@jimhoyd/urlcode-auth 0.1.0-alpha.1 → 0.1.0-alpha.2

package/dist/auth-flows.d.ts

@@ -0,0 +1,30 @@
+import type { PresentationContext } from './presentation.ts';
+import type { Presentation } from './presentation.ts';
+import type { RegistrationInput } from './registration.ts';
+import type { ExtensionRequest } from '@jimhoyd/urlcode/extensions';
+import type { AuthService, AuthSessionResult } from './auth-core.ts';
+import type { OidcProvider } from './oidc.ts';
+import type { PasskeyProvider } from './passkeys.ts';
+import { AuthHttp } from './auth-ui.ts';
+import type { AuthHttpResponse, UiHost } from './auth-ui.ts';
+export interface AuthFlowOptions {
+    service: AuthService;
+    presentation?: Presentation;
+    ui?: UiHost;
+    onSession?: (request: ExtensionRequest, result: AuthSessionResult) => Promise<[
+        string,
+        string
+    ][]>;
+    providers?: Record<string, OidcProvider>;
+    passkeys?: PasskeyProvider;
+    enrollment?: {
+        required: boolean;
+        fields: (presentation?: PresentationContext) => string;
+        read: (fields: Record<string, string>) => RegistrationInput;
+        names: string[];
+    };
+}
+export declare function createAuthFlows(options: AuthFlowOptions, http: AuthHttp, mount: string, registration: boolean): {
+    buttons(csrf: string, link?: boolean, text?: (value: string) => string, locale?: string, presentation?: PresentationContext): string;
+    handle(request: ExtensionRequest): Promise<AuthHttpResponse | undefined>;
+};

package/dist/auth-flows.js

@@ -0,0 +1,228 @@
+import { createSecondFactorFlows } from "./second-factor-flows.js";
+import { createPresentation } from "./presentation.js";
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { AuthHttp, AuthHttpError, csrfField, escapeHtml, formField as baseField, jsonResponse, readFields, screenResponse, wantsJson, secondFactorButton } from "./auth-ui.js";
+import { Markup } from '@jimhoyd/urlcode-ui';
+const trustedCookie = '__Host-urlcode-trusted-device';
+const defaultPresentation = createPresentation();
+const id = () => randomBytes(32).toString('base64url');
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+function record(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new AuthHttpError(400, 'Invalid authentication flow');
+    return value;
+}
+function checkBinding(data, binding) {
+    const expected = typeof data.browserHash === 'string' ? data.browserHash : '';
+    if (!binding || !/^[a-f0-9]{64}$/.test(expected) || !timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(hash(binding), 'hex')))
+        throw new AuthHttpError(403, 'Authentication flow belongs to another browser');
+}
+function complex(request) {
+    if (request.body.byteLength > 16384)
+        throw new AuthHttpError(413, 'Request body too large');
+    if (request.headers.get('content-type')?.split(';')[0] !== 'application/json')
+        throw new AuthHttpError(415, 'JSON required');
+    try {
+        return record(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(request.body)));
+    }
+    catch {
+        throw new AuthHttpError(400, 'Invalid authentication payload');
+    }
+}
+function fresh(authenticatedAt) {
+    if (Date.now() - authenticatedAt > 300000)
+        throw new AuthHttpError(403, 'Confirm your identity first');
+}
+export function createAuthFlows(options, http, mount, registration) {
+    const service = options.service, providers = options.providers || {}, flowCookie = '__Host-urlcode-oidc';
+    const secondFactors = createSecondFactorFlows(options, http, mount);
+    const trusted = (request) => { const token = service.getSecurityPolicy().trustedDeviceTtlMs ? http.cookie(request, trustedCookie) : undefined; return token ? { trustedDevice: token } : {}; };
+    if (Object.keys(providers).length > 16 || Object.keys(providers).some(name => !/^[a-z][a-z0-9-]{0,31}$/.test(name)))
+        throw new Error('Invalid provider names');
+    const cookie = (value, maxAge = 600) => ['set-cookie', `${flowCookie}=${value}; Path=/; Secure; HttpOnly; SameSite=None; Max-Age=${maxAge}`];
+    const finish = async (request, result) => { const headers = options.onSession ? await options.onSession(request, result) : []; return wantsJson(request) ? jsonResponse(200, { user: result.user, csrf: http.token(result.token), ...(result.principal.restrictions ? { restrictions: result.principal.restrictions } : {}) }, [...http.sessionHeaders(result.token), cookie('', 0), ...headers]) : jsonResponse(303, { redirect: mount + '/account' }, [['location', mount + '/account'], ...http.sessionHeaders(result.token), cookie('', 0), ...headers]); };
+    return {
+        buttons(csrf, link = false, text = value => value, locale, presentation) { return Object.keys(providers).map(name => `<form method="post" action="${escapeHtml(mount + '/providers/' + name + (link ? '/link' : '/start') + (locale ? '?lang=' + encodeURIComponent(locale) : ''))}">${csrfField(csrf)}<button type="submit">${escapeHtml((presentation ?? defaultPresentation.resolve()).text(link ? 'provider.link' : 'provider.signIn', { provider: name }))}</button></form>`).join(''); },
