@fitzzero/quickdraw-core 5.1.1 → 5.1.3

package/dist/server/auth/index.js

@@ -1,7 +1,15 @@
+import {
+  OAUTH_RETURN_ORIGIN_COOKIE,
+  originAllowlist,
+  rememberRouteOrigins,
+  routeOriginsOf,
+  validateRedirectOrigin
+} from "../../chunk-NO4M6PO5.js";
 import {
   HOST_SESSION_COOKIE,
   SESSION_COOKIE,
   clearSessionCookie,
+  clearStaleHostSession,
   cookieDomainFromEnv,
   cookieToken,
   cookiesOf,
@@ -11,25 +19,29 @@ import {
   httpCredentialOf,
   isJsonRequest,
   isSecureSessionRequest,
+  markSocketAuth,
   readJsonInput,
+  readVerifiedJWT,
   recordSocketSession,
   sessionCookieNameFor,
   sessionCookieNamesFor,
   setSessionCookie,
-  tokenOf,
   transportCookieNaming,
   verifyJWT
-} from "../../chunk-REX5YPHX.js";
-import "../../chunk-H23KEFBA.js";
-import "../../chunk-Z2LZ7IZ7.js";
+} from "../../chunk-PHCURHC7.js";
+import "../../chunk-DUBU3BB3.js";
 import {
-  consoleLogger
-} from "../../chunk-YSWH776Y.js";
+  consoleLogger,
+  errorText
+} from "../../chunk-DKE6QO26.js";
+import "../../chunk-SN3OZVEQ.js";
+import "../../chunk-7Y5ROPXL.js";
 import {
   INTERNAL_MESSAGE,
   QuickdrawError,
   httpStatus
-} from "../../chunk-4YO5H5ON.js";
+} from "../../chunk-Q4OGQM5I.js";
+import "../../chunk-QSU47XEX.js";
 
 // src/server/auth/oauth.ts
 function createOAuthURL(provider, config, state) {
@@ -128,38 +140,15 @@ var googleProvider = {
 // src/server/auth/mock.ts
 import { randomBytes } from "crypto";
 
-// src/server/auth/validateOrigin.ts
-var OAUTH_RETURN_ORIGIN_COOKIE = "oauth_return_origin";
-var LOCALHOST_REGEX = /^http:\/\/localhost:\d+$/;
-function envExtraOrigins() {
-  const raw = process.env.EXTRA_ALLOWED_ORIGINS;
-  if (!raw) return [];
-  return raw.split(",").map((s) => s.trim()).filter(Boolean);
-}
-function validateRedirectOrigin(origin, options = {}) {
-  if (!origin) return null;
-  const clientUrl = options.clientUrl ?? process.env.CLIENT_URL;
-  let parsedOrigin;
-  try {
-    parsedOrigin = new URL(origin);
-  } catch {
-    return null;
-  }
-  const cleanOrigin = parsedOrigin.origin;
-  if (clientUrl && cleanOrigin === clientUrl) {
-    return cleanOrigin;
-  }
-  const extra = options.extraAllowedOrigins ?? envExtraOrigins();
-  if (extra.includes(cleanOrigin)) {
-    return cleanOrigin;
-  }
-  if (options.allowedPatterns?.some((pattern) => pattern.test(cleanOrigin))) {
-    return cleanOrigin;
-  }
-  if ((options.allowLocalhostInDev ?? true) && process.env.NODE_ENV !== "production" && LOCALHOST_REGEX.test(cleanOrigin)) {
-    return cleanOrigin;
-  }
-  return null;
+// src/server/auth/devSignIns.ts
+var DEVELOPMENT_ENVS = /* @__PURE__ */ new Set(["development", "test"]);
+function developmentSignInsAllowed() {
+  const env = process.env.NODE_ENV;
+  return env !== void 0 && DEVELOPMENT_ENVS.has(env);
+}
+function nodeEnvLabel() {
+  const env = process.env.NODE_ENV;
+  return env === void 0 ? "unset" : JSON.stringify(env);
 }
 
 // src/server/auth/mock.ts
@@ -168,7 +157,7 @@ var CODE_TTL_MS = 5 * 60 * 1e3;
 var TOKEN_TTL_MS = 60 * 60 * 1e3;
 var DEV_PRIVATE_ORIGIN_REGEX = /^http:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}):\d+$/;
 function isMockOAuthEnabled() {
-  return process.env.ENABLE_MOCK_OAUTH === "true" && process.env.NODE_ENV !== "production";
+  return process.env.ENABLE_MOCK_OAUTH === "true" && developmentSignInsAllowed();
 }
 function createMockOAuthProvider(apiBaseUrl, options = {}) {
   const prefix = options.pathPrefix ?? DEFAULT_MOCK_PATH_PREFIX;
@@ -269,7 +258,7 @@ function sweep(store) {
   }
 }
 function guard(res) {
