@madauth/server 0.2.0-beta.1 → 0.3.0-beta.1

package/dist/standalone/main.mjs

@@ -38,8 +38,9 @@ var init_schema = __esm({
   "src/store/schema.ts"() {
     "use strict";
     madauthSchema = {
-      version: 3,
+      version: 4,
       models: {
+        /** Someone who signed in, whichever way: the e-mail address is the identity shared by the sign-in methods. */
         user: {
           fields: {
             id: { type: "string", primaryKey: true },
@@ -51,10 +52,12 @@ var init_schema = __esm({
             lastMailAt: { type: "number" },
             /** Wrong e-mail codes in a row, counted across e-mails (since version 2). */
             wrongCodes: { type: "number" },
+            /** What admins attached to the user, as JSON, e.g. `{"roles":["admin"]}` (since version 4). */
+            claims: { type: "string", nullable: true },
             createdAt: { type: "number" }
           }
         },
-        /** How a user signs in. `key` is e.g. `password:<userId>`; later `google:<sub>` or `totp:<userId>`. */
+        /** How a user signs in. `key` is `password:<userId>` or `google:<sub>`; later e.g. `totp:<userId>`. */
         account: {
           fields: {
             id: { type: "string", primaryKey: true },
@@ -63,6 +66,8 @@ var init_schema = __esm({
             secret: { type: "string", nullable: true },
             failedAttempts: { type: "number" },
             lockedUntil: { type: "number" },
+            /** The address the provider reported at the last sign-in, e.g. Google's current primary address (since version 4). */
+            email: { type: "string", nullable: true },
             createdAt: { type: "number" }
           }
         },
@@ -77,16 +82,13 @@ var init_schema = __esm({
             expiresAt: { type: "number" }
           }
         },
-        /**
-         * The roles of an e-mail address (since version 3). `id` is the normalized address, so the roles
-         * apply whichever way its owner signs in. `roles` holds the names separated by spaces.
-         */
-        role: {
+        /** A setting admins change at runtime, as JSON (since version 4), e.g. `methods`: which sign-in methods are on. */
+        setting: {
           fields: {
             id: { type: "string", primaryKey: true },
-            roles: { type: "string" },
+            value: { type: "string" },
             updatedAt: { type: "number" },
-            /** The address of the admin who set them; empty when set from the command line. */
+            /** The address of the admin who set it; empty when set from the command line. */
             updatedBy: { type: "string", nullable: true }
           }
         }
@@ -141,8 +143,30 @@ var init_sql = __esm({
         sql: (dialect) => `ALTER TABLE ${tableName("user")} ADD COLUMN ${columnName("wrongCodes")} ${columnTypes[dialect].number} NOT NULL DEFAULT 0;`
       },
       {
+        // Roles were per e-mail address in their own table; since version 4 they are one of the user's claims.
         version: 3,
-        sql: (dialect) => createTablesSql(dialect, { version: 3, models: { role: madauthSchema.models.role } })
+        sql: (dialect) => createTablesSql(dialect, {
+          version: 3,
+          models: {
+            role: {
+              fields: {
+                id: { type: "string", primaryKey: true },
+                roles: { type: "string" },
+                updatedAt: { type: "number" },
+                updatedBy: { type: "string", nullable: true }
+              }
+            }
+          }
+        })
+      },
+      {
+        version: 4,
+        sql: (dialect) => [
+          `ALTER TABLE ${tableName("user")} ADD COLUMN ${columnName("claims")} ${columnTypes[dialect].string};`,
+          `ALTER TABLE ${tableName("account")} ADD COLUMN ${columnName("email")} ${columnTypes[dialect].string};`,
+          `DROP TABLE ${tableName("role")};`,
+          createTablesSql(dialect, { version: 4, models: { setting: madauthSchema.models.setting } })
+        ].join("\n")
       }
     ];
   }
@@ -29999,11 +30023,16 @@ var WEBHOOK_TYPES = [
   "signup.before",
   "user.created",
   "email.verified",
-  "password.reset",
+  "email.password_reset",
   "user.signed_in",
   "user.deleted",
-  "roles.changed"
+  "user.claims_changed"
 ];
+var WEBHOOK_TIMEOUT_MS = 1e4;
+var MAX_LOCALE_LENGTH = 35;
+function localeOf(value) {
+  return typeof value === "string" && value.length <= MAX_LOCALE_LENGTH ? value : void 0;
+}
 var REQUIRED_EMAIL_TYPES = ["email.verify", "email.reset"];
 var SECRET_PREFIX = "whsec_";
 var DEV_WEBHOOK_RECEIVER_URL = "https://github.com/inouiw/madAuth-webhooks/tree/main/dev-receiver";
@@ -30124,19 +30153,18 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   if (clientId && !clientId.endsWith(".apps.googleusercontent.com")) {
     throw new ConfigError(`GOOGLE_CLIENT_ID must end with ".apps.googleusercontent.com" but is "${clientId}".`);
   }
-  const sendsEmails = !!(overrides.store || read("DATABASE_URL"));
-  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"), sendsEmails);
-  if (sendsEmails && !webhook) {
+  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
+  const sendsEmails = !!webhook && REQUIRED_EMAIL_TYPES.every((type) => webhook.events.has(type));
+  const password = sendsEmails ? { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")) } : void 0;
+  if (!clientId && !password) {
     throw new ConfigError(
-      `WEBHOOK_URL is not set. E-mail & password sign-in sends its e-mails through your webhook. For development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See "Webhooks" in docs/server.md.`
+      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See docs/server.md.`
     );
   }
   const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
-  let password;
-  if (store) password = { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")), store };
-  if (!clientId && !password) {
+  if (!store) {
     throw new ConfigError(
-      "No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in and/or DATABASE_URL (e.g. sqlite:./madauth.db) for e-mail & password sign-in. See docs/server.md."
+      "DATABASE_URL is not set. madAuth stores every user, whichever way they sign in: set e.g. DATABASE_URL=sqlite:./madauth.db or DATABASE_URL=dynamodb:<table>. See docs/server.md."
