@getstrata/bootstrap 0.2.68 → 0.4.3

package/dist/entries/createSpaRoutes.js

@@ -4,37 +4,61 @@ var __jsonParse = (a) => JSON.parse(a);
 // ../../src/bootstrap/createSpaRoutes.ts
 import { join } from "path";
 import { jsonResponse } from "@getstrata/core/http/response";
-import { isSpaEnabled } from "@getstrata/core/runtime/frontendMode";
+import { isSpaEnabled, isViewsEnabled, readSpaPrefix } from "@getstrata/core/runtime/frontendMode";
 var SPA_DIST_DIRECTORY = join(process.cwd(), "frontend/dist");
-var SPA_INDEX_FILE = join(SPA_DIST_DIRECTORY, "index.html");
-function createSpaRoutes(_dependencies) {
-  return {
-    "/app/*": async (request) => {
-      const pathname = new URL(request.url).pathname;
-      const relativePath = pathname.replace(/^\/app\//, "");
-      const assetFile = Bun.file(join(SPA_DIST_DIRECTORY, relativePath));
-      if (relativePath.length > 0 && await assetFile.exists()) {
-        return new Response(assetFile);
-      }
-      const indexFile = Bun.file(SPA_INDEX_FILE);
-      if (await indexFile.exists()) {
-        return new Response(indexFile, {
-          headers: { "Content-Type": "text/html; charset=utf-8" }
-        });
-      }
-      return jsonResponse({
-        error: "SPA build not found. Run `bun run build:frontend`."
-      }, { status: 503 });
-    },
-    "/": async () => Response.redirect("/app/", 302)
+function relativeSpaPath(pathname, prefix) {
+  if (pathname === prefix || pathname === `${prefix}/`) {
+    return "";
+  }
+  if (pathname.startsWith(`${prefix}/`)) {
+    return pathname.slice(prefix.length + 1);
+  }
+  return "";
+}
+function createSpaDocumentHandler(prefix, distDirectory) {
+  const indexFilePath = join(distDirectory, "index.html");
+  return async (request) => {
+    const pathname = new URL(request.url).pathname;
+    if (pathname.startsWith("/api/")) {
+      return new Response("Not found", { status: 404 });
+    }
+    const relativePath = relativeSpaPath(pathname, prefix);
+    const assetFile = Bun.file(join(distDirectory, relativePath));
+    if (relativePath.length > 0 && await assetFile.exists()) {
+      return new Response(assetFile);
+    }
+    const indexFile = Bun.file(indexFilePath);
+    if (await indexFile.exists()) {
+      return new Response(indexFile, {
+        headers: { "Content-Type": "text/html; charset=utf-8" }
+      });
+    }
+    return jsonResponse({
+      error: "SPA build not found. Run `bun run frontend:build` in your app."
+    }, { status: 503 });
   };
 }
-function mergeSpaRoutes(dependencies, routes) {
+function createSpaRoutes(_dependencies, options = {}) {
+  const prefix = options.prefix ?? readSpaPrefix();
+  const distDirectory = options.distDirectory ?? SPA_DIST_DIRECTORY;
+  const wrap = options.wrap ?? ((handler2) => handler2);
+  const handler = wrap(createSpaDocumentHandler(prefix, distDirectory));
+  const routes = {
+    [prefix]: handler,
+    [`${prefix}/`]: handler,
+    [`${prefix}/*`]: handler
+  };
+  if (!isViewsEnabled()) {
+    routes["/"] = async () => Response.redirect(`${prefix}/`, 302);
+  }
+  return routes;
+}
+function mergeSpaRoutes(dependencies, routes, options) {
   if (!isSpaEnabled()) {
     return routes;
   }
   return {
-    ...createSpaRoutes(dependencies),
+    ...createSpaRoutes(dependencies, options),
     ...routes
   };
 }

