@krizaka/auth 0.8.0 → 0.9.0

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { Query, ModuleSchema } from '@krizaka/db';
 export { Query } from '@krizaka/db';
-import { E as ExternalIdentity, I as IdentityLinkStore, a as IdentityProvider } from './identity-links-BI3DYE2I.js';
-export { C as CompleteOptions, F as FEDERATED_PROVIDERS, b as FEDERATION_CODE, c as FederatedProvider, d as FederationCode, e as FederationError, f as IdentityLinkError, S as StartOptions, g as StartedSignIn, h as dbIdentityLinks, i as identityLinksMigration, j as isFederatedProvider, k as isLocalReturn, m as memoryIdentityLinks, l as memoryIdentityProvider, p as pkceChallenge } from './identity-links-BI3DYE2I.js';
+import { E as ExternalIdentity, I as IdentityLinkStore, S as SessionStore, N as NewSession, a as IdentityProvider } from './sessions-B9YKXs0i.js';
+export { C as CompleteOptions, F as FEDERATED_PROVIDERS, b as FEDERATION_CODE, c as FederatedProvider, d as FederationCode, e as FederationError, f as IdentityLinkError, g as Session, h as SessionCookie, i as Sessions, j as SessionsDeps, k as StartOptions, l as StartedSignIn, m as clearedSessionCookie, n as createSessions, o as dbIdentityLinks, p as identityLinksMigration, q as isFederatedProvider, r as isLocalReturn, s as memoryIdentityLinks, t as memoryIdentityProvider, u as pkceChallenge, v as sessionCookie, w as sessionTokenOf } from './sessions-B9YKXs0i.js';
 
 /**
  * The account PORT (ADR-0008 of Yomizaka, now shared). A product's account — name, language, theme, avatar, e-mail change with
@@ -148,6 +148,82 @@ declare function dbAccounts(deps: AccountDeps): AccountService;
 /** @deprecated The old name of `dbAccounts` (a name says what a thing does, not the technology). Removed in the next major. */
 declare const postgresAccounts: typeof dbAccounts;
 
+/**
+ * The administration's locks, as one pure decision every product shares (it was copied in each product's `lib/access.ts`): a session,
+ * the ADMIN role, and an address on the allowed list. A pure function of its inputs: the product reads the session and the address
+ * and maps the verdict to its own answer.
+ */
+/** Stable codes of a refusal. */
+declare const ADMIN_REFUSAL: {
+    readonly unauthenticated: "UNAUTHENTICATED";
+    readonly forbidden: "FORBIDDEN";
+    readonly ipNotAllowed: "IP_NOT_ALLOWED";
+    readonly notFound: "NOT_FOUND";
+};
+type AdminRefusal = (typeof ADMIN_REFUSAL)[keyof typeof ADMIN_REFUSAL];
+/** The verdict: let in, or the status and code to answer. */
+type AdminDecision = {
+    ok: true;
+} | {
+    ok: false;
+    status: 401 | 403 | 404;
+    code: AdminRefusal;
+};
+/**
+ * The list the administration's address lock reads, from the environment's value (`AUTH_ALLOWED_IPS`): an empty list is « nobody » in
+ * production and « anybody » in development, so a forgotten setting never opens the console.
+ * @param list the configured addresses
+ * @returns the list to hand to `requireAdmin`, or null (anybody)
+ */
+declare function allowedIps(list: readonly string[], options: {
+    production: boolean;
+}): readonly string[] | null;
+/** Whether an address may use the administration: `null` allowed means anybody, an empty list nobody, and a missing address is never allowed by a list. */
+declare function ipAllowed(ip: string | null, allowed: readonly string[] | null): boolean;
+interface AdminGateInput {
+    /** The caller's session, or null when there is none. Only its account's role is read. */
+    session: {
+        account: {
+            role: string;
+        };
+    } | null;
+    /** The caller's address (see `clientIp`). */
+    ip: string | null;
+    /** The addresses allowed (see `allowedIps`); null = anybody. */
+    allowedIps: readonly string[] | null;
+    /** `api` (default): 401 without a session, 403 with the reason. `page`: the administration does not announce itself, so every failed lock is a 404. */
+    surface?: "api" | "page";
+    /** The role that administers. Default `ADMIN`. */
+    role?: string;
+}
+/**
+ * The administration's three locks. The first that fails decides.
