@madauth/server 0.2.0-beta.2 → 0.3.0-beta.2

package/dist/{chunk-YALS7OMV.js → chunk-DVVBIFIV.js}

@@ -10,28 +10,39 @@ import {
   signSession,
   signToken,
   userFromClaims
-} from "./chunk-7CTAB3QV.js";
+} from "./chunk-DCDTO5LG.js";
 import {
   ADMIN_ROLE,
   MAX_PASSWORD_LENGTH,
-  Roles,
+  SIGN_IN_METHODS,
+  Settings,
   Users,
+  anyOn,
   checkPasswordPolicy,
+  claimsFromJson,
   deriveCodeKey,
+  googleAccountKey,
   hashPassword,
+  isAdmin,
+  isOn,
   isValidEmail,
   normalizeEmail,
-  parseRoles,
-  sameRoles,
+  parseClaims,
+  parseMethodSettings,
+  passwordAccountKey,
+  sameClaims,
+  toMadauthUser,
   verifyAgainstDummy,
   verifyPassword
-} from "./chunk-5CKEMC6M.js";
+} from "./chunk-TI35AZ2U.js";
 import {
   importSigningKeys
 } from "./chunk-JDQLSL36.js";
 import {
-  createWebhookClient
-} from "./chunk-6EJDVZCD.js";
+  WEBHOOK_TIMEOUT_MS,
+  createWebhookClient,
+  localeOf
+} from "./chunk-3QRKWLR7.js";
 
 // src/routes/google.ts
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
@@ -62,14 +73,13 @@ async function verifyGoogleIdToken(idToken, opts) {
   if (payload.nonce !== opts.nonce) {
     return { ok: false, error: "verification_failed", reason: "nonce mismatch" };
   }
-  if (payload.email_verified !== true) {
+  if (typeof payload.email !== "string" || !payload.email || payload.email_verified !== true) {
     return { ok: false, error: "email_unverified", reason: "e-mail address not verified" };
   }
-  const user = { id: `google:${payload.sub}` };
-  if (typeof payload.email === "string") user.email = payload.email;
-  if (typeof payload.name === "string") user.name = payload.name;
-  if (typeof payload.picture === "string") user.picture = payload.picture;
-  return { ok: true, user };
+  const profile = { sub: payload.sub, email: payload.email };
+  if (typeof payload.name === "string") profile.name = payload.name;
+  if (typeof payload.picture === "string") profile.picture = payload.picture;
+  return { ok: true, profile };
 }
 
 // src/routes/google.ts
@@ -87,10 +97,57 @@ async function pkceChallenge(verifier) {
   return base64url.encode(new Uint8Array(digest));
 }
 function googleRoutes(app, ctx, google) {
-  const { config, keys, secure } = ctx;
+  const { config, keys, secure, users } = ctx;
   const { issuer } = config;
   const callbackUrl = `${issuer}/auth/google/callback`;
+  const resolveUser = async (profile, locale) => {
+    const key = googleAccountKey(profile.sub);
+    const emailNormalized = normalizeEmail(profile.email);
+    const signedIn = (user) => ({ ok: true, user: toMadauthUser(user, profile), sv: user.sessionVersion });
+    const account = await users.findAccountByKey(key);
+    if (account) {
+      const user = await users.findById(account.userId);
+      if (user) {
+        if (account.email !== profile.email) await users.updateAccount(account.id, { email: profile.email });
+        return signedIn(user);
+      }
+      await users.deleteAccount(account.id);
+    }
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const existing = await users.findByEmail(emailNormalized);
+      if (existing) {
+        await users.verifyByProvider(existing);
+        if (!await users.linkAccount(existing.id, { key, email: profile.email })) {
+          const linked = await users.findAccountByKey(key);
+          const owner = linked && await users.findById(linked.userId);
+          if (!owner) return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
+          return signedIn(owner);
+        }
+        return signedIn(existing);
+      }
+      if (attempt === 0) {
+        const check = await ctx.checkSignup({ email: profile.email, name: profile.name, locale, method: "google" });
+        if (!check.ok) {
+          return check.reason === "rejected" ? { ok: false, error: "signup_rejected", message: check.message } : { ok: false, error: "temporarily_unavailable", message: "Signing up is not possible right now. Please try again later." };
+        }
+      }
+      const user = await users.createUser({
+        email: profile.email,
+        emailNormalized,
+        name: profile.name ?? null,
+        emailVerified: true,
+        account: { key, email: profile.email }
+      });
+      if (user) {
