@manta-eu/auth 0.12.0 → 0.13.0

package/dist/request-origin.d.ts

@@ -0,0 +1,4 @@
+export declare const crossSiteSignOutMessage = "Sign out from the app";
+export declare function isWebSocket(request: Request): boolean;
+export declare function originAllowsRequest(request: Request, ownOrigin?: string): boolean;
+//# sourceMappingURL=request-origin.d.ts.map

package/dist/request-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-origin.d.ts","sourceRoot":"","sources":["../src/request-origin.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,uBAAuB,0BAA0B,CAAC;AAE/D,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAErD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,SAA8B,GAAG,OAAO,CAYtG"}

package/dist/request-origin.js

@@ -0,0 +1,17 @@
+import { isPresent } from "@manta-eu/lib/present";
+export const crossSiteSignOutMessage = "Sign out from the app";
+export function isWebSocket(request) {
+    return request.headers.get("upgrade")?.toLowerCase() === "websocket";
+}
+export function originAllowsRequest(request, ownOrigin = new URL(request.url).origin) {
+    const fetchSite = request.headers.get("sec-fetch-site");
+    if (fetchSite === "same-origin")
+        return true;
+    if (fetchSite === "cross-site" || fetchSite === "same-site")
+        return false;
+    const origin = request.headers.get("origin");
+    if (isPresent(origin))
+        return origin === ownOrigin;
+    return !isWebSocket(request) && (request.method === "GET" || request.method === "HEAD");
+}
+//# sourceMappingURL=request-origin.js.map

package/dist/request-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-origin.js","sourceRoot":"","sources":["../src/request-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAE/D,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAExD,IAAI,SAAS,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAE7C,IAAI,SAAS,KAAK,YAAY,IAAI,SAAS,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAE1E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE7C,IAAI,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,KAAK,SAAS,CAAC;IAEnD,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AAC1F,CAAC"}

package/dist/sealed-cookies.d.ts

@@ -0,0 +1,43 @@
+import { type JWTPayload } from "jose";
+export type SealingKey = Awaited<ReturnType<typeof crypto.subtle.deriveKey>>;
+export declare function purposeKey(secret: string, purpose: string): Promise<SealingKey>;
+export type SealArgs = {
+    key: SealingKey;
+    value: JWTPayload;
+    ttlMs?: number;
+};
+export declare function seal(args: SealArgs): Promise<string>;
+export declare function unseal(key: SealingKey, value: string | undefined): Promise<JWTPayload | undefined>;
+export declare function cookiesOf(request: Request): Map<string, string>;
+export type ReturnToArgs = {
+    raw: string | null;
+    fallback: string;
+    appUrl: URL;
+};
+export declare function safeReturnTo(args: ReturnToArgs): string;
+export declare const sessionMaxAgeSeconds: number;
+export type CookieArgs = {
+    name: string;
+    value: string;
+    path?: string;
+    maxAge?: number;
+};
+export type SetCookie = (cookie: CookieArgs) => string;
+export declare function httpOnlyCookie(secure: boolean): SetCookie;
+export type ChunkCookiesArgs = {
+    cookies: Map<string, string>;
+    name: string;
+    setCookie: SetCookie;
+};
+export type SealedChunkCookiesArgs = ChunkCookiesArgs & {
+    key: SealingKey;
+    value: JWTPayload;
+    maxAge?: number;
+};
+export declare function sealedChunkCookies(args: SealedChunkCookiesArgs): Promise<string[]>;
+export declare function expiredChunkCookies(args: ChunkCookiesArgs): string[];
+export type UnsealedChunksArgs = Pick<ChunkCookiesArgs, "cookies" | "name"> & {
+    key: SealingKey;
+};
+export declare function unsealedChunks(args: UnsealedChunksArgs): Promise<JWTPayload | undefined>;
+//# sourceMappingURL=sealed-cookies.d.ts.map

package/dist/sealed-cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed-cookies.d.ts","sourceRoot":"","sources":["../src/sealed-cookies.ts"],"names":[],"mappings":"AACA,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAE/D,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAO7E,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAKrF;AAED,MAAM,MAAM,QAAQ,GAAG;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9E,wBAAsB,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ1D;AAED,wBAAsB,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAUxG;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ/D;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAEjF,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAUvD;AAgCD,eAAO,MAAM,oBAAoB,QAAoB,CAAC;AAEtD,MAAM,MAAM,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzF,MAAM,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;AAEvD,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,CAazD;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAEpG,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAUxF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAIpE;AAED,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,MAAM,CAAC,GAAG;IAAE,GAAG,EAAE,UAAU,CAAA;CAAE,CAAC;AAElG,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAI9F"}

