@madauth/server 0.3.0-beta.1 → 0.4.0-beta.1

package/dist/chunk-ZSBKNV5W.js

@@ -1,713 +0,0 @@
-import {
-  EXPIRY_COOKIE,
-  RENEWAL_COOKIE,
-  RENEWAL_TYP,
-  SESSION_COOKIE,
-  SESSION_TYP,
-  randomString,
-  readToken,
-  signRenewal,
-  signSession,
-  signToken,
-  userFromClaims
-} from "./chunk-DCDTO5LG.js";
-import {
-  ADMIN_ROLE,
-  MAX_PASSWORD_LENGTH,
-  SIGN_IN_METHODS,
-  Settings,
-  Users,
-  anyOn,
-  checkPasswordPolicy,
-  claimsFromJson,
-  deriveCodeKey,
-  googleAccountKey,
-  hashPassword,
-  isAdmin,
-  isOn,
-  isValidEmail,
-  normalizeEmail,
-  parseClaims,
-  parseMethodSettings,
-  passwordAccountKey,
-  sameClaims,
-  toMadauthUser,
-  verifyAgainstDummy,
-  verifyPassword
-} from "./chunk-ODITZLMM.js";
-import {
-  importSigningKeys
-} from "./chunk-JDQLSL36.js";
-import {
-  WEBHOOK_TIMEOUT_MS,
-  createWebhookClient,
-  localeOf
-} from "./chunk-NPNM26J3.js";
-
-// src/routes/google.ts
-import { deleteCookie, getCookie, setCookie } from "hono/cookie";
-import { base64url } from "jose";
-
-// src/google.ts
-import { createRemoteJWKSet, jwtVerify } from "jose";
-var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
-var googleJwks;
-function googleKeys() {
-  googleJwks ??= createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
-  return googleJwks;
-}
-async function verifyGoogleIdToken(idToken, opts) {
-  let payload;
-  try {
-    ({ payload } = await jwtVerify(idToken, opts.keys ?? googleKeys(), {
-      issuer: GOOGLE_ISSUERS,
-      audience: opts.clientId,
-      algorithms: ["RS256", "ES256"]
-    }));
-  } catch (e) {
-    return { ok: false, error: "verification_failed", reason: e.message };
-  }
-  if (typeof payload.sub !== "string" || !payload.sub) {
-    return { ok: false, error: "verification_failed", reason: "missing sub" };
-  }
-  if (payload.nonce !== opts.nonce) {
-    return { ok: false, error: "verification_failed", reason: "nonce mismatch" };
-  }
-  if (typeof payload.email !== "string" || !payload.email || payload.email_verified !== true) {
-    return { ok: false, error: "email_unverified", reason: "e-mail address not verified" };
-  }
-  const profile = { sub: payload.sub, email: payload.email };
-  if (typeof payload.name === "string") profile.name = payload.name;
-  if (typeof payload.picture === "string") profile.picture = payload.picture;
-  return { ok: true, profile };
-}
-
-// src/routes/google.ts
-var NONCE_COOKIE = "madauth_nonce";
-var NONCE_TYP = "madauth-nonce+jwt";
-var NONCE_TTL = 5 * 60;
-var OAUTH_COOKIE = "madauth_oauth";
-var OAUTH_TYP = "madauth-oauth-state+jwt";
-var OAUTH_TTL = 10 * 60;
-var GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
-var GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-var REDIRECT_ERROR_PARAM = "madauth_error";
-async function pkceChallenge(verifier) {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-  return base64url.encode(new Uint8Array(digest));
-}
-function googleRoutes(app, ctx, google) {
-  const { config, keys, secure, users } = ctx;
-  const { issuer } = config;
-  const callbackUrl = `${issuer}/auth/google/callback`;
-  const resolveUser = async (profile, locale) => {
-    const key = googleAccountKey(profile.sub);
-    const emailNormalized = normalizeEmail(profile.email);
-    const signedIn = (user) => ({ ok: true, user: toMadauthUser(user, profile), sv: user.sessionVersion });
-    const account = await users.findAccountByKey(key);
-    if (account) {
-      const user = await users.findById(account.userId);
-      if (user) {
-        if (account.email !== profile.email) await users.updateAccount(account.id, { email: profile.email });
-        return signedIn(user);
-      }
-      await users.deleteAccount(account.id);
-    }
-    for (let attempt = 0; attempt < 2; attempt++) {
-      const existing = await users.findByEmail(emailNormalized);
