@gatwech/auth 1.0.0-beta.18

package/dist/plugins-3jfNste3.mjs

@@ -0,0 +1,1544 @@
+import { t as APIError } from "./api-0pR_I-Nx.mjs";
+import { t as getIp } from "./get-request-ip-DSjrEpGo.mjs";
+import { t as safeJSONParse } from "./json-D0TBLy4q.mjs";
+import { r as generateRandomString } from "./crypto-Bb42eMrH.mjs";
+import { n as mergeSchema, t as getDate } from "./date-Cx2yCiC4.mjs";
+import { r as getSessionFromCtx, u as sessionMiddleware } from "./session-Dgp133Yt.mjs";
+import { n as parser_default } from "./parser-DcrIEuXE.mjs";
+import { n as role } from "./access-BO2g7QVe.mjs";
+import { defineErrorCodes } from "@gatwech/core/utils";
+import { createAuthEndpoint, createAuthEndpoint as createAuthEndpoint$1, createAuthMiddleware, createAuthMiddleware as createAuthMiddleware$1, optionsMiddleware } from "@gatwech/core/api";
+import * as z$1 from "zod";
+import { createHash } from "@gatwech/utils/hash";
+import { base64Url } from "@gatwech/utils/base64";
+
+//#region src/plugins/api-key/schema.ts
+const apiKeySchema = ({ timeWindow, rateLimitMax }) => ({ apikey: { fields: {
+	name: {
+		type: "string",
+		required: false,
+		input: false
+	},
+	start: {
+		type: "string",
+		required: false,
+		input: false
+	},
+	prefix: {
+		type: "string",
+		required: false,
+		input: false
+	},
+	key: {
+		type: "string",
+		required: true,
+		input: false
+	},
+	userId: {
+		type: "string",
+		references: {
+			model: "user",
+			field: "id",
+			onDelete: "cascade"
+		},
+		required: true,
+		input: false
+	},
+	refillInterval: {
+		type: "number",
+		required: false,
+		input: false
+	},
+	refillAmount: {
+		type: "number",
+		required: false,
+		input: false
+	},
+	lastRefillAt: {
+		type: "date",
+		required: false,
+		input: false
+	},
+	enabled: {
+		type: "boolean",
+		required: false,
+		input: false,
+		defaultValue: true
+	},
+	rateLimitEnabled: {
+		type: "boolean",
+		required: false,
+		input: false,
+		defaultValue: true
+	},
+	rateLimitTimeWindow: {
+		type: "number",
+		required: false,
+		input: false,
+		defaultValue: timeWindow
+	},
+	rateLimitMax: {
+		type: "number",
+		required: false,
+		input: false,
+		defaultValue: rateLimitMax
+	},
+	requestCount: {
+		type: "number",
+		required: false,
+		input: false,
+		defaultValue: 0
+	},
+	remaining: {
+		type: "number",
+		required: false,
+		input: false
+	},
+	lastRequest: {
+		type: "date",
+		required: false,
+		input: false
+	},
+	expiresAt: {
+		type: "date",
+		required: false,
+		input: false
+	},
+	createdAt: {
+		type: "date",
+		required: true,
+		input: false
+	},
+	updatedAt: {
+		type: "date",
+		required: true,
+		input: false
+	},
+	permissions: {
+		type: "string",
+		required: false,
+		input: false
+	},
+	metadata: {
+		type: "string",
+		required: false,
+		input: true,
+		transform: {
+			input(value) {
+				return JSON.stringify(value);
+			},
+			output(value) {
+				if (!value) return null;
+				return parser_default(value);
+			}
+		}
+	}
+} } });
+
+//#endregion
+//#region src/plugins/api-key/routes/create-api-key.ts
+function createApiKey({ keyGenerator, opts, schema, deleteAllExpiredApiKeys: deleteAllExpiredApiKeys$1 }) {
+	return createAuthEndpoint("/api-key/create", {
+		method: "POST",
+		body: z$1.object({
+			name: z$1.string().meta({ description: "Name of the Api Key" }).optional(),
+			expiresIn: z$1.number().meta({ description: "Expiration time of the Api Key in seconds" }).min(1).optional().nullable().default(null),
+			userId: z$1.coerce.string().meta({ description: "User Id of the user that the Api Key belongs to. server-only. Eg: \"user-id\"" }).optional(),
+			prefix: z$1.string().meta({ description: "Prefix of the Api Key" }).regex(/^[a-zA-Z0-9_-]+$/, { message: "Invalid prefix format, must be alphanumeric and contain only underscores and hyphens." }).optional(),
+			remaining: z$1.number().meta({ description: "Remaining number of requests. Server side only" }).min(0).optional().nullable().default(null),
+			metadata: z$1.any().optional(),
+			refillAmount: z$1.number().meta({ description: "Amount to refill the remaining count of the Api Key. server-only. Eg: 100" }).min(1).optional(),
+			refillInterval: z$1.number().meta({ description: "Interval to refill the Api Key in milliseconds. server-only. Eg: 1000" }).optional(),
+			rateLimitTimeWindow: z$1.number().meta({ description: "The duration in milliseconds where each request is counted. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 1000" }).optional(),
+			rateLimitMax: z$1.number().meta({ description: "Maximum amount of requests allowed within a window. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 100" }).optional(),
+			rateLimitEnabled: z$1.boolean().meta({ description: "Whether the key has rate limiting enabled. server-only. Eg: true" }).optional(),
+			permissions: z$1.record(z$1.string(), z$1.array(z$1.string())).meta({ description: "Permissions of the Api Key." }).optional()
+		}),
+		metadata: { openapi: {
+			description: "Create a new API key for a user",
+			responses: { "200": {
+				description: "API key created successfully",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: {
+						id: {
+							type: "string",
+							description: "Unique identifier of the API key"
+						},
+						createdAt: {
+							type: "string",
+							format: "date-time",
+							description: "Creation timestamp"
+						},
+						updatedAt: {
+							type: "string",
+							format: "date-time",
+							description: "Last update timestamp"
+						},
+						name: {
+							type: "string",
+							nullable: true,
+							description: "Name of the API key"
+						},
+						prefix: {
+							type: "string",
+							nullable: true,
+							description: "Prefix of the API key"
+						},
+						start: {
+							type: "string",
+							nullable: true,
+							description: "Starting characters of the key (if configured)"
+						},
+						key: {
+							type: "string",
+							description: "The full API key (only returned on creation)"
+						},
+						enabled: {
+							type: "boolean",
+							description: "Whether the key is enabled"
+						},
+						expiresAt: {
+							type: "string",
+							format: "date-time",
+							nullable: true,
+							description: "Expiration timestamp"
+						},
+						userId: {
+							type: "string",
+							description: "ID of the user owning the key"
+						},
+						lastRefillAt: {
+							type: "string",
+							format: "date-time",
+							nullable: true,
+							description: "Last refill timestamp"
+						},
+						lastRequest: {
+							type: "string",
+							format: "date-time",
+							nullable: true,
+							description: "Last request timestamp"
+						},
+						metadata: {
+							type: "object",
+							nullable: true,
+							additionalProperties: true,
+							description: "Metadata associated with the key"
+						},
+						rateLimitMax: {
+							type: "number",