package/dist/sealed-cookies.js

@@ -0,0 +1,95 @@
+import { isPresent } from "@manta-eu/lib/present";
+import { EncryptJWT, jwtDecrypt } from "jose";
+const chunkSize = 3800;
+const maxChunks = 10;
+const encoded = (text) => new TextEncoder().encode(text);
+export async function purposeKey(secret, purpose) {
+    const material = await crypto.subtle.importKey("raw", encoded(secret), "HKDF", false, ["deriveKey"]);
+    const derivation = { name: "HKDF", hash: "SHA-256", salt: encoded("manta-web-login"), info: encoded(purpose) };
+    return crypto.subtle.deriveKey(derivation, material, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+export async function seal(args) {
+    const { key, value, ttlMs } = args;
+    const jwt = new EncryptJWT({ ...value }).setProtectedHeader({ alg: "dir", enc: "A256GCM" });
+    if (ttlMs !== undefined)
+        jwt.setExpirationTime(new Date(Date.now() + ttlMs));
+    return jwt.encrypt(key);
+}
+export async function unseal(key, value) {
+    if (!isPresent(value))
+        return undefined;
+    try {
+        const { payload } = await jwtDecrypt(value, key);
+        return payload;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function cookiesOf(request) {
+    const pairs = (request.headers.get("cookie") ?? "").split(";").flatMap((part) => {
+        const separator = part.indexOf("=");
+        return separator > 0 ? [[part.slice(0, separator).trim(), part.slice(separator + 1).trim()]] : [];
+    });
+    return new Map(pairs);
+}
+export function safeReturnTo(args) {
+    const { raw, fallback, appUrl } = args;
+    if (!raw?.startsWith("/") || /[\p{Cc}\\]/u.test(raw))
+        return fallback;
+    const { origin, pathname, search, hash } = new URL(raw, appUrl);
+    if (origin !== appUrl.origin || pathname.startsWith("//"))
+        return fallback;
+    return `${pathname}${search}${hash}`;
+}
+function cookieChunks(value) {
+    const count = Math.ceil(value.length / chunkSize);
+    if (count > maxChunks)
+        throw new Error("The session is too large to keep in cookies");
+    return Array.from({ length: count }, (_, index) => value.slice(index * chunkSize, (index + 1) * chunkSize));
+}
+function joinedChunks(cookies, name) {
+    const names = Array.from({ length: maxChunks }, (_, index) => `${name}.${index}`);
+    const firstMissing = names.findIndex((chunk) => !cookies.has(chunk));
+    return names
+        .slice(0, firstMissing === -1 ? undefined : firstMissing)
+        .map((chunk) => cookies.get(chunk))
+        .join("");
+}
+function chunkNamesFrom(args) {
+    const { cookies, name, first } = args;
+    const prefix = `${name}.`;
+    return [...cookies.keys()].filter((cookie) => cookie.startsWith(prefix) && Number(cookie.slice(prefix.length)) >= first);
+}
+export const sessionMaxAgeSeconds = 30 * 24 * 60 * 60;
+export function httpOnlyCookie(secure) {
+    return (cookie) => {
+        const { name, value, path = "/", maxAge } = cookie;
+        return [
+            `${name}=${value}`,
+            `Path=${path}`,
+            "HttpOnly",
+            "SameSite=Lax",
+            ...(secure ? ["Secure"] : []),
+            ...(maxAge === undefined ? [] : [`Max-Age=${maxAge}`]),
+        ].join("; ");
+    };
+}
+export async function sealedChunkCookies(args) {
+    const { cookies, name, setCookie, key, value, maxAge } = args;
+    const chunks = cookieChunks(await seal({ key, value, ttlMs: maxAge === undefined ? undefined : maxAge * 1000 }));
+    const stale = chunkNamesFrom({ cookies, name, first: chunks.length });
+    return [
+        ...chunks.map((chunk, index) => setCookie({ name: `${name}.${index}`, value: chunk, maxAge })),
+        ...stale.map((chunk) => setCookie({ name: chunk, value: "", maxAge: 0 })),
+    ];
+}
+export function expiredChunkCookies(args) {
+    const { cookies, name, setCookie } = args;
+    return chunkNamesFrom({ cookies, name, first: 0 }).map((chunk) => setCookie({ name: chunk, value: "", maxAge: 0 }));
+}
+export async function unsealedChunks(args) {
+    const { cookies, name, key } = args;
+    return unseal(key, joinedChunks(cookies, name));
+}
+//# sourceMappingURL=sealed-cookies.js.map

package/dist/sealed-cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed-cookies.js","sourceRoot":"","sources":["../src/sealed-cookies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAmB,MAAM,MAAM,CAAC;AAI/D,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAEjE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe;IAC9D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACrG,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/G,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AACxH,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc;IACvC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAE5F,IAAI,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IAE7E,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,KAAyB;IACrE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAEjD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAgB;IACxC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEpC,OAAO,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAID,MAAM,UAAU,YAAY,CAAC,IAAkB;IAC7C,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEvC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEtE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEhE,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE3E,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAElD,IAAI,KAAK,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAEtF,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,YAAY,CAAC,OAA4B,EAAE,IAAY;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IAClF,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAErE,OAAO,KAAK;SACT,KAAK,CAAC,CAAC,EAAE,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;SACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SAClC,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAID,SAAS,cAAc,CAAC,IAAoB;IAC1C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAEtC,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;IAE1B,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,CACtF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAMtD,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAEnD,OAAO;YACL,GAAG,IAAI,IAAI,KAAK,EAAE;YAClB,QAAQ,IAAI,EAAE;YACd,UAAU;YACV,cAAc;YACd,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;SACvD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAA4B;IACnE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE9D,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACjH,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAEtE,OAAO;QACL,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9F,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAsB;IACxD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAE1C,OAAO,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACtH,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAwB;IAC3D,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEpC,OAAO,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/dist/web-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-routes.d.ts","sourceRoot":"","sources":["../src/web-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAW5C,MAAM,MAAM,qBAAqB,GAAG;IAClC,gHAAgH;IAChH,MAAM,EAAE,UAAU,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,uHAAuH;IACvH,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,yGAAyG;IACzG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2GAA2G;IAC3G,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,uFAAuF;IACvF,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IACxD,+EAA+E;IAC/E,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChD,CAAC;AAmFF,yGAAyG;AACzG,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CA+L7E"}
+{"version":3,"file":"web-routes.d.ts","sourceRoot":"","sources":["../src/web-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAwB5C,MAAM,MAAM,qBAAqB,GAAG;IAClC,gHAAgH;IAChH,MAAM,EAAE,UAAU,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,uHAAuH;IACvH,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,yGAAyG;IACzG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2GAA2G;IAC3G,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,uFAAuF;IACvF,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IACxD,+EAA+E;IAC/E,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChD,CAAC;AA+BF,yGAAyG;AACzG,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CAuM7E"}