-      if (existing) {
-        await users.verifyByProvider(existing);
-        if (!await users.linkAccount(existing.id, { key, email: profile.email })) {
-          const linked = await users.findAccountByKey(key);
-          const owner = linked && await users.findById(linked.userId);
-          if (!owner) return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
-          return signedIn(owner);
-        }
-        return signedIn(existing);
-      }
-      if (attempt === 0) {
-        const check = await ctx.checkSignup({ email: profile.email, name: profile.name, locale, method: "google" });
-        if (!check.ok) {
-          return check.reason === "rejected" ? { ok: false, error: "signup_rejected", message: check.message } : { ok: false, error: "temporarily_unavailable", message: "Signing up is not possible right now. Please try again later." };
-        }
-      }
-      const user = await users.createUser({
-        email: profile.email,
-        emailNormalized,
-        name: profile.name ?? null,
-        emailVerified: true,
-        account: { key, email: profile.email }
-      });
-      if (user) {
-        await ctx.emit("user.created", { user: toMadauthUser(user), method: "google" });
-        return signedIn(user);
-      }
-    }
-    return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
-  };
-  const disabled = (c) => c.json({ error: "method_disabled", message: "Google sign-in is switched off." }, 403);
-  app.post("/auth/google/nonce", async (c) => {
-    if (!await ctx.enabled("google")) return disabled(c);
-    const nonce = randomString();
-    const token = await signToken(await keys, issuer, NONCE_TYP, { nonce }, NONCE_TTL);
-    setCookie(c, NONCE_COOKIE, token, {
-      path: "/auth/google",
-      httpOnly: true,
-      secure,
-      sameSite: "Strict",
-      maxAge: NONCE_TTL
-    });
-    return c.json({ nonce });
-  });
-  app.post("/auth/google/verify", async (c) => {
-    if (!await ctx.enabled("google")) return disabled(c);
-    const body = await c.req.json().catch(() => ({}));
-    if (typeof body.credential !== "string" || !body.credential) {
-      return c.json({ error: "verification_failed", message: "credential is missing" }, 400);
-    }
-    const nonceClaims = await readToken(await keys, issuer, NONCE_TYP, getCookie(c, NONCE_COOKIE));
-    if (!nonceClaims) {
-      return c.json({ error: "verification_failed", message: "nonce cookie missing or expired" }, 401);
-    }
-    const result = await verifyGoogleIdToken(body.credential, {
-      clientId: google.clientId,
-      nonce: nonceClaims.nonce,
-      keys: config.jwksResolver
-    });
-    if (!result.ok) {
-      return c.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
-    }
-    deleteCookie(c, NONCE_COOKIE, { path: "/auth/google", secure });
-    const resolved = await resolveUser(result.profile, localeOf(body.locale));
-    if (!resolved.ok) {
-      return c.json({ error: resolved.error, message: resolved.message }, resolved.error === "signup_rejected" ? 403 : 503);
-    }
-    const user = await ctx.startSession(c, resolved.user, ["google"], { sv: resolved.sv });
-    await ctx.emit("user.signed_in", { user, method: "google" });
-    return c.json({ user });
-  });
-  const requireCodeFlow = async (c, next) => {
-    if (!google.clientSecret) return c.json({ error: "not_found" }, 404);
-    if (!await ctx.enabled("google")) return disabled(c);
-    await next();
-  };
-  app.get("/auth/google/start", requireCodeFlow, async (c) => {
-    const returnUrl = ctx.allowedUrl(c.req.query("return_to"));
-    if (!returnUrl) return c.text("return_to must be an absolute URL whose origin is in ALLOWED_ORIGINS", 400);
-    const oauth = {
-      state: randomString(),
-      nonce: randomString(),
-      verifier: randomString(),
-      returnTo: returnUrl.href,
