@krizaka/auth 0.13.1 → 0.13.3

package/dist/contract.js

@@ -4,7 +4,7 @@ import {
   meAccountSchema,
   meResponse,
   meSchema
-} from "./chunk-G46LWJPQ.js";
+} from "./chunk-3MIBOYLS.js";
 export {
   ME_HEADERS,
   ME_PATH,

package/dist/index.d.ts

@@ -1,12 +1,12 @@
 import { Query, ModuleSchema } from '@krizaka/db';
 export { Query } from '@krizaka/db';
-import { E as ExternalIdentity, a as IdentityLinkStore, S as SessionStore, N as NewSession, I as IdentityProvider } from './sessions-DZXjHjzd.js';
-export { C as CompleteOptions, F as FEDERATED_PROVIDERS, b as FEDERATION_CODE, c as FederatedProvider, d as FederationCode, e as FederationError, f as IdentityLinkError, g as Session, h as SessionCookie, i as Sessions, j as SessionsDeps, k as StartOptions, l as StartedSignIn, m as clearedSessionCookie, n as createSessions, o as dbIdentityLinks, p as identityLinksMigration, q as isFederatedProvider, r as isLocalReturn, s as memoryIdentityLinks, t as memoryIdentityProvider, u as pkceChallenge, v as sessionCookie, w as sessionTokenOf } from './sessions-DZXjHjzd.js';
+import { E as ExternalIdentity, a as IdentityLinkStore, S as SessionStore, N as NewSession, I as IdentityProvider } from './sessions-DscdTKEJ.js';
+export { C as CompleteOptions, F as FEDERATED_PROVIDERS, b as FEDERATION_CODE, c as FederatedProvider, d as FederationCode, e as FederationError, f as IdentityLinkError, g as Session, h as SessionCookie, i as Sessions, j as SessionsDeps, k as StartOptions, l as StartedSignIn, m as clearedSessionCookie, n as createSessions, o as dbIdentityLinks, p as identityLinksMigration, q as isFederatedProvider, r as isLocalReturn, s as memoryIdentityLinks, t as memoryIdentityProvider, u as pkceChallenge, v as sessionCookie, w as sessionTokenOf } from './sessions-DscdTKEJ.js';
 import { a as RoleModel } from './roles-model-CSCe8O57.js';
 export { R as ROLES_CODE, b as RolesCode, c as RolesError, d as can, e as defineRoles } from './roles-model-CSCe8O57.js';
 
 /**
- * The account PORT (ADR-0008 of Yomizaka, now shared). A product's account — name, language, theme, avatar, e-mail change with
+ * The account PORT (ADR-0008 of Verikora, now shared). A product's account — name, language, theme, avatar, e-mail change with
  * verification, password (changed when signed in, or reset by a mailed link), sessions, export, deletion — behind one interface. Every product keeps its OWN accounts: no central
  * service, no runtime dependency between products.
  */
@@ -106,11 +106,11 @@ interface AccountDeps {
      */
     transaction?: <T>(work: (query: Query) => Promise<T>) => Promise<T>;
     mail: (mail: Mail) => Promise<void>;
-    /** `https://www.akinaza.com`: the e-mail change link is `<baseUrl>/<locale>/confirm-email?token=…`, the reset link `<baseUrl>/<locale>/reset-password?token=…`. */
+    /** `https://www.folioviv.com`: the e-mail change link is `<baseUrl>/<locale>/confirm-email?token=…`, the reset link `<baseUrl>/<locale>/reset-password?token=…`. */
     baseUrl: string;
-    /** The product's name, in the words of the mail (« Akinaza »). */
+    /** The product's name, in the words of the mail (« Folioviv »). */
     product: string;
-    /** The product's token prefix, two or three letters (`ye1.` for Yomizaka: `ye`). The tokens are `<prefix>1.<43 base64url>`. */
+    /** The product's token prefix, two or three letters (`ye1.` for Verikora: `ye`). The tokens are `<prefix>1.<43 base64url>`. */
     tokenPrefix: string;
     passwords: {
         hash: (password: string) => Promise<string>;
@@ -279,14 +279,14 @@ type FederatedSignIn = ReturnType<typeof createFederatedSignIn>;
 declare const SESSION_HINT_COOKIE = "kz-session";
 /** Where a signed-in visitor of the landing route goes. */
 interface LandingRule {
-    /** The product's session cookie name (`yomizaka_session`). */
+    /** The product's session cookie name (`verikora_session`). */
     cookie: string;
     /** The landing routes (`["/", "/fr", "/en"]`): exact paths, a trailing slash tolerated. */
     landing: readonly string[];
     /** The signed-in start page, or a function of the request (the language of the address). */
     home: string | ((request: Request) => string);
     /**
-     * The product's own public origin (`https://dev.yomizaka.com`), from its declared environment (APP_URL), NEVER from the
+     * The product's own public origin (`https://dev.verikora.com`), from its declared environment (APP_URL), NEVER from the
      * request: `Host` and `x-forwarded-*` are client-controlled. With it the Location is absolute on that origin (what a
      * Next.js proxy accepts). Only the origin of the value is used. Optional outside production (the Location is then
      * relative); REQUIRED in production, where a missing origin throws instead of falling back to the request's headers.
