@gauts/auth 0.5.0 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +152 -94
- package/SECURITY.md +1 -1
- package/dist/adapters/hono/index.d.ts +15 -16
- package/dist/adapters/hono/index.d.ts.map +1 -1
- package/dist/adapters/hono/index.js +1 -3
- package/dist/adapters/hono/index.js.map +1 -1
- package/dist/adapters/next/index.d.ts +6 -1
- package/dist/adapters/next/index.d.ts.map +1 -1
- package/dist/adapters/next/index.js +24 -15
- package/dist/adapters/next/index.js.map +1 -1
- package/dist/adapters/prisma/config.d.ts +7 -0
- package/dist/adapters/prisma/config.d.ts.map +1 -0
- package/dist/adapters/prisma/config.js +151 -0
- package/dist/adapters/prisma/config.js.map +1 -0
- package/dist/adapters/prisma/index.d.ts +3 -48
- package/dist/adapters/prisma/index.d.ts.map +1 -1
- package/dist/adapters/prisma/index.js +12 -221
- package/dist/adapters/prisma/index.js.map +1 -1
- package/dist/adapters/prisma/model.d.ts +33 -0
- package/dist/adapters/prisma/model.d.ts.map +1 -0
- package/dist/adapters/prisma/model.js +110 -0
- package/dist/adapters/prisma/model.js.map +1 -0
- package/dist/adapters/prisma/types.d.ts +125 -0
- package/dist/adapters/prisma/types.d.ts.map +1 -0
- package/dist/adapters/prisma/types.js +2 -0
- package/dist/adapters/prisma/types.js.map +1 -0
- package/dist/auth.d.ts +6 -6
- package/dist/auth.d.ts.map +1 -1
- package/dist/auth.js +1 -1
- package/dist/auth.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/session/cache.d.ts +7 -7
- package/dist/session/cache.d.ts.map +1 -1
- package/dist/session/cache.js +4 -33
- package/dist/session/cache.js.map +1 -1
- package/dist/session/guards.d.ts +2 -2
- package/dist/session/guards.d.ts.map +1 -1
- package/dist/session/guards.js +12 -13
- package/dist/session/guards.js.map +1 -1
- package/dist/session/service.d.ts +4 -4
- package/dist/session/service.d.ts.map +1 -1
- package/dist/session/service.js +0 -4
- package/dist/session/service.js.map +1 -1
- package/dist/session/types.d.ts +20 -25
- package/dist/session/types.d.ts.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -77,16 +77,6 @@ import { prisma } from "./db.js";
|
|
|
77
77
|
export const auth = createHonoAuth({
|
|
78
78
|
db: createPrismaAdapter({
|
|
79
79
|
client: prisma,
|
|
80
|
-
config: {
|
|
81
|
-
access: {
|
|
82
|
-
account: {
|
|
83
|
-
allowedStatuses: ["ACTIVE"],
|
|
84
|
-
},
|
|
85
|
-
user: {
|
|
86
|
-
allowedStatuses: ["ACTIVE"],
|
|
87
|
-
},
|
|
88
|
-
},
|
|
89
|
-
},
|
|
90
80
|
}),
|
|
91
81
|
});
|
|
92
82
|
```
|
|
@@ -107,16 +97,24 @@ cookies __ses, __cac, __ren
|
|
|
107
97
|
|
|
108
98
|
```ts
|
|
109
99
|
import { Hono } from "hono";
|
|
100
|
+
import type { AuthAccountOf } from "@gauts/auth";
|
|
110
101
|
import type { HonoAuthEnv } from "@gauts/auth/hono";
|
|
111
102
|
|
|
112
103
|
import { auth } from "./auth.js";
|
|
113
104
|
import { DUMMY_PASSWORD_HASH } from "./password.js";
|
|
114
105
|
|
|
115
|
-
|
|
106
|
+
type Account = AuthAccountOf<typeof auth>;
|
|
107
|
+
|
|
108
|
+
const app = new Hono<HonoAuthEnv<Account>>();
|
|
116
109
|
|
|
117
110
|
app.post("/auth/login", async (c) => {
|
|
118
|
-
const body = await c.req.json<{
|
|
111
|
+
const body = await c.req.json<{
|
|
112
|
+
email: string;
|
|
113
|
+
password: string;
|
|
114
|
+
}>();
|
|
115
|
+
|
|
119
116
|
const account = await findAccount(body.email);
|
|
117
|
+
|
|
120
118
|
const passwordValid = await auth.password.verify({
|
|
121
119
|
password: body.password,
|
|
122
120
|
storedHash: account?.passwordHash ?? DUMMY_PASSWORD_HASH,
|
|
@@ -148,7 +146,6 @@ app.get("/account", auth.requireSession, (c) => {
|
|
|
148
146
|
return c.json({
|
|
149
147
|
account: c.get("account"),
|
|
150
148
|
session: c.get("session"),
|
|
151
|
-
user: c.get("user"),
|
|
152
149
|
});
|
|
153
150
|
});
|
|
154
151
|
```
|
|
@@ -335,7 +332,7 @@ The cache is signed but not encrypted. Do not place passwords, password hashes,
|
|
|
335
332
|
role,
|
|
336
333
|
status,
|
|
337
334
|
timezone,
|
|
338
|
-
|
|
335
|
+
user: { id, role, status },
|
|
339
336
|
},
|
|
340
337
|
ses: {
|
|
341
338
|
id,
|
|
@@ -353,45 +350,122 @@ The cache is signed but not encrypted. Do not place passwords, password hashes,
|
|
|
353
350
|
|
|
354
351
|
### Prisma adapter
|
|
355
352
|
|
|
353
|
+
The default adapter requires the Prisma models `sessions` and `account`. The session model must expose an `account` relation. The account model must contain string `id`, `email`, and `password_hash` fields. Only `account.id` and `account.email` enter the payload by default.
