@seamless-auth/core 0.15.0 → 0.16.0

package/README.md

@@ -88,13 +88,27 @@ remain for direct imports.
 **Sessions and cookies**
 
 - `ensureCookies(...)` – validates and refreshes session cookies
-- `refreshAccessToken(...)` – rotates expired access sessions
+- `refreshAccessToken(...)` – rotates expired access sessions from a refresh cookie
+- `refreshBearerSession(...)` – rotates a session from a raw refresh token, for bearer transport
+- `refreshHandler(...)` – the `POST /refresh` route, in either transport
+- `sessionResult(...)` – an upstream session as a handler result: cookies for cookie transport, the body whole for bearer
+- `resolveAuthTransport(...)` / `AUTH_TRANSPORT_HEADER` – selects cookie or bearer transport for a request
 - `verifyCookieJwt(...)` – verifies signed cookie payloads
 - `verifyRefreshCookie(...)` – verifies a refresh cookie, returning `null` on failure
 - `verifySignedAuthResponse(...)` – verifies an auth API response signature against its JWKS
-- `getSeamlessUser(...)` – resolves the hydrated user, typed as `SeamlessUser | null`
+- `verifyAccessToken(...)` – verifies an auth API access token against its JWKS, requiring `typ: "access"`
+- `extractBearerToken(...)` – reads the token out of an `Authorization: Bearer` header
+- `getSeamlessUser(...)` – resolves the hydrated user, typed as `SeamlessUser | null`, from a cookie or a bearer token
 - `hasScopedRole(...)` – checks scoped role grants such as `admin:read`
 
+**Guards**
+
+- `authenticateCookie(...)` – verifies an access cookie into a session
+- `authenticateBearer(...)` – verifies a bearer access token into a session
+- `authenticateRequest(...)` – the cookie when present, otherwise the bearer token when enabled
+- `authorizeRoles(...)` – role check against an authenticated session
+- `checkOrigin(...)` – cross-site request check for `SameSite=None` deployments
+
 **Building an adapter**
 
 - `applyResult(result, adapter, opts)` – turns a handler result into a response

package/dist/applyResult.d.ts

@@ -1,5 +1,6 @@
 import type { CookiePayload } from "./ensureCookies.js";
 import type { ResultFailure } from "./result.js";
+import type { AuthTransport } from "./transport.js";
 export type CookieSameSite = "lax" | "none" | "strict";
 export interface CookieSecurityOptions {
     cookieSecret: string;
@@ -7,6 +8,15 @@ export interface CookieSecurityOptions {
     cookieSecure?: boolean;
     cookieSameSite?: CookieSameSite;
 }
+export interface ApplyResultOptions extends CookieSecurityOptions {
+    /**
+     * Bearer transport writes no cookies at all: the client holds its own tokens,
+     * and a `Set-Cookie` on a response it cannot store would be dead weight at
+     * best and, for a clear, a misleading signal that a session ended. Defaults
+     * to cookie transport.
+     */
+    transport?: AuthTransport;
+}
 /**
  * Resolves the effective `SameSite` policy. Shared so the cookie attributes and
  * any policy that keys off `SameSite=None` cannot drift. Browsers reject
@@ -96,5 +106,5 @@ export declare function applyCookies(result: Pick<AppliableResult, "setCookies"
  * untouched; callers read fields off it. A failure carrying `errorCode` is this
  * package's own and is rendered as `{ error, details }`.
  */
-export declare function applyResult(result: AppliableResult, adapter: ResponseAdapter, opts: CookieSecurityOptions): void;
+export declare function applyResult(result: AppliableResult, adapter: ResponseAdapter, opts: ApplyResultOptions): void;
 //# sourceMappingURL=applyResult.d.ts.map

