@madauth/server 0.3.0-beta.2 → 0.5.0-beta.1

package/dist/chunk-NYIEFI4B.js

@@ -0,0 +1,1040 @@
+import {
+  assertPrivateSigningJwk,
+  generateSigningKey
+} from "./chunk-JDQLSL36.js";
+import {
+  DEV_WEBHOOK_RECEIVER_URL,
+  REQUIRED_EMAIL_TYPES,
+  WEBHOOK_TYPES,
+  checkWebhookSecret,
+  generateWebhookSecret
+} from "./chunk-SISM7YUZ.js";
+
+// src/claims.ts
+var ADMIN_ROLE = "admin";
+var MAX_ROLES = 20;
+var MAX_CLAIMS_LENGTH = 2048;
+var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+var CLAIM_NAME = /^[a-zA-Z][a-zA-Z0-9_]{0,63}$/;
+function parseRoles(input) {
+  if (!Array.isArray(input)) return null;
+  if (!input.every((role) => typeof role === "string" && ROLE_NAME.test(role))) return null;
+  const roles = [...new Set(input)].sort();
+  return roles.length <= MAX_ROLES ? roles : null;
+}
+function parseClaims(input) {
+  if (!isJsonObject(input)) return null;
+  const claims = {};
+  for (const key of Object.keys(input).sort()) {
+    const value = input[key];
+    if (!CLAIM_NAME.test(key) || !isJsonValue(value)) return null;
+    if (key === "roles") {
+      const roles = parseRoles(value);
+      if (!roles) return null;
+      claims[key] = roles;
+    } else {
+      claims[key] = value;
+    }
+  }
+  return JSON.stringify(claims).length <= MAX_CLAIMS_LENGTH ? claims : null;
+}
+function isJsonObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isJsonValue(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+  if (typeof value === "number") return Number.isFinite(value);
+  if (Array.isArray(value)) return value.every(isJsonValue);
+  return isJsonObject(value) && Object.values(value).every(isJsonValue);
+}
+function sameClaims(a, b) {
+  return JSON.stringify(a ?? {}) === JSON.stringify(b ?? {});
+}
+function claimsFromJson(json) {
+  if (!json) return {};
+  try {
+    const parsed = JSON.parse(json);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function rolesOf(user) {
+  const roles = user.claims?.roles;
+  return Array.isArray(roles) ? roles.filter((role) => typeof role === "string") : [];
+}
+function isAdmin(user) {
+  return rolesOf(user).includes(ADMIN_ROLE);
+}
+
+// src/config.ts
+function sendsVerificationEmails(config) {
+  return !!config.webhook?.events.has("email.send_verification");
+}
+function sendsSignInEmails(config) {
+  return !!config.webhook?.events.has("email.send_signin_link");
+}
+function sendsSms(config) {
+  return !!config.webhook?.events.has("sms.send_code");
+}
+function methodConfig(config) {
+  return {
+    google: config.google,
+    github: config.github,
+    password: config.password,
+    emailVerification: sendsVerificationEmails(config),
+    emailLink: sendsSignInEmails(config),
+    sms: sendsSms(config)
+  };
+}
+var envVars = {
+  MADAUTH_ISSUER: true,
+  MADAUTH_SIGNING_KEY: true,
+  ALLOWED_ORIGINS: true,
+  GOOGLE_CLIENT_ID: false,
+  GOOGLE_CLIENT_SECRET: false,
+  GITHUB_CLIENT_ID: false,
+  GITHUB_CLIENT_SECRET: false,
+  DATABASE_URL: true,
+  TOTP_ISSUER: false,
+  WEBHOOK_URL: false,
+  WEBHOOK_SECRET: false,
+  WEBHOOK_EVENTS: false,
+  SESSION_TTL: false,
+  SESSION_RENEWAL_TTL: false,
+  COOKIE_DOMAIN: false
+};
+async function resolveEnv(source = process.env) {
+  return typeof source === "function" ? source() : source;
+}
+var DEFAULT_SESSION_TTL = 8 * 60 * 60;
+var DEFAULT_RENEWAL_TTL = 30 * 24 * 60 * 60;
+var ConfigError = class extends Error {
+  constructor() {
+    super(...arguments);
+    this.name = "ConfigError";
+  }
+};
+function parseOrigin(name, value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new ConfigError(`${name}: "${value}" is not a URL.`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new ConfigError(`${name}: "${value}" must be an http(s) URL.`);
+  }
+  return url.origin;
+}
+function readEnv(env, name) {
+  return env[name]?.trim().replace(/^(['"])(.*)\1$/s, "$2").trim() || void 0;
+}
+async function loadConfig(env, overrides = {}) {
+  const read = (name) => readEnv(env, name);
+  const require2 = (name) => {
+    const value = read(name);
+    if (!value) throw new ConfigError(`${name} is not set. See docs/server.md.`);
+    return value;
+  };
+  if (env.PASSWORD_MIN_LENGTH?.trim()) {
+    throw new ConfigError(
+      `PASSWORD_MIN_LENGTH was removed: the password rules are a setting now (default: at least 8 characters). Remove the variable and set the rules with \`npx @madauth/server set-password-rules min-length=${env.PASSWORD_MIN_LENGTH.trim()}\` or Madauth.admin.setSettings. See docs/upgrading.md.`
+    );
+  }
+  const issuerValue = require2("MADAUTH_ISSUER");
+  parseOrigin("MADAUTH_ISSUER", issuerValue);
+  const issuer = issuerValue.replace(/\/+$/, "");
+  const keyValue = read("MADAUTH_SIGNING_KEY");
+  if (!keyValue) {
+    const key = await generateSigningKey();
+    throw new ConfigError(
+      `MADAUTH_SIGNING_KEY is not set. Here is a newly generated key you can use (keep it secret and use the same key on every instance):
+
+MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
+`
+    );
+  }
+  let signingKey;
+  try {
+    signingKey = JSON.parse(keyValue);
+    assertPrivateSigningJwk(signingKey);
+  } catch (e) {
+    const reason = e instanceof SyntaxError ? "is not valid JSON" : e.message;
+    throw new ConfigError(`MADAUTH_SIGNING_KEY ${reason}. Generate one with: npx @madauth/server generate-key`);
+  }
+  const allowedOrigins = require2("ALLOWED_ORIGINS").split(",").map((o) => o.trim()).filter(Boolean).map((o) => parseOrigin("ALLOWED_ORIGINS", o));
+  const clientId = read("GOOGLE_CLIENT_ID");
+  if (clientId && !clientId.endsWith(".apps.googleusercontent.com")) {
+    throw new ConfigError(`GOOGLE_CLIENT_ID must end with ".apps.googleusercontent.com" but is "${clientId}".`);
+  }
+  const githubClientId = read("GITHUB_CLIENT_ID");
+  const githubClientSecret = read("GITHUB_CLIENT_SECRET");
+  if (githubClientId && !githubClientSecret) {
+    throw new ConfigError(
+      "GITHUB_CLIENT_ID needs GITHUB_CLIENT_SECRET: GitHub only has the redirect flow, in which the server exchanges the code. Set both from your OAuth App at https://github.com/settings/developers."
