@shtora/auth 0.0.0-stage → 0.1.0

package/dist/cloudflare.d.ts

@@ -0,0 +1,51 @@
+import type { AuthActionTokenStore, AuthRateLimiter, AuthRequestRateLimiter, SessionStore } from "./types.js";
+interface D1Result<Row> {
+    results?: Row[];
+    success?: boolean;
+    meta?: {
+        changes?: number;
+    };
+}
+type D1Value = string | number | boolean | null | ArrayBuffer | ArrayBufferView;
+interface D1PreparedStatement {
+    bind(...values: D1Value[]): D1PreparedStatement;
+    first<Row = Record<string, unknown>>(): Promise<Row | null>;
+    all<Row = Record<string, unknown>>(): Promise<D1Result<Row>>;
+    run(): Promise<D1Result<never>>;
+}
+/** The subset of Cloudflare's D1 binding used by these adapters. */
+export interface D1Database {
+    prepare(query: string): D1PreparedStatement;
+    batch<T = unknown>(statements: D1PreparedStatement[]): Promise<D1Result<T>[]>;
+}
+export type D1ActionTokenStore = AuthActionTokenStore;
+export declare function createD1ActionTokenStore(db: D1Database): D1ActionTokenStore;
+export declare function createD1SessionStore(db: D1Database): SessionStore;
+export interface D1RateLimitWindow {
+    limit: number;
+    windowSeconds: number;
+}
+export interface D1RateLimiterOptions {
+    email: D1RateLimitWindow;
+    ip: D1RateLimitWindow;
+    /** Epoch milliseconds; injectable to make window boundaries deterministic in tests. */
+    now?: () => number;
+}
+export declare function createD1RateLimiter(db: D1Database, options: D1RateLimiterOptions): AuthRateLimiter;
+export interface D1RequestRateLimiterOptions {
+    limit: number;
+    windowSeconds: number;
+    /** Epoch milliseconds; injectable to make window boundaries deterministic in tests. */
+    now?: () => number;
+}
+export declare function createD1RequestRateLimiter(db: D1Database, options: D1RequestRateLimiterOptions): AuthRequestRateLimiter;
+export interface D1AuthCleanupOptions {
+    /** Epoch milliseconds; injectable to make cleanup deterministic in tests. */
+    nowMs?: number;
+    /** Longest configured rate-limit window, used to retain active counters. */
+    rateLimitMaxWindowSeconds: number;
+    /** Rows removed per table per call. Defaults to 500; capped at 1000. */
+    batchSize?: number;
+}
+export declare function cleanupD1AuthState(db: D1Database, options: D1AuthCleanupOptions): Promise<void>;
+export {};

