@shware/security 1.0.0 → 1.1.1

package/dist/auth/index.cjs

@@ -38,7 +38,9 @@ var import_tiny_invariant = __toESM(require("tiny-invariant"), 1);
 var import_session = require("../session/index.cjs");
 var import_http = require("../utils/http.cjs");
 var import_client = require("../oauth2/client.cjs");
+var import_timing = require("../utils/timing.cjs");
 var Auth = class {
+  timing;
   cookieName;
   cookieOptions;
   repository;
@@ -51,7 +53,8 @@ var Auth = class {
   PATH_LOGIN_OAUTH2_CODE = "/login/oauth2/code/:registrationId";
   PATH_LOGIN_OAUTH2_NATIVE = "/login/oauth2/native/:registrationId";
   ATTR_OAUTH2_AUTHORIZATION_REQUEST = "oauth2AuthorizationRequest";
-  constructor({ repository, oauth2, cookie }) {
+  constructor({ repository, oauth2, cookie, timing: timing2 }) {
+    this.timing = timing2 ?? false;
     this.repository = repository;
     const { name, ...cookieOptions } = cookie ?? {};
     this.cookieName = name ?? "SESSION";
@@ -110,12 +113,14 @@ var Auth = class {
   };
   oauth2Authorization = async (request) => {
     (0, import_tiny_invariant.default)(this.oauth2Client, "oauth2Client is not initialized");
+    const { mark, setTiming } = (0, import_timing.timing)({ enabled: this.timing });
     const { registrationId } = (0, import_http.param)(request, this.PATH_OAUTH2_AUTHORIZATION);
     const state = (0, import_crypto.randomUUID)();
     const pkce = this.createPkceParameters();
     const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });
     const sessionId = (0, import_http.getCookie)(request, this.cookieName);
     const session = sessionId ? await this.repository.findById(sessionId) ?? this.repository.createSession() : this.repository.createSession();
+    mark("fetch_session");
     const authorizationRequest = {
       state,
       registrationId,
@@ -125,9 +130,11 @@ var Auth = class {
     const value = JSON.stringify(authorizationRequest);
     session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);
     await this.repository.save(session);
+    mark("save_session");
     const response = new Response(null, { status: 302, headers: { location: uri.href } });
     const maxAge = session.getMaxInactiveInterval();
     (0, import_http.setCookie)(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });
+    setTiming(response);
     return response;
   };
   redirect = (error, description) => {
@@ -139,11 +146,13 @@ var Auth = class {
   };
   loginOAuth2Code = async (request, onAuthorized) => {
     (0, import_tiny_invariant.default)(this.oauth2Client, "oauth2Client is not initialized");
+    const { mark, setTiming } = (0, import_timing.timing)({ enabled: this.timing });
     const sessionId = (0, import_http.getCookie)(request, this.cookieName);
     const session = sessionId ? await this.repository.findById(sessionId) : null;
     if (!session) {
       return this.redirect("invalid_request", "session not found");
     }
+    mark("load_session");
     const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);
     if (!json) {
       return this.redirect("invalid_request", "authorization request not  found");
@@ -170,6 +179,7 @@ var Auth = class {
     if (registrationId !== cached.registrationId) {
       return this.redirect("invalid_request", "redirect registration mismatch");
     }
+    mark("validate_session");
     const { code } = parsed.data;
     const token = await this.oauth2Client.exchangeAuthorizationCode({
       registrationId,
@@ -177,21 +187,26 @@ var Auth = class {
       pkce: cached.additionalParameters
     });
     const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });
+    mark("exchange_code");
     const principal = await onAuthorized(request, registrationId, userInfo, token);
+    mark("save_principal");
     session.setLastAccessedTime(Date.now());
     session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);
     session.setAttribute(import_session.PRINCIPAL_NAME_INDEX_NAME, principal.name);
     await this.repository.save(session);
+    mark("update_session");
     const response = new Response(null, {
       status: 302,
       headers: { location: this.oauth2Client.successUri }
     });
     const maxAge = session.getMaxInactiveInterval();
     (0, import_http.setCookie)(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });
+    setTiming(response);
     return response;
   };
   loginOAuth2Native = async (request, onAuthorized) => {
     (0, import_tiny_invariant.default)(this.oauth2Client, "oauth2Client is not initialized");
+    const { mark, setTiming } = (0, import_timing.timing)({ enabled: this.timing });
     const { registrationId } = (0, import_http.param)(request, this.PATH_LOGIN_OAUTH2_NATIVE);
     const credentials = await request.json();
     const key = this.getOauth2StateKey(credentials.state);
@@ -204,6 +219,7 @@ var Auth = class {
       const json = { error: "invalid_request", error_description: "registration mismatch" };
       return Response.json(json, { status: 400 });
     }
+    mark("validate_state");
     const pkce = {
       code_verifier: cached.code_verifier,
       code_challenge: cached.code_challenge,
@@ -214,7 +230,9 @@ var Auth = class {
       credentials,
       pkce
     });
+    mark("login_oauth2_native");
     const principal = await onAuthorized(request, registrationId, userInfo, token);
+    mark("save_principal");
     const session = this.repository.createSession();
     session.setAttribute(import_session.PRINCIPAL_NAME_INDEX_NAME, principal.name);
     await this.repository.save(session);
@@ -224,6 +242,7 @@ var Auth = class {
     });
     const maxAge = session.getMaxInactiveInterval();
     (0, import_http.setCookie)(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });
+    setTiming(response);
     return response;
   };
 };

