@growth-labs/auth 0.10.4 → 0.12.0

package/src/workers.ts

@@ -0,0 +1,758 @@
+import { createClientSecretBasicAuthHeader } from './utils/client-secret-header.js'
+import { getCookie, setCookie } from './utils/cookies.js'
+import { extractIdentityId } from './utils/identity.js'
+import { resolveInternalIssuer } from './utils/issuer.js'
+import { generatePKCE } from './utils/pkce.js'
+import { generateState, verifyState } from './utils/state.js'
+import { type VerifiedClaims, verifyAccessToken } from './utils/tokens.js'
+
+const DEFAULT_CALLBACK_PATH = '/api/auth/callback'
+const DEFAULT_LOGIN_PATH = '/login'
+const DEFAULT_ACCESS_TOKEN_MAX_AGE = 900
+const DEFAULT_REFRESH_TOKEN_MAX_AGE = 2_592_000
+const DEFAULT_TRANSACTION_MAX_AGE = 600
+const DEFAULT_CLOCK_SKEW = 60
+
+type MaybePromise<T> = T | Promise<T>
+
+export type ClientSecretValue = Uint8Array | string
+export type ClientSecretResolver = (request: Request) => MaybePromise<ClientSecretValue>
+
+export interface ClientSecretStore {
+	get(): MaybePromise<ClientSecretValue | string>
+}
+
+export interface ClientSecretResolverSource {
+	resolve(request: Request): MaybePromise<ClientSecretValue>
+}
+
+export type WorkersClientSecret =
+	| Uint8Array
+	| ClientSecretResolver
+	| ClientSecretResolverSource
+	| ClientSecretStore
+
+export interface WorkersAuthConfig {
+	issuer: string
+	issuerInternal?: string
+	clientId: string
+	clientSecret?: WorkersClientSecret
+	resource: string
+	callbackPath?: string
+	cookiePrefix: string
+	sessionCookieDomain?: string
+	providers: readonly string[]
+	gatedPaths?: readonly string[]
+	loginPath?: string
+	accessTokenMaxAge?: number
+	refreshTokenMaxAge?: number
+	transactionMaxAge?: number
+	clockSkew?: number
+}
+
+interface NormalizedWorkersAuthConfig {
+	issuer: string
+	issuerInternal: string
+	clientId: string
+	clientSecret?: WorkersClientSecret
+	resource: string
+	callbackPath: string
+	cookiePrefix: string
+	sessionCookieDomain?: string
+	providers: readonly string[]
+	gatedPaths: readonly string[]
+	loginPath: string
+	accessTokenMaxAge: number
+	refreshTokenMaxAge: number
+	transactionMaxAge: number
+	clockSkew: number
+}
+
+export interface Principal {
+	Subject: string
+	UserID: string
+	Email: string
+	Name: string
+	Image: string
+	Roles: string[]
+	Audiences: string[]
+}
+
+export interface Tokens {
+	AccessToken: string
+	RefreshToken: string
+}
+
+export interface Session {
+	Principal: Principal | null
+	Tokens: Tokens | null
+	Refreshed: boolean
+}
+
+export interface WorkersAuthVariables {
+	principal: Principal | null
+	session: Session
+}
+
+export interface WorkersAuthEnv {
+	Variables: WorkersAuthVariables
+}
+
+export interface WorkersAuthContext {
+	req: { readonly raw: Request }
+	get<Key extends keyof WorkersAuthVariables>(key: Key): WorkersAuthVariables[Key]
+	set<Key extends keyof WorkersAuthVariables>(key: Key, value: WorkersAuthVariables[Key]): void
+	redirect(location: string, status: 302): Response
+	res: Response
+}
+
+export type WorkersAuthMiddleware = (
+	context: WorkersAuthContext,
+	next: () => Promise<void>,
+) => Promise<Response | undefined>
+export type RequestOrHonoContext = Request | Pick<WorkersAuthContext, 'req'>
+export type PrincipalSource = Session | Pick<WorkersAuthContext, 'get'>
+
+export class WorkersAuthServiceUnavailableError extends Error {
+	readonly code = 'AUTH_SERVICE_UNAVAILABLE'
+	readonly status = 503
+
+	constructor() {
+		super('Auth service unavailable')
+		this.name = 'WorkersAuthServiceUnavailableError'
+	}
+}
+
+export interface WorkersAuthClient {
+	Authorize(
+		requestOrContext: RequestOrHonoContext,
+		provider: string,
+		redirectPath: string,
+	): Promise<Response>
+	Callback(requestOrContext: RequestOrHonoContext): Promise<Response>
+	Middleware(): WorkersAuthMiddleware
+	Principal(source: PrincipalSource): Principal | null