+        async handle(request) {
+            let presentation = (options.presentation ?? defaultPresentation).resolve({ ...(request.query.get('lang') ? { queryLocale: request.query.get('lang') } : {}), ...(request.headers.get('accept-language') ? { acceptLanguage: request.headers.get('accept-language') } : {}) });
+            const tr = (key, values) => escapeHtml(presentation.text(key, values));
+            const formScreen = (title, name, form, headers, scriptPath) => screenResponse(title, { name: 'auth/' + name, view: { form: new Markup(form) } }, { status: 200, headers, scriptPath, presentation, layout: 'compact', ui: options.ui });
+            const formField = (name, label, type = 'text', autocomplete = 'off', required = true) => baseField(name, presentation?.textSource(label) ?? label, type, autocomplete, required);
+            const path = request.path.slice(mount.length), match = /^\/providers\/([a-z][a-z0-9-]{0,31})\/(start|link|callback)$/.exec(path);
+            if (match) {
+                const name = match[1], operation = match[2], provider = providers[name];
+                if (!provider)
+                    throw new AuthHttpError(404, 'Not found');
+                if (operation !== 'callback') {
+                    if (request.method !== 'POST')
+                        throw new AuthHttpError(405, 'POST required');
+                    const fields = readFields(request, []);
+                    http.verify(request, fields);
+                    let actorToken;
+                    if (operation === 'link') {
+                        actorToken = http.session(request);
+                        const actor = actorToken ? await service.authenticate(actorToken) : null;
+                        if (!actor)
+                            throw new AuthHttpError(401, 'Sign in required');
+                        fresh(actor.authenticatedAt);
+                    }
+                    const started = await provider.start(), browser = id(), destination = new URL(started.url);
+                    if (destination.protocol !== 'https:' || destination.username || destination.password)
+                        throw new AuthHttpError(502, 'Invalid provider response');
+                    await service.putFlow({ id: started.flow.state, kind: 'oidc', expires: Date.now() + 600000, data: { name, locale: presentation.locale, flow: started.flow, browserHash: hash(browser), ...(actorToken ? { actorToken } : {}) } });
+                    return jsonResponse(303, { redirect: destination.href }, [['location', destination.href], cookie(browser)]);
+                }
+                if (!['GET', 'POST'].includes(request.method))
+                    throw new AuthHttpError(405, 'GET or POST required');
+                if (request.body.byteLength > 16384)
+                    throw new AuthHttpError(413, 'Request body too large');
+                const callback = new URL(request.target, http.origin), parameters = request.method === 'POST' ? new URLSearchParams(new TextDecoder('utf-8', { fatal: true }).decode(request.body)) : callback.searchParams;
+                if (request.method === 'POST' && request.headers.get('content-type')?.split(';')[0] !== 'application/x-www-form-urlencoded')
+                    throw new AuthHttpError(415, 'Form callback required');
+                const states = parameters.getAll('state');
+                if (states.length !== 1 || states[0].length > 256)
+                    throw new AuthHttpError(400, 'Invalid provider state');
+                const data = record(await service.consumeFlow(states[0], 'oidc'));
+                if (typeof data.locale === 'string')
+                    presentation = (options.presentation ?? defaultPresentation).resolve({ queryLocale: data.locale });
+                checkBinding(data, http.cookie(request, flowCookie));
+                if (data.name !== name)
+                    throw new AuthHttpError(400, 'Provider flow mismatch');
+                const identity = await provider.complete(request.method === 'POST' ? new Request(callback, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new Uint8Array(request.body).buffer }) : callback, data.flow);
+                let issuer;
+                try {
+                    issuer = new URL(identity.issuer);
+                }
+                catch {
+                    throw new AuthHttpError(401, 'Invalid identity issuer');
+                }
+                if (issuer.protocol !== 'https:' || issuer.username || issuer.password || identity.issuer.length > 2048)
+                    throw new AuthHttpError(401, 'Invalid identity issuer');
+                const identityProvider = 'oidc-' + createHash('sha256').update(identity.issuer).digest('hex').slice(0, 56);
+                if (typeof data.actorToken === 'string') {
+                    await service.linkExternal({ actorToken: data.actorToken, provider: identityProvider, subject: identity.subject });