     );
   }
   const ttlValue = read("SESSION_TTL");
@@ -30159,6 +30187,7 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
     renewalTtlSeconds,
     cookieDomain: read("COOKIE_DOMAIN"),
     google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
+    store,
     password,
     webhook
   };
@@ -30204,8 +30233,9 @@ async function dynamoDbStore(tableName2) {
   const { createDynamoDbAdapter: createDynamoDbAdapter2 } = await Promise.resolve().then(() => (init_dynamodb(), dynamodb_exports));
   return createDynamoDbAdapter2({ tableName: tableName2 });
 }
+var RENAMED_TYPES = { "password.reset": "email.password_reset", "roles.changed": "user.claims_changed" };
 var LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]", "host.docker.internal"];
-function webhookFromEnv(url, secret, events, sendsEmails) {
+function webhookFromEnv(url, secret, events) {
   if (!url) {
     if (secret || events) throw new ConfigError("WEBHOOK_SECRET and WEBHOOK_EVENTS need WEBHOOK_URL.");
     return void 0;
@@ -30235,24 +30265,22 @@ WEBHOOK_SECRET=${generateWebhookSecret()}
   const allTypes = `All types: ${WEBHOOK_TYPES.join(", ")}. See "Webhooks" in docs/server.md.`;
   if (!selected.size) {
     throw new ConfigError(
-      "WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. " + (sendsEmails ? `E-mail & password sign-in needs ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
+      `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
 
 WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered
 
-` : "For example:\n\nWEBHOOK_EVENTS=user.signed_in\n\n") + allTypes
+For one that only wants to know who signed in:
+
+WEBHOOK_EVENTS=user.signed_in
+
+` + allTypes
     );
   }
   const unknown = [...selected].filter((e6) => !WEBHOOK_TYPES.includes(e6));
   if (unknown.length) {
-    throw new ConfigError(`WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. Known types: ${WEBHOOK_TYPES.join(", ")}.`);
-  }
-  const missing = sendsEmails ? REQUIRED_EMAIL_TYPES.filter((type) => !selected.has(type)) : [];
-  if (missing.length) {
+    const renamed = unknown.filter((e6) => e6 in RENAMED_TYPES).map((e6) => `${e6} is now ${RENAMED_TYPES[e6]}`);
     throw new ConfigError(
-      `WEBHOOK_EVENTS lacks ${missing.join(" and ")}. E-mail & password sign-in can't work without these e-mails, so your webhook receiver must send them:
-
-WEBHOOK_EVENTS=${[...selected, ...missing].join(",")}
-`
+      `WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. ${renamed.length ? `${renamed.join("; ")}. ` : ""}Known types: ${WEBHOOK_TYPES.join(", ")}.`
     );
   }
   return { url: parsed.href, secret, events: selected };
@@ -33551,6 +33579,63 @@ var cors = (options) => {
   };
 };
 
+// src/claims.ts
+var ADMIN_ROLE = "admin";
+var MAX_ROLES = 20;
+var MAX_CLAIMS_LENGTH = 2048;
+var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+var CLAIM_NAME = /^[a-zA-Z][a-zA-Z0-9_]{0,63}$/;
+function parseRoles(input) {
+  if (!Array.isArray(input)) return null;
+  if (!input.every((role) => typeof role === "string" && ROLE_NAME.test(role))) return null;
+  const roles = [...new Set(input)].sort();
+  return roles.length <= MAX_ROLES ? roles : null;
+}
+function parseClaims(input) {
+  if (!isJsonObject(input)) return null;
+  const claims = {};
+  for (const key of Object.keys(input).sort()) {
+    const value = input[key];
+    if (!CLAIM_NAME.test(key) || !isJsonValue(value)) return null;
+    if (key === "roles") {
+      const roles = parseRoles(value);
+      if (!roles) return null;
+      claims[key] = roles;
+    } else {
+      claims[key] = value;
+    }
+  }
+  return JSON.stringify(claims).length <= MAX_CLAIMS_LENGTH ? claims : null;
+}
+function isJsonObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isJsonValue(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+  if (typeof value === "number") return Number.isFinite(value);
+  if (Array.isArray(value)) return value.every(isJsonValue);
+  return isJsonObject(value) && Object.values(value).every(isJsonValue);
+}
+function sameClaims(a6, b6) {
+  return JSON.stringify(a6 ?? {}) === JSON.stringify(b6 ?? {});
+}
+function claimsFromJson(json2) {
+  if (!json2) return {};
+  try {
+    const parsed = JSON.parse(json2);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function rolesOf(user) {
+  const roles = user.claims?.roles;
+  return Array.isArray(roles) ? roles.filter((role) => typeof role === "string") : [];
+}
+function isAdmin(user) {
+  return rolesOf(user).includes(ADMIN_ROLE);
+}
+
 // src/password.ts
 import { createHash as createHash4, createHmac as createHmac3, hkdfSync, randomBytes as randomBytes2, randomInt, scrypt, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var HASH_PARAMS = { logN: 15, r: 8, p: 3 };
@@ -33626,45 +33711,6 @@ function safeEqual(a6, b6) {
   return x2.length === y2.length && timingSafeEqual2(x2, y2);
 }
 
-// src/roles.ts
-var ADMIN_ROLE = "admin";
-var MAX_ROLES = 20;
-var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
-function parseRoles(input) {
-  if (!Array.isArray(input)) return null;
-  if (!input.every((role) => typeof role === "string" && ROLE_NAME.test(role))) return null;
-  const roles = [...new Set(input)].sort();
-  return roles.length <= MAX_ROLES ? roles : null;
-}
-function sameRoles(a6, b6) {
-  return a6.length === b6.length && a6.every((role, i6) => role === b6[i6]);
-}
-var Roles = class {
-  constructor(store) {
-    this.store = store;
-  }
-  /** The address's roles, sorted; empty if it has none. */
-  async get(emailNormalized) {
-    const record = await this.store.findOne("role", { id: emailNormalized });
-    return typeof record?.roles === "string" && record.roles ? record.roles.split(" ").filter(Boolean) : [];
-  }
-  /** Replaces the address's roles. `updatedBy` is the address of the admin, or null for the command line. */
-  async set(emailNormalized, roles, updatedBy) {
-    if (!roles.length) {
-      await this.remove(emailNormalized);
-      return;
-    }
-    const data = { roles: roles.join(" "), updatedAt: Date.now(), updatedBy };
-    if (await this.store.update("role", { id: emailNormalized }, data) === 1) return;
-    if (!await this.store.create("role", { id: emailNormalized, ...data })) {
-      await this.store.update("role", { id: emailNormalized }, data);
-    }
-  }
-  async remove(emailNormalized) {
-    await this.store.delete("role", { id: emailNormalized });
-  }
-};
-
 // src/google.ts
 var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
 var googleJwks;
@@ -33689,14 +33735,13 @@ async function verifyGoogleIdToken(idToken, opts) {
   if (payload.nonce !== opts.nonce) {
     return { ok: false, error: "verification_failed", reason: "nonce mismatch" };
