@fluixi/auth 1.0.0-alpha.83 → 1.0.0-alpha.85

package/dist/server.cjs

@@ -1 +1,148 @@
-"use strict";var a=Object.defineProperty;var S=Object.getOwnPropertyDescriptor;var k=Object.getOwnPropertyNames;var w=Object.prototype.hasOwnProperty;var C=(e,t)=>{for(var r in t)a(e,r,{get:t[r],enumerable:!0})},y=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of k(t))!w.call(e,s)&&s!==r&&a(e,s,{get:()=>t[s],enumerable:!(n=S(t,s))||n.enumerable});return e};var q=e=>y(a({},"__esModule",{value:!0}),e);var $={};C($,{AuthError:()=>i,authMiddleware:()=>O,defineAuth:()=>R,deleteCookie:()=>f,getAuth:()=>d,getCookie:()=>x,getCookies:()=>U,mountAuthRoutes:()=>P,optionalUser:()=>b,parseCookies:()=>o,requirePermission:()=>T,requireRole:()=>D,requireUser:()=>h,serializeCookie:()=>c});module.exports=q($);var u=require("@fluixi/server");var l="auth";var g=require("@fluixi/server");function o(e){let t={};if(!e)return t;for(let r of e.split(";")){let n=r.indexOf("=");if(n<0)continue;let s=r.slice(0,n).trim();s&&(t[s]=decodeURIComponent(r.slice(n+1).trim()))}return t}function c(e,t,r={}){let n={path:"/",httpOnly:!0,secure:!0,sameSite:"lax",...r},s=`${e}=${encodeURIComponent(t)}`;return n.maxAge!=null&&(s+=`; Max-Age=${Math.floor(n.maxAge)}`),n.expires&&(s+=`; Expires=${n.expires.toUTCString()}`),n.domain&&(s+=`; Domain=${n.domain}`),s+=`; Path=${n.path}`,n.httpOnly&&(s+="; HttpOnly"),n.secure&&(s+="; Secure"),s+=`; SameSite=${n.sameSite[0].toUpperCase()}${n.sameSite.slice(1)}`,s}function f(e,t={}){return c(e,"",{...t,maxAge:0})}function m(){return(0,g.getRequestEvent)()?.request?.headers??null}function x(e){return o(m()?.get("cookie"))[e]??null}function U(){return o(m()?.get("cookie"))}var p=null;function R(e){let t={raw:e,handler:r=>e.handler(r),getSession:async r=>{let n=await e.api.getSession({headers:r.headers});return{user:n?.user??null,session:n?.session??null}}};return p=t,t}function d(){if(!p)throw new Error("[@fluixi/auth] defineAuth() was not called — no auth instance registered.");return p}function P(){return e=>d().handler(e)}function O(){return async(e,t)=>{let r=await d().getSession(e);return(0,u.getRequestLocals)(e)[l]=r,t()}}var i=class extends Error{constructor(r,n,s){super(s??(r===401?"Unauthorized":"Forbidden"));this.status=r;this.redirectTo=n;this.name="AuthError"}};function A(){return(0,u.getLocals)()[l]??{user:null,session:null}}async function b(){return A().user}async function h(e){let t=A().user;if(!t)throw new i(401,e?.redirectTo??"/login");return t}async function D(e,t){let r=await h(t);if(r.role!==e)throw new i(403,t?.redirectTo);return r}async function T(e,t){if(await h(t),!(typeof e=="function"?e():e))throw new i(403,t?.redirectTo)}
+/*! @fluixi/auth v1.0.0-alpha.85 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  AuthError: () => AuthError,
+  authMiddleware: () => authMiddleware,
+  defineAuth: () => defineAuth,
+  deleteCookie: () => deleteCookie,
+  getAuth: () => getAuth,
+  getCookie: () => getCookie,
+  getCookies: () => getCookies,
+  mountAuthRoutes: () => mountAuthRoutes,
+  optionalUser: () => optionalUser,
+  parseCookies: () => parseCookies,
+  requirePermission: () => requirePermission,
+  requireRole: () => requireRole,
+  requireUser: () => requireUser,
+  serializeCookie: () => serializeCookie
+});
+module.exports = __toCommonJS(server_exports);