|
|
354
|
+
|
|
355
|
+
#### Default models
|
|
356
|
+
|
|
356
357
|
```ts
|
|
357
358
|
const db = createPrismaAdapter({
|
|
358
359
|
client: prisma,
|
|
359
|
-
|
|
360
|
-
|
|
361
|
-
|
|
362
|
-
|
|
363
|
-
|
|
364
|
-
|
|
360
|
+
});
|
|
361
|
+
```
|
|
362
|
+
|
|
363
|
+
The resolved account payload is:
|
|
364
|
+
|
|
365
|
+
```ts
|
|
366
|
+
{
|
|
367
|
+
email: "owner@example.com",
|
|
368
|
+
id: "account-id",
|
|
369
|
+
}
|
|
370
|
+
```
|
|
371
|
+
|
|
372
|
+
#### Selected fields and access rules
|
|
373
|
+
|
|
374
|
+
`select` defines the public account payload. `access` defines the values required to authenticate:
|
|
375
|
+
|
|
376
|
+
```ts
|
|
377
|
+
const db = createPrismaAdapter({
|
|
378
|
+
client: prisma,
|
|
379
|
+
models: {
|
|
380
|
+
account: {
|
|
381
|
+
select: ["id", "email", "name", "role"],
|
|
382
|
+
access: {
|
|
383
|
+
role: ["OWNER", "ADMIN"],
|
|
384
|
+
status: ["ACTIVE"],
|
|
365
385
|
},
|
|
366
386
|
},
|
|
367
|
-
|
|
368
|
-
|
|
369
|
-
|
|
370
|
-
|
|
387
|
+
},
|
|
388
|
+
});
|
|
389
|
+
```
|
|
390
|
+
|
|
391
|
+
`status` is selected internally for validation but is not exposed because it is absent from `select`.
|
|
392
|
+
|
|
393
|
+
#### Custom models and nested relations
|
|
394
|
+
|
|
395
|
+
Use `name` when the Prisma delegate differs from the default. Nested relation keys must match the relation fields on the parent model:
|
|
396
|
+
|
|
397
|
+
```ts
|
|
398
|
+
const db = createPrismaAdapter({
|
|
399
|
+
client: prisma,
|
|
400
|
+
models: {
|
|
401
|
+
sessions: {
|
|
402
|
+
name: "admin_sessions",
|
|
403
|
+
},
|
|
404
|
+
account: {
|
|
405
|
+
name: "user_accounts",
|
|
406
|
+
select: ["id", "email", "name", "role", "status", "timezone"],
|
|
407
|
+
access: {
|
|
408
|
+
role: ["OWNER", "ADMIN"],
|
|
409
|
+
status: ["ACTIVE"],
|
|
371
410
|
},
|
|
372
|
-
|
|
373
|
-
|
|
374
|
-
|
|
411
|
+
relations: {
|
|
412
|
+
user: {
|
|
413
|
+
name: "users",
|
|
414
|
+
select: ["id", "role", "status"],
|
|
415
|
+
access: {
|
|
416
|
+
status: ["ACTIVE"],
|
|
417
|
+
},
|
|
418
|
+
},
|
|
375
419
|
},
|
|
376
420
|
},
|
|
377
421
|
},
|
|
378
422
|
});
|
|
379
423
|
```
|
|
380
424
|
|
|
381
|
-
|
|
382
|
-
| --------------------------------------- | ------------------------------- | :-----------------------------: | -------------------- | --------------------------------------------------------------------- |
|
|
383
|
-
| `client` | Generated Prisma client | ✅ | — | Prisma client containing the session delegate. |
|
|
384
|
-
| `config.session` | Session model configuration | ❌ | Conventional names | Groups the Prisma delegate and relation names. |
|
|
385
|
-
| `config.session.table` | Compatible Prisma delegate name | Only without `account_sessions` | `"account_sessions"` | Delegate used to store sessions. This is not the physical table name. |
|
|
386
|
-
| `config.session.relations.account` | Non-empty `string` | ❌ | `"account"` | Account relation field on the session model. |
|
|
387
|
-
| `config.session.relations.user` | Non-empty `string` | ❌ | `"user"` | User relation field nested inside the account relation. |
|
|
388
|
-
| `config.access.account.allowedStatuses` | Non-empty unique `string[]` | ✅ | — | Account statuses allowed to authenticate. |
|
|
389
|
-
| `config.access.account.allowedRoles` | Non-empty unique `string[]` | ❌ | All roles | Account roles allowed to authenticate. |
|
|
390
|
-
| `config.access.user.allowedStatuses` | Non-empty unique `string[]` | ✅ | — | User statuses allowed to authenticate. |
|
|
391
|
-
| `config.access.user.allowedRoles` | Non-empty unique `string[]` | ❌ | All roles | User roles allowed to authenticate. |
|
|
425
|
+
This configuration uses `prisma.admin_sessions`, `prisma.user_accounts`, and `prisma.users`. The root relation on `admin_sessions` must still be named `account`.
