@rebasepro/server 0.16.0 → 0.16.1-canary.g2d1aec8

package/dist/{auth-5Et5mnUA.js → auth-C74dqR2B.js}

@@ -4,15 +4,16 @@ __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
 import { C as ListLimitError, D as isAnonymousUid, E as ANONYMOUS_USER_ID, T as resolveClientListLimit, a as deserializeLogicalCondition, i as deserializeFilter, r as UnknownFilterOperatorError } from "./src-BPfYOeN4.js";
 import "./src-CrCxd8km.js";
-import { n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin } from "./ddl-bootstrap-Cywoj8Ta.js";
-import { S as canonicalStorageId, T as require_jsonwebtoken, _ as verifyMfaPendingToken, a as generateMfaPendingToken, c as getJwks, d as hasAsymmetricSigningKey, f as hashRefreshToken, g as verifyDownloadToken, h as verifyAccessToken, i as generateDownloadToken, l as getRefreshTokenExpiry, n as configureJwt, o as generateRefreshToken, p as isJwtConfigured, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenTtlMs, w as tryCanonicalStorageKey } from "./jwt-DxH9fLPt.js";
-import { t as logger } from "./logger-DfvF_8r-.js";
-import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
+import { n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin } from "./ddl-bootstrap-DgSnERYN.js";
+import { S as canonicalStorageId, T as require_jsonwebtoken, _ as verifyMfaPendingToken, a as generateMfaPendingToken, c as getJwks, d as hasAsymmetricSigningKey, f as hashRefreshToken, g as verifyDownloadToken, h as verifyAccessToken, i as generateDownloadToken, l as getRefreshTokenExpiry, n as configureJwt, o as generateRefreshToken, p as isJwtConfigured, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenTtlMs, w as tryCanonicalStorageKey } from "./jwt-BbJi0TR0.js";
+import { t as logger } from "./logger-TdvXIGqR.js";
+import { n as errorHandler, t as ApiError } from "./errors-D_LwNKRM.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
 import { Hono } from "hono";
 import { promisify } from "util";
 import { createCipheriv, createDecipheriv, createHash as createHash$1, createHmac, createPublicKey, randomBytes as randomBytes$1, randomUUID as randomUUID$1, scrypt, timingSafeEqual } from "crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
+import { createMiddleware } from "hono/factory";
 //#region ../types/src/controllers/storage.ts
 /**
 * Path prefix that marks an object as **public**. Files stored under this
@@ -2458,6 +2459,64 @@ function createEmailService(config) {
 	return new SMTPEmailService(config);
 }
 //#endregion
+//#region src/email/dev-sink.ts
+/** How many messages the ring buffer keeps before dropping the oldest. */
+var DEFAULT_CAPACITY = 50;
+/**
+* Absolute http(s) URLs in a message body.
+*
+* Deliberately simple: it reads `href="…"` first, because that is where a real
+* link lives, and falls back to bare URLs in the text part. Trailing markup and
+* punctuation are trimmed so the result can be pasted straight into a browser.
+*/
+function extractLinks(html, text) {
+	const found = [];
+	const push = (url) => {
+		const cleaned = url.replace(/[)\]}>.,;'"]+$/, "");
+		if (cleaned && !found.includes(cleaned)) found.push(cleaned);
+	};
+	if (html) for (const match of html.matchAll(/href\s*=\s*["'](https?:\/\/[^"']+)["']/gi)) push(match[1]);
+	if (text) for (const match of text.matchAll(/https?:\/\/[^\s<>"']+/gi)) push(match[0]);
+	return found;
+}
+/** Whatever `to` was given as, rendered for a log line. */
+var formatRecipient = (to) => Array.isArray(to) ? to.join(", ") : to;
+/**
+* Create a sink. Each call is independent, which is what lets a test hold one
+* without touching whatever the process is using.
