@growth-labs/auth 0.9.1 → 0.10.2

package/README.md

@@ -16,7 +16,7 @@ auth({
   issuerInternal: 'https://auth-internal.example.com', // Optional back-channel issuer URL
   clientId: 'fedweek-prod',                      // Optional; defaults to request hostname
   clientSecret: 'AUTH_CLIENT_SECRET',            // Worker secret or Secrets Store binding name, resolved at request time
-  resource: 'https://fedweek.com',               // RFC 8707 resource/audience URI
+  resource: 'https://fedweek.com',               // Required RFC 8707 resource/JWT audience URI
   cookiePrefix: 'fedweek',                       // → fedweek_at, fedweek_rt, fedweek_provider cookies
   sessionCookieDomain: '.fedweek.com',           // Cross-subdomain sharing (optional)
   gatedPaths: ['/premium/*', '/account/*'],      // Glob patterns for protected routes
@@ -48,9 +48,10 @@ auth({
 **Middleware** (runs on every request):
 1. Reads `{cookiePrefix}_at` and `{cookiePrefix}_rt` cookies
 2. Verifies access token JWT against the internal issuer's JWKS (`{issuerInternal ?? issuer}/.well-known/jwks.json`, cached in Worker memory)
-3. If expired but refresh token valid → silent refresh, set new cookies
-4. Populates `context.locals.user` as `User | null`
-5. If path matches `gatedPaths` and `user` is null → redirect to `loginPath`
+3. Requires the access token `aud` to match `resource`; wrong or missing audiences remain unauthenticated
+4. If expired but refresh token valid → silent refresh, verify the new access token audience, then set new cookies
+5. Populates `context.locals.user` as `User | null`
+6. If path matches `gatedPaths` and `user` is null → redirect to `loginPath`
 
 **Routes:**
 - `GET /login` — provider-selection page; `?provider=google|password|email-code` starts auth locally and redirects into the issuer's generic `/authorize` endpoint
@@ -104,15 +105,20 @@ await client.password.reset.confirm({ token, newPassword })
 
 `authClient(context)` reads the resolved integration config and Worker
 bindings, posts to `{issuerInternal ?? issuer}/api/v1/auth/*`, resolves
-`clientSecret` Worker secret or Secrets Store binding names at request time,
-sends `client_secret_basic`
-for confidential clients, and includes `client_id`, `redirect_uri`, PKCE
+`clientSecret` Worker secret or Secrets Store binding names at request time
+using module-private request-lifetime cache storage keyed by `(Request,
+binding name)`, sends `client_secret_basic` for confidential clients, and
+includes `client_id`, `redirect_uri`, PKCE
 `code_challenge`, `state`, and `resource` for authorization-code issuing
 calls. Password reset request calls also include `reset_url_base` from the
 current consumer origin so the issuer can send reset links back to the same
 registered host. The package-owned POST routes use this SDK directly;
 consumers can also use it from custom server routes.
 
+If the configured confidential-client binding is missing, empty,
+malformed, or rejected, every SDK method returns exactly
+`{ error: 'auth_service_unavailable' }` and performs no issuer request.
+
 ## Analytics Events
 
 When `@growth-labs/analytics@0.4.0` or newer is installed, successful
@@ -182,6 +188,13 @@ JWKS cached in Worker memory. If issuer unreachable on cold start:
 - **Non-gated paths:** fail open — `user = null`, page serves normally
 - **Gated paths:** fail closed — redirect to loginPath
 
+This ordinary issuer-unreachable behavior does not apply to a configured
+client-secret resolution failure. If a refresh token is present, the
+middleware resolves the secret before access-token verification and returns
+a fixed 503 without a JWKS or issuer fetch. Browser requests receive plain
+text; `Accept: application/json` requests receive
+`{"error":"auth_service_unavailable"}`. Logout still clears local cookies.
+
 There is no public runtime/admin API for evicting the JWKS cache. Cache
 state follows the Worker isolate lifecycle; `_resetJwksCache()` is an
 internal package-test helper and is not exported from
@@ -234,7 +247,7 @@ analytics peer is installed.
 - Cookie names: `{cookiePrefix}_at`, `{cookiePrefix}_rt`, `{cookiePrefix}_pkce`, `{cookiePrefix}_state`, `{cookiePrefix}_redirect`, `{cookiePrefix}_provider`, `gl_id`
 - PKCE flow with `code_verifier` / `code_challenge` (S256); `{cookiePrefix}_pkce` is scoped to `callbackPath` for issuer redirect flows and set at both `/` and `callbackPath` for consumer-hosted password/code flows that can either post JSON in-place or hand off to callback
 - `issuer` is browser-facing; optional `issuerInternal` is used for token exchange, silent refresh, JWT verification/JWKS lookup, and revocation. If omitted, `issuerInternal` falls back to `issuer`.
-- Confidential OAuth clients use `client_secret_basic` on token exchange and refresh when `clientSecret` is configured. Prefer a Worker secret or Cloudflare Secrets Store binding name such as `AUTH_CLIENT_SECRET`; runtime code resolves that binding before calling the issuer and treats binding read failures as auth failures.
+- Confidential OAuth clients use `client_secret_basic` on token exchange and refresh when `clientSecret` is configured. Prefer a Worker secret or Cloudflare Secrets Store binding name such as `AUTH_CLIENT_SECRET`; runtime code resolves that binding once per `(Request, binding name)` in a module-private request-lifetime cache before issuer/JWKS I/O and returns a fixed fail-closed 503 or SDK error result on failure. No cache Symbol, Promise, result, or secret bytes are attached to the consumer-visible `Request`.
 - RFC 8707 `resource` is sent on authorize, token exchange, and refresh when configured
 - `email-code` is a client-side alias for the issuer's OpenAuth `code` provider
 - CSRF state parameter verified on callback
@@ -243,5 +256,5 @@ analytics peer is installed.
 - Package-owned auth POST routes require a same-origin `Origin` header; missing
   or cross-site form submissions return `403`
 - Branded auth screens use `renderers`, not consumer-local shadow routes
-- No `aud` claim validation in this package — single client per issuer assumed
+- Access-token `aud` must match the configured RFC 8707 `resource` exactly
 - `.astro` component files ship as source, not compiled

