@fluixi/oauth2 1.0.0-alpha.11 → 1.0.0-alpha.13

package/dist/server.cjs

@@ -1,4 +1,4 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.11 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/oauth2 v1.0.0-alpha.13 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -6,6 +6,9 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -28,11 +31,132 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/types.ts
+var OAuthError;
+var init_types = __esm({
+  "src/types.ts"() {
+    "use strict";
+    OAuthError = class extends Error {
+      constructor(message, code, description) {
+        super(message);
+        this.code = code;
+        this.description = description;
+        this.name = "OAuthError";
+      }
+    };
+  }
+});
+
+// src/dpop.ts
+var dpop_exports = {};
+__export(dpop_exports, {
+  boundKeyOf: () => boundKeyOf,
+  createDpopKey: () => createDpopKey,
+  exportDpopKey: () => exportDpopKey,
+  importDpopKey: () => importDpopKey,
+  nonceFrom: () => nonceFrom,
+  proofFor: () => proofFor,
+  thumbprintOf: () => thumbprintOf,
+  wantsNonce: () => wantsNonce
+});
+async function loadJose2() {
+  try {
+    return await import("jose");
+  } catch {
+    throw new OAuthError(
+      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function createDpopKey(alg = "ES256", options = {}) {
+  const jose = await loadJose2();
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
+  const publicJwk = { ...await jose.exportJWK(publicKey) };
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg
+  };
+}
+async function exportDpopKey(key) {
+  const jose = await loadJose2();
+  return { jwk: { ...await jose.exportJWK(key.privateKey) }, alg: key.alg };
+}
+async function importDpopKey(stored) {
+  const jose = await loadJose2();
+  const privateKey = await jose.importJWK(stored.jwk, stored.alg);
+  const publicJwk = Object.fromEntries(Object.entries(stored.jwk).filter(([k]) => !PRIVATE_MEMBERS.has(k)));
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg: stored.alg
+  };
+}
+async function thumbprintOf(jwk) {
+  const jose = await loadJose2();
+  return jose.calculateJwkThumbprint(jwk, "sha256");
+}
+async function proofFor(key, options) {
+  const jose = await loadJose2();
+  const htu = (() => {
+    try {
+      const url = new URL(options.url);
+      url.search = "";
+      url.hash = "";
+      return url.toString();
+    } catch {
+      return options.url;
+    }
+  })();
+  const claims = {
+    htm: options.method.toUpperCase(),
+    htu,
+    jti: crypto.randomUUID()
+  };
+  if (options.accessToken) {
+    const digest = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(options.accessToken)
+    );
+    let binary = "";
+    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+    claims.ath = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  if (options.nonce) claims.nonce = options.nonce;
+  return new jose.SignJWT(claims).setProtectedHeader({ typ: "dpop+jwt", alg: key.alg, jwk: key.publicJwk }).setIssuedAt().sign(key.privateKey);
+}
+function nonceFrom(response) {
+  return response.headers.get("dpop-nonce");
+}
+function wantsNonce(error, response) {
+  const code = typeof error === "string" ? error : error?.error;
+  return code === "use_dpop_nonce" || !!response && !!nonceFrom(response);
+}
+function boundKeyOf(claims) {
+  const cnf = claims.cnf;
+  return typeof cnf?.jkt === "string" ? cnf.jkt : null;
+}
+var PRIVATE_MEMBERS;
+var init_dpop = __esm({
+  "src/dpop.ts"() {
+    "use strict";
+    init_types();
+    PRIVATE_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+  }
+});
+
 // src/server.ts
 var server_exports = {};
 __export(server_exports, {
   authServerModule: () => authServerModule,
+  memoryLogouts: () => memoryLogouts,
   oauthRoutes: () => oauthRoutes,
+  requestAuth: () => requestAuth,
   sessionLocals: () => sessionLocals
 });
 module.exports = __toCommonJS(server_exports);
@@ -61,17 +185,8 @@ function safeReturnTo(candidate, options = {}) {
   return url.toString();
 }
 
-// src/types.ts
-var OAuthError = class extends Error {
-  constructor(message, code, description) {
-    super(message);
-    this.code = code;
-    this.description = description;
-    this.name = "OAuthError";
-  }
-};
-
 // src/client-auth.ts
+init_types();
 var CANONICAL = {
   basic: "client_secret_basic",
   body: "client_secret_post",
@@ -125,6 +240,7 @@ async function applyClientAuth(auth, endpoint, headers, form) {
 }
 
 // src/discovery.ts
+init_types();
 var cache = /* @__PURE__ */ new Map();
 function documentUrl(issuer) {
   return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
@@ -137,8 +253,12 @@ async function discover(issuer, fetcher = fetch) {
     try {
       response = await fetcher(documentUrl(issuer));
     } catch (cause) {
+      const why = cause instanceof Error ? cause.message : String(cause);
       throw new OAuthError(
-        `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`,
+        typeof window === "undefined" ? (
+          // On a server nothing blocks the read: the provider is down, or the address is wrong.
