s), this.adminClientEndpoints = new ye(this, s), this.sessionHook = async ({ event: t }) => {
+    y("enableEmailVerification", _.Boolean, this, s, "ENABLE_EMAIL_VERIFICATION"), y("enablePasswordReset", _.Boolean, this, s, "ENABLE_PASSWORD_RESET"), y("enableCsrfProtection", _.Boolean, this, s, "ENABLE_CSRF_PROTECTION"), y("editUserScope", _.String, this, s, "EDIT_USER_SCOPE"), s.validateUserFn && (this.validateUserFn = s.validateUserFn), s.createUserFn && (this.createUserFn = s.createUserFn), s.updateUserFn && (this.updateUserFn = s.updateUserFn), s.addToSession && (this.addToSession = s.addToSession), s.validateSession && (this.validateSession = s.validateSession), this.userEndpoints = new we(this, s), this.adminEndpoints = new ke(this, s), this.userClientEndpoints = new Ce(this, s), this.adminClientEndpoints = new ye(this, s), this.sessionHook = async ({ event: t }) => {
       var h, g;
       l.logger.debug("Session hook");
       let a = [];

package/dist/sveltekitsession.d.ts

@@ -88,7 +88,7 @@ export interface SvelteKitSessionServerOptions extends SessionManagerOptions {
          */
     createUserFn?: (event: RequestEvent, data: {
         [key: string]: string | undefined;
-    }, userEditableFields: string[]) => UserInputFields;
+    }, userEditableFields: string[], allowableFactor1: string[]) => UserInputFields;
     /** Function that updates a user from form fields.
      * Default one takes fields that begin with `user_`, removing the `user_`
      *  prefix and filtering out anything not in the userEditableFields list in
@@ -264,6 +264,16 @@ export interface SvelteKitSessionServerOptions extends SessionManagerOptions {
     redirect?: any;
     /** Pass the Sveltekit error function */
     error?: any;
+    /**
+     * When signing up themselves, users may choose any of these.
+     * Default: ["localpassword"]
+     */
+    userAllowedFactor1?: string[];
+    /**
+     * When admins create a user, they may choose any of these.
+     * Default: ["localpassword"]
+     */
+    adminAllowedFactor1?: string[];
 }
 /**
  * The Sveltekit session server.
@@ -331,7 +341,7 @@ export declare class SvelteKitSessionServer implements SvelteKitSessionAdapter {
      */
     createUserFn: (event: RequestEvent, data: {
         [key: string]: string | undefined;
-    }, userEditableFields: string[]) => UserInputFields;
+    }, userEditableFields: string[], allowableFactor1: string[]) => UserInputFields;
     /**
      * Funtion to update a user record from form fields.  Taken from the options during
      * construction or the default value.
@@ -444,6 +454,8 @@ export declare class SvelteKitSessionServer implements SvelteKitSessionAdapter {
      * See {@link SvelteKitServerOptions}.
      */
     readonly editUserScope?: string;
+    readonly userAllowedFactor1: string[];
+    readonly adminAllowedFactor1: string[];
     /**
      * Constructor
      * @param keyStorage where session IDs, email verification and reset tokens are stored

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crossauth/sveltekit",
-  "version": "0.0.36",
+  "version": "0.0.37",
   "license": "Apache-2.0",
   "private": false,
   "type": "module",
@@ -46,8 +46,8 @@
     "minimatch": "^10.0.1",
     "qrcode": "^1.5.4",
     "vite-plugin-dts": "^3.6.4",
-    "@crossauth/backend": "^0.0.36",
-    "@crossauth/common": "^0.0.36"
+    "@crossauth/backend": "^0.0.37",
+    "@crossauth/common": "^0.0.37"
   },
   "scripts": {
     "preparex": "svelte-kit sync",