@madauth/server 0.1.0 → 0.2.0-beta.1

package/dist/standalone/lambda.mjs

@@ -15,7 +15,7 @@ var init_schema = __esm({
   "src/store/schema.ts"() {
     "use strict";
     madauthSchema = {
-      version: 1,
+      version: 3,
       models: {
         user: {
           fields: {
@@ -26,6 +26,8 @@ var init_schema = __esm({
             name: { type: "string", nullable: true },
             sessionVersion: { type: "number" },
             lastMailAt: { type: "number" },
+            /** Wrong e-mail codes in a row, counted across e-mails (since version 2). */
+            wrongCodes: { type: "number" },
             createdAt: { type: "number" }
           }
         },
@@ -51,6 +53,19 @@ var init_schema = __esm({
             attempts: { type: "number" },
             expiresAt: { type: "number" }
           }
+        },
+        /**
+         * The roles of an e-mail address (since version 3). `id` is the normalized address, so the roles
+         * apply whichever way its owner signs in. `roles` holds the names separated by spaces.
+         */
+        role: {
+          fields: {
+            id: { type: "string", primaryKey: true },
+            roles: { type: "string" },
+            updatedAt: { type: "number" },
+            /** The address of the admin who set them; empty when set from the command line. */
+            updatedBy: { type: "string", nullable: true }
+          }
         }
       }
     };
@@ -64,6 +79,9 @@ function tableName(model) {
 function columnName(field) {
   return field.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
 }
+function upgradeTablesSql(dialect, fromVersion) {
+  return upgrades.filter((step) => step.version > fromVersion).map((step) => step.sql(dialect)).join("\n");
+}
 function createTablesSql(dialect, schema = madauthSchema) {
   const statements = [];
   for (const [model, { fields }] of Object.entries(schema.models)) {
@@ -83,7 +101,7 @@ ${columns.join(",\n")}
   }
   return statements.join("\n");
 }
-var columnTypes;
+var columnTypes, upgrades;
 var init_sql = __esm({
   "src/store/sql.ts"() {
     "use strict";
@@ -94,6 +112,16 @@ var init_sql = __esm({
       postgres: { string: "TEXT", number: "DOUBLE PRECISION", boolean: "BOOLEAN" },
       mysql: { string: "TEXT", number: "DOUBLE", boolean: "BOOLEAN" }
     };
+    upgrades = [
+      {
+        version: 2,
+        sql: (dialect) => `ALTER TABLE ${tableName("user")} ADD COLUMN ${columnName("wrongCodes")} ${columnTypes[dialect].number} NOT NULL DEFAULT 0;`
+      },
+      {
+        version: 3,
+        sql: (dialect) => createTablesSql(dialect, { version: 3, models: { role: madauthSchema.models.role } })
+      }
+    ];
   }
 });
 
@@ -108,7 +136,7 @@ function createSqliteAdapter(path) {
   db.exec("PRAGMA busy_timeout = 5000");
   if (path !== ":memory:") db.exec("PRAGMA journal_mode = WAL");
   migrate(db);
-  const fieldsOf = (model) => {
+  const fieldsOf2 = (model) => {
     const fields = madauthSchema.models[model]?.fields;
     if (!fields) throw new Error(`Unknown model "${model}"`);
     return fields;
@@ -141,25 +169,25 @@ function createSqliteAdapter(path) {
   };
   return {
     async create(model, data) {
-      const fields = fieldsOf(model);
+      const fields = fieldsOf2(model);
       const names = Object.keys(data);
       const sql = `INSERT INTO ${tableName(model)} (${names.map((f) => column(fields, f)).join(", ")}) VALUES (${names.map(() => "?").join(", ")}) ON CONFLICT DO NOTHING`;
       return Number(db.prepare(sql).run(...names.map((f) => toSql(data[f]))).changes) === 1;
     },
     async findOne(model, where) {
-      const fields = fieldsOf(model);
+      const fields = fieldsOf2(model);
       const w = whereSql(fields, where);
       const raw2 = db.prepare(`SELECT * FROM ${tableName(model)}${w.sql} LIMIT 1`).get(...w.params);
       return raw2 ? fromSql(fields, raw2) : null;
     },
     async findMany(model, where, opts = {}) {
-      const fields = fieldsOf(model);
+      const fields = fieldsOf2(model);
       const w = whereSql(fields, where);
       const limit = opts.limit === void 0 ? "" : ` LIMIT ${Math.max(0, Math.floor(opts.limit))}`;
       return db.prepare(`SELECT * FROM ${tableName(model)}${w.sql}${limit}`).all(...w.params).map((raw2) => fromSql(fields, raw2));
     },
     async update(model, where, patch) {
-      const fields = fieldsOf(model);
+      const fields = fieldsOf2(model);
       const names = Object.keys(patch);
       if (!names.length) return 0;
       const w = whereSql(fields, where);
@@ -167,7 +195,7 @@ function createSqliteAdapter(path) {
       return Number(db.prepare(sql).run(...names.map((f) => toSql(patch[f])), ...w.params).changes);
     },
     async delete(model, where) {
-      const fields = fieldsOf(model);
+      const fields = fieldsOf2(model);
       const w = whereSql(fields, where);
       return Number(db.prepare(`DELETE FROM ${tableName(model)}${w.sql}`).run(...w.params).changes);
     }
@@ -183,7 +211,7 @@ function migrate(db) {
   if (version === madauthSchema.version) return;
   db.exec("BEGIN");
   try {
-    db.exec(createTablesSql("sqlite"));
+    db.exec(version === 0 ? createTablesSql("sqlite") : upgradeTablesSql("sqlite", version));
     db.exec(`PRAGMA user_version = ${madauthSchema.version}`);
     db.exec("COMMIT");
   } catch (e) {
@@ -199,6 +227,255 @@ var init_sqlite = __esm({
   }
 });
 
+// src/store/dynamodb.ts
+var dynamodb_exports = {};
+__export(dynamodb_exports, {
+  createDynamoDbAdapter: () => createDynamoDbAdapter
+});
+function toAttribute(value) {
+  if (value === null) return { NULL: true };
+  if (typeof value === "string") return { S: value };
+  if (typeof value === "number") return { N: String(value) };
+  return { BOOL: value };
+}
+function fromAttribute(attribute) {
+  if (attribute?.S !== void 0) return attribute.S;
+  if (attribute?.N !== void 0) return Number(attribute.N);