-      locale: localeOf(c.req.query("locale"))
-    };
-    const token = await signToken(await keys, issuer, OAUTH_TYP, { ...oauth }, OAUTH_TTL);
-    setCookie(c, OAUTH_COOKIE, token, {
-      path: "/auth/google",
-      httpOnly: true,
-      secure,
-      sameSite: "Lax",
-      maxAge: OAUTH_TTL
-    });
-    const url = new URL(GOOGLE_AUTH_ENDPOINT);
-    url.search = new URLSearchParams({
-      client_id: google.clientId,
-      redirect_uri: callbackUrl,
-      response_type: "code",
-      scope: "openid email profile",
-      state: oauth.state,
-      nonce: oauth.nonce,
-      code_challenge: await pkceChallenge(oauth.verifier),
-      code_challenge_method: "S256"
-    }).toString();
-    return c.redirect(url.href, 302);
-  });
-  app.get("/auth/google/callback", requireCodeFlow, async (c) => {
-    const oauth = await readToken(await keys, issuer, OAUTH_TYP, getCookie(c, OAUTH_COOKIE));
-    if (!oauth) return c.text("Sign-in expired or was started in another browser. Please try again.", 400);
-    deleteCookie(c, OAUTH_COOKIE, { path: "/auth/google", secure });
-    const back = (error) => {
-      const url = new URL(oauth.returnTo);
-      if (error) url.hash = `${REDIRECT_ERROR_PARAM}=${error}`;
-      return c.redirect(url.href, 302);
-    };
-    if (c.req.query("error")) return back(c.req.query("error") === "access_denied" ? "cancelled" : "verification_failed");
-    const code = c.req.query("code");
-    if (!code || c.req.query("state") !== oauth.state) return back("verification_failed");
-    let idToken;
-    try {
-      const res = await fetch(GOOGLE_TOKEN_ENDPOINT, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-          code,
-          client_id: google.clientId,
-          client_secret: google.clientSecret,
-          redirect_uri: callbackUrl,
-          grant_type: "authorization_code",
-          code_verifier: oauth.verifier
-        })
-      });
-      if (!res.ok) return back("verification_failed");
-      ({ id_token: idToken } = await res.json());
-    } catch {
-      return back("verification_failed");
-    }
-    if (typeof idToken !== "string") return back("verification_failed");
-    const result = await verifyGoogleIdToken(idToken, {
-      clientId: google.clientId,
-      nonce: oauth.nonce,
-      keys: config.jwksResolver
-    });
-    if (!result.ok) return back(result.error);
-    const resolved = await resolveUser(result.profile, typeof oauth.locale === "string" ? oauth.locale : void 0);
-    if (!resolved.ok) return back(resolved.error);
-    const user = await ctx.startSession(c, resolved.user, ["google"], { sv: resolved.sv });
-    await ctx.emit("user.signed_in", { user, method: "google" });
-    return back();
-  });
-}
-
-// src/app.ts
-import { Hono } from "hono";
-import { deleteCookie as deleteCookie2, getCookie as getCookie2, setCookie as setCookie2 } from "hono/cookie";
-import { cors } from "hono/cors";
-
-// src/routes/password.ts
-var FREE_ATTEMPTS = 5;
-var MAX_LOCK_MS = 15 * 60 * 1e3;
-var MAIL_INTERVAL_MS = 60 * 1e3;
-var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
-var RESET_TTL_MS = 30 * 60 * 1e3;
-var VERIFY_LINK_PARAM = "madauth_verify";
-var RESET_LINK_PARAM = "madauth_reset";
-var MAX_NAME_LENGTH = 100;
-function passwordRoutes(app, ctx, password, users, webhook) {
-  const { minLength } = password;
-  const disabled = (c) => c.json({ error: "method_disabled", message: "E-mail & password sign-in is switched off." }, 403);
-  app.use("/auth/password/*", async (c, next) => {
-    if (!await ctx.enabled("password")) return disabled(c);
-    await next();
-  });
-  const body = async (c) => {
-    const data = await c.req.json().catch(() => null);
-    return data && typeof data === "object" ? data : {};
-  };
-  const error = (c, status, code, message) => c.json({ error: code, message }, status);