+ * @returns `{ ok: true }`, or the status (401, 403 or 404 on a page) and the code to answer
+ */
+declare function requireAdmin(input: AdminGateInput): AdminDecision;
+
+/** How a deployment tells the client's address: the header its edge sets, and how many proxies append to `X-Forwarded-For`. */
+interface ClientIpRules {
+    /** A header the edge sets and overwrites with the client's address (`do-connecting-ip` on DigitalOcean App Platform, `cf-connecting-ip` behind Cloudflare). Read first when present. */
+    header?: string | undefined;
+    /** How many trusted proxies append to `X-Forwarded-For`: 1 (the default) to 10. */
+    trustedProxyHops?: number | undefined;
+}
+/**
+ * The client's IP address, as far as this deployment can trust it. `X-Forwarded-For` is a list each proxy appends to: its LEFT end is
+ * whatever the client sent (anyone can write `X-Forwarded-For: 1.2.3.4`), so a limit keyed on it is a limit the attacker chooses. The
+ * address the last trusted proxy saw is read from the RIGHT:
+ *
+ * - the `header` the edge sets and overwrites, when present;
+ * - otherwise the entry `trustedProxyHops` (default 1: one proxy) from the right of `X-Forwarded-For`, then `X-Real-IP`;
+ * - otherwise null (local development without a proxy).
+ *
+ * The product reads its environment (`ABUSE_CLIENT_IP_HEADER`, `ABUSE_TRUSTED_PROXY_HOPS`) and passes the values: this function reads none.
+ * @param headers the request's headers
+ * @returns a valid IPv4 or IPv6 address, or null
+ */
+declare function clientIp(headers: Headers, rules?: ClientIpRules): string | null;
+
 /** What federated sign-in needs from the product's accounts: no second user table, just a look-up and, when registration is open, a creation. */
 interface FederatedAccounts {
     /** The account that holds this address (lower case), and whether the product has verified it; null when none. */
@@ -213,6 +289,25 @@ declare function rolesMigration(roles: readonly string[], options?: {
     scopeTable?: string;
 }): string;
 
+/** The shortest password the products accept. */
+declare const PASSWORD_MIN_LENGTH = 12;
+/** The longest: a longer one is refused before any work is done (a very long password is a way to make the server spend time). */
+declare const PASSWORD_MAX_LENGTH = 256;
+/** Why a new password is refused, or null when its length is acceptable. */
+declare function passwordProblem(password: string): "TOO_SHORT" | "TOO_LONG" | null;
+/**
+ * Hashes a password with a fresh salt.
+ * @returns `scrypt$N$r$p$salt$hash`
+ */
+declare function hashPassword(password: string): Promise<string>;
+/**
+ * Checks a password against a stored hash, in constant time. A hash of another scheme, a malformed one or an over-long password is `false`.
+ * The cost parameters are read from the stored value, so an older hash still verifies after the default changes.
+ */
+declare function verifyPassword(password: string, stored: string): Promise<boolean>;
+/** A hash to verify against when the address has no account: the same work, the same time, the same answer. */
+declare const decoyHash: () => Promise<string>;
+
 /**
  * Roles per scope (a shop, a workspace), as DATA: a model says which roles exist, which permissions each holds and who may hand which
  * role to whom. The code asks `can(role, "invoices:write")`, never `if (role === "owner")`. One person may belong to several scopes, with
@@ -343,6 +438,44 @@ declare function rolesSchema(roles: readonly string[], options?: {
 }): ModuleSchema;
 /** Which external identity belongs to which account (federated sign-in): `(issuer, subject) → account`, never a second user table. Idempotent. */
 declare const identityLinksSchema: ModuleSchema;
+/**
+ * The table of web sessions: the cookie holds a random token, the table its keyed hash (a leaked table opens nothing). The shape the
+ * products' own `sessions` table has, so a product that has it adopts version 1 (`adoptMigration`) and one that does not emits it.
+ * Idempotent.
+ */
+declare const sessionsSchema: ModuleSchema;
+
+/**
+ * An in-memory session store, for unit tests and demos. `accountOf` plays the accounts table: it answers the account of an id, or null
+ * when it does not exist or is not active.
+ */
+declare function memorySessionStore<Account>(accountOf: (accountId: string) => Account | null): SessionStore<Account> & {
+    rows(): readonly NewSession[];
+};
+
+interface DbSessionStoreOptions<Account> {
+    /** The product's session table. Default `sessions` (`id`, `account_id`, `token_hash` unique, `created_at`, `expires_at`, `ip`, `user_agent`). */
+    sessions?: string;
+    /** The product's account table. Default `accounts`. */
+    accounts?: string;
+    /** The account columns the session carries (`id`, `email`, `role`, `locale`, `name`…): all checked, all read in one query with the session. */
+    columns: readonly string[];
+    /** Builds the product's account from a row holding exactly `columns`. */
+    toAccount: (row: Record<string, unknown>) => Account;
+    /** An account that is not active signs nobody in (a suspension applies at once): the column and the value it must have (`status` = `ACTIVE`). */
+    active?: {
+        column: string;
+        equals: string;
+    };
+}
+/**
+ * The session store over the product's own tables (`sessions` joined to `accounts`): the declared tables and columns are checked by
+ * `ident()` and nothing else reaches SQL. The expiry is compared with the clock's `now`, not the database's.
