@eventuras/fides-auth 0.9.0 → 0.11.0

package/dist/session-cookies.js

@@ -0,0 +1,110 @@
+import { createLogger } from "./logger.js";
+import { createEncryptedJWT, decryptJWT } from "./utils.js";
+import { validateSessionJwt } from "./session-validation.js";
+import { decodeJwt } from "jose";
+//#region src/session-cookies.ts
+var logger = createLogger({ namespace: "fides-auth:session-cookies" });
+/**
+* True only when the access token is a JWT carrying an `exp` claim that is in the
+* past. Mirrors {@link validateSessionJwt}: an access token we can't decode (an
+* opaque token, or one without `exp`) has unknown expiry and must NOT be treated
+* as expired — otherwise opaque tokens would silently discard the whole session.
+*/
+function accessTokenIsExpired(accessToken) {
+	try {
+		const { exp } = decodeJwt(accessToken);
+		if (typeof exp !== "number") return false;
+		return exp - Date.now() / 1e3 <= 0;
+	} catch {
+		return false;
+	}
+}
+/**
+* Encrypts a session into the three cookie values, splitting the raw access and ID
+* tokens out.
+*
+* @param session - The session to encode.
+* @param secret - The encryption key as a hex string or Uint8Array (32 bytes for A256GCM).
+*/
+async function encodeSessionCookies(session, secret) {
+	const { tokens, ...rest } = session;
+	const accessToken = tokens?.accessToken;
+	const idToken = tokens?.idToken;
+	const coreSession = {
+		...rest,
+		tokens: tokens ? {
+			...tokens,
+			accessToken: void 0,
+			idToken: void 0
+		} : void 0
+	};
+	return {
+		session: await createEncryptedJWT(coreSession, secret),
+		accessToken: accessToken ? await createEncryptedJWT({ accessToken }, secret) : void 0,
+		idToken: idToken ? await createEncryptedJWT({ idToken }, secret) : void 0
+	};
+}
+/**
+* Decodes the cookie values back into a session, reattaching the access and ID tokens.
+*
+* Returns null when there is no session, the main value fails validation, or the
+* access token has expired — preserving the contract that an expired access token
+* means "no session". A corrupt access-token value is tolerated: the session is
+* returned without an access token rather than discarded.
+*
+* @param raw - The raw cookie values read from the store.
+* @param secret - The decryption key as a hex string or Uint8Array (32 bytes for A256GCM).
+*/
+async function decodeSessionCookies(raw, secret) {
+	if (!raw.session) return null;
+	const { status, session } = await validateSessionJwt(raw.session, secret);
+	if (status !== "VALID" || !session) {
+		logger.debug({ status }, "Session cookie did not validate");
+		return null;
+	}
+	if (raw.accessToken) try {
+		const payload = await decryptJWT(raw.accessToken, secret);
+		const accessToken = typeof payload.accessToken === "string" ? payload.accessToken : void 0;
+		if (accessToken) {
+			if (accessTokenIsExpired(accessToken)) {
+				logger.info("Access token has expired");
+				return null;
+			}
+			session.tokens = {
+				...session.tokens,
+				accessToken
+			};
+		}
+	} catch (error) {
+		logger.warn({ error }, "Failed to decode access-token cookie");
+	}
+	if (raw.idToken) {
+		const idToken = await decodeIdTokenCookie(raw.idToken, secret);
+		if (idToken) session.tokens = {
+			...session.tokens,
+			idToken
+		};
+	}
+	return session;
+}
+/**
+* Decrypts the ID-token cookie value on its own, independent of session validity.
+* Logout needs the hint precisely when the session has gone stale, so this must not
+* go through {@link decodeSessionCookies}.
+*
+* @param raw - The ID-token cookie value.
+* @param secret - The decryption key as a hex string or Uint8Array (32 bytes for A256GCM).
+*/
+async function decodeIdTokenCookie(raw, secret) {
+	try {
+		const payload = await decryptJWT(raw, secret);
+		return typeof payload.idToken === "string" ? payload.idToken : void 0;
+	} catch (error) {
+		logger.warn({ error }, "Failed to decode ID-token cookie");
+		return;
+	}
+}
+//#endregion
+export { decodeIdTokenCookie, decodeSessionCookies, encodeSessionCookies };
+
+//# sourceMappingURL=session-cookies.js.map

package/dist/session-cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cookies.js","names":[],"sources":["../src/session-cookies.ts"],"sourcesContent":["// session-cookies.ts\n//\n// Framework-agnostic encoding/decoding of a session into cookie *values*. This\n// module performs no I/O — it never reads or writes cookies. Framework adapters\n// (Next.js, React Router, …) own the actual cookie store and call these helpers\n// to split a session across two cookie values and to reassemble it again.\n//\n// The split: the large raw JWTs — the access token and the ID token (kept for\n// `id_token_hint` on logout) — each get their own encrypted value, everything else\n// goes in the main one, so no cookie has to carry two JWTs against the ~4KB limit.\n\nimport { decodeJwt } from 'jose';\n\nimport { createEncryptedJWT, decryptJWT } from './utils';\nimport { validateSessionJwt } from './session-validation';\nimport { createLogger } from './logger';\nimport { Session } from './types';\n\nconst logger = createLogger({ namespace: 'fides-auth:session-cookies' });\n\n/**\n * True only when the access token is a JWT carrying an `exp` claim that is in the\n * past. Mirrors {@link validateSessionJwt}: an access token we can't decode (an\n * opaque token, or one without `exp`) has unknown expiry and must NOT be treated\n * as expired — otherwise opaque tokens would silently discard the whole session.\n */\nfunction accessTokenIsExpired(accessToken: string): boolean {\n  try {\n    const { exp } = decodeJwt(accessToken);\n    if (typeof exp !== 'number') {\n      return false;\n    }\n    return exp - Date.now() / 1000 <= 0;\n  } catch {\n    return false;\n  }\n}\n\n/** Encrypted cookie values produced from a session. */\nexport interface EncodedSessionCookies {\n  /** Value for the main session cookie (everything except the raw access/ID tokens). */\n  session: string;\n  /**\n   * Value for the access-token cookie, or `undefined` when the session carries\n   * no access token. Adapters should delete the access-token cookie in that case.\n   */\n  accessToken?: string;\n  /** Value for the ID-token cookie, or `undefined` when the session carries none. */\n  idToken?: string;\n}\n\n/** Raw cookie values read from the store, before decoding. */\nexport interface RawSessionCookies {\n  /** The main session cookie value, or null if absent. */\n  session: string | null;\n  /** The access-token cookie value, or null if absent. */\n  accessToken: string | null;\n  /** The ID-token cookie value, or null if absent. */\n  idToken?: string | null;\n}\n\n/**\n * Encrypts a session into the three cookie values, splitting the raw access and ID\n * tokens out.\n *\n * @param session - The session to encode.\n * @param secret - The encryption key as a hex string or Uint8Array (32 bytes for A256GCM).\n */\nexport async function encodeSessionCookies(\n  session: Session,\n  secret: string | Uint8Array,\n): Promise<EncodedSessionCookies> {\n  const { tokens, ...rest } = session;\n  const accessToken = tokens?.accessToken;\n  const idToken = tokens?.idToken;\n\n  // Main value: the whole session minus the raw access and ID tokens (undefined\n  // keys are dropped during JWT serialization).\n  const coreSession: Session = {\n    ...rest,\n    tokens: tokens ? { ...tokens, accessToken: undefined, idToken: undefined } : undefined,\n  };\n\n  const main = await createEncryptedJWT(coreSession, secret);\n\n  return {\n    session: main,\n    accessToken: accessToken ? await createEncryptedJWT({ accessToken }, secret) : undefined,\n    idToken: idToken ? await createEncryptedJWT({ idToken }, secret) : undefined,\n  };\n}\n\n/**\n * Decodes the cookie values back into a session, reattaching the access and ID tokens.\n *\n * Returns null when there is no session, the main value fails validation, or the\n * access token has expired — preserving the contract that an expired access token\n * means \"no session\". A corrupt access-token value is tolerated: the session is\n * returned without an access token rather than discarded.\n *\n * @param raw - The raw cookie values read from the store.\n * @param secret - The decryption key as a hex string or Uint8Array (32 bytes for A256GCM).\n */\nexport async function decodeSessionCookies(\n  raw: RawSessionCookies,\n  secret: string | Uint8Array,\n): Promise<Session | null> {\n  if (!raw.session) {\n    return null;\n  }\n\n  const { status, session } = await validateSessionJwt(raw.session, secret);\n\n  // status === 'EXPIRED' only fires for legacy single-cookie sessions, where the\n  // access token still lives in the main value. Split sessions are checked below.\n  if (status !== 'VALID' || !session) {\n    logger.debug({ status }, 'Session cookie did not validate');\n    return null;\n  }\n\n  if (raw.accessToken) {\n    try {\n      const payload = await decryptJWT(raw.accessToken, secret);\n      const accessToken = typeof payload.accessToken === 'string' ? payload.accessToken : undefined;\n\n      if (accessToken) {\n        // Preserve the contract: a verifiably-expired access token means no\n        // session. Opaque/undecodable tokens are kept (unknown expiry).\n        if (accessTokenIsExpired(accessToken)) {\n          logger.info('Access token has expired');\n          return null;\n        }\n        session.tokens = { ...session.tokens, accessToken };\n      }\n    } catch (error) {\n      // A corrupt/forged access-token value shouldn't take down the session.\n      logger.warn({ error }, 'Failed to decode access-token cookie');\n    }\n  }\n\n  if (raw.idToken) {\n    const idToken = await decodeIdTokenCookie(raw.idToken, secret);\n    if (idToken) {\n      session.tokens = { ...session.tokens, idToken };\n    }\n  }\n\n  return session;\n}\n\n/**\n * Decrypts the ID-token cookie value on its own, independent of session validity.\n * Logout needs the hint precisely when the session has gone stale, so this must not\n * go through {@link decodeSessionCookies}.\n *\n * @param raw - The ID-token cookie value.\n * @param secret - The decryption key as a hex string or Uint8Array (32 bytes for A256GCM).\n */\nexport async function decodeIdTokenCookie(\n  raw: string,\n  secret: string | Uint8Array,\n): Promise<string | undefined> {\n  try {\n    const payload = await decryptJWT(raw, secret);\n    return typeof payload.idToken === 'string' ? payload.idToken : undefined;\n  } catch (error) {\n    logger.warn({ error }, 'Failed to decode ID-token cookie');\n    return undefined;\n  }\n}\n"],"mappings":";;;;;AAkBA,IAAM,SAAS,aAAa,EAAE,WAAW,6BAA6B,CAAC;;;;;;;AAQvE,SAAS,qBAAqB,aAA8B;CAC1D,IAAI;EACF,MAAM,EAAE,QAAQ,UAAU,WAAW;EACrC,IAAI,OAAO,QAAQ,UACjB,OAAO;EAET,OAAO,MAAM,KAAK,IAAI,IAAI,OAAQ;CACpC,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;AAgCA,eAAsB,qBACpB,SACA,QACgC;CAChC,MAAM,EAAE,QAAQ,GAAG,SAAS;CAC5B,MAAM,cAAc,QAAQ;CAC5B,MAAM,UAAU,QAAQ;CAIxB,MAAM,cAAuB;EAC3B,GAAG;EACH,QAAQ,SAAS;GAAE,GAAG;GAAQ,aAAa,KAAA;GAAW,SAAS,KAAA;EAAU,IAAI,KAAA;CAC/E;CAIA,OAAO;EACL,SAAS,MAHQ,mBAAmB,aAAa,MAAM;EAIvD,aAAa,cAAc,MAAM,mBAAmB,EAAE,YAAY,GAAG,MAAM,IAAI,KAAA;EAC/E,SAAS,UAAU,MAAM,mBAAmB,EAAE,QAAQ,GAAG,MAAM,IAAI,KAAA;CACrE;AACF;;;;;;;;;;;;AAaA,eAAsB,qBACpB,KACA,QACyB;CACzB,IAAI,CAAC,IAAI,SACP,OAAO;CAGT,MAAM,EAAE,QAAQ,YAAY,MAAM,mBAAmB,IAAI,SAAS,MAAM;CAIxE,IAAI,WAAW,WAAW,CAAC,SAAS;EAClC,OAAO,MAAM,EAAE,OAAO,GAAG,iCAAiC;EAC1D,OAAO;CACT;CAEA,IAAI,IAAI,aACN,IAAI;EACF,MAAM,UAAU,MAAM,WAAW,IAAI,aAAa,MAAM;EACxD,MAAM,cAAc,OAAO,QAAQ,gBAAgB,WAAW,QAAQ,cAAc,KAAA;EAEpF,IAAI,aAAa;GAGf,IAAI,qBAAqB,WAAW,GAAG;IACrC,OAAO,KAAK,0BAA0B;IACtC,OAAO;GACT;GACA,QAAQ,SAAS;IAAE,GAAG,QAAQ;IAAQ;GAAY;EACpD;CACF,SAAS,OAAO;EAEd,OAAO,KAAK,EAAE,MAAM,GAAG,sCAAsC;CAC/D;CAGF,IAAI,IAAI,SAAS;EACf,MAAM,UAAU,MAAM,oBAAoB,IAAI,SAAS,MAAM;EAC7D,IAAI,SACF,QAAQ,SAAS;GAAE,GAAG,QAAQ;GAAQ;EAAQ;CAElD;CAEA,OAAO;AACT;;;;;;;;;AAUA,eAAsB,oBACpB,KACA,QAC6B;CAC7B,IAAI;EACF,MAAM,UAAU,MAAM,WAAW,KAAK,MAAM;EAC5C,OAAO,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU,KAAA;CACjE,SAAS,OAAO;EACd,OAAO,KAAK,EAAE,MAAM,GAAG,kCAAkC;EACzD;CACF;AACF"}

