@micacms/auth-oidc 0.2.0

package/README.md

@@ -0,0 +1,16 @@
+# @micacms/auth-oidc
+
+> **Experimental.** Pre-1.0: the API can still change without notice.
+
+The server-only OIDC gate for Mica: the authorization code flow with PKCE,
+sessions in SQLite, admission rules over provider claims, and the middleware
+gate the runtime mounts in front of the admin API.
+
+It is a dependency of `@micacms/self-hosted` and of nothing else. In
+particular, the local editor (`@micacms/editor`) must never gain a path to
+this package — that absence is the product boundary that keeps
+`npx @micacms/editor` free of authentication code, and a test walks the
+dependency graph to enforce it.
+
+Mica implements no passwords, no reset flow, no MFA and no passkeys, in here
+or anywhere: an external identity provider does all of it better.

package/dist/admission.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Admission — who may edit this site.
+ *
+ * OpenID Connect states who a person is. It says nothing about whether that
+ * person may edit this website: a provider vouches for a whole company, and a
+ * perfectly valid ID token is the beginning of the question rather than the
+ * answer to it.
+ *
+ * Mica used to answer it from a `memberships` table. It no longer has one, and
+ * has no accounts to put in it. Admission is configuration:
+ *
+ *   MICA_ADMIT_GROUP=mica-editors            a claim the provider sends
+ *   MICA_ADMIT_DOMAIN=example.com            every verified address there
+ *   MICA_ADMIT_SUBJECTS=https://id.example.com|a1b2c3
+ *
+ * The group rule is the one to grow into. Adding an editor is then a group
+ * change in the identity provider — where the operator already manages
+ * joiners and leavers — and Mica is not touched, not restarted, and holds no
+ * copy of the list to go stale. The subject list exists for a provider with no
+ * groups, and for the first sign-in before a group exists.
+ *
+ * What this costs, and it is a real cost: removing somebody from a group at
+ * the provider does not take effect until their next sign-in, because the
+ * claims Mica checks are the ones it was given. Configuration changes *are*
+ * immediate — this policy is re-read on every request — and the session
+ * lifetime is the upper bound on the rest. That trade is recorded as a P1
+ * decision in docs/decisions.md.
+ */
+import type { AuthConfig } from "./config.js";
+import type { SessionIdentity } from "./sessions-repository.js";
+export type AdmissionResult = {
+    admitted: true;
+} | {
+    admitted: false;
+    reason: string;
+};
+export interface AdmissionPolicy {
+    /** One line for the startup log, so an operator can see what is in force. */
+    readonly summary: string;
+    admits(identity: SessionIdentity): AdmissionResult;
+}
+export declare function createAdmissionPolicy(config: Pick<AuthConfig, "admitGroups" | "admitDomains" | "admitSubjects">): AdmissionPolicy;
+//# sourceMappingURL=admission.d.ts.map

package/dist/admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.d.ts","sourceRoot":"","sources":["../src/admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvF,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,QAAQ,EAAE,eAAe,GAAG,eAAe,CAAC;CACpD;AAsCD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,aAAa,GAAG,cAAc,GAAG,eAAe,CAAC,GACzE,eAAe,CA+CjB"}

package/dist/admission.js

@@ -0,0 +1,101 @@
+/**
+ * Admission — who may edit this site.
+ *
+ * OpenID Connect states who a person is. It says nothing about whether that
+ * person may edit this website: a provider vouches for a whole company, and a
+ * perfectly valid ID token is the beginning of the question rather than the
+ * answer to it.
+ *
+ * Mica used to answer it from a `memberships` table. It no longer has one, and
+ * has no accounts to put in it. Admission is configuration:
+ *
+ *   MICA_ADMIT_GROUP=mica-editors            a claim the provider sends
+ *   MICA_ADMIT_DOMAIN=example.com            every verified address there
+ *   MICA_ADMIT_SUBJECTS=https://id.example.com|a1b2c3
+ *
+ * The group rule is the one to grow into. Adding an editor is then a group
+ * change in the identity provider — where the operator already manages
+ * joiners and leavers — and Mica is not touched, not restarted, and holds no
+ * copy of the list to go stale. The subject list exists for a provider with no
+ * groups, and for the first sign-in before a group exists.