+    );
+  }
+  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
+  const sendsEmails = !!webhook && REQUIRED_EMAIL_TYPES.every((type) => webhook.events.has(type));
+  const password = sendsEmails ? {} : void 0;
+  const emailVerification = !!webhook && webhook.events.has("email.send_verification");
+  const emailLink = !!webhook && webhook.events.has("email.send_signin_link");
+  if (!clientId && !githubClientId && !password && !emailVerification && !emailLink) {
+    throw new ConfigError(
+      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET for GitHub sign-in, and/or a webhook that sends the e-mails: e-mail & password sign-in needs email.send_verification and email.send_password_reset, the passwordless e-mail link needs email.send_signin_link, sign-up with the authenticator app needs email.send_verification. For development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.send_signin_link,email.send_already_registered,email.send_password_reset_no_password. See docs/server.md.`
+    );
+  }
+  const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
+  if (!store) {
+    throw new ConfigError(
+      "DATABASE_URL is not set. madAuth stores every user, whichever way they sign in: set e.g. DATABASE_URL=sqlite:./madauth.db or DATABASE_URL=dynamodb:<table>. See docs/server.md."
+    );
+  }
+  const ttlValue = read("SESSION_TTL");
+  const sessionTtlSeconds = ttlValue ? Number(ttlValue) : DEFAULT_SESSION_TTL;
+  if (!Number.isInteger(sessionTtlSeconds) || sessionTtlSeconds < 60) {
+    throw new ConfigError(`SESSION_TTL must be a whole number of seconds (at least 60) but is "${ttlValue}".`);
+  }
+  const renewalValue = read("SESSION_RENEWAL_TTL");
+  const renewalTtlSeconds = renewalValue ? Number(renewalValue) : Math.max(DEFAULT_RENEWAL_TTL, sessionTtlSeconds);
+  if (!Number.isInteger(renewalTtlSeconds) || renewalTtlSeconds < sessionTtlSeconds) {
+    throw new ConfigError(
+      `SESSION_RENEWAL_TTL must be a whole number of seconds, not less than SESSION_TTL (${sessionTtlSeconds}), but is "${renewalValue}".`
+    );
+  }
+  return {
+    issuer,
+    signingKey,
+    allowedOrigins,
+    sessionTtlSeconds,
+    renewalTtlSeconds,
+    cookieDomain: read("COOKIE_DOMAIN"),
+    totpIssuer: read("TOTP_ISSUER"),
+    google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
+    github: githubClientId && githubClientSecret ? { clientId: githubClientId, clientSecret: githubClientSecret } : void 0,
+    store,
+    password,
+    webhook
+  };
+}
+async function loadStore(env) {
+  const store = await storeFromDatabaseUrl(readEnv(env, "DATABASE_URL"));
+  if (!store) throw new ConfigError("Set DATABASE_URL to manage users.");
+  return store;
+}
+async function storeFromDatabaseUrl(url) {
+  if (!url) return void 0;
+  if (url.startsWith("dynamodb:")) return dynamoDbStore(url.slice("dynamodb:".length));
+  if (!url.startsWith("sqlite:")) {
+    throw new ConfigError(
+      `DATABASE_URL must start with "sqlite:" (e.g. sqlite:/data/madauth.db) or "dynamodb:" (e.g. dynamodb:madauth) but is "${url}". For other databases, pass your own store adapter (see "Custom store adapter" in docs/server.md).`
+    );
+  }
+  const path = url.slice("sqlite:".length);
+  if (!path) throw new ConfigError("DATABASE_URL needs a file path, e.g. sqlite:/data/madauth.db");
+  const { createSqliteAdapter } = await import("./sqlite.js");
+  try {
+    return createSqliteAdapter(path);
+  } catch (e) {
+    throw new ConfigError(`DATABASE_URL: could not open "${path}": ${e.message}`);
+  }
+}
+async function dynamoDbStore(tableName) {
+  if (!tableName) throw new ConfigError("DATABASE_URL needs a table name, e.g. dynamodb:madauth");
+  if (!/^[\w.-]{3,255}$/.test(tableName)) {
+    throw new ConfigError(
+      `DATABASE_URL=dynamodb: needs a DynamoDB table name (3 to 255 letters, digits, _ . -) but has "${tableName}"`
+    );
+  }
+  try {
+    await import("@aws-sdk/client-dynamodb");
+  } catch (e) {
+    throw new ConfigError(
+      `DATABASE_URL=dynamodb: needs the AWS SDK. Install it next to madAuth: npm install @aws-sdk/client-dynamodb (${e.message})`
+    );
+  }
+  const { createDynamoDbAdapter } = await import("./dynamodb.js");
+  return createDynamoDbAdapter({ tableName });
+}
+var RENAMED_TYPES = {
+  "password.reset": "user.password_reset",
+  "roles.changed": "user.claims_changed",
+  "email.verify": "email.send_verification",
+  "email.reset": "email.send_password_reset",
+  "email.signin": "email.send_signin_link",
+  "email.already_registered": "email.send_already_registered",
+  "email.no_password": "email.send_password_reset_no_password",
+  "sms.code": "sms.send_code",
+  "signup.before": "user.signing_up",
+  "email.verified": "user.email_verified",
+  "email.password_reset": "user.password_reset",
+  "totp.enabled": 'user.second_factor_enabled (with method "totp")',
+  "totp.disabled": 'user.second_factor_disabled (with method "totp")',
+  "sms.enabled": 'user.second_factor_enabled (with method "sms")',
+  "sms.disabled": 'user.second_factor_disabled (with method "sms")',
+  "totp.recovery_code_used": "user.recovery_code_used"
+};
+var REMOVED_TYPES = {
+  "user.created": "user.created is gone: user.signed_up tells when a user can sign in (an unconfirmed sign-up is no user yet)"
+};
+var LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]", "host.docker.internal"];
+function webhookFromEnv(url, secret, events) {