-  if (process.env.NODE_ENV === "production") {
+  if (!developmentSignInsAllowed()) {
     res.status(404).json({ error: "Not found" });
     return false;
   }
@@ -356,7 +345,9 @@ function registerMockOAuthProvider(router, options) {
   const logger = options.logger ?? consoleLogger;
   if (!isMockOAuthEnabled()) {
     if (process.env.ENABLE_MOCK_OAUTH === "true") {
-      logger.error("Mock OAuth is enabled but NODE_ENV is production \u2014 refusing to mount routes");
+      logger.error(
+        `Mock OAuth is enabled but NODE_ENV is ${nodeEnvLabel()}: the mock runs only when NODE_ENV is development or test, so its routes are not mounted; set NODE_ENV=development to use it`
+      );
     }
     return false;
   }
@@ -370,7 +361,9 @@ function registerMockOAuthProvider(router, options) {
   router.get(`${endpoints.prefix}/authorize`, authorizeHandler(endpoints));
   router.post(`${endpoints.prefix}/token`, tokenHandler(endpoints));
   router.get(`${endpoints.prefix}/userinfo`, userinfoHandler(endpoints));
-  logger.info(`Mock OAuth provider mounted at ${endpoints.prefix} (development only)`);
+  logger.warn(
+    `Mock OAuth provider mounted at ${endpoints.prefix}: anyone who reaches it signs in as any user it lists (NODE_ENV=${process.env.NODE_ENV ?? ""}; development and tests only)`
+  );
   return true;
 }
 
@@ -401,6 +394,14 @@ function sendJson(res, status, body) {
 function refuse(res, code, message) {
   sendJson(res, httpStatus(code), { error: code, message });
 }
+function failRoute(logger, req, res, error) {
+  logger.error("An auth route failed", {
+    category: "quickdraw.auth",
+    path: pathOf(req),
+    error: errorText(error)
+  });
+  refuse(res, "INTERNAL", INTERNAL_MESSAGE);
+}
 function redirect(res, location) {
   noStore(res, 302);
   res.setHeader("location", location);
@@ -411,67 +412,8 @@ function noContent(res) {
   res.end();
 }
 
-// src/server/auth/routes/origins.ts
-function exactOrigin(entry, owner) {
-  let url;
-  try {
-    url = typeof entry === "string" ? new URL(entry) : void 0;
-  } catch {
-    url = void 0;
-  }
-  const bare = url !== void 0 && (url.protocol === "https:" || url.protocol === "http:") && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === "";
-  if (url === void 0 || !bare) {
-    throw new TypeError(
-      `${owner}: allowedOrigins entries are origins such as "https://app.example.com" or anchored patterns; got ${String(entry)}`
-    );
-  }
-  return url.origin;
-}
-function anchoredPattern(pattern, owner) {
-  const { source } = pattern;
-  const anchored = source.startsWith("^") && source.endsWith("$") && !source.endsWith("\\$");
-  if (!anchored || pattern.global || pattern.sticky) {
-    throw new TypeError(
-      `${owner}: an allowedOrigins pattern must match whole origins, anchored with ^ and $ and without the g or y flag; got ${String(pattern)}`
-    );
-  }
-  return new RegExp(`^(?:${source})$`, pattern.flags);
-}
-function originAllowlist(allowedOrigins, owner, allowEmpty = false) {
-  if (!Array.isArray(allowedOrigins) || allowedOrigins.length === 0 && !allowEmpty) {
-    throw new TypeError(`${owner}: allowedOrigins must list the web app's origins`);
-  }
-  const exact = [];
-  const patterns = [];
-  for (const entry of allowedOrigins) {
-    if (entry instanceof RegExp) {
-      patterns.push(anchoredPattern(entry, owner));
-    } else {
-      exact.push(exactOrigin(entry, owner));
-    }
-  }
-  const options = {
-    // An empty client URL, not undefined: undefined falls back to process.env.CLIENT_URL.