package/dist/applyResult.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"applyResult.d.ts","sourceRoot":"","sources":["../src/applyResult.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,cAAc,GAAG,gBAAgB,CAAC,GACnE,cAAc,CAGhB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;CACd;AAKD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC3C,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC/C,4DAA4D;IAC5D,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,MAAM,CAKR;AAsCD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,GAAG,cAAc,CAAC,EAC5D,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,aAAa,CAAC,EAC3D,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CAsCN;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CAmBN"}
+{"version":3,"file":"applyResult.d.ts","sourceRoot":"","sources":["../src/applyResult.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAC/D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,cAAc,GAAG,gBAAgB,CAAC,GACnE,cAAc,CAGhB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;CACd;AAKD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC3C,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC/C,4DAA4D;IAC5D,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,MAAM,CAKR;AAsCD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,GAAG,cAAc,CAAC,EAC5D,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,aAAa,CAAC,EAC3D,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CAsCN;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,kBAAkB,GACvB,IAAI,CAqBN"}

package/dist/applyResult.js

@@ -103,7 +103,9 @@ export function applyCookies(result, adapter, opts) {
  * package's own and is rendered as `{ error, details }`.
  */
 export function applyResult(result, adapter, opts) {
-    applyCookies(result, adapter, opts);
+    if (opts.transport !== "bearer") {
+        applyCookies(result, adapter, opts);
+    }
     if (result.errorBody !== undefined) {
         adapter.send(result.status, result.errorBody);
         return;

package/dist/applyResult.js.map

@@ -1 +1 @@
-{"version":3,"file":"applyResult.js","sourceRoot":"","sources":["../src/applyResult.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAc/B;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAoE;IAEpE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IACzC,OAAO,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAsCD,gFAAgF;AAChF,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AA6BjC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAsB,EACtB,MAAc,EACd,UAAkB;IAElB,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE;QAC/B,SAAS,EAAE,OAAO;QAClB,SAAS,EAAE,GAAG,UAAU,GAAG;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAE5D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CACb,6CAA6C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,IAA2B;IAChD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA4D,EAC5D,OAA2D,EAC3D,IAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACvC,OAAO,CAAC,WAAW,CAAC;gBAClB,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,OAAO,EAAE,YAAY;gBACrB,MAAM;gBACN,QAAQ;gBACR,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAE5C,OAAO,CAAC,SAAS,CAAC;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC;gBAC1D,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,aAAa,EAAE,UAAU;gBACzB,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC;gBAC1C,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,QAAQ;gBACR,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,MAAuB,EACvB,OAAwB,EACxB,IAA2B;IAE3B,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAEpC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CACV,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,OAAO,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;YAC7B,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CACzD,CAAC;QACF,OAAO;IACT,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"applyResult.js","sourceRoot":"","sources":["../src/applyResult.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAyB/B;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAoE;IAEpE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IACzC,OAAO,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAsCD,gFAAgF;AAChF,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AA6BjC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAsB,EACtB,MAAc,EACd,UAAkB;IAElB,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE;QAC/B,SAAS,EAAE,OAAO;QAClB,SAAS,EAAE,GAAG,UAAU,GAAG;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAE5D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CACb,6CAA6C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,IAA2B;IAChD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA4D,EAC5D,OAA2D,EAC3D,IAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACvC,OAAO,CAAC,WAAW,CAAC;gBAClB,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,OAAO,EAAE,YAAY;gBACrB,MAAM;gBACN,QAAQ;gBACR,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAE5C,OAAO,CAAC,SAAS,CAAC;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC;gBAC1D,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,aAAa,EAAE,UAAU;gBACzB,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC;gBAC1C,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,QAAQ;gBACR,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,MAAuB,EACvB,OAAwB,EACxB,IAAwB;IAExB,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CACV,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,OAAO,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;YAC7B,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CACzD,CAAC;QACF,OAAO;IACT,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC"}

package/dist/getSeamlessUser.d.ts

@@ -21,12 +21,24 @@ export interface GetSeamlessUserOptions {
     serviceAuthorization?: string;
     forwardedClientIp?: string;
     forwardedUserAgent?: string;
+    /**
+     * Enables the bearer path for a request that carries no access cookie: the
+     * auth API's own access token in `Authorization: Bearer`, verified against the
+     * API's JWKS before it is forwarded. Left out, only the cookie is consulted.
+     */
+    bearer?: {
+        /** The request's raw `Authorization` header. */
+        authorization?: string;
+        /** Expected `aud` on the access token. The issuer is `authServerUrl`. */
+        audience: string;
+    };
 }
 /**
- * Resolves the authenticated Seamless Auth user from an access cookie.
+ * Resolves the authenticated Seamless Auth user from the request's credential.
  *
  * This function:
- * - Verifies the access cookie locally
+ * - Verifies the access cookie locally, or the bearer access token against JWKS
+ *   when there is no cookie and `bearer` is configured
  * - Uses the verified token to authenticate a request to the auth server
  * - Returns the canonical user object, or null if authentication fails
  *

