@madauth/server 0.3.0-beta.2 → 0.4.0-beta.1

package/dist/chunk-3PACOYTG.js

@@ -0,0 +1,1185 @@
+import {
+  EXPIRY_COOKIE,
+  RENEWAL_COOKIE,
+  RENEWAL_TYP,
+  SESSION_COOKIE,
+  SESSION_TYP,
+  randomString,
+  readToken,
+  signRenewal,
+  signSession,
+  signToken,
+  userFromClaims
+} from "./chunk-A7UYZRBL.js";
+import {
+  ADMIN_ROLE,
+  MAX_PASSWORD_LENGTH,
+  METHODS_WITH_SECOND_FACTOR,
+  SIGN_IN_METHODS,
+  Settings,
+  Users,
+  anyOn,
+  authenticatorOn,
+  canSignUp,
+  checkPasswordPolicy,
+  claimsFromJson,
+  deriveCodeKey,
+  googleAccountKey,
+  hashCode,
+  hashPassword,
+  initialMethods,
+  isAdmin,
+  isConfigured,
+  isOn,
+  isValidEmail,
+  methodConfig,
+  newId,
+  normalizeEmail,
+  parseClaims,
+  parseMethodSettings,
+  passwordAccountKey,
+  policyOf,
+  safeEqual,
+  sameClaims,
+  sendsVerificationEmails,
+  toMadauthUser,
+  totpAccountKey,
+  verifyAgainstDummy,
+  verifyPassword
+} from "./chunk-ISJGOCF3.js";
+import {
+  importSigningKeys
+} from "./chunk-JDQLSL36.js";
+import {
+  WEBHOOK_TIMEOUT_MS,
+  createWebhookClient,
+  localeOf
+} from "./chunk-Y7ZSUROX.js";
+
+// src/routes/google.ts
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { base64url } from "jose";
+
+// src/google.ts
+import { createRemoteJWKSet, jwtVerify } from "jose";
+var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
+var googleJwks;
+function googleKeys() {
+  googleJwks ??= createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
+  return googleJwks;
+}
+async function verifyGoogleIdToken(idToken, opts) {
+  let payload;
+  try {
+    ({ payload } = await jwtVerify(idToken, opts.keys ?? googleKeys(), {
+      issuer: GOOGLE_ISSUERS,
+      audience: opts.clientId,
+      algorithms: ["RS256", "ES256"]
+    }));
+  } catch (e) {
+    return { ok: false, error: "verification_failed", reason: e.message };
+  }
+  if (typeof payload.sub !== "string" || !payload.sub) {
+    return { ok: false, error: "verification_failed", reason: "missing sub" };
+  }
+  if (payload.nonce !== opts.nonce) {
+    return { ok: false, error: "verification_failed", reason: "nonce mismatch" };
+  }
+  if (typeof payload.email !== "string" || !payload.email || payload.email_verified !== true) {
+    return { ok: false, error: "email_unverified", reason: "e-mail address not verified" };
+  }
+  const profile = { sub: payload.sub, email: payload.email };
+  if (typeof payload.name === "string") profile.name = payload.name;
+  if (typeof payload.picture === "string") profile.picture = payload.picture;
+  return { ok: true, profile };
+}
+
+// src/routes/helpers.ts
+async function body(c) {
+  const data = await c.req.json().catch(() => null);
+  return data && typeof data === "object" ? data : {};
+}
+function error(c, status, code, message) {
+  return c.json({ error: code, message }, status);
+}
+var unavailable = (c) => error(c, 503, "temporarily_unavailable", "E-mails can not be sent right now. Please try again later.");
+var accepted = (c) => c.json({}, 202);
+var noSession = (c) => error(c, 401, "no_session", "Please sign in first.");
+function redirectTarget(ctx, c, value) {
+  const url = ctx.allowedUrl(value);
+  return url ?? error(c, 400, "invalid_options", "redirectTo must be an absolute URL whose origin is in ALLOWED_ORIGINS.");
+}
+var MAX_NAME_LENGTH = 100;
+function nameOf(value) {
+  return typeof value === "string" && value.trim() ? value.trim().slice(0, MAX_NAME_LENGTH) : null;
+}
+function signInAnswer(c, step) {
+  if ("disabled" in step) return error(c, 403, "method_disabled", "This way of signing in is switched off.");
+  if ("next" in step) {
+    return step.next === "totp" ? c.json({ error: "totp_required", message: "Enter the code from your authenticator app to finish signing in.", method: step.method }, 401) : c.json({ error: "totp_setup_required", message: "Set up an authenticator app to finish signing in.", method: step.method }, 401);
+  }
+  return c.json({ user: step.user });
+}
+
+// src/routes/google.ts
+var NONCE_COOKIE = "madauth_nonce";
+var NONCE_TYP = "madauth-nonce+jwt";
+var NONCE_TTL = 5 * 60;
+var OAUTH_COOKIE = "madauth_oauth";
+var OAUTH_TYP = "madauth-oauth-state+jwt";
+var OAUTH_TTL = 10 * 60;
+var GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+var GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+var REDIRECT_ERROR_PARAM = "madauth_error";
+var REDIRECT_NEXT_PARAM = "madauth_next";
+async function pkceChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64url.encode(new Uint8Array(digest));
+}
+function googleRoutes(app, ctx, google) {
+  const { config, keys, secure, users } = ctx;
+  const { issuer } = config;
+  const callbackUrl = `${issuer}/auth/google/callback`;
+  const resolveUser = async (profile, locale) => {
+    const key = googleAccountKey(profile.sub);
+    const emailNormalized = normalizeEmail(profile.email);
+    const signedIn = (user) => ({ ok: true, user });
+    const account = await users.findAccountByKey(key);
+    if (account) {
+      const user = await users.findById(account.userId);
+      if (user) {
+        if (account.email !== profile.email) await users.updateAccount(account.id, { email: profile.email });
+        return signedIn(user);
+      }
+      await users.deleteAccount(account.id);
+    }
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const existing = await users.findByEmail(emailNormalized);
+      if (existing) {
+        if (existing.emailVerified && await users.hasAccounts(existing.id)) {
+          const methods = await users.signInMethods(existing.id, await ctx.settings.methods());
+          const how = methods.map((method) => ({ password: "a password", totp: "an authenticator app", google: "Google" })[method]).join(" or ");
+          return { ok: false, error: "other_method", message: `This e-mail address signs in with ${how || "another method"}. Use that instead of Google.`, methods };
+        }
+        await users.verifyByProvider(existing);
+        if (!await users.linkAccount(existing.id, { key, email: profile.email })) {
+          const linked = await users.findAccountByKey(key);
+          const owner = linked && await users.findById(linked.userId);
+          if (!owner) return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
+          return signedIn(owner);
+        }
+        return signedIn(existing);
+      }
+      if (attempt === 0) {
+        const check = await ctx.checkSignup({ email: profile.email, name: profile.name, locale, method: "google" });
+        if (!check.ok) {
+          return check.reason === "rejected" ? { ok: false, error: "signup_rejected", message: check.message } : { ok: false, error: "temporarily_unavailable", message: "Signing up is not possible right now. Please try again later." };
+        }
+      }
+      const user = await users.createUser({
+        email: profile.email,
+        emailNormalized,
+        name: profile.name ?? null,