package/dist/config-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAKvD,wBAAgB,UAAU,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAE5D;AAED,wBAAgB,SAAS,IAAI,mBAAmB,CAa/C"}
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAMvD,wBAAgB,UAAU,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAE5D;AAED,wBAAgB,SAAS,IAAI,mBAAmB,CAa/C"}

package/dist/config-store.js

@@ -1,3 +1,4 @@
+import { rehydrateClientSecretLiteral } from './utils/client-secret-literal.js';
 import { isEnvMarker, resolveEnvMarker } from './utils/env-marker.js';
 let _config = null;
 export function _setConfig(config) {
@@ -5,12 +6,22 @@ export function _setConfig(config) {
 }
 export function getConfig() {
     const runtimeConfig = globalThis.__GL_AUTH_CONFIG__;
-    const base = runtimeConfig ?? _config;
+    const base = runtimeConfig ? rehydrateRuntimeConfig(runtimeConfig) : _config;
     if (!base) {
         throw new Error('@growth-labs/auth: integration not configured. Add auth() to your astro.config.mjs integrations array.');
     }
     return resolveEnvMarkers(base);
 }
+function rehydrateRuntimeConfig(base) {
+    // The Vite global is emitted only after authOptionsSchema accepts a
+    // WeakSet-issued literal at build time. Treat the structural wire shape as
+    // transport encoding here, then re-issue the runtime object; the resolver
+    // itself never trusts the structural marker.
+    const clientSecret = rehydrateClientSecretLiteral(base.clientSecret);
+    return clientSecret === base.clientSecret
+        ? base
+        : { ...base, clientSecret };
+}
 /**
  * Resolves any `"env:VAR_NAME"` markers on auth-tuple fields against the
  * runtime env stashed by `src/runtime-bridge.ts`. The bridge is loaded
@@ -34,12 +45,16 @@ function resolveEnvMarkers(base) {
     if (typeof issuer !== 'string') {
         throw new Error('@growth-labs/auth: issuer must resolve to a string');
     }
+    const resource = resolveEnvMarker(base.resource, env);
+    if (typeof resource !== 'string') {
+        throw new Error('@growth-labs/auth: resource must resolve to a string');
+    }
     return {
         ...base,
         issuer,
         issuerInternal: resolveEnvMarker(base.issuerInternal, env),
         clientId: resolveEnvMarker(base.clientId, env),
-        resource: resolveEnvMarker(base.resource, env),
+        resource,
     };
 }
 function anyMarkerPresent(base) {

package/dist/config-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAErE,IAAI,OAAO,GAA+B,IAAI,CAAA;AAE9C,MAAM,UAAU,UAAU,CAAC,MAA2B;IACrD,OAAO,GAAG,MAAM,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,SAAS;IACxB,MAAM,aAAa,GAClB,UAGA,CAAC,kBAAkB,CAAA;IACpB,MAAM,IAAI,GAAG,aAAa,IAAI,OAAO,CAAA;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACd,wGAAwG,CACxG,CAAA;IACF,CAAC;IACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,IAAyB;IACnD,MAAM,GAAG,GACR,UAGA,CAAC,uBAAuB,CAAA;IACzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACd,qLAAqL,CACrL,CAAA;QACF,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACtE,CAAC;IACD,OAAO;QACN,GAAG,IAAI;QACP,MAAM;QACN,cAAc,EAAE,gBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC;QAC1D,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;QAC9C,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;KAC9C,CAAA;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAyB;IAClD,OAAO,CACN,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;QACxB,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1B,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC1B,CAAA;AACF,CAAC"}
+{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAErE,IAAI,OAAO,GAA+B,IAAI,CAAA;AAE9C,MAAM,UAAU,UAAU,CAAC,MAA2B;IACrD,OAAO,GAAG,MAAM,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,SAAS;IACxB,MAAM,aAAa,GAClB,UAGA,CAAC,kBAAkB,CAAA;IACpB,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACd,wGAAwG,CACxG,CAAA;IACF,CAAC;IACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAyB;IACxD,oEAAoE;IACpE,2EAA2E;IAC3E,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,YAAY,GAAG,4BAA4B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACpE,OAAO,YAAY,KAAK,IAAI,CAAC,YAAY;QACxC,CAAC,CAAC,IAAI;QACN,CAAC,CAAE,EAAE,GAAG,IAAI,EAAE,YAAY,EAA0B,CAAA;AACtD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,IAAyB;IACnD,MAAM,GAAG,GACR,UAGA,CAAC,uBAAuB,CAAA;IACzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACd,qLAAqL,CACrL,CAAA;QACF,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACrD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACxE,CAAC;IACD,OAAO;QACN,GAAG,IAAI;QACP,MAAM;QACN,cAAc,EAAE,gBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC;QAC1D,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;QAC9C,QAAQ;KACR,CAAA;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAyB;IAClD,OAAO,CACN,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;QACxB,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1B,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC1B,CAAA;AACF,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,UAAU,gBAAgB;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE;QACN,oBAAoB,EAAE,CAAC,MAAM,EAAE;YAC9B,aAAa,EAAE,CAAC,IAAI,EAAE;gBAAE,UAAU,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAA;aAAE,KAAK,IAAI,CAAA;YAC5E,WAAW,EAAE,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,UAAU,EAAE,MAAM,CAAC;gBAAC,SAAS,CAAC,EAAE,OAAO,CAAA;aAAE,KAAK,IAAI,CAAA;YACzF,YAAY,EAAE,CAAC,MAAM,EAAE;gBACtB,IAAI,CAAC,EAAE;oBAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAA;iBAAE,CAAA;aAC/D,KAAK,IAAI,CAAA;SACV,KAAK,IAAI,CAAA;KACV,CAAA;CACD;AAYD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,aAAa,GAAG,OAAO,CAuBjE;AAWD,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,gBAAgB,CAyGvE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAM/C,UAAU,gBAAgB;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE;QACN,oBAAoB,EAAE,CAAC,MAAM,EAAE;YAC9B,aAAa,EAAE,CAAC,IAAI,EAAE;gBAAE,UAAU,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAA;aAAE,KAAK,IAAI,CAAA;YAC5E,WAAW,EAAE,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,UAAU,EAAE,MAAM,CAAC;gBAAC,SAAS,CAAC,EAAE,OAAO,CAAA;aAAE,KAAK,IAAI,CAAA;YACzF,YAAY,EAAE,CAAC,MAAM,EAAE;gBACtB,IAAI,CAAC,EAAE;oBAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAA;iBAAE,CAAA;aAC/D,KAAK,IAAI,CAAA;SACV,KAAK,IAAI,CAAA;KACV,CAAA;CACD;AAYD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,aAAa,GAAG,OAAO,CAuBjE;AAWD,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,gBAAgB,CA+GvE"}