+  if (!url) {
+    if (secret || events) throw new ConfigError("WEBHOOK_SECRET and WEBHOOK_EVENTS need WEBHOOK_URL.");
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new ConfigError(`WEBHOOK_URL: "${url}" is not a URL.`);
+  }
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && LOCAL_HOSTS.includes(parsed.hostname))) {
+    throw new ConfigError(`WEBHOOK_URL must be an https URL (http only for localhost) but is "${url}".`);
+  }
+  if (!secret) {
+    throw new ConfigError(
+      `WEBHOOK_SECRET is not set. Here is a newly generated secret you can use (keep it secret; your webhook receiver needs the same one):
+
+WEBHOOK_SECRET=${generateWebhookSecret()}
+`
+    );
+  }
+  const problem = checkWebhookSecret(secret);
+  if (problem) {
+    throw new ConfigError(`WEBHOOK_SECRET ${problem}. Generate one with: npx @madauth/server generate-webhook-secret`);
+  }
+  const selected = new Set((events ?? "").split(",").map((e) => e.trim()).filter(Boolean));
+  const allTypes = `All types: ${WEBHOOK_TYPES.join(", ")}. See "Webhooks" in docs/server.md.`;
+  if (!selected.size) {
+    throw new ConfigError(
+      `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}, the passwordless e-mail link when they include email.send_signin_link. For a receiver that sends the e-mails:
+
+WEBHOOK_EVENTS=email.send_verification,email.send_password_reset,email.send_signin_link,email.send_already_registered,email.send_password_reset_no_password
+
+SMS codes as a second factor need a receiver that sends the SMS: add sms.send_code,user.second_factor_enabled,user.second_factor_disabled. For one that only wants to know who signed in:
+
+WEBHOOK_EVENTS=user.signed_in
+
+` + allTypes
+    );
+  }
+  const unknown = [...selected].filter((e) => !WEBHOOK_TYPES.includes(e));
+  if (unknown.length) {
+    const renamed = unknown.flatMap((e) => e in RENAMED_TYPES ? [`${e} is now ${RENAMED_TYPES[e]}`] : e in REMOVED_TYPES ? [REMOVED_TYPES[e]] : []);
+    throw new ConfigError(
+      `WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. ${renamed.length ? `${renamed.join("; ")}. ` : ""}Known types: ${WEBHOOK_TYPES.join(", ")}.`
+    );
+  }
+  return { url: parsed.href, secret, events: selected };
+}
+
+// src/settings.ts
+var SIGN_IN_METHODS = ["google", "github", "password", "totp", "email-link"];
+var METHODS = [...SIGN_IN_METHODS, "sms"];
+var METHODS_WITH_SECOND_FACTOR = ["google", "github", "password", "email-link"];
+var SECOND_FACTOR_POLICIES = ["none", "optional", "required"];
+var METHODS_SETTING = "methods";
+var PASSWORD_SETTING = "password";
+var DEFAULT_PASSWORD_RULES = { minLength: 8, minScore: 2 };
+var MAX_MIN_LENGTH = 128;
+var isPasswordScore = (value) => Number.isInteger(value) && value >= 0 && value <= 4;
+function parsePasswordRules(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const { minLength = DEFAULT_PASSWORD_RULES.minLength, minScore = DEFAULT_PASSWORD_RULES.minScore, ...rest } = input;
+  if (Object.keys(rest).length) return null;
+  if (!Number.isInteger(minLength) || minLength < 1 || minLength > MAX_MIN_LENGTH) return null;
+  if (!isPasswordScore(minScore)) return null;
+  return { minLength, minScore };
+}
+var isMethodId = (value) => METHODS.includes(value);
+var hasSecondFactor = (method) => METHODS_WITH_SECOND_FACTOR.includes(method);
+var isPolicy = (value) => SECOND_FACTOR_POLICIES.includes(value);
+function parseMethodSettings(input, options = {}) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const settings = {};
+  for (const [method, value] of Object.entries(input)) {
+    if (!isMethodId(method)) return null;
+    if (typeof value === "boolean") {
+      if (!options.booleans) return null;
+      if (value) settings[method] = {};
+      continue;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+    const setting = {};
+    for (const [field, fieldValue] of Object.entries(value)) {
+      if (field !== "secondFactor" || !hasSecondFactor(method) || !isPolicy(fieldValue)) return null;
+      setting.secondFactor = fieldValue;
+    }
+    settings[method] = setting;
+  }
+  return settings;
+}
+function isConfigured(config, method) {
+  if (method === "google") return !!config.google;
+  if (method === "github") return !!config.github;
+  if (method === "password") return !!config.password;
+  if (method === "email-link") return !!config.emailLink;
+  if (method === "sms") return !!config.sms;
+  return true;
+}
+function canSignUp(config, method) {
+  return method === "totp" ? !!config.emailVerification : isConfigured(config, method);
+}
+function initialMethods(config) {
+  const methods = {};
+  if (config.google) methods.google = { secondFactor: "none" };
+  if (config.github) methods.github = { secondFactor: "none" };
+  if (config.password) methods.password = { secondFactor: "none" };
+  if (config.emailLink) methods["email-link"] = { secondFactor: "none" };
+  if (!config.google && !config.github && !config.password && !config.emailLink && config.emailVerification) methods.totp = {};
+  if (config.sms) methods.sms = {};
+  return methods;
+}
+var MAX_TRIES = 3;
+var Settings = class {
+  /** `initial` is what counts until the methods are set, see {@link initialMethods}. */
+  constructor(store, initial = {}) {
+    this.store = store;
+    this.initial = initial;
+    this.warned = false;
+    this.warnedRules = false;
+  }
