@hyper.authio/bff 0.0.0-stage → 0.7.0

package/dist/index.js

@@ -0,0 +1,950 @@
+import { randomBytes, createDecipheriv, createCipheriv, timingSafeEqual, createHash, hkdfSync, createHmac } from 'crypto';
+import { AuthioClaimTypes, AuthioResourceAccessClaims, systemClock, createAuthioClient, createAuthioTokenDecrypter, encryptionKeyFromFile, AuthioPrompts, AuthioProtocolError, AuthioTokenTypes, AuthioError, AuthioConfigurationError, AuthioDefaults, resourceAccessSourceOf, parseResourceAccess, AuthioOAuthErrors, isAuthioTokenEncrypted } from '@hyper.authio/client';
+import { Readable } from 'stream';
+import { pipeline } from 'stream/promises';
+
+// src/bff.ts
+var AuthioBffClaimTypes = {
+  /** Seconds until the BFF session expires. */
+  SessionExpiresIn: "bff:session_expires_in",
+  /** The URL the SPA navigates to in order to log out; it carries the session's `sid`. */
+  LogoutUrl: "bff:logout_url",
+  /** One Authio role the person holds (flattened from the `*_resource_access` claims). */
+  Role: "role",
+  /** One permission the person holds, as `{resource}:{method}` (flattened from the `*_resource_access` claims). */
+  Permission: "permission"
+};
+var accessTokenClaimTypes = /* @__PURE__ */ new Set([
+  ...Object.keys(AuthioResourceAccessClaims),
+  AuthioClaimTypes.OrganizationId,
+  AuthioClaimTypes.OrganizationAlias,
+  AuthioClaimTypes.AccountId
+]);
+var protocolClaimTypes = /* @__PURE__ */ new Set(["nonce", "aud", "azp", "iss", "iat", "nbf", "exp", "at_hash", "c_hash", "ipaddr", "platf", "ver"]);
+function toSessionClaims(idToken, fallbackSubject) {
+  const claims = {};
+  for (const [type, value] of Object.entries(idToken ?? {})) if (!protocolClaimTypes.has(type) && value !== void 0 && value !== null) claims[type] = value;
+  if (claims.sub === void 0 && fallbackSubject) claims.sub = fallbackSubject;
+  return claims;
+}
+function mergeUserInfo(claims, userInfo) {
+  for (const [type, value] of Object.entries(userInfo)) if (claims[type] === void 0 && value !== void 0 && value !== null) claims[type] = value;
+}
+async function replaceAccessTokenClaims(claims, accessToken, decrypt) {
+  const payload = await readPayload(accessToken, decrypt);
+  if (!payload) return;
+  for (const type of Object.keys(claims)) if (accessTokenClaimTypes.has(type)) delete claims[type];
+  for (const [type, value] of Object.entries(payload)) if (accessTokenClaimTypes.has(type) && value !== void 0 && value !== null) claims[type] = value;
+}
+async function readAccessTokenSubject(accessToken, decrypt) {
+  const subject = (await readPayload(accessToken, decrypt))?.sub;
+  return typeof subject === "string" && subject ? subject : void 0;
+}
+function toAuthioBffClaims(claims, sessionExpiresIn, logoutUrl) {
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (type, value) => {
+    const key = `${type}\0${value}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    entries.push({ type, value });
+  };
+  for (const [type, value] of Object.entries(claims)) {
+    if (resourceAccessSourceOf(type)) continue;
+    for (const item of Array.isArray(value) ? value : [value]) if (item !== void 0 && item !== null) add(type, toText(item));
+  }
+  const access = parseResourceAccess(claims);
+  for (const role of access.roles) add(AuthioBffClaimTypes.Role, role);
+  for (const [resource, methods] of Object.entries(access.permissions)) for (const method of methods) add(AuthioBffClaimTypes.Permission, `${resource}:${method}`);
+  entries.push({ type: AuthioBffClaimTypes.SessionExpiresIn, value: sessionExpiresIn });
+  entries.push({ type: AuthioBffClaimTypes.LogoutUrl, value: logoutUrl });
+  return entries;
+}
+async function readPayload(token, decrypt) {
+  if (!token) return void 0;
+  try {
+    const signed = isAuthioTokenEncrypted(token) ? await decrypt(token) : token;
+    const parts = signed.split(".");
+    if (parts.length !== 3 || !parts[1]) return void 0;
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function toText(value) {
+  return typeof value === "string" ? value : typeof value === "object" ? JSON.stringify(value) : String(value);
+}
+
+// src/http.ts
+function readCookies(request) {
+  const cookies = /* @__PURE__ */ new Map();
+  for (const part of (request.headers.cookie ?? "").split(";")) {
+    const separator = part.indexOf("=");
+    if (separator <= 0) continue;
+    const name = part.slice(0, separator).trim();
+    if (!name || cookies.has(name)) continue;
+    let value = part.slice(separator + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) value = value.slice(1, -1);
+    try {
+      cookies.set(name, decodeURIComponent(value));
+    } catch {
+      cookies.set(name, value);
+    }
+  }
+  return cookies;
+}
+function setCookie(response, name, value, sameSite, maxAge) {
+  if (response.headersSent) return;
+  const attributes = [
+    `${name}=${encodeURIComponent(value)}`,
+    "Path=/",
+    ...maxAge === void 0 ? [] : [`Max-Age=${Math.max(0, Math.floor(maxAge))}`],
+    ...maxAge === 0 ? ["Expires=Thu, 01 Jan 1970 00:00:00 GMT"] : [],
+    "HttpOnly",
+    "Secure",
+    `SameSite=${sameSite === "strict" ? "Strict" : "Lax"}`
+  ];
+  response.append("Set-Cookie", attributes.join("; "));
+}
+function sendError(response, status, error, description) {
+  if (response.headersSent) return;
+  response.status(status).set("Cache-Control", "no-store").json(description ? { error, error_description: description } : { error });
+}
+function hasAntiForgeryHeader(request, name, value) {
+  const lower = name.toLowerCase();
+  let count = 0;
+  let matched = false;
+  for (let index = 0; index < request.rawHeaders.length; index += 2) {
