@devmoods/express-extras 0.73.0 → 0.75.0

package/dist/auth/emailAndPassword.js

@@ -6,7 +6,7 @@ import {} from './types.js';
 import { Unauthorized } from '../errors.js';
 import { getLogger } from '../logger.js';
 import { jsonSchema } from '../validate.js';
-const passwordSchema = { type: 'string', minLength: 4 };
+const passwordSchema = { type: 'string', minLength: 8 };
 const emailSchema = { type: 'string', minLength: 4 };
 const logger = getLogger('auth');
 export function EmailAndPasswordAuthProvider(options) {
@@ -35,7 +35,7 @@ export function EmailAndPasswordAuthProvider(options) {
                 catch (error) {
                     logger.error(error);
                     await context.jitter(timer.getDuration());
-                    throw Unauthorized(error.message, { cause: error });
+                    throw Unauthorized('Invalid email or password', { cause: error });
                 }
             });
             router.post('/change-password', {
@@ -73,11 +73,18 @@ export function EmailAndPasswordAuthProvider(options) {
             }, async (req) => {
                 const { email } = req.body;
                 const timer = startTimer();
-                const user = await options.login(email, skipPasswordCheck);
-                const temporaryToken = await context.createTemporaryToken(user);
-                await options.onEmailVerificationRequest?.(user, temporaryToken);
-                await context.jitter(timer.getDuration());
-                return 202;
+                try {
+                    const user = await options.login(email, skipPasswordCheck);
+                    const temporaryToken = await context.createTemporaryToken(user);
+                    await options.onEmailVerificationRequest?.(user, temporaryToken);
+                    await context.jitter(timer.getDuration());
+                    return 202;
+                }
+                catch (error) {
+                    logger.error(error);
+                    await context.jitter(timer.getDuration());
+                    return 202;
+                }
             });
             router.post('/verify-email', {
                 request: jsonSchema({
@@ -93,7 +100,6 @@ export function EmailAndPasswordAuthProvider(options) {
                 }
                 catch (error) {
                     logger.warn('failed to verify token', {
-                        token,
                         user: context.filterUser(user),
                         error: error.message,
                     });

package/dist/auth/google-client.d.ts

@@ -0,0 +1,12 @@
+export declare function exchangeGoogleAuthorizationCode({ code, clientId, clientSecret, redirectUri, }: {
+    code: string;
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+}): Promise<{
+    id_token?: string | null;
+}>;
+export declare function verifyGoogleIdToken({ token, clientId, }: {
+    token: string;
+    clientId: string;
+}): Promise<import("jose").JWTPayload>;

package/dist/auth/google-client.js

@@ -0,0 +1,27 @@
+import { createFetch } from '@devmoods/fetch';
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+const fetch = createFetch();
+const googleJwks = createRemoteJWKSet(new URL('https://www.googleapis.com/oauth2/v3/certs'));
+export async function exchangeGoogleAuthorizationCode({ code, clientId, clientSecret, redirectUri, }) {
+    const response = await fetch('https://oauth2.googleapis.com/token', {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/x-www-form-urlencoded',
+        },
+        body: new URLSearchParams({
+            code,
+            client_id: clientId,
+            client_secret: clientSecret,
+            redirect_uri: redirectUri,
+            grant_type: 'authorization_code',
+        }),
+    });
+    return response.jsonData;
+}
+export async function verifyGoogleIdToken({ token, clientId, }) {
+    const { payload } = await jwtVerify(token, googleJwks, {
+        audience: clientId,
+        issuer: ['https://accounts.google.com', 'accounts.google.com'],
+    });
+    return payload;
+}

package/dist/auth/google.d.ts

@@ -7,7 +7,8 @@ interface GoogleAuthProviderOptions<UserModel = AnyUser> {
     clientId?: string;
     clientSecret?: string;
     redirectUri?: string;
+    hostedDomain?: string;
     getOrCreateUserFromUserIdentifier(userIdentifier: string, profile: GoogleProfile): Promise<UserModel>;
 }
-export declare function GoogleAuthProvider<UserModel extends AnyUser>({ clientId, clientSecret, redirectUri, getOrCreateUserFromUserIdentifier }: GoogleAuthProviderOptions<UserModel>): AuthProvider<UserModel>;
+export declare function GoogleAuthProvider<UserModel extends AnyUser>({ clientId, clientSecret, redirectUri, hostedDomain, getOrCreateUserFromUserIdentifier, }: GoogleAuthProviderOptions<UserModel>): AuthProvider<UserModel>;
 export {};