package/dist/index.js

@@ -1,5 +1,6 @@
 import { _setConfig } from './config-store.js';
 import { authOptionsSchema } from './options.js';
+import { isClientSecretLiteral, serializeClientSecretLiteral, } from './utils/client-secret-literal.js';
 function isSourceEntrypoint() {
     return typeof import.meta.url === 'string' && import.meta.url.endsWith('.ts');
 }
@@ -49,7 +50,13 @@ function isValidRendererSpec(value) {
 export default function auth(userOptions) {
     const options = authOptionsSchema.parse(userOptions);
     _setConfig(options);
-    const serializableOptions = { ...options, renderers: {} };
+    const serializableOptions = {
+        ...options,
+        clientSecret: isClientSecretLiteral(options.clientSecret)
+            ? serializeClientSecretLiteral(options.clientSecret)
+            : options.clientSecret,
+        renderers: {},
+    };
     return {
         name: '@growth-labs/auth',
         hooks: {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAgBhD,SAAS,kBAAkB;IAC1B,OAAO,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,oBAAoB,GAAG,kBAAkB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;AAEjE,SAAS,iBAAiB,CAAC,IAAY;IACtC,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,oBAAoB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;AAC/F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,SAAwB;IACvD,OAAO;QACN,IAAI,EAAE,6BAA6B;QACnC,SAAS,CAAC,EAAU;YACnB,IAAI,EAAE,KAAK,oCAAoC;gBAAE,OAAO,sCAAsC,CAAA;QAC/F,CAAC;QACD,IAAI,CAAC,EAAU;YACd,IAAI,EAAE,KAAK,sCAAsC;gBAAE,OAAM;YAEzD,MAAM,WAAW,GAAa,EAAE,CAAA;YAChC,MAAM,UAAU,GAAa,EAAE,CAAA;YAC/B,IAAI,CAAC,GAAG,CAAC,CAAA;YACT,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBACxC,MAAM,KAAK,GAAG,sBAAsB,CAAC,EAAE,EAAE,CAAA;gBACzC,WAAW,CAAC,IAAI,CACf,YAAY,IAAI,CAAC,MAAM,OAAO,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAC5E,CAAA;gBACD,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,CAAA;YAC3D,CAAC;YACD,OAAO,CAAC,GAAG,WAAW,EAAE,4BAA4B,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1F,CAAC;KACD,CAAA;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;QAC1D,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ,CAC1D,CAAA;AACF,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,WAAwB;IACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACpD,UAAU,CAAC,OAAO,CAAC,CAAA;IACnB,MAAM,mBAAmB,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IAEzD,OAAO;QACN,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE;YACN,oBAAoB,EAAE,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE;gBACtE,YAAY,CAAC;oBACZ,IAAI,EAAE;wBACL,MAAM,EAAE;4BACP,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;yBACpE;wBACD,OAAO,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;qBAC7C;iBACD,CAAC,CAAA;gBAEF,aAAa,CAAC;oBACb,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;oBAClD,KAAK,EAAE,KAAK;iBACZ,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,OAAO,CAAC,SAAS;oBAC1B,UAAU,EAAE,iBAAiB,CAAC,gBAAgB,CAAC;oBAC/C,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,SAAS;oBAClB,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;oBAChD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,OAAO,CAAC,YAAY;oBAC7B,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;oBAClD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5C,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,kBAAkB;wBACnC,UAAU,EAAE,iBAAiB,CAAC,0BAA0B,CAAC;wBACzD,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,iBAAiB;wBAClC,UAAU,EAAE,iBAAiB,CAAC,yBAAyB,CAAC;wBACxD,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,kBAAkB;wBACnC,UAAU,EAAE,iBAAiB,CAAC,8BAA8B,CAAC;wBAC7D,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,wBAAwB;wBACzC,UAAU,EAAE,iBAAiB,CAAC,qCAAqC,CAAC;wBACpE,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,wBAAwB;wBACzC,UAAU,EAAE,iBAAiB,CAAC,qCAAqC,CAAC;wBACpE,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;wBAChC,WAAW,CAAC;4BACX,OAAO,EAAE,OAAO,CAAC,YAAY;4BAC7B,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;4BAClD,SAAS,EAAE,KAAK;yBAChB,CAAC,CAAA;oBACH,CAAC;gBACF,CAAC;gBAED,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC9C,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,eAAe;wBAChC,UAAU,EAAE,iBAAiB,CAAC,2BAA2B,CAAC;wBAC1D,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,cAAc;wBAC/B,UAAU,EAAE,iBAAiB,CAAC,0BAA0B,CAAC;wBACzD,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,IAAI,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;wBAClC,WAAW,CAAC;4BACX,OAAO,EAAE,OAAO,CAAC,cAAc;4BAC/B,UAAU,EAAE,iBAAiB,CAAC,sBAAsB,CAAC;4BACrD,SAAS,EAAE,KAAK;yBAChB,CAAC,CAAA;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;SACD;KACD,CAAA;AACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD,OAAO,EACN,qBAAqB,EACrB,4BAA4B,GAC5B,MAAM,kCAAkC,CAAA;AAezC,SAAS,kBAAkB;IAC1B,OAAO,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,oBAAoB,GAAG,kBAAkB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;AAEjE,SAAS,iBAAiB,CAAC,IAAY;IACtC,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,oBAAoB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;AAC/F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,SAAwB;IACvD,OAAO;QACN,IAAI,EAAE,6BAA6B;QACnC,SAAS,CAAC,EAAU;YACnB,IAAI,EAAE,KAAK,oCAAoC;gBAAE,OAAO,sCAAsC,CAAA;QAC/F,CAAC;QACD,IAAI,CAAC,EAAU;YACd,IAAI,EAAE,KAAK,sCAAsC;gBAAE,OAAM;YAEzD,MAAM,WAAW,GAAa,EAAE,CAAA;YAChC,MAAM,UAAU,GAAa,EAAE,CAAA;YAC/B,IAAI,CAAC,GAAG,CAAC,CAAA;YACT,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBACxC,MAAM,KAAK,GAAG,sBAAsB,CAAC,EAAE,EAAE,CAAA;gBACzC,WAAW,CAAC,IAAI,CACf,YAAY,IAAI,CAAC,MAAM,OAAO,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAC5E,CAAA;gBACD,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,CAAA;YAC3D,CAAC;YACD,OAAO,CAAC,GAAG,WAAW,EAAE,4BAA4B,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1F,CAAC;KACD,CAAA;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;QAC1D,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ,CAC1D,CAAA;AACF,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,WAAwB;IACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACpD,UAAU,CAAC,OAAO,CAAC,CAAA;IACnB,MAAM,mBAAmB,GAAG;QAC3B,GAAG,OAAO;QACV,YAAY,EAAE,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC;YACxD,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC,YAAY,CAAC;YACpD,CAAC,CAAC,OAAO,CAAC,YAAY;QACvB,SAAS,EAAE,EAAE;KACb,CAAA;IAED,OAAO;QACN,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE;YACN,oBAAoB,EAAE,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE;gBACtE,YAAY,CAAC;oBACZ,IAAI,EAAE;wBACL,MAAM,EAAE;4BACP,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;yBACpE;wBACD,OAAO,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;qBAC7C;iBACD,CAAC,CAAA;gBAEF,aAAa,CAAC;oBACb,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;oBAClD,KAAK,EAAE,KAAK;iBACZ,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,OAAO,CAAC,SAAS;oBAC1B,UAAU,EAAE,iBAAiB,CAAC,gBAAgB,CAAC;oBAC/C,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,SAAS;oBAClB,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;oBAChD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,OAAO,CAAC,YAAY;oBAC7B,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;oBAClD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5C,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,kBAAkB;wBACnC,UAAU,EAAE,iBAAiB,CAAC,0BAA0B,CAAC;wBACzD,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,iBAAiB;wBAClC,UAAU,EAAE,iBAAiB,CAAC,yBAAyB,CAAC;wBACxD,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,kBAAkB;wBACnC,UAAU,EAAE,iBAAiB,CAAC,8BAA8B,CAAC;wBAC7D,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,wBAAwB;wBACzC,UAAU,EAAE,iBAAiB,CAAC,qCAAqC,CAAC;wBACpE,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,wBAAwB;wBACzC,UAAU,EAAE,iBAAiB,CAAC,qCAAqC,CAAC;wBACpE,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;wBAChC,WAAW,CAAC;4BACX,OAAO,EAAE,OAAO,CAAC,YAAY;4BAC7B,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;4BAClD,SAAS,EAAE,KAAK;yBAChB,CAAC,CAAA;oBACH,CAAC;gBACF,CAAC;gBAED,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC9C,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,eAAe;wBAChC,UAAU,EAAE,iBAAiB,CAAC,2BAA2B,CAAC;wBAC1D,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,cAAc;wBAC/B,UAAU,EAAE,iBAAiB,CAAC,0BAA0B,CAAC;wBACzD,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,IAAI,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;wBAClC,WAAW,CAAC;4BACX,OAAO,EAAE,OAAO,CAAC,cAAc;4BAC/B,UAAU,EAAE,iBAAiB,CAAC,sBAAsB,CAAC;4BACrD,SAAS,EAAE,KAAK;yBAChB,CAAC,CAAA;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;SACD;KACD,CAAA;AACF,CAAC"}