+    if (request.rawHeaders[index]?.toLowerCase() !== lower) continue;
+    count += 1;
+    matched = request.rawHeaders[index + 1] === value;
+  }
+  return count === 1 && matched;
+}
+function readQuery(request) {
+  return new URL(request.originalUrl || request.url, "http://localhost").searchParams;
+}
+function requestBase(request) {
+  return `${request.protocol}://${request.get("host") ?? "localhost"}${request.baseUrl ?? ""}`;
+}
+function withQueryParameter(url, name, value) {
+  const hash = url.indexOf("#");
+  const base = hash >= 0 ? url.slice(0, hash) : url;
+  const fragment = hash >= 0 ? url.slice(hash) : "";
+  return `${base}${base.includes("?") ? "&" : "?"}${encodeURIComponent(name)}=${encodeURIComponent(value)}${fragment}`;
+}
+async function readFormField(request, field, maxBytes = 64 * 1024) {
+  const parsed = request.body;
+  if (parsed && typeof parsed === "object" && !Buffer.isBuffer(parsed)) {
+    const value = parsed[field];
+    if (typeof value === "string") return value;
+  }
+  if (!(request.headers["content-type"] ?? "").toLowerCase().startsWith("application/x-www-form-urlencoded")) return void 0;
+  const text = Buffer.isBuffer(parsed) ? parsed.toString("utf8") : typeof parsed === "string" ? parsed : request.readableEnded ? void 0 : await readText(request, maxBytes);
+  return text === void 0 ? void 0 : new URLSearchParams(text).get(field) ?? void 0;
+}
+function readText(request, maxBytes) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    let done = false;
+    request.on("data", (chunk) => {
+      if (done) return;
+      size += chunk.byteLength;
+      if (size > maxBytes) {
+        done = true;
+        request.pause();
+        resolve(void 0);
+        return;
+      }
+      chunks.push(chunk);
+    });
+    request.on("end", () => {
+      if (!done) resolve(Buffer.concat(chunks).toString("utf8"));
+    });
+    request.on("error", reject);
+  });
+}
+var AuthioBffDefaults = {
+  /** The session cookie name. `__Host-` makes browsers refuse it unless it is `Secure`, has `Path=/` and no `Domain`. */
+  CookieName: "__Host-authio",
+  /** The route prefix of the BFF endpoints. */
+  EndpointPrefix: "/bff",
+  /** The anti-forgery header the SPA sends on every API call. */
+  AntiForgeryHeaderName: "X-CSRF",
+  /** The value the anti-forgery header carries. */
+  AntiForgeryHeaderValue: "1",
+  /** The redirect path Authio sends the person back to after sign-in. */
+  CallbackPath: "/signin-oidc",
+  /** The redirect path Authio sends the person back to after sign-out. */
+  SignedOutCallbackPath: "/signout-callback-oidc",
+  /** The `source` of the message the silent-login page posts to its parent window. */
+  SilentLoginMessageSource: "authio-bff-silent-login",
+  /** The prefix of the keys sessions are stored under. */
+  SessionKeyPrefix: "authio-bff:",
+  /** Seconds a session lasts without activity (8 hours). */
+  SessionLifetime: 8 * 60 * 60,
+  /** Seconds between two checks of the Authio session (5 minutes). */
+  SessionValidationInterval: 5 * 60,
+  /** Seconds a sign-in may take between the login request and the callback (15 minutes). */
+  LoginLifetime: 15 * 60,
+  /** The scopes asked for at sign-in; `offline_access` gives the BFF a refresh token. */
+  Scopes: Object.freeze(["openid", "profile", "email", "offline_access"])
+};
+function resolveBffSettings(options) {
+  const problems = [];
+  const cookieSecrets = (typeof options.cookieSecret === "string" ? [options.cookieSecret] : [...options.cookieSecret ?? []]).filter(
+    (secret) => typeof secret === "string"
+  );
+  const settings = {
+    cookieSecrets,
+    endpointPrefix: `/${(options.endpointPrefix ?? AuthioBffDefaults.EndpointPrefix).replace(/^\/+|\/+$/g, "")}`,
+    scopes: withOpenId([...options.scopes ?? AuthioBffDefaults.Scopes, ...options.requestRoles ? ["roles"] : []]),
+    getClaimsFromUserInfoEndpoint: options.getClaimsFromUserInfoEndpoint ?? false,
+    organization: nonEmpty(options.organization),
+    resource: nonEmpty(options.resource),
+    allowedResources: [...options.allowedResources ?? []],
+    prompt: options.prompt || void 0,
+    uiLocales: nonEmpty(options.uiLocales),
+    maxAge: options.maxAge,
+    additionalAuthorizationParameters: { ...options.additionalAuthorizationParameters },
+    requireIssuerParameter: options.requireIssuerParameter ?? true,
+    callbackPath: options.callbackPath ?? AuthioBffDefaults.CallbackPath,
+    signedOutCallbackPath: options.signedOutCallbackPath ?? AuthioBffDefaults.SignedOutCallbackPath,
+    defaultReturnUrl: options.defaultReturnUrl ?? "/",
+    cookieName: options.cookieName ?? AuthioBffDefaults.CookieName,
+    cookieSameSite: options.cookieSameSite ?? "lax",
+    sessionLifetimeMs: (options.sessionLifetime ?? AuthioBffDefaults.SessionLifetime) * 1e3,
+    slidingExpiration: options.slidingExpiration ?? true,
+    sessionValidation: options.sessionValidation ?? "introspection",
+    sessionValidationIntervalMs: (options.sessionValidationInterval ?? AuthioBffDefaults.SessionValidationInterval) * 1e3,
+    revokeRefreshTokenOnLogout: options.revokeRefreshTokenOnLogout ?? true,
+    antiForgeryHeaderName: options.antiForgeryHeaderName ?? AuthioBffDefaults.AntiForgeryHeaderName,
+    antiForgeryHeaderValue: options.antiForgeryHeaderValue ?? AuthioBffDefaults.AntiForgeryHeaderValue,
+    sessionKeyPrefix: options.sessionKeyPrefix ?? AuthioBffDefaults.SessionKeyPrefix,
+    backChannelLogout: options.backChannelLogout ?? true,
+    tokenRefreshSkewMs: (options.tokenRefreshSkew ?? 60) * 1e3,
+    redirectUri: nonEmpty(options.redirectUri),
+    postLogoutRedirectUri: nonEmpty(options.postLogoutRedirectUri),
