@nodefony/security 10.0.0-alpha.9 → 10.0.0-beta.2

package/dist/nodefony/service/webAuthn.js

@@ -135,10 +135,10 @@ var WebAuthnService = class extends Service {
 	* pour empêcher un double enregistrement sur le même authenticator (§7.1).
 	*/
 	async generateRegistrationOptions(user) {
-		this.#ensureReady();
+		const { store, config } = this.#ensureReady();
 		const lib = await this.#ensureLib();
-		const pk = this.#config.passkeys;
-		const existing = await this.#store.findByUser(user.id);
+		const pk = config.passkeys;
+		const existing = await store.findByUser(user.id);
 		return lib.generateRegistrationOptions({
 			rpName: this.#rpName,
 			rpID: this.#rpID,
@@ -169,23 +169,23 @@ var WebAuthnService = class extends Service {
 	* @throws WebAuthnError (409) — plafond `passkeys.maxPerUser` atteint.
 	*/
 	async verifyRegistration(response, expectedChallenge, userId, requestOrigin) {
-		this.#ensureReady();
+		const { store, config } = this.#ensureReady();
 		const lib = await this.#ensureLib();
-		const pk = this.#config.passkeys;
+		const pk = config.passkeys;
 		let verification;
 		try {
 			verification = await lib.verifyRegistrationResponse({
 				response,
 				expectedChallenge,
-				expectedOrigin: this.#expectedOrigin(requestOrigin),
+				expectedOrigin: this.#expectedOrigin(pk.origins, requestOrigin),
 				expectedRPID: this.#rpID,
 				requireUserVerification: pk.userVerification === "required"
 			});
 		} catch {
 			throw new AuthenticationError("WebAuthn registration failed");
 		}
-		if (!verification.verified || !verification.registrationInfo) throw new AuthenticationError("WebAuthn registration failed");
-		if (await this.#store.countByUser(userId) >= pk.maxPerUser) throw new WebAuthnError(`passkey limit reached (${pk.maxPerUser})`, 409);
+		if (!verification.verified) throw new AuthenticationError("WebAuthn registration failed");
+		if (await store.countByUser(userId) >= pk.maxPerUser) throw new WebAuthnError(`passkey limit reached (${pk.maxPerUser})`, 409);
 		const info = verification.registrationInfo;
 		const credential = {
 			id: info.credential.id,
@@ -199,7 +199,7 @@ var WebAuthnService = class extends Service {
 			createdAt: Date.now(),
 			lastUsedAt: null
 		};
-		await this.#store.save(credential);
+		await store.save(credential);
 		return credential;
 	}
 	/**
@@ -216,17 +216,17 @@ var WebAuthnService = class extends Service {
 	*   `WebAuthnController.loginOptions()` ne cible que depuis la session.
 	*/
 	async generateAuthenticationOptions(userId) {
-		this.#ensureReady();
+		const { store, config } = this.#ensureReady();
 		const lib = await this.#ensureLib();
-		const pk = this.#config.passkeys;
+		const pk = config.passkeys;
 		let allowCredentials;
-		if (userId) allowCredentials = (await this.#store.findByUser(userId)).map((c) => ({
+		if (userId) allowCredentials = (await store.findByUser(userId)).map((c) => ({
 			id: c.id,
 			transports: [...c.transports]
 		}));
 		return lib.generateAuthenticationOptions({
 			rpID: this.#rpID,
-			allowCredentials,
+			...allowCredentials !== void 0 && { allowCredentials },
 			userVerification: pk.userVerification,
 			timeout: pk.timeoutMs
 		});
@@ -240,17 +240,17 @@ var WebAuthnService = class extends Service {
 	* @throws AuthenticationError (401) — credential inconnu ou vérification échouée.
 	*/
 	async verifyAuthentication(response, expectedChallenge, requestOrigin) {
-		this.#ensureReady();
+		const { store, config } = this.#ensureReady();
 		const lib = await this.#ensureLib();
-		const pk = this.#config.passkeys;
-		const stored = await this.#store.findById(response.id);
+		const pk = config.passkeys;
+		const stored = await store.findById(response.id);
 		if (!stored) throw new AuthenticationError("WebAuthn authentication failed");
 		let verification;
 		try {