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,sBAAsB,CAAA;AAO7B,wBAAsB,SAAS,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACxE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAC3B,OAAO,CAAC,QAAQ,CAAC,CA0EnB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,sBAAsB,CAAA;AAQ7B,wBAAsB,SAAS,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACxE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAoGnB"}

package/dist/middleware/auth.js

@@ -2,6 +2,7 @@ import { getConfig } from '../config-store.js';
 import '../runtime-bridge.js';
 import { resolveClientSecret } from '../utils/client-secret.js';
 import { getCookie, setTokenCookies } from '../utils/cookies.js';
+import { secretResolutionFailureResponse } from '../utils/fail-closed.js';
 import { resolveInternalIssuer } from '../utils/issuer.js';
 import { refreshTokens, verifyAccessToken } from '../utils/tokens.js';
 export async function onRequest(context, next) {
@@ -14,8 +15,28 @@ export async function onRequest(context, next) {
     // 2. Attempt to authenticate
     let user = null;
     let refreshed = null;
+    let resolvedClientSecret;
+    // A request carrying a refresh token can enter the confidential-client
+    // refresh path if access-token verification fails. Resolve that request's
+    // configured secret before verification so a cold JWKS lookup can never
+    // precede discovery of a broken binding. The module-private Request-keyed
+    // resolver cache makes this the single read, and the exact bytes are reused
+    // below. A refresh token explicitly opts the request into this fail-closed
+    // confidential-session invariant even when its access token would verify;
+    // an access-token-only request never needs or reads the client secret.
+    if (refreshToken && options.clientSecret !== undefined) {
+        const secretResult = await resolveClientSecret(options.clientSecret, request);
+        if (!secretResult.ok) {
+            context.locals.user = null;
+            return secretResolutionFailureResponse(request, {
+                surface: 'middleware_refresh',
+                code: secretResult.code,
+            });
+        }
+        resolvedClientSecret = secretResult.secret ?? undefined;
+    }
     if (accessToken) {
-        const verified = await verifyAccessToken(issuer, accessToken);
+        const verified = await verifyAccessToken(issuer, accessToken, { audience: options.resource });
         if (verified) {
             user = {
                 id: verified.sub,
@@ -30,8 +51,7 @@ export async function onRequest(context, next) {
     }
     if (!user && refreshToken) {
         const clientId = options.clientId || context.url.hostname;
-        const clientSecret = await resolveClientSecret(options.clientSecret);
-        refreshed = await refreshTokens(issuer, refreshToken, clientId, clientSecret, options.resource);
+        refreshed = await refreshTokens(issuer, refreshToken, clientId, resolvedClientSecret, options.resource);
         if (refreshed) {
             user = {
                 id: refreshed.claims.sub,
@@ -50,7 +70,7 @@ export async function onRequest(context, next) {
     }
     // 5. Continue to the page
     const response = await next();
-    // 6. If tokens were refreshed or response must be modified, clone and apply changes
+    // 6. If tokens were refreshed or the response must carry no-store, clone and apply.
     if (refreshed || context.locals.synthetic === true) {
         const modifiedResponse = new Response(response.body, {
             status: response.status,