+    onError: options.onError ?? (() => void 0)
+  };
+  if (cookieSecrets.length === 0) problems.push("cookieSecret is required: the session cookie is signed with it.");
+  else if (cookieSecrets.some((secret) => secret.length < 32)) problems.push("Every cookieSecret must be at least 32 characters long.");
+  if (!settings.cookieName.trim()) problems.push("cookieName is required.");
+  else if (!settings.cookieName.startsWith("__Host-") && !settings.cookieName.startsWith("__Secure-"))
+    problems.push("cookieName must start with __Host- (or __Secure-) so browsers enforce a Secure, host-only cookie.");
+  else if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(settings.cookieName)) problems.push("cookieName holds characters a cookie name cannot.");
+  if (settings.cookieSameSite !== "lax" && settings.cookieSameSite !== "strict") problems.push("cookieSameSite must be lax or strict.");
+  if (!isPositive(settings.sessionLifetimeMs)) problems.push("sessionLifetime must be a positive number of seconds.");
+  if (settings.sessionValidation !== "none" && settings.sessionValidation !== "introspection")
+    problems.push("sessionValidation must be none or introspection.");
+  else if (settings.sessionValidation === "introspection" && !isPositive(settings.sessionValidationIntervalMs))
+    problems.push("sessionValidationInterval must be a positive number of seconds.");
+  if (!settings.antiForgeryHeaderName.trim() || !/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(settings.antiForgeryHeaderName))
+    problems.push("antiForgeryHeaderName must be a header name.");
+  if (!settings.antiForgeryHeaderValue) problems.push("antiForgeryHeaderValue is required.");
+  if (!isLocalUrl(settings.defaultReturnUrl)) problems.push("defaultReturnUrl must be a local URL starting with a single '/'.");
+  if (!isLocalUrl(settings.callbackPath)) problems.push("callbackPath must start with '/'.");
+  if (!isLocalUrl(settings.signedOutCallbackPath)) problems.push("signedOutCallbackPath must start with '/'.");
+  if (settings.endpointPrefix === "/") problems.push("endpointPrefix cannot be empty.");
+  if (settings.prompt !== void 0 && !AuthioPrompts.includes(settings.prompt)) problems.push("prompt must be none, login, select_account or consent.");
+  if (settings.maxAge !== void 0 && (!Number.isInteger(settings.maxAge) || settings.maxAge < 0))
+    problems.push("maxAge must be a non-negative whole number of seconds.");
+  if (!settings.sessionKeyPrefix.trim()) problems.push("sessionKeyPrefix is required.");
+  if (!Number.isFinite(settings.tokenRefreshSkewMs) || settings.tokenRefreshSkewMs < 0) problems.push("tokenRefreshSkew must be a non-negative number of seconds.");
+  if (problems.length > 0) throw new AuthioConfigurationError(`The Authio BFF options are not valid:
+- ${problems.join("\n- ")}`);
+  return settings;
+}
+function isLocalUrl(url) {
+  if (typeof url !== "string" || !url || /[\u0000-\u001f\u007f-\u009f]/.test(url)) return false;
+  return url[0] === "/" && (url.length === 1 || url[1] !== "/" && url[1] !== "\\");
+}
+function withOpenId(scopes) {
+  const distinct = [...new Set(scopes.map((scope) => scope.trim()).filter(Boolean))];
+  return Object.freeze(distinct.includes("openid") ? distinct : ["openid", ...distinct]);
+}
+function nonEmpty(value) {
+  return value?.trim() ? value : void 0;
+}
+function isPositive(value) {
+  return Number.isFinite(value) && value > 0;
+}
+function createAuthioBffProtector(secrets) {
+  const keys = /* @__PURE__ */ new Map();
+  const keysFor = (purpose) => {
+    let derived = keys.get(purpose);
+    if (!derived) {
+      derived = secrets.map((secret) => Buffer.from(hkdfSync("sha256", secret, "authio-bff", `authio-bff:${purpose}`, 32)));
+      keys.set(purpose, derived);
+    }
+    return derived;
+  };
+  const mac = (key, value) => createHmac("sha256", key).update(value, "utf8").digest();
+  return {
+    sign(value) {
+      return `${value}.${mac(keysFor("session-cookie")[0], value).toString("base64url")}`;
+    },
+    unsign(signed) {
+      const dot = signed.lastIndexOf(".");
+      if (dot <= 0) return void 0;
+      const value = signed.slice(0, dot);
+      const signature = Buffer.from(signed.slice(dot + 1), "base64url");
+      for (const key of keysFor("session-cookie")) {
+        const expected = mac(key, value);
+        if (signature.length === expected.length && timingSafeEqual(signature, expected)) return value;
+      }
+      return void 0;
+    },
+    seal(purpose, value) {
+      const iv = randomBytes(12);
+      const cipher = createCipheriv("aes-256-gcm", keysFor(purpose)[0], iv);
+      const ciphertext = Buffer.concat([cipher.update(JSON.stringify(value), "utf8"), cipher.final()]);
+      return Buffer.concat([iv, ciphertext, cipher.getAuthTag()]).toString("base64url");
+    },
+    open(purpose, sealed) {
+      const bytes = Buffer.from(sealed, "base64url");
+      if (bytes.length < 29) return void 0;
+      for (const key of keysFor(purpose)) {
+        try {
+          const decipher = createDecipheriv("aes-256-gcm", key, bytes.subarray(0, 12));
+          decipher.setAuthTag(bytes.subarray(bytes.length - 16));
+          const plaintext = Buffer.concat([decipher.update(bytes.subarray(12, bytes.length - 16)), decipher.final()]).toString("utf8");
+          return JSON.parse(plaintext);
+        } catch {
+          continue;
+        }
+      }
+      return void 0;
+    }
+  };
+}
+var tokenModes = ["user", "userOrNone", "clientCredentials", "userOrClientCredentials", "none"];
+var hopByHop = /* @__PURE__ */ new Set(["connection", "keep-alive", "proxy-authenticate", "proxy-authorization", "proxy-connection", "te", "trailer", "transfer-encoding", "upgrade"]);
