@kanjijs/cli 0.2.0-beta.56 → 0.2.0-beta.57

package/templates/starter/node_modules/@auth/core/lib/actions/callback/oauth/checks.d.ts

@@ -0,0 +1,80 @@
+import type { CookiesOptions, InternalOptions, RequestInternal, User } from "../../../../types.js";
+import type { Cookie } from "../../../utils/cookie.js";
+import type { OAuthConfigInternal } from "../../../../providers/oauth.js";
+import type { WebAuthnProviderType } from "../../../../providers/webauthn.js";
+/** Returns a signed cookie. */
+export declare function signCookie(type: keyof CookiesOptions, value: string, maxAge: number, options: InternalOptions<"oauth" | "oidc" | WebAuthnProviderType>, data?: any): Promise<Cookie>;
+export declare const pkce: {
+    create(options: InternalOptions<"oauth">): Promise<{
+        cookie: Cookie;
+        value: string;
+    }>;
+    /**
+     * Returns code_verifier if the provider is configured to use PKCE,
+     * and clears the container cookie afterwards.
+     * An error is thrown if the code_verifier is missing or invalid.
+     * @see https://www.rfc-editor.org/rfc/rfc7636
+     * @see https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/#pkce
+     */
+    use(cookies: RequestInternal["cookies"], resCookies: Cookie[], options: InternalOptions<"oauth">): Promise<string | undefined>;
+};
+export declare function decodeState(value: string): {
+    /** If defined, a redirect proxy is being used to support multiple OAuth apps with a single callback URL */
+    origin?: string;
+    /** Random value for CSRF protection */
+    random: string;
+} | undefined;
+export declare const state: {
+    create(options: InternalOptions<"oauth">, data?: object): Promise<{
+        cookie: Cookie;
+        value: string;
+    } | undefined>;
+    /**
+     * Returns state if the provider is configured to use state,
+     * and clears the container cookie afterwards.
+     * An error is thrown if the state is missing or invalid.
+     * @see https://www.rfc-editor.org/rfc/rfc6749#section-10.12
+     * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1
+     */
+    use(cookies: RequestInternal["cookies"], resCookies: Cookie[], options: InternalOptions<"oauth">, paramRandom?: string): Promise<string | undefined>;
+};
+export declare const nonce: {
+    create(options: InternalOptions<"oidc">): Promise<{
+        cookie: Cookie;
+        value: string;
+    } | undefined>;
+    /**
+     * Returns nonce if the provider is configured to use nonce,
+     * and clears the container cookie afterwards.
+     * An error is thrown if the nonce is missing or invalid.
+     * @see https://openid.net/specs/openid-connect-core-1_0.html#NonceNotes
+     * @see https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/#nonce
+     */
+    use(cookies: RequestInternal["cookies"], resCookies: Cookie[], options: InternalOptions<"oidc">): Promise<string | undefined>;
+};
+/**
+ * When the authorization flow contains a state, we check if it's a redirect proxy
+ * and if so, we return the random state and the original redirect URL.
+ */
+export declare function handleState(query: RequestInternal["query"], provider: OAuthConfigInternal<any>, isOnRedirectProxy: InternalOptions["isOnRedirectProxy"]): {
+    randomState: string | undefined;
+    proxyRedirect?: undefined;
+} | {
+    randomState: string | undefined;
+    proxyRedirect: string | undefined;
+};
+type WebAuthnChallengeCookie = {
+    challenge: string;
+    registerData?: User;
+};
+export declare const webauthnChallenge: {
+    create(options: InternalOptions<WebAuthnProviderType>, challenge: string, registerData?: User): Promise<{
+        cookie: Cookie;
+    }>;
+    /**
+     * Returns challenge if present,
+     */
+    use(options: InternalOptions<WebAuthnProviderType>, cookies: RequestInternal["cookies"], resCookies: Cookie[]): Promise<WebAuthnChallengeCookie>;
+};
+export {};
+//# sourceMappingURL=checks.d.ts.map