+  if (attribute?.BOOL !== void 0) return attribute.BOOL;
+  return null;
+}
+function fieldsOf(model) {
+  const fields = madauthSchema.models[model]?.fields;
+  if (!fields) throw new Error(`Unknown model "${model}"`);
+  return fields;
+}
+function checkFields(fields, names) {
+  for (const name of names) if (!fields[name]) throw new Error(`Unknown field "${name}"`);
+}
+function primaryKeyOf(fields) {
+  return Object.keys(fields).find((name) => fields[name].primaryKey);
+}
+function toRow(fields, item) {
+  return Object.fromEntries(Object.keys(fields).map((name) => [name, fromAttribute(item[name])]));
+}
+function matches(row, where) {
+  return Object.entries(where).every(([field, value]) => row[field] === value);
+}
+function stillMatches(where) {
+  const names = {};
+  const values = {};
+  const parts = ["attribute_exists(pk)"];
+  Object.entries(where).forEach(([field, value], i) => {
+    names[`#w${i}`] = field;
+    values[`:w${i}`] = toAttribute(value);
+    parts.push(value === null ? `(attribute_not_exists(#w${i}) OR #w${i} = :w${i})` : `#w${i} = :w${i}`);
+  });
+  return { text: parts.join(" AND "), names, values };
+}
+function failedWrite(error) {
+  const { name, CancellationReasons } = error;
+  if (name === "ConditionalCheckFailedException") return "refused";
+  if (name && RETRYABLE_ERRORS.includes(name)) return { retry: error };
+  if (name === "TransactionCanceledException") {
+    const reasons = (CancellationReasons ?? []).map((r) => r.Code ?? "None").filter((code) => code !== "None");
+    if (reasons.includes("ConditionalCheckFailed")) return "refused";
+    if (reasons.length && reasons.every((code) => RETRYABLE_REASONS.includes(code))) return { retry: error };
+  }
+  throw error;
+}
+function createDynamoDbAdapter(options) {
+  const { tableName: tableName2 } = options;
+  let loading;
+  const aws = () => loading ??= import("@aws-sdk/client-dynamodb").then((sdk) => ({
+    sdk,
+    client: options.client ?? new sdk.DynamoDBClient({})
+  }));
+  const write = async (send) => {
+    for (let attempt = 0; ; attempt++) {
+      const outcome = await send().then(() => "written", failedWrite);
+      if (outcome === "written") return true;
+      if (outcome === "refused") return false;
+      if (attempt === MAX_RETRIES) throw outcome.retry;
+      await pause(attempt);
+    }
+  };
+  const transact = async (items) => {
+    const { sdk, client } = await aws();
+    return write(() => client.send(new sdk.TransactWriteItemsCommand({ TransactItems: items })));
+  };
+  const getItem = async (key) => {
+    const { sdk, client } = await aws();
+    return (await client.send(new sdk.GetItemCommand({ TableName: tableName2, Key: key, ConsistentRead: true }))).Item;
+  };
+  const getRecord = async (model, fields, id) => {
+    const item = await getItem(recordKey(model, id));
+    return item ? toRow(fields, item) : null;
+  };
+  const idsOfIndex = async (model, field, value) => {
+    const { sdk, client } = await aws();
+    const ids = [];
+    let next;
+    do {
+      const page = await client.send(
+        new sdk.QueryCommand({
+          TableName: tableName2,
+          KeyConditionExpression: "pk = :pk",
+          ExpressionAttributeValues: { ":pk": { S: indexPartition(model, field, value) } },
+          ProjectionExpression: "sk",
+          ConsistentRead: true,
+          ExclusiveStartKey: next
+        })
+      );
+      for (const item of page.Items ?? []) if (item.sk?.S) ids.push(item.sk.S);
+      next = page.LastEvaluatedKey;
+    } while (next);
+    return ids;
+  };
+  const find = async (model, where) => {
+    const fields = fieldsOf(model);
+    checkFields(fields, Object.keys(where));
+    const given = (name) => where[name] !== void 0 && where[name] !== null;
+    const primaryKey = primaryKeyOf(fields);
+    const unique = Object.keys(fields).find((name) => fields[name].unique && given(name));
+    const indexed = Object.keys(fields).find((name) => fields[name].index && given(name));
+    let ids;
+    if (given(primaryKey)) {
+      ids = [String(where[primaryKey])];
+    } else if (unique) {
+      const ref = (await getItem(uniqueKey(model, unique, where[unique])))?.ref?.S;
+      ids = ref ? [ref] : [];
+    } else if (indexed) {
+      ids = await idsOfIndex(model, indexed, where[indexed]);
+    } else {
+      throw new Error(
+        `The DynamoDB adapter can't find "${model}" records by ${Object.keys(where).join(", ") || "nothing"}: the filter needs the id, a unique field or an indexed field.`
+      );
+    }
+    const rows = await Promise.all(ids.map((id) => getRecord(model, fields, id)));
+    return rows.filter((row) => row !== null && matches(row, where));
+  };
+  const derivedKeys = (model, fields, row, id) => Object.keys(fields).flatMap((name) => {
+    const value = row[name];
+    if (value === void 0 || value === null) return [];
+    return [
+      ...fields[name].unique ? [uniqueKey(model, name, value)] : [],
+      ...fields[name].index ? [indexKey(model, name, value, id)] : []
+    ];
+  });
+  return {
+    async create(model, data) {
+      const fields = fieldsOf(model);
+      checkFields(fields, Object.keys(data));
+      const primaryKey = primaryKeyOf(fields);
+      const id = data[primaryKey];
+      if (typeof id !== "string" || !id) throw new Error(`A "${model}" record needs a "${primaryKey}"`);
+      const record = { ...recordKey(model, id) };
+      for (const [field, value] of Object.entries(data)) record[field] = toAttribute(value);
+      const unused = "attribute_not_exists(pk)";
+      return transact([
+        { Put: { TableName: tableName2, Item: record, ConditionExpression: unused } },
+        ...derivedKeys(model, fields, data, id).map(
+          (key) => (
+            // A unique value refers to its record and may not be taken yet; an index entry is only a key.