package/dist/auth/google.js

@@ -1,20 +1,20 @@
 import { config } from '@devmoods/config';
 import { type } from 'arktype';
-import { OAuth2Client } from 'google-auth-library';
-import { BadRequest, Unauthorized } from '../errors.js';
-import { getLogger } from '../logger.js';
+import { exchangeGoogleAuthorizationCode, verifyGoogleIdToken, } from './google-client.js';
 import { createTokenResponse } from './token.js';
 import {} from './types.js';
+import { BadRequest, Unauthorized } from '../errors.js';
+import { getLogger } from '../logger.js';
 const logger = getLogger('auth');
-export function GoogleAuthProvider({ clientId = config.GOOGLE_AUTH_CLIENT_ID, clientSecret = config.GOOGLE_AUTH_CLIENT_SECRET, redirectUri = `${config.PUBLIC_URL}/api/v1/auth/google/callback`, getOrCreateUserFromUserIdentifier, }) {
-    const client = new OAuth2Client({
-        clientId,
-        clientSecret,
-        redirectUri,
-    });
+export function GoogleAuthProvider({ clientId = config.GOOGLE_AUTH_CLIENT_ID, clientSecret = config.GOOGLE_AUTH_CLIENT_SECRET, redirectUri = `${config.PUBLIC_URL}/api/v1/auth/google/callback`, hostedDomain, getOrCreateUserFromUserIdentifier, }) {
     const verifyAuthorizationCode = async (inputCode) => {
         try {
-            const { tokens } = await client.getToken(inputCode);
+            const tokens = await exchangeGoogleAuthorizationCode({
+                code: inputCode,
+                clientId,
+                clientSecret,
+                redirectUri,
+            });
             return { idToken: tokens.id_token };
         }
         catch (e) {
@@ -23,15 +23,18 @@ export function GoogleAuthProvider({ clientId = config.GOOGLE_AUTH_CLIENT_ID, cl
         }
     };
     const verifyIdToken = async (token) => {
-        const ticket = await client.verifyIdToken({
-            idToken: token,
-            audience: clientId,
-        });
-        const payload = ticket.getPayload();
-        if (!payload) {
-            throw Unauthorized('Token from Google contains invalid payload');
+        try {
+            return await verifyGoogleIdToken({
+                token,
+                clientId,
+            });
+        }
+        catch (e) {
+            logger.error(e);
+            throw Unauthorized('Token from Google contains invalid payload', {
+                cause: e,
+            });
         }
-        return payload;
     };
     const requiredScopes = ['openid', 'email', 'profile'];
     return {
@@ -79,10 +82,20 @@ export function GoogleAuthProvider({ clientId = config.GOOGLE_AUTH_CLIENT_ID, cl
                     throw Unauthorized('Invalid id token');
                 }
                 const payload = await verifyIdToken(idToken);
-                logger.info('google payload', { payload });
-                const user = await getOrCreateUserFromUserIdentifier(payload?.sub, {
+                if (typeof payload.sub !== 'string' || payload.sub.length === 0) {
+                    throw Unauthorized('Token from Google is missing subject');
+                }
+                if (typeof payload.email !== 'string' ||
+                    payload.email_verified !== true) {
+                    throw Unauthorized('Token from Google contains unverified email');
+                }
+                if (hostedDomain &&
+                    (typeof payload.hd !== 'string' || payload.hd !== hostedDomain)) {
+                    throw Unauthorized('Token from Google contains invalid hosted domain');
+                }
+                const user = await getOrCreateUserFromUserIdentifier(payload.sub, {
                     email: payload.email,
-                    fullName: payload.name,
+                    fullName: typeof payload.name === 'string' ? payload.name : '',
                 });
                 const accessToken = await context.login(req, res, user);
                 logger.info('google-login', { email: user.email });