+  /** The setting's value, or undefined if it was never set. */
+  async get(id) {
+    return (await this.read(id)).value;
+  }
+  /** The stored JSON and what it holds; both undefined if the setting was never set. */
+  async read(id) {
+    const record = await this.store.findOne("setting", { id });
+    if (typeof record?.value !== "string") return {};
+    try {
+      return { json: record.value, value: JSON.parse(record.value) };
+    } catch {
+      return { json: record.value };
+    }
+  }
+  /**
+   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
+   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
+   * again with the newer value. Resolves to the new value, or null if `apply` refused.
+   * `updatedBy` is the address of the admin, or null for the command line.
+   */
+  async change(id, apply, updatedBy) {
+    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
+      const { json, value } = await this.read(id);
+      const next = apply(value);
+      if (next === null) return null;
+      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
+      const written = json === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json }, patch) === 1;
+      if (written) return next;
+    }
+    throw new Error(`Setting "${id}" kept changing; try again.`);
+  }
+  /** Replaces the setting. */
+  async set(id, value, updatedBy) {
+    await this.change(id, () => value, updatedBy);
+  }
+  /** Which sign-in methods are on, with their settings; the initial ones until an admin set them. */
+  async methods() {
+    return this.current(await this.get(METHODS_SETTING));
+  }
+  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
+  async changeMethods(apply, updatedBy) {
+    return this.change(METHODS_SETTING, (current) => apply(this.current(current)), updatedBy);
+  }
+  /** The rules for new passwords; the defaults until an admin set them. */
+  async passwordRules() {
+    const stored = await this.get(PASSWORD_SETTING);
+    if (stored === void 0) return DEFAULT_PASSWORD_RULES;
+    const parsed = parsePasswordRules(stored);
+    if (parsed) return parsed;
+    if (!this.warnedRules) {
+      this.warnedRules = true;
+      console.warn("[madauth] The stored password rules are not in the form this version expects. Set them again with set-password-rules; until then the defaults count.");
+    }
+    return DEFAULT_PASSWORD_RULES;
+  }
+  /** Replaces the rules for new passwords. */
+  async setPasswordRules(rules, updatedBy) {
+    await this.set(PASSWORD_SETTING, rules, updatedBy);
+    return rules;
+  }
+  /** The stored methods, or the initial ones if nothing (usable) is stored. */
+  current(stored) {
+    if (stored === void 0) return this.initial;
+    const parsed = parseMethodSettings(stored);
+    if (parsed) return parsed;
+    if (!this.warned) {
+      this.warned = true;
+      console.warn("[madauth] The stored sign-in methods are not in the form this version expects (they were set by an older one?). Set them again with set-methods; until then the initial methods count.");
+    }
+    return this.initial;
+  }
+};
+function isOn(method, configured, methods) {
+  return configured(method) && methods[method] !== void 0;
+}
+function policyOf(method, methods) {
+  return methods[method]?.secondFactor ?? "none";
+}
+function anyOn(signsUp, methods) {
+  return SIGN_IN_METHODS.some((method) => signsUp(method) && methods[method] !== void 0);
+}
+function authenticatorOn(configured, methods) {
+  if (isOn("totp", configured, methods)) return true;
+  return METHODS_WITH_SECOND_FACTOR.some((method) => isOn(method, configured, methods) && policyOf(method, methods) !== "none");
+}
+
+// src/password.ts
+import { createHash, createHmac, hkdfSync, randomBytes, randomInt, scrypt, timingSafeEqual } from "crypto";
+
+// src/strength.ts
+var RATED_LENGTH = 64;
+var loading;
+async function passwordScore(password, userInputs = []) {
+  loading ??= Promise.all([import("@zxcvbn-ts/core"), import("@zxcvbn-ts/language-common")]).then(
+    ([core, common]) => new core.ZxcvbnFactory({
+      dictionary: common.dictionary,
+      graphs: common.adjacencyGraphs,
+      useLevenshteinDistance: true,
+      maxLength: RATED_LENGTH
+    })
+  );
+  return (await loading).check(password, userInputs).score;
+}
+
+// src/password.ts
+var HASH_PARAMS = { logN: 15, r: 8, p: 3 };
+var KEY_LENGTH = 64;
+var SALT_LENGTH = 16;
+var MAX_PASSWORD_LENGTH = 256;
+var MAX_EMAIL_LENGTH = 254;
+function derive(password, salt, { logN, r, p }) {
+  const N = 2 ** logN;
+  return new Promise(
+    (resolve, reject) => scrypt(
+      password.normalize("NFC"),
+      salt,
+      KEY_LENGTH,
+      { N, r, p, maxmem: 256 * N * r + 1024 * 1024 },
+      (err, key) => err ? reject(err) : resolve(key)
+    )
+  );
+}
+async function hashPassword(password, params = HASH_PARAMS) {
+  const salt = randomBytes(SALT_LENGTH);
+  const key = await derive(password, salt, params);
+  return ["scrypt", params.logN, params.r, params.p, salt.toString("base64url"), key.toString("base64url")].join("$");
+}
+async function verifyPassword(password, stored) {
+  const [scheme, logN, r, p, salt, hash] = stored.split("$");
+  const params = { logN: Number(logN), r: Number(r), p: Number(p) };
+  if (scheme !== "scrypt" || !salt || !hash || !Object.values(params).every((n) => Number.isInteger(n) && n > 0)) {
+    return { ok: false, needsRehash: false };
+  }