+            key.pk.S.startsWith("u|") ? { Put: { TableName: tableName2, Item: { ...key, ref: { S: id } }, ConditionExpression: unused } } : { Put: { TableName: tableName2, Item: key } }
+          )
+        )
+      ]);
+    },
+    async findOne(model, where) {
+      return (await find(model, where))[0] ?? null;
+    },
+    async findMany(model, where, opts = {}) {
+      const rows = await find(model, where);
+      return opts.limit === void 0 ? rows : rows.slice(0, Math.max(0, Math.floor(opts.limit)));
+    },
+    async update(model, where, patch) {
+      const fields = fieldsOf(model);
+      const changes = Object.entries(patch);
+      checkFields(fields, [...Object.keys(where), ...Object.keys(patch)]);
+      for (const [field] of changes) {
+        if (fields[field].primaryKey || fields[field].unique || fields[field].index) {
+          throw new Error(`The DynamoDB adapter can't change "${field}" of a "${model}" record: it is a key.`);
+        }
+      }
+      if (!changes.length) return 0;
+      const primaryKey = primaryKeyOf(fields);
+      const condition = stillMatches(where);
+      const names = { ...condition.names };
+      const values = { ...condition.values };
+      const assignments = changes.map(([field, value], i) => {
+        names[`#p${i}`] = field;
+        values[`:p${i}`] = toAttribute(value);
+        return `#p${i} = :p${i}`;
+      });
+      const byId = where[primaryKey];
+      const ids = byId !== void 0 && byId !== null ? [String(byId)] : (await find(model, where)).map((row) => String(row[primaryKey]));
+      const written = await Promise.all(
+        ids.map(
+          (id) => transact([
+            {
+              Update: {
+                TableName: tableName2,
+                Key: recordKey(model, id),
+                UpdateExpression: `SET ${assignments.join(", ")}`,
+                ConditionExpression: condition.text,
+                ExpressionAttributeNames: names,
+                ExpressionAttributeValues: values
+              }
+            }
+          ])
+        )
+      );
+      return written.filter(Boolean).length;
+    },
+    async delete(model, where) {
+      const fields = fieldsOf(model);
+      const primaryKey = primaryKeyOf(fields);
+      const condition = stillMatches(where);
+      const deleted = await Promise.all(
+        (await find(model, where)).map((row) => {
+          const id = String(row[primaryKey]);
+          return transact([
+            {
+              Delete: {
+                TableName: tableName2,
+                Key: recordKey(model, id),
+                ConditionExpression: condition.text,
+                ExpressionAttributeNames: condition.names,
+                ExpressionAttributeValues: condition.values
+              }
+            },
+            ...derivedKeys(model, fields, row, id).map((key) => ({ Delete: { TableName: tableName2, Key: key } }))
+          ]);
+        })
+      );
+      return deleted.filter(Boolean).length;
+    }
+  };
+}
+var SORT_KEY, MAX_RETRIES, RETRYABLE_REASONS, RETRYABLE_ERRORS, recordKey, uniqueKey, indexPartition, indexKey, pause;
+var init_dynamodb = __esm({
+  "src/store/dynamodb.ts"() {
+    "use strict";
+    init_schema();
+    SORT_KEY = "#";
+    MAX_RETRIES = 8;
+    RETRYABLE_REASONS = ["TransactionConflict", "ThrottlingError", "ProvisionedThroughputExceeded"];
+    RETRYABLE_ERRORS = ["TransactionConflictException", "TransactionInProgressException"];
+    recordKey = (model, id) => ({ pk: { S: `r|${model}|${id}` }, sk: { S: SORT_KEY } });
+    uniqueKey = (model, field, value) => ({
+      pk: { S: `u|${model}|${field}|${String(value)}` },
+      sk: { S: SORT_KEY }
+    });
+    indexPartition = (model, field, value) => `i|${model}|${field}|${String(value)}`;
+    indexKey = (model, field, value, id) => ({
+      pk: { S: indexPartition(model, field, value) },
+      sk: { S: id }
+    });
+    pause = (attempt) => new Promise((resolve) => setTimeout(resolve, Math.random() * Math.min(25 * 2 ** attempt, 400)));
+  }
+});
+
 // ../../node_modules/hono/dist/utils/encode.js
 var encodeBase64 = (buf) => {
   let binary = "";
@@ -3612,6 +3889,45 @@ function safeEqual(a, b) {
   return x.length === y.length && timingSafeEqual(x, y);
 }
 
+// src/roles.ts
+var ADMIN_ROLE = "admin";
+var MAX_ROLES = 20;
+var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+function parseRoles(input) {
+  if (!Array.isArray(input)) return null;
+  if (!input.every((role) => typeof role === "string" && ROLE_NAME.test(role))) return null;
+  const roles = [...new Set(input)].sort();
+  return roles.length <= MAX_ROLES ? roles : null;
+}
+function sameRoles(a, b) {
+  return a.length === b.length && a.every((role, i) => role === b[i]);
+}
+var Roles = class {
+  constructor(store) {
+    this.store = store;
+  }
+  /** The address's roles, sorted; empty if it has none. */
+  async get(emailNormalized) {
+    const record = await this.store.findOne("role", { id: emailNormalized });