package/dist/auth/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME, type SessionRepository } from '../session/index';\nimport {\n  param,\n  query,\n  getCookie,\n  setCookie,\n  deleteCookie,\n  type CookieOptions,\n} from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredentials,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n} from '../oauth2/types';\nimport type {\n  AuthConfig,\n  AuthService,\n  LoggedHandler,\n  OAuth2AuthorizedHandler,\n  OAuth2State,\n} from './types';\n\nexport class Auth implements AuthService {\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly repository: SessionRepository;\n  private readonly oauth2Client: OAuth2Client | null;\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n\n  public readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({ repository, oauth2, cookie }: AuthConfig) {\n    this.repository = repository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const state = randomUUID();\n    const nonce = randomUUID();\n    const pkce = this.createPkceParameters();\n    const value: OAuth2State = { state, nonce, registrationId, ...pkce };\n    await this.repository.setItem(this.getOauth2StateKey(state), value, 10 * 60);\n    return Response.json({\n      state,\n      nonce,\n      code_challenge: pkce.code_challenge,\n      code_challenge_method: pkce.code_challenge_method,\n    });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredentials;\n    const key = this.getOauth2StateKey(credentials.state);\n    const cached = await this.repository.getItem<OAuth2State>(key);\n    if (!cached) {\n      const json = { error: 'invalid_request', error_description: 'oauth2 state not found' };\n      return Response.json(json, { status: 400 });\n    }\n    if (cached.registrationId !== registrationId) {\n      const json = { error: 'invalid_request', error_description: 'registration mismatch' };\n      return Response.json(json, { status: 400 });\n    }\n    const pkce = {\n      code_verifier: cached.code_verifier,\n      code_challenge: cached.code_challenge,\n      code_challenge_method: cached.code_challenge_method,\n    };\n\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n      pkce,\n    });\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAuC;AACvC,4BAAsB;AACtB,qBAAkE;AAClE,kBAOO;AACP,oBAAwD;AAejD,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAED,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAE3B,oCAAoC;AAAA,EAEpD,YAAY,EAAE,YAAY,QAAQ,OAAO,GAAe;AACtD,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,2BAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,kCAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,wCAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AAEvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,oBAAgB,0BAAW;AACjC,UAAM,qBAAiB,0BAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,iBAAiB;AAChE,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,YAAQ,0BAAW;AACzB,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,QAAqB,EAAE,OAAO,OAAO,gBAAgB,GAAG,KAAK;AACnE,UAAM,KAAK,WAAW,QAAQ,KAAK,kBAAkB,KAAK,GAAG,OAAO,KAAK,EAAE;AAC3E,WAAO,SAAS,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,uBAAuB,KAAK;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAElC,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAElC,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAG9D,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AAGA,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,iBAAO,mBAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,wCAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AAGA,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAG9E,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAG7E,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,0CAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAElC,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,MAAM,KAAK,kBAAkB,YAAY,KAAK;AACpD,UAAM,SAAS,MAAM,KAAK,WAAW,QAAqB,GAAG;AAC7D,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,yBAAyB;AACrF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,QAAI,OAAO,mBAAmB,gBAAgB;AAC5C,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,wBAAwB;AACpF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,UAAM,OAAO;AAAA,MACX,eAAe,OAAO;AAAA,MACtB,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,0CAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AACF;","names":["invariant"]}
