@crossauth/sveltekit 1.1.0 → 1.1.1

package/dist/sveltekitsession.js

@@ -0,0 +1,1112 @@
+// Copyright (c) 2026 Matthew Baker.  All rights reserved.  Licenced under the Apache Licence 2.0.  See LICENSE file
+import { minimatch } from 'minimatch';
+import { KeyStorage, UserStorage, OAuthClientStorage, SessionManager, Authenticator, Crypto, setParameter, ParamType, toCookieSerializeOptions } from '@crossauth/backend';
+import { CrossauthError, CrossauthLogger, j, ErrorCode, httpStatus } from '@crossauth/common';
+import { UserState } from '@crossauth/common';
+import { error, redirect } from '@sveltejs/kit';
+import { JsonOrFormData } from './utils';
+import { SvelteKitUserEndpoints } from './sveltekituserendpoints';
+import { SvelteKitAdminEndpoints } from './sveltekitadminendpoints';
+import { SvelteKitUserClientEndpoints } from './sveltekituserclientendpoints';
+import { SvelteKitAdminClientEndpoints } from './sveltekitadminclientendpoints';
+import { SvelteKitSessionAdapter } from './sveltekitsessionadapter';
+import { SvelteKitServer } from './sveltekitserver';
+import {} from './tests/sveltemocks';
+export const CSRFHEADER = "X-CROSSAUTH-CSRF";
+/////////////////////////////////////////////////////////////////////////////
+// DEFAULT FUNCTIONS
+/**
+ * Default User validator.  Doesn't validate password
+ *
+ * Username must be at least two characters.
+ * @param password The password to validate
+ * @returns an array of errors.  If there were no errors, returns an empty array
+ */
+function defaultUserValidator(user) {
+    let errors = [];
+    if (user.username == undefined)
+        errors.push("Username must be given");
+    else if (user.username.length < 2)
+        errors.push("Username must be at least 2 characters");
+    else if (user.username.length > 254)
+        errors.push("Username must be no longer than 254 characters");
+    return errors;
+}
+/**
+ * Default function for creating users.  Can be overridden.
+ *
+ * Takes any field beginning with `user_` and that is also in
+ * `userEditableFields` (without the `user_` prefix).
+ *
+ * @param event the SvelteKit request event
+ * @param userEditableFields the fields a user may edit
+ * @returns the new user
+ */
+function defaultCreateUser(event, data, userEditableFields, allowableFactor1 = ["localpassword"]) {
+    let state = "active";
+    let user = {
+        username: data.username ?? "",
+        state: state,
+    };
+    const callerIsAdmin = event.locals.user && SvelteKitServer.isAdminFn(event.locals.user);
+    for (let field in data) {
+        let name = field.replace(/^user_/, "");
+        if (field.startsWith("user_") &&
+            (callerIsAdmin || userEditableFields.includes(name))) {
+            if ("type_" + name in data) {
+                if (data["type_" + name] == "string") {
+                    user[name] = data[field];
+                }
+                else if (data["type_" + name] == "number" || data["type_" + name] == "integer" || data["type_" + name] == "float") {
+                    user[name] = Number(data[field]);
+                }
+                else if (data["type_" + name] == "boolean") {
+                    const c = data[field]?.toLocaleLowerCase();
+                    user[name] = (c == "1" || c == "y" || c == "t" || c == "yes" || c == "true");
+                }
+            }
+            else {
+                user[name] = data[field];
+            }
+        }
+    }
+    user.factor1 = "localpassword";
+    if (data.factor1 && allowableFactor1.includes(data.factor1)) {
+        user.factor1 = data.factor1;
+    }
+    user.factor2 = data.factor2;
+    return user;
+}
+/**
+ * Default function for creating users.  Can be overridden.
+ *
+ * Takes any field beginning with `user_` and that is also in
+ * `userEditableFields` (without the `user_` prefix).
+ *
+ * @param user the user to update
+ * @param event the SvelteKit request event
+ * @param userEditableFields the fields a user may edit
+ * @returns the new user
+ */
+function defaultUpdateUser(user, event, data, userEditableFields) {
+    const callerIsAdmin = event.locals.user && SvelteKitServer.isAdminFn(event.locals.user);
+    for (let field in data) {
+        let name = field.replace(/^user_/, "");
+        if (field.startsWith("user_") &&
+            (callerIsAdmin || userEditableFields.includes(name))) {
+            if ("type_" + name in data) {
+                if (data["type_" + name] == "string") {
+                    user[name] = data[field];
+                }
+                else if (data["type_" + name] == "number" || data["type_" + name] == "integer" || data["type_" + name] == "float") {
+                    user[name] = Number(data[field]);
+                }
+                else if (data["type_" + name] == "boolean") {
+                    const c = data[field]?.toLocaleLowerCase();
+                    user[name] = (c == "1" || c == "y" || c == "t" || c == "yes" || c == "true");
+                }
+            }
+            else {
+                user[name] = data[field];
+            }
+        }
+    }
+    return user;
+}
+/**
+ * The Sveltekit session server.
+ *
+ * You shouldn't have to instantiate this directly.  It is created when
+ * you create a {@link SvelteKitServer} object.
+
+ *  **Middleware**
+ *
+ *  This class registers one middleware function to fill in the following
+ *  fields in the request:
+ *
+ *     - `user` a {@link @crossauth/common!User}` object
+ *     - `authType`: set to `cookie` or undefined
+ *     - `csrfToken`: a CSRF token that can be used in POST requests
+ *     - `sessionId` a session ID if one is created
+ */
+export class SvelteKitSessionServer {
+    /**
+     * Hook to check if the user is logged in and set data in `locals`
+     * accordingly.
+     */
+    sessionHook;
+    twoFAHook;
+    /**
+     * Key storage taken from constructor args.
+     * See {@link SvelteKitSessionServer.constructor}.
+     */
+    keyStorage;
+    /**
+     * Session Manager taken from constructor args.
