@sentropic/auth-hono 0.2.1

package/dist/route-handlers.js

@@ -0,0 +1,106 @@
+import { z } from 'zod';
+const requestEmailCodeSchema = z.object({
+    email: z.string().email(),
+});
+const verifyEmailCodeSchema = z.object({
+    code: z.string().regex(/^\d{6}$/),
+    email: z.string().email(),
+});
+const requestMagicLinkSchema = z.object({
+    email: z.string().email(),
+});
+const verifyMagicLinkSchema = z.object({
+    token: z.string().min(1),
+});
+export const createAuthEmailRouteHandlers = (options) => ({
+    async requestEmailCode(c) {
+        const input = await parseJson(c, requestEmailCodeSchema);
+        if (!input.ok) {
+            return invalidRequest(c, input.error);
+        }
+        const result = await options.service.requestEmailCode(input.value);
+        if (!result.success) {
+            return serviceError(c, result.error);
+        }
+        return c.json({
+            delivery: 'email',
+            expiresAt: result.expiresAt.toISOString(),
+            success: true,
+        });
+    },
+    async verifyEmailCode(c) {
+        const input = await parseJson(c, verifyEmailCodeSchema);
+        if (!input.ok) {
+            return invalidRequest(c, input.error);
+        }
+        const result = await options.service.verifyEmailCode(input.value);
+        if (!result.valid) {
+            return serviceError(c, result.error);
+        }
+        return c.json({
+            success: true,
+            verificationToken: result.verificationToken,
+        });
+    },
+});
+export const createAuthMagicLinkRouteHandlers = (options) => ({
+    async requestMagicLink(c) {
+        const input = await parseJson(c, requestMagicLinkSchema);
+        if (!input.ok) {
+            return invalidRequest(c, input.error);
+        }
+        const result = await options.service.requestMagicLink(input.value);
+        if (!result.success) {
+            return serviceError(c, result.error);
+        }
+        return c.json(formatRequestMagicLinkSuccess(options, result));
+    },
+    async verifyMagicLink(c) {
+        const input = await parseJson(c, verifyMagicLinkSchema);
+        if (!input.ok) {
+            return invalidRequest(c, input.error);
+        }
+        const result = await options.service.verifyMagicLink(input.value);
+        if (!result.valid) {
+            return serviceError(c, result.error);
+        }
+        return c.json({
+            success: true,
+            user: {
+                displayName: result.user.displayName,
+                email: result.email,
+                id: result.user.id,
+                role: result.user.role,
+            },
+        });
+    },
+});
+const formatRequestMagicLinkSuccess = (options, result) => options.formatRequestMagicLinkSuccess
+    ? options.formatRequestMagicLinkSuccess(result)
+    : {
+        delivery: 'magic_link',
+        expiresAt: result.expiresAt.toISOString(),
+        success: true,
+    };
+const parseJson = async (c, schema) => {
+    const body = await c.req.json().catch(() => null);
+    const parsed = schema.safeParse(body);
+    if (!parsed.success) {
+        return { error: parsed.error, ok: false };
+    }
+    return { ok: true, value: parsed.data };
+};
+const invalidRequest = (c, error) => c.json({
+    error: {
+        code: 'invalid_input',
+        details: error.errors,
+        message: 'Invalid request data.',
+    },
+}, 400);
+const serviceError = (c, error) => c.json({
+    error: {
+        code: error.code,
+        message: error.message,
+    },
+}, error.status);
+//# sourceMappingURL=route-handlers.js.map

package/dist/route-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-handlers.js","sourceRoot":"","sources":["../src/route-handlers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA4BxB,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,OAA4C,EACrB,EAAE,CAAC,CAAC;IAC3B,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAEzD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;YACzC,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAExD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAElE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,OAAgD,EACzB,EAAE,CAAC,CAAC;IAC3B,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAEzD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAExD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAElE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;gBACpC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;gBAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;aACvB;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,CACpC,OAAgD,EAChD,MAAkE,EACzB,EAAE,CAC3C,OAAO,CAAC,6BAA6B;IACnC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,MAAM,CAAC;IAC/C,CAAC,CAAC;QACE,QAAQ,EAAE,YAAY;QACtB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;QACzC,OAAO,EAAE,IAAI;KACd,CAAC;AAER,MAAM,SAAS,GAAG,KAAK,EACrB,CAAU,EACV,MAAS,EACoE,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAEtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,CAAU,EAAE,KAAiB,EAAY,EAAE,CACjE,CAAC,CAAC,IAAI,CACJ;IACE,KAAK,EAAE;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,OAAO,EAAE,uBAAuB;KACjC;CACF,EACD,GAAG,CACJ,CAAC;AAEJ,MAAM,YAAY,GAAG,CAAC,CAAU,EAAE,KAA+B,EAAY,EAAE,CAC7E,CAAC,CAAC,IAAI,CACJ;IACE,KAAK,EAAE;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB;CACF,EACD,KAAK,CAAC,MAA8B,CACrC,CAAC"}