+    return typeof record?.roles === "string" && record.roles ? record.roles.split(" ").filter(Boolean) : [];
+  }
+  /** Replaces the address's roles. `updatedBy` is the address of the admin, or null for the command line. */
+  async set(emailNormalized, roles, updatedBy) {
+    if (!roles.length) {
+      await this.remove(emailNormalized);
+      return;
+    }
+    const data = { roles: roles.join(" "), updatedAt: Date.now(), updatedBy };
+    if (await this.store.update("role", { id: emailNormalized }, data) === 1) return;
+    if (!await this.store.create("role", { id: emailNormalized, ...data })) {
+      await this.store.update("role", { id: emailNormalized }, data);
+    }
+  }
+  async remove(emailNormalized) {
+    await this.store.delete("role", { id: emailNormalized });
+  }
+};
+
 // src/google.ts
 var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
 var googleJwks;
@@ -3649,6 +3965,9 @@ async function verifyGoogleIdToken(idToken, opts) {
 // src/user.ts
 var SESSION_COOKIE = "madauth_session";
 var SESSION_TYP = "madauth-session+jwt";
+var RENEWAL_COOKIE = "madauth_renewal";
+var RENEWAL_TYP = "madauth-renewal+jwt";
+var EXPIRY_COOKIE = "madauth_session_expires";
 
 // src/tokens.ts
 function randomString(bytes = 32) {
@@ -3674,15 +3993,29 @@ function signSession(keys, issuer, ttlSeconds, user, amr, extra = {}) {
     email_verified: user.email ? true : void 0,
     name: user.name,
     picture: user.picture,
+    roles: user.roles?.length ? user.roles : void 0,
     amr
   };
   return signToken(keys, issuer, SESSION_TYP, claims, ttlSeconds);
 }
+function signRenewal(keys, issuer, ttlSeconds, user, amr, extra = {}) {
+  const claims = {
+    ...extra,
+    sub: user.id,
+    email: user.email,
+    email_verified: user.email ? true : void 0,
+    name: user.name,
+    picture: user.picture,
+    amr
+  };
+  return signToken(keys, issuer, RENEWAL_TYP, claims, ttlSeconds);
+}
 function userFromClaims(claims) {
   const user = { id: claims.sub };
   if (claims.email) user.email = claims.email;
   if (claims.name) user.name = claims.name;
   if (claims.picture) user.picture = claims.picture;
+  if (Array.isArray(claims.roles) && claims.roles.length) user.roles = claims.roles;
   return user;
 }
 
@@ -3734,9 +4067,9 @@ function googleRoutes(app, ctx, google) {
       return c.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
     }
     deleteCookie(c, NONCE_COOKIE, { path: "/auth/google", secure });
-    await ctx.startSession(c, result.user, ["google"]);
-    await ctx.emit("user.signed_in", { user: result.user, method: "google" });
-    return c.json({ user: result.user });
+    const user = await ctx.startSession(c, result.user, ["google"]);
+    await ctx.emit("user.signed_in", { user, method: "google" });
+    return c.json({ user });
   });
   const requireCodeFlow = async (c, next) => {
     if (!google.clientSecret) return c.json({ error: "not_found" }, 404);
@@ -3810,8 +4143,8 @@ function googleRoutes(app, ctx, google) {
       keys: config.jwksResolver
     });
     if (!result.ok) return back(result.error);
-    await ctx.startSession(c, result.user, ["google"]);
-    await ctx.emit("user.signed_in", { user: result.user, method: "google" });
+    const user = await ctx.startSession(c, result.user, ["google"]);
+    await ctx.emit("user.signed_in", { user, method: "google" });
     return back();
   });
 }
@@ -3876,12 +4209,17 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     }
     if (isValidEmail(data.email) && typeof data.code === "string") {
       const user = await users.findByEmail(normalizeEmail(data.email));
-      const code = data.code.replace(/\s/g, "");
-      return { userId: user ? await users.consumeCode(user.id, purpose, code) : null, via: "code" };
+      if (!user) return { userId: null, via: "code" };
+      return { ...await users.consumeCode(user, purpose, data.code.replace(/\s/g, "")), via: "code" };
     }
     return { userId: null, via: "code" };
   };
-  const invalidVerification = (c, via) => via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
+  const invalidVerification = (c, { via, locked }) => {
+    if (locked) {
+      return error(c, 429, "codes_locked", "Too many wrong codes. Please ask for a new e-mail and use the link in it.");
+    }
+    return via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
+  };
   app.post("/auth/password/signin", async (c) => {
     const data = await body(c);
     const wrong = () => error(c, 401, "invalid_credentials", "E-mail or password is wrong.");
@@ -3913,8 +4251,7 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (!user.emailVerified) {
       return error(c, 403, "email_unverified", "Please confirm your e-mail address first. We can send the e-mail again.");
     }
-    const result = toMadauthUser(user);
-    await ctx.startSession(c, result, ["pwd"], { sv: user.sessionVersion });
+    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
     await ctx.emit("user.signed_in", { user: result, method: "password" });
     return c.json({ user: result });
