@madauth/server 0.1.0 → 0.2.0-beta.2

package/dist/{chunk-TEMZRMFF.js → chunk-YALS7OMV.js}

@@ -1,29 +1,37 @@
 import {
+  EXPIRY_COOKIE,
+  RENEWAL_COOKIE,
+  RENEWAL_TYP,
   SESSION_COOKIE,
   SESSION_TYP,
   randomString,
   readToken,
+  signRenewal,
   signSession,
   signToken,
   userFromClaims
-} from "./chunk-PRRKLEW7.js";
+} from "./chunk-7CTAB3QV.js";
 import {
+  ADMIN_ROLE,
   MAX_PASSWORD_LENGTH,
+  Roles,
   Users,
   checkPasswordPolicy,
   deriveCodeKey,
   hashPassword,
   isValidEmail,
   normalizeEmail,
+  parseRoles,
+  sameRoles,
   verifyAgainstDummy,
   verifyPassword
-} from "./chunk-V2XKGETK.js";
+} from "./chunk-5CKEMC6M.js";
 import {
   importSigningKeys
 } from "./chunk-JDQLSL36.js";
 import {
   createWebhookClient
-} from "./chunk-AVZE6FFR.js";
+} from "./chunk-6EJDVZCD.js";
 
 // src/routes/google.ts
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
@@ -112,9 +120,9 @@ function googleRoutes(app, ctx, google) {
       return c.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
     }
     deleteCookie(c, NONCE_COOKIE, { path: "/auth/google", secure });
-    await ctx.startSession(c, result.user, ["google"]);
-    await ctx.emit("user.signed_in", { user: result.user, method: "google" });
-    return c.json({ user: result.user });
+    const user = await ctx.startSession(c, result.user, ["google"]);
+    await ctx.emit("user.signed_in", { user, method: "google" });
+    return c.json({ user });
   });
   const requireCodeFlow = async (c, next) => {
     if (!google.clientSecret) return c.json({ error: "not_found" }, 404);
@@ -188,8 +196,8 @@ function googleRoutes(app, ctx, google) {
       keys: config.jwksResolver
     });
     if (!result.ok) return back(result.error);
-    await ctx.startSession(c, result.user, ["google"]);
-    await ctx.emit("user.signed_in", { user: result.user, method: "google" });
+    const user = await ctx.startSession(c, result.user, ["google"]);
+    await ctx.emit("user.signed_in", { user, method: "google" });
     return back();
   });
 }
@@ -259,12 +267,17 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     }
     if (isValidEmail(data.email) && typeof data.code === "string") {
       const user = await users.findByEmail(normalizeEmail(data.email));
-      const code = data.code.replace(/\s/g, "");
-      return { userId: user ? await users.consumeCode(user.id, purpose, code) : null, via: "code" };
+      if (!user) return { userId: null, via: "code" };
+      return { ...await users.consumeCode(user, purpose, data.code.replace(/\s/g, "")), via: "code" };
     }
     return { userId: null, via: "code" };
   };
-  const invalidVerification = (c, via) => via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
+  const invalidVerification = (c, { via, locked }) => {
+    if (locked) {
+      return error(c, 429, "codes_locked", "Too many wrong codes. Please ask for a new e-mail and use the link in it.");
+    }
+    return via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
+  };
   app.post("/auth/password/signin", async (c) => {
     const data = await body(c);
     const wrong = () => error(c, 401, "invalid_credentials", "E-mail or password is wrong.");
@@ -296,8 +309,7 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (!user.emailVerified) {
       return error(c, 403, "email_unverified", "Please confirm your e-mail address first. We can send the e-mail again.");
     }
-    const result = toMadauthUser(user);
-    await ctx.startSession(c, result, ["pwd"], { sv: user.sessionVersion });
+    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
     await ctx.emit("user.signed_in", { user: result, method: "password" });
     return c.json({ user: result });
   });
@@ -326,6 +338,7 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     const passwordHash = await hashPassword(data.password);
     const existing = await users.findByEmail(normalizeEmail(email));
     if (existing?.emailVerified) {
+      if (!webhook.wants("email.already_registered")) return accepted(c);
       const sent = await sendEmail(existing, "email.already_registered", { link: target.href, site: target.host, locale });
       return sent ? accepted(c) : unavailable(c);
     }
@@ -359,12 +372,12 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     return accepted(c);
   });
   app.post("/auth/password/verify-email", async (c) => {
-    const { userId, via } = await consume(await body(c), "verify");
+    const consumed = await consume(await body(c), "verify");
+    const { userId, via } = consumed;
     const user = userId ? await users.findById(userId) : null;
-    if (!user) return invalidVerification(c, via);
-    await users.updateUser(user.id, { emailVerified: true });
-    const result = toMadauthUser(user);
-    await ctx.startSession(c, result, ["pwd"], { sv: user.sessionVersion });