package/dist/router.d.ts

@@ -0,0 +1,59 @@
+import { Hono, type Context } from 'hono';
+import { type AuthHonoAuthUiMethod, type AuthHonoRouteContract } from './contracts.js';
+import type { AuthHonoPorts } from './ports.js';
+export interface CreateAuthRouterOptions {
+    cookieNames?: AuthHonoCookieNames;
+    emailCode?: AuthHonoEmailCodePolicy;
+    handlers?: AuthHonoRouteHandlers;
+    magicLink?: AuthHonoMagicLinkPolicy;
+    ports?: AuthHonoPorts;
+    responsePolicy?: AuthHonoResponsePolicy;
+    routeOverrides?: Partial<Record<AuthHonoAuthUiMethod, AuthHonoRouteContract>>;
+    routePrefix?: string;
+    rp?: AuthHonoRelyingPartyOptions;
+    session?: AuthHonoSessionPolicy;
+    serviceName?: string;
+}
+export interface AuthHonoCookieNames {
+    session: string;
+    refresh: string;
+}
+export interface AuthHonoRelyingPartyOptions {
+    id: string;
+    name: string;
+    expectedOrigins: string[];
+}
+export interface AuthHonoSessionPolicy {
+    sessionTtlSeconds: number;
+    refreshTtlSeconds: number;
+}
+export interface AuthHonoEmailCodePolicy {
+    length: number;
+    ttlSeconds: number;
+    maxRequestsPerWindow: number;
+    windowSeconds: number;
+}
+export interface AuthHonoMagicLinkPolicy {
+    ttlSeconds: number;
+    baseUrl?: string;
+}
+export interface AuthHonoResponsePolicy {
+    notImplementedCode: string;
+    notImplementedMessage: string;
+}
+export interface AuthHonoRouterConfig {
+    cookieNames: AuthHonoCookieNames;
+    emailCode: AuthHonoEmailCodePolicy;
+    magicLink: AuthHonoMagicLinkPolicy;
+    responsePolicy: AuthHonoResponsePolicy;
+    routePrefix: string;
+    routes: Record<AuthHonoAuthUiMethod, AuthHonoRouteContract>;
+    rp?: AuthHonoRelyingPartyOptions;
+    session: AuthHonoSessionPolicy;
+    serviceName: string;
+}
+export type AuthHonoRouteHandler = (c: Context) => Response | Promise<Response>;
+export type AuthHonoRouteHandlers = Partial<Record<AuthHonoAuthUiMethod, AuthHonoRouteHandler>>;
+export declare const createAuthHonoConfig: (options?: CreateAuthRouterOptions) => AuthHonoRouterConfig;
+export declare const createAuthRouter: (options?: CreateAuthRouterOptions) => Hono;
+//# sourceMappingURL=router.d.ts.map

package/dist/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,WAAW,uBAAuB;IACtC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,EAAE,CAAC,EAAE,2BAA2B,CAAC;IACjC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,mBAAmB,CAAC;IACjC,SAAS,EAAE,uBAAuB,CAAC;IACnC,SAAS,EAAE,uBAAuB,CAAC;IACnC,cAAc,EAAE,sBAAsB,CAAC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAAC;IAC5D,EAAE,CAAC,EAAE,2BAA2B,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEhF,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAEhG,eAAO,MAAM,oBAAoB,aAAa,uBAAuB,KAAQ,oBA+B3E,CAAC;AAEH,eAAO,MAAM,gBAAgB,aAAa,uBAAuB,KAAQ,IA8BxE,CAAC"}

