@krizaka/auth 0.7.0 → 0.9.0

package/dist/index.js

@@ -3,204 +3,78 @@ import {
   FEDERATION_CODE,
   FederationError,
   IdentityLinkError,
+  accountsSchema,
   dbIdentityLinks,
   identityLinksMigration,
+  identityLinksSchema,
   isFederatedProvider,
   isLocalReturn,
   memoryIdentityLinks,
   memoryIdentityProvider,
-  pkceChallenge
-} from "./chunk-H7AKE2OH.js";
-
-// src/accounts.ts
-import crypto2 from "crypto";
-import { addHours, addMinutes } from "date-fns";
-
-// src/port.ts
-var AccountError = class extends Error {
-  constructor(status, code, message) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.name = "AccountError";
-  }
-  status;
-  code;
-};
+  pkceChallenge,
+  rolesSchema,
+  sessionsSchema
+} from "./chunk-5CFOMWBN.js";
+import {
+  AccountError,
+  EMAIL_CHANGE_TTL_HOURS,
+  PASSWORD_RESET_MAX_MINUTES,
+  PASSWORD_RESET_MIN_MINUTES,
+  PASSWORD_RESET_TTL_MINUTES,
+  dbAccounts,
+  emailChangeMail,
+  emailChangeToken,
+  isEmailChangeToken,
+  isLinkToken,
+  linkToken,
+  passwordResetMail,
+  postgresAccounts
+} from "./chunk-3CLSDLXB.js";
 
-// src/accounts.ts
-var EMAIL_CHANGE_TTL_HOURS = 24;
-var PASSWORD_RESET_TTL_MINUTES = 30;
-var PASSWORD_RESET_MIN_MINUTES = 5;
-var PASSWORD_RESET_MAX_MINUTES = 1440;
-var checkResetTtl = (minutes) => {
-  if (!Number.isInteger(minutes) || minutes < PASSWORD_RESET_MIN_MINUTES || minutes > PASSWORD_RESET_MAX_MINUTES) {
-    throw new RangeError(`passwordResetTtlMinutes must be a whole number from ${PASSWORD_RESET_MIN_MINUTES} to ${PASSWORD_RESET_MAX_MINUTES}, got ${minutes}`);
-  }
-  return minutes;
+// src/admin-gate.ts
+var ADMIN_REFUSAL = {
+  unauthenticated: "UNAUTHENTICATED",
+  forbidden: "FORBIDDEN",
+  ipNotAllowed: "IP_NOT_ALLOWED",
+  notFound: "NOT_FOUND"
 };
-var NAME_MAX = 80;
-var PASSWORD_MIN = 12;
-var PASSWORD_MAX = 256;
-var THEMES = ["light", "dark", "system"];
-var linkToken = (prefix) => `${prefix}1.${crypto2.randomBytes(32).toString("base64url")}`;
-var isLinkToken = (prefix, value) => !!value && new RegExp(`^${prefix}1\\.[A-Za-z0-9_-]{43}$`).test(value);
-var emailChangeToken = linkToken;
-var isEmailChangeToken = isLinkToken;
-function passwordResetMail(product, locale, url, ttlMinutes = PASSWORD_RESET_TTL_MINUTES) {
-  checkResetTtl(ttlMinutes);
-  return locale === "fr" ? { subject: `R\xE9initialisez votre mot de passe \u2014 ${product}`, text: `Bonjour,
-
-Pour choisir un nouveau mot de passe pour votre compte ${product}, ouvrez ce lien (valide ${ttlMinutes} min, une seule fois) :
-${url}
-
-Si vous n'avez rien demand\xE9, ignorez ce message : votre mot de passe ne change pas.
-` } : { subject: `Reset your password \u2014 ${product}`, text: `Hello,
-
-To choose a new password for your ${product} account, open this link (valid ${ttlMinutes} min, once):
-${url}
-
-If you did not ask for this, ignore this message: your password does not change.