+							nullable: true,
+							description: "Maximum requests in time window"
+						},
+						rateLimitTimeWindow: {
+							type: "number",
+							nullable: true,
+							description: "Rate limit time window in milliseconds"
+						},
+						remaining: {
+							type: "number",
+							nullable: true,
+							description: "Remaining requests"
+						},
+						refillAmount: {
+							type: "number",
+							nullable: true,
+							description: "Amount to refill"
+						},
+						refillInterval: {
+							type: "number",
+							nullable: true,
+							description: "Refill interval in milliseconds"
+						},
+						rateLimitEnabled: {
+							type: "boolean",
+							description: "Whether rate limiting is enabled"
+						},
+						requestCount: {
+							type: "number",
+							description: "Current request count in window"
+						},
+						permissions: {
+							type: "object",
+							nullable: true,
+							additionalProperties: {
+								type: "array",
+								items: { type: "string" }
+							},
+							description: "Permissions associated with the key"
+						}
+					},
+					required: [
+						"id",
+						"createdAt",
+						"updatedAt",
+						"key",
+						"enabled",
+						"userId",
+						"rateLimitEnabled",
+						"requestCount"
+					]
+				} } }
+			} }
+		} }
+	}, async (ctx) => {
+		const { name, expiresIn, prefix, remaining, metadata, refillAmount, refillInterval, permissions, rateLimitMax, rateLimitTimeWindow, rateLimitEnabled } = ctx.body;
+		const session = await getSessionFromCtx(ctx);
+		const authRequired = ctx.request || ctx.headers;
+		const user = authRequired && !session ? null : session?.user || { id: ctx.body.userId };
+		if (!user?.id) throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.UNAUTHORIZED_SESSION });
+		if (session && ctx.body.userId && session?.user.id !== ctx.body.userId) throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.UNAUTHORIZED_SESSION });
+		if (authRequired) {
+			if (refillAmount !== void 0 || refillInterval !== void 0 || rateLimitMax !== void 0 || rateLimitTimeWindow !== void 0 || rateLimitEnabled !== void 0 || permissions !== void 0 || remaining !== null) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.SERVER_ONLY_PROPERTY });
+		}
+		if (metadata) {
+			if (opts.enableMetadata === false) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.METADATA_DISABLED });
+			if (typeof metadata !== "object") throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_METADATA_TYPE });
+		}
+		if (refillAmount && !refillInterval) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.REFILL_AMOUNT_AND_INTERVAL_REQUIRED });
+		if (refillInterval && !refillAmount) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.REFILL_INTERVAL_AND_AMOUNT_REQUIRED });
+		if (expiresIn) {
+			if (opts.keyExpiration.disableCustomExpiresTime === true) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.KEY_DISABLED_EXPIRATION });
+			const expiresIn_in_days = expiresIn / (3600 * 24);
+			if (opts.keyExpiration.minExpiresIn > expiresIn_in_days) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.EXPIRES_IN_IS_TOO_SMALL });
+			else if (opts.keyExpiration.maxExpiresIn < expiresIn_in_days) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.EXPIRES_IN_IS_TOO_LARGE });
+		}
+		if (prefix) {
+			if (prefix.length < opts.minimumPrefixLength) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_PREFIX_LENGTH });
+			if (prefix.length > opts.maximumPrefixLength) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_PREFIX_LENGTH });
+		}
+		if (name) {
+			if (name.length < opts.minimumNameLength) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_NAME_LENGTH });
+			if (name.length > opts.maximumNameLength) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_NAME_LENGTH });
+		} else if (opts.requireName) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.NAME_REQUIRED });
+		deleteAllExpiredApiKeys$1(ctx.context);
+		const key = await keyGenerator({
+			length: opts.defaultKeyLength,
+			prefix: prefix || opts.defaultPrefix
+		});
+		const hashed = opts.disableKeyHashing ? key : await defaultKeyHasher(key);
+		let start = null;
+		if (opts.startingCharactersConfig.shouldStore) start = key.substring(0, opts.startingCharactersConfig.charactersLength);
+		const defaultPermissions = opts.permissions?.defaultPermissions ? typeof opts.permissions.defaultPermissions === "function" ? await opts.permissions.defaultPermissions(user.id, ctx) : opts.permissions.defaultPermissions : void 0;
+		const permissionsToApply = permissions ? JSON.stringify(permissions) : defaultPermissions ? JSON.stringify(defaultPermissions) : void 0;
+		let data = {
+			createdAt: /* @__PURE__ */ new Date(),
+			updatedAt: /* @__PURE__ */ new Date(),
+			name: name ?? null,
+			prefix: prefix ?? opts.defaultPrefix ?? null,
+			start,
+			key: hashed,
+			enabled: true,
+			expiresAt: expiresIn ? getDate(expiresIn, "sec") : opts.keyExpiration.defaultExpiresIn ? getDate(opts.keyExpiration.defaultExpiresIn, "sec") : null,
+			userId: user.id,
+			lastRefillAt: null,
+			lastRequest: null,
+			metadata: null,
+			rateLimitMax: rateLimitMax ?? opts.rateLimit.maxRequests ?? null,
+			rateLimitTimeWindow: rateLimitTimeWindow ?? opts.rateLimit.timeWindow ?? null,
+			remaining: remaining === null ? remaining : remaining ?? refillAmount ?? null,
+			refillAmount: refillAmount ?? null,
+			refillInterval: refillInterval ?? null,
+			rateLimitEnabled: rateLimitEnabled === void 0 ? opts.rateLimit.enabled ?? true : rateLimitEnabled,
+			requestCount: 0,
+			permissions: permissionsToApply
+		};
+		if (metadata) data.metadata = schema.apikey.fields.metadata.transform.input(metadata);
+		const apiKey$1 = await ctx.context.adapter.create({
+			model: API_KEY_TABLE_NAME,
+			data
+		});
+		return ctx.json({
+			...apiKey$1,
+			key,
+			metadata: metadata ?? null,
+			permissions: apiKey$1.permissions ? safeJSONParse(apiKey$1.permissions) : null
+		});
+	});
+}
+
+//#endregion
+//#region src/plugins/api-key/routes/delete-all-expired-api-keys.ts
+function deleteAllExpiredApiKeysEndpoint({ deleteAllExpiredApiKeys: deleteAllExpiredApiKeys$1 }) {
+	return createAuthEndpoint("/api-key/delete-all-expired-api-keys", {
+		method: "POST",
+		metadata: {
+			SERVER_ONLY: true,
+			client: false
+		}
+	}, async (ctx) => {
+		try {
+			await deleteAllExpiredApiKeys$1(ctx.context, true);
+		} catch (error) {
+			ctx.context.logger.error("[API KEY PLUGIN] Failed to delete expired API keys:", error);
+			return ctx.json({
+				success: false,
+				error
+			});
+		}
+		return ctx.json({
+			success: true,
+			error: null
+		});
+	});
+}
+
+//#endregion
+//#region src/plugins/api-key/routes/delete-api-key.ts
+function deleteApiKey({ opts, schema, deleteAllExpiredApiKeys: deleteAllExpiredApiKeys$1 }) {
+	return createAuthEndpoint("/api-key/delete", {
+		method: "POST",