package/dist/router.js

@@ -0,0 +1,65 @@
+import { Hono } from 'hono';
+import { AUTH_HONO_ROUTE_MAP, } from './contracts.js';
+export const createAuthHonoConfig = (options = {}) => ({
+    cookieNames: {
+        session: options.cookieNames?.session ?? 'session',
+        refresh: options.cookieNames?.refresh ?? 'refreshToken',
+    },
+    emailCode: {
+        length: options.emailCode?.length ?? 6,
+        ttlSeconds: options.emailCode?.ttlSeconds ?? 10 * 60,
+        maxRequestsPerWindow: options.emailCode?.maxRequestsPerWindow ?? 3,
+        windowSeconds: options.emailCode?.windowSeconds ?? 10 * 60,
+    },
+    magicLink: {
+        ttlSeconds: options.magicLink?.ttlSeconds ?? 10 * 60,
+        baseUrl: options.magicLink?.baseUrl,
+    },
+    responsePolicy: {
+        notImplementedCode: options.responsePolicy?.notImplementedCode ?? 'not_implemented',
+        notImplementedMessage: options.responsePolicy?.notImplementedMessage ?? 'Auth route handler is not implemented yet.',
+    },
+    routePrefix: normalizeRoutePrefix(options.routePrefix),
+    routes: {
+        ...AUTH_HONO_ROUTE_MAP,
+        ...options.routeOverrides,
+    },
+    rp: options.rp,
+    session: {
+        sessionTtlSeconds: options.session?.sessionTtlSeconds ?? 7 * 24 * 60 * 60,
+        refreshTtlSeconds: options.session?.refreshTtlSeconds ?? 30 * 24 * 60 * 60,
+    },
+    serviceName: options.serviceName ?? 'auth',
+});
+export const createAuthRouter = (options = {}) => {
+    const router = new Hono();
+    const config = createAuthHonoConfig(options);
+    router.get(joinRoutePath(config.routePrefix, '/health'), (c) => c.json({ status: 'ok', service: config.serviceName }));
+    for (const routeName of Object.keys(config.routes)) {
+        const contract = config.routes[routeName];
+        const handler = options.handlers?.[routeName];
+        router.on(contract.method, joinRoutePath(config.routePrefix, contract.path), (c) => {
+            if (handler) {
+                return handler(c);
+            }
+            return c.json({
+                error: {
+                    code: config.responsePolicy.notImplementedCode,
+                    message: config.responsePolicy.notImplementedMessage,
+                },
+            }, 501);
+        });
+    }
+    return router;
+};
+const normalizeRoutePrefix = (prefix) => {
+    if (!prefix || prefix === '/') {
+        return '';
+    }
+    return `/${prefix.replace(/^\/+|\/+$/g, '')}`;
+};
+const joinRoutePath = (prefix, path) => {
+    const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+    return `${prefix}${normalizedPath}`;
+};
+//# sourceMappingURL=router.js.map

package/dist/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAE1C,OAAO,EACL,mBAAmB,GAGpB,MAAM,gBAAgB,CAAC;AAkExB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAmC,EAAE,EAAwB,EAAE,CAAC,CAAC;IACpG,WAAW,EAAE;QACX,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,IAAI,SAAS;QAClD,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,IAAI,cAAc;KACxD;IACD,SAAS,EAAE;QACT,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC;QACtC,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,IAAI,EAAE,GAAG,EAAE;QACpD,oBAAoB,EAAE,OAAO,CAAC,SAAS,EAAE,oBAAoB,IAAI,CAAC;QAClE,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,IAAI,EAAE,GAAG,EAAE;KAC3D;IACD,SAAS,EAAE;QACT,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,IAAI,EAAE,GAAG,EAAE;QACpD,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO;KACpC;IACD,cAAc,EAAE;QACd,kBAAkB,EAAE,OAAO,CAAC,cAAc,EAAE,kBAAkB,IAAI,iBAAiB;QACnF,qBAAqB,EACnB,OAAO,CAAC,cAAc,EAAE,qBAAqB,IAAI,4CAA4C;KAChG;IACD,WAAW,EAAE,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC;IACtD,MAAM,EAAE;QACN,GAAG,mBAAmB;QACtB,GAAG,OAAO,CAAC,cAAc;KAC1B;IACD,EAAE,EAAE,OAAO,CAAC,EAAE;IACd,OAAO,EAAE;QACP,iBAAiB,EAAE,OAAO,CAAC,OAAO,EAAE,iBAAiB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;QACzE,iBAAiB,EAAE,OAAO,CAAC,OAAO,EAAE,iBAAiB,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;KAC3E;IACD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAmC,EAAE,EAAQ,EAAE;IAC9E,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE7C,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7D,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CACtD,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAA2B,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC;QAE9C,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YACjF,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,kBAAkB;oBAC9C,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,qBAAqB;iBACrD;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,MAA0B,EAAU,EAAE;IAClE,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAChE,OAAO,GAAG,MAAM,GAAG,cAAc,EAAE,CAAC;AACtC,CAAC,CAAC"}