+        await ctx.emit("user.created", { user: toMadauthUser(user), method: "google" });
+        return signedIn(user);
+      }
+    }
+    return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
+  };
+  const disabled = (c) => c.json({ error: "method_disabled", message: "Google sign-in is switched off." }, 403);
   app.post("/auth/google/nonce", async (c) => {
+    if (!await ctx.enabled("google")) return disabled(c);
     const nonce = randomString();
     const token = await signToken(await keys, issuer, NONCE_TYP, { nonce }, NONCE_TTL);
     setCookie(c, NONCE_COOKIE, token, {
@@ -103,6 +160,7 @@ function googleRoutes(app, ctx, google) {
     return c.json({ nonce });
   });
   app.post("/auth/google/verify", async (c) => {
+    if (!await ctx.enabled("google")) return disabled(c);
     const body = await c.req.json().catch(() => ({}));
     if (typeof body.credential !== "string" || !body.credential) {
       return c.json({ error: "verification_failed", message: "credential is missing" }, 400);
@@ -120,12 +178,17 @@ function googleRoutes(app, ctx, google) {
       return c.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
     }
     deleteCookie(c, NONCE_COOKIE, { path: "/auth/google", secure });
-    const user = await ctx.startSession(c, result.user, ["google"]);
+    const resolved = await resolveUser(result.profile, localeOf(body.locale));
+    if (!resolved.ok) {
+      return c.json({ error: resolved.error, message: resolved.message }, resolved.error === "signup_rejected" ? 403 : 503);
+    }
+    const user = await ctx.startSession(c, resolved.user, ["google"], { sv: resolved.sv });
     await ctx.emit("user.signed_in", { user, method: "google" });
     return c.json({ user });
   });
   const requireCodeFlow = async (c, next) => {
     if (!google.clientSecret) return c.json({ error: "not_found" }, 404);
+    if (!await ctx.enabled("google")) return disabled(c);
     await next();
   };
   app.get("/auth/google/start", requireCodeFlow, async (c) => {
@@ -135,7 +198,8 @@ function googleRoutes(app, ctx, google) {
       state: randomString(),
       nonce: randomString(),
       verifier: randomString(),
-      returnTo: returnUrl.href
+      returnTo: returnUrl.href,
+      locale: localeOf(c.req.query("locale"))
     };
     const token = await signToken(await keys, issuer, OAUTH_TYP, { ...oauth }, OAUTH_TTL);
     setCookie(c, OAUTH_COOKIE, token, {
@@ -196,7 +260,9 @@ function googleRoutes(app, ctx, google) {
       keys: config.jwksResolver
     });
     if (!result.ok) return back(result.error);
-    const user = await ctx.startSession(c, result.user, ["google"]);
+    const resolved = await resolveUser(result.profile, typeof oauth.locale === "string" ? oauth.locale : void 0);
+    if (!resolved.ok) return back(resolved.error);
+    const user = await ctx.startSession(c, resolved.user, ["google"], { sv: resolved.sv });
     await ctx.emit("user.signed_in", { user, method: "google" });
     return back();
   });
@@ -213,18 +279,16 @@ var MAX_LOCK_MS = 15 * 60 * 1e3;
 var MAIL_INTERVAL_MS = 60 * 1e3;
 var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
 var RESET_TTL_MS = 30 * 60 * 1e3;
-var WEBHOOK_TIMEOUT_MS = 1e4;
 var VERIFY_LINK_PARAM = "madauth_verify";
 var RESET_LINK_PARAM = "madauth_reset";
 var MAX_NAME_LENGTH = 100;
-var MAX_LOCALE_LENGTH = 35;
-function toMadauthUser(user) {
-  const result = { id: user.id, email: user.email };
-  if (user.name) result.name = user.name;
-  return result;
-}
 function passwordRoutes(app, ctx, password, users, webhook) {
   const { minLength } = password;
+  const disabled = (c) => c.json({ error: "method_disabled", message: "E-mail & password sign-in is switched off." }, 403);
+  app.use("/auth/password/*", async (c, next) => {
+    if (!await ctx.enabled("password")) return disabled(c);
+    await next();
+  });
   const body = async (c) => {
     const data = await c.req.json().catch(() => null);
     return data && typeof data === "object" ? data : {};
@@ -260,7 +324,11 @@ function passwordRoutes(app, ctx, password, users, webhook) {
       locale
     });
   };
-  const localeOf = (data) => typeof data.locale === "string" && data.locale.length <= MAX_LOCALE_LENGTH ? data.locale : void 0;