-  const unavailable = (c) => error(c, 503, "temporarily_unavailable", "E-mails can not be sent right now. Please try again later.");
-  const accepted = (c) => c.json({}, 202);
-  const redirectTarget = (c, value) => {
-    const url = ctx.allowedUrl(value);
-    return url ?? error(c, 400, "invalid_options", "redirectTo must be an absolute URL whose origin is in ALLOWED_ORIGINS.");
-  };
-  const sendEmail = async (user, type, data) => {
-    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
-    const result = await webhook.call(type, { to: user.email, user: { id: user.id, name: user.name ?? void 0 }, ...data }, WEBHOOK_TIMEOUT_MS);
-    if (!result.ok) {
-      console.error(`[madauth] Webhook "${type}" for ${user.email} failed: ${result.reason}`);
-      return false;
-    }
-    await users.updateUser(user.id, { lastMailAt: Date.now() });
-    return true;
-  };
-  const sendLinkEmail = async (user, purpose, target, locale) => {
-    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
-    const ttl = purpose === "verify" ? VERIFY_TTL_MS : RESET_TTL_MS;
-    const { token, code } = await users.issueVerification(user.id, purpose, ttl);
-    const link = new URL(target);
-    link.hash = `${purpose === "verify" ? VERIFY_LINK_PARAM : RESET_LINK_PARAM}=${token}`;
-    return sendEmail(user, purpose === "verify" ? "email.verify" : "email.reset", {
-      link: link.href,
-      code,
-      expiresAt: Date.now() + ttl,
-      site: target.host,
-      locale
-    });
-  };
-  const consume = async (data, purpose) => {
-    if (typeof data.token === "string" && data.token) {
-      return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
-    }
-    if (isValidEmail(data.email) && typeof data.code === "string") {
-      const user = await users.findByEmail(normalizeEmail(data.email));
-      if (!user) return { userId: null, via: "code" };
-      return { ...await users.consumeCode(user, purpose, data.code.replace(/\s/g, "")), via: "code" };
-    }
-    return { userId: null, via: "code" };
-  };
-  const invalidVerification = (c, { via, locked }) => {
-    if (locked) {
-      return error(c, 429, "codes_locked", "Too many wrong codes. Please ask for a new e-mail and use the link in it.");
-    }
-    return via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
-  };
-  app.post("/auth/password/signin", async (c) => {
-    const data = await body(c);
-    const wrong = () => error(c, 401, "invalid_credentials", "E-mail or password is wrong.");
-    const pw = typeof data.password === "string" ? data.password : "";
-    if (!isValidEmail(data.email) || !pw || pw.length > MAX_PASSWORD_LENGTH * 4) return wrong();
-    const user = await users.findByEmail(normalizeEmail(data.email));
-    const account = user ? await users.passwordAccount(user.id) : null;
-    if (!user || !account?.secret) {
-      await verifyAgainstDummy(pw);
-      return wrong();
-    }
-    const now = Date.now();
-    if (account.lockedUntil > now) {
-      const seconds = Math.ceil((account.lockedUntil - now) / 1e3);
-      return error(c, 429, "too_many_attempts", `Too many failed attempts. Try again in ${seconds} seconds.`);
-    }
-    const failed = account.failedAttempts + 1;
-    const lockedUntil = failed >= FREE_ATTEMPTS ? now + Math.min(2 ** (failed - FREE_ATTEMPTS) * 1e3, MAX_LOCK_MS) : 0;
-    if (!await users.countAttempt(account, { failedAttempts: failed, lockedUntil })) {
-      return error(c, 429, "too_many_attempts", "Too many attempts at once. Please try again.");
-    }
-    const { ok, needsRehash } = await verifyPassword(pw, account.secret);
-    if (!ok) return wrong();
-    await users.updateAccount(account.id, {
-      failedAttempts: 0,
-      lockedUntil: 0,
-      ...needsRehash ? { secret: await hashPassword(pw) } : {}
-    });
-    if (!user.emailVerified) {