+          `Could not reach the provider at ${documentUrl(issuer)}: is it running, and is the issuer right? (${why})`
+        ) : `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${why})`,
         "discovery_unreachable"
       );
     }
@@ -163,6 +283,7 @@ async function discover(issuer, fetcher = fetch) {
       jwks: doc.jwks_uri,
       introspection: doc.introspection_endpoint,
       revocation: doc.revocation_endpoint,
+      checkSession: doc.check_session_iframe,
       issuer: doc.issuer ?? issuer
     };
   })();
@@ -171,6 +292,252 @@ async function discover(issuer, fetcher = fetch) {
   return pending;
 }
 
+// src/verify.ts
+init_types();
+var TokenError = class extends OAuthError {
+  constructor(message, code = "invalid_token") {
+    super(message, code);
+    this.name = "TokenError";
+  }
+};
+function bearerOf(request) {
+  const header = request.headers.get("authorization");
+  if (!header) return null;
+  const match = header.match(/^(?:Bearer|DPoP)\s+(.+)$/i);
+  return match ? match[1].trim() : null;
+}
+async function loadJose3() {
+  try {
+    return await import("jose");
+  } catch {
+    throw new OAuthError(
+      "Token verification needs `jose`. Install it: npm i jose. It is an optional peer so an app that does not verify does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+function createTokenVerifier(options) {
+  const issuers = (Array.isArray(options.issuer) ? options.issuer : [options.issuer]).filter(Boolean);
+  if (!issuers.length) {
+    throw new Error("[fluixi/oauth2] createTokenVerifier needs an issuer to accept tokens from.");
+  }
+  const discoveryIssuer = issuers[0];
+  if (options.audience === void 0) {
+    throw new Error(
+      "[fluixi/oauth2] createTokenVerifier needs an audience, or `audience: false` to say this service really does accept a token minted for any client of the issuer."
+    );
+  }
+  if (options.audience === false && options.authorizedParty === void 0) {
+    console.warn(
+      "[fluixi/oauth2] This verifier checks neither `aud` nor `azp`, so a token minted for any client of the issuer is accepted. Set `authorizedParty` if that is not what you meant."
+    );
+  }
+  const algorithms = options.algorithms ?? ["RS256"];
+  if (algorithms.some((alg) => !alg || alg.toLowerCase() === "none")) {
+    throw new Error("[fluixi/oauth2] `none` is not a signing algorithm and cannot be accepted.");
+  }
+  let keys = null;
+  async function keySet() {
+    if (keys) return keys;
+    const jose = await loadJose3();
+    if (options.jwks) {
+      keys = jose.createLocalJWKSet(options.jwks);
+      return keys;
+    }
+    let uri = options.jwksUri;
+    if (!uri) {
+      const endpoints = await discover(discoveryIssuer);
+      uri = endpoints.jwks;
+    }
+    if (!uri) {
+      throw new OAuthError(
+        `${discoveryIssuer} published no jwks_uri. Give the verifier one directly.`,
+        "no_jwks"
+      );
+    }
+    keys = jose.createRemoteJWKSet(new URL(uri));
+    return keys;
+  }
+  const checkProof = async (claims, token, request) => {
+    const jose = await loadJose3();
+    const { boundKeyOf: boundKeyOf2, thumbprintOf: thumbprintOf2 } = await Promise.resolve().then(() => (init_dpop(), dpop_exports));
+    const bound = boundKeyOf2(claims);
+    if (!bound) {
+      throw new TokenError(
+        "This token is not bound to a key, and this service requires binding.",
+        "token_not_bound"
+      );
+    }
+    const proof = request.headers.get("dpop");
+    if (!proof) throw new TokenError("The request carried no DPoP proof.", "missing_dpop_proof");
+    let payload;
+    let header;
+    try {
+      const result = await jose.jwtVerify(proof, jose.EmbeddedJWK, { typ: "dpop+jwt" });
+      payload = result.payload;
+      header = result.protectedHeader;
+    } catch (cause) {
+      throw new TokenError(
+        `The DPoP proof did not verify: ${cause instanceof Error ? cause.message : String(cause)}`,
+        "invalid_dpop_proof"
+      );
+    }
+    const presented = await thumbprintOf2(header.jwk);
+    if (presented !== bound) {
+      throw new TokenError(
+        "The DPoP proof was signed with a different key from the one this token is bound to.",
+        "dpop_key_mismatch"
+      );
+    }
+    const url = new URL(request.url);
+    url.search = "";
+    url.hash = "";
+    if (payload.htm !== request.method.toUpperCase()) {
+      throw new TokenError("The DPoP proof was made for a different method.", "invalid_dpop_proof");
+    }
+    if (payload.htu !== url.toString()) {
+      throw new TokenError("The DPoP proof was made for a different URL.", "invalid_dpop_proof");
+    }
+    if (typeof payload.ath === "string") {
+      const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
+      let binary = "";
+      for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+      const expected = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+      if (payload.ath !== expected) {
+        throw new TokenError("The DPoP proof was made for a different token.", "invalid_dpop_proof");
+      }
+    }
+    const age = Math.abs(Date.now() / 1e3 - payload.iat);
+    if (!Number.isFinite(age) || age > (options.dpopProofAgeSec ?? 10)) {
+      throw new TokenError("The DPoP proof is too old to accept.", "invalid_dpop_proof");
+    }
+  };
+  const verify = async (token, request) => {
+    if (!token) throw new TokenError("No token to verify.", "no_token");
+    const jose = await loadJose3();
+    let payload;
+    try {
+      ({ payload } = await jose.jwtVerify(token, await keySet(), {
+        // jose takes a list and accepts any of them, which is what a provider naming
+        // itself two ways needs.