-    clientUrl: "",
-    extraAllowedOrigins: exact,
-    allowedPatterns: patterns,
-    allowLocalhostInDev: false
-  };
-  return Object.freeze({
-    allowed: (value) => typeof value === "string" && value !== "" ? validateRedirectOrigin(value, options) : null,
-    fallback: exact[0]
-  });
-}
-var ROUTE_ORIGINS = /* @__PURE__ */ new WeakMap();
-function rememberRouteOrigins(sessions, origins) {
-  ROUTE_ORIGINS.set(sessions, origins);
-}
-function routeOriginsOf(sessions) {
-  return ROUTE_ORIGINS.get(sessions);
-}
-
 // src/server/auth/routes/state.ts
-import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { createHmac, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
 var OAUTH_STATE_COOKIE = "qd_oauth";
 var HOST_OAUTH_STATE_COOKIE = "__Host-qd_oauth";
 var OAUTH_STATE_TTL_MS = 10 * 60 * 1e3;
@@ -479,16 +421,30 @@ var MAX_REDEEMED = 1e4;
 function newState() {
   return randomBytes2(32).toString("base64url");
 }
-function encodePending(pending) {
-  return Buffer.from(JSON.stringify(pending), "utf8").toString("base64url");
+function oauthStateKey(jwtSecret) {
+  return createHmac("sha256", jwtSecret).update("quickdraw:oauth-state").digest();
+}
+function macOf(payload, key) {
+  return createHmac("sha256", key).update(payload).digest();
+}
+function encodePending(pending, key) {
+  const payload = Buffer.from(JSON.stringify(pending), "utf8").toString("base64url");
+  return `${payload}.${macOf(payload, key).toString("base64url")}`;
 }
-function decodePending(raw) {
-  if (raw === void 0 || raw === "") {
+function decodePending(raw, key) {
+  const dot = raw === void 0 ? -1 : raw.lastIndexOf(".");
+  if (raw === void 0 || dot <= 0) {
+    return null;
+  }
+  const payload = raw.slice(0, dot);
+  const mac = Buffer.from(raw.slice(dot + 1), "base64url");
+  const expected = macOf(payload, key);
+  if (mac.length !== expected.length || !timingSafeEqual(mac, expected)) {
     return null;
   }
   let value;
   try {
-    value = JSON.parse(Buffer.from(raw, "base64url").toString("utf8"));
+    value = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
   } catch {
     return null;
   }
@@ -564,7 +520,7 @@ async function issueSession(keys, userId, meta, ttlMs = DEFAULT_SESSION_TTL_MS)
 }
 async function liveSession(keys, token) {
   checkSessionKeys(keys, "liveSession");
-  const payload = await verifyJWT(token, keys.jwtSecret);
+  const payload = await readVerifiedJWT(token, keys.jwtSecret);
   if (payload === null || typeof payload.userId !== "string" || payload.userId === "" || payload.sid === void 0) {
     return null;
   }
@@ -641,9 +597,9 @@ function warnOnCookieDomain(cookie, logger) {
   if (cookie.name !== void 0 || cookie.domain !== void 0 === transportsSeeDomain) {
     return;
   }
-  const why = cookie.domain === void 0 ? 'cookie.domain is "" while COOKIE_DOMAIN is set, so over HTTPS the routes set __Host-session where socketAuth and the HTTP transport read "session" first' : 'cookie.domain is set and COOKIE_DOMAIN is not, so the routes set "session" on every request, which socketAuth and the HTTP transport read over HTTPS only under that name';
+  const why = cookie.domain === void 0 ? 'cookie.domain is "" while COOKIE_DOMAIN is set, so over HTTPS the routes set __Host-session, but socketAuth and the HTTP transport also take a "session" cookie there, which any site under COOKIE_DOMAIN can set for a browser that holds no __Host-session. Unset COOKIE_DOMAIN' : `cookie.domain is set and COOKIE_DOMAIN is not, so the routes set "session" on every request, which socketAuth and the HTTP transport read over HTTPS only under that name. Set COOKIE_DOMAIN to the cookie's domain instead`;
   logger.warn(
-    `${OWNER}: ${why}. Set COOKIE_DOMAIN to the cookie's domain instead, or name the cookie in all three places: cookie.name, socketAuth's cookieName and createServer's http.cookieName.`,
+    `${OWNER}: ${why}, or name the cookie in all three places: cookie.name, socketAuth's cookieName and createServer's http.cookieName.`,
     { category: "quickdraw.auth" }
   );
 }
@@ -704,8 +660,9 @@ function routeSettings(options) {
   const cookie = cookieOf(options.cookie);
   const logger = options.logger ?? consoleLogger;
   const publicUrl = publicUrlOf(options.publicUrl);
+  const keys = checkSessionKeys(options, OWNER);
   const settings = Object.freeze({