+var import_server2 = require("@fluixi/server");
+
+// src/types.ts
+var AUTH_LOCALS_KEY = "auth";
+
+// src/cookies.ts
+var import_server = require("@fluixi/server");
+function parseCookies(header) {
+  const out = {};
+  if (!header) return out;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    const k = part.slice(0, eq).trim();
+    if (k) out[k] = decodeURIComponent(part.slice(eq + 1).trim());
+  }
+  return out;
+}
+function serializeCookie(name, value, opts = {}) {
+  const o = {
+    path: "/",
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax",
+    ...opts
+  };
+  let s = `${name}=${encodeURIComponent(value)}`;
+  if (o.maxAge != null) s += `; Max-Age=${Math.floor(o.maxAge)}`;
+  if (o.expires) s += `; Expires=${o.expires.toUTCString()}`;
+  if (o.domain) s += `; Domain=${o.domain}`;
+  s += `; Path=${o.path}`;
+  if (o.httpOnly) s += "; HttpOnly";
+  if (o.secure) s += "; Secure";
+  s += `; SameSite=${o.sameSite[0].toUpperCase()}${o.sameSite.slice(1)}`;
+  return s;
+}
+function deleteCookie(name, opts = {}) {
+  return serializeCookie(name, "", { ...opts, maxAge: 0 });
+}
+function requestHeaders() {
+  const req = (0, import_server.getRequestEvent)()?.request;
+  return req?.headers ?? null;
+}
+function getCookie(name) {
+  return parseCookies(requestHeaders()?.get("cookie"))[name] ?? null;
+}
+function getCookies() {
+  return parseCookies(requestHeaders()?.get("cookie"));
+}
+
+// src/server.ts
+var _auth = null;
+function defineAuth(instance) {
+  const auth = {
+    raw: instance,
+    handler: (request) => instance.handler(request),
+    getSession: async (request) => {
+      const res = await instance.api.getSession({ headers: request.headers });
+      return { user: res?.user ?? null, session: res?.session ?? null };
+    }
+  };
+  _auth = auth;
+  return auth;
+}
+function getAuth() {
+  if (!_auth) {
+    throw new Error("[@fluixi/auth] defineAuth() was not called — no auth instance registered.");
+  }
+  return _auth;
+}
+function mountAuthRoutes() {
+  return (request) => getAuth().handler(request);
+}
+function authMiddleware() {
+  return async (request, next) => {
+    const session = await getAuth().getSession(request);
+    (0, import_server2.getRequestLocals)(request)[AUTH_LOCALS_KEY] = session;
+    return next();
+  };
+}
+var AuthError = class extends Error {
+  constructor(status, redirectTo, message) {
+    super(message ?? (status === 401 ? "Unauthorized" : "Forbidden"));
+    this.status = status;
+    this.redirectTo = redirectTo;
+    this.name = "AuthError";
+  }
+};
+function current() {
+  return (0, import_server2.getLocals)()[AUTH_LOCALS_KEY] ?? { user: null, session: null };
+}
+async function optionalUser() {
+  return current().user;
+}
+async function requireUser(opts) {
+  const user = current().user;
+  if (!user) throw new AuthError(401, opts?.redirectTo ?? "/login");
+  return user;
+}
+async function requireRole(role, opts) {
+  const user = await requireUser(opts);
+  if (user.role !== role) throw new AuthError(403, opts?.redirectTo);
+  return user;
+}
+async function requirePermission(check, opts) {
+  await requireUser(opts);
+  const ok = typeof check === "function" ? check() : check;
+  if (!ok) throw new AuthError(403, opts?.redirectTo);
+}

package/dist/server.d.ts

@@ -1,9 +1,9 @@
 /**
- * @fluixi/auth/server — the server-side bindings.
