@server/next 0.40.4 → 0.42.0

package/index.js

@@ -43,20 +43,17 @@ ServerError_default.extend({
     status: 400,
     message: "The route param '{param}' tries to climb the path ('{value}'). If this route legitimately receives paths, set security: { traversalProtection: false }"
   },
-  NO_STORE: "You need a 'store' to write 'ctx.session'",
-  NO_STORE_WRITE: "You need a 'store' to write 'ctx.session.{key}'",
-  NO_STORE_READ: "You need a 'store' to read 'ctx.session.{key}'",
   AUTH_ARGON_NEEDED: "Argon2 is needed for the auth module, please install it with 'npm i argon2'",
   AUTH_INVALID_TOKEN: { status: 401, message: "Invalid Authorization token" },
-  AUTH_INVALID_COOKIE: { status: 401, message: "Invalid Authorization cookie" },
+  AUTH_NO_CODE: {
+    status: 400,
+    message: "Missing the OAuth 'code' in the request body"
+  },
+  SESSION_JWT: "The `jwt` strategy is stateless, so there is no `ctx.session` (tried '{key}'). Use the `token` strategy for server-side sessions, or `cookie` for browsers",
   AUTH_INVALID_HEADER: {
     status: 401,
     message: "Invalid authorization header {type}, must send 'Bearer {TOKEN}' (with space)"
   },
-  AUTH_INVALID_STRATEGY: {
-    status: 401,
-    message: "Invalid Authorization type '{strategy}', valid one is '{valid}'"
-  },
   AUTH_INVALID_STATE: { status: 403, message: "Invalid OAuth state" },
   AUTH_NO_PROVIDER: "No provider passed to the option 'auth.providers'",
   AUTH_INVALID_PROVIDER: {
@@ -220,7 +217,7 @@ function human(bytes) {
   return `${rounded}${UNITS[i]}`;
 }
 var tooLarge = (max) => new StatusError(
-  `Request body exceeds the ${human(max)} limit. Raise it with body: { max: '10mb' } on the route or server, or set max: false to disable.`,
+  `Request body exceeds the ${human(max)} limit. Raise it with security: { maxBody: '10mb' }, or maxBody: false to disable it.`,
   413
 );
 
@@ -577,11 +574,9 @@ var sources = /* @__PURE__ */ new WeakMap();
 function setBodySource(ctx, source) {
   sources.set(ctx, source);
 }
-async function resolveBody(ctx, body) {
+async function resolveBody(ctx, mode = "parse", max = resolveMax(void 0)) {
   const source = sources.get(ctx);
   if (!source) return void 0;
-  const mode = typeof body === "string" ? body : body?.mode ?? "parse";
-  const max = resolveMax(typeof body === "object" ? body?.max : void 0);
   const contentType = String(ctx.headers["content-type"] || "");
   const isMultipart = /multipart\/form-data/i.test(contentType);
   const declared = Number(ctx.headers["content-length"]);
@@ -731,13 +726,20 @@ function clientIp(headers2, opts = {}) {
 
 // src/helpers/store.ts
 import kv from "polystore";
-function toStore(source) {
+function isStore(source) {
   const store = source;
-  if (store && typeof store.prefix === "function" && typeof store.get === "function" && typeof store.set === "function") {
-    return store;
-  }
+  return Boolean(
+    store && typeof store.prefix === "function" && typeof store.get === "function" && typeof store.set === "function"
+  );
+}
+function toStore(source) {
+  if (isStore(source)) return source;
   return kv(source);
 }
+function toStoreExpiring(source, expires) {
+  if (isStore(source)) return source;
+  return kv(source).expires(expires);
+}
 
 // src/helpers/disposition.ts
 var encodeExt = (name) => encodeURIComponent(name).replace(
@@ -996,50 +998,108 @@ async function verifyJwt(token, secret) {
   return payload;
 }
 