+    if (!user) return invalidVerification(c, consumed);
+    await users.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
+    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
     await ctx.emit("email.verified", { user: result, via });
     await ctx.emit("user.signed_in", { user: result, method: "password" });
     return c.json({ user: result });
@@ -384,16 +397,15 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     const data = await body(c);
     const policy = checkPasswordPolicy(data.password, minLength);
     if (policy) return error(c, 400, "weak_password", policy);
-    const { userId, via } = await consume(data, "reset");
-    const user = userId ? await users.findById(userId) : null;
+    const consumed = await consume(data, "reset");
+    const user = consumed.userId ? await users.findById(consumed.userId) : null;
     const account = user ? await users.passwordAccount(user.id) : null;
-    if (!user || !account) return invalidVerification(c, via);
+    if (!user || !account) return invalidVerification(c, consumed);
     await users.updateAccount(account.id, { secret: await hashPassword(data.password), failedAttempts: 0, lockedUntil: 0 });
     const sessionVersion = user.sessionVersion + 1;
-    await users.updateUser(user.id, { emailVerified: true, sessionVersion });
+    await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
     await users.clearVerifications(user.id);
-    const result = toMadauthUser(user);
-    await ctx.startSession(c, result, ["pwd"], { sv: sessionVersion });
+    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: sessionVersion });
     await ctx.emit("password.reset", { user: result });
     await ctx.emit("user.signed_in", { user: result, method: "password" });
     return c.json({ user: result });
@@ -403,10 +415,50 @@ function passwordRoutes(app, ctx, password, users, webhook) {
 // src/app.ts
 var EVENT_TIMEOUT_MS = 5e3;
 function createApp(config) {
-  const { issuer, allowedOrigins, sessionTtlSeconds, cookieDomain } = config;
+  const { issuer, allowedOrigins, sessionTtlSeconds, renewalTtlSeconds, cookieDomain } = config;
   const keys = importSigningKeys(config.signingKey);
   const secure = issuer.startsWith("https:");
   const isAllowedOrigin = (origin) => !!origin && allowedOrigins.includes(origin);
+  const roles = config.password ? new Roles(config.password.store) : void 0;
+  const withRoles = async (user) => {
+    const { roles: _, ...rest } = user;
+    const current = roles && user.email ? await roles.get(normalizeEmail(user.email)) : [];
+    return current.length ? { ...rest, roles: current } : rest;
+  };
+  const issueSession = async (c, user, amr, extra) => {
+    const signingKeys = await keys;
+    const [sessionToken, renewalToken] = await Promise.all([
+      signSession(signingKeys, issuer, sessionTtlSeconds, user, amr, extra),
+      signRenewal(signingKeys, issuer, renewalTtlSeconds, user, amr, extra)
+    ]);
+    setCookie2(c, SESSION_COOKIE, sessionToken, {
+      path: "/",
+      domain: cookieDomain,
+      httpOnly: true,
+      secure,
+      sameSite: "Lax",
+      maxAge: sessionTtlSeconds
+    });
+    setCookie2(c, RENEWAL_COOKIE, renewalToken, {
+      path: "/auth",
+      httpOnly: true,
+      secure,
+      sameSite: "Lax",
+      maxAge: renewalTtlSeconds
+    });
+    setCookie2(c, EXPIRY_COOKIE, String(Math.floor(Date.now() / 1e3) + sessionTtlSeconds), {
+      path: "/",
+      domain: cookieDomain,
+      secure,
+      sameSite: "Lax",
+      maxAge: renewalTtlSeconds
+    });
+  };
+  const clearSession = (c) => {
+    deleteCookie2(c, SESSION_COOKIE, { path: "/", domain: cookieDomain, secure });
+    deleteCookie2(c, RENEWAL_COOKIE, { path: "/auth", secure });
+    deleteCookie2(c, EXPIRY_COOKIE, { path: "/", domain: cookieDomain, secure });
+  };
   const ctx = {
     config,
     keys,
@@ -424,15 +476,9 @@ function createApp(config) {
       return url;
     },
     async startSession(c, user, amr, extra) {
-      const token = await signSession(await keys, issuer, sessionTtlSeconds, user, amr, extra);
-      setCookie2(c, SESSION_COOKIE, token, {
-        path: "/",
-        domain: cookieDomain,
-        httpOnly: true,
-        secure,
-        sameSite: "Lax",
-        maxAge: sessionTtlSeconds
-      });
+      const signedIn = await withRoles(user);
+      await issueSession(c, signedIn, amr, extra);
+      return signedIn;
     },
     users: config.password ? new Users(config.password.store, deriveCodeKey(config.signingKey.d)) : void 0,
     webhook: config.webhook ? createWebhookClient(config.webhook, config.webhookFetch) : void 0,
@@ -474,21 +520,95 @@ function createApp(config) {
   );
   if (config.google) googleRoutes(app, ctx, config.google);
