@nestjs-kit/better-auth 0.0.0-stage → 2.1.0

package/dist/auth-errors-DmiKl0L_.cjs

@@ -0,0 +1,378 @@
+let better_auth_api = require("better-auth/api");
+//#region src/error-redactor.ts
+/** Reading an arbitrary thrown value must not invoke another escaping fault. */
+function readErrorProperty(value, key) {
+	if ((typeof value !== "object" || value === null) && typeof value !== "function") return;
+	try {
+		return Reflect.get(value, key);
+	} catch {
+		return;
+	}
+}
+var ErrorRedactor = class {
+	#secrets;
+	constructor(options = {}) {
+		const values = /* @__PURE__ */ new Set();
+		const add = (value) => {
+			if (!value) return;
+			values.add(value);
+			let decoded = value;
+			try {
+				decoded = decodeURIComponent(value);
+				values.add(decoded);
+			} catch {}
+			for (const form of [value, decoded]) {
+				const separator = form.lastIndexOf(".");
+				if (separator >= 16) values.add(form.slice(0, separator));
+			}
+		};
+		for (const value of options.secrets ?? []) add(value);
+		const headers = options.headers;
+		for (const cookie of (headers?.get("cookie") ?? "").split(";")) {
+			const separator = cookie.indexOf("=");
+			if (separator >= 0) {
+				const value = cookie.slice(separator + 1).trim();
+				add(value);
+				if (value.startsWith("\"") && value.endsWith("\"")) add(value.slice(1, -1));
+			}
+		}
+		const authorization = headers?.get("authorization");
+		if (authorization) {
+			add(authorization);
+			const credential = /^\S+\s+(.+)$/.exec(authorization)?.[1];
+			if (credential) add(credential);
+		}
+		for (const name of options.credentialHeaders ?? []) {
+			const value = headers?.get(name);
+			if (value) add(value);
+		}
+		this.#secrets = [...values].sort((left, right) => right.length - left.length);
+	}
+	redact(cause) {
+		return this.redactCause(cause, 0, /* @__PURE__ */ new Set());
+	}
+	replaceSecrets(value) {
+		for (const secret of this.#secrets) value = value.split(secret).join("[REDACTED]");
+		return value;
+	}
+	diagnostic(value) {
+		return this.replaceSecrets(value).split(/[\r\n]/, 1)[0].slice(0, 300);
+	}
+	redactCause(cause, depth, seen) {
+		const message = readErrorProperty(cause, "message");
+		const error = new Error(this.diagnostic(typeof message === "string" ? message : typeof cause === "string" ? cause : "Unknown authentication infrastructure failure"));
+		const name = readErrorProperty(cause, "name");
+		error.name = typeof name === "string" ? this.diagnostic(name) : "Error";
+		for (const key of [
+			"code",
+			"errno",
+			"syscall"
+		]) {
+			const value = readErrorProperty(cause, key);
+			if (typeof value === "string" || typeof value === "number" && Number.isFinite(value)) Object.defineProperty(error, key, {
+				value: typeof value === "string" ? this.diagnostic(value) : value,
+				enumerable: true
+			});
+		}
+		const stack = readErrorProperty(cause, "stack");
+		const frames = typeof stack === "string" ? stack.split(/\r?\n/).filter((line) => /^\s+at .+:\d+:\d+\)?$/.test(line)).map((line) => this.replaceSecrets(line)) : [];
+		error.stack = [`${error.name}: ${error.message}`, ...frames].join("\n");
+		seen.add(cause);
+		const nested = readErrorProperty(cause, "cause");
+		if (nested !== void 0 && depth < 3 && !seen.has(nested)) Object.defineProperty(error, "cause", {
+			value: this.redactCause(nested, depth + 1, seen),
+			enumerable: false
+		});
+		return error;
+	}
+};
+//#endregion
+//#region src/auth-errors.ts
+const FAILURE_BRAND = Symbol.for("@nestjs-kit/better-auth:auth-failure");
+const INFRASTRUCTURE_BRAND = Symbol.for("@nestjs-kit/better-auth:infrastructure-error");
+const CONFIGURATION_BRAND = Symbol.for("@nestjs-kit/better-auth:configuration-error");
+const RAW_CAUSE = Symbol.for("@nestjs-kit/better-auth:raw-cause");
+/** Unredacted causes stay module-private; only an instance's exposeRawCause opt-in attaches one (RAW_CAUSE). */
+const ORIGINAL_CAUSES = /* @__PURE__ */ new WeakMap();
+const SDK_HEADERS = Symbol.for("better-call:api-error-headers");
+function branded(value, brand) {
+	Object.defineProperty(value, brand, { value: true });
+	return value;
+}
+function isAuthFailure(value) {
+	return readErrorProperty(value, FAILURE_BRAND) === true;
+}
+function isInfrastructureError(value) {
+	return readErrorProperty(value, INFRASTRUCTURE_BRAND) === true;
+}
+function isConfigurationError(value) {
+	return readErrorProperty(value, CONFIGURATION_BRAND) === true;
+}
+function sdkStatus(error) {
+	try {
+		if (!(0, better_auth_api.isAPIError)(error)) return;
+		const status = readErrorProperty(error, "statusCode");
+		return typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599 ? status : void 0;
+	} catch {
+		return;
+	}
+}
+function sdkReason(error) {
+	const reason = readErrorProperty(readErrorProperty(error, "body"), "code");
+	return typeof reason === "string" ? reason : void 0;
+}
+/** Internal: preserve cookie lines for the exchange's separately governed cleanup. */
+function getAPIErrorHeaders(error) {
+	const result = new Headers();
+	for (const value of [readErrorProperty(error, SDK_HEADERS), readErrorProperty(error, "headers")]) {
+		if (value === void 0 || value === null) continue;
+		try {
+			const headers = new Headers(value);
+			for (const [name, value] of headers) if (name !== "set-cookie") result.set(name, value);
+			for (const cookie of headers.getSetCookie()) result.append("set-cookie", cookie);
+		} catch {}
+	}
+	return result;
+}
+function rejection(input) {
+	const codes = {
+		401: "UNAUTHENTICATED",
+		403: "FORBIDDEN",
+		429: "RATE_LIMITED"
+	};
+	const messages = {
+		401: "Unauthorized",
+		403: "Forbidden",
+		429: "Too Many Requests"
+	};
+	const headers = new Headers();
+	const retry = input.retryAfterSeconds;
+	if (retry !== void 0 && Number.isFinite(retry) && retry >= 0) headers.set("retry-after", String(Math.ceil(retry)));
+	return branded({
+		status: input.status,
+		code: codes[input.status],
+		reason: input.reason,
+		message: input.message ?? messages[input.status],