package/dist/entries/createWebRoutes.js

@@ -36,7 +36,7 @@ import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/require
 import { createRequirePasswordConfirmMiddleware } from "@getstrata/core/http/requirePasswordConfirmMiddleware";
 import { createRequireVerifiedMiddleware } from "@getstrata/core/http/requireVerifiedMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
-import { withErrorHandling } from "@getstrata/core/http/response";
+import { withErrorHandling, withJsonErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createValidateSignatureMiddleware } from "@getstrata/core/http/signedUrl";
@@ -184,7 +184,7 @@ class HttpKernel {
     return withMiddleware(...middleware)(handler);
   }
   wrapApi(handler) {
-    return this.wrap(["api", "authenticated"], handler);
+    return withJsonErrorHandling(this.wrap(["api", "authenticated"], handler));
   }
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));

package/dist/entries/dependencies.js

@@ -96,17 +96,19 @@ function resetDiscoverModulesForTests() {
   state.modulesReady = undefined;
 }
 // ../../src/bootstrap/providers/auth.ts
+import { BasicAuthGuard } from "@getstrata/core/auth/basicAuthGuard";
 import {
   AuthManager,
   CompositeGuard,
   DatabaseTokenGuard,
   GuestGuard
 } from "@getstrata/core/auth/guard";
+import { JwtGuard } from "@getstrata/core/auth/jwtGuard";
 import { SessionGuard } from "@getstrata/core/auth/sessionGuard";
 
 // ../../src/config/auth.ts
 var authConfig = {
-  allowDevHeaders: (process.env.AUTH_DEV_HEADERS ?? "true") !== "false",
+  allowDevHeaders: process.env.AUTH_DEV_HEADERS === "true",
   tokenDefaultAbilities: ["*"]
 };
 
@@ -141,11 +143,22 @@ var authProvider = {
   name: "core.auth",
   register({ container, config }) {
     config.set("auth.allowDevHeaders", authConfig.allowDevHeaders);
-    const guards = [new DatabaseTokenGuard(container), new SessionGuard(container)];
+    const apiGuard = new DatabaseTokenGuard(container);
+    const sessionGuard = new SessionGuard(container);
+    const jwtGuard = new JwtGuard;
+    const basicGuard = new BasicAuthGuard(container);
+    const guards = [apiGuard, jwtGuard, basicGuard, sessionGuard];
     if (authConfig.allowDevHeaders) {
       guards.push(new GuestGuard);
     }
-    container.set(CORE_AUTH_TOKEN, new AuthManager(new CompositeGuard(guards)));
+    const auth = new AuthManager(new CompositeGuard(guards));
+    auth.registerGuard("api", apiGuard);
+    auth.registerGuard("access_token", apiGuard);
+    auth.registerGuard("jwt", jwtGuard);
+    auth.registerGuard("basic", basicGuard);
+    auth.registerGuard("web", sessionGuard);
+    auth.registerGuard("session", sessionGuard);
+    container.set(CORE_AUTH_TOKEN, auth);
   }
 };
 var auth_default = authProvider;
@@ -206,8 +219,12 @@ var queueConfig = {
 };
 // ../../src/bootstrap/env.ts
 import { defineEnvSchema } from "@getstrata/core/config/envSchema";
+import { DEFAULT_SPA_PREFIX, FRONTEND_MODE_PATTERN } from "@getstrata/core/runtime/frontendMode";
 var appEnvSchema = defineEnvSchema({
-  DATABASE_URL: { required: true, pattern: /^postgres(ql)?:\/\// },
+  DATABASE_URL: {
+    required: true,
+    pattern: /^(postgres(ql)?|mysql|sqlite):\/\//i
+  },
   PORT: {
     integer: true,
     minimum: 1,
@@ -235,9 +252,21 @@ var appEnvSchema = defineEnvSchema({
     pattern: /^(sync|async|redis)$/
   },
   AUTH_DEV_HEADERS: {
-    default: "true",
+    default: "false",
     pattern: /^(true|false|0|1)$/
   },
+  DB_CONNECTION: {
+    default: "",
+    pattern: /^(pgsql|postgres|postgresql|mysql|mariadb|sqlite)?$/i
+  },
+  AUTH_DEFAULT_GUARD: {
+    default: "web"
+  },
+  JWT_TTL_SECONDS: {
+    integer: true,
+    minimum: 60,
+    default: "3600"
+  },
   APP_ENV: {
     default: "local"
   },
@@ -247,6 +276,13 @@ var appEnvSchema = defineEnvSchema({
   APP_URL: {
     default: "http://localhost:3000"
   },
+  FRONTEND_MODE: {
+    default: "api",
+    pattern: FRONTEND_MODE_PATTERN
+  },
+  SPA_PREFIX: {
+    default: DEFAULT_SPA_PREFIX
+  },
   API_PREFIX: {
     default: "/api/v1"
   },