+        emailVerified: true,
+        account: { key, email: profile.email }
+      });
+      if (user) {
+        await ctx.emit("user.created", { user: toMadauthUser(user), method: "google" });
+        return signedIn(user);
+      }
+    }
+    return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
+  };
+  const disabled = (c) => c.json({ error: "method_disabled", message: "Google sign-in is switched off." }, 403);
+  app.post("/auth/google/nonce", async (c) => {
+    if (!await ctx.enabled(c, "google")) return disabled(c);
+    const nonce = randomString();
+    const token = await signToken(await keys, issuer, NONCE_TYP, { nonce }, NONCE_TTL);
+    setCookie(c, NONCE_COOKIE, token, {
+      path: "/auth/google",
+      httpOnly: true,
+      secure,
+      sameSite: "Strict",
+      maxAge: NONCE_TTL
+    });
+    return c.json({ nonce });
+  });
+  app.post("/auth/google/verify", async (c) => {
+    if (!await ctx.enabled(c, "google")) return disabled(c);
+    const body2 = await c.req.json().catch(() => ({}));
+    if (typeof body2.credential !== "string" || !body2.credential) {
+      return c.json({ error: "verification_failed", message: "credential is missing" }, 400);
+    }
+    const nonceClaims = await readToken(await keys, issuer, NONCE_TYP, getCookie(c, NONCE_COOKIE));
+    if (!nonceClaims) {
+      return c.json({ error: "verification_failed", message: "nonce cookie missing or expired" }, 401);
+    }
+    const result = await verifyGoogleIdToken(body2.credential, {
+      clientId: google.clientId,
+      nonce: nonceClaims.nonce,
+      keys: config.jwksResolver
+    });
+    if (!result.ok) {
+      return c.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
+    }
+    deleteCookie(c, NONCE_COOKIE, { path: "/auth/google", secure });
+    const resolved = await resolveUser(result.profile, localeOf(body2.locale));
+    if (!resolved.ok) {
+      if (resolved.error === "other_method") return c.json({ error: resolved.error, message: resolved.message, methods: resolved.methods }, 403);
+      return c.json({ error: resolved.error, message: resolved.message }, resolved.error === "signup_rejected" ? 403 : 503);
+    }
+    return signInAnswer(c, await ctx.secondStep(c, resolved.user, ["google"], "google", result.profile));
+  });
+  const requireCodeFlow = async (c, next) => {
+    if (!google.clientSecret) return c.json({ error: "not_found" }, 404);
+    if (!await ctx.enabled(c, "google")) return disabled(c);
+    await next();
+  };
+  app.get("/auth/google/start", requireCodeFlow, async (c) => {
+    const returnUrl = ctx.allowedUrl(c.req.query("return_to"));
+    if (!returnUrl) return c.text("return_to must be an absolute URL whose origin is in ALLOWED_ORIGINS", 400);
+    const oauth = {
+      state: randomString(),
+      nonce: randomString(),
+      verifier: randomString(),
+      returnTo: returnUrl.href,
+      locale: localeOf(c.req.query("locale"))
+    };
+    const token = await signToken(await keys, issuer, OAUTH_TYP, { ...oauth }, OAUTH_TTL);
+    setCookie(c, OAUTH_COOKIE, token, {
+      path: "/auth/google",
+      httpOnly: true,
+      secure,
+      sameSite: "Lax",
+      maxAge: OAUTH_TTL
+    });
+    const url = new URL(GOOGLE_AUTH_ENDPOINT);
+    url.search = new URLSearchParams({
+      client_id: google.clientId,
+      redirect_uri: callbackUrl,
+      response_type: "code",
+      scope: "openid email profile",
+      state: oauth.state,
+      nonce: oauth.nonce,
+      code_challenge: await pkceChallenge(oauth.verifier),
+      code_challenge_method: "S256"
+    }).toString();
+    return c.redirect(url.href, 302);
+  });
+  app.get("/auth/google/callback", requireCodeFlow, async (c) => {
+    const oauth = await readToken(await keys, issuer, OAUTH_TYP, getCookie(c, OAUTH_COOKIE));
+    if (!oauth) return c.text("Sign-in expired or was started in another browser. Please try again.", 400);
+    deleteCookie(c, OAUTH_COOKIE, { path: "/auth/google", secure });
+    const back = (error2, next) => {
+      const url = new URL(oauth.returnTo);
+      if (error2) url.hash = `${REDIRECT_ERROR_PARAM}=${error2}`;
+      if (next) url.hash = `${REDIRECT_NEXT_PARAM}=${next}`;
+      return c.redirect(url.href, 302);
+    };
+    if (c.req.query("error")) return back(c.req.query("error") === "access_denied" ? "cancelled" : "verification_failed");
+    const code = c.req.query("code");
+    if (!code || c.req.query("state") !== oauth.state) return back("verification_failed");
+    let idToken;
+    try {
+      const res = await fetch(GOOGLE_TOKEN_ENDPOINT, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          code,
+          client_id: google.clientId,
+          client_secret: google.clientSecret,
+          redirect_uri: callbackUrl,
+          grant_type: "authorization_code",
+          code_verifier: oauth.verifier
+        })
+      });
+      if (!res.ok) return back("verification_failed");
+      ({ id_token: idToken } = await res.json());
+    } catch {
+      return back("verification_failed");
+    }
+    if (typeof idToken !== "string") return back("verification_failed");
+    const result = await verifyGoogleIdToken(idToken, {
+      clientId: google.clientId,
+      nonce: oauth.nonce,
+      keys: config.jwksResolver
+    });
+    if (!result.ok) return back(result.error);
+    const resolved = await resolveUser(result.profile, typeof oauth.locale === "string" ? oauth.locale : void 0);
+    if (!resolved.ok) return back(resolved.error);
+    const step = await ctx.secondStep(c, resolved.user, ["google"], "google", result.profile);
+    if ("disabled" in step) return back("method_disabled");
+    if ("next" in step) return back(void 0, step.next);
+    return back();
+  });
+}
+
+// src/app.ts
+import { Hono } from "hono";
+import { deleteCookie as deleteCookie3, getCookie as getCookie3, setCookie as setCookie3 } from "hono/cookie";
+import { cors } from "hono/cors";
+
+// src/routes/emails.ts
+var MAIL_INTERVAL_MS = 60 * 1e3;
+var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
+var RESET_TTL_MS = 30 * 60 * 1e3;
+var VERIFY_LINK_PARAM = "madauth_verify";
+var RESET_LINK_PARAM = "madauth_reset";
+function createEmails(ctx, users, webhook) {
+  const sendEmail = async (user, type, data) => {
+    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+    const result = await webhook.call(type, { to: user.email, user: { id: user.id, name: user.name ?? void 0 }, ...data }, WEBHOOK_TIMEOUT_MS);
+    if (!result.ok) {
+      console.error(`[madauth] Webhook "${type}" for ${user.email} failed: ${result.reason}`);
+      return false;
+    }
+    await users.updateUser(user.id, { lastMailAt: Date.now() });
+    return true;
+  };
+  return {
+    sendEmail,
+    async sendLinkEmail(user, purpose, target, locale) {
+      if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+      const ttl = purpose === "verify" ? VERIFY_TTL_MS : RESET_TTL_MS;