 			verification = await lib.verifyAuthenticationResponse({
 				response,
 				expectedChallenge,
-				expectedOrigin: this.#expectedOrigin(requestOrigin),
+				expectedOrigin: this.#expectedOrigin(pk.origins, requestOrigin),
 				expectedRPID: this.#rpID,
 				credential: {
 					id: stored.id,
@@ -265,7 +265,7 @@ var WebAuthnService = class extends Service {
 		}
 		if (!verification.verified) throw new AuthenticationError("WebAuthn authentication failed");
 		const info = verification.authenticationInfo;
-		await this.#store.update(stored.id, {
+		await store.update(stored.id, {
 			signCount: info.newCounter,
 			backupState: info.credentialBackedUp,
 			uvInitialized: stored.uvInitialized || info.userVerified,
@@ -278,8 +278,7 @@ var WebAuthnService = class extends Service {
 	}
 	/** Liste les credentials d'un utilisateur (UX « mes appareils »). */
 	listUserCredentials(userId) {
-		this.#ensureReady();
-		return this.#store.findByUser(userId);
+		return this.#ensureReady().store.findByUser(userId);
 	}
 	/**
 	* Page de passkeys pour le data plane admin (vue TRANSVERSE : « quels appareils
@@ -290,21 +289,18 @@ var WebAuthnService = class extends Service {
 	* du store exclut la clé publique.
 	*/
 	listCredentialsPage(query) {
-		this.#ensureReady();
-		return this.#store.listPage(query);
+		return this.#ensureReady().store.listPage(query);
 	}
 	/**
 	* Nombre de passkeys correspondant aux filtres, ou `-1` si le backend ne sait
 	* pas compter à coût raisonnable (Redis).
 	*/
 	countCredentials(query) {
-		this.#ensureReady();
-		return this.#store.countCredentials(query);
+		return this.#ensureReady().store.countCredentials(query);
 	}
 	/** Révoque un credential (retrait d'un appareil). */
 	removeCredential(credentialId) {
-		this.#ensureReady();
-		return this.#store.delete(credentialId);
+		return this.#ensureReady().store.delete(credentialId);
 	}
 	/**
 	* Supprime un credential **du propriétaire** (self-service, anti-IDOR) : la
@@ -313,10 +309,10 @@ var WebAuthnService = class extends Service {
 	* credential d'autrui).
 	*/
 	async removeUserCredential(userId, credentialId) {
-		this.#ensureReady();
-		const cred = await this.#store.findById(credentialId);
+		const { store } = this.#ensureReady();
+		const cred = await store.findById(credentialId);
 		if (!cred || cred.userId !== userId) return false;
-		await this.#store.delete(credentialId);
+		await store.delete(credentialId);
 		return true;
 	}
 	/**
@@ -324,9 +320,11 @@ var WebAuthnService = class extends Service {
 	* priorité (prod). À défaut : l'origine de la requête est acceptée **seulement
 	* si son hostname == rpID** (dev : `localhost:port` quel que soit le port, sans
 	* jamais ouvrir à un domaine tiers). Dernier recours : `https://{rpID}`.
+	*
+	* @param origins - liste blanche `passkeys.origins` de la config prête.
+	* @param requestOrigin - origine HTTP de la requête, si connue.
 	*/
-	#expectedOrigin(requestOrigin) {
-		const origins = this.#config.passkeys.origins;
+	#expectedOrigin(origins, requestOrigin) {
 		if (origins.length > 0) return [...origins];
 		if (requestOrigin) try {
 			if (new URL(requestOrigin).hostname === this.#rpID) return requestOrigin;
@@ -336,8 +334,17 @@ var WebAuthnService = class extends Service {
 	async #ensureLib() {
 		return this.#lib ??= await import("@simplewebauthn/server");
 	}
+	/**
+	* Garde d'initialisation : lève si le service n'est pas prêt, sinon rend le
+	* store et la config typés non nuls (ni l'un ni l'autre ne sont réassignés
+	* après le boot — les capturer ici équivaut à les relire plus tard).
+	*/
 	#ensureReady() {
 		if (!this.#ready || !this.#store || !this.#config) throw new Error("WebAuthnService: non initialisé (passkeys désactivés ou boot échoué)");
+		return {
+			store: this.#store,
+			config: this.#config
+		};
 	}
 };
 //#endregion

