@dotpress/auth 1.3.1 → 2.0.0-alpha.0

package/dist/index.js

@@ -1,22 +1,1229 @@
-import bcrypt from 'bcryptjs';
-import cookieParser from 'cookie-parser';
-import { setSettings } from './lib/settings.js';
-import { registerHandlers } from './lib/handlers.js';
-import { attachAuthenticatedUser } from './lib/middleware.js';
-import { generateAccessToken, generateTokensForUser, generateRefreshToken, } from './lib/tokens.js';
-export const configurePlugin = (settings) => {
-    setSettings(settings);
-    return (plugin) => {
-        plugin.useBeforeRoutes((app) => {
-            if (settings.cookies?.enabled) {
-                app.use(cookieParser());
-            }
-            app.use(attachAuthenticatedUser);
-        });
-        registerHandlers(plugin);
+// src/context.ts
+import { declareContextKey } from "@dotpress/core";
+declareContextKey("user", "authPlugin");
+declareContextKey("auth", "authPlugin");
+
+// src/auth.ts
+import bcrypt from "bcryptjs";
+import {
+  CompactSign,
+  SignJWT,
+  calculateJwkThumbprint,
+  compactVerify,
+  decodeProtectedHeader,
+  errors,
+  exportJWK,
+  importPKCS8,
+  importSPKI,
+  jwtVerify
+} from "jose";
+
+// src/crypto.ts
+var toHex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+var sha256 = async (value) => toHex(
+  new Uint8Array(
+    await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value))
+  )
+);
+
+// src/csrf.ts
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+var hostOf = (url) => {
+  if (url === void 0) return void 0;
+  try {
+    return new URL(url).host;
+  } catch {
+    return void 0;
+  }
+};
+var isCookieAuthenticationAllowed = async (req, isTrustedOrigin) => {
+  if (SAFE_METHODS.has(req.method)) return true;
+  const origin = req.header("origin");
+  if (origin !== void 0 && await isTrustedOrigin(origin)) return true;
+  const site = req.header("sec-fetch-site");
+  if (site !== void 0) return site === "same-origin" || site === "none";
+  if (origin === void 0) return true;
+  const originHost = hostOf(origin);
+  return originHost !== void 0 && originHost === (req.header("host") ?? hostOf(req.url));
+};
+
+// src/rate-limit.ts
+var memoryRateLimitStore = (options = {}) => {
+  const maxKeys = options.maxKeys ?? 1e4;
+  if (!Number.isInteger(maxKeys) || maxKeys < 1) {
+    throw new RangeError("Invalid maxKeys: expected a positive integer.");
+  }
+  const counters = /* @__PURE__ */ new Map();
+  const makeRoom = (now) => {
+    if (counters.size < maxKeys) return;
+    for (const [key, state] of counters) {
+      if (state.resetAt.getTime() <= now) counters.delete(key);
+    }
+    for (const key of counters.keys()) {
+      if (counters.size < maxKeys) break;
+      counters.delete(key);
+    }
+  };
+  return {
+    async increment(key, windowSeconds) {
+      const now = Date.now();
+      const current = counters.get(key);
+      if (current && current.resetAt.getTime() > now) {
+        current.count += 1;
+        return { ...current };
+      }
+      counters.delete(key);
+      makeRoom(now);
+      const state = { count: 1, resetAt: new Date(now + windowSeconds * 1e3) };
+      counters.set(key, state);
+      return { ...state };
+    },
+    async reset(key) {
+      counters.delete(key);
+    }
+  };
+};
+
+// src/auth.ts
+var ALGORITHM = "RS256";
+var ACCESS_TOKEN_TYPE = "at+jwt";
+var DEFAULT_IDLE_TIMEOUT = 14 * 24 * 60 * 60;
+var AuthError = class extends Error {
+  constructor(code, options) {
+    super(code, options);
+    this.code = code;
+    this.name = "AuthError";
+  }
+  code;
+};
+var DEFAULT_COOKIE_SETTINGS = {
+  enabled: false,
+  httpOnly: true,
+  secure: true,
+  sameSite: "lax",
+  path: "/",
+  refreshTokenPath: "/auth",
+  refreshTokenSameSite: "strict",
+  trustedOrigins: [],
+  accessTokenName: "dotpress_access_token",
+  refreshTokenName: "dotpress_refresh_token",
+  accessTokenInCookie: false,
+  domain: void 0
+};
+var defaultUserRoles = (user) => {
+  const { roles, role } = user;
+  if (Array.isArray(roles)) {
+    return roles.filter((value) => typeof value === "string");
+  }
+  return typeof role === "string" ? [role] : [];
+};
+var checkSession = (session, name) => {
+  for (const key of ["idleTimeout", "absoluteTimeout"]) {
+    const value = session?.[key];
+    if (value !== void 0 && (!Number.isFinite(value) || value <= 0)) {
+      throw new RangeError(
+        `Invalid ${name}.${key}: expected a positive number of seconds.`
+      );
+    }
+  }
+};
+var DEFAULT_LOGIN_LIMITS = {
+  usernameAndIp: { max: 5, window: 60 },
+  username: { max: 100, window: 60 * 60 }
+};
+var resolveLoginThrottle = (input) => {
+  if (input === false) return void 0;
+  const limit = (name) => {
+    const value = input?.limits?.[name];
+    if (value === false) return void 0;
+    const resolved = value ?? DEFAULT_LOGIN_LIMITS[name];
+    if (!Number.isInteger(resolved.max) || resolved.max < 1 || !Number.isFinite(resolved.window) || resolved.window <= 0) {
+      throw new RangeError(
+        `Invalid loginThrottle.limits.${name}: expected a positive integer max and a positive window, in seconds.`
+      );
+    }
+    return { max: resolved.max, window: resolved.window };
+  };
+  const store = input?.store ?? memoryRateLimitStore();
+  if (typeof store.increment !== "function" || typeof store.reset !== "function") {
+    throw new TypeError(
+      "Invalid loginThrottle.store: expected increment() and reset() methods."
+    );
+  }
+  return {
+    store,
+    limits: {
+      usernameAndIp: limit("usernameAndIp"),
+      username: limit("username")
+    }
+  };
+};
+var resolveSettings = (settings) => {
+  if (!settings?.keys?.secretKey || !settings.keys.publicKey) {
+    throw new TypeError(
+      "createAuth() requires keys.secretKey and keys.publicKey."