package/dist/session-refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-refresh.d.ts","sourceRoot":"","sources":["../src/session-refresh.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAsB,MAAM,SAAS,CAAC;AAE1D,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIxD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,iBAAiB,OAAO,EACxB,QAAQ,WAAW,EACnB,UAAS,oBAAyB,KACjC,OAAO,CAAC,OAAO,GAAG,IAAI,CA8CxB,CAAC"}
+{"version":3,"file":"session-refresh.d.ts","sourceRoot":"","sources":["../src/session-refresh.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAsB,MAAM,SAAS,CAAC;AAE1D,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIxD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,iBAAiB,OAAO,EACxB,QAAQ,WAAW,EACnB,UAAS,oBAAyB,KACjC,OAAO,CAAC,OAAO,GAAG,IAAI,CAgDxB,CAAC"}

package/dist/session-refresh.js

@@ -26,7 +26,8 @@ var refreshSession = async (current_session, config, options = {}) => {
 				...current_session.tokens,
 				accessToken: newtokens.access_token,
 				accessTokenExpiresAt: newtokens.expires_in ? new Date(Date.now() + newtokens.expires_in * 1e3).toISOString() : void 0,
-				refreshToken: newtokens.refresh_token ?? current_session.tokens?.refreshToken
+				refreshToken: newtokens.refresh_token ?? current_session.tokens?.refreshToken,
+				idToken: newtokens.id_token ?? current_session.tokens?.idToken
 			}
 		};
 		logger.info({

package/dist/session-refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-refresh.js","names":[],"sources":["../src/session-refresh.ts"],"sourcesContent":["import { createLogger } from './logger';\nimport { OAuthConfig, refreshAccessToken } from \"./oauth\";\nimport { getOAuthErrorLogContext } from './oauth-logging';\nimport { CreateSessionOptions, Session } from \"./types\";\n\nconst logger = createLogger({ namespace: 'fides-auth:session-refresh' });\n\n/**\n * Refreshes an existing session by exchanging its refresh token for new tokens.\n *\n * @param current_session - The current session containing a refresh token\n * @param config - OAuth configuration for the identity provider\n * @param options - Optional session creation options\n * @returns The updated session with new tokens, or throws on failure\n * @throws Error if no refresh token is available or the token exchange fails\n */\nexport const refreshSession = async (\n  current_session: Session,\n  config: OAuthConfig,\n  options: CreateSessionOptions = {}\n): Promise<Session | null> => {\n  logger.debug('Starting session refresh');\n\n  if (!current_session.tokens?.refreshToken) {\n    logger.error('No refresh token available in session');\n    throw new Error('No refresh token available');\n  }\n\n  try {\n    const newtokens = await refreshAccessToken(config, current_session.tokens.refreshToken);\n\n    const updatedSession = {\n      ...current_session,\n      tokens: {\n        ...current_session.tokens,\n        accessToken: newtokens.access_token,\n        accessTokenExpiresAt: newtokens.expires_in\n          ? new Date(Date.now() + newtokens.expires_in * 1000).toISOString()\n          : undefined,\n        refreshToken: newtokens.refresh_token ?? current_session.tokens?.refreshToken,\n      },\n    };\n\n    logger.info({\n      hasNewAccessToken: !!updatedSession.tokens.accessToken,\n      hasNewRefreshToken: !!newtokens.refresh_token,\n      expiresIn: newtokens.expires_in,\n    }, 'Session refreshed successfully');\n\n    return updatedSession;\n  } catch (error) {\n    // Check if this is an expected invalid_grant error\n    const errorContext = getOAuthErrorLogContext(error);\n    const isInvalidGrant =\n      errorContext.code === 'OAUTH_RESPONSE_BODY_ERROR' && errorContext.error === 'invalid_grant';\n\n    if (isInvalidGrant) {\n      // Expected error during logout/session expiry - log at info level\n      logger.info('Session refresh failed - refresh token expired or invalid');\n    } else {\n      // Unexpected error - log at error level\n      logger.error({ error: errorContext }, 'Session refresh failed');\n    }\n\n    throw error;\n  }\n};\n\n"],"mappings":";;;;AAKA,IAAM,SAAS,aAAa,EAAE,WAAW,6BAA6B,CAAC;;;;;;;;;;AAWvE,IAAa,iBAAiB,OAC5B,iBACA,QACA,UAAgC,CAAC,MACL;CAC5B,OAAO,MAAM,0BAA0B;CAEvC,IAAI,CAAC,gBAAgB,QAAQ,cAAc;EACzC,OAAO,MAAM,uCAAuC;EACpD,MAAM,IAAI,MAAM,4BAA4B;CAC9C;CAEA,IAAI;EACF,MAAM,YAAY,MAAM,mBAAmB,QAAQ,gBAAgB,OAAO,YAAY;EAEtF,MAAM,iBAAiB;GACrB,GAAG;GACH,QAAQ;IACN,GAAG,gBAAgB;IACnB,aAAa,UAAU;IACvB,sBAAsB,UAAU,aAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,UAAU,aAAa,GAAI,EAAE,YAAY,IAC/D,KAAA;IACJ,cAAc,UAAU,iBAAiB,gBAAgB,QAAQ;GACnE;EACF;EAEA,OAAO,KAAK;GACV,mBAAmB,CAAC,CAAC,eAAe,OAAO;GAC3C,oBAAoB,CAAC,CAAC,UAAU;GAChC,WAAW,UAAU;EACvB,GAAG,gCAAgC;EAEnC,OAAO;CACT,SAAS,OAAO;EAEd,MAAM,eAAe,wBAAwB,KAAK;EAIlD,IAFE,aAAa,SAAS,+BAA+B,aAAa,UAAU,iBAI5E,OAAO,KAAK,2DAA2D;OAGvE,OAAO,MAAM,EAAE,OAAO,aAAa,GAAG,wBAAwB;EAGhE,MAAM;CACR;AACF"}
+{"version":3,"file":"session-refresh.js","names":[],"sources":["../src/session-refresh.ts"],"sourcesContent":["import { createLogger } from './logger';\nimport { OAuthConfig, refreshAccessToken } from \"./oauth\";\nimport { getOAuthErrorLogContext } from './oauth-logging';\nimport { CreateSessionOptions, Session } from \"./types\";\n\nconst logger = createLogger({ namespace: 'fides-auth:session-refresh' });\n\n/**\n * Refreshes an existing session by exchanging its refresh token for new tokens.\n *\n * @param current_session - The current session containing a refresh token\n * @param config - OAuth configuration for the identity provider\n * @param options - Optional session creation options\n * @returns The updated session with new tokens, or throws on failure\n * @throws Error if no refresh token is available or the token exchange fails\n */\nexport const refreshSession = async (\n  current_session: Session,\n  config: OAuthConfig,\n  options: CreateSessionOptions = {}\n): Promise<Session | null> => {\n  logger.debug('Starting session refresh');\n\n  if (!current_session.tokens?.refreshToken) {\n    logger.error('No refresh token available in session');\n    throw new Error('No refresh token available');\n  }\n\n  try {\n    const newtokens = await refreshAccessToken(config, current_session.tokens.refreshToken);\n\n    const updatedSession = {\n      ...current_session,\n      tokens: {\n        ...current_session.tokens,\n        accessToken: newtokens.access_token,\n        accessTokenExpiresAt: newtokens.expires_in\n          ? new Date(Date.now() + newtokens.expires_in * 1000).toISOString()\n          : undefined,\n        refreshToken: newtokens.refresh_token ?? current_session.tokens?.refreshToken,\n        // A refresh doesn't always return id_token, and a stale hint still works.\n        idToken: newtokens.id_token ?? current_session.tokens?.idToken,\n      },\n    };\n\n    logger.info({\n      hasNewAccessToken: !!updatedSession.tokens.accessToken,\n      hasNewRefreshToken: !!newtokens.refresh_token,\n      expiresIn: newtokens.expires_in,\n    }, 'Session refreshed successfully');\n\n    return updatedSession;\n  } catch (error) {\n    // Check if this is an expected invalid_grant error\n    const errorContext = getOAuthErrorLogContext(error);\n    const isInvalidGrant =\n      errorContext.code === 'OAUTH_RESPONSE_BODY_ERROR' && errorContext.error === 'invalid_grant';\n\n    if (isInvalidGrant) {\n      // Expected error during logout/session expiry - log at info level\n      logger.info('Session refresh failed - refresh token expired or invalid');\n    } else {\n      // Unexpected error - log at error level\n      logger.error({ error: errorContext }, 'Session refresh failed');\n    }\n\n    throw error;\n  }\n};\n\n"],"mappings":";;;;AAKA,IAAM,SAAS,aAAa,EAAE,WAAW,6BAA6B,CAAC;;;;;;;;;;AAWvE,IAAa,iBAAiB,OAC5B,iBACA,QACA,UAAgC,CAAC,MACL;CAC5B,OAAO,MAAM,0BAA0B;CAEvC,IAAI,CAAC,gBAAgB,QAAQ,cAAc;EACzC,OAAO,MAAM,uCAAuC;EACpD,MAAM,IAAI,MAAM,4BAA4B;CAC9C;CAEA,IAAI;EACF,MAAM,YAAY,MAAM,mBAAmB,QAAQ,gBAAgB,OAAO,YAAY;EAEtF,MAAM,iBAAiB;GACrB,GAAG;GACH,QAAQ;IACN,GAAG,gBAAgB;IACnB,aAAa,UAAU;IACvB,sBAAsB,UAAU,aAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,UAAU,aAAa,GAAI,CAAC,CAAC,YAAY,IAC/D,KAAA;IACJ,cAAc,UAAU,iBAAiB,gBAAgB,QAAQ;IAEjE,SAAS,UAAU,YAAY,gBAAgB,QAAQ;GACzD;EACF;EAEA,OAAO,KAAK;GACV,mBAAmB,CAAC,CAAC,eAAe,OAAO;GAC3C,oBAAoB,CAAC,CAAC,UAAU;GAChC,WAAW,UAAU;EACvB,GAAG,gCAAgC;EAEnC,OAAO;CACT,SAAS,OAAO;EAEd,MAAM,eAAe,wBAAwB,KAAK;EAIlD,IAFE,aAAa,SAAS,+BAA+B,aAAa,UAAU,iBAI5E,OAAO,KAAK,2DAA2D;OAGvE,OAAO,MAAM,EAAE,OAAO,aAAa,GAAG,wBAAwB;EAGhE,MAAM;CACR;AACF"}