package/dist/getSeamlessUser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSeamlessUser.d.ts","sourceRoot":"","sources":["../src/getSeamlessUser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAMnD;;;;;GAKG;AACH;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,YAAY,EACpD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC3C,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAuBnB"}
+{"version":3,"file":"getSeamlessUser.d.ts","sourceRoot":"","sources":["../src/getSeamlessUser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAOnD;;;;;GAKG;AACH;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,gDAAgD;QAChD,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,yEAAyE;QACzE,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,YAAY,EACpD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC3C,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAkBnB"}

package/dist/getSeamlessUser.js

@@ -1,11 +1,13 @@
-import { verifyCookieJwt } from "./verifyCookieJwt.js";
 import { authFetch } from "./authFetch.js";
 import { assertSecretStrength } from "./validateSecrets.js";
+import { extractBearerToken, verifyAccessToken } from "./verifyAccessToken.js";
+import { verifyCookieJwt } from "./verifyCookieJwt.js";
 /**
- * Resolves the authenticated Seamless Auth user from an access cookie.
+ * Resolves the authenticated Seamless Auth user from the request's credential.
  *
  * This function:
- * - Verifies the access cookie locally
+ * - Verifies the access cookie locally, or the bearer access token against JWKS
+ *   when there is no cookie and `bearer` is configured
  * - Uses the verified token to authenticate a request to the auth server
  * - Returns the canonical user object, or null if authentication fails
  *
@@ -13,16 +15,12 @@ import { assertSecretStrength } from "./validateSecrets.js";
  */
 export async function getSeamlessUser(cookies, opts) {
     assertSecretStrength("cookieSecret", opts.cookieSecret);
-    const cookieName = opts.cookieName ?? "seamless-access";
-    const token = cookies[cookieName];
-    if (!token)
-        return null;
-    const payload = verifyCookieJwt(token, opts.cookieSecret);
-    if (!payload)
+    const authorization = await resolveUpstreamAuthorization(cookies, opts);
+    if (authorization === null)
         return null;
     const response = await authFetch(`${opts.authServerUrl}/users/me`, {
         method: "GET",
-        authorization: opts.authorization,
+        authorization,
         serviceAuthorization: opts.serviceAuthorization,
         forwardedClientIp: opts.forwardedClientIp,
         forwardedUserAgent: opts.forwardedUserAgent,
@@ -32,4 +30,24 @@ export async function getSeamlessUser(cookies, opts) {
     const data = await response.json();
     return data?.user ?? null;
 }
+/**
+ * `null` means the request carried nothing that verifies. `undefined` keeps the
+ * cookie path's historical shape: a verified cookie with no caller-supplied
+ * `authorization` still reaches the auth server, which decides for itself.
+ */
+async function resolveUpstreamAuthorization(cookies, opts) {
+    const cookieName = opts.cookieName ?? "seamless-access";
+    const cookie = cookies[cookieName];
+    if (cookie) {
+        const payload = verifyCookieJwt(cookie, opts.cookieSecret);
+        return payload ? opts.authorization : null;
+    }
+    if (!opts.bearer)
+        return null;
+    const token = extractBearerToken(opts.bearer.authorization);
+    if (!token)
+        return null;
+    const claims = await verifyAccessToken(token, opts.authServerUrl, opts.bearer.audience);
+    return claims ? `Bearer ${token}` : null;
+}
 //# sourceMappingURL=getSeamlessUser.js.map

package/dist/getSeamlessUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"getSeamlessUser.js","sourceRoot":"","sources":["../src/getSeamlessUser.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AA2B5D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA2C,EAC3C,IAA4B;IAE5B,oBAAoB,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAExD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAElC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,WAAW,EAAE;QACjE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"getSeamlessUser.js","sourceRoot":"","sources":["../src/getSeamlessUser.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAsCvD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA2C,EAC3C,IAA4B;IAE5B,oBAAoB,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAExD,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,WAAW,EAAE;QACjE,MAAM,EAAE,KAAK;QACb,aAAa;QACb,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,4BAA4B,CACzC,OAA2C,EAC3C,IAA4B;IAE5B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEnC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,KAAK,EACL,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CAAC,QAAQ,CACrB,CAAC;IAEF,OAAO,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC"}