package/dist/web-routes.js

@@ -1,57 +1,9 @@
-import { EncryptJWT, jwtDecrypt } from "jose";
+import { crossSiteSignOutMessage, originAllowsRequest } from "./request-origin.js";
+import { cookiesOf, expiredChunkCookies, purposeKey, safeReturnTo, seal, sealedChunkCookies, sessionMaxAgeSeconds, unseal, unsealedChunks, httpOnlyCookie, } from "./sealed-cookies.js";
 import { accessTokenExpiresAt } from "./token.js";
 import { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl, } from "./web-login.js";
 const loginTtlMs = 10 * 60 * 1000;
-const offlineCookieMaxAgeSeconds = 30 * 24 * 60 * 60;
-const chunkSize = 3800;
-const maxChunks = 10;
 const refreshReuseMs = 10_000;
-// One key per purpose, so a login cookie can never be replayed as a session cookie or the other way round.
-async function purposeKey(secret, purpose) {
-    const material = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), "HKDF", false, ["deriveKey"]);
-    return crypto.subtle.deriveKey({
-        name: "HKDF",
-        hash: "SHA-256",
-        salt: new TextEncoder().encode("manta-web-login"),
-        info: new TextEncoder().encode(purpose),
-    }, material, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
-}
-async function seal(key, value, ttlMs) {
-    const jwt = new EncryptJWT({ ...value }).setProtectedHeader({ alg: "dir", enc: "A256GCM" });
-    if (ttlMs !== undefined)
-        jwt.setExpirationTime(new Date(Date.now() + ttlMs));
-    return jwt.encrypt(key);
-}
-async function unseal(key, value) {
-    if (!value)
-        return undefined;
-    try {
-        return (await jwtDecrypt(value, key)).payload;
-    }
-    catch {
-        return undefined;
-    }
-}
-function cookiesOf(request) {
-    const cookies = new Map();
-    for (const part of (request.headers.get("cookie") ?? "").split(";")) {
-        const separator = part.indexOf("=");
-        if (separator > 0)
-            cookies.set(part.slice(0, separator).trim(), part.slice(separator + 1).trim());
-    }
-    return cookies;
-}
-// Only a path on the app itself, so `/login?returnTo=` can never send people to another site.
-// A browser drops tabs and newlines from a Location, so `/\t/evil.example` would land on `//evil.example`.
-function safeReturnTo(raw, fallback, appUrl) {
-    if (!raw?.startsWith("/") || /[\p{Cc}\\]/u.test(raw))
-        return fallback;
-    const resolved = new URL(raw, appUrl);
-    // Resolving drops dot segments, so `/.//evil.example` comes out as the protocol-relative `//evil.example`.
-    if (resolved.origin !== appUrl.origin || resolved.pathname.startsWith("//"))
-        return fallback;
-    return `${resolved.pathname}${resolved.search}${resolved.hash}`;
-}
 function isStoredSession(value) {
     return typeof value === "object" && value !== null && typeof value.accessToken === "string";
 }
@@ -72,7 +24,7 @@ export function webLoginRoutes(options) {
     if (options.sessionSecret.length < 32)
         throw new Error("sessionSecret must be at least 32 characters");
     const appUrl = new URL(options.appUrl);
-    const secure = appUrl.protocol === "https:";
+    const cookie = httpOnlyCookie(appUrl.protocol === "https:");
     const paths = { login: "/login", callback: "/callback", logout: "/logout", ...options.paths };
     const afterLogin = options.afterLogin ?? "/";
     const afterLogout = options.afterLogout ?? "/";
@@ -114,55 +66,40 @@ export function webLoginRoutes(options) {
             }
         }
     }
-    function cookie(name, value, extra = {}) {
-        const attributes = [`${name}=${value}`, `Path=${extra.path ?? "/"}`, "HttpOnly", "SameSite=Lax"];
-        if (secure)
-            attributes.push("Secure");
-        if (extra.maxAge !== undefined)
-            attributes.push(`Max-Age=${extra.maxAge}`);
-        return attributes.join("; ");
-    }
     function clearedSession(cookies) {
-        return [...cookies.keys()]
-            .filter((name) => name.startsWith(`${sessionName}.`))
-            .map((name) => cookie(name, "", { maxAge: 0 }));
+        return expiredChunkCookies({ cookies, name: sessionName, setCookie: cookie });
     }
     async function sessionCookies(stored, cookies) {
-        const value = await seal(await keys.session, stored);
-        const chunks = Math.ceil(value.length / chunkSize);
-        if (chunks > maxChunks)
-            throw new Error("The session is too large to keep in cookies");
-        const maxAge = options.offlineAccess === true ? offlineCookieMaxAgeSeconds : undefined;
-        const written = Array.from({ length: chunks }, (_, index) => cookie(`${sessionName}.${index}`, value.slice(index * chunkSize, (index + 1) * chunkSize), {
-            ...(maxAge === undefined ? {} : { maxAge }),
-        }));
-        const stale = [...cookies.keys()]
-            .filter((name) => name.startsWith(`${sessionName}.`) && Number(name.slice(sessionName.length + 1)) >= chunks)
-            .map((name) => cookie(name, "", { maxAge: 0 }));
-        return [...written, ...stale];
+        const maxAge = options.offlineAccess === true ? sessionMaxAgeSeconds : undefined;
+        return sealedChunkCookies({
+            cookies,
+            name: sessionName,
+            setCookie: cookie,
+            key: await keys.session,
+            value: stored,
+            maxAge,
+        });
     }
     async function storedSession(cookies) {
-        let value = "";
-        for (let index = 0; cookies.has(`${sessionName}.${index}`); index += 1) {
-            value += cookies.get(`${sessionName}.${index}`);
-        }
-        const stored = await unseal(await keys.session, value);
+        const stored = await unsealedChunks({ cookies, name: sessionName, key: await keys.session });
         return isStoredSession(stored) ? stored : undefined;
     }
     async function login(request) {
-        const returnTo = safeReturnTo(new URL(request.url).searchParams.get("returnTo"), afterLogin, appUrl);
+        const raw = new URL(request.url).searchParams.get("returnTo");
+        const returnTo = safeReturnTo({ raw, fallback: afterLogin, appUrl });
         const { url, state, verifier } = await startWebLogin(client, {
             redirectUri,
             ...(options.offlineAccess === true ? { offlineAccess: true } : {}),
             ...(options.idpHint ? { idpHint: options.idpHint } : {}),
         });
-        const sealed = await seal(await keys.login, { state, verifier, returnTo }, loginTtlMs);
-        return redirect(url, [cookie(loginName, sealed, { path: paths.callback, maxAge: loginTtlMs / 1000 })]);
+        const value = { state, verifier, returnTo };
+        const sealed = await seal({ key: await keys.login, value, ttlMs: loginTtlMs });
+        return redirect(url, [cookie({ name: loginName, value: sealed, path: paths.callback, maxAge: loginTtlMs / 1000 })]);
     }
     async function callback(request) {
         const url = new URL(request.url);
         const cookies = cookiesOf(request);
-        const clearLogin = cookie(loginName, "", { path: paths.callback, maxAge: 0 });
+        const clearLogin = cookie({ name: loginName, value: "", path: paths.callback, maxAge: 0 });
         const pending = await unseal(await keys.login, cookies.get(loginName));
         const failed = (reason) => new Response(`Sign-in failed: ${reason}`, { status: 400, headers: { "set-cookie": clearLogin } });
         if (url.searchParams.has("error")) {
@@ -209,9 +146,8 @@ export function webLoginRoutes(options) {
                 return callback(request);
             if (pathname === paths.logout && (request.method === "GET" || request.method === "POST")) {
                 // The session cookies are SameSite=Lax, so a link from another site would otherwise sign the person out.
-                const site = request.headers.get("sec-fetch-site");
-                if (site === "cross-site" || site === "same-site")
-                    return new Response("Sign out from the app", { status: 403 });
+                if (!originAllowsRequest(request, appUrl.origin))
+                    return new Response(crossSiteSignOutMessage, { status: 403 });
                 return logout(request);
             }
             return undefined;