package/dist/silent-login.js.map

@@ -1 +1 @@
-{"version":3,"file":"silent-login.js","names":[],"sources":["../src/silent-login.ts"],"sourcesContent":["/**\n * Silent login functionality for OAuth flows.\n *\n * Silent login (also called \"prompt=none\") attempts to authenticate the user\n * without any user interaction. This is useful for:\n * - Checking if a user has an active SSO session\n * - Refreshing authentication silently in the background\n * - Implementing \"keep me logged in\" features\n */\n\nimport * as openid from 'openid-client';\n\nimport { createLogger } from './logger';\nimport { OAuthConfig } from './oauth';\n\nconst logger = createLogger({ namespace: 'fides-auth:silent-login' });\n\nexport interface SilentLoginOptions {\n  /** Optional hint about the user's identity (e.g., email or user ID) */\n  loginHint?: string;\n  /** Maximum age of authentication in seconds */\n  maxAge?: number;\n  /** Additional parameters to pass to the authorization endpoint */\n  additionalParams?: Record<string, string>;\n}\n\nexport interface SilentLoginResult {\n  /** Whether silent login was successful */\n  success: boolean;\n  /** The authorization URL to use (only if success is true) */\n  authorizationUrl?: URL;\n  /** Error message if silent login failed */\n  error?: string;\n  /** Detailed error description from OAuth provider */\n  errorDescription?: string;\n}\n\n/**\n * Builds an authorization URL for silent authentication.\n *\n * This function creates an authorization URL with prompt=none,\n * which tells the OAuth provider to authenticate without user interaction.\n * If the user doesn't have an active session, the provider will return an error.\n *\n * @param config - OAuth configuration\n * @param options - Silent login options\n * @returns Authorization URL for silent authentication\n *\n * @example\n * ```ts\n * const silentAuthUrl = await buildSilentLoginUrl(oauthConfig, {\n *   loginHint: 'user@example.com',\n *   maxAge: 3600, // Require authentication within last hour\n * });\n *\n * // Use this URL in an iframe or hidden window\n * ```\n */\nexport async function buildSilentLoginUrl(\n  config: OAuthConfig,\n  options: SilentLoginOptions = {}\n): Promise<URL> {\n  logger.debug({ issuer: config.issuer }, 'Building silent login URL');\n\n  try {\n    const server = await openid.discovery(\n      new URL(config.issuer),\n      config.clientId,\n      config.clientSecret,\n      openid.ClientSecretPost(config.clientSecret)\n    );\n\n    const parameters: Record<string, string> = {\n      redirect_uri: config.redirect_uri,\n      scope: config.scope,\n      prompt: 'none', // Critical: tells provider to not show any UI\n      response_type: 'code',\n      ...options.additionalParams,\n    };\n\n    // Add optional parameters\n    if (options.loginHint) {\n      parameters.login_hint = options.loginHint;\n    }\n\n    if (options.maxAge !== undefined) {\n      parameters.max_age = options.maxAge.toString();\n    }\n\n    const authUrl = openid.buildAuthorizationUrl(server, parameters);\n\n    logger.info('Silent login URL built successfully');\n    return authUrl;\n  } catch (error) {\n    logger.error({ error, issuer: config.issuer }, 'Failed to build silent login URL');\n    throw error;\n  }\n}\n\n/**\n * Checks if silent login is possible by examining the callback URL.\n *\n * After redirecting to the silent login URL, the OAuth provider will redirect back\n * with either a code (success) or an error (failure). This function parses the\n * callback URL to determine the result.\n *\n * @param callbackUrl - The URL the OAuth provider redirected to\n * @returns Result indicating success or failure with details\n *\n * @example\n * ```ts\n * // In your OAuth callback handler\n * const result = checkSilentLoginResult(new URL(request.url));\n *\n * if (result.success) {\n *   // User has active SSO session, proceed with token exchange\n *   const code = new URL(request.url).searchParams.get('code');\n *   // ... exchange code for tokens\n * } else if (result.error === 'login_required') {\n *   // User needs to log in interactively\n *   redirect('/login');\n * } else {\n *   // Other error\n *   console.error(result.errorDescription);\n * }\n * ```\n */\nexport function checkSilentLoginResult(callbackUrl: URL): SilentLoginResult {\n  const error = callbackUrl.searchParams.get('error');\n  const errorDescription = callbackUrl.searchParams.get('error_description');\n  const code = callbackUrl.searchParams.get('code');\n\n  if (error) {\n    logger.info({ error, errorDescription }, 'Silent login failed with error');\n\n    return {\n      success: false,\n      error,\n      errorDescription: errorDescription ?? undefined,\n    };\n  }\n\n  if (code) {\n    logger.info('Silent login successful');\n    return {\n      success: true,\n    };\n  }\n\n  logger.warn('Silent login callback missing both code and error');\n  return {\n    success: false,\n    error: 'invalid_callback',\n    errorDescription: 'Callback URL missing both code and error parameters',\n  };\n}\n\n/**\n * Common OAuth errors returned from silent login attempts.\n *\n * These can be used to handle specific error cases:\n * - login_required: User must log in interactively\n * - interaction_required: User interaction is needed (e.g., consent)\n * - consent_required: User must grant consent\n * - account_selection_required: User must select an account\n */\nexport const SilentLoginErrors = {\n  LOGIN_REQUIRED: 'login_required',\n  INTERACTION_REQUIRED: 'interaction_required',\n  CONSENT_REQUIRED: 'consent_required',\n  ACCOUNT_SELECTION_REQUIRED: 'account_selection_required',\n} as const;\n\nexport type SilentLoginError = typeof SilentLoginErrors[keyof typeof SilentLoginErrors];\n\n/**\n * Helper to check if an error requires interactive login.\n *\n * @param error - The error code from the OAuth provider\n * @returns True if the user must log in interactively\n *\n * @example\n * ```ts\n * const result = checkSilentLoginResult(callbackUrl);\n * if (!result.success && requiresInteractiveLogin(result.error)) {\n *   // Redirect to full login page\n *   redirect('/login');\n * }\n * ```\n */\nexport function requiresInteractiveLogin(error: string | undefined): boolean {\n  if (!error) return false;\n\n  return Object.values(SilentLoginErrors).includes(error as SilentLoginError);\n}\n"],"mappings":";;;;;;;;;;;;AAeA,IAAM,SAAS,aAAa,EAAE,WAAW,0BAA0B,CAAC;;;;;;;;;;;;;;;;;;;;;;AA2CpE,eAAsB,oBACpB,QACA,UAA8B,CAAC,GACjB;CACd,OAAO,MAAM,EAAE,QAAQ,OAAO,OAAO,GAAG,2BAA2B;CAEnE,IAAI;EACF,MAAM,SAAS,MAAM,OAAO,UAC1B,IAAI,IAAI,OAAO,MAAM,GACrB,OAAO,UACP,OAAO,cACP,OAAO,iBAAiB,OAAO,YAAY,CAC7C;EAEA,MAAM,aAAqC;GACzC,cAAc,OAAO;GACrB,OAAO,OAAO;GACd,QAAQ;GACR,eAAe;GACf,GAAG,QAAQ;EACb;EAGA,IAAI,QAAQ,WACV,WAAW,aAAa,QAAQ;EAGlC,IAAI,QAAQ,WAAW,KAAA,GACrB,WAAW,UAAU,QAAQ,OAAO,SAAS;EAG/C,MAAM,UAAU,OAAO,sBAAsB,QAAQ,UAAU;EAE/D,OAAO,KAAK,qCAAqC;EACjD,OAAO;CACT,SAAS,OAAO;EACd,OAAO,MAAM;GAAE;GAAO,QAAQ,OAAO;EAAO,GAAG,kCAAkC;EACjF,MAAM;CACR;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,uBAAuB,aAAqC;CAC1E,MAAM,QAAQ,YAAY,aAAa,IAAI,OAAO;CAClD,MAAM,mBAAmB,YAAY,aAAa,IAAI,mBAAmB;CACzE,MAAM,OAAO,YAAY,aAAa,IAAI,MAAM;CAEhD,IAAI,OAAO;EACT,OAAO,KAAK;GAAE;GAAO;EAAiB,GAAG,gCAAgC;EAEzE,OAAO;GACL,SAAS;GACT;GACA,kBAAkB,oBAAoB,KAAA;EACxC;CACF;CAEA,IAAI,MAAM;EACR,OAAO,KAAK,yBAAyB;EACrC,OAAO,EACL,SAAS,KACX;CACF;CAEA,OAAO,KAAK,mDAAmD;CAC/D,OAAO;EACL,SAAS;EACT,OAAO;EACP,kBAAkB;CACpB;AACF;;;;;;;;;;AAWA,IAAa,oBAAoB;CAC/B,gBAAgB;CAChB,sBAAsB;CACtB,kBAAkB;CAClB,4BAA4B;AAC9B;;;;;;;;;;;;;;;;AAmBA,SAAgB,yBAAyB,OAAoC;CAC3E,IAAI,CAAC,OAAO,OAAO;CAEnB,OAAO,OAAO,OAAO,iBAAiB,EAAE,SAAS,KAAyB;AAC5E"}
+{"version":3,"file":"silent-login.js","names":[],"sources":["../src/silent-login.ts"],"sourcesContent":["/**\n * Silent login functionality for OAuth flows.\n *\n * Silent login (also called \"prompt=none\") attempts to authenticate the user\n * without any user interaction. This is useful for:\n * - Checking if a user has an active SSO session\n * - Refreshing authentication silently in the background\n * - Implementing \"keep me logged in\" features\n */\n\nimport * as openid from 'openid-client';\n\nimport { createLogger } from './logger';\nimport { OAuthConfig } from './oauth';\n\nconst logger = createLogger({ namespace: 'fides-auth:silent-login' });\n\nexport interface SilentLoginOptions {\n  /** Optional hint about the user's identity (e.g., email or user ID) */\n  loginHint?: string;\n  /** Maximum age of authentication in seconds */\n  maxAge?: number;\n  /** Additional parameters to pass to the authorization endpoint */\n  additionalParams?: Record<string, string>;\n}\n\nexport interface SilentLoginResult {\n  /** Whether silent login was successful */\n  success: boolean;\n  /** The authorization URL to use (only if success is true) */\n  authorizationUrl?: URL;\n  /** Error message if silent login failed */\n  error?: string;\n  /** Detailed error description from OAuth provider */\n  errorDescription?: string;\n}\n\n/**\n * Builds an authorization URL for silent authentication.\n *\n * This function creates an authorization URL with prompt=none,\n * which tells the OAuth provider to authenticate without user interaction.\n * If the user doesn't have an active session, the provider will return an error.\n *\n * @param config - OAuth configuration\n * @param options - Silent login options\n * @returns Authorization URL for silent authentication\n *\n * @example\n * ```ts\n * const silentAuthUrl = await buildSilentLoginUrl(oauthConfig, {\n *   loginHint: 'user@example.com',\n *   maxAge: 3600, // Require authentication within last hour\n * });\n *\n * // Use this URL in an iframe or hidden window\n * ```\n */\nexport async function buildSilentLoginUrl(\n  config: OAuthConfig,\n  options: SilentLoginOptions = {}\n): Promise<URL> {\n  logger.debug({ issuer: config.issuer }, 'Building silent login URL');\n\n  try {\n    const server = await openid.discovery(\n      new URL(config.issuer),\n      config.clientId,\n      config.clientSecret,\n      openid.ClientSecretPost(config.clientSecret)\n    );\n\n    const parameters: Record<string, string> = {\n      redirect_uri: config.redirect_uri,\n      scope: config.scope,\n      prompt: 'none', // Critical: tells provider to not show any UI\n      response_type: 'code',\n      ...options.additionalParams,\n    };\n\n    // Add optional parameters\n    if (options.loginHint) {\n      parameters.login_hint = options.loginHint;\n    }\n\n    if (options.maxAge !== undefined) {\n      parameters.max_age = options.maxAge.toString();\n    }\n\n    const authUrl = openid.buildAuthorizationUrl(server, parameters);\n\n    logger.info('Silent login URL built successfully');\n    return authUrl;\n  } catch (error) {\n    logger.error({ error, issuer: config.issuer }, 'Failed to build silent login URL');\n    throw error;\n  }\n}\n\n/**\n * Checks if silent login is possible by examining the callback URL.\n *\n * After redirecting to the silent login URL, the OAuth provider will redirect back\n * with either a code (success) or an error (failure). This function parses the\n * callback URL to determine the result.\n *\n * @param callbackUrl - The URL the OAuth provider redirected to\n * @returns Result indicating success or failure with details\n *\n * @example\n * ```ts\n * // In your OAuth callback handler\n * const result = checkSilentLoginResult(new URL(request.url));\n *\n * if (result.success) {\n *   // User has active SSO session, proceed with token exchange\n *   const code = new URL(request.url).searchParams.get('code');\n *   // ... exchange code for tokens\n * } else if (result.error === 'login_required') {\n *   // User needs to log in interactively\n *   redirect('/login');\n * } else {\n *   // Other error\n *   console.error(result.errorDescription);\n * }\n * ```\n */\nexport function checkSilentLoginResult(callbackUrl: URL): SilentLoginResult {\n  const error = callbackUrl.searchParams.get('error');\n  const errorDescription = callbackUrl.searchParams.get('error_description');\n  const code = callbackUrl.searchParams.get('code');\n\n  if (error) {\n    logger.info({ error, errorDescription }, 'Silent login failed with error');\n\n    return {\n      success: false,\n      error,\n      errorDescription: errorDescription ?? undefined,\n    };\n  }\n\n  if (code) {\n    logger.info('Silent login successful');\n    return {\n      success: true,\n    };\n  }\n\n  logger.warn('Silent login callback missing both code and error');\n  return {\n    success: false,\n    error: 'invalid_callback',\n    errorDescription: 'Callback URL missing both code and error parameters',\n  };\n}\n\n/**\n * Common OAuth errors returned from silent login attempts.\n *\n * These can be used to handle specific error cases:\n * - login_required: User must log in interactively\n * - interaction_required: User interaction is needed (e.g., consent)\n * - consent_required: User must grant consent\n * - account_selection_required: User must select an account\n */\nexport const SilentLoginErrors = {\n  LOGIN_REQUIRED: 'login_required',\n  INTERACTION_REQUIRED: 'interaction_required',\n  CONSENT_REQUIRED: 'consent_required',\n  ACCOUNT_SELECTION_REQUIRED: 'account_selection_required',\n} as const;\n\nexport type SilentLoginError = typeof SilentLoginErrors[keyof typeof SilentLoginErrors];\n\n/**\n * Helper to check if an error requires interactive login.\n *\n * @param error - The error code from the OAuth provider\n * @returns True if the user must log in interactively\n *\n * @example\n * ```ts\n * const result = checkSilentLoginResult(callbackUrl);\n * if (!result.success && requiresInteractiveLogin(result.error)) {\n *   // Redirect to full login page\n *   redirect('/login');\n * }\n * ```\n */\nexport function requiresInteractiveLogin(error: string | undefined): boolean {\n  if (!error) return false;\n\n  return Object.values(SilentLoginErrors).includes(error as SilentLoginError);\n}\n"],"mappings":";;;;;;;;;;;;AAeA,IAAM,SAAS,aAAa,EAAE,WAAW,0BAA0B,CAAC;;;;;;;;;;;;;;;;;;;;;;AA2CpE,eAAsB,oBACpB,QACA,UAA8B,CAAC,GACjB;CACd,OAAO,MAAM,EAAE,QAAQ,OAAO,OAAO,GAAG,2BAA2B;CAEnE,IAAI;EACF,MAAM,SAAS,MAAM,OAAO,UAC1B,IAAI,IAAI,OAAO,MAAM,GACrB,OAAO,UACP,OAAO,cACP,OAAO,iBAAiB,OAAO,YAAY,CAC7C;EAEA,MAAM,aAAqC;GACzC,cAAc,OAAO;GACrB,OAAO,OAAO;GACd,QAAQ;GACR,eAAe;GACf,GAAG,QAAQ;EACb;EAGA,IAAI,QAAQ,WACV,WAAW,aAAa,QAAQ;EAGlC,IAAI,QAAQ,WAAW,KAAA,GACrB,WAAW,UAAU,QAAQ,OAAO,SAAS;EAG/C,MAAM,UAAU,OAAO,sBAAsB,QAAQ,UAAU;EAE/D,OAAO,KAAK,qCAAqC;EACjD,OAAO;CACT,SAAS,OAAO;EACd,OAAO,MAAM;GAAE;GAAO,QAAQ,OAAO;EAAO,GAAG,kCAAkC;EACjF,MAAM;CACR;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,uBAAuB,aAAqC;CAC1E,MAAM,QAAQ,YAAY,aAAa,IAAI,OAAO;CAClD,MAAM,mBAAmB,YAAY,aAAa,IAAI,mBAAmB;CACzE,MAAM,OAAO,YAAY,aAAa,IAAI,MAAM;CAEhD,IAAI,OAAO;EACT,OAAO,KAAK;GAAE;GAAO;EAAiB,GAAG,gCAAgC;EAEzE,OAAO;GACL,SAAS;GACT;GACA,kBAAkB,oBAAoB,KAAA;EACxC;CACF;CAEA,IAAI,MAAM;EACR,OAAO,KAAK,yBAAyB;EACrC,OAAO,EACL,SAAS,KACX;CACF;CAEA,OAAO,KAAK,mDAAmD;CAC/D,OAAO;EACL,SAAS;EACT,OAAO;EACP,kBAAkB;CACpB;AACF;;;;;;;;;;AAWA,IAAa,oBAAoB;CAC/B,gBAAgB;CAChB,sBAAsB;CACtB,kBAAkB;CAClB,4BAA4B;AAC9B;;;;;;;;;;;;;;;;AAmBA,SAAgB,yBAAyB,OAAoC;CAC3E,IAAI,CAAC,OAAO,OAAO;CAEnB,OAAO,OAAO,OAAO,iBAAiB,CAAC,CAAC,SAAS,KAAyB;AAC5E"}