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,sBAAsB,CAAA;AAE7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAErE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAgB,IAAI,CAAA;IAC5B,IAAI,SAAS,GAA8C,IAAI,CAAA;IAE/D,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAC7D,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;gBAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;aACjC,CAAA;YACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBACtE,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAA;YAChC,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QACpE,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC/F,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBACxB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;gBACnC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI;aACzC,CAAA;QACF,CAAC;IACF,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAE1B,0BAA0B;IAC1B,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAC3E,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,oFAAoF;IACpF,IAAI,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,IAAI,SAAS,EAAE,CAAC;YACf,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QAC1F,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACvC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;QAC1D,CAAC;QACD,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,sBAAsB,CAAA;AAE7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAErE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAgB,IAAI,CAAA;IAC5B,IAAI,SAAS,GAA8C,IAAI,CAAA;IAC/D,IAAI,oBAAwC,CAAA;IAE5C,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,YAAY,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QAC7E,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;YAC1B,OAAO,+BAA+B,CAAC,OAAO,EAAE;gBAC/C,OAAO,EAAE,oBAAoB;gBAC7B,IAAI,EAAE,YAAY,CAAC,IAAI;aACvB,CAAC,CAAA;QACH,CAAC;QACD,oBAAoB,GAAG,YAAY,CAAC,MAAM,IAAI,SAAS,CAAA;IACxD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC7F,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;gBAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;aACjC,CAAA;YACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBACtE,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAA;YAChC,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,SAAS,GAAG,MAAM,aAAa,CAC9B,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,oBAAoB,EACpB,OAAO,CAAC,QAAQ,CAChB,CAAA;QACD,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBACxB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;gBACnC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI;aACzC,CAAA;QACF,CAAC;IACF,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAE1B,0BAA0B;IAC1B,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAC3E,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,oFAAoF;IACpF,IAAI,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,IAAI,SAAS,EAAE,CAAC;YACf,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QAC1F,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACvC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;QAC1D,CAAC;QACD,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}

package/dist/options.d.ts

@@ -1,11 +1,12 @@
 import { z } from 'zod';
 import type { AuthRenderers } from './types.js';
+import type { ClientSecretLiteral } from './utils/client-secret-literal.js';
 export declare const authOptionsSchema: z.ZodObject<{
     issuer: z.ZodEffects<z.ZodString, string, string>;
     issuerInternal: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     clientId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    clientSecret: z.ZodOptional<z.ZodString>;
-    resource: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    clientSecret: z.ZodOptional<z.ZodUnion<[z.ZodEffects<z.ZodString, string, string>, z.ZodType<ClientSecretLiteral, z.ZodTypeDef, ClientSecretLiteral>]>>;
+    resource: z.ZodEffects<z.ZodString, string, string>;
     cookiePrefix: z.ZodString;
     sessionCookieDomain: z.ZodOptional<z.ZodString>;
     accessTokenMaxAge: z.ZodDefault<z.ZodNumber>;
@@ -40,6 +41,7 @@ export declare const authOptionsSchema: z.ZodObject<{
     renderers: z.ZodDefault<z.ZodType<AuthRenderers, z.ZodTypeDef, AuthRenderers>>;
 }, "strip", z.ZodTypeAny, {
     issuer: string;
+    resource: string;
     cookiePrefix: string;
     accessTokenMaxAge: number;
     refreshTokenMaxAge: number;
@@ -65,16 +67,15 @@ export declare const authOptionsSchema: z.ZodObject<{
     renderers: AuthRenderers;
     issuerInternal?: string | undefined;
     clientId?: string | undefined;
-    clientSecret?: string | undefined;
-    resource?: string | undefined;
+    clientSecret?: string | ClientSecretLiteral | undefined;
     sessionCookieDomain?: string | undefined;
 }, {
     issuer: string;
+    resource: string;
     cookiePrefix: string;
     issuerInternal?: string | undefined;
     clientId?: string | undefined;
-    clientSecret?: string | undefined;
-    resource?: string | undefined;
+    clientSecret?: string | ClientSecretLiteral | undefined;
     sessionCookieDomain?: string | undefined;
     accessTokenMaxAge?: number | undefined;
     refreshTokenMaxAge?: number | undefined;

package/dist/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAqB/C,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiD5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAC3D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAA"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AAsB3E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8D5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAC3D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAA"}