+    );
+  }
+  if (!settings.dataProvider) {
+    throw new TypeError("createAuth() requires a dataProvider.");
+  }
+  if (typeof settings.issuer !== "string" || settings.issuer === "") {
+    throw new TypeError(
+      "createAuth() requires an issuer (iss claim), such as the URL of the API."
+    );
+  }
+  if (settings.audience !== void 0 && settings.audience === "") {
+    throw new TypeError("Invalid audience: expected a non-empty string.");
+  }
+  const clients = settings.clients;
+  if (clients && (!Array.isArray(clients.allowed) || clients.allowed.length === 0 || clients.allowed.some((id) => typeof id !== "string" || id === ""))) {
+    throw new TypeError(
+      "Invalid clients.allowed: expected a non-empty list of client identifiers."
+    );
+  }
+  const rounds = settings.passwordHashRounds;
+  if (rounds !== void 0 && (!Number.isInteger(rounds) || rounds < 4 || rounds > 31)) {
+    throw new RangeError(
+      "Invalid passwordHashRounds: expected an integer between 4 and 31."
+    );
+  }
+  if ("refreshTokenTTLInDays" in settings) {
+    throw new TypeError(
+      "refreshTokenTTLInDays is replaced by session.idleTimeout, in seconds."
+    );
+  }
+  for (const origin of settings.cookies?.trustedOrigins ?? []) {
+    let valid = false;
+    try {
+      valid = new URL(origin).origin === origin;
+    } catch {
+    }
+    if (!valid) {
+      throw new TypeError(
+        `Invalid cookies.trustedOrigins: "${origin}" is not an origin (expected a scheme and a host, such as https://app.example.com, without path or trailing slash).`
+      );
+    }
+  }
+  checkSession(settings.session, "session");
+  for (const [clientId, session] of Object.entries(clients?.sessions ?? {})) {
+    if (!clients?.allowed.includes(clientId)) {
+      throw new TypeError(
+        `Invalid clients.sessions: "${clientId}" is not in clients.allowed.`
+      );
+    }
+    checkSession(session, `clients.sessions.${clientId}`);
+  }
+  const reuseInterval = settings.refreshTokenReuseInterval;
+  if (reuseInterval !== void 0 && (!Number.isFinite(reuseInterval) || reuseInterval < 0)) {
+    throw new RangeError(
+      "Invalid refreshTokenReuseInterval: expected a non-negative number of seconds."
+    );
+  }
+  return {
+    keys: settings.keys,
+    dataProvider: settings.dataProvider,
+    accessTokenTTL: settings.accessTokenTTL ?? 900,
+    session: {
+      idleTimeout: settings.session?.idleTimeout ?? DEFAULT_IDLE_TIMEOUT,
+      absoluteTimeout: settings.session?.absoluteTimeout
+    },
+    issuer: settings.issuer,
+    audience: settings.audience ?? settings.issuer,
+    cookies: resolveCookies(settings.cookies),
+    clients: settings.clients,
+    onLoginFailed: settings.onLoginFailed,
+    onLoginSuccess: settings.onLoginSuccess,
+    loginThrottle: resolveLoginThrottle(settings.loginThrottle),
+    beforeLogin: settings.beforeLogin,
+    passwordHashRounds: settings.passwordHashRounds ?? 12,
+    usernameClaim: settings.usernameClaim ?? false,
+    refreshTokenReuseInterval: settings.refreshTokenReuseInterval ?? 10,
+    onRefreshTokenReuse: settings.onRefreshTokenReuse,
+    getUserRoles: settings.getUserRoles ?? defaultUserRoles
+  };
+};
+var cookieName = (setting, name, base, attributes) => {
+  const { secure, domain, path } = attributes;
+  const hostAllowed = secure && domain === void 0 && path === "/";
+  if (name === void 0) {
+    if (!secure) return base;
+    return hostAllowed ? `__Host-${base}` : `__Secure-${base}`;
+  }
+  const lowerName = name.toLowerCase();
+  if (lowerName.startsWith("__host-") && !hostAllowed) {
+    throw new TypeError(
+      `Invalid cookies.${setting}: a __Host- cookie must be secure, without domain, and with path "/".`
+    );
+  }
+  if (lowerName.startsWith("__secure-") && !secure) {
+    throw new TypeError(
+      `Invalid cookies.${setting}: a __Secure- cookie must be secure.`
+    );
+  }
+  return name;
+};
+var resolveCookies = (settings = {}) => {
+  const merged = { ...DEFAULT_COOKIE_SETTINGS };
+  for (const [key, value] of Object.entries(settings)) {
+    if (value !== void 0) Object.assign(merged, { [key]: value });
+  }
+  for (const key of ["path", "refreshTokenPath"]) {
+    if (!merged[key].startsWith("/")) {
+      throw new TypeError(
+        `Invalid cookies.${key}: expected a path starting with "/".`
+      );
+    }
+  }
+  const { secure, domain } = merged;
+  return {
+    ...merged,
+    refreshTokenSameSite: settings.refreshTokenSameSite ?? (settings.sameSite === "none" ? "none" : "strict"),
+    accessTokenName: cookieName(
+      "accessTokenName",
+      settings.accessTokenName,
+      "dotpress_access_token",
+      { secure, domain, path: merged.path }
+    ),
+    refreshTokenName: cookieName(
+      "refreshTokenName",
+      settings.refreshTokenName,
+      "dotpress_refresh_token",
+      { secure, domain, path: merged.refreshTokenPath }
+    )
+  };
+};
+var PKCS1_PUBLIC_KEY_ERROR = 'PKCS#1 keys ("BEGIN RSA PUBLIC KEY") are not supported, use SPKI ("BEGIN PUBLIC KEY"). Convert it with: openssl rsa -RSAPublicKey_in -in public.pem -pubout -out public.spki.pem';