package/dist/guards.d.ts

@@ -62,6 +62,45 @@ export type CookieAuthResult = {
  * there.
  */
 export declare function authenticateCookie(input: CookieAuthInput): CookieAuthResult;
+export interface BearerAuthInput {
+    /** The raw `Authorization` header, or `undefined` when the request carried none. */
+    authorization?: string;
+    authServerUrl: string;
+    /** Expected `aud` on the access token. The issuer is `authServerUrl`. */
+    audience: string;
+}
+export type AuthResult = CookieAuthResult;
+/**
+ * Verifies an access token the auth API issued, carried as `Authorization:
+ * Bearer`, into a session.
+ *
+ * This is the path a native client takes: it has no cookie jar, so it holds the
+ * API's own access token and presents it directly. The token carries `sub`,
+ * `roles` and the session id but not the profile, so `email` and `phone` are
+ * left unset; `getSeamlessUser` hydrates them.
+ */
+export declare function authenticateBearer(input: BearerAuthInput): Promise<AuthResult>;
+export interface RequestAuthInput extends CookieAuthInput {
+    /** The raw `Authorization` header, or `undefined` when the request carried none. */
+    authorization?: string;
+    /**
+     * Enables bearer tokens. Left out, the guard accepts cookies only, which is
+     * what every adopter predating this option gets.
+     */
+    bearer?: {
+        authServerUrl: string;
+        audience: string;
+    };
+}
+/**
+ * Authenticates a request from whichever credential it carries.
+ *
+ * The cookie wins when present, including when it is invalid: a browser with a
+ * stale cookie should see the session rejected rather than fall through to a
+ * header it never meant to send. Bearer is only consulted when there is no
+ * cookie at all and the adopter has opted in.
+ */
+export declare function authenticateRequest(input: RequestAuthInput): Promise<AuthResult>;
 /**
  * Authorization only, against a session a guard has already authenticated.
  *

package/dist/guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../src/guards.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAK9E;;;;;;;GAOG;AACH,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAMD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,gBAAgB,GACtB,cAAc,GAAG,SAAS,CAyC5B;AAED,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GACjD;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,cAAc,CAAA;CAAE,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAgC3E;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,gBAAgB,GAAG,SAAS,EAClC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAC/B,cAAc,GAAG,SAAS,CAoB5B"}
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../src/guards.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAM9E;;;;;;;GAOG;AACH,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAMD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,gBAAgB,GACtB,cAAc,GAAG,SAAS,CAyC5B;AAED,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GACjD;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,cAAc,CAAA;CAAE,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAgC3E;AAED,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAU1C;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,UAAU,CAAC,CAgCrB;AAED,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,gBAAgB,GAAG,SAAS,EAClC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAC/B,cAAc,GAAG,SAAS,CAoB5B"}