+      const { token, code } = await users.issueVerification(user.id, purpose, ttl);
+      const link = new URL(target);
+      link.hash = `${purpose === "verify" ? VERIFY_LINK_PARAM : RESET_LINK_PARAM}=${token}`;
+      return sendEmail(user, purpose === "verify" ? "email.verify" : "email.reset", {
+        link: link.href,
+        code,
+        expiresAt: Date.now() + ttl,
+        site: target.host,
+        locale
+      });
+    },
+    async sendAccountEmail(user, type, target, locale) {
+      if (!webhook.wants(type)) return true;
+      const methods = await users.signInMethods(user.id, await ctx.settings.methods());
+      return sendEmail(user, type, { link: target.href, site: target.host, locale, methods });
+    },
+    async consume(data, purpose) {
+      if (typeof data.token === "string" && data.token) {
+        return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
+      }
+      if (isValidEmail(data.email) && typeof data.code === "string") {
+        const user = await users.findByEmail(normalizeEmail(data.email));
+        if (!user) return { userId: null, via: "code" };
+        return { ...await users.consumeCode(user, purpose, data.code.replace(/\s/g, "")), via: "code" };
+      }
+      return { userId: null, via: "code" };
+    },
+    invalidVerification(c, { via, locked }) {
+      if (locked) {
+        return error(c, 429, "codes_locked", "Too many wrong codes. Please ask for a new e-mail and use the link in it.");
+      }
+      return via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
+    }
+  };
+}
+
+// src/routes/email.ts
+function emailRoutes(app, ctx, users, webhook) {
+  const emails = createEmails(ctx, users, webhook);
+  const signUpMethod = async (userId) => await users.passwordAccount(userId) ? "password" : "totp";
+  app.post("/auth/email/send-verification", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(ctx, c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (user && !user.emailVerified && await ctx.enabled(c, await signUpMethod(user.id))) {
+      if (!await emails.sendLinkEmail(user, "verify", target, localeOf(data.locale))) return unavailable(c);
+    }
+    return accepted(c);
+  });
+  const disabled = (c) => error(c, 403, "method_disabled", "This way of signing in is switched off.");
+  app.post("/auth/email/verify", async (c) => {
+    const data = await body(c);
+    const waiting = typeof data.token === "string" && data.token ? await users.peekLinkToken(data.token, "verify") : isValidEmail(data.email) ? (await users.findByEmail(normalizeEmail(data.email)))?.id ?? null : null;
+    if (waiting && !await ctx.enabled(c, await signUpMethod(waiting))) return disabled(c);
+    const consumed = await emails.consume(data, "verify");
+    const { userId, via } = consumed;
+    const user = userId ? await users.findById(userId) : null;
+    if (!user) return emails.invalidVerification(c, consumed);
+    const method = await signUpMethod(user.id);
+    if (!await ctx.enabled(c, method)) return disabled(c);
+    await users.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
+    const verified = { ...user, emailVerified: true, wrongCodes: 0 };
+    await ctx.emit("email.verified", { user: toMadauthUser(verified), via });
+    return signInAnswer(c, await ctx.secondStep(c, verified, method === "password" ? ["pwd"] : [], method));
+  });
+}
+
+// src/routes/lockout.ts
+var FREE_ATTEMPTS = 5;
+var MAX_LOCK_MS = 15 * 60 * 1e3;
+async function countSignInAttempt(c, users, account, now = Date.now()) {
+  const tooMany = (message) => c.json({ error: "too_many_attempts", message }, 429);
+  if (account.lockedUntil > now) {
+    const seconds = Math.ceil((account.lockedUntil - now) / 1e3);
+    return tooMany(`Too many failed attempts. Try again in ${seconds} seconds.`);
+  }
+  const failed = account.failedAttempts + 1;
+  const lockedUntil = failed >= FREE_ATTEMPTS ? now + Math.min(2 ** (failed - FREE_ATTEMPTS) * 1e3, MAX_LOCK_MS) : 0;
+  if (!await users.countAttempt(account, { failedAttempts: failed, lockedUntil })) {
+    return tooMany("Too many attempts at once. Please try again.");
+  }
+  return null;
+}
+
+// src/routes/password.ts
+function passwordRoutes(app, ctx, password, users, webhook) {
+  const { minLength } = password;
+  const emails = createEmails(ctx, users, webhook);
+  app.use("/auth/password/*", async (c, next) => {
+    if (!await ctx.enabled(c, "password")) return error(c, 403, "method_disabled", "E-mail & password sign-in is switched off.");
+    await next();
+  });
+  app.post("/auth/password/signin", async (c) => {
+    const data = await body(c);
+    const wrong = () => error(c, 401, "invalid_credentials", "E-mail or password is wrong.");
+    const pw = typeof data.password === "string" ? data.password : "";
+    if (!isValidEmail(data.email) || !pw || pw.length > MAX_PASSWORD_LENGTH * 4) return wrong();
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account?.secret) {
+      await verifyAgainstDummy(pw);
+      return wrong();
+    }
+    const refused = await countSignInAttempt(c, users, account);
+    if (refused) return refused;
+    const { ok, needsRehash } = await verifyPassword(pw, account.secret);
+    if (!ok) return wrong();
+    await users.updateAccount(account.id, {
+      failedAttempts: 0,
+      lockedUntil: 0,
+      ...needsRehash ? { secret: await hashPassword(pw) } : {}
+    });
+    if (!user.emailVerified) {
+      return error(c, 403, "email_unverified", "Please confirm your e-mail address first. We can send the e-mail again.");
+    }
+    return signInAnswer(c, await ctx.secondStep(c, user, ["pwd"], "password"));
+  });
+  app.post("/auth/password/signup", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(ctx, c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const policy = checkPasswordPolicy(data.password, minLength);
+    if (policy) return error(c, 400, "weak_password", policy);
+    const name = nameOf(data.name);
+    const email = data.email.trim();
+    const locale = localeOf(data.locale);
+    const check = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "password" });
+    if (!check.ok) return check.reason === "rejected" ? error(c, 403, "signup_rejected", check.message) : unavailable(c);
+    const passwordHash = await hashPassword(data.password);
+    const existing = await users.findByEmail(normalizeEmail(email));
+    if (existing?.emailVerified && await users.hasAccounts(existing.id)) {
+      return await emails.sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c) : unavailable(c);
+    }
+    if (existing) {
+      if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
+      const account = await users.passwordAccount(existing.id);
+      if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
+      else await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash });
+      await users.updateUser(existing.id, { name });