package/dist/session-route-handlers.d.ts

@@ -0,0 +1,9 @@
+import type { AuthHonoCookiePort } from './ports.js';
+import type { AuthHonoSessionService } from './session.js';
+import type { AuthHonoRouteHandlers } from './router.js';
+export interface CreateAuthSessionRouteHandlersOptions {
+    cookies: AuthHonoCookiePort;
+    service: AuthHonoSessionService;
+}
+export declare const createAuthSessionRouteHandlers: (options: CreateAuthSessionRouteHandlersOptions) => AuthHonoRouteHandlers;
+//# sourceMappingURL=session-route-handlers.d.ts.map

package/dist/session-route-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-route-handlers.d.ts","sourceRoot":"","sources":["../src/session-route-handlers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,WAAW,qCAAqC;IACpD,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,sBAAsB,CAAC;CACjC;AAMD,eAAO,MAAM,8BAA8B,YAChC,qCAAqC,KAC7C,qBAyDD,CAAC"}

package/dist/session-route-handlers.js

@@ -0,0 +1,74 @@
+import { z } from 'zod';
+const refreshSessionSchema = z.object({
+    refreshToken: z.string().min(1),
+});
+export const createAuthSessionRouteHandlers = (options) => ({
+    async refreshSession(c) {
+        const parsed = await parseJson(c, refreshSessionSchema);
+        if (!parsed.ok) {
+            return errorResponse(c, 400, 'invalid_input', 'Invalid request data.', parsed.error.errors);
+        }
+        const tokens = await options.service.refreshSession(parsed.value.refreshToken);
+        if (!tokens) {
+            return errorResponse(c, 401, 'invalid_session', 'Invalid or expired refresh token.');
+        }
+        appendSetCookie(c, options.cookies.serializeSessionCookie({
+            expiresAt: tokens.expiresAt,
+            token: tokens.sessionToken,
+        }));
+        appendSetCookie(c, options.cookies.serializeRefreshCookie({
+            expiresAt: tokens.expiresAt,
+            token: tokens.refreshToken,
+        }));
+        return c.json({
+            expiresAt: tokens.expiresAt.toISOString(),
+            refreshToken: tokens.refreshToken,
+            sessionToken: tokens.sessionToken,
+            success: true,
+        });
+    },
+    async logout(c) {
+        const sessionToken = readSessionToken(c, options.cookies);
+        if (!sessionToken) {
+            return errorResponse(c, 401, 'authentication_required', 'No session token provided.');
+        }
+        const session = await options.service.validateSessionToken(sessionToken);
+        if (!session) {
+            return errorResponse(c, 401, 'invalid_session', 'Invalid session.');
+        }
+        await options.service.revokeSession(session.sessionRecord.id);
+        appendSetCookie(c, options.cookies.serializeClearedSessionCookie());
+        appendSetCookie(c, options.cookies.serializeClearedRefreshCookie());
+        return c.json({ message: 'Logged out successfully', success: true });
+    },
+});
+const parseJson = async (c, schema) => {
+    const body = await c.req.json().catch(() => null);
+    const parsed = schema.safeParse(body);
+    if (!parsed.success) {
+        return { error: parsed.error, ok: false };
+    }
+    return { ok: true, value: parsed.data };
+};
+const readSessionToken = (c, cookies) => {
+    const cookieToken = cookies.readSessionToken(c.req.raw);
+    if (cookieToken) {
+        return cookieToken;
+    }
+    const authorization = c.req.header('authorization');
+    if (!authorization?.startsWith('Bearer ')) {
+        return null;
+    }
+    return authorization.slice('Bearer '.length).trim() || null;
+};
+const appendSetCookie = (c, value) => {
+    c.header('Set-Cookie', value, { append: true });
+};
+const errorResponse = (c, status, code, message, details) => c.json({
+    error: {
+        code,
+        ...(details ? { details } : {}),
+        message,
+    },
+}, status);
+//# sourceMappingURL=session-route-handlers.js.map