package/dist/guards.js

@@ -1,6 +1,7 @@
 import { resolveCookieSameSite } from "./applyResult.js";
 import { hasScopedRole } from "@seamless-auth/types/role/matching";
 import { assertSecretStrength } from "./validateSecrets.js";
+import { extractBearerToken, verifyAccessToken } from "./verifyAccessToken.js";
 import { verifyCookieJwt } from "./verifyCookieJwt.js";
 // GET/HEAD are read-only and OPTIONS is the CORS preflight, so none can carry a
 // state change worth gating.
@@ -88,6 +89,68 @@ export function authenticateCookie(input) {
         },
     };
 }
+function missingTokenRejection(warn) {
+    return {
+        status: 401,
+        errorCode: "Failed to find authentication token required",
+        warn,
+    };
+}
+/**
+ * Verifies an access token the auth API issued, carried as `Authorization:
+ * Bearer`, into a session.
+ *
+ * This is the path a native client takes: it has no cookie jar, so it holds the
+ * API's own access token and presents it directly. The token carries `sub`,
+ * `roles` and the session id but not the profile, so `email` and `phone` are
+ * left unset; `getSeamlessUser` hydrates them.
+ */
+export async function authenticateBearer(input) {
+    const token = extractBearerToken(input.authorization);
+    if (!token) {
+        return {
+            rejection: missingTokenRejection("Missing expected Authorization bearer token."),
+        };
+    }
+    const claims = await verifyAccessToken(token, input.authServerUrl, input.audience);
+    if (!claims) {
+        return {
+            rejection: { status: 401, errorCode: "Invalid or expired session" },
+        };
+    }
+    return {
+        user: {
+            id: claims.sub,
+            roles: Array.isArray(claims.roles) ? claims.roles : [],
+            iat: claims.iat,
+            exp: claims.exp,
+            token,
+        },
+    };
+}
+/**
+ * Authenticates a request from whichever credential it carries.
+ *
+ * The cookie wins when present, including when it is invalid: a browser with a
+ * stale cookie should see the session rejected rather than fall through to a
+ * header it never meant to send. Bearer is only consulted when there is no
+ * cookie at all and the adopter has opted in.
+ */
+export async function authenticateRequest(input) {
+    if (input.token || !input.bearer) {
+        return authenticateCookie(input);
+    }
+    assertSecretStrength("requireAuth: cookieSecret", input.cookieSecret);
+    if (!extractBearerToken(input.authorization)) {
+        return {
+            rejection: missingTokenRejection("Missing expected auth cookie or Authorization bearer token."),
+        };
+    }
+    return authenticateBearer({
+        authorization: input.authorization,
+        ...input.bearer,
+    });
+}
 /**
  * Authorization only, against a session a guard has already authenticated.
  *

package/dist/guards.js.map

@@ -1 +1 @@
-{"version":3,"file":"guards.js","sourceRoot":"","sources":["../src/guards.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAuB,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAuBvD,gFAAgF;AAChF,6BAA6B;AAC7B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAazD,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,KAAuB;IAEvB,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;IAEvD,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAmB;QAChC,MAAM,EAAE,GAAG;QACX,SAAS,EAAE,4BAA4B;KACxC,CAAC;IAEF,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,YAAY;YACtD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,sEAAsE;IACtE,2BAA2B;IAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,sEAAsE;IACtE,+BAA+B;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,+EAA+E;IAC/E,wDAAwD;IACxD,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAC1D,CAAC;IAEF,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,oBAAoB,CAAC,2BAA2B,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAEtE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,SAAS,EAAE;gBACT,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,8CAA8C;gBACzD,IAAI,EAAE,+BAA+B;aACtC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAEjE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO;YACL,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,4BAA4B,EAAE;SACpE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE;YACJ,EAAE,EAAE,OAAO,CAAC,GAAG;YACf,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACxD,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAkC,EAClC,aAAgC;IAEhC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAE7E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,4BAA4B,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,mBAAmB;YAC9B,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;SAChD,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../src/guards.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAuB,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAuBvD,gFAAgF;AAChF,6BAA6B;AAC7B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAazD,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,KAAuB;IAEvB,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;IAEvD,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAmB;QAChC,MAAM,EAAE,GAAG;QACX,SAAS,EAAE,4BAA4B;KACxC,CAAC;IAEF,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,YAAY;YACtD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,sEAAsE;IACtE,2BAA2B;IAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,sEAAsE;IACtE,+BAA+B;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,+EAA+E;IAC/E,wDAAwD;IACxD,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAC1D,CAAC;IAEF,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,oBAAoB,CAAC,2BAA2B,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAEtE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,SAAS,EAAE;gBACT,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,8CAA8C;gBACzD,IAAI,EAAE,+BAA+B;aACtC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAEjE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO;YACL,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,4BAA4B,EAAE;SACpE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE;YACJ,EAAE,EAAE,OAAO,CAAC,GAAG;YACf,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACxD,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB;KACF,CAAC;AACJ,CAAC;AAYD,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO;QACL,MAAM,EAAE,GAAG;QACX,SAAS,EAAE,8CAA8C;QACzD,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAsB;IAEtB,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEtD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,SAAS,EAAE,qBAAqB,CAC9B,8CAA8C,CAC/C;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,KAAK,EACL,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,QAAQ,CACf,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,4BAA4B,EAAE;SACpE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM,CAAC,GAAG;YACd,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACtD,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK;SACN;KACF,CAAC;AACJ,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAuB;IAEvB,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,oBAAoB,CAAC,2BAA2B,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAEtE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,SAAS,EAAE,qBAAqB,CAC9B,6DAA6D,CAC9D;SACF,CAAC;IACJ,CAAC;IAED,OAAO,kBAAkB,CAAC;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,GAAG,KAAK,CAAC,MAAM;KAChB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAkC,EAClC,aAAgC;IAEhC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAE7E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,4BAA4B,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,mBAAmB;YAC9B,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE;SAChD,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/handlers/finishLogin.d.ts