-` };
+function allowedIps(list, options) {
+  if (list.length > 0) return list;
+  return options.production ? [] : null;
+}
+function ipAllowed(ip, allowed) {
+  if (allowed === null) return true;
+  return !!ip && allowed.includes(ip);
+}
+function requireAdmin(input) {
+  const page = input.surface === "page";
+  const refuse = (status, code) => page ? { ok: false, status: 404, code: ADMIN_REFUSAL.notFound } : { ok: false, status, code };
+  if (!input.session) return refuse(401, ADMIN_REFUSAL.unauthenticated);
+  if (input.session.account.role !== (input.role ?? "ADMIN")) return refuse(403, ADMIN_REFUSAL.forbidden);
+  if (!ipAllowed(input.ip, input.allowedIps)) return refuse(403, ADMIN_REFUSAL.ipNotAllowed);
+  return { ok: true };
 }
-function emailChangeMail(product, locale, url) {
-  return locale === "fr" ? { subject: `Confirmez votre nouvelle adresse \u2014 ${product}`, text: `Bonjour,
-
-Pour utiliser cette adresse avec votre compte ${product}, confirmez-la en ouvrant ce lien (valide ${EMAIL_CHANGE_TTL_HOURS} h) :
-${url}
-
-Si vous n'avez rien demand\xE9, ignorez ce message : rien ne change.
-` } : { subject: `Confirm your new address \u2014 ${product}`, text: `Hello,
-
-To use this address with your ${product} account, confirm it by opening this link (valid ${EMAIL_CHANGE_TTL_HOURS} h):
-${url}
 
-If you did not ask for this, ignore this message: nothing changes.
-` };
+// src/client-ip.ts
+var IPV4 = /^(?:\d{1,3}\.){3}\d{1,3}$/;
+var IPV6 = /^[0-9a-f:]+(?:%\w+)?$/i;
+function isIp(value) {
+  return IPV4.test(value) && value.split(".").every((n) => Number(n) <= 255) || value.includes(":") && IPV6.test(value);
 }
-var looksLikeEmail = (address) => {
-  if (address.length > 320 || /\s/.test(address)) return false;
-  const at = address.indexOf("@");
-  if (at < 1 || at !== address.lastIndexOf("@")) return false;
-  const domain = address.slice(at + 1);
-  const dot = domain.lastIndexOf(".");
-  return dot > 0 && dot < domain.length - 1;
-};
-var cleanName = (raw) => {
-  const name = raw.replace(/\s+/g, " ").trim();
-  if (name.length > NAME_MAX) throw new AccountError(400, "BAD_REQUEST", `A name is at most ${NAME_MAX} characters`);
-  return name;
-};
-function dbAccounts(deps) {
-  const { query } = deps;
-  const resetTtlMinutes = checkResetTtl(deps.passwordResetTtlMinutes ?? PASSWORD_RESET_TTL_MINUTES);
-  const transaction = deps.transaction ?? ((work) => work(query));
-  const wrong = () => new AccountError(403, "WRONG_PASSWORD", "The password is not right");
-  async function profileOf(id) {
-    const [row] = await query(
-      `SELECT a.id, a.email, a.name, a.locale, a.theme, a.avatar_seed, a.email_verified_at,
-              (SELECT c.new_email FROM email_changes c WHERE c.account_id = a.id AND c.used_at IS NULL AND c.expires_at > now() ORDER BY c.created_at DESC LIMIT 1) AS pending
-         FROM accounts a WHERE a.id = $1`,
-      [id]
-    );
-    if (!row) throw new AccountError(404, "NOT_FOUND", "No such account");
-    return { id: row.id, email: row.email, name: row.name, locale: row.locale, theme: row.theme, avatarSeed: row.avatar_seed, emailVerified: !!row.email_verified_at, pendingEmail: row.pending };
-  }
-  async function confirmPassword(id, password) {
-    const [row] = await query("SELECT password_hash FROM accounts WHERE id = $1", [id]);
-    if (!row?.password_hash || password.length > PASSWORD_MAX || !await deps.passwords.verify(password, row.password_hash)) throw wrong();
+function clientIp(headers, rules = {}) {
+  const custom = rules.header?.trim().toLowerCase();
+  if (custom) {
+    const value = headers.get(custom)?.split(",")[0]?.trim();
+    if (value && isIp(value)) return value;
   }
-  return {
-    profile: profileOf,