+ *
+ * What this costs, and it is a real cost: removing somebody from a group at
+ * the provider does not take effect until their next sign-in, because the
+ * claims Mica checks are the ones it was given. Configuration changes *are*
+ * immediate — this policy is re-read on every request — and the session
+ * lifetime is the upper bound on the rest. That trade is recorded as a P1
+ * decision in docs/decisions.md.
+ */
+/**
+ * The subject is the account key, and an email address is never one.
+ *
+ * Most providers let a person change their address, and some let two people
+ * hold one in turn. Keying admission on an address is therefore a standing
+ * offer to whoever holds it next, which is a well-trodden route to account
+ * takeover. The issuer is part of the key because a subject is only unique
+ * within the provider that issued it.
+ */
+function matchesSubject(identity, entries) {
+    return entries.some((entry) => entry.issuer === identity.issuer && entry.subject === identity.subject);
+}
+function matchesDomain(identity, domains) {
+    const at = identity.email.lastIndexOf("@");
+    if (at < 0)
+        return false;
+    return domains.includes(identity.email.slice(at + 1).toLowerCase());
+}
+/**
+ * Group names are compared case-sensitively, and a leading `/` is ignored.
+ *
+ * Keycloak sends group paths — `/mica-editors` — while most other providers
+ * send bare names. Accepting both means an operator writes the name they see
+ * in their own console, which is the only name they have.
+ */
+function matchesGroup(identity, groups) {
+    const held = new Set(identity.groups.map((group) => group.replace(/^\//, "")));
+    return groups.some((group) => held.has(group.replace(/^\//, "")));
+}
+export function createAdmissionPolicy(config) {
+    const { admitGroups, admitDomains, admitSubjects } = config;
+    const summary = [
+        admitGroups.length > 0 ? `group=${admitGroups.join("|")}` : null,
+        admitDomains.length > 0 ? `domain=${admitDomains.join("|")}` : null,
+        admitSubjects.length > 0 ? `subjects=${admitSubjects.length}` : null,
+    ]
+        .filter(Boolean)
+        .join(", ");
+    return {
+        summary,
+        admits(identity) {
+            // The explicit list first: it is the escape hatch, and it has to work
+            // when the group claim is missing or the address is unverified.
+            if (matchesSubject(identity, admitSubjects))
+                return { admitted: true };
+            if (matchesGroup(identity, admitGroups))
+                return { admitted: true };
+            if (admitDomains.length > 0 && matchesDomain(identity, admitDomains)) {
+                /**
+                 * A domain rule trusts the provider to have checked the address.
+                 *
+                 * Where a provider allows self-registration, an unverified address is
+                 * a claim the person typed. Admitting on that would let anybody enter
+                 * a domain they do not hold, so the rule refuses and says why — the
+                 * operator can turn verification on, or use a group or subject rule
+                 * instead.
+                 */
+                if (identity.emailVerified)
+                    return { admitted: true };
+                return {
+                    admitted: false,
+                    reason: `${identity.email} is in an admitted domain, but the identity provider ` +
+                        "does not report the address as verified.",
+                };
+            }
+            return {
+                admitted: false,
+                reason: `${identity.email || identity.subject} is not admitted to this site.`,
+            };
+        },
+    };
+}
+//# sourceMappingURL=admission.js.map

package/dist/admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../src/admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAaH;;;;;;;;GAQG;AACH,SAAS,cAAc,CACrB,QAAyB,EACzB,OAA2D;IAE3D,OAAO,OAAO,CAAC,IAAI,CACjB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAClF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAyB,EAAE,OAA0B;IAC1E,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,QAAyB,EAAE,MAAyB;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAA0E;IAE1E,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAE5D,MAAM,OAAO,GAAG;QACd,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAChE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QACnE,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI;KACrE;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;QACL,OAAO;QAEP,MAAM,CAAC,QAAQ;YACb,sEAAsE;YACtE,gEAAgE;YAChE,IAAI,cAAc,CAAC,QAAQ,EAAE,aAAa,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAEvE,IAAI,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAEnE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;gBACrE;;;;;;;;mBAQG;gBACH,IAAI,QAAQ,CAAC,aAAa;oBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAEtD,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EACJ,GAAG,QAAQ,CAAC,KAAK,uDAAuD;wBACxE,0CAA0C;iBAC7C,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,gCAAgC;aAC9E,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,126 @@
+/**
+ * The auth gate's slice of the environment.