+ * @param query the product's query
+ * @param options the table names, the account columns and how the account is built
+ * @throws DbError `DB_UNSAFE_IDENTIFIER` for a table or column name that is not a safe identifier
+ */
+declare function dbSessionStore<Account>(query: Query, options: DbSessionStoreOptions<Account>): SessionStore<Account>;
 
 /** The `fetch` the adapter calls krizaka-users with (injected: no global, no network in tests). */
 type Fetcher = (url: string, init: {
@@ -369,4 +502,4 @@ declare function parseExternalIdentity(body: unknown): ExternalIdentity;
  */
 declare function usersIdentityProvider({ baseUrl, appUrl, fetch }: UsersFederationOptions): IdentityProvider;
 
-export { type AccountDeps, AccountError, type AccountProfile, type AccountService, EMAIL_CHANGE_TTL_HOURS, ExternalIdentity, FEDERATED_REFUSAL, type FederatedAccounts, type FederatedRefusal, type FederatedSignIn, type FederatedSignInDeps, type FederatedSignInResult, type Fetcher, IdentityLinkStore, IdentityProvider, type Invitation, type Mail, type MailLink, type Member, PASSWORD_RESET_MAX_MINUTES, PASSWORD_RESET_MIN_MINUTES, PASSWORD_RESET_TTL_MINUTES, type ProfilePatch, ROLES_CODE, type RoleModel, type Roles, type RolesCode, type RolesDeps, RolesError, type RolesQuery, type SessionSummary, type Theme, type UsersFederationOptions, accountsMigration, accountsSchema, can, createFederatedSignIn, createRoles, dbAccounts, defineRoles, emailChangeMail, emailChangeToken, identityLinksSchema, isEmailChangeToken, isLinkToken, linkToken, parseExternalIdentity, passwordResetMail, postgresAccounts, rolesMigration, rolesSchema, usersIdentityProvider };
+export { ADMIN_REFUSAL, type AccountDeps, AccountError, type AccountProfile, type AccountService, type AdminDecision, type AdminGateInput, type AdminRefusal, type ClientIpRules, type DbSessionStoreOptions, EMAIL_CHANGE_TTL_HOURS, ExternalIdentity, FEDERATED_REFUSAL, type FederatedAccounts, type FederatedRefusal, type FederatedSignIn, type FederatedSignInDeps, type FederatedSignInResult, type Fetcher, IdentityLinkStore, IdentityProvider, type Invitation, type Mail, type MailLink, type Member, NewSession, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PASSWORD_RESET_MAX_MINUTES, PASSWORD_RESET_MIN_MINUTES, PASSWORD_RESET_TTL_MINUTES, type ProfilePatch, ROLES_CODE, type RoleModel, type Roles, type RolesCode, type RolesDeps, RolesError, type RolesQuery, SessionStore, type SessionSummary, type Theme, type UsersFederationOptions, accountsMigration, accountsSchema, allowedIps, can, clientIp, createFederatedSignIn, createRoles, dbAccounts, dbSessionStore, decoyHash, defineRoles, emailChangeMail, emailChangeToken, hashPassword, identityLinksSchema, ipAllowed, isEmailChangeToken, isLinkToken, linkToken, memorySessionStore, parseExternalIdentity, passwordProblem, passwordResetMail, postgresAccounts, requireAdmin, rolesMigration, rolesSchema, sessionsSchema, usersIdentityProvider, verifyPassword };

package/dist/index.js

@@ -12,198 +12,69 @@ import {
   memoryIdentityLinks,
   memoryIdentityProvider,
   pkceChallenge,
-  rolesSchema
-} from "./chunk-U5SDV7YV.js";
-
-// src/accounts.ts
-import crypto2 from "crypto";
-import { addHours, addMinutes } from "date-fns";
-
-// src/port.ts
-var AccountError = class extends Error {
-  constructor(status, code, message) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.name = "AccountError";
-  }
-  status;
-  code;
-};
+  rolesSchema,
+  sessionsSchema
+} from "./chunk-5CFOMWBN.js";
+import {