+	getSession(requestOrContext: RequestOrHonoContext): Promise<Session>
+	setSessionCookies(response: Response, tokens: Tokens): Response
+	clearSessionCookies(response: Response): Response
+}
+
+function normalizeIssuer(value: string, label: string): string {
+	let url: URL
+	try {
+		url = new URL(value)
+	} catch {
+		throw new TypeError(`${label} must be an absolute HTTP URL`)
+	}
+	if (
+		(url.protocol !== 'https:' && url.protocol !== 'http:') ||
+		url.username !== '' ||
+		url.password !== '' ||
+		(url.pathname !== '/' && url.pathname !== '') ||
+		url.search !== '' ||
+		url.hash !== ''
+	) {
+		throw new TypeError(`${label} must be an origin without credentials, path, query, or fragment`)
+	}
+	return url.origin
+}
+
+function validateResource(value: string): string {
+	let url: URL
+	try {
+		url = new URL(value)
+	} catch {
+		throw new TypeError('resource must be an absolute HTTP URL')
+	}
+	if (
+		(url.protocol !== 'https:' && url.protocol !== 'http:') ||
+		url.username !== '' ||
+		url.password !== '' ||
+		url.hash !== ''
+	) {
+		throw new TypeError('resource must be an absolute HTTP URL without credentials or fragment')
+	}
+	return value
+}
+
+function isSafeAbsolutePath(path: string): boolean {
+	const lower = path.toLowerCase()
+	if (
+		!path.startsWith('/') ||
+		path.startsWith('//') ||
+		path.includes('\\') ||
+		lower.includes('%2f') ||
+		lower.includes('%5c')
+	) {
+		return false
+	}
+	try {
+		const parsed = new URL(path, 'https://local.invalid')
+		return parsed.origin === 'https://local.invalid'
+	} catch {
+		return false
+	}
+}
+
+function isSafeLocalRoute(path: string): boolean {
+	if (!isSafeAbsolutePath(path)) return false
+	const parsed = new URL(path, 'https://local.invalid')
+	return parsed.search === '' && parsed.hash === ''
+}
+
+function safeRedirect(path: string | null): string {
+	return path !== null && isSafeAbsolutePath(path) ? path : '/'
+}
+
+function positiveSeconds(value: number | undefined, fallback: number, label: string): number {
+	if (value === undefined) return fallback
+	if (!Number.isInteger(value) || value <= 0) {
+		throw new TypeError(`${label} must be a positive integer number of seconds`)
+	}
+	return value
+}
+
+function normalizeConfig(config: WorkersAuthConfig): NormalizedWorkersAuthConfig {
+	const issuer = normalizeIssuer(config.issuer, 'issuer')
+	const issuerInternal = config.issuerInternal
+		? normalizeIssuer(config.issuerInternal, 'issuerInternal')
+		: issuer
+	if (typeof config.clientId !== 'string' || config.clientId.trim() === '') {
+		throw new TypeError('clientId is required')
+	}
+	if (typeof config.cookiePrefix !== 'string' || !/^[A-Za-z0-9_-]+$/.test(config.cookiePrefix)) {
+		throw new TypeError('cookiePrefix must contain only letters, numbers, underscores, or hyphens')
+	}
+	const callbackPath = config.callbackPath ?? DEFAULT_CALLBACK_PATH
+	const loginPath = config.loginPath ?? DEFAULT_LOGIN_PATH
+	if (!isSafeLocalRoute(callbackPath)) throw new TypeError('callbackPath must be a local route')
+	if (!isSafeLocalRoute(loginPath)) throw new TypeError('loginPath must be a local route')
+	if (!Array.isArray(config.providers) || config.providers.length === 0) {
+		throw new TypeError('at least one provider is required')
+	}
+	if (config.providers.some((provider) => typeof provider !== 'string' || provider.trim() === '')) {
+		throw new TypeError('providers must be non-empty strings')
+	}
+	const gatedPaths = [...(config.gatedPaths ?? [])]
+	for (const pattern of gatedPaths) {
+		const route = pattern.endsWith('/*') ? pattern.slice(0, -1) : pattern
+		if (!isSafeLocalRoute(route)) throw new TypeError('gatedPaths must contain local routes')
+	}
+	if (
+		config.sessionCookieDomain !== undefined &&
+		(!/^(?:\.?[A-Za-z0-9-]+)(?:\.[A-Za-z0-9-]+)*$/.test(config.sessionCookieDomain) ||
+			config.sessionCookieDomain.includes('..'))