package/dist/entries/httpKernel.js

@@ -24,7 +24,7 @@ import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/require
 import { createRequirePasswordConfirmMiddleware } from "@getstrata/core/http/requirePasswordConfirmMiddleware";
 import { createRequireVerifiedMiddleware } from "@getstrata/core/http/requireVerifiedMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
-import { withErrorHandling } from "@getstrata/core/http/response";
+import { withErrorHandling, withJsonErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createValidateSignatureMiddleware } from "@getstrata/core/http/signedUrl";
@@ -172,7 +172,7 @@ class HttpKernel {
     return withMiddleware(...middleware)(handler);
   }
   wrapApi(handler) {
-    return this.wrap(["api", "authenticated"], handler);
+    return withJsonErrorHandling(this.wrap(["api", "authenticated"], handler));
   }
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));

package/dist/entries/providers.js

@@ -2,17 +2,19 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/providers/auth.ts
+import { BasicAuthGuard } from "@getstrata/core/auth/basicAuthGuard";
 import {
   AuthManager,
   CompositeGuard,
   DatabaseTokenGuard,
   GuestGuard
 } from "@getstrata/core/auth/guard";
+import { JwtGuard } from "@getstrata/core/auth/jwtGuard";
 import { SessionGuard } from "@getstrata/core/auth/sessionGuard";
 
 // ../../src/config/auth.ts
 var authConfig = {
-  allowDevHeaders: (process.env.AUTH_DEV_HEADERS ?? "true") !== "false",
+  allowDevHeaders: process.env.AUTH_DEV_HEADERS === "true",
   tokenDefaultAbilities: ["*"]
 };
 
@@ -47,11 +49,22 @@ var authProvider = {
   name: "core.auth",
   register({ container, config }) {
     config.set("auth.allowDevHeaders", authConfig.allowDevHeaders);
-    const guards = [new DatabaseTokenGuard(container), new SessionGuard(container)];
+    const apiGuard = new DatabaseTokenGuard(container);
+    const sessionGuard = new SessionGuard(container);
+    const jwtGuard = new JwtGuard;
+    const basicGuard = new BasicAuthGuard(container);
+    const guards = [apiGuard, jwtGuard, basicGuard, sessionGuard];
     if (authConfig.allowDevHeaders) {
       guards.push(new GuestGuard);
     }
-    container.set(CORE_AUTH_TOKEN, new AuthManager(new CompositeGuard(guards)));
+    const auth = new AuthManager(new CompositeGuard(guards));
+    auth.registerGuard("api", apiGuard);
+    auth.registerGuard("access_token", apiGuard);
+    auth.registerGuard("jwt", jwtGuard);
+    auth.registerGuard("basic", basicGuard);
+    auth.registerGuard("web", sessionGuard);
+    auth.registerGuard("session", sessionGuard);
+    container.set(CORE_AUTH_TOKEN, auth);
   }
 };
 var auth_default = authProvider;
@@ -112,8 +125,12 @@ var queueConfig = {
 };
 // ../../src/bootstrap/env.ts
 import { defineEnvSchema } from "@getstrata/core/config/envSchema";
+import { DEFAULT_SPA_PREFIX, FRONTEND_MODE_PATTERN } from "@getstrata/core/runtime/frontendMode";
 var appEnvSchema = defineEnvSchema({
-  DATABASE_URL: { required: true, pattern: /^postgres(ql)?:\/\// },
+  DATABASE_URL: {
+    required: true,
+    pattern: /^(postgres(ql)?|mysql|sqlite):\/\//i
+  },
   PORT: {
     integer: true,
     minimum: 1,
@@ -141,9 +158,21 @@ var appEnvSchema = defineEnvSchema({
     pattern: /^(sync|async|redis)$/
   },
   AUTH_DEV_HEADERS: {
-    default: "true",
+    default: "false",
     pattern: /^(true|false|0|1)$/
   },
+  DB_CONNECTION: {
+    default: "",
+    pattern: /^(pgsql|postgres|postgresql|mysql|mariadb|sqlite)?$/i
+  },
+  AUTH_DEFAULT_GUARD: {
+    default: "web"
+  },
+  JWT_TTL_SECONDS: {
+    integer: true,
+    minimum: 60,
+    default: "3600"
+  },
   APP_ENV: {
     default: "local"
   },
@@ -153,6 +182,13 @@ var appEnvSchema = defineEnvSchema({
   APP_URL: {
     default: "http://localhost:3000"
   },
+  FRONTEND_MODE: {
+    default: "api",
+    pattern: FRONTEND_MODE_PATTERN
+  },
+  SPA_PREFIX: {
+    default: DEFAULT_SPA_PREFIX
+  },
   API_PREFIX: {
     default: "/api/v1"
   },