-      return error(c, 403, "email_unverified", "Please confirm your e-mail address first. We can send the e-mail again.");
-    }
-    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
-    await ctx.emit("user.signed_in", { user: result, method: "password" });
-    return c.json({ user: result });
-  });
-  app.post("/auth/password/signup", async (c) => {
-    const data = await body(c);
-    const target = redirectTarget(c, data.redirectTo);
-    if (target instanceof Response) return target;
-    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
-    const policy = checkPasswordPolicy(data.password, minLength);
-    if (policy) return error(c, 400, "weak_password", policy);
-    const name = typeof data.name === "string" && data.name.trim() ? data.name.trim().slice(0, MAX_NAME_LENGTH) : null;
-    const email = data.email.trim();
-    const locale = localeOf(data.locale);
-    const check = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "password" });
-    if (!check.ok) return check.reason === "rejected" ? error(c, 403, "signup_rejected", check.message) : unavailable(c);
-    const passwordHash = await hashPassword(data.password);
-    const existing = await users.findByEmail(normalizeEmail(email));
-    if (existing?.emailVerified) {
-      if (!webhook.wants("email.already_registered")) return accepted(c);
-      const sent = await sendEmail(existing, "email.already_registered", { link: target.href, site: target.host, locale });
-      return sent ? accepted(c) : unavailable(c);
-    }
-    if (existing) {
-      if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
-      const account = await users.passwordAccount(existing.id);
-      if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
-      else await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash });
-      await users.updateUser(existing.id, { name });
-      return await sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
-    }
-    const user = await users.createUser({
-      email,
-      emailNormalized: normalizeEmail(email),
-      name,
-      emailVerified: false,
-      account: (userId) => ({ key: passwordAccountKey(userId), secret: passwordHash })
-    });
-    if (!user) return accepted(c);
-    await ctx.emit("user.created", { user: toMadauthUser(user), method: "password" });
-    return await sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
-  });
-  app.post("/auth/password/send-verification", async (c) => {
-    const data = await body(c);
-    const target = redirectTarget(c, data.redirectTo);
-    if (target instanceof Response) return target;
-    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
-    const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && !user.emailVerified && await users.passwordAccount(user.id)) {
-      if (!await sendLinkEmail(user, "verify", target, localeOf(data.locale))) return unavailable(c);
-    }
-    return accepted(c);
-  });
-  app.post("/auth/password/verify-email", async (c) => {
-    const consumed = await consume(await body(c), "verify");
-    const { userId, via } = consumed;
-    const user = userId ? await users.findById(userId) : null;
-    if (!user) return invalidVerification(c, consumed);
-    await users.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
-    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: user.sessionVersion });
-    await ctx.emit("email.verified", { user: result, via });
-    await ctx.emit("user.signed_in", { user: result, method: "password" });
-    return c.json({ user: result });
-  });
-  app.post("/auth/password/send-reset", async (c) => {
-    const data = await body(c);
-    const target = redirectTarget(c, data.redirectTo);
-    if (target instanceof Response) return target;
-    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