+  const sendAccountEmail = async (user, type, target, locale) => {
+    if (!webhook.wants(type)) return true;
+    const methods = await users.signInMethods(user.id);
+    return sendEmail(user, type, { link: target.href, site: target.host, locale, methods });
+  };
   const consume = async (data, purpose) => {
     if (typeof data.token === "string" && data.token) {
       return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
@@ -322,42 +390,31 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (policy) return error(c, 400, "weak_password", policy);
     const name = typeof data.name === "string" && data.name.trim() ? data.name.trim().slice(0, MAX_NAME_LENGTH) : null;
     const email = data.email.trim();
-    const locale = localeOf(data);
-    if (webhook.wants("signup.before")) {
-      const check = await webhook.call("signup.before", { email, name: name ?? void 0, locale }, WEBHOOK_TIMEOUT_MS);
-      if (!check.ok) {
-        console.error(`[madauth] Webhook "signup.before" failed: ${check.reason}`);
-        return unavailable(c);
-      }
-      const answer = check.body;
-      if (answer?.allow === false) {
-        const message = typeof answer.message === "string" && answer.message ? answer.message : "Sign-up is not possible with this e-mail address.";
-        return error(c, 403, "signup_rejected", message);
-      }
-    }
+    const locale = localeOf(data.locale);
+    const check = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "password" });
+    if (!check.ok) return check.reason === "rejected" ? error(c, 403, "signup_rejected", check.message) : unavailable(c);
     const passwordHash = await hashPassword(data.password);
     const existing = await users.findByEmail(normalizeEmail(email));
     if (existing?.emailVerified) {
-      if (!webhook.wants("email.already_registered")) return accepted(c);
-      const sent = await sendEmail(existing, "email.already_registered", { link: target.href, site: target.host, locale });
-      return sent ? accepted(c) : unavailable(c);
+      return await sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c) : unavailable(c);
     }
     if (existing) {
       if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
       const account = await users.passwordAccount(existing.id);
       if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
+      else await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash });
       await users.updateUser(existing.id, { name });
       return await sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
     }
-    const user = await users.createPasswordUser({
+    const user = await users.createUser({
       email,
       emailNormalized: normalizeEmail(email),
       name,
-      passwordHash,
-      emailVerified: false
+      emailVerified: false,
+      account: (userId) => ({ key: passwordAccountKey(userId), secret: passwordHash })
     });
     if (!user) return accepted(c);
-    await ctx.emit("user.created", { user: toMadauthUser(user) });
+    await ctx.emit("user.created", { user: toMadauthUser(user), method: "password" });
     return await sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
   });
   app.post("/auth/password/send-verification", async (c) => {
@@ -367,7 +424,7 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
     const user = await users.findByEmail(normalizeEmail(data.email));
     if (user && !user.emailVerified && await users.passwordAccount(user.id)) {
-      if (!await sendLinkEmail(user, "verify", target, localeOf(data))) return unavailable(c);
+      if (!await sendLinkEmail(user, "verify", target, localeOf(data.locale))) return unavailable(c);
     }
     return accepted(c);
   });
@@ -388,8 +445,11 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (target instanceof Response) return target;
     if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
     const user = await users.findByEmail(normalizeEmail(data.email));
+    const locale = localeOf(data.locale);
     if (user && await users.passwordAccount(user.id)) {
-      if (!await sendLinkEmail(user, "reset", target, localeOf(data))) return unavailable(c);
+      if (!await sendLinkEmail(user, "reset", target, locale)) return unavailable(c);
+    } else if (user) {
