@shtora/auth 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 airshakur88
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,187 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @shtora/auth
+
+Framework-neutral authentication handlers and session management for Next.js and Cloudflare Workers. The core uses standard `Request`/`Response` APIs and Web Crypto; optional entry points add Cloudflare D1, OIDC, and WebAuthn support.
+
+Your application owns its user records, credential verification, password hashing, email delivery, and persistent stores. The package does not hash, encrypt, or persist passwords and includes no ORM.
+
+## Install
+
+```sh
+bun add @shtora/auth
+```
+
+Install optional protocol dependencies only when you use those entry points:
+
+```sh
+bun add openid-client              # @shtora/auth/oidc
+bun add @simplewebauthn/server     # @shtora/auth/webauthn
+```
+
+## Next.js App Router
+
+Create the handler with application-owned adapters. `users`, `credentials`, `sessions`, `rateLimiter`, and `resolveClientIp` below are implementations in your application, not exports from this package.
+
+```ts
+// src/server/auth.ts
+import { createAuth } from "@shtora/auth";
+import {
+  blockedEmails,
+  blockedIps,
+  credentials,
+  rateLimiter,
+  resolveClientIp,
+  sessions,
+  users,
+} from "./auth-adapters";
+
+export const auth = createAuth({
+  users,
+  credentials,
+  sessions,
+  rateLimiter,
+  resolveClientIp,
+  allowedHosts: ["app.example.com"],
+  emailPolicy: {
+    async allow({ value }) {
+      return !blockedEmails.has(value);
+    },
+  },
+  ipPolicy: {
+    async allow({ value }) {
+      return !blockedIps.has(value);
+    },
+  },
+});
+```
+
+Forward the supported methods from a Route Handler:
+
+```ts
+// app/api/auth/[...auth]/route.ts
+import { auth } from "@/server/auth";
+
+export const GET = (request: Request) => auth.handle(request);
+export const POST = (request: Request) => auth.handle(request);
+export const DELETE = (request: Request) => auth.handle(request);
+```
+
+Use the real hostname in `allowedHosts`. Resolve client IPs only from a trusted hosting-platform or proxy value; do not parse arbitrary `X-Forwarded-For` input. Configure a shared, persistent rate limiter for public authentication endpoints.
+
+## Cloudflare Workers and D1
+
+Import D1 adapters from the dedicated entry point. The application still supplies its own user and credential adapters; D1 stores sessions and rate-limit counters in this example.
+
+```ts
+import { createAuth } from "@shtora/auth";
+import {
+  cleanupD1AuthState,
+  createD1RateLimiter,
+  createD1SessionStore,
+  type D1Database,
+} from "@shtora/auth/cloudflare";
+import { credentials, users } from "./auth-adapters";
+
+interface Env {
+  DB: D1Database;
+}
+
+let auth: ReturnType<typeof createAuth> | undefined;
+
+function getAuth(env: Env) {
+  return auth ??= createAuth({
+    users,
+    credentials,
+    sessions: createD1SessionStore(env.DB),
+    rateLimiter: createD1RateLimiter(env.DB, {
+      email: { limit: 5, windowSeconds: 60 },
+      ip: { limit: 100, windowSeconds: 60 },
+    }),
+    resolveClientIp: (request) => request.headers.get("cf-connecting-ip"),
+    allowedHosts: ["auth.example.com"],
+  });
+}
+
+export default {
+  fetch(request: Request, env: Env): Promise<Response> {
+    return getAuth(env).handle(request);
+  },
+
+  async scheduled(_controller: unknown, env: Env): Promise<void> {
+    await cleanupD1AuthState(env.DB, { rateLimitMaxWindowSeconds: 60 });
+  },
+};
+```
+
+Apply the SQL files in `migrations/` to the D1 database before handling requests. D1 cleanup is bounded; schedule it often enough for your session and rate-limit volume. Workers Free and Paid use the same package code, subject to each plan's D1, storage, and CPU quotas. Local Worker tests do not measure production quotas.
+
+## Routes
+
+The default base path is `/api/auth`; set `basePath` to change it.