+  AccountError,
+  EMAIL_CHANGE_TTL_HOURS,
+  PASSWORD_RESET_MAX_MINUTES,
+  PASSWORD_RESET_MIN_MINUTES,
+  PASSWORD_RESET_TTL_MINUTES,
+  dbAccounts,
+  emailChangeMail,
+  emailChangeToken,
+  isEmailChangeToken,
+  isLinkToken,
+  linkToken,
+  passwordResetMail,
+  postgresAccounts
+} from "./chunk-3CLSDLXB.js";
 
-// src/accounts.ts
-var EMAIL_CHANGE_TTL_HOURS = 24;
-var PASSWORD_RESET_TTL_MINUTES = 30;
-var PASSWORD_RESET_MIN_MINUTES = 5;
-var PASSWORD_RESET_MAX_MINUTES = 1440;
-var checkResetTtl = (minutes) => {
-  if (!Number.isInteger(minutes) || minutes < PASSWORD_RESET_MIN_MINUTES || minutes > PASSWORD_RESET_MAX_MINUTES) {
-    throw new RangeError(`passwordResetTtlMinutes must be a whole number from ${PASSWORD_RESET_MIN_MINUTES} to ${PASSWORD_RESET_MAX_MINUTES}, got ${minutes}`);
-  }
-  return minutes;
+// src/admin-gate.ts
+var ADMIN_REFUSAL = {
+  unauthenticated: "UNAUTHENTICATED",
+  forbidden: "FORBIDDEN",
+  ipNotAllowed: "IP_NOT_ALLOWED",
+  notFound: "NOT_FOUND"
 };
-var NAME_MAX = 80;
-var PASSWORD_MIN = 12;
-var PASSWORD_MAX = 256;
-var THEMES = ["light", "dark", "system"];
-var linkToken = (prefix) => `${prefix}1.${crypto2.randomBytes(32).toString("base64url")}`;
-var isLinkToken = (prefix, value) => !!value && new RegExp(`^${prefix}1\\.[A-Za-z0-9_-]{43}$`).test(value);
-var emailChangeToken = linkToken;
-var isEmailChangeToken = isLinkToken;
-function passwordResetMail(product, locale, url, ttlMinutes = PASSWORD_RESET_TTL_MINUTES) {
-  checkResetTtl(ttlMinutes);
-  return locale === "fr" ? { subject: `R\xE9initialisez votre mot de passe \u2014 ${product}`, text: `Bonjour,
-
-Pour choisir un nouveau mot de passe pour votre compte ${product}, ouvrez ce lien (valide ${ttlMinutes} min, une seule fois) :
-${url}
-
-Si vous n'avez rien demand\xE9, ignorez ce message : votre mot de passe ne change pas.
-` } : { subject: `Reset your password \u2014 ${product}`, text: `Hello,
-
-To choose a new password for your ${product} account, open this link (valid ${ttlMinutes} min, once):
-${url}
-
-If you did not ask for this, ignore this message: your password does not change.
-` };
+function allowedIps(list, options) {
+  if (list.length > 0) return list;
+  return options.production ? [] : null;
+}
+function ipAllowed(ip, allowed) {
+  if (allowed === null) return true;
+  return !!ip && allowed.includes(ip);
+}
+function requireAdmin(input) {
+  const page = input.surface === "page";
+  const refuse = (status, code) => page ? { ok: false, status: 404, code: ADMIN_REFUSAL.notFound } : { ok: false, status, code };
+  if (!input.session) return refuse(401, ADMIN_REFUSAL.unauthenticated);
+  if (input.session.account.role !== (input.role ?? "ADMIN")) return refuse(403, ADMIN_REFUSAL.forbidden);
+  if (!ipAllowed(input.ip, input.allowedIps)) return refuse(403, ADMIN_REFUSAL.ipNotAllowed);
+  return { ok: true };
 }
-function emailChangeMail(product, locale, url) {
-  return locale === "fr" ? { subject: `Confirmez votre nouvelle adresse \u2014 ${product}`, text: `Bonjour,
-
-Pour utiliser cette adresse avec votre compte ${product}, confirmez-la en ouvrant ce lien (valide ${EMAIL_CHANGE_TTL_HOURS} h) :
-${url}
-
-Si vous n'avez rien demand\xE9, ignorez ce message : rien ne change.
-` } : { subject: `Confirm your new address \u2014 ${product}`, text: `Hello,
-
-To use this address with your ${product} account, confirm it by opening this link (valid ${EMAIL_CHANGE_TTL_HOURS} h):
-${url}
 
-If you did not ask for this, ignore this message: nothing changes.