package/dist/web-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-routes.js","sourceRoot":"","sources":["../src/web-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAmB,MAAM,MAAM,CAAC;AAG/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,GAEb,MAAM,gBAAgB,CAAC;AA4CxB,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACrD,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,2GAA2G;AAC3G,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe;IACvD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACtH,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACjD,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;KACxC,EACD,QAAQ,EACR,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAe,EAAE,KAAmC,EAAE,KAAc;IACtF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5F,IAAI,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,KAAyB;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8FAA8F;AAC9F,2GAA2G;AAC3G,SAAS,YAAY,CAAC,GAAkB,EAAE,QAAgB,EAAE,MAAW;IACrE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,2GAA2G;IAC3G,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7F,OAAO,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAQ,KAAuB,CAAC,WAAW,KAAK,QAAQ,CAAC;AACjH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAqB,CAAC;IACpC,OAAO,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACrH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,UAAU,GAAa,EAAE;IAC3D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,KAAK,MAAM,MAAM,IAAI,UAAU;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAEvG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC5C,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAC9F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC;IAC1D,MAAM,SAAS,GAAG,GAAG,WAAW,QAAQ,CAAC;IACzC,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC;QACrD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC;KAClD,CAAC;IACF,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACtC,0GAA0G;IAC1G,uEAAuE;IACvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEnD,SAAS,WAAW,CAAC,YAAoB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,GAAG,SAAS,GAAG,cAAc;gBAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC;QAChC,MAAM,KAAK,GAAkB,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3F,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACnC,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE;YACT,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,KAAK,CAAC,gBAAgB,GAAG,MAAM,EAAE,YAAY,CAAC;QAChD,CAAC,EACD,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CACrC,CAAC;QACF,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,oHAAoH;IACpH,SAAS,eAAe,CAAC,iBAAyB;QAChD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACrE,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;gBACxF,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjB,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa,EAAE,KAAK,GAAuC,EAAE;QACzF,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,QAAQ,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QACjG,IAAI,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,SAAS,cAAc,CAAC,OAA4B;QAClD,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;aACvB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,MAAqB,EAAE,OAA4B;QAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QACnD,IAAI,MAAM,GAAG,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAC1D,MAAM,CAAC,GAAG,WAAW,IAAI,KAAK,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,EAAE;YACzF,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CACH,CAAC;QACF,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;aAC9B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;aAC5G,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,OAA4B;QACvD,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACvE,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,OAAgB;QACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACrG,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE;YAC3D,WAAW;YACX,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAyB,EAAE,UAAU,CAAC,CAAC;QAC9G,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAChC,IAAI,QAAQ,CAAC,mBAAmB,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAEpG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC,yCAAyC,CAAC,CAAC;QAC9G,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,MAAM,EACN,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EACpG,SAAS,CACV,CAAC;QACF,MAAM,MAAM,GAAkB;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;YACzB,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACrC,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,2GAA2G;QAC3G,MAAM,OAAO,GAAG,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnH,MAAM,MAAM,GACV,OAAO,CAAC,cAAc,KAAK,KAAK;YAC9B,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE;gBACnB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,qBAAqB,EAAE,OAAO;aAC/B,CAAC,CAAC;QACT,OAAO,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;YAChF,IAAI,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtF,IAAI,QAAQ,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;gBACzF,yGAAyG;gBACzG,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,WAAW;oBAC/C,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAE/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;gBACxD,OAAO;oBACL,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,UAAU,EAAE,EAAE;iBACf,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzF,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAErF,MAAM,IAAI,GAAkB;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/F,CAAC;YACF,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,UAAU,EAAE,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;aAChD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"web-routes.js","sourceRoot":"","sources":["../src/web-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,IAAI,EACJ,kBAAkB,EAClB,oBAAoB,EACpB,MAAM,EACN,cAAc,EACd,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,GAEb,MAAM,gBAAgB,CAAC;AA0CxB,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAQ,KAAuB,CAAC,WAAW,KAAK,QAAQ,CAAC;AACjH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAE9D,MAAM,KAAK,GAAG,KAAqB,CAAC;IAEpC,OAAO,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACrH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,UAAU,GAAa,EAAE;IAC3D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IAEvE,KAAK,MAAM,MAAM,IAAI,UAAU;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAEtE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAEvG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAC9F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC;IAC1D,MAAM,SAAS,GAAG,GAAG,WAAW,QAAQ,CAAC;IACzC,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC;QACrD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC;KAClD,CAAC;IACF,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEtC,0GAA0G;IAC1G,uEAAuE;IACvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEnD,SAAS,WAAW,CAAC,YAAoB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,GAAG,SAAS,GAAG,cAAc;gBAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAE1C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC;QAEhC,MAAM,KAAK,GAAkB,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3F,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACnC,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE;YACT,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,KAAK,CAAC,gBAAgB,GAAG,MAAM,EAAE,YAAY,CAAC;QAChD,CAAC,EACD,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CACrC,CAAC;QAEF,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,oHAAoH;IACpH,SAAS,eAAe,CAAC,iBAAyB;QAChD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACrE,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;gBACxF,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjB,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,cAAc,CAAC,OAA4B;QAClD,OAAO,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,MAAqB,EAAE,OAA4B;QAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjF,OAAO,kBAAkB,CAAC;YACxB,OAAO;YACP,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,MAAM;YACjB,GAAG,EAAE,MAAM,IAAI,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM;YACb,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,OAA4B;QACvD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAE7F,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,OAAgB;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE;YAC3D,WAAW;YACX,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAyB,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAE/E,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtH,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAChC,IAAI,QAAQ,CAAC,mBAAmB,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAEpG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC;QACzG,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC,yCAAyC,CAAC,CAAC;QAE9G,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE1C,IAAI,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,MAAM,EACN,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EACpG,SAAS,CACV,CAAC;QACF,MAAM,MAAM,GAAkB;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC;QAEF,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAE5C,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;YACzB,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACrC,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC;QAED,2GAA2G;QAC3G,MAAM,OAAO,GAAG,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnH,MAAM,MAAM,GACV,OAAO,CAAC,cAAc,KAAK,KAAK;YAC9B,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE;gBACnB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,qBAAqB,EAAE,OAAO;aAC/B,CAAC,CAAC;QAET,OAAO,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAE1C,IAAI,QAAQ,KAAK,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;YAChF,IAAI,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;YAEtF,IAAI,QAAQ,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;gBACzF,yGAAyG;gBACzG,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;oBAAE,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAEhH,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAE5C,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAE/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,IAAI,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;gBACxD,OAAO;oBACL,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,UAAU,EAAE,EAAE;iBACf,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAEzF,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAErF,MAAM,IAAI,GAAkB;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/F,CAAC;YAEF,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,UAAU,EAAE,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;aAChD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manta-eu/auth",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Keycloak login for the SDK CLIs: browser and device-code login, silent token renewal, and credential storage; plus the default deployment the SDK targets",
   "homepage": "https://developers.manta.eu",
   "keywords": [
@@ -23,6 +23,14 @@
     "./web": {
       "types": "./dist/web.d.ts",
       "import": "./dist/web.js"
+    },
+    "./sealed-cookies": {
+      "types": "./dist/sealed-cookies.d.ts",
+      "import": "./dist/sealed-cookies.js"
+    },
+    "./request-origin": {
+      "types": "./dist/request-origin.d.ts",
+      "import": "./dist/request-origin.js"
     }
   },
   "author": "",
@@ -31,7 +39,7 @@
     "commander": "^15.0.0",
     "jose": "^6.2.12",
     "openid-client": "^6.8.8",
-    "@manta-eu/lib": "0.12.0"
+    "@manta-eu/lib": "0.13.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",