   }
-  if (payload.email_verified !== true) {
+  if (typeof payload.email !== "string" || !payload.email || payload.email_verified !== true) {
     return { ok: false, error: "email_unverified", reason: "e-mail address not verified" };
   }
-  const user = { id: `google:${payload.sub}` };
-  if (typeof payload.email === "string") user.email = payload.email;
-  if (typeof payload.name === "string") user.name = payload.name;
-  if (typeof payload.picture === "string") user.picture = payload.picture;
-  return { ok: true, user };
+  const profile = { sub: payload.sub, email: payload.email };
+  if (typeof payload.name === "string") profile.name = payload.name;
+  if (typeof payload.picture === "string") profile.picture = payload.picture;
+  return { ok: true, profile };
 }
 
 // src/user.ts
@@ -33730,7 +33775,7 @@ function signSession(keys, issuer, ttlSeconds, user, amr, extra = {}) {
     email_verified: user.email ? true : void 0,
     name: user.name,
     picture: user.picture,
-    roles: user.roles?.length ? user.roles : void 0,
+    claims: user.claims && Object.keys(user.claims).length ? user.claims : void 0,
     amr
   };
   return signToken(keys, issuer, SESSION_TYP, claims, ttlSeconds);
@@ -33752,10 +33797,203 @@ function userFromClaims(claims) {
   if (claims.email) user.email = claims.email;
   if (claims.name) user.name = claims.name;
   if (claims.picture) user.picture = claims.picture;
-  if (Array.isArray(claims.roles) && claims.roles.length) user.roles = claims.roles;
+  if (claims.claims && typeof claims.claims === "object" && Object.keys(claims.claims).length) user.claims = claims.claims;
   return user;
 }
 
+// src/users.ts
+import { randomBytes as randomBytes3 } from "crypto";
+var MAX_CODE_ATTEMPTS = 5;
+var MAX_WRONG_CODES = 10;
+var newId = (prefix) => `${prefix}_${randomBytes3(16).toString("base64url")}`;
+function passwordAccountKey(userId) {
+  return `password:${userId}`;
+}
+function googleAccountKey(sub) {
+  return `google:${sub}`;
+}
+function toMadauthUser(user, profile = {}) {
+  const result = { id: user.id, email: user.email };
+  const name = user.name ?? profile.name;
+  if (name) result.name = name;
+  if (profile.picture) result.picture = profile.picture;
+  const claims = claimsFromJson(user.claims);
+  if (Object.keys(claims).length) result.claims = claims;
+  return result;
+}
+var Users = class {
+  /** `codeKey` keys the e-mail codes (see deriveCodeKey); only needed to issue and check them. */
+  constructor(store, codeKey) {
+    this.store = store;
+    this.codeKey = codeKey;
+  }
+  get key() {
+    if (!this.codeKey) throw new Error("Users needs a code key to issue or check e-mail codes.");
+    return this.codeKey;
+  }
+  async findByEmail(emailNormalized) {
+    return await this.store.findOne("user", { emailNormalized });
+  }
+  async findById(id) {
+    return await this.store.findOne("user", { id });
+  }
+  async passwordAccount(userId) {
+    return this.findAccountByKey(passwordAccountKey(userId));
+  }
+  async findAccountByKey(key) {
+    return await this.store.findOne("account", { key });
+  }
+  /**
+   * Creates a user with their first account. Resolves to null if the e-mail address or the account key is
+   * taken. `account.key` is `password:<userId>` for a password (its hash as `secret`), or e.g. `google:<sub>`.
+   */
+  async createUser(data) {
+    const user = {
+      id: newId("usr"),
+      email: data.email,
+      emailNormalized: data.emailNormalized,
+      emailVerified: data.emailVerified,
+      name: data.name,
+      sessionVersion: 0,
+      lastMailAt: 0,
+      wrongCodes: 0,
+      claims: null,
+      createdAt: Date.now()
+    };
+    if (!await this.store.create("user", user)) return null;
+    const account = typeof data.account === "function" ? data.account(user.id) : data.account;
+    if (!await this.linkAccount(user.id, account)) {
+      await this.store.delete("user", { id: user.id });
+      return null;
+    }
+    return user;
+  }
+  /**
+   * A provider verified the user's address: an unconfirmed password sign-up with it, whose password nobody
+   * has proven, is dropped (the account and its pending links and codes), and the user counts as verified.
+   */
+  async verifyByProvider(user) {
+    if (user.emailVerified) return;
+    await this.store.delete("account", { key: passwordAccountKey(user.id) });
+    await this.clearVerifications(user.id);
+    await this.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
+  }
+  /** Removes an account record, e.g. one left behind by a deletion that did not finish. */
+  async deleteAccount(id) {
+    await this.store.delete("account", { id });
+  }
+  /** Adds a sign-in method to a user. Resolves to null if the account key is taken. */
+  async linkAccount(userId, account) {
+    const record = {
+      id: newId("acc"),
+      userId,
+      key: account.key,
+      secret: account.secret ?? null,
+      failedAttempts: 0,
+      lockedUntil: 0,
+      email: account.email ?? null,
+      createdAt: Date.now()
+    };
+    return await this.store.create("account", record) ? record : null;
+  }
+  /**
+   * Deletes the user and everything stored for them. Resolves to false if there is no such user (any more).
+   */
+  async deleteById(id) {
+    const user = await this.findById(id);
+    if (!user) return false;
+    if (await this.store.delete("user", { id: user.id }) !== 1) return false;
+    try {
+      await this.store.delete("account", { userId: user.id });
+      await this.store.delete("verification", { userId: user.id });
+    } catch (e6) {
+      console.error(`[madauth] Deleted user ${user.id}, but not all of their records: ${e6.message}`);
+    }
+    return true;
+  }
+  async updateUser(id, patch) {
+    await this.store.update("user", { id }, patch);
+  }
+  async updateAccount(id, patch) {
+    await this.store.update("account", { id }, patch);
+  }
+  /**
+   * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
+   * was read. Resolves to false if another request counted an attempt meanwhile.
+   */
+  async countAttempt(account, patch) {
+    const changed = await this.store.update("account", { id: account.id, failedAttempts: account.failedAttempts }, patch);
+    return changed === 1;
+  }
+  /** Deletes the user's pending verifications and password resets; their links and codes stop working. */
+  async clearVerifications(userId) {
+    await this.store.delete("verification", { userId });
+  }
+  /**
+   * Starts a verification or password reset: replaces the user's earlier one for the same purpose and
+   * returns the link token and the code for the e-mail. Only their hashes are stored.