@@ -1,3 +1,4 @@
+import type { AuthTransport } from "../transport.js";
 import type { ResultFailure } from "../result.js";
 import type { CookiePayload } from "../ensureCookies.js";
 export interface FinishLoginInput {
@@ -13,6 +14,7 @@ export interface FinishLoginOptions {
     cookieDomain?: string;
     accessCookieName: string;
     refreshCookieName: string;
+    transport?: AuthTransport;
 }
 export interface FinishLoginResult extends ResultFailure {
     status: number;

package/dist/handlers/finishLogin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finishLogin.d.ts","sourceRoot":"","sources":["../../src/handlers/finishLogin.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,iBAAiB,CAAC,CA8B5B"}
+{"version":3,"file":"finishLogin.d.ts","sourceRoot":"","sources":["../../src/handlers/finishLogin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,iBAAiB,CAAC,CA8B5B"}

package/dist/handlers/finishLogin.js

@@ -1,5 +1,5 @@
 import { authFetch } from "../authFetch.js";
-import { issueSessionCookies, withoutSessionMaterial, } from "../upstreamSession.js";
+import { sessionResult } from "../upstreamSession.js";
 import { readPassthroughFailure } from "../upstreamError.js";
 export async function finishLoginHandler(input, opts) {
     const up = await authFetch(`${opts.authServerUrl}/webAuthn/login/finish`, {
@@ -19,14 +19,14 @@ export async function finishLoginHandler(input, opts) {
     }
     return {
         status: 200,
-        body: withoutSessionMaterial(data),
-        setCookies: await issueSessionCookies(data, {
+        ...(await sessionResult(data, {
             authServerUrl: opts.authServerUrl,
             audience: opts.audience,
             accessCookieName: opts.accessCookieName,
             refreshCookieName: opts.refreshCookieName,
             cookieDomain: opts.cookieDomain,
-        }),
+            transport: opts.transport,
+        })),
     };
 }
 //# sourceMappingURL=finishLogin.js.map

package/dist/handlers/finishLogin.js.map

@@ -1 +1 @@
-{"version":3,"file":"finishLogin.js","sourceRoot":"","sources":["../../src/handlers/finishLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA+B7D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAuB,EACvB,IAAwB;IAExB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,wBAAwB,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"finishLogin.js","sourceRoot":"","sources":["../../src/handlers/finishLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAgC7D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAuB,EACvB,IAAwB;IAExB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,wBAAwB,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE;YAC5B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/handlers/login.d.ts

@@ -1,5 +1,7 @@
 import type { ResultFailure } from "../result.js";
 import type { CookiePayload } from "../ensureCookies.js";
+import { type UpstreamSessionResponse } from "../upstreamSession.js";
+import type { AuthTransport } from "../transport.js";
 export interface LoginInput {
     body: unknown;
 }
@@ -11,14 +13,20 @@ export interface LoginOptions {
     serviceAuthorization?: string;
     forwardedClientIp?: string;
     forwardedUserAgent?: string;
+    transport?: AuthTransport;
+}
+export interface LoginStartBody {
+    message?: string;
+    identifierType?: string;
+    loginMethods?: string[];
 }
 export interface LoginResult extends ResultFailure {
     status: number;
-    body?: {
-        message?: string;
-        identifierType?: string;
-        loginMethods?: string[];
-    };
+    /**
+     * Cookie transport narrows the body to what the browser needs. Bearer
+     * transport returns the upstream body whole, ephemeral token included.
+     */
+    body?: LoginStartBody | UpstreamSessionResponse;
     setCookies?: {
         name: string;
         value: CookiePayload;