package/dist/types.d.ts

@@ -6,6 +6,11 @@ export interface Tokens {
     refreshToken?: string;
     /** ISO 8601 string — see {@link accessTokenExpiresAt}. */
     refreshTokenExpiresAt?: string;
+    /**
+     * Raw (encoded) ID token, sent as `id_token_hint` on RP-initiated logout. Rides
+     * in the access-token cookie, not the main one — see `session-cookies.ts`.
+     */
+    idToken?: string;
 }
 /** Authenticated user session with tokens, user info, and optional custom data. */
 export interface Session<TData = Record<string, unknown>> {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,MAAM,WAAW,MAAM;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,mFAAmF;AACnF,MAAM,WAAW,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,KAAK,CAAC;CACd;AAED,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,MAAM,WAAW,MAAM;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,mFAAmF;AACnF,MAAM,WAAW,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,KAAK,CAAC;CACd;AAED,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/utils.d.ts

@@ -1,4 +1,5 @@
 import { Session } from './types';
+import * as jose from 'jose';
 /**
  * Converts a hex string to a Uint8Array.
  *
@@ -14,6 +15,17 @@ export declare function hexToUint8Array(hex: string): Uint8Array;
  * @returns A promise that resolves to the encrypted JWT as a string.
  */
 export declare function createEncryptedJWT(payload: unknown, secret: string | Uint8Array): Promise<string>;
+/**
+ * Decrypts a JWE produced by {@link createEncryptedJWT} and returns its payload.
+ *
+ * Counterpart to {@link createEncryptedJWT}. Throws if the token cannot be
+ * decrypted (wrong key, tampering, or malformed input).
+ *
+ * @param encryptedJwt - The encrypted JWT string.
+ * @param secret - The decryption key as a hex string or Uint8Array (32 bytes for A256GCM).
+ * @returns A promise that resolves to the decrypted JWT payload.
+ */
+export declare function decryptJWT(encryptedJwt: string, secret: string | Uint8Array): Promise<jose.JWTPayload>;
 /**
  * Encrypts the given text using AES-GCM via the Web Crypto API.
  * Returns a string in the format: iv:authTag:ciphertext, all in hex.