+	) {
+		throw new TypeError('sessionCookieDomain is invalid')
+	}
+	return {
+		issuer,
+		issuerInternal,
+		clientId: config.clientId,
+		clientSecret: config.clientSecret,
+		resource: validateResource(config.resource),
+		callbackPath,
+		cookiePrefix: config.cookiePrefix,
+		sessionCookieDomain: config.sessionCookieDomain,
+		providers: [...config.providers],
+		gatedPaths,
+		loginPath,
+		accessTokenMaxAge: positiveSeconds(
+			config.accessTokenMaxAge,
+			DEFAULT_ACCESS_TOKEN_MAX_AGE,
+			'accessTokenMaxAge',
+		),
+		refreshTokenMaxAge: positiveSeconds(
+			config.refreshTokenMaxAge,
+			DEFAULT_REFRESH_TOKEN_MAX_AGE,
+			'refreshTokenMaxAge',
+		),
+		transactionMaxAge: positiveSeconds(
+			config.transactionMaxAge,
+			DEFAULT_TRANSACTION_MAX_AGE,
+			'transactionMaxAge',
+		),
+		clockSkew: positiveSeconds(config.clockSkew, DEFAULT_CLOCK_SKEW, 'clockSkew'),
+	}
+}
+
+function requestFrom(input: RequestOrHonoContext): Request {
+	if (input instanceof Request) return input
+	if (input && input.req?.raw instanceof Request) return input.req.raw
+	throw new TypeError('expected a Web Request or Hono Context')
+}
+
+function cookieName(config: NormalizedWorkersAuthConfig, suffix: string): string {
+	return `${config.cookiePrefix}_${suffix}`
+}
+
+function setSecureCookie(
+	response: Response,
+	name: string,
+	value: string,
+	path: string,
+	maxAge: number,
+	domain?: string,
+): void {
+	setCookie(response, name, value, {
+		path,
+		maxAge,
+		httpOnly: true,
+		secure: true,
+		sameSite: 'lax',
+		...(domain ? { domain } : {}),
+	})
+}
+
+function setTransactionCookies(
+	config: NormalizedWorkersAuthConfig,
+	response: Response,
+	transaction: {
+		verifier: string
+		callback: string
+		expires: number
+		state: string
+		redirect: string
+		provider: string
+	},
+): void {
+	const callbackNames = ['pkce', 'callback', 'expires'] as const
+	const callbackValues = [
+		transaction.verifier,
+		transaction.callback,
+		String(transaction.expires),
+	] as const
+	for (let index = 0; index < callbackNames.length; index += 1) {
+		setSecureCookie(
+			response,
+			cookieName(config, callbackNames[index]),
+			callbackValues[index],
+			config.callbackPath,
+			config.transactionMaxAge,
+		)
+	}
+	for (const [suffix, value] of [
+		['state', transaction.state],
+		['redirect', transaction.redirect],
+		['provider', transaction.provider],
+	] as const) {
+		setSecureCookie(response, cookieName(config, suffix), value, '/', config.transactionMaxAge)
+	}
+}
+
+function clearTransactionCookies(config: NormalizedWorkersAuthConfig, response: Response): void {
+	for (const suffix of ['pkce', 'callback', 'expires']) {
+		setSecureCookie(response, cookieName(config, suffix), '', config.callbackPath, 0)
+	}
+	for (const suffix of ['state', 'redirect', 'provider']) {
+		setSecureCookie(response, cookieName(config, suffix), '', '/', 0)
+	}
+}
+
+function setSessionCookiesNormalized(
+	config: NormalizedWorkersAuthConfig,
+	response: Response,
+	tokens: Tokens,
+): Response {
+	const mutable = cloneMutableResponse(response)
+	appendSessionCookiesNormalized(config, mutable, tokens)
+	return mutable
+}
+
+function appendSessionCookiesNormalized(
+	config: NormalizedWorkersAuthConfig,
+	response: Response,
+	tokens: Tokens,
+): void {
+	setSecureCookie(
+		response,
+		cookieName(config, 'at'),
+		tokens.AccessToken,
+		'/',
+		config.accessTokenMaxAge,
+		config.sessionCookieDomain,
+	)
+	setSecureCookie(
+		response,
+		cookieName(config, 'rt'),
+		tokens.RefreshToken,
+		'/',
+		config.refreshTokenMaxAge,
+		config.sessionCookieDomain,
+	)
+}
+
+function clearSessionCookiesNormalized(
+	config: NormalizedWorkersAuthConfig,
+	response: Response,
+): Response {
+	const mutable = cloneMutableResponse(response)
+	setSecureCookie(mutable, cookieName(config, 'at'), '', '/', 0, config.sessionCookieDomain)
+	setSecureCookie(mutable, cookieName(config, 'rt'), '', '/', 0, config.sessionCookieDomain)