+  const expected = Buffer.from(hash, "base64url");
+  const key = await derive(password, Buffer.from(salt, "base64url"), params);
+  const ok = key.length === expected.length && timingSafeEqual(key, expected);
+  const needsRehash = params.logN !== HASH_PARAMS.logN || params.r !== HASH_PARAMS.r || params.p !== HASH_PARAMS.p;
+  return { ok, needsRehash };
+}
+var dummyHash;
+async function verifyAgainstDummy(password) {
+  dummyHash ??= hashPassword(randomBytes(16).toString("hex"));
+  await verifyPassword(password, await dummyHash);
+}
+async function checkPasswordPolicy(password, rules, userInputs = []) {
+  if (typeof password !== "string") return { message: "password is missing" };
+  const length = [...password].length;
+  if (length > MAX_PASSWORD_LENGTH) return { message: `The password must have at most ${MAX_PASSWORD_LENGTH} characters.` };
+  if (length < rules.minLength) return { message: `The password must have at least ${rules.minLength} characters.`, minLength: rules.minLength };
+  if (rules.minScore > 0 && await passwordScore(password, userInputs) < rules.minScore) {
+    return {
+      message: "This password is too easy to guess. Add another word or two, or choose less common ones.",
+      minScore: rules.minScore
+    };
+  }
+  return null;
+}
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+function isValidEmail(email) {
+  return typeof email === "string" && email.trim().length <= MAX_EMAIL_LENGTH && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email.trim());
+}
+function generateLinkToken() {
+  return randomBytes(32).toString("base64url");
+}
+function hashLinkToken(token) {
+  return createHash("sha256").update(token).digest("base64url");
+}
+function generateCode() {
+  return randomInt(0, 1e6).toString().padStart(6, "0");
+}
+function deriveCodeKey(signingKeyD) {
+  return Buffer.from(hkdfSync("sha256", Buffer.from(signingKeyD, "base64url"), "", "madauth e-mail code", 32));
+}
+function hashCode(key, code) {
+  return createHmac("sha256", key).update(code).digest("base64url");
+}
+function safeEqual(a, b) {
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual(x, y);
+}
+
+// src/users.ts
+import { randomBytes as randomBytes2 } from "crypto";
+var MAX_CODE_ATTEMPTS = 5;
+var MAX_WRONG_CODES = 10;
+var newId = (prefix) => `${prefix}_${randomBytes2(16).toString("base64url")}`;
+function passwordAccountKey(userId) {
+  return `password:${userId}`;
+}
+function googleAccountKey(sub) {
+  return `google:${sub}`;
+}
+function githubAccountKey(id) {
+  return `github:${id}`;
+}
+function totpAccountKey(userId) {
+  return `totp:${userId}`;
+}
+function emailLinkAccountKey(userId) {
+  return `email-link:${userId}`;
+}
+function smsAccountKey(userId) {
+  return `sms:${userId}`;
+}
+var methodOf = (account) => String(account.key).split(":")[0];
+var ALWAYS_PRIMARY = ["password", "google", "github", "email-link"];
+function isPrimary(account, accounts) {
+  if (account.primaryUserId) return true;
+  if (account.secondFactor === true) return false;
+  const method = methodOf(account);
+  if (method !== "totp") return ALWAYS_PRIMARY.includes(method);
+  return !accounts.some((other) => ALWAYS_PRIMARY.includes(methodOf(other)));
+}
+function toMadauthUser(user, profile = {}) {
+  const result = { id: user.id, email: user.email };
+  const name = user.name ?? profile.name;
+  if (name) result.name = name;
+  if (profile.picture) result.picture = profile.picture;
+  const claims = claimsFromJson(user.claims);
+  if (Object.keys(claims).length) result.claims = claims;
+  return result;
+}
+var Users = class {
+  /** `codeKey` keys the e-mail codes (see deriveCodeKey); only needed to issue and check them. */
+  constructor(store, codeKey) {
+    this.store = store;
+    this.codeKey = codeKey;
+  }
+  get key() {
+    if (!this.codeKey) throw new Error("Users needs a code key to issue or check e-mail codes.");
+    return this.codeKey;
+  }
+  async findByEmail(emailNormalized) {
+    return await this.store.findOne("user", { emailNormalized });
+  }
+  async findById(id) {
+    return await this.store.findOne("user", { id });
+  }
+  async passwordAccount(userId) {
+    return this.findAccountByKey(passwordAccountKey(userId));
+  }
+  /** The user's authenticator app, if they set one up. */
+  async totpAccount(userId) {
+    return this.findAccountByKey(totpAccountKey(userId));
+  }
+  /** The user's e-mail link account, if they sign in that way. */
+  async emailLinkAccount(userId) {
+    return this.findAccountByKey(emailLinkAccountKey(userId));
+  }
+  /** The user's phone number for SMS codes, if they added one. */
+  async smsAccount(userId) {
+    return this.findAccountByKey(smsAccountKey(userId));
+  }
+  /** The user's accounts: their sign-in method and their second factors. */
+  async accounts(userId) {
+    return await this.store.findMany("account", { userId });
+  }
+  /** The account the user signs in with (they have one at most), or null; a sign-up with the authenticator app has none until it is set up. */
+  async primaryAccount(userId) {
+    const accounts = await this.accounts(userId);
+    return accounts.find((account) => isPrimary(account, accounts)) ?? null;
+  }
+  /**
+   * The user's authenticator app, if they set one up, and whether it is how they sign in (they signed up with
+   * it) as opposed to a second factor. One read: the app and the user's other accounts together.