+        issuer: issuers,
+        ...options.audience === false ? {} : { audience: options.audience },
+        algorithms,
+        clockTolerance: options.clockToleranceSec ?? 5
+      }));
+    } catch (cause) {
+      throw new TokenError(
+        `The token was not accepted: ${cause instanceof Error ? cause.message : String(cause)}`
+      );
+    }
+    if (options.authorizedParty !== void 0) {
+      const allowed = Array.isArray(options.authorizedParty) ? options.authorizedParty : [options.authorizedParty];
+      const issuedTo = payload.azp ?? payload.client_id;
+      if (typeof issuedTo !== "string" || !allowed.includes(issuedTo)) {
+        throw new TokenError("The token was issued to a different client.", "invalid_azp");
+      }
+    }
+    if (options.dpop) {
+      if (!request) {
+        throw new Error(
+          "[fluixi/oauth2] `dpop: true` needs the request to read its proof. Use `verify.fromRequest(request)` rather than verifying a bare token."
+        );
+      }
+      await checkProof(payload, token, request);
+    }
+    if (options.require) {
+      const verdict = options.require(payload);
+      if (verdict !== true) {
+        throw new TokenError(
+          typeof verdict === "string" ? verdict : "The token did not meet this service's requirements.",
+          "insufficient_claims"
+        );
+      }
+    }
+    return payload;
+  };
+  const verifier = verify;
+  verifier.bearerOf = bearerOf;
+  verifier.fromRequest = async (request) => {
+    const token = verifier.bearerOf(request);
+    if (!token) {
+      throw new TokenError("The request carried no bearer token.", "no_token");
+    }
+    return verify(token, request);
+  };
+  return verifier;
+}
+
+// src/backchannel.ts
+var LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+function memoryLogouts(ttlMs = 14 * 24 * 36e5) {
+  const sids = /* @__PURE__ */ new Map();
+  const subs = /* @__PURE__ */ new Map();
+  const prune = (now) => {
+    for (const map of [sids, subs]) for (const [key, at] of map) if (now - at > ttlMs) map.delete(key);
+  };
+  return {
+    add(entry) {
+      prune(Date.now());
+      if (entry.sid) sids.set(entry.sid, entry.at);
+      else if (entry.sub) subs.set(entry.sub, Math.max(entry.at, subs.get(entry.sub) ?? 0));
+    },
+    ended(session) {
+      if (session.sid && sids.has(session.sid)) return true;
+      const all = session.sub ? subs.get(session.sub) : void 0;
+      return all !== void 0 && session.since <= all;
+    }
+  };
+}
+function idTokenClaims(idToken) {
+  if (!idToken) return {};
+  try {
+    const part = idToken.split(".")[1] ?? "";
+    const json = atob(part.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(part.length / 4) * 4, "="));
+    const claims = JSON.parse(json);
+    return {
+      sid: typeof claims.sid === "string" ? claims.sid : void 0,
+      sub: typeof claims.sub === "string" ? claims.sub : void 0,
+      iat: typeof claims.iat === "number" ? claims.iat : void 0
+    };
+  } catch {
+    return {};
+  }
+}
+function headerOf(token) {
+  try {
+    const part = token.split(".")[0] ?? "";
+    return JSON.parse(atob(part.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(part.length / 4) * 4, "=")));
+  } catch {
+    return {};
+  }
+}
+function logoutTokenVerifier(options) {
+  const verify = createTokenVerifier({
+    issuer: options.issuer,
+    audience: options.clientId,
+    jwksUri: options.jwksUri,
+    jwks: options.jwks,
+    require: (claims) => {
+      const events = claims.events;
+      if (!events || typeof events !== "object" || !(LOGOUT_EVENT in events)) return "no logout event";
+      if ("nonce" in claims) return "a logout token has no nonce";
+      if (typeof claims.sid !== "string" && typeof claims.sub !== "string") return "names no session and no subject";
+      return true;
+    }
+  });
+  return async (token) => {
+    const typ = headerOf(token).typ;
+    if (typ !== void 0 && typ !== "logout+jwt") throw new Error("not a logout token");
+    const claims = await verify(token);
+    return {
+      sid: typeof claims.sid === "string" ? claims.sid : void 0,