+      return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
+    }
+    const user = await users.createUser({
+      email,
+      emailNormalized: normalizeEmail(email),
+      name,
+      emailVerified: false,
+      account: (userId) => ({ key: passwordAccountKey(userId), secret: passwordHash })
+    });
+    if (!user) return accepted(c);
+    await ctx.emit("user.created", { user: toMadauthUser(user), method: "password" });
+    return await emails.sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
+  });
+  app.post("/auth/password/send-reset", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(ctx, c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    const locale = localeOf(data.locale);
+    if (user && await users.passwordAccount(user.id)) {
+      if (!await emails.sendLinkEmail(user, "reset", target, locale)) return unavailable(c);
+    } else if (user) {
+      if (!await emails.sendAccountEmail(user, "email.no_password", target, locale)) return unavailable(c);
+    }
+    return accepted(c);
+  });
+  app.post("/auth/password/reset", async (c) => {
+    const data = await body(c);
+    const policy = checkPasswordPolicy(data.password, minLength);
+    if (policy) return error(c, 400, "weak_password", policy);
+    const consumed = await emails.consume(data, "reset");
+    const user = consumed.userId ? await users.findById(consumed.userId) : null;
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account) return emails.invalidVerification(c, consumed);
+    const secret = await hashPassword(data.password);
+    if (!await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 })) return emails.invalidVerification(c, consumed);
+    const sessionVersion = user.sessionVersion + 1;
+    await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
+    await users.clearVerifications(user.id);
+    const reset = { ...user, emailVerified: true, sessionVersion, wrongCodes: 0 };
+    await ctx.emit("email.password_reset", { user: toMadauthUser(reset) });
+    return signInAnswer(c, await ctx.secondStep(c, reset, ["pwd"], "password"));
+  });
+}
+
+// src/routes/totp.ts
+import { deleteCookie as deleteCookie2, getCookie as getCookie2, setCookie as setCookie2 } from "hono/cookie";
+
+// src/totp.ts
+import { createCipheriv, createDecipheriv, createHmac, hkdfSync, randomBytes, randomInt } from "crypto";
+var TOTP_STEP_SECONDS = 30;
+var TOTP_DIGITS = 6;
+var TOTP_WINDOW = 1;
+var RECOVERY_CODES = 10;
+var SECRET_BYTES = 20;
+var BASE32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+var RECOVERY_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+var RECOVERY_CODE_LENGTH = 10;
+var ENCRYPTION_VERSION = "v1";
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+function base32Encode(bytes) {
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (const byte of bytes) {
+    value = (value << 8 | byte) & 65535;
+    bits += 8;
+    while (bits >= 5) {
+      out += BASE32[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) out += BASE32[value << 5 - bits & 31];
+  return out;
+}
+function hotp(secret, counter, digits = TOTP_DIGITS) {
+  const message = Buffer.alloc(8);
+  message.writeBigUInt64BE(BigInt(counter));
+  const digest = createHmac("sha1", secret).update(message).digest();
+  const offset = digest[digest.length - 1] & 15;
+  const binary = (digest[offset] & 127) << 24 | digest[offset + 1] << 16 | digest[offset + 2] << 8 | digest[offset + 3];
+  return (binary % 10 ** digits).toString().padStart(digits, "0");
+}
+function stepOf(nowMs) {
+  return Math.floor(nowMs / 1e3 / TOTP_STEP_SECONDS);
+}
+function totp(secret, step, digits = TOTP_DIGITS) {
+  return hotp(secret, step, digits);
+}
+function verifyTotp(secret, code, nowMs, window = TOTP_WINDOW) {
+  const given = code.replace(/\s/g, "");
+  if (!new RegExp(`^\\d{${TOTP_DIGITS}}$`).test(given)) return null;
+  const now = stepOf(nowMs);
+  let found = null;
+  for (let step = now - window; step <= now + window; step++) {
+    if (safeEqual(totp(secret, step), given) && found === null) found = step;
+  }
+  return found;
+}
+function generateTotpSecret() {
+  return randomBytes(SECRET_BYTES);
+}
+function otpauthUri(options) {
+  const issuer = encodeURIComponent(options.issuer);
+  const account = encodeURIComponent(options.account);
+  const secret = base32Encode(options.secret);
+  return `otpauth://totp/${issuer}:${account}?secret=${secret}&issuer=${issuer}&algorithm=SHA1&digits=${TOTP_DIGITS}&period=${TOTP_STEP_SECONDS}`;
+}
+function deriveTotpKey(signingKeyD) {
+  return Buffer.from(hkdfSync("sha256", Buffer.from(signingKeyD, "base64url"), "", "madauth totp secret", 32));
+}
+function encryptSecret(key, secret) {
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(secret), cipher.final()]);
+  const parts = [iv, encrypted, cipher.getAuthTag()].map((part) => part.toString("base64url"));
+  return [ENCRYPTION_VERSION, ...parts].join(".");
+}
+function decryptSecret(key, stored) {
+  const [version, iv, encrypted, tag, ...rest] = stored.split(".");
+  if (version !== ENCRYPTION_VERSION || !iv || !encrypted || !tag || rest.length) return null;
+  const ivBytes = Buffer.from(iv, "base64url");
+  const tagBytes = Buffer.from(tag, "base64url");
+  if (ivBytes.length !== IV_BYTES || tagBytes.length !== TAG_BYTES) return null;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, ivBytes);
+    decipher.setAuthTag(tagBytes);
+    return Buffer.concat([decipher.update(Buffer.from(encrypted, "base64url")), decipher.final()]);
+  } catch {
+    return null;
+  }
+}
+function generateRecoveryCodes() {
+  const codes = /* @__PURE__ */ new Set();
+  while (codes.size < RECOVERY_CODES) {
+    let code = "";
+    for (let i = 0; i < RECOVERY_CODE_LENGTH; i++) code += RECOVERY_ALPHABET[randomInt(RECOVERY_ALPHABET.length)];
+    codes.add(`${code.slice(0, 5)}-${code.slice(5)}`);
+  }
+  return [...codes];
+}
+function normalizeRecoveryCode(text) {
+  if (typeof text !== "string") return null;
+  const code = text.toLowerCase().replace(/[\s-]/g, "");
+  return code.length === RECOVERY_CODE_LENGTH && [...code].every((char) => RECOVERY_ALPHABET.includes(char)) ? code : null;
+}
+function hashRecoveryCode(codeKey, code) {
+  return hashCode(codeKey, `recovery:${code}`);
+}
+
+// src/routes/totp.ts
+var CHALLENGE_COOKIE = "madauth_challenge";
+var CHALLENGE_TYP = "madauth-challenge+jwt";
+var CHALLENGE_TTL = 10 * 60;
+var SETUP_COOKIE = "madauth_totp_setup";
+var SETUP_TYP = "madauth-totp-setup+jwt";
+var SETUP_TTL = 10 * 60;
+var COOKIE_PATH = "/auth/totp";
+var cookieOptions = (secure) => ({ path: COOKIE_PATH, httpOnly: true, secure, sameSite: "Strict" });
+async function setChallenge(c, ctx, challenge) {
+  const token = await signToken(await ctx.keys, ctx.config.issuer, CHALLENGE_TYP, { ...challenge }, CHALLENGE_TTL);
+  setCookie2(c, CHALLENGE_COOKIE, token, { ...cookieOptions(ctx.secure), maxAge: CHALLENGE_TTL });
+}
+function clearChallenge(c, secure) {