+var decodedEncodings = /* @__PURE__ */ new Set(["gzip", "x-gzip", "deflate", "br"]);
+function resolveRemoteApi(destination, options) {
+  let url;
+  try {
+    url = new URL(destination);
+  } catch {
+    throw new AuthioConfigurationError(`The remote API destination '${destination}' must be an absolute HTTP(S) URL.`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:")
+    throw new AuthioConfigurationError(`The remote API destination '${destination}' must be an absolute HTTP(S) URL.`);
+  const tokenMode = options.tokenMode ?? "user";
+  if (!tokenModes.includes(tokenMode)) throw new AuthioConfigurationError(`The remote API tokenMode must be one of ${tokenModes.join(", ")}.`);
+  const fetchImplementation = options.fetch ?? globalThis.fetch;
+  if (typeof fetchImplementation !== "function") throw new AuthioConfigurationError("No fetch implementation is available: pass fetch to remoteApi.");
+  return {
+    destination: destination.replace(/\/+$/, ""),
+    tokenMode,
+    resource: options.resource?.trim() || void 0,
+    scopes: [...options.scopes ?? []],
+    requireAntiForgery: options.requireAntiForgery ?? true,
+    validateSessionOnUnauthorized: options.validateSessionOnUnauthorized ?? true,
+    fetch: fetchImplementation
+  };
+}
+async function forwardToRemoteApi(request, response, remote, context) {
+  if (remote.requireAntiForgery && !context.antiForgery())
+    return sendError(response, 401, "antiforgery_required", `The ${context.antiForgeryHeaderName} header is required.`);
+  const token = await tokenFor(remote, context);
+  if (token.refused) return sendError(response, 401, "unauthorized", "Sign in first.");
+  const headers = outgoingHeaders(request, context.antiForgeryHeaderName);
+  if (token.accessToken) headers.set("authorization", `Bearer ${token.accessToken}`);
+  let upstream;
+  try {
+    upstream = await remote.fetch(remote.destination + remainingUrl(request), {
+      method: request.method,
+      headers,
+      body: outgoingBody(request),
+      redirect: "manual",
+      duplex: "half"
+    });
+  } catch {
+    return sendError(response, 502, "bad_gateway", "The remote API could not be reached.");
+  }
+  if (upstream.status === 401 && token.isUserToken && remote.validateSessionOnUnauthorized) await context.endIfInactive();
+  if (response.headersSent) return;
+  const encoding = upstream.headers.get("content-encoding")?.trim().toLowerCase();
+  const decoded = encoding !== void 0 && decodedEncodings.has(encoding);
+  response.status(upstream.status);
+  upstream.headers.forEach((value, name) => {
+    if (hopByHop.has(name) || name === "set-cookie" || decoded && (name === "content-encoding" || name === "content-length")) return;
+    response.setHeader(name, value);
+  });
+  if (!upstream.body || request.method === "HEAD") {
+    response.end();
+    return;
+  }
+  await pipeline(Readable.fromWeb(upstream.body), response);
+}
+async function tokenFor(remote, context) {
+  switch (remote.tokenMode) {
+    case "none":
+      return { refused: false };
+    case "clientCredentials":
+      return { refused: false, accessToken: await context.clientToken() };
+    default: {
+      const userToken = await context.hasSession() ? await context.userToken() : void 0;
+      if (userToken) return { refused: false, accessToken: userToken, isUserToken: true };
+      if (remote.tokenMode === "userOrNone") return { refused: false };
+      if (remote.tokenMode === "userOrClientCredentials") return { refused: false, accessToken: await context.clientToken() };
+      return { refused: true };
+    }
+  }
+}
+function outgoingHeaders(request, antiForgeryHeaderName) {
+  const headers = new Headers();
+  const skipped = /* @__PURE__ */ new Set([
+    ...hopByHop,
+    "host",
+    "cookie",
+    "authorization",
+    "content-length",
+    antiForgeryHeaderName.toLowerCase(),
+    ...(request.headers.connection ?? "").split(",").map((name) => name.trim().toLowerCase())
+  ]);
+  for (const [name, value] of Object.entries(request.headers)) {
+    if (value === void 0 || skipped.has(name)) continue;
+    for (const item of Array.isArray(value) ? value : [value]) headers.append(name, item);
+  }
+  headers.set("accept-encoding", "identity");
+  return headers;
+}
+function outgoingBody(request) {
+  const declaresBody = request.headers["transfer-encoding"] !== void 0 || Number(request.headers["content-length"] ?? 0) > 0;
+  if (request.method === "GET" || request.method === "HEAD" || !declaresBody) return void 0;
+  const parsed = request.body;
+  if (!request.readableEnded) return Readable.toWeb(request);
+  if (parsed === void 0 || parsed === null) return void 0;
+  if (Buffer.isBuffer(parsed)) return new Uint8Array(parsed);
+  if (typeof parsed === "string") return parsed;
+  if ((request.headers["content-type"] ?? "").toLowerCase().startsWith("application/x-www-form-urlencoded"))
+    return new URLSearchParams(parsed).toString();
+  return JSON.stringify(parsed);
+}
+function remainingUrl(request) {
+  const url = request.url || "/";
+  const originalPath = new URL(request.originalUrl || url, "http://localhost").pathname;
+  if ((url === "/" || url.startsWith("/?")) && !originalPath.endsWith("/")) return url.slice(1);
+  return url;
+}
+
+// src/session-locks.ts
+var AuthioBffSessionLocks = class {
+  tails = /* @__PURE__ */ new Map();
+  /** The number of keys with a holder or a waiter. */
+  get size() {
+    return this.tails.size;
+  }
+  /**
+   * Runs `work` once every earlier holder of `key` released it, and releases it afterwards, even when `work` throws.