+ *
+ * A fragment, like the runtime's: the self-hosted app spreads `authEnv` into
+ * its own schema, derives with `deriveAuth`, and passes the result here. The
+ * local editor never touches any of this — these variables do not exist in
+ * its configuration at all, which is a stronger statement than ignoring them.
+ */
+import { z } from "zod";
+export declare const authEnv: {
+    /**
+     * OpenID Connect. Mica implements no passwords, no reset flow and no second
+     * factor. It asks a provider who you are; the admission rules below decide
+     * whether that person may edit this site.
+     */
+    MICA_OIDC_ISSUER: z.ZodOptional<z.ZodString>;
+    MICA_OIDC_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    /** Omit for a public client using PKCE alone. */
+    MICA_OIDC_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    MICA_OIDC_SCOPE: z.ZodDefault<z.ZodString>;
+    /**
+     * Which claim carries the person's groups. There is no standard one:
+     * Keycloak and Entra normally send `groups`, others send `roles`, and some
+     * send whatever the operator mapped. Naming it here is what keeps
+     * `MICA_ADMIT_GROUP` working against any provider.
+     */
+    MICA_OIDC_GROUPS_CLAIM: z.ZodDefault<z.ZodString>;
+    /**
+     * Who may edit this site. Authentication says who somebody is; these say
+     * whether that person gets in. At least one is required — the composition
+     * refuses to start without one. Comma-separated, all three.
+     */
+    MICA_ADMIT_GROUP: z.ZodOptional<z.ZodString>;
+    MICA_ADMIT_DOMAIN: z.ZodOptional<z.ZodString>;
+    /** `issuer|subject` pairs. Never an email — see admission.ts. */
+    MICA_ADMIT_SUBJECTS: z.ZodOptional<z.ZodString>;
+    /** Signs session cookies. Rotating it invalidates every session. */
+    SESSION_SECRET: z.ZodOptional<z.ZodString>;
+    /**
+     * Deliberately short. Admission is configuration and is re-read on every
+     * request; what cannot be immediate is a change *at the provider*, which
+     * Mica only sees at the next sign-in. The session lifetime is therefore the
+     * upper bound on how long a revoked editor keeps working.
+     */
+    SESSION_TTL_HOURS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    SESSION_IDLE_HOURS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    LOGIN_MAX_ATTEMPTS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    LOGIN_WINDOW_MS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+};
+declare const authSchema: z.ZodObject<{
+    MICA_OIDC_ISSUER: z.ZodOptional<z.ZodString>;
+    MICA_OIDC_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    MICA_OIDC_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    MICA_OIDC_SCOPE: z.ZodDefault<z.ZodString>;
+    MICA_OIDC_GROUPS_CLAIM: z.ZodDefault<z.ZodString>;
+    MICA_ADMIT_GROUP: z.ZodOptional<z.ZodString>;
+    MICA_ADMIT_DOMAIN: z.ZodOptional<z.ZodString>;
+    MICA_ADMIT_SUBJECTS: z.ZodOptional<z.ZodString>;
+    SESSION_SECRET: z.ZodOptional<z.ZodString>;
+    SESSION_TTL_HOURS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    SESSION_IDLE_HOURS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    LOGIN_MAX_ATTEMPTS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    LOGIN_WINDOW_MS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export type AuthEnv = z.infer<typeof authSchema>;
+/** The derived values the gate reads, on top of the parsed environment. */
+export declare function deriveAuth<T extends AuthEnv & {
+    NODE_ENV: string;
+    MICA_PUBLIC_URL: string;
+}>(env: T): T & {
+    /**
+     * Discovery over plain HTTP, for an identity provider running on
+     * localhost. Never in production, and never for a remote host.