+var loadKey = async (kind, load) => {
+  try {
+    return await load();
+  } catch (error) {
+    throw new TypeError(
+      `Invalid auth ${kind}: expected an RSA PEM key (${error.message}).`,
+      { cause: error }
+    );
+  }
+};
+var loadPublicKey = async (kind, pem, kid) => {
+  if (pem.includes("BEGIN RSA PUBLIC KEY")) {
+    throw new TypeError(`Invalid auth ${kind}: ${PKCS1_PUBLIC_KEY_ERROR}`);
+  }
+  const key = await loadKey(
+    kind,
+    () => importSPKI(pem, ALGORITHM, { extractable: true })
+  );
+  const { kty, n, e } = await exportJWK(key);
+  const jwk = { kty, n, e };
+  return { kid: kid ?? await calculateJwkThumbprint(jwk), key, jwk };
+};
+var importKeys = async ({
+  secretKey,
+  publicKey,
+  kid,
+  additionalPublicKeys = []
+}) => {
+  if (secretKey.includes("BEGIN RSA PRIVATE KEY")) {
+    throw new TypeError(
+      'Invalid auth secretKey: PKCS#1 keys ("BEGIN RSA PRIVATE KEY") are not supported, use PKCS#8 ("BEGIN PRIVATE KEY"). Convert it with: openssl pkcs8 -topk8 -nocrypt -in private.pem -out private.pkcs8.pem'
+    );
+  }
+  const privateKey = await loadKey(
+    "secretKey",
+    () => importPKCS8(secretKey, ALGORITHM)
+  );
+  const active = await loadPublicKey("publicKey", publicKey, kid);
+  try {
+    const probe = await new CompactSign(new Uint8Array([1])).setProtectedHeader({ alg: ALGORITHM }).sign(privateKey);
+    await compactVerify(probe, active.key);
+  } catch (error) {
+    throw new TypeError(
+      "Invalid auth keys: publicKey does not match secretKey.",
+      { cause: error }
+    );
+  }
+  const verificationKeys = [active];
+  for (const [index, entry] of additionalPublicKeys.entries()) {
+    const { publicKey: pem, kid: entryKid } = typeof entry === "string" ? { publicKey: entry, kid: void 0 } : entry;
+    const loaded = await loadPublicKey(
+      `additionalPublicKeys[${index}]`,
+      pem,
+      entryKid
+    );
+    const existing = verificationKeys.find((item) => item.kid === loaded.kid);
+    if (!existing) {
+      verificationKeys.push(loaded);
+    } else if (existing.jwk.n !== loaded.jwk.n || existing.jwk.e !== loaded.jwk.e) {
+      throw new TypeError(
+        `Invalid auth keys: kid "${loaded.kid}" is used by several keys.`
+      );
+    }
+  }
+  return { privateKey, kid: active.kid, verificationKeys };
+};
+var verifyWithKeys = async (token, verificationKeys, verify) => {
+  const { kid } = decodeProtectedHeader(token);
+  const candidates = kid === void 0 ? verificationKeys : verificationKeys.filter((item) => item.kid === kid);
+  if (candidates.length === 0) {
+    throw new errors.JWKSNoMatchingKey(`Unknown key id: ${String(kid)}`);
+  }
+  let lastError;
+  for (const candidate of candidates) {
+    try {
+      return await verify(candidate.key);
+    } catch (error) {
+      if (!(error instanceof errors.JWSSignatureVerificationFailed)) throw error;
+      lastError = error;
+    }
+  }
+  throw lastError;
+};
+var BCRYPT_HASH = /^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/;
+var nowInSeconds = () => Math.floor(Date.now() / 1e3);
+var toSession = (claims, roles) => {
+  if (typeof claims.sub !== "string" || claims.sub === "") {
+    throw new AuthError("INVALID_ACCESS_TOKEN");
+  }
+  return {
+    userId: claims.sub,
+    username: typeof claims.username === "string" ? claims.username : void 0,
+    tokenId: typeof claims.jti === "string" ? claims.jti : "",
+    sessionId: typeof claims.sid === "string" ? claims.sid : void 0,
+    clientId: typeof claims.client_id === "string" ? claims.client_id : void 0,
+    roles,
+    claims
+  };
+};
+var createAuth = (input) => {
+  const settings = resolveSettings(input);
+  let keys;
+  const getKeys = () => {
+    keys ??= importKeys(settings.keys).catch((error) => {
+      keys = void 0;
+      throw error;
+    });
+    return keys;
+  };
+  let dummyHash;
+  const getDummyHash = () => {
+    dummyHash ??= bcrypt.hash(
+      toHex(crypto.getRandomValues(new Uint8Array(16))),
+      settings.passwordHashRounds
+    );
+    return dummyHash;
+  };
+  const sessionPolicy = (clientId) => {
+    const override = clientId === void 0 ? void 0 : settings.clients?.sessions?.[clientId];
+    if (!override) return settings.session;
+    return {
+      idleTimeout: override.idleTimeout ?? settings.session.idleTimeout,
+      absoluteTimeout: "absoluteTimeout" in override ? override.absoluteTimeout : settings.session.absoluteTimeout
+    };
+  };
+  const sessionEnd = (authTime, clientId) => {
+    const { absoluteTimeout } = sessionPolicy(clientId);
+    return absoluteTimeout === void 0 ? void 0 : authTime + absoluteTimeout;
+  };
+  const signAccessToken = async (claims) => {
+    const { privateKey, kid } = await getKeys();
+    const jwtId = crypto.randomUUID();
+    const issuedAt = nowInSeconds();
+    const expiresAt = Math.min(
+      issuedAt + settings.accessTokenTTL,
+      sessionEnd(claims.auth_time, claims.client_id) ?? Infinity
+    );
+    const token = await new SignJWT({
+      // Personal data: written on demand only.