+   */
+  async issueVerification(userId, purpose, ttlMs) {
+    await this.store.delete("verification", { userId, purpose });
+    const token = generateLinkToken();
+    const code = generateCode();
+    const record = {
+      id: hashLinkToken(token),
+      userId,
+      purpose,
+      codeHash: hashCode(this.key, code),
+      attempts: 0,
+      expiresAt: Date.now() + ttlMs
+    };
+    await this.store.create("verification", record);
+    return { token, code };
+  }
+  /** Uses up the verification a link token belongs to. Resolves to its user ID, or null if invalid, expired or used. */
+  async consumeLinkToken(token, purpose) {
+    const id = hashLinkToken(token);
+    const record = await this.store.findOne("verification", { id, purpose });
+    return record ? this.consume(record) : null;
+  }
+  /**
+   * Uses up the user's verification if `code` matches. Too many wrong codes delete it, and after
+   * MAX_WRONG_CODES wrong codes in a row the user's codes stop working until an e-mail link is used.
+   */
+  async consumeCode(user, purpose, code) {
+    if ((user.wrongCodes ?? 0) >= MAX_WRONG_CODES) return { userId: null, locked: true };
+    const record = await this.store.findOne("verification", { userId: user.id, purpose });
+    if (!record) return { userId: null, locked: false };
+    const attempts = record.attempts + 1;
+    if (await this.store.update("verification", { id: record.id, attempts: record.attempts }, { attempts }) !== 1) {
+      return { userId: null, locked: false };
+    }
+    const wrongCodes = await this.countWrongCode(user);
+    if (wrongCodes === null) return { userId: null, locked: false };
+    if (wrongCodes > MAX_WRONG_CODES) return { userId: null, locked: true };
+    if (!safeEqual(hashCode(this.key, code), record.codeHash)) {
+      if (attempts >= MAX_CODE_ATTEMPTS) await this.store.delete("verification", { id: record.id });
+      return { userId: null, locked: wrongCodes >= MAX_WRONG_CODES };
+    }
+    return { userId: await this.consume(record), locked: false };
+  }
+  /** Counts a code for the user and resolves to the new count; null if other requests kept changing it. */
+  async countWrongCode(user) {
+    let current = user;
+    for (let attempt = 0; attempt < 3 && current; attempt++) {
+      const wrongCodes = (current.wrongCodes ?? 0) + 1;
+      if (await this.store.update("user", { id: user.id, wrongCodes: current.wrongCodes ?? null }, { wrongCodes }) === 1) {
+        return wrongCodes;
+      }
+      current = await this.findById(user.id);
+    }
+    return null;
+  }
+  async consume(record) {
+    const deleted = await this.store.delete("verification", { id: record.id });
+    if (deleted !== 1 || record.expiresAt <= Date.now()) return null;
+    return record.userId;
+  }
+};
+
 // src/routes/google.ts
 var NONCE_COOKIE = "madauth_nonce";
 var NONCE_TYP = "madauth-nonce+jwt";
@@ -33771,10 +34009,57 @@ async function pkceChallenge(verifier) {
   return base64url_exports.encode(new Uint8Array(digest2));
 }
 function googleRoutes(app, ctx, google) {
-  const { config, keys, secure } = ctx;
+  const { config, keys, secure, users } = ctx;
   const { issuer } = config;
   const callbackUrl = `${issuer}/auth/google/callback`;
+  const resolveUser = async (profile, locale) => {
+    const key = googleAccountKey(profile.sub);
+    const emailNormalized = normalizeEmail(profile.email);
+    const signedIn = (user) => ({ ok: true, user: toMadauthUser(user, profile), sv: user.sessionVersion });
+    const account = await users.findAccountByKey(key);
+    if (account) {
+      const user = await users.findById(account.userId);
+      if (user) {
+        if (account.email !== profile.email) await users.updateAccount(account.id, { email: profile.email });
+        return signedIn(user);
+      }
+      await users.deleteAccount(account.id);
+    }
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const existing = await users.findByEmail(emailNormalized);
+      if (existing) {
+        await users.verifyByProvider(existing);
+        if (!await users.linkAccount(existing.id, { key, email: profile.email })) {
+          const linked = await users.findAccountByKey(key);
+          const owner = linked && await users.findById(linked.userId);
+          if (!owner) return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
+          return signedIn(owner);
+        }
+        return signedIn(existing);
+      }
+      if (attempt === 0) {
+        const check2 = await ctx.checkSignup({ email: profile.email, name: profile.name, locale, method: "google" });
+        if (!check2.ok) {
+          return check2.reason === "rejected" ? { ok: false, error: "signup_rejected", message: check2.message } : { ok: false, error: "temporarily_unavailable", message: "Signing up is not possible right now. Please try again later." };
+        }
+      }
+      const user = await users.createUser({
+        email: profile.email,
+        emailNormalized,
+        name: profile.name ?? null,
+        emailVerified: true,
+        account: { key, email: profile.email }
+      });
+      if (user) {
+        await ctx.emit("user.created", { user: toMadauthUser(user), method: "google" });
+        return signedIn(user);
+      }
+    }
+    return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
+  };
+  const disabled = (c6) => c6.json({ error: "method_disabled", message: "Google sign-in is switched off." }, 403);
   app.post("/auth/google/nonce", async (c6) => {
+    if (!await ctx.enabled("google")) return disabled(c6);
     const nonce = randomString();
     const token = await signToken(await keys, issuer, NONCE_TYP, { nonce }, NONCE_TTL);
     setCookie(c6, NONCE_COOKIE, token, {
@@ -33787,6 +34072,7 @@ function googleRoutes(app, ctx, google) {
     return c6.json({ nonce });
   });
   app.post("/auth/google/verify", async (c6) => {
+    if (!await ctx.enabled("google")) return disabled(c6);
     const body = await c6.req.json().catch(() => ({}));
     if (typeof body.credential !== "string" || !body.credential) {
       return c6.json({ error: "verification_failed", message: "credential is missing" }, 400);
@@ -33804,12 +34090,17 @@ function googleRoutes(app, ctx, google) {
       return c6.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
     }
     deleteCookie(c6, NONCE_COOKIE, { path: "/auth/google", secure });
-    const user = await ctx.startSession(c6, result.user, ["google"]);
+    const resolved = await resolveUser(result.profile, localeOf(body.locale));
+    if (!resolved.ok) {
+      return c6.json({ error: resolved.error, message: resolved.message }, resolved.error === "signup_rejected" ? 403 : 503);
+    }
+    const user = await ctx.startSession(c6, resolved.user, ["google"], { sv: resolved.sv });
     await ctx.emit("user.signed_in", { user, method: "google" });