+// src/auth/findSessionId.ts
+var validateToken = (authorization) => {
+  const [type2, id] = authorization.trim().split(" ");
+  if (type2?.toLowerCase() !== "bearer") {
+    throw ServerError_default.AUTH_INVALID_HEADER({ type: type2 });
+  }
+  if (id?.length !== 16) {
+    throw ServerError_default.AUTH_INVALID_TOKEN();
+  }
+  return id;
+};
+function findSessionId(ctx) {
+  const strategy = ctx.options.auth?.strategy;
+  if (strategy?.includes("token") && ctx.headers.authorization) {
+    return validateToken(ctx.headers.authorization);
+  }
+  return ctx.cookies.session || void 0;
+}
+
+// src/middle/session.ts
+var loaded = /* @__PURE__ */ new WeakMap();
+function jwtSession() {
+  const target = {};
+  return new Proxy(target, {
+    get(target2, key) {
+      if (typeof key === "symbol" || key === "then") return target2[key];
+      throw ServerError_default.SESSION_JWT({ key: String(key) });
+    },
+    set(target2, key, value) {
+      if (typeof key === "symbol") {
+        target2[key] = value;
+        return true;
+      }
+      throw ServerError_default.SESSION_JWT({ key: String(key) });
+    }
+  });
+}
+async function session(ctx) {
+  if (ctx.options.auth?.strategy.includes("jwt")) {
+    ctx.session = jwtSession();
+    return;
+  }
+  const id = findSessionId(ctx);
+  ctx.session = id && await ctx.options.sessions.get(id) || {};
+  loaded.set(ctx, { id, data: JSON.stringify(ctx.session) });
+}
+
 // src/auth/finishLogin.ts
-async function finishLogin(ctx, input) {
+async function finishLogin(ctx, input, opts = {}) {
   const settings = ctx.options.auth;
-  const { strategy, onLogin, onUser } = settings;
+  const { strategy, onLogin, onUser, onToken } = settings;
   const key = String(input.key);
   const auth2 = {
-    id: createId(),
-    strategy,
-    provider: input.provider,
     user: key,
-    email: input.email,
-    time: (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "")
+    provider: input.provider,
+    created: (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "")
   };
   const loginUser = {
     ...input.user,
     provider: input.provider,
     strategy
   };
-  const existingUser = await settings.store.get(key) ?? null;
+  const existingUser = await settings.users.get(key) ?? null;
   const user = onLogin ? await onLogin(loginUser, existingUser, ctx) : { ...existingUser ?? {}, ...loginUser };
   assertUser(user, "onLogin");
-  await settings.store.set(key, user);
-  if (!strategy.includes("jwt")) {
-    await settings.session.set(auth2.id, auth2, { expires: "1w" });
-  }
+  await settings.users.set(key, user);
   if (strategy.includes("jwt")) {
-    const token = await signJwt(auth2, ctx.options.secret, 7 * 24 * 60 * 60);
-    const exposed = await onUser(user, ctx);
+    const payload = {
+      ...await onToken(user, ctx),
+      provider: input.provider
+    };
+    assertUser(payload, "onToken");
+    const token = await signJwt(payload, ctx.options.secret, 7 * 24 * 60 * 60);
+    const exposed = await onUser(payload, ctx);
     assertUser(exposed, "onUser");
     return status(201).json({ ...exposed, token });
   }
+  const prev = loaded.get(ctx);
+  if (prev?.id) await ctx.options.sessions.del(prev.id);
+  const id = createId();
+  Object.assign(ctx.session, auth2);
+  await ctx.options.sessions.set(id, ctx.session);
+  loaded.set(ctx, { id, data: JSON.stringify(ctx.session) });
   if (strategy.includes("token")) {
     const exposed = await onUser(user, ctx);
     assertUser(exposed, "onUser");
-    return status(201).json({ ...exposed, token: auth2.id });
+    return status(201).json({ ...exposed, token: id });
   }
   if (strategy.includes("cookie")) {
-    return cookies("authentication", {
-      value: auth2.id,
+    const reply = cookies("session", {
+      value: id,
       path: "/",
       httpOnly: true,
       secure: ctx.platform.production,
       sameSite: "Lax"
-    }).redirect(settings.redirect);
+    });
+    if (opts.json) {
+      const exposed = await onUser(user, ctx);
+      assertUser(exposed, "onUser");
+      return reply.status(201).json(exposed);
+    }
+    return reply.redirect(settings.redirect);
   }
   throw new Error("Unknown auth type");
 }
@@ -1125,78 +1185,111 @@ var login = (ctx) => {
   });
   return cookies("oauth_state", cookie).redirect(`${AUTHORIZE}?${params}`);
 };
-var callback = async (ctx) => {
-  const body = ctx.body || {};
-  checkState(ctx, body.state);
+var exchange = async (code, redirectUri, user) => {
+  const params = new URLSearchParams({
+    client_id: env.APPLE_ID,
+    client_secret: await clientSecret(),
+    code: code ?? "",
+    grant_type: "authorization_code"
+  });
+  if (redirectUri) params.set("redirect_uri", redirectUri);
   const tokenRes = await fetch(TOKEN, {
     method: "POST",
     headers: {
       accept: "application/json",
       "content-type": "application/x-www-form-urlencoded"
     },
-    body: new URLSearchParams({
-      client_id: env.APPLE_ID,
-      client_secret: await clientSecret(),
-      code: body.code,
-      grant_type: "authorization_code",
-      redirect_uri: `${ctx.url.origin}/auth/callback/apple`
-    })
+    body: params
   });
   if (!tokenRes.ok) throw new Error("apple: token exchange failed");
   const token = await tokenRes.json();
   const claims = b64urlJson(token.id_token.split(".")[1]);
   let name;
-  if (body.user) {
-    const parsed = JSON.parse(body.user).name;
+  if (user) {
+    const parsed = JSON.parse(user).name;
     if (parsed) name = `${parsed.firstName} ${parsed.lastName}`.trim();
   }
-  const raw = { ...claims, name };
+  return { ...claims, name };
+};
+var finish = async (ctx, raw, opts) => {
   const { onProfile } = ctx.options.auth;
   const profile = onProfile ? await onProfile(raw, "apple") : { id: raw.sub, name: raw.name, email: raw.email };
   assertUser(profile, "onProfile");
-  const res = await finishLogin(ctx, {
-    provider: "apple",
-    key: profile.id,
-    email: profile.email,
-    user: profile
-  });
+  return finishLogin(
+    ctx,
+    {
+      provider: "apple",
+      key: profile.id,
+      email: profile.email,
+      user: profile
+    },
+    opts
+  );
+};
+var callback = async (ctx) => {
+  const body = ctx.body || {};
+  checkState(ctx, body.state);
+  const url = `${ctx.url.origin}/auth/callback/apple`;
+  const raw = await exchange(body.code, url, body.user);
+  const res = await finish(ctx, raw);
   res.headers.append("set-cookie", clearState());
   return res;
 };
-var apple_default = { login, callback };
+var verify = async (ctx) => {
+  const { code, redirect_uri, user } = ctx.body ?? {};
+  if (!code) throw ServerError_default.AUTH_NO_CODE();
+  const raw = await exchange(code, redirect_uri, user);
+  return finish(ctx, raw, { json: true });
+};
+var apple_default = { login, callback, verify };
 