package/src/request-origin.ts

@@ -0,0 +1,21 @@
+import { isPresent } from "@manta-eu/lib/present";
+
+export const crossSiteSignOutMessage = "Sign out from the app";
+
+export function isWebSocket(request: Request): boolean {
+  return request.headers.get("upgrade")?.toLowerCase() === "websocket";
+}
+
+export function originAllowsRequest(request: Request, ownOrigin = new URL(request.url).origin): boolean {
+  const fetchSite = request.headers.get("sec-fetch-site");
+
+  if (fetchSite === "same-origin") return true;
+
+  if (fetchSite === "cross-site" || fetchSite === "same-site") return false;
+
+  const origin = request.headers.get("origin");
+
+  if (isPresent(origin)) return origin === ownOrigin;
+
+  return !isWebSocket(request) && (request.method === "GET" || request.method === "HEAD");
+}

package/src/sealed-cookies.ts

@@ -0,0 +1,145 @@
+import { isPresent } from "@manta-eu/lib/present";
+import { EncryptJWT, jwtDecrypt, type JWTPayload } from "jose";
+
+export type SealingKey = Awaited<ReturnType<typeof crypto.subtle.deriveKey>>;
+
+const chunkSize = 3800;
+const maxChunks = 10;
+
+const encoded = (text: string) => new TextEncoder().encode(text);
+
+export async function purposeKey(secret: string, purpose: string): Promise<SealingKey> {
+  const material = await crypto.subtle.importKey("raw", encoded(secret), "HKDF", false, ["deriveKey"]);
+  const derivation = { name: "HKDF", hash: "SHA-256", salt: encoded("manta-web-login"), info: encoded(purpose) };
+
+  return crypto.subtle.deriveKey(derivation, material, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+
+export type SealArgs = { key: SealingKey; value: JWTPayload; ttlMs?: number };
+
+export async function seal(args: SealArgs): Promise<string> {
+  const { key, value, ttlMs } = args;
+
+  const jwt = new EncryptJWT({ ...value }).setProtectedHeader({ alg: "dir", enc: "A256GCM" });
+
+  if (ttlMs !== undefined) jwt.setExpirationTime(new Date(Date.now() + ttlMs));
+
+  return jwt.encrypt(key);
+}
+
+export async function unseal(key: SealingKey, value: string | undefined): Promise<JWTPayload | undefined> {
+  if (!isPresent(value)) return undefined;
+
+  try {
+    const { payload } = await jwtDecrypt(value, key);
+
+    return payload;
+  } catch {
+    return undefined;
+  }
+}
+
+export function cookiesOf(request: Request): Map<string, string> {
+  const pairs = (request.headers.get("cookie") ?? "").split(";").flatMap((part) => {
+    const separator = part.indexOf("=");
+
+    return separator > 0 ? [[part.slice(0, separator).trim(), part.slice(separator + 1).trim()] as const] : [];
+  });
+
+  return new Map(pairs);
+}
+
+export type ReturnToArgs = { raw: string | null; fallback: string; appUrl: URL };
+
+export function safeReturnTo(args: ReturnToArgs): string {
+  const { raw, fallback, appUrl } = args;
+
+  if (!raw?.startsWith("/") || /[\p{Cc}\\]/u.test(raw)) return fallback;
+
+  const { origin, pathname, search, hash } = new URL(raw, appUrl);
+
+  if (origin !== appUrl.origin || pathname.startsWith("//")) return fallback;
+
+  return `${pathname}${search}${hash}`;
+}
+
+function cookieChunks(value: string): string[] {
+  const count = Math.ceil(value.length / chunkSize);
+
+  if (count > maxChunks) throw new Error("The session is too large to keep in cookies");
+
+  return Array.from({ length: count }, (_, index) => value.slice(index * chunkSize, (index + 1) * chunkSize));
+}
+
+function joinedChunks(cookies: Map<string, string>, name: string): string {
+  const names = Array.from({ length: maxChunks }, (_, index) => `${name}.${index}`);