|
|
392
426
|
|
|
393
|
-
|
|
394
|
-
|
|
427
|
+
When a relation name differs from its target model, the object key identifies the relation and `name` identifies the delegate:
|
|
428
|
+
|
|
429
|
+
```ts
|
|
430
|
+
relations: {
|
|
431
|
+
owner: {
|
|
432
|
+
name: "users",
|
|
433
|
+
select: ["id", "email", "status"],
|
|
434
|
+
access: {
|
|
435
|
+
status: ["ACTIVE"],
|
|
436
|
+
},
|
|
437
|
+
},
|
|
438
|
+
}
|
|
439
|
+
```
|
|
440
|
+
|
|
441
|
+
This loads the `account.owner` relation using the `prisma.users` model metadata.
|
|
442
|
+
|
|
443
|
+
| Property | Type / allowed values | Required | Default | Description |
|
|
444
|
+
| ------------------------------------- | ----------------------------------------- | :------: | -------------------- | --------------------------------------------------------------------------- |
|
|
445
|
+
| `client` | Generated Prisma client | ✅ | — | Prisma client containing every configured model. |
|
|
446
|
+
| `models.sessions.name` | Compatible session delegate name | ❌ | `"sessions"` | Overrides the Prisma model used to persist sessions. |
|
|
447
|
+
| `models.account.name` | Compatible account delegate name | ❌ | `"account"` | Identifies the account model and types its configuration. |
|
|
448
|
+
| `models.account.select` | Unique scalar field array | ❌ | `["id", "email"]` | Fields exposed in `account` and the signed cache. `id` is always included. |
|
|
449
|
+
| `models.account.access` | Scalar equality or allowed-value arrays | ❌ | `{}` | Conditions required for authentication. |
|
|
450
|
+
| `models.account.relations` | Relation configuration object | ❌ | `{}` | Additional required to-one relations loaded inside `account`. |
|
|
451
|
+
| `models.account.relations[key].name` | Compatible related-model delegate name | ❌ | Relation key | Identifies the related model and types its `select` and `access`. |
|
|
452
|
+
| `models.account.relations[key].select`| Unique scalar field array | ❌ | `["id"]` | Fields exposed under that relation. `id` is always included. |
|
|
453
|
+
| `models.account.relations[key].access`| Scalar equality or allowed-value arrays | ❌ | `{}` | Conditions required on the related record. |
|
|
454
|
+
|
|
455
|
+
The root Prisma relation on the session model is always named `account`. Keys inside `relations` are the actual Prisma relation field names. `name` identifies the target Prisma model/delegate; it does not rename a relation or a physical SQL table.
|
|
456
|
+
|
|
457
|
+
`select` accepts only JSON-safe scalar fields. It controls the public account payload and receives autocomplete from the generated Prisma client. Treat it as an explicit allowlist: never select passwords, password hashes, tokens, or other secrets because the cache is signed, not encrypted. Fields used only by `access` are selected for validation and removed before the account is exposed or cached.
|
|
458
|
+
|
|
459
|
+
Each `access` condition is either an exact scalar value or an array of accepted values:
|
|
460
|
+
|
|
461
|
+
```ts
|
|
462
|
+
access: {
|
|
463
|
+
active: true,
|
|
464
|
+
role: ["OWNER", "ADMIN"],
|
|
465
|
+
}
|
|
466
|
+
```
|
|
467
|
+
|
|
468
|
+
All configured conditions and nested relations must match. Omitting `access` applies no application-specific account restriction.
|
|
395
469
|
|
|
396
470
|
### Next.js adapter
|
|
397
471
|
|
|
@@ -417,7 +491,7 @@ export const nextAuth = createNextAuth({
|
|
|
417
491
|
credentials accepted
|
|
418
492
|
-> generate 256-bit opaque token
|
|
419
493
|
-> store SHA-256 token hash in DB
|
|
420
|
-
-> load current account and
|
|
494
|
+
-> load selected current account data and configured relations
|
|
421
495
|
-> apply configured access rules
|
|
422
496
|
-> write __ses
|
|
423
497
|
-> write __ren
|
|
@@ -431,7 +505,7 @@ Only the raw browser token authenticates. The database stores only its SHA-256 h
|
|
|
431
505
|
```text
|
|
432
506
|
session token
|
|
433
507
|
-> valid signed cache?