package/dist/auth/passwordless.d.ts

@@ -1,6 +1,6 @@
 import { type AnyUser, type AuthProvider } from './types.js';
 export interface PasswordlessAuthProviderOptions<UserModel = AnyUser> {
     getUserByEmail(email: string): Promise<UserModel | null>;
-    onLoginRequest(user: UserModel, temporaryToken: string, otp: string): Promise<void>;
+    onLoginRequest(user: UserModel, challengeId: string, temporaryToken: string, otp: string): Promise<void>;
 }
 export declare function PasswordlessAuthProvider<UserModel extends AnyUser>(options: PasswordlessAuthProviderOptions<UserModel>): AuthProvider<UserModel>;

package/dist/auth/passwordless.js

@@ -1,6 +1,8 @@
+import * as crypto from 'node:crypto';
 import { DoesNotExistError } from '@devmoods/postgres';
 import { createTokenResponse } from './token.js';
 import {} from './types.js';
+import { BadRequest } from '../errors.js';
 import { getLogger } from '../logger.js';
 import { jsonSchema } from '../validate.js';
 const logger = getLogger('auth');
@@ -25,20 +27,30 @@ export function PasswordlessAuthProvider(options) {
                     type: 'object',
                     properties: {
                         type: { type: 'string', enum: ['otp', 'token'] },
+                        challengeId: { type: 'string' },
                         otp: { type: 'string' },
                         token: { type: 'string' },
                     },
                     required: ['type'],
                 }),
             }, async (req, res) => {
-                const { token: temporaryToken, otp, type: tokenType } = req.body;
-                const verify = tokenType === 'otp'
-                    ? context.verifyOtp
-                    : context.verifyTemporaryToken;
-                const tokenValue = String(tokenType === 'otp' ? otp : temporaryToken);
-                const uid = await verify(tokenValue, null, false);
+                const { challengeId, token: temporaryToken, otp, type: tokenType, } = req.body;
+                if (tokenType === 'otp' && (!challengeId || !otp)) {
+                    throw BadRequest('OTP logins require challengeId and otp');
+                }
+                if (tokenType === 'token' && !temporaryToken) {
+                    throw BadRequest('Token logins require token');
+                }
+                const uid = tokenType === 'otp'
+                    ? await context.verifyOtp(String(challengeId), String(otp), null, false)
+                    : await context.verifyTemporaryToken(String(temporaryToken), null, false);
                 const user = await context.getUserById(uid);
-                await verify(tokenValue, user);
+                if (tokenType === 'otp') {
+                    await context.verifyOtp(String(challengeId), String(otp), user);
+                }
+                else {
+                    await context.verifyTemporaryToken(String(temporaryToken), user);
+                }
                 const accessToken = await context.login(req, res, user);
                 logger.info('passwordless login', { tokenType, uid: user.id });
                 if (req.accepts('html')) {
@@ -62,13 +74,13 @@ export function PasswordlessAuthProvider(options) {
                 const user = await getUserOrNull(email);
                 if (!user) {
                     logger.warn('passwordless: user not found', { email });
-                    return 202;
+                    return [202, { challengeId: crypto.randomUUID() }];
                 }
                 const token = await context.createTemporaryToken(user);
-                const otp = await context.createOtp(user);
-                await options.onLoginRequest(user, token, otp);
+                const { challengeId, otp } = await context.createOtp(user);
+                await options.onLoginRequest(user, challengeId, token, otp);
                 logger.info('passwordless login requested', { email });
-                return 202;
+                return [202, { challengeId }];
             });
         },
     };

package/dist/auth/token.d.ts

@@ -4,7 +4,7 @@ export declare const tokenSchema: ValidationSchema;
 export declare function createTokenResponse(accessToken: AccessToken): readonly [201, {
     readonly token: string;
 }, {
-    readonly 'Cache-Control': 'no-store';
+    readonly 'Cache-Control': "no-store";
 }];
 export type AccessToken = Awaited<ReturnType<typeof createAccessToken>>;
 /**
@@ -12,7 +12,7 @@ export type AccessToken = Awaited<ReturnType<typeof createAccessToken>>;
  */
 export declare function createAccessToken(payload: any, version?: string, secret?: string): Promise<{
     token: string;
-    tokenType: 'Bearer';
+    tokenType: "Bearer";
     expiresIn: number;
 }>;
 /**