package/dist/cloudflare.js

@@ -0,0 +1,156 @@
+export function createD1ActionTokenStore(db) {
+    return {
+        async create({ purpose, userId, tokenHash, expiresAtMs }) {
+            await db.batch([
+                db.prepare("DELETE FROM shtora_action_tokens WHERE purpose = ? AND user_id = ?").bind(purpose, userId),
+                db.prepare("INSERT INTO shtora_action_tokens (purpose, user_id, token_hash, expires_at_ms) VALUES (?, ?, ?, ?)").bind(purpose, userId, tokenHash, expiresAtMs),
+            ]);
+        },
+        async consume({ purpose, tokenHash, nowMs }) {
+            const row = await db.prepare("DELETE FROM shtora_action_tokens WHERE purpose = ? AND token_hash = ? AND expires_at_ms > ? RETURNING user_id").bind(purpose, tokenHash, nowMs).first();
+            return row ? { userId: row.user_id } : null;
+        },
+        async deleteExpired({ nowMs, limit }) {
+            validateCleanupInput(nowMs, limit);
+            await db.prepare("DELETE FROM shtora_action_tokens WHERE rowid IN " +
+                "(SELECT rowid FROM shtora_action_tokens WHERE expires_at_ms <= ? ORDER BY expires_at_ms LIMIT ?)").bind(nowMs, limit).run();
+        },
+    };
+}
+export function createD1SessionStore(db) {
+    return {
+        async create(session) {
+            await db.prepare("INSERT INTO shtora_sessions (id, token_hash, user_id, created_at_ms, expires_at_ms) VALUES (?, ?, ?, ?, ?)").bind(session.id, session.tokenHash, session.userId, session.createdAtMs, session.expiresAtMs).run();
+        },
+        async findByTokenHash(tokenHash) {
+            const row = await db.prepare("SELECT id, token_hash, user_id, created_at_ms, expires_at_ms FROM shtora_sessions WHERE token_hash = ? LIMIT 1").bind(tokenHash).first();
+            return row ? toStoredSession(row) : null;
+        },
+        async deleteByTokenHash(tokenHash) {
+            await db.prepare("DELETE FROM shtora_sessions WHERE token_hash = ?").bind(tokenHash).run();
+        },
+        async listByUserId(userId) {
+            const result = await db.prepare("SELECT id, token_hash, user_id, created_at_ms, expires_at_ms FROM shtora_sessions " +
+                "WHERE user_id = ? AND expires_at_ms > ? ORDER BY created_at_ms, id").bind(userId, Date.now()).all();
+            return (result.results ?? []).map(toStoredSession);
+        },
+        async deleteByIdForUser(id, userId) {
+            await db.prepare("DELETE FROM shtora_sessions WHERE id = ? AND user_id = ?").bind(id, userId).run();
+        },
+        async deleteByUserId(userId) {
+            await db.prepare("DELETE FROM shtora_sessions WHERE user_id = ?").bind(userId).run();
+        },
+        async deleteExpired({ nowMs, limit }) {
+            validateCleanupInput(nowMs, limit);
+            await db.prepare("DELETE FROM shtora_sessions WHERE rowid IN " +
+                "(SELECT rowid FROM shtora_sessions WHERE expires_at_ms <= ? ORDER BY expires_at_ms LIMIT ?)").bind(nowMs, limit).run();
+        },
+    };
+}
+function toStoredSession(row) {
+    return {
+        id: row.id,
+        tokenHash: row.token_hash,
+        userId: row.user_id,
+        createdAtMs: row.created_at_ms,
+        expiresAtMs: row.expires_at_ms,
+    };
+}
+export function createD1RateLimiter(db, options) {
+    validateWindow("email", options.email);
+    validateWindow("ip", options.ip);
+    const now = options.now ?? Date.now;
+    return {
+        async check({ action, email, ip }) {
+            const dimensions = [
+                { name: "email", raw: email, config: options.email },
+                { name: "ip", raw: ip, config: options.ip },
+            ];
+            const digests = await Promise.all(dimensions.map(({ name, raw }) => hashKey(`${action}\0${name}\0${raw}`)));
+            const timestamp = now();
+            const windows = dimensions.map(({ config }) => Math.floor(timestamp / (config.windowSeconds * 1000)) * config.windowSeconds * 1000);
+            const statements = dimensions.map((_, index) => db.prepare("INSERT INTO shtora_rate_limits (key_hash, window_start_ms, count) VALUES (?, ?, 1) " +
+                "ON CONFLICT(key_hash) DO UPDATE SET " +
+                "count = CASE WHEN shtora_rate_limits.window_start_ms < excluded.window_start_ms THEN 1 ELSE shtora_rate_limits.count + 1 END, " +
+                "window_start_ms = MAX(shtora_rate_limits.window_start_ms, excluded.window_start_ms) RETURNING count, window_start_ms").bind(digests[index], windows[index]));
+            const results = await db.batch(statements);