|
|
434
|
-
-> yes: expose cached account
|
|
508
|
+
-> yes: expose cached account and session
|
|
435
509
|
-> no: validate through DB and create a fresh cache
|
|
436
510
|
```
|
|
437
511
|
|
|
@@ -441,7 +515,7 @@ session token
|
|
|
441
515
|
session token
|
|
442
516
|
-> SHA-256 hash
|
|
443
517
|
-> indexed DB lookup
|
|
444
|
-
-> validate expiry, revocation, account,
|
|
518
|
+
-> validate expiry, revocation, account access, configured relations, and client
|
|
445
519
|
-> clear short cache
|
|
446
520
|
-> continue
|
|
447
521
|
```
|
|
@@ -461,39 +535,24 @@ Next reads __ren
|
|
|
461
535
|
|
|
462
536
|
## Prisma schema
|
|
463
537
|
|
|
464
|
-
The Prisma adapter resolves:
|
|
538
|
+
The default Prisma adapter resolves:
|
|
465
539
|
|
|
466
540
|
```text
|
|
467
|
-
|
|
541
|
+
sessions -> account
|
|
468
542
|
```
|
|
469
543
|
|
|
470
|
-
The following is a complete MySQL/MariaDB example.
|
|
544
|
+
The following is a complete MySQL/MariaDB example for email/password authentication. The account model requires `id`, `email`, and `password_hash`; the password hash is used only by the application's login query and never enters the session payload.
|
|
471
545
|
|
|
472
546
|
```prisma
|
|
473
|
-
model
|
|
474
|
-
id
|
|
475
|
-
|
|
476
|
-
|
|
547
|
+
model account {
|
|
548
|
+
id String @id @default(uuid()) @db.VarChar(255)
|
|
549
|
+
email String @unique @db.VarChar(255)
|
|
550
|
+
password_hash String @db.VarChar(255)
|
|
477
551
|
|
|
478
|
-
|
|
552
|
+
sessions sessions[]
|
|
479
553
|
}
|
|
480
554
|
|
|
481
|
-
model
|
|
482
|
-
id String @id @default(uuid()) @db.VarChar(255)
|
|
483
|
-
user_id String @db.VarChar(255)
|
|
484
|
-
email String @db.VarChar(255)
|
|
485
|
-
name String @db.VarChar(255)
|
|
486
|
-
role String @db.VarChar(255)
|
|
487
|
-
status String @db.VarChar(255)
|
|
488
|
-
timezone String? @db.VarChar(255)
|
|
489
|
-
|
|
490
|
-
user users @relation(fields: [user_id], references: [id], onDelete: Cascade)
|
|
491
|
-
sessions account_sessions[]
|
|
492
|
-
|
|
493
|
-
@@index([user_id])
|
|
494
|
-
}
|
|
495
|
-
|
|
496
|
-
model account_sessions {
|
|
555
|
+
model sessions {
|
|
497
556
|
id String @id @default(uuid()) @db.VarChar(255)
|
|
498
557
|
account_id String @db.VarChar(255)
|
|
499
558
|
token_hash String @unique @db.VarChar(64)
|
|
@@ -505,7 +564,7 @@ model account_sessions {
|
|
|
505
564
|
created_at DateTime @default(now()) @db.Timestamp(0)
|
|
506
565
|
updated_at DateTime? @db.Timestamp(0)
|
|
507
566
|
|
|
508
|
-
account
|
|
567
|
+
account account @relation(fields: [account_id], references: [id], onDelete: Cascade)
|
|
509
568
|
|
|
510
569
|
@@index([account_id])
|
|
511
570
|
@@index([expires_at])
|
|
@@ -515,17 +574,16 @@ model account_sessions {
|
|
|
515
574
|
|
|
516
575
|
Required fields and relation names:
|
|
517
576
|
|
|
518
|
-
| Path
|
|
519
|
-
|
|
|
520
|
-
| Session model
|
|
521
|
-
| `account` relation
|
|
522
|
-
| `account.user` relation | `id`, `role`, `status` |
|
|
577
|
+
| Path | Required fields |
|
|
578
|
+
| ------------------ | ------------------------------------------------------------------------------------------------------------------- |
|
|
579
|
+
| Session model | `id`, `account_id`, `token_hash`, `ip`, `platform`, `agent`, `expires_at`, `revoked_at`, `created_at`, `updated_at` |
|
|
580
|
+
| `account` relation | String `id`, `email`, and `password_hash` |
|
|
523
581
|
|
|
524
|
-
The relation
|
|
582
|
+
The session relation must be named `account`. Additional account fields and nested relations are selected through `models.account`. Application models may add fields, indexes, defaults, mappings, and relations. Access fields may use Prisma enums, strings, booleans, numbers, or null.
|
|
525
583
|
|
|
526
584
|
Keep `agent` large enough for the complete User-Agent. Use provider-compatible native annotations when the database is not MySQL/MariaDB.
|
|
527
585
|
|
|
528
|
-
`
|
|
586
|
+
`models.sessions.name` and every model `name` are Prisma client delegate names. Physical SQL table names remain an application concern and can use Prisma `@@map` without changing the adapter configuration.
|
|
529
587
|
|
|
530
588
|
Create and run migrations through the application's Prisma workflow. The package never manages migrations.