 // src/auth/providers/oauth.ts
+var wantsJson = (ctx) => String(ctx.headers.accept || "").includes("application/json");
+var clientParams = (source) => ({
+  redirect_uri: source.redirect_uri,
+  state: source.state,
+  code_challenge: source.code_challenge,
+  code_challenge_method: source.code_challenge ? "S256" : void 0
+});
 function oauthProvider(config2) {
   const KEY = config2.name.toUpperCase();
   const callbackUrl = (ctx) => `${ctx.url.origin}/auth/callback/${config2.name}`;
-  const login3 = (ctx) => {
-    const { state, cookie } = startState(ctx);
-    const params = new URLSearchParams({
+  const authorizeUrl2 = (params) => {
+    const search = new URLSearchParams({
       client_id: env[`${KEY}_ID`],
-      redirect_uri: callbackUrl(ctx),
       response_type: "code",
-      scope: config2.scope,
-      state
+      scope: config2.scope
     });
-    return cookies("oauth_state", cookie).redirect(
-      `${config2.authorizeUrl}?${params}`
-    );
+    for (const [key, value] of Object.entries(params)) {
+      if (value) search.set(key, value);
+    }
+    return `${config2.authorizeUrl}?${search}`;
   };
-  const callback3 = async (ctx) => {
-    checkState(ctx, ctx.url.query.state);
+  const login3 = (ctx) => {
+    if (wantsJson(ctx)) {
+      return json({ url: authorizeUrl2(clientParams(ctx.url.query)) });
+    }
+    const { state, cookie } = startState(ctx);
+    const url = authorizeUrl2({ redirect_uri: callbackUrl(ctx), state });
+    return cookies("oauth_state", cookie).redirect(url);
+  };
+  const exchange2 = async (ctx, code, extra) => {
+    const body = new URLSearchParams({
+      client_id: env[`${KEY}_ID`],
+      client_secret: env[`${KEY}_SECRET`],
+      code,
+      grant_type: "authorization_code"
+    });
+    for (const [key, value] of Object.entries(extra)) {
+      if (value) body.set(key, value);
+    }
     const tokenRes = await fetch(config2.tokenUrl, {
       method: "POST",
       headers: {
         accept: "application/json",
         "content-type": "application/x-www-form-urlencoded"
       },
-      body: new URLSearchParams({
-        client_id: env[`${KEY}_ID`],
-        client_secret: env[`${KEY}_SECRET`],
-        code: ctx.url.query.code,
-        grant_type: "authorization_code",
-        redirect_uri: callbackUrl(ctx)
-      })
+      body
     });
     if (!tokenRes.ok) throw new Error(`${config2.name}: token exchange failed`);
     const token = await tokenRes.json();
@@ -1207,20 +1300,39 @@ function oauthProvider(config2) {
       }
     });
     if (!profileRes.ok) throw new Error(`${config2.name}: profile fetch failed`);
-    const raw = await profileRes.json();
+    return profileRes.json();
+  };
+  const finish3 = async (ctx, raw, opts) => {
     const { onProfile } = ctx.options.auth;
     const profile = onProfile ? await onProfile(raw, config2.name) : config2.profile(raw);
     assertUser(profile, "onProfile");
-    const res = await finishLogin(ctx, {
-      provider: config2.name,
-      key: profile.id,
-      email: profile.email,
-      user: profile
+    return finishLogin(
+      ctx,
+      {
+        provider: config2.name,
+        key: profile.id,
+        email: profile.email,
+        user: profile
+      },
+      opts
+    );
+  };
+  const callback3 = async (ctx) => {
+    checkState(ctx, ctx.url.query.state);
+    const raw = await exchange2(ctx, ctx.url.query.code, {
+      redirect_uri: callbackUrl(ctx)
     });
+    const res = await finish3(ctx, raw);
     res.headers.append("set-cookie", clearState());
     return res;
   };
-  return { login: login3, callback: callback3 };
+  const verify4 = async (ctx) => {
+    const { code, redirect_uri, code_verifier } = ctx.body ?? {};
+    if (!code) throw ServerError_default.AUTH_NO_CODE();
+    const raw = await exchange2(ctx, code, { redirect_uri, code_verifier });
+    return finish3(ctx, raw, { json: true });
+  };
+  return { login: login3, callback: callback3, verify: verify4 };
 }
 
 // src/auth/providers/discord.ts
@@ -1252,10 +1364,10 @@ async function emailLogin(ctx) {
   if (!/@/.test(email)) throw ServerError_default.LOGIN_INVALID_EMAIL();
   if (!password) throw ServerError_default.LOGIN_NO_PASSWORD();
   if (password.length < 8) throw ServerError_default.LOGIN_INVALID_PASSWORD();
-  const store = ctx.options.auth.store;
-  if (!await store.has(email)) throw ServerError_default.LOGIN_WRONG_EMAIL();
-  const user = await store.get(email);
-  const isValid = await verify(password, user.password);
+  const users = ctx.options.auth.users;
+  if (!await users.has(email)) throw ServerError_default.LOGIN_WRONG_EMAIL();
+  const user = await users.get(email);
+  const isValid = await verify2(password, user.password);
   if (!isValid) throw ServerError_default.LOGIN_WRONG_PASSWORD();
   return finishLogin(ctx, {
     provider: "email",
@@ -1270,8 +1382,8 @@ async function emailRegister(ctx) {
   if (!/@/.test(email)) throw ServerError_default.REGISTER_INVALID_EMAIL();
   if (!password) throw ServerError_default.REGISTER_NO_PASSWORD();
   if (password.length < 8) throw ServerError_default.REGISTER_INVALID_PASSWORD();
-  const store = ctx.options.auth.store;
-  if (await store.has(email)) throw ServerError_default.REGISTER_EMAIL_EXISTS();
+  const users = ctx.options.auth.users;
+  if (await users.has(email)) throw ServerError_default.REGISTER_EMAIL_EXISTS();
   const time = (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "");
   const user = {
     id: createId(email),
@@ -1293,12 +1405,12 @@ async function emailResetPassword() {
 }
 async function emailUpdatePassword(ctx) {
   const passwords = ctx.body;
-  const fullUser = await ctx.options.auth.store.get(ctx.user.email);
+  const fullUser = await ctx.options.auth.users.get(ctx.user.email);
   if (!fullUser) throw ServerError_default.AUTH_NO_USER();
-  const isValid = await verify(passwords.previous, fullUser.password);
+  const isValid = await verify2(passwords.previous, fullUser.password);
   if (!isValid) throw ServerError_default.LOGIN_WRONG_PASSWORD();
   fullUser.password = await hash2(passwords.updated);
-  await updateUser(fullUser, ctx.user, ctx.options.auth.store);
+  await updateUser(fullUser, ctx.user, ctx.options.auth.users);
   return 200;
 }
 var email_default = {
@@ -1324,7 +1436,8 @@ var facebook_default = oauthProvider({
 });
 