     return c6.json({ user });
   });
   const requireCodeFlow = async (c6, next) => {
     if (!google.clientSecret) return c6.json({ error: "not_found" }, 404);
+    if (!await ctx.enabled("google")) return disabled(c6);
     await next();
   };
   app.get("/auth/google/start", requireCodeFlow, async (c6) => {
@@ -33819,7 +34110,8 @@ function googleRoutes(app, ctx, google) {
       state: randomString(),
       nonce: randomString(),
       verifier: randomString(),
-      returnTo: returnUrl.href
+      returnTo: returnUrl.href,
+      locale: localeOf(c6.req.query("locale"))
     };
     const token = await signToken(await keys, issuer, OAUTH_TYP, { ...oauth }, OAUTH_TTL);
     setCookie(c6, OAUTH_COOKIE, token, {
@@ -33880,7 +34172,9 @@ function googleRoutes(app, ctx, google) {
       keys: config.jwksResolver
     });
     if (!result.ok) return back(result.error);
-    const user = await ctx.startSession(c6, result.user, ["google"]);
+    const resolved = await resolveUser(result.profile, typeof oauth.locale === "string" ? oauth.locale : void 0);
+    if (!resolved.ok) return back(resolved.error);
+    const user = await ctx.startSession(c6, resolved.user, ["google"], { sv: resolved.sv });
     await ctx.emit("user.signed_in", { user, method: "google" });
     return back();
   });
@@ -33892,18 +34186,16 @@ var MAX_LOCK_MS = 15 * 60 * 1e3;
 var MAIL_INTERVAL_MS = 60 * 1e3;
 var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
 var RESET_TTL_MS = 30 * 60 * 1e3;
-var WEBHOOK_TIMEOUT_MS = 1e4;
 var VERIFY_LINK_PARAM = "madauth_verify";
 var RESET_LINK_PARAM = "madauth_reset";
 var MAX_NAME_LENGTH = 100;
-var MAX_LOCALE_LENGTH = 35;
-function toMadauthUser(user) {
-  const result = { id: user.id, email: user.email };
-  if (user.name) result.name = user.name;
-  return result;
-}
 function passwordRoutes(app, ctx, password, users, webhook) {
   const { minLength } = password;
+  const disabled = (c6) => c6.json({ error: "method_disabled", message: "E-mail & password sign-in is switched off." }, 403);
+  app.use("/auth/password/*", async (c6, next) => {
+    if (!await ctx.enabled("password")) return disabled(c6);
+    await next();
+  });
   const body = async (c6) => {
     const data = await c6.req.json().catch(() => null);
     return data && typeof data === "object" ? data : {};
@@ -33939,7 +34231,6 @@ function passwordRoutes(app, ctx, password, users, webhook) {
       locale
     });
   };
-  const localeOf = (data) => typeof data.locale === "string" && data.locale.length <= MAX_LOCALE_LENGTH ? data.locale : void 0;
   const consume = async (data, purpose) => {
     if (typeof data.token === "string" && data.token) {
       return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
@@ -34001,19 +34292,9 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (policy) return error(c6, 400, "weak_password", policy);
     const name = typeof data.name === "string" && data.name.trim() ? data.name.trim().slice(0, MAX_NAME_LENGTH) : null;
     const email = data.email.trim();
-    const locale = localeOf(data);
-    if (webhook.wants("signup.before")) {
-      const check2 = await webhook.call("signup.before", { email, name: name ?? void 0, locale }, WEBHOOK_TIMEOUT_MS);
-      if (!check2.ok) {
-        console.error(`[madauth] Webhook "signup.before" failed: ${check2.reason}`);
-        return unavailable(c6);
-      }
-      const answer = check2.body;
-      if (answer?.allow === false) {
-        const message2 = typeof answer.message === "string" && answer.message ? answer.message : "Sign-up is not possible with this e-mail address.";
-        return error(c6, 403, "signup_rejected", message2);
-      }
-    }
+    const locale = localeOf(data.locale);
+    const check2 = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "password" });
+    if (!check2.ok) return check2.reason === "rejected" ? error(c6, 403, "signup_rejected", check2.message) : unavailable(c6);
     const passwordHash = await hashPassword(data.password);
     const existing = await users.findByEmail(normalizeEmail(email));
     if (existing?.emailVerified) {
@@ -34025,18 +34306,19 @@ function passwordRoutes(app, ctx, password, users, webhook) {
       if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c6);
       const account = await users.passwordAccount(existing.id);
       if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
+      else await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash });
       await users.updateUser(existing.id, { name });
       return await sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c6) : unavailable(c6);
     }
-    const user = await users.createPasswordUser({
+    const user = await users.createUser({
       email,
       emailNormalized: normalizeEmail(email),
       name,
-      passwordHash,
-      emailVerified: false
+      emailVerified: false,
+      account: (userId) => ({ key: passwordAccountKey(userId), secret: passwordHash })
     });
     if (!user) return accepted(c6);
-    await ctx.emit("user.created", { user: toMadauthUser(user) });
+    await ctx.emit("user.created", { user: toMadauthUser(user), method: "password" });
     return await sendLinkEmail(user, "verify", target, locale) ? accepted(c6) : unavailable(c6);
   });
   app.post("/auth/password/send-verification", async (c6) => {
@@ -34046,7 +34328,7 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (!isValidEmail(data.email)) return error(c6, 400, "invalid_email", "This is not a valid e-mail address.");
     const user = await users.findByEmail(normalizeEmail(data.email));
     if (user && !user.emailVerified && await users.passwordAccount(user.id)) {
-      if (!await sendLinkEmail(user, "verify", target, localeOf(data))) return unavailable(c6);
+      if (!await sendLinkEmail(user, "verify", target, localeOf(data.locale))) return unavailable(c6);
     }
     return accepted(c6);
   });
@@ -34067,8 +34349,8 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (target instanceof Response) return target;
     if (!isValidEmail(data.email)) return error(c6, 400, "invalid_email", "This is not a valid e-mail address.");
     const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && await users.passwordAccount(user.id)) {
-      if (!await sendLinkEmail(user, "reset", target, localeOf(data))) return unavailable(c6);
+    if (user && (user.emailVerified || await users.passwordAccount(user.id))) {
+      if (!await sendLinkEmail(user, "reset", target, localeOf(data.locale))) return unavailable(c6);
     }
     return accepted(c6);
   });
@@ -34078,174 +34360,88 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (policy) return error(c6, 400, "weak_password", policy);
     const consumed = await consume(data, "reset");
     const user = consumed.userId ? await users.findById(consumed.userId) : null;