+ * @fluixi/auth/server: the server-side bindings.
  *
  * `defineAuth(betterAuth(...))` registers the engine; `authMiddleware()` resolves the
  * session once per request and writes it to `locals.auth` (via the @fluixi/start locals
- * bridge), so the server helpers — `requireUser`, `requireRole`, `requirePermission` —
+ * bridge), so the server helpers: `requireUser`, `requireRole`, `requirePermission` ,
  * are pure reads of request-scoped state. No manual token parsing; works inside loaders
  * AND server functions (same request context).
  */
@@ -33,7 +33,7 @@ export declare class AuthError extends Error {
     redirectTo?: string | undefined;
     constructor(status: 401 | 403, redirectTo?: string | undefined, message?: string);
 }
-/** The current user or null — never throws. */
+/** The current user or null: never throws. */
 export declare function optionalUser<U = AuthUser>(): Promise<U | null>;
 /** The current user, or throw `AuthError(401, redirectTo)`. */
 export declare function requireUser<U = AuthUser>(opts?: {

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,QAAQ;IACtC,2CAA2C;IAC3C,GAAG,EAAE,gBAAgB,CAAC;IACtB,8BAA8B;IAC9B,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,kEAAkE;IAClE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;CAC3D;AAMD,wBAAgB,UAAU,CAAC,CAAC,GAAG,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,GAAG,UAAU,CAAC,CAAC,CAAC,CAWlF;AAED,wBAAgB,OAAO,CAAC,CAAC,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAKrD;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAM3C;AAED,0FAA0F;AAC1F,qBAAa,SAAU,SAAQ,KAAK;IAEzB,MAAM,EAAE,GAAG,GAAG,GAAG;IACjB,UAAU,CAAC,EAAE,MAAM;gBADnB,MAAM,EAAE,GAAG,GAAG,GAAG,EACjB,UAAU,CAAC,EAAE,MAAM,YAAA,EAC1B,OAAO,CAAC,EAAE,MAAM;CAKnB;AAMD,+CAA+C;AAC/C,wBAAsB,YAAY,CAAC,CAAC,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAEpE;AAED,+DAA+D;AAC/D,wBAAsB,WAAW,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAI1F;AAED,0DAA0D;AAC1D,wBAAsB,WAAW,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,QAAQ,EACtE,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,CAAC,CAAC,CAIZ;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,EAChC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAIf;AAGD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,SAAS,EACT,UAAU,EACV,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,QAAQ;IACtC,2CAA2C;IAC3C,GAAG,EAAE,gBAAgB,CAAC;IACtB,8BAA8B;IAC9B,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,kEAAkE;IAClE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;CAC3D;AAMD,wBAAgB,UAAU,CAAC,CAAC,GAAG,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,GAAG,UAAU,CAAC,CAAC,CAAC,CAWlF;AAED,wBAAgB,OAAO,CAAC,CAAC,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAKrD;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAM3C;AAED,0FAA0F;AAC1F,qBAAa,SAAU,SAAQ,KAAK;IAEzB,MAAM,EAAE,GAAG,GAAG,GAAG;IACjB,UAAU,CAAC,EAAE,MAAM;gBADnB,MAAM,EAAE,GAAG,GAAG,GAAG,EACjB,UAAU,CAAC,EAAE,MAAM,YAAA,EAC1B,OAAO,CAAC,EAAE,MAAM;CAKnB;AAMD,8CAA8C;AAC9C,wBAAsB,YAAY,CAAC,CAAC,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAEpE;AAED,+DAA+D;AAC/D,wBAAsB,WAAW,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAI1F;AAED,0DAA0D;AAC1D,wBAAsB,WAAW,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,QAAQ,EACtE,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,CAAC,CAAC,CAIZ;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,EAChC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAIf;AAGD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,SAAS,EACT,UAAU,EACV,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/server.js

@@ -1,6 +1,6 @@
 import { getLocals, getRequestLocals } from '@fluixi/server';
 import { AUTH_LOCALS_KEY, } from './types.js';
-// Registered instance — so the helpers/middleware find "the" auth without the app
+// Registered instance: so the helpers/middleware find "the" auth without the app
 // threading it through every call. defineAuth sets it; getAuth reads it.