package/dist/entries/secretsGuard.js

@@ -2,15 +2,21 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/secretsGuard.ts
-var PUBLISHED_TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var PUBLISHED_TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
-var PUBLISHED_TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+import { isViewsMode, parseFrontendMode } from "@getstrata/core/runtime/frontendMode";
+var PUBLISHED_TEST_ADMIN_API_TOKEN = "strata-admin-test-token";
+var PUBLISHED_TEST_MEMBER_API_TOKEN = "strata-member-test-token";
+var PUBLISHED_TEST_SCIM_BEARER_TOKEN = "strata-scim-test-token";
 var MIN_SESSION_SECRET_LENGTH = 32;
 var PUBLISHED_TEST_TOKENS = new Set([
   PUBLISHED_TEST_ADMIN_API_TOKEN,
-  PUBLISHED_TEST_MEMBER_API_TOKEN
+  PUBLISHED_TEST_MEMBER_API_TOKEN,
+  "workhub-admin-test-token",
+  "workhub-member-test-token"
+]);
+var PUBLISHED_TEST_SCIM_TOKENS = new Set([
+  PUBLISHED_TEST_SCIM_BEARER_TOKEN,
+  "workhub-scim-test-token"
 ]);
-var PUBLISHED_TEST_SCIM_TOKENS = new Set([PUBLISHED_TEST_SCIM_BEARER_TOKEN]);
 function isEnabled(value, defaultEnabled) {
   if (value === undefined) {
     return defaultEnabled;
@@ -34,7 +40,7 @@ function assertAuthDevHeadersDisabled(env) {
 function assertSessionSecret(env) {
   const secret = env.SESSION_SECRET?.trim() ?? "";
   if (secret.length < MIN_SESSION_SECRET_LENGTH) {
-    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx (32+ characters).");
+    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx or hybrid (32+ characters).");
   }
 }
 function assertPublishedTestTokensRotated(env) {
@@ -96,8 +102,7 @@ function assertProductionSecrets(env = process.env) {
     assertTokenAuthProductionSecrets(env);
   }
   assertFeatureProductionSecrets(env);
-  const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx") {
+  if (isViewsMode(parseFrontendMode(env.FRONTEND_MODE))) {
     assertSessionSecret(env);
   }
 }

package/dist/entries/web/routing.js

@@ -2,6 +2,7 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/web/routing.ts
+import { requestPrefersJson } from "@getstrata/core/http/contentNegotiation";
 import { withErrorHandling as withErrorHandling2 } from "@getstrata/core/http/response";
 