package/dist/session-route-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-route-handlers.js","sourceRoot":"","sources":["../src/session-route-handlers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,OAA8C,EACvB,EAAE,CAAC,CAAC;IAC3B,KAAK,CAAC,cAAc,CAAC,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE/E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;QACvF,CAAC;QAED,eAAe,CACb,CAAC,EACD,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;YACrC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,YAAY;SAC3B,CAAC,CACH,CAAC;QACF,eAAe,CACb,CAAC,EACD,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;YACrC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,YAAY;SAC3B,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;YACzC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,CAAC;QACZ,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAE1D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,yBAAyB,EAAE,4BAA4B,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAEzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAE9D,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC,CAAC;QACpE,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC,CAAC;QAEpE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,KAAK,EACrB,CAAU,EACV,MAAS,EACoE,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAEtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAU,EAAE,OAA2B,EAAiB,EAAE;IAClF,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAExD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAEpD,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,CAAU,EAAE,KAAa,EAAQ,EAAE;IAC1D,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,CAAU,EACV,MAAiB,EACjB,IAAY,EACZ,OAAe,EACf,OAAsB,EACZ,EAAE,CACZ,CAAC,CAAC,IAAI,CACJ;IACE,KAAK,EAAE;QACL,IAAI;QACJ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,OAAO;KACR;CACF,EACD,MAAM,CACP,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,33 @@
+import type { AuthHonoDeviceInfo, AuthHonoPorts, AuthHonoSessionClaims, AuthHonoSessionRecord, AuthHonoUserRecord } from './ports.js';
+export interface AuthHonoSessionTokens {
+    expiresAt: Date;
+    refreshToken: string;
+    sessionId: string;
+    sessionToken: string;
+}
+export interface AuthHonoValidatedSession {
+    role: string;
+    session: AuthHonoSessionClaims;
+    sessionRecord: AuthHonoSessionRecord;
+    user: AuthHonoUserRecord;
+}
+export interface CreateAuthSessionServiceOptions {
+    ports: AuthHonoPorts;
+    refreshTokenBytes?: number;
+    sessionTtlSeconds?: number;
+}
+export interface CreateAuthSessionInput {
+    deviceInfo?: AuthHonoDeviceInfo;
+    mfaVerified?: boolean;
+    user: AuthHonoUserRecord;
+}
+export interface AuthHonoSessionService {
+    createSession(input: CreateAuthSessionInput): Promise<AuthHonoSessionTokens>;
+    listUserSessions(userId: string): Promise<AuthHonoSessionRecord[]>;
+    refreshSession(refreshToken: string): Promise<AuthHonoSessionTokens | null>;
+    revokeAllSessions(userId: string): Promise<number>;
+    revokeSession(sessionId: string): Promise<boolean>;
+    validateSessionToken(sessionToken: string): Promise<AuthHonoValidatedSession | null>;
+}
+export declare const createAuthSessionService: (options: CreateAuthSessionServiceOptions) => AuthHonoSessionService;
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,qBAAqB,CAAC;IAC/B,aAAa,EAAE,qBAAqB,CAAC;IACrC,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,MAAM,WAAW,+BAA+B;IAC9C,KAAK,EAAE,aAAa,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7E,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACnE,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC5E,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;CACtF;AAED,eAAO,MAAM,wBAAwB,YAC1B,+BAA+B,KACvC,sBA2JF,CAAC"}