 let _auth = null;
 export function defineAuth(instance) {
@@ -51,7 +51,7 @@ export class AuthError extends Error {
 function current() {
     return getLocals()[AUTH_LOCALS_KEY] ?? { user: null, session: null };
 }
-/** The current user or null — never throws. */
+/** The current user or null: never throws. */
 export async function optionalUser() {
     return current().user;
 }
@@ -79,5 +79,5 @@ export async function requirePermission(check, opts) {
     if (!ok)
         throw new AuthError(403, opts?.redirectTo);
 }
-// Cookie API — proper, secure-by-default cookie management (parse/serialize/request reads).
+// Cookie API: proper, secure-by-default cookie management (parse/serialize/request reads).
 export { parseCookies, serializeCookie, deleteCookie, getCookie, getCookies, } from './cookies.js';

package/dist/server.mjs

@@ -1 +1,128 @@
-import{getLocals as U,getRequestLocals as A}from"@fluixi/server";var o="auth";import{getRequestEvent as g}from"@fluixi/server";function u(e){let t={};if(!e)return t;for(let n of e.split(";")){let r=n.indexOf("=");if(r<0)continue;let s=n.slice(0,r).trim();s&&(t[s]=decodeURIComponent(n.slice(r+1).trim()))}return t}function l(e,t,n={}){let r={path:"/",httpOnly:!0,secure:!0,sameSite:"lax",...n},s=`${e}=${encodeURIComponent(t)}`;return r.maxAge!=null&&(s+=`; Max-Age=${Math.floor(r.maxAge)}`),r.expires&&(s+=`; Expires=${r.expires.toUTCString()}`),r.domain&&(s+=`; Domain=${r.domain}`),s+=`; Path=${r.path}`,r.httpOnly&&(s+="; HttpOnly"),r.secure&&(s+="; Secure"),s+=`; SameSite=${r.sameSite[0].toUpperCase()}${r.sameSite.slice(1)}`,s}function f(e,t={}){return l(e,"",{...t,maxAge:0})}function c(){return g()?.request?.headers??null}function m(e){return u(c()?.get("cookie"))[e]??null}function x(){return u(c()?.get("cookie"))}var a=null;function q(e){let t={raw:e,handler:n=>e.handler(n),getSession:async n=>{let r=await e.api.getSession({headers:n.headers});return{user:r?.user??null,session:r?.session??null}}};return a=t,t}function p(){if(!a)throw new Error("[@fluixi/auth] defineAuth() was not called — no auth instance registered.");return a}function R(){return e=>p().handler(e)}function P(){return async(e,t)=>{let n=await p().getSession(e);return A(e)[o]=n,t()}}var i=class extends Error{constructor(n,r,s){super(s??(n===401?"Unauthorized":"Forbidden"));this.status=n;this.redirectTo=r;this.name="AuthError"}};function d(){return U()[o]??{user:null,session:null}}async function O(){return d().user}async function h(e){let t=d().user;if(!t)throw new i(401,e?.redirectTo??"/login");return t}async function b(e,t){let n=await h(t);if(n.role!==e)throw new i(403,t?.redirectTo);return n}async function D(e,t){if(await h(t),!(typeof e=="function"?e():e))throw new i(403,t?.redirectTo)}export{i as AuthError,P as authMiddleware,q as defineAuth,f as deleteCookie,p as getAuth,m as getCookie,x as getCookies,R as mountAuthRoutes,O as optionalUser,u as parseCookies,D as requirePermission,b as requireRole,h as requireUser,l as serializeCookie};
+/*! @fluixi/auth v1.0.0-alpha.85 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+
+// src/server.ts
+import { getLocals, getRequestLocals } from "@fluixi/server";
+
+// src/types.ts
+var AUTH_LOCALS_KEY = "auth";
+
+// src/cookies.ts
+import { getRequestEvent } from "@fluixi/server";