-    keys: checkSessionKeys(options, OWNER),
+    keys,
     origins: originAllowlist(options.allowedOrigins, OWNER),
     publicUrl,
     basePath: basePathOf(options.basePath),
@@ -716,6 +673,7 @@ function routeSettings(options) {
     onRevoke: options.onRevoke,
     logger,
     redeemed: redeemedStates(),
+    stateKey: oauthStateKey(keys.jwtSecret),
     watchHost: hostWatcher(publicUrl, logger)
   });
   warnOnCookieDomain(cookie, logger);
@@ -772,16 +730,25 @@ function setSession(res, settings, req, token, pageOrigin) {
   const from = fromPage(req, pageOrigin);
   const name = sessionCookieName(settings, from);
   res.cookie(name, token, sessionCookieSettings(settings, from, name, true));
+  if (settings.cookie.name === void 0) {
+    clearStaleHostSession(res, req, name, settings.cookie.sameSite);
+  }
 }
 function clearSession(res, settings, req) {
   const name = sessionCookieName(settings, req);
   res.clearCookie(name, sessionCookieSettings(settings, req, name, false));
+  if (settings.cookie.name === void 0) {
+    clearStaleHostSession(res, req, name, settings.cookie.sameSite);
+  }
+}
+function stateSecure(settings, req) {
+  return secureFor(settings, req) || settings.publicUrl.startsWith("https:");
 }
 function stateCookieName(settings, req) {
-  return secureFor(settings, req) ? HOST_OAUTH_STATE_COOKIE : OAUTH_STATE_COOKIE;
+  return stateSecure(settings, req) ? HOST_OAUTH_STATE_COOKIE : OAUTH_STATE_COOKIE;
 }
 function stateCookieOf(settings, req, live = false) {
-  const secure = secureFor(settings, req);
+  const secure = stateSecure(settings, req);
   return {
     httpOnly: true,
     secure,
@@ -800,6 +767,151 @@ function issueFor(settings, userId, provider, req) {
   return issueSession(settings.keys, userId, meta, settings.cookie.ttlMs);
 }
 
+// src/server/auth/routes/socketAuth.ts
+function handshakeOf(request) {
+  const { handshake } = request.socket;
+  return { headers: request.headers, secure: handshake?.secure === true };
+}
+function credentialOf(request, naming) {
+  if (request.transport === "http") {
+    const { sessionCookie } = request;
+    if (typeof sessionCookie === "string" && sessionCookie !== "") {
+      return { token: sessionCookie, checkOrigin: true };
+    }
+  }
+  const { token } = request.auth;
+  if (typeof token === "string" && token !== "") {
+    return { token, checkOrigin: request.transport === "http" && request.credential === "cookie" };
+  }
+  if (request.transport === "http") {
+    return null;
+  }
+  const names = sessionCookieNamesFor(handshakeOf(request), naming);
+  const cookie = cookieToken(cookiesOf({ headers: request.headers }), names);
+  return cookie === null ? null : { token: cookie, checkOrigin: true };
+}
+function originAccepted(headers, origins, allowMissing) {
+  const { origin } = headers;
+  if (origin !== void 0) {
+    return origins.allowed(origin) !== null;
+  }
+  return allowMissing || headers["sec-fetch-site"] === "same-origin";
+}
+function httpOriginAccepted(headers, origins) {
+  const { origin } = headers;
+  if (origin !== void 0) {
+    return origins.allowed(origin) !== null;
+  }
+  const site = headers["sec-fetch-site"];
+  return site === void 0 || site === "same-origin";
+}
+var compiled = /* @__PURE__ */ new WeakMap();
+function cookieOriginAllowed(request, allowedOrigins, options = {}) {
+  let origins = compiled.get(allowedOrigins);
+  if (origins === void 0) {
+    origins = originAllowlist(allowedOrigins, "cookieOriginAllowed", true);
+    compiled.set(allowedOrigins, origins);
+  }
+  return request.transport === "socket" ? originAccepted(request.headers, origins, options.allowMissingOrigin === true) : httpOriginAccepted(request.headers, origins);
+}
+function httpCookieOriginAllowed(headers, origins) {
+  return httpOriginAccepted(headers, origins);
+}
+var COOKIE_REFUSED = "This page's origin may not use the session cookie; send it from an allowed origin or use a bearer token";
+function checkCookieOrigin(request, origins, allowMissing) {
+  if (request.transport === "http") {
+    if (!httpOriginAccepted(request.headers, origins)) {
+      throw new QuickdrawError("FORBIDDEN", COOKIE_REFUSED);
+    }
+    return;
+  }
+  if (!originAccepted(request.headers, origins, allowMissing)) {
+    throw refused("This page's origin may not use the session cookie on a socket");
+  }
+}