package/dist/options.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { isClientSecretLiteral } from './utils/client-secret-literal.js';
 // String accepted as either a literal URL or an "env:VAR_NAME" marker that
 // gets resolved against the Worker runtime env at request time. See
 // `src/utils/env-marker.ts` and `src/config-store.ts`. Bare "env:" (no
@@ -22,8 +23,21 @@ export const authOptionsSchema = z.object({
     issuerInternal: urlOrEnvMarker.optional(),
     // ─── Client identity ───
     clientId: stringOrEnvMarker.optional(),
-    clientSecret: z.string().optional(),
-    resource: urlOrEnvMarker.optional(),
+    // clientSecret accepts either a binding name (string resolved at request time
+    // against the Worker runtime env) or an explicit literalClientSecret() value
+    // (local-dev only; embedded in the serialized config). A bare string is
+    // always treated as a binding name — fail closed when the binding is absent.
+    // An empty or whitespace-only binding name is schema-rejected; it can never
+    // resolve to a usable secret and must not silently become a public client.
+    clientSecret: z
+        .union([
+        z.string().refine((v) => v.trim().length > 0, {
+            message: 'clientSecret binding name must not be empty or whitespace-only',
+        }),
+        z.custom(isClientSecretLiteral),
+    ])
+        .optional(),
+    resource: urlOrEnvMarker,
     // ─── Cookie configuration ───
     cookiePrefix: z.string(),
     sessionCookieDomain: z.string().optional(),

package/dist/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,2EAA2E;AAC3E,oEAAoE;AACpE,uEAAuE;AACvE,uEAAuE;AACvE,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACjF,OAAO,EAAE,0DAA0D;CACnE,CAAC,CAAA;AAEH,qEAAqE;AACrE,oEAAoE;AACpE,wEAAwE;AACxE,wEAAwE;AACxE,wDAAwD;AACxD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;IACzF,OAAO,EAAE,uEAAuE;CAChF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,sBAAsB;IACtB,MAAM,EAAE,cAAc;IACtB,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;IAEzC,0BAA0B;IAC1B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IAEnC,+BAA+B;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,0BAA0B;IAC1B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE/C,6BAA6B;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;IAClD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC;IACnE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;IAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAC3D,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC;IAChF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC;IAEhF,oBAAoB;IACpB,SAAS,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;SACnD,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAE/C,mCAAmC;IACnC,SAAS,EAAE,CAAC;SACV,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IAEb,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAA"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAExE,2EAA2E;AAC3E,oEAAoE;AACpE,uEAAuE;AACvE,uEAAuE;AACvE,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACjF,OAAO,EAAE,0DAA0D;CACnE,CAAC,CAAA;AAEH,qEAAqE;AACrE,oEAAoE;AACpE,wEAAwE;AACxE,wEAAwE;AACxE,wDAAwD;AACxD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;IACzF,OAAO,EAAE,uEAAuE;CAChF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,sBAAsB;IACtB,MAAM,EAAE,cAAc;IACtB,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;IAEzC,0BAA0B;IAC1B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACtC,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,YAAY,EAAE,CAAC;SACb,KAAK,CAAC;QACN,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE;YAC7C,OAAO,EAAE,gEAAgE;SACzE,CAAC;QACF,CAAC,CAAC,MAAM,CAAsB,qBAAqB,CAAC;KACpD,CAAC;SACD,QAAQ,EAAE;IACZ,QAAQ,EAAE,cAAc;IAExB,+BAA+B;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,0BAA0B;IAC1B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE/C,6BAA6B;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;IAClD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC;IACnE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;IAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAC3D,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC;IAChF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC;IAEhF,oBAAoB;IACpB,SAAS,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;SACnD,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAE/C,mCAAmC;IACnC,SAAS,EAAE,CAAC;SACV,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IAEb,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAA"}

package/dist/routes/api/code-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code-request.d.ts","sourceRoot":"","sources":["../../../src/routes/api/code-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,YAAY,EAKjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2BnE"}
+{"version":3,"file":"code-request.d.ts","sourceRoot":"","sources":["../../../src/routes/api/code-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,KAAK,YAAY,EAKjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+BnE"}

package/dist/routes/api/code-request.js

@@ -1,5 +1,6 @@
-import { authClient, getConfig, readForm, readFormString, rejectCrossSitePost, statusRedirect, } from './shared.js';
+import { authClient, failClosedOnSecretResolutionFailure, getConfig, readForm, readFormString, rejectCrossSitePost, statusRedirect, } from './shared.js';
 export async function POST(context) {
+    // Trust boundary: Origin rejection must precede config, secret, form, and issuer I/O.
     const crossSitePost = rejectCrossSitePost(context);
     if (crossSitePost)
         return crossSitePost;
@@ -7,6 +8,9 @@ export async function POST(context) {
     if (!options.providers.includes('email-code')) {
         return new Response('Not found', { status: 404 });
     }
+    const secretError = await failClosedOnSecretResolutionFailure(context);
+    if (secretError)
+        return secretError;
     const form = await readForm(context);
     const email = await readFormString(form, 'email');
     const redirect = form.get('redirect')?.toString();

package/dist/routes/api/code-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"code-request.js","sourceRoot":"","sources":["../../../src/routes/api/code-request.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAA;IACjD,MAAM,WAAW,GAChB,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,gBAAgB;QACxD,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,OAAO,CAAC,cAAc,CAAA;IAC1B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAEhE,OAAO,cAAc,CACpB,OAAO,EACP,MAAM,EACN,WAAW,EACX,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC9B,WAAW,EACX,EAAE,KAAK,EAAE,QAAQ,EAAE,EACnB,YAAY,CACZ,CAAA;AACF,CAAC"}
+{"version":3,"file":"code-request.js","sourceRoot":"","sources":["../../../src/routes/api/code-request.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,mCAAmC,EACnC,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,sFAAsF;IACtF,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAA;IACtE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAA;IAEnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAA;IACjD,MAAM,WAAW,GAChB,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,gBAAgB;QACxD,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,OAAO,CAAC,cAAc,CAAA;IAC1B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAEhE,OAAO,cAAc,CACpB,OAAO,EACP,MAAM,EACN,WAAW,EACX,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC9B,WAAW,EACX,EAAE,KAAK,EAAE,QAAQ,EAAE,EACnB,YAAY,CACZ,CAAA;AACF,CAAC"}

package/dist/routes/api/code-verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code-verify.d.ts","sourceRoot":"","sources":["../../../src/routes/api/code-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,KAAK,YAAY,EAIjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4BnE"}
+{"version":3,"file":"code-verify.d.ts","sourceRoot":"","sources":["../../../src/routes/api/code-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAKN,KAAK,YAAY,EAIjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgCnE"}