+      sub: typeof claims.sub === "string" ? claims.sub : void 0,
+      at: (typeof claims.iat === "number" ? claims.iat : Math.floor(Date.now() / 1e3)) * 1e3
+    };
+  };
+}
+
 // src/pkce.ts
 function base64url(bytes) {
   let binary = "";
@@ -207,81 +574,62 @@ function expiryFrom(expiresIn, now = Date.now()) {
   return Number.isFinite(seconds) && seconds > 0 ? now + seconds * 1e3 : void 0;
 }
 
-// src/dpop.ts
-async function loadJose2() {
-  try {
-    return await import("jose");
-  } catch {
-    throw new OAuthError(
-      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
-      "jose_missing"
-    );
-  }
-}
-async function createDpopKey(alg = "ES256", options = {}) {
-  const jose = await loadJose2();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
-    extractable: options.extractable ?? false
-  });
-  const publicJwk = { ...await jose.exportJWK(publicKey) };
-  return {
-    privateKey,
-    publicJwk,
-    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
-    alg
-  };
+// src/server.ts
+init_types();
+init_dpop();
+var import_app = require("@fluixi/start/app");
+var RETRY_MARK = ".retry";
+var PROMPTS = /* @__PURE__ */ new Set(["none", "login", "consent", "select_account"]);
+var SILENT_REFUSALS = /* @__PURE__ */ new Set([
+  "login_required",
+  "consent_required",
+  "interaction_required",
+  "account_selection_required"
+]);
+function checkedCookie(config, sessionState) {
+  const name = `${config.cookieName ?? "fx_session"}_checked`;
+  const secure = config.secureCookie ?? true;
+  const maxAge = Math.max(0, Math.floor(config.silentRecheck ?? 60));
+  const value = sessionState ?? "1";
+  return { name, header: `${name}=${value}; Path=/; Max-Age=${maxAge}; HttpOnly; SameSite=Lax${secure ? "; Secure" : ""}` };
 }
-async function exportDpopKey(key) {
-  const jose = await loadJose2();
-  return { jwk: { ...await jose.exportJWK(key.privateKey) }, alg: key.alg };
+function sessionStateFrom(url) {
+  const value = url.searchParams.get("session_state");
+  return value && /^[\w-]{1,128}\.[\w-]{1,64}$/.test(value) ? value : void 0;
 }
-var PRIVATE_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
-async function importDpopKey(stored) {
-  const jose = await loadJose2();
-  const privateKey = await jose.importJWK(stored.jwk, stored.alg);
-  const publicJwk = Object.fromEntries(Object.entries(stored.jwk).filter(([k]) => !PRIVATE_MEMBERS.has(k)));
-  return {
-    privateKey,
-    publicJwk,
-    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
-    alg: stored.alg
-  };
+function isPageRequest(request) {
+  if (request.method !== "GET") return false;
+  const dest = request.headers.get("sec-fetch-dest");
+  if (dest) return dest === "document";
+  return (request.headers.get("accept") ?? "").includes("text/html");
 }
-async function proofFor(key, options) {
-  const jose = await loadJose2();
-  const htu = (() => {
-    try {
-      const url = new URL(options.url);
-      url.search = "";
-      url.hash = "";
-      return url.toString();
-    } catch {
-      return options.url;
-    }
-  })();
-  const claims = {
-    htm: options.method.toUpperCase(),
-    htu,
-    jti: crypto.randomUUID()
-  };
-  if (options.accessToken) {
-    const digest = await crypto.subtle.digest(
-      "SHA-256",
-      new TextEncoder().encode(options.accessToken)
-    );
-    let binary = "";
-    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
-    claims.ath = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function cookieValue(request, name) {
+  for (const part of (request.headers.get("cookie") ?? "").split(";")) {
+    const [key, ...rest] = part.trim().split("=");
+    if (key === name) return rest.join("=");
   }
-  if (options.nonce) claims.nonce = options.nonce;
-  return new jose.SignJWT(claims).setProtectedHeader({ typ: "dpop+jwt", alg: key.alg, jwk: key.publicJwk }).setIssuedAt().sign(key.privateKey);
+  return void 0;
 }
-function nonceFrom(response) {
-  return response.headers.get("dpop-nonce");
+function hasCookie(request, name) {
+  return cookieValue(request, name) !== void 0;
+}
+function under(pathname, path) {