+     * See {@link SvelteKitSessionServer.constructor}.
+     */
+    sessionManager;
+    /**
+     * User storage taken from constructor args.
+     * See {@link SvelteKitSessionServer.constructor}.
+     */
+    userStorage;
+    /**
+     * User storage taken from constructor args.
+     * See {@link SvelteKitSessionServer.constructor}.
+     */
+    clientStorage;
+    /**
+     * Funtion to validate users upon creation.  Taken from the options during
+     * construction or the default value.
+     * See {@link SvelteKitSessionServerOptions}.
+     */
+    validateUserFn = defaultUserValidator;
+    /**
+     * Funtion to create a user record from form fields.  Taken from the options during
+     * construction or the default value.
+     * See {@link SvelteKitSessionServerOptions}.
+     */
+    createUserFn = defaultCreateUser;
+    /**
+     * Funtion to update a user record from form fields.  Taken from the options during
+     * construction or the default value.
+     * See {@link SvelteKitSessionServerOptions}.
+     */
+    updateUserFn = defaultUpdateUser;
+    /**
+     * The set of authenticators taken from constructor args.
+     * See {@link SvelteKitSessionServer.constructor}.
+     */
+    authenticators;
+    /**
+     * The set of allowed authenticators taken from the options during
+     * construction.
+     *
+     * The default is `[{name: "none", friendlyName: "none"}]`
+     */
+    allowedFactor2 = [];
+    /**
+     * The set of allowed authenticators taken from the options during
+     * construction.
+     *
+     * The default is `["none"]`.
+     */
+    allowedFactor2Names = [];
+    /** Called when a new session token is going to be saved
+     *  Add additional fields to your session storage here.  Return a map of
+     * keys to values  */
+    addToSession;
+    /**
+     * The set of allowed authenticators taken from the options during
+     * construction.
+     */
+    validateSession;
+    factor2ProtectedPageEndpoints = [];
+    factor2ProtectedApiEndpoints = [];
+    loginProtectedPageEndpoints = [];
+    loginProtectedApiEndpoints = [];
+    loginProtectedExceptionPageEndpoints = [];
+    loginProtectedExceptionApiEndpoints = [];
+    adminPageEndpoints = [];
+    adminApiEndpoints = [];
+    adminProtectedExceptionPageEndpoints = [];
+    adminProtectedExceptionApiEndpoints = [];
+    unauthorizedUrl = undefined;
+    enableCsrfProtection = true;
+    /** Whether email verification is enabled.
+     *
+     * Reads from constructor options
+     */
+    enableEmailVerification = false;
+    /** Whether password reset is enabled.
+     *
+     * Reads from constructor options
+     */
+    enablePasswordReset = false;
+    factor2Url = "/factor2";
+    loginUrl = "/login";
+    logoutUrl = "/logout";
+    /**
+     * Use these to access the `load` and `action` endpoints for functions
+     * provided by Crossauth.  These are the ones intended for users to
+     * have access to.
+     *
+     * See {@link SvelteKitUserEndpoints}
+     */
+    userEndpoints;
+    /**
+     * Use these to access the `load` and `action` endpoints for functions
+     * provided by Crossauth that relate to manipulating OAuth clients in the
+     * database.  These are the ones intended for users to
+     * have access to.
+     *
+     * See {@link SvelteKitUserEndpoints}
+     */
+    userClientEndpoints;
+    /**
+     * Use these to access the `load` and `action` endpoints for functions
+     * provided by Crossauth that relate to manipulating OAuth clients in the
+     * database as admin.  These are the ones intended for users to
+     * have access to.
+     *
+     * See {@link SvelteKitAdminEndpoints}
+     */
+    adminClientEndpoints;
+    /**
+     * Use these to access the `load` and `action` endpoints for functions
+     * provides by Crossauth.  These are the ones intended for admins to
+     * have access to.
+     *
+     * See {@link SvelteKitAdminEndpoints}
+     */
+    adminEndpoints;
+    redirect;
+    error;
+    /**
+     * This is read from options during construction.
+     *
+     * See {@link SvelteKitServerOptions}.
+     */
+    editUserScope;
+    userAllowedFactor1 = ["localpassword"];
+    adminAllowedFactor1 = ["localpassword"];
+    /**
+     * Constructor
+     * @param keyStorage where session IDs, email verification and reset tokens are stored
+     * @param authenticators valid authenticators that can be in `factor1` or `factor2`
+     *    of the user.  See class documentation for {@link SvelteKitServer} for an example.
+     * @param options See {@link SvelteKitSessionServerOptions}.