+*/
+function createDevEmailSink(options = {}) {
+	const capacity = options.capacity ?? DEFAULT_CAPACITY;
+	const messages = [];
+	let nextId = 1;
+	let announced = false;
+	const sendEmail = async (mail) => {
+		const captured = {
+			id: nextId++,
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			to: formatRecipient(mail.to),
+			subject: mail.subject,
+			html: mail.html,
+			text: mail.text,
+			links: extractLinks(mail.html, mail.text)
+		};
+		messages.unshift(captured);
+		if (messages.length > capacity) messages.length = capacity;
+		if (!announced) {
+			announced = true;
+			logger.warn("No SMTP is configured, so auth email is being captured here instead of sent. Follow the link below to complete the flow. Set SMTP_HOST to deliver mail for real; this sink is unavailable when NODE_ENV=production.");
+		}
+		logger.info(`[email] ${captured.subject} → ${captured.to}` + (captured.links.length ? `\n         ${captured.links.join("\n         ")}` : "\n         (no links in this message)"));
+	};
+	return {
+		sendEmail,
+		list: () => [...messages],
+		clear: () => {
+			messages.length = 0;
+		}
+	};
+}
+//#endregion
 //#region src/auth/rate-limit-store.ts
 /**
 * The default store: a sliding window in this process's memory.
@@ -2763,6 +2822,174 @@ function createDataRateLimiter(config = {}) {
 	});
 }
 //#endregion
+//#region src/auth/captcha.ts
+/**
+* Bot protection on the auth endpoints that cost something to hit.
+*
+* Rate limiting was the whole defence, and it bounds a single caller rather
+* than a botnet: a thousand addresses each sending one request per minute never
+* touch a per-IP window, and `/auth/register` and `/auth/forgot-password` both
+* send mail. So the bill for an unprotected signup form is paid in reputation on
+* a sending domain, not in CPU.
+*
+* This adds a challenge the caller has to have solved, verified server-side
+* against the provider before the route does any work.
+*
+* ## Fail closed, and why that is the safe direction here
+*
+* If the provider cannot be reached, verification fails and the request is
+* refused. That is the opposite of the choice made for the RLS audit, which
+* logs and continues, and the difference is what failure means: an audit that
+* does not run leaves you where you were, while a challenge that is not checked
+* leaves the door open for exactly as long as the outage lasts. An attacker who
+* can cause the outage would otherwise be able to turn the protection off.
+*
+* The cost is that a provider outage blocks sign-ups. That is visible, loud, and
+* recoverable by unsetting one config key — which is a better failure than a
+* silent one nobody notices until the mail domain is blocklisted.
+*
+* ## Why the verifier is injected
+*
+* Same reason as the RLS scanner: so the whole thing is testable without a
+* network, and so no provider SDK enters this package's dependency graph. The
+* built-in verifier is `fetch` and a form post, which is the entire protocol for
+* both providers this supports.
+*/
+var VERIFY_ENDPOINT = {
+	turnstile: "https://challenges.cloudflare.com/turnstile/v0/siteverify",
+	hcaptcha: "https://api.hcaptcha.com/siteverify"
+};
+var DEFAULT_CAPTCHA_ROUTES = [
+	"register",
+	"forgotPassword",
+	"magicLink"
+];
+var DEFAULT_TIMEOUT_MS = 5e3;
+var DEFAULT_TOKEN_FIELD = "captchaToken";
+/** Header names the two widgets post by convention. */
+var TOKEN_HEADERS = ["cf-turnstile-response", "h-captcha-response"];
+/**
+* The built-in verifier: a form post, which is the whole protocol.
+*
+* A non-200, a timeout or a malformed body are all "not verified" rather than
+* exceptions — the caller cannot distinguish them and should not be told which
+* one happened.
+*/
+function createHttpCaptchaVerifier(options) {
+	const endpoint = VERIFY_ENDPOINT[options.provider];
+	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	const doFetch = options.fetchImpl ?? fetch;
+	return async ({ token, remoteIp }) => {
+		const body = new URLSearchParams({
+			secret: options.secret,
+			response: token
+		});
+		if (remoteIp) body.set("remoteip", remoteIp);
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), timeoutMs);
+		try {
+			const response = await doFetch(endpoint, {
+				method: "POST",
+				headers: { "Content-Type": "application/x-www-form-urlencoded" },
+				body,
+				signal: controller.signal
+			});
+			if (!response.ok) return {
+				success: false,
+				errorCodes: [`http-${response.status}`]
+			};
+			const parsed = await response.json();
+			return {
+				success: parsed?.success === true,
+				errorCodes: parsed?.["error-codes"]
+			};
+		} catch (err) {
+			return {
+				success: false,
+				errorCodes: [err instanceof Error && err.name === "AbortError" ? "timeout" : "unreachable"]
+			};
+		} finally {
+			clearTimeout(timer);
+		}
+	};
+}
+/**
+* Resolve a config into a verifier, or explain why it cannot be used.
