@korajs/auth 0.1.0

package/dist/server.cjs

@@ -0,0 +1,1040 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  AuthProviderError: () => AuthProviderError,
+  BuiltInAuthRoutes: () => BuiltInAuthRoutes,
+  BuiltInProvider: () => BuiltInProvider,
+  DuplicateEmailError: () => DuplicateEmailError,
+  InMemoryUserStore: () => InMemoryUserStore,
+  TokenManager: () => TokenManager,
+  computePublicKeyThumbprint: () => computePublicKeyThumbprint,
+  decodeJwt: () => decodeJwt,
+  encodeJwt: () => encodeJwt,
+  hashPassword: () => hashPassword,
+  isExpired: () => isExpired,
+  verifyChallenge: () => verifyChallenge,
+  verifyJwt: () => verifyJwt,
+  verifyPassword: () => verifyPassword
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/types.ts
+var import_core = require("@korajs/core");
+var DEFAULT_ACCESS_TOKEN_LIFETIME = 15 * 60 * 1e3;
+var DEFAULT_REFRESH_TOKEN_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
+var DEFAULT_DEVICE_CREDENTIAL_LIFETIME = 90 * 24 * 60 * 60 * 1e3;
+var DEFAULT_MAX_OFFLINE_DURATION = 30 * 24 * 60 * 60 * 1e3;
+var DEFAULT_AUTO_LOCK_TIMEOUT = 15 * 60 * 1e3;
+
+// src/tokens/jwt.ts
+var import_node_crypto = require("crypto");
+function base64urlEncode(input) {
+  return Buffer.from(input, "utf-8").toString("base64url");
+}
+function base64urlDecode(input) {
+  return Buffer.from(input, "base64url").toString("utf-8");
+}
+function hmacSha256Base64url(data, secret) {
+  return (0, import_node_crypto.createHmac)("sha256", secret).update(data).digest("base64url");
+}
+var ENCODED_HEADER = base64urlEncode(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+function encodeJwt(payload, secret) {
+  const encodedPayload = base64urlEncode(JSON.stringify(payload));
+  const signingInput = `${ENCODED_HEADER}.${encodedPayload}`;
+  const signature = hmacSha256Base64url(signingInput, secret);
+  return `${signingInput}.${signature}`;
+}
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const payloadSegment = parts[1];
+  if (payloadSegment === void 0) {
+    return null;
+  }
+  try {
+    const decoded = base64urlDecode(payloadSegment);
+    const parsed = JSON.parse(decoded);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const headerSegment = parts[0];
+  const payloadSegment = parts[1];
+  const signatureSegment = parts[2];
+  if (headerSegment === void 0 || payloadSegment === void 0 || signatureSegment === void 0) {
+    return null;
+  }
+  const signingInput = `${headerSegment}.${payloadSegment}`;
+  const expectedSignature = hmacSha256Base64url(signingInput, secret);
+  if (expectedSignature.length !== signatureSegment.length) {
+    return null;
+  }
+  let mismatch = 0;
+  for (let i = 0; i < expectedSignature.length; i++) {
+    mismatch |= expectedSignature.charCodeAt(i) ^ signatureSegment.charCodeAt(i);
+  }
+  if (mismatch !== 0) {
+    return null;
+  }
+  try {
+    const decoded = base64urlDecode(payloadSegment);
+    const parsed = JSON.parse(decoded);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function isExpired(payload) {
+  if (typeof payload.exp !== "number") {
+    return false;
+  }
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  return nowSeconds >= payload.exp;
+}
+
+// src/tokens/token-manager.ts
+var TokenManager = class {
+  secret;
+  accessTokenLifetime;
+  refreshTokenLifetime;
+  deviceCredentialLifetime;
+  constructor(config) {
+    this.secret = config.secret;
+    this.accessTokenLifetime = config.accessTokenLifetime ?? DEFAULT_ACCESS_TOKEN_LIFETIME;
+    this.refreshTokenLifetime = config.refreshTokenLifetime ?? DEFAULT_REFRESH_TOKEN_LIFETIME;
+    this.deviceCredentialLifetime = config.deviceCredentialLifetime ?? DEFAULT_DEVICE_CREDENTIAL_LIFETIME;
+  }
+  /**
+   * Issue a signed JWT access token.