+     */
+    oidcAllowInsecure: boolean;
+    admitGroups: string[];
+    admitDomains: string[];
+    admitSubjects: {
+        issuer: string;
+        subject: string;
+    }[];
+    cookieSecure: boolean;
+};
+/** What the gate requires of a finished configuration. */
+export interface AuthConfig {
+    MICA_PUBLIC_URL: string;
+    isProduction: boolean;
+    MICA_OIDC_ISSUER?: string | undefined;
+    MICA_OIDC_CLIENT_ID?: string | undefined;
+    MICA_OIDC_CLIENT_SECRET?: string | undefined;
+    MICA_OIDC_SCOPE: string;
+    MICA_OIDC_GROUPS_CLAIM: string;
+    oidcAllowInsecure: boolean;
+    admitGroups: string[];
+    admitDomains: string[];
+    admitSubjects: Array<{
+        issuer: string;
+        subject: string;
+    }>;
+    /** Resolved by the app: mandatory in production, ephemeral in development. */
+    sessionSecret: string;
+    cookieSecure: boolean;
+    SESSION_TTL_HOURS: number;
+    SESSION_IDLE_HOURS: number;
+    LOGIN_MAX_ATTEMPTS: number;
+    LOGIN_WINDOW_MS: number;
+}
+/**
+ * The refusals that make a deployment honest before it serves a request.
+ *
+ * An OIDC deployment that admits every person its issuer knows is a
+ * misconfiguration, not a default — see decisions.md.
+ */
+export declare function requireAuthConfig(config: {
+    MICA_PUBLIC_URL: string;
+    MICA_OIDC_ISSUER?: string | undefined;
+    MICA_OIDC_CLIENT_ID?: string | undefined;
+    admitGroups: string[];
+    admitDomains: string[];
+    admitSubjects: Array<{
+        issuer: string;
+        subject: string;
+    }>;
+}): void;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,OAAO;IAClB;;;;OAIG;;;IAGH,iDAAiD;;;IAGjD;;;;;OAKG;;IAGH;;;;OAIG;;;IAGH,iEAAiE;;IAGjE,oEAAoE;;IAEpE;;;;;OAKG;;;;;CAUJ,CAAC;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;;;iBAAoB,CAAC;AACrC,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEjD,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,CAAC,SAAS,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,EAC1F,GAAG,EAAE,CAAC;IAIJ;;;OAGG;;;;;;;;;EAqBN;AAED,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,eAAe,EAAE,MAAM,CAAC;IACxB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D,GAAG,IAAI,CA2CP"}

package/dist/config.js

@@ -0,0 +1,119 @@
+/**
+ * The auth gate's slice of the environment.
+ *
+ * A fragment, like the runtime's: the self-hosted app spreads `authEnv` into
+ * its own schema, derives with `deriveAuth`, and passes the result here. The
+ * local editor never touches any of this — these variables do not exist in
+ * its configuration at all, which is a stronger statement than ignoring them.
+ */
+import { z } from "zod";
+import { ConfigError, list } from "@micacms/runtime";
+export const authEnv = {
+    /**
+     * OpenID Connect. Mica implements no passwords, no reset flow and no second
+     * factor. It asks a provider who you are; the admission rules below decide
+     * whether that person may edit this site.
+     */
+    MICA_OIDC_ISSUER: z.string().url().optional(),
+    MICA_OIDC_CLIENT_ID: z.string().optional(),
+    /** Omit for a public client using PKCE alone. */
+    MICA_OIDC_CLIENT_SECRET: z.string().optional(),
+    MICA_OIDC_SCOPE: z.string().default("openid profile email"),
+    /**
+     * Which claim carries the person's groups. There is no standard one:
+     * Keycloak and Entra normally send `groups`, others send `roles`, and some
+     * send whatever the operator mapped. Naming it here is what keeps
+     * `MICA_ADMIT_GROUP` working against any provider.