-    const account = user ? await users.passwordAccount(user.id) : null;
-    if (!user || !account) return invalidVerification(c6, consumed);
-    await users.updateAccount(account.id, { secret: await hashPassword(data.password), failedAttempts: 0, lockedUntil: 0 });
+    if (!user) return invalidVerification(c6, consumed);
+    const secret = await hashPassword(data.password);
+    const account = await users.passwordAccount(user.id);
+    if (account) await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 });
+    else await users.linkAccount(user.id, { key: passwordAccountKey(user.id), secret });
     const sessionVersion = user.sessionVersion + 1;
     await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
     await users.clearVerifications(user.id);
     const result = await ctx.startSession(c6, toMadauthUser(user), ["pwd"], { sv: sessionVersion });
-    await ctx.emit("password.reset", { user: result });
+    await ctx.emit("email.password_reset", { user: result });
     await ctx.emit("user.signed_in", { user: result, method: "password" });
     return c6.json({ user: result });
   });
 }
 
-// src/users.ts
-import { randomBytes as randomBytes3 } from "crypto";
-var MAX_CODE_ATTEMPTS = 5;
-var MAX_WRONG_CODES = 10;
-var newId = (prefix) => `${prefix}_${randomBytes3(16).toString("base64url")}`;
-function passwordAccountKey(userId) {
-  return `password:${userId}`;
+// src/settings.ts
+var SIGN_IN_METHODS = ["google", "password"];
+var METHODS_SETTING = "methods";
+function parseMethodSettings(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const settings = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (!SIGN_IN_METHODS.includes(key) || typeof value !== "boolean") return null;
+    settings[key] = value;
+  }
+  return settings;
 }
-var Users = class {
-  /** `codeKey` keys the e-mail codes (see deriveCodeKey); only needed to issue and check them. */
-  constructor(store, codeKey) {
+var MAX_TRIES = 3;
+var Settings = class {
+  constructor(store) {
     this.store = store;
-    this.codeKey = codeKey;
-  }
-  get key() {
-    if (!this.codeKey) throw new Error("Users needs a code key to issue or check e-mail codes.");
-    return this.codeKey;
-  }
-  async findByEmail(emailNormalized) {
-    return await this.store.findOne("user", { emailNormalized });
-  }
-  async findById(id) {
-    return await this.store.findOne("user", { id });
-  }
-  async passwordAccount(userId) {
-    return await this.store.findOne("account", { key: passwordAccountKey(userId) });
   }
-  /** Creates a user with a password. Resolves to null if the e-mail address is taken. */
-  async createPasswordUser(data) {
-    const now = Date.now();
-    const user = {
-      id: newId("usr"),
-      email: data.email,
-      emailNormalized: data.emailNormalized,
-      emailVerified: data.emailVerified,
-      name: data.name,
-      sessionVersion: 0,
-      lastMailAt: 0,
-      wrongCodes: 0,
-      createdAt: now
-    };
-    if (!await this.store.create("user", user)) return null;
-    const account = {
-      id: newId("acc"),
-      userId: user.id,
-      key: passwordAccountKey(user.id),
-      secret: data.passwordHash,
-      failedAttempts: 0,
-      lockedUntil: 0,
-      createdAt: now
-    };
-    if (!await this.store.create("account", account)) {
-      await this.store.delete("user", { id: user.id });
-      return null;
-    }
-    return user;
+  /** The setting's value, or undefined if it was never set. */
+  async get(id) {
+    return (await this.read(id)).value;
   }
-  /**
-   * Deletes the user with this e-mail address and everything stored for them. Resolves to the deleted
-   * user's ID, or null if there is no such user (any more).
-   */
-  async deleteByEmail(emailNormalized) {
-    const user = await this.findByEmail(emailNormalized);
-    if (!user) return null;
-    if (await this.store.delete("user", { id: user.id }) !== 1) return null;
+  /** The stored JSON and what it holds; both undefined if the setting was never set. */
+  async read(id) {
+    const record = await this.store.findOne("setting", { id });
+    if (typeof record?.value !== "string") return {};
     try {
-      await this.store.delete("account", { userId: user.id });
-      await this.store.delete("verification", { userId: user.id });
-    } catch (e6) {
-      console.error(`[madauth] Deleted user ${user.id}, but not all of their records: ${e6.message}`);
+      return { json: record.value, value: JSON.parse(record.value) };
+    } catch {
+      return { json: record.value };
     }
-    return user.id;
-  }
-  async updateUser(id, patch) {
-    await this.store.update("user", { id }, patch);
-  }
-  async updateAccount(id, patch) {
-    await this.store.update("account", { id }, patch);
   }
   /**
-   * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
-   * was read. Resolves to false if another request counted an attempt meanwhile.
-   */
-  async countAttempt(account, patch) {
-    const changed = await this.store.update("account", { id: account.id, failedAttempts: account.failedAttempts }, patch);
-    return changed === 1;
-  }
-  /** Deletes the user's pending verifications and password resets; their links and codes stop working. */
-  async clearVerifications(userId) {
-    await this.store.delete("verification", { userId });
-  }
-  /**
-   * Starts a verification or password reset: replaces the user's earlier one for the same purpose and
-   * returns the link token and the code for the e-mail. Only their hashes are stored.
+   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
+   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
+   * again with the newer value. Resolves to the new value, or null if `apply` refused.
+   * `updatedBy` is the address of the admin, or null for the command line.
    */
-  async issueVerification(userId, purpose, ttlMs) {
-    await this.store.delete("verification", { userId, purpose });
-    const token = generateLinkToken();
-    const code = generateCode();
-    const record = {
-      id: hashLinkToken(token),
-      userId,
-      purpose,
-      codeHash: hashCode(this.key, code),
-      attempts: 0,
-      expiresAt: Date.now() + ttlMs
-    };
-    await this.store.create("verification", record);
-    return { token, code };
-  }
-  /** Uses up the verification a link token belongs to. Resolves to its user ID, or null if invalid, expired or used. */
-  async consumeLinkToken(token, purpose) {
-    const id = hashLinkToken(token);
-    const record = await this.store.findOne("verification", { id, purpose });
-    return record ? this.consume(record) : null;
-  }
-  /**
-   * Uses up the user's verification if `code` matches. Too many wrong codes delete it, and after
-   * MAX_WRONG_CODES wrong codes in a row the user's codes stop working until an e-mail link is used.