+  const firstMissing = names.findIndex((chunk) => !cookies.has(chunk));
+
+  return names
+    .slice(0, firstMissing === -1 ? undefined : firstMissing)
+    .map((chunk) => cookies.get(chunk))
+    .join("");
+}
+
+type ChunkNamesArgs = { cookies: Map<string, string>; name: string; first: number };
+
+function chunkNamesFrom(args: ChunkNamesArgs): string[] {
+  const { cookies, name, first } = args;
+
+  const prefix = `${name}.`;
+
+  return [...cookies.keys()].filter(
+    (cookie) => cookie.startsWith(prefix) && Number(cookie.slice(prefix.length)) >= first,
+  );
+}
+
+export const sessionMaxAgeSeconds = 30 * 24 * 60 * 60;
+
+export type CookieArgs = { name: string; value: string; path?: string; maxAge?: number };
+
+export type SetCookie = (cookie: CookieArgs) => string;
+
+export function httpOnlyCookie(secure: boolean): SetCookie {
+  return (cookie) => {
+    const { name, value, path = "/", maxAge } = cookie;
+
+    return [
+      `${name}=${value}`,
+      `Path=${path}`,
+      "HttpOnly",
+      "SameSite=Lax",
+      ...(secure ? ["Secure"] : []),
+      ...(maxAge === undefined ? [] : [`Max-Age=${maxAge}`]),
+    ].join("; ");
+  };
+}
+
+export type ChunkCookiesArgs = { cookies: Map<string, string>; name: string; setCookie: SetCookie };
+
+export type SealedChunkCookiesArgs = ChunkCookiesArgs & { key: SealingKey; value: JWTPayload; maxAge?: number };
+
+export async function sealedChunkCookies(args: SealedChunkCookiesArgs): Promise<string[]> {
+  const { cookies, name, setCookie, key, value, maxAge } = args;
+
+  const chunks = cookieChunks(await seal({ key, value, ttlMs: maxAge === undefined ? undefined : maxAge * 1000 }));
+  const stale = chunkNamesFrom({ cookies, name, first: chunks.length });
+
+  return [
+    ...chunks.map((chunk, index) => setCookie({ name: `${name}.${index}`, value: chunk, maxAge })),
+    ...stale.map((chunk) => setCookie({ name: chunk, value: "", maxAge: 0 })),
+  ];
+}
+
+export function expiredChunkCookies(args: ChunkCookiesArgs): string[] {
+  const { cookies, name, setCookie } = args;
+
+  return chunkNamesFrom({ cookies, name, first: 0 }).map((chunk) => setCookie({ name: chunk, value: "", maxAge: 0 }));
+}
+
+export type UnsealedChunksArgs = Pick<ChunkCookiesArgs, "cookies" | "name"> & { key: SealingKey };
+
+export async function unsealedChunks(args: UnsealedChunksArgs): Promise<JWTPayload | undefined> {
+  const { cookies, name, key } = args;
+
+  return unseal(key, joinedChunks(cookies, name));
+}

package/src/web-routes.ts

@@ -1,6 +1,18 @@
-import { EncryptJWT, jwtDecrypt, type JWTPayload } from "jose";
 import type { FetchLike } from "./http.js";
 import type { OidcClient } from "./oidc.js";
+import { crossSiteSignOutMessage, originAllowsRequest } from "./request-origin.js";
+import {
+  cookiesOf,
+  expiredChunkCookies,
+  purposeKey,
+  safeReturnTo,
+  seal,
+  sealedChunkCookies,
+  sessionMaxAgeSeconds,
+  unseal,
+  unsealedChunks,
+  httpOnlyCookie,
+} from "./sealed-cookies.js";
 import { accessTokenExpiresAt } from "./token.js";
 import {
   endWebLogin,
@@ -51,78 +63,26 @@ type PendingLogin = { state: string; verifier: string; returnTo: string };
 
 type SharedRefresh = { renewed: Promise<WebTokens | undefined>; settledAt?: number; nextRefreshToken?: string };
 
-type SealingKey = Awaited<ReturnType<typeof crypto.subtle.deriveKey>>;
-
 const loginTtlMs = 10 * 60 * 1000;
-const offlineCookieMaxAgeSeconds = 30 * 24 * 60 * 60;
-const chunkSize = 3800;
-const maxChunks = 10;
 const refreshReuseMs = 10_000;
 