+   */
+  async run(key, work) {
+    const previous = this.tails.get(key);
+    let release;
+    const turn = new Promise((resolve) => {
+      release = resolve;
+    });
+    const entry = { promise: (previous?.promise ?? Promise.resolve()).then(() => turn), references: (previous?.references ?? 0) + 1 };
+    this.tails.set(key, entry);
+    try {
+      await previous?.promise;
+      return await work();
+    } finally {
+      release();
+      const current = this.tails.get(key);
+      if (current) {
+        current.references -= 1;
+        if (current.references === 0) this.tails.delete(key);
+      }
+    }
+  }
+};
+function createAuthioBffMemoryStore(options = {}) {
+  const clock = options.clock ?? systemClock;
+  const sessions = /* @__PURE__ */ new Map();
+  const bySessionId = /* @__PURE__ */ new Map();
+  const bySubject = /* @__PURE__ */ new Map();
+  let nextSweep = 0;
+  const index = (lookup, value, key) => {
+    if (!value) return;
+    const keys = lookup.get(value) ?? /* @__PURE__ */ new Set();
+    keys.add(key);
+    lookup.set(value, keys);
+  };
+  const unindex = (lookup, value, key) => {
+    if (!value) return;
+    const keys = lookup.get(value);
+    keys?.delete(key);
+    if (keys?.size === 0) lookup.delete(value);
+  };
+  const remove = (key) => {
+    const session = sessions.get(key);
+    if (!session) return;
+    sessions.delete(key);
+    unindex(bySessionId, session.sessionId, key);
+    unindex(bySubject, session.subject, key);
+  };
+  const sweep = () => {
+    const now = clock.now();
+    if (now < nextSweep) return;
+    nextSweep = now + 6e4;
+    for (const [key, session] of sessions) if (session.expiresAt <= now) remove(key);
+  };
+  return {
+    get size() {
+      return sessions.size;
+    },
+    get(key) {
+      const session = sessions.get(key);
+      if (!session) return void 0;
+      if (session.expiresAt > clock.now()) return session;
+      remove(key);
+      return void 0;
+    },
+    set(session) {
+      sweep();
+      remove(session.key);
+      sessions.set(session.key, session);
+      index(bySessionId, session.sessionId, session.key);
+      index(bySubject, session.subject, session.key);
+    },
+    delete: remove,
+    deleteBySessionId(sessionId) {
+      for (const key of [...bySessionId.get(sessionId) ?? []]) remove(key);
+    },
+    deleteBySubject(subject) {
+      for (const key of [...bySubject.get(subject) ?? []]) remove(key);
+    }
+  };
+}
+
+// src/bff.ts
+var sessionSlot = /* @__PURE__ */ Symbol.for("authio.bff.session");
+function authioBff(options) {
+  const settings = resolveBffSettings(options);
+  const client = options.client ?? createAuthioClient(options);
+  const clock = client.connection.clock;
+  const store = options.store ?? createAuthioBffMemoryStore({ clock });
+  const protector = createAuthioBffProtector(settings.cookieSecrets);
+  const locks = new AuthioBffSessionLocks();
+  const exchanges = /* @__PURE__ */ new Map();
+  const decrypt = createAuthioTokenDecrypter(
+    options.clientEncryptionKey ?? (options.clientEncryptionKeyPath ? encryptionKeyFromFile(options.clientEncryptionKeyPath) : void 0)
+  );
+  const prefix = settings.endpointPrefix;
+  const loginLifetimeMs = AuthioBffDefaults.LoginLifetime * 1e3;
+  const loginCookieName = (state) => `${settings.cookieName}.login.${createHash("sha256").update(state).digest("base64url").slice(0, 16)}`;
+  const toInfo = (session) => Object.freeze({
+    subject: textOf(session.data.claims.sub),
+    sessionId: textOf(session.data.claims.sid),
+    claims: Object.freeze({ ...session.data.claims }),
+    expiresAt: session.expiresAt
+  });
+  const expose = (request, session) => {
+    request[sessionSlot] = Promise.resolve(session);
+    request.authioBff = session ? toInfo(session) : void 0;
+  };
+  const read = async (key) => {
+    const stored = await store.get(key);
+    if (!stored || stored.expiresAt <= clock.now()) return void 0;
+    const data = protector.open("session-data", stored.data);
+    return data ? { key, expiresAt: stored.expiresAt, data } : void 0;
+  };
+  const write = async (key, data, expiresAt) => {
+    await store.set({ key, sessionId: textOf(data.claims.sid), subject: textOf(data.claims.sub), expiresAt, data: protector.seal("session-data", data) });
+    return { key, expiresAt, data };
+  };
+  const update = (key, change) => locks.run(key, async () => {
+    const current = await read(key);
+    if (!current) return void 0;
+    const next = change(current);
+    return write(key, next.data, next.expiresAt);
+  });
+  const dropExchanges = (key) => {
+    for (const [cacheKey, entry] of exchanges) if (entry.sessionKey === key) exchanges.delete(cacheKey);
+  };
+  const clearCookie = (response) => setCookie(response, settings.cookieName, "", settings.cookieSameSite, 0);
+  const endSessionByKey = async (request, response, key) => {
+    await store.delete(key);
+    dropExchanges(key);
+    clearCookie(response);
+    expose(request, void 0);
+  };
+  const report = (error) => {
+    try {
+      settings.onError(error);
+    } catch {
+      return;
+    }
+  };
+  const isActive = async (data) => {
+    const token = data.refreshToken ?? data.accessToken;
+    if (!token) return void 0;
+    try {
+      const result = await client.introspect(token, { tokenTypeHint: data.refreshToken ? AuthioTokenTypes.RefreshToken : AuthioTokenTypes.AccessToken });
+      return result.active === true;
+    } catch (error) {
+      report(error);
+      return void 0;
+    }
+  };
+  const maintain = async (request, response, session) => {
+    const now = clock.now();
+    const validate = settings.sessionValidation === "introspection" && now - session.data.validatedAt >= settings.sessionValidationIntervalMs;
+    const slide = settings.slidingExpiration && session.expiresAt - now < settings.sessionLifetimeMs / 2;
+    let validated = false;
+    if (validate) {
+      const active = await isActive(session.data);
+      if (active === false) {
+        await endSessionByKey(request, response, session.key);
+        return void 0;
+      }