+                    return jsonResponse(303, { linked: true }, [['location', mount + '/account'], cookie('', 0), ...http.sessionHeaders(data.actorToken)]);
+                }
+                let externalProof = await service.getExternalProof(identityProvider, identity.subject), user = externalProof?.user;
+                if (user?.profile?.locale)
+                    presentation = (options.presentation ?? defaultPresentation).resolve({ accountLocale: user.profile.locale, queryLocale: presentation.locale });
+                if (!user) {
+                    if (!registration || !identity.email || !identity.emailVerified)
+                        throw new AuthHttpError(403, 'An existing linked account is required');
+                    if (options.enrollment?.required) {
+                        const enrollment = id();
+                        await service.putFlow({ id: enrollment, kind: 'oidc-enrollment', expires: Date.now() + 600000, data: { email: identity.email, provider: identityProvider, subject: identity.subject, browserHash: data.browserHash, locale: presentation.locale } });
+                        const browser = http.prepare(request);
+                        return formScreen('Complete your account', 'provider-enroll', `<form method="post" action="${escapeHtml(mount + '/providers/enroll?lang=' + encodeURIComponent(presentation.locale))}">${csrfField(browser.csrf)}<input type="hidden" name="flowId" value="${escapeHtml(enrollment)}">${options.enrollment.fields(presentation)}<button type="submit">${tr("action.register")}</button></form>`, browser.headers);
+                    }
+                    user = await service.createExternalAccount({ email: identity.email, emailVerified: true, provider: identityProvider, subject: identity.subject });
+                    externalProof = await service.getExternalProof(identityProvider, identity.subject);
+                }
+                if (!externalProof || externalProof.user.id !== user.id)
+                    throw new AuthHttpError(401, 'Identity changed during sign in');
+                if (user.totpEnabled || user.passkeyMfaEnabled) {
+                    const extraHeaders = [];
+                    if (trusted(request).trustedDevice) {
+                        try {
+                            return finish(request, await service.issueSession(user.id, { device: http.device(request), ...trusted(request), method: 'oidc', proof: externalProof.proof }));
+                        }
+                        catch (error) {
+                            if (!(error instanceof Error) || !('code' in error) || error.code !== 'invalid_trusted_device')
+                                throw error;
+                            extraHeaders.push(['set-cookie', http.setCookie(trustedCookie, '', 0)]);
+                        }
+                    }
+                    const pending = id();
+                    await service.putFlow({ id: pending, kind: 'oidc-mfa', expires: Date.now() + 300000, data: { accountId: user.id, proof: externalProof.proof, browserHash: data.browserHash, locale: presentation.locale } });
+                    const browser = http.prepare(request);
+                    return formScreen('Confirm second factor', 'provider-second-factor', `<form method="post" action="${escapeHtml(mount + '/providers/complete?lang=' + encodeURIComponent(presentation.locale))}">${csrfField(browser.csrf)}<input type="hidden" name="flowId" value="${escapeHtml(pending)}">${formField('totp', 'Authenticator code', 'text', 'one-time-code', false)}${formField('recoveryCode', 'Recovery code (instead of authenticator code)', 'text', 'off', false)}${service.getSecurityPolicy().allowPasskeySecondFactor && options.passkeys ? secondFactorButton(mount, value => presentation.textSource(value)) : ''}<button type="submit">${tr("action.completeSignIn")}</button></form>`, [...browser.headers, ...extraHeaders], options.passkeys ? mount + '/assets/passkeys.js' : undefined);
+                }
+                return finish(request, await service.issueSession(user.id, { device: http.device(request), ...trusted(request), method: 'oidc', proof: externalProof.proof }));
+            }
+            if (path === '/providers/enroll') {
+                if (request.method !== 'POST' || !registration || !options.enrollment)
+                    throw new AuthHttpError(404, 'Not found');
+                const fields = readFields(request, ['flowId', ...options.enrollment.names]);
+                http.verify(request, fields);
+                const data = record(await service.consumeFlow(fields.flowId || '', 'oidc-enrollment'));
+                checkBinding(data, http.cookie(request, flowCookie));
+                if (typeof data.email !== 'string' || typeof data.provider !== 'string' || typeof data.subject !== 'string')
+                    throw new AuthHttpError(400, 'Invalid enrollment');
+                const user = await service.createExternalAccount({ email: data.email, emailVerified: true, provider: data.provider, subject: data.subject, profile: options.enrollment.read(fields) });