-   */
-  async consumeCode(user, purpose, code) {
-    if ((user.wrongCodes ?? 0) >= MAX_WRONG_CODES) return { userId: null, locked: true };
-    const record = await this.store.findOne("verification", { userId: user.id, purpose });
-    if (!record) return { userId: null, locked: false };
-    const attempts = record.attempts + 1;
-    if (await this.store.update("verification", { id: record.id, attempts: record.attempts }, { attempts }) !== 1) {
-      return { userId: null, locked: false };
-    }
-    const wrongCodes = await this.countWrongCode(user);
-    if (wrongCodes === null) return { userId: null, locked: false };
-    if (wrongCodes > MAX_WRONG_CODES) return { userId: null, locked: true };
-    if (!safeEqual(hashCode(this.key, code), record.codeHash)) {
-      if (attempts >= MAX_CODE_ATTEMPTS) await this.store.delete("verification", { id: record.id });
-      return { userId: null, locked: wrongCodes >= MAX_WRONG_CODES };
+  async change(id, apply, updatedBy) {
+    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
+      const { json: json2, value } = await this.read(id);
+      const next = apply(value);
+      if (next === null) return null;
+      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
+      const written = json2 === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json2 }, patch) === 1;
+      if (written) return next;
     }
-    return { userId: await this.consume(record), locked: false };
+    throw new Error(`Setting "${id}" kept changing; try again.`);
   }
-  /** Counts a code for the user and resolves to the new count; null if other requests kept changing it. */
-  async countWrongCode(user) {
-    let current = user;
-    for (let attempt = 0; attempt < 3 && current; attempt++) {
-      const wrongCodes = (current.wrongCodes ?? 0) + 1;
-      if (await this.store.update("user", { id: user.id, wrongCodes: current.wrongCodes ?? null }, { wrongCodes }) === 1) {
-        return wrongCodes;
-      }
-      current = await this.findById(user.id);
-    }
-    return null;
+  /** Replaces the setting. */
+  async set(id, value, updatedBy) {
+    await this.change(id, () => value, updatedBy);
   }
-  async consume(record) {
-    const deleted = await this.store.delete("verification", { id: record.id });
-    if (deleted !== 1 || record.expiresAt <= Date.now()) return null;
-    return record.userId;
+  /** Which sign-in methods are on; a method that was never switched off is on. */
+  async methods() {
+    return parseMethodSettings(await this.get(METHODS_SETTING)) ?? {};
+  }
+  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
+  async changeMethods(apply, updatedBy) {
+    return this.change(METHODS_SETTING, (current) => apply(parseMethodSettings(current) ?? {}), updatedBy);
   }
 };
+function isOn(method, available, methods) {
+  return available(method) && methods[method] !== false;
+}
+function anyOn(available, methods) {
+  return SIGN_IN_METHODS.some((method) => isOn(method, available, methods));
+}
 
 // src/app.ts
 var EVENT_TIMEOUT_MS = 5e3;
@@ -34254,12 +34450,9 @@ function createApp(config) {
   const keys = importSigningKeys(config.signingKey);
   const secure = issuer.startsWith("https:");
   const isAllowedOrigin = (origin) => !!origin && allowedOrigins.includes(origin);
-  const roles = config.password ? new Roles(config.password.store) : void 0;
-  const withRoles = async (user) => {
-    const { roles: _, ...rest } = user;
-    const current = roles && user.email ? await roles.get(normalizeEmail(user.email)) : [];
-    return current.length ? { ...rest, roles: current } : rest;
-  };
+  const users = new Users(config.store, deriveCodeKey(config.signingKey.d));
+  const settings = new Settings(config.store);
+  const available = (method) => method === "google" ? !!config.google : !!config.password;
   const issueSession = async (c6, user, amr, extra) => {
     const signingKeys = await keys;
     const [sessionToken, renewalToken] = await Promise.all([
@@ -34311,12 +34504,29 @@ function createApp(config) {
       return url;
     },
     async startSession(c6, user, amr, extra) {
-      const signedIn = await withRoles(user);
-      await issueSession(c6, signedIn, amr, extra);
-      return signedIn;
+      await issueSession(c6, user, amr, extra);
+      return user;
     },
-    users: config.password ? new Users(config.password.store, deriveCodeKey(config.signingKey.d)) : void 0,
+    users,
+    settings,
     webhook: config.webhook ? createWebhookClient(config.webhook, config.webhookFetch) : void 0,
+    async enabled(method) {
+      return isOn(method, available, await settings.methods());
+    },
+    async checkSignup(data) {
+      if (!this.webhook?.wants("signup.before")) return { ok: true };
+      const check2 = await this.webhook.call("signup.before", data, WEBHOOK_TIMEOUT_MS);
+      if (!check2.ok) {
+        console.error(`[madauth] Webhook "signup.before" failed: ${check2.reason}`);
+        return { ok: false, reason: "unavailable" };
+      }
+      const answer = check2.body;
+      if (answer?.allow === false) {
+        const message2 = typeof answer.message === "string" && answer.message ? answer.message : "Sign-up is not possible with this e-mail address.";
+        return { ok: false, reason: "rejected", message: message2 };
+      }
+      return { ok: true };
+    },
     async emit(type, data) {
       if (!this.webhook?.wants(type)) return;
       const result = await this.webhook.call(type, data, EVENT_TIMEOUT_MS);
@@ -34346,29 +34556,28 @@ function createApp(config) {
     c6.header("Cache-Control", "public, max-age=3600");
     return c6.json({ keys: [publicJwk] });
   });
-  app.get(
-    "/auth/config",
-    (c6) => c6.json({
-      google: config.google ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret } : null,
-      password: config.password ? { minLength: config.password.minLength } : null
-    })
-  );
+  app.get("/auth/config", async (c6) => {
+    const methods = await settings.methods();
+    const on = (method) => isOn(method, available, methods);
+    return c6.json({
+      google: on("google") ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret } : null,
+      password: on("password") ? { minLength: config.password.minLength } : null
+    });
+  });
   if (config.google) googleRoutes(app, ctx, config.google);
-  if (config.password && ctx.users && ctx.webhook) passwordRoutes(app, ctx, config.password, ctx.users, ctx.webhook);
+  if (config.password && ctx.webhook) passwordRoutes(app, ctx, config.password, users, ctx.webhook);
   const tokenClaims = async (c6, cookie, typ) => readToken(await keys, issuer, typ, getCookie(c6, cookie));
-  const hasEnded = async (claims) => {
-    if (!claims.sub.startsWith("usr_")) return false;
-    const stored = await ctx.users?.findById(claims.sub);
-    return !stored || stored.sessionVersion !== claims.sv;
-  };
   const checked = async (claims) => {
-    const [ended, user] = await Promise.all([hasEnded(claims), withRoles(userFromClaims(claims))]);