+  deleteCookie2(c, CHALLENGE_COOKIE, cookieOptions(secure));
+}
+async function readChallenge(c, ctx, next) {
+  const claims = await readToken(await ctx.keys, ctx.config.issuer, CHALLENGE_TYP, getCookie2(c, CHALLENGE_COOKIE));
+  return claims && claims.next === next && typeof claims.sub === "string" && Array.isArray(claims.amr) ? claims : null;
+}
+async function checkCode(c, ctx, keys, user, account, data, wrong = () => error(c, 401, "code_invalid", "The code is wrong or was already used.")) {
+  const { users } = ctx;
+  const refused = await countSignInAttempt(c, users, account);
+  if (refused) return refused;
+  if (typeof data.recoveryCode === "string") {
+    const code = normalizeRecoveryCode(data.recoveryCode);
+    if (!code || !await users.consumeRecoveryCode(account, hashRecoveryCode(keys.codeKey, code))) return wrong();
+    await users.updateAccount(account.id, { failedAttempts: 0, lockedUntil: 0 });
+    const remaining = await users.countRecoveryCodes(account);
+    await ctx.emit("totp.recovery_code_used", { user: toMadauthUser(user), remaining });
+    return "recovery_code";
+  }
+  if (typeof data.code !== "string" || !account.secret) return wrong();
+  const secret = decryptSecret(keys.totpKey, account.secret);
+  if (!secret) {
+    console.error(`[madauth] The authenticator secret of user ${user.id} can't be read: was MADAUTH_SIGNING_KEY changed?`);
+    return wrong();
+  }
+  const step = verifyTotp(secret, data.code, Date.now(), TOTP_WINDOW);
+  if (step === null || step <= (account.lastUsedStep ?? 0) || !await users.useTotpStep(account, step)) return wrong();
+  return "totp";
+}
+function totpRoutes(app, ctx, keys) {
+  const { config, secure, users } = ctx;
+  const { issuer } = config;
+  const cookie = cookieOptions(secure);
+  const methodsNow = (c) => ctx.methods(c);
+  app.use(`${COOKIE_PATH}/*`, async (c, next) => {
+    if (!authenticatorOn(ctx.configured, await methodsNow(c))) {
+      return error(c, 403, "method_disabled", "The authenticator app is switched off.");
+    }
+    await next();
+  });
+  const standalone = async (c) => isOn("totp", ctx.configured, await methodsNow(c));
+  const notStandalone = (c) => error(c, 403, "method_disabled", "Signing in with the authenticator app alone is switched off.");
+  const methodStillOn = async (c, challenge) => isOn(challenge.method, ctx.configured, await methodsNow(c));
+  const methodOff = (c) => error(c, 403, "method_disabled", "This way of signing in is switched off.");
+  const signedIn = async (c) => {
+    const user = await ctx.currentUser(c);
+    return user ? users.findById(user.id) : null;
+  };
+  const whoSetsUp = async (c) => {
+    const challenge = await readChallenge(c, ctx, "totp-setup");
+    const waiting = challenge ? await users.findById(challenge.sub) : null;
+    if (challenge && waiting && waiting.sessionVersion === challenge.sv) return { user: waiting, challenge };
+    const user = await signedIn(c);
+    return user ? { user, challenge: null } : null;
+  };
+  const newRecoveryCodes = () => {
+    const recoveryCodes = generateRecoveryCodes();
+    return { recoveryCodes, hashes: recoveryCodes.map((code) => hashRecoveryCode(keys.codeKey, normalizeRecoveryCode(code))) };
+  };
+  const issuerLabel = (c) => {
+    if (config.totpIssuer) return config.totpIssuer;
+    const origin = c.req.header("origin");
+    return URL.canParse(origin ?? "") ? new URL(origin).hostname : new URL(issuer).hostname;
+  };
+  const finishSignIn = async (c, user, challenge, via) => {
+    const result = await ctx.startSession(c, toMadauthUser(user, challenge.profile), [...challenge.amr, "otp"], { sv: user.sessionVersion });
+    await ctx.emit("user.signed_in", { user: result, method: challenge.method, ...challenge.amr.length ? { secondFactor: via } : {} });
+    return result;
+  };
+  app.post(`${COOKIE_PATH}/setup`, async (c) => {
+    const who = await whoSetsUp(c);
+    if (!who) return noSession(c);
+    if (who.challenge && !await methodStillOn(c, who.challenge)) return methodOff(c);
+    const existing = await users.totpAccount(who.user.id);
+    let approved;
+    if (existing) {
+      const previous = await readToken(await ctx.keys, issuer, SETUP_TYP, getCookie2(c, SETUP_COOKIE));
+      const holds = previous?.sub === who.user.id && typeof previous.approved === "number" && Date.now() - previous.approved < SETUP_TTL * 1e3;
+      if (holds) {
+        approved = previous.approved;
+      } else {
+        const data = await body(c);
+        if (data.code === void 0 && data.recoveryCode === void 0) {
+          return error(c, 401, "code_required", "Enter a code from your current authenticator app (or a recovery code) to replace it.");
+        }
+        const via = await checkCode(c, ctx, keys, who.user, existing, data);
+        if (via instanceof Response) return via;
+        approved = Date.now();
+      }
+    }
+    const secret = generateTotpSecret();
+    const claims = {
+      sub: who.user.id,
+      setup: newId("tsu"),
+      secret: encryptSecret(keys.totpKey, secret),
+      ...existing ? { replaces: existing.setupId } : {},
+      ...approved ? { approved } : {}
+    };
+    const token = await signToken(await ctx.keys, issuer, SETUP_TYP, claims, SETUP_TTL);
+    setCookie2(c, SETUP_COOKIE, token, { ...cookie, maxAge: SETUP_TTL });
+    return c.json({ secret: base32Encode(secret), uri: otpauthUri({ issuer: issuerLabel(c), account: who.user.email, secret }) });
+  });
+  app.post(`${COOKIE_PATH}/confirm`, async (c) => {
+    const who = await whoSetsUp(c);
+    if (!who) return noSession(c);
+    const { user, challenge } = who;
+    if (challenge && !await methodStillOn(c, challenge)) return methodOff(c);
+    const data = await body(c);
+    const setup = await readToken(await ctx.keys, issuer, SETUP_TYP, getCookie2(c, SETUP_COOKIE));
+    const secret = setup && setup.sub === user.id && typeof setup.secret === "string" && typeof setup.setup === "string" ? decryptSecret(keys.totpKey, setup.secret) : null;
+    if (!setup || !secret) return error(c, 400, "setup_expired", "The setup has expired or was started in another browser. Please start again.");
+    const step = typeof data.code === "string" ? verifyTotp(secret, data.code, Date.now(), TOTP_WINDOW) : null;
+    if (step === null) return error(c, 400, "code_invalid", "The code is wrong. Enter the current code from the app.");
+    const { recoveryCodes, hashes } = newRecoveryCodes();
+    await users.addRecoveryCodes(user.id, setup.setup, hashes);
+    const patch = { secret: setup.secret, setupId: setup.setup, failedAttempts: 0, lockedUntil: 0, lastUsedStep: step };
+    const current = setup.replaces === void 0 ? null : await users.totpAccount(user.id);
+    const written = setup.replaces === void 0 ? !!await users.linkAccount(user.id, { key: totpAccountKey(user.id), ...patch }) : !!current && await users.confirmTotpSetup(current.id, setup.replaces, patch);