+     */
+    constructor(keyStorage, authenticators, options = {}) {
+        this.keyStorage = keyStorage;
+        this.userStorage = options.userStorage;
+        this.clientStorage = options.clientStorage;
+        this.authenticators = authenticators;
+        this.sessionManager = new SessionManager(keyStorage, authenticators, options);
+        this.redirect = options.redirect ?? redirect;
+        this.error = options.error ?? error;
+        setParameter("factor2Url", ParamType.String, this, options, "FACTOR2_URL");
+        if (!this.factor2Url.endsWith("/"))
+            this.factor2Url += "/";
+        setParameter("factor2ProtectedPageEndpoints", ParamType.JsonArray, this, options, "FACTOR2_PROTECTED_PAGE_ENDPOINTS");
+        setParameter("factor2ProtectedApiEndpoints", ParamType.JsonArray, this, options, "FACTOR2_PROTECTED_API_ENDPOINTS");
+        setParameter("loginProtectedPageEndpoints", ParamType.JsonArray, this, options, "LOGIN_PROTECTED_PAGE_ENDPOINTS");
+        setParameter("loginProtectedApiEndpoints", ParamType.JsonArray, this, options, "LOGIN_PROTECTED_API_ENDPOINTS");
+        setParameter("loginProtectedExceptionPageEndpoints", ParamType.JsonArray, this, options, "LOGIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS");
+        setParameter("loginProtectedExceptionApiEndpoints", ParamType.JsonArray, this, options, "LOGIN_PROTECTED_EXCEPTION_API_ENDPOINTS");
+        setParameter("adminPageEndpoints", ParamType.JsonArray, this, options, "ADMIN_PAGE_ENDPOINTS");
+        setParameter("adminApiEndpoints", ParamType.JsonArray, this, options, "ADMIN_API_ENDPOINTS");
+        setParameter("adminProtectedExceptionPageEndpoints", ParamType.JsonArray, this, options, "ADMIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS");
+        setParameter("adminProtectedExceptionApiEndpoints", ParamType.JsonArray, this, options, "ADMIN_PROTECTED_EXCEPTION_API_ENDPOINTS");
+        setParameter("loginUrl", ParamType.JsonArray, this, options, "LOGIN_URL");
+        setParameter("logoutUrl", ParamType.JsonArray, this, options, "LOGOUT_URL");
+        setParameter("unauthorizedUrl", ParamType.JsonArray, this, options, "UNAUTHORIZED_PAGE");
+        setParameter("userAllowedFactor1", ParamType.JsonArray, this, options, "USER_ALLOWED_FACTOR1");
+        setParameter("adminAllowedFactor1", ParamType.JsonArray, this, options, "ADMIN_ALLOWED_FACTOR1");
+        let options1 = {};
+        setParameter("allowedFactor2", ParamType.JsonArray, options1, options, "ALLOWED_FACTOR2");
+        this.allowedFactor2Names = options.allowedFactor2 ?? ["none"];
+        if (options1.allowedFactor2) {
+            for (let factor of options1.allowedFactor2) {
+                if (factor in this.authenticators) {
+                    this.allowedFactor2.push({
+                        name: factor,
+                        friendlyName: this.authenticators[factor].friendlyName,
+                        configurable: this.authenticators[factor].secretNames().length > 0,
+                    });
+                }
+                else if (factor == "none") {
+                    this.allowedFactor2.push({
+                        name: "none",
+                        friendlyName: "None",
+                        configurable: false
+                    });
+                }
+            }
+        }
+        setParameter("enableEmailVerification", ParamType.Boolean, this, options, "ENABLE_EMAIL_VERIFICATION");
+        setParameter("enablePasswordReset", ParamType.Boolean, this, options, "ENABLE_PASSWORD_RESET");
+        setParameter("enableCsrfProtection", ParamType.Boolean, this, options, "ENABLE_CSRF_PROTECTION");
+        setParameter("editUserScope", ParamType.String, this, options, "EDIT_USER_SCOPE");
+        if (options.validateUserFn)
+            this.validateUserFn = options.validateUserFn;
+        if (options.createUserFn)
+            this.createUserFn = options.createUserFn;
+        if (options.updateUserFn)
+            this.updateUserFn = options.updateUserFn;
+        if (options.addToSession)
+            this.addToSession = options.addToSession;
+        if (options.validateSession)
+            this.validateSession = options.validateSession;
+        this.userEndpoints = new SvelteKitUserEndpoints(this, options);
+        this.adminEndpoints = new SvelteKitAdminEndpoints(this, options);
+        this.userClientEndpoints = new SvelteKitUserClientEndpoints(this, options);
+        this.adminClientEndpoints = new SvelteKitAdminClientEndpoints(this, options);
+        this.sessionHook = async ({ event } /*, response*/) => {
+            CrossauthLogger.logger.debug(j({ msg: "Session hook" }));
+            let headers = [];
+            let status = undefined;
+            const csrfCookieName = this.sessionManager.csrfCookieName;
+            const sessionCookieName = this.sessionManager.sessionCookieName;
+            //const response = await resolve(event);
+            // check if CSRF token is in cookie (and signature is valid)
+            // remove it if it is not.
+            // we are not checking it matches the CSRF token in the header or
+            // body at this stage - just removing invalid cookies
+            if (this.enableCsrfProtection) {
+                CrossauthLogger.logger.debug(j({ msg: "Getting csrf cookie" }));
+                let cookieValue;
+                try {
+                    cookieValue = this.getCsrfCookieValue(event);
+                    if (cookieValue)
+                        this.sessionManager.validateCsrfCookie(cookieValue);
+                }
+                catch (e) {
+                    CrossauthLogger.logger.warn(j({ msg: "Invalid csrf cookie received", cerr: e, hashedCsrfCookie: this.getHashOfCsrfCookie(event) }));
+                    try {
+                        this.clearCookie(csrfCookieName, this.sessionManager.csrfCookiePath, event);
+                    }
+                    catch (e2) {
+                        CrossauthLogger.logger.debug(j({ err: e2 }));
+                        CrossauthLogger.logger.error(j({ cerr: e2, msg: "Couldn't delete CSRF cookie", ip: event.request.referrer, hashedCsrfCookie: this.getHashOfCsrfCookie(event) }));
+                    }
+                    cookieValue = undefined;
+                    event.locals.csrfToken = undefined;
+                }
+                if (["GET", "OPTIONS", "HEAD"].includes(event.request.method)) {
+                    // for get methods, create a CSRF token in the request object and response header
+                    try {
+                        if (!cookieValue) {
+                            CrossauthLogger.logger.debug(j({ msg: "Invalid CSRF cookie - recreating" }));
+                            const { csrfCookie, csrfFormOrHeaderValue } = await this.sessionManager.createCsrfToken();
+                            this.setCsrfCookie(csrfCookie, event);
+                            event.locals.csrfToken = csrfFormOrHeaderValue;
+                        }
+                        else {
+                            CrossauthLogger.logger.debug(j({ msg: "Valid CSRF cookie - creating token" }));
+                            const csrfFormOrHeaderValue = await this.sessionManager.createCsrfFormOrHeaderValue(cookieValue);
+                            event.locals.csrfToken = csrfFormOrHeaderValue;
+                        }
+                        this.setHeader(CSRFHEADER, event.locals.csrfToken, headers);
+                        //response.headers.set(CSRFHEADER, event.locals.csrfToken);
+                    }
+                    catch (e) {
+                        CrossauthLogger.logger.error(j({ msg: "Couldn't create CSRF token", cerr: e, user: event.locals.user?.username, hashedSessionCookie: this.getHashOfSessionCookie(event) }));
+                        CrossauthLogger.logger.debug(j({ err: e }));
+                        this.clearCookie(csrfCookieName, this.sessionManager.csrfCookiePath, event);
+                        event.locals.csrfToken = undefined;