|
|
531
589
|
|
|
@@ -538,24 +596,11 @@ Create and run migrations through the application's Prisma workflow. The package
|
|
|
538
596
|
```ts
|
|
539
597
|
const account = c.get("account");
|
|
540
598
|
const session = c.get("session");
|
|
541
|
-
const user = c.get("user");
|
|
542
599
|
```
|
|
543
600
|
|
|
544
601
|
```ts
|
|
545
602
|
type AuthAccount = {
|
|
546
|
-
email: string;
|
|
547
|
-
id: string;
|
|
548
|
-
name: string;
|
|
549
|
-
role: string;
|
|
550
|
-
status: string;
|
|
551
|
-
timezone: string | null;
|
|
552
|
-
user: AuthUser;
|
|
553
|
-
};
|
|
554
|
-
|
|
555
|
-
type AuthUser = {
|
|
556
603
|
id: string;
|
|
557
|
-
role: string;
|
|
558
|
-
status: string;
|
|
559
604
|
};
|
|
560
605
|
|
|
561
606
|
type Session = {
|
|
@@ -572,14 +617,16 @@ type Session = {
|
|
|
572
617
|
};
|
|
573
618
|
```
|
|
574
619
|
|
|
575
|
-
|
|
620
|
+
The Prisma adapter refines `AuthAccount` with the exact fields and nested relations declared in `select`.
|
|
621
|
+
|
|
622
|
+
Only `account_id` is persisted in the session row. Current selected account data and configured relations are loaded through the database relation and never copied into the table.
|
|
576
623
|
|
|
577
624
|
### Methods
|
|
578
625
|
|
|
579
626
|
| Method | Purpose |
|
|
580
627
|
| --------------------------------------------- | -------------------------------------------------------------------------- |
|
|
581
628
|
| `auth.createSession({ account_id, context })` | Creates the DB session and writes the browser cookies. |
|
|
582
|
-
| `auth.resolveSession(context)` | Resolves a request and returns account
|
|
629
|
+
| `auth.resolveSession(context)` | Resolves a request and returns the selected account and session. |
|
|
583
630
|
| `auth.renewSession(context)` | Performs DB validation, renews when due, and writes authoritative cookies. |
|
|
584
631
|
| `auth.revokeSession(context)` | Revokes the current DB session and clears cookies. |
|
|
585
632
|
| `auth.clearSession(context)` | Clears browser cookies without revoking the DB session. |
|
|
@@ -636,7 +683,18 @@ Result values:
|
|
|
636
683
|
|
|
637
684
|
The adapter copies every returned `Set-Cookie` header to the browser response. It forwards only the session cookie and controlled client/origin headers required by the private API. Other cookies, authorization headers, and arbitrary headers are not forwarded.
|
|
638
685
|
|
|
639
|
-
`FORWARD_HEADERS`
|
|
686
|
+
`buildForwardHeaders()` and `FORWARD_HEADERS` are exported from `@gauts/auth/next` for application fetchers that need the same controlled forwarding rules:
|
|
687
|
+
|
|
688
|
+
```ts
|
|
689
|
+
import { buildForwardHeaders } from "@gauts/auth/next";
|
|
690
|
+
|
|
691
|
+
const headers = buildForwardHeaders({
|
|
692
|
+
headers: incoming,
|
|
693
|
+
extra: ["cookie", "authorization"],
|
|
694
|
+
});
|
|
695
|
+
```
|
|
696
|
+
|
|
697
|
+
Safe client and proxy metadata is copied by default. Credentials such as `cookie` and `authorization` are excluded unless explicitly listed in `extra`.
|
|
640
698
|
|
|
641
699
|
When `Origin` is absent and trusted `X-Forwarded-Proto` and `X-Forwarded-Host` headers exist, the adapter reconstructs the public origin from them. It never derives a public origin from the internal Next.js request URL. The deployment proxy must overwrite forwarded headers received from untrusted clients.
|
|
642
700
|
|
|
@@ -683,17 +741,17 @@ const db = {
|
|
|
683
741
|
} satisfies DbAdapter;
|
|
684
742
|
```
|
|
685
743
|
|
|
686
|
-
`findToken` receives only the SHA-256 token hash. It must return the current
|
|
744
|
+
`findToken` receives only the SHA-256 token hash. It must return the current selected account plus an `allowed` result. Raw tokens must never be persisted.
|
|
687
745
|
|
|
688
746
|
## Performance
|
|
689
747
|
|
|
690
748
|
The package contains no Redis or in-process cache.
|
|
691
749
|
|
|
692
|
-
Without the optional browser cache, each `requireSession` performs an indexed database lookup through `
|
|
750
|
+
Without the optional browser cache, each `requireSession` performs an indexed database lookup through `sessions.token_hash`.
|
|
693
751
|
|
|
694
752
|
With a valid cache, `GET` and `HEAD` skip the lookup until `cache.ttl` expires. Unsafe methods always use current database state.
|
|
695
753
|
|
|
696
|
-
The tradeoff is explicit: revocation and account
|
|
754
|
+
The tradeoff is explicit: revocation and selected account or relation changes made elsewhere may remain visible to safe cached requests until the short TTL expires. A 60-second TTL limits this stale-read window to one minute. Disable cache when immediate read revocation is required.
|
|
697
755
|
|
|
698
756
|
## Errors
|
|
699
757
|
|
package/SECURITY.md
CHANGED
|
@@ -35,7 +35,7 @@ The optional browser cache is disabled when omitted. When configured, it is acce
|
|
|
35
35
|
|
|
36
36
|
The cache is bound to the opaque session token, its own expiry, the authoritative session expiry, and the configured client fields. Invalid cache data never authenticates a request; it causes normal database validation.