+		challenge: input.challenge,
+		...headers.has("retry-after") ? { headers } : {}
+	}, FAILURE_BRAND);
+}
+const AuthFailures = {
+	unauthenticated(message) {
+		return rejection({
+			status: 401,
+			message
+		});
+	},
+	rejected: rejection,
+	forbidden(reason, message) {
+		return rejection({
+			status: 403,
+			reason,
+			message
+		});
+	},
+	fromAPIError(error) {
+		const status = sdkStatus(error);
+		if (status !== 401 && status !== 403 && status !== 429) return null;
+		const originalHeaders = getAPIErrorHeaders(error);
+		const delay = readErrorProperty(readErrorProperty(readErrorProperty(error, "body"), "details"), "tryAgainIn");
+		const failure = rejection({
+			status,
+			reason: sdkReason(error),
+			challenge: originalHeaders.get("www-authenticate") ?? void 0,
+			retryAfterSeconds: status === 429 && typeof delay === "number" ? delay / 1e3 : void 0
+		});
+		const retryAfter = originalHeaders.get("retry-after");
+		if (retryAfter !== null) {
+			const headers = new Headers(failure.headers);
+			headers.set("retry-after", retryAfter);
+			return branded({
+				...failure,
+				headers
+			}, FAILURE_BRAND);
+		}
+		return failure;
+	}
+};
+var BetterAuthConfigurationError = class BetterAuthConfigurationError extends Error {
+	code;
+	detail;
+	site;
+	hint;
+	phase;
+	extensions = {
+		code: "INTERNAL_SERVER_ERROR",
+		reason: "AUTH_MISCONFIGURED",
+		statusCode: 500
+	};
+	issues;
+	constructor(code, detail, hint) {
+		super(detail);
+		this.name = "BetterAuthConfigurationError";
+		this.code = code;
+		this.detail = detail;
+		this.hint = hint;
+		this.phase = "boot";
+		branded(this, CONFIGURATION_BRAND);
+	}
+	static atRequest(code, detail, options) {
+		const error = new BetterAuthConfigurationError(code, "Authentication is misconfigured", options?.hint);
+		Object.defineProperties(error, {
+			detail: {
+				value: detail,
+				enumerable: true
+			},
+			site: {
+				value: options?.site,
+				enumerable: true
+			},
+			phase: {
+				value: "request",
+				enumerable: true
+			}
+		});
+		return error;
+	}
+};
+var BetterAuthInfrastructureError = class extends Error {
+	cause;
+	extensions = {
+		code: "INTERNAL_SERVER_ERROR",
+		reason: "AUTH_UNAVAILABLE",
+		statusCode: 500
+	};
+	constructor(cause, options) {
+		super("Authentication service unavailable");
+		this.name = "BetterAuthInfrastructureError";
+		this.cause = new ErrorRedactor(options).redact(cause);
+		ORIGINAL_CAUSES.set(this, cause);
+		branded(this, INFRASTRUCTURE_BRAND);
+	}
+};
+/** Internal factory for an instance's explicit diagnostic opt-in, never global state. */
+function createInfrastructureError(cause, options) {
+	const error = new BetterAuthInfrastructureError(cause, options);
+	if (options?.exposeRawCause === true) Object.defineProperty(error, RAW_CAUSE, {
+		value: cause,
+		enumerable: false
+	});
+	return error;
+}
+/**
+* Internal: the form of an already-classified infrastructure error that one request delivers. The request's cookie,
+* authorization and declared credential values are redacted on top of the thrower's own redaction, and the original
+* cause is attached only when the instance opts in, as for errors the kernel classifies itself.
+*/
+function redactForRequest(error, options) {
+	const original = ORIGINAL_CAUSES.has(error) ? ORIGINAL_CAUSES.get(error) : readErrorProperty(error, RAW_CAUSE);
+	const delivered = new BetterAuthInfrastructureError(readErrorProperty(error, "cause"), options);
+	ORIGINAL_CAUSES.set(delivered, original);
+	if (options.exposeRawCause === true && original !== void 0) Object.defineProperty(delivered, RAW_CAUSE, {
+		value: original,
+		enumerable: false
+	});
+	return delivered;
+}
+function getRawCause(error) {
+	return readErrorProperty(error, RAW_CAUSE);
+}
+/** Internal safety net. Evaluation performs the authoritative session-loss recheck. */
+function normalizeThrown(error, where, site, secrets, options) {
+	if (isAuthFailure(error)) return error;
+	if (isInfrastructureError(error) || isConfigurationError(error)) throw error;
+	const status = sdkStatus(error);
+	const reason = sdkReason(error);
+	if (status === 429) return AuthFailures.fromAPIError(error);
+	if (status === 401 && where === "policy" && (reason === void 0 || reason === "UNAUTHORIZED")) return {
+		sessionLoss: error,
+		reason
+	};
+	if (status === 401 || status === 403) return where === "source" ? AuthFailures.fromAPIError(error) : AuthFailures.forbidden(reason ?? "FORBIDDEN");
+	if (status !== void 0 && status < 500) throw BetterAuthConfigurationError.atRequest("BETTER_AUTH_REJECTED_CALL", `better-auth rejected the library's call (${status} ${reason})`, { site });
+	throw createInfrastructureError(error, {
+		secrets,
+		exposeRawCause: options?.exposeRawCause
+	});
+}
+//#endregion
+Object.defineProperty(exports, "AuthFailures", {
+	enumerable: true,
+	get: function() {
+		return AuthFailures;
+	}
+});
+Object.defineProperty(exports, "BetterAuthConfigurationError", {
+	enumerable: true,
+	get: function() {
+		return BetterAuthConfigurationError;
+	}
+});
+Object.defineProperty(exports, "BetterAuthInfrastructureError", {
+	enumerable: true,
+	get: function() {
+		return BetterAuthInfrastructureError;
+	}
+});
+Object.defineProperty(exports, "ErrorRedactor", {
+	enumerable: true,
+	get: function() {
+		return ErrorRedactor;
+	}
+});
+Object.defineProperty(exports, "createInfrastructureError", {
+	enumerable: true,
+	get: function() {
+		return createInfrastructureError;
+	}
+});
+Object.defineProperty(exports, "getAPIErrorHeaders", {
+	enumerable: true,
+	get: function() {
+		return getAPIErrorHeaders;
+	}
+});
+Object.defineProperty(exports, "getRawCause", {
+	enumerable: true,
+	get: function() {
+		return getRawCause;
+	}
+});
+Object.defineProperty(exports, "isAuthFailure", {
+	enumerable: true,
+	get: function() {
+		return isAuthFailure;
+	}
+});
+Object.defineProperty(exports, "isConfigurationError", {
+	enumerable: true,
+	get: function() {
+		return isConfigurationError;
+	}
+});