+		body: z$1.object({ keyId: z$1.string().meta({ description: "The id of the Api Key" }) }),
+		use: [sessionMiddleware],
+		metadata: { openapi: {
+			description: "Delete an existing API key",
+			requestBody: { content: { "application/json": { schema: {
+				type: "object",
+				properties: { keyId: {
+					type: "string",
+					description: "The id of the API key to delete"
+				} },
+				required: ["keyId"]
+			} } } },
+			responses: { "200": {
+				description: "API key deleted successfully",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: { success: {
+						type: "boolean",
+						description: "Indicates if the API key was successfully deleted"
+					} },
+					required: ["success"]
+				} } }
+			} }
+		} }
+	}, async (ctx) => {
+		const { keyId } = ctx.body;
+		const session = ctx.context.session;
+		if (session.user.banned === true) throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.USER_BANNED });
+		const apiKey$1 = await ctx.context.adapter.findOne({
+			model: API_KEY_TABLE_NAME,
+			where: [{
+				field: "id",
+				value: keyId
+			}]
+		});
+		if (!apiKey$1 || apiKey$1.userId !== session.user.id) throw new APIError("NOT_FOUND", { message: ERROR_CODES.KEY_NOT_FOUND });
+		try {
+			await ctx.context.adapter.delete({
+				model: API_KEY_TABLE_NAME,
+				where: [{
+					field: "id",
+					value: apiKey$1.id
+				}]
+			});
+		} catch (error) {
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: error?.message });
+		}
+		deleteAllExpiredApiKeys$1(ctx.context);
+		return ctx.json({ success: true });
+	});
+}
+
+//#endregion
+//#region src/plugins/api-key/routes/get-api-key.ts
+function getApiKey({ opts, schema, deleteAllExpiredApiKeys: deleteAllExpiredApiKeys$1 }) {
+	return createAuthEndpoint("/api-key/get", {
+		method: "GET",
+		query: z$1.object({ id: z$1.string().meta({ description: "The id of the Api Key" }) }),
+		use: [sessionMiddleware],
+		metadata: { openapi: {
+			description: "Retrieve an existing API key by ID",
+			responses: { "200": {
+				description: "API key retrieved successfully",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: {
+						id: {
+							type: "string",
+							description: "ID"
+						},
+						name: {
+							type: "string",
+							nullable: true,
+							description: "The name of the key"
+						},
+						start: {
+							type: "string",
+							nullable: true,
+							description: "Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key."
+						},
+						prefix: {
+							type: "string",
+							nullable: true,
+							description: "The API Key prefix. Stored as plain text."
+						},
+						userId: {
+							type: "string",
+							description: "The owner of the user id"
+						},
+						refillInterval: {
+							type: "number",
+							nullable: true,
+							description: "The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)"
+						},
+						refillAmount: {
+							type: "number",
+							nullable: true,
+							description: "The amount to refill"
+						},
+						lastRefillAt: {
+							type: "string",
+							format: "date-time",
+							nullable: true,
+							description: "The last refill date"
+						},
+						enabled: {
+							type: "boolean",
+							description: "Sets if key is enabled or disabled",
+							default: true
+						},
+						rateLimitEnabled: {
+							type: "boolean",
+							description: "Whether the key has rate limiting enabled"
+						},
+						rateLimitTimeWindow: {
+							type: "number",
+							nullable: true,
+							description: "The duration in milliseconds"
+						},
+						rateLimitMax: {
+							type: "number",
+							nullable: true,
+							description: "Maximum amount of requests allowed within a window"
+						},
+						requestCount: {
+							type: "number",
+							description: "The number of requests made within the rate limit time window"
+						},
+						remaining: {
+							type: "number",
+							nullable: true,
+							description: "Remaining requests (every time api key is used this should updated and should be updated on refill as well)"
+						},
+						lastRequest: {
+							type: "string",
+							format: "date-time",
+							nullable: true,
+							description: "When last request occurred"
+						},
+						expiresAt: {
+							type: "string",
+							format: "date-time",
+							nullable: true,
+							description: "Expiry date of a key"
+						},
+						createdAt: {
+							type: "string",
+							format: "date-time",
+							description: "created at"
+						},
+						updatedAt: {
+							type: "string",
+							format: "date-time",
+							description: "updated at"
+						},
+						metadata: {
+							type: "object",
+							nullable: true,
+							additionalProperties: true,
+							description: "Extra metadata about the apiKey"
+						},
+						permissions: {
+							type: "string",
+							nullable: true,
+							description: "Permissions for the api key (stored as JSON string)"
+						}
+					},
+					required: [
+						"id",
+						"userId",
+						"enabled",
+						"rateLimitEnabled",
+						"requestCount",
+						"createdAt",
+						"updatedAt"
+					]
+				} } }
+			} }
+		} }
+	}, async (ctx) => {
+		const { id } = ctx.query;
+		const session = ctx.context.session;
+		let apiKey$1 = await ctx.context.adapter.findOne({
+			model: API_KEY_TABLE_NAME,
+			where: [{
+				field: "id",
+				value: id
+			}, {
+				field: "userId",
+				value: session.user.id
+			}]
+		});
+		if (!apiKey$1) throw new APIError("NOT_FOUND", { message: ERROR_CODES.KEY_NOT_FOUND });
+		deleteAllExpiredApiKeys$1(ctx.context);
+		apiKey$1.metadata = schema.apikey.fields.metadata.transform.output(apiKey$1.metadata);
+		const { key,...returningApiKey } = apiKey$1;
+		return ctx.json({
+			...returningApiKey,
+			permissions: returningApiKey.permissions ? safeJSONParse(returningApiKey.permissions) : null
+		});
+	});
+}
+
+//#endregion
+//#region src/plugins/api-key/routes/list-api-keys.ts
+function listApiKeys({ opts, schema, deleteAllExpiredApiKeys: deleteAllExpiredApiKeys$1 }) {
+	return createAuthEndpoint("/api-key/list", {
+		method: "GET",
+		use: [sessionMiddleware],
+		metadata: { openapi: {
+			description: "List all API keys for the authenticated user",
+			responses: { "200": {
+				description: "API keys retrieved successfully",
+				content: { "application/json": { schema: {
+					type: "array",
+					items: {
+						type: "object",
+						properties: {
+							id: {
+								type: "string",
+								description: "ID"
+							},
+							name: {
+								type: "string",
+								nullable: true,
+								description: "The name of the key"
+							},
+							start: {
+								type: "string",
+								nullable: true,
+								description: "Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key."
+							},
+							prefix: {
+								type: "string",
+								nullable: true,
+								description: "The API Key prefix. Stored as plain text."