-    const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && (user.emailVerified || await users.passwordAccount(user.id))) {
-      if (!await sendLinkEmail(user, "reset", target, localeOf(data.locale))) return unavailable(c);
-    }
-    return accepted(c);
-  });
-  app.post("/auth/password/reset", async (c) => {
-    const data = await body(c);
-    const policy = checkPasswordPolicy(data.password, minLength);
-    if (policy) return error(c, 400, "weak_password", policy);
-    const consumed = await consume(data, "reset");
-    const user = consumed.userId ? await users.findById(consumed.userId) : null;
-    if (!user) return invalidVerification(c, consumed);
-    const secret = await hashPassword(data.password);
-    const account = await users.passwordAccount(user.id);
-    if (account) await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 });
-    else await users.linkAccount(user.id, { key: passwordAccountKey(user.id), secret });
-    const sessionVersion = user.sessionVersion + 1;
-    await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
-    await users.clearVerifications(user.id);
-    const result = await ctx.startSession(c, toMadauthUser(user), ["pwd"], { sv: sessionVersion });
-    await ctx.emit("email.password_reset", { user: result });
-    await ctx.emit("user.signed_in", { user: result, method: "password" });
-    return c.json({ user: result });
-  });
-}
-
-// src/app.ts
-var EVENT_TIMEOUT_MS = 5e3;
-function createApp(config) {
-  const { issuer, allowedOrigins, sessionTtlSeconds, renewalTtlSeconds, cookieDomain } = config;
-  const keys = importSigningKeys(config.signingKey);
-  const secure = issuer.startsWith("https:");
-  const isAllowedOrigin = (origin) => !!origin && allowedOrigins.includes(origin);
-  const users = new Users(config.store, deriveCodeKey(config.signingKey.d));
-  const settings = new Settings(config.store);
-  const available = (method) => method === "google" ? !!config.google : !!config.password;
-  const issueSession = async (c, user, amr, extra) => {
-    const signingKeys = await keys;
-    const [sessionToken, renewalToken] = await Promise.all([
-      signSession(signingKeys, issuer, sessionTtlSeconds, user, amr, extra),
-      signRenewal(signingKeys, issuer, renewalTtlSeconds, user, amr, extra)
-    ]);
-    setCookie2(c, SESSION_COOKIE, sessionToken, {
-      path: "/",
-      domain: cookieDomain,
-      httpOnly: true,
-      secure,
-      sameSite: "Lax",
-      maxAge: sessionTtlSeconds
-    });
-    setCookie2(c, RENEWAL_COOKIE, renewalToken, {
-      path: "/auth",
-      httpOnly: true,
-      secure,
-      sameSite: "Lax",
-      maxAge: renewalTtlSeconds
-    });
-    setCookie2(c, EXPIRY_COOKIE, String(Math.floor(Date.now() / 1e3) + sessionTtlSeconds), {
-      path: "/",
-      domain: cookieDomain,
-      secure,
-      sameSite: "Lax",
-      maxAge: renewalTtlSeconds
-    });
-  };
-  const clearSession = (c) => {
-    deleteCookie2(c, SESSION_COOKIE, { path: "/", domain: cookieDomain, secure });
-    deleteCookie2(c, RENEWAL_COOKIE, { path: "/auth", secure });
-    deleteCookie2(c, EXPIRY_COOKIE, { path: "/", domain: cookieDomain, secure });
-  };
-  const ctx = {
-    config,
-    keys,
-    secure,
-    isAllowedOrigin,
-    allowedUrl(value) {
-      let url;
-      try {
-        url = new URL(typeof value === "string" ? value : "");
-      } catch {
-        return null;
-      }
-      if (!isAllowedOrigin(url.origin)) return null;
-      url.hash = "";
-      return url;
-    },
-    async startSession(c, user, amr, extra) {
-      await issueSession(c, user, amr, extra);
-      return user;
-    },
-    users,
-    settings,
-    webhook: config.webhook ? createWebhookClient(config.webhook, config.webhookFetch) : void 0,
-    async enabled(method) {
-      return isOn(method, available, await settings.methods());
-    },