+     */
+    MICA_OIDC_GROUPS_CLAIM: z.string().default("groups"),
+    /**
+     * Who may edit this site. Authentication says who somebody is; these say
+     * whether that person gets in. At least one is required — the composition
+     * refuses to start without one. Comma-separated, all three.
+     */
+    MICA_ADMIT_GROUP: z.string().optional(),
+    MICA_ADMIT_DOMAIN: z.string().optional(),
+    /** `issuer|subject` pairs. Never an email — see admission.ts. */
+    MICA_ADMIT_SUBJECTS: z.string().optional(),
+    /** Signs session cookies. Rotating it invalidates every session. */
+    SESSION_SECRET: z.string().min(32).optional(),
+    /**
+     * Deliberately short. Admission is configuration and is re-read on every
+     * request; what cannot be immediate is a change *at the provider*, which
+     * Mica only sees at the next sign-in. The session lifetime is therefore the
+     * upper bound on how long a revoked editor keeps working.
+     */
+    SESSION_TTL_HOURS: z.coerce.number().int().positive().default(8),
+    SESSION_IDLE_HOURS: z.coerce.number().int().positive().default(4),
+    LOGIN_MAX_ATTEMPTS: z.coerce.number().int().positive().default(10),
+    LOGIN_WINDOW_MS: z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(15 * 60 * 1000),
+};
+const authSchema = z.object(authEnv);
+/** The derived values the gate reads, on top of the parsed environment. */
+export function deriveAuth(env) {
+    return {
+        ...env,
+        /**
+         * Discovery over plain HTTP, for an identity provider running on
+         * localhost. Never in production, and never for a remote host.
+         */
+        oidcAllowInsecure: env.NODE_ENV !== "production" &&
+            /^http:\/\/(localhost|127\.0\.0\.1)(:|\/|$)/.test(env.MICA_OIDC_ISSUER ?? ""),
+        admitGroups: list(env.MICA_ADMIT_GROUP),
+        // Lowercased: a domain is case-insensitive, and an operator who writes
+        // `Example.com` means the same thing the provider spells `example.com`.
+        admitDomains: list(env.MICA_ADMIT_DOMAIN).map((domain) => domain.toLowerCase().replace(/^@/, "")),
+        admitSubjects: list(env.MICA_ADMIT_SUBJECTS).map((entry) => {
+            const separator = entry.indexOf("|");
+            return {
+                issuer: separator < 0 ? "" : entry.slice(0, separator).trim(),
+                subject: separator < 0 ? entry : entry.slice(separator + 1).trim(),
+            };
+        }),
+        // Secure cookies are not sent over plain HTTP, which would break a
+        // localhost trial run.
+        cookieSecure: env.MICA_PUBLIC_URL.startsWith("https://"),
+    };
+}
+/**
+ * The refusals that make a deployment honest before it serves a request.
+ *
+ * An OIDC deployment that admits every person its issuer knows is a
+ * misconfiguration, not a default — see decisions.md.