@@ -494,7 +494,7 @@ type Fetcher = (url: string, init: {
     json(): Promise<unknown>;
 }>;
 interface UsersFederationOptions {
-    /** The tenant host of the product: `https://auth.dev.akinaza.com`. */
+    /** The tenant host of the product: `https://auth.dev.folioviv.com`. */
     baseUrl: string;
     /** The product's public address: the start URL sends the person back to it, so `returnTo` is absolute from it. */
     appUrl: string;
@@ -503,7 +503,8 @@ interface UsersFederationOptions {
 /** Reads krizaka-users' answer into an identity; anything that is not a complete identity is refused. */
 declare function parseExternalIdentity(body: unknown): ExternalIdentity;
 /**
- * The adapter for krizaka-users (`auth.<product>` tenant host, krizaka/krizaka-users#31): `start` builds the tenant's start address,
+ * The adapter for the users service (`auth.<product>` tenant host), which lives in krizaka/krizaka-java `krizaka-users/` since
+ * ADR-021 (the federation landed as krizaka/krizaka-users#31, the old split): `start` builds the tenant's start address,
  * `complete` exchanges the one-time code (and the PKCE verifier of a native app) for the verified identity.
  */
 declare function usersIdentityProvider({ baseUrl, appUrl, fetch }: UsersFederationOptions): IdentityProvider;

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   pkceChallenge,
   rolesSchema,
   sessionsSchema
-} from "./chunk-5CFOMWBN.js";
+} from "./chunk-2QUHBEBL.js";
 import {
   AccountError,
   EMAIL_CHANGE_TTL_HOURS,
@@ -29,13 +29,13 @@ import {
   linkToken,
   passwordResetMail,
   postgresAccounts
-} from "./chunk-3CLSDLXB.js";
+} from "./chunk-73MO6V5M.js";
 import {
   ROLES_CODE,
   RolesError,
   can,
   defineRoles
-} from "./chunk-2PWX2B4I.js";
+} from "./chunk-RWKBQE6N.js";
 
 // src/admin-gate.ts
 var ADMIN_REFUSAL = {
@@ -136,14 +136,18 @@ function landingRedirect(request, rule) {
   const path = `${target.pathname}${target.search}${target.hash}`;
   const base = rule.origin ? new URL(rule.origin).origin : null;
   const location = base && new URL(home, base).origin === base ? new URL(home, base).href : path;
-  return new Response(null, { status: 307, headers: { Location: location, "Cache-Control": "private, no-store", Vary: "Cookie" } });
+  return new Response(null, {
+    status: 307,
+    headers: { Location: location, "Cache-Control": "private, no-store", Vary: "Cookie" }
+  });
 }
 function sessionHint(response, request, options) {
   const session = Boolean(cookieValue(request.headers, options.cookie));
   const flagged = cookieValue(request.headers, SESSION_HINT_COOKIE) === "1";
   const base = `${SESSION_HINT_COOKIE}=${session ? "1" : ""}; Path=/; SameSite=Lax${options.secure ? "; Secure" : ""}`;
   if (session && !flagged) response.headers.append("Set-Cookie", base);
-  else if (!session && cookieValue(request.headers, SESSION_HINT_COOKIE) !== void 0) response.headers.append("Set-Cookie", `${base}; Max-Age=0`);
+  else if (!session && cookieValue(request.headers, SESSION_HINT_COOKIE) !== void 0)
+    response.headers.append("Set-Cookie", `${base}; Max-Age=0`);
   return response;
 }
 
@@ -157,8 +161,14 @@ function accountsMigration(options = {}) {
   return accountsSchema(options).migrations[0].sql({ schema: "public", tables: { accounts: "accounts" } });
 }
 function rolesMigration(roles, options = {}) {
-  const tables = { owner: ident(options.ownerTable ?? "accounts"), ...options.scopeTable ? { scope: ident(options.scopeTable) } : {} };
-  return rolesSchema(roles, { scoped: options.scopeTable !== void 0 }).migrations[0].sql({ schema: "public", tables });
+  const tables = {