package/templates/starter/node_modules/@auth/core/lib/actions/callback/oauth/checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../../../src/lib/actions/callback/oauth/checks.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,eAAe,EACf,IAAI,EACL,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAA;AAM7E,+BAA+B;AAC/B,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,cAAc,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,eAAe,CAAC,OAAO,GAAG,MAAM,GAAG,oBAAoB,CAAC,EACjE,IAAI,CAAC,EAAE,GAAG,GACT,OAAO,CAAC,MAAM,CAAC,CAejB;AAGD,eAAO,MAAM,IAAI;oBACO,gBAAgB,OAAO,CAAC;;;;IAY9C;;;;;;OAMG;iBAEQ,eAAe,CAAC,SAAS,CAAC,cACvB,MAAM,EAAE,WACX,gBAAgB,OAAO,CAAC,GAChC,QAAQ,MAAM,GAAG,SAAS,CAAC;CA4B/B,CAAA;AAGD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GACrC;IACE,2GAA2G;IAC3G,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAA;CACf,GACD,SAAS,CAKZ;AAED,eAAO,MAAM,KAAK;oBACM,gBAAgB,OAAO,CAAC,SAAS,MAAM;;;;IAyB7D;;;;;;OAMG;iBAEQ,eAAe,CAAC,SAAS,CAAC,cACvB,MAAM,EAAE,WACX,gBAAgB,OAAO,CAAC,gBACnB,MAAM,GACnB,QAAQ,MAAM,GAAG,SAAS,CAAC;CAqC/B,CAAA;AAGD,eAAO,MAAM,KAAK;oBACM,gBAAgB,MAAM,CAAC;;;;IAO7C;;;;;;OAMG;iBAEQ,eAAe,CAAC,SAAS,CAAC,cACvB,MAAM,EAAE,WACX,gBAAgB,MAAM,CAAC,GAC/B,QAAQ,MAAM,GAAG,SAAS,CAAC;CAyB/B,CAAA;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,EAC/B,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAClC,iBAAiB,EAAE,eAAe,CAAC,mBAAmB,CAAC;;;;;;EAoBxD;AAGD,KAAK,uBAAuB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,IAAI,CAAA;CAAE,CAAA;AACzE,eAAO,MAAM,iBAAiB;oBAEjB,gBAAgB,oBAAoB,CAAC,aACnC,MAAM,iBACF,IAAI;;;IAarB;;OAEG;iBAEQ,gBAAgB,oBAAoB,CAAC,WACrC,eAAe,CAAC,SAAS,CAAC,cACvB,MAAM,EAAE,GACnB,QAAQ,uBAAuB,CAAC;CAwBpC,CAAA"}

package/templates/starter/node_modules/@auth/core/lib/actions/callback/oauth/checks.js