+   *
+   * Access tokens are short-lived (default 15 minutes) and used to authorize
+   * API requests. When expired, use {@link refreshAccessToken} with a valid
+   * refresh token to obtain a new one.
+   *
+   * @param userId - The subject (user ID) to encode in the token
+   * @param deviceId - The device ID of the requesting device
+   * @returns A signed JWT string with type 'access'
+   */
+  issueAccessToken(userId, deviceId) {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const payload = {
+      sub: userId,
+      dev: deviceId,
+      type: "access",
+      iat: nowSeconds,
+      exp: nowSeconds + Math.floor(this.accessTokenLifetime / 1e3)
+    };
+    return encodeJwt(payload, this.secret);
+  }
+  /**
+   * Issue a signed JWT refresh token.
+   *
+   * Refresh tokens are longer-lived (default 90 days) and used exclusively
+   * to obtain new access tokens via {@link refreshAccessToken}. They should
+   * be stored securely and never sent to resource APIs.
+   *
+   * @param userId - The subject (user ID) to encode in the token
+   * @param deviceId - The device ID of the requesting device
+   * @returns A signed JWT string with type 'refresh'
+   */
+  issueRefreshToken(userId, deviceId) {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const payload = {
+      sub: userId,
+      dev: deviceId,
+      type: "refresh",
+      iat: nowSeconds,
+      exp: nowSeconds + Math.floor(this.refreshTokenLifetime / 1e3)
+    };
+    return encodeJwt(payload, this.secret);
+  }
+  /**
+   * Issue a signed device credential token.
+   *
+   * Device credentials are long-lived tokens bound to a device's public key.
+   * They include a `mustCheckinBy` deadline; if the device does not check in
+   * before this deadline, the credential should be treated as revoked.
+   *
+   * @param userId - The subject (user ID) to encode in the token
+   * @param deviceId - The device ID of the requesting device
+   * @param publicKeyThumbprint - SHA-256 thumbprint of the device's public key
+   * @returns A signed JWT string with type 'device_credential'
+   */
+  issueDeviceCredential(userId, deviceId, publicKeyThumbprint) {
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const lifetimeSeconds = Math.floor(this.deviceCredentialLifetime / 1e3);
+    const payload = {
+      sub: userId,
+      dev: deviceId,
+      type: "device_credential",
+      iat: nowSeconds,
+      exp: nowSeconds + lifetimeSeconds,
+      dpk: publicKeyThumbprint,
+      mustCheckinBy: nowSeconds + lifetimeSeconds
+    };
+    return encodeJwt(payload, this.secret);
+  }
+  /**
+   * Issue a complete set of authentication tokens.
+   *
+   * Always issues an access token and refresh token. If a `publicKeyThumbprint`
+   * is provided, also issues a device credential.
+   *
+   * @param userId - The subject (user ID) to encode in the tokens
+   * @param deviceId - The device ID of the requesting device
+   * @param publicKeyThumbprint - Optional SHA-256 thumbprint of the device's public key.
+   *   When provided, a device credential is included in the returned tokens.
+   * @returns An {@link AuthTokens} object containing the issued tokens
+   */
+  issueTokens(userId, deviceId, publicKeyThumbprint) {
+    const tokens = {
+      accessToken: this.issueAccessToken(userId, deviceId),
+      refreshToken: this.issueRefreshToken(userId, deviceId)
+    };
+    if (publicKeyThumbprint !== void 0) {
+      tokens.deviceCredential = this.issueDeviceCredential(
+        userId,
+        deviceId,
+        publicKeyThumbprint
+      );
+    }
+    return tokens;
+  }
+  /**
+   * Validate and decode a token.
+   *
+   * Verifies the HMAC-SHA256 signature and checks that the token has not expired.
+   * Returns null (rather than throwing) for invalid or expired tokens, so callers
+   * can handle authentication failure without try/catch.