-    return ended ? null : user;
+    const stored = await users.findById(claims.sub);
+    if (!stored || stored.sessionVersion !== claims.sv) return null;
+    const { claims: _, ...user } = userFromClaims(claims);
+    const current = claimsFromJson(stored.claims);
+    return Object.keys(current).length ? { ...user, claims: current } : user;
   };
   const currentSession = async (c6) => {
     const session = await tokenClaims(c6, SESSION_COOKIE, SESSION_TYP);
     const user = session ? await checked(session) : null;
-    const upToDate = session && user && sameRoles(user.roles ?? [], session.roles ?? []) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
+    const upToDate = session && user && sameClaims(user.claims, session.claims) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
     if (upToDate) return user;
     const renewal = await tokenClaims(c6, RENEWAL_COOKIE, RENEWAL_TYP);
     const sameSignIn = session && user && renewal && renewal.sub === session.sub && renewal.sv === session.sv && renewal.email === session.email;
@@ -34394,56 +34603,82 @@ function createApp(config) {
   app.post("/auth/account/delete", async (c6) => {
     const user = await currentSession(c6);
     if (!user) return c6.json({ error: "no_session" }, 401);
-    if (roles && user.email) await roles.remove(normalizeEmail(user.email));
-    const passwordUserId = ctx.users && user.email ? await ctx.users.deleteByEmail(normalizeEmail(user.email)) : null;
+    await users.deleteById(user.id);
     clearSession(c6);
-    await ctx.emit("user.deleted", { user, passwordUserId: passwordUserId ?? void 0 });
+    await ctx.emit("user.deleted", { user });
     return c6.body(null, 204);
   });
-  if (roles) {
-    const admin = async (c6) => {
-      const user = await currentSession(c6);
-      if (!user) return { answer: c6.json({ error: "no_session" }, 401) };
-      const email = user.email ? normalizeEmail(user.email) : void 0;
-      if (!email || !user.roles?.includes(ADMIN_ROLE)) {
-        return { answer: c6.json({ error: "forbidden", message: `Only users with the role "${ADMIN_ROLE}" can manage roles.` }, 403) };
-      }
-      return { email };
-    };
-    const body = async (c6) => {
-      const data = await c6.req.json().catch(() => null);
-      return data && typeof data === "object" ? data : {};
-    };
-    const invalidEmail = (c6) => c6.json({ error: "invalid_email", message: "This is not a valid e-mail address." }, 400);
-    app.post("/auth/admin/roles/get", async (c6) => {
-      const caller = await admin(c6);
-      if ("answer" in caller) return caller.answer;
-      const data = await body(c6);
-      if (!isValidEmail(data.email)) return invalidEmail(c6);
-      const email = normalizeEmail(data.email);
-      return c6.json({ email, roles: await roles.get(email) });
-    });
-    app.post("/auth/admin/roles/set", async (c6) => {
-      const caller = await admin(c6);
-      if ("answer" in caller) return caller.answer;
-      const data = await body(c6);
-      if (!isValidEmail(data.email)) return invalidEmail(c6);
-      const names = parseRoles(data.roles);
-      if (!names) {
-        return c6.json(
-          {
-            error: "invalid_roles",
-            message: 'roles must be a list of names: lower-case letters, digits, "-" and "_", starting with a letter.'
-          },
-          400
-        );
-      }
-      const email = normalizeEmail(data.email);
-      await roles.set(email, names, caller.email);
-      await ctx.emit("roles.changed", { email, roles: names, by: caller.email });
-      return c6.json({ email, roles: names });
-    });
-  }
+  const admin = async (c6) => {
+    const user = await currentSession(c6);
+    if (!user) return { answer: c6.json({ error: "no_session" }, 401) };
+    const email = user.email ? normalizeEmail(user.email) : void 0;
+    if (!email || !isAdmin(user)) {
+      const message2 = `Only users with the role "${ADMIN_ROLE}" can manage claims and settings.`;
+      return { answer: c6.json({ error: "forbidden", message: message2 }, 403) };
+    }
+    return { email };
+  };
+  const body = async (c6) => {
+    const data = await c6.req.json().catch(() => null);
+    return data && typeof data === "object" ? data : {};
+  };
+  const invalidEmail = (c6) => c6.json({ error: "invalid_email", message: "This is not a valid e-mail address." }, 400);
+  const noUser = (c6) => c6.json({ error: "user_not_found", message: "No user has this e-mail address." }, 404);
+  app.post("/auth/admin/claims/get", async (c6) => {
+    const caller = await admin(c6);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c6);
+    if (!isValidEmail(data.email)) return invalidEmail(c6);
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c6);
+    return c6.json({ email: user.emailNormalized, userId: user.id, claims: claimsFromJson(user.claims) });
+  });
+  app.post("/auth/admin/claims/set", async (c6) => {
+    const caller = await admin(c6);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c6);
+    if (!isValidEmail(data.email)) return invalidEmail(c6);
+    const claims = parseClaims(data.claims);
+    if (!claims) {
+      return c6.json(
+        {
+          error: "invalid_claims",
+          message: 'claims must be a JSON object of at most 2048 characters whose keys are names (letters, digits and "_", starting with a letter). "roles" must be a list of names of lower-case letters, digits, "-" and "_".'
+        },
+        400
+      );
+    }
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c6);
+    await users.updateUser(user.id, { claims: Object.keys(claims).length ? JSON.stringify(claims) : null });
+    const email = user.emailNormalized;
+    await ctx.emit("user.claims_changed", { userId: user.id, email, claims, by: caller.email });
+    return c6.json({ email, userId: user.id, claims });
+  });
+  const settingsAnswer = (methods) => ({
+    methods: Object.fromEntries(
+      SIGN_IN_METHODS.map((method) => [method, { available: available(method), enabled: isOn(method, available, methods) }])
+    )
+  });
+  app.post("/auth/admin/settings/get", async (c6) => {
+    const caller = await admin(c6);
+    if ("answer" in caller) return caller.answer;
+    return c6.json(settingsAnswer(await settings.methods()));
+  });
+  app.post("/auth/admin/settings/set", async (c6) => {
+    const caller = await admin(c6);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c6);
+    const invalid2 = (message2) => c6.json({ error: "invalid_settings", message: message2 }, 400);
+    const changes = parseMethodSettings(data.methods);
+    if (!changes) return invalid2(`methods must be an object with true or false for ${SIGN_IN_METHODS.join(" and/or ")}.`);
+    const methods = await settings.changeMethods((current) => {
+      const next = { ...current, ...changes };
+      return anyOn(available, next) ? next : null;
+    }, caller.email);
+    if (!methods) return invalid2("At least one sign-in method must stay on.");
+    return c6.json(settingsAnswer(methods));
+  });
   return app;
 }