 // src/auth/providers/github.ts
-var oauth = async (code) => {
+var AUTHORIZE2 = "https://github.com/login/oauth/authorize";
+var oauth = async (code, extra) => {
   const fch = async (url, { body, headers: headers2 = {}, ...rest } = {}) => {
     headers2.accept = "application/json";
     headers2["content-type"] = "application/json";
@@ -1332,13 +1445,17 @@ var oauth = async (code) => {
     if (!res2.ok) throw new Error("Invalid request");
     return res2.json();
   };
+  const params = {
+    client_id: env.GITHUB_ID,
+    client_secret: env.GITHUB_SECRET,
+    code
+  };
+  for (const [key, value] of Object.entries(extra)) {
+    if (value) params[key] = value;
+  }
   const res = await fch("https://github.com/login/oauth/access_token", {
     method: "post",
-    body: JSON.stringify({
-      client_id: env.GITHUB_ID,
-      client_secret: env.GITHUB_SECRET,
-      code
-    })
+    body: JSON.stringify(params)
   });
   return (path) => {
     return fch(`https://api.github.com${path}`, {
@@ -1346,19 +1463,25 @@ var oauth = async (code) => {
     });
   };
 };
-var login2 = (ctx) => {
-  const { state, cookie } = startState(ctx);
-  const params = new URLSearchParams({
+var authorizeUrl = (params) => {
+  const search = new URLSearchParams({
     client_id: env.GITHUB_ID,
-    scope: "user:email",
-    state
+    scope: "user:email"
   });
-  return cookies("oauth_state", cookie).redirect(
-    `https://github.com/login/oauth/authorize?${params}`
-  );
+  for (const [key, value] of Object.entries(params)) {
+    if (value) search.set(key, value);
+  }
+  return `${AUTHORIZE2}?${search}`;
+};
+var login2 = (ctx) => {
+  if (wantsJson(ctx)) {
+    return json({ url: authorizeUrl(clientParams(ctx.url.query)) });
+  }
+  const { state, cookie } = startState(ctx);
+  return cookies("oauth_state", cookie).redirect(authorizeUrl({ state }));
 };
-var getUserProfile = async (code) => {
-  const api = await oauth(code);
+var getUserProfile = async (code, extra = {}) => {
+  const api = await oauth(code, extra);
   const [profile, emails] = await Promise.all([
     api("/user"),
     api("/user/emails")
@@ -1374,22 +1497,35 @@ var defaultProfile = (raw) => ({
   location: raw.location,
   created: raw.created_at
 });
-var callback2 = async (ctx) => {
-  checkState(ctx, ctx.url.query.state);
-  const raw = await getUserProfile(ctx.url.query.code);
+var finish2 = async (ctx, raw, opts) => {
   const { onProfile } = ctx.options.auth;
   const profile = onProfile ? await onProfile(raw, "github") : defaultProfile(raw);
   assertUser(profile, "onProfile");
-  const res = await finishLogin(ctx, {
-    provider: "github",
-    key: profile.id,
-    email: profile.email,
-    user: profile
-  });
+  return finishLogin(
+    ctx,
+    {
+      provider: "github",
+      key: profile.id,
+      email: profile.email,
+      user: profile
+    },
+    opts
+  );
+};
+var callback2 = async (ctx) => {
+  checkState(ctx, ctx.url.query.state);
+  const raw = await getUserProfile(ctx.url.query.code);
+  const res = await finish2(ctx, raw);
   res.headers.append("set-cookie", clearState());
   return res;
 };
-var github_default = { login: login2, callback: callback2 };
+var verify3 = async (ctx) => {
+  const { code, redirect_uri, code_verifier } = ctx.body ?? {};
+  if (!code) throw ServerError_default.AUTH_NO_CODE();
+  const raw = await getUserProfile(code, { redirect_uri, code_verifier });
+  return finish2(ctx, raw, { json: true });
+};
+var github_default = { login: login2, callback: callback2, verify: verify3 };
 