+    owner: ident(options.ownerTable ?? "accounts"),
+    ...options.scopeTable ? { scope: ident(options.scopeTable) } : {}
+  };
+  return rolesSchema(roles, { scoped: options.scopeTable !== void 0 }).migrations[0].sql({
+    schema: "public",
+    tables
+  });
 }
 
 // src/password.ts
@@ -188,7 +198,12 @@ async function verifyPassword(password, stored) {
   const [scheme, n, r, p, salt, hash] = stored.split("$");
   if (scheme !== "scrypt" || !salt || !hash || password.length > PASSWORD_MAX_LENGTH) return false;
   const expected = Buffer.from(hash, "base64url");
-  const given = await scrypt(password, Buffer.from(salt, "base64url"), expected.length, { N: Number(n), r: Number(r), p: Number(p), maxmem: MAXMEM });
+  const given = await scrypt(password, Buffer.from(salt, "base64url"), expected.length, {
+    N: Number(n),
+    r: Number(r),
+    p: Number(p),
+    maxmem: MAXMEM
+  });
   return given.length === expected.length && crypto2.timingSafeEqual(given, expected);
 }
 var decoy;
@@ -205,10 +220,16 @@ function createRoles(deps) {
     return role;
   };
   const newToken = deps.token ?? (() => `${deps.tokenPrefix}1.${crypto3.randomBytes(32).toString("base64url")}`);
-  const owners = (scopeId) => query("SELECT account_id FROM memberships WHERE scope_id = $1 AND role = $2", [scopeId, ownerRole()]);
+  const owners = (scopeId) => query("SELECT account_id FROM memberships WHERE scope_id = $1 AND role = $2", [
+    scopeId,
+    ownerRole()
+  ]);
   const ownerRole = () => model.roles.find((r) => model.roles.every((x) => model.manages[r].includes(x) || x === r)) ?? model.roles[0];
   async function roleOf(accountId, scopeId) {
-    const [row] = await query("SELECT role FROM memberships WHERE scope_id = $1 AND account_id = $2", [scopeId, accountId]);
+    const [row] = await query("SELECT role FROM memberships WHERE scope_id = $1 AND account_id = $2", [
+      scopeId,
+      accountId
+    ]);
     return row?.role ?? null;
   }
   return {
@@ -216,7 +237,10 @@ function createRoles(deps) {
     roleOf,
     /** Every scope the person belongs to, with their role in it. */
     async scopesOf(accountId) {
-      return (await query("SELECT scope_id, role FROM memberships WHERE account_id = $1 ORDER BY created_at", [accountId])).map((r) => ({ scopeId: r.scope_id, role: r.role }));
+      return (await query(
+        "SELECT scope_id, role FROM memberships WHERE account_id = $1 ORDER BY created_at",
+        [accountId]
+      )).map((r) => ({ scopeId: r.scope_id, role: r.role }));
     },
     /** The person's role in the scope if it holds the permission; otherwise `NOT_A_MEMBER` (404: nothing tells the scope exists) or `FORBIDDEN`. */
     async authorize(accountId, scopeId, permission) {
@@ -238,7 +262,13 @@ function createRoles(deps) {
         "SELECT m.account_id, a.email, a.name, m.role, m.created_at FROM memberships m JOIN accounts a ON a.id = m.account_id WHERE m.scope_id = $1 ORDER BY m.created_at",
         [scopeId]
       );
-      return rows.map((r) => ({ accountId: r.account_id, email: r.email, name: r.name, role: r.role, since: r.created_at }));
+      return rows.map((r) => ({
+        accountId: r.account_id,
+        email: r.email,
+        name: r.name,
+        role: r.role,
+        since: r.created_at
+      }));
     },
     /** Changes someone's role. The actor must manage both the current and the new role; the last owner can never be demoted. */
     async setRole(scopeId, actor, target, role) {
@@ -246,8 +276,10 @@ function createRoles(deps) {
       const mine = await roleOf(actor.id, scopeId);
       const current = await roleOf(target, scopeId);