+*
+* Returns `undefined` when the feature is off. Throws when it is on but
+* unusable — a misconfigured challenge must not boot as an absent one, because
+* the whole point is that it is there.
+*/
+function resolveCaptchaVerifier(config) {
+	if (!config?.enabled) return void 0;
+	if (config.verify) return config.verify;
+	if (!config.provider) throw new Error("Captcha is enabled but no `provider` is set. Use \"turnstile\" or \"hcaptcha\", or supply your own `verify` function.");
+	if (!(config.provider in VERIFY_ENDPOINT)) throw new Error(`Captcha \`provider\` is "${config.provider}", which is not supported. Use "turnstile" or "hcaptcha", or supply your own \`verify\` function.`);
+	if (!config.secret) throw new Error(`Captcha is enabled for ${config.provider} but no \`secret\` is set. The token has to be verified server-side; a widget on its own protects nothing.`);
+	return createHttpCaptchaVerifier({
+		provider: config.provider,
+		secret: config.secret,
+		timeoutMs: config.timeoutMs
+	});
+}
+/** Read the challenge token out of a request, body field first, then headers. */
+async function extractCaptchaToken(c, field) {
+	for (const header of TOKEN_HEADERS) {
+		const value = c.req.header(header);
+		if (value) return value;
+	}
+	try {
+		const value = (await c.req.json())?.[field];
+		return typeof value === "string" && value.length > 0 ? value : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Middleware refusing a request whose challenge is missing or unverified.
+*
+* The response says only that the challenge failed. Which of "absent",
+* "malformed", "already used" or "provider unreachable" it was is a log line,
+* because telling a script which one it hit is telling it how to get closer.
+*/
+function createCaptchaMiddleware(options) {
+	const field = options.tokenField ?? DEFAULT_TOKEN_FIELD;
+	return createMiddleware(async (c, next) => {
+		const token = await extractCaptchaToken(c, field);
+		if (!token) {
+			logger.debug(`[captcha] ${options.route}: no token on the request`);
+			throw ApiError.badRequest("A captcha challenge is required for this request.", "CAPTCHA_REQUIRED");
+		}
+		const result = await options.verify({
+			token,
+			remoteIp: c.req.header("cf-connecting-ip") ?? void 0
+		});
+		if (!result.success) {
+			logger.warn(`[captcha] ${options.route}: verification failed` + (result.errorCodes?.length ? ` (${result.errorCodes.join(", ")})` : ""));
+			throw ApiError.badRequest("The captcha challenge could not be verified.", "CAPTCHA_FAILED");
+		}
+		await next();
+	});
+}
+/**
+* A middleware per protected route, or an empty map when the feature is off.
+*
+* Routes not named get nothing at all rather than a pass-through, so an unnamed
+* route costs exactly what it did before.
+*/
+function buildCaptchaMiddlewares(config) {
+	const verify = resolveCaptchaVerifier(config);
+	if (!verify) return {};
+	const routes = config?.routes ?? DEFAULT_CAPTCHA_ROUTES;
+	const middlewares = {};
+	for (const route of routes) middlewares[route] = createCaptchaMiddleware({
+		verify,
+		tokenField: config?.tokenField,
+		route
+	});
+	return middlewares;
+}
+//#endregion
 //#region ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/core.js
 var _a$1;
 function $constructor(name, initializer, params) {
@@ -7475,7 +7702,7 @@ function mountSessionRoutes(opts) {
 		clearRefreshCookie(c, config.cookieAuth);
 		const accessToken = extractBearerToken(c.req.header("authorization"));
 		if (ops.afterLogout && accessToken !== void 0) {
-			const { verifyAccessToken } = await import("./jwt-DxH9fLPt.js").then((n) => n.m);
+			const { verifyAccessToken } = await import("./jwt-BbJi0TR0.js").then((n) => n.m);
 			const payload = verifyAccessToken(accessToken);
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
@@ -7714,7 +7941,7 @@ function getMagicLinkExpiry() {
 * Follows the same delegation pattern as `mountMfaRoutes()` and `mountSessionRoutes()`.