+	return mutable
+}
+
+function cloneMutableResponse(response: Response): Response {
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: new Headers(response.headers),
+	})
+}
+
+function clearTerminalTransaction(
+	config: NormalizedWorkersAuthConfig,
+	response: Response,
+): Response {
+	clearTransactionCookies(config, response)
+	return response
+}
+
+function serviceUnavailable(request: Request): Response {
+	const headers = {
+		'Cache-Control': 'private, no-store',
+		Pragma: 'no-cache',
+		Expires: '0',
+	}
+	const acceptsJson = request.headers
+		.get('accept')
+		?.split(',')
+		.some((part) => part.split(';', 1)[0].trim().toLowerCase() === 'application/json')
+	if (acceptsJson) {
+		return Response.json({ error: 'auth_service_unavailable' }, { status: 503, headers })
+	}
+	return new Response('Service unavailable', { status: 503, headers })
+}
+
+async function resolveSecret(
+	config: NormalizedWorkersAuthConfig,
+	request: Request,
+): Promise<string | null> {
+	const source = config.clientSecret
+	if (source === undefined) return null
+	let value: unknown
+	try {
+		if (source instanceof Uint8Array) {
+			value = source
+		} else if (typeof source === 'function') {
+			value = await source(request)
+		} else if ('resolve' in source && typeof source.resolve === 'function') {
+			value = await source.resolve(request)
+		} else if ('get' in source && typeof source.get === 'function') {
+			value = await source.get()
+		}
+	} catch {
+		throw new WorkersAuthServiceUnavailableError()
+	}
+	let secret: string
+	try {
+		secret =
+			value instanceof Uint8Array
+				? new TextDecoder('utf-8', { fatal: true }).decode(value)
+				: typeof value === 'string'
+					? value
+					: ''
+	} catch {
+		throw new WorkersAuthServiceUnavailableError()
+	}
+	if (secret.trim() === '') throw new WorkersAuthServiceUnavailableError()
+	return secret
+}
+
+function principalFromClaims(claims: VerifiedClaims): Principal | null {
+	try {
+		const userId = claims.userId ?? extractIdentityId(claims.sub)
+		return {
+			Subject: claims.sub,
+			UserID: userId,
+			Email: claims.email,
+			Name: claims.name ?? '',
+			Image: claims.image ?? '',
+			Roles: [...(claims.roles ?? [])],
+			Audiences: [...(claims.audiences ?? [])],
+		}
+	} catch {
+		return null
+	}
+}
+
+async function verifyToken(
+	config: NormalizedWorkersAuthConfig,
+	token: string,
+): Promise<Principal | null> {
+	const claims = await verifyAccessToken(config.issuer, token, {
+		audience: config.resource,
+		algorithms: ['ES256'],
+		jwksIssuer: resolveInternalIssuer(config),
+		requireUserToken: true,
+		clockSkew: config.clockSkew,
+	})
+	return claims ? principalFromClaims(claims) : null
+}
+
+async function requestTokens(
+	config: NormalizedWorkersAuthConfig,
+	request: Request,
+	form: URLSearchParams,
+): Promise<{ tokens: Tokens; principal: Principal } | null> {
+	const secret = await resolveSecret(config, request)
+	const headers = new Headers({ 'Content-Type': 'application/x-www-form-urlencoded' })
+	if (secret !== null) {
+		headers.set('Authorization', createClientSecretBasicAuthHeader(config.clientId, secret))
+	}
+	let response: Response
+	try {
+		response = await fetch(`${config.issuerInternal}/token`, {
+			method: 'POST',
+			headers,
+			body: form.toString(),
+		})
+	} catch {
+		return null
+	}
+	if (!response.ok) return null
+	let data: unknown
+	try {
+		data = await response.json()
+	} catch {
+		return null
+	}
+	if (
+		typeof data !== 'object' ||
+		data === null ||
+		typeof (data as { access_token?: unknown }).access_token !== 'string' ||
+		typeof (data as { refresh_token?: unknown }).refresh_token !== 'string'
+	) {
+		return null
+	}
+	const tokens: Tokens = {
+		AccessToken: (data as { access_token: string }).access_token,
+		RefreshToken: (data as { refresh_token: string }).refresh_token,
+	}
+	const principal = await verifyToken(config, tokens.AccessToken)