+							},
+							userId: {
+								type: "string",
+								description: "The owner of the user id"
+							},
+							refillInterval: {
+								type: "number",
+								nullable: true,
+								description: "The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)"
+							},
+							refillAmount: {
+								type: "number",
+								nullable: true,
+								description: "The amount to refill"
+							},
+							lastRefillAt: {
+								type: "string",
+								format: "date-time",
+								nullable: true,
+								description: "The last refill date"
+							},
+							enabled: {
+								type: "boolean",
+								description: "Sets if key is enabled or disabled",
+								default: true
+							},
+							rateLimitEnabled: {
+								type: "boolean",
+								description: "Whether the key has rate limiting enabled"
+							},
+							rateLimitTimeWindow: {
+								type: "number",
+								nullable: true,
+								description: "The duration in milliseconds"
+							},
+							rateLimitMax: {
+								type: "number",
+								nullable: true,
+								description: "Maximum amount of requests allowed within a window"
+							},
+							requestCount: {
+								type: "number",
+								description: "The number of requests made within the rate limit time window"
+							},
+							remaining: {
+								type: "number",
+								nullable: true,
+								description: "Remaining requests (every time api key is used this should updated and should be updated on refill as well)"
+							},
+							lastRequest: {
+								type: "string",
+								format: "date-time",
+								nullable: true,
+								description: "When last request occurred"
+							},
+							expiresAt: {
+								type: "string",
+								format: "date-time",
+								nullable: true,
+								description: "Expiry date of a key"
+							},
+							createdAt: {
+								type: "string",
+								format: "date-time",
+								description: "created at"
+							},
+							updatedAt: {
+								type: "string",
+								format: "date-time",
+								description: "updated at"
+							},
+							metadata: {
+								type: "object",
+								nullable: true,
+								additionalProperties: true,
+								description: "Extra metadata about the apiKey"
+							},
+							permissions: {
+								type: "string",
+								nullable: true,
+								description: "Permissions for the api key (stored as JSON string)"
+							}
+						},
+						required: [
+							"id",
+							"userId",
+							"enabled",
+							"rateLimitEnabled",
+							"requestCount",
+							"createdAt",
+							"updatedAt"
+						]
+					}
+				} } }
+			} }
+		} }
+	}, async (ctx) => {
+		const session = ctx.context.session;
+		let apiKeys = await ctx.context.adapter.findMany({
+			model: API_KEY_TABLE_NAME,
+			where: [{
+				field: "userId",
+				value: session.user.id
+			}]
+		});
+		deleteAllExpiredApiKeys$1(ctx.context);
+		apiKeys = apiKeys.map((apiKey$1) => {
+			return {
+				...apiKey$1,
+				metadata: schema.apikey.fields.metadata.transform.output(apiKey$1.metadata)
+			};
+		});
+		let returningApiKey = apiKeys.map((x) => {
+			const { key,...returningApiKey$1 } = x;
+			return {
+				...returningApiKey$1,
+				permissions: returningApiKey$1.permissions ? safeJSONParse(returningApiKey$1.permissions) : null
+			};
+		});
+		return ctx.json(returningApiKey);
+	});
+}
+
+//#endregion
+//#region src/plugins/api-key/routes/update-api-key.ts
+function updateApiKey({ opts, schema, deleteAllExpiredApiKeys: deleteAllExpiredApiKeys$1 }) {
+	return createAuthEndpoint("/api-key/update", {
+		method: "POST",
+		body: z$1.object({
+			keyId: z$1.string().meta({ description: "The id of the Api Key" }),
+			userId: z$1.coerce.string().meta({ description: "The id of the user which the api key belongs to. server-only. Eg: \"some-user-id\"" }).optional(),
+			name: z$1.string().meta({ description: "The name of the key" }).optional(),
+			enabled: z$1.boolean().meta({ description: "Whether the Api Key is enabled or not" }).optional(),
+			remaining: z$1.number().meta({ description: "The number of remaining requests" }).min(1).optional(),
+			refillAmount: z$1.number().meta({ description: "The refill amount" }).optional(),
+			refillInterval: z$1.number().meta({ description: "The refill interval" }).optional(),
+			metadata: z$1.any().optional(),
+			expiresIn: z$1.number().meta({ description: "Expiration time of the Api Key in seconds" }).min(1).optional().nullable(),
+			rateLimitEnabled: z$1.boolean().meta({ description: "Whether the key has rate limiting enabled." }).optional(),
+			rateLimitTimeWindow: z$1.number().meta({ description: "The duration in milliseconds where each request is counted. server-only. Eg: 1000" }).optional(),
+			rateLimitMax: z$1.number().meta({ description: "Maximum amount of requests allowed within a window. Once the `maxRequests` is reached, the request will be rejected until the `timeWindow` has passed, at which point the `timeWindow` will be reset. server-only. Eg: 100" }).optional(),
+			permissions: z$1.record(z$1.string(), z$1.array(z$1.string())).meta({ description: "Update the permissions on the API Key. server-only." }).optional().nullable()
+		}),
+		metadata: { openapi: {
+			description: "Update an existing API key by ID",
+			responses: { "200": {
+				description: "API key updated successfully",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: {
+						id: {
+							type: "string",
+							description: "ID"
+						},
+						name: {
+							type: "string",
+							nullable: true,
+							description: "The name of the key"
+						},
+						start: {
+							type: "string",
+							nullable: true,
+							description: "Shows the first few characters of the API key, including the prefix. This allows you to show those few characters in the UI to make it easier for users to identify the API key."
+						},
+						prefix: {
+							type: "string",
+							nullable: true,
+							description: "The API Key prefix. Stored as plain text."
