@micacms/auth-oidc 0.2.0

package/dist/session.js

@@ -0,0 +1,150 @@
+/**
+ * Session management.
+ *
+ * Server-side sessions in SQLite, addressed by an opaque random token held in a
+ * Secure/HttpOnly/SameSite cookie. No JWTs: revocation has to be immediate, and
+ * a row delete is the simplest way to get it.
+ *
+ * Three layers of defence on the cookie value:
+ *   1. the token is 256 bits from `crypto.randomBytes`;
+ *   2. it is HMAC-signed with SESSION_SECRET, so forged or truncated cookies
+ *      are rejected without touching the database;
+ *   3. only its SHA-256 is stored, so a database dump yields no usable session.
+ *
+ * Session fixation is handled by never adopting a client-supplied identifier —
+ * a token is minted at login and the previous one deleted.
+ */
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { getCookie, setCookie } from "hono/cookie";
+import { clientIp, randomToken } from "@micacms/runtime";
+export const SESSION_COOKIE = "mica_session";
+export const CSRF_COOKIE = "mica_csrf";
+export const CSRF_HEADER = "x-csrf-token";
+/** Writing `last_seen_at` on every request would be a write per page view. */
+const TOUCH_INTERVAL_MS = 5 * 60 * 1000;
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+function sign(token, secret) {
+    return createHmac("sha256", secret).update(token).digest("base64url");
+}
+/** Constant-time string comparison that tolerates differing lengths. */
+export function safeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    if (left.length !== right.length) {
+        // Still compare, so the branch does not leak the length difference.
+        timingSafeEqual(left, left);
+        return false;
+    }
+    return timingSafeEqual(left, right);
+}
+export function createSessionService(sessions, config) {
+    const ttlMs = config.SESSION_TTL_HOURS * 3600_000;
+    const idleMs = config.SESSION_IDLE_HOURS * 3600_000;
+    /** Expiry is the earlier of the idle window and the absolute lifetime. */
+    const nextExpiry = (createdAt, now) => new Date(Math.min(now + idleMs, createdAt + ttlMs)).toISOString();
+    const unwrap = (cookieValue) => {
+        if (!cookieValue)
+            return null;
+        const separator = cookieValue.lastIndexOf(".");
+        if (separator <= 0)
+            return null;
+        const token = cookieValue.slice(0, separator);
+        const signature = cookieValue.slice(separator + 1);
+        if (!safeEqual(signature, sign(token, config.sessionSecret)))
+            return null;
+        return token;
+    };
+    return {
+        create({ identity, ip, userAgent }) {
+            const token = randomToken(32);
+            const csrfToken = randomToken(32);
+            const now = Date.now();
+            const record = sessions.create({
+                id: sha256(token),
+                identity,
+                csrfToken,
+                expiresAt: nextExpiry(now, now),
+                ip: ip ?? null,
+                userAgent: userAgent ?? null,
+            });
+            return { record, cookie: `${token}.${sign(token, config.sessionSecret)}`, csrfToken };
+        },
+        resolve(cookieValue) {
+            const token = unwrap(cookieValue);
+            if (!token)
+                return null;
+            const record = sessions.find(sha256(token));
+            if (!record)
+                return null;
+            const now = Date.now();
+            if (Date.parse(record.expiresAt) <= now) {
+                sessions.delete(record.id);
+                return null;
+            }
+            if (now - Date.parse(record.lastSeenAt) > TOUCH_INTERVAL_MS) {
+                const expiresAt = nextExpiry(Date.parse(record.createdAt), now);
+                sessions.touch(record.id, new Date(now).toISOString(), expiresAt);
+                return { ...record, lastSeenAt: new Date(now).toISOString(), expiresAt };
+            }
+            return record;
+        },
+        destroy(cookieValue) {
+            const token = unwrap(cookieValue);
+            if (token)
+                sessions.delete(sha256(token));
+        },
+        destroyAllForIdentity(issuer, subject) {
+            sessions.deleteForIdentity(issuer, subject);
+        },
+        sessionCookieOptions() {
+            return {
+                path: "/",
+                httpOnly: true,
+                secure: config.cookieSecure,
+                // Lax keeps the cookie on top-level navigations back to the admin
+                // while blocking it on cross-site form posts.