   if (config.password && ctx.users && ctx.webhook) passwordRoutes(app, ctx, config.password, ctx.users, ctx.webhook);
+  const tokenClaims = async (c, cookie, typ) => readToken(await keys, issuer, typ, getCookie2(c, cookie));
+  const hasEnded = async (claims) => {
+    if (!claims.sub.startsWith("usr_")) return false;
+    const stored = await ctx.users?.findById(claims.sub);
+    return !stored || stored.sessionVersion !== claims.sv;
+  };
+  const checked = async (claims) => {
+    const [ended, user] = await Promise.all([hasEnded(claims), withRoles(userFromClaims(claims))]);
+    return ended ? null : user;
+  };
+  const currentSession = async (c) => {
+    const session = await tokenClaims(c, SESSION_COOKIE, SESSION_TYP);
+    const user = session ? await checked(session) : null;
+    const upToDate = session && user && sameRoles(user.roles ?? [], session.roles ?? []) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
+    if (upToDate) return user;
+    const renewal = await tokenClaims(c, RENEWAL_COOKIE, RENEWAL_TYP);
+    const sameSignIn = session && user && renewal && renewal.sub === session.sub && renewal.sv === session.sv && renewal.email === session.email;
+    const renewed = sameSignIn ? user : renewal ? await checked(renewal) : null;
+    if (renewal && renewed) {
+      await issueSession(c, renewed, renewal.amr, { sv: renewal.sv });
+      return renewed;
+    }
+    return user;
+  };
   app.get("/auth/session", async (c) => {
-    const claims = await readToken(await keys, issuer, SESSION_TYP, getCookie2(c, SESSION_COOKIE));
-    if (!claims) return c.json({ error: "no_session" }, 401);
-    if (claims.sub.startsWith("usr_")) {
-      const stored = await ctx.users?.findById(claims.sub);
-      if (!stored || stored.sessionVersion !== claims.sv) return c.json({ error: "no_session" }, 401);
+    const user = await currentSession(c);
+    if (!user) {
+      clearSession(c);
+      return c.json({ error: "no_session" }, 401);
     }
-    const user = userFromClaims(claims);
-    if (Date.now() / 1e3 - claims.iat > sessionTtlSeconds / 2) await ctx.startSession(c, user, claims.amr, { sv: claims.sv });
     return c.json({ user });
   });
   app.post("/auth/logout", (c) => {
-    deleteCookie2(c, SESSION_COOKIE, { path: "/", domain: cookieDomain, secure });
+    clearSession(c);
     return c.body(null, 204);
   });
+  app.post("/auth/account/delete", async (c) => {
+    const user = await currentSession(c);
+    if (!user) return c.json({ error: "no_session" }, 401);
+    if (roles && user.email) await roles.remove(normalizeEmail(user.email));
+    const passwordUserId = ctx.users && user.email ? await ctx.users.deleteByEmail(normalizeEmail(user.email)) : null;
+    clearSession(c);
+    await ctx.emit("user.deleted", { user, passwordUserId: passwordUserId ?? void 0 });
+    return c.body(null, 204);
+  });
+  if (roles) {
+    const admin = async (c) => {
+      const user = await currentSession(c);
+      if (!user) return { answer: c.json({ error: "no_session" }, 401) };
+      const email = user.email ? normalizeEmail(user.email) : void 0;
+      if (!email || !user.roles?.includes(ADMIN_ROLE)) {
+        return { answer: c.json({ error: "forbidden", message: `Only users with the role "${ADMIN_ROLE}" can manage roles.` }, 403) };
+      }
+      return { email };
+    };
+    const body = async (c) => {
+      const data = await c.req.json().catch(() => null);
+      return data && typeof data === "object" ? data : {};
+    };
+    const invalidEmail = (c) => c.json({ error: "invalid_email", message: "This is not a valid e-mail address." }, 400);
+    app.post("/auth/admin/roles/get", async (c) => {
+      const caller = await admin(c);
+      if ("answer" in caller) return caller.answer;
+      const data = await body(c);
+      if (!isValidEmail(data.email)) return invalidEmail(c);
+      const email = normalizeEmail(data.email);
+      return c.json({ email, roles: await roles.get(email) });
+    });
+    app.post("/auth/admin/roles/set", async (c) => {
+      const caller = await admin(c);
+      if ("answer" in caller) return caller.answer;
+      const data = await body(c);
+      if (!isValidEmail(data.email)) return invalidEmail(c);
+      const names = parseRoles(data.roles);
+      if (!names) {
+        return c.json(
+          {
+            error: "invalid_roles",
+            message: 'roles must be a list of names: lower-case letters, digits, "-" and "_", starting with a letter.'
+          },
+          400
+        );
+      }
+      const email = normalizeEmail(data.email);
+      await roles.set(email, names, caller.email);
+      await ctx.emit("roles.changed", { email, roles: names, by: caller.email });
+      return c.json({ email, roles: names });
+    });
+  }
   return app;
 }
 