+                    }
+                }
+                else {
+                    // for other methods, create a new token only if there is already a valid one
+                    if (cookieValue) {
+                        try {
+                            await this.csrfToken(event, headers);
+                        }
+                        catch (e) {
+                            CrossauthLogger.logger.error(j({ msg: "Couldn't create CSRF token", cerr: e, user: event.locals.user?.username, hashedSessionCookie: this.getHashOfSessionCookie(event) }));
+                            CrossauthLogger.logger.debug(j({ err: e }));
+                        }
+                    }
+                }
+            }
+            // we now either have a valid CSRF token, or none at all (or CSRF
+            // protection has been disabled, in which case the CSRF cookie
+            // is ignored)
+            // validate any session cookie.  Remove if invalid
+            event.locals.user = undefined;
+            event.locals.authType = undefined;
+            const sessionCookieValue = this.getSessionCookieValue(event);
+            CrossauthLogger.logger.debug(j({ msg: "Getting session cookie" }));
+            if (sessionCookieValue) {
+                try {
+                    const sessionId = this.sessionManager.getSessionId(sessionCookieValue);
+                    let { key, user } = await this.sessionManager.userForSessionId(sessionId);
+                    if (this.validateSession)
+                        this.validateSession(key, user, event);
+                    const endpoint = event.url.pathname;
+                    CrossauthLogger.logger.debug(j({ msg: "Session cookie is for user " + user }));
+                    if (user) { // XXX
+                        if (this.allowedFactor2.length > 0 &&
+                            (user.state == UserState.factor2ResetNeeded ||
+                                !this.allowedFactor2Names.includes(user.factor2 ? user.factor2 : "none"))) {
+                            if (!this.userEndpoints.configureFactor2Url)
+                                throw new CrossauthError(ErrorCode.Configuration, "Must set configureFactor2Url in session server");
+                            if (!this.userEndpoints.changeFactor2Url)
+                                throw new CrossauthError(ErrorCode.Configuration, "Must set changeFactor2Url in session server");
+                            if (!this.logoutUrl)
+                                throw new CrossauthError(ErrorCode.Configuration, "Must set logoutUrl in session server");
+                            if (!([this.userEndpoints.changeFactor2Url, this.userEndpoints.configureFactor2Url, this.loginUrl, this.logoutUrl].includes(endpoint))) {
+                                status = 302;
+                                headers.push({ name: "location", value: this.userEndpoints.changeFactor2Url + "?required=true&next=" + encodeURIComponent("login?next=" + event.url) });
+                                //this.redirect(302, this.userEndpoints.changeFactor2Url + "?required=true&next="+encodeURIComponent("login?next="+event.url));
+                            }
+                        }
+                    }
+                    event.locals.sessionId = sessionId;
+                    event.locals.user = user;
+                    event.locals.authType = "cookie";
+                    CrossauthLogger.logger.debug(j({ msg: "Valid session id", user: user?.username }));
+                }
+                catch (e) {
+                    CrossauthLogger.logger.warn(j({ msg: "Invalid session cookie received", hashedSessionCookie: this.getHashOfSessionCookie(event) }));
+                    this.clearCookie(sessionCookieName, this.sessionManager.sessionCookiePath, event);
+                }
+            }
+            //return response;
+            return { headers, status };
+        };
+        this.twoFAHook = async ({ event }) => {
+            CrossauthLogger.logger.debug(j({ msg: "twoFAHook", username: event.locals.user?.username }));
+            if (!this.userStorage)
+                throw this.error(500, "No user storage defined"); // shouldn't happen as checked in SvelteKitServer
+            const sessionCookieValue = this.getSessionCookieValue(event);
+            const isFactor2PageProtected = this.isFactor2PageProtected(event);
+            const isFactor2ApiProtected = this.isFactor2ApiProtected(event);
+            let user;
+            if (sessionCookieValue) {
+                if (event.locals.user)
+                    user = event.locals.user;
+                else {
+                    const anonUser = await this.getSessionData(event, "user");
+                    if (anonUser) {
+                        const resp = await this.userStorage.getUserByUsername(anonUser.username, { skipActiveCheck: true });
+                        if (resp.user.status == UserState.active || resp.user.state == UserState.factor2ResetNeeded)
+                            user = resp.user;
+                    }
+                }
+            }
+            if (user && sessionCookieValue && user.factor2 != "" && (isFactor2PageProtected || isFactor2ApiProtected)) {
+                CrossauthLogger.logger.debug(j({ msg: "Factor2-protected endpoint visited" }));
+                if (!(["GET", "OPTIONS", "HEAD"].includes(event.request.method))) {
+                    const sessionId = this.sessionManager.getSessionId(sessionCookieValue);
+                    const sessionData = await this.sessionManager.dataForSessionId(sessionId);
+                    if (("pre2fa") in sessionData) {
+                        // 2FA has started - validate it
+                        CrossauthLogger.logger.debug(j({ msg: "Completing 2FA" }));
+                        // get secrets from the request body 
+                        const authenticator = this.authenticators[sessionData.pre2fa.factor2];
+                        const secretNames = [...authenticator.secretNames(), ...authenticator.transientSecretNames()];
+                        let secrets = {};
+                        const bodyData = new JsonOrFormData();
+                        await bodyData.loadData(event);
+                        for (let field of bodyData.keys()) {
+                            if (secretNames.includes(field))
+                                secrets[field] = bodyData.get(field) ?? "";
+                        }
+                        const sessionCookieValue = this.getSessionCookieValue(event);
+                        if (!sessionCookieValue)
+                            throw new CrossauthError(ErrorCode.Unauthorized, "No session cookie found");
+                        let error1 = undefined;
+                        try {
+                            await this.sessionManager.completeTwoFactorPageVisit(secrets, event.locals.sessionId ?? "");
+                        }
+                        catch (e) {
+                            error1 = CrossauthError.asCrossauthError(e);
+                            CrossauthLogger.logger.debug(j({ err: e }));
+                            const ce = CrossauthError.asCrossauthError(e);
+                            CrossauthLogger.logger.error(j({ msg: error1.message, cerr: e, user: bodyData.get("username"), errorCode: ce.code, errorCodeName: ce.codeName }));
+                        }
+                        if (error1) {
+                            if (error1.code == ErrorCode.Expired) {
+                                // user will not be able to complete this process - delete 
+                                CrossauthLogger.logger.debug(j({ msg: "Error - cancelling 2FA" }));
+                                // the 2FA data and start again
+                                try {
+                                    await this.sessionManager.cancelTwoFactorPageVisit(sessionCookieValue);
+                                }
+                                catch (e) {