+                const externalProof = await service.getExternalProof(data.provider, data.subject);
+                if (!externalProof || externalProof.user.id !== user.id)
+                    throw new AuthHttpError(401, 'Identity changed during enrollment');
+                return finish(request, await service.issueSession(user.id, { device: http.device(request), ...trusted(request), method: 'oidc', proof: externalProof.proof }));
+            }
+            if (path === '/providers/complete') {
+                if (request.method !== 'POST')
+                    throw new AuthHttpError(405, 'POST required');
+                const fields = readFields(request, ['flowId', 'totp', 'recoveryCode', 'secondFactorToken']);
+                http.verify(request, fields);
+                const data = record(await service.consumeFlow(fields.flowId || '', 'oidc-mfa'));
+                checkBinding(data, http.cookie(request, flowCookie));
+                if (typeof data.accountId !== 'string')
+                    throw new AuthHttpError(400, 'Invalid authentication flow');
+                return finish(request, await service.issueSession(data.accountId, { device: http.device(request), method: 'oidc', proof: record(data.proof), ...(fields.totp ? { totp: fields.totp } : {}), ...(fields.recoveryCode ? { recoveryCode: fields.recoveryCode } : {}), ...(fields.secondFactorToken ? { secondFactor: secondFactors.proof(request, fields.secondFactorToken) } : {}), ...trusted(request) }));
+            }
+            const ceremony = /^\/passkeys\/(register|login|step-up)\/(options|verify)$/.exec(path);
+            if (!ceremony)
+                return undefined;
+            if (!options.passkeys)
+                throw new AuthHttpError(404, 'Not found');
+            if (request.method !== 'POST')
+                throw new AuthHttpError(405, 'POST required');
+            const body = complex(request);
+            if (Object.keys(body).some(key => !['csrf', 'flowId', 'response', 'totp', 'recoveryCode', 'secondFactorToken'].includes(key)))
+                throw new AuthHttpError(400, 'Unknown authentication field');
+            http.verify(request, typeof body.csrf === 'string' ? { csrf: body.csrf } : {});
+            const session = http.session(request), binding = session || http.cookie(request, http.flowCookie);
+            if (!binding)
+                throw new AuthHttpError(403, 'Browser flow required');
+            const kind = ceremony[1], phase = ceremony[2], actor = session ? await service.authenticate(session) : null;
+            if (kind === 'step-up' && (!session || !actor || actor.impersonatorId))
+                throw new AuthHttpError(401, 'Sign in required');
+            if (kind === 'register') {
+                if (!session || !actor)
+                    throw new AuthHttpError(401, 'Sign in required');
+                fresh(actor.authenticatedAt);
+            }
+            if (phase === 'options') {
+                const generated = kind === 'register' ? await options.passkeys.beginRegistration({ id: actor.id, email: actor.email }, await service.listPasskeys(actor.id)) : await options.passkeys.beginAuthentication();
+                const flowId = id();
+                await service.putFlow({ id: flowId, kind: 'passkey-' + kind, expires: Date.now() + 300000, data: { challenge: generated.challenge, browserHash: hash(binding), ...(actor ? { accountId: actor.id } : {}) } });
+                return jsonResponse(200, { options: generated, flowId });
+            }
+            if (typeof body.flowId !== 'string')
+                throw new AuthHttpError(400, 'Flow ID required');
+            const data = record(await service.consumeFlow(body.flowId, 'passkey-' + kind));
+            checkBinding(data, binding);
+            if (typeof data.challenge !== 'string')
+                throw new AuthHttpError(400, 'Invalid challenge');
+            const response = record(body.response);
+            if (typeof response.id !== 'string')
+                throw new AuthHttpError(400, 'Invalid credential');
+            if (kind === 'register') {
+                if (data.accountId !== actor.id)
+                    throw new AuthHttpError(403, 'Account changed during ceremony');
+                const credential = await options.passkeys.verifyRegistration(response, data.challenge);
+                await service.addPasskey({ actorToken: session, credential });
+                return jsonResponse(200, { registered: true });
+            }
+            const stored = await service.getPasskey(response.id);
+            if (!stored)
+                throw new AuthHttpError(401, 'Passkey authentication failed');
+            if (kind === 'step-up' && (stored.accountId !== actor.id || data.accountId !== actor.id))
+                throw new AuthHttpError(403, 'Passkey belongs to another account');
+            const verified = await options.passkeys.verifyAuthentication(response, data.challenge, stored.credential);
+            const proof = { ...stored.proof, newCounter: verified.counter };