       if (!mine || !current) throw new RolesError(ROLES_CODE.notMember);
-      if (!model.manages[mine].includes(current) || !model.manages[mine].includes(role)) throw new RolesError(ROLES_CODE.notAllowed);
-      if (current === ownerRole() && role !== current && (await owners(scopeId)).length <= 1) throw new RolesError(ROLES_CODE.lastOwner);
+      if (!model.manages[mine].includes(current) || !model.manages[mine].includes(role))
+        throw new RolesError(ROLES_CODE.notAllowed);
+      if (current === ownerRole() && role !== current && (await owners(scopeId)).length <= 1)
+        throw new RolesError(ROLES_CODE.lastOwner);
       await query("UPDATE memberships SET role = $3 WHERE scope_id = $1 AND account_id = $2", [scopeId, target, role]);
     },
     /** Removes someone from the scope (or leaves it, when the target is the actor). The last owner cannot go. */
@@ -266,22 +298,50 @@ function createRoles(deps) {
       if (!mine) throw new RolesError(ROLES_CODE.notMember);
       if (!model.manages[mine].includes(role)) throw new RolesError(ROLES_CODE.notAllowed);
       const email = input.email.trim().toLowerCase();
-      await query("UPDATE invitations SET used_at = $3 WHERE scope_id = $1 AND email = $2 AND used_at IS NULL", [scopeId, email, now]);
+      await query("UPDATE invitations SET used_at = $3 WHERE scope_id = $1 AND email = $2 AND used_at IS NULL", [
+        scopeId,
+        email,
+        now
+      ]);
       const token = newToken();
       const [row] = await query(
         "INSERT INTO invitations (id, scope_id, email, role, token_hash, invited_by, created_at, expires_at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8) RETURNING id, created_at, expires_at",
-        [crypto3.randomUUID(), scopeId, email, role, deps.tokenHash(token), actor.id, now, addHours(now, deps.inviteTtlHours)]
+        [
+          crypto3.randomUUID(),
+          scopeId,
+          email,
+          role,
+          deps.tokenHash(token),
+          actor.id,
+          now,
+          addHours(now, deps.inviteTtlHours)
+        ]
       );
-      return { token, invitation: { id: row.id, email, role, createdAt: row.created_at, expiresAt: row.expires_at } };
+      return {
+        token,
+        invitation: { id: row.id, email, role, createdAt: row.created_at, expiresAt: row.expires_at }
+      };
     },
     async pendingInvitations(scopeId, now) {
-      const rows = await query("SELECT id, email, role, created_at, expires_at FROM invitations WHERE scope_id = $1 AND used_at IS NULL AND expires_at > $2 ORDER BY created_at", [scopeId, now]);
-      return rows.map((r) => ({ id: r.id, email: r.email, role: r.role, createdAt: r.created_at, expiresAt: r.expires_at }));
+      const rows = await query(
+        "SELECT id, email, role, created_at, expires_at FROM invitations WHERE scope_id = $1 AND used_at IS NULL AND expires_at > $2 ORDER BY created_at",
+        [scopeId, now]
+      );
+      return rows.map((r) => ({
+        id: r.id,
+        email: r.email,
+        role: r.role,
+        createdAt: r.created_at,
+        expiresAt: r.expires_at
+      }));
     },
     async revokeInvitation(scopeId, actor, invitationId, now) {
       const mine = await roleOf(actor.id, scopeId);
       if (!mine) throw new RolesError(ROLES_CODE.notMember);
-      const [row] = await query("SELECT role FROM invitations WHERE id = $1 AND scope_id = $2 AND used_at IS NULL", [invitationId, scopeId]);
+      const [row] = await query(
+        "SELECT role FROM invitations WHERE id = $1 AND scope_id = $2 AND used_at IS NULL",
+        [invitationId, scopeId]
+      );