package/dist/nodefony/service/webhooks.js

@@ -104,7 +104,7 @@ var WebhookService = class extends Service {
 			return;
 		}
 		this.#audit = audit;
-		this.#dispatcher = new WebhookDispatcher({
+		const dispatcher = new WebhookDispatcher({
 			endpointCount: () => this.endpointCount(),
 			getSnapshot: () => this.getSnapshot(),
 			secretOf: (ep) => this.decryptEndpointSecret(ep).toString("utf8"),
@@ -122,7 +122,8 @@ var WebhookService = class extends Service {
 			},
 			log: (m) => this.log(m, "ERROR")
 		});
-		this.#unsubscribe = audit.subscribe((e) => this.#dispatcher.onAuditEvent(e));
+		this.#dispatcher = dispatcher;
+		this.#unsubscribe = audit.subscribe((e) => dispatcher.onAuditEvent(e));
 		this.log("webhooks dispatcher abonné à l'audit", "DEBUG");
 	}
 	/** Arrêt propre : désabonnement audit + annulation des retries en vol. */
@@ -262,14 +263,14 @@ var WebhookService = class extends Service {
 	* @throws SsrfError si l'URL est invalide / cible non publique.
 	*/
 	async register(input) {
-		this.#assertReady();
-		await this.#assertSafeUrl(input.url);
+		const { store, key, config } = this.#assertReady();
+		await this.#assertSafeUrl(config, input.url);
 		const secret = generateSecret();
 		const now = Date.now();
 		const endpoint = {
 			id: generateId(),
 			url: input.url,
-			secretEnc: encryptSecret(Buffer.from(secret, "utf8"), this.#key),
+			secretEnc: encryptSecret(Buffer.from(secret, "utf8"), key),
 			events: [...input.events],
 			enabled: input.enabled ?? true,
 			description: input.description ?? null,
@@ -283,7 +284,7 @@ var WebhookService = class extends Service {
 			failureCount: 0,
 			metadata: input.metadata ?? {}
 		};
-		await this.#store.save(endpoint);
+		await store.save(endpoint);
 		this.#endpoints?.set(endpoint.id, endpoint);
 		return {
 			endpoint: toSummary(endpoint),
@@ -298,8 +299,7 @@ var WebhookService = class extends Service {
 	* @returns la page, chaque endpoint réduit à sa vue publique.
 	*/
 	async listPage(query) {
-		this.#assertReady();
-		const page = await this.#store.listPage(query);
+		const page = await this.#assertReady().store.listPage(query);
 		return {
 			...page,
 			items: page.items.map(toSummary)
@@ -312,8 +312,7 @@ var WebhookService = class extends Service {
 	* @returns le compte exact, ou `-1` si le backend ne sait pas compter.
 	*/
 	async countEndpoints(query) {
-		this.#assertReady();
-		return this.#store.countEndpoints(query);
+		return this.#assertReady().store.countEndpoints(query);
 	}
 	/**
 	* Les compteurs de tête de la console — posés sur la collection ENTIÈRE, pas
@@ -326,16 +325,15 @@ var WebhookService = class extends Service {
 	* @param query - filtres à appliquer avant comptage (sans fenêtre).
 	*/
 	async countWebhookFacets(query) {
-		this.#assertReady();
-		return countFacets(WEBHOOK_FACETS, (facet) => this.#store.countEndpoints({
+		const { store } = this.#assertReady();
+		return countFacets(WEBHOOK_FACETS, (facet) => store.countEndpoints({
 			...query,
 			...facet
 		}));
 	}
 	/** Un endpoint par id (vue publique), ou `null`. */
 	async getEndpoint(id) {
-		this.#assertReady();
-		const found = await this.#store.findById(id);
+		const found = await this.#assertReady().store.findById(id);
 		return found ? toSummary(found) : null;
 	}
 	/**
@@ -344,15 +342,15 @@ var WebhookService = class extends Service {
 	* ou `null` si absent.
 	*/
 	async update(id, patch) {
-		this.#assertReady();
-		const current = await this.#store.findById(id);
+		const { store, config } = this.#assertReady();
+		const current = await store.findById(id);
 		if (!current) return null;
-		if (patch.url !== void 0 && patch.url !== current.url) await this.#assertSafeUrl(patch.url);
+		if (patch.url !== void 0 && patch.url !== current.url) await this.#assertSafeUrl(config, patch.url);
 		const applied = {
 			...patch,
 			updatedAt: Date.now()
 		};
-		await this.#store.update(id, applied);
+		await store.update(id, applied);
 		const next = {
 			...current,
 			...applied
@@ -369,15 +367,15 @@ var WebhookService = class extends Service {
 	* L'ancien cesse immédiatement d'être valide. `null` si l'endpoint est absent.
 	*/
 	async rotateSecret(id) {
-		this.#assertReady();
-		const current = await this.#store.findById(id);
+		const { store, key } = this.#assertReady();
+		const current = await store.findById(id);
 		if (!current) return null;
 		const secret = generateSecret();
 		const patch = {