package/dist/handlers/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/handlers/login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,WAAW,CAAC,CAgDtB"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/handlers/login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,cAAc,GAAG,uBAAuB,CAAC;IAChD,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,WAAW,CAAC,CAsDtB"}

package/dist/handlers/login.js

@@ -1,6 +1,6 @@
 import { authFetch } from "../authFetch.js";
 import { readPassthroughFailure } from "../upstreamError.js";
-import { verifyUpstreamSession } from "../upstreamSession.js";
+import { verifyUpstreamSession, } from "../upstreamSession.js";
 export async function loginHandler(input, opts) {
     const up = await authFetch(`${opts.authServerUrl}/login`, {
         method: "POST",
@@ -19,6 +19,11 @@ export async function loginHandler(input, opts) {
     // Login issues only the pre-auth cookie, so it verifies the response without
     // building session cookies from it.
     await verifyUpstreamSession(data, opts.authServerUrl, opts.audience);
+    // The ephemeral token is what carries the flow forward, and a bearer client
+    // has nowhere to get it from but the body.
+    if (opts.transport === "bearer") {
+        return { status: up.status, body: data };
+    }
     const body = {
         ...(typeof data.message === "string" ? { message: data.message } : {}),
         ...(typeof data.identifierType === "string"

package/dist/handlers/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/handlers/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AA+B9D,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAiB,EACjB,IAAkB;IAElB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,QAAQ,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,oCAAoC;IACpC,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;YACzC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;YAClC,CAAC,CAAC;gBACE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CACpC,CAAC,IAAa,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAC5C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI;QACJ,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/handlers/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAEL,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAuC/B,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAiB,EACjB,IAAkB;IAElB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,QAAQ,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,oCAAoC;IACpC,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAErE,4EAA4E;IAC5E,2CAA2C;IAC3C,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;YACzC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;YAClC,CAAC,CAAC;gBACE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CACpC,CAAC,IAAa,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAC5C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI;QACJ,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/handlers/oauthHandlers.d.ts

@@ -1,3 +1,4 @@
+import type { AuthTransport } from "../transport.js";
 import type { ResultFailure } from "../result.js";
 import type { CookiePayload } from "../ensureCookies.js";
 export interface OAuthHandlerOptions {
@@ -6,6 +7,7 @@ export interface OAuthHandlerOptions {
     cookieDomain?: string;
     accessCookieName: string;
     refreshCookieName: string;
+    transport?: AuthTransport;
 }
 export interface OAuthRequestInput {
     providerId?: string;

package/dist/handlers/oauthHandlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthHandlers.d.ts","sourceRoot":"","sources":["../../src/handlers/oauthHandlers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;;;;;;;;GAYjD;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;;;;;;;;GAmBjD;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAgC7B"}
+{"version":3,"file":"oauthHandlers.d.ts","sourceRoot":"","sources":["../../src/handlers/oauthHandlers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;;;;;;;;GAYjD;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;;;;;;;;GAmBjD;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAgC7B"}

package/dist/handlers/oauthHandlers.js

@@ -1,5 +1,5 @@
 import { authFetch } from "../authFetch.js";
-import { issueSessionCookies, withoutSessionMaterial, } from "../upstreamSession.js";
+import { sessionResult } from "../upstreamSession.js";
 import { readPassthroughFailure } from "../upstreamError.js";
 export async function listOAuthProvidersHandler(opts) {
     const up = await authFetch(`${opts.authServerUrl}/oauth/providers`, {
@@ -42,14 +42,14 @@ export async function finishOAuthLoginHandler(input, opts) {
     }
     return {
         status: up.status,
-        body: withoutSessionMaterial(data),
-        setCookies: await issueSessionCookies(data, {
+        ...(await sessionResult(data, {
             authServerUrl: opts.authServerUrl,
             audience: opts.audience,
             accessCookieName: opts.accessCookieName,
             refreshCookieName: opts.refreshCookieName,
             cookieDomain: opts.cookieDomain,
-        }),
+            transport: opts.transport,
+        })),
     };
 }
 //# sourceMappingURL=oauthHandlers.js.map