 // src/auth/providers/google.ts
 var google_default = oauthProvider({
@@ -1439,7 +1575,7 @@ function defaultOnUser(fullUser) {
   return user;
 }
 var available = Object.keys(providers_default);
-function parseAuthOptions(auth2, all) {
+function parseAuthOptions(auth2) {
   if (!auth2) return null;
   if (typeof auth2 === "string") {
     const [strategy2, provider] = auth2.split(":");
@@ -1462,15 +1598,8 @@ function parseAuthOptions(auth2, all) {
   const redirect2 = auth2.redirect || defaultRedirect;
   const { onProfile, onLogin, onLogout } = auth2;
   const onUser = auth2.onUser || defaultOnUser;
-  if (!auth2.store && !all.store) {
-    throw new Error("Need a userStore store for Auth");
-  }
-  if (!auth2.session && !all.store) {
-    throw new Error("Need a sessionStore store for Auth");
-  }
-  const store = all.store ? toStore(all.store) : null;
-  const authStore = auth2.store ? toStore(auth2.store) : store.prefix("user:");
-  const sessionStore = auth2.session ? toStore(auth2.session) : store.prefix("auth:");
+  const onToken = auth2.onToken || defaultOnUser;
+  const users = auth2.users ? toStore(auth2.users) : null;
   return {
     strategy,
     providers: list,
@@ -1478,9 +1607,9 @@ function parseAuthOptions(auth2, all) {
     onProfile,
     onLogin,
     onUser,
+    onToken,
     onLogout,
-    store: authStore,
-    session: sessionStore
+    users
   };
 }
 
@@ -1631,6 +1760,9 @@ function resolveSecurity(security) {
   return {
     trustProxy: o.trustProxy ?? true,
     traversalProtection: off ? false : o.traversalProtection !== false,
+    // Cap on the bytes buffered per request (see bodyLimit). `false` (or
+    // turning security off entirely) resolves to Infinity, meaning no limit.
+    maxBody: off ? INF : resolveMax(o.maxBody),
     headers: headers2,
     hsts: off ? null : val(o.hsts, "max-age=15552000; includeSubDomains")
   };
@@ -1661,6 +1793,19 @@ function applySecurity(res, ctx) {
 // src/helpers/config.ts
 function config(options = {}) {
   const env2 = globalThis.env;
+  const opts = options;
+  if (typeof opts.body === "string") {
+    throw new Error(
+      `The root \`body: '${opts.body}'\` option is now \`parser: '${opts.body}'\`.`
+    );
+  }
+  for (const key of ["body", "query", "params", "response"]) {
+    if (opts[key] !== void 0) {
+      throw new Error(
+        `\`${key}\` is a route option, not a root one; pass it per route, like .post('/', { ${key} }, handler).`
+      );
+    }
+  }
   const raw = options.log ?? env2.LOG_LEVEL;
   const level = raw === true ? "info" : raw === false ? void 0 : raw;
   const log = createLogger(level);
@@ -1670,10 +1815,14 @@ function config(options = {}) {
     log,
     // How request bodies are read: parsed into ctx.body by default; `raw` keeps
     // the Buffer, `stream` hands the handler the unread web ReadableStream.
-    body: options.body ?? "parse",
+    parser: options.parser ?? "parse",
     // Secure-by-default response headers + trustProxy for ctx.ip. `false` turns
     // the added headers off; see resolveSecurity for the defaults.
-    security: resolveSecurity(options.security)
+    security: resolveSecurity(options.security),
+    // Sessions: one record per device, exposed as ctx.session. Anything
+    // polystore accepts works; raw sources (a Map, a Redis client) get a 1w
+    // expiry, a built store is honored as-is, prefix and expiry included.
+    sessions: toStoreExpiring(options.sessions ?? /* @__PURE__ */ new Map(), "1w")
   };
   if (options.cache !== void 0) settings.cache = options.cache;
   options.cors = options.cors || env2.CORS || null;
@@ -1727,16 +1876,26 @@ function config(options = {}) {
   }
   const favicon2 = options.favicon || env2.FAVICON;
   if (favicon2) settings.favicon = favicon2;
-  settings.store = options.store ? toStore(options.store) : null;
-  if (options.session) {
-    const store = typeof options.session === "object" && "store" in options.session ? options.session.store : options.session;
-    settings.session = { store: toStore(store) };
-  }
-  if (settings.store && !options.session) {
-    settings.session = { store: settings.store.prefix("session:") };
-  }
+  const production = env2.NODE_ENV === "production";
+  const defaulted = options.sessions == null;
+  settings.sessionsDefault = defaulted;
   if (options.auth || env2.AUTH) {
-    settings.auth = parseAuthOptions(options.auth || env2.AUTH || null, options);
+    settings.auth = parseAuthOptions(options.auth || env2.AUTH || null);
+  }
+  if (settings.auth) {
+    if (!settings.auth.users) {
+      if (production) {
+        throw new Error(
+          "Auth in production needs a persistent `users` store, like auth: { ..., users: kv(redis).prefix('users:') }."
+        );
+      }
+      settings.auth.users = toStore(/* @__PURE__ */ new Map());
+    }
+    if (production && defaulted && !settings.auth.strategy.includes("jwt")) {
+      throw new Error(
+        "Auth in production needs a persistent `sessions` store, like sessions: kv(redis).prefix('session:')."
+      );
+    }
   }
   if (settings.auth?.strategy.includes("jwt") && settings.secret.startsWith("unsafe-")) {
     console.warn(
@@ -1760,7 +1919,7 @@ function config(options = {}) {
   }
   if (settings.public) log.message("public", loc(options.public));
   if (settings.uploads) log.message("uploads", loc(options.uploads));
-  if (settings.session) log.message("session", "enabled");
+  if (options.sessions) log.message("sessions", "enabled");
   if (settings.cors) {
     const origin = settings.cors.origin === true ? "*" : String(settings.cors.origin);
     log.message("cors", origin);
@@ -1808,7 +1967,7 @@ function applyCors(res, ctx) {
 