+ */
+export function requireAuthConfig(config) {
+    const needed = ["MICA_OIDC_ISSUER", "MICA_OIDC_CLIENT_ID"].filter((key) => !config[key]);
+    if (needed.length > 0) {
+        throw new ConfigError(`This deployment authenticates with OpenID Connect, so ` +
+            `${needed.join(" and ")} must be set.\n` +
+            "  Mica implements no passwords. Point it at Keycloak, Authentik,\n" +
+            "  ZITADEL, Entra, Okta, Google — anything that speaks OIDC.\n" +
+            `  The redirect URI to register is ${config.MICA_PUBLIC_URL}/api/auth/callback`);
+    }
+    if (config.admitGroups.length === 0 &&
+        config.admitDomains.length === 0 &&
+        config.admitSubjects.length === 0) {
+        throw new ConfigError("Nothing says who may edit this site.\n" +
+            "  Authentication is not admission: your provider will happily vouch for\n" +
+            "  everybody it knows. Set at least one of these:\n\n" +
+            "    MICA_ADMIT_GROUP=mica-editors            a claim your provider sends\n" +
+            "    MICA_ADMIT_DOMAIN=example.com            every verified address there\n" +
+            "    MICA_ADMIT_SUBJECTS=https://id.example.com|a1b2c3\n\n" +
+            "  The group rule is the one to grow into: adding an editor is then a\n" +
+            "  change in the identity provider, and Mica is not touched.");
+    }
+    const wrong = config.admitSubjects.filter((entry) => !entry.issuer || !entry.subject);
+    if (wrong.length > 0) {
+        throw new ConfigError("MICA_ADMIT_SUBJECTS entries are `issuer|subject` pairs, and one is not:\n" +
+            `    ${wrong.map((entry) => entry.subject || "(empty)").join(", ")}\n\n` +
+            "  The issuer is part of the key because a subject is only unique within\n" +
+            "  the provider that issued it. It is never an email address: providers\n" +
+            "  let people change those, and two people can hold one in turn.\n" +
+            `    MICA_ADMIT_SUBJECTS=${config.MICA_OIDC_ISSUER ?? "https://id.example.com"}|a1b2c3`);
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,iDAAiD;IACjD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAC3D;;;;;OAKG;IACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEpD;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,iEAAiE;IACjE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,oEAAoE;IACpE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEjE,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM;SACtB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAGrC,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CACxB,GAAM;IAEN,OAAO;QACL,GAAG,GAAG;QACN;;;WAGG;QACH,iBAAiB,EACf,GAAG,CAAC,QAAQ,KAAK,YAAY;YAC7B,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAC/E,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACvC,uEAAuE;QACvE,wEAAwE;QACxE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACvD,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CACvC;QACD,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACzD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE;gBAC7D,OAAO,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;aACnE,CAAC;QACJ,CAAC,CAAC;QACF,mEAAmE;QACnE,uBAAuB;QACvB,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC;KACzD,CAAC;AACJ,CAAC;AAwBD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAOjC;IACC,MAAM,MAAM,GAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAW,CAAC,MAAM,CAC1E,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACtB,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CACnB,wDAAwD;YACtD,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACxC,oEAAoE;YACpE,+DAA+D;YAC/D,qCAAqC,MAAM,CAAC,eAAe,oBAAoB,CAClF,CAAC;IACJ,CAAC;IAED,IACE,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC/B,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAChC,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,WAAW,CACnB,wCAAwC;YACtC,2EAA2E;YAC3E,sDAAsD;YACtD,4EAA4E;YAC5E,6EAA6E;YAC7E,2DAA2D;YAC3D,wEAAwE;YACxE,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,WAAW,CACnB,2EAA2E;YACzE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YACxE,2EAA2E;YAC3E,0EAA0E;YAC1E,mEAAmE;YACnE,2BAA2B,MAAM,CAAC,gBAAgB,IAAI,wBAAwB,SAAS,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/gate.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The gate: what stands between a request and the admin API.
+ *
+ * Two layers, in order. `requireAccess` turns a session cookie into an
+ * `AccessContext` — or a 401 — re-checking admission on every request so a
+ * configuration change is immediate. `csrfProtection` is the double-submit
+ * token over the Origin check the runtime already applies: cross-origin
+ * JavaScript can neither read the cookie nor set the header.
+ */
+import type { Context, MiddlewareHandler } from "hono";
+import { type Env } from "@micacms/runtime";
+import type { AdmissionPolicy } from "./admission.js";
+import { type SessionService } from "./session.js";
+import type { SessionRecord, SessionRepository } from "./sessions-repository.js";
+export declare function sessionOf(c: Context<Env>): SessionRecord;
+export interface GateDeps {
+    sessions: SessionService;
+    sessionsRepo: SessionRepository;
+    admission: AdmissionPolicy;
+}
+/**
+ * Rejects the request unless there is a live session whose person is still
+ * admitted.
+ *
+ * Admission is re-read on every request, not decided once at sign-in. That is
+ * what makes a configuration change immediate: an operator who takes somebody
+ * out of `MICA_ADMIT_SUBJECTS` and restarts has removed them. What it cannot
+ * make immediate is a group removal at the provider — the claims here are the
+ * ones the provider sent, and Mica learns better at the next sign-in.