package/dist/{config-KQvE2imU.d.ts → config-BkxADgtp.d.ts}

@@ -1,6 +1,6 @@
 import { JWK, JWTVerifyGetKey } from 'jose';
-import { S as StoreAdapter } from './schema-Dotc6LU7.js';
-import { W as WebhookSettings } from './webhook-CT80emTQ.js';
+import { S as StoreAdapter } from './schema-BSgYVRpd.js';
+import { W as WebhookSettings } from './webhook-ltwulgcB.js';
 
 interface MadauthConfig {
     /** Public base URL of the server (MADAUTH_ISSUER). */
@@ -9,8 +9,10 @@ interface MadauthConfig {
     signingKey: JWK;
     /** App origins allowed to call the server (ALLOWED_ORIGINS). */
     allowedOrigins: string[];
-    /** Session lifetime in seconds (SESSION_TTL). */
+    /** Lifetime of a session token in seconds (SESSION_TTL): how long backends accept it. */
     sessionTtlSeconds: number;
+    /** How long a session can be renewed without signing in again, counted from its last renewal (SESSION_RENEWAL_TTL). */
+    renewalTtlSeconds: number;
     /** Cookie domain, e.g. `.example.com` (COOKIE_DOMAIN). */
     cookieDomain?: string;
     /** Google sign-in; off when GOOGLE_CLIENT_ID is not set. */
@@ -46,6 +48,7 @@ declare const envVars: {
     readonly WEBHOOK_SECRET: false;
     readonly WEBHOOK_EVENTS: false;
     readonly SESSION_TTL: false;
+    readonly SESSION_RENEWAL_TTL: false;
     readonly COOKIE_DOMAIN: false;
 };
 /** Instead of environment variables: your own store adapter. */
@@ -53,6 +56,15 @@ interface ConfigOverrides {
     /** Stores users; replaces DATABASE_URL. */
     store?: StoreAdapter;
 }
+type Env = Record<string, string | undefined>;
+/** Options of the hosting entry points: `start` (Node), `createHandler` (AWS Lambda) and `register` (Azure). */
+interface EntryOptions extends ConfigOverrides {
+    /**
+     * The environment variables to read, or a function that loads them, e.g. to add secrets from a
+     * parameter store. The function runs once, before the first request. Default: `process.env`.
+     */
+    env?: Env | (() => Env | Promise<Env>);
+}
 declare class ConfigError extends Error {
     name: string;
 }
@@ -62,4 +74,4 @@ declare class ConfigError extends Error {
  */
 declare function loadConfig(env: Record<string, string | undefined>, overrides?: ConfigOverrides): Promise<MadauthConfig>;
 