package/dist/auth/token.js

@@ -1,7 +1,7 @@
+import { randomUUID } from 'node:crypto';
 import { config } from '@devmoods/config';
 import {} from 'express';
 import { SignJWT, jwtVerify } from 'jose';
-import { v4 } from 'uuid';
 import { InvalidToken } from './errors.js';
 import {} from '../validate.js';
 const ACCESS_TOKEN_COOKIE_NAME = 'access_token';
@@ -27,7 +27,7 @@ export function createTokenResponse(accessToken) {
 export async function createAccessToken(payload, version = '1', secret = config.AUTH_JWT_SECRET) {
     const expiresIn = config.AUTH_TOKEN_EXPIRES;
     const secretKey = new TextEncoder().encode(secret);
-    const token = await new SignJWT({ v: version, ...payload })
+    const token = await new SignJWT({ jti: randomUUID(), v: version, ...payload })
         .setProtectedHeader({ alg: 'HS256' })
         .setExpirationTime(`${expiresIn}s`)
         .setIssuedAt(new Date())
@@ -100,7 +100,7 @@ export function extractAccessTokenFromRequest(req) {
 export function setAccessTokenCookie(res, token) {
     const sameSite = config.AUTH_COOKIE_SAME_SITE;
     if (token == null) {
-        res.cookie(ACCESS_TOKEN_COOKIE_NAME, v4(), {
+        res.cookie(ACCESS_TOKEN_COOKIE_NAME, randomUUID(), {
             expires: new Date(1970, 0, 1),
             sameSite,
             secure: process.env.NODE_ENV === 'production',

package/dist/auth/tokenStorage.d.ts

@@ -1,5 +1,5 @@
-import { type RedisClient } from '../redis.js';
 import { TokenStorage } from './types.js';
+import { type RedisClient } from '../redis.js';
 export declare class RedisTokenStorage extends TokenStorage {
     redis: RedisClient;
     keyPrefix: string;

package/dist/auth/tokenStorage.js

@@ -1,6 +1,6 @@
 import { config } from '@devmoods/config';
-import {} from '../redis.js';
 import { TokenStorage } from './types.js';
+import {} from '../redis.js';
 export class RedisTokenStorage extends TokenStorage {
     redis;
     keyPrefix;

package/dist/auth/types.d.ts

@@ -31,6 +31,10 @@ export interface DecodedTemporaryToken {
     };
     signature: string;
 }
+export interface OtpChallenge {
+    challengeId: string;
+    otp: string;
+}
 export interface AuthProviderContext<UserModel extends AnyUser> {
     filterUser: AuthOptions<UserModel>['filterUser'];
     tokenStorage: AuthOptions<UserModel>['tokenStorage'];
@@ -38,8 +42,8 @@ export interface AuthProviderContext<UserModel extends AnyUser> {
     createTemporaryToken(user: UserModel | null): Promise<string>;
     verifyTemporaryToken(token: string, user: UserModel | null, consume?: boolean): Promise<string>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
-    createOtp(user: UserModel): Promise<string>;
-    verifyOtp(otp: string, user: UserModel | null, consume?: boolean): Promise<string>;
+    createOtp(user: UserModel): Promise<OtpChallenge>;
+    verifyOtp(challengeId: string, otp: string, user: UserModel | null, consume?: boolean): Promise<string>;
     middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
     login: (req: Request, res: Response, user: UserModel, isRefresh?: boolean) => Promise<AccessToken>;
     getUserById(id: string): Promise<UserModel>;

