@pablozaiden/webapp 0.0.1

package/src/server/auth/device-auth.ts

@@ -0,0 +1,324 @@
+import {
+  exportJWK,
+  generateKeyPair,
+  importJWK,
+  jwtVerify,
+  SignJWT,
+  type CryptoKey,
+  type JWK,
+} from "jose";
+import type { AuthSessionSummary, DeviceAuthorizationResponse, DeviceVerificationDetails, TokenResponse } from "../../contracts";
+import type { RuntimeConfig } from "../runtime-config";
+import type { RefreshSessionRecord, WebAppStore } from "./store";
+import { addSeconds, isExpired, nowIso, randomToken, sha256 } from "./crypto";
+import { getRequestOriginInfo } from "./request-origin";
+import { AuthError, type AccessTokenClaims } from "./types";
+
+const ACCESS_TOKEN_TTL_SECONDS = 60 * 10;
+const REFRESH_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30;
+const DEVICE_CODE_TTL_SECONDS = 60 * 10;
+const DEVICE_POLL_INTERVAL_SECONDS = 5;
+const USER_CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+
+interface SigningKeyPair {
+  alg: string;
+  kid: string;
+  publicJwk: JWK;
+  privateJwk: JWK;
+  publicKey: CryptoKey;
+  privateKey: CryptoKey;
+}
+
+function generateUserCode(): string {
+  const chars: string[] = [];
+  const bytes = crypto.getRandomValues(new Uint8Array(8));
+  for (const byte of bytes) {
+    chars.push(USER_CODE_ALPHABET[byte % USER_CODE_ALPHABET.length]!);
+  }
+  return `${chars.slice(0, 4).join("")}-${chars.slice(4).join("")}`;
+}
+
+function getPublicBaseUrl(req: Request, config: RuntimeConfig): string {
+  return config.publicBaseUrl ?? getRequestOriginInfo(req).origin;
+}
+
+async function createSigningKey(): Promise<SigningKeyPair> {
+  try {
+    const pair = await generateKeyPair("EdDSA", { extractable: true });
+    const publicJwk = await exportJWK(pair.publicKey);
+    const privateJwk = await exportJWK(pair.privateKey);
+    const kid = crypto.randomUUID();
+    return { alg: "EdDSA", kid, publicJwk, privateJwk, publicKey: pair.publicKey, privateKey: pair.privateKey };
+  } catch {
+    const pair = await generateKeyPair("ES256", { extractable: true });
+    const publicJwk = await exportJWK(pair.publicKey);
+    const privateJwk = await exportJWK(pair.privateKey);
+    const kid = crypto.randomUUID();
+    return { alg: "ES256", kid, publicJwk, privateJwk, publicKey: pair.publicKey, privateKey: pair.privateKey };
+  }
+}
+
+async function getSigningKey(store: WebAppStore): Promise<SigningKeyPair> {
+  const stored = store.getSigningKey();
+  if (stored) {
+    return {
+      alg: stored.alg,
+      kid: stored.kid,
+      publicJwk: stored.publicJwk as JWK,
+      privateJwk: stored.privateJwk as JWK,
+      publicKey: await importJWK(stored.publicJwk as JWK, stored.alg) as CryptoKey,
+      privateKey: await importJWK(stored.privateJwk as JWK, stored.alg) as CryptoKey,
+    };
+  }
+  const created = await createSigningKey();
+  store.saveSigningKey({
+    alg: created.alg,
+    kid: created.kid,
+    publicJwk: created.publicJwk as Record<string, unknown>,
+    privateJwk: created.privateJwk as Record<string, unknown>,
+    createdAt: nowIso(),
+  });
+  return created;
+}
+
+function issuer(config: RuntimeConfig): string {
+  return config.authIssuer || `urn:${config.envPrefix.toLowerCase()}:webapp`;
+}
+
+async function issueAccessToken(store: WebAppStore, config: RuntimeConfig, input: {
+  sessionId: string;
+  clientId: string;
+  scope: string;
+}): Promise<{ accessToken: string; jti: string }> {
+  const key = await getSigningKey(store);
+  const jti = crypto.randomUUID();
+  const token = await new SignJWT({
+    sid: input.sessionId,
+    clientId: input.clientId,
+    scope: input.scope,
+  })
+    .setProtectedHeader({ alg: key.alg, kid: key.kid })
+    .setSubject(`${config.envPrefix.toLowerCase()}-user`)
+    .setJti(jti)
+    .setIssuer(issuer(config))
+    .setAudience(`${config.envPrefix.toLowerCase()}-api`)
+    .setIssuedAt()
+    .setExpirationTime(`${ACCESS_TOKEN_TTL_SECONDS}s`)
+    .sign(key.privateKey);
+  return { accessToken: token, jti };