-` };
+// src/client-ip.ts
+var IPV4 = /^(?:\d{1,3}\.){3}\d{1,3}$/;
+var IPV6 = /^[0-9a-f:]+(?:%\w+)?$/i;
+function isIp(value) {
+  return IPV4.test(value) && value.split(".").every((n) => Number(n) <= 255) || value.includes(":") && IPV6.test(value);
 }
-var looksLikeEmail = (address) => {
-  if (address.length > 320 || /\s/.test(address)) return false;
-  const at = address.indexOf("@");
-  if (at < 1 || at !== address.lastIndexOf("@")) return false;
-  const domain = address.slice(at + 1);
-  const dot = domain.lastIndexOf(".");
-  return dot > 0 && dot < domain.length - 1;
-};
-var cleanName = (raw) => {
-  const name = raw.replace(/\s+/g, " ").trim();
-  if (name.length > NAME_MAX) throw new AccountError(400, "BAD_REQUEST", `A name is at most ${NAME_MAX} characters`);
-  return name;
-};
-function dbAccounts(deps) {
-  const { query } = deps;
-  const resetTtlMinutes = checkResetTtl(deps.passwordResetTtlMinutes ?? PASSWORD_RESET_TTL_MINUTES);
-  const transaction = deps.transaction ?? ((work) => work(query));
-  const wrong = () => new AccountError(403, "WRONG_PASSWORD", "The password is not right");
-  async function profileOf(id) {
-    const [row] = await query(
-      `SELECT a.id, a.email, a.name, a.locale, a.theme, a.avatar_seed, a.email_verified_at,
-              (SELECT c.new_email FROM email_changes c WHERE c.account_id = a.id AND c.used_at IS NULL AND c.expires_at > now() ORDER BY c.created_at DESC LIMIT 1) AS pending
-         FROM accounts a WHERE a.id = $1`,
-      [id]
-    );
-    if (!row) throw new AccountError(404, "NOT_FOUND", "No such account");
-    return { id: row.id, email: row.email, name: row.name, locale: row.locale, theme: row.theme, avatarSeed: row.avatar_seed, emailVerified: !!row.email_verified_at, pendingEmail: row.pending };
+function clientIp(headers, rules = {}) {
+  const custom = rules.header?.trim().toLowerCase();
+  if (custom) {
+    const value = headers.get(custom)?.split(",")[0]?.trim();
+    if (value && isIp(value)) return value;
   }
-  async function confirmPassword(id, password) {
-    const [row] = await query("SELECT password_hash FROM accounts WHERE id = $1", [id]);
-    if (!row?.password_hash || password.length > PASSWORD_MAX || !await deps.passwords.verify(password, row.password_hash)) throw wrong();
-  }
-  return {
-    profile: profileOf,
-    async updateProfile(id, patch) {
-      const name = patch.name === void 0 ? void 0 : patch.name === null ? null : cleanName(patch.name);
-      if (patch.avatarSeed && !/^[a-z0-9-]{1,40}$/.test(patch.avatarSeed)) throw new AccountError(400, "BAD_REQUEST", "Not an avatar");
-      if (patch.theme && !THEMES.includes(patch.theme)) throw new AccountError(400, "BAD_REQUEST", "Not a theme");
-      await query(
-        `UPDATE accounts SET name = CASE WHEN $2::boolean THEN $3 ELSE name END, locale = COALESCE($4, locale),
-                avatar_seed = CASE WHEN $5::boolean THEN $6 ELSE avatar_seed END, theme = CASE WHEN $7::boolean THEN $8 ELSE theme END WHERE id = $1`,
-        [id, name !== void 0, name === "" ? null : name ?? null, patch.locale ?? null, patch.avatarSeed !== void 0, patch.avatarSeed ?? null, patch.theme !== void 0, patch.theme ?? null]
-      );
-      return profileOf(id);
-    },
-    async requestEmailChange(id, input, now) {
-      await confirmPassword(id, input.password);
-      const address = input.newEmail.trim().toLowerCase();
-      if (!looksLikeEmail(address)) throw new AccountError(400, "BAD_REQUEST", "Not an e-mail address");
-      const [taken] = await query("SELECT 1 FROM accounts WHERE email = $1", [address]);
-      if (taken) return;
-      const profile = await profileOf(id);
-      await query("UPDATE email_changes SET used_at = $2 WHERE account_id = $1 AND used_at IS NULL", [id, now]);
-      const token = (deps.token ?? (() => emailChangeToken(deps.tokenPrefix)))();
-      await query("INSERT INTO email_changes (account_id, new_email, token_hash, expires_at) VALUES ($1, $2, $3, $4)", [id, address, deps.tokenHash(token), addHours(now, EMAIL_CHANGE_TTL_HOURS)]);
-      const url = `${deps.baseUrl.replace(/\/$/, "")}/${profile.locale}/confirm-email?token=${encodeURIComponent(token)}`;
-      await deps.mail({ to: address, locale: profile.locale, ...emailChangeMail(deps.product, profile.locale, url), link: { kind: "emailChange", url, hours: EMAIL_CHANGE_TTL_HOURS } });
-    },
-    async confirmEmailChange(token, now) {
-      if (!isEmailChangeToken(deps.tokenPrefix, token)) return "INVALID";