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAYvD;AAaD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GAAG,UAAU,GAC1B,OAAO,CAAC,MAAM,CAAC,CAKjB;AAGD;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCxF;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA4CxF;AAcD;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvE;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,IAAI,UAAU,CAKvD;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI/C;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAAW,GAAG,MAAM,CAI9D;AAGD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAC7B,aAAa,MAAM,EACnB,UAAS,MAAW,KACnB,OAsBF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjE"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAG7B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAYvD;AAaD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GAAG,UAAU,GAC1B,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAC9B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GAAG,UAAU,GAC1B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAG1B;AAGD;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCxF;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA4CxF;AAcD;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvE;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,IAAI,UAAU,CAKvD;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI/C;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAAW,GAAG,MAAM,CAI9D;AAGD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAC7B,aAAa,MAAM,EACnB,UAAS,MAAW,KACnB,OAsBF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjE"}

package/dist/utils.js

@@ -37,6 +37,20 @@ async function createEncryptedJWT(payload, secret) {
 	}).setIssuedAt().encrypt(normalizeSecret(secret));
 }
 /**
+* Decrypts a JWE produced by {@link createEncryptedJWT} and returns its payload.
+*
+* Counterpart to {@link createEncryptedJWT}. Throws if the token cannot be
+* decrypted (wrong key, tampering, or malformed input).
+*
+* @param encryptedJwt - The encrypted JWT string.
+* @param secret - The decryption key as a hex string or Uint8Array (32 bytes for A256GCM).
+* @returns A promise that resolves to the decrypted JWT payload.
+*/
+async function decryptJWT(encryptedJwt, secret) {
+	const { payload } = await jose.jwtDecrypt(encryptedJwt, normalizeSecret(secret));
+	return payload;
+}
+/**
 * Encrypts the given text using AES-GCM via the Web Crypto API.
 * Returns a string in the format: iv:authTag:ciphertext, all in hex.
 *
@@ -47,7 +61,7 @@ async function createEncryptedJWT(payload, secret) {
 async function encrypt(text, secret) {
 	const keyData = normalizeSecret(secret);
 	const key = await crypto.subtle.importKey("raw", keyData, { name: "AES-GCM" }, false, ["encrypt"]);
-	const iv = crypto.getRandomValues(new Uint8Array(12));
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
 	const data = new TextEncoder().encode(text);
 	const encryptedBuffer = await crypto.subtle.encrypt({
 		name: "AES-GCM",
@@ -191,6 +205,6 @@ function hasScope(session, scope) {
 	return session.scopes?.includes(scope) ?? false;
 }
 //#endregion
-export { accessTokenExpires, createEncryptedJWT, decrypt, encrypt, generateToken, getSessionSecret, getSessionSecretUint8Array, hasScope, hexToUint8Array, sha256, sha512, toHex };
+export { accessTokenExpires, createEncryptedJWT, decrypt, decryptJWT, encrypt, generateToken, getSessionSecret, getSessionSecretUint8Array, hasScope, hexToUint8Array, sha256, sha512, toHex };
 