+            let retryAfterSeconds = 0;
+            for (let index = 0; index < dimensions.length; index += 1) {
+                const row = results[index]?.results?.[0];
+                if (!row || typeof row.count !== "number" || typeof row.window_start_ms !== "number") {
+                    throw new Error("D1 rate limiter did not return a counter value");
+                }
+                const dimension = dimensions[index];
+                if (row.count > dimension.config.limit) {
+                    const durationMs = dimension.config.windowSeconds * 1000;
+                    const remainingMs = row.window_start_ms + durationMs - timestamp;
+                    retryAfterSeconds = Math.max(retryAfterSeconds, Math.ceil(remainingMs / 1000), 1);
+                }
+            }
+            return retryAfterSeconds > 0
+                ? { allowed: false, retryAfterSeconds }
+                : { allowed: true };
+        },
+    };
+}
+function validateWindow(name, value) {
+    if (!Number.isSafeInteger(value.limit) || value.limit < 1) {
+        throw new RangeError(`${name} rate limit must be a positive safe integer`);
+    }
+    if (!Number.isSafeInteger(value.windowSeconds) || value.windowSeconds < 1 ||
+        value.windowSeconds > Math.floor(Number.MAX_SAFE_INTEGER / 1000)) {
+        throw new RangeError(`${name} rate limit windowSeconds must be a positive safe integer whose milliseconds are safe`);
+    }
+}
+export function createD1RequestRateLimiter(db, options) {
+    validateWindow("request", options);
+    const now = options.now ?? Date.now;
+    const durationMs = options.windowSeconds * 1000;
+    return {
+        async check({ action, ip }) {
+            const timestamp = now();
+            const windowStart = Math.floor(timestamp / durationMs) * durationMs;
+            const row = await db.prepare("INSERT INTO shtora_rate_limits (key_hash, window_start_ms, count) VALUES (?, ?, 1) " +
+                "ON CONFLICT(key_hash) DO UPDATE SET " +
+                "count = CASE WHEN shtora_rate_limits.window_start_ms < excluded.window_start_ms THEN 1 ELSE shtora_rate_limits.count + 1 END, " +
+                "window_start_ms = MAX(shtora_rate_limits.window_start_ms, excluded.window_start_ms) RETURNING count, window_start_ms").bind(await hashKey(`${action}\0request\0${ip}`), windowStart).first();
+            if (!row || typeof row.count !== "number" || typeof row.window_start_ms !== "number") {
+                throw new Error("D1 request rate limiter did not return a counter value");
+            }
+            if (row.count <= options.limit)
+                return { allowed: true };
+            const remainingMs = row.window_start_ms + durationMs - timestamp;
+            return { allowed: false, retryAfterSeconds: Math.max(Math.ceil(remainingMs / 1000), 1) };
+        },
+    };
+}
+function validateCleanupInput(nowMs, limit) {
+    if (!Number.isSafeInteger(nowMs) || nowMs < 0)
+        throw new RangeError("nowMs must be a non-negative safe integer");
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) {
+        throw new RangeError("limit must be between 1 and 1000");
+    }
+}
+export async function cleanupD1AuthState(db, options) {
+    const nowMs = options.nowMs ?? Date.now();
+    const batchSize = options.batchSize ?? 500;
+    if (!Number.isSafeInteger(nowMs) || nowMs < 0)
+        throw new RangeError("nowMs must be a non-negative safe integer");
+    validateWindow("rate-limit cleanup", { limit: 1, windowSeconds: options.rateLimitMaxWindowSeconds });
+    if (!Number.isSafeInteger(batchSize) || batchSize < 1 || batchSize > 1000) {
+        throw new RangeError("batchSize must be between 1 and 1000");
+    }
+    const rateLimitCutoff = nowMs - options.rateLimitMaxWindowSeconds * 1000;
+    await db.batch([
+        db.prepare("DELETE FROM shtora_sessions WHERE rowid IN " +
+            "(SELECT rowid FROM shtora_sessions WHERE expires_at_ms <= ? ORDER BY expires_at_ms LIMIT ?)").bind(nowMs, batchSize),
+        db.prepare("DELETE FROM shtora_action_tokens WHERE rowid IN " +
+            "(SELECT rowid FROM shtora_action_tokens WHERE expires_at_ms <= ? ORDER BY expires_at_ms LIMIT ?)").bind(nowMs, batchSize),
+        db.prepare("DELETE FROM shtora_rate_limits WHERE rowid IN " +
+            "(SELECT rowid FROM shtora_rate_limits WHERE window_start_ms < ? ORDER BY window_start_ms LIMIT ?)").bind(rateLimitCutoff, batchSize),
+    ]);
+}
+async function hashKey(value) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/dist/cookies.d.ts