-    async checkSignup(data) {
-      if (!this.webhook?.wants("signup.before")) return { ok: true };
-      const check = await this.webhook.call("signup.before", data, WEBHOOK_TIMEOUT_MS);
-      if (!check.ok) {
-        console.error(`[madauth] Webhook "signup.before" failed: ${check.reason}`);
-        return { ok: false, reason: "unavailable" };
-      }
-      const answer = check.body;
-      if (answer?.allow === false) {
-        const message = typeof answer.message === "string" && answer.message ? answer.message : "Sign-up is not possible with this e-mail address.";
-        return { ok: false, reason: "rejected", message };
-      }
-      return { ok: true };
-    },
-    async emit(type, data) {
-      if (!this.webhook?.wants(type)) return;
-      const result = await this.webhook.call(type, data, EVENT_TIMEOUT_MS);
-      if (!result.ok) console.error(`[madauth] Webhook "${type}" failed: ${result.reason}`);
-    }
-  };
-  const app = new Hono();
-  app.use(
-    "/auth/*",
-    cors({
-      origin: (origin) => isAllowedOrigin(origin) ? origin : null,
-      credentials: true,
-      allowMethods: ["GET", "POST"],
-      allowHeaders: ["Content-Type"],
-      maxAge: 600
-    })
-  );
-  app.use("/auth/*", async (c, next) => {
-    if (c.req.method === "POST" && !isAllowedOrigin(c.req.header("origin"))) {
-      return c.json({ error: "forbidden_origin" }, 403);
-    }
-    await next();
-  });
-  app.get("/health", (c) => c.text("ok"));
-  app.get("/.well-known/jwks.json", async (c) => {
-    const { publicJwk } = await keys;
-    c.header("Cache-Control", "public, max-age=3600");
-    return c.json({ keys: [publicJwk] });
-  });
-  app.get("/auth/config", async (c) => {
-    const methods = await settings.methods();
-    const on = (method) => isOn(method, available, methods);
-    return c.json({
-      google: on("google") ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret } : null,
-      password: on("password") ? { minLength: config.password.minLength } : null
-    });
-  });
-  if (config.google) googleRoutes(app, ctx, config.google);
-  if (config.password && ctx.webhook) passwordRoutes(app, ctx, config.password, users, ctx.webhook);
-  const tokenClaims = async (c, cookie, typ) => readToken(await keys, issuer, typ, getCookie2(c, cookie));
-  const checked = async (claims) => {
-    const stored = await users.findById(claims.sub);
-    if (!stored || stored.sessionVersion !== claims.sv) return null;
-    const { claims: _, ...user } = userFromClaims(claims);
-    const current = claimsFromJson(stored.claims);
-    return Object.keys(current).length ? { ...user, claims: current } : user;
-  };
-  const currentSession = async (c) => {
-    const session = await tokenClaims(c, SESSION_COOKIE, SESSION_TYP);
-    const user = session ? await checked(session) : null;
-    const upToDate = session && user && sameClaims(user.claims, session.claims) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
-    if (upToDate) return user;
-    const renewal = await tokenClaims(c, RENEWAL_COOKIE, RENEWAL_TYP);
-    const sameSignIn = session && user && renewal && renewal.sub === session.sub && renewal.sv === session.sv && renewal.email === session.email;
-    const renewed = sameSignIn ? user : renewal ? await checked(renewal) : null;
-    if (renewal && renewed) {
-      await issueSession(c, renewed, renewal.amr, { sv: renewal.sv });
-      return renewed;
-    }
-    return user;
-  };
-  app.get("/auth/session", async (c) => {
-    const user = await currentSession(c);
-    if (!user) {
-      clearSession(c);
-      return c.json({ error: "no_session" }, 401);
-    }
-    return c.json({ user });
-  });
-  app.post("/auth/logout", (c) => {
-    clearSession(c);
-    return c.body(null, 204);
-  });
-  app.post("/auth/account/delete", async (c) => {