+  return pathname === path || pathname.startsWith(path.endsWith("/") ? path : `${path}/`);
+}
+function signInRedirect(request, config) {
+  if (!isPageRequest(request)) return null;
+  const url = new URL(request.url);
+  const base = (config.basePath ?? "/auth").replace(/\/$/, "");
+  const guarded = (config.protectedPaths ?? []).some((path) => under(url.pathname, path));
+  const mode = guarded ? "required" : config.signIn ?? "manual";
+  if (mode === "manual") return null;
+  if ([base, ...config.publicPaths ?? []].some((path) => under(url.pathname, path))) return null;
+  if (url.searchParams.has("auth_error")) return null;
+  if (mode === "silent" && hasCookie(request, checkedCookie(config).name)) return null;
+  const login = new URLSearchParams({ returnTo: url.pathname + url.search });
+  if (mode === "silent") login.set("prompt", "none");
+  return new Response(null, { status: 302, headers: { location: `${base}/login?${login}` } });
 }
-
-// src/server.ts
-var import_app = require("@fluixi/start/app");
 var dpopNonces = /* @__PURE__ */ new Map();
 async function prove(headers, key, method, url, accessToken) {
   headers.dpop = await proofFor(key, { method, url, accessToken, nonce: dpopNonces.get(new URL(url).origin) });
@@ -294,27 +642,25 @@ function learnNonce(url, response) {
   dpopNonces.set(origin, offered);
   return fresh && !response.ok;
 }
-async function withToken(url, session) {
+async function sendAs(session, input, init = {}) {
+  const url = String(input);
+  const method = (init.method ?? "GET").toUpperCase();
   const key = session.dpop && session.tokenType?.toLowerCase() === "dpop" ? await importDpopKey(session.dpop) : null;
   const send = async () => {
-    const headers = {
+    const credentials = {
       authorization: `${key ? "DPoP" : "Bearer"} ${session.accessToken}`
     };
-    if (key) await prove(headers, key, "GET", url, session.accessToken);
-    return fetch(url, { headers });
+    if (key) await prove(credentials, key, method, url, session.accessToken);
+    const headers = new Headers(init.headers);
+    for (const [name, value] of Object.entries(credentials)) headers.set(name, value);
+    return fetch(url, { ...init, method, headers });
   };
   let response = await send();
   if (key && learnNonce(url, response)) response = await send();
   return response;
 }
-function oauthRoutes(config) {
-  const base = (config.basePath ?? "/auth").replace(/\/$/, "");
-  const scopes = config.scopes ?? ["openid", "profile", "email"];
-  const cookie = (0, import_server.createSessionCookie)({
-    secret: config.cookieSecret,
-    name: config.cookieName,
-    secure: config.secureCookie
-  });
+var withToken = (url, session) => sendAs(session, url);
+function tokenClient(config) {
   let endpoints = config.endpoints ?? null;
   const resolve = async () => {
     if (endpoints) return endpoints;
@@ -324,10 +670,6 @@ function oauthRoutes(config) {
     endpoints = await discover(config.issuer);
     return endpoints;
   };
-  const json = (body, status = 200, headers = {}) => new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json", ...headers }
-  });
   const clientAuth = {
     clientId: config.clientId,
     // `client_secret_post` by default here, which is what this half has always sent, so
@@ -360,17 +702,111 @@ function oauthRoutes(config) {
     }
     return payload;
   }
+  return { resolve, tokenRequest, clientAuth };
+}
+var renewals = /* @__PURE__ */ new Map();
+var RENEWAL_REUSE_MS = 3e4;
+function renew(current, tokenRequest) {
+  const refreshToken = current.refreshToken;
+  const now = Date.now();
+  for (const [key, entry] of renewals) if (entry.until <= now) renewals.delete(key);
+  const known = renewals.get(refreshToken);
+  if (known) return known.result;
+  const result = (async () => {
+    const key = current.dpop ? await importDpopKey(current.dpop) : null;
+    const payload = await tokenRequest({ grant_type: "refresh_token", refresh_token: refreshToken }, key);
+    return {
+      accessToken: String(payload.access_token ?? ""),
+      // A provider that rotates refresh tokens sends a new one; one that does not
+      // expects the old one to keep working.