+}
+
+function tokenSet(accessToken: string, refreshToken: string, scope: string): TokenResponse {
+  return {
+    access_token: accessToken,
+    refresh_token: refreshToken,
+    token_type: "Bearer",
+    expires_in: ACCESS_TOKEN_TTL_SECONDS,
+    scope,
+  };
+}
+
+export function createDeviceAuthorization(req: Request, store: WebAppStore, config: RuntimeConfig, input: { clientId?: string; scope?: string } = {}): DeviceAuthorizationResponse {
+  const deviceCode = randomToken(32);
+  let userCode = generateUserCode();
+  while (store.getDeviceAuthByUserCode(userCode)) {
+    userCode = generateUserCode();
+  }
+  const baseUrl = getPublicBaseUrl(req, config);
+  const record = {
+    deviceCodeHash: sha256(deviceCode),
+    userCode,
+    clientId: input.clientId?.trim() || `${config.envPrefix.toLowerCase()}-cli`,
+    scope: input.scope?.trim() || "*",
+    status: "pending" as const,
+    createdAt: nowIso(),
+    updatedAt: nowIso(),
+    expiresAt: addSeconds(DEVICE_CODE_TTL_SECONDS),
+  };
+  store.saveDeviceAuthRequest(record);
+  return {
+    device_code: deviceCode,
+    user_code: userCode,
+    verification_uri: `${baseUrl}/device`,
+    verification_uri_complete: `${baseUrl}/device?user_code=${encodeURIComponent(userCode)}`,
+    expires_in: DEVICE_CODE_TTL_SECONDS,
+    interval: DEVICE_POLL_INTERVAL_SECONDS,
+  };
+}
+
+export function getDeviceVerificationDetails(store: WebAppStore, userCode: string, passkeyRequired: boolean): DeviceVerificationDetails {
+  const record = store.getDeviceAuthByUserCode(userCode);
+  if (!record || isExpired(record.expiresAt)) {
+    throw new AuthError("invalid_user_code", "Device authorization code is invalid or expired", 404);
+  }
+  return {
+    userCode: record.userCode,
+    clientId: record.clientId,
+    scope: record.scope,
+    status: record.status,
+    expiresAt: record.expiresAt,
+    passkeyRequired,
+  };
+}
+
+export function approveDevice(store: WebAppStore, userCode: string): DeviceVerificationDetails {
+  const record = store.getDeviceAuthByUserCode(userCode);
+  if (!record || isExpired(record.expiresAt)) {
+    throw new AuthError("invalid_user_code", "Device authorization code is invalid or expired", 404);
+  }
+  if (record.status !== "pending" && record.status !== "approved") {
+    throw new AuthError("invalid_request", "Device authorization can no longer be approved", 400);
+  }
+  store.updateDeviceAuthStatus(userCode, "approved", nowIso());
+  return getDeviceVerificationDetails(store, userCode, false);
+}
+
+export function denyDevice(store: WebAppStore, userCode: string): DeviceVerificationDetails {
+  const record = store.getDeviceAuthByUserCode(userCode);
+  if (!record || isExpired(record.expiresAt)) {
+    throw new AuthError("invalid_user_code", "Device authorization code is invalid or expired", 404);
+  }
+  store.updateDeviceAuthStatus(userCode, "denied", nowIso());
+  return getDeviceVerificationDetails(store, userCode, false);
+}
+
+function createRefreshRecord(clientId: string, scope: string, familyId: string = crypto.randomUUID()): { token: string; record: RefreshSessionRecord } {
+  const token = randomToken(32);
+  const createdAt = nowIso();
+  const id = crypto.randomUUID();
+  return {
+    token,
+    record: {
+      id,
+      familyId,
+      clientId,
+      scope,
+      refreshTokenHash: sha256(token),
+      createdAt,
+      updatedAt: createdAt,
+      expiresAt: addSeconds(REFRESH_TOKEN_TTL_SECONDS),
+    },
+  };
+}
+
+export async function exchangeDeviceCode(store: WebAppStore, config: RuntimeConfig, deviceCode: string, clientId?: string): Promise<TokenResponse> {
+  const record = store.getDeviceAuthByDeviceCodeHash(sha256(deviceCode));
+  if (!record) {
+    throw new AuthError("invalid_grant", "Device code is invalid", 400);
+  }
+  if (isExpired(record.expiresAt)) {
+    throw new AuthError("expired_token", "Device code has expired", 400);
+  }
+  if (clientId && clientId !== record.clientId) {