@@ -0,0 +1,208 @@
+import * as jose from "jose";
+import * as o from "oauth4webapi";
+import { InvalidCheck } from "../../../../errors.js";
+import { decode, encode } from "../../../../jwt.js";
+/** Returns a signed cookie. */
+export async function signCookie(type, value, maxAge, options, data) {
+    const { cookies, logger } = options;
+    logger.debug(`CREATE_${type.toUpperCase()}`, { value, maxAge });
+    const expires = new Date();
+    expires.setTime(expires.getTime() + maxAge * 1000);
+    const token = { value };
+    if (type === "state" && data)
+        token.data = data;
+    const name = cookies[type].name;
+    return {
+        name,
+        value: await encode({ ...options.jwt, maxAge, token, salt: name }),
+        options: { ...cookies[type].options, expires },
+    };
+}
+const PKCE_MAX_AGE = 60 * 15; // 15 minutes in seconds
+export const pkce = {
+    async create(options) {
+        const code_verifier = o.generateRandomCodeVerifier();
+        const value = await o.calculatePKCECodeChallenge(code_verifier);
+        const maxAge = PKCE_MAX_AGE;
+        const cookie = await signCookie("pkceCodeVerifier", code_verifier, maxAge, options);
+        return { cookie, value };
+    },
+    /**
+     * Returns code_verifier if the provider is configured to use PKCE,
+     * and clears the container cookie afterwards.
+     * An error is thrown if the code_verifier is missing or invalid.
+     * @see https://www.rfc-editor.org/rfc/rfc7636
+     * @see https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/#pkce
+     */
+    async use(cookies, resCookies, options) {
+        const { provider } = options;
+        if (!provider?.checks?.includes("pkce"))
+            return;
+        const codeVerifier = cookies?.[options.cookies.pkceCodeVerifier.name];
+        if (!codeVerifier)
+            throw new InvalidCheck("PKCE code_verifier cookie was missing");
+        const value = await decode({
+            ...options.jwt,
+            token: codeVerifier,
+            salt: options.cookies.pkceCodeVerifier.name,
+        });
+        if (!value?.value)
+            throw new InvalidCheck("PKCE code_verifier value could not be parsed");
+        // Clear the pkce code verifier cookie after use
+        resCookies.push({
+            name: options.cookies.pkceCodeVerifier.name,
+            value: "",
+            options: { ...options.cookies.pkceCodeVerifier.options, maxAge: 0 },
+        });
+        return value.value;
+    },
+};
+const STATE_MAX_AGE = 60 * 15; // 15 minutes in seconds
+export function decodeState(value) {
+    try {
+        const decoder = new TextDecoder();
+        return JSON.parse(decoder.decode(jose.base64url.decode(value)));
+    }
+    catch { }
+}
+export const state = {
+    async create(options, data) {
+        const { provider } = options;
+        if (!provider.checks.includes("state")) {
+            if (data) {
+                throw new InvalidCheck("State data was provided but the provider is not configured to use state");
+            }
+            return;
+        }
+        const encodedState = jose.base64url.encode(JSON.stringify({ ...data, random: o.generateRandomState() }));
+        const maxAge = STATE_MAX_AGE;
+        const cookie = await signCookie("state", encodedState, maxAge, options, data);
+        return { cookie, value: encodedState };
+    },
+    /**
+     * Returns state if the provider is configured to use state,
+     * and clears the container cookie afterwards.
+     * An error is thrown if the state is missing or invalid.
+     * @see https://www.rfc-editor.org/rfc/rfc6749#section-10.12
+     * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1
+     */
+    async use(cookies, resCookies, options, paramRandom) {
+        const { provider } = options;
+        if (!provider.checks.includes("state"))
+            return;
+        const state = cookies?.[options.cookies.state.name];
+        if (!state)
+            throw new InvalidCheck("State cookie was missing");
+        // IDEA: Let the user do something with the returned state
+        const encodedState = await decode({
+            ...options.jwt,
+            token: state,
+            salt: options.cookies.state.name,
+        });
+        if (!encodedState?.value)