+   *
+   * @param token - The JWT string to validate
+   * @returns The decoded {@link TokenPayload} if valid, or null if the token is
+   *   invalid, expired, or missing required claims
+   */
+  validateToken(token) {
+    const decoded = verifyJwt(token, this.secret);
+    if (decoded === null) {
+      return null;
+    }
+    if (isExpired(decoded)) {
+      return null;
+    }
+    if (typeof decoded["sub"] !== "string" || typeof decoded["dev"] !== "string" || typeof decoded["type"] !== "string" || typeof decoded["iat"] !== "number" || typeof decoded["exp"] !== "number") {
+      return null;
+    }
+    const type = decoded["type"];
+    if (type !== "access" && type !== "refresh" && type !== "device_credential") {
+      return null;
+    }
+    return {
+      sub: decoded["sub"],
+      dev: decoded["dev"],
+      type,
+      iat: decoded["iat"],
+      exp: decoded["exp"]
+    };
+  }
+  /**
+   * Refresh an access token using a valid refresh token.
+   *
+   * Implements **refresh token rotation**: a new refresh token is issued alongside
+   * the new access token, and the old refresh token should be considered consumed.
+   * This limits the window of vulnerability if a refresh token is compromised.
+   *
+   * Returns null if the provided token is invalid, expired, or not a refresh token.
+   *
+   * @param refreshToken - The refresh token JWT string
+   * @returns A new access/refresh token pair, or null if the refresh token is invalid
+   */
+  refreshAccessToken(refreshToken) {
+    const payload = this.validateToken(refreshToken);
+    if (payload === null) {
+      return null;
+    }
+    if (payload.type !== "refresh") {
+      return null;
+    }
+    return {
+      accessToken: this.issueAccessToken(payload.sub, payload.dev),
+      refreshToken: this.issueRefreshToken(payload.sub, payload.dev)
+    };
+  }
+};
+
+// src/provider/built-in/password-hash.ts
+var import_node_crypto2 = require("crypto");
+var PBKDF2_ITERATIONS = 6e5;
+var PBKDF2_DIGEST = "sha512";
+var KEY_LENGTH = 64;
+var SALT_LENGTH = 32;
+async function hashPassword(password) {
+  const salt = (0, import_node_crypto2.randomBytes)(SALT_LENGTH);
+  const derivedKey = await pbkdf2Async(
+    password,
+    salt,
+    PBKDF2_ITERATIONS,
+    KEY_LENGTH,
+    PBKDF2_DIGEST
+  );
+  return {
+    hash: derivedKey.toString("hex"),
+    salt: salt.toString("hex")
+  };
+}
+async function verifyPassword(password, hash, salt) {
+  const saltBuffer = Buffer.from(salt, "hex");
+  const derivedKey = await pbkdf2Async(
+    password,
+    saltBuffer,
+    PBKDF2_ITERATIONS,
+    KEY_LENGTH,
+    PBKDF2_DIGEST
+  );
+  const hashBuffer = Buffer.from(hash, "hex");
+  if (derivedKey.length !== hashBuffer.length) {
+    return false;
+  }
+  return (0, import_node_crypto2.timingSafeEqual)(derivedKey, hashBuffer);
+}
+function pbkdf2Async(password, salt, iterations, keyLength, digest) {
+  return new Promise((resolve, reject) => {
+    (0, import_node_crypto2.pbkdf2)(password, salt, iterations, keyLength, digest, (err, derivedKey) => {
+      if (err) {
+        reject(err);
+      } else {
+        resolve(derivedKey);
+      }
+    });
+  });
+}
+
+// src/provider/built-in/user-store.ts
+var import_core2 = require("@korajs/core");
+var import_node_crypto3 = require("crypto");
+var DuplicateEmailError = class extends import_core2.KoraError {
+  constructor(email) {
+    super(
+      `A user with email "${email}" already exists. Use a different email address or sign in to the existing account.`,
+      "DUPLICATE_EMAIL",
+      { email }
+    );
+    this.name = "DuplicateEmailError";
+  }
+};
+var InMemoryUserStore = class {
+  /** Users indexed by ID */
+  usersById = /* @__PURE__ */ new Map();
+  /** Users indexed by email (lowercase) for fast lookup */
+  usersByEmail = /* @__PURE__ */ new Map();
+  /** Devices indexed by device ID */
+  devicesById = /* @__PURE__ */ new Map();
+  /** Device IDs indexed by user ID for fast listing */
+  devicesByUserId = /* @__PURE__ */ new Map();
+  /**
+   * Create a new user account.