-export { type ConfigOverrides as C, type MadauthConfig as M, ConfigError as a, envVars as e, loadConfig as l };
+export { ConfigError as C, type EntryOptions as E, type MadauthConfig as M, type ConfigOverrides as a, envVars as e, loadConfig as l };

package/dist/dynamodb.js

@@ -0,0 +1,244 @@
+import {
+  madauthSchema
+} from "./chunk-XNBWZZHT.js";
+
+// src/store/dynamodb.ts
+var SORT_KEY = "#";
+var MAX_RETRIES = 8;
+var RETRYABLE_REASONS = ["TransactionConflict", "ThrottlingError", "ProvisionedThroughputExceeded"];
+var RETRYABLE_ERRORS = ["TransactionConflictException", "TransactionInProgressException"];
+var recordKey = (model, id) => ({ pk: { S: `r|${model}|${id}` }, sk: { S: SORT_KEY } });
+var uniqueKey = (model, field, value) => ({
+  pk: { S: `u|${model}|${field}|${String(value)}` },
+  sk: { S: SORT_KEY }
+});
+var indexPartition = (model, field, value) => `i|${model}|${field}|${String(value)}`;
+var indexKey = (model, field, value, id) => ({
+  pk: { S: indexPartition(model, field, value) },
+  sk: { S: id }
+});
+function toAttribute(value) {
+  if (value === null) return { NULL: true };
+  if (typeof value === "string") return { S: value };
+  if (typeof value === "number") return { N: String(value) };
+  return { BOOL: value };
+}
+function fromAttribute(attribute) {
+  if (attribute?.S !== void 0) return attribute.S;
+  if (attribute?.N !== void 0) return Number(attribute.N);
+  if (attribute?.BOOL !== void 0) return attribute.BOOL;
+  return null;
+}
+function fieldsOf(model) {
+  const fields = madauthSchema.models[model]?.fields;
+  if (!fields) throw new Error(`Unknown model "${model}"`);
+  return fields;
+}
+function checkFields(fields, names) {
+  for (const name of names) if (!fields[name]) throw new Error(`Unknown field "${name}"`);
+}
+function primaryKeyOf(fields) {
+  return Object.keys(fields).find((name) => fields[name].primaryKey);
+}
+function toRow(fields, item) {
+  return Object.fromEntries(Object.keys(fields).map((name) => [name, fromAttribute(item[name])]));
+}
+function matches(row, where) {
+  return Object.entries(where).every(([field, value]) => row[field] === value);
+}
+function stillMatches(where) {
+  const names = {};
+  const values = {};
+  const parts = ["attribute_exists(pk)"];
+  Object.entries(where).forEach(([field, value], i) => {
+    names[`#w${i}`] = field;
+    values[`:w${i}`] = toAttribute(value);
+    parts.push(value === null ? `(attribute_not_exists(#w${i}) OR #w${i} = :w${i})` : `#w${i} = :w${i}`);
+  });
+  return { text: parts.join(" AND "), names, values };
+}
+function failedWrite(error) {
+  const { name, CancellationReasons } = error;
+  if (name === "ConditionalCheckFailedException") return "refused";
+  if (name && RETRYABLE_ERRORS.includes(name)) return { retry: error };
+  if (name === "TransactionCanceledException") {
+    const reasons = (CancellationReasons ?? []).map((r) => r.Code ?? "None").filter((code) => code !== "None");
+    if (reasons.includes("ConditionalCheckFailed")) return "refused";
+    if (reasons.length && reasons.every((code) => RETRYABLE_REASONS.includes(code))) return { retry: error };
+  }
+  throw error;
+}
+var pause = (attempt) => new Promise((resolve) => setTimeout(resolve, Math.random() * Math.min(25 * 2 ** attempt, 400)));
+function createDynamoDbAdapter(options) {
+  const { tableName } = options;
+  let loading;
+  const aws = () => loading ??= import("@aws-sdk/client-dynamodb").then((sdk) => ({
+    sdk,
+    client: options.client ?? new sdk.DynamoDBClient({})
+  }));
+  const write = async (send) => {
+    for (let attempt = 0; ; attempt++) {
+      const outcome = await send().then(() => "written", failedWrite);
+      if (outcome === "written") return true;
+      if (outcome === "refused") return false;
+      if (attempt === MAX_RETRIES) throw outcome.retry;
+      await pause(attempt);
+    }
+  };
+  const transact = async (items) => {
+    const { sdk, client } = await aws();
+    return write(() => client.send(new sdk.TransactWriteItemsCommand({ TransactItems: items })));
+  };
+  const getItem = async (key) => {
+    const { sdk, client } = await aws();
+    return (await client.send(new sdk.GetItemCommand({ TableName: tableName, Key: key, ConsistentRead: true }))).Item;
+  };
+  const getRecord = async (model, fields, id) => {
+    const item = await getItem(recordKey(model, id));
+    return item ? toRow(fields, item) : null;
+  };
+  const idsOfIndex = async (model, field, value) => {
+    const { sdk, client } = await aws();
+    const ids = [];
+    let next;
+    do {
+      const page = await client.send(
+        new sdk.QueryCommand({
+          TableName: tableName,
+          KeyConditionExpression: "pk = :pk",
+          ExpressionAttributeValues: { ":pk": { S: indexPartition(model, field, value) } },
+          ProjectionExpression: "sk",
+          ConsistentRead: true,
+          ExclusiveStartKey: next
+        })
+      );
+      for (const item of page.Items ?? []) if (item.sk?.S) ids.push(item.sk.S);
+      next = page.LastEvaluatedKey;
+    } while (next);
+    return ids;
+  };
+  const find = async (model, where) => {
+    const fields = fieldsOf(model);
+    checkFields(fields, Object.keys(where));