 // src/helpers/createWebsocket.ts
 function createWebsocket(sockets, handlers) {
-  const run = (event, socket, body) => {
+  const run2 = (event, socket, body) => {
     const routes = handlers.socket?.filter((r2) => r2.path === event) ?? [];
     const user = socket.user ?? socket.data?.user;
     for (const route of routes) {
@@ -1818,14 +1977,14 @@ function createWebsocket(sockets, handlers) {
     }
   };
   return {
-    message: (socket, body) => run("message", socket, body),
+    message: (socket, body) => run2("message", socket, body),
     open: (socket) => {
       sockets.push(socket);
-      run("open", socket);
+      run2("open", socket);
     },
     close: (socket) => {
       sockets.splice(sockets.indexOf(socket), 1);
-      run("close", socket);
+      run2("close", socket);
     }
   };
 }
@@ -1871,6 +2030,14 @@ function getMachine() {
 }
 
 // src/parseResponse.ts
+var warned = false;
+var warnDefault = () => {
+  if (warned) return;
+  warned = true;
+  console.warn(
+    "[server:sessions] Using the default in-memory session store in production: sessions are lost on restart and not shared across instances. Configure one with sessions: kv(redis).prefix('session:')."
+  );
+};
 async function parseResponse(out, ctx) {
   if (!out && typeof out !== "string") return null;
   if (typeof out === "function") {
@@ -1938,11 +2105,14 @@ async function parseResponse(out, ctx) {
   if (ctx.time?.times?.length > 1) {
     out.headers.set("Server-Timing", ctx.time.headers());
   }
-  if (Object.keys(ctx.session || {}).length) {
-    if (!ctx.options.session?.store) {
-      throw ServerError_default.NO_STORE();
+  const prev = loaded.get(ctx);
+  const jwt = ctx.options.auth?.strategy.includes("jwt");
+  const data = jwt ? "{}" : JSON.stringify(ctx.session ?? {});
+  if (!jwt && data !== (prev?.data ?? "{}")) {
+    if (ctx.options.sessionsDefault && ctx.platform.production) {
+      warnDefault();
     }
-    let id = ctx.cookies.session;
+    let id = prev?.id;
     if (!id) {
       id = createId();
       out.headers.append(
@@ -1956,7 +2126,7 @@ async function parseResponse(out, ctx) {
         })
       );
     }
-    ctx.options.session.store.set(id, ctx.session);
+    ctx.options.sessions.set(id, ctx.session);
   }
   if (ctx?.res?.headers) {
     for (const key in ctx.res.headers) {
@@ -2009,36 +2179,48 @@ function pathPattern(pattern, path) {
   return null;
 }
 
-// src/helpers/validate.ts
-function validate(ctx, schema) {
-  if (!schema || typeof schema !== "object") return;
-  let base;
-  try {
-    if (typeof schema?.body === "function") {
-      base = "body";
-      schema.body(ctx.body || {});
-    }
-    if (typeof schema?.body?.parse === "function") {
-      base = "body";
-      schema.body.parse(ctx.body || {});
-    }
-    if (typeof schema?.query === "function") {
-      base = "query";
-      schema.query(ctx.url.query || {});
-    }
-    if (typeof schema?.query?.parse === "function") {
-      base = "query";
-      schema.query.parse(ctx.url.query || {});
-    }
-  } catch (error) {
-    if (error.name === "ZodError" || error.constructor.name === "ZodError") {
-      const message = error.issues.map(
-        ({ path, message: message2 }) => `[${base}.${path.join(".")}]: ${message2}`
-      ).sort().join("\n");
-      throw new StatusError(message, 422);
+// src/errors/ValidationError.ts
+var ValidationError = class extends StatusError {
+  source;
+  issues;
+  constructor(source, issues) {
+    if (source === "response") {
+      super("Server Error", 500);
+    } else {
+      super(`Invalid request ${source}`, 422);
     }
-    throw error;
+    this.source = source;
+    this.issues = issues;
   }
+};
+
+// src/helpers/validate.ts
+async function run(schema, value, source) {
+  const result = await schema["~standard"].validate(value);
+  if (result.issues) throw new ValidationError(source, result.issues);
+  return result.value;
+}
+async function validateRequest(ctx, options) {
+  if (options.body) {
+    ctx.body = await run(options.body, ctx.body ?? {}, "body");
+  }
+  if (options.query) {
+    const query = await run(options.query, ctx.url.query || {}, "query");
+    replace2(ctx.url.query, query);
+  }
+  if (options.params) {
+    const params = await run(options.params, ctx.url.params || {}, "params");
+    replace2(ctx.url.params, params);
+  }
+}
+async function validateResponse(out, options) {
+  if (!options.response) return out;
+  if (out?.constructor !== Object && !Array.isArray(out)) return out;
+  return await run(options.response, out, "response");
+}
+function replace2(target, values) {
+  for (const key of Object.keys(target)) delete target[key];
+  Object.assign(target, values);
 }
 
 // src/helpers/handleRequest.ts
@@ -2063,20 +2245,28 @@ async function getResponse(app, ctx) {
         ctx.options = { ...app.settings, ...route.options };
       }
       checkTraversal(params, ctx);
-      ctx.body = await resolveBody(ctx, ctx.options.body);
+      ctx.body = await resolveBody(
+        ctx,
+        ctx.options.parser,
+        ctx.options.security.maxBody
+      );
+      await validateRequest(ctx, route.options);
       for (const cb of route.fns) {
-        if (typeof cb === "function") {
-          const res = await cb(ctx);
-          const out = await parseResponse(res, ctx);
-          if (out) return out;
-        } else {
-          validate(ctx, cb);
-        }
+        const res = await cb(ctx);
+        const out = await parseResponse(
+          await validateResponse(res, route.options),
+          ctx
+        );
+        if (out) return out;
       }
       break;
     }
     if (!matched) {
-      ctx.body = await resolveBody(ctx, ctx.options.body);
+      ctx.body = await resolveBody(
+        ctx,
+        ctx.options.parser,
+        ctx.options.security.maxBody
+      );
       for (const mw of app.middleware) {
         const out = await parseResponse(await mw(ctx), ctx);
         if (out) return out;
@@ -2218,7 +2408,7 @@ function timingSafeEqual(a, b) {
   }
   return mismatch === 0;
 }
-async function verify(password, hash3) {
+async function verify2(password, hash3) {
   if ("Bun" in globalThis) {
     return Bun.password.verify(password, hash3, "argon2id");
   }
@@ -2252,94 +2442,72 @@ async function verify(password, hash3) {
   });
 }
 