+function refused(message) {
+  return new QuickdrawError("UNAUTHENTICATED", message);
+}
+function checkDevCredentials(devCredentials) {
+  if (devCredentials === void 0) {
+    return void 0;
+  }
+  if (typeof devCredentials !== "function") {
+    throw new TypeError("socketAuth: devCredentials must be a function of the user id");
+  }
+  if (!developmentSignInsAllowed()) {
+    throw new TypeError(
+      `socketAuth: devCredentials signs sockets in by a user id alone, so it runs only when NODE_ENV is development or test (NODE_ENV is ${nodeEnvLabel()}); set NODE_ENV=development to use it`
+    );
+  }
+  return devCredentials;
+}
+function devUserOf(request) {
+  const { token, userId } = request.auth;
+  const tokenless = token === void 0 || token === null || token === "";
+  return request.transport === "socket" && tokenless && typeof userId === "string" && userId !== "" ? userId : void 0;
+}
+async function devPrincipal(devCredentials, userId) {
+  if (!developmentSignInsAllowed()) {
+    throw refused("Development credentials are refused unless NODE_ENV is development or test");
+  }
+  const principal = await devCredentials(userId);
+  if (principal === null || principal === void 0) {
+    throw refused("No development user has that id");
+  }
+  if (principal.userId !== userId) {
+    throw new TypeError("socketAuth: devCredentials must return the principal of the user named");
+  }
+  return principal;
+}
+async function principalOfSession(session, loadPrincipal, owner) {
+  if (loadPrincipal === void 0) {
+    return { userId: session.userId, kind: "user" };
+  }
+  const principal = await loadPrincipal(session.userId, session);
+  if (principal === null || principal === void 0) {
+    throw refused("The session's user has no principal");
+  }
+  if (principal.userId !== session.userId) {
+    throw new TypeError(`${owner}: loadPrincipal must return the principal of the session's user`);
+  }
+  return principal;
+}
+function socketAuth(options) {
+  const keys = checkSessionKeys(options, "socketAuth");
+  const origins = originAllowlist(options.allowedOrigins, "socketAuth", true);
+  const naming = transportCookieNaming(options.cookieName);
+  const allowMissing = options.allowMissingOrigin === true;
+  const { loadPrincipal } = options;
+  if (loadPrincipal !== void 0 && typeof loadPrincipal !== "function") {
+    throw new TypeError("socketAuth: loadPrincipal must be a function");
+  }
+  const devCredentials = checkDevCredentials(options.devCredentials);
+  const authenticate = async (request) => {
+    const devUser = devCredentials === void 0 ? void 0 : devUserOf(request);
+    if (devCredentials !== void 0 && devUser !== void 0) {
+      return await devPrincipal(devCredentials, devUser);
+    }
+    const credential = credentialOf(request, naming);
+    if (credential === null) {
+      return null;
+    }
+    if (credential.checkOrigin) {
+      checkCookieOrigin(request, origins, allowMissing);
+    }
+    const session = await liveSession(keys, credential.token);
+    if (session === null) {
+      throw refused("The session is not valid");
+    }
+    if (request.transport === "socket") {
+      recordSocketSession(request.socket, session.id, session.expiresAt);
+    }
+    return await principalOfSession(session, loadPrincipal, "socketAuth");
+  };
+  markSocketAuth(authenticate, { devCredentials: devCredentials !== void 0 });
+  return authenticate;
+}
+
 // src/server/auth/routes/guest.ts
 var GUEST_MAX_BODY_BYTES = 16384;
 function guest(options) {
@@ -832,7 +944,7 @@ async function createGuest(settings, provider, req, res) {
     }
     settings.logger.error("Creating a guest user failed", {
       category: "quickdraw.auth",
-      error: error instanceof Error ? error.message : String(error)
+      error: errorText(error)
     });
     refuse(res, "INTERNAL", INTERNAL_MESSAGE);
     return null;
@@ -840,6 +952,10 @@ async function createGuest(settings, provider, req, res) {
 }
 function guestRoute(settings, provider) {
   return async (req, res) => {
+    if (!httpCookieOriginAllowed(req.headers, settings.origins)) {
+      refuse(res, "FORBIDDEN", COOKIE_REFUSED);
+      return;
+    }
     const user = await createGuest(settings, provider, req, res);
     if (user === null) {
       return;
@@ -880,7 +996,7 @@ async function loadLimiters(option) {