+      ...settings.usernameClaim && claims.username && { username: claims.username },
+      auth_time: claims.auth_time,
+      ...claims.sid !== void 0 && { sid: claims.sid },
+      ...claims.client_id !== void 0 && { client_id: claims.client_id }
+    }).setProtectedHeader({ alg: ALGORITHM, typ: ACCESS_TOKEN_TYPE, kid }).setSubject(claims.sub).setIssuer(settings.issuer).setAudience(settings.audience).setJti(jwtId).setIssuedAt(issuedAt).setExpirationTime(expiresAt).sign(privateKey);
+    return { jwtId, accessToken: token, expiresAt: new Date(expiresAt * 1e3) };
+  };
+  const generateRefreshToken = async () => {
+    const token = toHex(crypto.getRandomValues(new Uint8Array(128)));
+    return { token, tokenHash: await sha256(token) };
+  };
+  const issueTokens = async (claims, familyId) => {
+    const access = await signAccessToken({ ...claims, sid: familyId });
+    const refreshToken = await generateRefreshToken();
+    const end = sessionEnd(claims.auth_time, claims.client_id);
+    const refreshTokenExpiresAt = new Date(
+      Math.min(
+        Date.now() + sessionPolicy(claims.client_id).idleTimeout * 1e3,
+        end === void 0 ? Infinity : end * 1e3
+      )
+    );
+    await settings.dataProvider.storeRefreshToken({
+      ...refreshToken,
+      userId: claims.sub,
+      jwtId: access.jwtId,
+      familyId,
+      expiresAt: refreshTokenExpiresAt
+    });
+    return {
+      accessToken: access.accessToken,
+      refreshToken: refreshToken.token,
+      accessTokenExpiresAt: access.expiresAt,
+      refreshTokenExpiresAt,
+      sessionExpiresAt: end === void 0 ? void 0 : new Date(end * 1e3)
     };
+  };
+  const checkReuse = async (stored) => {
+    const usedAt = stored.usedAt?.getTime();
+    if (usedAt !== void 0 && Date.now() - usedAt < settings.refreshTokenReuseInterval * 1e3) {
+      return;
+    }
+    const familyId = stored.familyId ?? void 0;
+    if (familyId) {
+      await settings.dataProvider.revokeTokenFamily(familyId);
+    } else {
+      await settings.dataProvider.revokeTokens(stored.userId);
+    }
+    try {
+      await settings.onRefreshTokenReuse?.({
+        userId: stored.userId,
+        familyId,
+        jwtId: stored.jwtId
+      });
+    } catch {
+    }
+    throw new AuthError("REFRESH_TOKEN_REUSED");
+  };
+  const isClientAccepted = (clientId) => {
+    const { clients } = settings;
+    if (!clients) return true;
+    return clientId === void 0 ? !clients.required : clients.allowed.includes(clientId);
+  };
+  const sessionClaims = ({ userId, username, clientId }) => {
+    if (!isClientAccepted(clientId)) {
+      throw new TypeError(
+        clientId === void 0 ? "A clientId is required by the clients setting." : `Unknown client "${clientId}": add it to clients.allowed.`
+      );
+    }
+    return {
+      sub: userId,
+      username,
+      auth_time: nowInSeconds(),
+      client_id: clientId
+    };
+  };
+  const generateAccessToken = async (subject) => signAccessToken(sessionClaims(subject));
+  let routesPath;
+  let cors;
+  const isTrustedOrigin = (req) => (origin) => {
+    if (input.cookies?.trustedOrigins !== void 0 || !cors?.credentials) {
+      return settings.cookies.trustedOrigins.includes(origin);
+    }
+    return cors.isOriginAllowed(req);
+  };
+  const bindRoutesPath = (path) => {
+    if (typeof path !== "string" || !path.startsWith("/")) {
+      throw new TypeError(
+        `Invalid routesPath: expected a path starting with "/", received ${JSON.stringify(path)}.`
+      );
+    }
+    if (routesPath !== void 0 && routesPath !== path) {
+      throw new Error(
+        `This auth service already serves routes under "${routesPath}": create one auth service per app to serve them under "${path}".`
+      );
+    }
+    routesPath = path;
+    if (input.cookies?.refreshTokenPath === void 0) {
+      settings.cookies = resolveCookies({
+        ...input.cookies,
+        refreshTokenPath: path
+      });
+    }
+  };
+  const cookieOptions = () => {
+    const { httpOnly, secure, sameSite, path, domain } = settings.cookies;
+    return { httpOnly, secure, sameSite, path, domain };
+  };
+  return {
+    settings,
+    isCookieAuthenticationAllowed: (req) => isCookieAuthenticationAllowed(req, isTrustedOrigin(req)),
+    init: async (options = {}) => {
+      if (options.routesPath !== void 0) bindRoutesPath(options.routesPath);
+      if (options.cors !== void 0) cors = options.cors;
+      await Promise.all([getKeys(), getDummyHash()]);
+    },
+    generateAccessToken,
+    generateRefreshToken,
+    async generateTokensForUser(subject) {
+      return issueTokens(sessionClaims(subject), crypto.randomUUID());
+    },
+    async refreshTokens({ accessToken, refreshToken }) {
+      const { verificationKeys } = await getKeys();
+      let claims;
+      let legacy;
+      try {
+        const { payload, protectedHeader } = await verifyWithKeys(
+          accessToken,
+          verificationKeys,
+          (key) => compactVerify(accessToken, key, { algorithms: [ALGORITHM] })
+        );
+        claims = JSON.parse(new TextDecoder().decode(payload));
+        legacy = protectedHeader.typ !== ACCESS_TOKEN_TYPE;
+      } catch (error) {
+        throw new AuthError("INVALID_REFRESH_TOKEN", { cause: error });
+      }
+      const userId = typeof claims.sub === "string" ? claims.sub : "";
+      const clientId = typeof claims.client_id === "string" ? claims.client_id : (
+        // V1 tokens carried the client in `aud`.
+        legacy && typeof claims.aud === "string" && settings.clients?.allowed.includes(claims.aud) ? claims.aud : void 0
+      );
+      const refreshTokenHash = await sha256(refreshToken);
+      const stored = await settings.dataProvider.findRefreshToken(refreshTokenHash);
+      if (!userId || !stored || stored.userId !== userId || stored.jwtId !== claims.jti || stored.revokedAt || // Client removed from the configuration: the session ends.