+
+| Method | Path | Behavior |
+| --- | --- | --- |
+| `POST` | `/api/auth/register` | Creates an account. Duplicate and policy-blocked registrations share the same `202` response. |
+| `POST` | `/api/auth/login` | Verifies credentials and sets a session cookie. |
+| `POST` | `/api/auth/logout` | Revokes the current session and clears the cookie after successful revocation. |
+| `GET` | `/api/auth/session` | Returns the authenticated user or `401`. |
+| `GET` | `/api/auth/sessions` | Lists the user's active sessions without token hashes. |
+| `DELETE` | `/api/auth/sessions/:id` | Revokes a session owned by the current user. |
+| `DELETE` | `/api/auth/sessions` | Revokes all sessions for the current user. |
+| `POST` | `/api/auth/email-verification/request` | Optional; sends a verification message with an enumeration-resistant response. |
+| `POST` | `/api/auth/email-verification/confirm` | Optional; consumes a one-time token and marks the account verified. |
+| `POST` | `/api/auth/password-reset/request` | Optional; sends a reset message with an enumeration-resistant response. |
+| `POST` | `/api/auth/password-reset/confirm` | Optional; revokes sessions, then delegates the password update to the application. |
+
+State-changing POST and DELETE requests require a same-origin `Origin` header by default. Read-only session GET requests allow a missing `Origin`. Keep this check enabled for browser cookie authentication unless equivalent CSRF protection is in place.
+
+## Email verification and password reset
+
+These flows are opt-in. Configure the matching options with an `AuthActionTokenStore` and a delivery callback. The store persists only a SHA-256 token hash, atomically replaces an earlier token for the same user and purpose, consumes the current unexpired token once, and implements bounded expiration cleanup. The callback receives the raw bearer token: enqueue it promptly and never log it. Submit tokens to the POST confirmation routes rather than consuming them in GET requests, which link scanners may follow.
+
+Email verification also requires `isVerified` and `markVerified`. When enabled, unverified users cannot log in or use existing sessions. Password reset delegates password hashing and persistence to `setPassword`; sessions are revoked before that callback runs. If password persistence fails, the user remains signed out but the old password may still work. The application remains responsible for password policy and hash configuration.
+
+Known and unknown addresses receive the same request response, though delivery timing can differ. Use asynchronous delivery and configure rate limiting for public auth endpoints.
+
+## External identity handlers
+
+`auth.createSessionResponse(request, userId)` creates a package session after an external identity handler has verified its protocol response. It reloads the application user and applies configured host, email, IP, and verification policies. The caller remains responsible for protocol state, CSRF protection, and rate limiting.
+
+## Security and storage contracts
+
+- The default `__Host-shtora.session` cookie is `Secure`, `HttpOnly`, `SameSite=Lax`, `Path=/`, and has no `Domain`. Cookie names must use the `__Host-` prefix.
+- Session cookies contain a random 256-bit token. `SessionStore` persists only its SHA-256 hash. Use storage with reliable revocation consistency; `deleteByIdForUser` must match both session and user IDs.
+- The default session lifetime is seven days (maximum one year). Request bodies are limited to 8 KiB by default; oversized cookie headers are treated as unauthenticated.
+- The application must hash passwords before storing them. `CredentialVerifier.verify` should do equivalent work for missing users to reduce account-enumeration timing differences. Never return password material through `AuthUser`.
+- Rate limiting is optional for core routes and should be configured for public deployments. OIDC and WebAuthn require a trusted client-IP resolver and request rate limiter; they fail closed when the IP is unavailable.
+- `resolveClientIp` must use a trusted proxy or platform header. Never trust arbitrary forwarded headers.
+- `allowedHosts` is an optional exact-authority allowlist. If omitted, reject unexpected hosts at the platform or proxy.
+- `onError({ operation, error })` observes unexpected adapter, policy, and delivery errors. HTTP responses remain generic. Avoid logging unreviewed adapter errors; they may contain sensitive values. Direct `getSession()` and `createSessionResponse()` calls reject adapter errors after notifying the observer.
+
+The application also owns persistent storage for action tokens, OIDC transactions, WebAuthn challenges, and credentials. Their `consume` operations must be atomic and one-use; WebAuthn credential IDs must be unique and counter updates conditional on the stored counter. Expired-record cleanup methods must honor their supplied limit. See the exported TypeScript interfaces for the complete contracts.