-    async updateProfile(id, patch) {
-      const name = patch.name === void 0 ? void 0 : patch.name === null ? null : cleanName(patch.name);
-      if (patch.avatarSeed && !/^[a-z0-9-]{1,40}$/.test(patch.avatarSeed)) throw new AccountError(400, "BAD_REQUEST", "Not an avatar");
-      if (patch.theme && !THEMES.includes(patch.theme)) throw new AccountError(400, "BAD_REQUEST", "Not a theme");
-      await query(
-        `UPDATE accounts SET name = CASE WHEN $2::boolean THEN $3 ELSE name END, locale = COALESCE($4, locale),
-                avatar_seed = CASE WHEN $5::boolean THEN $6 ELSE avatar_seed END, theme = CASE WHEN $7::boolean THEN $8 ELSE theme END WHERE id = $1`,
-        [id, name !== void 0, name === "" ? null : name ?? null, patch.locale ?? null, patch.avatarSeed !== void 0, patch.avatarSeed ?? null, patch.theme !== void 0, patch.theme ?? null]
-      );
-      return profileOf(id);
-    },
-    async requestEmailChange(id, input, now) {
-      await confirmPassword(id, input.password);
-      const address = input.newEmail.trim().toLowerCase();
-      if (!looksLikeEmail(address)) throw new AccountError(400, "BAD_REQUEST", "Not an e-mail address");
-      const [taken] = await query("SELECT 1 FROM accounts WHERE email = $1", [address]);
-      if (taken) return;
-      const profile = await profileOf(id);
-      await query("UPDATE email_changes SET used_at = $2 WHERE account_id = $1 AND used_at IS NULL", [id, now]);
-      const token = (deps.token ?? (() => emailChangeToken(deps.tokenPrefix)))();
-      await query("INSERT INTO email_changes (account_id, new_email, token_hash, expires_at) VALUES ($1, $2, $3, $4)", [id, address, deps.tokenHash(token), addHours(now, EMAIL_CHANGE_TTL_HOURS)]);
-      const url = `${deps.baseUrl.replace(/\/$/, "")}/${profile.locale}/confirm-email?token=${encodeURIComponent(token)}`;
-      await deps.mail({ to: address, locale: profile.locale, ...emailChangeMail(deps.product, profile.locale, url), link: { kind: "emailChange", url, hours: EMAIL_CHANGE_TTL_HOURS } });
-    },
-    async confirmEmailChange(token, now) {
-      if (!isEmailChangeToken(deps.tokenPrefix, token)) return "INVALID";
-      const [row] = await query("UPDATE email_changes SET used_at = $2 WHERE token_hash = $1 AND used_at IS NULL AND expires_at > $2 RETURNING account_id, new_email", [deps.tokenHash(token), now]);
-      if (!row) return "INVALID";
-      try {
-        await query("UPDATE accounts SET email = $2, email_verified_at = $3 WHERE id = $1", [row.account_id, row.new_email, now]);
-      } catch {
-        return "INVALID";
-      }
-      return "CHANGED";
-    },
-    async changePassword(id, input, keepSessionId) {
-      await confirmPassword(id, input.current);
-      if (input.next.length < PASSWORD_MIN) throw new AccountError(400, "PASSWORD_TOO_SHORT", `At least ${PASSWORD_MIN} characters`);
-      if (input.next.length > PASSWORD_MAX) throw new AccountError(400, "PASSWORD_TOO_LONG", `At most ${PASSWORD_MAX} characters`);
-      await query("UPDATE accounts SET password_hash = $2 WHERE id = $1", [id, await deps.passwords.hash(input.next)]);
-      await query("DELETE FROM sessions WHERE account_id = $1 AND ($2::uuid IS NULL OR id <> $2::uuid)", [id, keepSessionId ?? null]);
-    },
-    confirmPassword,
-    async requestPasswordReset(email, now) {
-      const address = email.trim().toLowerCase();
-      if (!looksLikeEmail(address)) return;
-      const issued = await transaction(async (q) => {
-        const [row] = await q("SELECT id, locale FROM accounts WHERE email = $1 AND password_hash IS NOT NULL FOR UPDATE", [address]);
-        if (!row) return null;
-        await q("UPDATE password_resets SET used_at = $2 WHERE account_id = $1 AND used_at IS NULL", [row.id, now]);