+    if (!written) {
+      await users.clearRecoveryCodes(user.id, { only: setup.setup });
+      deleteCookie2(c, SETUP_COOKIE, cookie);
+      return error(c, 400, "setup_expired", "Your authenticator app was set up or removed elsewhere meanwhile. Please start again.");
+    }
+    await users.clearRecoveryCodes(user.id, { except: setup.setup });
+    deleteCookie2(c, SETUP_COOKIE, cookie);
+    await ctx.emit("totp.enabled", { user: toMadauthUser(user) });
+    if (!challenge) return c.json({ recoveryCodes });
+    const result = await finishSignIn(c, user, challenge, "totp");
+    return c.json({ user: result, recoveryCodes });
+  });
+  app.post(`${COOKIE_PATH}/verify`, async (c) => {
+    const expired = () => error(c, 401, "challenge_expired", "The sign-in has expired. Please sign in again.");
+    const challenge = await readChallenge(c, ctx, "totp");
+    if (!challenge) return expired();
+    if (!await methodStillOn(c, challenge)) return methodOff(c);
+    const user = await users.findById(challenge.sub);
+    const account = user && user.sessionVersion === challenge.sv ? await users.totpAccount(user.id) : null;
+    if (!user || !account) return expired();
+    const via = await checkCode(c, ctx, keys, user, account, await body(c));
+    if (via instanceof Response) return via;
+    return c.json({ user: await finishSignIn(c, user, challenge, via) });
+  });
+  app.post(`${COOKIE_PATH}/signin`, async (c) => {
+    if (!await standalone(c)) return notStandalone(c);
+    const data = await body(c);
+    const wrong = () => error(c, 401, "invalid_credentials", "E-mail or code is wrong.");
+    if (!isValidEmail(data.email)) return wrong();
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    const account = user ? await users.totpAccount(user.id) : null;
+    if (!user || !user.emailVerified || !account?.secret) return wrong();
+    const via = await checkCode(c, ctx, keys, user, account, data, wrong);
+    if (via instanceof Response) return via;
+    const result = await ctx.startSession(c, toMadauthUser(user), ["otp"], { sv: user.sessionVersion });
+    await ctx.emit("user.signed_in", { user: result, method: "totp" });
+    return c.json({ user: result });
+  });
+  app.post(`${COOKIE_PATH}/remove`, async (c) => {
+    const user = await signedIn(c);
+    if (!user) return noSession(c);
+    const methods = await methodsNow(c);
+    const required = METHODS_WITH_SECOND_FACTOR.filter((method) => isOn(method, ctx.configured, methods) && policyOf(method, methods) === "required");
+    if (required.length) {
+      const names = required.map((method) => method === "google" ? "Google" : "e-mail & password");
+      return error(c, 403, "required_by_policy", `Signing in with ${names.join(" and ")} requires the authenticator app, so it can't be removed.`);
+    }
+    const account = await users.totpAccount(user.id);
+    if (!account) return c.json({});
+    if (!(await users.signInMethods(user.id, methods)).some((method) => method !== "totp" && isOn(method, ctx.configured, methods))) {
+      return error(c, 403, "only_method", "The authenticator app is the only way you sign in, so it can't be removed. Delete your account instead.");
+    }
+    const via = await checkCode(c, ctx, keys, user, account, await body(c));
+    if (via instanceof Response) return via;
+    await users.removeTotp(user.id);
+    await ctx.emit("totp.disabled", { user: toMadauthUser(user) });
+    return c.json({});
+  });
+  app.post(`${COOKIE_PATH}/recovery-codes`, async (c) => {
+    const user = await signedIn(c);
+    if (!user) return noSession(c);
+    const account = await users.totpAccount(user.id);
+    if (!account) return error(c, 400, "no_authenticator", "No authenticator app is set up.");
+    const via = await checkCode(c, ctx, keys, user, account, await body(c));
+    if (via instanceof Response) return via;
+    const { recoveryCodes, hashes } = newRecoveryCodes();
+    await users.replaceRecoveryCodes(account, hashes);
+    return c.json({ recoveryCodes });
+  });
+  app.get(`${COOKIE_PATH}/status`, async (c) => {
+    const user = await signedIn(c);
+    if (!user) return noSession(c);
+    const account = await users.totpAccount(user.id);
+    return c.json({ enabled: !!account, recoveryCodesLeft: account ? await users.countRecoveryCodes(account) : 0 });
+  });
+  if (ctx.webhook && ctx.emailVerification) {
+    const emails = createEmails(ctx, users, ctx.webhook);
+    app.post(`${COOKIE_PATH}/signup`, async (c) => {
+      if (!await standalone(c)) return notStandalone(c);
+      const data = await body(c);
+      const target = redirectTarget(ctx, c, data.redirectTo);
+      if (target instanceof Response) return target;
+      if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+      const name = nameOf(data.name);
+      const email = data.email.trim();
+      const locale = localeOf(data.locale);
+      const check = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "totp" });
+      if (!check.ok) return check.reason === "rejected" ? error(c, 403, "signup_rejected", check.message) : unavailable(c);
+      const existing = await users.findByEmail(normalizeEmail(email));
+      if (existing?.emailVerified && await users.hasAccounts(existing.id)) {
+        return await emails.sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c) : unavailable(c);
+      }
+      if (existing) {
+        if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
+        if (!existing.emailVerified) await users.unlinkAccount(passwordAccountKey(existing.id));
+        await users.updateUser(existing.id, { name });
+        return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
+      }
+      const user = await users.createUser({ email, emailNormalized: normalizeEmail(email), name, emailVerified: false });
+      if (!user) return accepted(c);
+      await ctx.emit("user.created", { user: toMadauthUser(user), method: "totp" });
+      return await emails.sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
+    });
+  }
+}
+
+// src/app.ts
+var EVENT_TIMEOUT_MS = 5e3;
+function createApp(config) {
+  const { issuer, allowedOrigins, sessionTtlSeconds, renewalTtlSeconds, cookieDomain } = config;
+  const keys = importSigningKeys(config.signingKey);
+  const secure = issuer.startsWith("https:");
+  const isAllowedOrigin = (origin) => !!origin && allowedOrigins.includes(origin);
+  const codeKey = deriveCodeKey(config.signingKey.d);
+  const users = new Users(config.store, codeKey);
+  const methods = methodConfig(config);
+  const settings = new Settings(config.store, initialMethods(methods));
+  const configured = (method) => isConfigured(methods, method);
+  const signsUp = (method) => canSignUp(methods, method);
+  const emailVerification = sendsVerificationEmails(config);
+  const totpKeys = { totpKey: deriveTotpKey(config.signingKey.d), codeKey };