   });
@@ -3943,6 +4280,7 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     const passwordHash = await hashPassword(data.password);
     const existing = await users.findByEmail(normalizeEmail(email));
     if (existing?.emailVerified) {
+      if (!webhook.wants("email.already_registered")) return accepted(c);
       const sent = await sendEmail(existing, "email.already_registered", { link: target.href, site: target.host, locale });
       return sent ? accepted(c) : unavailable(c);
     }
@@ -3976,12 +4314,12 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     return accepted(c);
   });
   app.post("/auth/password/verify-email", async (c) => {
-    const { userId, via } = await consume(await body(c), "verify");
+    const consumed = await consume(await body(c), "verify");
+    const { userId, via } = consumed;
     const user = userId ? await users.findById(userId) : null;
-    if (!user) return invalidVerification(c, via);
-    await users.updateUser(user.id, { emailVerified: true });
-    const result = toMadauthUser(user);
-    await ctx.startSession(c, result, ["pwd"], { sv: user.sessionVersion });
+    if (!user) return invalidVerification(c, consumed);
+    await users.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
+    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
     await ctx.emit("email.verified", { user: result, via });
     await ctx.emit("user.signed_in", { user: result, method: "password" });
     return c.json({ user: result });
@@ -4001,16 +4339,15 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     const data = await body(c);
     const policy = checkPasswordPolicy(data.password, minLength);
     if (policy) return error(c, 400, "weak_password", policy);
-    const { userId, via } = await consume(data, "reset");
-    const user = userId ? await users.findById(userId) : null;
+    const consumed = await consume(data, "reset");
+    const user = consumed.userId ? await users.findById(consumed.userId) : null;
     const account = user ? await users.passwordAccount(user.id) : null;
-    if (!user || !account) return invalidVerification(c, via);
+    if (!user || !account) return invalidVerification(c, consumed);
     await users.updateAccount(account.id, { secret: await hashPassword(data.password), failedAttempts: 0, lockedUntil: 0 });
     const sessionVersion = user.sessionVersion + 1;
-    await users.updateUser(user.id, { emailVerified: true, sessionVersion });
+    await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
     await users.clearVerifications(user.id);
-    const result = toMadauthUser(user);
-    await ctx.startSession(c, result, ["pwd"], { sv: sessionVersion });
+    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: sessionVersion });
     await ctx.emit("password.reset", { user: result });
     await ctx.emit("user.signed_in", { user: result, method: "password" });
     return c.json({ user: result });
@@ -4020,6 +4357,7 @@ function passwordRoutes(app, ctx, password, users, webhook) {
 // src/users.ts
 import { randomBytes as randomBytes2 } from "crypto";
 var MAX_CODE_ATTEMPTS = 5;
+var MAX_WRONG_CODES = 10;
 var newId = (prefix) => `${prefix}_${randomBytes2(16).toString("base64url")}`;
 function passwordAccountKey(userId) {
   return `password:${userId}`;
@@ -4054,6 +4392,7 @@ var Users = class {
       name: data.name,
       sessionVersion: 0,
       lastMailAt: 0,
+      wrongCodes: 0,
       createdAt: now
     };
     if (!await this.store.create("user", user)) return null;
@@ -4072,6 +4411,22 @@ var Users = class {
     }
     return user;
   }
+  /**
+   * Deletes the user with this e-mail address and everything stored for them. Resolves to the deleted
+   * user's ID, or null if there is no such user (any more).
+   */
+  async deleteByEmail(emailNormalized) {
+    const user = await this.findByEmail(emailNormalized);
+    if (!user) return null;
+    if (await this.store.delete("user", { id: user.id }) !== 1) return null;
+    try {
+      await this.store.delete("account", { userId: user.id });
+      await this.store.delete("verification", { userId: user.id });
+    } catch (e) {
+      console.error(`[madauth] Deleted user ${user.id}, but not all of their records: ${e.message}`);
+    }
+    return user.id;
+  }
   async updateUser(id, patch) {
     await this.store.update("user", { id }, patch);
   }
@@ -4115,17 +4470,38 @@ var Users = class {
     const record = await this.store.findOne("verification", { id, purpose });
     return record ? this.consume(record) : null;
   }
-  /** Uses up the user's verification if `code` matches. Too many wrong codes delete it. */
-  async consumeCode(userId, purpose, code) {
-    const record = await this.store.findOne("verification", { userId, purpose });
-    if (!record) return null;
+  /**
+   * Uses up the user's verification if `code` matches. Too many wrong codes delete it, and after
+   * MAX_WRONG_CODES wrong codes in a row the user's codes stop working until an e-mail link is used.