@@ -0,0 +1,3 @@
+export declare function readSessionToken(cookieHeader: string | null, cookieName: string): string | null;
+export declare function sessionCookie(token: string, cookieName: string, ttlSeconds: number, now: number): string;
+export declare function clearedSessionCookie(cookieName: string): string;

package/dist/cookies.js

@@ -0,0 +1,25 @@
+const tokenPattern = /^[a-f0-9]{64}$/;
+export function readSessionToken(cookieHeader, cookieName) {
+    if (!cookieHeader || cookieHeader.length > 16_384)
+        return null;
+    let token = null;
+    for (const part of cookieHeader.split(";")) {
+        const separator = part.indexOf("=");
+        if (separator < 0 || part.slice(0, separator).trim() !== cookieName)
+            continue;
+        if (token !== null)
+            return null;
+        const value = part.slice(separator + 1).trim();
+        if (!tokenPattern.test(value))
+            return null;
+        token = value;
+    }
+    return token;
+}
+export function sessionCookie(token, cookieName, ttlSeconds, now) {
+    const expires = new Date(now + ttlSeconds * 1000).toUTCString();
+    return `${cookieName}=${token}; Max-Age=${ttlSeconds}; Expires=${expires}; Path=/; HttpOnly; Secure; SameSite=Lax`;
+}
+export function clearedSessionCookie(cookieName) {
+    return `${cookieName}=; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=/; HttpOnly; Secure; SameSite=Lax`;
+}

package/dist/crypto.d.ts

@@ -0,0 +1,2 @@
+export declare function createSessionToken(): string;
+export declare function hashSessionToken(token: string): Promise<string>;

package/dist/crypto.js

@@ -0,0 +1,10 @@
+const encoder = new TextEncoder();
+export function createSessionToken() {
+    const bytes = new Uint8Array(32);
+    globalThis.crypto.getRandomValues(bytes);
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+export async function hashSessionToken(token) {
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", encoder.encode(token));
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { createAuth } from "./auth.js";
+export type { AccessPolicy, AuthActionTokenDelivery, AuthActionTokenPurpose, AuthActionTokenStore, AuthApi, AuthenticatedUser, AuthOptions, AuthRateLimiter, AuthRequestRateLimitAction, AuthRequestRateLimiter, AuthUser, CredentialVerifier, EmailVerificationOptions, ExpiredRecordStore, PasswordResetOptions, SessionStore, StoredSession, UserStore, } from "./types.js";

package/dist/index.js

@@ -0,0 +1 @@
+export { createAuth } from "./auth.js";

package/dist/oidc.d.ts

@@ -0,0 +1,44 @@
+import type { AuthApi, AuthRequestRateLimiter, AuthUser, ExpiredRecordStore } from "./types.js";
+export interface OidcTransaction {
+    readonly state: string;
+    readonly codeVerifier: string;
+    readonly nonce: string;
+    readonly expiresAtMs: number;
+}
+/** Stores must consume atomically and delete at most the requested number of expired records per cleanup call. */
+export interface OidcTransactionStore extends ExpiredRecordStore {
+    create(transaction: OidcTransaction): Promise<void>;
+    consume(input: {
+        state: string;
+        nowMs: number;
+    }): Promise<OidcTransaction | null>;
+}
+export interface OidcHandler {
+    (request: Request): Promise<Response>;
+    cleanupExpired(): Promise<void>;
+}
+export interface OidcConfig<User extends AuthUser> {
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly clientSecret?: string;
+    /** Absolute, pre-registered callback URL. */
+    readonly callbackUrl: string;
+    /** Fixed same-origin path after success, e.g. "/account". */
+    readonly successPath: string;
+    readonly transactions: OidcTransactionStore;
+    readonly resolveUser: (identity: {
+        issuer: string;
+        subject: string;
+    }) => Promise<User | null>;
+    readonly auth: Pick<AuthApi, "createSessionResponse">;
+    readonly resolveClientIp: (request: Request) => string | null | Promise<string | null>;
+    readonly rateLimiter: AuthRequestRateLimiter;
+    readonly transactionTtlSeconds?: number;
+    readonly scope?: string;
+    readonly onError?: (input: {
+        operation: "start" | "callback" | "cleanup";
+        error: unknown;
+    }) => void | Promise<void>;
+}
+/** Creates a Web-Request handler for GET /start and GET /callback. */
+export declare function createOidc<User extends AuthUser>(options: OidcConfig<User>): OidcHandler;