|
|
37
37
|
|
|
38
|
-
Cookie caching introduces a bounded consistency window. A session revoked on another device, or account
|
|
38
|
+
Cookie caching introduces a bounded consistency window. A session revoked on another device, or selected account or relation access changed in the database, may remain readable until the cache TTL expires. Unsafe methods, renewal, logout, WebSockets, and direct core calls always validate through the database. Applications requiring immediate cross-device read revocation must leave the cache disabled or provide shared server-side enforcement outside this package.
|
|
39
39
|
|
|
40
40
|
Keep `AUTH_SECRET` in the API environment. Do not expose it to browser code or share it with a frontend merely to inspect the renewal timestamp. The timestamp is intentionally untrusted and never authenticates or renews a session by itself.
|
|
41
41
|
|
|
@@ -1,16 +1,15 @@
|
|
|
1
1
|
import type { Context, Env, MiddlewareHandler } from "hono";
|
|
2
2
|
import { type Auth, type AuthDeps } from "../../auth.js";
|
|
3
3
|
import { type SessionCacheConfig } from "../../session/cache.js";
|
|
4
|
-
import type { AuthAccount,
|
|
4
|
+
import type { AuthAccount, ResolvedSession, Session } from "../../session/types.js";
|
|
5
5
|
export type { SessionCacheConfig } from "../../session/cache.js";
|
|
6
6
|
import { type SessionCookieNames } from "../../session/cookie.js";
|
|
7
|
-
export type HonoAuthVariables = {
|
|
8
|
-
account:
|
|
7
|
+
export type HonoAuthVariables<TAccount extends AuthAccount = AuthAccount> = {
|
|
8
|
+
account: TAccount;
|
|
9
9
|
session: Session;
|
|
10
|
-
user: AuthUser;
|
|
11
10
|
};
|
|
12
|
-
export type HonoAuthEnv = Env & {
|
|
13
|
-
Variables: HonoAuthVariables
|
|
11
|
+
export type HonoAuthEnv<TAccount extends AuthAccount = AuthAccount> = Env & {
|
|
12
|
+
Variables: HonoAuthVariables<TAccount>;
|
|
14
13
|
};
|
|
15
14
|
export type HonoCookieConfig = {
|
|
16
15
|
cacheName?: string;
|
|
@@ -29,33 +28,33 @@ type HonoCacheOptions = {
|
|
|
29
28
|
cache?: undefined;
|
|
30
29
|
secret?: string;
|
|
31
30
|
};
|
|
32
|
-
export type HonoAdapterConfig = {
|
|
33
|
-
auth: Auth
|
|
31
|
+
export type HonoAdapterConfig<TAccount extends AuthAccount = AuthAccount> = {
|
|
32
|
+
auth: Auth<TAccount>;
|
|
34
33
|
cache?: SessionCacheConfig;
|
|
35
34
|
cookie?: HonoCookieConfig;
|
|
36
35
|
getIp?: HonoGetIp;
|
|
37
36
|
secret?: string;
|
|
38
37
|
};
|
|
39
|
-
type HonoAuthBase = AuthDeps & {
|
|
38
|
+
type HonoAuthBase<TAccount extends AuthAccount> = AuthDeps<TAccount> & {
|
|
40
39
|
cookie?: HonoCookieConfig;
|
|
41
40
|
getIp?: HonoGetIp;
|
|
42
41
|
};
|
|
43
|
-
export type HonoAuthConfig = HonoAuthBase & HonoCacheOptions;
|
|
42
|
+
export type HonoAuthConfig<TAccount extends AuthAccount = AuthAccount> = HonoAuthBase<TAccount> & HonoCacheOptions;
|
|
44
43
|
type CreateSessionInput = {
|
|
45
44
|
account_id: string;
|
|
46
45
|
context: Context;
|
|
47
46
|
};
|
|
48
|
-
export type HonoAdapter = {
|
|
47
|
+
export type HonoAdapter<TAccount extends AuthAccount = AuthAccount> = {
|
|
49
48
|
clearSession(c: Context): void;
|
|
50
49
|
cookie: Readonly<SessionCookieNames>;
|
|
51
50
|
createSession(input: CreateSessionInput): Promise<Session>;
|
|
52
51
|
getToken(c: Context): string | null;
|
|
53
52
|
renewSession(c: Context): Promise<Session>;
|
|
54
|
-
requireSession: MiddlewareHandler<HonoAuthEnv
|
|
55
|
-
resolveSession(c: Context): Promise<ResolvedSession
|
|
53
|
+
requireSession: MiddlewareHandler<HonoAuthEnv<TAccount>>;
|
|
54
|
+
resolveSession(c: Context): Promise<ResolvedSession<TAccount>>;
|
|
56
55
|
revokeSession(c: Context): Promise<string[]>;
|
|
57
56
|
};
|
|
58
|
-
export type HonoAuth = Auth & HonoAdapter
|
|
59
|
-
export declare const createHonoAdapter: ({ auth, cache, cookie, getIp, secret, }: HonoAdapterConfig) => HonoAdapter
|
|
60
|
-
export declare const createHonoAuth: ({ cache, cookie, db, getIp, password, secret, session, }: HonoAuthConfig) => HonoAuth
|
|
57
|
+
export type HonoAuth<TAccount extends AuthAccount = AuthAccount> = Auth<TAccount> & HonoAdapter<TAccount>;
|
|
58
|
+
export declare const createHonoAdapter: <TAccount extends AuthAccount>({ auth, cache, cookie, getIp, secret, }: HonoAdapterConfig<TAccount>) => HonoAdapter<TAccount>;
|
|
59
|
+
export declare const createHonoAuth: <TAccount extends AuthAccount>({ cache, cookie, db, getIp, password, secret, session, }: HonoAuthConfig<TAccount>) => HonoAuth<TAccount>;
|
|
61
60