-      const [row] = await query("UPDATE email_changes SET used_at = $2 WHERE token_hash = $1 AND used_at IS NULL AND expires_at > $2 RETURNING account_id, new_email", [deps.tokenHash(token), now]);
-      if (!row) return "INVALID";
-      try {
-        await query("UPDATE accounts SET email = $2, email_verified_at = $3 WHERE id = $1", [row.account_id, row.new_email, now]);
-      } catch {
-        return "INVALID";
-      }
-      return "CHANGED";
-    },
-    async changePassword(id, input, keepSessionId) {
-      await confirmPassword(id, input.current);
-      if (input.next.length < PASSWORD_MIN) throw new AccountError(400, "PASSWORD_TOO_SHORT", `At least ${PASSWORD_MIN} characters`);
-      if (input.next.length > PASSWORD_MAX) throw new AccountError(400, "PASSWORD_TOO_LONG", `At most ${PASSWORD_MAX} characters`);
-      await query("UPDATE accounts SET password_hash = $2 WHERE id = $1", [id, await deps.passwords.hash(input.next)]);
-      await query("DELETE FROM sessions WHERE account_id = $1 AND ($2::uuid IS NULL OR id <> $2::uuid)", [id, keepSessionId ?? null]);
-    },
-    confirmPassword,
-    async requestPasswordReset(email, now) {
-      const address = email.trim().toLowerCase();
-      if (!looksLikeEmail(address)) return;
-      const issued = await transaction(async (q) => {
-        const [row] = await q("SELECT id, locale FROM accounts WHERE email = $1 AND password_hash IS NOT NULL FOR UPDATE", [address]);
-        if (!row) return null;
-        await q("UPDATE password_resets SET used_at = $2 WHERE account_id = $1 AND used_at IS NULL", [row.id, now]);
-        const token = (deps.token ?? (() => linkToken(deps.tokenPrefix)))();
-        await q("INSERT INTO password_resets (account_id, token_hash, expires_at) VALUES ($1, $2, $3)", [row.id, deps.tokenHash(token), addMinutes(now, resetTtlMinutes)]);
-        return { token, locale: row.locale };
-      });
-      if (!issued) return;
-      const url = `${deps.baseUrl.replace(/\/$/, "")}/${issued.locale}/reset-password?token=${encodeURIComponent(issued.token)}`;
-      await deps.mail({ to: address, locale: issued.locale, ...passwordResetMail(deps.product, issued.locale, url, resetTtlMinutes), link: { kind: "passwordReset", url, minutes: resetTtlMinutes } });
-    },
-    async resetPassword(token, next, now) {
-      if (next.length < PASSWORD_MIN) throw new AccountError(400, "PASSWORD_TOO_SHORT", `At least ${PASSWORD_MIN} characters`);
-      if (next.length > PASSWORD_MAX) throw new AccountError(400, "PASSWORD_TOO_LONG", `At most ${PASSWORD_MAX} characters`);
-      if (!isLinkToken(deps.tokenPrefix, token)) return "INVALID";
-      return transaction(async (q) => {
-        const [row] = await q("UPDATE password_resets SET used_at = $2 WHERE token_hash = $1 AND used_at IS NULL AND expires_at > $2 RETURNING account_id", [deps.tokenHash(token), now]);
-        if (!row) return "INVALID";
-        await q("UPDATE accounts SET password_hash = $2 WHERE id = $1", [row.account_id, await deps.passwords.hash(next)]);
-        await q("DELETE FROM sessions WHERE account_id = $1", [row.account_id]);
-        return "CHANGED";
-      });
-    },
-    async sessions(id, now, currentSessionId) {
-      const rows = await query("SELECT id, created_at, expires_at, ip, user_agent FROM sessions WHERE account_id = $1 AND expires_at > $2 ORDER BY created_at DESC", [id, now]);
-      return rows.map((r) => ({ id: r.id, createdAt: r.created_at, expiresAt: r.expires_at, ip: r.ip, userAgent: r.user_agent, current: r.id === currentSessionId }));
-    },
-    async signOutOthers(id, keepSessionId) {
-      return (await query("DELETE FROM sessions WHERE account_id = $1 AND id <> $2::uuid RETURNING id", [id, keepSessionId])).length;
-    },
-    async exportAccount(id, now, extra) {
-      const profile = await profileOf(id);
-      const live = await this.sessions(id, now);
-      return { exportedAt: now.toISOString(), account: profile, sessions: live.map(({ current: _current, ...s }) => s), ...extra ? await extra() : {} };
-    },
-    async deleteAccount(id) {
-      const rows = await query("DELETE FROM accounts WHERE id = $1 RETURNING id", [id]);
-      if (!rows.length) throw new AccountError(404, "NOT_FOUND", "No such account");
-    }
-  };
+  const hops = Math.max(1, Math.min(10, Number(rules.trustedProxyHops) || 1));
+  const chain = (headers.get("x-forwarded-for") ?? "").split(",").map((part) => part.trim()).filter(Boolean);