+ */
+export declare function requireAccess(deps: GateDeps): MiddlewareHandler<Env>;
+/**
+ * Second CSRF layer: double-submit token. The session's token is issued in a
+ * cookie the SPA can read and must be echoed in a header.
+ *
+ * Runs after `requireAccess`, and complements the session cookie's
+ * `SameSite=Lax`, which already blocks the classic cross-site form post.
+ */
+export declare function csrfProtection(): MiddlewareHandler<Env>;
+//# sourceMappingURL=gate.d.ts.map

package/dist/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,EAAY,KAAK,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAuD,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACxG,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAQjF,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,CAGxD;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,cAAc,CAAC;IACzB,YAAY,EAAE,iBAAiB,CAAC;IAChC,SAAS,EAAE,eAAe,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAgCpE;AAID;;;;;;GAMG;AACH,wBAAgB,cAAc,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAiBvD"}

package/dist/gate.js

@@ -0,0 +1,84 @@
+/**
+ * The gate: what stands between a request and the admin API.
+ *
+ * Two layers, in order. `requireAccess` turns a session cookie into an
+ * `AccessContext` — or a 401 — re-checking admission on every request so a
+ * configuration change is immediate. `csrfProtection` is the double-submit
+ * token over the Origin check the runtime already applies: cross-origin
+ * JavaScript can neither read the cookie nor set the header.
+ */
+import { getCookie } from "hono/cookie";
+import { ApiError } from "@micacms/runtime";
+import { CSRF_COOKIE, CSRF_HEADER, safeEqual, SESSION_COOKIE } from "./session.js";
+/**
+ * The session behind the current request. Auth's own context variable —
+ * the runtime knows only the `access` it derives from it.
+ */
+const SESSION_VARIABLE = "authSession";
+export function sessionOf(c) {
+    // Set by requireAccess, which runs in front of everything that calls this.
+    return c.get(SESSION_VARIABLE);
+}
+/**
+ * Rejects the request unless there is a live session whose person is still
+ * admitted.
+ *
+ * Admission is re-read on every request, not decided once at sign-in. That is
+ * what makes a configuration change immediate: an operator who takes somebody
+ * out of `MICA_ADMIT_SUBJECTS` and restarts has removed them. What it cannot
+ * make immediate is a group removal at the provider — the claims here are the
+ * ones the provider sent, and Mica learns better at the next sign-in.
+ */
+export function requireAccess(deps) {
+    return async (c, next) => {
+        const session = deps.sessions.resolve(getCookie(c, SESSION_COOKIE));
+        if (!session) {
+            throw new ApiError("unauthenticated", "Your session has expired. Please sign in again.");
+        }
+        const { identity } = session;
+        if (!identity) {
+            // A row from a pre-split local-mode run of the same database. It
+            // authenticates nobody, so it is not a session for an authenticated
+            // deployment.
+            deps.sessionsRepo.delete(session.id);
+            throw new ApiError("unauthenticated", "Please sign in again.");
+        }
+        const verdict = deps.admission.admits(identity);
+        if (!verdict.admitted) {
+            c.get("logger").warn("Session no longer admitted", {
+                subject: identity.subject,
+                reason: verdict.reason,
+            });
+            throw new ApiError("forbidden", "You no longer have access to this site.");
+        }
+        c.set(SESSION_VARIABLE, session);
+        c.set("access", {
+            identity: { subject: identity.subject, email: identity.email, name: identity.name },
+        });
+        await next();
+    };
+}
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+/**
+ * Second CSRF layer: double-submit token. The session's token is issued in a
+ * cookie the SPA can read and must be echoed in a header.
+ *
+ * Runs after `requireAccess`, and complements the session cookie's
+ * `SameSite=Lax`, which already blocks the classic cross-site form post.