+      !isClientAccepted(clientId)) {
+        throw new AuthError("INVALID_REFRESH_TOKEN");
+      }
+      if (stored.isUsed) await checkReuse(stored);
+      const claimedAuthTime = typeof claims.auth_time === "number" ? claims.auth_time : void 0;
+      if (claimedAuthTime === void 0 && sessionPolicy(clientId).absoluteTimeout !== void 0) {
+        throw new AuthError("EXPIRED_REFRESH_TOKEN");
+      }
+      const authTime = claimedAuthTime ?? nowInSeconds();
+      const end = sessionEnd(authTime, clientId);
+      if (stored.expiresAt.getTime() <= Date.now() || end !== void 0 && end * 1e3 <= Date.now()) {
+        throw new AuthError("EXPIRED_REFRESH_TOKEN");
+      }
+      const user = await settings.dataProvider.findUserById(userId);
+      if (!user) {
+        if (stored.familyId) {
+          await settings.dataProvider.revokeTokenFamily(stored.familyId);
+        } else {
+          await settings.dataProvider.revokeTokens(userId);
+        }
+        throw new AuthError("INVALID_REFRESH_TOKEN");
+      }
+      const issued = await issueTokens(
+        {
+          sub: userId,
+          username: typeof claims.username === "string" ? claims.username : void 0,
+          auth_time: authTime,
+          client_id: clientId
+        },
+        // Tokens stored without family start one, derived from the token
+        // so that concurrent rotations land in the same family.
+        stored.familyId || stored.jwtId
+      );
+      if (!stored.isUsed) {
+        await settings.dataProvider.markRefreshTokenAsUsed(
+          refreshTokenHash,
+          /* @__PURE__ */ new Date()
+        );
+      }
+      return { userId, user, ...issued };
+    },
+    async verifyAccessToken(accessToken) {
+      const { verificationKeys } = await getKeys();
+      try {
+        const { payload } = await verifyWithKeys(
+          accessToken,
+          verificationKeys,
+          (key) => jwtVerify(accessToken, key, {
+            algorithms: [ALGORITHM],
+            typ: ACCESS_TOKEN_TYPE,
+            issuer: settings.issuer,
+            audience: settings.audience
+          })
+        );
+        const session = toSession(payload, []);
+        if (!isClientAccepted(session.clientId)) {
+          throw new AuthError("INVALID_ACCESS_TOKEN");
+        }
+        const { isSessionRevoked } = settings.dataProvider;
+        if (session.sessionId !== void 0 && isSessionRevoked && await isSessionRevoked.call(
+          settings.dataProvider,
+          session.sessionId
+        )) {
+          throw new AuthError("SESSION_REVOKED");
+        }
+        return session;
+      } catch (error) {
+        if (error instanceof AuthError) throw error;
+        throw new AuthError("INVALID_ACCESS_TOKEN", { cause: error });
+      }
+    },
+    async revokeSession(refreshToken, { scope = "current" } = {}) {
+      const { dataProvider } = settings;
+      const stored = await dataProvider.findRefreshToken(
+        await sha256(refreshToken)
+      );
+      if (!stored) return void 0;
+      const sessionId = stored.familyId || void 0;
+      if (scope === "all") {
+        if (stored.revokedAt || stored.isUsed || stored.expiresAt.getTime() <= Date.now()) {
+          return void 0;
+        }
+        await dataProvider.revokeTokens(stored.userId);
+      } else if (sessionId) {
+        await dataProvider.revokeTokenFamily(sessionId);
+      } else {
+        await dataProvider.revokeTokens(stored.userId);
+      }
+      return { userId: stored.userId, sessionId };
+    },
+    async getJwks() {
+      const { verificationKeys } = await getKeys();
+      return {
+        keys: verificationKeys.map(({ kid, jwk }) => ({
+          ...jwk,
+          kid,
+          alg: ALGORITHM,
+          use: "sig"
+        }))
+      };
+    },
+    getSessionExpiresAt(session) {
+      const authTime = session.claims.auth_time;
+      if (typeof authTime !== "number") return void 0;
+      const end = sessionEnd(authTime, session.clientId);
+      return end === void 0 ? void 0 : new Date(end * 1e3);
+    },
+    getUserRoles: (user) => settings.getUserRoles(user),
+    setAuthCookies(res, tokens, expiresInSeconds) {
+      const cookies = settings.cookies;
+      if (!cookies.enabled) return;
+      const expiresAt = tokens.refreshTokenExpiresAt?.getTime();
+      const options = {
+        ...cookieOptions(),
+        maxAge: expiresInSeconds ?? (expiresAt === void 0 ? settings.session.idleTimeout : Math.max(0, Math.ceil((expiresAt - Date.now()) / 1e3)))
+      };
+      res.setCookie(cookies.refreshTokenName, tokens.refreshToken, {
+        ...options,
+        path: cookies.refreshTokenPath,
+        sameSite: cookies.refreshTokenSameSite
+      });
+      if (cookies.accessTokenInCookie) {
+        res.setCookie(cookies.accessTokenName, tokens.accessToken, options);
+      }
+    },
+    clearAuthCookies(res) {
+      const cookies = settings.cookies;
+      if (!cookies.enabled) return;
+      res.clearCookie(cookies.refreshTokenName, {
+        ...cookieOptions(),
+        path: cookies.refreshTokenPath
+      });
+      if (cookies.accessTokenInCookie) {
+        res.clearCookie(cookies.accessTokenName, cookieOptions());
+      }
+    },
+    hashPassword: (password, saltRounds = settings.passwordHashRounds) => generatePasswordHash(password, saltRounds),
+    passwordNeedsRehash: (passwordHash) => BCRYPT_HASH.test(passwordHash) && bcrypt.getRounds(passwordHash) !== settings.passwordHashRounds,
+    // No length check: the password was verified, and a longer V1 password
+    // is truncated the same way.