+   *
+   * @param params - User creation parameters
+   * @param params.email - The user's email address (must be unique, case-insensitive)
+   * @param params.passwordHash - Hex-encoded PBKDF2 derived key
+   * @param params.salt - Hex-encoded salt used during hashing
+   * @param params.name - The user's display name
+   * @returns The created user (without sensitive credential fields)
+   * @throws {DuplicateEmailError} If a user with the same email already exists
+   */
+  async createUser(params) {
+    const normalizedEmail = params.email.toLowerCase();
+    if (this.usersByEmail.has(normalizedEmail)) {
+      throw new DuplicateEmailError(params.email);
+    }
+    const now = Date.now();
+    const id = (0, import_node_crypto3.randomUUID)();
+    const storedUser = {
+      id,
+      email: normalizedEmail,
+      name: params.name,
+      createdAt: now,
+      passwordHash: params.passwordHash,
+      salt: params.salt
+    };
+    this.usersById.set(id, storedUser);
+    this.usersByEmail.set(normalizedEmail, storedUser);
+    return toAuthUser(storedUser);
+  }
+  /**
+   * Find a user by email address.
+   *
+   * @param email - The email to search for (case-insensitive)
+   * @returns The stored user record including credentials, or null if not found
+   */
+  async findByEmail(email) {
+    return this.usersByEmail.get(email.toLowerCase()) ?? null;
+  }
+  /**
+   * Find a user by ID.
+   *
+   * @param id - The user ID to search for
+   * @returns The stored user record including credentials, or null if not found
+   */
+  async findById(id) {
+    return this.usersById.get(id) ?? null;
+  }
+  /**
+   * Register a device for a user.
+   *
+   * If a device with the same ID already exists and is not revoked, it is
+   * returned as-is (idempotent registration). If it was previously revoked,
+   * it is re-activated with updated details.
+   *
+   * @param params - Device registration parameters
+   * @param params.id - Unique device identifier
+   * @param params.userId - ID of the user who owns the device
+   * @param params.publicKey - Base64url-encoded device public key or thumbprint
+   * @param params.name - Human-readable device name
+   * @returns The registered device record
+   */
+  async registerDevice(params) {
+    const existing = this.devicesById.get(params.id);
+    if (existing !== void 0 && !existing.revoked) {
+      return existing;
+    }
+    const now = Date.now();
+    const device = {
+      id: params.id,
+      userId: params.userId,
+      publicKey: params.publicKey,
+      name: params.name,
+      revoked: false,
+      createdAt: now,
+      lastSeenAt: now
+    };
+    this.devicesById.set(params.id, device);
+    let userDevices = this.devicesByUserId.get(params.userId);
+    if (userDevices === void 0) {
+      userDevices = /* @__PURE__ */ new Set();
+      this.devicesByUserId.set(params.userId, userDevices);
+    }
+    userDevices.add(params.id);
+    return device;
+  }
+  /**
+   * Find a device by its ID.
+   *
+   * @param deviceId - The device ID to search for
+   * @returns The device record, or null if not found
+   */
+  async findDevice(deviceId) {
+    return this.devicesById.get(deviceId) ?? null;
+  }
+  /**
+   * List all devices registered for a user.
+   *
+   * @param userId - The user ID whose devices to list
+   * @returns Array of device records (includes revoked devices)
+   */
+  async listDevices(userId) {
+    const deviceIds = this.devicesByUserId.get(userId);
+    if (deviceIds === void 0) {
+      return [];
+    }
+    const devices = [];
+    for (const deviceId of deviceIds) {
+      const device = this.devicesById.get(deviceId);
+      if (device !== void 0) {
+        devices.push(device);
+      }
+    }
+    return devices;
+  }
+  /**
+   * Revoke a device, preventing it from being used for authentication.