-			secretEnc: encryptSecret(Buffer.from(secret, "utf8"), this.#key),
+			secretEnc: encryptSecret(Buffer.from(secret, "utf8"), key),
 			updatedAt: Date.now()
 		};
-		await this.#store.update(id, patch);
+		await store.update(id, patch);
 		const next = {
 			...current,
 			...patch
@@ -393,16 +391,16 @@ var WebhookService = class extends Service {
 	* par l'appelant). `null` si absent.
 	*/
 	async revealSecret(id) {
-		this.#assertReady();
-		const current = await this.#store.findById(id);
+		const { store, key } = this.#assertReady();
+		const current = await store.findById(id);
 		if (!current) return null;
-		return decryptSecret(current.secretEnc, this.#key).toString("utf8");
+		return decryptSecret(current.secretEnc, key).toString("utf8");
 	}
 	/** Supprime un endpoint. Retourne `false` si absent. */
 	async delete(id) {
-		this.#assertReady();
-		if (!await this.#store.findById(id)) return false;
-		await this.#store.delete(id);
+		const { store } = this.#assertReady();
+		if (!await store.findById(id)) return false;
+		await store.delete(id);
 		this.#endpoints?.delete(id);
 		this.#deliveries?.delete(id);
 		return true;
@@ -422,7 +420,7 @@ var WebhookService = class extends Service {
 	* sur l'issue FINALE d'une livraison.
 	*/
 	#recordDelivery(id, rec) {
-		if (this.#deliveries === null) this.#deliveries = /* @__PURE__ */ new Map();
+		this.#deliveries ??= /* @__PURE__ */ new Map();
 		let ring = this.#deliveries.get(id);
 		if (ring === void 0) {
 			ring = [];
@@ -461,13 +459,11 @@ var WebhookService = class extends Service {
 	}
 	/** Déchiffre le secret de signature d'un endpoint (pour signer une livraison). */
 	decryptEndpointSecret(endpoint) {
-		this.#assertReady();
-		return decryptSecret(endpoint.secretEnc, this.#key);
+		return decryptSecret(endpoint.secretEnc, this.#assertReady().key);
 	}
 	/** Politique de livraison (tolérance/retries/timeout…) issue de la config. */
 	getDeliveryPolicy() {
-		this.#assertReady();
-		const w = this.#config.webhooks;
+		const w = this.#assertReady().config.webhooks;
 		return {
 			timestampToleranceS: w.timestampToleranceS,
 			maxRetries: w.maxRetries,
@@ -485,12 +481,14 @@ var WebhookService = class extends Service {
 	* l'endpoint au-delà du seuil (façon GitHub). Le succès remet le compteur à 0.
 	*/
 	async markDelivery(id, result) {
-		if (!this.#ready || !this.#store) return;
-		const current = await this.#store.findById(id);
+		const config = this.#config;
+		const store = this.#store;
+		if (!this.#ready || !store || !config) return;
+		const current = await store.findById(id);
 		if (!current) return;
 		const failureCount = result.ok ? 0 : current.failureCount + 1;
 		const now = Date.now();
-		const threshold = this.#config.webhooks.autoDisableThreshold;
+		const threshold = config.webhooks.autoDisableThreshold;
 		const disable = !result.ok && threshold > 0 && failureCount >= threshold;
 		const patch = {
 			lastDeliveryAt: now,
@@ -511,17 +509,28 @@ var WebhookService = class extends Service {
 				reason: "max_failures"
 			});
 		}
-		await this.#store.update(id, patch);
+		await store.update(id, patch);
 		this.#endpoints?.set(id, {
 			...current,
 			...patch
 		});
 	}
+	/**
+	* Garde d'initialisation : lève si le service n'est pas prêt, sinon rend le
+	* store, la clé de chiffrement et la config typés non nuls. Les quatre champs
+	* sont posés ensemble au boot et jamais réassignés — tester aussi `#config`
+	* ne change donc rien au verdict.
+	*/
 	#assertReady() {
-		if (!this.#ready || !this.#store || !this.#key) throw new Error("webhooks indisponibles (désactivés ou mal configurés)");
+		if (!this.#ready || !this.#store || !this.#key || !this.#config) throw new Error("webhooks indisponibles (désactivés ou mal configurés)");
+		return {
+			store: this.#store,
+			key: this.#key,
+			config: this.#config
+		};
 	}
-	async #assertSafeUrl(url) {
-		const w = this.#config.webhooks;
+	async #assertSafeUrl(config, url) {
+		const w = config.webhooks;
 		await assertPublicUrl(url, {
 			allowPrivate: !w.denyPrivateIps,
 			allowHttp: w.allowHttp
@@ -529,7 +538,7 @@ var WebhookService = class extends Service {
 	}
 	/** Re-contrôle SSRF avant livraison → IP validées à pinner (anti-rebinding). */
 	async #resolveTarget(url) {
-		const w = this.#config.webhooks;
+		const w = this.#assertReady().config.webhooks;
 		const { addresses } = await assertPublicUrl(url, {
 			allowPrivate: !w.denyPrivateIps,
 			allowHttp: w.allowHttp