+    rehashPassword: (password) => bcrypt.hash(password, settings.passwordHashRounds),
+    async verifyPassword(password, passwordHash) {
+      if (typeof passwordHash === "string" && BCRYPT_HASH.test(passwordHash)) {
+        return bcrypt.compare(password, passwordHash);
+      }
+      await bcrypt.compare(password, await getDummyHash());
+      return false;
+    }
+  };
+};
+var MAX_PASSWORD_BYTES = 72;
+var isPasswordTooLong = (password) => bcrypt.truncates(password);
+var generatePasswordHash = async (password, saltRounds = 12) => {
+  if (isPasswordTooLong(password)) {
+    throw new RangeError(
+      `Password too long: bcrypt reads ${MAX_PASSWORD_BYTES} bytes at most (UTF-8). Check it with isPasswordTooLong().`
+    );
+  }
+  return bcrypt.hash(password, saltRounds);
+};
+
+// src/middlewares.ts
+import {
+  defineMiddleware,
+  forbiddenError,
+  unauthorizedError
+} from "@dotpress/core";
+var SECURED = { security: ["bearerAuth"] };
+var requireAuth = defineMiddleware(
+  (ctx) => ctx.user && ctx.auth ? void 0 : unauthorizedError(),
+  SECURED
+);
+var requireRole = (...roles) => {
+  if (roles.length === 0) {
+    throw new TypeError("requireRole() expects at least one role.");
+  }
+  return defineMiddleware((ctx) => {
+    if (!ctx.user || !ctx.auth) return unauthorizedError();
+    const granted = ctx.auth.roles;
+    return roles.some((role) => granted.includes(role)) ? void 0 : forbiddenError();
+  }, SECURED);
+};
+var requireClient = (...clientIds) => {
+  if (clientIds.length === 0) {
+    throw new TypeError("requireClient() expects at least one client.");
+  }
+  return defineMiddleware((ctx) => {
+    if (!ctx.user || !ctx.auth) return unauthorizedError();
+    const { clientId } = ctx.auth;
+    return clientId !== void 0 && clientIds.includes(clientId) ? void 0 : forbiddenError();
+  }, SECURED);
+};
+
+// src/plugin.ts
+import {
+  definePlugin,
+  forbiddenError as forbiddenError2,
+  internalError,
+  tooManyRequestsError,
+  unauthorizedError as unauthorizedError2
+} from "@dotpress/core";
+var AUTH_SECURITY_SCHEMES = {
+  bearerAuth: { type: "http", scheme: "bearer", bearerFormat: "JWT" }
+};
+var LOCAL_IPS = /* @__PURE__ */ new Set([
+  "127.0.0.1",
+  "localhost",
+  "::1",
+  "::ffff",
+  "::ffff:127.0.0.1"
+]);
+var clientIp = (req) => req.ip && !LOCAL_IPS.has(req.ip) ? req.ip : "";
+var BEARER = /^bearer +(\S+) *$/i;
+var bodyField = (body, key) => {
+  if (typeof body !== "object" || body === null) return void 0;
+  const value = body[key];
+  return typeof value === "string" && value !== "" ? value : void 0;
+};
+var findAccessToken = (req, cookies) => {
+  const bearer = BEARER.exec(req.header("authorization") ?? "");
+  if (bearer) return { token: bearer[1], source: "header" };
+  if (cookies.enabled && cookies.accessTokenInCookie) {
+    const cookie = req.cookies[cookies.accessTokenName];
+    if (cookie) return { token: cookie, source: "cookie" };
+  }
+  return void 0;
+};
+var extractAccessToken = (req, cookies) => findAccessToken(req, cookies)?.token;
+var loginThrottleKeys = async (throttle, username, ipAddress) => {
+  const normalized = username.trim().toLowerCase();
+  const { usernameAndIp, username: perUsername } = throttle.limits;
+  return {
+    usernameAndIp: usernameAndIp && {
+      key: `dotpress:login:username-ip:${await sha256(`${normalized}
+${ipAddress}`)}`,
+      limit: usernameAndIp
+    },
+    username: perUsername && {
+      key: `dotpress:login:username:${await sha256(normalized)}`,
+      limit: perUsername
+    }
+  };
+};
+var crossOriginError = () => forbiddenError2("CROSS_ORIGIN_REQUEST");
+var extractTokens = (req, body, cookies) => {
+  const cookieRefreshToken = req.cookies[cookies.refreshTokenName];
+  if (cookieRefreshToken) {
+    const accessToken2 = cookies.accessTokenInCookie ? req.cookies[cookies.accessTokenName] : bodyField(body, "accessToken");
+    return accessToken2 ? { accessToken: accessToken2, refreshToken: cookieRefreshToken, mode: "cookie" } : void 0;
+  }
+  const accessToken = bodyField(body, "accessToken");
+  const refreshToken = bodyField(body, "refreshToken");
+  return accessToken && refreshToken ? { accessToken, refreshToken, mode: "body" } : void 0;
+};
+var refreshErrorResponse = (error, fallback) => {
+  if (error instanceof AuthError) {
+    if (error.code === "EXPIRED_REFRESH_TOKEN") {
+      return unauthorizedError2("EXPIRED_REFRESH_TOKEN");
+    }
+    return unauthorizedError2("INVALID_REFRESH_TOKEN");
+  }
+  return internalError(fallback);
+};
+var registerRoutes = (group, auth) => {
+  const { settings } = auth;
+  const { dataProvider, cookies } = settings;
+  const expiration = (accessTokenExpiresAt, sessionExpiresAt) => ({
+    expiresIn: Math.max(
+      0,
+      Math.ceil((accessTokenExpiresAt.getTime() - Date.now()) / 1e3)
+    ),
+    expiresAt: accessTokenExpiresAt.toISOString(),
+    ...sessionExpiresAt && {
+      sessionExpiresAt: sessionExpiresAt.toISOString()
+    }
+  });
+  const issuedExpiration = (tokens) => expiration(tokens.accessTokenExpiresAt, tokens.sessionExpiresAt);
+  const bodyTokens = (tokens, inCookies) => {
+    if (!inCookies) {
+      return {
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken
+      };
+    }
+    return cookies.accessTokenInCookie ? {} : { accessToken: tokens.accessToken };
+  };
+  const { clients } = settings;
+  const loginFailed = async (event) => {
+    await settings.onLoginFailed?.(event);
+    return unauthorizedError2("INVALID_LOGIN");
+  };
+  const meta = { tags: ["auth"] };
+  const crossOrigin = "Cross-origin request in cookie mode (`CROSS_ORIGIN_REQUEST`, see cookies.trustedOrigins).";
+  group.defineRoute({
+    method: "post",
+    path: "/login",
+    meta: {
+      ...meta,
+      summary: "Log in with a username and a password",
+      responses: {
+        401: "Invalid credentials (`INVALID_LOGIN`).",
+        429: "Too many failed attempts (`TOO_MANY_LOGIN_ATTEMPTS`), with a `Retry-After` header."