-        const token = (deps.token ?? (() => linkToken(deps.tokenPrefix)))();
-        await q("INSERT INTO password_resets (account_id, token_hash, expires_at) VALUES ($1, $2, $3)", [row.id, deps.tokenHash(token), addMinutes(now, resetTtlMinutes)]);
-        return { token, locale: row.locale };
-      });
-      if (!issued) return;
-      const url = `${deps.baseUrl.replace(/\/$/, "")}/${issued.locale}/reset-password?token=${encodeURIComponent(issued.token)}`;
-      await deps.mail({ to: address, locale: issued.locale, ...passwordResetMail(deps.product, issued.locale, url, resetTtlMinutes), link: { kind: "passwordReset", url, minutes: resetTtlMinutes } });
-    },
-    async resetPassword(token, next, now) {
-      if (next.length < PASSWORD_MIN) throw new AccountError(400, "PASSWORD_TOO_SHORT", `At least ${PASSWORD_MIN} characters`);
-      if (next.length > PASSWORD_MAX) throw new AccountError(400, "PASSWORD_TOO_LONG", `At most ${PASSWORD_MAX} characters`);
-      if (!isLinkToken(deps.tokenPrefix, token)) return "INVALID";
-      return transaction(async (q) => {
-        const [row] = await q("UPDATE password_resets SET used_at = $2 WHERE token_hash = $1 AND used_at IS NULL AND expires_at > $2 RETURNING account_id", [deps.tokenHash(token), now]);
-        if (!row) return "INVALID";
-        await q("UPDATE accounts SET password_hash = $2 WHERE id = $1", [row.account_id, await deps.passwords.hash(next)]);
-        await q("DELETE FROM sessions WHERE account_id = $1", [row.account_id]);
-        return "CHANGED";
-      });
-    },
-    async sessions(id, now, currentSessionId) {
-      const rows = await query("SELECT id, created_at, expires_at, ip, user_agent FROM sessions WHERE account_id = $1 AND expires_at > $2 ORDER BY created_at DESC", [id, now]);
-      return rows.map((r) => ({ id: r.id, createdAt: r.created_at, expiresAt: r.expires_at, ip: r.ip, userAgent: r.user_agent, current: r.id === currentSessionId }));
-    },
-    async signOutOthers(id, keepSessionId) {
-      return (await query("DELETE FROM sessions WHERE account_id = $1 AND id <> $2::uuid RETURNING id", [id, keepSessionId])).length;
-    },
-    async exportAccount(id, now, extra) {
-      const profile = await profileOf(id);
-      const live = await this.sessions(id, now);
-      return { exportedAt: now.toISOString(), account: profile, sessions: live.map(({ current: _current, ...s }) => s), ...extra ? await extra() : {} };
-    },
-    async deleteAccount(id) {
-      const rows = await query("DELETE FROM accounts WHERE id = $1 RETURNING id", [id]);
-      if (!rows.length) throw new AccountError(404, "NOT_FOUND", "No such account");
-    }
-  };
+  const hops = Math.max(1, Math.min(10, Number(rules.trustedProxyHops) || 1));
+  const chain = (headers.get("x-forwarded-for") ?? "").split(",").map((part) => part.trim()).filter(Boolean);
+  const fromRight = chain[chain.length - hops];
+  if (fromRight && isIp(fromRight)) return fromRight;
+  const real = headers.get("x-real-ip")?.trim();
+  if (real && isIp(real)) return real;
+  return null;
 }
-var postgresAccounts = dbAccounts;
 
 // src/federated-sign-in.ts
 var FEDERATED_REFUSAL = {
@@ -233,68 +107,54 @@ function createFederatedSignIn({ links, accounts, clock }) {
 }
 
 // src/migration.ts
-function accountsMigration(options = {}) {
-  return `
-ALTER TABLE accounts ADD COLUMN IF NOT EXISTS name text CHECK (name IS NULL OR char_length(name) <= 80);
-ALTER TABLE accounts ADD COLUMN IF NOT EXISTS avatar_seed text CHECK (avatar_seed IS NULL OR avatar_seed ~ '^[a-z0-9-]{1,40}$');
-ALTER TABLE accounts ADD COLUMN IF NOT EXISTS theme text CHECK (theme IS NULL OR theme IN ('light', 'dark', 'system'));