+      if (!await sendAccountEmail(user, "email.no_password", target, locale)) return unavailable(c);
     }
     return accepted(c);
   });
@@ -401,12 +461,13 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     const user = consumed.userId ? await users.findById(consumed.userId) : null;
     const account = user ? await users.passwordAccount(user.id) : null;
     if (!user || !account) return invalidVerification(c, consumed);
-    await users.updateAccount(account.id, { secret: await hashPassword(data.password), failedAttempts: 0, lockedUntil: 0 });
+    const secret = await hashPassword(data.password);
+    if (!await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 })) return invalidVerification(c, consumed);
     const sessionVersion = user.sessionVersion + 1;
     await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
     await users.clearVerifications(user.id);
     const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: sessionVersion });
-    await ctx.emit("password.reset", { user: result });
+    await ctx.emit("email.password_reset", { user: result });
     await ctx.emit("user.signed_in", { user: result, method: "password" });
     return c.json({ user: result });
   });
@@ -419,12 +480,9 @@ function createApp(config) {
   const keys = importSigningKeys(config.signingKey);
   const secure = issuer.startsWith("https:");
   const isAllowedOrigin = (origin) => !!origin && allowedOrigins.includes(origin);
-  const roles = config.password ? new Roles(config.password.store) : void 0;
-  const withRoles = async (user) => {
-    const { roles: _, ...rest } = user;
-    const current = roles && user.email ? await roles.get(normalizeEmail(user.email)) : [];
-    return current.length ? { ...rest, roles: current } : rest;
-  };
+  const users = new Users(config.store, deriveCodeKey(config.signingKey.d));
+  const settings = new Settings(config.store);
+  const available = (method) => method === "google" ? !!config.google : !!config.password;
   const issueSession = async (c, user, amr, extra) => {
     const signingKeys = await keys;
     const [sessionToken, renewalToken] = await Promise.all([
@@ -476,12 +534,29 @@ function createApp(config) {
       return url;
     },
     async startSession(c, user, amr, extra) {
-      const signedIn = await withRoles(user);
-      await issueSession(c, signedIn, amr, extra);
-      return signedIn;
+      await issueSession(c, user, amr, extra);
+      return user;
     },
-    users: config.password ? new Users(config.password.store, deriveCodeKey(config.signingKey.d)) : void 0,
+    users,
+    settings,
     webhook: config.webhook ? createWebhookClient(config.webhook, config.webhookFetch) : void 0,
+    async enabled(method) {
+      return isOn(method, available, await settings.methods());
+    },
+    async checkSignup(data) {
+      if (!this.webhook?.wants("signup.before")) return { ok: true };
+      const check = await this.webhook.call("signup.before", data, WEBHOOK_TIMEOUT_MS);
+      if (!check.ok) {
+        console.error(`[madauth] Webhook "signup.before" failed: ${check.reason}`);
+        return { ok: false, reason: "unavailable" };
+      }
+      const answer = check.body;
+      if (answer?.allow === false) {
+        const message = typeof answer.message === "string" && answer.message ? answer.message : "Sign-up is not possible with this e-mail address.";
+        return { ok: false, reason: "rejected", message };
+      }
+      return { ok: true };
+    },
     async emit(type, data) {
       if (!this.webhook?.wants(type)) return;
       const result = await this.webhook.call(type, data, EVENT_TIMEOUT_MS);
@@ -511,29 +586,28 @@ function createApp(config) {
     c.header("Cache-Control", "public, max-age=3600");
     return c.json({ keys: [publicJwk] });
   });
-  app.get(
-    "/auth/config",
-    (c) => c.json({
-      google: config.google ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret } : null,
-      password: config.password ? { minLength: config.password.minLength } : null
-    })
-  );
+  app.get("/auth/config", async (c) => {
+    const methods = await settings.methods();
+    const on = (method) => isOn(method, available, methods);
+    return c.json({