+                                    CrossauthLogger.logger.error(j({ msg: "Failed cancelling 2FA", cerr: e, user: user.username, hashedSessionCookie: this.getHashOfSessionCookie(event) }));
+                                    CrossauthLogger.logger.debug(j({ err: e }));
+                                }
+                                this.error(401, { message: "Sorry, your code has expired" });
+                                return { ok: false, twofa: true };
+                            }
+                            else {
+                                if (isFactor2PageProtected) {
+                                    return {
+                                        twofa: true,
+                                        ok: false,
+                                        response: new Response('', {
+                                            status: 302,
+                                            statusText: httpStatus(302),
+                                            headers: { Location: this.factor2Url + "?error=" + ErrorCode[error1.code] }
+                                        })
+                                    };
+                                }
+                                else {
+                                    return {
+                                        twofa: true,
+                                        ok: false,
+                                        response: new Response(JSON.stringify({
+                                            ok: false,
+                                            errorMessage: error1.message,
+                                            errorMessages: error1.messages,
+                                            errorCode: error1.code,
+                                            errorCodeName: ErrorCode[error1.code]
+                                        }), {
+                                            status: error1.httpStatus,
+                                            statusText: httpStatus(error1.httpStatus),
+                                            headers: { 'content-tyoe': 'application/json' },
+                                        })
+                                    };
+                                }
+                            }
+                        }
+                        // restore original request body
+                        SvelteKitSessionServer.updateRequest(event, sessionData.pre2fa.body, sessionData.pre2fa["content-type"]);
+                        return { twofa: true, ok: true };
+                    }
+                    else {
+                        // 2FA has not started - start it
+                        CrossauthLogger.logger.debug(j({ msg: "Starting 2FA", username: user.username }));
+                        if (this.enableCsrfProtection && !event.locals.csrfToken) {
+                            const error = new CrossauthError(ErrorCode.Forbidden, "CSRF token missing");
+                            return {
+                                twofa: true,
+                                ok: false,
+                                response: new Response(JSON.stringify({
+                                    ok: false,
+                                    errorMessage: error.message,
+                                    errorMessages: error.messages,
+                                    errorCode: error.code,
+                                    errorCodeName: ErrorCode[error.code]
+                                }), {
+                                    status: error.httpStatus,
+                                    statusText: httpStatus(error.httpStatus),
+                                    headers: {
+                                        ...{ 'content-tyoe': 'application/json' },
+                                    }
+                                })
+                            };
+                        }
+                        const bodyData = new JsonOrFormData();
+                        await bodyData.loadData(event);
+                        let contentType = event.request.headers.get("content-type");
+                        await this.sessionManager.initiateTwoFactorPageVisit(user, event.locals.sessionId ?? "", bodyData.toObject(), event.request.url.replace(/\?.*$/, ""), contentType ? contentType : undefined);
+                        if (isFactor2PageProtected) {
+                            return {
+                                twofa: true,
+                                ok: true,
+                                response: new Response('', {
+                                    status: 302,
+                                    statusText: httpStatus(302),
+                                    headers: { Location: this.factor2Url }
+                                })
+                            };
+                        }
+                        else {
+                            return {
+                                twofa: true,
+                                ok: true,
+                                response: new Response(JSON.stringify({
+                                    ok: true,
+                                    factor2Required: true
+                                }), {
+                                    headers: {
+                                        ...{ 'content-tyoe': 'application/json' },
+                                    }
+                                })
+                            };
+                        }
+                    }
+                }
+                else {
+                    CrossauthLogger.logger.debug(j({ msg: "Factor2-protected GET endpoint - cancelling 2FA" }));
+                    // if we have a get request to one of the protected urls, cancel any pending 2FA
+                    const sessionCookieValue = this.getSessionCookieValue(event);
+                    if (sessionCookieValue) {
+                        const sessionId = this.sessionManager.getSessionId(sessionCookieValue);
+                        const sessionData = await this.sessionManager.dataForSessionId(sessionId);
+                        if (("pre2fa") in sessionData) {
+                            CrossauthLogger.logger.debug(j({ msg: "Cancelling 2FA" }));
+                            try {
+                                await this.sessionManager.cancelTwoFactorPageVisit(sessionCookieValue);
+                            }
+                            catch (e) {
+                                CrossauthLogger.logger.debug(j({ err: e }));
+                                CrossauthLogger.logger.error(j({ msg: "Failed cancelling 2FA", cerr: e, user: user.username, hashedSessionCookie: this.getHashOfSessionCookie(event) }));
+                            }
+                        }
+                    }
+                }
+            }
+            return { twofa: false, ok: true };
+        };
+    }
+    //////////////
+    // Helpers
+    /**
+     * Returns the session cookie value from the Sveltekit request event
+     * @param event the request event
+     * @returns the whole cookie value
+     */
+    getSessionCookieValue(event) {
+        //let allCookies = event.cookies.getAll();
+        if (event.cookies && event.cookies.get(this.sessionManager.sessionCookieName)) {
+            return event.cookies.get(this.sessionManager.sessionCookieName);
+        }
+        return undefined;
+    }
+    /**
+     * Returns the session cookie value from the Sveltekit request event
+     * @param event the request event
+     * @returns the whole cookie value
+     */
+    getCsrfCookieValue(event) {
+        if (event.cookies) {
+            const cookie = event.cookies.get(this.sessionManager.csrfCookieName);
+            if (cookie)
+                return event.cookies.get(this.sessionManager.csrfCookieName);
+        }
+        return undefined;
+    }
+    clearCookie(name, path, event) {
+        event.cookies.delete(name, { path });
+    }
+    /**
+     * Sets headers in the request event.