+            if (body.secondFactorToken !== undefined && typeof body.secondFactorToken !== 'string')
+                throw new AuthHttpError(400, 'Invalid second-factor proof');
+            if (body.totp !== undefined && typeof body.totp !== 'string' || body.recoveryCode !== undefined && typeof body.recoveryCode !== 'string')
+                throw new AuthHttpError(400, 'Invalid second factor');
+            if (kind === 'step-up')
+                return finish(request, await service.completeStepUp({ token: session, accountId: stored.accountId, method: 'passkey', proof, ...(typeof body.totp === 'string' && body.totp ? { totp: body.totp } : {}), ...(typeof body.recoveryCode === 'string' && body.recoveryCode ? { recoveryCode: body.recoveryCode } : {}), ...(typeof body.secondFactorToken === 'string' && body.secondFactorToken ? { secondFactor: secondFactors.proof(request, body.secondFactorToken) } : {}) }));
+            return finish(request, await service.issueSession(stored.accountId, { device: http.device(request), ...trusted(request), method: 'passkey', proof, ...(typeof body.totp === 'string' && body.totp ? { totp: body.totp } : {}), ...(typeof body.recoveryCode === 'string' && body.recoveryCode ? { recoveryCode: body.recoveryCode } : {}), ...(typeof body.secondFactorToken === 'string' && body.secondFactorToken ? { secondFactor: secondFactors.proof(request, body.secondFactorToken) } : {}) }));
+        },
+    };
+}

package/dist/auth-signup.d.ts

@@ -0,0 +1,11 @@
+import type { ExtensionRequest } from '@jimhoyd/urlcode/extensions';
+import type { AuthExtensionOptions } from './auth.ts';
+import type { PresentationContext } from './presentation.ts';
+import type { RegistrationInput } from './registration.ts';
+import { AuthHttp } from './auth-ui.ts';
+/** Operator-owned signup orchestration. Only opaque browser-bound state is held in cookies. */
+export declare function createSignup(options: AuthExtensionOptions, http: AuthHttp, mount: string, profile: {
+    fields(p: PresentationContext): string;
+    read(fields: Record<string, string>): RegistrationInput;
+    names: string[];
+}): (request: ExtensionRequest, presentation: PresentationContext) => Promise<import("./auth-ui.ts").AuthHttpResponse | undefined>;

package/dist/auth-signup.js

@@ -0,0 +1,145 @@
+import { field as uiField, icon } from '@jimhoyd/urlcode-ui';
+import { createHash, randomBytes } from 'node:crypto';
+import { AuthHttp, AuthHttpError, csrfField, escapeHtml, formField, jsonResponse, readFields, screenResponse, wantsJson } from "./auth-ui.js";
+import { Markup } from '@jimhoyd/urlcode-ui';
+/** Operator-owned signup orchestration. Only opaque browser-bound state is held in cookies. */
+export function createSignup(options, http, mount, profile) {
+    const service = options.service, browserCookie = '__Host-urlcode-signup-browser', flowCookie = '__Host-urlcode-signup';
+    const clear = () => [['set-cookie', http.setCookie(flowCookie, '', 0)]];
+    async function delivery(message, locale) {
+        const controller = new AbortController();
+        let timer;
+        try {
+            const operation = message.kind === 'signup-code' ? options.sendSignupCode?.({ email: message.email, code: message.code, locale, signal: controller.signal }) : options.sendNotice?.({ email: message.email, event: message.kind === 'new-device' ? 'new-device' : 'registration-attempt', locale, signal: controller.signal });
+            if (!operation && message.kind === 'signup-code')
+                throw new AuthHttpError(503, 'Email delivery is not configured');
+            if (operation)
+                await Promise.race([operation, new Promise((_, reject) => { timer = setTimeout(() => { controller.abort(); reject(new Error('Delivery timeout')); }, 5000); })]);
+        }
+        catch { /* The same public result is returned for every eligible identifier. */ }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    return async function handle(request, presentation) {
+        const path = request.path.slice(mount.length);
+        if (path !== '/signup' && !path.startsWith('/signup/'))
+            return undefined;
+        if (!['open', 'invite-only', 'waitlist'].includes(service.getRegistrationMode()))
+            throw new AuthHttpError(403, 'Registration is disabled');
+        if (!['GET', 'HEAD', 'POST'].includes(request.method))
+            return jsonResponse(405, { error: 'Method not allowed' }, [['allow', 'GET, HEAD, POST']]);
+        const existingBrowser = http.cookie(request, browserCookie), browser = existingBrowser || randomBytes(32).toString('base64url'), browserHash = createHash('sha256').update(browser).digest('hex');
+        const flowId = http.cookie(request, flowCookie), binding = flowId ? { flowId, browserHash } : undefined;
+        const prepared = http.prepare(request), headers = [...prepared.headers, ['set-cookie', http.setCookie(browserCookie, browser, 1800)]];
+        const text = (source) => presentation.textSource(source), e = (source) => escapeHtml(text(source));