+    const given = (name) => where[name] !== void 0 && where[name] !== null;
+    const primaryKey = primaryKeyOf(fields);
+    const unique = Object.keys(fields).find((name) => fields[name].unique && given(name));
+    const indexed = Object.keys(fields).find((name) => fields[name].index && given(name));
+    let ids;
+    if (given(primaryKey)) {
+      ids = [String(where[primaryKey])];
+    } else if (unique) {
+      const ref = (await getItem(uniqueKey(model, unique, where[unique])))?.ref?.S;
+      ids = ref ? [ref] : [];
+    } else if (indexed) {
+      ids = await idsOfIndex(model, indexed, where[indexed]);
+    } else {
+      throw new Error(
+        `The DynamoDB adapter can't find "${model}" records by ${Object.keys(where).join(", ") || "nothing"}: the filter needs the id, a unique field or an indexed field.`
+      );
+    }
+    const rows = await Promise.all(ids.map((id) => getRecord(model, fields, id)));
+    return rows.filter((row) => row !== null && matches(row, where));
+  };
+  const derivedKeys = (model, fields, row, id) => Object.keys(fields).flatMap((name) => {
+    const value = row[name];
+    if (value === void 0 || value === null) return [];
+    return [
+      ...fields[name].unique ? [uniqueKey(model, name, value)] : [],
+      ...fields[name].index ? [indexKey(model, name, value, id)] : []
+    ];
+  });
+  return {
+    async create(model, data) {
+      const fields = fieldsOf(model);
+      checkFields(fields, Object.keys(data));
+      const primaryKey = primaryKeyOf(fields);
+      const id = data[primaryKey];
+      if (typeof id !== "string" || !id) throw new Error(`A "${model}" record needs a "${primaryKey}"`);
+      const record = { ...recordKey(model, id) };
+      for (const [field, value] of Object.entries(data)) record[field] = toAttribute(value);
+      const unused = "attribute_not_exists(pk)";
+      return transact([
+        { Put: { TableName: tableName, Item: record, ConditionExpression: unused } },
+        ...derivedKeys(model, fields, data, id).map(
+          (key) => (
+            // A unique value refers to its record and may not be taken yet; an index entry is only a key.
+            key.pk.S.startsWith("u|") ? { Put: { TableName: tableName, Item: { ...key, ref: { S: id } }, ConditionExpression: unused } } : { Put: { TableName: tableName, Item: key } }
+          )
+        )
+      ]);
+    },
+    async findOne(model, where) {
+      return (await find(model, where))[0] ?? null;
+    },
+    async findMany(model, where, opts = {}) {
+      const rows = await find(model, where);
+      return opts.limit === void 0 ? rows : rows.slice(0, Math.max(0, Math.floor(opts.limit)));
+    },
+    async update(model, where, patch) {
+      const fields = fieldsOf(model);
+      const changes = Object.entries(patch);
+      checkFields(fields, [...Object.keys(where), ...Object.keys(patch)]);
+      for (const [field] of changes) {
+        if (fields[field].primaryKey || fields[field].unique || fields[field].index) {
+          throw new Error(`The DynamoDB adapter can't change "${field}" of a "${model}" record: it is a key.`);
+        }
+      }
+      if (!changes.length) return 0;
+      const primaryKey = primaryKeyOf(fields);
+      const condition = stillMatches(where);
+      const names = { ...condition.names };
+      const values = { ...condition.values };
+      const assignments = changes.map(([field, value], i) => {
+        names[`#p${i}`] = field;
+        values[`:p${i}`] = toAttribute(value);
+        return `#p${i} = :p${i}`;
+      });
+      const byId = where[primaryKey];
+      const ids = byId !== void 0 && byId !== null ? [String(byId)] : (await find(model, where)).map((row) => String(row[primaryKey]));
+      const written = await Promise.all(
+        ids.map(
+          (id) => transact([
+            {
+              Update: {
+                TableName: tableName,
+                Key: recordKey(model, id),
+                UpdateExpression: `SET ${assignments.join(", ")}`,
+                ConditionExpression: condition.text,
+                ExpressionAttributeNames: names,
+                ExpressionAttributeValues: values
+              }
+            }
+          ])
+        )
+      );
+      return written.filter(Boolean).length;
+    },
+    async delete(model, where) {
+      const fields = fieldsOf(model);
+      const primaryKey = primaryKeyOf(fields);
+      const condition = stillMatches(where);
+      const deleted = await Promise.all(
+        (await find(model, where)).map((row) => {
+          const id = String(row[primaryKey]);
+          return transact([
+            {
+              Delete: {
+                TableName: tableName,
+                Key: recordKey(model, id),
+                ConditionExpression: condition.text,
+                ExpressionAttributeNames: condition.names,
+                ExpressionAttributeValues: condition.values
+              }
+            },
+            ...derivedKeys(model, fields, row, id).map((key) => ({ Delete: { TableName: tableName, Key: key } }))
+          ]);
+        })
+      );
+      return deleted.filter(Boolean).length;
+    }
+  };
+}
+export {
+  createDynamoDbAdapter
+};