 // ../../src/bootstrap/http/securedRouteModelBinding.ts
@@ -33,7 +34,7 @@ import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/require
 import { createRequirePasswordConfirmMiddleware } from "@getstrata/core/http/requirePasswordConfirmMiddleware";
 import { createRequireVerifiedMiddleware } from "@getstrata/core/http/requireVerifiedMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
-import { withErrorHandling } from "@getstrata/core/http/response";
+import { withErrorHandling, withJsonErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createValidateSignatureMiddleware } from "@getstrata/core/http/signedUrl";
@@ -181,7 +182,7 @@ class HttpKernel {
     return withMiddleware(...middleware)(handler);
   }
   wrapApi(handler) {
-    return this.wrap(["api", "authenticated"], handler);
+    return withJsonErrorHandling(this.wrap(["api", "authenticated"], handler));
   }
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
@@ -366,7 +367,7 @@ function wrapWebThrottle(kernel, scope, handler, onThrottled) {
   const throttled = scope === "login" ? kernel.wrapLogin(handler) : kernel.wrapRegister(handler);
   return async (request) => {
     const response = await throttled(request);
-    if (response.status === 429) {
+    if (response.status === 429 && !requestPrefersJson(request)) {
       return onThrottled(request);
     }
     return response;

package/dist/entries/web/session.js

@@ -2,11 +2,19 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/web/session.ts
-import { createHash, randomBytes } from "crypto";
+import { createHmac, randomBytes } from "crypto";
 import { AuthManager } from "@getstrata/core/auth/guard";
 import { getBoundDatabaseConnection } from "@getstrata/core/database/boundConnection";
 import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+import { currentSqlDialect } from "@getstrata/core/database/dialect";
 import { readRequestCookie } from "@getstrata/core/http/cookies";
+import { timingSafeCompareString } from "@getstrata/core/security/timingSafeCompare";
+function sqlPlaceholder(index) {
+  return currentSqlDialect().placeholder(index);
+}
+function sqlNow() {
+  return currentSqlDialect().nowExpression();
+}
 function isSqlClient(value) {
   return typeof value.unsafe === "function";
 }
@@ -26,25 +34,39 @@ function defaultSessionSql() {
 function defaultMapSessionUser(user) {
   return {
     id: user.id,
-    role: user.is_admin ? "admin" : "member"
+    role: user.is_admin ? "admin" : "member",
+    ...user.email_verified_at !== undefined ? { emailVerifiedAt: user.email_verified_at } : {}
+  };
+}
+function sessionDisplayName(row, email) {
+  if (typeof row.name === "string" && row.name.trim() !== "") {
+    return row.name;
+  }
+  const first = typeof row.first_name === "string" ? row.first_name.trim() : "";
+  const last = typeof row.last_name === "string" ? row.last_name.trim() : "";
+  const composed = `${first} ${last}`.trim();
+  return composed || email;
+}
+function mapSessionUserRow(row) {
+  const email = typeof row.email === "string" ? row.email : "";
+  return {
+    id: Number(row.user_id ?? row.id),
+    name: sessionDisplayName(row, email),
+    email,
+    learn_subscriber: Boolean(row.learn_subscriber),
+    is_admin: Boolean(row.is_admin),
+    ...row.email_verified_at !== undefined ? { email_verified_at: row.email_verified_at } : {}
   };
 }
 async function defaultLoadSessionUser(sql, sessionId) {
-  const rows = await sql.unsafe(`SELECT s.id, s.user_id, s.expires_at, u.name, u.email, u.learn_subscriber,
-            COALESCE(u.is_admin, false) AS is_admin
+  const rows = await sql.unsafe(`SELECT s.user_id, s.expires_at, u.*
      FROM sessions s
      INNER JOIN users u ON u.id = s.user_id