+            throw new InvalidCheck("State (cookie) value could not be parsed");
+        const decodedState = decodeState(encodedState.value);
+        if (!decodedState)
+            throw new InvalidCheck("State (encoded) value could not be parsed");
+        if (decodedState.random !== paramRandom)
+            throw new InvalidCheck(`Random state values did not match. Expected: ${decodedState.random}. Got: ${paramRandom}`);
+        // Clear the state cookie after use
+        resCookies.push({
+            name: options.cookies.state.name,
+            value: "",
+            options: { ...options.cookies.state.options, maxAge: 0 },
+        });
+        return encodedState.value;
+    },
+};
+const NONCE_MAX_AGE = 60 * 15; // 15 minutes in seconds
+export const nonce = {
+    async create(options) {
+        if (!options.provider.checks.includes("nonce"))
+            return;
+        const value = o.generateRandomNonce();
+        const maxAge = NONCE_MAX_AGE;
+        const cookie = await signCookie("nonce", value, maxAge, options);
+        return { cookie, value };
+    },
+    /**
+     * Returns nonce if the provider is configured to use nonce,
+     * and clears the container cookie afterwards.
+     * An error is thrown if the nonce is missing or invalid.
+     * @see https://openid.net/specs/openid-connect-core-1_0.html#NonceNotes
+     * @see https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/#nonce
+     */
+    async use(cookies, resCookies, options) {
+        const { provider } = options;
+        if (!provider?.checks?.includes("nonce"))
+            return;
+        const nonce = cookies?.[options.cookies.nonce.name];
+        if (!nonce)
+            throw new InvalidCheck("Nonce cookie was missing");
+        const value = await decode({
+            ...options.jwt,
+            token: nonce,
+            salt: options.cookies.nonce.name,
+        });
+        if (!value?.value)
+            throw new InvalidCheck("Nonce value could not be parsed");
+        // Clear the nonce cookie after use
+        resCookies.push({
+            name: options.cookies.nonce.name,
+            value: "",
+            options: { ...options.cookies.nonce.options, maxAge: 0 },
+        });
+        return value.value;
+    },
+};
+/**
+ * When the authorization flow contains a state, we check if it's a redirect proxy
+ * and if so, we return the random state and the original redirect URL.
+ */
+export function handleState(query, provider, isOnRedirectProxy) {
+    let randomState;
+    let proxyRedirect;
+    if (provider.redirectProxyUrl && !query?.state) {
+        throw new InvalidCheck("Missing state in query, but required for redirect proxy");
+    }
+    const state = decodeState(query?.state);
+    randomState = state?.random;
+    if (isOnRedirectProxy) {
+        if (!state?.origin)
+            return { randomState };
+        proxyRedirect = `${state.origin}?${new URLSearchParams(query)}`;
+    }
+    return { randomState, proxyRedirect };
+}
+const WEBAUTHN_CHALLENGE_MAX_AGE = 60 * 15; // 15 minutes in seconds
+export const webauthnChallenge = {
+    async create(options, challenge, registerData) {
+        const maxAge = WEBAUTHN_CHALLENGE_MAX_AGE;
+        const data = { challenge, registerData };
+        const cookie = await signCookie("webauthnChallenge", JSON.stringify(data), maxAge, options);
+        return { cookie };
+    },
+    /**
+     * Returns challenge if present,
+     */
+    async use(options, cookies, resCookies) {
+        const challenge = cookies?.[options.cookies.webauthnChallenge.name];
+        if (!challenge)
+            throw new InvalidCheck("Challenge cookie missing");
+        const value = await decode({
+            ...options.jwt,
+            token: challenge,
+            salt: options.cookies.webauthnChallenge.name,
+        });
+        if (!value?.value)
+            throw new InvalidCheck("Challenge value could not be parsed");
+        // Clear the pkce code verifier cookie after use
+        const cookie = {
+            name: options.cookies.webauthnChallenge.name,
+            value: "",
+            options: { ...options.cookies.webauthnChallenge.options, maxAge: 0 },
+        };
+        resCookies.push(cookie);
+        return JSON.parse(value.value);
+    },
+};