+
+## Optional protocols
+
+### OIDC
+
+Import `createOidc` from `@shtora/auth/oidc`. It uses state, nonce, and PKCE, checks the fixed callback URL, and consumes a matching unexpired transaction once. The application owns `OidcTransactionStore`, issuer/client configuration, identity-to-user mapping, and session creation. Use an HTTPS issuer and pre-registered callback URL; schedule the returned `cleanupExpired()` method.
+
+### WebAuthn and passkeys
+
+Import `createWebAuthn` from `@shtora/auth/webauthn`. Registration requires an authenticated user flow and a stable, non-PII application user ID of at most 64 UTF-8 bytes. Configure the exact expected origin and RP ID, persistent one-use challenge storage, unique credential IDs, compare-and-set counter updates, trusted client-IP resolution, and a request rate limiter. Schedule the returned `cleanupExpired()` method.
+
+## Cloudflare D1 adapter
+
+`@shtora/auth/cloudflare` exports D1 session, action-token, and fixed-window rate-limit adapters. The core entry point does not import Cloudflare code. Rate-limit keys are hashed before storage; the counters remain scoped to one D1 database and consume D1 write capacity. Cloudflare's Workers Rate Limit binding is location-local and approximate, not a globally strict limiter.
+
+Run all SQL migrations in order. `cleanupD1AuthState` removes bounded batches of expired sessions, action tokens, and rate-limit records; set `rateLimitMaxWindowSeconds` to at least the longest configured rate-limit window. See the [D1 Worker API](https://developers.cloudflare.com/d1/worker-api/d1-database/) and [Workers Rate Limit binding](https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/).
+
+## Development
+
+```sh
+bun install
+bun run typecheck
+bun test
+bun run build
+```
+
+Changes to auth behavior should include tests for the affected boundary or state transition. Keep package documentation in English, update this README when public contracts change, and avoid adding generated output to commits. See [CONTRIBUTING.md](CONTRIBUTING.md) for the contribution workflow.

package/dist/auth.d.ts

@@ -0,0 +1,2 @@
+import type { AuthApi, AuthOptions, AuthUser } from "./types.js";
+export declare function createAuth<User extends AuthUser>(options: AuthOptions<User>): AuthApi;

package/dist/auth.js

@@ -0,0 +1,429 @@
+import { clearedSessionCookie, readSessionToken, sessionCookie } from "./cookies.js";
+import { createSessionToken, hashSessionToken } from "./crypto.js";
+import { parseActionTokenRequest, parseCredentials, parseEmailRequest, parsePasswordReset, readJson, RequestError } from "./request.js";
+const defaultBasePath = "/api/auth";
+const defaultCookieName = "__Host-shtora.session";
+const defaultSessionTtl = 60 * 60 * 24 * 7;
+const maxSessionTtl = 60 * 60 * 24 * 365;
+const defaultMaxRequestBytes = 8192;
+const defaultVerificationTokenTtl = 60 * 60;
+const defaultResetTokenTtl = 15 * 60;
+const maxActionTokenTtl = 60 * 60 * 24;
+export function createAuth(options) {
+    const basePath = options.basePath ?? defaultBasePath;
+    const cookieName = options.cookieName ?? defaultCookieName;
+    const sessionTtlSeconds = options.sessionTtlSeconds ?? defaultSessionTtl;
+    const maxRequestBytes = options.maxRequestBytes ?? defaultMaxRequestBytes;
+    const requireOrigin = options.requireOrigin ?? true;
+    if (!basePath.startsWith("/") || basePath.endsWith("/") || basePath.includes("?")) {
+        throw new TypeError("basePath must start with '/' and must not end with '/'");
+    }
+    if (!/^__Host-[A-Za-z0-9._-]+$/.test(cookieName)) {
+        throw new TypeError("cookieName must use the __Host- prefix");
+    }
+    if (!Number.isInteger(sessionTtlSeconds) || sessionTtlSeconds < 1 || sessionTtlSeconds > maxSessionTtl) {
+        throw new RangeError("sessionTtlSeconds must be between 1 and 31536000");
+    }
+    if (!Number.isInteger(maxRequestBytes) || maxRequestBytes < 1 || maxRequestBytes > 1024 * 1024) {
+        throw new RangeError("maxRequestBytes must be between 1 and 1048576");
+    }
+    if ((options.ipPolicy || options.rateLimiter) && !options.resolveClientIp) {
+        throw new TypeError("resolveClientIp is required when ipPolicy or rateLimiter is configured");
+    }
+    for (const ttl of [options.emailVerification?.tokenTtlSeconds, options.passwordReset?.tokenTtlSeconds]) {
+        if (ttl !== undefined && (!Number.isInteger(ttl) || ttl < 1 || ttl > maxActionTokenTtl)) {
+            throw new RangeError("tokenTtlSeconds must be between 1 and 86400");
+        }
+    }