-ALTER TABLE accounts ADD COLUMN IF NOT EXISTS email_verified_at timestamptz;
-${options.backfillVerified ? "UPDATE accounts SET email_verified_at = created_at WHERE email_verified_at IS NULL;\n" : ""}CREATE TABLE IF NOT EXISTS email_changes (
-  id         uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  account_id uuid NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
-  new_email  text NOT NULL CHECK (new_email = lower(new_email)),
-  token_hash text NOT NULL UNIQUE,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  expires_at timestamptz NOT NULL,
-  used_at    timestamptz
-);
-CREATE TABLE IF NOT EXISTS password_resets (
-  id         uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  account_id uuid NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
-  token_hash text NOT NULL UNIQUE,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  expires_at timestamptz NOT NULL,
-  used_at    timestamptz
-);
-`;
-}
 var IDENT = /^[a-z_][a-z0-9_]{0,62}$/;
 var ident = (name) => {
   if (!IDENT.test(name)) throw new Error(`not a safe SQL identifier: ${name}`);
   return name;
 };
+function accountsMigration(options = {}) {
+  return accountsSchema(options).migrations[0].sql({ schema: "public", tables: { accounts: "accounts" } });
+}
 function rolesMigration(roles, options = {}) {
-  const owner = ident(options.ownerTable ?? "accounts");
-  const scope = options.scopeTable ? ` REFERENCES ${ident(options.scopeTable)}(id) ON DELETE CASCADE` : "";
-  const list = roles.map((r) => `'${ident(r)}'`).join(", ");
-  return `
-CREATE TABLE IF NOT EXISTS memberships (
-  scope_id   uuid NOT NULL${scope},
-  account_id uuid NOT NULL REFERENCES ${owner}(id) ON DELETE CASCADE,
-  role       text NOT NULL CHECK (role IN (${list})),
-  invited_by uuid REFERENCES ${owner}(id) ON DELETE SET NULL,
-  created_at timestamptz NOT NULL,
-  PRIMARY KEY (scope_id, account_id)
-);
-CREATE INDEX IF NOT EXISTS memberships_account ON memberships(account_id);
-CREATE TABLE IF NOT EXISTS invitations (
-  id         uuid PRIMARY KEY,
-  scope_id   uuid NOT NULL${scope},
-  email      text NOT NULL CHECK (email = lower(email)),
-  role       text NOT NULL CHECK (role IN (${list})),
-  token_hash text NOT NULL UNIQUE,
-  invited_by uuid REFERENCES ${owner}(id) ON DELETE SET NULL,
-  created_at timestamptz NOT NULL,
-  expires_at timestamptz NOT NULL,
-  used_at    timestamptz
-);
-CREATE INDEX IF NOT EXISTS invitations_scope ON invitations(scope_id) WHERE used_at IS NULL;
-`;
+  const tables = { owner: ident(options.ownerTable ?? "accounts"), ...options.scopeTable ? { scope: ident(options.scopeTable) } : {} };
+  return rolesSchema(roles, { scoped: options.scopeTable !== void 0 }).migrations[0].sql({ schema: "public", tables });
 }
 
+// src/password.ts
+import crypto2 from "crypto";
+import { promisify } from "util";
+var scrypt = promisify(crypto2.scrypt);
+var N = 32768;
+var R = 8;
+var P = 1;
+var KEYLEN = 32;
+var MAXMEM = 64 * 1024 * 1024;
+var OPTIONS = { N, r: R, p: P, maxmem: MAXMEM };
+var PASSWORD_MIN_LENGTH = 12;
+var PASSWORD_MAX_LENGTH = 256;
+function passwordProblem(password) {
+  if (password.length < PASSWORD_MIN_LENGTH) return "TOO_SHORT";
+  if (password.length > PASSWORD_MAX_LENGTH) return "TOO_LONG";
+  return null;
+}
+async function hashPassword(password) {
+  const salt = crypto2.randomBytes(16);
+  const hash = await scrypt(password, salt, KEYLEN, OPTIONS);
+  return `scrypt$${N}$${R}$${P}$${salt.toString("base64url")}$${hash.toString("base64url")}`;
+}
+async function verifyPassword(password, stored) {
+  const [scheme, n, r, p, salt, hash] = stored.split("$");
+  if (scheme !== "scrypt" || !salt || !hash || password.length > PASSWORD_MAX_LENGTH) return false;