package/dist/entry/azure.d.ts

@@ -1,13 +1,13 @@
-import { C as ConfigOverrides } from '../config-KQvE2imU.js';
+import { E as EntryOptions } from '../config-BkxADgtp.js';
 import 'jose';
-import '../schema-Dotc6LU7.js';
-import '../webhook-CT80emTQ.js';
+import '../schema-BSgYVRpd.js';
+import '../webhook-ltwulgcB.js';
 
 /**
  * Registers madAuth as an Azure Functions v4 HTTP function that handles every route. Pass `store` to use your
- * own store adapter.
+ * own store adapter, and `env` to load settings from elsewhere, e.g. secrets from Key Vault.
  * Set `"routePrefix": ""` in host.json so the routes are served at /auth/... (see docs/server.md).
  */
-declare function register(overrides?: ConfigOverrides): void;
+declare function register(options?: EntryOptions): void;
 
 export { register };

package/dist/entry/azure.js

@@ -1,12 +1,13 @@
 import {
   createApp
-} from "../chunk-TEMZRMFF.js";
-import "../chunk-PRRKLEW7.js";
+} from "../chunk-YALS7OMV.js";
+import "../chunk-7CTAB3QV.js";
 import {
-  loadConfig
-} from "../chunk-V2XKGETK.js";
+  loadConfig,
+  resolveEnv
+} from "../chunk-5CKEMC6M.js";
 import "../chunk-JDQLSL36.js";
-import "../chunk-AVZE6FFR.js";
+import "../chunk-6EJDVZCD.js";
 
 // src/entry/azure.ts
 import { app } from "@azure/functions";
@@ -66,14 +67,15 @@ async function handleAzureRequest(app2, request) {
 }
 
 // src/entry/azure.ts
-function register(overrides = {}) {
+function register(options = {}) {
+  const { env, ...overrides } = options;
   let appPromise;
   app.http("madauth", {
     route: "{*path}",
     methods: ["GET", "POST", "OPTIONS"],
     authLevel: "anonymous",
     handler: async (request) => {
-      appPromise ??= loadConfig(process.env, overrides).then(createApp);
+      appPromise ??= resolveEnv(env).then((loaded) => loadConfig(loaded, overrides)).then(createApp);
       appPromise.catch(() => appPromise = void 0);
       return handleAzureRequest(await appPromise, request);
     }