+{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME, type SessionRepository } from '../session/index';\nimport {\n  param,\n  query,\n  getCookie,\n  setCookie,\n  deleteCookie,\n  type CookieOptions,\n} from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredentials,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n} from '../oauth2/types';\nimport type {\n  AuthConfig,\n  AuthService,\n  LoggedHandler,\n  OAuth2AuthorizedHandler,\n  OAuth2State,\n} from './types';\nimport { timing } from '../utils/timing';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly repository: SessionRepository;\n  private readonly oauth2Client: OAuth2Client | null;\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n\n  public readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({ repository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.repository = repository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const state = randomUUID();\n    const nonce = randomUUID();\n    const pkce = this.createPkceParameters();\n    const value: OAuth2State = { state, nonce, registrationId, ...pkce };\n    await this.repository.setItem(this.getOauth2StateKey(state), value, 10 * 60);\n    return Response.json({\n      state,\n      nonce,\n      code_challenge: pkce.code_challenge,\n      code_challenge_method: pkce.code_challenge_method,\n    });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n    mark('validate_session');\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('exchange_code');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredentials;\n    const key = this.getOauth2StateKey(credentials.state);\n    const cached = await this.repository.getItem<OAuth2State>(key);\n    if (!cached) {\n      const json = { error: 'invalid_request', error_description: 'oauth2 state not found' };\n      return Response.json(json, { status: 400 });\n    }\n    if (cached.registrationId !== registrationId) {\n      const json = { error: 'invalid_request', error_description: 'registration mismatch' };\n      return Response.json(json, { status: 400 });\n    }\n    mark('validate_state');\n\n    const pkce = {\n      code_verifier: cached.code_verifier,\n      code_challenge: cached.code_challenge,\n      code_challenge_method: cached.code_challenge_method,\n    };\n\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n      pkce,\n    });\n    mark('login_oauth2_native');\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAuC;AACvC,4BAAsB;AACtB,qBAAkE;AAClE,kBAOO;AACP,oBAAwD;AAcxD,oBAAuB;AAEhB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAED,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAE3B,oCAAoC;AAAA,EAEpD,YAAY,EAAE,YAAY,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AAC9D,SAAK,SAASA,WAAU;AACxB,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,2BAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,kCAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,wCAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,oBAAgB,0BAAW;AACjC,UAAM,qBAAiB,0BAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,iBAAiB;AAChE,8BAAAC,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,YAAQ,0BAAW;AACzB,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,QAAqB,EAAE,OAAO,OAAO,gBAAgB,GAAG,KAAK;AACnE,UAAM,KAAK,WAAW,QAAQ,KAAK,kBAAkB,KAAK,GAAG,OAAO,KAAK,EAAE;AAC3E,WAAO,SAAS,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,uBAAuB,KAAK;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,iBAAO,mBAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,wCAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AACA,SAAK,kBAAkB;AAGvB,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,eAAe;AAGpB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,0CAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,MAAM,KAAK,kBAAkB,YAAY,KAAK;AACpD,UAAM,SAAS,MAAM,KAAK,WAAW,QAAqB,GAAG;AAC7D,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,yBAAyB;AACrF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,QAAI,OAAO,mBAAmB,gBAAgB;AAC5C,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,wBAAwB;AACpF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,SAAK,gBAAgB;AAErB,UAAM,OAAO;AAAA,MACX,eAAe,OAAO;AAAA,MACtB,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,0CAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AACF;","names":["timing","invariant"]}