+   *
+   * This is a soft revoke — the device record remains but is marked as revoked.
+   * If the device does not exist, this is a no-op.
+   *
+   * @param deviceId - The ID of the device to revoke
+   */
+  async revokeDevice(deviceId) {
+    const device = this.devicesById.get(deviceId);
+    if (device !== void 0) {
+      device.revoked = true;
+    }
+  }
+  /**
+   * Update the last-seen timestamp for a device.
+   *
+   * Called when a device authenticates or syncs to track activity.
+   * If the device does not exist, this is a no-op.
+   *
+   * @param deviceId - The ID of the device to update
+   */
+  async touchDevice(deviceId) {
+    const device = this.devicesById.get(deviceId);
+    if (device !== void 0) {
+      device.lastSeenAt = Date.now();
+    }
+  }
+};
+function toAuthUser(stored) {
+  return {
+    id: stored.id,
+    email: stored.email,
+    name: stored.name,
+    createdAt: stored.createdAt
+  };
+}
+
+// src/provider/built-in/auth-routes.ts
+var MIN_PASSWORD_LENGTH = 8;
+function isValidEmail(email) {
+  if (email.length === 0 || email.length > 254) {
+    return false;
+  }
+  const atIndex = email.indexOf("@");
+  if (atIndex < 1) {
+    return false;
+  }
+  const domain = email.slice(atIndex + 1);
+  if (domain.length === 0 || !domain.includes(".")) {
+    return false;
+  }
+  if (email.indexOf("@", atIndex + 1) !== -1) {
+    return false;
+  }
+  if (email.includes(" ")) {
+    return false;
+  }
+  return true;
+}
+var BuiltInAuthRoutes = class {
+  userStore;
+  tokenManager;
+  constructor(config) {
+    this.userStore = config.userStore;
+    this.tokenManager = config.tokenManager;
+  }
+  /**
+   * Handle user sign-up (POST /auth/signup).
+   *
+   * Validates email format and password length, hashes the password,
+   * creates the user, optionally registers a device, and issues tokens.
+   *
+   * @param body - Sign-up request body
+   * @param body.email - The user's email address
+   * @param body.password - The plaintext password (min 8 characters)
+   * @param body.name - Optional display name (defaults to email local part)
+   * @param body.deviceId - Optional device ID to register
+   * @param body.devicePublicKey - Optional device public key (base64url)
+   * @returns Auth response with the created user and tokens, or an error
+   */
+  async handleSignUp(body) {
+    if (!isValidEmail(body.email)) {
+      return {
+        status: 400,
+        body: {
+          error: "Invalid email address. Please provide a valid email in the format user@domain.com."
+        }
+      };
+    }
+    if (body.password.length < MIN_PASSWORD_LENGTH) {
+      return {
+        status: 400,
+        body: {
+          error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters long.`
+        }
+      };
+    }
+    const { hash, salt } = await hashPassword(body.password);
+    let user;
+    try {
+      user = await this.userStore.createUser({
+        email: body.email,
+        passwordHash: hash,
+        salt,
+        name: body.name ?? body.email.split("@")[0] ?? body.email
+      });
+    } catch (err) {
+      if (err instanceof Error && err.name === "DuplicateEmailError") {
+        return {
+          status: 409,
+          body: { error: "An account with this email already exists." }
+        };
+      }
+      throw err;
+    }
+    const deviceId = body.deviceId ?? `device-${user.id}`;
+    if (body.deviceId !== void 0 && body.devicePublicKey !== void 0) {
+      await this.userStore.registerDevice({
+        id: body.deviceId,
+        userId: user.id,
+        publicKey: body.devicePublicKey,
+        name: "Primary Device"
+      });
+    }
+    const tokens = this.tokenManager.issueTokens(user.id, deviceId);
+    return {
+      status: 201,
+      body: { data: { user, tokens } }
+    };
+  }
+  /**
+   * Handle user sign-in (POST /auth/signin).
+   *
+   * Looks up the user by email, verifies the password, optionally registers
+   * a new device, and issues tokens.