 //# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import * as jose from 'jose';\n\nimport { createLogger } from './logger';\nimport type { Session } from './types';\n\nconst logger = createLogger({ namespace: 'fides-auth:utils' });\n\n\n/**\n * Converts a hex string to a Uint8Array.\n *\n * @param hex - A hexadecimal string.\n * @returns A Uint8Array representing the bytes of the hex string.\n */\nexport function hexToUint8Array(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) {\n    throw new Error('Invalid hex string: odd length');\n  }\n  if (hex.length > 0 && !/^[0-9a-fA-F]+$/.test(hex)) {\n    throw new Error('Invalid hex string: contains non-hex characters');\n  }\n  const arr = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < arr.length; i++) {\n    arr[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  }\n  return arr;\n}\n\n/**\n * Normalizes a secret to a Uint8Array.\n * Accepts either a hex-encoded string or an existing Uint8Array.\n */\nfunction normalizeSecret(secret: string | Uint8Array): Uint8Array {\n  if (typeof secret === 'string') {\n    return hexToUint8Array(secret);\n  }\n  return secret;\n}\n\n/**\n * Encrypts a payload into a JWT using the specified secret.\n *\n * @param payload - The payload to encrypt (can be any JSON-serializable value)\n * @param secret - The encryption key as a hex string or Uint8Array (32 bytes for A256GCM)\n * @returns A promise that resolves to the encrypted JWT as a string.\n */\nexport async function createEncryptedJWT(\n  payload: unknown,\n  secret: string | Uint8Array,\n): Promise<string> {\n  return new jose.EncryptJWT(payload as jose.JWTPayload)\n    .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })\n    .setIssuedAt()\n    .encrypt(normalizeSecret(secret));\n}\n\n\n/**\n * Encrypts the given text using AES-GCM via the Web Crypto API.\n * Returns a string in the format: iv:authTag:ciphertext, all in hex.\n *\n * @param text - The plaintext to encrypt.\n * @param secret - The encryption key as a hex string or Uint8Array (32 bytes for AES-256).\n * @returns A promise that resolves to the encrypted string.\n */\nexport async function encrypt(text: string, secret: string | Uint8Array): Promise<string> {\n  const keyData = normalizeSecret(secret);\n\n  // Import the key for AES-GCM encryption.\n  const key = await crypto.subtle.importKey(\n    'raw',\n    keyData as BufferSource,\n    { name: 'AES-GCM' },\n    false,\n    ['encrypt']\n  );\n\n  // Generate a 12-byte IV using the Web Crypto API.\n  const iv = crypto.getRandomValues(new Uint8Array(12));\n\n  // Encode the plaintext into a Uint8Array.\n  const encoder = new TextEncoder();\n  const data = encoder.encode(text);\n\n  // Encrypt the data using AES-GCM.\n  // Note: The Web Crypto API combines the ciphertext and authentication tag in the output.\n  const encryptedBuffer = await crypto.subtle.encrypt(\n    { name: 'AES-GCM', iv, tagLength: 128 },\n    key,\n    data\n  );\n\n  // Convert the encrypted data to a Uint8Array for separation.\n  const encryptedArray = new Uint8Array(encryptedBuffer);\n  const tagLength = 16; // AES-GCM uses a 128-bit (16-byte) tag.\n  const ciphertext = encryptedArray.slice(0, encryptedArray.length - tagLength);\n  const authTag = encryptedArray.slice(encryptedArray.length - tagLength);\n\n  return [toHex(iv), toHex(authTag), toHex(ciphertext)].join(':');\n}\n\n/**\n * Decrypts data encrypted with AES-256-GCM (using the Web Crypto API).\n * The input is expected to be in the format: iv:authTag:ciphertext (all hex-encoded).\n *\n * @param data - The encrypted data string.\n * @param secret - The decryption key as a hex string or Uint8Array (32 bytes for AES-256).\n * @returns A promise that resolves to the decrypted plaintext.\n */\nexport async function decrypt(data: string, secret: string | Uint8Array): Promise<string> {\n\n  // Split the incoming data. We expect exactly three parts.\n  const [ivHex, tagHex, ciphertextHex] = data.split(':');\n  if (!ivHex || !tagHex || !ciphertextHex) {\n    throw new Error('Invalid encrypted data format');\n  }\n\n  // Convert each hex-encoded part to a Uint8Array\n  const iv = hexToUint8Array(ivHex);\n  const tag = hexToUint8Array(tagHex);\n  const ciphertext = hexToUint8Array(ciphertextHex);\n\n  // Concatenate ciphertext and auth tag (Web Crypto expects them combined)\n  const combined = new Uint8Array(ciphertext.length + tag.length);\n  combined.set(ciphertext);\n  combined.set(tag, ciphertext.length);\n\n  // Convert the secret and import it as a CryptoKey for AES-GCM decryption.\n  const keyData = normalizeSecret(secret);\n  // Ensure keyData is backed by a real ArrayBuffer (not SharedArrayBuffer)\n  const keyDataArrayBuffer = new Uint8Array([...keyData]);\n\n  // Ensure iv is backed by a real ArrayBuffer (not SharedArrayBuffer)\n  const ivArrayBuffer = new Uint8Array([...iv]);\n\n  const key = await crypto.subtle.importKey(\n    'raw',\n    keyDataArrayBuffer as BufferSource,\n    { name: 'AES-GCM' },\n    false,\n    ['decrypt']\n  );\n\n  // Decrypt the combined ciphertext+tag using the IV.\n  const decryptedBuffer = await crypto.subtle.decrypt(\n    { name: 'AES-GCM', iv: ivArrayBuffer, tagLength: 128 },\n    key,\n    combined.buffer\n  );\n\n  // Decode the decrypted ArrayBuffer back to a string.\n  const decoder = new TextDecoder();\n  return decoder.decode(decryptedBuffer);\n}\n\n/**\n * Converts input data (string or Uint8Array) to a Uint8Array backed by a plain ArrayBuffer.\n * @param data - The input data.\n * @returns A Uint8Array representing the input data.\n */\nfunction toUint8Array(data: string | Uint8Array): Uint8Array {\n  if (typeof data === 'string') {\n    return new TextEncoder().encode(data);\n  }\n  return data;\n}\n\n/**\n * Hashes the input using SHA-256 with the Web Crypto API.\n * @param data - The input data (string or Uint8Array).\n * @returns A Promise that resolves to the SHA-256 hash as a hex string.\n */\nexport async function sha256(data: string | Uint8Array): Promise<string> {\n  const buffer = toUint8Array(data);\n  const hashBuffer = await crypto.subtle.digest('SHA-256', buffer as BufferSource);\n  return toHex(new Uint8Array(hashBuffer));\n}\n\n/**\n * Hashes the input using SHA-512 with the Web Crypto API.\n * @param data - The input data (string or Uint8Array).\n * @returns A Promise that resolves to the SHA-512 hash as a hex string.\n */\nexport async function sha512(data: string | Uint8Array): Promise<string> {\n  const buffer = toUint8Array(data);\n  const hashBuffer = await crypto.subtle.digest('SHA-512', buffer as BufferSource);\n  return toHex(new Uint8Array(hashBuffer));\n}\n\n/**\n * Retrieves the session secret from environment variables.\n * Throws an error if the SESSION_SECRET is not defined.\n *\n * @returns {string} The session secret.\n */\nexport function getSessionSecret(): string {\n  const secret = process.env.SESSION_SECRET;\n  if (!secret) {\n    throw new Error('SESSION_SECRET is not defined');\n  }\n  return secret;\n}\n\n/**\n * Retrieves the session secret from environment variables as Uint8Array .\n * Throws an error if the SESSION_SECRET is not defined.\n *\n * @returns {Uint8Array} The session secret as Uint8Array.\n */\nexport function getSessionSecretUint8Array(): Uint8Array {\n  const secret = getSessionSecret();\n  const keyData = hexToUint8Array(secret);\n  // Ensure it's backed by a regular ArrayBuffer (not SharedArrayBuffer)\n  return new Uint8Array([...keyData]);\n}\n\n/**\n * Converts a Uint8Array to a lowercase hexadecimal string.\n */\nexport function toHex(bytes: Uint8Array): string {\n  return Array.from(bytes)\n    .map(b => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\n/**\n * Generates a random token of the given byte length and returns it as a hex string.\n * Default token length is 20 bytes (160 bits).\n *\n * @param tokenLength - The number of random bytes to generate (default is 20).\n * @returns A hex string representing the token.\n */\nexport function generateToken(tokenLength: number = 32): string {\n  const bytes = new Uint8Array(tokenLength);\n  crypto.getRandomValues(bytes);\n  return toHex(bytes);\n}\n\n\n/**\n * Determines if the access token of a session will expire in less than the given threshold.\n *\n * It decodes the access token (assumed to be a JWT) and reads the `exp` claim.\n * The expiration (`exp`) claim is the UNIX timestamp (in seconds) when the token expires.\n *\n * @param accessToken - The access token string.\n * @param seconds - The threshold (in seconds) for checking expiration (default is 10 seconds).\n * @returns True if the access token expires within the threshold; otherwise, false.\n */\nexport const accessTokenExpires = (\n  accessToken: string,\n  seconds: number = 10\n): boolean => {\n  try {\n    // Decode the JWT without verifying the signature.\n    const payload = jose.decodeJwt(accessToken) as { exp?: number; };\n\n    // If there is no exp claim, assume the token does not expire\n    if (!payload.exp) {\n      return false;\n    }\n\n    const nowInSeconds = Date.now() / 1000;\n    const remainingSeconds = payload.exp - nowInSeconds;\n\n    return remainingSeconds < seconds;\n  } catch (error) {\n    // If decoding fails, treat the token as invalid so no refresh is triggered.\n    logger.error(\n      { error },\n      'Error decoding access token'\n    );\n    return true;\n  }\n};\n\n/**\n * Returns true if the session was granted the given scope.\n *\n * @param session - The session to check\n * @param scope - The scope string to look for (e.g. \"operations.read\")\n */\nexport function hasScope(session: Session, scope: string): boolean {\n  return session.scopes?.includes(scope) ?? false;\n}\n"],"mappings":";;;AAKA,IAAM,SAAS,aAAa,EAAE,WAAW,mBAAmB,CAAC;;;;;;;AAS7D,SAAgB,gBAAgB,KAAyB;CACvD,IAAI,IAAI,SAAS,MAAM,GACrB,MAAM,IAAI,MAAM,gCAAgC;CAElD,IAAI,IAAI,SAAS,KAAK,CAAC,iBAAiB,KAAK,GAAG,GAC9C,MAAM,IAAI,MAAM,iDAAiD;CAEnE,MAAM,MAAM,IAAI,WAAW,IAAI,SAAS,CAAC;CACzC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAC9B,IAAI,KAAK,OAAO,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;CAE1D,OAAO;AACT;;;;;AAMA,SAAS,gBAAgB,QAAyC;CAChE,IAAI,OAAO,WAAW,UACpB,OAAO,gBAAgB,MAAM;CAE/B,OAAO;AACT;;;;;;;;AASA,eAAsB,mBACpB,SACA,QACiB;CACjB,OAAO,IAAI,KAAK,WAAW,OAA0B,EAClD,mBAAmB;EAAE,KAAK;EAAO,KAAK;CAAU,CAAC,EACjD,YAAY,EACZ,QAAQ,gBAAgB,MAAM,CAAC;AACpC;;;;;;;;;AAWA,eAAsB,QAAQ,MAAc,QAA8C;CACxF,MAAM,UAAU,gBAAgB,MAAM;CAGtC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,OACA,SACA,EAAE,MAAM,UAAU,GAClB,OACA,CAAC,SAAS,CACZ;CAGA,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;CAIpD,MAAM,OAAO,IADO,YACP,EAAQ,OAAO,IAAI;CAIhC,MAAM,kBAAkB,MAAM,OAAO,OAAO,QAC1C;EAAE,MAAM;EAAW;EAAI,WAAW;CAAI,GACtC,KACA,IACF;CAGA,MAAM,iBAAiB,IAAI,WAAW,eAAe;CACrD,MAAM,YAAY;CAClB,MAAM,aAAa,eAAe,MAAM,GAAG,eAAe,SAAS,SAAS;CAC5E,MAAM,UAAU,eAAe,MAAM,eAAe,SAAS,SAAS;CAEtE,OAAO;EAAC,MAAM,EAAE;EAAG,MAAM,OAAO;EAAG,MAAM,UAAU;CAAC,EAAE,KAAK,GAAG;AAChE;;;;;;;;;AAUA,eAAsB,QAAQ,MAAc,QAA8C;CAGxF,MAAM,CAAC,OAAO,QAAQ,iBAAiB,KAAK,MAAM,GAAG;CACrD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,eACxB,MAAM,IAAI,MAAM,+BAA+B;CAIjD,MAAM,KAAK,gBAAgB,KAAK;CAChC,MAAM,MAAM,gBAAgB,MAAM;CAClC,MAAM,aAAa,gBAAgB,aAAa;CAGhD,MAAM,WAAW,IAAI,WAAW,WAAW,SAAS,IAAI,MAAM;CAC9D,SAAS,IAAI,UAAU;CACvB,SAAS,IAAI,KAAK,WAAW,MAAM;CAGnC,MAAM,UAAU,gBAAgB,MAAM;CAEtC,MAAM,qBAAqB,IAAI,WAAW,CAAC,GAAG,OAAO,CAAC;CAGtD,MAAM,gBAAgB,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;CAE5C,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,OACA,oBACA,EAAE,MAAM,UAAU,GAClB,OACA,CAAC,SAAS,CACZ;CAGA,MAAM,kBAAkB,MAAM,OAAO,OAAO,QAC1C;EAAE,MAAM;EAAW,IAAI;EAAe,WAAW;CAAI,GACrD,KACA,SAAS,MACX;CAIA,OAAO,IADa,YACb,EAAQ,OAAO,eAAe;AACvC;;;;;;AAOA,SAAS,aAAa,MAAuC;CAC3D,IAAI,OAAO,SAAS,UAClB,OAAO,IAAI,YAAY,EAAE,OAAO,IAAI;CAEtC,OAAO;AACT;;;;;;AAOA,eAAsB,OAAO,MAA4C;CACvE,MAAM,SAAS,aAAa,IAAI;CAChC,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,MAAsB;CAC/E,OAAO,MAAM,IAAI,WAAW,UAAU,CAAC;AACzC;;;;;;AAOA,eAAsB,OAAO,MAA4C;CACvE,MAAM,SAAS,aAAa,IAAI;CAChC,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,MAAsB;CAC/E,OAAO,MAAM,IAAI,WAAW,UAAU,CAAC;AACzC;;;;;;;AAQA,SAAgB,mBAA2B;CACzC,MAAM,SAAS,QAAQ,IAAI;CAC3B,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,+BAA+B;CAEjD,OAAO;AACT;;;;;;;AAQA,SAAgB,6BAAyC;CAEvD,MAAM,UAAU,gBADD,iBACiB,CAAM;CAEtC,OAAO,IAAI,WAAW,CAAC,GAAG,OAAO,CAAC;AACpC;;;;AAKA,SAAgB,MAAM,OAA2B;CAC/C,OAAO,MAAM,KAAK,KAAK,EACpB,KAAI,MAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EACxC,KAAK,EAAE;AACZ;;;;;;;;AASA,SAAgB,cAAc,cAAsB,IAAY;CAC9D,MAAM,QAAQ,IAAI,WAAW,WAAW;CACxC,OAAO,gBAAgB,KAAK;CAC5B,OAAO,MAAM,KAAK;AACpB;;;;;;;;;;;AAaA,IAAa,sBACX,aACA,UAAkB,OACN;CACZ,IAAI;EAEF,MAAM,UAAU,KAAK,UAAU,WAAW;EAG1C,IAAI,CAAC,QAAQ,KACX,OAAO;EAGT,MAAM,eAAe,KAAK,IAAI,IAAI;EAGlC,OAFyB,QAAQ,MAAM,eAEb;CAC5B,SAAS,OAAO;EAEd,OAAO,MACL,EAAE,MAAM,GACR,6BACF;EACA,OAAO;CACT;AACF;;;;;;;AAQA,SAAgB,SAAS,SAAkB,OAAwB;CACjE,OAAO,QAAQ,QAAQ,SAAS,KAAK,KAAK;AAC5C"}