+        const route = mount + '/signup?lang=' + encodeURIComponent(presentation.locale);
+        const redirect = (extra = []) => (jsonResponse(303, { redirect: route }, [['location', route], ...headers, ...extra]));
+        const form = (action, fields, button) => `<form class="ui-stack" method="post" action="${escapeHtml(mount + '/signup/' + action + '?lang=' + encodeURIComponent(presentation.locale))}">${csrfField(prepared.csrf)}${fields}<button>${action === 'begin' || action === 'password' ? icon('arrow-right') : action === 'verify' ? icon('check') : action === 'complete' ? icon('user') : ''}${e(button)}</button></form>`;
+        const field = (name, label, type = 'text', autocomplete = 'off') => formField(name, text(label), type, autocomplete);
+        if (request.method !== 'POST') {
+            if (path === '/signup/pending')
+                return wantsJson(request) ? jsonResponse(200, { pending: true }, headers) : screenResponse('Request an account', { name: 'auth/status', view: { alert: false, message: text('Your request has been received. If eligible, an administrator will review it before you can sign in.'), href: null, label: null } }, { status: 200, headers, presentation, layout: 'compact', ui: options.ui });
+            let state;
+            if (binding) {
+                state = await service.getSignup(binding);
+                if (!state)
+                    headers.push(...clear());
+            }
+            if (wantsJson(request))
+                return jsonResponse(200, { step: state?.step ?? 'identifier', csrf: prepared.csrf, ...(state ? { expires: state.expires } : {}) }, headers);
+            const verificationRequired = service.getSecurityPolicy().requireEmailVerification;
+            const steps = ['Email address', ...(verificationRequired ? ['Verify email'] : []), 'Secure your account', 'Your details'];
+            const currentStep = !state ? 0 : state.step === 'verify-email' ? 1 : state.step === 'credential' ? (verificationRequired ? 2 : 1) : steps.length - 1;
+            const progress = steps.map((label, index) => ({ number: index + 1, label: text(label), current: index === currentStep }));
+            const title = !state ? (service.getRegistrationMode() === 'waitlist' ? 'Request an account' : 'Create account') : state.step === 'verify-email' ? 'Check your email' : state.step === 'credential' ? (options.passkeys ? 'Secure your account' : 'Create a password') : 'Your details';
+            let intro, markup, passkey = '', identifier = null;
+            if (!state) {
+                const invitations = request.query.getAll('token');
+                if (invitations.length > 1 || (invitations[0] && !/^[A-Za-z0-9_-]{43}$/.test(invitations[0])))
+                    throw new AuthHttpError(400, 'Invalid invitation');
+                intro = '';
+                markup = form('begin', field('email', 'Email address', 'email', 'email') + '<div hidden><label>Leave empty<input name="website" tabindex="-1" autocomplete="off"></label></div>' + (service.getRegistrationMode() === 'invite-only' ? (invitations[0] ? `<input type="hidden" name="invitationToken" value="${escapeHtml(invitations[0])}">` : field('invitationToken', 'Invitation token')) : ''), 'Continue');
+            }
+            else if (state.step === 'verify-email') {
+                intro = text('If this address is eligible, a signup code has been sent. Enter the code to continue.');
+                identifier = state.email;
+                markup = form('verify', field('code', 'Email code', 'text', 'one-time-code'), 'Verify email');
+            }
+            else if (state.step === 'credential') {
+                intro = options.passkeys ? text('Use a password or passkey.') : '';
+                markup = form('password', uiField({ name: 'password', label: text('Password'), type: 'password', autocomplete: 'new-password', required: true, description: text('At least 15 characters. Use a unique password.') }), 'Continue');
+                passkey = options.passkeys ? `<button class="ui-button-secondary" type="button" data-passkey="signup" data-base="${escapeHtml(mount)}" data-failed="${e('Passkey request failed')}" data-unavailable="${e('Passkeys are unavailable in this browser. Use another sign-in method.')}" data-cancelled="${e('Passkey ceremony cancelled')}">${e('Create a passkey')}</button><p role="status" aria-live="polite" data-passkey-status></p>` : '';
+            }
+            else {
+                intro = service.getRegistrationMode() === 'waitlist' ? text('An administrator must approve your request.') : '';
+                markup = form('complete', profile.fields(presentation), service.getRegistrationMode() === 'waitlist' ? 'Request account' : 'Create account');
+            }
+            const restart = state ? { summary: text('Use a different email address'), help: text('Starting again clears this signup progress. No account is created until you finish.'), form: new Markup(form('restart', '', 'Start again').replace('<button>', '<button class="ui-button-secondary">')) } : null;