+   */
+  async totpApp(userId) {
+    const accounts = await this.accounts(userId);
+    const account = accounts.find((a) => a.key === totpAccountKey(userId));
+    return account ? { account, signsIn: isPrimary(account, accounts) } : null;
+  }
+  /** Whether someone can sign in as the user: they have a sign-in method. */
+  async hasSignInMethod(userId) {
+    return await this.primaryAccount(userId) !== null;
+  }
+  /**
+   * How the user signs in, e.g. `['google']`; empty while nobody can. A user has one sign-in method (only
+   * users from before madAuth 0.4 may have a password and Google); a second factor (the authenticator app of
+   * a password user, SMS) is a step of it, not a way in. The app of a user who signed up with it counts only
+   * while it signs in on its own (`methods` lists it).
+   */
+  async signInMethods(userId, methods) {
+    const accounts = await this.accounts(userId);
+    const signIn = accounts.filter((account) => isPrimary(account, accounts)).map(methodOf);
+    return SIGN_IN_METHODS.filter((m) => signIn.includes(m) && (m !== "totp" || methods.totp !== void 0));
+  }
+  /**
+   * Notes that the user's first session started: their sign-up is complete. Resolves to true only for the
+   * request that wrote it, so `user.signed_up` is sent once; false for a later session, and for a user from
+   * before schema version 7.
+   */
+  async markSignedUp(userId) {
+    return await this.store.update("user", { id: userId, signedUpAt: 0 }, { signedUpAt: Date.now() }) === 1;
+  }
+  /**
+   * For a user whose sign-up is not complete (no confirmed address, or no sign-in method) and who is about to
+   * finish it or sign up again: one from before schema version 7 says nothing (`signedUpAt` empty, which
+   * counts as complete), so it is set to 0 and `user.signed_up` comes at their first session like for anyone.
+   */
+  async reopenSignUp(user) {
+    if (user.signedUpAt !== null && user.signedUpAt !== void 0) return user;
+    await this.store.update("user", { id: user.id, signedUpAt: null }, { signedUpAt: 0 });
+    return { ...user, signedUpAt: 0 };
+  }
+  /** The `sub` of the user's linked Google account, if they have one. */
+  async googleSub(userId) {
+    const accounts = await this.store.findMany("account", { userId });
+    const key = accounts.map((account) => String(account.key)).find((k) => k.startsWith("google:"));
+    return key ? key.slice("google:".length) : null;
+  }
+  /** The user's GitHub account, if linked: its key holds GitHub's user id, its secret the encrypted access token of the last sign-in. */
+  async githubAccount(userId) {
+    const accounts = await this.accounts(userId);
+    return accounts.find((account) => account.key.startsWith("github:")) ?? null;
+  }
+  async findAccountByKey(key) {
+    return await this.store.findOne("account", { key });
+  }
+  /**
+   * Creates a user, with their first account if given. Resolves to null if the e-mail address or the
+   * account key is taken. `account.key` is `password:<userId>` for a password (its hash as `secret`), or
+   * e.g. `google:<sub>`. A sign-up with the authenticator app creates the user without an account: the app
+   * is set up once the address is confirmed.
+   */
+  async createUser(data) {
+    const user = {
+      id: newId("usr"),
+      email: data.email,
+      emailNormalized: data.emailNormalized,
+      emailVerified: data.emailVerified,
+      name: data.name,
+      sessionVersion: 0,
+      lastMailAt: 0,
+      lastSmsAt: 0,
+      wrongCodes: 0,
+      claims: null,
+      signedUpAt: 0,
+      createdAt: Date.now()
+    };
+    if (!await this.store.create("user", user)) return null;
+    if (!data.account) return user;
+    const account = typeof data.account === "function" ? data.account(user.id) : data.account;
+    if (!await this.linkAccount(user.id, account)) {
+      await this.store.delete("user", { id: user.id });
+      return null;
+    }
+    return user;
+  }
+  /**
+   * Removes what an unconfirmed sign-up set without proving it: the password, and the e-mail link account of
+   * a first link nobody used. Only `except`'s own account stays: the method that proves the address, or
+   * signs it up anew, is the one the user ends up with.
+   */
+  async dropUnprovenAccounts(userId, except) {
+    const keys = { password: passwordAccountKey(userId), "email-link": emailLinkAccountKey(userId) };
+    for (const [method, key] of Object.entries(keys)) {
+      if (method !== except) await this.store.delete("account", { key });
+    }
+  }
+  /**
+   * A provider verified the user's address: an unconfirmed sign-up with it, whose password or e-mail link
+   * nobody has proven, is dropped (its accounts, except `proven`'s own, and its pending links and codes),
+   * and the user counts as verified.