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/hono/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE5D,OAAO,EAAc,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGrE,OAAO,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/hono/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE5D,OAAO,EAAc,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGrE,OAAO,EAGH,KAAK,kBAAkB,EAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEpF,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAIH,KAAK,kBAAkB,EAC1B,MAAM,yBAAyB,CAAC;AAEjC,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI;IACxE,OAAO,EAAE,QAAQ,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI,GAAG,GAAG;IACxE,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,CACpB,CAAC,EAAE,OAAO,KACT,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAEpE,KAAK,gBAAgB,GACf;IACI,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAClB,GACD;IACI,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAER,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI;IACxE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,YAAY,CAAC,QAAQ,SAAS,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG;IACnE,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,cAAc,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI,YAAY,CAAC,QAAQ,CAAC,GAC3F,gBAAgB,CAAC;AAErB,KAAK,kBAAkB,GAAG;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAcF,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI;IAClE,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACrC,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,cAAc,EAAE,iBAAiB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,QAAQ,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,GAC7E,WAAW,CAAC,QAAQ,CAAC,CAAC;AAoD1B,eAAO,MAAM,iBAAiB,GAAI,QAAQ,SAAS,WAAW,EAAE,yCAM7D,iBAAiB,CAAC,QAAQ,CAAC,KAAG,WAAW,CAAC,QAAQ,CAiOpD,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,QAAQ,SAAS,WAAW,EAAE,0DAQ1D,cAAc,CAAC,QAAQ,CAAC,KAAG,QAAQ,CAAC,QAAQ,CAiB9C,CAAC"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { deleteCookie, getCookie, setCookie } from "hono/cookie";
|
|
2
2
|
import { createAuth } from "../../auth.js";
|
|
3
3
|
import { createError, isAuthError } from "../../errors.js";
|
|
4
|
-
import { createSessionCache } from "../../session/cache.js";
|
|
4
|
+
import { createSessionCache, } from "../../session/cache.js";
|
|
5
5
|
import { formatRenewAt, parseSessionToken, resolveSessionCookieNames, } from "../../session/cookie.js";
|
|
6
6
|
const resolveCookie = (config = {}) => {
|
|
7
7
|
const names = resolveSessionCookieNames(config);
|
|
@@ -151,7 +151,6 @@ export const createHonoAdapter = ({ auth, cache, cookie, getIp, secret, }) => {
|
|
|
151
151
|
const value = {
|
|
152
152
|
account: created.account,
|
|
153
153
|
session: created.session,
|
|
154
|
-
user: created.user,
|
|
155
154
|
};
|
|
156
155
|
setSession({ context, session: created.session, token: created.token });
|
|
157
156
|
setCache({ context, resolved: value, token: created.token });
|
|
@@ -210,7 +209,6 @@ export const createHonoAdapter = ({ auth, cache, cookie, getIp, secret, }) => {
|
|
|
210
209
|
const value = await resolveSession(c);
|
|
211
210
|
c.set("session", value.session);
|
|
212
211
|
c.set("account", value.account);
|
|
213
|
-
c.set("user", value.user);
|
|
214
212
|
await next();
|
|
215
213
|
};
|
|
216
214
|
const revokeSession = async (c) => {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/hono/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,UAAU,EAA4B,MAAM,eAAe,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/hono/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,UAAU,EAA4B,MAAM,eAAe,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACH,kBAAkB,GAGrB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACH,aAAa,EACb,iBAAiB,EACjB,yBAAyB,GAE5B,MAAM,yBAAyB,CAAC;AAkFjC,MAAM,aAAa,GAAG,CAAC,SAA2B,EAAE,EAAE,EAAE;IACpD,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC;IAErC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,wCAAwC;SACpD,CAAC,CAAC;IACP,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,6DAA6D;aACzE,CAAC,CAAC;QACP,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,wCAAwC;aACpD,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,4CAA4C;SACxD,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,KAAK;QACL,OAAO,EAAE;YACL,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,QAAQ,EAAE,IAAa;YACvB,IAAI;YACJ,QAAQ;YACR,MAAM;SACT;KACJ,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;AAEvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAA+B,EAC5D,IAAI,EACJ,KAAK,EACL,MAAM,EACN,KAAK,EACL,MAAM,GACoB,EAAyB,EAAE;IACrD,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QACrD,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,gCAAgC;SAC5C,CAAC,CAAC;IACP,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,6DAA6D;SACzE,CAAC,CAAC;IACP,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,YAAY,GAAkC,IAAI,CAAC;IAEvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,qEAAqE;aACjF,CAAC,CAAC;QACP,CAAC;QAED,YAAY,GAAG,kBAAkB,CAAW;YACxC,MAAM,EAAE,KAAK;YACb,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC/B,CAAC,CAAC;IACP,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,EAAE,CAAU,EAA+B,EAAE,CAAC,CAAC;QACzE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;QACzC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAC7C,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,IAAI;KACvD,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAiB,EAAE;QAC3C,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAmB,EAAQ,EAAE;QAC7E,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE;YAClD,GAAG,QAAQ,CAAC,OAAO;YACnB,OAAO,EAAE,KAAK,