package/dist/routes/api/code-verify.js

@@ -1,5 +1,6 @@
-import { authClient, callbackRedirect, getConfig, readForm, readFormString, rejectCrossSitePost, } from './shared.js';
+import { authClient, callbackRedirect, failClosedOnSecretResolutionFailure, getConfig, readForm, readFormString, rejectCrossSitePost, } from './shared.js';
 export async function POST(context) {
+    // Trust boundary: Origin rejection must precede config, secret, form, and issuer I/O.
     const crossSitePost = rejectCrossSitePost(context);
     if (crossSitePost)
         return crossSitePost;
@@ -7,6 +8,9 @@ export async function POST(context) {
     if (!options.providers.includes('email-code')) {
         return new Response('Not found', { status: 404 });
     }
+    const secretError = await failClosedOnSecretResolutionFailure(context);
+    if (secretError)
+        return secretError;
     const form = await readForm(context);
     const email = await readFormString(form, 'email');
     const code = await readFormString(form, 'code');

package/dist/routes/api/code-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"code-verify.js","sourceRoot":"","sources":["../../../src/routes/api/code-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,gBAAgB,EAChB,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,GACnB,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC/C,MAAM,SAAS,GACd,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,gBAAgB;QACxD,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,OAAO,CAAC,cAAc,CAAA;IAC1B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAErE,OAAO,gBAAgB,CACtB,OAAO,EACP,MAAM,EACN,SAAS,EACT;QACC,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE;KAC1C,EACD,YAAY,CACZ,CAAA;AACF,CAAC"}
+{"version":3,"file":"code-verify.js","sourceRoot":"","sources":["../../../src/routes/api/code-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,gBAAgB,EAChB,mCAAmC,EACnC,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,GACnB,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,sFAAsF;IACtF,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAA;IACtE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAA;IAEnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC/C,MAAM,SAAS,GACd,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,gBAAgB;QACxD,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,OAAO,CAAC,cAAc,CAAA;IAC1B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAErE,OAAO,gBAAgB,CACtB,OAAO,EACP,MAAM,EACN,SAAS,EACT;QACC,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE;KAC1C,EACD,YAAY,CACZ,CAAA;AACF,CAAC"}

package/dist/routes/api/password-reset-confirm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-confirm.d.ts","sourceRoot":"","sources":["../../../src/routes/api/password-reset-confirm.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,YAAY,EAKjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0BnE"}
+{"version":3,"file":"password-reset-confirm.d.ts","sourceRoot":"","sources":["../../../src/routes/api/password-reset-confirm.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,KAAK,YAAY,EAKjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8BnE"}

package/dist/routes/api/password-reset-confirm.js

@@ -1,5 +1,6 @@
-import { authClient, getConfig, readForm, readFormString, rejectCrossSitePost, statusRedirect, } from './shared.js';
+import { authClient, failClosedOnSecretResolutionFailure, getConfig, readForm, readFormString, rejectCrossSitePost, statusRedirect, } from './shared.js';
 export async function POST(context) {
+    // Trust boundary: Origin rejection must precede config, secret, form, and issuer I/O.
     const crossSitePost = rejectCrossSitePost(context);
     if (crossSitePost)
         return crossSitePost;
@@ -7,6 +8,9 @@ export async function POST(context) {
     if (!options.providers.includes('password')) {
         return new Response('Not found', { status: 404 });
     }
+    const secretError = await failClosedOnSecretResolutionFailure(context);
+    if (secretError)
+        return secretError;
     const form = await readForm(context);
     const token = await readFormString(form, 'token');
     const password = await readFormString(form, 'password', { trim: false });

package/dist/routes/api/password-reset-confirm.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-confirm.js","sourceRoot":"","sources":["../../../src/routes/api/password-reset-confirm.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/D,KAAK;QACL,WAAW,EAAE,QAAQ;KACrB,CAAC,CAAA;IAEF,OAAO,cAAc,CACpB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,EAAE,KAAK,EAAE,SAAS,EAAE,EACpB,OAAO,CAAC,iBAAiB,EACzB,EAAE,KAAK,EAAE,EACT,UAAU,CACV,CAAA;AACF,CAAC"}
+{"version":3,"file":"password-reset-confirm.js","sourceRoot":"","sources":["../../../src/routes/api/password-reset-confirm.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,mCAAmC,EACnC,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,sFAAsF;IACtF,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAA;IACtE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAA;IAEnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/D,KAAK;QACL,WAAW,EAAE,QAAQ;KACrB,CAAC,CAAA;IAEF,OAAO,cAAc,CACpB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,EAAE,KAAK,EAAE,SAAS,EAAE,EACpB,OAAO,CAAC,iBAAiB,EACzB,EAAE,KAAK,EAAE,EACT,UAAU,CACV,CAAA;AACF,CAAC"}

package/dist/routes/api/password-reset-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-request.d.ts","sourceRoot":"","sources":["../../../src/routes/api/password-reset-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,YAAY,EAKjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBnE"}
+{"version":3,"file":"password-reset-request.d.ts","sourceRoot":"","sources":["../../../src/routes/api/password-reset-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,KAAK,YAAY,EAKjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0BnE"}

package/dist/routes/api/password-reset-request.js

@@ -1,5 +1,6 @@
-import { authClient, getConfig, readForm, readFormString, rejectCrossSitePost, statusRedirect, } from './shared.js';
+import { authClient, failClosedOnSecretResolutionFailure, getConfig, readForm, readFormString, rejectCrossSitePost, statusRedirect, } from './shared.js';
 export async function POST(context) {
+    // Trust boundary: Origin rejection must precede config, secret, form, and issuer I/O.
     const crossSitePost = rejectCrossSitePost(context);
     if (crossSitePost)
         return crossSitePost;
@@ -7,6 +8,9 @@ export async function POST(context) {
     if (!options.providers.includes('password')) {
         return new Response('Not found', { status: 404 });
     }
+    const secretError = await failClosedOnSecretResolutionFailure(context);
+    if (secretError)
+        return secretError;
     const form = await readForm(context);
     const email = await readFormString(form, 'email');
     const result = await authClient(context).password.reset.request({ email });