+   */
+  async consumeCode(user, purpose, code) {
+    if ((user.wrongCodes ?? 0) >= MAX_WRONG_CODES) return { userId: null, locked: true };
+    const record = await this.store.findOne("verification", { userId: user.id, purpose });
+    if (!record) return { userId: null, locked: false };
     const attempts = record.attempts + 1;
-    if (await this.store.update("verification", { id: record.id, attempts: record.attempts }, { attempts }) !== 1) return null;
+    if (await this.store.update("verification", { id: record.id, attempts: record.attempts }, { attempts }) !== 1) {
+      return { userId: null, locked: false };
+    }
+    const wrongCodes = await this.countWrongCode(user);
+    if (wrongCodes === null) return { userId: null, locked: false };
+    if (wrongCodes > MAX_WRONG_CODES) return { userId: null, locked: true };
     if (!safeEqual(hashCode(this.key, code), record.codeHash)) {
       if (attempts >= MAX_CODE_ATTEMPTS) await this.store.delete("verification", { id: record.id });
-      return null;
+      return { userId: null, locked: wrongCodes >= MAX_WRONG_CODES };
+    }
+    return { userId: await this.consume(record), locked: false };
+  }
+  /** Counts a code for the user and resolves to the new count; null if other requests kept changing it. */
+  async countWrongCode(user) {
+    let current = user;
+    for (let attempt = 0; attempt < 3 && current; attempt++) {
+      const wrongCodes = (current.wrongCodes ?? 0) + 1;
+      if (await this.store.update("user", { id: user.id, wrongCodes: current.wrongCodes ?? null }, { wrongCodes }) === 1) {
+        return wrongCodes;
+      }
+      current = await this.findById(user.id);
     }
-    return this.consume(record);
+    return null;
   }
   async consume(record) {
     const deleted = await this.store.delete("verification", { id: record.id });
@@ -4144,10 +4520,13 @@ var WEBHOOK_TYPES = [
   "user.created",
   "email.verified",
   "password.reset",
-  "user.signed_in"
+  "user.signed_in",
+  "user.deleted",
+  "roles.changed"
 ];
-var isEmailType = (type) => type.startsWith("email.") && type !== "email.verified";
+var REQUIRED_EMAIL_TYPES = ["email.verify", "email.reset"];
 var SECRET_PREFIX = "whsec_";
+var DEV_WEBHOOK_RECEIVER_URL = "https://github.com/inouiw/madAuth-webhooks/tree/main/dev-receiver";
 var WEBHOOK_TOLERANCE_SECONDS = 5 * 60;
 function generateWebhookSecret() {
   return `${SECRET_PREFIX}${randomBytes3(32).toString("base64")}`;
@@ -4166,7 +4545,7 @@ function signWebhook(secret, id, timestamp, body) {
   return `v1,${hmac2(secret, `${id}.${timestamp}.${body}`)}`;
 }
 function createWebhookClient(settings, fetchImpl = fetch) {
-  const wants = (type) => isEmailType(type) || !settings.events || settings.events.has(type);
+  const wants = (type) => settings.events.has(type);
   return {
     wants,
     async call(type, data, timeoutMs) {
@@ -4207,10 +4586,50 @@ function createWebhookClient(settings, fetchImpl = fetch) {
 // src/app.ts
 var EVENT_TIMEOUT_MS = 5e3;
 function createApp(config) {
-  const { issuer, allowedOrigins, sessionTtlSeconds, cookieDomain } = config;
+  const { issuer, allowedOrigins, sessionTtlSeconds, renewalTtlSeconds, cookieDomain } = config;
   const keys = importSigningKeys(config.signingKey);
   const secure = issuer.startsWith("https:");
   const isAllowedOrigin = (origin) => !!origin && allowedOrigins.includes(origin);
+  const roles = config.password ? new Roles(config.password.store) : void 0;
+  const withRoles = async (user) => {
+    const { roles: _, ...rest } = user;
+    const current = roles && user.email ? await roles.get(normalizeEmail(user.email)) : [];
+    return current.length ? { ...rest, roles: current } : rest;
+  };
+  const issueSession = async (c, user, amr, extra) => {
+    const signingKeys = await keys;
+    const [sessionToken, renewalToken] = await Promise.all([
+      signSession(signingKeys, issuer, sessionTtlSeconds, user, amr, extra),
+      signRenewal(signingKeys, issuer, renewalTtlSeconds, user, amr, extra)
+    ]);
+    setCookie(c, SESSION_COOKIE, sessionToken, {
+      path: "/",
+      domain: cookieDomain,
+      httpOnly: true,
+      secure,
+      sameSite: "Lax",
+      maxAge: sessionTtlSeconds
+    });
+    setCookie(c, RENEWAL_COOKIE, renewalToken, {
+      path: "/auth",
+      httpOnly: true,
+      secure,
+      sameSite: "Lax",
+      maxAge: renewalTtlSeconds
+    });
+    setCookie(c, EXPIRY_COOKIE, String(Math.floor(Date.now() / 1e3) + sessionTtlSeconds), {
+      path: "/",
+      domain: cookieDomain,
+      secure,
+      sameSite: "Lax",
+      maxAge: renewalTtlSeconds
+    });
+  };
+  const clearSession = (c) => {
+    deleteCookie(c, SESSION_COOKIE, { path: "/", domain: cookieDomain, secure });
+    deleteCookie(c, RENEWAL_COOKIE, { path: "/auth", secure });
+    deleteCookie(c, EXPIRY_COOKIE, { path: "/", domain: cookieDomain, secure });
+  };
   const ctx = {
     config,
     keys,
@@ -4228,15 +4647,9 @@ function createApp(config) {
       return url;
     },
     async startSession(c, user, amr, extra) {
-      const token = await signSession(await keys, issuer, sessionTtlSeconds, user, amr, extra);
-      setCookie(c, SESSION_COOKIE, token, {
-        path: "/",
-        domain: cookieDomain,
-        httpOnly: true,
-        secure,
-        sameSite: "Lax",
-        maxAge: sessionTtlSeconds
-      });
+      const signedIn = await withRoles(user);
+      await issueSession(c, signedIn, amr, extra);
+      return signedIn;
     },
     users: config.password ? new Users(config.password.store, deriveCodeKey(config.signingKey.d)) : void 0,
     webhook: config.webhook ? createWebhookClient(config.webhook, config.webhookFetch) : void 0,
@@ -4278,26 +4691,104 @@ function createApp(config) {
   );
   if (config.google) googleRoutes(app, ctx, config.google);
   if (config.password && ctx.users && ctx.webhook) passwordRoutes(app, ctx, config.password, ctx.users, ctx.webhook);
+  const tokenClaims = async (c, cookie, typ) => readToken(await keys, issuer, typ, getCookie(c, cookie));
+  const hasEnded = async (claims) => {
+    if (!claims.sub.startsWith("usr_")) return false;
+    const stored = await ctx.users?.findById(claims.sub);
+    return !stored || stored.sessionVersion !== claims.sv;