package/dist/nodefony/src/admin/SecurityAdminApi.js

@@ -21,6 +21,7 @@ function tokenStoreDriver(className) {
 		case "DrizzleTokenStore":
 		case "MongooseTokenStore": return "orm";
 		case "RedisTokenStore": return "redis";
+		case void 0:
 		default: return null;
 	}
 }
@@ -65,7 +66,7 @@ function parseTokenListQuery(query, sortable) {
 function one(query, key) {
 	const value = query[key];
 	if (value === void 0) return void 0;
-	return Array.isArray(value) ? value[0] : value;
+	return Array.isArray(value) ? value.at(0) : value;
 }
 /** Taille de page du journal d'audit quand l'appelant n'en demande pas. */
 const AUDIT_DEFAULT_LIMIT = 100;

package/dist/nodefony/src/admin/WebhookAdminApi.js

@@ -17,6 +17,7 @@ function webhookStoreDriver(className) {
 		case "MemoryWebhookStore": return "memory";
 		case "DrizzleWebhookStore":
 		case "MongooseWebhookStore": return "orm";
+		case void 0:
 		default: return null;
 	}
 }

package/dist/nodefony/src/admin/userRevocationCascade.js

@@ -19,7 +19,7 @@ async function cascadeUserRevocation(container, event, now = Date.now()) {
 		await container.get("sessions")?.destroyByUser?.(identifier);
 	} catch {}
 	try {
-		await container.get("tokenStore")?.revokeAllForSubject?.(identifier, now);
+		await container.get("tokenStore")?.revokeAllForSubject(identifier, now);
 	} catch {}
 }
 /**

package/dist/nodefony/src/apikey/apiKeyFormat.js

@@ -41,7 +41,7 @@ const CRC_TABLE = (() => {
 /** CRC32 (IEEE) d'une chaîne ASCII — entier non signé 32 bits. */
 function crc32(input) {
 	let crc = 4294967295;
-	for (let i = 0; i < input.length; i++) crc = CRC_TABLE[(crc ^ input.charCodeAt(i)) & 255] ^ crc >>> 8;
+	for (let i = 0; i < input.length; i++) crc = (CRC_TABLE[(crc ^ input.charCodeAt(i)) & 255] ?? 0) ^ crc >>> 8;
 	return (crc ^ 4294967295) >>> 0;
 }
 /** Chunk de checksum (6 car. base64url) du payload `prefix_pubid_secret`. */