+    async function isAllowed(policy, value, request) {
+        return policy ? policy.allow({ value, request }) : true;
+    }
+    async function clientIp(request) {
+        const ip = await options.resolveClientIp(request);
+        return typeof ip === "string" && ip.length > 0 ? ip : null;
+    }
+    async function report(operation, error) {
+        try {
+            await options.onError?.({ operation, error });
+        }
+        catch {
+            // Observers must not affect the public result.
+        }
+    }
+    function response(body, status, headers) {
+        const responseHeaders = new Headers(headers);
+        responseHeaders.set("Cache-Control", "no-store");
+        responseHeaders.set("Content-Type", "application/json; charset=utf-8");
+        responseHeaders.set("X-Content-Type-Options", "nosniff");
+        responseHeaders.set("Vary", "Cookie");
+        return new Response(JSON.stringify(body), { status, headers: responseHeaders });
+    }
+    function errorResponse(error) {
+        if (error instanceof RequestError)
+            return response({ error: error.code }, error.status);
+        return response({ error: "internal_error" }, 500);
+    }
+    function hostIsAllowed(request) {
+        if (!options.allowedHosts)
+            return true;
+        const host = request.headers.get("host");
+        if (!host || host.includes(","))
+            return false;
+        try {
+            const parsed = new URL(`https://${host}`);
+            return parsed.pathname === "/" && !parsed.username && !parsed.password &&
+                options.allowedHosts.some((allowed) => allowed.toLowerCase() === parsed.host.toLowerCase());
+        }
+        catch {
+            return false;
+        }
+    }
+    function originIsAllowed(request) {
+        const origin = request.headers.get("origin");
+        if (!origin)
+            return !requireOrigin;
+        try {
+            const parsedOrigin = new URL(origin);
+            const normalizedOrigin = parsedOrigin.origin.toLowerCase();
+            if (parsedOrigin.username ||
+                parsedOrigin.password ||
+                parsedOrigin.pathname !== "/" ||
+                parsedOrigin.search ||
+                parsedOrigin.hash ||
+                origin.toLowerCase() !== normalizedOrigin)
+                return false;
+            const requestUrl = new URL(request.url);
+            const host = request.headers.get("host");
+            const expectedOrigin = host ? new URL(`${requestUrl.protocol}//${host}`).origin : requestUrl.origin;
+            return normalizedOrigin === expectedOrigin.toLowerCase();
+        }
+        catch {
+            return false;
+        }
+    }
+    function publicUser(user) {
+        if (typeof user.id !== "string" || user.id.length === 0 || typeof user.email !== "string") {
+            throw new TypeError("UserStore returned an invalid user");
+        }
+        return { id: user.id, email: user.email };
+    }
+    async function getSession(request) {
+        try {
+            const token = readSessionToken(request.headers.get("cookie"), cookieName);
+            if (!token)
+                return null;
+            const tokenHash = await hashSessionToken(token);
+            const stored = await options.sessions.findByTokenHash(tokenHash);
+            const now = Date.now();
+            if (!stored || stored.tokenHash !== tokenHash || !Number.isFinite(stored.expiresAtMs) || stored.expiresAtMs <= now) {
+                if (stored?.tokenHash === tokenHash)
+                    await options.sessions.deleteByTokenHash(tokenHash);
+                return null;
+            }
+            const user = await options.users.findById(stored.userId);
+            if (!user) {
+                await options.sessions.deleteByTokenHash(tokenHash);
+                return null;
+            }
+            if (options.emailVerification && !options.emailVerification.isVerified(user))
+                return null;
+            if (!(await isAllowed(options.emailPolicy, user.email, request)))
+                return null;
+            if (options.ipPolicy) {
+                const ip = await clientIp(request);
+                if (!ip || !(await isAllowed(options.ipPolicy, ip, request)))
+                    return null;
+            }
+            return publicUser(user);
+        }
+        catch (error) {
+            if (!(error instanceof RequestError))
+                await report("getSession", error);
+            throw error;
+        }
+    }
+    async function rateLimit(action, email, request) {