package/dist/handlers/oauthHandlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthHandlers.js","sourceRoot":"","sources":["../../src/handlers/oauthHandlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA+B7D,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAgD;IAEhD,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,kBAAkB,EAAE;QAClE,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAwB,EACxB,IAAgD;IAEhD,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,UAAW,CAAC,QAAQ,EAC5E;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAwB,EACxB,IAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,UAAW,CAAC,WAAW,EAC/E;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauthHandlers.js","sourceRoot":"","sources":["../../src/handlers/oauthHandlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAgC7D,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAgD;IAEhD,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,kBAAkB,EAAE;QAClE,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAwB,EACxB,IAAgD;IAEhD,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,UAAW,CAAC,QAAQ,EAC5E;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAwB,EACxB,IAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,UAAW,CAAC,WAAW,EAC/E;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE;YAC5B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/handlers/pollMagicLinkConfirmationHandler.d.ts

@@ -1,3 +1,4 @@
+import type { AuthTransport } from "../transport.js";
 import type { ResultFailure } from "../result.js";
 import type { CookiePayload } from "../ensureCookies.js";
 export interface PollMagicLinkConfirmationInput {
@@ -12,6 +13,7 @@ export interface PollMagicLinkConfirmationOptions {
     accessCookieName: string;
     refreshCookieName: string;
     serviceAuthorization?: string;
+    transport?: AuthTransport;
 }
 export interface PollMagicLinkConfirmationResult extends ResultFailure {
     status: number;

package/dist/handlers/pollMagicLinkConfirmationHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pollMagicLinkConfirmationHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/pollMagicLinkConfirmationHandler.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,8BAA8B;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gCAAgC;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,+BAAgC,SAAQ,aAAa;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,8BAA8B,EACrC,IAAI,EAAE,gCAAgC,GACrC,OAAO,CAAC,+BAA+B,CAAC,CA0C1C"}
+{"version":3,"file":"pollMagicLinkConfirmationHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/pollMagicLinkConfirmationHandler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,8BAA8B;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gCAAgC;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,+BAAgC,SAAQ,aAAa;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,8BAA8B,EACrC,IAAI,EAAE,gCAAgC,GACrC,OAAO,CAAC,+BAA+B,CAAC,CA0C1C"}

package/dist/handlers/pollMagicLinkConfirmationHandler.js

@@ -1,5 +1,5 @@
 import { authFetch } from "../authFetch.js";
-import { issueSessionCookies, withoutSessionMaterial, } from "../upstreamSession.js";
+import { sessionResult } from "../upstreamSession.js";
 import { readPassthroughFailure } from "../upstreamError.js";
 export async function pollMagicLinkConfirmationHandler(input, opts) {
     const up = await authFetch(`${opts.authServerUrl}/magic-link/check`, {
@@ -29,14 +29,14 @@ export async function pollMagicLinkConfirmationHandler(input, opts) {
     }
     return {
         status: 200,
-        body: withoutSessionMaterial(data),
-        setCookies: await issueSessionCookies(data, {
+        ...(await sessionResult(data, {
             authServerUrl: opts.authServerUrl,
             audience: opts.audience,
             accessCookieName: opts.accessCookieName,
             refreshCookieName: opts.refreshCookieName,
             cookieDomain: opts.cookieDomain,
-        }),
+            transport: opts.transport,
+        })),
     };
 }
 //# sourceMappingURL=pollMagicLinkConfirmationHandler.js.map

package/dist/handlers/pollMagicLinkConfirmationHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"pollMagicLinkConfirmationHandler.js","sourceRoot":"","sources":["../../src/handlers/pollMagicLinkConfirmationHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA8B7D,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAqC,EACrC,IAAsC;IAEtC,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,mBAAmB,EAAE;QACnE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;KAChD,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;QACtD,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pollMagicLinkConfirmationHandler.js","sourceRoot":"","sources":["../../src/handlers/pollMagicLinkConfirmationHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA+B7D,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAqC,EACrC,IAAsC;IAEtC,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,mBAAmB,EAAE;QACnE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;KAChD,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,GAAG;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;QACtD,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE;YAC5B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}