+{"version":3,"file":"utils.js","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import * as jose from 'jose';\n\nimport { createLogger } from './logger';\nimport type { Session } from './types';\n\nconst logger = createLogger({ namespace: 'fides-auth:utils' });\n\n\n/**\n * Converts a hex string to a Uint8Array.\n *\n * @param hex - A hexadecimal string.\n * @returns A Uint8Array representing the bytes of the hex string.\n */\nexport function hexToUint8Array(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) {\n    throw new Error('Invalid hex string: odd length');\n  }\n  if (hex.length > 0 && !/^[0-9a-fA-F]+$/.test(hex)) {\n    throw new Error('Invalid hex string: contains non-hex characters');\n  }\n  const arr = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < arr.length; i++) {\n    arr[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  }\n  return arr;\n}\n\n/**\n * Normalizes a secret to a Uint8Array.\n * Accepts either a hex-encoded string or an existing Uint8Array.\n */\nfunction normalizeSecret(secret: string | Uint8Array): Uint8Array {\n  if (typeof secret === 'string') {\n    return hexToUint8Array(secret);\n  }\n  return secret;\n}\n\n/**\n * Encrypts a payload into a JWT using the specified secret.\n *\n * @param payload - The payload to encrypt (can be any JSON-serializable value)\n * @param secret - The encryption key as a hex string or Uint8Array (32 bytes for A256GCM)\n * @returns A promise that resolves to the encrypted JWT as a string.\n */\nexport async function createEncryptedJWT(\n  payload: unknown,\n  secret: string | Uint8Array,\n): Promise<string> {\n  return new jose.EncryptJWT(payload as jose.JWTPayload)\n    .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })\n    .setIssuedAt()\n    .encrypt(normalizeSecret(secret));\n}\n\n/**\n * Decrypts a JWE produced by {@link createEncryptedJWT} and returns its payload.\n *\n * Counterpart to {@link createEncryptedJWT}. Throws if the token cannot be\n * decrypted (wrong key, tampering, or malformed input).\n *\n * @param encryptedJwt - The encrypted JWT string.\n * @param secret - The decryption key as a hex string or Uint8Array (32 bytes for A256GCM).\n * @returns A promise that resolves to the decrypted JWT payload.\n */\nexport async function decryptJWT(\n  encryptedJwt: string,\n  secret: string | Uint8Array,\n): Promise<jose.JWTPayload> {\n  const { payload } = await jose.jwtDecrypt(encryptedJwt, normalizeSecret(secret));\n  return payload;\n}\n\n\n/**\n * Encrypts the given text using AES-GCM via the Web Crypto API.\n * Returns a string in the format: iv:authTag:ciphertext, all in hex.\n *\n * @param text - The plaintext to encrypt.\n * @param secret - The encryption key as a hex string or Uint8Array (32 bytes for AES-256).\n * @returns A promise that resolves to the encrypted string.\n */\nexport async function encrypt(text: string, secret: string | Uint8Array): Promise<string> {\n  const keyData = normalizeSecret(secret);\n\n  // Import the key for AES-GCM encryption.\n  const key = await crypto.subtle.importKey(\n    'raw',\n    keyData as BufferSource,\n    { name: 'AES-GCM' },\n    false,\n    ['encrypt']\n  );\n\n  // Generate a 12-byte IV using the Web Crypto API.\n  const iv = crypto.getRandomValues(new Uint8Array(12));\n\n  // Encode the plaintext into a Uint8Array.\n  const encoder = new TextEncoder();\n  const data = encoder.encode(text);\n\n  // Encrypt the data using AES-GCM.\n  // Note: The Web Crypto API combines the ciphertext and authentication tag in the output.\n  const encryptedBuffer = await crypto.subtle.encrypt(\n    { name: 'AES-GCM', iv, tagLength: 128 },\n    key,\n    data\n  );\n\n  // Convert the encrypted data to a Uint8Array for separation.\n  const encryptedArray = new Uint8Array(encryptedBuffer);\n  const tagLength = 16; // AES-GCM uses a 128-bit (16-byte) tag.\n  const ciphertext = encryptedArray.slice(0, encryptedArray.length - tagLength);\n  const authTag = encryptedArray.slice(encryptedArray.length - tagLength);\n\n  return [toHex(iv), toHex(authTag), toHex(ciphertext)].join(':');\n}\n\n/**\n * Decrypts data encrypted with AES-256-GCM (using the Web Crypto API).\n * The input is expected to be in the format: iv:authTag:ciphertext (all hex-encoded).\n *\n * @param data - The encrypted data string.\n * @param secret - The decryption key as a hex string or Uint8Array (32 bytes for AES-256).\n * @returns A promise that resolves to the decrypted plaintext.\n */\nexport async function decrypt(data: string, secret: string | Uint8Array): Promise<string> {\n\n  // Split the incoming data. We expect exactly three parts.\n  const [ivHex, tagHex, ciphertextHex] = data.split(':');\n  if (!ivHex || !tagHex || !ciphertextHex) {\n    throw new Error('Invalid encrypted data format');\n  }\n\n  // Convert each hex-encoded part to a Uint8Array\n  const iv = hexToUint8Array(ivHex);\n  const tag = hexToUint8Array(tagHex);\n  const ciphertext = hexToUint8Array(ciphertextHex);\n\n  // Concatenate ciphertext and auth tag (Web Crypto expects them combined)\n  const combined = new Uint8Array(ciphertext.length + tag.length);\n  combined.set(ciphertext);\n  combined.set(tag, ciphertext.length);\n\n  // Convert the secret and import it as a CryptoKey for AES-GCM decryption.\n  const keyData = normalizeSecret(secret);\n  // Ensure keyData is backed by a real ArrayBuffer (not SharedArrayBuffer)\n  const keyDataArrayBuffer = new Uint8Array([...keyData]);\n\n  // Ensure iv is backed by a real ArrayBuffer (not SharedArrayBuffer)\n  const ivArrayBuffer = new Uint8Array([...iv]);\n\n  const key = await crypto.subtle.importKey(\n    'raw',\n    keyDataArrayBuffer as BufferSource,\n    { name: 'AES-GCM' },\n    false,\n    ['decrypt']\n  );\n\n  // Decrypt the combined ciphertext+tag using the IV.\n  const decryptedBuffer = await crypto.subtle.decrypt(\n    { name: 'AES-GCM', iv: ivArrayBuffer, tagLength: 128 },\n    key,\n    combined.buffer\n  );\n\n  // Decode the decrypted ArrayBuffer back to a string.\n  const decoder = new TextDecoder();\n  return decoder.decode(decryptedBuffer);\n}\n\n/**\n * Converts input data (string or Uint8Array) to a Uint8Array backed by a plain ArrayBuffer.\n * @param data - The input data.\n * @returns A Uint8Array representing the input data.\n */\nfunction toUint8Array(data: string | Uint8Array): Uint8Array {\n  if (typeof data === 'string') {\n    return new TextEncoder().encode(data);\n  }\n  return data;\n}\n\n/**\n * Hashes the input using SHA-256 with the Web Crypto API.\n * @param data - The input data (string or Uint8Array).\n * @returns A Promise that resolves to the SHA-256 hash as a hex string.\n */\nexport async function sha256(data: string | Uint8Array): Promise<string> {\n  const buffer = toUint8Array(data);\n  const hashBuffer = await crypto.subtle.digest('SHA-256', buffer as BufferSource);\n  return toHex(new Uint8Array(hashBuffer));\n}\n\n/**\n * Hashes the input using SHA-512 with the Web Crypto API.\n * @param data - The input data (string or Uint8Array).\n * @returns A Promise that resolves to the SHA-512 hash as a hex string.\n */\nexport async function sha512(data: string | Uint8Array): Promise<string> {\n  const buffer = toUint8Array(data);\n  const hashBuffer = await crypto.subtle.digest('SHA-512', buffer as BufferSource);\n  return toHex(new Uint8Array(hashBuffer));\n}\n\n/**\n * Retrieves the session secret from environment variables.\n * Throws an error if the SESSION_SECRET is not defined.\n *\n * @returns {string} The session secret.\n */\nexport function getSessionSecret(): string {\n  const secret = process.env.SESSION_SECRET;\n  if (!secret) {\n    throw new Error('SESSION_SECRET is not defined');\n  }\n  return secret;\n}\n\n/**\n * Retrieves the session secret from environment variables as Uint8Array .\n * Throws an error if the SESSION_SECRET is not defined.\n *\n * @returns {Uint8Array} The session secret as Uint8Array.\n */\nexport function getSessionSecretUint8Array(): Uint8Array {\n  const secret = getSessionSecret();\n  const keyData = hexToUint8Array(secret);\n  // Ensure it's backed by a regular ArrayBuffer (not SharedArrayBuffer)\n  return new Uint8Array([...keyData]);\n}\n\n/**\n * Converts a Uint8Array to a lowercase hexadecimal string.\n */\nexport function toHex(bytes: Uint8Array): string {\n  return Array.from(bytes)\n    .map(b => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\n/**\n * Generates a random token of the given byte length and returns it as a hex string.\n * Default token length is 20 bytes (160 bits).\n *\n * @param tokenLength - The number of random bytes to generate (default is 20).\n * @returns A hex string representing the token.\n */\nexport function generateToken(tokenLength: number = 32): string {\n  const bytes = new Uint8Array(tokenLength);\n  crypto.getRandomValues(bytes);\n  return toHex(bytes);\n}\n\n\n/**\n * Determines if the access token of a session will expire in less than the given threshold.\n *\n * It decodes the access token (assumed to be a JWT) and reads the `exp` claim.\n * The expiration (`exp`) claim is the UNIX timestamp (in seconds) when the token expires.\n *\n * @param accessToken - The access token string.\n * @param seconds - The threshold (in seconds) for checking expiration (default is 10 seconds).\n * @returns True if the access token expires within the threshold; otherwise, false.\n */\nexport const accessTokenExpires = (\n  accessToken: string,\n  seconds: number = 10\n): boolean => {\n  try {\n    // Decode the JWT without verifying the signature.\n    const payload = jose.decodeJwt(accessToken) as { exp?: number; };\n\n    // If there is no exp claim, assume the token does not expire\n    if (!payload.exp) {\n      return false;\n    }\n\n    const nowInSeconds = Date.now() / 1000;\n    const remainingSeconds = payload.exp - nowInSeconds;\n\n    return remainingSeconds < seconds;\n  } catch (error) {\n    // If decoding fails, treat the token as invalid so no refresh is triggered.\n    logger.error(\n      { error },\n      'Error decoding access token'\n    );\n    return true;\n  }\n};\n\n/**\n * Returns true if the session was granted the given scope.\n *\n * @param session - The session to check\n * @param scope - The scope string to look for (e.g. \"operations.read\")\n */\nexport function hasScope(session: Session, scope: string): boolean {\n  return session.scopes?.includes(scope) ?? false;\n}\n"],"mappings":";;;AAKA,IAAM,SAAS,aAAa,EAAE,WAAW,mBAAmB,CAAC;;;;;;;AAS7D,SAAgB,gBAAgB,KAAyB;CACvD,IAAI,IAAI,SAAS,MAAM,GACrB,MAAM,IAAI,MAAM,gCAAgC;CAElD,IAAI,IAAI,SAAS,KAAK,CAAC,iBAAiB,KAAK,GAAG,GAC9C,MAAM,IAAI,MAAM,iDAAiD;CAEnE,MAAM,MAAM,IAAI,WAAW,IAAI,SAAS,CAAC;CACzC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAC9B,IAAI,KAAK,OAAO,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;CAE1D,OAAO;AACT;;;;;AAMA,SAAS,gBAAgB,QAAyC;CAChE,IAAI,OAAO,WAAW,UACpB,OAAO,gBAAgB,MAAM;CAE/B,OAAO;AACT;;;;;;;;AASA,eAAsB,mBACpB,SACA,QACiB;CACjB,OAAO,IAAI,KAAK,WAAW,OAA0B,CAAC,CACnD,mBAAmB;EAAE,KAAK;EAAO,KAAK;CAAU,CAAC,CAAC,CAClD,YAAY,CAAC,CACb,QAAQ,gBAAgB,MAAM,CAAC;AACpC;;;;;;;;;;;AAYA,eAAsB,WACpB,cACA,QAC0B;CAC1B,MAAM,EAAE,YAAY,MAAM,KAAK,WAAW,cAAc,gBAAgB,MAAM,CAAC;CAC/E,OAAO;AACT;;;;;;;;;AAWA,eAAsB,QAAQ,MAAc,QAA8C;CACxF,MAAM,UAAU,gBAAgB,MAAM;CAGtC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,OACA,SACA,EAAE,MAAM,UAAU,GAClB,OACA,CAAC,SAAS,CACZ;CAGA,MAAM,KAAK,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;CAIpD,MAAM,OAAO,IADO,YACP,CAAA,CAAQ,OAAO,IAAI;CAIhC,MAAM,kBAAkB,MAAM,OAAO,OAAO,QAC1C;EAAE,MAAM;EAAW;EAAI,WAAW;CAAI,GACtC,KACA,IACF;CAGA,MAAM,iBAAiB,IAAI,WAAW,eAAe;CACrD,MAAM,YAAY;CAClB,MAAM,aAAa,eAAe,MAAM,GAAG,eAAe,SAAS,SAAS;CAC5E,MAAM,UAAU,eAAe,MAAM,eAAe,SAAS,SAAS;CAEtE,OAAO;EAAC,MAAM,EAAE;EAAG,MAAM,OAAO;EAAG,MAAM,UAAU;CAAC,CAAC,CAAC,KAAK,GAAG;AAChE;;;;;;;;;AAUA,eAAsB,QAAQ,MAAc,QAA8C;CAGxF,MAAM,CAAC,OAAO,QAAQ,iBAAiB,KAAK,MAAM,GAAG;CACrD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,eACxB,MAAM,IAAI,MAAM,+BAA+B;CAIjD,MAAM,KAAK,gBAAgB,KAAK;CAChC,MAAM,MAAM,gBAAgB,MAAM;CAClC,MAAM,aAAa,gBAAgB,aAAa;CAGhD,MAAM,WAAW,IAAI,WAAW,WAAW,SAAS,IAAI,MAAM;CAC9D,SAAS,IAAI,UAAU;CACvB,SAAS,IAAI,KAAK,WAAW,MAAM;CAGnC,MAAM,UAAU,gBAAgB,MAAM;CAEtC,MAAM,qBAAqB,IAAI,WAAW,CAAC,GAAG,OAAO,CAAC;CAGtD,MAAM,gBAAgB,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;CAE5C,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,OACA,oBACA,EAAE,MAAM,UAAU,GAClB,OACA,CAAC,SAAS,CACZ;CAGA,MAAM,kBAAkB,MAAM,OAAO,OAAO,QAC1C;EAAE,MAAM;EAAW,IAAI;EAAe,WAAW;CAAI,GACrD,KACA,SAAS,MACX;CAIA,OAAO,IADa,YACb,CAAA,CAAQ,OAAO,eAAe;AACvC;;;;;;AAOA,SAAS,aAAa,MAAuC;CAC3D,IAAI,OAAO,SAAS,UAClB,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI;CAEtC,OAAO;AACT;;;;;;AAOA,eAAsB,OAAO,MAA4C;CACvE,MAAM,SAAS,aAAa,IAAI;CAChC,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,MAAsB;CAC/E,OAAO,MAAM,IAAI,WAAW,UAAU,CAAC;AACzC;;;;;;AAOA,eAAsB,OAAO,MAA4C;CACvE,MAAM,SAAS,aAAa,IAAI;CAChC,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,MAAsB;CAC/E,OAAO,MAAM,IAAI,WAAW,UAAU,CAAC;AACzC;;;;;;;AAQA,SAAgB,mBAA2B;CACzC,MAAM,SAAS,QAAQ,IAAI;CAC3B,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,+BAA+B;CAEjD,OAAO;AACT;;;;;;;AAQA,SAAgB,6BAAyC;CAEvD,MAAM,UAAU,gBADD,iBACiB,CAAM;CAEtC,OAAO,IAAI,WAAW,CAAC,GAAG,OAAO,CAAC;AACpC;;;;AAKA,SAAgB,MAAM,OAA2B;CAC/C,OAAO,MAAM,KAAK,KAAK,CAAC,CACrB,KAAI,MAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CACzC,KAAK,EAAE;AACZ;;;;;;;;AASA,SAAgB,cAAc,cAAsB,IAAY;CAC9D,MAAM,QAAQ,IAAI,WAAW,WAAW;CACxC,OAAO,gBAAgB,KAAK;CAC5B,OAAO,MAAM,KAAK;AACpB;;;;;;;;;;;AAaA,IAAa,sBACX,aACA,UAAkB,OACN;CACZ,IAAI;EAEF,MAAM,UAAU,KAAK,UAAU,WAAW;EAG1C,IAAI,CAAC,QAAQ,KACX,OAAO;EAGT,MAAM,eAAe,KAAK,IAAI,IAAI;EAGlC,OAFyB,QAAQ,MAAM,eAEb;CAC5B,SAAS,OAAO;EAEd,OAAO,MACL,EAAE,MAAM,GACR,6BACF;EACA,OAAO;CACT;AACF;;;;;;;AAQA,SAAgB,SAAS,SAAkB,OAAwB;CACjE,OAAO,QAAQ,QAAQ,SAAS,KAAK,KAAK;AAC5C"}