package/dist/session.js

@@ -0,0 +1,123 @@
+export const createAuthSessionService = (options) => {
+    const sessionTtlSeconds = options.sessionTtlSeconds ?? 7 * 24 * 60 * 60;
+    const refreshTokenBytes = options.refreshTokenBytes ?? 32;
+    return {
+        async createSession(input) {
+            const now = options.ports.clock.now();
+            const sessionId = options.ports.random.uuid();
+            const expiresAt = options.ports.clock.addSeconds(now, sessionTtlSeconds);
+            const refreshToken = options.ports.random.token(refreshTokenBytes);
+            const sessionToken = await options.ports.tokens.signSessionToken({
+                userId: input.user.id,
+                sessionId,
+                role: input.user.role,
+                email: input.user.email,
+                displayName: input.user.displayName,
+            }, expiresAt);
+            const sessionTokenHash = await options.ports.tokens.hashSecret(sessionToken);
+            const refreshTokenHash = await options.ports.tokens.hashSecret(refreshToken);
+            const sessionRecord = await options.ports.sessions.create({
+                id: sessionId,
+                userId: input.user.id,
+                sessionTokenHash,
+                refreshTokenHash,
+                deviceInfo: input.deviceInfo,
+                mfaVerified: input.mfaVerified ?? false,
+                expiresAt,
+                now,
+            });
+            return {
+                expiresAt: sessionRecord.expiresAt,
+                refreshToken,
+                sessionId: sessionRecord.id,
+                sessionToken,
+            };
+        },
+        listUserSessions(userId) {
+            return options.ports.sessions.listForUser(userId);
+        },
+        async refreshSession(refreshToken) {
+            const now = options.ports.clock.now();
+            const refreshTokenHash = await options.ports.tokens.hashSecret(refreshToken);
+            const sessionRecord = await options.ports.sessions.findByRefreshTokenHash(refreshTokenHash);
+            if (!sessionRecord || sessionRecord.revokedAt || sessionRecord.expiresAt <= now) {
+                return null;
+            }
+            const user = await options.ports.users.findById(sessionRecord.userId);
+            if (!user) {
+                return null;
+            }
+            const decision = await options.ports.accountPolicy.canAuthenticate(user, now);
+            if (!decision.allowed) {
+                return null;
+            }
+            const role = await options.ports.accountPolicy.resolveSessionRole(user, now);
+            const expiresAt = options.ports.clock.addSeconds(now, sessionTtlSeconds);
+            const nextRefreshToken = options.ports.random.token(refreshTokenBytes);
+            const nextSessionToken = await options.ports.tokens.signSessionToken({
+                userId: user.id,
+                sessionId: sessionRecord.id,
+                role,
+                email: user.email,
+                displayName: user.displayName,
+            }, expiresAt);
+            const nextSessionTokenHash = await options.ports.tokens.hashSecret(nextSessionToken);
+            const nextRefreshTokenHash = await options.ports.tokens.hashSecret(nextRefreshToken);
+            const updatedSession = await options.ports.sessions.updateTokens({
+                expiresAt,
+                refreshTokenHash: nextRefreshTokenHash,
+                sessionId: sessionRecord.id,
+                sessionTokenHash: nextSessionTokenHash,
+            });
+            if (!updatedSession) {
+                return null;
+            }
+            return {
+                expiresAt: updatedSession.expiresAt,
+                refreshToken: nextRefreshToken,
+                sessionId: updatedSession.id,
+                sessionToken: nextSessionToken,
+            };
+        },
+        revokeAllSessions(userId) {
+            return options.ports.sessions.revokeAllForUser(userId);
+        },
+        revokeSession(sessionId) {
+            return options.ports.sessions.revoke(sessionId);
+        },
+        async validateSessionToken(sessionToken) {
+            const claims = await options.ports.tokens.verifySessionToken(sessionToken);
+            if (!claims) {
+                return null;
+            }
+            const tokenHash = await options.ports.tokens.hashSecret(sessionToken);
+            const sessionRecord = await options.ports.sessions.findByTokenHash(tokenHash);
+            const now = options.ports.clock.now();
+            if (!sessionRecord ||
+                sessionRecord.id !== claims.sessionId ||
+                sessionRecord.userId !== claims.userId ||
+                sessionRecord.revokedAt ||
+                sessionRecord.expiresAt <= now) {
+                return null;
+            }
+            const user = await options.ports.users.findById(claims.userId);
+            if (!user) {
+                return null;
+            }
+            const decision = await options.ports.accountPolicy.canAuthenticate(user, now);
+            if (!decision.allowed) {
+                return null;
+            }
+            const role = await options.ports.accountPolicy.resolveSessionRole(user, now);
+            const session = { ...claims, role };
+            await options.ports.sessions.touch(sessionRecord.id, now);
+            return {
+                role,
+                session,
+                sessionRecord,
+                user,
+            };
+        },
+    };
+};
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AA2CA,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,OAAwC,EAChB,EAAE;IAC1B,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACxE,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAE1D,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,KAAK;YACvB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACzE,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACnE,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAC9D;gBACE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;gBACrB,SAAS;gBACT,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;gBACrB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;gBACvB,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;aACpC,EACD,SAAS,CACV,CAAC;YAEF,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC7E,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC7E,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACxD,EAAE,EAAE,SAAS;gBACb,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;gBACrB,gBAAgB;gBAChB,gBAAgB;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK;gBACvC,SAAS;gBACT,GAAG;aACJ,CAAC,CAAC;YAEH,OAAO;gBACL,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,YAAY;gBACZ,SAAS,EAAE,aAAa,CAAC,EAAE;gBAC3B,YAAY;aACb,CAAC;QACJ,CAAC;QAED,gBAAgB,CAAC,MAAM;YACrB,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,YAAY;YAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACtC,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC7E,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;YAE5F,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,SAAS,IAAI,aAAa,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAChF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAEtE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAE9E,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACzE,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACvE,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAClE;gBACE,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,aAAa,CAAC,EAAE;gBAC3B,IAAI;gBACJ,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,EACD,SAAS,CACV,CAAC;YACF,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;YACrF,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;YACrF,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC/D,SAAS;gBACT,gBAAgB,EAAE,oBAAoB;gBACtC,SAAS,EAAE,aAAa,CAAC,EAAE;gBAC3B,gBAAgB,EAAE,oBAAoB;aACvC,CAAC,CAAC;YAEH,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,cAAc,CAAC,SAAS;gBACnC,YAAY,EAAE,gBAAgB;gBAC9B,SAAS,EAAE,cAAc,CAAC,EAAE;gBAC5B,YAAY,EAAE,gBAAgB;aAC/B,CAAC;QACJ,CAAC;QAED,iBAAiB,CAAC,MAAM;YACtB,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QAED,aAAa,CAAC,SAAS;YACrB,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,YAAY;YACrC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAE3E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACtE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAEtC,IACE,CAAC,aAAa;gBACd,aAAa,CAAC,EAAE,KAAK,MAAM,CAAC,SAAS;gBACrC,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;gBACtC,aAAa,CAAC,SAAS;gBACvB,aAAa,CAAC,SAAS,IAAI,GAAG,EAC9B,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAE/D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAE9E,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7E,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;YAEpC,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAE1D,OAAO;gBACL,IAAI;gBACJ,OAAO;gBACP,aAAa;gBACb,IAAI;aACL,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/webauthn-authentication-route-handlers.d.ts