package/dist/oidc.js

@@ -0,0 +1,192 @@
+import * as oidc from "openid-client";
+const cookieName = "__Host-shtora.oidc-state";
+const defaultTtlSeconds = 600;
+/** Creates a Web-Request handler for GET /start and GET /callback. */
+export function createOidc(options) {
+    const issuerUrl = new URL(options.issuer);
+    const callbackUrl = new URL(options.callbackUrl);
+    if (issuerUrl.protocol !== "https:" || issuerUrl.username || issuerUrl.password || issuerUrl.search || issuerUrl.hash) {
+        throw new TypeError("issuer must be an HTTPS issuer URL without credentials, query, or fragment");
+    }
+    if (callbackUrl.protocol !== "https:" || callbackUrl.username || callbackUrl.password || callbackUrl.search || callbackUrl.hash) {
+        throw new TypeError("callbackUrl must be an HTTPS URL without credentials, query, or fragment");
+    }
+    if (!options.successPath.startsWith("/") || options.successPath.startsWith("//") || /[?#\\]/.test(options.successPath)) {
+        throw new TypeError("successPath must be a fixed absolute same-origin path");
+    }
+    const ttl = options.transactionTtlSeconds ?? defaultTtlSeconds;
+    if (!Number.isInteger(ttl) || ttl < 1 || ttl > 3600)
+        throw new RangeError("transactionTtlSeconds must be between 1 and 3600");
+    let configPromise;
+    const getConfig = async () => {
+        configPromise ??= oidc.discovery(issuerUrl, options.clientId, options.clientSecret);
+        try {
+            return await configPromise;
+        }
+        catch (error) {
+            configPromise = undefined;
+            throw error;
+        }
+    };
+    const cookie = (state, maxAge) => `${cookieName}=${state}; Path=/; Max-Age=${maxAge}; Secure; HttpOnly; SameSite=Lax`;
+    const clearCookie = `${cookieName}=; Path=/; Max-Age=0; Secure; HttpOnly; SameSite=Lax`;
+    const readStateCookie = (request) => {
+        let found = null;
+        for (const value of (request.headers.get("cookie") ?? "").split(";")) {
+            const pair = value.trim();
+            const equals = pair.indexOf("=");
+            if (equals < 0 || pair.slice(0, equals) !== cookieName)
+                continue;
+            if (found !== null)
+                return null;
+            found = pair.slice(equals + 1);
+        }
+        return found;
+    };
+    const callbackRequestUrl = (request) => {
+        const host = request.headers.get("host");
+        if (host) {
+            try {
+                const requestAuthority = new URL(`https://${host}`);
+                if (requestAuthority.host !== callbackUrl.host || requestAuthority.username || requestAuthority.password ||
+                    requestAuthority.pathname !== "/" || requestAuthority.search || requestAuthority.hash)
+                    return null;
+            }
+            catch {
+                return null;
+            }
+        }
+        const incoming = new URL(request.url);
+        if (incoming.pathname !== callbackUrl.pathname)
+            return null;
+        const callback = new URL(options.callbackUrl);
+        const allowed = new Set(["code", "state", "iss", "error", "error_description", "error_uri", "session_state"]);
+        for (const key of new Set(incoming.searchParams.keys())) {
+            const values = incoming.searchParams.getAll(key);
+            if (!allowed.has(key) || values.length !== 1)
+                return null;
+            callback.searchParams.set(key, values[0]);
+        }
+        return callback;
+    };
+    const report = async (operation, error) => {
+        try {
+            await options.onError?.({ operation, error });
+        }
+        catch { /* observer failures do not affect the response */ }
+    };
+    const failure = (headers, status = 400) => new Response("Sign-in failed", {
+        status,
+        headers: { "Cache-Control": "no-store", "Content-Type": "text/plain; charset=utf-8", ...Object.fromEntries(new Headers(headers)) },
+    });
+    const rateLimited = async (action, request, headers) => {
+        try {
+            const ip = await options.resolveClientIp(request);
+            const decision = ip ? await options.rateLimiter.check({ action, ip }) : { allowed: false, retryAfterSeconds: 60 };
+            if (decision.allowed)
+                return null;
+            const seconds = Number.isSafeInteger(decision.retryAfterSeconds) && decision.retryAfterSeconds > 0
+                ? decision.retryAfterSeconds
+                : 60;
+            const responseHeaders = new Headers(headers);
+            responseHeaders.set("Retry-After", String(seconds));
+            return failure(responseHeaders, 429);
+        }
+        catch (error) {
+            await report(action === "oidc-start" ? "start" : "callback", error);