+  const issueSession = async (c, user, amr, extra) => {
+    const signingKeys = await keys;
+    const [sessionToken, renewalToken] = await Promise.all([
+      signSession(signingKeys, issuer, sessionTtlSeconds, user, amr, extra),
+      signRenewal(signingKeys, issuer, renewalTtlSeconds, user, amr, extra)
+    ]);
+    setCookie3(c, SESSION_COOKIE, sessionToken, {
+      path: "/",
+      domain: cookieDomain,
+      httpOnly: true,
+      secure,
+      sameSite: "Lax",
+      maxAge: sessionTtlSeconds
+    });
+    setCookie3(c, RENEWAL_COOKIE, renewalToken, {
+      path: "/auth",
+      httpOnly: true,
+      secure,
+      sameSite: "Lax",
+      maxAge: renewalTtlSeconds
+    });
+    setCookie3(c, EXPIRY_COOKIE, String(Math.floor(Date.now() / 1e3) + sessionTtlSeconds), {
+      path: "/",
+      domain: cookieDomain,
+      secure,
+      sameSite: "Lax",
+      maxAge: renewalTtlSeconds
+    });
+  };
+  const clearSession = (c) => {
+    deleteCookie3(c, SESSION_COOKIE, { path: "/", domain: cookieDomain, secure });
+    deleteCookie3(c, RENEWAL_COOKIE, { path: "/auth", secure });
+    deleteCookie3(c, EXPIRY_COOKIE, { path: "/", domain: cookieDomain, secure });
+  };
+  const tokenClaims = async (c, cookie, typ) => readToken(await keys, issuer, typ, getCookie3(c, cookie));
+  const checked = async (claims) => {
+    const stored = await users.findById(claims.sub);
+    if (!stored || stored.sessionVersion !== claims.sv) return null;
+    const { claims: _, ...user } = userFromClaims(claims);
+    const current = claimsFromJson(stored.claims);
+    return Object.keys(current).length ? { ...user, claims: current } : user;
+  };
+  const currentSession = async (c) => {
+    const session = await tokenClaims(c, SESSION_COOKIE, SESSION_TYP);
+    const user = session ? await checked(session) : null;
+    const upToDate = session && user && sameClaims(user.claims, session.claims) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
+    if (upToDate) return user;
+    const renewal = await tokenClaims(c, RENEWAL_COOKIE, RENEWAL_TYP);
+    const sameSignIn = session && user && renewal && renewal.sub === session.sub && renewal.sv === session.sv && renewal.email === session.email;
+    const renewed = sameSignIn ? user : renewal ? await checked(renewal) : null;
+    if (renewal && renewed) {
+      await issueSession(c, renewed, renewal.amr, { sv: renewal.sv });
+      return renewed;
+    }
+    return user;
+  };
+  const methodsOf = /* @__PURE__ */ new WeakMap();
+  const ctx = {
+    config,
+    keys,
+    secure,
+    isAllowedOrigin,
+    allowedUrl(value) {
+      let url;
+      try {
+        url = new URL(typeof value === "string" ? value : "");
+      } catch {
+        return null;
+      }
+      if (!isAllowedOrigin(url.origin)) return null;
+      url.hash = "";
+      return url;
+    },
+    async startSession(c, user, amr, extra) {
+      clearChallenge(c, secure);
+      await issueSession(c, user, amr, extra);
+      return { ...user, amr };
+    },
+    async secondStep(c, user, amr, method, profile) {
+      const methods2 = await this.methods(c);
+      if (!isOn(method, configured, methods2)) return { disabled: true };
+      const enrolled = await users.totpAccount(user.id);
+      const policy = method === "totp" ? "required" : policyOf(method, methods2);
+      const next = policy === "none" ? null : enrolled ? "totp" : policy === "required" ? "totp-setup" : null;
+      if (next) {
+        clearSession(c);
+        const known = { ...profile?.name ? { name: profile.name } : {}, ...profile?.picture ? { picture: profile.picture } : {} };
+        await setChallenge(c, this, { sub: user.id, sv: user.sessionVersion, amr, method, next, ...Object.keys(known).length ? { profile: known } : {} });
+        return { next, method };
+      }
+      const result = await this.startSession(c, toMadauthUser(user, profile), amr, { sv: user.sessionVersion });
+      await this.emit("user.signed_in", { user: result, method });
+      return { user: result };
+    },
+    currentUser: currentSession,
+    users,
+    settings,
+    webhook: config.webhook ? createWebhookClient(config.webhook, config.webhookFetch) : void 0,
+    configured,
+    emailVerification,
+    methods(c) {
+      let reading = methodsOf.get(c.req.raw);
+      if (!reading) {
+        reading = settings.methods();
+        methodsOf.set(c.req.raw, reading);
+      }
+      return reading;
+    },
+    async enabled(c, method) {
+      return isOn(method, configured, await this.methods(c));
+    },
+    async checkSignup(data) {
+      if (!this.webhook?.wants("signup.before")) return { ok: true };
+      const check = await this.webhook.call("signup.before", data, WEBHOOK_TIMEOUT_MS);
+      if (!check.ok) {
+        console.error(`[madauth] Webhook "signup.before" failed: ${check.reason}`);
+        return { ok: false, reason: "unavailable" };
+      }
+      const answer = check.body;
+      if (answer?.allow === false) {
+        const message = typeof answer.message === "string" && answer.message ? answer.message : "Sign-up is not possible with this e-mail address.";
+        return { ok: false, reason: "rejected", message };
+      }
+      return { ok: true };
+    },
+    async emit(type, data) {
+      if (!this.webhook?.wants(type)) return;
+      const user = data.user;
+      const payload = user && typeof user === "object" && "amr" in user ? { ...data, user: { ...user, amr: void 0 } } : data;
+      const result = await this.webhook.call(type, payload, EVENT_TIMEOUT_MS);
+      if (!result.ok) console.error(`[madauth] Webhook "${type}" failed: ${result.reason}`);
+    }
+  };
+  const app = new Hono();
+  app.use(
+    "/auth/*",
+    cors({
+      origin: (origin) => isAllowedOrigin(origin) ? origin : null,
+      credentials: true,
+      allowMethods: ["GET", "POST"],
+      allowHeaders: ["Content-Type"],
+      maxAge: 600
+    })
+  );
+  app.use("/auth/*", async (c, next) => {
+    if (c.req.method === "POST" && !isAllowedOrigin(c.req.header("origin"))) {
+      return c.json({ error: "forbidden_origin" }, 403);
+    }
+    await next();
+  });
+  app.get("/health", (c) => c.text("ok"));
+  app.get("/.well-known/jwks.json", async (c) => {
+    const { publicJwk } = await keys;
+    c.header("Cache-Control", "public, max-age=3600");
+    return c.json({ keys: [publicJwk] });
+  });
+  app.get("/auth/config", async (c) => {
+    const current = await ctx.methods(c);
+    const on = (method) => isOn(method, configured, current);
+    return c.json({
+      google: on("google") ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret, secondFactor: policyOf("google", current) } : null,
+      password: on("password") ? { minLength: config.password.minLength, secondFactor: policyOf("password", current) } : null,
+      // The app can be set up when it is in use at all; `signIn` says whether it signs in on its own.