+    throw new AuthError("invalid_client", "client_id does not match device authorization", 400);
+  }
+  if (record.status === "pending") {
+    throw new AuthError("authorization_pending", "Device authorization is still pending", 400);
+  }
+  if (record.status === "denied") {
+    throw new AuthError("access_denied", "Device authorization was denied", 400);
+  }
+  if (record.status === "consumed") {
+    throw new AuthError("invalid_grant", "Device code has already been used", 400);
+  }
+  const refresh = createRefreshRecord(record.clientId, record.scope);
+  store.saveRefreshSession(refresh.record);
+  const access = await issueAccessToken(store, config, {
+    sessionId: refresh.record.id,
+    clientId: record.clientId,
+    scope: record.scope,
+  });
+  store.updateDeviceAuthStatus(record.userCode, "consumed", nowIso());
+  return tokenSet(access.accessToken, refresh.token, record.scope);
+}
+
+export async function exchangeRefreshToken(store: WebAppStore, config: RuntimeConfig, refreshToken: string, clientId?: string): Promise<TokenResponse> {
+  const hash = sha256(refreshToken);
+  const session = store.getRefreshSessionByHash(hash);
+  if (!session) {
+    throw new AuthError("invalid_grant", "Refresh token is invalid", 400);
+  }
+  if (session.revokedAt) {
+    store.revokeRefreshFamily(session.familyId, nowIso());
+    throw new AuthError("invalid_grant", "Refresh token has been revoked", 400);
+  }
+  if (isExpired(session.expiresAt)) {
+    throw new AuthError("invalid_grant", "Refresh token has expired", 400);
+  }
+  if (clientId && clientId !== session.clientId) {
+    throw new AuthError("invalid_client", "client_id does not match refresh session", 400);
+  }
+  const next = createRefreshRecord(session.clientId, session.scope, session.familyId);
+  const rotated = store.rotateRefreshSession(hash, next.record, nowIso());
+  if (!rotated) {
+    throw new AuthError("invalid_grant", "Refresh token is invalid", 400);
+  }
+  const access = await issueAccessToken(store, config, {
+    sessionId: next.record.id,
+    clientId: next.record.clientId,
+    scope: next.record.scope,
+  });
+  return tokenSet(access.accessToken, next.token, next.record.scope);
+}
+
+export async function verifyAccessToken(store: WebAppStore, config: RuntimeConfig, token: string): Promise<AccessTokenClaims> {
+  const key = await getSigningKey(store);
+  const result = await jwtVerify(token, key.publicKey, {
+    issuer: issuer(config),
+    audience: `${config.envPrefix.toLowerCase()}-api`,
+  });
+  const payload = result.payload;
+  return {
+    sub: payload.sub ?? "",
+    jti: payload.jti ?? "",
+    sid: String(payload["sid"] ?? ""),
+    clientId: String(payload["clientId"] ?? ""),
+    scope: String(payload["scope"] ?? ""),
+  };
+}
+
+export function listAuthSessions(store: WebAppStore): AuthSessionSummary[] {
+  return store.listRefreshSessions().map((session) => ({
+    id: session.id,
+    clientId: session.clientId,
+    scope: session.scope,
+    createdAt: session.createdAt,
+    updatedAt: session.updatedAt,
+    expiresAt: session.expiresAt,
+    lastUsedAt: session.lastUsedAt,
+    revokedAt: session.revokedAt,
+    active: !session.revokedAt && !isExpired(session.expiresAt),
+  }));
+}
+
+export function revokeAuthSession(store: WebAppStore, id: string): boolean {
+  return store.revokeRefreshSession(id, nowIso());
+}
+
+export function revokeRefreshToken(store: WebAppStore, refreshToken: string): boolean {
+  const session = store.getRefreshSessionByHash(sha256(refreshToken));
+  return session ? store.revokeRefreshSession(session.id, nowIso()) : false;
+}
+
+export async function jwks(store: WebAppStore) {
+  const key = await getSigningKey(store);
+  return {
+    keys: [{
+      ...key.publicJwk,
+      kid: key.kid,
+      alg: key.alg,
+      use: "sig",
+    }],
+  };
+}
+
+export function discovery(req: Request, config: RuntimeConfig) {
+  const base = getPublicBaseUrl(req, config);
+  return {
+    issuer: issuer(config),