package/dist/auth/index.d.cts

@@ -6,6 +6,7 @@ import '../utils/http.cjs';
 import 'cookie';
 
 declare class Auth implements AuthService {
+    private readonly timing;
     private readonly cookieName;
     private readonly cookieOptions;
     private readonly repository;
@@ -18,7 +19,7 @@ declare class Auth implements AuthService {
     readonly PATH_LOGIN_OAUTH2_CODE: "/login/oauth2/code/:registrationId";
     readonly PATH_LOGIN_OAUTH2_NATIVE: "/login/oauth2/native/:registrationId";
     readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = "oauth2AuthorizationRequest";
-    constructor({ repository, oauth2, cookie }: AuthConfig);
+    constructor({ repository, oauth2, cookie, timing }: AuthConfig);
     logout: (request: Request) => Promise<Response>;
     logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;
     private createPkceParameters;

package/dist/auth/index.d.ts

@@ -6,6 +6,7 @@ import '../utils/http.js';
 import 'cookie';
 
 declare class Auth implements AuthService {
+    private readonly timing;
     private readonly cookieName;
     private readonly cookieOptions;
     private readonly repository;
@@ -18,7 +19,7 @@ declare class Auth implements AuthService {
     readonly PATH_LOGIN_OAUTH2_CODE: "/login/oauth2/code/:registrationId";
     readonly PATH_LOGIN_OAUTH2_NATIVE: "/login/oauth2/native/:registrationId";
     readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = "oauth2AuthorizationRequest";
-    constructor({ repository, oauth2, cookie }: AuthConfig);
+    constructor({ repository, oauth2, cookie, timing }: AuthConfig);
     logout: (request: Request) => Promise<Response>;
     logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;
     private createPkceParameters;

package/dist/auth/index.mjs

@@ -10,7 +10,9 @@ import {
   deleteCookie
 } from "../utils/http.mjs";
 import { OAuth2Client, oauth2RedirectQuerySchema } from "../oauth2/client.mjs";
+import { timing } from "../utils/timing.mjs";
 var Auth = class {
+  timing;
   cookieName;
   cookieOptions;
   repository;
@@ -23,7 +25,8 @@ var Auth = class {
   PATH_LOGIN_OAUTH2_CODE = "/login/oauth2/code/:registrationId";
   PATH_LOGIN_OAUTH2_NATIVE = "/login/oauth2/native/:registrationId";
   ATTR_OAUTH2_AUTHORIZATION_REQUEST = "oauth2AuthorizationRequest";
-  constructor({ repository, oauth2, cookie }) {
+  constructor({ repository, oauth2, cookie, timing: timing2 }) {
+    this.timing = timing2 ?? false;
     this.repository = repository;
     const { name, ...cookieOptions } = cookie ?? {};
     this.cookieName = name ?? "SESSION";
@@ -82,12 +85,14 @@ var Auth = class {
   };
   oauth2Authorization = async (request) => {
     invariant(this.oauth2Client, "oauth2Client is not initialized");
+    const { mark, setTiming } = timing({ enabled: this.timing });
     const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);
     const state = randomUUID();
     const pkce = this.createPkceParameters();
     const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });
     const sessionId = getCookie(request, this.cookieName);
     const session = sessionId ? await this.repository.findById(sessionId) ?? this.repository.createSession() : this.repository.createSession();
+    mark("fetch_session");
     const authorizationRequest = {
       state,
       registrationId,
@@ -97,9 +102,11 @@ var Auth = class {
     const value = JSON.stringify(authorizationRequest);
     session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);
     await this.repository.save(session);
+    mark("save_session");
     const response = new Response(null, { status: 302, headers: { location: uri.href } });
     const maxAge = session.getMaxInactiveInterval();
     setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });
+    setTiming(response);
     return response;
   };
   redirect = (error, description) => {
@@ -111,11 +118,13 @@ var Auth = class {
   };
   loginOAuth2Code = async (request, onAuthorized) => {
     invariant(this.oauth2Client, "oauth2Client is not initialized");
+    const { mark, setTiming } = timing({ enabled: this.timing });
     const sessionId = getCookie(request, this.cookieName);
     const session = sessionId ? await this.repository.findById(sessionId) : null;
     if (!session) {
       return this.redirect("invalid_request", "session not found");
     }
+    mark("load_session");
     const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);
     if (!json) {
       return this.redirect("invalid_request", "authorization request not  found");
@@ -142,6 +151,7 @@ var Auth = class {
     if (registrationId !== cached.registrationId) {
       return this.redirect("invalid_request", "redirect registration mismatch");
     }
+    mark("validate_session");
     const { code } = parsed.data;
     const token = await this.oauth2Client.exchangeAuthorizationCode({
       registrationId,
@@ -149,21 +159,26 @@ var Auth = class {
       pkce: cached.additionalParameters
     });
     const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });
+    mark("exchange_code");
     const principal = await onAuthorized(request, registrationId, userInfo, token);
+    mark("save_principal");
     session.setLastAccessedTime(Date.now());
     session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);
     session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);
     await this.repository.save(session);
+    mark("update_session");
     const response = new Response(null, {
       status: 302,
       headers: { location: this.oauth2Client.successUri }
     });
     const maxAge = session.getMaxInactiveInterval();
     setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });
+    setTiming(response);
     return response;
   };
   loginOAuth2Native = async (request, onAuthorized) => {
     invariant(this.oauth2Client, "oauth2Client is not initialized");
+    const { mark, setTiming } = timing({ enabled: this.timing });
     const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);
     const credentials = await request.json();
     const key = this.getOauth2StateKey(credentials.state);
@@ -176,6 +191,7 @@ var Auth = class {
       const json = { error: "invalid_request", error_description: "registration mismatch" };
       return Response.json(json, { status: 400 });
     }
+    mark("validate_state");
     const pkce = {
       code_verifier: cached.code_verifier,
       code_challenge: cached.code_challenge,
@@ -186,7 +202,9 @@ var Auth = class {
       credentials,
       pkce
     });
+    mark("login_oauth2_native");
     const principal = await onAuthorized(request, registrationId, userInfo, token);
+    mark("save_principal");
     const session = this.repository.createSession();
     session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);
     await this.repository.save(session);
@@ -196,6 +214,7 @@ var Auth = class {
     });
     const maxAge = session.getMaxInactiveInterval();
     setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });
+    setTiming(response);
     return response;
   };
 };