+      totp: authenticatorOn(configured, current) ? { signIn: on("totp"), signUp: on("totp") && emailVerification } : null,
+      email: { verification: emailVerification }
+    });
+  });
+  if (emailVerification && ctx.webhook) emailRoutes(app, ctx, users, ctx.webhook);
+  if (config.google) googleRoutes(app, ctx, config.google);
+  if (config.password && ctx.webhook) passwordRoutes(app, ctx, config.password, users, ctx.webhook);
+  totpRoutes(app, ctx, totpKeys);
+  app.get("/auth/session", async (c) => {
+    const user = await currentSession(c);
+    if (!user) {
+      clearSession(c);
+      return c.json({ error: "no_session" }, 401);
+    }
+    return c.json({ user });
+  });
+  app.post("/auth/logout", (c) => {
+    clearSession(c);
+    clearChallenge(c, secure);
+    return c.body(null, 204);
+  });
+  app.post("/auth/account/delete", async (c) => {
+    const user = await currentSession(c);
+    if (!user) return c.json({ error: "no_session" }, 401);
+    const stored = await users.findById(user.id);
+    const protects = stored && authenticatorOn(configured, await ctx.methods(c));
+    const authenticator = protects ? await users.totpAccount(user.id) : null;
+    if (stored && authenticator) {
+      const data = await body(c);
+      if (data.code === void 0 && data.recoveryCode === void 0) {
+        return error(c, 401, "code_required", "Enter a code from your authenticator app (or a recovery code) to delete your account.");
+      }
+      const via = await checkCode(c, ctx, totpKeys, stored, authenticator, data);
+      if (via instanceof Response) return via;
+    }
+    await users.deleteById(user.id);
+    clearSession(c);
+    await ctx.emit("user.deleted", { user });
+    return c.body(null, 204);
+  });
+  const admin = async (c) => {
+    const user = await currentSession(c);
+    if (!user) return { answer: c.json({ error: "no_session" }, 401) };
+    const email = user.email ? normalizeEmail(user.email) : void 0;
+    if (!email || !isAdmin(user)) {
+      const message = `Only users with the role "${ADMIN_ROLE}" can manage claims and settings.`;
+      return { answer: c.json({ error: "forbidden", message }, 403) };
+    }
+    return { email };
+  };
+  const invalidEmail = (c) => c.json({ error: "invalid_email", message: "This is not a valid e-mail address." }, 400);
+  const noUser = (c) => c.json({ error: "user_not_found", message: "No user has this e-mail address." }, 404);
+  app.post("/auth/admin/claims/get", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    if (!isValidEmail(data.email)) return invalidEmail(c);
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c);
+    return c.json({ email: user.emailNormalized, userId: user.id, claims: claimsFromJson(user.claims) });
+  });
+  app.post("/auth/admin/claims/set", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    if (!isValidEmail(data.email)) return invalidEmail(c);
+    const claims = parseClaims(data.claims);
+    if (!claims) {
+      return c.json(
+        {
+          error: "invalid_claims",
+          message: 'claims must be a JSON object of at most 2048 characters whose keys are names (letters, digits and "_", starting with a letter). "roles" must be a list of names of lower-case letters, digits, "-" and "_".'
+        },
+        400
+      );
+    }
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c);
+    await users.updateUser(user.id, { claims: Object.keys(claims).length ? JSON.stringify(claims) : null });
+    const email = user.emailNormalized;
+    await ctx.emit("user.claims_changed", { userId: user.id, email, claims, by: caller.email });
+    return c.json({ email, userId: user.id, claims });
+  });
+  const settingsAnswer = (methods2) => ({
+    methods: Object.fromEntries(
+      SIGN_IN_METHODS.map((method) => [
+        method,
+        {
+          configured: configured(method),
+          enabled: isOn(method, configured, methods2),
+          ...method === "totp" ? {} : { secondFactor: policyOf(method, methods2) }
+        }
+      ])
+    )
+  });
+  app.post("/auth/admin/settings/get", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    return c.json(settingsAnswer(await settings.methods()));
+  });
+  app.post("/auth/admin/settings/set", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    const invalid = (message) => c.json({ error: "invalid_settings", message }, 400);
+    const next = parseMethodSettings(data.methods, { booleans: true });
+    if (!next) {
+      return invalid(
+        `methods must list the sign-in methods that are on (${SIGN_IN_METHODS.join(", ")}), each as true, {} or { "secondFactor": "none" | "optional" | "required" } (google and password), e.g. { "google": {}, "password": { "secondFactor": "optional" } }. A method that is not listed is off.`
+      );
+    }
+    const methods2 = await settings.changeMethods(() => anyOn(signsUp, next) ? next : null, caller.email);
+    if (!methods2) return invalid("At least one sign-in method that creates users must stay on: Google, e-mail & password, or the authenticator app with sign-up by e-mail.");
+    return c.json(settingsAnswer(methods2));
+  });
+  app.post("/auth/admin/totp/remove", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    if (!isValidEmail(data.email)) return invalidEmail(c);
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c);
+    const removed = await users.removeTotp(user.id);
+    if (removed) await ctx.emit("totp.disabled", { user: toMadauthUser(user), by: caller.email });
+    return c.json({ email: user.emailNormalized, userId: user.id, enabled: false });
+  });
+  return app;
+}
+
+export {
+  REDIRECT_ERROR_PARAM,
+  createApp
+};