+   *
+   * @param body - Sign-in request body
+   * @param body.email - The user's email address
+   * @param body.password - The plaintext password
+   * @param body.deviceId - Optional device ID to register
+   * @param body.devicePublicKey - Optional device public key (base64url)
+   * @returns Auth response with the user and tokens, or an error
+   */
+  async handleSignIn(body) {
+    const storedUser = await this.userStore.findByEmail(body.email);
+    if (storedUser === null) {
+      return {
+        status: 401,
+        body: { error: "Invalid email or password." }
+      };
+    }
+    const passwordValid = await verifyPassword(
+      body.password,
+      storedUser.passwordHash,
+      storedUser.salt
+    );
+    if (!passwordValid) {
+      return {
+        status: 401,
+        body: { error: "Invalid email or password." }
+      };
+    }
+    const deviceId = body.deviceId ?? `device-${storedUser.id}`;
+    if (body.deviceId !== void 0 && body.devicePublicKey !== void 0) {
+      await this.userStore.registerDevice({
+        id: body.deviceId,
+        userId: storedUser.id,
+        publicKey: body.devicePublicKey,
+        name: "Device"
+      });
+    }
+    const tokens = this.tokenManager.issueTokens(storedUser.id, deviceId);
+    const user = {
+      id: storedUser.id,
+      email: storedUser.email,
+      name: storedUser.name,
+      createdAt: storedUser.createdAt
+    };
+    return {
+      status: 200,
+      body: { data: { user, tokens } }
+    };
+  }
+  /**
+   * Handle token refresh (POST /auth/refresh).
+   *
+   * Validates the provided refresh token and issues a new token pair
+   * (refresh token rotation). The old refresh token should be considered
+   * consumed after this call.
+   *
+   * @param body - Refresh request body
+   * @param body.refreshToken - The current refresh token
+   * @returns Auth response with new tokens, or an error
+   */
+  async handleRefresh(body) {
+    const result = this.tokenManager.refreshAccessToken(body.refreshToken);
+    if (result === null) {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired refresh token." }
+      };
+    }
+    return {
+      status: 200,
+      body: { data: result }
+    };
+  }
+  /**
+   * Handle get-current-user (GET /auth/me).
+   *
+   * Validates the access token and returns the authenticated user's profile.
+   *
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @returns Auth response with the user profile, or an error
+   */
+  async handleGetMe(accessToken) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
+    }
+    const storedUser = await this.userStore.findById(payload.sub);
+    if (storedUser === null) {
+      return {
+        status: 404,
+        body: { error: "User not found." }
+      };
+    }
+    const user = {
+      id: storedUser.id,
+      email: storedUser.email,
+      name: storedUser.name,
+      createdAt: storedUser.createdAt
+    };
+    return {
+      status: 200,
+      body: { data: user }
+    };
+  }
+  /**
+   * Handle list-devices (GET /auth/devices).
+   *
+   * Validates the access token and returns all devices registered for the user.
+   *
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @returns Auth response with the device list, or an error
+   */
+  async handleListDevices(accessToken) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
+    }
+    const devices = await this.userStore.listDevices(payload.sub);
+    return {
+      status: 200,
+      body: { data: devices }
+    };
+  }
+  /**
+   * Handle device revocation (DELETE /auth/device/:id).
+   *
+   * Validates the access token and revokes the specified device.
+   * Only the device's owner can revoke it.
+   *
+   * @param accessToken - The JWT access token (without "Bearer " prefix)
+   * @param deviceId - The ID of the device to revoke
+   * @returns Auth response with success flag, or an error
+   */
+  async handleRevokeDevice(accessToken, deviceId) {
+    const payload = this.tokenManager.validateToken(accessToken);
+    if (payload === null || payload.type !== "access") {
+      return {
+        status: 401,
+        body: { error: "Invalid or expired access token." }
+      };
+    }
+    const device = await this.userStore.findDevice(deviceId);
+    if (device === null) {
+      return {
+        status: 404,
+        body: { error: "Device not found." }
+      };
+    }
+    if (device.userId !== payload.sub) {
+      return {
+        status: 403,
+        body: { error: "You can only revoke your own devices." }
+      };
+    }
+    await this.userStore.revokeDevice(deviceId);
+    return {
+      status: 200,
+      body: { data: { success: true } }
+    };
+  }
+  /**
+   * Creates a sync server auth provider compatible with `@korajs/server`.