package/dist/routes/api/password-reset-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-request.js","sourceRoot":"","sources":["../../../src/routes/api/password-reset-request.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAE1E,OAAO,cAAc,CACpB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,kBAAkB,EAC1B,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,OAAO,CAAC,kBAAkB,EAC1B,EAAE,KAAK,EAAE,EACT,UAAU,CACV,CAAA;AACF,CAAC"}
+{"version":3,"file":"password-reset-request.js","sourceRoot":"","sources":["../../../src/routes/api/password-reset-request.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,mCAAmC,EACnC,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,cAAc,GACd,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,sFAAsF;IACtF,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAA;IACtE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAA;IAEnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAE1E,OAAO,cAAc,CACpB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,kBAAkB,EAC1B,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,OAAO,CAAC,kBAAkB,EAC1B,EAAE,KAAK,EAAE,EACT,UAAU,CACV,CAAA;AACF,CAAC"}

package/dist/routes/api/password-verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-verify.d.ts","sourceRoot":"","sources":["../../../src/routes/api/password-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,KAAK,YAAY,EAIjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwBnE"}
+{"version":3,"file":"password-verify.d.ts","sourceRoot":"","sources":["../../../src/routes/api/password-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAKN,KAAK,YAAY,EAIjB,MAAM,aAAa,CAAA;AAEpB,wBAAsB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4BnE"}

package/dist/routes/api/password-verify.js

@@ -1,5 +1,6 @@
-import { authClient, callbackRedirect, getConfig, readForm, readFormString, rejectCrossSitePost, } from './shared.js';
+import { authClient, callbackRedirect, failClosedOnSecretResolutionFailure, getConfig, readForm, readFormString, rejectCrossSitePost, } from './shared.js';
 export async function POST(context) {
+    // Trust boundary: Origin rejection must precede config, secret, form, and issuer I/O.
     const crossSitePost = rejectCrossSitePost(context);
     if (crossSitePost)
         return crossSitePost;
@@ -7,6 +8,9 @@ export async function POST(context) {
     if (!options.providers.includes('password')) {
         return new Response('Not found', { status: 404 });
     }
+    const secretError = await failClosedOnSecretResolutionFailure(context);
+    if (secretError)
+        return secretError;
     const form = await readForm(context);
     const email = await readFormString(form, 'email');
     const password = await readFormString(form, 'password', { trim: false });

package/dist/routes/api/password-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-verify.js","sourceRoot":"","sources":["../../../src/routes/api/password-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,gBAAgB,EAChB,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,GACnB,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAE7E,OAAO,gBAAgB,CACtB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,YAAY,EACpB;QACC,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE;KAC1C,EACD,UAAU,CACV,CAAA;AACF,CAAC"}
+{"version":3,"file":"password-verify.js","sourceRoot":"","sources":["../../../src/routes/api/password-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EACV,gBAAgB,EAChB,mCAAmC,EACnC,SAAS,EAET,QAAQ,EACR,cAAc,EACd,mBAAmB,GACnB,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC/C,sFAAsF;IACtF,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAA;IAEvC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAA;IACtE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAA;IAEnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAE7E,OAAO,gBAAgB,CACtB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,YAAY,EACpB;QACC,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE;KAC1C,EACD,UAAU,CACV,CAAA;AACF,CAAC"}

package/dist/routes/api/shared.d.ts

@@ -8,6 +8,7 @@ export declare function readFormString(form: FormData, key: string, options?: {
 export declare function rejectCrossSitePost(context: RouteContext): Response | null;
 export declare function callbackRedirect(context: RouteContext, result: AuthClientCodeResult, errorPath: string, errorParams: Record<string, string | undefined>, provider?: 'password' | 'email-code'): Promise<Response> | Response;
 export declare function statusRedirect(context: RouteContext, result: AuthClientOkResult, successPath: string, successParams: Record<string, string | undefined>, errorPath: string, errorParams: Record<string, string | undefined>, provider?: AuthAnalyticsProvider): Response;
+export declare function failClosedOnSecretResolutionFailure(context: RouteContext): Promise<Response | null>;
 export type { RouteContext };
 export { authClient, getConfig, readForm, redirectTo };
 //# sourceMappingURL=shared.d.ts.map

package/dist/routes/api/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/routes/api/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,OAAO,EAAE,KAAK,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAChG,OAAO,EACN,KAAK,qBAAqB,EAI1B,MAAM,0BAA0B,CAAA;AAYjC,OAAO,EAAE,KAAK,YAAY,EAAE,QAAQ,EAAoB,UAAU,EAAE,MAAM,YAAY,CAAA;AAItF,wBAAsB,cAAc,CACnC,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9B,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,QAAQ,GAAG,IAAI,CAe1E;AAED,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,oBAAoB,EAC5B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC/C,QAAQ,CAAC,EAAE,UAAU,GAAG,YAAY,GAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAsC9B;AAED,wBAAgB,cAAc,CAC7B,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,kBAAkB,EAC1B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC/C,QAAQ,CAAC,EAAE,qBAAqB,GAC9B,QAAQ,CAMV;AAyBD,YAAY,EAAE,YAAY,EAAE,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/routes/api/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,OAAO,EAAE,KAAK,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAChG,OAAO,EACN,KAAK,qBAAqB,EAI1B,MAAM,0BAA0B,CAAA;AAcjC,OAAO,EAAE,KAAK,YAAY,EAAE,QAAQ,EAAoB,UAAU,EAAE,MAAM,YAAY,CAAA;AAItF,wBAAsB,cAAc,CACnC,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9B,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,QAAQ,GAAG,IAAI,CAe1E;AAED,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,oBAAoB,EAC5B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC/C,QAAQ,CAAC,EAAE,UAAU,GAAG,YAAY,GAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAsC9B;AAED,wBAAgB,cAAc,CAC7B,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,kBAAkB,EAC1B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC/C,QAAQ,CAAC,EAAE,qBAAqB,GAC9B,QAAQ,CAMV;AA4BD,wBAAsB,mCAAmC,CACxD,OAAO,EAAE,YAAY,GACnB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAS1B;AAED,YAAY,EAAE,YAAY,EAAE,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA"}