-     WHERE s.id = $1 AND s.expires_at > NOW()`, [sessionId]);
+     WHERE s.id = ${sqlPlaceholder(1)} AND s.expires_at > ${sqlNow()}`, [sessionId]);
   const row = rows[0];
   if (!row)
     return null;
-  return {
-    id: row.user_id,
-    name: row.name,
-    email: row.email,
-    learn_subscriber: row.learn_subscriber,
-    is_admin: row.is_admin
-  };
+  return mapSessionUserRow(row);
 }
 function redirectWithCookie(location, setCookie, status) {
   return new Response(null, {
@@ -82,7 +104,7 @@ class CookieSessionStore {
     if (!raw)
       return null;
     const [sessionId, signature] = raw.split(".");
-    if (!sessionId || !signature || signature !== this.sign(sessionId)) {
+    if (!sessionId || !signature || !timingSafeCompareString(signature, this.sign(sessionId))) {
       return null;
     }
     return sessionId;
@@ -100,28 +122,24 @@ class CookieSessionStore {
     const id = randomBytes(32).toString("hex");
     const expires = new Date(Date.now() + this.maxAgeSeconds * 1000);
     await this.sql().unsafe(`INSERT INTO sessions (id, user_id, expires_at, user_agent, ip_address, last_active_at)
-       VALUES ($1, $2, $3, $4, $5, NOW())`, [id, user.id, expires, meta.userAgent ?? null, meta.ipAddress ?? null]);
+       VALUES (${sqlPlaceholder(1)}, ${sqlPlaceholder(2)}, ${sqlPlaceholder(3)}, ${sqlPlaceholder(4)}, ${sqlPlaceholder(5)}, ${sqlNow()})`, [id, user.id, expires.toISOString(), meta.userAgent ?? null, meta.ipAddress ?? null]);
     return id;
   }
   async destroy(sessionId) {
-    await this.sql().unsafe(`DELETE FROM sessions WHERE id = $1`, [sessionId]);
+    await this.sql().unsafe(`DELETE FROM sessions WHERE id = ${sqlPlaceholder(1)}`, [sessionId]);
   }
   async destroyOtherSessions(userId, keepSessionId) {
-    await this.sql().unsafe(`DELETE FROM sessions WHERE user_id = $1 AND id <> $2`, [
-      userId,
-      keepSessionId
-    ]);
+    await this.sql().unsafe(`DELETE FROM sessions WHERE user_id = ${sqlPlaceholder(1)} AND id <> ${sqlPlaceholder(2)}`, [userId, keepSessionId]);
   }
   async listForUser(userId) {
+    const dialect = currentSqlDialect();
     return this.sql().unsafe(`SELECT id, user_id, user_agent, ip_address, last_active_at, expires_at
        FROM sessions
-       WHERE user_id = $1 AND expires_at > NOW()
-       ORDER BY last_active_at DESC NULLS LAST, expires_at DESC`, [userId]);
+       WHERE user_id = ${dialect.placeholder(1)} AND expires_at > ${dialect.nowExpression()}
+       ORDER BY last_active_at DESC${dialect.nullsLastSuffix()}, expires_at DESC`, [userId]);
   }
   async touch(sessionId) {
-    await this.sql().unsafe(`UPDATE sessions SET last_active_at = NOW() WHERE id = $1`, [
-      sessionId
-    ]);
+    await this.sql().unsafe(`UPDATE sessions SET last_active_at = ${sqlNow()} WHERE id = ${sqlPlaceholder(1)}`, [sessionId]);
   }
   async read(request) {
     const sessionId = this.sessionIdFromRequest(request);
@@ -130,7 +148,7 @@ class CookieSessionStore {
     return this.loadSessionUser(this.sql(), sessionId);
   }
   sign(value) {
-    return createHash("sha256").update(`${value}.${this.secret}`).digest("hex").slice(0, 32);
+    return createHmac("sha256", this.secret).update(value).digest("hex").slice(0, 32);
   }
 }
 
@@ -153,8 +171,11 @@ class CookieSessionGuard {
 class CookieSessionAuthManager extends AuthManager {
   store;
   constructor(store, mapUser = defaultMapSessionUser) {
-    super(new CookieSessionGuard(store, mapUser));
+    const guard = new CookieSessionGuard(store, mapUser);
+    super(guard);
     this.store = store;
+    this.registerGuard("web", guard);
+    this.registerGuard("session", guard);
   }
   async signIn(user, meta = {}) {
     const sessionId = await this.store.create(user, meta);