+      }
+    },
+    schema: (z) => ({
+      body: z.object({
+        username: z.string(),
+        password: z.string(),
+        // One of the allowed clients when the clients setting is defined,
+        // otherwise any string, only reported in the login events.
+        clientId: !clients ? z.string().optional() : clients.required ? z.enum(clients.allowed) : z.enum(clients.allowed).optional(),
+        mode: z.enum(["body", "cookie"]).optional()
+      }),
+      response: z.object({
+        userId: z.string(),
+        accessToken: z.string().optional(),
+        refreshToken: z.string().optional(),
+        expiresIn: z.number(),
+        expiresAt: z.string(),
+        sessionExpiresAt: z.string().optional()
+      })
+    }),
+    handler: async ({ req, res, logger }) => {
+      const { username, password, clientId, mode } = req.body;
+      const event = {
+        username,
+        clientId: clientId ?? "",
+        ipAddress: clientIp(req)
+      };
+      const throttle = settings.loginThrottle;
+      const counters = throttle && await loginThrottleKeys(throttle, username, event.ipAddress);
+      if (throttle && counters) {
+        let retryAfter = 0;
+        for (const counter of [counters.usernameAndIp, counters.username]) {
+          if (!counter) continue;
+          const state = await throttle.store.increment(
+            counter.key,
+            counter.limit.window
+          );
+          if (state.count > counter.limit.max) {
+            retryAfter = Math.max(
+              retryAfter,
+              Math.ceil((state.resetAt.getTime() - Date.now()) / 1e3),
+              1
+            );
+          }
+        }
+        if (retryAfter > 0) {
+          await settings.onLoginFailed?.({
+            ...event,
+            errorType: "too_many_attempts"
+          });
+          res.setHeader("retry-after", String(retryAfter));
+          return tooManyRequestsError("TOO_MANY_LOGIN_ATTEMPTS");
+        }
+      }
+      const rejected = await settings.beforeLogin?.({ ...event, req });
+      if (rejected) return rejected;
+      const user = await dataProvider.findUserIdentifiers(username);
+      const passwordValid = await auth.verifyPassword(
+        password,
+        user?.passwordHash
+      );
+      if (!user) {
+        return loginFailed({ ...event, errorType: "invalid_username" });
+      }
+      if (!passwordValid) {
+        return loginFailed({ ...event, errorType: "invalid_password" });
+      }
+      if (clientId !== void 0 && clients?.isUserRoleAllowed && !clients.isUserRoleAllowed(user.role ?? "", clientId)) {
+        return loginFailed({ ...event, errorType: "invalid_role" });
+      }
+      const tokens = await auth.generateTokensForUser({
+        userId: user.userId,
+        username,
+        // Without clients setting, the clientId is only reported in the
+        // login events: an unchecked value is not written in the token.
+        clientId: clients ? clientId : void 0
+      });
+      if (throttle && counters?.usernameAndIp) {
+        await throttle.store.reset(counters.usernameAndIp.key);
+      }
+      await settings.onLoginSuccess?.({ ...event, userId: user.userId });
+      if (dataProvider.updatePasswordHash && user.passwordHash && auth.passwordNeedsRehash(user.passwordHash)) {
+        try {
+          await dataProvider.updatePasswordHash(
+            user.userId,
+            await auth.rehashPassword(password)
+          );
+        } catch (error) {
+          logger.warn(
+            error instanceof Error ? error : { error },
+            "Cannot update the password hash"
+          );
+        }
+      }
+      const inCookies = mode === "cookie" && cookies.enabled;
+      if (inCookies) auth.setAuthCookies(res, tokens);
+      return {
+        userId: user.userId,
+        ...bodyTokens(tokens, inCookies),
+        ...issuedExpiration(tokens)
+      };
+    }
+  });
+  group.defineRoute({
+    method: "post",
+    path: "/refresh",
+    meta: {
+      ...meta,
+      summary: "Rotate a token pair",
+      responses: {
+        401: "Missing, invalid, expired or reused tokens.",
+        403: crossOrigin
+      }
+    },
+    schema: (z) => ({
+      body: z.object({
+        accessToken: z.string().optional(),
+        refreshToken: z.string().optional()
+      }).optional(),
+      response: z.object({
+        userId: z.string(),
+        accessToken: z.string().optional(),
+        refreshToken: z.string().optional(),
+        expiresIn: z.number(),
+        expiresAt: z.string(),
+        sessionExpiresAt: z.string().optional()
+      })
+    }),
+    handler: async ({ req, res }) => {
+      const extracted = extractTokens(req, req.body, cookies);
+      if (!extracted) return unauthorizedError2("NO_TOKENS_PROVIDED");
+      if (extracted.mode === "cookie" && !await auth.isCookieAuthenticationAllowed(req)) {
+        return crossOriginError();
+      }
+      try {
+        const { userId, ...tokens } = await auth.refreshTokens(extracted);
+        const inCookies = extracted.mode === "cookie" && cookies.enabled;
+        if (inCookies) auth.setAuthCookies(res, tokens);
+        return {
+          userId,
+          ...bodyTokens(tokens, inCookies),
+          ...issuedExpiration(tokens)
+        };
+      } catch (error) {
+        return refreshErrorResponse(error, "Can not refresh tokens.");
+      }
+    }
+  });
+  group.defineRoute({
+    path: "/me",
+    meta: { ...meta, summary: "Authenticated user" },
+    middlewares: [requireAuth],
+    handler: ({ user }) => user
+  });
+  group.defineRoute({
+    method: "post",
+    path: "/restore",
+    meta: {
+      ...meta,
+      summary: "Restore a session from the auth cookies",
+      responses: {
+        401: "Missing or invalid auth cookies.",
+        403: crossOrigin
+      }
+    },
+    schema: (z) => ({
+      response: z.object({
+        userId: z.string(),
+        accessToken: z.string().optional(),
+        refreshToken: z.string().optional(),
+        expiresIn: z.number(),
+        expiresAt: z.string(),
+        sessionExpiresAt: z.string().optional(),
+        user: z.unknown()
+      })
+    }),
+    handler: async ({ req, res }) => {
+      if (!cookies.enabled) return unauthorizedError2("COOKIES_NOT_ENABLED");
+      if (!cookies.accessTokenInCookie) {
+        return unauthorizedError2("ACCESS_TOKEN_NOT_IN_COOKIE");
+      }
+      const refreshToken = req.cookies[cookies.refreshTokenName];
+      const accessToken = req.cookies[cookies.accessTokenName];
+      if (!refreshToken) return unauthorizedError2("NO_REFRESH_TOKEN");
+      if (!accessToken) return unauthorizedError2("NO_ACCESS_TOKEN");
+      if (!await auth.isCookieAuthenticationAllowed(req)) {
+        return crossOriginError();
+      }
+      try {
+        const session = await auth.verifyAccessToken(accessToken);
+        const { userId } = session;
+        const user = await dataProvider.findUserById(userId);
+        if (user) {
+          return {
+            userId,
+            ...expiration(
+              new Date(Number(session.claims.exp) * 1e3),
+              auth.getSessionExpiresAt(session)
+            ),
+            user
+          };
+        }
+      } catch {
+      }
+      try {
+        const { userId, user, ...tokens } = await auth.refreshTokens({
+          accessToken,
+          refreshToken
+        });
+        auth.setAuthCookies(res, tokens);
+        return { userId, ...issuedExpiration(tokens), user };
+      } catch (error) {
+        return refreshErrorResponse(error, "Cannot restore session.");
+      }
+    }
+  });
+  group.defineRoute({
+    method: "post",
+    path: "/logout",
+    meta: {
+      ...meta,
+      summary: "Revoke the current session, or every session of the user",
+      responses: {
+        401: '`scope: "all"` without a valid refresh token or access token.',
+        403: crossOrigin
+      }
+    },
+    schema: (z) => ({
+      body: z.object({
+        refreshToken: z.string().optional(),
+        scope: z.enum(["current", "all"]).optional()
+      }).optional()
+    }),
+    // The session is proven by the refresh token (cookie, then body), or
+    // by the access token: an expired access token does not prevent a
+    // logout.