+ */
+export function csrfProtection() {
+    return async (c, next) => {
+        if (SAFE_METHODS.has(c.req.method)) {
+            await next();
+            return;
+        }
+        const session = sessionOf(c);
+        const header = c.req.header(CSRF_HEADER);
+        const cookie = getCookie(c, CSRF_COOKIE);
+        if (!header || !cookie || !safeEqual(header, cookie) || !safeEqual(header, session.csrfToken)) {
+            throw new ApiError("forbidden", "Invalid or missing CSRF token. Reload the page and retry.");
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=gate.js.map

package/dist/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,QAAQ,EAAY,MAAM,kBAAkB,CAAC;AAGtD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAC;AAGxG;;;GAGG;AACH,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC,MAAM,UAAU,SAAS,CAAC,CAAe;IACvC,2EAA2E;IAC3E,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAyB,CAAkB,CAAC;AAC3D,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAAc;IAC1C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;QAEpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,iDAAiD,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,iEAAiE;YACjE,oEAAoE;YACpE,cAAc;YACd,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACrC,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBACjD,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,gBAAyB,EAAE,OAAgB,CAAC,CAAC;QACnD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;YACd,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;SACpF,CAAC,CAAC;QACH,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAEzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,2DAA2D,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @micacms/auth-oidc — the server-only OIDC gate around @micacms/runtime.
+ *
+ * One factory: hand it the finished configuration, an open database and a
+ * logger, and it returns the `AuthSurface` the runtime mounts — sign-in
+ * routes at `/api/auth`, and the session-plus-CSRF gate in front of the admin
+ * API — together with the services the composing app reports on.
+ *
+ * This package is a dependency of `@micacms/self-hosted` and of nothing else.
+ * The local editor must never gain a path to it: that absence is the product
+ * boundary that keeps `npx @micacms/editor` free of authentication code.
+ */
+import type { AuthSurface, Logger, SqlDatabase } from "@micacms/runtime";
+import { type RateLimiter } from "@micacms/runtime";
+import { type AdmissionPolicy } from "./admission.js";
+import type { AuthConfig } from "./config.js";
+import { type OidcService } from "./oidc.js";
+import { type SessionService } from "./session.js";
+import { type SessionRepository } from "./sessions-repository.js";
+export interface OidcAuthDeps {
+    config: AuthConfig;
+    /** The database sessions live in. Owned and opened by the composing app. */
+    db: SqlDatabase;
+    logger: Logger;
+}
+export interface OidcAuth {
+    /** What `createApp` mounts: routes at /api/auth, the gate before /api/admin. */
+    surface: AuthSurface;
+    sessions: SessionService;
+    sessionsRepo: SessionRepository;
+    admission: AdmissionPolicy;
+    oidc: OidcService;
+    loginLimiter: RateLimiter;
+}
+export declare function createOidcAuth(deps: OidcAuthDeps): OidcAuth;
+export { createAdmissionPolicy, type AdmissionPolicy, type AdmissionResult } from "./admission.js";
+export { authEnv, deriveAuth, requireAuthConfig, type AuthConfig, type AuthEnv, } from "./config.js";
+export { csrfProtection, requireAccess, sessionOf } from "./gate.js";
+export { createOidcService, type OidcService } from "./oidc.js";
+export { createSessionService, CSRF_COOKIE, CSRF_HEADER, SESSION_COOKIE, type SessionService, } from "./session.js";
+export { createSessionRepository, type SessionIdentity, type SessionRecord, type SessionRepository, } from "./sessions-repository.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAEhE,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAA2B,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,4EAA4E;IAC5E,EAAE,EAAE,WAAW,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IACvB,gFAAgF;IAChF,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,cAAc,CAAC;IACzB,YAAY,EAAE,iBAAiB,CAAC;IAChC,SAAS,EAAE,eAAe,CAAC;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,YAAY,EAAE,WAAW,CAAC;CAC3B;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAyB3D;AAED,OAAO,EAAE,qBAAqB,EAAE,KAAK,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACnG,OAAO,EACL,OAAO,EACP,UAAU,EACV,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,OAAO,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,cAAc,EACd,KAAK,cAAc,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAC"}