-// One key per purpose, so a login cookie can never be replayed as a session cookie or the other way round.
-async function purposeKey(secret: string, purpose: string): Promise<SealingKey> {
-  const material = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), "HKDF", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    {
-      name: "HKDF",
-      hash: "SHA-256",
-      salt: new TextEncoder().encode("manta-web-login"),
-      info: new TextEncoder().encode(purpose),
-    },
-    material,
-    { name: "AES-GCM", length: 256 },
-    false,
-    ["encrypt", "decrypt"],
-  );
-}
-
-async function seal(key: SealingKey, value: StoredSession | PendingLogin, ttlMs?: number): Promise<string> {
-  const jwt = new EncryptJWT({ ...value }).setProtectedHeader({ alg: "dir", enc: "A256GCM" });
-  if (ttlMs !== undefined) jwt.setExpirationTime(new Date(Date.now() + ttlMs));
-  return jwt.encrypt(key);
-}
-
-async function unseal(key: SealingKey, value: string | undefined): Promise<JWTPayload | undefined> {
-  if (!value) return undefined;
-  try {
-    return (await jwtDecrypt(value, key)).payload;
-  } catch {
-    return undefined;
-  }
-}
-
-function cookiesOf(request: Request): Map<string, string> {
-  const cookies = new Map<string, string>();
-  for (const part of (request.headers.get("cookie") ?? "").split(";")) {
-    const separator = part.indexOf("=");
-    if (separator > 0) cookies.set(part.slice(0, separator).trim(), part.slice(separator + 1).trim());
-  }
-  return cookies;
-}
-
-// Only a path on the app itself, so `/login?returnTo=` can never send people to another site.
-// A browser drops tabs and newlines from a Location, so `/\t/evil.example` would land on `//evil.example`.
-function safeReturnTo(raw: string | null, fallback: string, appUrl: URL): string {
-  if (!raw?.startsWith("/") || /[\p{Cc}\\]/u.test(raw)) return fallback;
-  const resolved = new URL(raw, appUrl);
-  // Resolving drops dot segments, so `/.//evil.example` comes out as the protocol-relative `//evil.example`.
-  if (resolved.origin !== appUrl.origin || resolved.pathname.startsWith("//")) return fallback;
-  return `${resolved.pathname}${resolved.search}${resolved.hash}`;
-}
-
 function isStoredSession(value: unknown): value is StoredSession {
   return typeof value === "object" && value !== null && typeof (value as StoredSession).accessToken === "string";
 }
 
 function isPendingLogin(value: unknown): value is PendingLogin {
   if (typeof value !== "object" || value === null) return false;
+
   const login = value as PendingLogin;
+
   return typeof login.state === "string" && typeof login.verifier === "string" && typeof login.returnTo === "string";
 }
 
 function redirect(location: string, setCookies: string[] = []): Response {
   const headers = new Headers({ location, "cache-control": "no-store" });
+
   for (const cookie of setCookies) headers.append("set-cookie", cookie);
+
   return new Response(null, { status: 302, headers });
 }
 
@@ -131,7 +91,7 @@ export function webLoginRoutes(options: WebLoginRoutesOptions): WebLoginRoutes {
   if (options.sessionSecret.length < 32) throw new Error("sessionSecret must be at least 32 characters");
 
   const appUrl = new URL(options.appUrl);
-  const secure = appUrl.protocol === "https:";
+  const cookie = httpOnlyCookie(appUrl.protocol === "https:");
   const paths = { login: "/login", callback: "/callback", logout: "/logout", ...options.paths };
   const afterLogin = options.afterLogin ?? "/";
   const afterLogout = options.afterLogout ?? "/";
@@ -143,17 +103,22 @@ export function webLoginRoutes(options: WebLoginRoutesOptions): WebLoginRoutes {
     login: purposeKey(options.sessionSecret, "login"),
   };
   const { client, fetchImpl } = options;
+
   // Keycloak takes a refresh token at most twice, so requests racing one expired session share one refresh,
   // and so do requests that arrive with the old cookie shortly after it.
   const refreshes = new Map<string, SharedRefresh>();
 
   function refreshOnce(refreshToken: string): Promise<WebTokens | undefined> {
     const now = Date.now();
+
     for (const [token, { settledAt }] of refreshes) {
       if (settledAt !== undefined && now - settledAt > refreshReuseMs) refreshes.delete(token);
     }
+
     const known = refreshes.get(refreshToken);
+
     if (known) return known.renewed;
+
     const entry: SharedRefresh = { renewed: refreshWebLogin(client, refreshToken, fetchImpl) };
     refreshes.set(refreshToken, entry);
     void entry.renewed.then(
@@ -163,6 +128,7 @@ export function webLoginRoutes(options: WebLoginRoutesOptions): WebLoginRoutes {
       },
       () => refreshes.delete(refreshToken),
     );
+
     return entry.renewed;
   }
 
@@ -177,59 +143,48 @@ export function webLoginRoutes(options: WebLoginRoutesOptions): WebLoginRoutes {
     }
   }
 
-  function cookie(name: string, value: string, extra: { path?: string; maxAge?: number } = {}): string {
-    const attributes = [`${name}=${value}`, `Path=${extra.path ?? "/"}`, "HttpOnly", "SameSite=Lax"];
-    if (secure) attributes.push("Secure");
-    if (extra.maxAge !== undefined) attributes.push(`Max-Age=${extra.maxAge}`);
-    return attributes.join("; ");
-  }
-
   function clearedSession(cookies: Map<string, string>): string[] {
-    return [...cookies.keys()]
-      .filter((name) => name.startsWith(`${sessionName}.`))
-      .map((name) => cookie(name, "", { maxAge: 0 }));
+    return expiredChunkCookies({ cookies, name: sessionName, setCookie: cookie });
   }
 
   async function sessionCookies(stored: StoredSession, cookies: Map<string, string>): Promise<string[]> {
-    const value = await seal(await keys.session, stored);
-    const chunks = Math.ceil(value.length / chunkSize);
-    if (chunks > maxChunks) throw new Error("The session is too large to keep in cookies");
-    const maxAge = options.offlineAccess === true ? offlineCookieMaxAgeSeconds : undefined;
-    const written = Array.from({ length: chunks }, (_, index) =>
-      cookie(`${sessionName}.${index}`, value.slice(index * chunkSize, (index + 1) * chunkSize), {
-        ...(maxAge === undefined ? {} : { maxAge }),
-      }),
-    );
-    const stale = [...cookies.keys()]
-      .filter((name) => name.startsWith(`${sessionName}.`) && Number(name.slice(sessionName.length + 1)) >= chunks)
-      .map((name) => cookie(name, "", { maxAge: 0 }));
-    return [...written, ...stale];
+    const maxAge = options.offlineAccess === true ? sessionMaxAgeSeconds : undefined;
+
+    return sealedChunkCookies({
+      cookies,
+      name: sessionName,
+      setCookie: cookie,
+      key: await keys.session,
+      value: stored,
+      maxAge,
+    });
   }
 