+      validated = active === true;
+    }
+    if (!validated && !slide) return session;
+    const renewed = await update(session.key, (current) => ({
+      data: validated ? { ...current.data, validatedAt: now } : current.data,
+      expiresAt: slide ? now + settings.sessionLifetimeMs : current.expiresAt
+    }));
+    return renewed;
+  };
+  const loadSession = (request, response) => {
+    const holder = request;
+    const cached = holder[sessionSlot];
+    if (cached) return cached;
+    const loading = (async () => {
+      const cookie = readCookies(request).get(settings.cookieName);
+      if (!cookie) return void 0;
+      const id = protector.unsign(cookie);
+      const found = id ? await read(settings.sessionKeyPrefix + id) : void 0;
+      const session = found ? await maintain(request, response, found) : void 0;
+      if (!session) {
+        clearCookie(response);
+        request.authioBff = void 0;
+        return void 0;
+      }
+      request.authioBff = toInfo(session);
+      return session;
+    })();
+    holder[sessionSlot] = loading;
+    return loading;
+  };
+  const isFresh = (data, skewMs) => Boolean(data.accessToken) && (data.accessTokenExpiresAt === void 0 || clock.now() < data.accessTokenExpiresAt - skewMs);
+  const refresh = async (request, response, session) => {
+    const data = { ...session.data, claims: { ...session.data.claims } };
+    const unexpired = isFresh(data, 0) ? data.accessToken : void 0;
+    if (!data.refreshToken) return unexpired;
+    try {
+      const issuedAt = clock.now();
+      const answer = await client.tokens.refresh({ refreshToken: data.refreshToken });
+      data.accessToken = answer.access_token;
+      data.accessTokenExpiresAt = issuedAt + lifetimeOf(answer.expires_in);
+      data.tokenType = answer.token_type ?? data.tokenType;
+      if (answer.refresh_token) data.refreshToken = answer.refresh_token;
+      if (answer.id_token) data.idToken = answer.id_token;
+      await replaceAccessTokenClaims(data.claims, answer.access_token, decrypt);
+      if (!await store.get(session.key)) {
+        await endSessionByKey(request, response, session.key);
+        return void 0;
+      }
+      expose(request, await write(session.key, data, session.expiresAt));
+      return answer.access_token;
+    } catch (error) {
+      report(error);
+      if (error instanceof AuthioProtocolError && error.error === AuthioOAuthErrors.InvalidGrant) {
+        await endSessionByKey(request, response, session.key);
+        return void 0;
+      }
+      return unexpired;
+    }
+  };
+  const sessionAccessToken = async (request, response) => {
+    const session = await loadSession(request, response);
+    if (!session) return void 0;
+    if (isFresh(session.data, settings.tokenRefreshSkewMs)) return session.data.accessToken;
+    return locks.run(session.key, async () => {
+      const current = await read(session.key);
+      if (!current) {
+        await endSessionByKey(request, response, session.key);
+        return void 0;
+      }
+      if (isFresh(current.data, settings.tokenRefreshSkewMs)) {
+        expose(request, current);
+        return current.data.accessToken;
+      }
+      return refresh(request, response, current);
+    });
+  };
+  const getUserAccessToken = async (request, response, tokenOptions = {}) => {
+    const scopes = [...new Set((tokenOptions.scopes ?? []).map((scope) => scope.trim()).filter(Boolean))].sort();
+    const resource = tokenOptions.resource?.trim() || void 0;
+    const subjectToken = await sessionAccessToken(request, response);
+    if (!subjectToken || !resource && scopes.length === 0) return subjectToken;
+    const session = await loadSession(request, response);
+    if (!session) return void 0;
+    const cacheKey = `${session.key}|${resource ?? ""}|${scopes.join(" ")}`;
+    const cached = exchanges.get(cacheKey);
+    if (cached && clock.now() < cached.refreshAt) return cached.accessToken;
+    return locks.run(cacheKey, async () => {
+      const again = exchanges.get(cacheKey);
+      if (again && clock.now() < again.refreshAt) return again.accessToken;
+      const issuedAt = clock.now();
+      const answer = await client.tokens.exchange({ subjectToken, scopes: scopes.length > 0 ? scopes : void 0, resource });
+      const lifetime = lifetimeOf(answer.expires_in);
+      for (const [key, entry] of exchanges) if (entry.expiresAt <= issuedAt) exchanges.delete(key);
+      exchanges.set(cacheKey, {
+        sessionKey: session.key,
+        accessToken: answer.access_token,
+        refreshAt: issuedAt + lifetime - Math.min(settings.tokenRefreshSkewMs, lifetime / 2),
+        expiresAt: issuedAt + lifetime
+      });
+      return answer.access_token;
+    });
+  };
+  const endIfInactive = async (request, response) => {
+    const session = await loadSession(request, response);
+    if (session && await isActive(session.data) === false) await endSessionByKey(request, response, session.key);
+  };
+  const antiForgery = (request) => hasAntiForgeryHeader(request, settings.antiForgeryHeaderName, settings.antiForgeryHeaderValue);
+  const antiForgeryRequired = (response) => sendError(response, 401, "antiforgery_required", `The ${settings.antiForgeryHeaderName} header is required.`);
+  const startLogin = async (request, response, parameters) => {
+    const { url, transaction } = await client.createAuthorizationUrl({
+      redirectUri: settings.redirectUri ?? requestBase(request) + settings.callbackPath,
+      scopes: settings.scopes,
+      resource: parameters.resource ?? settings.resource,
+      organization: parameters.organization ?? settings.organization,
+      prompt: parameters.prompt ?? settings.prompt,
+      loginHint: parameters.loginHint,
+      uiLocales: parameters.uiLocales ?? settings.uiLocales,
+      maxAge: parameters.maxAge ?? settings.maxAge,
+      extraParameters: settings.additionalAuthorizationParameters
+    });
+    const state = { transaction, returnUrl: parameters.returnUrl, expiresAt: clock.now() + loginLifetimeMs };
+    setCookie(response, loginCookieName(transaction.state), protector.seal("login", state), "lax", AuthioBffDefaults.LoginLifetime);