       if (!row) throw new RolesError(ROLES_CODE.inviteInvalid);
       if (!model.manages[mine].includes(row.role)) throw new RolesError(ROLES_CODE.notAllowed);
       await query("UPDATE invitations SET used_at = $2 WHERE id = $1", [invitationId, now]);
@@ -296,8 +356,15 @@ function createRoles(deps) {
       if (row.email !== account.email.trim().toLowerCase()) throw new RolesError(ROLES_CODE.inviteWrongAccount);
       await query("UPDATE invitations SET used_at = $2 WHERE id = $1", [row.id, now]);
       const current = await roleOf(account.id, row.scope_id);
-      if (!current || model.manages[current].length < model.manages[row.role].length) await query("INSERT INTO memberships (scope_id, account_id, role, invited_by, created_at) VALUES ($1, $2, $3, $4, $5) ON CONFLICT (scope_id, account_id) DO UPDATE SET role = excluded.role", [row.scope_id, account.id, row.role, row.invited_by, now]);
-      return { scopeId: row.scope_id, role: !current || model.manages[current].length < model.manages[row.role].length ? row.role : current };
+      if (!current || model.manages[current].length < model.manages[row.role].length)
+        await query(
+          "INSERT INTO memberships (scope_id, account_id, role, invited_by, created_at) VALUES ($1, $2, $3, $4, $5) ON CONFLICT (scope_id, account_id) DO UPDATE SET role = excluded.role",
+          [row.scope_id, account.id, row.role, row.invited_by, now]
+        );
+      return {
+        scopeId: row.scope_id,
+        role: !current || model.manages[current].length < model.manages[row.role].length ? row.role : current
+      };
     }
   };
 }
@@ -308,7 +375,8 @@ var BODY = /^[A-Za-z0-9_-]{43}$/;
 var PREFIX = /^[a-z]{1,4}$/;
 var USER_AGENT_MAX = 300;
 function createSessions(deps) {
-  if (!PREFIX.test(deps.tokenPrefix)) throw new RangeError(`tokenPrefix must be 1 to 4 lower-case letters, got ${deps.tokenPrefix}`);
+  if (!PREFIX.test(deps.tokenPrefix))
+    throw new RangeError(`tokenPrefix must be 1 to 4 lower-case letters, got ${deps.tokenPrefix}`);
   const head = `${deps.tokenPrefix}1.`;
   const secret = () => typeof deps.secret === "function" ? deps.secret() : deps.secret;
   const isToken = (value) => !!value && value.startsWith(head) && BODY.test(value.slice(head.length));
@@ -320,12 +388,20 @@ function createSessions(deps) {
     tokenHash,
     async create(accountId, meta) {
       const days = typeof deps.sessionDays === "function" ? await deps.sessionDays() : deps.sessionDays;
-      if (!Number.isInteger(days) || days < 1) throw new RangeError(`sessionDays must be a whole number of days from 1, got ${days}`);
+      if (!Number.isInteger(days) || days < 1)
+        throw new RangeError(`sessionDays must be a whole number of days from 1, got ${days}`);
       const token = newToken();
       const createdAt = deps.clock.now();
       const expires = new Date(createdAt);
       expires.setUTCHours(expires.getUTCHours() + days * 24);
-      await deps.store.insert({ accountId, tokenHash: tokenHash(token), createdAt, expiresAt: expires, ip: meta.ip, userAgent: meta.userAgent?.slice(0, USER_AGENT_MAX) ?? null });
+      await deps.store.insert({
+        accountId,
+        tokenHash: tokenHash(token),
+        createdAt,
+        expiresAt: expires,
+        ip: meta.ip,
+        userAgent: meta.userAgent?.slice(0, USER_AGENT_MAX) ?? null
+      });
       return { token, expires };
     },
     async resolve(token) {
@@ -339,7 +415,15 @@ function createSessions(deps) {
   };
 }
 function sessionCookie(token, expires, options) {
-  return { name: options.name, value: token, httpOnly: true, secure: options.secure, sameSite: "lax", path: "/", expires };