+      refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : refreshToken,
+      idToken: typeof payload.id_token === "string" ? payload.id_token : current.idToken,
+      expiresAt: expiryFrom(payload.expires_in),
+      tokenType: typeof payload.token_type === "string" ? payload.token_type : current.tokenType,
+      dpop: current.dpop,
+      sessionState: current.sessionState
+    };
+  })().catch((error) => {
+    if (error instanceof OAuthError) return null;
+    renewals.delete(refreshToken);
+    throw error;
+  });
+  renewals.set(refreshToken, { until: now + RENEWAL_REUSE_MS, result });
+  return result;
+}
+var EXPIRY_SKEW_MS = 3e4;
+var expired = (session) => session.expiresAt !== void 0 && session.expiresAt - EXPIRY_SKEW_MS <= Date.now();
+var defaultLogouts = /* @__PURE__ */ new WeakMap();
+function logoutsOf(config) {
+  if (config.logouts) return config.logouts;
+  let store = defaultLogouts.get(config);
+  if (!store) defaultLogouts.set(config, store = memoryLogouts());
+  return store;
+}
+async function endedAtProvider(config, session) {
+  const id = idTokenClaims(session.idToken);
+  if (!id.sid && !id.sub) return false;
+  return logoutsOf(config).ended({ sid: id.sid, sub: id.sub, since: (id.iat ?? 0) * 1e3 });
+}
+function oauthRoutes(config) {
+  const { resolve, tokenRequest, clientAuth } = tokenClient(config);
+  const json = (body, status = 200, headers = {}) => new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json", ...headers }
+  });
+  const base = (config.basePath ?? "/auth").replace(/\/$/, "");
+  const scopes = config.scopes ?? ["openid", "profile", "email"];
+  const cookie = (0, import_server.createSessionCookie)({
+    secret: config.cookieSecret,
+    name: config.cookieName,
+    secure: config.secureCookie
+  });
   return async function middleware(request, next) {
     const url = new URL(request.url);
     if (!url.pathname.startsWith(`${base}/`)) return next();
     const route = url.pathname.slice(base.length);
     const session = async () => {
-      return cookie.read(request);
+      const current = await cookie.read(request);
+      return current && await endedAtProvider(config, current) ? null : current;
     };
+    if (route === "/backchannel-logout") {
+      const headers = { "cache-control": "no-store" };
+      if (request.method !== "POST") return json({ error: "invalid_request" }, 405, headers);
+      try {
+        const form = await request.formData();
+        const token = form.get("logout_token");
+        if (typeof token !== "string" || !token) throw new Error("no logout_token");
+        const endpoints = await resolve();
+        const issuer = endpoints.issuer ?? config.issuer;
+        if (!issuer) throw new Error("no issuer");
+        if (!endpoints.jwks) throw new Error("no jwks_uri");
+        const jwks = await (await fetch(endpoints.jwks)).json();
+        const entry = await logoutTokenVerifier({ issuer, clientId: config.clientId, jwks })(token);
+        await logoutsOf(config).add(entry);
+        return new Response(null, { status: 200, headers });
+      } catch {
+        return json({ error: "invalid_request" }, 400, headers);
+      }
+    }
     if (route === "/login") {
-      const { authorization } = await resolve();
+      let authorization;
+      try {
+        ({ authorization } = await resolve());
+      } catch (error) {
+        if (!(error instanceof OAuthError) || error.code !== "discovery_unreachable") throw error;
+        const back = safeReturnTo(url.searchParams.get("returnTo"), {
+          fallback: config.defaultReturnTo ?? "/",
+          origin: url.origin,
+          allowedOrigins: config.allowedReturnOrigins
+        });
+        const target2 = new URL(back, url.origin);
+        target2.searchParams.set("auth_error", "provider_unreachable");
+        const location2 = target2.origin === url.origin ? target2.pathname + target2.search : target2.toString();
+        return new Response(null, { status: 302, headers: { location: location2 } });
+      }
       const { verifier, challenge } = await createPkcePair();
-      const state = createStateValue();
+      const retry = url.searchParams.get("retry") === "1";
+      const state = createStateValue() + (retry ? RETRY_MARK : "");
       const target = new URL(authorization);
       target.searchParams.set("response_type", "code");
       target.searchParams.set("client_id", config.clientId);
@@ -379,6 +815,8 @@ function oauthRoutes(config) {
       target.searchParams.set("state", state);
       target.searchParams.set("code_challenge", challenge);
       target.searchParams.set("code_challenge_method", "S256");
+      const prompt = url.searchParams.get("prompt");
+      if (prompt && PROMPTS.has(prompt)) target.searchParams.set("prompt", prompt);
       const pendingCookie = await cookie.write(
         {
           accessToken: "",
@@ -391,7 +829,8 @@ function oauthRoutes(config) {
               fallback: "",
               origin: url.origin,
               allowedOrigins: config.allowedReturnOrigins
-            }) || void 0
+            }) || void 0,
+            silent: prompt === "none" || void 0
           }
         },
         // Ten minutes: long enough to sign in, short enough that an abandoned attempt
@@ -410,12 +849,43 @@ function oauthRoutes(config) {
       const current = await session();
       const pending = current?.pending;
       const error = url.searchParams.get("error");