+      google: on("google") ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret } : null,
+      password: on("password") ? { minLength: config.password.minLength } : null
+    });
+  });
   if (config.google) googleRoutes(app, ctx, config.google);
-  if (config.password && ctx.users && ctx.webhook) passwordRoutes(app, ctx, config.password, ctx.users, ctx.webhook);
+  if (config.password && ctx.webhook) passwordRoutes(app, ctx, config.password, users, ctx.webhook);
   const tokenClaims = async (c, cookie, typ) => readToken(await keys, issuer, typ, getCookie2(c, cookie));
-  const hasEnded = async (claims) => {
-    if (!claims.sub.startsWith("usr_")) return false;
-    const stored = await ctx.users?.findById(claims.sub);
-    return !stored || stored.sessionVersion !== claims.sv;
-  };
   const checked = async (claims) => {
-    const [ended, user] = await Promise.all([hasEnded(claims), withRoles(userFromClaims(claims))]);
-    return ended ? null : user;
+    const stored = await users.findById(claims.sub);
+    if (!stored || stored.sessionVersion !== claims.sv) return null;
+    const { claims: _, ...user } = userFromClaims(claims);
+    const current = claimsFromJson(stored.claims);
+    return Object.keys(current).length ? { ...user, claims: current } : user;
   };
   const currentSession = async (c) => {
     const session = await tokenClaims(c, SESSION_COOKIE, SESSION_TYP);
     const user = session ? await checked(session) : null;
-    const upToDate = session && user && sameRoles(user.roles ?? [], session.roles ?? []) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
+    const upToDate = session && user && sameClaims(user.claims, session.claims) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
     if (upToDate) return user;
     const renewal = await tokenClaims(c, RENEWAL_COOKIE, RENEWAL_TYP);
     const sameSignIn = session && user && renewal && renewal.sub === session.sub && renewal.sv === session.sv && renewal.email === session.email;
@@ -559,56 +633,82 @@ function createApp(config) {
   app.post("/auth/account/delete", async (c) => {
     const user = await currentSession(c);
     if (!user) return c.json({ error: "no_session" }, 401);
-    if (roles && user.email) await roles.remove(normalizeEmail(user.email));
-    const passwordUserId = ctx.users && user.email ? await ctx.users.deleteByEmail(normalizeEmail(user.email)) : null;
+    await users.deleteById(user.id);
     clearSession(c);
-    await ctx.emit("user.deleted", { user, passwordUserId: passwordUserId ?? void 0 });
+    await ctx.emit("user.deleted", { user });
     return c.body(null, 204);
   });
-  if (roles) {
-    const admin = async (c) => {
-      const user = await currentSession(c);
-      if (!user) return { answer: c.json({ error: "no_session" }, 401) };
-      const email = user.email ? normalizeEmail(user.email) : void 0;
-      if (!email || !user.roles?.includes(ADMIN_ROLE)) {
-        return { answer: c.json({ error: "forbidden", message: `Only users with the role "${ADMIN_ROLE}" can manage roles.` }, 403) };
-      }
-      return { email };
-    };
-    const body = async (c) => {
-      const data = await c.req.json().catch(() => null);
-      return data && typeof data === "object" ? data : {};
-    };
-    const invalidEmail = (c) => c.json({ error: "invalid_email", message: "This is not a valid e-mail address." }, 400);
-    app.post("/auth/admin/roles/get", async (c) => {
-      const caller = await admin(c);
-      if ("answer" in caller) return caller.answer;
-      const data = await body(c);
-      if (!isValidEmail(data.email)) return invalidEmail(c);
-      const email = normalizeEmail(data.email);
-      return c.json({ email, roles: await roles.get(email) });
-    });
-    app.post("/auth/admin/roles/set", async (c) => {
-      const caller = await admin(c);
-      if ("answer" in caller) return caller.answer;
-      const data = await body(c);
-      if (!isValidEmail(data.email)) return invalidEmail(c);
-      const names = parseRoles(data.roles);
-      if (!names) {
-        return c.json(
-          {
-            error: "invalid_roles",
-            message: 'roles must be a list of names: lower-case letters, digits, "-" and "_", starting with a letter.'