+        if (!options.rateLimiter)
+            return null;
+        const ip = await clientIp(request);
+        if (!ip) {
+            if (action === "login")
+                return response({ error: "invalid_credentials" }, 401);
+            return response({ status: "accepted" }, 202);
+        }
+        const result = await options.rateLimiter.check({ action, email, ip });
+        if (result.allowed)
+            return null;
+        const seconds = Number.isInteger(result.retryAfterSeconds) && result.retryAfterSeconds > 0
+            ? result.retryAfterSeconds
+            : 60;
+        return response({ error: "rate_limited" }, 429, { "Retry-After": String(seconds) });
+    }
+    async function issueActionToken(purpose, userId, email, tokens, delivery, defaultTtlSeconds, operation) {
+        try {
+            const token = createSessionToken();
+            const expiresAtMs = Date.now() + (delivery.tokenTtlSeconds ?? defaultTtlSeconds) * 1000;
+            await tokens.create({ purpose, userId, tokenHash: await hashSessionToken(token), expiresAtMs });
+            await delivery.send({ email, token, expiresAtMs });
+        }
+        catch (error) {
+            await report(operation, error);
+        }
+    }
+    async function passPolicies(email, request) {
+        if (!(await isAllowed(options.emailPolicy, email, request)))
+            return false;
+        if (!options.ipPolicy)
+            return true;
+        const ip = await clientIp(request);
+        return ip !== null && isAllowed(options.ipPolicy, ip, request);
+    }
+    async function register(request) {
+        const credentials = parseCredentials(await readJson(request, maxRequestBytes));
+        const limited = await rateLimit("register", credentials.email, request);
+        if (limited)
+            return limited;
+        if (!(await passPolicies(credentials.email, request)))
+            return response({ status: "accepted" }, 202);
+        const created = await options.users.create({ email: credentials.email, password: credentials.password });
+        if (created.created) {
+            if (!created.user)
+                throw new TypeError("UserStore must return the created user");
+            if (options.emailVerification) {
+                await issueActionToken("email-verification", created.user.id, created.user.email, options.emailVerification.tokens, options.emailVerification, defaultVerificationTokenTtl, "email-verification.send");
+            }
+        }
+        return response({ status: "accepted" }, 202);
+    }
+    async function requestEmailVerification(request) {
+        const flow = options.emailVerification;
+        if (!flow)
+            return response({ error: "not_found" }, 404);
+        const email = parseEmailRequest(await readJson(request, maxRequestBytes));
+        const limited = await rateLimit("email-verification", email, request);
+        if (limited)
+            return limited;
+        if (!(await passPolicies(email, request)))
+            return response({ status: "accepted" }, 202);
+        const user = await options.users.findByEmail(email);
+        if (user && !flow.isVerified(user)) {
+            await issueActionToken("email-verification", user.id, user.email, flow.tokens, flow, defaultVerificationTokenTtl, "email-verification.send");
+        }
+        return response({ status: "accepted" }, 202);
+    }
+    async function confirmEmailVerification(request) {
+        const flow = options.emailVerification;
+        if (!flow)
+            return response({ error: "not_found" }, 404);
+        const token = parseActionTokenRequest(await readJson(request, maxRequestBytes));
+        const consumed = await flow.tokens.consume({
+            purpose: "email-verification",
+            tokenHash: await hashSessionToken(token),
+            nowMs: Date.now(),
+        });
+        if (!consumed)
+            return response({ error: "invalid_token" }, 400);
+        const user = await options.users.findById(consumed.userId);
+        if (!user)
+            return response({ error: "invalid_token" }, 400);
+        await flow.markVerified(user.id);
+        return new Response(null, { status: 204, headers: { "Cache-Control": "no-store" } });
+    }
+    async function requestPasswordReset(request) {
+        const flow = options.passwordReset;
+        if (!flow)
+            return response({ error: "not_found" }, 404);
+        const email = parseEmailRequest(await readJson(request, maxRequestBytes));