+  const expected = Buffer.from(hash, "base64url");
+  const given = await scrypt(password, Buffer.from(salt, "base64url"), expected.length, { N: Number(n), r: Number(r), p: Number(p), maxmem: MAXMEM });
+  return given.length === expected.length && crypto2.timingSafeEqual(given, expected);
+}
+var decoy;
+var decoyHash = () => decoy ??= hashPassword(crypto2.randomBytes(24).toString("base64url"));
+
 // src/roles.ts
 import crypto3 from "crypto";
-import { addHours as addHours2 } from "date-fns";
+import { addHours } from "date-fns";
 var defineRoles = (model) => model;
 var can = (model, role, permission) => !!role && model.permissions[role].includes(permission);
 var ROLES_CODE = {
@@ -390,7 +250,7 @@ function createRoles(deps) {
       const token = newToken();
       const [row] = await query(
         "INSERT INTO invitations (id, scope_id, email, role, token_hash, invited_by, created_at, expires_at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8) RETURNING id, created_at, expires_at",
-        [crypto3.randomUUID(), scopeId, email, role, deps.tokenHash(token), actor.id, now, addHours2(now, deps.inviteTtlHours)]
+        [crypto3.randomUUID(), scopeId, email, role, deps.tokenHash(token), actor.id, now, addHours(now, deps.inviteTtlHours)]
       );
       return { token, invitation: { id: row.id, email, role, createdAt: row.created_at, expiresAt: row.expires_at } };
     },
@@ -422,6 +282,108 @@ function createRoles(deps) {
   };
 }
 
+// src/sessions.ts
+import crypto4 from "crypto";
+var BODY = /^[A-Za-z0-9_-]{43}$/;
+var PREFIX = /^[a-z]{1,4}$/;
+var USER_AGENT_MAX = 300;
+function createSessions(deps) {
+  if (!PREFIX.test(deps.tokenPrefix)) throw new RangeError(`tokenPrefix must be 1 to 4 lower-case letters, got ${deps.tokenPrefix}`);
+  const head = `${deps.tokenPrefix}1.`;
+  const secret = () => typeof deps.secret === "function" ? deps.secret() : deps.secret;
+  const isToken = (value) => !!value && value.startsWith(head) && BODY.test(value.slice(head.length));
+  const tokenHash = (token) => crypto4.createHmac("sha256", `session:${secret()}`).update(token).digest("hex");
+  const newToken = () => `${head}${crypto4.randomBytes(32).toString("base64url")}`;
+  return {
+    newToken,
+    isToken,
+    tokenHash,
+    async create(accountId, meta) {
+      const days = typeof deps.sessionDays === "function" ? await deps.sessionDays() : deps.sessionDays;
+      if (!Number.isInteger(days) || days < 1) throw new RangeError(`sessionDays must be a whole number of days from 1, got ${days}`);
+      const token = newToken();
+      const createdAt = deps.clock.now();
+      const expires = new Date(createdAt);
+      expires.setUTCHours(expires.getUTCHours() + days * 24);
+      await deps.store.insert({ accountId, tokenHash: tokenHash(token), createdAt, expiresAt: expires, ip: meta.ip, userAgent: meta.userAgent?.slice(0, USER_AGENT_MAX) ?? null });
+      return { token, expires };
+    },
+    async resolve(token) {
+      if (!isToken(token)) return null;
+      return deps.store.find(tokenHash(token), deps.clock.now());
+    },
+    async revoke(token) {
+      if (!isToken(token)) return;
+      await deps.store.delete(tokenHash(token));
+    }
+  };
+}
+function sessionCookie(token, expires, options) {
+  return { name: options.name, value: token, httpOnly: true, secure: options.secure, sameSite: "lax", path: "/", expires };
+}
+function clearedSessionCookie(options, now) {
+  return sessionCookie("", now, options);
+}
+function sessionTokenOf(headers, options) {
+  if (options.bearer !== false) {
+    const bearer = /^bearer (\S+)$/i.exec(headers.get("authorization") ?? "")?.[1];
+    if (bearer) return bearer;
+  }
+  const prefix = `${options.cookie}=`;