package/templates/starter/node_modules/@auth/core/lib/actions/callback/oauth/csrf-token.d.ts

@@ -0,0 +1,33 @@
+import type { AuthAction, InternalOptions } from "../../../../types.js";
+interface CreateCSRFTokenParams {
+    options: InternalOptions;
+    cookieValue?: string;
+    isPost: boolean;
+    bodyValue?: string;
+}
+/**
+ * Ensure CSRF Token cookie is set for any subsequent requests.
+ * Used as part of the strategy for mitigation for CSRF tokens.
+ *
+ * Creates a cookie like 'next-auth.csrf-token' with the value 'token|hash',
+ * where 'token' is the CSRF token and 'hash' is a hash made of the token and
+ * the secret, and the two values are joined by a pipe '|'. By storing the
+ * value and the hash of the value (with the secret used as a salt) we can
+ * verify the cookie was set by the server and not by a malicious attacker.
+ *
+ * For more details, see the following OWASP links:
+ * https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#double-submit-cookie
+ * https://owasp.org/www-chapter-london/assets/slides/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf
+ */
+export declare function createCSRFToken({ options, cookieValue, isPost, bodyValue, }: CreateCSRFTokenParams): Promise<{
+    csrfTokenVerified: boolean;
+    csrfToken: string;
+    cookie?: undefined;
+} | {
+    cookie: string;
+    csrfToken: string;
+    csrfTokenVerified?: undefined;
+}>;
+export declare function validateCSRF(action: AuthAction, verified?: boolean): void;
+export {};
+//# sourceMappingURL=csrf-token.d.ts.map