-// src/auth/findSessionId.ts
-var validateToken = (authorization) => {
-  const [type2, id] = authorization.trim().split(" ");
-  if (type2?.toLowerCase() !== "bearer") {
+// src/auth/getUser.ts
+async function getJwtUser(ctx) {
+  const header = ctx.headers.authorization;
+  if (!header) return;
+  const [type2, token] = header.trim().split(" ");
+  if (type2?.toLowerCase() !== "bearer" || !token) {
     throw ServerError_default.AUTH_INVALID_HEADER({ type: type2 });
   }
-  if (id?.length !== 16) {
-    throw ServerError_default.AUTH_INVALID_TOKEN();
-  }
-  return id;
-};
-var validateCookie = (authorization) => {
-  if (authorization.length !== 16) {
-    throw ServerError_default.AUTH_INVALID_COOKIE();
-  }
-  return authorization;
-};
-function findSessionId(ctx) {
-  const strategy = ctx.options.auth.strategy;
-  if (!strategy) throw new Error(`Invalid strategy "${strategy}"`);
-  if (strategy.includes("token")) {
-    if (!ctx.headers.authorization) return;
-    return validateToken(ctx.headers.authorization);
-  }
-  if (strategy.includes("cookie")) {
-    if (!ctx.cookies.authentication) return;
-    return validateCookie(ctx.cookies.authentication);
+  const payload = await verifyJwt(token, ctx.options.secret);
+  if (!payload) throw ServerError_default.AUTH_INVALID_TOKEN();
+  const { iat, exp, ...claims } = payload;
+  if (!claims.id || !claims.email) throw ServerError_default.AUTH_INVALID_TOKEN();
+  if (!ctx.options.auth.providers.includes(claims.provider)) {
+    throw ServerError_default.AUTH_INVALID_PROVIDER({
+      provider: claims.provider,
+      valid: ctx.options.auth.providers
+    });
   }
-  throw new Error(`Invalid auth type "${strategy}"`);
+  const exposed = await ctx.options.auth.onUser(claims, ctx);
+  assertUser(exposed, "onUser");
+  return exposed;
 }
-
-// src/auth/getUser.ts
 async function getAuthSession(ctx) {
-  const strategy = ctx.options.auth.strategy;
-  if (strategy.includes("jwt")) {
-    const header = ctx.headers.authorization;
-    if (!header) return;
-    const [type2, token] = header.trim().split(" ");
-    if (type2?.toLowerCase() !== "bearer" || !token) {
-      throw ServerError_default.AUTH_INVALID_HEADER({ type: type2 });
-    }
-    const payload = await verifyJwt(token, ctx.options.secret);
-    if (!payload) throw ServerError_default.AUTH_INVALID_TOKEN();
-    return payload;
+  let session2 = ctx.session;
+  if (!session2) {
+    const id = findSessionId(ctx);
+    if (!id) return;
+    session2 = await ctx.options.sessions.get(id) ?? void 0;
   }
-  const id = findSessionId(ctx);
-  if (!id) return;
-  return ctx.options.auth.session.get(id);
+  if (!session2?.user) return;
+  return session2;
 }
 async function getUser(ctx) {
   if (!ctx.options.auth) return;
   const options = ctx.options.auth;
+  if (options.strategy.includes("jwt")) return getJwtUser(ctx);
   const auth2 = await getAuthSession(ctx);
   if (!auth2) return;
-  if (options.strategy !== auth2.strategy) {
-    throw ServerError_default.AUTH_INVALID_STRATEGY({
-      strategy: auth2.strategy || "undefined",
-      valid: options.strategy
-    });
-  }
   if (!options.providers.includes(auth2.provider)) {
     throw ServerError_default.AUTH_INVALID_PROVIDER({
       provider: auth2.provider,
       valid: options.providers
     });
   }
-  const user = await ctx.options.auth.store.get(auth2.user);
+  const user = await options.users.get(auth2.user);
   if (!user) throw ServerError_default.AUTH_NO_USER();
-  user.strategy = auth2.strategy;
-  user.provider = auth2.provider;
-  const exposed = await ctx.options.auth.onUser(user, ctx);
+  const exposed = await options.onUser(user, ctx);
   assertUser(exposed, "onUser");
   return exposed;
 }
 