+   */
+  async verifyByProvider(user, proven) {
+    if (user.emailVerified) return;
+    await this.dropUnprovenAccounts(user.id, proven);
+    await this.clearVerifications(user.id);
+    await this.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
+  }
+  /** Removes an account record, e.g. one left behind by a deletion that did not finish. */
+  async deleteAccount(id) {
+    await this.store.delete("account", { id });
+  }
+  /** Removes a sign-in method by its key. Resolves to false if there was none. */
+  async unlinkAccount(key) {
+    return await this.store.delete("account", { key }) === 1;
+  }
+  /** Removes the user's authenticator app and recovery codes. Resolves to false if they had no app. */
+  async removeTotp(userId) {
+    const removed = await this.unlinkAccount(totpAccountKey(userId));
+    await this.clearRecoveryCodes(userId);
+    return removed;
+  }
+  /** Removes the user's phone number for SMS codes. Resolves to false if they had none. */
+  async removeSms(userId) {
+    return this.unlinkAccount(smsAccountKey(userId));
+  }
+  /**
+   * Adds a sign-in method or a second factor to a user. Resolves to null if the account key is taken, or if
+   * it is a sign-in method and the user has one already.
+   */
+  async linkAccount(userId, account) {
+    const primary = account.primary ?? ALWAYS_PRIMARY.includes(methodOf(account));
+    const record = {
+      id: newId("acc"),
+      userId,
+      key: account.key,
+      secret: account.secret ?? null,
+      failedAttempts: 0,
+      lockedUntil: 0,
+      email: account.email ?? null,
+      lastUsedStep: account.lastUsedStep ?? 0,
+      setupId: account.setupId ?? null,
+      phone: account.phone ?? null,
+      primaryUserId: primary ? userId : null,
+      secondFactor: !primary,
+      createdAt: Date.now()
+    };
+    return await this.store.create("account", record) ? record : null;
+  }
+  /**
+   * Writes the secret of a confirmed setup over the authenticator account, only if the account still has the
+   * setup it had when this setup started (`replaces`): the write count decides, so of two setups confirmed
+   * at once exactly one wins, and the other is told to start again.
+   */
+  async confirmTotpSetup(accountId, replaces, patch) {
+    return await this.store.update("account", { id: accountId, setupId: replaces }, patch) === 1;
+  }
+  /**
+   * Marks the time step of an accepted authenticator code as used and resets the failed attempts, only if
+   * no other request accepted a code meanwhile: the write count decides, so the same code sent twice signs
+   * in once.
+   */
+  async useTotpStep(account, step) {
+    const changed = await this.store.update(
+      "account",
+      { id: account.id, lastUsedStep: account.lastUsedStep ?? null },
+      { lastUsedStep: step, failedAttempts: 0, lockedUntil: 0 }
+    );
+    return changed === 1;
+  }
+  /** Replaces the user's recovery codes with new ones, given as their hashes. */
+  /** Stores the recovery codes of a setup (their hashes), next to whatever codes the user has. */
+  async addRecoveryCodes(userId, setupId, hashes) {
+    const createdAt = Date.now();
+    for (const id of hashes) await this.store.create("recoveryCode", { id, userId, setupId, createdAt });
+  }
+  /** New recovery codes for the user's current app: the codes they had before stop working. */
+  async replaceRecoveryCodes(account, hashes) {
+    const before = await this.store.findMany("recoveryCode", { userId: account.userId });
+    await this.addRecoveryCodes(account.userId, account.setupId ?? "", hashes);
+    for (const old of before) await this.store.delete("recoveryCode", { id: old.id });
+  }
+  /**
+   * Uses up the recovery code with this hash for the user's authenticator account. Resolves to false if it
+   * is not theirs, belongs to another setup than the account's, or was used already.
+   */
+  async consumeRecoveryCode(account, hash) {
+    const record = await this.store.findOne("recoveryCode", { id: hash });
+    if (!record || record.userId !== account.userId || record.setupId !== (account.setupId ?? "")) return false;
+    return await this.store.delete("recoveryCode", { id: hash }) === 1;
+  }
+  /** How many recovery codes of the account's setup are left. */
+  async countRecoveryCodes(account) {
+    const codes = await this.store.findMany("recoveryCode", { userId: account.userId });
+    return codes.filter((code) => code.setupId === (account.setupId ?? "")).length;
+  }
+  /** Deletes the user's recovery codes: all of them, or only those of one setup, or all but one setup's. */
+  async clearRecoveryCodes(userId, which = {}) {
+    if (which.only === void 0 && which.except === void 0) {
+      await this.store.delete("recoveryCode", { userId });
+      return;
+    }
+    for (const code of await this.store.findMany("recoveryCode", { userId })) {
+      const match = which.only !== void 0 ? code.setupId === which.only : code.setupId !== which.except;
+      if (match) await this.store.delete("recoveryCode", { id: code.id });
+    }
+  }
+  /**
+   * Deletes the user and everything stored for them. Resolves to false if there is no such user (any more).
+   */
+  async deleteById(id) {
+    const user = await this.findById(id);
+    if (!user) return false;
+    if (await this.store.delete("user", { id: user.id }) !== 1) return false;
+    try {
+      await this.store.delete("account", { userId: user.id });
+      await this.store.delete("verification", { userId: user.id });
+      await this.store.delete("recoveryCode", { userId: user.id });
+    } catch (e) {
+      console.error(`[madauth] Deleted user ${user.id}, but not all of their records: ${e.message}`);
+    }
+    return true;
+  }
+  async updateUser(id, patch) {
+    await this.store.update("user", { id }, patch);
+  }
+  /** Changes an account. Resolves to false if it is gone meanwhile. */
+  async updateAccount(id, patch) {
+    return await this.store.update("account", { id }, patch) === 1;
+  }
+  /**
+   * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
+   * was read. Resolves to false if another request counted an attempt meanwhile.