+            const view = { progressLabel: presentation.text('ux.signupProgress', { current: currentStep + 1, total: steps.length }), stepsLabel: text('Account setup progress'), steps: progress, email: state && state.step !== 'verify-email' ? state.email : null, changeLabel: text('Change'), intro, identifier, form: new Markup(markup), passkey: new Markup(passkey), restart, signInPrompt: text('Already have an account?'), signInHref: mount + '/login?lang=' + encodeURIComponent(presentation.locale), signInLabel: text('Sign in') };
+            return screenResponse(title, { name: 'auth/signup', view }, { status: 200, headers, scriptPath: state?.step === 'credential' && options.passkeys ? mount + '/assets/passkeys.js' : undefined, presentation, turnstile: !state ? options.challenge?.widget : undefined, layout: 'compact', ui: options.ui });
+        }
+        if (!existingBrowser)
+            throw new AuthHttpError(403, 'Signup browser binding required');
+        // WebAuthn returns nested JSON; parse its bounded envelope separately from ordinary form fields.
+        if (path === '/signup/passkeys/verify') {
+            http.verify(request, {});
+            if (!binding || !options.passkeys || request.body.byteLength > 16384 || request.headers.get('content-type')?.split(';')[0] !== 'application/json')
+                throw new AuthHttpError(400, 'Invalid passkey request');
+            let payload;
+            try {
+                payload = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(request.body));
+            }
+            catch {
+                throw new AuthHttpError(400, 'Invalid passkey request');
+            }
+            if (!payload || typeof payload !== 'object' || Array.isArray(payload) || Object.keys(payload).some(key => !['response', 'flowId'].includes(key)))
+                throw new AuthHttpError(400, 'Invalid passkey request');
+            const pending = await service.getSignupPasskeyChallenge(binding), credential = await options.passkeys.verifyRegistration(payload.response, pending.challenge);
+            await service.setSignupPasskey({ ...binding, challenge: pending.challenge, credential });
+            return jsonResponse(200, { step: 'profile' }, headers);
+        }
+        const fields = readFields(request, ['email', 'invitationToken', 'code', 'password', 'website', ...profile.names]);
+        http.verify(request, fields);
+        if (path === '/signup/restart')
+            return redirect(clear());
+        if (path === '/signup/begin') {
+            if (service.getSecurityPolicy().requireEmailVerification && !options.sendSignupCode)
+                throw new AuthHttpError(503, 'Email delivery is not configured');
+            const started = await service.beginSignup({ email: fields.email || '', browserHash, ...(fields.invitationToken ? { invitationToken: fields.invitationToken } : {}) });
+            if (started.delivery)
+                await delivery(started.delivery, presentation.locale);
+            const cookies = [['set-cookie', http.setCookie(flowCookie, started.flowId, 1800)]];
+            return wantsJson(request) ? jsonResponse(200, { step: started.step, expires: started.expires }, [...headers, ...cookies]) : redirect(cookies);
+        }
+        if (!binding)
+            throw new AuthHttpError(400, 'Restart signup');
+        if (path === '/signup/verify')
+            await service.verifySignup({ ...binding, code: fields.code || '' });
+        else if (path === '/signup/password')
+            await service.setSignupPassword({ ...binding, password: fields.password || '' });
+        else if (path === '/signup/passkeys/options') {
+            if (!options.passkeys)
+                throw new AuthHttpError(404, 'Passkeys are not configured');
+            const state = await service.getSignup(binding);
+            if (!state || state.step !== 'credential')
+                throw new AuthHttpError(400, 'Complete the previous signup step');
+            const passkey = await options.passkeys.beginRegistration({ id: state.accountId, email: state.email });
+            await service.setSignupPasskeyChallenge({ ...binding, challenge: passkey.challenge });
+            return jsonResponse(200, { options: passkey }, headers);
+        }
+        else if (path === '/signup/complete') {
+            const device = http.device(request), result = await service.completeSignup({ ...binding, profile: profile.read(fields), device: { id: device.id, label: device.label } });
+            const resultHeaders = [...headers, ...clear(), ...(result ? http.sessionHeaders(result.token) : [])];
+            if (result?.newDevice)
+                await delivery({ kind: 'new-device', email: result.user.email }, options.presentation?.resolve({ ...(result.user.profile?.locale ? { accountLocale: result.user.profile.locale } : {}), queryLocale: presentation.locale }).locale ?? presentation.locale);
+            // Existing-account attempts finish at sign-in; no existing credentials are replaced.