+        const limited = await rateLimit("password-reset", email, request);
+        if (limited)
+            return limited;
+        if (!(await passPolicies(email, request)))
+            return response({ status: "accepted" }, 202);
+        const user = await options.users.findByEmail(email);
+        if (user) {
+            await issueActionToken("password-reset", user.id, user.email, flow.tokens, flow, defaultResetTokenTtl, "password-reset.send");
+        }
+        return response({ status: "accepted" }, 202);
+    }
+    async function confirmPasswordReset(request) {
+        const flow = options.passwordReset;
+        if (!flow)
+            return response({ error: "not_found" }, 404);
+        const { token, password } = parsePasswordReset(await readJson(request, maxRequestBytes));
+        const consumed = await flow.tokens.consume({
+            purpose: "password-reset",
+            tokenHash: await hashSessionToken(token),
+            nowMs: Date.now(),
+        });
+        if (!consumed)
+            return response({ error: "invalid_token" }, 400);
+        const user = await options.users.findById(consumed.userId);
+        if (!user)
+            return response({ error: "invalid_token" }, 400);
+        await options.sessions.deleteByUserId(user.id);
+        await flow.setPassword({ userId: user.id, password });
+        return new Response(null, { status: 204, headers: { "Cache-Control": "no-store" } });
+    }
+    async function createSessionForUser(user) {
+        const token = createSessionToken();
+        const tokenHash = await hashSessionToken(token);
+        const now = Date.now();
+        const session = {
+            id: createSessionToken(),
+            tokenHash,
+            userId: user.id,
+            createdAtMs: now,
+            expiresAtMs: now + sessionTtlSeconds * 1000,
+        };
+        await options.sessions.create(session);
+        return response({ user: publicUser(user) }, 200, {
+            "Set-Cookie": sessionCookie(token, cookieName, sessionTtlSeconds, now),
+        });
+    }
+    async function createSessionResponse(request, userId) {
+        try {
+            if (!hostIsAllowed(request))
+                return response({ error: "invalid_host" }, 403);
+            const user = await options.users.findById(userId);
+            if (!user ||
+                (options.emailVerification && !options.emailVerification.isVerified(user)) ||
+                !(await passPolicies(user.email, request))) {
+                return response({ error: "unauthenticated" }, 401);
+            }
+            return await createSessionForUser(user);
+        }
+        catch (error) {
+            if (!(error instanceof RequestError))
+                await report("createSessionResponse", error);
+            throw error;
+        }
+    }
+    async function login(request) {
+        const { email, password } = parseCredentials(await readJson(request, maxRequestBytes));
+        const limited = await rateLimit("login", email, request);
+        if (limited)
+            return limited;
+        if (!(await passPolicies(email, request)))
+            return response({ error: "invalid_credentials" }, 401);
+        const user = await options.users.findByEmail(email);
+        const verified = await options.credentials.verify({ email, password, user });
+        if (!user || !verified || (options.emailVerification && !options.emailVerification.isVerified(user))) {
+            return response({ error: "invalid_credentials" }, 401);
+        }
+        return createSessionForUser(user);
+    }
+    async function logout(request) {
+        const token = readSessionToken(request.headers.get("cookie"), cookieName);
+        if (token)
+            await options.sessions.deleteByTokenHash(await hashSessionToken(token));
+        return new Response(null, {
+            status: 204,
+            headers: { "Cache-Control": "no-store", "Set-Cookie": clearedSessionCookie(cookieName) },
+        });
+    }
+    async function cleanupExpired() {
+        const stores = new Set([options.sessions]);
+        if (options.emailVerification)
+            stores.add(options.emailVerification.tokens);
+        if (options.passwordReset)
+            stores.add(options.passwordReset.tokens);
+        const nowMs = Date.now();
+        try {
+            await Promise.all([...stores].map((store) => store.deleteExpired({ nowMs, limit: 500 })));
+        }
+        catch (error) {
+            await report("cleanupExpired", error);
+            throw error;
+        }
+    }
+    async function handle(request) {