+            return failure(headers, 503);
+        }
+    };
+    const handler = async (request) => {
+        const current = new URL(request.url);
+        if (request.method !== "GET")
+            return new Response("Method not allowed", { status: 405, headers: { Allow: "GET", "Cache-Control": "no-store" } });
+        if (current.pathname === new URL(options.callbackUrl).pathname) {
+            const headers = new Headers({ "Cache-Control": "no-store", "Set-Cookie": clearCookie });
+            try {
+                const limited = await rateLimited("oidc-callback", request, headers);
+                if (limited)
+                    return limited;
+                const callbackRequest = callbackRequestUrl(request);
+                if (!callbackRequest)
+                    return failure(headers);
+                const state = callbackRequest.searchParams.get("state");
+                const browserState = readStateCookie(request);
+                if (!state || !browserState || state !== browserState)
+                    return failure(headers);
+                const transaction = await options.transactions.consume({ state, nowMs: Date.now() });
+                if (!transaction || transaction.state !== state || transaction.expiresAtMs <= Date.now())
+                    return failure(headers);
+                const client = await getConfig();
+                const tokens = await oidc.authorizationCodeGrant(client, callbackRequest, {
+                    pkceCodeVerifier: transaction.codeVerifier,
+                    expectedState: transaction.state,
+                    expectedNonce: transaction.nonce,
+                    idTokenExpected: true,
+                }, { redirect_uri: options.callbackUrl });
+                const claims = tokens.claims();
+                if (!claims?.sub || claims.iss !== issuerUrl.href)
+                    return failure(headers);
+                const user = await options.resolveUser({ issuer: claims.iss, subject: claims.sub });
+                if (!user)
+                    return failure(headers);
+                const sessionResponse = await options.auth.createSessionResponse(request, user.id);
+                if (sessionResponse.status !== 200) {
+                    return failure(headers, sessionResponse.status >= 500 ? 500 : 400);
+                }
+                const responseHeaders = new Headers(sessionResponse.headers);
+                responseHeaders.append("Set-Cookie", clearCookie);
+                responseHeaders.set("Location", new URL(options.successPath, callbackUrl.origin).href);
+                responseHeaders.set("Cache-Control", "no-store");
+                return new Response(null, { status: 303, headers: responseHeaders });
+            }
+            catch (error) {
+                await report("callback", error);
+                return failure(headers);
+            }
+        }
+        if (current.pathname !== new URL(callbackUrl.origin + "/start").pathname) {
+            return new Response("Not found", { status: 404, headers: { "Cache-Control": "no-store" } });
+        }
+        try {
+            const limited = await rateLimited("oidc-start", request);
+            if (limited)
+                return limited;
+            const state = oidc.randomState();
+            const nonce = oidc.randomNonce();
+            const codeVerifier = oidc.randomPKCECodeVerifier();
+            const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
+            await options.transactions.create({ state, nonce, codeVerifier, expiresAtMs: Date.now() + ttl * 1000 });
+            const client = await getConfig();
+            const destination = oidc.buildAuthorizationUrl(client, {
+                redirect_uri: options.callbackUrl,
+                scope: options.scope ?? "openid email",
+                state,
+                nonce,
+                code_challenge: codeChallenge,
+                code_challenge_method: "S256",
+            });
+            return new Response(null, { status: 302, headers: {
+                    Location: destination.href,
+                    "Set-Cookie": cookie(state, ttl),
+                    "Cache-Control": "no-store",
+                    "Referrer-Policy": "no-referrer",
+                } });
+        }
+        catch (error) {
+            await report("start", error);
+            return failure();
+        }
+    };
+    return Object.assign(handler, {
+        async cleanupExpired() {
+            try {
+                await options.transactions.deleteExpired({ nowMs: Date.now(), limit: 500 });
+            }
+            catch (error) {
+                await report("cleanup", error);
+                throw error;
+            }
+        },
+    });
+}