+    jwks_uri: `${base}/.well-known/jwks.json`,
+    device_authorization_endpoint: `${base}/api/auth/device`,
+    token_endpoint: `${base}/api/auth/token`,
+    revocation_endpoint: `${base}/api/auth/revoke`,
+  };
+}

package/src/server/auth/passkeys.ts

@@ -0,0 +1,280 @@
+import {
+  generateAuthenticationOptions,
+  generateRegistrationOptions,
+  verifyAuthenticationResponse,
+  verifyRegistrationResponse,
+  type AuthenticationResponseJSON,
+  type RegistrationResponseJSON,
+} from "@simplewebauthn/server";
+import type { PasskeyAuthStatusResponse } from "../../contracts";
+import type { RuntimeConfig } from "../runtime-config";
+import type { WebAppStore } from "./store";
+import { hmacSha256, nowIso, randomToken, secureEqual } from "./crypto";
+import { getCookiePath, getRequestOriginInfo } from "./request-origin";
+import { AuthError } from "./types";
+
+const SESSION_COOKIE = "webapp_passkey_session";
+const CHALLENGE_COOKIE = "webapp_passkey_challenge";
+const SESSION_TTL_SECONDS = 60 * 60 * 24 * 30;
+const CHALLENGE_TTL_SECONDS = 60 * 10;
+const SECRET_KEY = "passkey.secret";
+const VERSION_KEY = "passkey.version";
+
+interface SignedCookiePayload {
+  expiresAt: number;
+}
+
+interface ChallengePayload extends SignedCookiePayload {
+  challenge: string;
+  type: "registration" | "authentication";
+}
+
+interface SessionPayload extends SignedCookiePayload {
+  nonce: string;
+  version: number;
+}
+
+function getSecret(store: WebAppStore): string {
+  const existing = store.getPreference(SECRET_KEY);
+  if (existing) {
+    return existing;
+  }
+  const secret = randomToken();
+  store.setPreference(SECRET_KEY, secret);
+  return secret;
+}
+
+function getVersion(store: WebAppStore): number {
+  const raw = store.getPreference(VERSION_KEY);
+  const version = raw ? Number(raw) : 1;
+  if (!Number.isInteger(version) || version <= 0) {
+    store.setPreference(VERSION_KEY, "1");
+    return 1;
+  }
+  if (!raw) {
+    store.setPreference(VERSION_KEY, "1");
+  }
+  return version;
+}
+
+function bumpVersion(store: WebAppStore): void {
+  store.setPreference(VERSION_KEY, String(getVersion(store) + 1));
+}
+
+function encodeSigned(payload: object, secret: string): string {
+  const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  return `${body}.${hmacSha256(body, secret)}`;
+}
+
+function decodeSigned<T>(value: string | undefined, secret: string): T | undefined {
+  if (!value) {
+    return undefined;
+  }
+  const [body, signature] = value.split(".", 2);
+  if (!body || !signature || !secureEqual(signature, hmacSha256(body, secret))) {
+    return undefined;
+  }
+  try {
+    return JSON.parse(Buffer.from(body, "base64url").toString("utf8")) as T;
+  } catch {
+    return undefined;
+  }
+}
+
+function getCookie(req: Request, name: string): string | undefined {
+  const cookie = req.headers.get("cookie");
+  if (!cookie) {
+    return undefined;
+  }
+  for (const part of cookie.split(";")) {
+    const [rawName, ...rawValue] = part.trim().split("=");
+    if (rawName === name) {
+      return rawValue.join("=");
+    }
+  }
+  return undefined;
+}
+
+function cookieHeader(req: Request, name: string, value: string, maxAge: number, secure: boolean): string {
+  return [
+    `${name}=${value}`,
+    `Path=${getCookiePath(req)}`,
+    "HttpOnly",
+    "SameSite=Strict",
+    `Max-Age=${maxAge}`,
+    secure ? "Secure" : "",
+  ].filter(Boolean).join("; ");
+}
+
+function expiredCookie(req: Request, name: string, secure: boolean): string {
+  return cookieHeader(req, name, "", 0, secure);
+}
+
+function setSessionHeaders(req: Request, store: WebAppStore, config: RuntimeConfig): Headers {
+  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const secret = getSecret(store);
+  const payload: SessionPayload = {
+    nonce: randomToken(16),
+    version: getVersion(store),
+    expiresAt: Date.now() + SESSION_TTL_SECONDS * 1000,
+  };
+  const headers = new Headers();