+Object.defineProperty(exports, "isInfrastructureError", {
+	enumerable: true,
+	get: function() {
+		return isInfrastructureError;
+	}
+});
+Object.defineProperty(exports, "normalizeThrown", {
+	enumerable: true,
+	get: function() {
+		return normalizeThrown;
+	}
+});
+Object.defineProperty(exports, "readErrorProperty", {
+	enumerable: true,
+	get: function() {
+		return readErrorProperty;
+	}
+});
+Object.defineProperty(exports, "redactForRequest", {
+	enumerable: true,
+	get: function() {
+		return redactForRequest;
+	}
+});
+
+//# sourceMappingURL=auth-errors-DmiKl0L_.cjs.map

package/dist/auth-errors-DmiKl0L_.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-errors-DmiKl0L_.cjs","names":["isAPIError"],"sources":["../src/error-redactor.ts","../src/auth-errors.ts"],"sourcesContent":["/** Inputs come from the active request's owner; the redactor retains no scope. */\nexport interface ErrorRedactorOptions {\n  secrets?: readonly string[];\n  headers?: Headers;\n  credentialHeaders?: readonly string[];\n}\n\n/** Reading an arbitrary thrown value must not invoke another escaping fault. */\nexport function readErrorProperty(value: unknown, key: PropertyKey): unknown {\n  if (\n    (typeof value !== \"object\" || value === null) &&\n    typeof value !== \"function\"\n  ) {\n    return undefined;\n  }\n  try {\n    return Reflect.get(value, key);\n  } catch {\n    return undefined;\n  }\n}\n\nexport class ErrorRedactor {\n  readonly #secrets: readonly string[];\n\n  constructor(options: ErrorRedactorOptions = {}) {\n    const values = new Set<string>();\n    const add = (value: string) => {\n      if (!value) {\n        return;\n      }\n      values.add(value);\n      let decoded = value;\n      try {\n        decoded = decodeURIComponent(value);\n        values.add(decoded);\n      } catch {\n        // Invalid escaping must not prevent redaction of the raw credential.\n      }\n      for (const form of [value, decoded]) {\n        const separator = form.lastIndexOf(\".\");\n        if (separator >= 16) {\n          values.add(form.slice(0, separator));\n        }\n      }\n    };\n    for (const value of options.secrets ?? []) {\n      add(value);\n    }\n    const headers = options.headers;\n    for (const cookie of (headers?.get(\"cookie\") ?? \"\").split(\";\")) {\n      const separator = cookie.indexOf(\"=\");\n      if (separator >= 0) {\n        const value = cookie.slice(separator + 1).trim();\n        add(value);\n        if (value.startsWith('\"') && value.endsWith('\"')) {\n          add(value.slice(1, -1));\n        }\n      }\n    }\n    const authorization = headers?.get(\"authorization\");\n    if (authorization) {\n      add(authorization);\n      const credential = /^\\S+\\s+(.+)$/.exec(authorization)?.[1];\n      if (credential) {\n        add(credential);\n      }\n    }\n    for (const name of options.credentialHeaders ?? []) {\n      const value = headers?.get(name);\n      if (value) {\n        add(value);\n      }\n    }\n    this.#secrets = [...values].sort(\n      (left, right) => right.length - left.length,\n    );\n  }\n\n  redact(cause: unknown): Error {\n    return this.redactCause(cause, 0, new Set());\n  }\n\n  private replaceSecrets(value: string): string {\n    for (const secret of this.#secrets) {\n      value = value.split(secret).join(\"[REDACTED]\");\n    }\n    return value;\n  }\n\n  private diagnostic(value: string): string {\n    return this.replaceSecrets(value)\n      .split(/[\\r\\n]/, 1)[0]\n      .slice(0, 300);\n  }\n\n  private redactCause(\n    cause: unknown,\n    depth: number,\n    seen: Set<unknown>,\n  ): Error {\n    const message = readErrorProperty(cause, \"message\");\n    const error = new Error(\n      this.diagnostic(\n        typeof message === \"string\"\n          ? message\n          : typeof cause === \"string\"\n            ? cause\n            : \"Unknown authentication infrastructure failure\",\n      ),\n    );\n    const name = readErrorProperty(cause, \"name\");\n    error.name = typeof name === \"string\" ? this.diagnostic(name) : \"Error\";\n    for (const key of [\"code\", \"errno\", \"syscall\"] as const) {\n      const value = readErrorProperty(cause, key);\n      if (\n        typeof value === \"string\" ||\n        (typeof value === \"number\" && Number.isFinite(value))\n      ) {\n        Object.defineProperty(error, key, {\n          value: typeof value === \"string\" ? this.diagnostic(value) : value,\n          enumerable: true,\n        });\n      }\n    }\n    const stack = readErrorProperty(cause, \"stack\");\n    const frames =\n      typeof stack === \"string\"\n        ? stack\n            .split(/\\r?\\n/)\n            .filter((line) => /^\\s+at .+:\\d+:\\d+\\)?$/.test(line))\n            .map((line) => this.replaceSecrets(line))\n        : [];\n    error.stack = [`${error.name}: ${error.message}`, ...frames].join(\"\\n\");\n    seen.add(cause);\n    const nested = readErrorProperty(cause, \"cause\");\n    if (nested !== undefined && depth < 3 && !seen.has(nested)) {\n      Object.defineProperty(error, \"cause\", {\n        value: this.redactCause(nested, depth + 1, seen),\n        enumerable: false,\n      });\n    }\n    return error;\n  }\n}\n","import type { ExecutionContext } from \"@nestjs/common\";\nimport { isAPIError } from \"better-auth/api\";\nimport {\n  ErrorRedactor,\n  type ErrorRedactorOptions,\n  readErrorProperty,\n} from \"./error-redactor.js\";\n\nconst FAILURE_BRAND = Symbol.for(\"@nestjs-kit/better-auth:auth-failure\");\nconst INFRASTRUCTURE_BRAND = Symbol.for(\n  \"@nestjs-kit/better-auth:infrastructure-error\",\n);\nconst CONFIGURATION_BRAND = Symbol.for(\n  \"@nestjs-kit/better-auth:configuration-error\",\n);\nconst RAW_CAUSE = Symbol.for(\"@nestjs-kit/better-auth:raw-cause\");\n/** Unredacted causes stay module-private; only an instance's exposeRawCause opt-in attaches one (RAW_CAUSE). */\nconst ORIGINAL_CAUSES = new WeakMap<object, unknown>();\nconst SDK_HEADERS = Symbol.for(\"better-call:api-error-headers\");\n\nexport type AuthErrorCode = \"UNAUTHENTICATED\" | \"FORBIDDEN\" | \"RATE_LIMITED\";\n\n/** A transport-neutral denial. Only transports make it throwable. */\nexport interface AuthFailure {\n  readonly status: 401 | 403 | 429;\n  readonly code: AuthErrorCode;\n  readonly reason?: string;\n  readonly message: string;\n  readonly challenge?: string;\n  readonly headers?: Headers;\n}\n\nexport interface AuthErrorBody {\n  statusCode: 401 | 403 | 429;\n  error: string;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface AuthGraphqlExtensions {\n  code: AuthErrorCode | \"INTERNAL_SERVER_ERROR\";\n  reason?: string;\n  statusCode: number;\n}\n\nexport interface AuthTransportErrorPayload {\n  status: \"error\";\n  statusCode: number;\n  code: AuthErrorCode;\n  reason?: string;\n  message: string;\n}\n\nexport interface ErrorMappingOptions {\n  map?: (\n    failure: AuthFailure,\n    context: ExecutionContext,\n    transport: string,\n  ) => unknown;\n  exposeRawCause?: boolean;\n}\n\nfunction branded<T extends object>(value: T, brand: symbol): T {\n  Object.defineProperty(value, brand, { value: true });\n  return value;\n}\n\nexport function isAuthFailure(value: unknown): value is AuthFailure {\n  return readErrorProperty(value, FAILURE_BRAND) === true;\n}\n\nexport function isInfrastructureError(\n  value: unknown,\n): value is BetterAuthInfrastructureError {\n  return readErrorProperty(value, INFRASTRUCTURE_BRAND) === true;\n}\n\nexport function isConfigurationError(\n  value: unknown,\n): value is BetterAuthConfigurationError {\n  return readErrorProperty(value, CONFIGURATION_BRAND) === true;\n}\n\nfunction sdkStatus(error: unknown): number | undefined {\n  try {\n    if (!isAPIError(error)) {\n      return undefined;\n    }\n    const status = readErrorProperty(error, \"statusCode\");\n    return typeof status === \"number\" &&\n      Number.isInteger(status) &&\n      status >= 100 &&\n      status <= 599\n      ? status\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction sdkReason(error: unknown): string | undefined {\n  const reason = readErrorProperty(readErrorProperty(error, \"body\"), \"code\");\n  return typeof reason === \"string\" ? reason : undefined;\n}\n\n/** Internal: preserve cookie lines for the exchange's separately governed cleanup. */\nexport function getAPIErrorHeaders(error: unknown): Headers {\n  const result = new Headers();\n  for (const value of [\n    readErrorProperty(error, SDK_HEADERS),\n    readErrorProperty(error, \"headers\"),\n  ]) {\n    if (value === undefined || value === null) {\n      continue;\n    }\n    try {\n      const headers = new Headers(value as HeadersInit);\n      for (const [name, value] of headers) {\n        if (name !== \"set-cookie\") {\n          result.set(name, value);\n        }\n      }\n      for (const cookie of headers.getSetCookie()) {\n        result.append(\"set-cookie\", cookie);\n      }\n    } catch {\n      // A malformed optional header collection must not mask the original fault.\n    }\n  }\n  return result;\n}\n\nfunction rejection(input: {\n  status: 401 | 403 | 429;\n  reason?: string;\n  message?: string;\n  challenge?: string;\n  retryAfterSeconds?: number;\n}): AuthFailure {\n  const codes = {\n    401: \"UNAUTHENTICATED\",\n    403: \"FORBIDDEN\",\n    429: \"RATE_LIMITED\",\n  } as const;\n  const messages = {\n    401: \"Unauthorized\",\n    403: \"Forbidden\",\n    429: \"Too Many Requests\",\n  } as const;\n  const headers = new Headers();\n  const retry = input.retryAfterSeconds;\n  if (retry !== undefined && Number.isFinite(retry) && retry >= 0) {\n    headers.set(\"retry-after\", String(Math.ceil(retry)));\n  }\n  return branded(\n    {\n      status: input.status,\n      code: codes[input.status],\n      reason: input.reason,\n      message: input.message ?? messages[input.status],\n      challenge: input.challenge,\n      ...(headers.has(\"retry-after\") ? { headers } : {}),\n    },\n    FAILURE_BRAND,\n  );\n}\n\nexport const AuthFailures = {\n  unauthenticated(message?: string): AuthFailure {\n    return rejection({ status: 401, message });\n  },\n  rejected: rejection,\n  forbidden(reason: string, message?: string): AuthFailure {\n    return rejection({ status: 403, reason, message });\n  },\n  fromAPIError(error: unknown): AuthFailure | null {\n    const status = sdkStatus(error);\n    if (status !== 401 && status !== 403 && status !== 429) {\n      return null;\n    }\n    const originalHeaders = getAPIErrorHeaders(error);\n    const details = readErrorProperty(\n      readErrorProperty(error, \"body\"),\n      \"details\",\n    );\n    const delay = readErrorProperty(details, \"tryAgainIn\");\n    const failure = rejection({\n      status,\n      reason: sdkReason(error),\n      challenge: originalHeaders.get(\"www-authenticate\") ?? undefined,\n      retryAfterSeconds:\n        status === 429 && typeof delay === \"number\" ? delay / 1000 : undefined,\n    });\n    const retryAfter = originalHeaders.get(\"retry-after\");\n    if (retryAfter !== null) {\n      const headers = new Headers(failure.headers);\n      headers.set(\"retry-after\", retryAfter);\n      return branded({ ...failure, headers }, FAILURE_BRAND);\n    }\n    return failure;\n  },\n};\n\nexport class BetterAuthConfigurationError extends Error {\n  readonly code: string;\n  readonly detail: string;\n  readonly site?: string;\n  readonly hint?: string;\n  readonly phase: \"boot\" | \"request\";\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_MISCONFIGURED\",\n    statusCode: 500,\n  } as const;\n  readonly issues?: readonly BetterAuthConfigurationError[];\n\n  constructor(code: string, detail: string, hint?: string) {\n    super(detail);\n    this.name = \"BetterAuthConfigurationError\";\n    this.code = code;\n    this.detail = detail;\n    this.hint = hint;\n    this.phase = \"boot\";\n    branded(this, CONFIGURATION_BRAND);\n  }\n\n  static atRequest(\n    code: string,\n    detail: string,\n    