+						},
+						userId: {
+							type: "string",
+							description: "The owner of the user id"
+						},
+						refillInterval: {
+							type: "number",
+							nullable: true,
+							description: "The interval in milliseconds between refills of the `remaining` count. Example: 3600000 // refill every hour (3600000ms = 1h)"
+						},
+						refillAmount: {
+							type: "number",
+							nullable: true,
+							description: "The amount to refill"
+						},
+						lastRefillAt: {
+							type: "string",
+							format: "date-time",
+							nullable: true,
+							description: "The last refill date"
+						},
+						enabled: {
+							type: "boolean",
+							description: "Sets if key is enabled or disabled",
+							default: true
+						},
+						rateLimitEnabled: {
+							type: "boolean",
+							description: "Whether the key has rate limiting enabled"
+						},
+						rateLimitTimeWindow: {
+							type: "number",
+							nullable: true,
+							description: "The duration in milliseconds"
+						},
+						rateLimitMax: {
+							type: "number",
+							nullable: true,
+							description: "Maximum amount of requests allowed within a window"
+						},
+						requestCount: {
+							type: "number",
+							description: "The number of requests made within the rate limit time window"
+						},
+						remaining: {
+							type: "number",
+							nullable: true,
+							description: "Remaining requests (every time api key is used this should updated and should be updated on refill as well)"
+						},
+						lastRequest: {
+							type: "string",
+							format: "date-time",
+							nullable: true,
+							description: "When last request occurred"
+						},
+						expiresAt: {
+							type: "string",
+							format: "date-time",
+							nullable: true,
+							description: "Expiry date of a key"
+						},
+						createdAt: {
+							type: "string",
+							format: "date-time",
+							description: "created at"
+						},
+						updatedAt: {
+							type: "string",
+							format: "date-time",
+							description: "updated at"
+						},
+						metadata: {
+							type: "object",
+							nullable: true,
+							additionalProperties: true,
+							description: "Extra metadata about the apiKey"
+						},
+						permissions: {
+							type: "string",
+							nullable: true,
+							description: "Permissions for the api key (stored as JSON string)"
+						}
+					},
+					required: [
+						"id",
+						"userId",
+						"enabled",
+						"rateLimitEnabled",
+						"requestCount",
+						"createdAt",
+						"updatedAt"
+					]
+				} } }
+			} }
+		} }
+	}, async (ctx) => {
+		const { keyId, expiresIn, enabled, metadata, refillAmount, refillInterval, remaining, name, permissions, rateLimitEnabled, rateLimitTimeWindow, rateLimitMax } = ctx.body;
+		const session = await getSessionFromCtx(ctx);
+		const authRequired = ctx.request || ctx.headers;
+		const user = authRequired && !session ? null : session?.user || { id: ctx.body.userId };
+		if (!user?.id) throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.UNAUTHORIZED_SESSION });
+		if (session && ctx.body.userId && session?.user.id !== ctx.body.userId) throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.UNAUTHORIZED_SESSION });
+		if (authRequired) {
+			if (refillAmount !== void 0 || refillInterval !== void 0 || rateLimitMax !== void 0 || rateLimitTimeWindow !== void 0 || rateLimitEnabled !== void 0 || remaining !== void 0 || permissions !== void 0) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.SERVER_ONLY_PROPERTY });
+		}
+		const apiKey$1 = await ctx.context.adapter.findOne({
+			model: API_KEY_TABLE_NAME,
+			where: [{
+				field: "id",
+				value: keyId
+			}, {
+				field: "userId",
+				value: user.id
+			}]
+		});
+		if (!apiKey$1) throw new APIError("NOT_FOUND", { message: ERROR_CODES.KEY_NOT_FOUND });
+		let newValues = {};
+		if (name !== void 0) {
+			if (name.length < opts.minimumNameLength) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_NAME_LENGTH });
+			else if (name.length > opts.maximumNameLength) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_NAME_LENGTH });
+			newValues.name = name;
+		}
+		if (enabled !== void 0) newValues.enabled = enabled;
+		if (expiresIn !== void 0) {
+			if (opts.keyExpiration.disableCustomExpiresTime === true) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.KEY_DISABLED_EXPIRATION });
+			if (expiresIn !== null) {
+				const expiresIn_in_days = expiresIn / (3600 * 24);
+				if (expiresIn_in_days < opts.keyExpiration.minExpiresIn) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.EXPIRES_IN_IS_TOO_SMALL });
+				else if (expiresIn_in_days > opts.keyExpiration.maxExpiresIn) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.EXPIRES_IN_IS_TOO_LARGE });
+			}
+			newValues.expiresAt = expiresIn ? getDate(expiresIn, "sec") : null;
+		}
+		if (metadata !== void 0) {
+			if (typeof metadata !== "object") throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_METADATA_TYPE });
+			newValues.metadata = schema.apikey.fields.metadata.transform.input(metadata);
+		}
+		if (remaining !== void 0) newValues.remaining = remaining;
+		if (refillAmount !== void 0 || refillInterval !== void 0) {
+			if (refillAmount !== void 0 && refillInterval === void 0) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.REFILL_AMOUNT_AND_INTERVAL_REQUIRED });
+			else if (refillInterval !== void 0 && refillAmount === void 0) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.REFILL_INTERVAL_AND_AMOUNT_REQUIRED });
+			newValues.refillAmount = refillAmount;
+			newValues.refillInterval = refillInterval;
+		}
+		if (rateLimitEnabled !== void 0) newValues.rateLimitEnabled = rateLimitEnabled;
+		if (rateLimitTimeWindow !== void 0) newValues.rateLimitTimeWindow = rateLimitTimeWindow;
+		if (rateLimitMax !== void 0) newValues.rateLimitMax = rateLimitMax;
+		if (permissions !== void 0) newValues.permissions = JSON.stringify(permissions);
+		if (Object.keys(newValues).length === 0) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.NO_VALUES_TO_UPDATE });
+		let newApiKey = apiKey$1;
+		try {
+			let result = await ctx.context.adapter.update({
+				model: API_KEY_TABLE_NAME,
+				where: [{
+					field: "id",
+					value: apiKey$1.id
+				}],
+				update: { ...newValues }
+			});
+			if (result) newApiKey = result;
+		} catch (error) {
+			throw new APIError("INTERNAL_SERVER_ERROR", { message: error?.message });
+		}
+		deleteAllExpiredApiKeys$1(ctx.context);
+		newApiKey.metadata = schema.apikey.fields.metadata.transform.output(newApiKey.metadata);
+		const { key,...returningApiKey } = newApiKey;