+     *
+     * Used internally by {@link SvelteKitServer}.  Shouldn't be necessary
+     * to call this directly.
+     * @param headers the headres to set
+     * @param resp the response object to set them in
+     */
+    setHeaders(headers, resp) {
+        for (let header of headers) {
+            resp.headers.append(header.name, header.value);
+        }
+    }
+    /**
+     * Sets the CSRF cookie.
+     *
+     * Used internally.  Shouldn't be necessary
+     * to call this directly.
+     * @param cookie the new cookie and parameters
+     * @param event the request event
+     */
+    setCsrfCookie(cookie, event) {
+        event.cookies.set(cookie.name, cookie.value, toCookieSerializeOptions(cookie.options));
+    }
+    setHeader(name, value, headers) {
+        headers.push({
+            name: name,
+            value: value,
+        });
+    }
+    /**
+     * Returns a hash of the session cookie value.
+     *
+     * Used only in reporting, so that logs don't contain the actual session ID.
+     *
+     * @param event the Sveltelkit request event
+     * @returns a stering hash of the cookie value
+     */
+    getHashOfSessionCookie(event) {
+        const cookieValue = this.getSessionCookieValue(event);
+        if (!cookieValue)
+            return "";
+        try {
+            return Crypto.hash(cookieValue);
+        }
+        catch (e) { }
+        return "";
+    }
+    /**
+     * Returns a hash of the CSRF cookie value.
+     *
+     * Used only in reporting, so that logs don't contain the actual CSRF cookie value.
+     *
+     * @param event the Sveltelkit request event
+     * @returns a stering hash of the cookie value
+     */
+    getHashOfCsrfCookie(event) {
+        const cookieValue = this.getCsrfCookieValue(event);
+        if (!cookieValue)
+            return "";
+        try {
+            return Crypto.hash(cookieValue);
+        }
+        catch (e) { }
+        return "";
+    }
+    /**
+     * Returns a CSRF token if the CSRF cookie is valid.
+     *
+     * Used internally.  Shouldn't be necessary
+     * to call this directly.
+     *
+     * @param event the request event
+     * @param headers headers the token will be added to, as well as
+     *   adding it to locals
+     * @returns the string CSRF token for inclusion in forms
+     */
+    async csrfToken(event, headers) {
+        let token = undefined;
+        // first try token in header
+        if (event.request.headers && event.request.headers.has(CSRFHEADER.toLowerCase())) {
+            const header = event.request.headers.get(CSRFHEADER.toLowerCase());
+            if (Array.isArray(header))
+                token = header[0];
+            else if (header)
+                token = header;
+        }
+        // if not in header, try in body
+        if (!token) {
+            if (!event.request?.body) {
+                CrossauthLogger.logger.warn(j({ msg: "Received CSRF header but not token", ip: event.request.referrerPolicy, hashedCsrfCookie: this.getHashOfCsrfCookie(event) }));
+                return;
+            }
+            const contentType = event.request.headers.get("content-type");
+            if (contentType == "application/json") {
+                const body = await event.request?.clone()?.json();
+                token = body.csrfToken;
+            }
+            else if (contentType == "application/x-www-form-urlencoded" || contentType == "multipart/form-data") {
+                const body = await event.request.clone().formData();
+                const formValue = body.get("csrfToken");
+                if (formValue && typeof formValue == "string")
+                    token = formValue;
+            }
+        }
+        if (token) {
+            try {
+                this.sessionManager.validateDoubleSubmitCsrfToken(this.getCsrfCookieValue(event), token);
+                event.locals.csrfToken = token;
+                //resp.headers.set(CSRFHEADER, token);
+                this.setHeader(CSRFHEADER, token, headers);
+            }
+            catch (e) {
+                CrossauthLogger.logger.warn(j({ msg: "Invalid CSRF token", hashedCsrfCookie: this.getHashOfCsrfCookie(event) }));
+                this.clearCookie(this.sessionManager.csrfCookieName, this.sessionManager.csrfCookiePath, event);
+                event.locals.csrfToken = undefined;
+            }
+        }
+        else {
+            event.locals.csrfToken = undefined;
+        }
+        return token;
+    }
+    /**
+     * Used internally to update an existing Sveltekit request object with
+     * a new body and headers.