-      if (error) return json({ error }, 400);
+      if (error) {
+        const ours = !!pending && timingSafeEqual(pending.state, url.searchParams.get("state") ?? "");
+        let location2 = safeReturnTo(ours ? pending.returnTo ?? config.defaultReturnTo : config.defaultReturnTo, {
+          fallback: "/",
+          origin: url.origin,
+          allowedOrigins: config.allowedReturnOrigins
+        });
+        const headers = new Headers();
+        headers.append("set-cookie", cookie.clear());
+        if (ours && pending.silent && SILENT_REFUSALS.has(error)) {
+          headers.append("set-cookie", checkedCookie(config, sessionStateFrom(url)).header);
+        } else {
+          const target = new URL(location2, url.origin);
+          target.searchParams.set("auth_error", error);
+          location2 = target.origin === url.origin ? target.pathname + target.search : target.toString();
+        }
+        headers.set("location", location2);
+        return new Response(null, { status: 302, headers });
+      }
       const code = url.searchParams.get("code");
       const state = url.searchParams.get("state");
       if (!code) return json({ error: "no_code" }, 400);
       if (!pending || !state || !timingSafeEqual(pending.state, state)) {
-        return json({ error: "state_mismatch" }, 400);
+        const home = safeReturnTo(config.defaultReturnTo, { fallback: "/", origin: url.origin, allowedOrigins: config.allowedReturnOrigins });
+        if (current?.accessToken) return new Response(null, { status: 302, headers: { location: home } });
+        if (!state?.endsWith(RETRY_MARK)) {
+          return new Response(null, { status: 302, headers: { location: `${base}/login?retry=1` } });
+        }
+        const target = new URL(home, url.origin);
+        target.searchParams.set("auth_error", "state_mismatch");
+        return new Response(null, {
+          status: 302,
+          headers: {
+            location: target.origin === url.origin ? target.pathname + target.search : target.toString(),
+            "set-cookie": cookie.clear()
+          }
+        });
       }
       const key = config.dpop ? await createDpopKey(config.dpopAlgorithm, { extractable: true }) : null;
       const payload = await tokenRequest(
@@ -433,7 +903,8 @@ function oauthRoutes(config) {
         idToken: typeof payload.id_token === "string" ? payload.id_token : void 0,
         expiresAt: expiryFrom(payload.expires_in),
         tokenType: typeof payload.token_type === "string" ? payload.token_type : void 0,
-        dpop: key ? await exportDpopKey(key) : void 0
+        dpop: key ? await exportDpopKey(key) : void 0,
+        sessionState: sessionStateFrom(url)
       });
       return new Response(null, {
         status: 302,
@@ -453,22 +924,9 @@ function oauthRoutes(config) {
     if (route === "/refresh") {
       const current = await session();
       if (!current?.refreshToken) return json({ error: "no_session" }, 401);
-      const key = current.dpop ? await importDpopKey(current.dpop) : null;
-      const payload = await tokenRequest(
-        { grant_type: "refresh_token", refresh_token: current.refreshToken },
-        key
-      );
-      const refreshed = await cookie.write({
-        accessToken: String(payload.access_token ?? ""),
-        // A provider that rotates refresh tokens sends a new one; one that does not
-        // expects the old one to keep working.
-        refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : current.refreshToken,
-        idToken: current.idToken,
-        expiresAt: expiryFrom(payload.expires_in),
-        tokenType: typeof payload.token_type === "string" ? payload.token_type : current.tokenType,
-        dpop: current.dpop
-      });
-      return json({ ok: true }, 200, { "set-cookie": refreshed });
+      const renewed = await renew(current, tokenRequest);
+      if (!renewed) return json({ error: "refresh_refused" }, 401, { "set-cookie": cookie.clear() });
+      return json({ ok: true }, 200, { "set-cookie": await cookie.write(renewed) });
     }
     if (route === "/me") {
       const current = await session();
@@ -480,6 +938,13 @@ function oauthRoutes(config) {
       const claims = await response.json();
       return json(config.mapUser ? config.mapUser(claims, current.accessToken) : claims);
     }
+    if (route === "/session-check") {
+      const { checkSession } = await resolve().catch(() => ({ checkSession: void 0 }));
+      const current = await session();
+      const checked = cookieValue(request, checkedCookie(config).name);
+      const state = current?.accessToken ? current.sessionState : checked !== "1" ? checked : void 0;
+      return json({ frame: checkSession ?? null, clientId: config.clientId, state: state ?? null });
+    }
     if (route === "/revoke") {
       const current = await session();
       const hint = url.searchParams.get("hint") === "access_token" ? "access_token" : "refresh_token";
@@ -502,31 +967,33 @@ function oauthRoutes(config) {
       const { endSession } = await resolve().catch(() => ({ endSession: void 0 }));
       const { revocation } = await resolve().catch(() => ({ revocation: void 0 }));
       if (revocation && current?.refreshToken) {
-        const headers = {
+        const headers2 = {
           "content-type": "application/x-www-form-urlencoded"
         };
         const form = new URLSearchParams({
           token: current.refreshToken,
           token_type_hint: "refresh_token"