package/dist/auth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME, type SessionRepository } from '../session/index';\nimport {\n  param,\n  query,\n  getCookie,\n  setCookie,\n  deleteCookie,\n  type CookieOptions,\n} from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredentials,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n} from '../oauth2/types';\nimport type {\n  AuthConfig,\n  AuthService,\n  LoggedHandler,\n  OAuth2AuthorizedHandler,\n  OAuth2State,\n} from './types';\n\nexport class Auth implements AuthService {\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly repository: SessionRepository;\n  private readonly oauth2Client: OAuth2Client | null;\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n\n  public readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({ repository, oauth2, cookie }: AuthConfig) {\n    this.repository = repository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const state = randomUUID();\n    const nonce = randomUUID();\n    const pkce = this.createPkceParameters();\n    const value: OAuth2State = { state, nonce, registrationId, ...pkce };\n    await this.repository.setItem(this.getOauth2StateKey(state), value, 10 * 60);\n    return Response.json({\n      state,\n      nonce,\n      code_challenge: pkce.code_challenge,\n      code_challenge_method: pkce.code_challenge_method,\n    });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredentials;\n    const key = this.getOauth2StateKey(credentials.state);\n    const cached = await this.repository.getItem<OAuth2State>(key);\n    if (!cached) {\n      const json = { error: 'invalid_request', error_description: 'oauth2 state not found' };\n      return Response.json(json, { status: 400 });\n    }\n    if (cached.registrationId !== registrationId) {\n      const json = { error: 'invalid_request', error_description: 'registration mismatch' };\n      return Response.json(json, { status: 400 });\n    }\n    const pkce = {\n      code_verifier: cached.code_verifier,\n      code_challenge: cached.code_challenge,\n      code_challenge_method: cached.code_challenge_method,\n    };\n\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n      pkce,\n    });\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n}\n"],"mappings":";AAAA,SAAS,YAAY,kBAAkB;AACvC,OAAO,eAAe;AACtB,SAAS,iCAAyD;AAClE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,cAAc,iCAAiC;AAejD,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAED,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAE3B,oCAAoC;AAAA,EAEpD,YAAY,EAAE,YAAY,QAAQ,OAAO,GAAe;AACtD,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,aAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,iBAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,yBAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AAEvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,gBAAgB,WAAW;AACjC,UAAM,iBAAiB,WAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,iBAAiB;AAChE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,QAAQ,WAAW;AACzB,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,QAAqB,EAAE,OAAO,OAAO,gBAAgB,GAAG,KAAK;AACnE,UAAM,KAAK,WAAW,QAAQ,KAAK,kBAAkB,KAAK,GAAG,OAAO,KAAK,EAAE;AAC3E,WAAO,SAAS,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,uBAAuB,KAAK;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAElC,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAElC,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAG9D,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AAGA,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,aAAO,MAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AAGA,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAG9E,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAG7E,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAElC,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,MAAM,KAAK,kBAAkB,YAAY,KAAK;AACpD,UAAM,SAAS,MAAM,KAAK,WAAW,QAAqB,GAAG;AAC7D,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,yBAAyB;AACrF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,QAAI,OAAO,mBAAmB,gBAAgB;AAC5C,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,wBAAwB;AACpF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,UAAM,OAAO;AAAA,MACX,eAAe,OAAO;AAAA,MACtB,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME, type