+    handler: async ({ req, res, auth: session }) => {
+      const scope = req.body?.scope ?? "current";
+      const cookieRefreshToken = cookies.enabled ? req.cookies[cookies.refreshTokenName] : void 0;
+      if (cookieRefreshToken && !await auth.isCookieAuthenticationAllowed(req)) {
+        return crossOriginError();
+      }
+      const refreshToken = cookieRefreshToken || req.body?.refreshToken;
+      const revoked = refreshToken ? await auth.revokeSession(refreshToken, { scope }) : void 0;
+      if (!revoked && session) {
+        if (scope === "all") {
+          await dataProvider.revokeTokens(session.userId);
+        } else if (session.sessionId) {
+          await dataProvider.revokeTokenFamily(session.sessionId);
+        }
+      } else if (!revoked && scope === "all") {
+        return unauthorizedError2();
+      }
+      auth.clearAuthCookies(res);
+      return { success: true };
+    }
+  });
+};
+var normalizePrefix = (prefix) => `/${prefix.split("/").filter(Boolean).join("/")}`;
+var authPlugin = (auth, options = {}) => {
+  const prefix = options.prefix ?? "/auth";
+  return definePlugin({
+    name: "auth",
+    auth,
+    securitySchemes: AUTH_SECURITY_SCHEMES,
+    async setup(api) {
+      await auth.init({
+        ...options.routes === false ? {} : { routesPath: api.publicPath(normalizePrefix(prefix)) },
+        ...api.cors ? { cors: api.cors } : {}
+      });
+      api.decorateContext("user", () => void 0);
+      api.decorateContext("auth", () => void 0);
+      const rejectedTokens = /* @__PURE__ */ new WeakSet();
+      const authenticate = async (ctx) => {
+        const { cookies } = auth.settings;
+        const found = findAccessToken(ctx.req, cookies);
+        if (!found) return;
+        const { token } = found;
+        if (found.source === "cookie" && !await auth.isCookieAuthenticationAllowed(ctx.req)) {
+          ctx.logger.warn(
+            { origin: ctx.req.header("origin") },
+            "Access token cookie ignored: cross-origin request (see cookies.trustedOrigins)"
+          );
+          return;
+        }
+        try {
+          const session = await auth.verifyAccessToken(token);
+          const user = await auth.settings.dataProvider.findUserById(
+            session.userId
+          );
+          if (!user) {
+            if (found.source === "header") rejectedTokens.add(ctx);
+            return;
+          }
+          ctx.user = user;
+          ctx.auth = { ...session, roles: auth.getUserRoles(user) };
+        } catch (error) {
+          if (found.source === "header") rejectedTokens.add(ctx);
+          ctx.logger.warn(
+            error instanceof Error ? error : { error },
+            "Invalid access token"
+          );
+        }
+      };
+      api.addGlobalMiddleware(authenticate);
+      api.hooks.onResponse(({ response, ctx }) => {
+        if (response.status !== 401) return;
+        const has = Object.keys(response.headers).some(
+          (name) => name.toLowerCase() === "www-authenticate"
+        );
+        if (has) return;
+        return {
+          ...response,
+          headers: {
+            ...response.headers,
+            "www-authenticate": ctx && rejectedTokens.has(ctx) ? 'Bearer error="invalid_token"' : "Bearer"
+          }
+        };
+      });
+      if (options.jwks) {
+        api.addRoute({
+          path: "/.well-known/jwks.json",
+          meta: { tags: ["auth"], summary: "Public keys of the access tokens" },
+          handler: async ({ res }) => {
+            res.setHeader("cache-control", "public, max-age=300");
+            return auth.getJwks();
+          }
+        });
+      }
+      if (options.routes !== false) {
+        registerRoutes(api.addRouteGroup(prefix), auth);
+      }
+    }
+  });
 };
-export const generatePasswordHash = (password, salt = 10) => {
-    return bcrypt.hash(password, salt);
+export {
+  AUTH_SECURITY_SCHEMES,
+  AuthError,
+  MAX_PASSWORD_BYTES,
+  authPlugin,
+  createAuth,
+  extractAccessToken,
+  generatePasswordHash,
+  isPasswordTooLong,
+  memoryRateLimitStore,
+  requireAuth,
+  requireClient,
+  requireRole
 };
-export { generateAccessToken, generateRefreshToken, generateTokensForUser };
+//# sourceMappingURL=index.js.map