package/templates/starter/node_modules/@auth/core/lib/actions/callback/oauth/csrf-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf-token.d.ts","sourceRoot":"","sources":["../../../../src/lib/actions/callback/oauth/csrf-token.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEvE,UAAU,qBAAqB;IAC7B,OAAO,EAAE,eAAe,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,EACpC,OAAO,EACP,WAAW,EACX,MAAM,EACN,SAAS,GACV,EAAE,qBAAqB;;;;;;;;GAwBvB;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,QAGlE"}

package/templates/starter/node_modules/@auth/core/lib/actions/callback/oauth/csrf-token.js

@@ -0,0 +1,39 @@
+import { createHash, randomString } from "../../../utils/web.js";
+import { MissingCSRF } from "../../../../errors.js";
+/**
+ * Ensure CSRF Token cookie is set for any subsequent requests.
+ * Used as part of the strategy for mitigation for CSRF tokens.
+ *
+ * Creates a cookie like 'next-auth.csrf-token' with the value 'token|hash',
+ * where 'token' is the CSRF token and 'hash' is a hash made of the token and
+ * the secret, and the two values are joined by a pipe '|'. By storing the
+ * value and the hash of the value (with the secret used as a salt) we can
+ * verify the cookie was set by the server and not by a malicious attacker.
+ *
+ * For more details, see the following OWASP links:
+ * https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#double-submit-cookie
+ * https://owasp.org/www-chapter-london/assets/slides/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf
+ */
+export async function createCSRFToken({ options, cookieValue, isPost, bodyValue, }) {
+    if (cookieValue) {
+        const [csrfToken, csrfTokenHash] = cookieValue.split("|");
+        const expectedCsrfTokenHash = await createHash(`${csrfToken}${options.secret}`);
+        if (csrfTokenHash === expectedCsrfTokenHash) {
+            // If hash matches then we trust the CSRF token value
+            // If this is a POST request and the CSRF Token in the POST request matches
+            // the cookie we have already verified is the one we have set, then the token is verified!
+            const csrfTokenVerified = isPost && csrfToken === bodyValue;
+            return { csrfTokenVerified, csrfToken };
+        }
+    }
+    // New CSRF token
+    const csrfToken = randomString(32);
+    const csrfTokenHash = await createHash(`${csrfToken}${options.secret}`);
+    const cookie = `${csrfToken}|${csrfTokenHash}`;
+    return { cookie, csrfToken };
+}
+export function validateCSRF(action, verified) {
+    if (verified)
+        return;
+    throw new MissingCSRF(`CSRF token was missing during an action ${action}`);
+}

package/templates/starter/node_modules/@auth/core/lib/actions/index.d.ts

@@ -0,0 +1,6 @@
+export { callback } from "./callback/index.js";
+export { session } from "./session.js";
+export { signIn } from "./signin/index.js";
+export { signOut } from "./signout.js";
+export { webAuthnOptions } from "./webauthn-options.js";
+//# sourceMappingURL=index.d.ts.map

package/templates/starter/node_modules/@auth/core/lib/actions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/actions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA"}

package/templates/starter/node_modules/@auth/core/lib/actions/index.js

@@ -0,0 +1,5 @@
+export { callback } from "./callback/index.js";
+export { session } from "./session.js";
+export { signIn } from "./signin/index.js";
+export { signOut } from "./signout.js";
+export { webAuthnOptions } from "./webauthn-options.js";