SessionRepository } from '../session/index';\nimport {\n  param,\n  query,\n  getCookie,\n  setCookie,\n  deleteCookie,\n  type CookieOptions,\n} from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredentials,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n} from '../oauth2/types';\nimport type {\n  AuthConfig,\n  AuthService,\n  LoggedHandler,\n  OAuth2AuthorizedHandler,\n  OAuth2State,\n} from './types';\nimport { timing } from '../utils/timing';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly repository: SessionRepository;\n  private readonly oauth2Client: OAuth2Client | null;\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n\n  public readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({ repository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.repository = repository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const state = randomUUID();\n    const nonce = randomUUID();\n    const pkce = this.createPkceParameters();\n    const value: OAuth2State = { state, nonce, registrationId, ...pkce };\n    await this.repository.setItem(this.getOauth2StateKey(state), value, 10 * 60);\n    return Response.json({\n      state,\n      nonce,\n      code_challenge: pkce.code_challenge,\n      code_challenge_method: pkce.code_challenge_method,\n    });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n    mark('validate_session');\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('exchange_code');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredentials;\n    const key = this.getOauth2StateKey(credentials.state);\n    const cached = await this.repository.getItem<OAuth2State>(key);\n    if (!cached) {\n      const json = { error: 'invalid_request', error_description: 'oauth2 state not found' };\n      return Response.json(json, { status: 400 });\n    }\n    if (cached.registrationId !== registrationId) {\n      const json = { error: 'invalid_request', error_description: 'registration mismatch' };\n      return Response.json(json, { status: 400 });\n    }\n    mark('validate_state');\n\n    const pkce = {\n      code_verifier: cached.code_verifier,\n      code_challenge: cached.code_challenge,\n      code_challenge_method: cached.code_challenge_method,\n    };\n\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n      pkce,\n    });\n    mark('login_oauth2_native');\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n}\n"],"mappings":";AAAA,SAAS,YAAY,kBAAkB;AACvC,OAAO,eAAe;AACtB,SAAS,iCAAyD;AAClE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,cAAc,iCAAiC;AAcxD,SAAS,cAAc;AAEhB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAED,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAE3B,oCAAoC;AAAA,EAEpD,YAAY,EAAE,YAAY,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AAC9D,SAAK,SAASA,WAAU;AACxB,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,aAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,iBAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,yBAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,gBAAgB,WAAW;AACjC,UAAM,iBAAiB,WAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,iBAAiB;AAChE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,QAAQ,WAAW;AACzB,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,QAAqB,EAAE,OAAO,OAAO,gBAAgB,GAAG,KAAK;AACnE,UAAM,KAAK,WAAW,QAAQ,KAAK,kBAAkB,KAAK,GAAG,OAAO,KAAK,EAAE;AAC3E,WAAO,SAAS,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,uBAAuB,KAAK;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,aAAO,MAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AACA,SAAK,kBAAkB;AAGvB,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,eAAe;AAGpB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,MAAM,KAAK,kBAAkB,YAAY,KAAK;AACpD,UAAM,SAAS,MAAM,KAAK,WAAW,QAAqB,GAAG;AAC7D,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,yBAAyB;AACrF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,QAAI,OAAO,mBAAmB,gBAAgB;AAC5C,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,wBAAwB;AACpF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,SAAK,gBAAgB;AAErB,UAAM,OAAO;AAAA,MACX,eAAe,OAAO;AAAA,MACtB,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AACF;","names":["timing"]}