-    const user = await currentSession(c);
-    if (!user) return c.json({ error: "no_session" }, 401);
-    await users.deleteById(user.id);
-    clearSession(c);
-    await ctx.emit("user.deleted", { user });
-    return c.body(null, 204);
-  });
-  const admin = async (c) => {
-    const user = await currentSession(c);
-    if (!user) return { answer: c.json({ error: "no_session" }, 401) };
-    const email = user.email ? normalizeEmail(user.email) : void 0;
-    if (!email || !isAdmin(user)) {
-      const message = `Only users with the role "${ADMIN_ROLE}" can manage claims and settings.`;
-      return { answer: c.json({ error: "forbidden", message }, 403) };
-    }
-    return { email };
-  };
-  const body = async (c) => {
-    const data = await c.req.json().catch(() => null);
-    return data && typeof data === "object" ? data : {};
-  };
-  const invalidEmail = (c) => c.json({ error: "invalid_email", message: "This is not a valid e-mail address." }, 400);
-  const noUser = (c) => c.json({ error: "user_not_found", message: "No user has this e-mail address." }, 404);
-  app.post("/auth/admin/claims/get", async (c) => {
-    const caller = await admin(c);
-    if ("answer" in caller) return caller.answer;
-    const data = await body(c);
-    if (!isValidEmail(data.email)) return invalidEmail(c);
-    const user = await users.findByEmail(normalizeEmail(data.email));
-    if (!user) return noUser(c);
-    return c.json({ email: user.emailNormalized, userId: user.id, claims: claimsFromJson(user.claims) });
-  });
-  app.post("/auth/admin/claims/set", async (c) => {
-    const caller = await admin(c);
-    if ("answer" in caller) return caller.answer;
-    const data = await body(c);
-    if (!isValidEmail(data.email)) return invalidEmail(c);
-    const claims = parseClaims(data.claims);
-    if (!claims) {
-      return c.json(
-        {
-          error: "invalid_claims",
-          message: 'claims must be a JSON object of at most 2048 characters whose keys are names (letters, digits and "_", starting with a letter). "roles" must be a list of names of lower-case letters, digits, "-" and "_".'
-        },
-        400
-      );
-    }
-    const user = await users.findByEmail(normalizeEmail(data.email));
-    if (!user) return noUser(c);
-    await users.updateUser(user.id, { claims: Object.keys(claims).length ? JSON.stringify(claims) : null });
-    const email = user.emailNormalized;
-    await ctx.emit("user.claims_changed", { userId: user.id, email, claims, by: caller.email });
-    return c.json({ email, userId: user.id, claims });
-  });
-  const settingsAnswer = (methods) => ({
-    methods: Object.fromEntries(
-      SIGN_IN_METHODS.map((method) => [method, { available: available(method), enabled: isOn(method, available, methods) }])
-    )
-  });
-  app.post("/auth/admin/settings/get", async (c) => {
-    const caller = await admin(c);
-    if ("answer" in caller) return caller.answer;
-    return c.json(settingsAnswer(await settings.methods()));
-  });
-  app.post("/auth/admin/settings/set", async (c) => {
-    const caller = await admin(c);
-    if ("answer" in caller) return caller.answer;
-    const data = await body(c);
-    const invalid = (message) => c.json({ error: "invalid_settings", message }, 400);
-    const changes = parseMethodSettings(data.methods);
-    if (!changes) return invalid(`methods must be an object with true or false for ${SIGN_IN_METHODS.join(" and/or ")}.`);
-    const methods = await settings.changeMethods((current) => {
-      const next = { ...current, ...changes };
-      return anyOn(available, next) ? next : null;
-    }, caller.email);
-    if (!methods) return invalid("At least one sign-in method must stay on.");
-    return c.json(settingsAnswer(methods));
-  });
-  return app;
-}
-
-export {
-  REDIRECT_ERROR_PARAM,
-  createApp
-};