+  headers.append("set-cookie", cookieHeader(req, SESSION_COOKIE, encodeSigned(payload, secret), SESSION_TTL_SECONDS, origin.secure));
+  headers.append("set-cookie", expiredCookie(req, CHALLENGE_COOKIE, origin.secure));
+  return headers;
+}
+
+function setChallengeHeaders(req: Request, store: WebAppStore, config: RuntimeConfig, payload: Omit<ChallengePayload, "expiresAt">): Headers {
+  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const secret = getSecret(store);
+  const headers = new Headers();
+  headers.append("set-cookie", cookieHeader(req, CHALLENGE_COOKIE, encodeSigned({
+    ...payload,
+    expiresAt: Date.now() + CHALLENGE_TTL_SECONDS * 1000,
+  }, secret), CHALLENGE_TTL_SECONDS, origin.secure));
+  return headers;
+}
+
+function readChallenge(req: Request, store: WebAppStore, type: ChallengePayload["type"]): ChallengePayload {
+  const secret = getSecret(store);
+  const challenge = decodeSigned<ChallengePayload>(getCookie(req, CHALLENGE_COOKIE), secret);
+  if (!challenge || challenge.type !== type || challenge.expiresAt <= Date.now()) {
+    throw new AuthError("challenge_invalid", "Passkey challenge is invalid or expired", 400);
+  }
+  return challenge;
+}
+
+export function hasPasskeySession(req: Request, store: WebAppStore): boolean {
+  const secret = store.getPreference(SECRET_KEY);
+  if (!secret) {
+    return false;
+  }
+  const session = decodeSigned<SessionPayload>(getCookie(req, SESSION_COOKIE), secret);
+  return Boolean(session && session.expiresAt > Date.now() && session.version === getVersion(store));
+}
+
+export function isPasskeyAuthRequired(store: WebAppStore, config: RuntimeConfig): boolean {
+  return !config.passkeyDisabled && store.listPasskeys().length > 0;
+}
+
+export function passkeyStatus(req: Request, store: WebAppStore, config: RuntimeConfig, enabled = true): PasskeyAuthStatusResponse {
+  const passkeyConfigured = store.listPasskeys().length > 0;
+  return {
+    enabled,
+    passkeyConfigured,
+    passkeyDisabled: config.passkeyDisabled,
+    passkeyRequired: enabled && passkeyConfigured && !config.passkeyDisabled,
+    authenticated: !enabled || config.passkeyDisabled || hasPasskeySession(req, store),
+  };
+}
+
+export async function beginRegistration(req: Request, store: WebAppStore, config: RuntimeConfig) {
+  if (store.listPasskeys().length > 0) {
+    throw new AuthError("passkey_exists", "A passkey is already configured", 409);
+  }
+  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const options = await generateRegistrationOptions({
+    rpName: config.appName,
+    rpID: origin.hostname,
+    userID: new Uint8Array(Buffer.from(config.envPrefix.toLowerCase())),
+    userName: config.envPrefix.toLowerCase(),
+    userDisplayName: config.appName,
+    attestationType: "none",
+    authenticatorSelection: {
+      residentKey: "preferred",
+      userVerification: "preferred",
+    },
+  });
+  return { options, headers: setChallengeHeaders(req, store, config, { challenge: options.challenge, type: "registration" }) };
+}
+
+export async function completeRegistration(req: Request, store: WebAppStore, config: RuntimeConfig, response: RegistrationResponseJSON) {
+  if (store.listPasskeys().length > 0) {
+    throw new AuthError("passkey_exists", "A passkey is already configured", 409);
+  }
+  const challenge = readChallenge(req, store, "registration");
+  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const verification = await verifyRegistrationResponse({
+    response,
+    expectedChallenge: challenge.challenge,
+    expectedOrigin: origin.origin,
+    expectedRPID: origin.hostname,
+    requireUserVerification: false,
+  });
+  if (!verification.verified || !verification.registrationInfo) {
+    throw new AuthError("registration_failed", "Passkey registration failed", 400);
+  }
+  const info = verification.registrationInfo;
+  store.savePasskey({
+    id: crypto.randomUUID(),
+    name: "Primary passkey",
+    credentialId: info.credential.id,
+    publicKey: new Uint8Array(info.credential.publicKey) as Uint8Array<ArrayBuffer>,