   if (option.signIn !== void 0 && option.session !== void 0 && option.providers !== void 0) {
     return option;
   }
-  const presets = await import("../../rateLimit-ZMIZJUZF.js");
+  const presets = await import("../../rateLimit-5RKBFLUR.js");
   return {
     signIn: option.signIn ?? presets.createAuthLimiter({ max: SIGN_IN_LIMIT }),
     session: option.session ?? presets.createAuthStatusLimiter(),
@@ -944,9 +1060,6 @@ function mockServes() {
 
 // src/server/auth/routes/oauth.ts
 var CATEGORY = "quickdraw.auth";
-function messageOf(error) {
-  return error instanceof Error ? error.message : String(error);
-}
 function startRoute(settings, flow) {
   return (req, res) => {
     if (flow.enabled?.() === false) {
@@ -961,7 +1074,10 @@ function startRoute(settings, flow) {
     }
     const state = newState();
     const location = flow.authorizeUrl(state, redirectUriOf(settings, flow.id));
-    const pending = encodePending({ state, provider: flow.id, origin, issuedAt: Date.now() });
+    const pending = encodePending(
+      { state, provider: flow.id, origin, issuedAt: Date.now() },
+      settings.stateKey
+    );
     res.cookie(stateCookieName(settings, req), pending, stateCookieOf(settings, req, true));
     redirect(res, location);
   };
@@ -974,7 +1090,7 @@ async function userFor(settings, flow, code) {
     settings.logger.warn("A sign-in's code exchange failed", {
       category: CATEGORY,
       provider: flow.id,
-      error: messageOf(error)
+      error: errorText(error)
     });
     return { error: "failed" };
   }
@@ -989,7 +1105,7 @@ async function userFor(settings, flow, code) {
     settings.logger.error("onLogin failed", {
       category: CATEGORY,
       provider: flow.id,
-      error: messageOf(error)
+      error: errorText(error)
     });
     return { error: "failed" };
   }
@@ -1012,7 +1128,7 @@ async function complete(settings, flow, req, res, origin) {
   } catch (error) {
     settings.logger.error("Creating a session failed", {
       category: CATEGORY,
-      error: messageOf(error)
+      error: errorText(error)
     });
     redirect(res, landingOf(settings, origin, "failed"));
     return;
@@ -1028,7 +1144,7 @@ function callbackRoute(settings, flow) {
       return;
     }
     const name = stateCookieName(settings, req);
-    const pending = decodePending(cookiesOf(req)[name]);
+    const pending = decodePending(cookiesOf(req)[name], settings.stateKey);
     res.clearCookie(name, stateCookieOf(settings, req));
     if (pending === null) {
       const { fallback } = settings.origins;
@@ -1060,13 +1176,24 @@ function callbackRoute(settings, flow) {
 
 // src/server/auth/routes/session.ts
 var NOT_SIGNED_IN = "Not signed in";
-function sessionOf(settings, req) {
-  const token = tokenOf(req, sessionCookieNaming(settings));
+function tokenFor(settings, req, res) {
+  const credential = httpCredentialOf(req, sessionCookieNaming(settings));
+  if (credential?.from === "cookie" && !httpCookieOriginAllowed(req.headers, settings.origins)) {
+    refuse(res, "FORBIDDEN", COOKIE_REFUSED);
+    return void 0;
+  }
+  return credential?.token ?? null;
+}
+function sessionOf(settings, token) {
   return token === null ? Promise.resolve(null) : liveSession(settings.keys, token);
 }
 function meRoute(settings) {
   return async (req, res) => {
-    const session = await sessionOf(settings, req);
+    const token = tokenFor(settings, req, res);
+    if (token === void 0) {
+      return;
+    }
+    const session = await sessionOf(settings, token);
     if (session === null) {
       refuse(res, "UNAUTHENTICATED", NOT_SIGNED_IN);
       return;
@@ -1081,14 +1208,17 @@ async function revoked(settings, userId, sessionId) {
     settings.logger.error("onRevoke failed", {
       category: "quickdraw.auth",
       userId,
-      error: error instanceof Error ? error.message : String(error)
+      error: errorText(error)
     });
   }
 }
 function logoutRoute(settings) {
   return async (req, res) => {
-    const token = tokenOf(req, sessionCookieNaming(settings));
-    const payload = token === null ? null : await verifyJWT(token, settings.keys.jwtSecret);
+    const token = tokenFor(settings, req, res);
+    if (token === void 0) {
+      return;
+    }
+    const payload = token === null ? null : await readVerifiedJWT(token, settings.keys.jwtSecret);
     if (payload?.sid !== void 0) {