options?: { site?: string; hint?: string },\n  ): BetterAuthConfigurationError {\n    const error = new BetterAuthConfigurationError(\n      code,\n      \"Authentication is misconfigured\",\n      options?.hint,\n    );\n    Object.defineProperties(error, {\n      detail: { value: detail, enumerable: true },\n      site: { value: options?.site, enumerable: true },\n      phase: { value: \"request\", enumerable: true },\n    });\n    return error;\n  }\n}\n\nexport class BetterAuthInfrastructureError extends Error {\n  readonly cause: Error;\n  readonly extensions = {\n    code: \"INTERNAL_SERVER_ERROR\",\n    reason: \"AUTH_UNAVAILABLE\",\n    statusCode: 500,\n  } as const;\n\n  constructor(cause: unknown, options?: { secrets?: readonly string[] }) {\n    super(\"Authentication service unavailable\");\n    this.name = \"BetterAuthInfrastructureError\";\n    this.cause = new ErrorRedactor(options).redact(cause);\n    ORIGINAL_CAUSES.set(this, cause);\n    branded(this, INFRASTRUCTURE_BRAND);\n  }\n}\n\n/** Internal factory for an instance's explicit diagnostic opt-in, never global state. */\nexport function createInfrastructureError(\n  cause: unknown,\n  options?: ErrorRedactorOptions & { exposeRawCause?: boolean },\n): BetterAuthInfrastructureError {\n  // Preserve request-owned redaction inputs without widening the public constructor.\n  const error = new BetterAuthInfrastructureError(cause, options);\n  if (options?.exposeRawCause === true) {\n    Object.defineProperty(error, RAW_CAUSE, {\n      value: cause,\n      enumerable: false,\n    });\n  }\n  return error;\n}\n\n/**\n * Internal: the form of an already-classified infrastructure error that one request delivers. The request's cookie,\n * authorization and declared credential values are redacted on top of the thrower's own redaction, and the original\n * cause is attached only when the instance opts in, as for errors the kernel classifies itself.\n */\nexport function redactForRequest(\n  error: BetterAuthInfrastructureError,\n  options: ErrorRedactorOptions & { exposeRawCause?: boolean },\n): BetterAuthInfrastructureError {\n  const original = ORIGINAL_CAUSES.has(error)\n    ? ORIGINAL_CAUSES.get(error)\n    : readErrorProperty(error, RAW_CAUSE);\n  const delivered = new BetterAuthInfrastructureError(\n    readErrorProperty(error, \"cause\"),\n    options,\n  );\n  ORIGINAL_CAUSES.set(delivered, original);\n  if (options.exposeRawCause === true && original !== undefined) {\n    Object.defineProperty(delivered, RAW_CAUSE, {\n      value: original,\n      enumerable: false,\n    });\n  }\n  return delivered;\n}\n\nexport function getRawCause(error: BetterAuthInfrastructureError): unknown {\n  return readErrorProperty(error, RAW_CAUSE);\n}\n\n/** Internal: evaluation must distinguish session loss from a failed session read. */\nexport interface SessionLossCandidate {\n  readonly sessionLoss: unknown;\n  readonly reason?: string;\n}\n\n/** Internal safety net. Evaluation performs the authoritative session-loss recheck. */\nexport function normalizeThrown(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  secrets: readonly string[],\n  options?: { exposeRawCause?: boolean },\n): AuthFailure | SessionLossCandidate {\n  if (isAuthFailure(error)) {\n    return error;\n  }\n  if (isInfrastructureError(error) || isConfigurationError(error)) {\n    throw error;\n  }\n  const status = sdkStatus(error);\n  const reason = sdkReason(error);\n  if (status === 429) {\n    return AuthFailures.fromAPIError(error)!;\n  }\n  if (\n    status === 401 &&\n    where === \"policy\" &&\n    (reason === undefined || reason === \"UNAUTHORIZED\")\n  ) {\n    return { sessionLoss: error, reason };\n  }\n  if (status === 401 || status === 403) {\n    return where === \"source\"\n      ? AuthFailures.fromAPIError(error)!\n      : AuthFailures.forbidden(reason ?? \"FORBIDDEN\");\n  }\n  if (status !== undefined && status < 500) {\n    throw BetterAuthConfigurationError.atRequest(\n      \"BETTER_AUTH_REJECTED_CALL\",\n      `better-auth rejected the library's call (${status} ${reason})`,\n      { site },\n    );\n  }\n  throw createInfrastructureError(error, {\n    secrets,\n    exposeRawCause: options?.exposeRawCause,\n  });\n}\n"],"mappings":";;;AAQA,SAAgB,kBAAkB,OAAgB,KAA2B;CAC3E,KACG,OAAO,UAAU,YAAY,UAAU,SACxC,OAAO,UAAU,YAEjB;CAEF,IAAI;EACF,OAAO,QAAQ,IAAI,OAAO,GAAG;CAC/B,QAAQ;EACN;CACF;AACF;AAEA,IAAa,gBAAb,MAA2B;CACzB;CAEA,YAAY,UAAgC,CAAC,GAAG;EAC9C,MAAM,yBAAS,IAAI,IAAY;EAC/B,MAAM,OAAO,UAAkB;GAC7B,IAAI,CAAC,OACH;GAEF,OAAO,IAAI,KAAK;GAChB,IAAI,UAAU;GACd,IAAI;IACF,UAAU,mBAAmB,KAAK;IAClC,OAAO,IAAI,OAAO;GACpB,QAAQ,CAER;GACA,KAAK,MAAM,QAAQ,CAAC,OAAO,OAAO,GAAG;IACnC,MAAM,YAAY,KAAK,YAAY,GAAG;IACtC,IAAI,aAAa,IACf,OAAO,IAAI,KAAK,MAAM,GAAG,SAAS,CAAC;GAEvC;EACF;EACA,KAAK,MAAM,SAAS,QAAQ,WAAW,CAAC,GACtC,IAAI,KAAK;EAEX,MAAM,UAAU,QAAQ;EACxB,KAAK,MAAM,WAAW,SAAS,IAAI,QAAQ,KAAK,GAAA,CAAI,MAAM,GAAG,GAAG;GAC9D,MAAM,YAAY,OAAO,QAAQ,GAAG;GACpC,IAAI,aAAa,GAAG;IAClB,MAAM,QAAQ,OAAO,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK;IAC/C,IAAI,KAAK;IACT,IAAI,MAAM,WAAW,IAAG,KAAK,MAAM,SAAS,IAAG,GAC7C,IAAI,MAAM,MAAM,GAAG,EAAE,CAAC;GAE1B;EACF;EACA,MAAM,gBAAgB,SAAS,IAAI,eAAe;EAClD,IAAI,eAAe;GACjB,IAAI,aAAa;GACjB,MAAM,aAAa,eAAe,KAAK,aAAa,CAAC,GAAG;GACxD,IAAI,YACF,IAAI,UAAU;EAElB;EACA,KAAK,MAAM,QAAQ,QAAQ,qBAAqB,CAAC,GAAG;GAClD,MAAM,QAAQ,SAAS,IAAI,IAAI;GAC/B,IAAI,OACF,IAAI,KAAK;EAEb;EACA,KAAK,WAAW,CAAC,GAAG,MAAM,CAAC,CAAC,MACzB,MAAM,UAAU,MAAM,SAAS,KAAK,MACvC;CACF;CAEA,OAAO,OAAuB;EAC5B,OAAO,KAAK,YAAY,OAAO,mBAAG,IAAI,IAAI,CAAC;CAC7C;CAEA,eAAuB,OAAuB;EAC5C,KAAK,MAAM,UAAU,KAAK,UACxB,QAAQ,MAAM,MAAM,MAAM,CAAC,CAAC,KAAK,YAAY;EAE/C,OAAO;CACT;CAEA,WAAmB,OAAuB;EACxC,OAAO,KAAK,eAAe,KAAK,CAAC,CAC9B,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CACrB,MAAM,GAAG,GAAG;CACjB;CAEA,YACE,OACA,OACA,MACO;EACP,MAAM,UAAU,kBAAkB,OAAO,SAAS;EAClD,MAAM,QAAQ,IAAI,MAChB,KAAK,WACH,OAAO,YAAY,WACf,UACA,OAAO,UAAU,WACf,QACA,+CACR,CACF;EACA,MAAM,OAAO,kBAAkB,OAAO,MAAM;EAC5C,MAAM,OAAO,OAAO,SAAS,WAAW,KAAK,WAAW,IAAI,IAAI;EAChE,KAAK,MAAM,OAAO;GAAC;GAAQ;GAAS;EAAS,GAAY;GACvD,MAAM,QAAQ,kBAAkB,OAAO,GAAG;GAC1C,IACE,OAAO,UAAU,YAChB,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAEnD,OAAO,eAAe,OAAO,KAAK;IAChC,OAAO,OAAO,UAAU,WAAW,KAAK,WAAW,KAAK,IAAI;IAC5D,YAAY;GACd,CAAC;EAEL;EACA,MAAM,QAAQ,kBAAkB,OAAO,OAAO;EAC9C,MAAM,SACJ,OAAO,UAAU,WACb,MACG,MAAM,OAAO,CAAC,CACd,QAAQ,SAAS,wBAAwB,KAAK,IAAI,CAAC,CAAC,CACpD,KAAK,SAAS,KAAK,eAAe,IAAI,CAAC,IAC1C,CAAC;EACP,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK,IAAI,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,KAAK,IAAI;EACtE,KAAK,IAAI,KAAK;EACd,MAAM,SAAS,kBAAkB,OAAO,OAAO;EAC/C,IAAI,WAAW,KAAA,KAAa,QAAQ,KAAK,CAAC,KAAK,IAAI,MAAM,GACvD,OAAO,eAAe,OAAO,SAAS;GACpC,OAAO,KAAK,YAAY,QAAQ,QAAQ,GAAG,IAAI;GAC/C,YAAY;EACd,CAAC;EAEH,OAAO;CACT;AACF;;;ACxIA,MAAM,gBAAgB,OAAO,IAAI,sCAAsC;AACvE,MAAM,uBAAuB,OAAO,IAClC,8CACF;AACA,MAAM,sBAAsB,OAAO,IACjC,6CACF;AACA,MAAM,YAAY,OAAO,IAAI,mCAAmC;;AAEhE,MAAM,kCAAkB,IAAI,QAAyB;AACrD,MAAM,cAAc,OAAO,IAAI,+BAA+B;AA6C9D,SAAS,QAA0B,OAAU,OAAkB;CAC7D,OAAO,eAAe,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;CACnD,OAAO;AACT;AAEA,SAAgB,cAAc,OAAsC;CAClE,OAAO,kBAAkB,OAAO,aAAa,MAAM;AACrD;AAEA,SAAgB,sBACd,OACwC;CACxC,OAAO,kBAAkB,OAAO,oBAAoB,MAAM;AAC5D;AAEA,SAAgB,qBACd,OACuC;CACvC,OAAO,kBAAkB,OAAO,mBAAmB,MAAM;AAC3D;AAEA,SAAS,UAAU,OAAoC;CACrD,IAAI;EACF,IAAI,EAAA,GAACA,gBAAAA,WAAAA,CAAW,KAAK,GACnB;EAEF,MAAM,SAAS,kBAAkB,OAAO,YAAY;EACpD,OAAO,OAAO,WAAW,YACvB,OAAO,UAAU,MAAM,KACvB,UAAU,OACV,UAAU,MACR,SACA,KAAA;CACN,QAAQ;EACN;CACF;AACF;AAEA,SAAS,UAAU,OAAoC;CACrD,MAAM,SAAS,kBAAkB,kBAAkB,OAAO,MAAM,GAAG,MAAM;CACzE,OAAO,OAAO,WAAW,WAAW,SAAS,KAAA;AAC/C;;AAGA,SAAgB,mBAAmB,OAAyB;CAC1D,MAAM,SAAS,IAAI,QAAQ;CAC3B,KAAK,MAAM,SAAS,CAClB,kBAAkB,OAAO,WAAW,GACpC,kBAAkB,OAAO,SAAS,CACpC,GAAG;EACD,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC;EAEF,IAAI;GACF,MAAM,UAAU,IAAI,QAAQ,KAAoB;GAChD,KAAK,MAAM,CAAC,MAAM,UAAU,SAC1B,IAAI,SAAS,cACX,OAAO,IAAI,MAAM,KAAK;GAG1B,KAAK,MAAM,UAAU,QAAQ,aAAa,GACxC,OAAO,OAAO,cAAc,MAAM;EAEtC,QAAQ,CAER;CACF;CACA,OAAO;AACT;AAEA,SAAS,UAAU,OAMH;CACd,MAAM,QAAQ;EACZ,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,WAAW;EACf,KAAK;EACL,KAAK;EACL,KAAK;CACP;CACA,MAAM,UAAU,IAAI,QAAQ;CAC5B,MAAM,QAAQ,MAAM;CACpB,IAAI,UAAU,KAAA,KAAa,OAAO,SAAS,KAAK,KAAK,SAAS,GAC5D,QAAQ,IAAI,eAAe,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC;CAErD,OAAO,QACL;EACE,QAAQ,MAAM;EACd,MAAM,MAAM,MAAM;EAClB,QAAQ,MAAM;EACd,SAAS,MAAM,WAAW,SAAS,MAAM;EACzC,WAAW,MAAM;EACjB,GAAI,QAAQ,IAAI,aAAa,IAAI,EAAE,QAAQ,IAAI,CAAC;CAClD,GACA,aACF;AACF;AAEA,MAAa,eAAe;CAC1B,gBAAgB,SAA+B;EAC7C,OAAO,UAAU;GAAE,QAAQ;GAAK;EAAQ,CAAC;CAC3C;CACA,UAAU;CACV,UAAU,QAAgB,SAA+B;EACvD,OAAO,UAAU;GAAE,QAAQ;GAAK;GAAQ;EAAQ,CAAC;CACnD;CACA,aAAa,OAAoC;EAC/C,MAAM,SAAS,UAAU,KAAK;EAC9B,IAAI,WAAW,OAAO,WAAW,OAAO,WAAW,KACjD,OAAO;EAET,MAAM,kBAAkB,mBAAmB,KAAK;EAKhD,MAAM,QAAQ,kBAJE,kBACd,kBAAkB,OAAO,MAAM,GAC/B,SAE8B,GAAS,YAAY;EACrD,MAAM,UAAU,UAAU;GACxB;GACA,QAAQ,UAAU,KAAK;GACvB,WAAW,gBAAgB,IAAI,kBAAkB,KAAK,KAAA;GACtD,mBACE,WAAW,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAO,KAAA;EACjE,CAAC;EACD,MAAM,aAAa,gBAAgB,IAAI,aAAa;EACpD,IAAI,eAAe,MAAM;GACvB,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;GAC3C,QAAQ,IAAI,eAAe,UAAU;GACrC,OAAO,QAAQ;IAAE,GAAG;IAAS;GAAQ,GAAG,aAAa;EACvD;EACA,OAAO;CACT;AACF;AAEA,IAAa,+BAAb,MAAa,qCAAqC,MAAM;CACtD;CACA;CACA;CACA;CACA;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CACA;CAEA,YAAY,MAAc,QAAgB,MAAe;EACvD,MAAM,MAAM;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,QAAQ,MAAM,mBAAmB;CACnC;CAEA,OAAO,UACL,MACA,QACA,SAC8B;EAC9B,MAAM,QAAQ,IAAI,6BAChB,MACA,mCACA,SAAS,IACX;EACA,OAAO,iBAAiB,OAAO;GAC7B,QAAQ;IAAE,OAAO;IAAQ,YAAY;GAAK;GAC1C,MAAM;IAAE,OAAO,SAAS;IAAM,YAAY;GAAK;GAC/C,OAAO;IAAE,OAAO;IAAW,YAAY;GAAK;EAC9C,CAAC;EACD,OAAO;CACT;AACF;AAEA,IAAa,gCAAb,cAAmD,MAAM;CACvD;CACA,aAAsB;EACpB,MAAM;EACN,QAAQ;EACR,YAAY;CACd;CAEA,YAAY,OAAgB,SAA2C;EACrE,MAAM,oCAAoC;EAC1C,KAAK,OAAO;EACZ,KAAK,QAAQ,IAAI,cAAc,OAAO,CAAC,CAAC,OAAO,KAAK;EACpD,gBAAgB,IAAI,MAAM,KAAK;EAC/B,QAAQ,MAAM,oBAAoB;CACpC;AACF;;AAGA,SAAgB,0BACd,OACA,SAC+B;CAE/B,MAAM,QAAQ,IAAI,8BAA8B,OAAO,OAAO;CAC9D,IAAI,SAAS,mBAAmB,MAC9B,OAAO,eAAe,OAAO,WAAW;EACtC,OAAO;EACP,YAAY;CACd,CAAC;CAEH,OAAO;AACT;;;;;;AAOA,SAAgB,iBACd,OACA,SAC+B;CAC/B,MAAM,WAAW,gBAAgB,IAAI,KAAK,IACtC,gBAAgB,IAAI,KAAK,IACzB,kBAAkB,OAAO,SAAS;CACtC,MAAM,YAAY,IAAI,8BACpB,kBAAkB,OAAO,OAAO,GAChC,OACF;CACA,gBAAgB,IAAI,WAAW,QAAQ;CACvC,IAAI,QAAQ,mBAAmB,QAAQ,aAAa,KAAA,GAClD,OAAO,eAAe,WAAW,WAAW;EAC1C,OAAO;EACP,YAAY;CACd,CAAC;CAEH,OAAO;AACT;AAEA,SAAgB,YAAY,OAA+C;CACzE,OAAO,kBAAkB,OAAO,SAAS;AAC3C;;AASA,SAAgB,gBACd,OACA,OACA,MACA,SACA,SACoC;CACpC,IAAI,cAAc,KAAK,GACrB,OAAO;CAET,IAAI,sBAAsB,KAAK,KAAK,qBAAqB,KAAK,GAC5D,MAAM;CAER,MAAM,SAAS,UAAU,KAAK;CAC9B,MAAM,SAAS,UAAU,KAAK;CAC9B,IAAI,WAAW,KACb,OAAO,aAAa,aAAa,KAAK;CAExC,IACE,WAAW,OACX,UAAU,aACT,WAAW,KAAA,KAAa,WAAW,iBAEpC,OAAO;EAAE,aAAa;EAAO;CAAO;CAEtC,IAAI,WAAW,OAAO,WAAW,KAC/B,OAAO,UAAU,WACb,aAAa,aAAa,KAAK,IAC/B,aAAa,UAAU,UAAU,WAAW;CAElD,IAAI,WAAW,KAAA,KAAa,SAAS,KACnC,MAAM,6BAA6B,UACjC,6BACA,4CAA4C,OAAO,GAAG,OAAO,IAC7D,EAAE,KAAK,CACT;CAEF,MAAM,0BAA0B,OAAO;EACrC;EACA,gBAAgB,SAAS;CAC3B,CAAC;AACH"}

package/dist/auth-guard-CLyhAEEj.cjs

@@ -0,0 +1,136 @@
+const require_auth_errors = require("./auth-errors-DmiKl0L_.cjs");
+const require_decorate = require("./decorate-Cr4Q7bNE.cjs");
+let _nestjs_common = require("@nestjs/common");
+//#region src/auth-guard.ts
+let BetterAuthGuard = class BetterAuthGuard {
+	core;
+	static [require_decorate.AUTH_ENHANCER] = "guard";
+	[require_decorate.AUTH_ENHANCER] = "guard";
+	constructor(core) {
+		this.core = core;
+	}
+	canActivate(context) {
+		return this.core.canActivate(context);
+	}
+};
+BetterAuthGuard = require_decorate.__decorate([
+	(0, _nestjs_common.Injectable)(),
+	require_decorate.__decorateParam(0, (0, _nestjs_common.Inject)(require_decorate.GUARD_CORE)),
+	require_decorate.__decorateMetadata("design:paramtypes", [typeof Pick === "undefined" ? Object : Pick])
+], BetterAuthGuard);
+var GuardCore = class {
+	instances;
+	planner;
+	transports;
+	resolver;
+	evaluator;
+	scope;
+	readings;