+                sameSite: "Lax",
+                maxAge: Math.floor(ttlMs / 1000),
+            };
+        },
+        csrfCookieOptions() {
+            return {
+                path: "/",
+                // Readable by the SPA on purpose: it echoes the value in a header,
+                // which is what makes the double-submit check work.
+                httpOnly: false,
+                secure: config.cookieSecure,
+                sameSite: "Lax",
+                maxAge: Math.floor(ttlMs / 1000),
+            };
+        },
+        clearedCookieOptions() {
+            return {
+                path: "/",
+                httpOnly: true,
+                secure: config.cookieSecure,
+                sameSite: "Lax",
+                maxAge: 0,
+            };
+        },
+        purgeExpired() {
+            return sessions.deleteExpired();
+        },
+    };
+}
+/* ------------------------------------------------------------------ *
+ * Starting one
+ * ------------------------------------------------------------------ */
+/** Issues the session cookies for a browser that has just been identified. */
+export function establishSession(c, sessions, identity) {
+    // Session fixation: discard whatever identifier the client already holds.
+    sessions.destroy(getCookie(c, SESSION_COOKIE));
+    const { cookie, csrfToken } = sessions.create({
+        identity,
+        ip: clientIp(c),
+        userAgent: c.req.header("user-agent") ?? null,
+    });
+    setCookie(c, SESSION_COOKIE, cookie, sessions.sessionCookieOptions());
+    setCookie(c, CSRF_COOKIE, csrfToken, sessions.csrfCookieOptions());
+}
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGtE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAY,MAAM,kBAAkB,CAAC;AASnE,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAC7C,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AA8BxC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE3F,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc;IACzC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACxE,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,oEAAoE;QACpE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAA2B,EAC3B,MAAkB;IAElB,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB,GAAG,QAAQ,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,kBAAkB,GAAG,QAAQ,CAAC;IAEpD,0EAA0E;IAC1E,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,GAAW,EAAU,EAAE,CAC5D,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,EAAE,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAEpE,MAAM,MAAM,GAAG,CAAC,WAA+B,EAAiB,EAAE;QAChE,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEhC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1E,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE;YAChC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAC7B,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC;gBACjB,QAAQ;gBACR,SAAS;gBACT,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;gBAC/B,EAAE,EAAE,EAAE,IAAI,IAAI;gBACd,SAAS,EAAE,SAAS,IAAI,IAAI;aAC7B,CAAC,CAAC;YAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;QACxF,CAAC;QAED,OAAO,CAAC,WAAW;YACjB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC;gBACxC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,iBAAiB,EAAE,CAAC;gBAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;gBAChE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC;gBAClE,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC;YAC3E,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,CAAC,WAAW;YACjB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,qBAAqB,CAAC,MAAM,EAAE,OAAO;YACnC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,oBAAoB;YAClB,OAAO;gBACL,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,MAAM,CAAC,YAAY;gBAC3B,kEAAkE;gBAClE,8CAA8C;gBAC9C,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;aACjC,CAAC;QACJ,CAAC;QAED,iBAAiB;YACf,OAAO;gBACL,IAAI,EAAE,GAAG;gBACT,mEAAmE;gBACnE,oDAAoD;gBACpD,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,MAAM,CAAC,YAAY;gBAC3B,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;aACjC,CAAC;QACJ,CAAC;QAED,oBAAoB;YAClB,OAAO;gBACL,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,MAAM,CAAC,YAAY;gBAC3B,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,CAAC;aACV,CAAC;QACJ,CAAC;QAED,YAAY;YACV,OAAO,QAAQ,CAAC,aAAa,EAAE,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;wEAEwE;AAExE,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAC9B,CAAe,EACf,QAAwB,EACxB,QAAyB;IAEzB,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;IAE/C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC5C,QAAQ;QACR,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACf,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;KAC9C,CAAC,CAAC;IAEH,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACtE,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/dist/sessions-repository.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Session repository.
+ *
+ * The primary key is the SHA-256 of the cookie token, never the token itself:
+ * a leaked database backup therefore does not hand an attacker usable sessions.
+ *
+ * A row carries who the provider said this is, because there is no user table
+ * to look it up in. That is the whole of Mica's identity storage.
+ */
+import type { SqlDatabase } from "@micacms/runtime";
+/**
+ * What the identity provider stated about the person holding this session.