+	return principal ? { tokens, principal } : null
+}
+
+export async function Authorize(
+	config: WorkersAuthConfig,
+	requestOrContext: RequestOrHonoContext,
+	provider: string,
+	redirectPath: string,
+): Promise<Response> {
+	const normalized = normalizeConfig(config)
+	if (!normalized.providers.includes(provider)) throw new TypeError('provider is not configured')
+	const request = requestFrom(requestOrContext)
+	const requestUrl = new URL(request.url)
+	const callback = `${requestUrl.origin}${normalized.callbackPath}`
+	const { verifier, challenge } = await generatePKCE()
+	const state = generateState()
+	const redirect = safeRedirect(redirectPath)
+	const expires = Math.floor(Date.now() / 1000) + normalized.transactionMaxAge
+	const authorizationUrl = new URL(`${normalized.issuer}/authorize`)
+	for (const [key, value] of [
+		['response_type', 'code'],
+		['client_id', normalized.clientId],
+		['redirect_uri', callback],
+		['scope', 'openid email profile'],
+		['state', state],
+		['code_challenge', challenge],
+		['code_challenge_method', 'S256'],
+		['provider', provider === 'email-code' ? 'code' : provider],
+		['resource', normalized.resource],
+	] as const) {
+		authorizationUrl.searchParams.set(key, value)
+	}
+	const response = new Response(null, {
+		status: 302,
+		headers: { Location: authorizationUrl.toString() },
+	})
+	setTransactionCookies(normalized, response, {
+		verifier,
+		callback,
+		expires,
+		state,
+		redirect,
+		provider,
+	})
+	return response
+}
+
+export async function Callback(
+	config: WorkersAuthConfig,
+	requestOrContext: RequestOrHonoContext,
+): Promise<Response> {
+	const normalized = normalizeConfig(config)
+	const request = requestFrom(requestOrContext)
+	const url = new URL(request.url)
+	const state = url.searchParams.get('state') ?? ''
+	const storedState = getCookie(request, cookieName(normalized, 'state')) ?? ''
+	const callback = getCookie(request, cookieName(normalized, 'callback'))
+	const expectedCallback = `${url.origin}${normalized.callbackPath}`
+	const storedExpires = getCookie(request, cookieName(normalized, 'expires')) ?? ''
+	const expires = /^(?:0|[1-9]\d*)$/.test(storedExpires) ? Number(storedExpires) : Number.NaN
+	if (url.pathname !== normalized.callbackPath || !verifyState(state, storedState)) {
+		return new Response('Invalid state parameter', { status: 403 })
+	}
+	if (
+		callback !== expectedCallback ||
+		!Number.isSafeInteger(expires) ||
+		Math.floor(Date.now() / 1000) >= expires
+	) {
+		return clearTerminalTransaction(
+			normalized,
+			new Response('Invalid state parameter', { status: 403 }),
+		)
+	}
+	const verifier = getCookie(request, cookieName(normalized, 'pkce'))
+	if (!verifier) {
+		return clearTerminalTransaction(
+			normalized,
+			new Response('Missing PKCE verifier', { status: 400 }),
+		)
+	}
+	const code = url.searchParams.get('code')
+	if (url.searchParams.has('error') || !code) {
+		return clearTerminalTransaction(
+			normalized,
+			new Response(null, {
+				status: 302,
+				headers: { Location: `${normalized.loginPath}?error=auth_failed` },
+			}),
+		)
+	}
+	const form = new URLSearchParams()
+	form.set('grant_type', 'authorization_code')
+	form.set('code', code)
+	form.set('code_verifier', verifier)
+	form.set('redirect_uri', callback)
+	form.set('client_id', normalized.clientId)
+	form.set('resource', normalized.resource)
+	let result: Awaited<ReturnType<typeof requestTokens>>
+	try {
+		result = await requestTokens(normalized, request, form)
+	} catch (error) {
+		if (error instanceof WorkersAuthServiceUnavailableError) {
+			return clearTerminalTransaction(normalized, serviceUnavailable(request))
+		}
+		throw error
+	}
+	if (!result) {
+		return clearTerminalTransaction(
+			normalized,
+			new Response(null, {
+				status: 302,
+				headers: { Location: `${normalized.loginPath}?error=auth_failed` },
+			}),
+		)
+	}
+	let response = new Response(null, {
+		status: 302,