+    response.set("Cache-Control", "no-store").redirect(302, url);
+  };
+  const login = async (request, response) => {
+    const query = readQuery(request);
+    const returnUrl = query.get("returnUrl") ?? "";
+    const prompt = query.get("prompt") ?? "";
+    const maxAge = query.get("max_age") ?? "";
+    const resource = query.get("resource") ?? "";
+    if (returnUrl && !isLocalUrl(returnUrl)) return sendError(response, 400, "invalid_request", "returnUrl must be a local URL.");
+    if (prompt && !AuthioPrompts.includes(prompt))
+      return sendError(response, 400, "invalid_request", "prompt must be none, login, select_account or consent.");
+    if (maxAge && !/^\d+$/.test(maxAge)) return sendError(response, 400, "invalid_request", "max_age must be a number of seconds.");
+    if (resource && resource !== settings.resource && !settings.allowedResources.includes(resource))
+      return sendError(response, 400, "invalid_target", "The resource is not allowed by allowedResources.");
+    await startLogin(request, response, {
+      returnUrl: returnUrl || settings.defaultReturnUrl,
+      prompt: prompt || void 0,
+      loginHint: query.get("login_hint") || void 0,
+      uiLocales: query.get("ui_locales") || void 0,
+      maxAge: maxAge ? Number(maxAge) : void 0,
+      organization: query.get("organization") || void 0,
+      resource: resource || void 0
+    });
+  };
+  const silentLogin = (request, response) => startLogin(request, response, { returnUrl: `${request.baseUrl ?? ""}${prefix}/silent-login-callback`, prompt: "none" });
+  const callback = async (request, response) => {
+    const query = readQuery(request);
+    const state = query.get("state") ?? "";
+    const cookieName = state ? loginCookieName(state) : void 0;
+    const sealed = cookieName ? readCookies(request).get(cookieName) : void 0;
+    const pending = sealed ? protector.open("login", sealed) : void 0;
+    if (cookieName && sealed) setCookie(response, cookieName, "", "lax", 0);
+    response.set("Cache-Control", "no-store");
+    const fail = (target2, error) => response.redirect(302, withQueryParameter(target2, "error", error));
+    if (!pending || pending.transaction?.state !== state || pending.expiresAt <= clock.now()) return fail(settings.defaultReturnUrl, "login_failed");
+    const target = isLocalUrl(pending.returnUrl) ? pending.returnUrl : settings.defaultReturnUrl;
+    if (settings.requireIssuerParameter && !query.has("iss") && !query.has("error")) return fail(target, "login_failed");
+    let data;
+    try {
+      const { tokens, idToken } = await client.handleAuthorizationCallback(query, pending.transaction);
+      const now = clock.now();
+      const claims = toSessionClaims(idToken, await readAccessTokenSubject(tokens.access_token, decrypt));
+      await replaceAccessTokenClaims(claims, tokens.access_token, decrypt);
+      if (settings.getClaimsFromUserInfoEndpoint) mergeUserInfo(claims, await client.userInfo(tokens.access_token));
+      data = {
+        publicId: randomBytes(16).toString("hex"),
+        claims,
+        accessToken: tokens.access_token,
+        accessTokenExpiresAt: now + lifetimeOf(tokens.expires_in),
+        refreshToken: tokens.refresh_token,
+        idToken: tokens.id_token,
+        tokenType: tokens.token_type,
+        resource: pending.transaction.resource,
+        createdAt: now,
+        validatedAt: now
+      };
+    } catch (error) {
+      report(error);
+      return fail(target, error instanceof AuthioProtocolError ? error.error : "login_failed");
+    }
+    const previous = readCookies(request).get(settings.cookieName);
+    const previousId = previous ? protector.unsign(previous) : void 0;
+    if (previousId) {
+      await store.delete(settings.sessionKeyPrefix + previousId);
+      dropExchanges(settings.sessionKeyPrefix + previousId);
+    }
+    const id = randomBytes(32).toString("hex");
+    expose(request, await write(settings.sessionKeyPrefix + id, data, clock.now() + settings.sessionLifetimeMs));
+    setCookie(response, settings.cookieName, protector.sign(id), settings.cookieSameSite);
+    response.redirect(302, target);
+  };
+  const user = async (request, response) => {
+    if (!antiForgery(request)) return antiForgeryRequired(response);
+    const session = await loadSession(request, response);
+    if (!session) return sendError(response, 401, "unauthorized", "Nobody is signed in.");
+    const expiresIn = Math.max(0, Math.floor((session.expiresAt - clock.now()) / 1e3));
+    const logoutUrl = `${request.baseUrl ?? ""}${prefix}/logout?sid=${encodeURIComponent(session.data.publicId)}`;
+    response.set("Cache-Control", "no-store").json(toAuthioBffClaims(session.data.claims, expiresIn, logoutUrl));
+  };
+  const logout = async (request, response) => {
+    const query = readQuery(request);
+    const returnUrl = query.get("returnUrl") ?? "";
+    if (returnUrl && !isLocalUrl(returnUrl)) return sendError(response, 400, "invalid_request", "returnUrl must be a local URL.");
+    const target = returnUrl || settings.defaultReturnUrl;
+    const session = await loadSession(request, response);
+    response.set("Cache-Control", "no-store");
+    if (!session) {
+      clearCookie(response);
+      return response.redirect(302, target);
+    }
+    if (!antiForgery(request) && !fixedTimeEquals(query.get("sid") ?? "", session.data.publicId))
+      return sendError(response, 400, "invalid_request", `Logging out requires the ${settings.antiForgeryHeaderName} header or the session's sid parameter.`);
+    if (settings.revokeRefreshTokenOnLogout && session.data.refreshToken) {
+      try {
+        await client.revoke(session.data.refreshToken, { tokenTypeHint: AuthioTokenTypes.RefreshToken });
+      } catch (error) {
+        report(error);
+      }
+    }
+    await endSessionByKey(request, response, session.key);
+    const document = await client.discovery.get();
+    if (!document.end_session_endpoint) return response.redirect(302, target);
+    const endSessionUrl = await client.createEndSessionUrl({