package/dist/nodefony/src/audit/MemoryAuditStore.js

@@ -1,7 +1,6 @@
 import { assertPageQuery } from "nodefony";
 //#region nodefony/src/audit/MemoryAuditStore.ts
 const DEFAULT_MAX_ENTRIES = 1e4;
-const DEFAULT_LIMIT = 100;
 const MAX_LIMIT = 500;
 /**
 * Sépare les deux composantes du curseur. Le curseur est **composite**
@@ -44,12 +43,9 @@ var MemoryAuditStore = class {
 	}
 	listPage(query) {
 		assertPageQuery(query, "cursor");
-		const limit = Math.min(Math.max(1, query.limit ?? DEFAULT_LIMIT), MAX_LIMIT);
+		const limit = Math.min(Math.max(1, query.limit), MAX_LIMIT);
 		const matched = [];
-		for (let i = 0; i < this.#events.length; i++) {
-			const event = this.#events[i];
-			if (this.#matches(event, query)) matched.push(event);
-		}
+		for (const event of this.#events) if (this.#matches(event, query)) matched.push(event);
 		const total = matched.length;
 		matched.sort((a, b) => a.ts !== b.ts ? b.ts - a.ts : a.id < b.id ? 1 : -1);
 		let page = matched;
@@ -60,7 +56,7 @@ var MemoryAuditStore = class {
 		}
 		const hasNext = page.length > limit;
 		const items = hasNext ? page.slice(0, limit) : page;
-		const last = items[items.length - 1];
+		const last = items.at(-1);
 		return Promise.resolve({
 			items,
 			limit,
@@ -87,7 +83,7 @@ var MemoryAuditStore = class {
 	gc(now = this.#now()) {
 		const threshold = now - this.#retentionMs;
 		let purged = 0;
-		while (this.#events.length > 0 && this.#events[0].ts < threshold) {
+		while ((this.#events[0]?.ts ?? threshold) < threshold) {
 			this.#events.shift();
 			purged++;
 		}

package/dist/nodefony/src/audit/auditBridge.js

@@ -39,11 +39,15 @@ function createAuditBridge(source, publish, channel, opts = {}) {
 	let timer = null;
 	const flush = () => {
 		timer = null;
-		if (count === 0 && dropped === 0) return;
-		const events = new Array(count);
-		for (let i = 0; i < count; i++) events[i] = ring[(head + i) % maxBatch];
+		const buf = ring;
+		if (buf === null || count === 0 && dropped === 0) return;
+		const events = [];
+		for (let i = 0; i < count; i++) {
+			const event = buf[(head + i) % maxBatch];
+			if (event !== void 0) events.push(event);
+		}
 		const d = dropped;
-		for (let i = 0; i < maxBatch; i++) ring[i] = void 0;
+		for (let i = 0; i < maxBatch; i++) buf[i] = void 0;
 		head = 0;
 		count = 0;
 		dropped = 0;
@@ -53,7 +57,7 @@ function createAuditBridge(source, publish, channel, opts = {}) {
 		});
 	};
 	const onEvent = (event) => {
-		if (ring === null) ring = new Array(maxBatch);
+		ring ??= new Array(maxBatch);
 		if (count === maxBatch) {
 			ring[head] = event;
 			head = (head + 1) % maxBatch;

package/dist/nodefony/src/authenticator/ApiKeyAuthenticator.js

@@ -50,14 +50,14 @@ var ApiKeyAuthenticator = class {
 	}
 	/** La requête porte-t-elle un `Authorization: Bearer <prefix>_…` ? (test bon marché) */
 	supports(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		if (typeof auth !== "string") return false;
 		const token = bearerToken(auth);
 		return token !== null && looksLikeApiKey(token, this.#prefix);
 	}
 	/** Extrait la valeur brute (non vérifiée) → portée par un `UserToken` type `"apikey"`. */
 	createToken(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		return Promise.resolve(new UserToken("apikey", bearerToken(auth) ?? ""));
 	}
 	/**
@@ -77,7 +77,7 @@ var ApiKeyAuthenticator = class {
 		const store = this.#resolveStore();
 		const record = await store.findByHash(parsed.secretHash);
 		const now = Date.now();
-		if (!record || record.kind !== "pat" || record.revokedAt !== null || record.expiresAt !== null && record.expiresAt <= now) throw new AuthenticationError(INVALID_TOKEN);
+		if (record?.kind !== "pat" || record.revokedAt !== null || record.expiresAt !== null && record.expiresAt <= now) throw new AuthenticationError(INVALID_TOKEN);
 		const invalidBefore = await store.getInvalidBefore(record.subjectId);
 		if (invalidBefore !== null && record.createdAt < invalidBefore) throw new AuthenticationError(INVALID_TOKEN);
 		const user = await this.#resolveUserOrReject(record.subjectId);

package/dist/nodefony/src/authenticator/ExternalJwtAuthenticator.js

@@ -83,7 +83,7 @@ var ExternalJwtAuthenticator = class {
 	* un jeton d'un émetteur inconnu n'a pas à provoquer le moindre travail.
 	*/
 	supports(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		if (typeof auth !== "string") return false;
 		const raw = bearerToken(auth);
 		if (raw === null) return false;
@@ -104,7 +104,7 @@ var ExternalJwtAuthenticator = class {
 	* visée.
 	*/
 	createToken(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		const token = new UserToken("external-jwt", bearerToken(auth) ?? "");
 		const area = context.security;
 		if (area?.resource) token.setAttribute(AUDIENCE, area.resource);