 */
 function mountMagicLinkRoutes(deps) {
-	const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook } = deps;
+	const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook, captchaMiddleware } = deps;
 	const { authRepo, emailService, emailConfig } = config;
 	const magicLinkSchema = object({ email: string().email("Invalid email address").max(255) });
 	const verifyMagicLinkSchema = object({ token: string().min(1, "Token is required") });
@@ -7725,7 +7952,7 @@ function mountMagicLinkRoutes(deps) {
 	* POST /auth/magic-link
 	* Request a magic link email
 	*/
-	router.post("/magic-link", strictAuthLimiter, async (c) => {
+	router.post("/magic-link", strictAuthLimiter, ...captchaMiddleware ? [captchaMiddleware] : [], async (c) => {
 		const { email } = parseBody(magicLinkSchema, await c.req.json());
 		if (!isEmailConfigured()) throw ApiError.serviceUnavailable("Email service not configured. Magic link login is not available.", "EMAIL_NOT_CONFIGURED");
 		const user = await authRepo.getUserByEmail(email);
@@ -7877,6 +8104,7 @@ function getPasswordResetExpiry() {
 }
 function createAuthRoutes(config) {
 	if (config.defaultRole && isAdministrativeRole(config.defaultRole)) throw new Error(`CRITICAL SECURITY ERROR: defaultRole cannot be '${config.defaultRole}'. Administrative privilege escalation via registration is strictly forbidden (administrative roles: ${ADMINISTRATIVE_ROLES.join(", ")}). Use the POST /admin/bootstrap endpoint to promote the initial administrator.`);
+	const captcha = buildCaptchaMiddlewares(config.captcha);
 	const router = new Hono();
 	router.onError(errorHandler);
 	const authRepo = config.authRepo;
@@ -8017,7 +8245,7 @@ function createAuthRoutes(config) {
 	* POST /auth/register
 	* Create a new account with email/password
 	*/
-	router.post("/register", defaultAuthLimiter, async (c) => {
+	router.post("/register", defaultAuthLimiter, ...captcha.register ? [captcha.register] : [], async (c) => {
 		const { email, password, displayName } = parseBody(registerSchema, await c.req.json());
 		if (config.disableSelfRegistration) throw ApiError.forbidden("Registration is disabled", "REGISTRATION_DISABLED");
 		let bootstrapRegistration = false;
@@ -8065,7 +8293,7 @@ function createAuthRoutes(config) {
 	* POST /auth/login
 	* Login with email/password
 	*/
-	router.post("/login", defaultAuthLimiter, async (c) => {
+	router.post("/login", defaultAuthLimiter, ...captcha.login ? [captcha.login] : [], async (c) => {
 		const { email, password } = parseBody(loginSchema, await c.req.json());
 		if (ops.beforeLogin) await ops.beforeLogin(email, "login");
 		let user;
@@ -8222,7 +8450,7 @@ function createAuthRoutes(config) {
 	* POST /auth/forgot-password
 	* Request password reset email
 	*/
-	router.post("/forgot-password", strictAuthLimiter, async (c) => {
+	router.post("/forgot-password", strictAuthLimiter, ...captcha.forgotPassword ? [captcha.forgotPassword] : [], async (c) => {
 		const { email } = parseBody(forgotPasswordSchema, await c.req.json());
 		if (!isEmailConfigured()) throw ApiError.serviceUnavailable("Email service not configured. Password reset is not available.", "EMAIL_NOT_CONFIGURED");
 		const user = await authRepo.getUserByEmail(email);
@@ -8470,7 +8698,8 @@ function createAuthRoutes(config) {
 		parseBody,
 		buildAuthResponse,
 		createSessionAndTokens,
-		applyTransformHook
+		applyTransformHook,
+		captchaMiddleware: captcha.magicLink
 	});
 	return router;
 }
@@ -8850,7 +9079,7 @@ function createAdminUsersRoute(config) {
 * when the user passes a plain `RebaseAuthConfig` object.