+        if (!hostIsAllowed(request))
+            return response({ error: "invalid_host" }, 403);
+        const { pathname } = new URL(request.url);
+        if (!pathname.startsWith(`${basePath}/`))
+            return response({ error: "not_found" }, 404);
+        const route = pathname.slice(basePath.length);
+        const method = request.method.toUpperCase();
+        if (route === "/session" && method === "GET") {
+            if (!originIsAllowed(request) && request.headers.has("origin"))
+                return response({ error: "invalid_origin" }, 403);
+            try {
+                const user = await getSession(request);
+                return user ? response({ user }, 200) : response({ error: "unauthenticated" }, 401);
+            }
+            catch (error) {
+                return errorResponse(error);
+            }
+        }
+        if (route === "/sessions" || /^\/sessions\/[^/]+$/.test(route)) {
+            if ((route === "/sessions" && !["GET", "DELETE"].includes(method)) ||
+                (route !== "/sessions" && method !== "DELETE")) {
+                return response({ error: "method_not_allowed" }, 405, { Allow: route === "/sessions" ? "GET, DELETE" : "DELETE" });
+            }
+            if ((method !== "GET" || request.headers.has("origin")) && !originIsAllowed(request)) {
+                return response({ error: "invalid_origin" }, 403);
+            }
+            let user;
+            try {
+                user = await getSession(request);
+            }
+            catch (error) {
+                return errorResponse(error);
+            }
+            if (!user)
+                return response({ error: "unauthenticated" }, 401);
+            try {
+                if (route === "/sessions" && method === "GET") {
+                    const sessions = (await options.sessions.listByUserId(user.id)).filter((session) => session.expiresAtMs > Date.now());
+                    return response({ sessions: sessions.map(({ id, createdAtMs, expiresAtMs }) => ({ id, createdAtMs, expiresAtMs })) }, 200);
+                }
+                if (route === "/sessions") {
+                    await options.sessions.deleteByUserId(user.id);
+                    return new Response(null, {
+                        status: 204,
+                        headers: { "Set-Cookie": clearedSessionCookie(cookieName) },
+                    });
+                }
+                await options.sessions.deleteByIdForUser(route.slice("/sessions/".length), user.id);
+                return new Response(null, { status: 204 });
+            }
+            catch (error) {
+                if (!(error instanceof RequestError))
+                    await report(`sessions.${method.toLowerCase()}`, error);
+                return errorResponse(error);
+            }
+        }
+        const emailVerificationRoute = route === "/email-verification/request" || route === "/email-verification/confirm";
+        const passwordResetRoute = route === "/password-reset/request" || route === "/password-reset/confirm";
+        const enabled = ["/register", "/login", "/logout"].includes(route) ||
+            (emailVerificationRoute && !!options.emailVerification) ||
+            (passwordResetRoute && !!options.passwordReset);
+        if (!enabled)
+            return response({ error: "not_found" }, 404);
+        if (method !== "POST")
+            return response({ error: "method_not_allowed" }, 405, { Allow: "POST" });
+        if (!originIsAllowed(request))
+            return response({ error: "invalid_origin" }, 403);
+        try {
+            if (route === "/register")
+                return await register(request);
+            if (route === "/login")
+                return await login(request);
+            if (route === "/logout")
+                return await logout(request);
+            if (route === "/email-verification/request")
+                return await requestEmailVerification(request);
+            if (route === "/email-verification/confirm")
+                return await confirmEmailVerification(request);
+            if (route === "/password-reset/request")
+                return await requestPasswordReset(request);
+            return await confirmPasswordReset(request);
+        }
+        catch (error) {
+            if (!(error instanceof RequestError))
+                await report(route.slice(1), error);
+            return errorResponse(error);
+        }
+    }
+    return { handle, cleanupExpired, getSession, createSessionResponse };
+}