 // src/auth/logout.ts
 async function logout(ctx) {
-  const { strategy } = ctx.user;
-  if (!strategy) throw new Error(`Invalid strategy "${strategy}"`);
+  const { strategy } = ctx.options.auth;
   if (!strategy.includes("jwt")) {
-    await ctx.options.auth.session.del(findSessionId(ctx));
+    const prev = loaded.get(ctx);
+    if (prev?.id) await ctx.options.sessions.del(prev.id);
+    ctx.session = {};
+    loaded.set(ctx, { id: void 0, data: "{}" });
   }
   if (ctx.options.auth.onLogout) await ctx.options.auth.onLogout(ctx);
   if (strategy.includes("token") || strategy.includes("jwt")) {
     return { token: null };
   }
   if (strategy.includes("cookie")) {
-    return cookies({ authentication: null }).redirect("/");
+    return cookies({ session: null }).redirect("/");
   }
   throw new Error("Unknown auth type");
 }
@@ -2365,6 +2533,7 @@ function auth(app) {
     if (!env[`${key}_SECRET`]) throw new Error(`${key}_SECRET not defined`);
     app.get(`/auth/login/${name}`, providers_default[name].login);
     app.get(`/auth/callback/${name}`, providers_default[name].callback);
+    app.post(`/auth/verify/${name}`, providers_default[name].verify);
   }
   if (enabled.includes("apple")) {
     const keys = ["APPLE_ID", "APPLE_TEAM_ID", "APPLE_KEY_ID", "APPLE_PRIVATE_KEY"];
@@ -2373,6 +2542,7 @@ function auth(app) {
     }
     app.get("/auth/login/apple", providers_default.apple.login);
     app.post("/auth/callback/apple", providers_default.apple.callback);
+    app.post("/auth/verify/apple", providers_default.apple.verify);
   }
   if (enabled.includes("email")) {
     app.post("/auth/register/email", providers_default.email.register);
@@ -2541,8 +2711,8 @@ var generateOpenApiPaths = (handlers) => {
     for (const route of routes) {
       const path = route.path;
       const fn = route.fns.find((p) => typeof p === "function");
-      const meta = route.fns.find((p) => typeof p === "object");
-      const config2 = getConfig(route.options);
+      const meta = route.options ?? {};
+      const config2 = getConfig(route.options?.schema);
       if (typeof path !== "string" || path === "*" || path === "/docs" || !fn) {
         continue;
       }
@@ -2595,7 +2765,7 @@ var generateOpenApiPaths = (handlers) => {
       paths[normalizedPath][method] = {
         tags: config2.tags,
         summary: config2.title || getTag("@title", fn) || `${method.toUpperCase()} ${normalizedPath}`,
-        description: getTitle(fn) || getDescription(fn),
+        description: config2.description || getTitle(fn) || getDescription(fn),
         requestBody,
         parameters,
         responses
@@ -2647,39 +2817,6 @@ function preflight(ctx) {
   return 204;
 }
 
-// src/middle/NoSession.ts
-var NoSession = class {
-};
-function createNoSession() {
-  return new Proxy(NoSession, {
-    get(target, key) {
-      if (target[key]) return target[key];
-      if (key === "then") return target[key];
-      if (typeof key === "symbol") return target[key];
-      throw ServerError_default.NO_STORE_READ({ key: String(key) });
-    },
-    set(target, key, value) {
-      if (target[key] || key === "then" || typeof key === "symbol") {
-        target[key] = value;
-        return true;
-      }
-      throw ServerError_default.NO_STORE_WRITE({ key: String(key) });
-    }
-  });
-}
-
-// src/middle/session.ts
-async function session(ctx) {
-  const store = ctx.options.session?.store;
-  if (!store) {
-    ctx.session = createNoSession();
-    return;
-  }
-  if (ctx.cookies.session) {
-    ctx.session = await store.get(ctx.cookies.session) || {};
-  }
-}
-
 // src/middle/timer.ts
 var createTime = () => {
   const times2 = [["init", performance.now()]];
@@ -3052,6 +3189,14 @@ var Netlify = async (app, request, context) => {
 };
 
 // src/router.ts
+function checkParserConflict(options, globalParser) {
+  const parser = options.parser ?? globalParser ?? "parse";
+  if (options.body && parser !== "parse") {
+    throw new Error(
+      `A \`parser: '${parser}'\` route never parses the body, so its \`body\` schema cannot run. Remove one, or set \`parser: 'parse'\` on the route.`
+    );
+  }
+}
 var Router = class _Router {
   // Cross-cutting middleware added with .use(); they run on every request
   middleware = [];
@@ -3085,6 +3230,7 @@ var Router = class _Router {
     if (rest[0] != null && typeof rest[0] !== "function") {
       options = rest.shift();
     }
+    checkParserConflict(options, this.settings?.parser);
     const base = method === "socket" ? [] : this.middleware;
     const fns = [...base, ...rest].filter((fn) => fn != null);
     this.handlers[method].push({ path, options, fns });
@@ -3119,6 +3265,7 @@ var Router = class _Router {
       if (arg instanceof _Router) {
         for (const m of Object.keys(arg.handlers)) {
           for (const route of arg.handlers[m]) {
+            checkParserConflict(route.options, this.settings?.parser);
             const base = m === "socket" ? [] : this.middleware;
             this.handlers[m].push({
               path: route.path,
@@ -3208,16 +3355,17 @@ var Server = class extends Router {
     } else if (this.platform.runtime === "bun") {
       this.settings.log.start(`http://localhost:${this.settings.port}/`);
     }
-    this.use(timer);
-    if (this.settings.cors) this.use(preflight);
-    this.use(assets);
-    if (this.settings.favicon) this.get("/favicon.ico", favicon);
-    this.use(session);
+    const app = this;
+    app.use(timer);
+    if (this.settings.cors) app.use(preflight);
+    app.use(assets);
+    if (this.settings.favicon) app.get("/favicon.ico", favicon);
+    app.use(session);
     if (this.settings.auth) {
-      auth(this);
+      auth(app);
     }
     if (this.settings.openapi) {
-      this.get(this.settings.openapi.path || "/docs", openapi_default);
+      app.get(this.settings.openapi.path || "/docs", openapi_default);
     }
   }
   self() {
@@ -3252,6 +3400,7 @@ function server(options) {
 export {
   Server,
   ServerError_default as ServerError,
+  ValidationError,
   default3 as bucket,
   cache,
   cookies,