         });
-        await applyClientAuth(clientAuth, revocation, headers, form);
-        await fetch(revocation, { method: "POST", headers, body: form.toString() }).catch(
+        await applyClientAuth(clientAuth, revocation, headers2, form);
+        await fetch(revocation, { method: "POST", headers: headers2, body: form.toString() }).catch(
           () => void 0
         );
       }
       const cleared = cookie.clear();
+      const headers = new Headers();
+      headers.append("set-cookie", cleared);
+      headers.append("set-cookie", checkedCookie(config).header);
       if (endSession && current?.idToken) {
         const target = new URL(endSession);
         target.searchParams.set("id_token_hint", current.idToken);
         if (config.defaultReturnTo) {
           target.searchParams.set("post_logout_redirect_uri", config.defaultReturnTo);
         }
-        return new Response(null, {
-          status: 302,
-          headers: { location: target.toString(), "set-cookie": cleared }
-        });
+        headers.set("location", target.toString());
+        return new Response(null, { status: 302, headers });
       }
-      return json({ ok: true }, 200, { "set-cookie": cleared });
+      headers.set("content-type", "application/json");
+      return new Response(JSON.stringify({ ok: true }), { status: 200, headers });
     }
     return next();
   };
@@ -537,6 +1004,7 @@ function sessionLocals(config) {
     name: config.cookieName,
     secure: config.secureCookie
   });
+  const { tokenRequest } = tokenClient(config);
   const ttl = config.userCacheMs ?? 3e4;
   const cache2 = /* @__PURE__ */ new Map();
   const remember = (token, user) => {
@@ -551,21 +1019,56 @@ function sessionLocals(config) {
   return async function middleware(request, next) {
     const { getRequestLocals } = await import("@fluixi/server");
     const locals = getRequestLocals(request);
-    const session = await cookie.read(request);
-    if (!session?.accessToken) {
+    let session = await cookie.read(request);
+    let setCookie;
+    const respond = async (response) => {
+      if (!setCookie) return response;
+      const copy = new Response(response.body, response);
+      copy.headers.append("set-cookie", setCookie);
+      return copy;
+    };
+    const renewOrDrop = async (current2) => {
+      const renewed = current2.refreshToken ? await renew(current2, tokenRequest) : null;
+      setCookie = renewed ? await cookie.write(renewed) : cookie.clear();
+      return renewed;
+    };
+    if (session?.accessToken && expired(session)) {
+      session = await renewOrDrop(session).catch(() => session);
+    }
+    const signedOut = async () => {
+      const redirect = signInRedirect(request, config);
+      if (redirect) return respond(redirect);
       locals.auth = { user: null, session: null };
-      return next();
+      return respond(await next());
+    };
+    if (!session?.accessToken) return signedOut();
+    if (await endedAtProvider(config, session)) {
+      setCookie = cookie.clear();
+      session = null;
+      return signedOut();
     }
-    const cached = cache2.get(session.accessToken);
+    const live = session;
+    const fetchAs = (input, init) => sendAs(live, input, init);
+    const cached = cache2.get(live.accessToken);
     if (cached && cached.until > Date.now()) {
-      locals.auth = { user: cached.user, session: { expiresAt: session.expiresAt } };
-      return next();
+      locals.auth = { user: cached.user, session: { expiresAt: live.expiresAt }, fetch: fetchAs };
+      return respond(await next());
     }
     let user = null;
+    let unreachable = false;
     try {
       const endpoints = config.endpoints ?? (config.issuer ? await discover(config.issuer) : null);
       if (endpoints?.userinfo) {
-        const response = await withToken(endpoints.userinfo, session);
+        let response = await withToken(endpoints.userinfo, session);
+        if (response.status === 401 && !setCookie) {
+          session = await renewOrDrop(session).catch(() => session);
+          if (!session) return signedOut();
+          response = await withToken(endpoints.userinfo, session);
+        }
+        if (response.status === 401) {
+          setCookie = cookie.clear();
+          return signedOut();
+        }
         if (response.ok) {
           const claims = await response.json();
           user = config.mapUser ? config.mapUser(claims, session.accessToken) : claims;
@@ -573,11 +1076,20 @@ function sessionLocals(config) {
         }
       }
     } catch {
+      unreachable = true;
     }
-    locals.auth = { user, session: user ? { expiresAt: session.expiresAt } : null };
-    return next();
+    if (!session) return signedOut();
+    const current = session;
+    const fetchCurrent = (input, init) => sendAs(current, input, init);
+    locals.auth = user ? { user, session: { expiresAt: current.expiresAt }, fetch: fetchCurrent } : { user: null, session: null, ...unreachable ? { unreachable: true } : {} };
+    return respond(await next());
   };
 }
+async function requestAuth(request) {
+  const { getLocals, getRequestLocals } = await import("@fluixi/server");
+  const locals = request ? getRequestLocals(request) : getLocals();
+  return locals.auth ?? { user: null, session: null };
+}
 function authServerModule(config) {
   return (0, import_app.defineModule)({ name: "oauth2-server", middleware: [oauthRoutes(config), sessionLocals(config)] });
 }