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;YACxE,GAAG,QAAQ,CAAC,OAAO;YACnB,OAAO,EAAE,KAAK,CAAC,UAAU;SAC5B,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAA2B,EAAQ,EAAE;QACpF,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE;YACvD,GAAG,QAAQ,CAAC,OAAO;YACnB,OAAO,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,CAAU,EAAQ,EAAE;QACpC,IAAI,YAAY,EAAE,CAAC;YACf,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,CAAU,EAAQ,EAAE;QACtC,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,CAAU,EAAU,EAAE;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAE1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,0BAA0B;aACtC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,EAC5B,MAAM,EACN,OAAO,EACP,KAAK,GAKR,EAAsC,EAAE;QACrC,IAAI,KAAK,CAAC;QAEV,IAAI,CAAC;YACD,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBACjE,YAAY,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YAED,MAAM,KAAK,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,0BAA0B;aACtC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,EAAsB,EAAoB,EAAE;QAC1F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACtC,UAAU;YACV,MAAM,EAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC;SAC1C,CAAC,CAAC;QAEH,MAAM,KAAK,GAA8B;YACrC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;SAC3B,CAAC;QAEF,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACxE,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAE7D,OAAO,OAAO,CAAC,OAAO,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,KAAK,EAAE,CAAU,EAAsC,EAAE;QAC5E,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE3C,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC;gBAChC,MAAM;gBACN,KAAK;gBACL,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;aAChD,CAAC,CAAC;YAEH,IAAI,MAAM,EAAE,CAAC;gBACT,OAAO,MAAM,CAAC;YAClB,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpE,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC3B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACJ,UAAU,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EAAE,CAAU,EAAoB,EAAE;QACxD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC;QAEZ,IAAI,CAAC;YACD,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC/B,MAAM,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC;gBACjC,KAAK;aACR,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBACjE,YAAY,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;YAED,MAAM,KAAK,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,0BAA0B;aACtC,CAAC,CAAC;QACP,CAAC;QAED,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,OAAO,OAAO,CAAC,OAAO,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,cAAc,GAA6C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;QAEtC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,EAAE,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAAE,CAAU,EAAqB,EAAE;QAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,YAAY,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,OAAO,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO;QACH,YAAY;QACZ,MAAM,EAAE,QAAQ,CAAC,KAAK;QACtB,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,cAAc;QACd,cAAc;QACd,aAAa;KAChB,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAA+B,EACzD,KAAK,EACL,MAAM,EACN,EAAE,EACF,KAAK,EACL,QAAQ,EACR,MAAM,EACN,OAAO,GACgB,EAAsB,EAAE;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,EAAE;QACF,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAChD,CAAC,CAAC;IAEH,OAAO;QACH,GAAG,IAAI;QACP,GAAG,iBAAiB,CAAC;YACjB,IAAI;YACJ,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC9C,CAAC;KACL,CAAC;AACN,CAAC,CAAC"}
|
|
@@ -19,6 +19,11 @@ export type NextRenewResult = {
|
|
|
19
19
|
export type NextAuth = {
|
|
20
20
|
renew(input: NextRenewInput): Promise<NextRenewResult>;
|
|
21
21
|
};
|
|
22
|
-
export
|
|
22
|
+
export type BuildForwardHeadersInput = {
|
|
23
|
+
extra?: readonly string[];
|
|
24
|
+
headers: Headers;
|
|
25
|
+
};
|
|
26
|
+
export declare const FORWARD_HEADERS: readonly ["accept-language", "cf-connecting-ip", "origin", "referer", "sec-ch-ua", "sec-ch-ua-mobile", "sec-ch-ua-platform", "sec-fetch-dest", "sec-fetch-mode", "sec-fetch-site", "sec-fetch-user", "true-client-ip", "user-agent", "x-forwarded-for", "x-forwarded-host", "x-forwarded-port", "x-forwarded-proto", "x-real-ip"];
|
|
27
|
+
export declare const buildForwardHeaders: ({ extra, headers: incoming, }: BuildForwardHeadersInput) => Headers;
|
|
23
28
|
export declare const createNextAuth: ({ cookie, renewUrl }: NextAuthConfig) => NextAuth;
|
|
24
29
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAShE,MAAM,MAAM,gBAAgB,GAAG;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACnB,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1D,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAShE,MAAM,MAAM,gBAAgB,GAAG;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACnB,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1D,CAAC;AAQF,MAAM,MAAM,wBAAwB,GAAG;IACnC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAIF,eAAO,MAAM,eAAe,mUAmBlB,CAAC;AAEX,eAAO,MAAM,mBAAmB,GAAI,+BAGjC,wBAAwB,KAAG,OAoB7B,CAAC;AAsBF,eAAO,MAAM,cAAc,GAAI,sBAAsB,cAAc,KAAG,QA8DrE,CAAC"}
|