@@ -0,0 +1,26 @@
+import type { AuthenticationResponseJSON } from '@simplewebauthn/server';
+import type { Context } from 'hono';
+import type { AuthHonoGenerateAuthenticationOptionsInput, AuthHonoWebAuthnAuthenticationService } from './webauthn-authentication.js';
+import type { AuthHonoRouteHandlers } from './router.js';
+import type { AuthHonoRouteHandlerError } from './webauthn-registration-route-handlers.js';
+export interface CreateAuthWebAuthnAuthenticationRouteHandlersOptions {
+    finalizeAuthentication?: AuthHonoFinalizeAuthentication;
+    resolveAuthenticationOptions: AuthHonoResolveAuthenticationOptions;
+    service: AuthHonoWebAuthnAuthenticationService;
+}
+export type AuthHonoResolveAuthenticationOptions = (input: AuthHonoAuthenticationOptionsRequest, c: Context) => Promise<AuthHonoGenerateAuthenticationOptionsInput | AuthHonoRouteHandlerError> | AuthHonoGenerateAuthenticationOptionsInput | AuthHonoRouteHandlerError;
+export type AuthHonoFinalizeAuthentication = (result: AuthHonoFinalizeAuthenticationInput, c: Context) => Response | Promise<Response>;
+export interface AuthHonoFinalizeAuthenticationInput {
+    credentialId: string;
+    request: AuthHonoAuthenticationVerifyRequest;
+    userId: string;
+}
+export interface AuthHonoAuthenticationOptionsRequest {
+    email?: string;
+}
+export interface AuthHonoAuthenticationVerifyRequest {
+    credential: AuthenticationResponseJSON;
+    deviceName?: string;
+}
+export declare const createAuthWebAuthnAuthenticationRouteHandlers: (options: CreateAuthWebAuthnAuthenticationRouteHandlersOptions) => AuthHonoRouteHandlers;
+//# sourceMappingURL=webauthn-authentication-route-handlers.d.ts.map