+function parseCookies(header) {
+  const out = {};
+  if (!header) return out;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    const k = part.slice(0, eq).trim();
+    if (k) out[k] = decodeURIComponent(part.slice(eq + 1).trim());
+  }
+  return out;
+}
+function serializeCookie(name, value, opts = {}) {
+  const o = {
+    path: "/",
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax",
+    ...opts
+  };
+  let s = `${name}=${encodeURIComponent(value)}`;
+  if (o.maxAge != null) s += `; Max-Age=${Math.floor(o.maxAge)}`;
+  if (o.expires) s += `; Expires=${o.expires.toUTCString()}`;
+  if (o.domain) s += `; Domain=${o.domain}`;
+  s += `; Path=${o.path}`;
+  if (o.httpOnly) s += "; HttpOnly";
+  if (o.secure) s += "; Secure";
+  s += `; SameSite=${o.sameSite[0].toUpperCase()}${o.sameSite.slice(1)}`;
+  return s;
+}
+function deleteCookie(name, opts = {}) {
+  return serializeCookie(name, "", { ...opts, maxAge: 0 });
+}
+function requestHeaders() {
+  const req = getRequestEvent()?.request;
+  return req?.headers ?? null;
+}
+function getCookie(name) {
+  return parseCookies(requestHeaders()?.get("cookie"))[name] ?? null;
+}
+function getCookies() {
+  return parseCookies(requestHeaders()?.get("cookie"));
+}
+
+// src/server.ts
+var _auth = null;
+function defineAuth(instance) {
+  const auth = {
+    raw: instance,
+    handler: (request) => instance.handler(request),
+    getSession: async (request) => {
+      const res = await instance.api.getSession({ headers: request.headers });
+      return { user: res?.user ?? null, session: res?.session ?? null };
+    }
+  };
+  _auth = auth;
+  return auth;
+}
+function getAuth() {
+  if (!_auth) {
+    throw new Error("[@fluixi/auth] defineAuth() was not called — no auth instance registered.");
+  }
+  return _auth;
+}
+function mountAuthRoutes() {
+  return (request) => getAuth().handler(request);
+}
+function authMiddleware() {
+  return async (request, next) => {
+    const session = await getAuth().getSession(request);
+    getRequestLocals(request)[AUTH_LOCALS_KEY] = session;
+    return next();
+  };
+}
+var AuthError = class extends Error {
+  constructor(status, redirectTo, message) {
+    super(message ?? (status === 401 ? "Unauthorized" : "Forbidden"));
+    this.status = status;
+    this.redirectTo = redirectTo;
+    this.name = "AuthError";
+  }
+};
+function current() {
+  return getLocals()[AUTH_LOCALS_KEY] ?? { user: null, session: null };
+}
+async function optionalUser() {
+  return current().user;
+}
+async function requireUser(opts) {
+  const user = current().user;
+  if (!user) throw new AuthError(401, opts?.redirectTo ?? "/login");
+  return user;
+}
+async function requireRole(role, opts) {
+  const user = await requireUser(opts);
+  if (user.role !== role) throw new AuthError(403, opts?.redirectTo);
+  return user;
+}
+async function requirePermission(check, opts) {
+  await requireUser(opts);
+  const ok = typeof check === "function" ? check() : check;
+  if (!ok) throw new AuthError(403, opts?.redirectTo);
+}
+export {
+  AuthError,
+  authMiddleware,
+  defineAuth,
+  deleteCookie,
+  getAuth,
+  getCookie,
+  getCookies,
+  mountAuthRoutes,
+  optionalUser,
+  parseCookies,
+  requirePermission,
+  requireRole,
+  requireUser,
+  serializeCookie
+};