+	constructor(instances, planner, transports, resolver, evaluator, scope, readings) {
+		this.instances = instances;
+		this.planner = planner;
+		this.transports = transports;
+		this.resolver = resolver;
+		this.evaluator = evaluator;
+		this.scope = scope;
+		this.readings = readings;
+	}
+	async canActivate(context) {
+		let transport;
+		let call;
+		let plan;
+		try {
+			plan = this.planner.forContext(context);
+			if (plan.access === "inherit") {
+				transport = this.transports.find(context);
+				const lineage = transport?.lineage?.(context);
+				if (lineage && !this.readings.enclosing(lineage, context.getArgs())) {
+					call = this.transports.describe(context, transport);
+					throw require_auth_errors.BetterAuthConfigurationError.atRequest("NO_ENCLOSING_DECISION", "An inherited invocation has no enclosing guard decision", { site: plan.site });
+				}
+				if (plan.originCheck !== "form") return true;
+			}
+			if (plan.access === "public" && plan.originCheck !== "form") {
+				const lineage = this.transports.find(context)?.lineage?.(context);
+				if (lineage && !plan.nested) this.readings.recordLineage(lineage, {
+					outcome: "no-identity",
+					instance: plan.instance
+				});
+				return true;
+			}
+			transport = this.transports.select(context);
+			call = this.transports.describe(context, transport);
+			const entry = this.instances.get(plan.instance);
+			if (plan.originCheck !== "off") {
+				const browser = call.browser;
+				if (browser) {
+					if (plan.originCheck === "form" || browser.enforce) {
+						const failure = await entry.origin.check(browser, plan.originCheck);
+						if (failure) throw failure;
+					} else await entry.origin.advisory(browser);
+				}
+			}
+			if (plan.access === "inherit") return true;
+			if (plan.access === "public") {
+				if (!plan.nested) this.readings.record(call, {
+					outcome: "no-identity",
+					instance: plan.instance
+				});
+				return true;
+			}
+			const result = await this.resolver.resolve(call, {
+				auth: entry.handle,
+				freshness: plan.freshness,
+				accepts: plan.accepts,
+				sourceSet: plan.sourceSet
+			});
+			this.readings.record(call, {
+				...result,
+				instance: plan.instance
+			});
+			if (result.outcome === "rejected") throw result.failure;
+			if (result.outcome === "absent") {
+				if (plan.access === "optional") return true;
+				throw require_auth_errors.AuthFailures.unauthenticated();
+			}
+			if (!plan.accepts.has(result.principal.kind)) throw require_auth_errors.AuthFailures.forbidden("PRINCIPAL_NOT_SUPPORTED");
+			const decision = await this.evaluator.evaluate(plan, result.principal, call, entry, context, transport.id);
+			if (decision.effect === "deny") throw require_auth_errors.AuthFailures.rejected({
+				status: decision.status ?? 403,
+				reason: decision.reason,
+				message: decision.message,
+				challenge: decision.challenge
+			});
+			return true;
+		} catch (error) {
+			if (require_auth_errors.isAuthFailure(error) && transport) {
+				const mapping = plan && this.instances.get(plan.instance).options.errors?.map;
+				throw mapping ? mapping(error, context, transport.id) : transport.toException(error, context);
+			}
+			if ((require_auth_errors.isConfigurationError(error) || require_auth_errors.isInfrastructureError(error)) && transport) {
+				const repeated = call ? this.scope.surfaced(call.key, error, {
+					instance: plan?.instance ?? "default",
+					site: plan?.site ?? "guard",
+					lineage: call.lineage
+				}) : false;
+				throw transport.toInternalException?.(error, context, { repeated }) ?? error;
+			}
+			throw error;
+		}
+	}
+};
+//#endregion
+Object.defineProperty(exports, "BetterAuthGuard", {
+	enumerable: true,
+	get: function() {
+		return BetterAuthGuard;
+	}
+});
+Object.defineProperty(exports, "GuardCore", {
+	enumerable: true,
+	get: function() {
+		return GuardCore;
+	}
+});
+
+//# sourceMappingURL=auth-guard-CLyhAEEj.cjs.map

package/dist/auth-guard-CLyhAEEj.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-guard-CLyhAEEj.cjs","names":["AUTH_ENHANCER","Injectable","Inject","GUARD_CORE","BetterAuthConfigurationError","AuthFailures","isAuthFailure","isConfigurationError","isInfrastructureError"],"sources":["../src/auth-guard.ts"],"sourcesContent":["import {\n  Inject,\n  Injectable,\n  type CanActivate,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  AuthTransport,\n  PrincipalResolver,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  BetterAuthConfigurationError,\n  isAuthFailure,\n  isConfigurationError,\n  isInfrastructureError,\n} from \"./auth-errors.js\";\nimport { AUTH_ENHANCER, GUARD_CORE } from \"./auth-tokens.js\";\nimport type { AuthorizationEvaluator } from \"./authorization-evaluator.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthGuard implements CanActivate {\n  static readonly [AUTH_ENHANCER] = \"guard\";\n  readonly [AUTH_ENHANCER] = \"guard\";\n\n  constructor(\n    @Inject(GUARD_CORE) private readonly core: Pick<GuardCore, \"canActivate\">,\n  ) {}\n\n  canActivate(context: ExecutionContext): Promise<boolean> {\n    return this.core.canActivate(context);\n  }\n}\nexport class GuardCore implements CanActivate {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly resolver: PrincipalResolver,\n    private readonly evaluator: AuthorizationEvaluator,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    let transport: AuthTransport | undefined;\n    let call: TransportCall | undefined;\n    let plan: RoutePlan | undefined;\n    try {\n      plan = this.planner.forContext(context);\n      if (plan.access === \"inherit\") {\n        transport = this.transports.find(context);\n        const lineage = transport?.lineage?.(context);\n        if (lineage && !this.readings.enclosing(lineage, context.getArgs())) {\n          call = this.transports.describe(context, transport);\n          throw BetterAuthConfigurationError.atRequest(\n            \"NO_ENCLOSING_DECISION\",\n            \"An inherited invocation has no enclosing guard decision\",\n            { site: plan.site },\n          );\n        }\n        if (plan.originCheck !