package/templates/starter/node_modules/@auth/core/lib/actions/session.d.ts

@@ -0,0 +1,5 @@
+import type { InternalOptions, ResponseInternal, Session } from "../../types.js";
+import type { Cookie, SessionStore } from "../utils/cookie.js";
+/** Return a session object filtered via `callbacks.session` */
+export declare function session(options: InternalOptions, sessionStore: SessionStore, cookies: Cookie[], isUpdate?: boolean, newSession?: any): Promise<ResponseInternal<Session | null>>;
+//# sourceMappingURL=session.d.ts.map

package/templates/starter/node_modules/@auth/core/lib/actions/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/lib/actions/session.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAChF,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAE9D,+DAA+D;AAC/D,wBAAsB,OAAO,CAC3B,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,MAAM,EAAE,EACjB,QAAQ,CAAC,EAAE,OAAO,EAClB,UAAU,CAAC,EAAE,GAAG,GACf,OAAO,CAAC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAiJ3C"}

package/templates/starter/node_modules/@auth/core/lib/actions/session.js

@@ -0,0 +1,120 @@
+import { JWTSessionError, SessionTokenError } from "../../errors.js";
+import { fromDate } from "../utils/date.js";
+/** Return a session object filtered via `callbacks.session` */
+export async function session(options, sessionStore, cookies, isUpdate, newSession) {
+    const { adapter, jwt, events, callbacks, logger, session: { strategy: sessionStrategy, maxAge: sessionMaxAge }, } = options;
+    const response = {
+        body: null,
+        headers: { "Content-Type": "application/json" },
+        cookies,
+    };
+    const sessionToken = sessionStore.value;
+    if (!sessionToken)
+        return response;
+    if (sessionStrategy === "jwt") {
+        try {
+            const salt = options.cookies.sessionToken.name;
+            const payload = await jwt.decode({ ...jwt, token: sessionToken, salt });
+            if (!payload)
+                throw new Error("Invalid JWT");
+            // @ts-expect-error
+            const token = await callbacks.jwt({
+                token: payload,
+                ...(isUpdate && { trigger: "update" }),
+                session: newSession,
+            });
+            const newExpires = fromDate(sessionMaxAge);
+            if (token !== null) {
+                // By default, only exposes a limited subset of information to the client
+                // as needed for presentation purposes (e.g. "you are logged in as...").
+                const session = {
+                    user: { name: token.name, email: token.email, image: token.picture },
+                    expires: newExpires.toISOString(),
+                };
+                // @ts-expect-error
+                const newSession = await callbacks.session({ session, token });
+                // Return session payload as response
+                response.body = newSession;
+                // Refresh JWT expiry by re-signing it, with an updated expiry date
+                const newToken = await jwt.encode({ ...jwt, token, salt });
+                // Set cookie, to also update expiry date on cookie
+                const sessionCookies = sessionStore.chunk(newToken, {
+                    expires: newExpires,
+                });
+                response.cookies?.push(...sessionCookies);
+                await events.session?.({ session: newSession, token });
+            }
+            else {
+                response.cookies?.push(...sessionStore.clean());
+            }
+        }
+        catch (e) {
+            logger.error(new JWTSessionError(e));
+            // If the JWT is not verifiable remove the broken session cookie(s).
+            response.cookies?.push(...sessionStore.clean());
+        }
+        return response;
+    }
+    // Retrieve session from database
+    try {
+        const { getSessionAndUser, deleteSession, updateSession } = adapter;
+        let userAndSession = await getSessionAndUser(sessionToken);
+        // If session has expired, clean up the database
+        if (userAndSession &&
+            userAndSession.session.expires.valueOf() < Date.now()) {
+            await deleteSession(sessionToken);
+            userAndSession = null;
+        }
+        if (userAndSession) {
+            const { user, session } = userAndSession;
+            const sessionUpdateAge = options.session.updateAge;
+            // Calculate last updated date to throttle write updates to database
+            // Formula: ({expiry date} - sessionMaxAge) + sessionUpdateAge
+            //     e.g. ({expiry date} - 30 days) + 1 hour
+            const sessionIsDueToBeUpdatedDate = session.expires.valueOf() -
+                sessionMaxAge * 1000 +
+                sessionUpdateAge * 1000;
+            const newExpires = fromDate(sessionMaxAge);
+            // Trigger update of session expiry date and write to database, only
+            // if the session was last updated more than {sessionUpdateAge} ago
+            if (sessionIsDueToBeUpdatedDate <= Date.now()) {
+                await updateSession({
+                    sessionToken: sessionToken,
+                    expires: newExpires,
+                });
+            }
+            // Pass Session through to the session callback
+            const sessionPayload = await callbacks.session({
+                // TODO: user already passed below,
+                // remove from session object in https://github.com/nextauthjs/next-auth/pull/9702
+                // @ts-expect-error
+                session: { ...session, user },
+                user,
+                newSession,
+                ...(isUpdate ? { trigger: "update" } : {}),
+            });
+            // Return session payload as response
+            response.body = sessionPayload;
+            // Set cookie again to update expiry
+            response.cookies?.push({
+                name: options.cookies.sessionToken.name,
+                value: sessionToken,
+                options: {
+                    ...options.cookies.sessionToken.options,
+                    expires: newExpires,
+                },
+            });
+            // @ts-expect-error
+            await events.session?.({ session: sessionPayload });
+        }
+        else if (sessionToken) {
+            // If `sessionToken` was found set but it's not valid for a session then
+            // remove the sessionToken cookie from browser.
+            response.cookies?.push(...sessionStore.clean());
+        }
+    }
+    catch (e) {
+        logger.error(new SessionTokenError(e));
+    }
+    return response;
+}