+  const fromRight = chain[chain.length - hops];
+  if (fromRight && isIp(fromRight)) return fromRight;
+  const real = headers.get("x-real-ip")?.trim();
+  if (real && isIp(real)) return real;
+  return null;
 }
-var postgresAccounts = dbAccounts;
 
 // src/federated-sign-in.ts
 var FEDERATED_REFUSAL = {
@@ -249,9 +120,41 @@ function rolesMigration(roles, options = {}) {
   return rolesSchema(roles, { scoped: options.scopeTable !== void 0 }).migrations[0].sql({ schema: "public", tables });
 }
 
+// src/password.ts
+import crypto2 from "crypto";
+import { promisify } from "util";
+var scrypt = promisify(crypto2.scrypt);
+var N = 32768;
+var R = 8;
+var P = 1;
+var KEYLEN = 32;
+var MAXMEM = 64 * 1024 * 1024;
+var OPTIONS = { N, r: R, p: P, maxmem: MAXMEM };
+var PASSWORD_MIN_LENGTH = 12;
+var PASSWORD_MAX_LENGTH = 256;
+function passwordProblem(password) {
+  if (password.length < PASSWORD_MIN_LENGTH) return "TOO_SHORT";
+  if (password.length > PASSWORD_MAX_LENGTH) return "TOO_LONG";
+  return null;
+}
+async function hashPassword(password) {
+  const salt = crypto2.randomBytes(16);
+  const hash = await scrypt(password, salt, KEYLEN, OPTIONS);
+  return `scrypt$${N}$${R}$${P}$${salt.toString("base64url")}$${hash.toString("base64url")}`;
+}
+async function verifyPassword(password, stored) {
+  const [scheme, n, r, p, salt, hash] = stored.split("$");
+  if (scheme !== "scrypt" || !salt || !hash || password.length > PASSWORD_MAX_LENGTH) return false;
+  const expected = Buffer.from(hash, "base64url");
+  const given = await scrypt(password, Buffer.from(salt, "base64url"), expected.length, { N: Number(n), r: Number(r), p: Number(p), maxmem: MAXMEM });
+  return given.length === expected.length && crypto2.timingSafeEqual(given, expected);
+}
+var decoy;
+var decoyHash = () => decoy ??= hashPassword(crypto2.randomBytes(24).toString("base64url"));
+
 // src/roles.ts
 import crypto3 from "crypto";
-import { addHours as addHours2 } from "date-fns";
+import { addHours } from "date-fns";
 var defineRoles = (model) => model;
 var can = (model, role, permission) => !!role && model.permissions[role].includes(permission);
 var ROLES_CODE = {
@@ -347,7 +250,7 @@ function createRoles(deps) {
       const token = newToken();
       const [row] = await query(
         "INSERT INTO invitations (id, scope_id, email, role, token_hash, invited_by, created_at, expires_at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8) RETURNING id, created_at, expires_at",
-        [crypto3.randomUUID(), scopeId, email, role, deps.tokenHash(token), actor.id, now, addHours2(now, deps.inviteTtlHours)]
+        [crypto3.randomUUID(), scopeId, email, role, deps.tokenHash(token), actor.id, now, addHours(now, deps.inviteTtlHours)]
       );
       return { token, invitation: { id: row.id, email, role, createdAt: row.created_at, expiresAt: row.expires_at } };
     },
@@ -379,6 +282,108 @@ function createRoles(deps) {
   };
 }
 
+// src/sessions.ts
+import crypto4 from "crypto";
+var BODY = /^[A-Za-z0-9_-]{43}$/;
+var PREFIX = /^[a-z]{1,4}$/;
+var USER_AGENT_MAX = 300;
+function createSessions(deps) {
+  if (!PREFIX.test(deps.tokenPrefix)) throw new RangeError(`tokenPrefix must be 1 to 4 lower-case letters, got ${deps.tokenPrefix}`);
+  const head = `${deps.tokenPrefix}1.`;
+  const secret = () => typeof deps.secret === "function" ? deps.secret() : deps.secret;
+  const isToken = (value) => !!value && value.startsWith(head) && BODY.test(value.slice(head.length));
+  const tokenHash = (token) => crypto4.createHmac("sha256", `session:${secret()}`).update(token).digest("hex");
+  const newToken = () => `${head}${crypto4.randomBytes(32).toString("base64url")}`;
+  return {
+    newToken,
+    isToken,
+    tokenHash,
+    async create(accountId, meta) {
+      const days = typeof deps.sessionDays === "function" ? await deps.sessionDays() : deps.sessionDays;
+      if (!Number.isInteger(days) || days < 1) throw new RangeError(`sessionDays must be a whole number of days from 1, got ${days}`);
+      const token = newToken();
+      const createdAt = deps.clock.now();
+      const expires = new Date(createdAt);
+      expires.setUTCHours(expires.getUTCHours() + days * 24);
+      await deps.store.insert({ accountId, tokenHash: tokenHash(token), createdAt, expiresAt: expires, ip: meta.ip, userAgent: meta.userAgent?.slice(0, USER_AGENT_MAX) ?? null });
+      return { token, expires };
+    },
+    async resolve(token) {
+      if (!isToken(token)) return null;