package/dist/auth.d.ts

@@ -1,5 +1,5 @@
 import { type RequestHandler, type Response, type Request, type Router } from 'express';
-import { type AnyUser, type AuthIsAllowedFn, type AuthMiddlewareOptions, type AuthOptions, type DecodedTemporaryToken } from './auth/types.js';
+import { type AnyUser, type AuthIsAllowedFn, type AuthMiddlewareOptions, type AuthOptions, type DecodedTemporaryToken, type OtpChallenge } from './auth/types.js';
 export * from './auth/types.js';
 export * from './auth/emailAndPassword.js';
 export * from './auth/passwordless.js';
@@ -15,9 +15,9 @@ export interface CreateAuth<UserModel extends AnyUser> {
     createTemporaryToken(user: UserModel | null): Promise<string>;
     verifyTemporaryToken(token: string, user: UserModel | null, consume?: boolean): Promise<string>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
-    createOtp(user: UserModel): Promise<string>;
-    verifyOtp(otp: string, user: UserModel | null, consume?: boolean): Promise<string>;
+    createOtp(user: UserModel): Promise<OtpChallenge>;
+    verifyOtp(challengeId: string, otp: string, user: UserModel | null, consume?: boolean): Promise<string>;
     logout: (req: Request, res: Response) => Promise<void>;
     setSessionTokenVersion: (version: string) => void;
 }
-export declare function createAuth<UserModel extends AnyUser>({ getUserById, filterUser, tokenStorage, providers, loginUrl, onUserLoggedIn, sessionTokenVersion: initialSessionTokenVersion }: AuthOptions<UserModel>): CreateAuth<UserModel>;
+export declare function createAuth<UserModel extends AnyUser>({ getUserById, filterUser, tokenStorage, providers, loginUrl, onUserLoggedIn, sessionTokenVersion: initialSessionTokenVersion, }: AuthOptions<UserModel>): CreateAuth<UserModel>;

package/dist/auth.js

@@ -17,14 +17,27 @@ export * from './auth/token.js';
 export * from './auth/google.js';
 export * from './auth/tokenStorage.js';
 const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex');
+const hashEquals = (left, right) => {
+    const leftBuffer = Buffer.from(left, 'hex');
+    const rightBuffer = Buffer.from(right, 'hex');
+    if (leftBuffer.length !== rightBuffer.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(leftBuffer, rightBuffer);
+};
 export function createAuth({ getUserById, filterUser, tokenStorage, providers, loginUrl = '/', onUserLoggedIn, sessionTokenVersion: initialSessionTokenVersion = '1', }) {
     let sessionTokenVersion = initialSessionTokenVersion;
     const useCurrentUser = () => useRequestContext('currentUser');
     const setCurrentUser = (user) => setRequestContext('currentUser', user);
     const login = async (req, res, user, isRefresh = false) => {
+        const previousToken = isRefresh ? extractAccessTokenFromRequest(req) : null;
+        const previousSessionId = previousToken ? sha256(previousToken) : null;
         const accessToken = await createAccessToken({ uid: user.id }, sessionTokenVersion);
         const sessionId = sha256(accessToken.token);
         await tokenStorage.set(sessionId, String(user.id), accessToken.expiresIn);
+        if (previousSessionId && previousSessionId !== sessionId) {
+            await tokenStorage.invalidate(previousSessionId);
+        }
         setAccessTokenCookie(res, accessToken.token);
         setCurrentUser(user);
         if (!isRefresh) {
@@ -161,7 +174,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                     if (req.accepts('html')) {
                         return res.redirect(loginUrl);
                     }
-                    return next(Unauthorized(`Invalid token: ${error.message}`, { cause: error }));
+                    return next(Unauthorized('Invalid token', { cause: error }));
                 }
                 /* v8 ignore next -- @preserve */
                 next(error);
@@ -171,6 +184,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
     function protect(isAuthorized) {
         return async function authorizationMiddleware(req, res, next) {
             try {
+                // oxlint-disable-next-line eslint-plugin-react-hooks/rules-of-hooks
                 const user = useCurrentUser();
                 if (!user) {
                     throw new InvalidToken('User not logged in');
@@ -202,22 +216,48 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
     }
     async function createOtp(user) {
         const otp = crypto.randomInt(100000, 999999).toString();
-        await tokenStorage.set(otp, String(user.id), config.AUTH_OTP_EXPIRES);
-        return otp;
+        const challengeId = crypto.randomUUID();
+        const otpHash = sha256(otp);
+        await tokenStorage.set(`otp:${challengeId}`, JSON.stringify({
+            uid: String(user.id),
+            otpHash,
+            attempts: 0,
+            maxAttempts: config.AUTH_OTP_MAX_ATTEMPTS,
+        }), config.AUTH_OTP_EXPIRES);
+        return { challengeId, otp };
     }
-    async function verifyOtp(otp, user, consume = true) {
-        const storedUid = await tokenStorage.get(otp);
-        if (!storedUid) {
+    async function verifyOtp(challengeId, otp, user, consume = true) {
+        const storedChallenge = await tokenStorage.get(`otp:${challengeId}`);
+        if (!storedChallenge) {
             throw new InvalidToken('Invalid OTP');
         }
-        /* c8 ignore next 3 */
-        if (user && storedUid !== user.id) {
+        let parsedChallenge;
+        try {
+            parsedChallenge = JSON.parse(storedChallenge);
+        }
+        catch (error) {
+            await tokenStorage.invalidate(`otp:${challengeId}`);
+            throw new InvalidToken('Invalid OTP', { cause: error });
+        }
+        if (user && parsedChallenge.uid !== String(user.id)) {
+            throw new InvalidToken('Invalid OTP');
+        }
+        const attemptedOtpHash = sha256(otp);
+        const matches = hashEquals(parsedChallenge.otpHash, attemptedOtpHash);
+        if (!matches) {
+            const attempts = parsedChallenge.attempts + 1;
+            if (attempts >= parsedChallenge.maxAttempts) {
+                await tokenStorage.invalidate(`otp:${challengeId}`);
+            }
+            else {
+                await tokenStorage.set(`otp:${challengeId}`, JSON.stringify({ ...parsedChallenge, attempts }), config.AUTH_OTP_EXPIRES);
+            }
             throw new InvalidToken('Invalid OTP');
         }
         if (consume) {
-            await tokenStorage.invalidate(otp);
+            await tokenStorage.invalidate(`otp:${challengeId}`);
         }
-        return storedUid;
+        return parsedChallenge.uid;
     }
     /**
      * Create a short-lived token tied to a user that can be