package/docs/rp-initiated-logout.md

@@ -0,0 +1,139 @@
+# RP-Initiated Logout
+
+Clearing your application's session cookie is not a logout. The provider's session
+cookie survives, so the next `/authorize` round trip re-authenticates silently and
+the user appears logged in again. Ending the provider session too requires an
+RP-initiated logout request — [OpenID Connect RP-Initiated Logout 1.0][spec].
+
+"RP" is the *relying party*: your application, the one relying on the provider for
+authentication. The provider itself is the "OP", the *OpenID provider*. RP-initiated
+means your application starts the logout, as opposed to OP-initiated logout, where the
+provider notifies applications that a session ended elsewhere — fides-auth has no
+support for that direction.
+
+[spec]: https://openid.net/specs/openid-connect-rpinitiated-1_0.html
+
+## The short version
+
+```typescript
+import { handleOidcLogout } from "@eventuras/fides-auth/server";
+
+return handleOidcLogout(request, {
+  oauthConfig,
+  cookies,
+  postLogoutRedirectUri: "https://app.example.com/",
+});
+```
+
+That reads the session's ID token, clears the local cookies, and redirects to the
+provider's end-session endpoint. Next.js apps can use the wrapper at
+`@eventuras/fides-auth-next/oidc-logout`.
+
+## Building the URL yourself
+
+```typescript
+import { buildOidcLogoutUrl } from "@eventuras/fides-auth/oauth";
+
+const logoutUrl = await buildOidcLogoutUrl(oauthConfig, {
+  postLogoutRedirectUri: "https://app.example.com/",
+  idTokenHint: session?.tokens?.idToken,
+  state: "correlation-123",
+});
+```
+
+| Option                 | Sent as                    | Notes                                                       |
+| ---------------------- | -------------------------- | ----------------------------------------------------------- |
+| `postLogoutRedirectUri` | `post_logout_redirect_uri` | Must be registered with the provider                        |
+| `idTokenHint`          | `id_token_hint`            | Identifies the session to end; recommended                  |
+| `state`                | `state`                    | Echoed back unchanged on the redirect                       |
+| `logoutHint`           | `logout_hint`              | Meaning is provider-specific                                |
+| `includeClientId`      | `client_id`                | Default `true`                                              |
+
+Unsupplied parameters are omitted. A string second argument is shorthand for
+`postLogoutRedirectUri`.
+
+`buildOidcLogoutUrl` returns `null` when the provider advertises no
+`end_session_endpoint`, when discovery fails, or when the endpoint is not https —
+the URL carries a raw ID token, so it never travels in the clear. Callers fall back to
+a local-only logout.
+
+## Why `id_token_hint` matters
+
+The spec recommends it, and in practice it is what makes logout work smoothly:
+
+- It tells the provider **which** session to terminate when several are active.
+- Providers that can skip the "are you sure you want to sign out?" interstitial
+  generally do so only when the hint is present.
+
+`session.tokens.idToken` holds the raw token. `buildSessionFromTokens` populates it,
+and `refreshSession` replaces it whenever a refresh response carries a new `id_token`
+— otherwise the hint would go stale and eventually fall outside the window in which
+the provider still recognises it.
+
+## Why `client_id` is still sent
+
+`client_id` is sent by default, including alongside `id_token_hint`. The spec allows
+both:
+
+> When both `client_id` and `id_token_hint` are present, the OP MUST verify that the
+> Client Identifier matches the one used when issuing the ID Token.
+
+It also earns its place in the degraded cases. A provider **must not** redirect to
+`post_logout_redirect_uri` unless it can confirm the target is legitimate, and
+`client_id` is one of the ways it does that — which is what keeps logout working when
+there is no session left to take a hint from, or when the ID token is old enough that
+the provider no longer accepts it.
+
+Set `includeClientId: false` only for a provider that documents rejecting the
+combination.
+
+## Where the ID token is stored
+
+Sessions are split across three cookies: the access token in `session_at`, the ID
+token in `session_it`, everything else in `session`. Each large JWT gets its own
+per-cookie byte budget — an encoded ID token is typically 0.5–1.5 kB, and cookies at
+or above 4096 bytes are silently dropped by the browser, so sharing a cookie between
+two JWTs would eventually surface as a failed *login*.
+
+The ID token is also read independently of session validity. `readSession` returns
+null once the access token has expired, but the hint is needed precisely then: an
+idle user coming back to a stale tab and clicking log out still has a live session at
+the provider. `readIdToken` reads the `session_it` cookie directly, and
+`handleOidcLogout` uses it rather than going through the session.
+
+## Correlating the response with `state`
+
+`state` is passed through to the provider and echoed back on the redirect. fides-auth
+does not store or verify it; generating a value, persisting it, and checking it on the
+way back is the caller's job.
+
+## CSRF
+
+`handleOidcLogout` accepts `POST` only and answers `405` to anything else. That alone
+is not protection — a third-party page can auto-submit a form at the endpoint, and the
+response clears the cookies whether or not the browser attached them — so the handler
+also requires the request to come from the application itself:
+
+- `Sec-Fetch-Site` must be `same-origin` or `none` where the browser sends it.
+- Otherwise `Origin`, when present, must match `applicationUrl` (falling back to the
+  request's own origin). Set `applicationUrl` behind a proxy, where the request URL
+  carries the internal origin.
+- A request with neither header is not a browser form post and is allowed through.
+
+Cross-origin requests get `403`. Cross-*subdomain* logout is rejected too; if you need
+it, call `buildOidcLogoutUrl` from your own handler with whatever origin check fits.
+
+Use a form or a fetch rather than a plain link:
+
+```html
+<form method="post" action="/api/auth/logout"><button>Log out</button></form>
+```
+
+Pass `allowedMethods: ["GET", "POST"]` to opt into link-based logout — note this
+drops the method check, leaving only the origin check.
+
+## Non-Next.js frameworks
+
+`handleOidcLogout` takes a standard `Request` and a `CookieStore` — an object with
+`get`, `set` and `delete`. Any framework that can expose its cookie jar behind those
+three methods can use it, the same way `handleOidcLogin` and `handleOidcCallback` do.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eventuras/fides-auth",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Framework-agnostic OAuth/OIDC authentication library with PKCE, session management, and pluggable logging",
   "keywords": [
     "oauth",
@@ -13,14 +13,14 @@
     "identity",
     "vipps"
   ],
-  "homepage": "https://github.com/losol/eventuras/tree/main/libs/fides-auth#readme",
+  "homepage": "https://github.com/losol/fides-auth/tree/main/packages/fides-auth#readme",
   "bugs": {
-    "url": "https://github.com/losol/eventuras/issues"
+    "url": "https://github.com/losol/fides-auth/issues"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/losol/eventuras.git",
-    "directory": "libs/fides-auth"
+    "url": "https://github.com/losol/fides-auth.git",
+    "directory": "packages/fides-auth"
   },
   "license": "MIT",
   "author": "losol <losol@users.noreply.github.com>",
@@ -35,6 +35,14 @@
       "types": "./dist/activity-tracker.d.ts",
       "import": "./dist/activity-tracker.js"
     },
+    "./cookies": {
+      "types": "./dist/cookies.d.ts",
+      "import": "./dist/cookies.js"
+    },
+    "./heartbeat": {
+      "types": "./dist/heartbeat.d.ts",
+      "import": "./dist/heartbeat.js"
+    },
     "./logger": {
       "types": "./dist/logger.d.ts",
       "import": "./dist/logger.js"
@@ -47,6 +55,10 @@
       "types": "./dist/session-validation.d.ts",
       "import": "./dist/session-validation.js"
     },
+    "./session-cookies": {
+      "types": "./dist/session-cookies.d.ts",
+      "import": "./dist/session-cookies.js"
+    },
     "./oauth": {
       "types": "./dist/oauth.d.ts",
       "import": "./dist/oauth.js"
@@ -75,6 +87,10 @@
       "types": "./dist/rate-limit.d.ts",
       "import": "./dist/rate-limit.js"
     },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "import": "./dist/server/index.js"
+    },
     "./providers/vipps": {
       "types": "./dist/providers/vipps/index.d.ts",
       "import": "./dist/providers/vipps/index.js"
@@ -84,17 +100,19 @@
   "types": "./dist/index.d.ts",
   "files": [
     "dist",
+    "docs",
     "LICENSE",
     "README.md"
   ],
   "dependencies": {
-    "jose": "6.2.3",
+    "jose": "^6.2.8",
     "openid-client": "^6.8.3"
   },
   "devDependencies": {
-    "@types/node": "^24.12.0",
-    "vite": "^8.0.8",
-    "vitest": "^4.1.4",
+    "@types/node": "^22.20.1",
+    "jsdom": "29.1.1",
+    "vite": "^8.2.0",
+    "vitest": "^4.1.10",
     "@eventuras/typescript-config": "1.0.0",
     "@eventuras/vite-config": "0.2.2"
   },