+  return {
+    name: options.name,
+    value: token,
+    httpOnly: true,
+    secure: options.secure,
+    sameSite: "lax",
+    path: "/",
+    expires
+  };
 }
 function clearedSessionCookie(options, now) {
   return sessionCookie("", now, options);
@@ -385,7 +469,10 @@ function dbSessionStore(query, options) {
   const active = options.active ? ` AND a.${ident2(options.active.column)} = $3` : "";
   return {
     async insert(session) {
-      await query(`INSERT INTO ${sessions} (account_id, token_hash, created_at, expires_at, ip, user_agent) VALUES ($1, $2, $3, $4, $5, $6)`, [session.accountId, session.tokenHash, session.createdAt, session.expiresAt, session.ip, session.userAgent]);
+      await query(
+        `INSERT INTO ${sessions} (account_id, token_hash, created_at, expires_at, ip, user_agent) VALUES ($1, $2, $3, $4, $5, $6)`,
+        [session.accountId, session.tokenHash, session.createdAt, session.expiresAt, session.ip, session.userAgent]
+      );
     },
     async find(tokenHash, now) {
       const params = [tokenHash, now];
@@ -412,7 +499,8 @@ function parseExternalIdentity(body) {
   const o = body ?? {};
   const issuer = text(o.issuer);
   const subject = text(o.subject);
-  if (!issuer || !subject) throw new FederationError(FEDERATION_CODE.unavailable, "krizaka-users answered without an issuer and a subject");
+  if (!issuer || !subject)
+    throw new FederationError(FEDERATION_CODE.unavailable, "krizaka-users answered without an issuer and a subject");
   return { issuer, subject, email: text(o.email), emailVerified: o.email_verified === true, name: text(o.name) };
 }
 function usersIdentityProvider({ baseUrl, appUrl, fetch }) {
@@ -420,8 +508,10 @@ function usersIdentityProvider({ baseUrl, appUrl, fetch }) {
   const app = appUrl.replace(/\/+$/, "");
   return {
     async start(provider, returnTo, options = {}) {
-      if (!isFederatedProvider(provider)) throw new FederationError(FEDERATION_CODE.unknownProvider, `Unknown provider ${String(provider)}`);
-      if (!isLocalReturn(returnTo)) throw new FederationError(FEDERATION_CODE.badReturn, "That return address is not allowed");
+      if (!isFederatedProvider(provider))
+        throw new FederationError(FEDERATION_CODE.unknownProvider, `Unknown provider ${String(provider)}`);
+      if (!isLocalReturn(returnTo))
+        throw new FederationError(FEDERATION_CODE.badReturn, "That return address is not allowed");
       const state = crypto.randomUUID();
       const query = new URLSearchParams({ return_to: `${app}${returnTo}`, state });
       if (options.codeChallenge) {
@@ -436,8 +526,10 @@ function usersIdentityProvider({ baseUrl, appUrl, fetch }) {
         headers: { "content-type": "application/json" },
         body: JSON.stringify({ code, ...options.codeVerifier ? { code_verifier: options.codeVerifier } : {} })
       });
-      if (response.status === 400 || response.status === 401 || response.status === 404 || response.status === 410) throw new FederationError(FEDERATION_CODE.invalidCode, "That code is not valid");
-      if (!response.ok) throw new FederationError(FEDERATION_CODE.unavailable, `krizaka-users answered ${response.status}`);
+      if (response.status === 400 || response.status === 401 || response.status === 404 || response.status === 410)
+        throw new FederationError(FEDERATION_CODE.invalidCode, "That code is not valid");
+      if (!response.ok)
+        throw new FederationError(FEDERATION_CODE.unavailable, `krizaka-users answered ${response.status}`);
       return parseExternalIdentity(await response.json());
     }
   };