+      idTokenHint: session.data.idToken,
+      postLogoutRedirectUri: settings.postLogoutRedirectUri ?? requestBase(request) + settings.signedOutCallbackPath,
+      state: protector.seal("logout-state", { returnUrl: target, expiresAt: clock.now() + loginLifetimeMs }),
+      uiLocales: settings.uiLocales
+    });
+    response.redirect(302, endSessionUrl);
+  };
+  const signedOutCallback = (request, response) => {
+    const state = readQuery(request).get("state");
+    const value = state ? protector.open("logout-state", state) : void 0;
+    const target = value && value.expiresAt > clock.now() && isLocalUrl(value.returnUrl) ? value.returnUrl : settings.defaultReturnUrl;
+    response.set("Cache-Control", "no-store").redirect(302, target);
+  };
+  const silentLoginCallback = async (request, response) => {
+    const session = await loadSession(request, response);
+    const error = readQuery(request).get("error") || null;
+    const message = JSON.stringify({ source: AuthioBffDefaults.SilentLoginMessageSource, isLoggedIn: Boolean(session) && !error, error }).replace(
+      /[^ -~]|[<>&]/g,
+      (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`
+    );
+    response.set("Cache-Control", "no-store").type("text/html; charset=utf-8").send(
+      `<!doctype html><html><head><meta charset="utf-8"><title>Authio</title></head><body><script>(function(){var m=${message};(window.parent!==window?window.parent:window.opener||window).postMessage(m,window.location.origin);})();</script></body></html>`
+    );
+  };
+  const backChannelLogout = async (request, response) => {
+    response.set("Cache-Control", "no-store");
+    if (!settings.backChannelLogout) return void response.status(404).end();
+    const token = await readFormField(request, "logout_token");
+    if (!token?.trim()) return sendError(response, 400, "invalid_request", "The logout_token form field is required.");
+    let logout2;
+    try {
+      logout2 = await client.validateLogoutToken(token);
+    } catch (error) {
+      report(error);
+      if (!(error instanceof AuthioError)) throw error;
+      return sendError(response, 400, "invalid_request", "The logout token is not valid.");
+    }
+    if (logout2.sessionId) await store.deleteBySessionId(logout2.sessionId);
+    else if (logout2.subject) await store.deleteBySubject(logout2.subject);
+    response.status(200).end();
+  };
+  const routes = /* @__PURE__ */ new Map([
+    [settings.callbackPath, { methods: ["GET"], run: callback }],
+    [settings.signedOutCallbackPath, { methods: ["GET"], run: signedOutCallback }],
+    [`${prefix}/login`, { methods: ["GET"], run: login }],
+    [`${prefix}/logout`, { methods: ["GET", "POST"], run: logout }],
+    [`${prefix}/user`, { methods: ["GET"], run: user }],
+    [`${prefix}/silent-login`, { methods: ["GET"], run: silentLogin }],
+    [`${prefix}/silent-login-callback`, { methods: ["GET"], run: silentLoginCallback }],
+    [`${prefix}/backchannel-logout`, { methods: ["POST"], run: backChannelLogout }]
+  ]);
+  const middleware = (request, response, next) => {
+    const route = routes.get(request.path.replace(/(.)\/+$/, "$1"));
+    if (route && route.methods.includes(request.method)) {
+      Promise.resolve().then(() => route.run(request, response)).catch(next);
+      return;
+    }
+    loadSession(request, response).then(() => next(), next);
+  };
+  const bff = middleware;
+  return Object.assign(bff, {
+    client,
+    store,
+    api(apiOptions = {}) {
+      return (request, response, next) => {
+        if (apiOptions.requireAntiForgery !== false && !antiForgery(request)) return antiForgeryRequired(response);
+        loadSession(request, response).then((session) => {
+          if (!session && !apiOptions.optional) return sendError(response, 401, "unauthorized", "Sign in first.");
+          next();
+        }, next);
+      };
+    },
+    remoteApi(destination, remoteOptions = {}) {
+      const remote = resolveRemoteApi(destination, remoteOptions);
+      return (request, response, next) => {
+        forwardToRemoteApi(request, response, remote, {
+          antiForgery: () => antiForgery(request),
+          antiForgeryHeaderName: settings.antiForgeryHeaderName,
+          hasSession: async () => Boolean(await loadSession(request, response)),
+          userToken: () => getUserAccessToken(request, response, { resource: remote.resource, scopes: remote.scopes }),
+          clientToken: async () => (await client.clientCredentials.getToken({ scopes: remote.scopes, resource: remote.resource })).accessToken,
+          endIfInactive: () => endIfInactive(request, response)
+        }).catch(next);
+      };
+    },
+    async getSession(request, response) {
+      const session = await loadSession(request, response);
+      return session ? toInfo(session) : void 0;
+    },
+    getUserAccessToken,
+    userFetch(request, response, fetchOptions = {}) {
+      const inner = fetchOptions.fetch ?? client.connection.fetch;
+      return async (input, init) => {
+        const token = await getUserAccessToken(request, response, fetchOptions);
+        const headers = new Headers(init?.headers ?? (input instanceof globalThis.Request ? input.headers : void 0));
+        if (token) headers.set("authorization", `Bearer ${token}`);
+        return inner(input, { ...init, headers });
+      };
+    },
+    async endSession(request, response) {
+      const session = await loadSession(request, response);
+      if (session) await endSessionByKey(request, response, session.key);
+    }
+  });
+}
+function lifetimeOf(expiresIn) {
+  return (expiresIn && expiresIn > 0 ? expiresIn : AuthioDefaults.AssumedTokenLifetime) * 1e3;
+}
+function textOf(value) {
+  return typeof value === "string" && value ? value : void 0;
+}
+function fixedTimeEquals(left, right) {
+  const a = Buffer.from(left, "utf8");
+  const b = Buffer.from(right, "utf8");
+  return a.length > 0 && a.length === b.length && timingSafeEqual(a, b);
+}
+
+export { AuthioBffClaimTypes, AuthioBffDefaults, authioBff, createAuthioBffMemoryStore, isLocalUrl };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map