       await settings.keys.sessions.revoke(payload.sid);
       settings.logger.info("Signed out", { category: "quickdraw.auth", userId: payload.userId });
@@ -1100,7 +1230,11 @@ function logoutRoute(settings) {
 }
 function logoutAllRoute(settings) {
   return async (req, res) => {
-    const session = await sessionOf(settings, req);
+    const token = tokenFor(settings, req, res);
+    if (token === void 0) {
+      return;
+    }
+    const session = await sessionOf(settings, token);
     clearSession(res, settings, req);
     if (session === null) {
       refuse(res, "UNAUTHENTICATED", NOT_SIGNED_IN);
@@ -1187,7 +1321,7 @@ function routeTable(settings, listed) {
   const mounted = providers.filter((provider) => addProvider(table, settings, provider));
   if (mounted.length === 0) {
     settings.logger.warn(
-      "createAuthRoutes: no provider can sign anyone in (the mock is mounted only while ENABLE_MOCK_OAUTH is set outside production): every sign-in route answers 404",
+      "createAuthRoutes: no provider can sign anyone in (the mock is mounted only while ENABLE_MOCK_OAUTH is set and NODE_ENV is development or test): every sign-in route answers 404",
       { category: "quickdraw.auth" }
     );
   }
@@ -1216,12 +1350,7 @@ async function serve(route, req, res) {
 }
 function dispatch(settings, limiters, route, req, res) {
   const fail = (error) => {
-    settings.logger.error("An auth route failed", {
-      category: "quickdraw.auth",
-      path: pathOf(req),
-      error: error instanceof Error ? error.message : String(error)
-    });
-    refuse(res, "INTERNAL", INTERNAL_MESSAGE);
+    failRoute(settings.logger, req, res, error);
   };
   if (limiters === null) {
     refuse(res, "INTERNAL", "The auth routes' rate limiters are unavailable");
@@ -1270,151 +1399,28 @@ function createAuthRoutes(options) {
   return Object.assign(routes, { providers: () => servedProviders(mounted) });
 }
 
-// src/server/auth/routes/socketAuth.ts
-function handshakeOf(request) {
-  const { handshake } = request.socket;
-  return { headers: request.headers, secure: handshake?.secure === true };
-}
-function credentialOf(request, naming) {
-  const { token } = request.auth;
-  if (typeof token === "string" && token !== "") {
-    return { token, checkOrigin: request.transport === "http" && request.credential === "cookie" };
-  }
-  if (request.transport === "http") {
-    return null;
-  }
-  const names = sessionCookieNamesFor(handshakeOf(request), naming);
-  const cookie = cookieToken(cookiesOf({ headers: request.headers }), names);
-  return cookie === null ? null : { token: cookie, checkOrigin: true };
-}
-function originAccepted(headers, origins, allowMissing) {
-  const { origin } = headers;
-  if (origin !== void 0) {
-    return origins.allowed(origin) !== null;
-  }
-  return allowMissing || headers["sec-fetch-site"] === "same-origin";
-}
-function httpOriginAccepted(headers, origins) {
-  const { origin } = headers;
-  if (origin !== void 0) {
-    return origins.allowed(origin) !== null;
-  }
-  const site = headers["sec-fetch-site"];
-  return site === void 0 || site === "same-origin";
-}
-var compiled = /* @__PURE__ */ new WeakMap();
-function cookieOriginAllowed(request, allowedOrigins, options = {}) {
-  let origins = compiled.get(allowedOrigins);
-  if (origins === void 0) {
-    origins = originAllowlist(allowedOrigins, "cookieOriginAllowed", true);
-    compiled.set(allowedOrigins, origins);
-  }
-  return request.transport === "socket" ? originAccepted(request.headers, origins, options.allowMissingOrigin === true) : httpOriginAccepted(request.headers, origins);
-}
-function httpCookieOriginAllowed(headers, origins) {
-  return httpOriginAccepted(headers, origins);
-}
-function checkCookieOrigin(request, origins, allowMissing) {
-  if (request.transport === "http") {
-    if (!httpOriginAccepted(request.headers, origins)) {
-      throw new QuickdrawError(
-        "FORBIDDEN",
-        "This page's origin may not use the session cookie; send it from an allowed origin or use a bearer token"
-      );
-    }
-    return;
-  }
-  if (!originAccepted(request.headers, origins, allowMissing)) {
-    throw refused("This page's origin may not use the session cookie on a socket");
-  }
-}
-function refused(message) {
-  return new QuickdrawError("UNAUTHENTICATED", message);