+    counter: info.credential.counter,
+    deviceType: info.credentialDeviceType,
+    backedUp: info.credentialBackedUp,
+    transports: info.credential.transports ?? response.response.transports ?? [],
+    createdAt: nowIso(),
+    updatedAt: nowIso(),
+  });
+  bumpVersion(store);
+  return setSessionHeaders(req, store, config);
+}
+
+export async function beginAuthentication(req: Request, store: WebAppStore, config: RuntimeConfig) {
+  const passkeys = store.listPasskeys();
+  if (passkeys.length === 0) {
+    throw new AuthError("passkey_missing", "No passkey is configured", 409);
+  }
+  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const options = await generateAuthenticationOptions({
+    rpID: origin.hostname,
+    allowCredentials: passkeys.map((passkey) => ({
+      id: passkey.credentialId,
+      transports: passkey.transports as AuthenticatorTransport[],
+    })),
+    userVerification: "preferred",
+  });
+  return { options, headers: setChallengeHeaders(req, store, config, { challenge: options.challenge, type: "authentication" }) };
+}
+
+export async function completeAuthentication(req: Request, store: WebAppStore, config: RuntimeConfig, response: AuthenticationResponseJSON) {
+  const challenge = readChallenge(req, store, "authentication");
+  const passkey = store.getPasskeyByCredentialId(response.id);
+  if (!passkey) {
+    throw new AuthError("passkey_not_found", "Passkey credential is not registered", 404);
+  }
+  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const verification = await verifyAuthenticationResponse({
+    response,
+    expectedChallenge: challenge.challenge,
+    expectedOrigin: origin.origin,
+    expectedRPID: origin.hostname,
+    credential: {
+      id: passkey.credentialId,
+      publicKey: passkey.publicKey,
+      counter: passkey.counter,
+      transports: passkey.transports as AuthenticatorTransport[],
+    },
+    requireUserVerification: false,
+  });
+  if (!verification.verified) {
+    throw new AuthError("authentication_failed", "Passkey authentication failed", 401);
+  }
+  store.updatePasskeyUsage(passkey.credentialId, verification.authenticationInfo.newCounter, nowIso());
+  return setSessionHeaders(req, store, config);
+}
+
+export function logoutHeaders(req: Request, config: RuntimeConfig): Headers {
+  const origin = getRequestOriginInfo(req, config.publicBaseUrl);
+  const headers = new Headers();
+  headers.append("set-cookie", expiredCookie(req, SESSION_COOKIE, origin.secure));
+  headers.append("set-cookie", expiredCookie(req, CHALLENGE_COOKIE, origin.secure));
+  return headers;
+}
+
+export function deletePasskey(req: Request, store: WebAppStore, config: RuntimeConfig): Headers {
+  store.deleteAllPasskeys();
+  bumpVersion(store);
+  return logoutHeaders(req, config);
+}

package/src/server/auth/request-origin.ts

@@ -0,0 +1,33 @@
+export interface RequestOriginInfo {
+  origin: string;
+  hostname: string;
+  secure: boolean;
+}
+
+export function getRequestOriginInfo(req: Request, publicBaseUrl?: string): RequestOriginInfo {
+  if (publicBaseUrl) {
+    const parsed = new URL(publicBaseUrl);
+    return {
+      origin: parsed.origin,
+      hostname: parsed.hostname,
+      secure: parsed.protocol === "https:",
+    };
+  }
+  const url = new URL(req.url);
+  const forwardedProto = req.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+  const forwardedHost = req.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const proto = forwardedProto || url.protocol.replace(":", "");
+  const host = forwardedHost || req.headers.get("host") || url.host;
+  const origin = `${proto}://${host}`;
+  const parsed = new URL(origin);
+  return {
+    origin: parsed.origin,
+    hostname: parsed.hostname,
+    secure: parsed.protocol === "https:",
+  };
+}
+
+export function getCookiePath(req: Request): string {
+  const prefix = req.headers.get("x-forwarded-prefix")?.trim().replace(/\/+$/, "");
+  return prefix || "/";
+}