+		return ctx.json({
+			...returningApiKey,
+			permissions: returningApiKey.permissions ? safeJSONParse(returningApiKey.permissions) : null
+		});
+	});
+}
+
+//#endregion
+//#region src/plugins/api-key/rate-limit.ts
+/**
+* Determines if a request is allowed based on rate limiting parameters.
+*
+* @returns An object indicating whether the request is allowed and, if not,
+*          a message and updated ApiKey data.
+*/
+function isRateLimited(apiKey$1, opts) {
+	const now = /* @__PURE__ */ new Date();
+	const lastRequest = apiKey$1.lastRequest;
+	const rateLimitTimeWindow = apiKey$1.rateLimitTimeWindow;
+	const rateLimitMax = apiKey$1.rateLimitMax;
+	let requestCount = apiKey$1.requestCount;
+	if (opts.rateLimit.enabled === false) return {
+		success: true,
+		message: null,
+		update: { lastRequest: now },
+		tryAgainIn: null
+	};
+	if (apiKey$1.rateLimitEnabled === false) return {
+		success: true,
+		message: null,
+		update: { lastRequest: now },
+		tryAgainIn: null
+	};
+	if (rateLimitTimeWindow === null || rateLimitMax === null) return {
+		success: true,
+		message: null,
+		update: null,
+		tryAgainIn: null
+	};
+	if (lastRequest === null) return {
+		success: true,
+		message: null,
+		update: {
+			lastRequest: now,
+			requestCount: 1
+		},
+		tryAgainIn: null
+	};
+	const timeSinceLastRequest = now.getTime() - new Date(lastRequest).getTime();
+	if (timeSinceLastRequest > rateLimitTimeWindow) return {
+		success: true,
+		message: null,
+		update: {
+			lastRequest: now,
+			requestCount: 1
+		},
+		tryAgainIn: null
+	};
+	if (requestCount >= rateLimitMax) return {
+		success: false,
+		message: ERROR_CODES.RATE_LIMIT_EXCEEDED,
+		update: null,
+		tryAgainIn: Math.ceil(rateLimitTimeWindow - timeSinceLastRequest)
+	};
+	requestCount++;
+	return {
+		success: true,
+		message: null,
+		tryAgainIn: null,
+		update: {
+			lastRequest: now,
+			requestCount
+		}
+	};
+}
+
+//#endregion
+//#region src/plugins/api-key/routes/verify-api-key.ts
+async function validateApiKey({ hashedKey, ctx, opts, schema, permissions }) {
+	const apiKey$1 = await ctx.context.adapter.findOne({
+		model: API_KEY_TABLE_NAME,
+		where: [{
+			field: "key",
+			value: hashedKey
+		}]
+	});
+	if (!apiKey$1) throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.INVALID_API_KEY });
+	if (apiKey$1.enabled === false) throw new APIError("UNAUTHORIZED", {
+		message: ERROR_CODES.KEY_DISABLED,
+		code: "KEY_DISABLED"
+	});
+	if (apiKey$1.expiresAt) {
+		if ((/* @__PURE__ */ new Date()).getTime() > new Date(apiKey$1.expiresAt).getTime()) {
+			try {
+				ctx.context.adapter.delete({
+					model: API_KEY_TABLE_NAME,
+					where: [{
+						field: "id",
+						value: apiKey$1.id
+					}]
+				});
+			} catch (error) {
+				ctx.context.logger.error(`Failed to delete expired API keys:`, error);
+			}
+			throw new APIError("UNAUTHORIZED", {
+				message: ERROR_CODES.KEY_EXPIRED,
+				code: "KEY_EXPIRED"
+			});
+		}
+	}
+	if (permissions) {
+		const apiKeyPermissions = apiKey$1.permissions ? safeJSONParse(apiKey$1.permissions) : null;
+		if (!apiKeyPermissions) throw new APIError("UNAUTHORIZED", {
+			message: ERROR_CODES.KEY_NOT_FOUND,
+			code: "KEY_NOT_FOUND"
+		});
+		if (!role(apiKeyPermissions).authorize(permissions).success) throw new APIError("UNAUTHORIZED", {
+			message: ERROR_CODES.KEY_NOT_FOUND,
+			code: "KEY_NOT_FOUND"
+		});
+	}
+	let remaining = apiKey$1.remaining;
+	let lastRefillAt = apiKey$1.lastRefillAt;
+	if (apiKey$1.remaining === 0 && apiKey$1.refillAmount === null) {
+		try {
+			ctx.context.adapter.delete({
+				model: API_KEY_TABLE_NAME,
+				where: [{
+					field: "id",
+					value: apiKey$1.id
+				}]
+			});
+		} catch (error) {
+			ctx.context.logger.error(`Failed to delete expired API keys:`, error);
+		}
+		throw new APIError("TOO_MANY_REQUESTS", {
+			message: ERROR_CODES.USAGE_EXCEEDED,
+			code: "USAGE_EXCEEDED"
+		});
+	} else if (remaining !== null) {
+		let now = (/* @__PURE__ */ new Date()).getTime();
+		const refillInterval = apiKey$1.refillInterval;
+		const refillAmount = apiKey$1.refillAmount;
+		let lastTime = new Date(lastRefillAt ?? apiKey$1.createdAt).getTime();
+		if (refillInterval && refillAmount) {
+			if (now - lastTime > refillInterval) {
+				remaining = refillAmount;
+				lastRefillAt = /* @__PURE__ */ new Date();
+			}
+		}
+		if (remaining === 0) throw new APIError("TOO_MANY_REQUESTS", {
+			message: ERROR_CODES.USAGE_EXCEEDED,
+			code: "USAGE_EXCEEDED"
+		});
+		else remaining--;
+	}
+	const { message, success, update, tryAgainIn } = isRateLimited(apiKey$1, opts);
+	const newApiKey = await ctx.context.adapter.update({
+		model: API_KEY_TABLE_NAME,
+		where: [{
+			field: "id",
+			value: apiKey$1.id
+		}],
+		update: {
+			...update,
+			remaining,
+			lastRefillAt
+		}
+	});
+	if (!newApiKey) throw new APIError("INTERNAL_SERVER_ERROR", {
+		message: ERROR_CODES.FAILED_TO_UPDATE_API_KEY,
+		code: "INTERNAL_SERVER_ERROR"
+	});
+	if (success === false) throw new APIError("UNAUTHORIZED", {
+		message: message ?? void 0,
+		code: "RATE_LIMITED",
+		details: { tryAgainIn }
+	});
+	return newApiKey;
+}
+function verifyApiKey({ opts, schema, deleteAllExpiredApiKeys: deleteAllExpiredApiKeys$1 }) {
+	return createAuthEndpoint("/api-key/verify", {
+		method: "POST",
+		body: z$1.object({
+			key: z$1.string().meta({ description: "The key to verify" }),
+			permissions: z$1.record(z$1.string(), z$1.array(z$1.string())).meta({ description: "The permissions to verify." }).optional()
+		}),
+		metadata: { SERVER_ONLY: true }
+	}, async (ctx) => {
+		const { key } = ctx.body;
+		if (key.length < opts.defaultKeyLength) return ctx.json({
+			valid: false,
+			error: {
+				message: ERROR_CODES.INVALID_API_KEY,
+				code: "KEY_NOT_FOUND"
+			},
+			key: null
+		});
+		if (opts.customAPIKeyValidator) {
+			if (!await opts.customAPIKeyValidator({
+				ctx,
+				key
+			})) return ctx.json({
+				valid: false,
+				error: {
+					message: ERROR_CODES.INVALID_API_KEY,
+					code: "KEY_NOT_FOUND"
+				},
+				key: null
+			});
+		}
+		const hashed = opts.disableKeyHashing ? key : await defaultKeyHasher(key);
+		let apiKey$1 = null;
+		try {
+			apiKey$1 = await validateApiKey({
+				hashedKey: hashed,
+				permissions: ctx.body.permissions,
+				ctx,
+				opts,
+				schema
+			});
+			await deleteAllExpiredApiKeys$1(ctx.context);
+		} catch (error) {
+			if (error instanceof APIError) return ctx.json({
+				valid: false,
+				error: {
+					message: error.body?.message,
+					code: error.body?.code
+				},
+				key: null
+			});
+			return ctx.json({
+				valid: false,
+				error: {