+ *
+ * `null` where there is no provider: local mode has no user, and the row is
+ * then a CSRF token with an expiry.
+ */
+export interface SessionIdentity {
+    issuer: string;
+    /** Opaque and stable at that issuer. The account key, and never the email. */
+    subject: string;
+    email: string;
+    /** The provider's own `email_verified`. Absent counts as false. */
+    emailVerified: boolean;
+    name: string;
+    /** The groups claim as it arrived, or empty when the provider sends none. */
+    groups: string[];
+}
+export interface SessionRecord {
+    id: string;
+    identity: SessionIdentity | null;
+    csrfToken: string;
+    createdAt: string;
+    lastSeenAt: string;
+    expiresAt: string;
+    ip: string | null;
+    userAgent: string | null;
+}
+export declare function createSessionRepository(db: SqlDatabase): {
+    create(input: {
+        id: string;
+        identity: SessionIdentity | null;
+        csrfToken: string;
+        expiresAt: string;
+        ip?: string | null;
+        userAgent?: string | null;
+    }): SessionRecord;
+    find(id: string): SessionRecord | undefined;
+    touch(id: string, lastSeenAt: string, expiresAt: string): void;
+    delete(id: string): boolean;
+    /** Every session this person holds, on every device. */
+    deleteForIdentity(issuer: string, subject: string): number;
+    deleteExpired(now?: string): number;
+    count(): number;
+};
+export type SessionRepository = ReturnType<typeof createSessionRepository>;
+//# sourceMappingURL=sessions-repository.d.ts.map

package/dist/sessions-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions-repository.d.ts","sourceRoot":"","sources":["../src/sessions-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AA2DD,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,WAAW;kBAErC;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,GAAG,aAAa;aAwBR,MAAM,GAAG,aAAa,GAAG,SAAS;cAKjC,MAAM,cAAc,MAAM,aAAa,MAAM,GAAG,IAAI;eAQnD,MAAM,GAAG,OAAO;IAI3B,wDAAwD;8BAC9B,MAAM,WAAW,MAAM,GAAG,MAAM;iCAKX,MAAM;aAI5C,MAAM;EAIlB;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/sessions-repository.js

@@ -0,0 +1,96 @@
+/**
+ * Session repository.
+ *
+ * The primary key is the SHA-256 of the cookie token, never the token itself:
+ * a leaked database backup therefore does not hand an attacker usable sessions.
+ *
+ * A row carries who the provider said this is, because there is no user table
+ * to look it up in. That is the whole of Mica's identity storage.
+ */
+/**
+ * The groups column holds whatever the provider sent, serialised. It is read
+ * back defensively — a claim that was a string, or an object, or absent, must
+ * not throw four weeks later on a request that has nothing to do with it.
+ */
+function parseGroups(value) {
+    try {
+        const parsed = JSON.parse(value);
+        return Array.isArray(parsed) ? parsed.filter((entry) => typeof entry === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}
+function toRecord(row) {
+    return {
+        id: row.id,
+        identity: row.issuer && row.subject
+            ? {
+                issuer: row.issuer,
+                subject: row.subject,
+                email: row.email ?? "",
+                emailVerified: row.email_verified === 1,
+                name: row.name ?? "",
+                groups: parseGroups(row.groups),
+            }
+            : null,
+        csrfToken: row.csrf_token,
+        createdAt: row.created_at,
+        lastSeenAt: row.last_seen_at,
+        expiresAt: row.expires_at,
+        ip: row.ip,
+        userAgent: row.user_agent,
+    };
+}
+const COLUMNS = "id, issuer, subject, email, email_verified, name, groups, csrf_token, " +
+    "created_at, last_seen_at, expires_at, ip, user_agent";
+export function createSessionRepository(db) {
+    return {
+        create(input) {
+            const now = new Date().toISOString();
+            db.run(`INSERT INTO sessions
+           (${COLUMNS}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+                input.id,
+                input.identity?.issuer ?? null,
+                input.identity?.subject ?? null,
+                input.identity?.email ?? null,
+                input.identity?.emailVerified ? 1 : 0,
+                input.identity?.name ?? null,
+                JSON.stringify(input.identity?.groups ?? []),
+                input.csrfToken,
+                now,
+                now,
+                input.expiresAt,