package/dist/cache.d.ts

@@ -3,16 +3,37 @@ export interface CacheOptions {
     key?: string;
     expiresMs?: number | null;
 }
-export interface CacheAdapter {
-    get(key: string): Promise<any>;
-    set(key: string, value: any, expires?: number | null | undefined): Promise<void>;
-    clear(key?: string): Promise<void>;
+export declare abstract class CacheAdapter {
+    abstract get(key: string): Promise<any>;
+    abstract set(key: string, value: any, expires?: number | null | undefined): Promise<void>;
+    abstract clear(key?: string): Promise<void>;
 }
 export interface RedisCacheAdapterOptions {
     keyPrefix?: string;
 }
+export interface MemoryCacheAdapterOptions {
+    maxSize?: number;
+}
+export declare class RedisCacheAdapter extends CacheAdapter {
+    redis: RedisClient;
+    keyPrefix: string;
+    constructor(redis: RedisClient, { keyPrefix, }?: RedisCacheAdapterOptions);
+    get(key: string): Promise<any>;
+    set(key: string, value: unknown, expires?: number | null): Promise<void>;
+    clear(key?: string): Promise<void>;
+    private withKeyPrefix;
+}
 export declare function createRedisCacheAdapter(redis: RedisClient, options?: RedisCacheAdapterOptions): CacheAdapter;
-export declare function createMemoryCacheAdapter(): CacheAdapter;
+export declare class MemoryCacheAdapter extends CacheAdapter {
+    #private;
+    maxSize?: number;
+    constructor({ maxSize }?: MemoryCacheAdapterOptions);
+    get(key: string): Promise<unknown>;
+    set(key: string, value: unknown, expires?: number): Promise<void>;
+    clear(key?: string): Promise<void>;
+    private evictLeastRecentlyUsedEntries;
+}
+export declare function createMemoryCacheAdapter(options?: MemoryCacheAdapterOptions): CacheAdapter;
 export type Cache = ReturnType<typeof createCache>;
 export declare function createCache(adapter: CacheAdapter): {
     set: (key: string, value: any, expires?: number | null | undefined) => Promise<void>;
@@ -21,7 +42,7 @@ export declare function createCache(adapter: CacheAdapter): {
     wrap: <T>(key: string, options: CacheOptions | number | null, fn: () => Promise<T>) => Promise<T>;
     decorate: <T, Arguments extends any[]>(options: CacheOptions | number | null, fn: (...args: Arguments) => T | Promise<T>) => {
         (...args: Arguments): Promise<T>;
-        clear: (...args: Arguments) => Promise<void>;
+        clear(...args: Arguments): Promise<void>;
     };
     hashKey: typeof hashKey;
 };