 */
 function createBuiltinAuthAdapter(config) {
-	const { authRepository, emailService, emailConfig, allowRegistration = false, disableSelfRegistration = false, allowAnonymous = false, allowUserLookup = false, defaultRole, oauthProviders = [], allowedRedirectUris, serviceKey, authHooks, collectionAuthConfig, enableMagicLink = false, cookieAuth } = config;
+	const { authRepository, emailService, emailConfig, allowRegistration = false, disableSelfRegistration = false, allowAnonymous = false, allowUserLookup = false, captcha, defaultRole, oauthProviders = [], allowedRedirectUris, serviceKey, authHooks, collectionAuthConfig, enableMagicLink = false, cookieAuth } = config;
 	const resolvedOps = resolveAuthHooks(authHooks);
 	return {
 		id: "rebase-builtin",
@@ -8937,7 +9166,8 @@ function createBuiltinAuthAdapter(config) {
 				allowedRedirectUris,
 				authHooks,
 				enableMagicLink,
-				cookieAuth
+				cookieAuth,
+				captcha
 			});
 		},
 		createAdminRoutes() {
@@ -10734,9 +10964,11 @@ function createCustomAuthAdapter(options) {
 //#endregion
 //#region src/auth/index.ts
 var auth_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_CAPTCHA_ROUTES: () => DEFAULT_CAPTCHA_ROUTES,
 	MemoryRateLimitStore: () => MemoryRateLimitStore,
 	RateLimitStoreConfigurationError: () => RateLimitStoreConfigurationError,
 	apiKeyKeyGenerator: () => apiKeyKeyGenerator,
+	buildCaptchaMiddlewares: () => buildCaptchaMiddlewares,
 	configureJwt: () => configureJwt,
 	createAdapterAuthMiddleware: () => createAdapterAuthMiddleware,
 	createApiKeyRoutes: () => createApiKeyRoutes,
@@ -10746,6 +10978,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	createAuthRoutes: () => createAuthRoutes,
 	createBitbucketProvider: () => createBitbucketProvider,
 	createBuiltinAuthAdapter: () => createBuiltinAuthAdapter,
+	createCaptchaMiddleware: () => createCaptchaMiddleware,
 	createCustomAuthAdapter: () => createCustomAuthAdapter,
 	createDataRateLimiter: () => createDataRateLimiter,
 	createDiscordProvider: () => createDiscordProvider,
@@ -10753,6 +10986,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	createGitHubProvider: () => createGitHubProvider,
 	createGitLabProvider: () => createGitLabProvider,
 	createGoogleProvider: () => createGoogleProvider,
+	createHttpCaptchaVerifier: () => createHttpCaptchaVerifier,
 	createJwksRoutes: () => createJwksRoutes,
 	createLinkedinProvider: () => createLinkedinProvider,
 	createMicrosoftProvider: () => createMicrosoftProvider,
@@ -10794,6 +11028,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	requireAdmin: () => requireAdmin,
 	requireAuth: () => requireAuth,
 	resolveAuthHooks: () => resolveAuthHooks,
+	resolveCaptchaVerifier: () => resolveCaptchaVerifier,
 	resolveRateLimitStoreKind: () => resolveRateLimitStoreKind,
 	safeCompare: () => safeCompare,
 	strictAuthLimiter: () => strictAuthLimiter,
@@ -10806,6 +11041,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { createAdapterAuthMiddleware as $, _coercedNumber as A, validatePasswordStrength as B, providerVerifiedEmail as C, parseQueryOptions as Ct, _enum as D, ZodNumber as E, isPublicStoragePath as Et, createEmailService as F, getPasswordResetTemplate as G, generateSecurePassword as H, assertEmailLinkBases as I, resolveEmailBranding as J, getUserInvitationTemplate as K, resolveEmailLinkBase as L, createDataRateLimiter as M, MemoryRateLimitStore as N, object as O, SMTPEmailService as P, raw as Q, resolveAuthHooks as R, pkceTokenParams as S, parseGroupBy as St, createBuiltinAuthAdapter as T, PUBLIC_STORAGE_PREFIX as Tt, getEmailVerificationTemplate