+					message: ERROR_CODES.INVALID_API_KEY,
+					code: "INVALID_API_KEY"
+				},
+				key: null
+			});
+		}
+		const { key: _,...returningApiKey } = apiKey$1 ?? {
+			key: 1,
+			permissions: void 0
+		};
+		if ("metadata" in returningApiKey) returningApiKey.metadata = schema.apikey.fields.metadata.transform.output(returningApiKey.metadata);
+		returningApiKey.permissions = returningApiKey.permissions ? safeJSONParse(returningApiKey.permissions) : null;
+		return ctx.json({
+			valid: true,
+			error: null,
+			key: apiKey$1 === null ? null : returningApiKey
+		});
+	});
+}
+
+//#endregion
+//#region src/plugins/api-key/routes/index.ts
+let lastChecked = null;
+async function deleteAllExpiredApiKeys(ctx, byPassLastCheckTime = false) {
+	if (lastChecked && !byPassLastCheckTime) {
+		if ((/* @__PURE__ */ new Date()).getTime() - lastChecked.getTime() < 1e4) return;
+	}
+	lastChecked = /* @__PURE__ */ new Date();
+	await ctx.adapter.deleteMany({
+		model: API_KEY_TABLE_NAME,
+		where: [{
+			field: "expiresAt",
+			operator: "lt",
+			value: /* @__PURE__ */ new Date()
+		}, {
+			field: "expiresAt",
+			operator: "ne",
+			value: null
+		}]
+	}).catch((error) => {
+		ctx.logger.error(`Failed to delete expired API keys:`, error);
+	});
+}
+function createApiKeyRoutes({ keyGenerator, opts, schema }) {
+	return {
+		createApiKey: createApiKey({
+			keyGenerator,
+			opts,
+			schema,
+			deleteAllExpiredApiKeys
+		}),
+		verifyApiKey: verifyApiKey({
+			opts,
+			schema,
+			deleteAllExpiredApiKeys
+		}),
+		getApiKey: getApiKey({
+			opts,
+			schema,
+			deleteAllExpiredApiKeys
+		}),
+		updateApiKey: updateApiKey({
+			opts,
+			schema,
+			deleteAllExpiredApiKeys
+		}),
+		deleteApiKey: deleteApiKey({
+			opts,
+			schema,
+			deleteAllExpiredApiKeys
+		}),
+		listApiKeys: listApiKeys({
+			opts,
+			schema,
+			deleteAllExpiredApiKeys
+		}),
+		deleteAllExpiredApiKeys: deleteAllExpiredApiKeysEndpoint({ deleteAllExpiredApiKeys })
+	};
+}
+
+//#endregion
+//#region src/plugins/api-key/index.ts
+const defaultKeyHasher = async (key) => {
+	const hash = await createHash("SHA-256", "none").digest(new TextEncoder().encode(key));
+	return base64Url.encode(new Uint8Array(hash), { padding: false });
+};
+const ERROR_CODES = defineErrorCodes({
+	INVALID_METADATA_TYPE: "metadata must be an object or undefined",
+	REFILL_AMOUNT_AND_INTERVAL_REQUIRED: "refillAmount is required when refillInterval is provided",
+	REFILL_INTERVAL_AND_AMOUNT_REQUIRED: "refillInterval is required when refillAmount is provided",
+	USER_BANNED: "User is banned",
+	UNAUTHORIZED_SESSION: "Unauthorized or invalid session",
+	KEY_NOT_FOUND: "API Key not found",
+	KEY_DISABLED: "API Key is disabled",
+	KEY_EXPIRED: "API Key has expired",
+	USAGE_EXCEEDED: "API Key has reached its usage limit",
+	KEY_NOT_RECOVERABLE: "API Key is not recoverable",
+	EXPIRES_IN_IS_TOO_SMALL: "The expiresIn is smaller than the predefined minimum value.",
+	EXPIRES_IN_IS_TOO_LARGE: "The expiresIn is larger than the predefined maximum value.",
+	INVALID_REMAINING: "The remaining count is either too large or too small.",
+	INVALID_PREFIX_LENGTH: "The prefix length is either too large or too small.",
+	INVALID_NAME_LENGTH: "The name length is either too large or too small.",
+	METADATA_DISABLED: "Metadata is disabled.",
+	RATE_LIMIT_EXCEEDED: "Rate limit exceeded.",
+	NO_VALUES_TO_UPDATE: "No values to update.",
+	KEY_DISABLED_EXPIRATION: "Custom key expiration values are disabled.",
+	INVALID_API_KEY: "Invalid API key.",
+	INVALID_USER_ID_FROM_API_KEY: "The user id from the API key is invalid.",
+	INVALID_API_KEY_GETTER_RETURN_TYPE: "API Key getter returned an invalid key type. Expected string.",
+	SERVER_ONLY_PROPERTY: "The property you're trying to set can only be set from the server auth instance only.",
+	FAILED_TO_UPDATE_API_KEY: "Failed to update API key",
+	NAME_REQUIRED: "API Key name is required."
+});
+const API_KEY_TABLE_NAME = "apikey";
+const apiKey = (options) => {
+	const opts = {
+		...options,
+		apiKeyHeaders: options?.apiKeyHeaders ?? "x-api-key",
+		defaultKeyLength: options?.defaultKeyLength || 64,
+		maximumPrefixLength: options?.maximumPrefixLength ?? 32,
+		minimumPrefixLength: options?.minimumPrefixLength ?? 1,
+		maximumNameLength: options?.maximumNameLength ?? 32,
+		minimumNameLength: options?.minimumNameLength ?? 1,
+		enableMetadata: options?.enableMetadata ?? false,
+		disableKeyHashing: options?.disableKeyHashing ?? false,
+		requireName: options?.requireName ?? false,
+		rateLimit: {
+			enabled: options?.rateLimit?.enabled === void 0 ? true : options?.rateLimit?.enabled,
+			timeWindow: options?.rateLimit?.timeWindow ?? 1e3 * 60 * 60 * 24,
+			maxRequests: options?.rateLimit?.maxRequests ?? 10
+		},
+		keyExpiration: {
+			defaultExpiresIn: options?.keyExpiration?.defaultExpiresIn ?? null,
+			disableCustomExpiresTime: options?.keyExpiration?.disableCustomExpiresTime ?? false,
+			maxExpiresIn: options?.keyExpiration?.maxExpiresIn ?? 365,
+			minExpiresIn: options?.keyExpiration?.minExpiresIn ?? 1
+		},
+		startingCharactersConfig: {
+			shouldStore: options?.startingCharactersConfig?.shouldStore ?? true,
+			charactersLength: options?.startingCharactersConfig?.charactersLength ?? 6
+		},
+		enableSessionForAPIKeys: options?.enableSessionForAPIKeys ?? false
+	};
+	const schema = mergeSchema(apiKeySchema({
+		rateLimitMax: opts.rateLimit.maxRequests,
+		timeWindow: opts.rateLimit.timeWindow
+	}), opts.schema);
+	const getter = opts.customAPIKeyGetter || ((ctx) => {
+		if (Array.isArray(opts.apiKeyHeaders)) for (const header of opts.apiKeyHeaders) {
+			const value = ctx.headers?.get(header);
+			if (value) return value;
+		}
+		else return ctx.headers?.get(opts.apiKeyHeaders);
+	});
+	const routes = createApiKeyRoutes({
+		keyGenerator: opts.customKeyGenerator || (async (options$1) => {
+			const characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+			let apiKey$1 = `${options$1.prefix || ""}`;
+			for (let i = 0; i < options$1.length; i++) {
+				const randomIndex = Math.floor(Math.random() * 52);
+				apiKey$1 += characters[randomIndex];
+			}
+			return apiKey$1;
+		}),
+		opts,
+		schema
+	});
+	return {
+		id: "api-key",
+		$ERROR_CODES: ERROR_CODES,
+		hooks: { before: [{
+			matcher: (ctx) => !!getter(ctx) && opts.enableSessionForAPIKeys,
+			handler: createAuthMiddleware(async (ctx) => {
+				const key = getter(ctx);
+				if (typeof key !== "string") throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_API_KEY_GETTER_RETURN_TYPE });
+				if (key.length < opts.defaultKeyLength) throw new APIError("FORBIDDEN", { message: ERROR_CODES.INVALID_API_KEY });