+   *
+   * The returned object implements the `AuthProvider` interface from
+   * `@korajs/server`, validating access tokens and returning an auth
+   * context containing the user ID and device metadata. This bridges
+   * the built-in auth system with the sync server's authentication layer.
+   *
+   * @returns An object with an `authenticate` method suitable for KoraSyncServer's `auth` config
+   *
+   * @example
+   * ```typescript
+   * const routes = new BuiltInAuthRoutes({ userStore, tokenManager })
+   * const syncServer = new KoraSyncServer({
+   *   store,
+   *   auth: routes.toSyncAuthProvider(),
+   * })
+   * ```
+   */
+  toSyncAuthProvider() {
+    const tokenManager = this.tokenManager;
+    const userStore = this.userStore;
+    return {
+      async authenticate(token) {
+        const payload = tokenManager.validateToken(token);
+        if (payload === null || payload.type !== "access") {
+          return null;
+        }
+        const user = await userStore.findById(payload.sub);
+        if (user === null) {
+          return null;
+        }
+        await userStore.touchDevice(payload.dev);
+        return {
+          userId: payload.sub,
+          metadata: {
+            deviceId: payload.dev,
+            email: user.email,
+            name: user.name
+          }
+        };
+      }
+    };
+  }
+};
+
+// src/provider/adapter.ts
+var AuthProviderError = class extends Error {
+  /** HTTP-style status code */
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "AuthProviderError";
+    this.status = status;
+  }
+};
+var BuiltInProvider = class {
+  routes;
+  tokenManager;
+  userStore;
+  constructor(config) {
+    this.routes = new BuiltInAuthRoutes(config);
+    this.tokenManager = config.tokenManager;
+    this.userStore = config.userStore;
+  }
+  /** @inheritdoc */
+  async signUp(params) {
+    const result = await this.routes.handleSignUp(params);
+    if ("error" in result.body) {
+      throw new AuthProviderError(result.body.error, result.status);
+    }
+    return result.body.data;
+  }
+  /** @inheritdoc */
+  async signIn(params) {
+    const result = await this.routes.handleSignIn(params);
+    if ("error" in result.body) {
+      throw new AuthProviderError(result.body.error, result.status);
+    }
+    return result.body.data;
+  }
+  /** @inheritdoc */
+  async refreshTokens(refreshToken) {
+    const result = await this.routes.handleRefresh({ refreshToken });
+    if ("error" in result.body) {
+      throw new AuthProviderError(result.body.error, result.status);
+    }
+    return result.body.data;
+  }
+  /** @inheritdoc */
+  async validateAccessToken(token) {
+    const payload = this.tokenManager.validateToken(token);
+    if (payload === null || payload.type !== "access") {
+      return null;
+    }
+    return { userId: payload.sub, deviceId: payload.dev };
+  }
+  /** @inheritdoc */
+  async getUser(userId) {
+    const stored = await this.userStore.findById(userId);
+    if (stored === null) {
+      return null;
+    }
+    return {
+      id: stored.id,
+      email: stored.email,
+      name: stored.name,
+      createdAt: stored.createdAt
+    };
+  }
+  /** @inheritdoc */
+  async revokeDevice(accessToken, deviceId) {
+    const result = await this.routes.handleRevokeDevice(accessToken, deviceId);
+    if ("error" in result.body) {
+      throw new AuthProviderError(result.body.error, result.status);
+    }
+  }
+  /** @inheritdoc */
+  async listDevices(accessToken) {
+    const result = await this.routes.handleListDevices(accessToken);
+    if ("error" in result.body) {
+      throw new AuthProviderError(result.body.error, result.status);
+    }
+    return result.body.data;
+  }
+};
+
+// src/device/device-identity.ts