+      return deps.store.find(tokenHash(token), deps.clock.now());
+    },
+    async revoke(token) {
+      if (!isToken(token)) return;
+      await deps.store.delete(tokenHash(token));
+    }
+  };
+}
+function sessionCookie(token, expires, options) {
+  return { name: options.name, value: token, httpOnly: true, secure: options.secure, sameSite: "lax", path: "/", expires };
+}
+function clearedSessionCookie(options, now) {
+  return sessionCookie("", now, options);
+}
+function sessionTokenOf(headers, options) {
+  if (options.bearer !== false) {
+    const bearer = /^bearer (\S+)$/i.exec(headers.get("authorization") ?? "")?.[1];
+    if (bearer) return bearer;
+  }
+  const prefix = `${options.cookie}=`;
+  return headers.get("cookie")?.split(";").map((part) => part.trim()).find((part) => part.startsWith(prefix))?.slice(prefix.length);
+}
+
+// src/sessions-memory.ts
+function memorySessionStore(accountOf) {
+  const rows = /* @__PURE__ */ new Map();
+  let next = 0;
+  return {
+    async insert(session) {
+      if (rows.has(session.tokenHash)) throw new Error("duplicate session token hash");
+      next += 1;
+      rows.set(session.tokenHash, { ...session, id: `session-${next}` });
+    },
+    async find(tokenHash, now) {
+      const row = rows.get(tokenHash);
+      if (!row || row.expiresAt.getTime() <= now.getTime()) return null;
+      const account = accountOf(row.accountId);
+      return account === null ? null : { id: row.id, account };
+    },
+    async delete(tokenHash) {
+      rows.delete(tokenHash);
+    },
+    rows: () => [...rows.values()]
+  };
+}
+
+// src/sessions-persistence.ts
+import { ident as ident2 } from "@krizaka/db";
+function dbSessionStore(query, options) {
+  const sessions = ident2(options.sessions ?? "sessions");
+  const accounts = ident2(options.accounts ?? "accounts");
+  const columns = options.columns.map((column) => `a.${ident2(column)}`).join(", ");
+  const active = options.active ? ` AND a.${ident2(options.active.column)} = $3` : "";
+  return {
+    async insert(session) {
+      await query(`INSERT INTO ${sessions} (account_id, token_hash, created_at, expires_at, ip, user_agent) VALUES ($1, $2, $3, $4, $5, $6)`, [session.accountId, session.tokenHash, session.createdAt, session.expiresAt, session.ip, session.userAgent]);
+    },
+    async find(tokenHash, now) {
+      const params = [tokenHash, now];
+      if (options.active) params.push(options.active.equals);
+      const [row] = await query(
+        `SELECT s.id AS session_id, ${columns} FROM ${sessions} s JOIN ${accounts} a ON a.id = s.account_id WHERE s.token_hash = $1 AND s.expires_at > $2${active}`,
+        params
+      );
+      if (!row) return null;
+      const { session_id: id, ...account } = row;
+      return { id, account: options.toAccount(account) };
+    },
+    async delete(tokenHash) {
+      await query(`DELETE FROM ${sessions} WHERE token_hash = $1`, [tokenHash]);
+    }
+  };
+}
+
 // src/users-federation.ts
 var START = (base, provider) => `${base}/api/v1/auth/web/${provider}/start`;
 var EXCHANGE = (base) => `${base}/api/v1/auth/web/exchange`;
@@ -418,6 +423,7 @@ function usersIdentityProvider({ baseUrl, appUrl, fetch }) {
   };
 }
 export {
+  ADMIN_REFUSAL,
   AccountError,
   EMAIL_CHANGE_TTL_HOURS,
   FEDERATED_PROVIDERS,
@@ -425,6 +431,8 @@ export {
   FEDERATION_CODE,
   FederationError,
   IdentityLinkError,
+  PASSWORD_MAX_LENGTH,
+  PASSWORD_MIN_LENGTH,
   PASSWORD_RESET_MAX_MINUTES,
   PASSWORD_RESET_MIN_MINUTES,
   PASSWORD_RESET_TTL_MINUTES,
@@ -432,16 +440,24 @@ export {
   RolesError,
   accountsMigration,
   accountsSchema,
+  allowedIps,
   can,
+  clearedSessionCookie,
+  clientIp,
   createFederatedSignIn,
   createRoles,
+  createSessions,
   dbAccounts,
   dbIdentityLinks,
+  dbSessionStore,
+  decoyHash,
   defineRoles,
   emailChangeMail,
   emailChangeToken,
+  hashPassword,
   identityLinksMigration,
   identityLinksSchema,
+  ipAllowed,
   isEmailChangeToken,
   isFederatedProvider,
   isLinkToken,
@@ -449,12 +465,19 @@ export {
   linkToken,
   memoryIdentityLinks,
   memoryIdentityProvider,
+  memorySessionStore,
   parseExternalIdentity,
+  passwordProblem,
   passwordResetMail,
   pkceChallenge,
   postgresAccounts,
+  requireAdmin,
   rolesMigration,
   rolesSchema,
-  usersIdentityProvider
+  sessionCookie,
+  sessionTokenOf,
+  sessionsSchema,
+  usersIdentityProvider,
+  verifyPassword
 };
 //# sourceMappingURL=index.js.map