+     *
+     * Used when restoring a request that was interrupted for 2FA
+     *
+     * @param event the request event
+     * @param params JSON params to add to the new body
+     * @param contentType the new content type
+     * @returns the updated request event
+     */
+    static updateRequest(event, params, contentType) {
+        //const contentType = event.headers.get('content-type');
+        //const newContentType = contentType == 'application/json' ? 'application/json' : 'application/x-www-form-urlencoded';
+        let body;
+        if (contentType == 'application/json') {
+            body = JSON.stringify(params);
+        }
+        else {
+            body = "";
+            for (let name in params) {
+                const value = params[name];
+                if (body.length > 0)
+                    body += "&";
+                body += encodeURIComponent(name) + "=" + encodeURIComponent(value);
+            }
+        }
+        event.request = new Request(event.request.url, {
+            method: "POST",
+            headers: event.request.headers,
+            body: body
+        });
+        return event;
+    }
+    /**
+     * Returns a hash of the session ID.  Used for logging (for security,
+     * the actual session ID is not logged)
+     * @param event the Sveltekit request event
+     * @returns hash of the session ID
+     */
+    getHashOfSessionId(event) {
+        if (!event.locals.sessionId)
+            return "";
+        try {
+            return Crypto.hash(event.locals.sessionId);
+        }
+        catch (e) { }
+        return "";
+    }
+    /**
+     * Returns whether or not 2FA authentication was initiated as a result
+     * of visiting a page protected by it
+     * @param event the request event
+     * @returns true or false
+     */
+    async factor2PageVisitStarted(event) {
+        try {
+            const pre2fa = this.getSessionData(event, "pre2fa");
+            return pre2fa != undefined;
+        }
+        catch (e) {
+            const ce = CrossauthError.asCrossauthError(e);
+            CrossauthLogger.logger.debug(j({ err: ce }));
+            CrossauthLogger.logger.error(j({ cerr: ce, msg: "Couldn't get pre2fa data from session" }));
+            return false;
+        }
+    }
+    /////////////////////////////////////////////////////////////
+    // login protected URLs
+    /**
+     * Returns whether a page being visited as part of a request event is
+     * configured to be protected by login.
+     *
+     * See {@link SvelteKitSessionServerOptions.loginProtectedPageEndpoints} and
+     * {@link SvelteKitSessionServerOptions.loginProtectedExceptionPageEndpoints}.
+     *
+     * @param event the request event
+     * @returns true or false
+     */
+    isLoginPageProtected(event) {
+        const url = new URL(typeof event == "string" ? event : event.request.url);
+        // login page is never protected
+        if (url.pathname == this.loginUrl)
+            return false;
+        // return false for loginProtectedExceptionPageEndpoints
+        let isNotProtected = false;
+        isNotProtected = this.loginProtectedExceptionPageEndpoints.reduce((accumulator, currentValue) => accumulator || minimatch(url.pathname, currentValue), isNotProtected);
+        if (isNotProtected)
+            return false;
+        // set protected to true for any pages that are in loginProtectedPageEndpoints
+        let isProtected = false;
+        return this.loginProtectedPageEndpoints.reduce((accumulator, currentValue) => accumulator || minimatch(url.pathname, currentValue), isProtected);
+    }
+    /**
+     * Returns whether an API call is being visited as part of a request event is
+     * configured to be protected by login.
+     *
+     * See {@link SvelteKitSessionServerOptions.loginProtectedApiEndpoints}.
+     *
+     * @param event the request event
+     * @returns true or false
+     */
+    isLoginApiProtected(event) {
+        const url = new URL(typeof event == "string" ? event : event.request.url);
+        // login page is never protected
+        if (url.pathname == this.loginUrl)
+            return false;
+        // return false for loginProtectedExceptionApiEndpoints
+        let isNotProtected = false;
+        isNotProtected = this.loginProtectedExceptionApiEndpoints.reduce((accumulator, currentValue) => accumulator || minimatch(url.pathname, currentValue), isNotProtected);
+        if (isNotProtected)
+            return false;
+        let isProtected = false;
+        return this.loginProtectedApiEndpoints.reduce((accumulator, currentValue) => accumulator || minimatch(url.pathname, currentValue), isProtected);
+    }
+    /**
+     * Returns whether a page being visited as part of a request event is
+     * configured to be protected by 2FA.
+     *
+     * See {@link SvelteKitSessionServerOptions.factor2ProtectedPageEndpoints}.
+     *
+     * @param event the request event
+     * @returns true or false
+     */
+    isFactor2PageProtected(event) {
+        const url = new URL(typeof event == "string" ? event : event.request.url);
+        let isProtected = false;
+        return this.factor2ProtectedPageEndpoints.reduce((accumulator, currentValue) => accumulator || minimatch(url.pathname, currentValue), isProtected);
+        //return (this.loginProtectedPageEndpoints.includes(url.pathname));
+    }
+    /**
+     * Returns whether an API call is being visited as part of a request event is
+     * configured to be protected by 2FA.
+     *
+     * See {@link SvelteKitSessionServerOptions.factor2ProtectedApiEndpoints}.
+     *
+     * @param event the request event
+     * @returns true or false
+     */
+    isFactor2ApiProtected(event) {
+        const url = new URL(typeof event == "string" ? event : event.request.url);
+        //return (this.loginProtectedApiEndpoints.includes(url.pathname));
+        let isProtected = false;
+        return this.factor2ProtectedApiEndpoints.reduce((accumulator, currentValue) => accumulator || minimatch(url.pathname, currentValue), isProtected);
+    }
+    /**
+     * Returns whether a page being visited as part of a request event is
+     * configured to be protected as admin only.
+     *
+     * See {@link SvelteKitSessionServerOptions.adminPageEndpoints}.
+     *
+     * @param event the request event
+     * @returns true or false
+     */
+    isAdminPageEndpoint(event) {
+        const url = new URL(typeof event == "string" ? event : event.request.url);
+        //return (this.adminEndpoints.includes(url.pathname));
+        // return false for adminProtectedExceptionPageEndpoints
+        let isNotProtected = false;
+        isNotProtected = this.adminProtectedExceptionPageEndpoints.reduce((accumulator, currentValue) => accumulator || minimatch(url.pathname, currentValue), isNotProtected);
+        if (isNotProtected)
+            return false;
+        isNotProtected = this.loginProtectedExceptionPageEndpoints.reduce((accumulator, currentValue) => accumulator || minimatch(url.pathname, currentValue), isNotProtected);
+        if (isNotProtected)
+            return false;
+        let isAdmin = false;
+        return this.adminPageEndpoints.reduce((accumulator, currentValue) => accumulator || minimatch(url.pathname, currentValue), isAdmin);
+    }
+    /**
+     * Returns whether an AP call being visited as part of a request event is
+     * configured to be protected as admin only.