+            const target = mount + (result ? '/account' : service.getRegistrationMode() === 'waitlist' ? '/signup/pending' : '/login');
+            return wantsJson(request) ? jsonResponse(200, { complete: true, redirect: target, ...(result ? { csrf: http.token(result.token) } : {}) }, resultHeaders) : jsonResponse(303, { redirect: target }, [['location', target], ...resultHeaders]);
+        }
+        else
+            throw new AuthHttpError(404, 'Page not found');
+        return wantsJson(request) ? jsonResponse(200, { step: (await service.getSignup(binding))?.step }, headers) : redirect();
+    };
+}

package/dist/auth-store.d.ts

@@ -0,0 +1,81 @@
+import type { AuthAbusePolicy } from './abuse.ts';
+import type { RegistrationProfile } from './registration.ts';
+export declare class AuthError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string);
+}
+export interface AuthRecord {
+    mfaPasskeys?: string[];
+    mfaRecoveryRequired?: boolean;
+    id: string;
+    email: string;
+    emailVerified: boolean;
+    status: 'active' | 'locked' | 'pending-delete';
+    deleteAfter?: number;
+    roles: string[];
+    created: number;
+    passwordHash: string;
+    version: number;
+    totpSecret?: string;
+    totpPending?: string;
+    totpPendingUntil?: number;
+    totpCounter: number;
+    profile?: RegistrationProfile;
+    newDevice?: boolean;
+}
+export interface SessionRecord {
+    primaryMethod?: string;
+    primaryCredentialId?: string;
+    mfaAuthenticatedAt?: number;
+    mfaVersion?: number;
+    recoveryEnrollment?: number;
+    id: string;
+    hash: string;
+    accountId: string;
+    created: number;
+    authenticatedAt: number;
+    expires: number;
+    lastSeen?: number;
+    deviceLabel?: string;
+    deviceHash?: string;
+    impersonatorId?: string;
+    actorVersion?: number;
+}
+export interface StoreOptions {
+    approveConfigurationChangeFrom?: string;
+    configurationTag?: string;
+    configurationChangeAt: number;
+    database: string;
+    roles: Record<string, string[]>;
+    defaultRole: string;
+    sessionIdleMs: number;
+    sessionTtlMs: number;
+    securityPolicy: {
+        abuse?: AuthAbusePolicy;
+        allowPasskeySecondFactor?: true;
+        trustedDeviceTtlMs?: number;
+        allowEmailFactorRecovery?: true;
+        allowManualRecovery?: true;
+        requireEmailVerification: boolean;
+        requireMfa: boolean;
+        deletionGraceMs: number;
+    };
+    registration: {
+        disposableDomainsRevision?: string;
+        mode: string;
+        allowed: string[];
+        blocked: string[];
+        allowedEmails: string[];
+        blockedEmails: string[];
+        allowImpersonation: boolean;
+    };
+    activeKey: string;
+    keyFingerprints: Record<string, string>;
+}
+export interface AuthStore {
+    call<T = unknown>(operation: string, args?: Record<string, unknown>): Promise<T>;
+    close(): Promise<void>;
+}
+export declare function patched(version: string): boolean;
+export declare function openAuthStore(options: StoreOptions): Promise<AuthStore>;