   async function storedSession(cookies: Map<string, string>): Promise<StoredSession | undefined> {
-    let value = "";
-    for (let index = 0; cookies.has(`${sessionName}.${index}`); index += 1) {
-      value += cookies.get(`${sessionName}.${index}`);
-    }
-    const stored = await unseal(await keys.session, value);
+    const stored = await unsealedChunks({ cookies, name: sessionName, key: await keys.session });
+
     return isStoredSession(stored) ? stored : undefined;
   }
 
   async function login(request: Request): Promise<Response> {
-    const returnTo = safeReturnTo(new URL(request.url).searchParams.get("returnTo"), afterLogin, appUrl);
+    const raw = new URL(request.url).searchParams.get("returnTo");
+    const returnTo = safeReturnTo({ raw, fallback: afterLogin, appUrl });
     const { url, state, verifier } = await startWebLogin(client, {
       redirectUri,
       ...(options.offlineAccess === true ? { offlineAccess: true } : {}),
       ...(options.idpHint ? { idpHint: options.idpHint } : {}),
     });
-    const sealed = await seal(await keys.login, { state, verifier, returnTo } satisfies PendingLogin, loginTtlMs);
-    return redirect(url, [cookie(loginName, sealed, { path: paths.callback, maxAge: loginTtlMs / 1000 })]);
+
+    const value = { state, verifier, returnTo } satisfies PendingLogin;
+    const sealed = await seal({ key: await keys.login, value, ttlMs: loginTtlMs });
+
+    return redirect(url, [cookie({ name: loginName, value: sealed, path: paths.callback, maxAge: loginTtlMs / 1000 })]);
   }
 
   async function callback(request: Request): Promise<Response> {
     const url = new URL(request.url);
     const cookies = cookiesOf(request);
-    const clearLogin = cookie(loginName, "", { path: paths.callback, maxAge: 0 });
+    const clearLogin = cookie({ name: loginName, value: "", path: paths.callback, maxAge: 0 });
     const pending = await unseal(await keys.login, cookies.get(loginName));
     const failed = (reason: string) =>
       new Response(`Sign-in failed: ${reason}`, { status: 400, headers: { "set-cookie": clearLogin } });
@@ -237,9 +192,12 @@ export function webLoginRoutes(options: WebLoginRoutesOptions): WebLoginRoutes {
     if (url.searchParams.has("error")) {
       return failed(url.searchParams.get("error_description") ?? url.searchParams.get("error") ?? "refused");
     }
+
     if (!isPendingLogin(pending)) return failed("the sign-in expired, start again");
     if (url.searchParams.get("state") !== pending.state) return failed("the sign-in does not match this browser");
+
     const code = url.searchParams.get("code");
+
     if (!code) return failed("no code");
 
     const tokens = await finishWebLogin(
@@ -252,16 +210,19 @@ export function webLoginRoutes(options: WebLoginRoutesOptions): WebLoginRoutes {
       ...(tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {}),
       ...(tokens.idToken ? { idToken: tokens.idToken } : {}),
     };
+
     return redirect(pending.returnTo, [...(await sessionCookies(stored, cookies)), clearLogin]);
   }
 
   async function logout(request: Request): Promise<Response> {
     const cookies = cookiesOf(request);
     const stored = await storedSession(cookies);
+
     if (stored?.refreshToken) {
       forgetRefreshes(stored.refreshToken);
       await endWebLogin(client, stored.refreshToken, fetchImpl);
     }
+
     // Keycloak matches this exactly against the app's redirect URLs and home URL, which has no trailing slash.
     const landing = afterLogout === "/" ? options.appUrl.replace(/\/+$/, "") : new URL(afterLogout, appUrl).toString();
     const target =
@@ -271,30 +232,35 @@ export function webLoginRoutes(options: WebLoginRoutesOptions): WebLoginRoutes {
             ...(stored?.idToken ? { idToken: stored.idToken } : {}),
             postLogoutRedirectUri: landing,
           });
+
     return redirect(target, clearedSession(cookies));
   }
 
   return {
     async handle(request) {
       const { pathname } = new URL(request.url);
+
       if (pathname === paths.login && request.method === "GET") return login(request);
       if (pathname === paths.callback && request.method === "GET") return callback(request);
+
       if (pathname === paths.logout && (request.method === "GET" || request.method === "POST")) {
         // The session cookies are SameSite=Lax, so a link from another site would otherwise sign the person out.
-        const site = request.headers.get("sec-fetch-site");
-        if (site === "cross-site" || site === "same-site")
-          return new Response("Sign out from the app", { status: 403 });
+        if (!originAllowsRequest(request, appUrl.origin)) return new Response(crossSiteSignOutMessage, { status: 403 });
+
         return logout(request);
       }
+
       return undefined;
     },
 
     async session(request) {
       const cookies = cookiesOf(request);
       const stored = await storedSession(cookies);
+
       if (!stored) return { accessToken: undefined, setCookies: [] };
 
       const now = Date.now();
+
       if (accessTokenExpiresAt(stored.accessToken, now) > now) {
         return {
           accessToken: stored.accessToken,
@@ -304,6 +270,7 @@ export function webLoginRoutes(options: WebLoginRoutesOptions): WebLoginRoutes {
       }
 
       const renewed = stored.refreshToken ? await refreshOnce(stored.refreshToken) : undefined;
+
       if (!renewed) return { accessToken: undefined, setCookies: clearedSession(cookies) };
 
       const next: StoredSession = {
@@ -311,6 +278,7 @@ export function webLoginRoutes(options: WebLoginRoutesOptions): WebLoginRoutes {
         ...(renewed.refreshToken ? { refreshToken: renewed.refreshToken } : {}),
         ...((renewed.idToken ?? stored.idToken) ? { idToken: renewed.idToken ?? stored.idToken } : {}),
       };
+
       return {
         accessToken: next.accessToken,
         ...(next.idToken ? { idToken: next.idToken } : {}),