-          },
-          400
-        );
-      }
-      const email = normalizeEmail(data.email);
-      await roles.set(email, names, caller.email);
-      await ctx.emit("roles.changed", { email, roles: names, by: caller.email });
-      return c.json({ email, roles: names });
-    });
-  }
+  const admin = async (c) => {
+    const user = await currentSession(c);
+    if (!user) return { answer: c.json({ error: "no_session" }, 401) };
+    const email = user.email ? normalizeEmail(user.email) : void 0;
+    if (!email || !isAdmin(user)) {
+      const message = `Only users with the role "${ADMIN_ROLE}" can manage claims and settings.`;
+      return { answer: c.json({ error: "forbidden", message }, 403) };
+    }
+    return { email };
+  };
+  const body = async (c) => {
+    const data = await c.req.json().catch(() => null);
+    return data && typeof data === "object" ? data : {};
+  };
+  const invalidEmail = (c) => c.json({ error: "invalid_email", message: "This is not a valid e-mail address." }, 400);
+  const noUser = (c) => c.json({ error: "user_not_found", message: "No user has this e-mail address." }, 404);
+  app.post("/auth/admin/claims/get", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    if (!isValidEmail(data.email)) return invalidEmail(c);
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c);
+    return c.json({ email: user.emailNormalized, userId: user.id, claims: claimsFromJson(user.claims) });
+  });
+  app.post("/auth/admin/claims/set", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    if (!isValidEmail(data.email)) return invalidEmail(c);
+    const claims = parseClaims(data.claims);
+    if (!claims) {
+      return c.json(
+        {
+          error: "invalid_claims",
+          message: 'claims must be a JSON object of at most 2048 characters whose keys are names (letters, digits and "_", starting with a letter). "roles" must be a list of names of lower-case letters, digits, "-" and "_".'
+        },
+        400
+      );
+    }
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c);
+    await users.updateUser(user.id, { claims: Object.keys(claims).length ? JSON.stringify(claims) : null });
+    const email = user.emailNormalized;
+    await ctx.emit("user.claims_changed", { userId: user.id, email, claims, by: caller.email });
+    return c.json({ email, userId: user.id, claims });
+  });
+  const settingsAnswer = (methods) => ({
+    methods: Object.fromEntries(
+      SIGN_IN_METHODS.map((method) => [method, { available: available(method), enabled: isOn(method, available, methods) }])
+    )
+  });
+  app.post("/auth/admin/settings/get", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    return c.json(settingsAnswer(await settings.methods()));
+  });
+  app.post("/auth/admin/settings/set", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    const invalid = (message) => c.json({ error: "invalid_settings", message }, 400);
+    const changes = parseMethodSettings(data.methods);
+    if (!changes) return invalid(`methods must be an object with true or false for ${SIGN_IN_METHODS.join(" and/or ")}.`);
+    const methods = await settings.changeMethods((current) => {
+      const next = { ...current, ...changes };
+      return anyOn(available, next) ? next : null;
+    }, caller.email);
+    if (!methods) return invalid("At least one sign-in method must stay on.");
+    return c.json(settingsAnswer(methods));
+  });
   return app;
 }