+  };
+  const checked = async (claims) => {
+    const [ended, user] = await Promise.all([hasEnded(claims), withRoles(userFromClaims(claims))]);
+    return ended ? null : user;
+  };
+  const currentSession = async (c) => {
+    const session = await tokenClaims(c, SESSION_COOKIE, SESSION_TYP);
+    const user = session ? await checked(session) : null;
+    const upToDate = session && user && sameRoles(user.roles ?? [], session.roles ?? []) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
+    if (upToDate) return user;
+    const renewal = await tokenClaims(c, RENEWAL_COOKIE, RENEWAL_TYP);
+    const sameSignIn = session && user && renewal && renewal.sub === session.sub && renewal.sv === session.sv && renewal.email === session.email;
+    const renewed = sameSignIn ? user : renewal ? await checked(renewal) : null;
+    if (renewal && renewed) {
+      await issueSession(c, renewed, renewal.amr, { sv: renewal.sv });
+      return renewed;
+    }
+    return user;
+  };
   app.get("/auth/session", async (c) => {
-    const claims = await readToken(await keys, issuer, SESSION_TYP, getCookie(c, SESSION_COOKIE));
-    if (!claims) return c.json({ error: "no_session" }, 401);
-    if (claims.sub.startsWith("usr_")) {
-      const stored = await ctx.users?.findById(claims.sub);
-      if (!stored || stored.sessionVersion !== claims.sv) return c.json({ error: "no_session" }, 401);
+    const user = await currentSession(c);
+    if (!user) {
+      clearSession(c);
+      return c.json({ error: "no_session" }, 401);
     }
-    const user = userFromClaims(claims);
-    if (Date.now() / 1e3 - claims.iat > sessionTtlSeconds / 2) await ctx.startSession(c, user, claims.amr, { sv: claims.sv });
     return c.json({ user });
   });
   app.post("/auth/logout", (c) => {
-    deleteCookie(c, SESSION_COOKIE, { path: "/", domain: cookieDomain, secure });
+    clearSession(c);
+    return c.body(null, 204);
+  });
+  app.post("/auth/account/delete", async (c) => {
+    const user = await currentSession(c);
+    if (!user) return c.json({ error: "no_session" }, 401);
+    if (roles && user.email) await roles.remove(normalizeEmail(user.email));
+    const passwordUserId = ctx.users && user.email ? await ctx.users.deleteByEmail(normalizeEmail(user.email)) : null;
+    clearSession(c);
+    await ctx.emit("user.deleted", { user, passwordUserId: passwordUserId ?? void 0 });
     return c.body(null, 204);
   });
+  if (roles) {
+    const admin = async (c) => {
+      const user = await currentSession(c);
+      if (!user) return { answer: c.json({ error: "no_session" }, 401) };
+      const email = user.email ? normalizeEmail(user.email) : void 0;
+      if (!email || !user.roles?.includes(ADMIN_ROLE)) {
+        return { answer: c.json({ error: "forbidden", message: `Only users with the role "${ADMIN_ROLE}" can manage roles.` }, 403) };
+      }
+      return { email };
+    };
+    const body = async (c) => {
+      const data = await c.req.json().catch(() => null);
+      return data && typeof data === "object" ? data : {};
+    };
+    const invalidEmail = (c) => c.json({ error: "invalid_email", message: "This is not a valid e-mail address." }, 400);
+    app.post("/auth/admin/roles/get", async (c) => {
+      const caller = await admin(c);
+      if ("answer" in caller) return caller.answer;
+      const data = await body(c);
+      if (!isValidEmail(data.email)) return invalidEmail(c);
+      const email = normalizeEmail(data.email);
+      return c.json({ email, roles: await roles.get(email) });
+    });
+    app.post("/auth/admin/roles/set", async (c) => {
+      const caller = await admin(c);
+      if ("answer" in caller) return caller.answer;
+      const data = await body(c);
+      if (!isValidEmail(data.email)) return invalidEmail(c);
+      const names = parseRoles(data.roles);
+      if (!names) {
+        return c.json(
+          {
+            error: "invalid_roles",
+            message: 'roles must be a list of names: lower-case letters, digits, "-" and "_", starting with a letter.'
+          },
+          400
+        );
+      }
+      const email = normalizeEmail(data.email);
+      await roles.set(email, names, caller.email);
+      await ctx.emit("roles.changed", { email, roles: names, by: caller.email });
+      return c.json({ email, roles: names });
+    });
+  }
   return app;
 }
 
 // src/config.ts
+async function resolveEnv(source = process.env) {
+  return typeof source === "function" ? source() : source;
+}
 var DEFAULT_SESSION_TTL = 8 * 60 * 60;
+var DEFAULT_RENEWAL_TTL = 30 * 24 * 60 * 60;
 var DEFAULT_PASSWORD_MIN_LENGTH = 8;
 var ConfigError = class extends Error {
   constructor() {
@@ -4353,17 +4844,16 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   if (clientId && !clientId.endsWith(".apps.googleusercontent.com")) {
     throw new ConfigError(`GOOGLE_CLIENT_ID must end with ".apps.googleusercontent.com" but is "${clientId}".`);
   }
-  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
+  const sendsEmails = !!(overrides.store || read("DATABASE_URL"));
+  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"), sendsEmails);
+  if (sendsEmails && !webhook) {
+    throw new ConfigError(
+      `WEBHOOK_URL is not set. E-mail & password sign-in sends its e-mails through your webhook. For development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See "Webhooks" in docs/server.md.`
+    );
+  }
   const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
   let password;
-  if (store) {
-    if (!webhook) {
-      throw new ConfigError(
-        'WEBHOOK_URL is not set. E-mail & password sign-in sends its e-mails through your webhook. For development, run the example receiver (npm run dev:webhooks) and set WEBHOOK_URL=http://localhost:8790/webhook. See "Webhooks" in docs/server.md.'
-      );
-    }
-    password = { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")), store };
-  }
+  if (store) password = { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")), store };
   if (!clientId && !password) {
     throw new ConfigError(
       "No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in and/or DATABASE_URL (e.g. sqlite:./madauth.db) for e-mail & password sign-in. See docs/server.md."