package/dist/nodefony/src/authenticator/FirewallRealtimeAuthenticator.js

@@ -100,7 +100,7 @@ var FirewallRealtimeAuthenticator = class {
 		const jti = issued.getAttribute("jti") ?? (typeof claims.jti === "string" ? claims.jti : null);
 		const resolveStore = this.#resolveStore;
 		if (expMs === null && (resolveStore === null || jti === null && iatMs === null)) {
-			Nodefony.getKernel()?.log?.(`Realtime ${type} token "${identifier}" carries neither an expiry nor any revocation handle ("jti"/"iat") — connection will be revoked (fail-closed). Ensure the authenticator forwards the token claims.`, "WARNING");
+			Nodefony.getKernel()?.log(`Realtime ${type} token "${identifier}" carries neither an expiry nor any revocation handle ("jti"/"iat") — connection will be revoked (fail-closed). Ensure the authenticator forwards the token claims.`, "WARNING");
 			return () => Promise.resolve(false);
 		}
 		return async (nowMs = Date.now()) => {
@@ -149,7 +149,7 @@ function buildSessionRevalidator(identifier) {
 	const id = session?.id;
 	const storage = session?.storage;
 	if (typeof id !== "string" || !storage || typeof storage.read !== "function") {
-		Nodefony.getKernel()?.log?.(`Realtime session token "${identifier}" has no revalidatable session at handshake — connection will be revoked (fail-closed). Ensure the realtime zone runs after startSession.`, "WARNING");
+		Nodefony.getKernel()?.log(`Realtime session token "${identifier}" has no revalidatable session at handshake — connection will be revoked (fail-closed). Ensure the realtime zone runs after startSession.`, "WARNING");
 		return () => Promise.resolve(false);
 	}
 	return async () => {

package/dist/nodefony/src/authenticator/JwtAuthenticator.js

@@ -58,7 +58,7 @@ var JwtAuthenticator = class {
 	* qu'un credential qui disparaîtrait sans laisser de trace.
 	*/
 	supports(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		if (typeof auth !== "string") return false;
 		const token = bearerToken(auth);
 		if (token === null || !COMPACT_JWS.test(token)) return false;
@@ -67,7 +67,7 @@ var JwtAuthenticator = class {
 	}
 	/** Extrait le token brut (non vérifié) → porté par un `UserToken` type `"jwt"`. */
 	createToken(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		return Promise.resolve(new UserToken("jwt", bearerToken(auth) ?? ""));
 	}
 	/**

package/dist/nodefony/src/authenticator/SessionAuthenticator.js

@@ -13,9 +13,11 @@ import { UserToken } from "../token/UserToken.js";
 * démarre jamais rien lui-même. L'identité est re-résolue à CHAQUE requête
 * via {@link resolveSessionIdentity} (rôles frais, révocation immédiate).
 *
-* Pas de `challenge()` : une session absente/expirée donne un 401 nu — le
-* client web redirige vers son écran de login, jamais de popup Basic. Si la
-* zone liste aussi `userpassword`, le firewall pose SON challenge (RFC 7235).
+* Pas de `challenge()` : sur une zone à session seule, le firewall pose son
+* défi de repli `Session realm="nodefony"` (RFC 9110 §15.5.2 : tout 401 en
+* porte un) — schéma inconnu des navigateurs, donc jamais de popup Basic ; le
+* client web redirige vers son écran de login. Si la zone liste aussi
+* `userpassword`, le firewall pose SON challenge.
 */
 var SessionAuthenticator = class {
 	name = "session";

package/dist/nodefony/src/authenticator/UserPasswordAuthenticator.js

@@ -35,12 +35,12 @@ var UserPasswordAuthenticator = class {
 	}
 	/** La requête porte-t-elle un en-tête `Authorization: Basic ...` ? */
 	supports(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		return typeof auth === "string" && BASIC_SCHEME.test(auth);
 	}
 	/** Décode l'enveloppe Basic — un contenu malformé donne un credential vide (échec uniforme). */
 	createToken(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		const decoded = Buffer.from(auth.replace(BASIC_SCHEME, ""), "base64").toString("utf8");
 		const sep = decoded.indexOf(":");
 		const credentials = sep > 0 ? {