+var import_core3 = require("@korajs/core");
+var CryptoUnavailableError = class extends import_core3.KoraError {
+  constructor() {
+    super(
+      "Web Crypto API (crypto.subtle) is not available in this environment. Device identity requires crypto.subtle, which is available in modern browsers and Node.js 20+. If running in SSR, ensure your runtime provides the Web Crypto API.",
+      "CRYPTO_UNAVAILABLE"
+    );
+    this.name = "CryptoUnavailableError";
+  }
+};
+var DeviceIdentityError = class extends import_core3.KoraError {
+  constructor(message, context) {
+    super(message, "DEVICE_IDENTITY_ERROR", context);
+    this.name = "DeviceIdentityError";
+  }
+};
+function toBase64Url(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(str) {
+  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  const paddingNeeded = (4 - base64.length % 4) % 4;
+  base64 += "=".repeat(paddingNeeded);
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+function assertCryptoAvailable() {
+  if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
+    throw new CryptoUnavailableError();
+  }
+}
+var ECDSA_ALGORITHM = {
+  name: "ECDSA",
+  namedCurve: "P-256"
+};
+var ECDSA_SIGN_ALGORITHM = {
+  name: "ECDSA",
+  hash: { name: "SHA-256" }
+};
+async function verifyChallenge(publicKeyJwk, challenge, signature) {
+  assertCryptoAvailable();
+  try {
+    const publicKey = await globalThis.crypto.subtle.importKey(
+      "jwk",
+      publicKeyJwk,
+      ECDSA_ALGORITHM,
+      true,
+      ["verify"]
+    );
+    const encoded = new TextEncoder().encode(challenge);
+    const signatureBytes = fromBase64Url(signature);
+    const isValid = await globalThis.crypto.subtle.verify(
+      ECDSA_SIGN_ALGORITHM,
+      publicKey,
+      signatureBytes,
+      encoded
+    );
+    return isValid;
+  } catch (cause) {
+    throw new DeviceIdentityError(
+      "Failed to verify challenge signature. The public key JWK or signature format may be invalid.",
+      {
+        cause: cause instanceof Error ? cause.message : String(cause),
+        publicKeyKty: publicKeyJwk.kty,
+        publicKeyCrv: publicKeyJwk.crv
+      }
+    );
+  }
+}
+async function computePublicKeyThumbprint(publicKeyJwk) {
+  assertCryptoAvailable();
+  if (publicKeyJwk.kty !== "EC") {
+    throw new DeviceIdentityError(
+      `Expected JWK key type "EC" but received "${publicKeyJwk.kty ?? "undefined"}". Only ECDSA public keys are supported for device identity.`,
+      { kty: publicKeyJwk.kty }
+    );
+  }
+  if (!publicKeyJwk.crv || !publicKeyJwk.x || !publicKeyJwk.y) {
+    throw new DeviceIdentityError(
+      'JWK is missing required EC fields. An EC public key JWK must include "crv", "x", and "y" members.',
+      {
+        hasCrv: Boolean(publicKeyJwk.crv),
+        hasX: Boolean(publicKeyJwk.x),
+        hasY: Boolean(publicKeyJwk.y)
+      }
+    );
+  }
+  const canonicalJson = JSON.stringify({
+    crv: publicKeyJwk.crv,
+    kty: publicKeyJwk.kty,
+    x: publicKeyJwk.x,
+    y: publicKeyJwk.y
+  });
+  try {
+    const encoded = new TextEncoder().encode(canonicalJson);
+    const hashBuffer = await globalThis.crypto.subtle.digest("SHA-256", encoded);
+    return toBase64Url(hashBuffer);
+  } catch (cause) {
+    throw new DeviceIdentityError(
+      "Failed to compute SHA-256 thumbprint of the public key JWK.",
+      { cause: cause instanceof Error ? cause.message : String(cause) }
+    );
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AuthProviderError,
+  BuiltInAuthRoutes,
+  BuiltInProvider,
+  DuplicateEmailError,
+  InMemoryUserStore,
+  TokenManager,
+  computePublicKeyThumbprint,
+  decodeJwt,
+  encodeJwt,
+  hashPassword,
+  isExpired,
+  verifyChallenge,
+  verifyJwt,
+  verifyPassword
+});
+//# sourceMappingURL=server.cjs.map