== \"form\") {\n          return true;\n        }\n      }\n      if (plan.access === \"public\" && plan.originCheck !== \"form\") {\n        const lineage = this.transports.find(context)?.lineage?.(context);\n        if (lineage && !plan.nested) {\n          this.readings.recordLineage(lineage, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      transport = this.transports.select(context);\n      call = this.transports.describe(context, transport);\n      const entry = this.instances.get(plan.instance);\n      if (plan.originCheck !== \"off\") {\n        const browser = call.browser;\n        if (browser) {\n          if (plan.originCheck === \"form\" || browser.enforce) {\n            const failure = await entry.origin.check(browser, plan.originCheck);\n            if (failure) {\n              throw failure;\n            }\n          } else {\n            await entry.origin.advisory(browser);\n          }\n        }\n      }\n      if (plan.access === \"inherit\") {\n        return true;\n      }\n      if (plan.access === \"public\") {\n        if (!plan.nested) {\n          this.readings.record(call, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      const result = await this.resolver.resolve(call, {\n        auth: entry.handle,\n        freshness: plan.freshness,\n        accepts: plan.accepts,\n        sourceSet: plan.sourceSet,\n      });\n      this.readings.record(call, { ...result, instance: plan.instance });\n      if (result.outcome === \"rejected\") {\n        throw result.failure;\n      }\n      if (result.outcome === \"absent\") {\n        if (plan.access === \"optional\") {\n          return true;\n        }\n        throw AuthFailures.unauthenticated();\n      }\n      if (!plan.accepts.has(result.principal.kind)) {\n        throw AuthFailures.forbidden(\"PRINCIPAL_NOT_SUPPORTED\");\n      }\n      const decision = await this.evaluator.evaluate(\n        plan,\n        result.principal,\n        call,\n        entry,\n        context,\n        transport.id,\n      );\n      if (decision.effect === \"deny\") {\n        throw AuthFailures.rejected({\n          status: decision.status ?? 403,\n          reason: decision.reason,\n          message: decision.message,\n          challenge: decision.challenge,\n        });\n      }\n      return true;\n    } catch (error) {\n      if (isAuthFailure(error) && transport) {\n        const mapping =\n          plan && this.instances.get(plan.instance).options.errors?.map;\n        throw mapping\n          ? mapping(error, context, transport.id)\n          : transport.toException(error, context);\n      }\n      if (\n        (isConfigurationError(error) || isInfrastructureError(error)) &&\n        transport\n      ) {\n        const repeated = call\n          ? this.scope.surfaced(call.key, error, {\n              instance: plan?.instance ?? \"default\",\n              site: plan?.site ?? \"guard\",\n              lineage: call.lineage,\n            })\n          : false;\n        throw (\n          transport.toInternalException?.(error, context, { repeated }) ?? error\n        );\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":";;;;AA4BO,IAAM,kBAAN,MAAM,gBAAuC;CAKX;CAJvC,QAAiBA,iBAAAA,iBAAiB;CAClC,CAAUA,iBAAAA,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,YAAY,SAA6C;EACvD,OAAO,KAAK,KAAK,YAAY,OAAO;CACtC;AACF;;EAZCC,GAAAA,eAAAA,WAAAA,CAAW;CAMPC,iBAAAA,gBAAAA,IAAAA,GAAAA,eAAAA,OAAAA,CAAOC,iBAAAA,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAA8C;CAEzB;CACA;CACA;CACA;CACA;CACA;CACA;CAPnB,YACE,WACA,SACA,YACA,UACA,WACA,OACA,UACA;EAPiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,WAAA;EACA,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,OAAO,KAAK,QAAQ,WAAW,OAAO;GACtC,IAAI,KAAK,WAAW,WAAW;IAC7B,YAAY,KAAK,WAAW,KAAK,OAAO;IACxC,MAAM,UAAU,WAAW,UAAU,OAAO;IAC5C,IAAI,WAAW,CAAC,KAAK,SAAS,UAAU,SAAS,QAAQ,QAAQ,CAAC,GAAG;KACnE,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;KAClD,MAAMC,oBAAAA,6BAA6B,UACjC,yBACA,2DACA,EAAE,MAAM,KAAK,KAAK,CACpB;IACF;IACA,IAAI,KAAK,gBAAgB,QACvB,OAAO;GAEX;GACA,IAAI,KAAK,WAAW,YAAY,KAAK,gBAAgB,QAAQ;IAC3D,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;IAChE,IAAI,WAAW,CAAC,KAAK,QACnB,KAAK,SAAS,cAAc,SAAS;KACnC,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,YAAY,KAAK,WAAW,OAAO,OAAO;GAC1C,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;GAClD,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;GAC9C,IAAI,KAAK,gBAAgB,OAAO;IAC9B,MAAM,UAAU,KAAK;IACrB,IAAI,SAAS;KACX,IAAI,KAAK,gBAAgB,UAAU,QAAQ,SAAS;MAClD,MAAM,UAAU,MAAM,MAAM,OAAO,MAAM,SAAS,KAAK,WAAW;MAClE,IAAI,SACF,MAAM;KAEV,OACE,MAAM,MAAM,OAAO,SAAS,OAAO;IAEvC;GACF;GACA,IAAI,KAAK,WAAW,WAClB,OAAO;GAET,IAAI,KAAK,WAAW,UAAU;IAC5B,IAAI,CAAC,KAAK,QACR,KAAK,SAAS,OAAO,MAAM;KACzB,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,MAAM,SAAS,MAAM,KAAK,SAAS,QAAQ,MAAM;IAC/C,MAAM,MAAM;IACZ,WAAW,KAAK;IAChB,SAAS,KAAK;IACd,WAAW,KAAK;GAClB,CAAC;GACD,KAAK,SAAS,OAAO,MAAM;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACjE,IAAI,OAAO,YAAY,YACrB,MAAM,OAAO;GAEf,IAAI,OAAO,YAAY,UAAU;IAC/B,IAAI,KAAK,WAAW,YAClB,OAAO;IAET,MAAMC,oBAAAA,aAAa,gBAAgB;GACrC;GACA,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,UAAU,IAAI,GACzC,MAAMA,oBAAAA,aAAa,UAAU,yBAAyB;GAExD,MAAM,WAAW,MAAM,KAAK,UAAU,SACpC,MACA,OAAO,WACP,MACA,OACA,SACA,UAAU,EACZ;GACA,IAAI,SAAS,WAAW,QACtB,MAAMA,oBAAAA,aAAa,SAAS;IAC1B,QAAQ,SAAS,UAAU;IAC3B,QAAQ,SAAS;IACjB,SAAS,SAAS;IAClB,WAAW,SAAS;GACtB,CAAC;GAEH,OAAO;EACT,SAAS,OAAO;GACd,IAAIC,oBAAAA,cAAc,KAAK,KAAK,WAAW;IACrC,MAAM,UACJ,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ,CAAC,CAAC,QAAQ,QAAQ;IAC5D,MAAM,UACF,QAAQ,OAAO,SAAS,UAAU,EAAE,IACpC,UAAU,YAAY,OAAO,OAAO;GAC1C;GACA,KACGC,oBAAAA,qBAAqB,KAAK,KAAKC,oBAAAA,sBAAsB,KAAK,MAC3D,WACA;IACA,MAAM,WAAW,OACb,KAAK,MAAM,SAAS,KAAK,KAAK,OAAO;KACnC,UAAU,MAAM,YAAY;KAC5B,MAAM,MAAM,QAAQ;KACpB,SAAS,KAAK;IAChB,CAAC,IACD;IACJ,MACE,UAAU,sBAAsB,OAAO,SAAS,EAAE,SAAS,CAAC,KAAK;GAErE;GACA,MAAM;EACR;CACF;AACF"}