package/dist/webauthn-authentication-route-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-authentication-route-handlers.d.ts","sourceRoot":"","sources":["../src/webauthn-authentication-route-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAIpC,OAAO,KAAK,EACV,0CAA0C,EAC1C,qCAAqC,EACtC,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAE3F,MAAM,WAAW,oDAAoD;IACnE,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,4BAA4B,EAAE,oCAAoC,CAAC;IACnE,OAAO,EAAE,qCAAqC,CAAC;CAChD;AAED,MAAM,MAAM,oCAAoC,GAAG,CACjD,KAAK,EAAE,oCAAoC,EAC3C,CAAC,EAAE,OAAO,KAER,OAAO,CAAC,0CAA0C,GAAG,yBAAyB,CAAC,GAC/E,0CAA0C,GAC1C,yBAAyB,CAAC;AAE9B,MAAM,MAAM,8BAA8B,GAAG,CAC3C,MAAM,EAAE,mCAAmC,EAC3C,CAAC,EAAE,OAAO,KACP,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,MAAM,WAAW,mCAAmC;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,mCAAmC,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oCAAoC;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mCAAmC;IAClD,UAAU,EAAE,0BAA0B,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAsBD,eAAO,MAAM,6CAA6C,YAC/C,oDAAoD,KAC5D,qBA+DD,CAAC"}

package/dist/webauthn-authentication-route-handlers.js

@@ -0,0 +1,97 @@
+import { z } from 'zod';
+const isRouteHandlerError = (value) => Boolean(value &&
+    typeof value === 'object' &&
+    'error' in value &&
+    typeof value.error === 'object' &&
+    value.error?.code !== undefined);
+const authenticationOptionsSchema = z.object({
+    email: z.string().email().optional(),
+});
+const authenticationVerifySchema = z.object({
+    credential: z.custom((value) => Boolean(value && typeof value === 'object' && 'response' in value)),
+    deviceName: z.string().max(100).optional(),
+});
+export const createAuthWebAuthnAuthenticationRouteHandlers = (options) => ({
+    async createPasskeyAuthenticationOptions(c) {
+        const input = await parseJson(c, authenticationOptionsSchema);
+        if (!input.ok) {
+            return invalidRequest(c, input.error);
+        }
+        const serviceInput = await options.resolveAuthenticationOptions(input.value, c);
+        if (isRouteHandlerError(serviceInput)) {
+            return simpleError(c, serviceInput.error.status, serviceInput.error.code, serviceInput.error.message);
+        }
+        const authenticationOptions = await options.service.generateAuthenticationOptions(serviceInput);
+        return c.json({ options: authenticationOptions });
+    },
+    async verifyPasskeyAuthentication(c) {
+        const input = await parseJson(c, authenticationVerifySchema);
+        if (!input.ok) {
+            return invalidRequest(c, input.error);
+        }
+        const challenge = extractChallenge(input.value.credential);
+        if (!challenge) {
+            return simpleError(c, 400, 'invalid_credential', 'Credential challenge is missing or invalid.');
+        }
+        const result = await options.service.verifyAuthentication({
+            credential: input.value.credential,
+            expectedChallenge: challenge,
+        });
+        if (!result.verified) {
+            return serviceError(c, result.error);
+        }
+        if (options.finalizeAuthentication) {
+            return options.finalizeAuthentication({
+                credentialId: result.credentialId,
+                request: input.value,
+                userId: result.userId,
+            }, c);
+        }
+        return c.json({
+            credentialId: result.credentialId,
+            success: true,
+            userId: result.userId,
+        });
+    },
+});
+const parseJson = async (c, schema) => {
+    const body = await c.req.json().catch(() => null);
+    const parsed = schema.safeParse(body);
+    if (!parsed.success) {
+        return { error: parsed.error, ok: false };
+    }
+    return { ok: true, value: parsed.data };
+};
+const extractChallenge = (credential) => {
+    const clientDataJson = credential.response?.clientDataJSON;
+    if (!clientDataJson) {
+        return null;
+    }
+    try {
+        const json = JSON.parse(decodeBase64Url(clientDataJson));
+        return typeof json.challenge === 'string' && json.challenge.length > 0 ? json.challenge : null;
+    }
+    catch {
+        return null;
+    }
+};
+const decodeBase64Url = (value) => {
+    const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');
+    return atob(padded);
+};
+const invalidRequest = (c, error) => c.json({
+    error: {
+        code: 'invalid_input',
+        details: error.errors,
+        message: 'Invalid request data.',
+    },
+}, 400);
+const serviceError = (c, error) => simpleError(c, error.status, error.code, error.message);
+const simpleError = (c, status, code, message) => c.json({
+    error: {
+        code,
+        message,
+    },
+}, status);
+//# sourceMappingURL=webauthn-authentication-route-handlers.js.map