+		headers: { Location: safeRedirect(getCookie(request, cookieName(normalized, 'redirect'))) },
+	})
+	response = setSessionCookiesNormalized(normalized, response, result.tokens)
+	clearTransactionCookies(normalized, response)
+	return response
+}
+
+async function getSessionNormalized(
+	config: NormalizedWorkersAuthConfig,
+	request: Request,
+): Promise<Session> {
+	const accessToken = getCookie(request, cookieName(config, 'at')) ?? ''
+	const refreshToken = getCookie(request, cookieName(config, 'rt')) ?? ''
+	if (accessToken) {
+		const principal = await verifyToken(config, accessToken)
+		if (principal) {
+			return {
+				Principal: principal,
+				Tokens: { AccessToken: accessToken, RefreshToken: refreshToken },
+				Refreshed: false,
+			}
+		}
+	}
+	if (refreshToken) {
+		const form = new URLSearchParams()
+		form.set('grant_type', 'refresh_token')
+		form.set('refresh_token', refreshToken)
+		form.set('client_id', config.clientId)
+		form.set('resource', config.resource)
+		const result = await requestTokens(config, request, form)
+		if (result) {
+			return { Principal: result.principal, Tokens: result.tokens, Refreshed: true }
+		}
+	}
+	return { Principal: null, Tokens: null, Refreshed: false }
+}
+
+export async function getSession(
+	config: WorkersAuthConfig,
+	requestOrContext: RequestOrHonoContext,
+): Promise<Session> {
+	return getSessionNormalized(normalizeConfig(config), requestFrom(requestOrContext))
+}
+
+export function setSessionCookies(
+	config: WorkersAuthConfig,
+	response: Response,
+	tokens: Tokens,
+): Response {
+	return setSessionCookiesNormalized(normalizeConfig(config), response, tokens)
+}
+
+export function clearSessionCookies(config: WorkersAuthConfig, response: Response): Response {
+	return clearSessionCookiesNormalized(normalizeConfig(config), response)
+}
+
+export function Principal(source: PrincipalSource): Principal | null {
+	if ('Principal' in source) return source.Principal
+	return source.get('principal') ?? null
+}
+
+function isGated(config: NormalizedWorkersAuthConfig, path: string): boolean {
+	return config.gatedPaths.some((pattern) =>
+		pattern.endsWith('/*') ? path.startsWith(pattern.slice(0, -1)) : path === pattern,
+	)
+}
+
+export function Middleware(config: WorkersAuthConfig): WorkersAuthMiddleware {
+	const normalized = normalizeConfig(config)
+	return async (context, next) => {
+		const request = context.req.raw
+		let session: Session
+		try {
+			session = await getSessionNormalized(normalized, request)
+		} catch (error) {
+			if (error instanceof WorkersAuthServiceUnavailableError) return serviceUnavailable(request)
+			throw error
+		}
+		context.set('session', session)
+		context.set('principal', session.Principal)
+		if (!session.Principal && isGated(normalized, new URL(request.url).pathname)) {
+			const login = new URL(normalized.loginPath, request.url)
+			login.searchParams.set('redirect', new URL(request.url).pathname)
+			return context.redirect(login.toString(), 302)
+		}
+		await next()
+		if (session.Refreshed && session.Tokens) {
+			context.res = cloneMutableResponse(context.res)
+			appendSessionCookiesNormalized(normalized, context.res, session.Tokens)
+		}
+	}
+}
+
+export function New(config: WorkersAuthConfig): WorkersAuthClient {
+	const normalized = normalizeConfig(config)
+	const stableConfig: WorkersAuthConfig = normalized
+	return {
+		Authorize: (requestOrContext, provider, redirectPath) =>
+			Authorize(stableConfig, requestOrContext, provider, redirectPath),
+		Callback: (requestOrContext) => Callback(stableConfig, requestOrContext),
+		Middleware: () => Middleware(stableConfig),
+		Principal,
+		getSession: (requestOrContext) => getSession(stableConfig, requestOrContext),
+		setSessionCookies: (response, tokens) => setSessionCookies(stableConfig, response, tokens),
+		clearSessionCookies: (response) => clearSessionCookies(stableConfig, response),
+	}
+}
+
+export const createWorkersAuth = New