+  return headers.get("cookie")?.split(";").map((part) => part.trim()).find((part) => part.startsWith(prefix))?.slice(prefix.length);
+}
+
+// src/sessions-memory.ts
+function memorySessionStore(accountOf) {
+  const rows = /* @__PURE__ */ new Map();
+  let next = 0;
+  return {
+    async insert(session) {
+      if (rows.has(session.tokenHash)) throw new Error("duplicate session token hash");
+      next += 1;
+      rows.set(session.tokenHash, { ...session, id: `session-${next}` });
+    },
+    async find(tokenHash, now) {
+      const row = rows.get(tokenHash);
+      if (!row || row.expiresAt.getTime() <= now.getTime()) return null;
+      const account = accountOf(row.accountId);
+      return account === null ? null : { id: row.id, account };
+    },
+    async delete(tokenHash) {
+      rows.delete(tokenHash);
+    },
+    rows: () => [...rows.values()]
+  };
+}
+
+// src/sessions-persistence.ts
+import { ident as ident2 } from "@krizaka/db";
+function dbSessionStore(query, options) {
+  const sessions = ident2(options.sessions ?? "sessions");
+  const accounts = ident2(options.accounts ?? "accounts");
+  const columns = options.columns.map((column) => `a.${ident2(column)}`).join(", ");
+  const active = options.active ? ` AND a.${ident2(options.active.column)} = $3` : "";
+  return {
+    async insert(session) {
+      await query(`INSERT INTO ${sessions} (account_id, token_hash, created_at, expires_at, ip, user_agent) VALUES ($1, $2, $3, $4, $5, $6)`, [session.accountId, session.tokenHash, session.createdAt, session.expiresAt, session.ip, session.userAgent]);
+    },
+    async find(tokenHash, now) {
+      const params = [tokenHash, now];
+      if (options.active) params.push(options.active.equals);
+      const [row] = await query(
+        `SELECT s.id AS session_id, ${columns} FROM ${sessions} s JOIN ${accounts} a ON a.id = s.account_id WHERE s.token_hash = $1 AND s.expires_at > $2${active}`,
+        params
+      );
+      if (!row) return null;
+      const { session_id: id, ...account } = row;
+      return { id, account: options.toAccount(account) };
+    },
+    async delete(tokenHash) {
+      await query(`DELETE FROM ${sessions} WHERE token_hash = $1`, [tokenHash]);
+    }
+  };
+}
+
 // src/users-federation.ts
 var START = (base, provider) => `${base}/api/v1/auth/web/${provider}/start`;
 var EXCHANGE = (base) => `${base}/api/v1/auth/web/exchange`;
@@ -461,6 +423,7 @@ function usersIdentityProvider({ baseUrl, appUrl, fetch }) {
   };
 }
 export {
+  ADMIN_REFUSAL,
   AccountError,
   EMAIL_CHANGE_TTL_HOURS,
   FEDERATED_PROVIDERS,
@@ -468,21 +431,33 @@ export {
   FEDERATION_CODE,
   FederationError,
   IdentityLinkError,
+  PASSWORD_MAX_LENGTH,
+  PASSWORD_MIN_LENGTH,
   PASSWORD_RESET_MAX_MINUTES,
   PASSWORD_RESET_MIN_MINUTES,
   PASSWORD_RESET_TTL_MINUTES,
   ROLES_CODE,
   RolesError,
   accountsMigration,
+  accountsSchema,
+  allowedIps,
   can,
+  clearedSessionCookie,
+  clientIp,
   createFederatedSignIn,
   createRoles,
+  createSessions,
   dbAccounts,
   dbIdentityLinks,
+  dbSessionStore,
+  decoyHash,
   defineRoles,
   emailChangeMail,
   emailChangeToken,
+  hashPassword,
   identityLinksMigration,
+  identityLinksSchema,
+  ipAllowed,
   isEmailChangeToken,
   isFederatedProvider,
   isLinkToken,
@@ -490,11 +465,19 @@ export {
   linkToken,
   memoryIdentityLinks,
   memoryIdentityProvider,
+  memorySessionStore,
   parseExternalIdentity,
+  passwordProblem,
   passwordResetMail,
   pkceChallenge,
   postgresAccounts,
+  requireAdmin,
   rolesMigration,
-  usersIdentityProvider
+  rolesSchema,
+  sessionCookie,
+  sessionTokenOf,
+  sessionsSchema,
+  usersIdentityProvider,
+  verifyPassword
 };
 //# sourceMappingURL=index.js.map