+				if (opts.customAPIKeyValidator) {
+					if (!await opts.customAPIKeyValidator({
+						ctx,
+						key
+					})) throw new APIError("FORBIDDEN", { message: ERROR_CODES.INVALID_API_KEY });
+				}
+				const apiKey$1 = await validateApiKey({
+					hashedKey: opts.disableKeyHashing ? key : await defaultKeyHasher(key),
+					ctx,
+					opts,
+					schema
+				});
+				deleteAllExpiredApiKeys(ctx.context).catch((err) => {
+					ctx.context.logger.error("Failed to delete expired API keys:", err);
+				});
+				const user = await ctx.context.internalAdapter.findUserById(apiKey$1.userId);
+				if (!user) throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.INVALID_USER_ID_FROM_API_KEY });
+				const session = {
+					user,
+					session: {
+						id: apiKey$1.id,
+						token: key,
+						userId: apiKey$1.userId,
+						userAgent: ctx.request?.headers.get("user-agent") ?? null,
+						ipAddress: ctx.request ? getIp(ctx.request, ctx.context.options) : null,
+						createdAt: /* @__PURE__ */ new Date(),
+						updatedAt: /* @__PURE__ */ new Date(),
+						expiresAt: apiKey$1.expiresAt || getDate(ctx.context.options.session?.expiresIn || 3600 * 24 * 7, "ms")
+					}
+				};
+				ctx.context.session = session;
+				if (ctx.path === "/get-session") return session;
+				else return { context: ctx };
+			})
+		}] },
+		endpoints: {
+			createApiKey: routes.createApiKey,
+			verifyApiKey: routes.verifyApiKey,
+			getApiKey: routes.getApiKey,
+			updateApiKey: routes.updateApiKey,
+			deleteApiKey: routes.deleteApiKey,
+			listApiKeys: routes.listApiKeys,
+			deleteAllExpiredApiKeys: routes.deleteAllExpiredApiKeys
+		},
+		schema
+	};
+};
+
+//#endregion
+//#region src/plugins/last-login-method/index.ts
+/**
+* Plugin to track the last used login method
+*/
+const lastLoginMethod = (userConfig) => {
+	const paths = [
+		"/callback/:id",
+		"/oauth2/callback/:id",
+		"/sign-in/email",
+		"/sign-up/email"
+	];
+	const defaultResolveMethod = (ctx) => {
+		if (paths.includes(ctx.path)) return ctx.params?.id ? ctx.params.id : ctx.path.split("/").pop();
+		return null;
+	};
+	const config = {
+		cookieName: "payvo-auth.last_used_login_method",
+		maxAge: 3600 * 24 * 30,
+		...userConfig
+	};
+	return {
+		id: "last-login-method",
+		init(ctx) {
+			return { options: { databaseHooks: {
+				user: { create: { async before(user, context) {
+					if (!config.storeInDatabase) return;
+					if (!context) return;
+					const lastUsedLoginMethod = config.customResolveMethod?.(context) ?? defaultResolveMethod(context);
+					if (lastUsedLoginMethod) return { data: {
+						...user,
+						lastLoginMethod: lastUsedLoginMethod
+					} };
+				} } },
+				session: { create: { async after(session, context) {
+					if (!config.storeInDatabase) return;
+					if (!context) return;
+					const lastUsedLoginMethod = config.customResolveMethod?.(context) ?? defaultResolveMethod(context);
+					if (lastUsedLoginMethod && session?.userId) try {
+						await ctx.internalAdapter.updateUser(session.userId, { lastLoginMethod: lastUsedLoginMethod });
+					} catch (error) {
+						ctx.logger.error("Failed to update lastLoginMethod", error);
+					}
+				} } }
+			} } };
+		},
+		hooks: { after: [{
+			matcher() {
+				return true;
+			},
+			handler: createAuthMiddleware(async (ctx) => {
+				const lastUsedLoginMethod = config.customResolveMethod?.(ctx) ?? defaultResolveMethod(ctx);
+				if (lastUsedLoginMethod) {
+					const setCookie = ctx.context.responseHeaders?.get("set-cookie");
+					const sessionTokenName = ctx.context.authCookies.sessionToken.name;
+					if (setCookie && setCookie.includes(sessionTokenName)) {
+						const cookieAttributes = {
+							...ctx.context.authCookies.sessionToken.options,
+							maxAge: config.maxAge,
+							httpOnly: false
+						};
+						ctx.setCookie(config.cookieName, lastUsedLoginMethod, cookieAttributes);
+					}
+				}
+			})
+		}] },
+		schema: config.storeInDatabase ? { user: { fields: { lastLoginMethod: {
+			type: "string",
+			input: false,
+			required: false,
+			fieldName: config.schema?.user?.lastLoginMethod || "lastLoginMethod"
+		} } } } : void 0
+	};
+};
+
+//#endregion
+//#region src/plugins/one-time-token/index.ts
+const oneTimeToken = (options) => {
+	const opts = {
+		storeToken: "plain",
+		...options
+	};
+	async function storeToken(ctx, token) {
+		if (opts.storeToken === "hashed") return await defaultKeyHasher(token);
+		if (typeof opts.storeToken === "object" && "type" in opts.storeToken && opts.storeToken.type === "custom-hasher") return await opts.storeToken.hash(token);
+		return token;
+	}
+	return {
+		id: "one-time-token",
+		endpoints: {
+			generateOneTimeToken: createAuthEndpoint("/one-time-token/generate", {
+				method: "GET",
+				use: [sessionMiddleware]
+			}, async (c) => {
+				if (opts?.disableClientRequest && c.request) throw c.error("BAD_REQUEST", { message: "Client requests are disabled" });
+				const session = c.context.session;
+				const token = opts?.generateToken ? await opts.generateToken(session, c) : generateRandomString(32);
+				const expiresAt = new Date(Date.now() + (opts?.expiresIn ?? 3) * 60 * 1e3);
+				const storedToken = await storeToken(c, token);
+				await c.context.internalAdapter.createVerificationValue({
+					value: session.session.token,
+					identifier: `one-time-token:${storedToken}`,
+					expiresAt
+				});
+				return c.json({ token });
+			}),
+			verifyOneTimeToken: createAuthEndpoint("/one-time-token/verify", {
+				method: "POST",
+				body: z$1.object({ token: z$1.string().meta({ description: "The token to verify. Eg: \"some-token\"" }) })
+			}, async (c) => {
+				const { token } = c.body;
+				const storedToken = await storeToken(c, token);
+				const verificationValue = await c.context.internalAdapter.findVerificationValue(`one-time-token:${storedToken}`);
+				if (!verificationValue) throw c.error("BAD_REQUEST", { message: "Invalid token" });
+				await c.context.internalAdapter.deleteVerificationValue(verificationValue.id);
+				if (verificationValue.expiresAt < /* @__PURE__ */ new Date()) throw c.error("BAD_REQUEST", { message: "Token expired" });
+				const session = await c.context.internalAdapter.findSession(verificationValue.value);
+				if (!session) throw c.error("BAD_REQUEST", { message: "Session not found" });
+				return c.json(session);
+			})
+		}
+	};
+};
+
+//#endregion
+export { lastLoginMethod as a, apiKey as c, oneTimeToken as i, defaultKeyHasher as l, createAuthMiddleware$1 as n, API_KEY_TABLE_NAME as o, optionsMiddleware as r, ERROR_CODES as s, createAuthEndpoint$1 as t };