@@ -4374,11 +4864,19 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   if (!Number.isInteger(sessionTtlSeconds) || sessionTtlSeconds < 60) {
     throw new ConfigError(`SESSION_TTL must be a whole number of seconds (at least 60) but is "${ttlValue}".`);
   }
+  const renewalValue = read("SESSION_RENEWAL_TTL");
+  const renewalTtlSeconds = renewalValue ? Number(renewalValue) : Math.max(DEFAULT_RENEWAL_TTL, sessionTtlSeconds);
+  if (!Number.isInteger(renewalTtlSeconds) || renewalTtlSeconds < sessionTtlSeconds) {
+    throw new ConfigError(
+      `SESSION_RENEWAL_TTL must be a whole number of seconds, not less than SESSION_TTL (${sessionTtlSeconds}), but is "${renewalValue}".`
+    );
+  }
   return {
     issuer,
     signingKey,
     allowedOrigins,
     sessionTtlSeconds,
+    renewalTtlSeconds,
     cookieDomain: read("COOKIE_DOMAIN"),
     google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
     password,
@@ -4394,9 +4892,10 @@ function passwordMinLength(value) {
 }
 async function storeFromDatabaseUrl(url) {
   if (!url) return void 0;
+  if (url.startsWith("dynamodb:")) return dynamoDbStore(url.slice("dynamodb:".length));
   if (!url.startsWith("sqlite:")) {
     throw new ConfigError(
-      `DATABASE_URL must start with "sqlite:" (e.g. sqlite:/data/madauth.db) but is "${url}". For other databases, pass your own store adapter (see "Custom store adapter" in docs/server.md).`
+      `DATABASE_URL must start with "sqlite:" (e.g. sqlite:/data/madauth.db) or "dynamodb:" (e.g. dynamodb:madauth) but is "${url}". For other databases, pass your own store adapter (see "Custom store adapter" in docs/server.md).`
     );
   }
   const path = url.slice("sqlite:".length);
@@ -4408,8 +4907,25 @@ async function storeFromDatabaseUrl(url) {
     throw new ConfigError(`DATABASE_URL: could not open "${path}": ${e.message}`);
   }
 }
+async function dynamoDbStore(tableName2) {
+  if (!tableName2) throw new ConfigError("DATABASE_URL needs a table name, e.g. dynamodb:madauth");
+  if (!/^[\w.-]{3,255}$/.test(tableName2)) {
+    throw new ConfigError(
+      `DATABASE_URL=dynamodb: needs a DynamoDB table name (3 to 255 letters, digits, _ . -) but has "${tableName2}"`
+    );
+  }
+  try {
+    await import("@aws-sdk/client-dynamodb");
+  } catch (e) {
+    throw new ConfigError(
+      `DATABASE_URL=dynamodb: needs the AWS SDK. Install it next to madAuth: npm install @aws-sdk/client-dynamodb (${e.message})`
+    );
+  }
+  const { createDynamoDbAdapter: createDynamoDbAdapter2 } = await Promise.resolve().then(() => (init_dynamodb(), dynamodb_exports));
+  return createDynamoDbAdapter2({ tableName: tableName2 });
+}
 var LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]", "host.docker.internal"];
-function webhookFromEnv(url, secret, events) {
+function webhookFromEnv(url, secret, events, sendsEmails) {
   if (!url) {
     if (secret || events) throw new ConfigError("WEBHOOK_SECRET and WEBHOOK_EVENTS need WEBHOOK_URL.");
     return void 0;
@@ -4435,22 +4951,39 @@ WEBHOOK_SECRET=${generateWebhookSecret()}
   if (problem) {
     throw new ConfigError(`WEBHOOK_SECRET ${problem}. Generate one with: npx @madauth/server generate-webhook-secret`);
   }
-  let selected = null;
-  if (events) {
-    selected = new Set(events.split(",").map((e) => e.trim()).filter(Boolean));
-    const unknown = [...selected].filter((e) => !WEBHOOK_TYPES.includes(e));
-    if (unknown.length) {
-      throw new ConfigError(`WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. Known types: ${WEBHOOK_TYPES.join(", ")}.`);
-    }
+  const selected = new Set((events ?? "").split(",").map((e) => e.trim()).filter(Boolean));
+  const allTypes = `All types: ${WEBHOOK_TYPES.join(", ")}. See "Webhooks" in docs/server.md.`;
+  if (!selected.size) {
+    throw new ConfigError(
+      "WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. " + (sendsEmails ? `E-mail & password sign-in needs ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
+
+WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered
+
+` : "For example:\n\nWEBHOOK_EVENTS=user.signed_in\n\n") + allTypes
+    );
+  }
+  const unknown = [...selected].filter((e) => !WEBHOOK_TYPES.includes(e));
+  if (unknown.length) {
+    throw new ConfigError(`WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. Known types: ${WEBHOOK_TYPES.join(", ")}.`);
+  }
+  const missing = sendsEmails ? REQUIRED_EMAIL_TYPES.filter((type) => !selected.has(type)) : [];
+  if (missing.length) {
+    throw new ConfigError(
+      `WEBHOOK_EVENTS lacks ${missing.join(" and ")}. E-mail & password sign-in can't work without these e-mails, so your webhook receiver must send them:
+
+WEBHOOK_EVENTS=${[...selected, ...missing].join(",")}
+`
+    );
   }
   return { url: parsed.href, secret, events: selected };
 }
 
 // src/entry/lambda.ts
-function createHandler(overrides = {}) {
+function createHandler(options = {}) {
+  const { env, ...overrides } = options;
   let handlerPromise;
   return async (event, context) => {
-    handlerPromise ??= loadConfig(process.env, overrides).then((config) => handle(createApp(config)));
+    handlerPromise ??= resolveEnv(env).then((loaded) => loadConfig(loaded, overrides)).then((config) => handle(createApp(config)));
     handlerPromise.catch(() => handlerPromise = void 0);
     return (await handlerPromise)(event, context);
   };