package/templates/starter/node_modules/@auth/core/lib/actions/signin/authorization-url.d.ts

@@ -0,0 +1,12 @@
+import type { InternalOptions, RequestInternal } from "../../../types.js";
+import type { Cookie } from "../../utils/cookie.js";
+/**
+ * Generates an authorization/request token URL.
+ *
+ * [OAuth 2](https://www.oauth.com/oauth2-servers/authorization/the-authorization-request/)
+ */
+export declare function getAuthorizationUrl(query: RequestInternal["query"], options: InternalOptions<"oauth" | "oidc">): Promise<{
+    redirect: string;
+    cookies: Cookie[];
+}>;
+//# sourceMappingURL=authorization-url.d.ts.map

package/templates/starter/node_modules/@auth/core/lib/actions/signin/authorization-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-url.d.ts","sourceRoot":"","sources":["../../../src/lib/actions/signin/authorization-url.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAEnD;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,EAC/B,OAAO,EAAE,eAAe,CAAC,OAAO,GAAG,MAAM,CAAC;;;GAqF3C"}

package/templates/starter/node_modules/@auth/core/lib/actions/signin/authorization-url.js

@@ -0,0 +1,75 @@
+import * as checks from "../callback/oauth/checks.js";
+import * as o from "oauth4webapi";
+/**
+ * Generates an authorization/request token URL.
+ *
+ * [OAuth 2](https://www.oauth.com/oauth2-servers/authorization/the-authorization-request/)
+ */
+export async function getAuthorizationUrl(query, options) {
+    const { logger, provider } = options;
+    let url = provider.authorization?.url;
+    let as;
+    // Falls back to authjs.dev if the user only passed params
+    if (!url || url.host === "authjs.dev") {
+        // If url is undefined, we assume that issuer is always defined
+        // We check this in assert.ts
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        const issuer = new URL(provider.issuer);
+        const discoveryResponse = await o.discoveryRequest(issuer);
+        const as = await o.processDiscoveryResponse(issuer, discoveryResponse);
+        if (!as.authorization_endpoint) {
+            throw new TypeError("Authorization server did not provide an authorization endpoint.");
+        }
+        url = new URL(as.authorization_endpoint);
+    }
+    const authParams = url.searchParams;
+    let redirect_uri = provider.callbackUrl;
+    let data;
+    if (!options.isOnRedirectProxy && provider.redirectProxyUrl) {
+        redirect_uri = provider.redirectProxyUrl;
+        data = { origin: provider.callbackUrl };
+        logger.debug("using redirect proxy", { redirect_uri, data });
+    }
+    const params = Object.assign({
+        response_type: "code",
+        // clientId can technically be undefined, should we check this in assert.ts or rely on the Authorization Server to do it?
+        client_id: provider.clientId,
+        redirect_uri,
+        // @ts-expect-error TODO:
+        ...provider.authorization?.params,
+    }, Object.fromEntries(provider.authorization?.url.searchParams ?? []), query);
+    for (const k in params)
+        authParams.set(k, params[k]);
+    const cookies = [];
+    const state = await checks.state.create(options, data);
+    if (state) {
+        authParams.set("state", state.value);
+        cookies.push(state.cookie);
+    }
+    if (provider.checks?.includes("pkce")) {
+        if (as && !as.code_challenge_methods_supported?.includes("S256")) {
+            // We assume S256 PKCE support, if the server does not advertise that,
+            // a random `nonce` must be used for CSRF protection.
+            if (provider.type === "oidc")
+                provider.checks = ["nonce"];
+        }
+        else {
+            const { value, cookie } = await checks.pkce.create(options);
+            authParams.set("code_challenge", value);
+            authParams.set("code_challenge_method", "S256");
+            cookies.push(cookie);
+        }
+    }
+    const nonce = await checks.nonce.create(options);
+    if (nonce) {
+        authParams.set("nonce", nonce.value);
+        cookies.push(nonce.cookie);
+    }
+    // TODO: This does not work in normalizeOAuth because authorization endpoint can come from discovery
+    // Need to make normalizeOAuth async
+    if (provider.type === "oidc" && !url.searchParams.has("scope")) {
+        url.searchParams.set("scope", "openid profile email");
+    }
+    logger.debug("authorization url is ready", { url, cookies, provider });
+    return { redirect: url.toString(), cookies };
+}

package/templates/starter/node_modules/@auth/core/lib/actions/signin/index.d.ts

@@ -0,0 +1,4 @@
+import type { Cookie } from "../../utils/cookie.js";
+import type { InternalOptions, RequestInternal, ResponseInternal } from "../../../types.js";
+export declare function signIn(request: RequestInternal, cookies: Cookie[], options: InternalOptions): Promise<ResponseInternal>;
+//# sourceMappingURL=index.d.ts.map

package/templates/starter/node_modules/@auth/core/lib/actions/signin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/actions/signin/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAE1B,wBAAsB,MAAM,CAC1B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAsB3B"}

package/templates/starter/node_modules/@auth/core/lib/actions/signin/index.js

@@ -0,0 +1,22 @@
+import { getAuthorizationUrl } from "./authorization-url.js";
+import { sendToken } from "./send-token.js";
+export async function signIn(request, cookies, options) {
+    const signInUrl = `${options.url.origin}${options.basePath}/signin`;
+    if (!options.provider)
+        return { redirect: signInUrl, cookies };
+    switch (options.provider.type) {
+        case "oauth":
+        case "oidc": {
+            const { redirect, cookies: authCookies } = await getAuthorizationUrl(request.query, options);
+            if (authCookies)
+                cookies.push(...authCookies);
+            return { redirect, cookies };
+        }
+        case "email": {
+            const response = await sendToken(request, options);
+            return { ...response, cookies };
+        }
+        default:
+            return { redirect: signInUrl, cookies };
+    }
+}

package/templates/starter/node_modules/@auth/core/lib/actions/signin/send-token.d.ts

@@ -0,0 +1,10 @@
+import type { InternalOptions, RequestInternal } from "../../../types.js";
+/**
+ * Starts an e-mail login flow, by generating a token,
+ * and sending it to the user's e-mail (with the help of a DB adapter).
+ * At the end, it returns a redirect to the `verify-request` page.
+ */
+export declare function sendToken(request: RequestInternal, options: InternalOptions<"email">): Promise<{
+    redirect: string;
+}>;
+//# sourceMappingURL=send-token.d.ts.map