+     *
+     * See {@link SvelteKitSessionServerOptions.adminApiEndpoints}.
+     *
+     * @param event the request event
+     * @returns true or false
+     */
+    isAdminApiEndpoint(event) {
+        const url = new URL(typeof event == "string" ? event : event.request.url);
+        //return (this.adminEndpoints.includes(url.pathname));
+        // return false for adminProtectedExceptionApiEndpoints
+        let isNotProtected = false;
+        isNotProtected = this.adminProtectedExceptionApiEndpoints.reduce((accumulator, currentValue) => accumulator || minimatch(url.pathname, currentValue), isNotProtected);
+        if (isNotProtected)
+            return false;
+        isNotProtected = this.loginProtectedExceptionApiEndpoints.reduce((accumulator, currentValue) => accumulator || minimatch(url.pathname, currentValue), isNotProtected);
+        if (isNotProtected)
+            return false;
+        let isAdmin = false;
+        return this.adminApiEndpoints.reduce((accumulator, currentValue) => accumulator || minimatch(url.pathname, currentValue), isAdmin);
+    }
+    /**
+     * Creates an anonymous session, setting the `Set-Cookue` headers
+     * in the reply.
+     *
+     * An anonymous sessiin is a session cookie that is not associated
+     * with a user (`userid` is undefined).  It can be used to persist
+     * data between sessions just like a regular user session ID.
+     *
+     * @param event the SvelteKit reqzest event
+     * @param data session data to save
+     * @returns the session cookie value
+     */
+    async createAnonymousSession(event, data) {
+        CrossauthLogger.logger.debug(j({ msg: "Creating anonympous session ID  " }));
+        // get custom fields from implentor-provided function
+        const formData = new JsonOrFormData();
+        await formData.loadData(event);
+        let extraFields = this.addToSession ? this.addToSession(event, formData.toObject()) : {};
+        if (data)
+            extraFields.data = JSON.stringify(data);
+        // create session, setting the session cookie, CSRF cookie and CSRF token 
+        let { sessionCookie, csrfCookie, csrfFormOrHeaderValue } = await this.sessionManager.createAnonymousSession(extraFields);
+        event.cookies.set(sessionCookie.name, sessionCookie.value, toCookieSerializeOptions(sessionCookie.options));
+        if (this.enableCsrfProtection) {
+            event.locals.csrfToken = csrfFormOrHeaderValue;
+            event.cookies.set(csrfCookie.name, csrfCookie.value, toCookieSerializeOptions(csrfCookie.options));
+        }
+        event.locals.user = undefined;
+        const sessionId = this.sessionManager.getSessionId(sessionCookie.value);
+        event.locals.sessionId = sessionId;
+        return sessionCookie.value;
+    }
+    ;
+    /**
+     * Sets locals based on session and CSRF cookies.
+     *
+     * Sets things like `locals.user`.  You can call this if you need them
+     * updated based on cookie settings and a page load hasn't been done
+     * (ie the hooks haven't run).
+     *
+     * @param event the Sveltekit request event.
+     */
+    async refreshLocals(event) {
+        try {
+            const sessionCookieValue = this.getSessionCookieValue(event);
+            if (sessionCookieValue) {
+                const sessionId = this.sessionManager.getSessionId(sessionCookieValue);
+                event.locals.sessionId = sessionId;
+                const resp = await this.sessionManager.userForSessionId(sessionId);
+                event.locals.user = resp.user;
+            }
+            else {
+                event.locals.sessionId = undefined;
+                event.locals.user = undefined;
+            }
+        }
+        catch (e) {
+            CrossauthLogger.logger.error(j({ errr: e }));
+        }
+    }
+    ////////////////////////////////////////////////////////////////
+    // SessionAdapter interface
+    csrfProtectionEnabled() {
+        return this.enableCsrfProtection;
+    }
+    getCsrfToken(event) {
+        return event.locals.csrfToken;
+    }
+    getUser(event) {
+        return event.locals.user;
+    }
+    /**
+     * Returns the data stored along with the session server-side, with the
+     * given name
+     * @param event the Sveltekit request event
+     * @param name tjhe data name to return
+     * @returns an object or undefined.
+     */
+    async getSessionData(event, name) {
+        try {
+            const data = event.locals.sessionId ?
+                await this.sessionManager.dataForSessionId(event.locals.sessionId) :
+                undefined;
+            if (data && name in data)
+                return data[name];
+        }
+        catch (e) {
+            CrossauthLogger.logger.error(j({
+                msg: "Couldn't get " + name + "from session",
+                cerr: e
+            }));
+            CrossauthLogger.logger.debug(j({ err: e }));
+        }
+        return undefined;
+    }
+    /**
+     * Updates or sets the given field in the session `data` field.
+     *
+     * The `data` field in the session record is assumed to be JSON
+     *
+     * @param event the Sveltekit request event
+     * @param name the name of the field to set
+     * @param value the value to set it to.
+     */
+    async updateSessionData(event, name, value) {
+        if (!event.locals.sessionId)
+            throw new CrossauthError(ErrorCode.Unauthorized, "No session present");
+        await this.sessionManager.updateSessionData(event.locals.sessionId, name, value);
+    }
+    async updateManySessionData(event, dataArray) {
+        if (!event.locals.sessionId)
+            throw new CrossauthError(ErrorCode.Unauthorized, "No session present");
+        await this.sessionManager.updateManySessionData(event.locals.sessionId, dataArray);
+    }
+    /**
+     * Deletes the given field from the session `data` field.
+     *
+     * The `data` field in the session record is assumed to be JSON
+     *
+     * @param event the Sveltekit request event
+     * @param name the name of the field to set
+     */
+    async deleteSessionData(event, name) {
+        if (!event.locals.sessionId) {
+            CrossauthLogger.logger.debug(j({ msg: `Attempting to delete session data ${name} when no session is present` }));
+        }
+        else {
+            await this.sessionManager.deleteSessionData(event.locals.sessionId, name);
+        }
+    }
+}