+   */
+  async countAttempt(account, patch) {
+    const changed = await this.store.update("account", { id: account.id, failedAttempts: account.failedAttempts }, patch);
+    return changed === 1;
+  }
+  /** Deletes the user's pending verifications and password resets; their links and codes stop working. */
+  async clearVerifications(userId) {
+    await this.store.delete("verification", { userId });
+  }
+  /**
+   * Starts a verification, password reset or e-mail link sign-in: replaces the user's earlier one for the same purpose and
+   * returns the link token and the code for the e-mail. Only their hashes are stored.
+   */
+  async issueVerification(userId, purpose, ttlMs) {
+    await this.store.delete("verification", { userId, purpose });
+    const token = generateLinkToken();
+    const code = generateCode();
+    const record = {
+      id: hashLinkToken(token),
+      userId,
+      purpose,
+      codeHash: hashCode(this.key, code),
+      attempts: 0,
+      expiresAt: Date.now() + ttlMs
+    };
+    await this.store.create("verification", record);
+    return { token, code };
+  }
+  /** The user ID a link token belongs to, without using the verification up; null if invalid, expired or used. */
+  async peekLinkToken(token, purpose) {
+    const record = await this.store.findOne("verification", { id: hashLinkToken(token), purpose });
+    return record && record.expiresAt > Date.now() ? record.userId : null;
+  }
+  /** Uses up the verification a link token belongs to. Resolves to its user ID, or null if invalid, expired or used. */
+  async consumeLinkToken(token, purpose) {
+    const id = hashLinkToken(token);
+    const record = await this.store.findOne("verification", { id, purpose });
+    return record ? this.consume(record) : null;
+  }
+  /**
+   * Uses up the user's verification if `code` matches. Too many wrong codes delete it, and after
+   * MAX_WRONG_CODES wrong e-mail codes in a row the user's codes stop working until an e-mail link is used.
+   * SMS codes are not counted that way: that lock is only lifted by an e-mail link or a password reset, which
+   * a Google user with a phone never has. Their record's attempts, one SMS per minute and the lock on the
+   * sms account (routes/lockout.ts) are their limits.
+   */
+  async consumeCode(user, purpose, code) {
+    const counted = purpose !== "sms";
+    if (counted && (user.wrongCodes ?? 0) >= MAX_WRONG_CODES) return { userId: null, locked: true };
+    const record = await this.store.findOne("verification", { userId: user.id, purpose });
+    if (!record) return { userId: null, locked: false };
+    const attempts = record.attempts + 1;
+    if (await this.store.update("verification", { id: record.id, attempts: record.attempts }, { attempts }) !== 1) {
+      return { userId: null, locked: false };
+    }
+    let wrongCodes = 0;
+    if (counted) {
+      const count = await this.countWrongCode(user);
+      if (count === null) return { userId: null, locked: false };
+      if (count > MAX_WRONG_CODES) return { userId: null, locked: true };
+      wrongCodes = count;
+    }
+    if (!safeEqual(hashCode(this.key, code), record.codeHash)) {
+      if (attempts >= MAX_CODE_ATTEMPTS) await this.store.delete("verification", { id: record.id });
+      return { userId: null, locked: counted && wrongCodes >= MAX_WRONG_CODES };
+    }
+    return { userId: await this.consume(record), locked: false };
+  }
+  /** Counts a code for the user and resolves to the new count; null if other requests kept changing it. */
+  async countWrongCode(user) {
+    let current = user;
+    for (let attempt = 0; attempt < 3 && current; attempt++) {
+      const wrongCodes = (current.wrongCodes ?? 0) + 1;
+      if (await this.store.update("user", { id: user.id, wrongCodes: current.wrongCodes ?? null }, { wrongCodes }) === 1) {
+        return wrongCodes;
+      }
+      current = await this.findById(user.id);
+    }
+    return null;
+  }
+  async consume(record) {
+    const deleted = await this.store.delete("verification", { id: record.id });
+    if (deleted !== 1 || record.expiresAt <= Date.now()) return null;
+    return record.userId;
+  }
+};
+
+export {
+  ADMIN_ROLE,
+  parseRoles,
+  parseClaims,
+  sameClaims,
+  claimsFromJson,
+  isAdmin,
+  sendsVerificationEmails,
+  methodConfig,
+  envVars,
+  resolveEnv,
+  ConfigError,
+  loadConfig,
+  loadStore,
+  MAX_PASSWORD_LENGTH,
+  hashPassword,
+  verifyPassword,
+  verifyAgainstDummy,
+  checkPasswordPolicy,
+  normalizeEmail,
+  isValidEmail,
+  deriveCodeKey,
+  hashCode,
+  safeEqual,
+  SIGN_IN_METHODS,
+  METHODS,
+  METHODS_WITH_SECOND_FACTOR,
+  SECOND_FACTOR_POLICIES,
+  DEFAULT_PASSWORD_RULES,
+  MAX_MIN_LENGTH,
+  isPasswordScore,
+  parsePasswordRules,
+  hasSecondFactor,
+  parseMethodSettings,
+  isConfigured,
+  canSignUp,
+  initialMethods,
+  Settings,
+  isOn,
+  policyOf,
+  anyOn,
+  authenticatorOn,
+  newId,
+  passwordAccountKey,
+  googleAccountKey,
+  githubAccountKey,
+  totpAccountKey,
+  emailLinkAccountKey,
+  smsAccountKey,
+  toMadauthUser,
+  Users
+};