+                input.ip ?? null,
+                input.userAgent ?? null,
+            ]);
+            return this.find(input.id);
+        },
+        find(id) {
+            const row = db.get(`SELECT ${COLUMNS} FROM sessions WHERE id = ?`, [id]);
+            return row && toRecord(row);
+        },
+        touch(id, lastSeenAt, expiresAt) {
+            db.run("UPDATE sessions SET last_seen_at = ?, expires_at = ? WHERE id = ?", [
+                lastSeenAt,
+                expiresAt,
+                id,
+            ]);
+        },
+        delete(id) {
+            return db.run("DELETE FROM sessions WHERE id = ?", [id]).changes > 0;
+        },
+        /** Every session this person holds, on every device. */
+        deleteForIdentity(issuer, subject) {
+            return db.run("DELETE FROM sessions WHERE issuer = ? AND subject = ?", [issuer, subject])
+                .changes;
+        },
+        deleteExpired(now = new Date().toISOString()) {
+            return db.run("DELETE FROM sessions WHERE expires_at <= ?", [now]).changes;
+        },
+        count() {
+            return db.get("SELECT COUNT(*) AS count FROM sessions")?.count ?? 0;
+        },
+    };
+}
+//# sourceMappingURL=sessions-repository.js.map

package/dist/sessions-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions-repository.js","sourceRoot":"","sources":["../src/sessions-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiDH;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAe;IAC/B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EACN,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO;YACvB,CAAC,CAAC;gBACE,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;gBACtB,aAAa,EAAE,GAAG,CAAC,cAAc,KAAK,CAAC;gBACvC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;aAChC;YACH,CAAC,CAAC,IAAI;QACV,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GACX,wEAAwE;IACxE,sDAAsD,CAAC;AAEzD,MAAM,UAAU,uBAAuB,CAAC,EAAe;IACrD,OAAO;QACL,MAAM,CAAC,KAON;YACC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,EAAE,CAAC,GAAG,CACJ;cACM,OAAO,kDAAkD,EAC/D;gBACE,KAAK,CAAC,EAAE;gBACR,KAAK,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI;gBAC9B,KAAK,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI;gBAC/B,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,IAAI;gBAC7B,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrC,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI;gBAC5B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;gBAC5C,KAAK,CAAC,SAAS;gBACf,GAAG;gBACH,GAAG;gBACH,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,EAAE,IAAI,IAAI;gBAChB,KAAK,CAAC,SAAS,IAAI,IAAI;aACxB,CACF,CAAC;YACF,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAE,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,EAAU;YACb,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAa,UAAU,OAAO,6BAA6B,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACrF,OAAO,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,KAAK,CAAC,EAAU,EAAE,UAAkB,EAAE,SAAiB;YACrD,EAAE,CAAC,GAAG,CAAC,mEAAmE,EAAE;gBAC1E,UAAU;gBACV,SAAS;gBACT,EAAE;aACH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,EAAU;YACf,OAAO,EAAE,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,wDAAwD;QACxD,iBAAiB,CAAC,MAAc,EAAE,OAAe;YAC/C,OAAO,EAAE,CAAC,GAAG,CAAC,uDAAuD,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;iBACtF,OAAO,CAAC;QACb,CAAC;QAED,aAAa,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC1C,OAAO,EAAE,CAAC,GAAG,CAAC,4CAA4C,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7E,CAAC;QAED,KAAK;YACH,OAAO,EAAE,CAAC,GAAG,CAAoB,wCAAwC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;QACzF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@micacms/auth-oidc",
+  "version": "0.2.0",
+  "type": "module",
+  "description": "The server-only OIDC gate for Mica: sign-in, sessions and admission around @micacms/runtime. Never enters a browser bundle, and never a dependency of the local editor.",
+  "license": "MIT",
+  "author": "Alexander Müdespacher",
+  "keywords": [
+    "mica",
+    "cms",
+    "oidc",
+    "authentication"
+  ],
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "hono": "^4.6.20",
+    "openid-client": "^6.8.5",
+    "zod": "^4.3.6",
+    "@micacms/core": "0.2.0",
+    "@micacms/runtime": "0.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.1",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.test.json",
+    "test": "tsc -p tsconfig.json && node --test --import tsx test/*.test.ts"
+  }
+}