package/dist/request.d.ts

@@ -0,0 +1,18 @@
+export declare class RequestError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string);
+}
+export declare function readJson(request: Request, maxBytes: number): Promise<unknown>;
+export declare function parseEmailRequest(value: unknown): string;
+export declare function parseActionTokenRequest(value: unknown): string;
+export declare function parseEmail(value: unknown): string;
+export declare function parseActionToken(value: unknown): string;
+export declare function parseCredentials(value: unknown): {
+    email: string;
+    password: string;
+};
+export declare function parsePasswordReset(value: unknown): {
+    token: string;
+    password: string;
+};

package/dist/request.js

@@ -0,0 +1,93 @@
+export class RequestError extends Error {
+    status;
+    code;
+    constructor(status, code) {
+        super(code);
+        this.status = status;
+        this.code = code;
+    }
+}
+export async function readJson(request, maxBytes) {
+    const contentType = request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+    if (contentType !== "application/json")
+        throw new RequestError(415, "unsupported_media_type");
+    const declaredLength = request.headers.get("content-length");
+    if (declaredLength !== null) {
+        const length = Number(declaredLength);
+        if (!Number.isSafeInteger(length) || length < 0)
+            throw new RequestError(400, "invalid_request");
+        if (length > maxBytes)
+            throw new RequestError(413, "request_too_large");
+    }
+    if (!request.body)
+        throw new RequestError(400, "invalid_request");
+    const reader = request.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > maxBytes) {
+                await reader.cancel();
+                throw new RequestError(413, "request_too_large");
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new RequestError(400, "invalid_request");
+    }
+}
+function objectFields(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new RequestError(400, "invalid_request");
+    }
+    return value;
+}
+export function parseEmailRequest(value) {
+    return parseEmail(objectFields(value).email);
+}
+export function parseActionTokenRequest(value) {
+    return parseActionToken(objectFields(value).token);
+}
+export function parseEmail(value) {
+    if (typeof value !== "string" || value.length > 254 || !value.includes("@") || /\s/.test(value)) {
+        throw new RequestError(400, "invalid_request");
+    }
+    return value.trim().toLowerCase();
+}
+export function parseActionToken(value) {
+    if (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) {
+        throw new RequestError(400, "invalid_request");
+    }
+    return value;
+}
+export function parseCredentials(value) {
+    const { email, password } = objectFields(value);
+    if (typeof password !== "string" || password.length === 0 || password.length > 4096) {
+        throw new RequestError(400, "invalid_request");
+    }
+    return { email: parseEmail(email), password };
+}
+export function parsePasswordReset(value) {
+    const { token, password } = objectFields(value);
+    if (typeof password !== "string" || password.length === 0 || password.length > 4096) {
+        throw new RequestError(400, "invalid_request");
+    }
+    return { token: parseActionToken(token), password };
+}