as U, verifyPassword as V, getMagicLinkTemplate as W, escapeHtml as X, RawHtml as Y, html as Z, verifyOidcIdToken as _, scopeDataDriver as _t, resolveRateLimitStoreKind as a, publicObjectAuth as at, createGoogleProvider as b, orderByEntriesToTuples as bt, createSlackProvider as c, requireAuth as ct, createDiscordProvider as d, createStorageApiKeyGuard as dt, createAuthMiddleware as et, createTwitterProvider as f, isApiKeyToken as ft, tryVerifyOidcIdToken as g, SERVICE_IDENTITY as gt, createMicrosoftProvider as h, safeCompare as ht, createApiKeyStore as i, optionalAuth as it, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as j, string as k, createBitbucketProvider as l, createApiKeyPreAuth as lt, createAppleProvider as m, extractBearerToken as mt, createCustomAuthAdapter as n, extractUserFromToken as nt, createSqlRateLimitStore as o, queryTokenAuth as ot, createFacebookProvider as p, validateApiKey as pt, getWelcomeEmailTemplate as q, createApiKeyRoutes as r, fileTokenAuth as rt, createSpotifyProvider as s, requireAdmin as st, auth_exports as t, createRequireAuth as tt, createGitLabProvider as u, createFunctionApiKeyGuard as ut, createGitHubProvider as v, httpMethodToOperation as vt, createJwksRoutes as w, resolveListLimitParam as wt, oauthCodeFlowSchema as x, parseAggregateSelect as xt, createLinkedinProvider as y, isOperationAllowed as yt, hashPassword as z };
+export { html as $, _coercedNumber as A, resolveAuthHooks as B, providerVerifiedEmail as C, orderByEntriesToTuples as Ct, _enum as D, resolveListLimitParam as Dt, ZodNumber as E, parseQueryOptions as Et, extractLinks as F, getEmailVerificationTemplate as G, validatePasswordStrength as H, SMTPEmailService as I, getUserInvitationTemplate as J, getMagicLinkTemplate as K, createEmailService as L, createDataRateLimiter as M, MemoryRateLimitStore as N, object as O, PUBLIC_STORAGE_PREFIX as Ot, createDevEmailSink as P, escapeHtml as Q, assertEmailLinkBases as R, pkceTokenParams as S, isOperationAllowed as St, createBuiltinAuthAdapter as T, parseGroupBy as Tt, verifyPassword as U, hashPassword as V, generateSecurePassword as W, resolveEmailBranding as X, getWelcomeEmailTemplate as Y, RawHtml as Z, verifyOidcIdToken as _, safeCompare as _t, resolveRateLimitStoreKind as a, fileTokenAuth as at, createGoogleProvider as b, hasAdministrativeRole as bt, createSlackProvider as c, queryTokenAuth as ct, createDiscordProvider as d, createApiKeyPreAuth as dt, raw as et, createTwitterProvider as f, createFunctionApiKeyGuard as ft, tryVerifyOidcIdToken as g, extractBearerToken as gt, createMicrosoftProvider as h, validateApiKey as ht, createApiKeyStore as i, extractUserFromToken as it, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as j, string as k, isPublicStoragePath as kt, createBitbucketProvider as l, requireAdmin as lt, createAppleProvider as m, isApiKeyToken as mt, createCustomAuthAdapter as n, createAuthMiddleware as nt, createSqlRateLimitStore as o, optionalAuth as ot, createFacebookProvider as p, createStorageApiKeyGuard as pt, getPasswordResetTemplate as q, createApiKeyRoutes as r, createRequireAuth as rt, createSpotifyProvider as s, publicObjectAuth as st, auth_exports as t, createAdapterAuthMiddleware as tt, createGitLabProvider as u, requireAuth as ut, createGitHubProvider as v, SERVICE_IDENTITY as vt, createJwksRoutes as w, parseAggregateSelect as wt, oauthCodeFlowSchema as x, httpMethodToOperation as xt, createLinkedinProvider as y, scopeDataDriver as yt, resolveEmailLinkBase as z };
 
-//# sourceMappingURL=auth-5Et5mnUA.js.map
+//# sourceMappingURL=auth-C74dqR2B.js.map