-}
-function production() {
-  return process.env.NODE_ENV === "production";
-}
-function checkDevCredentials(devCredentials) {
-  if (devCredentials === void 0) {
-    return void 0;
-  }
-  if (typeof devCredentials !== "function") {
-    throw new TypeError("socketAuth: devCredentials must be a function of the user id");
-  }
-  if (production()) {
-    throw new TypeError(
-      "socketAuth: devCredentials signs sockets in by a user id alone, so it cannot be used when NODE_ENV is production"
-    );
-  }
-  return devCredentials;
-}
-function devUserOf(request) {
-  const { token, userId } = request.auth;
-  const tokenless = token === void 0 || token === null || token === "";
-  return request.transport === "socket" && tokenless && typeof userId === "string" && userId !== "" ? userId : void 0;
-}
-async function devPrincipal(devCredentials, userId) {
-  if (production()) {
-    throw refused("Development credentials are refused in production");
-  }
-  const principal = await devCredentials(userId);
-  if (principal === null || principal === void 0) {
-    throw refused("No development user has that id");
-  }
-  if (principal.userId !== userId) {
-    throw new TypeError("socketAuth: devCredentials must return the principal of the user named");
-  }
-  return principal;
-}
-function socketAuth(options) {
-  const keys = checkSessionKeys(options, "socketAuth");
-  const origins = originAllowlist(options.allowedOrigins, "socketAuth", true);
-  const naming = transportCookieNaming(options.cookieName);
-  const allowMissing = options.allowMissingOrigin === true;
+// src/server/auth/routes/bearerAuth.ts
+function bearerAuth(options) {
+  const keys = checkSessionKeys(options, "bearerAuth");
   const { loadPrincipal } = options;
   if (loadPrincipal !== void 0 && typeof loadPrincipal !== "function") {
-    throw new TypeError("socketAuth: loadPrincipal must be a function");
+    throw new TypeError("bearerAuth: loadPrincipal must be a function");
   }
-  const devCredentials = checkDevCredentials(options.devCredentials);
-  return async (request) => {
-    const devUser = devCredentials === void 0 ? void 0 : devUserOf(request);
-    if (devCredentials !== void 0 && devUser !== void 0) {
-      return await devPrincipal(devCredentials, devUser);
-    }
-    const credential = credentialOf(request, naming);
-    if (credential === null) {
+  return async (token) => {
+    if (typeof token !== "string" || token === "") {
       return null;
     }
-    if (credential.checkOrigin) {
-      checkCookieOrigin(request, origins, allowMissing);
-    }
-    const session = await liveSession(keys, credential.token);
+    const session = await liveSession(keys, token);
     if (session === null) {
-      throw refused("The session is not valid");
-    }
-    if (request.transport === "socket") {
-      recordSocketSession(request.socket, session.id);
-    }
-    if (loadPrincipal === void 0) {
-      return { userId: session.userId, kind: "user" };
+      throw new QuickdrawError("UNAUTHENTICATED", "The session is not valid");
     }
-    const principal = await loadPrincipal(session.userId, session);
-    if (principal === null || principal === void 0) {
-      throw refused("The session's user has no principal");
-    }
-    if (principal.userId !== session.userId) {
-      throw new TypeError(
-        "socketAuth: loadPrincipal must return the principal of the session's user"
-      );
-    }
-    return principal;
+    return await principalOfSession(session, loadPrincipal, "bearerAuth");
   };
 }
 
 // src/server/auth/routes/requireSession.ts
 var SESSIONS = /* @__PURE__ */ new WeakMap();
 var NO_ORIGINS = originAllowlist([], "requireSession", true);
-var COOKIE_REFUSED = "This page's origin may not use the session cookie; send it from an allowed origin or use a bearer token";
 var NO_LIST = "requireSession has no origin list, so no page may use the session cookie: pass it the sessions object createAuthRoutes was given (the same store object: a second store over the same table is another), or pass allowedOrigins";
 function requireSession(keys, options = {}) {
   checkSessionKeys(keys, "requireSession");
@@ -1625,6 +1631,7 @@ export {
   OAUTH_STATE_COOKIE,
   OAUTH_STATE_TTL_MS,
   SESSION_COOKIE,
+  bearerAuth,
   clearSessionCookie,
   cookieOriginAllowed,
   createAuthRoutes,