package/dist/auth/types.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { Principal } from '../core';\nimport type { OAuth2Token, OAuth2ClientConfig, PkceParameters, UserInfo } from '../oauth2/types';\nimport type { SessionRepository } from '../session';\nimport type { CookieOptions } from '../utils/http';\n\nexport type LoggedHandler = (principal: Principal) => Promise<void>;\nexport type OAuth2AuthorizedHandler = (\n  request: Request,\n  registrationId: string,\n  userInfo: UserInfo,\n  token: OAuth2Token\n) => Promise<Principal>;\n\nexport interface OAuth2State extends PkceParameters {\n  state: string;\n  nonce: string;\n  registrationId: string;\n}\n\nexport interface AuthConfig {\n  repository: SessionRepository;\n  cookie?: CookieOptions & { name?: string };\n  oauth2?: {\n    client?: OAuth2ClientConfig;\n  };\n}\n\nexport interface AuthService {\n  logout: (request: Request) => Promise<Response>;\n  logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;\n\n  oauth2State: (request: Request) => Promise<Response>;\n  oauth2Authorization: (request: Request) => Promise<Response>;\n  loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n  loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}
+{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { Principal } from '../core';\nimport type { OAuth2Token, OAuth2ClientConfig, PkceParameters, UserInfo } from '../oauth2/types';\nimport type { SessionRepository } from '../session';\nimport type { CookieOptions } from '../utils/http';\n\nexport type LoggedHandler = (principal: Principal) => Promise<void>;\nexport type OAuth2AuthorizedHandler = (\n  request: Request,\n  registrationId: string,\n  userInfo: UserInfo,\n  token: OAuth2Token\n) => Promise<Principal>;\n\nexport interface OAuth2State extends PkceParameters {\n  state: string;\n  nonce: string;\n  registrationId: string;\n}\n\nexport interface AuthConfig {\n  timing?: boolean;\n  repository: SessionRepository;\n  cookie?: CookieOptions & { name?: string };\n  oauth2?: {\n    client?: OAuth2ClientConfig;\n  };\n}\n\nexport interface AuthService {\n  logout: (request: Request) => Promise<Response>;\n  logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;\n\n  oauth2State: (request: Request) => Promise<Response>;\n  oauth2Authorization: (request: Request) => Promise<Response>;\n  loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n  loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/dist/auth/types.d.cts

@@ -12,6 +12,7 @@ interface OAuth2State extends PkceParameters {
     registrationId: string;
 }
 interface AuthConfig {
+    timing?: boolean;
     repository: SessionRepository;
     cookie?: CookieOptions & {
         name?: string;

package/dist/auth/types.d.ts

@@ -12,6 +12,7 @@ interface OAuth2State extends PkceParameters {
     registrationId: string;
 }
 interface AuthConfig {
+    timing?: boolean;
     repository: SessionRepository;
     cookie?: CookieOptions & {
         name?: string;

package/dist/index.cjs

@@ -22,20 +22,20 @@ var index_exports = {};
 __export(index_exports, {
   Auth: () => import_auth.Auth,
   OAuth2Client: () => import_client.OAuth2Client,
-  PRINCIPAL_NAME_INDEX_NAME: () => import_redis_session.PRINCIPAL_NAME_INDEX_NAME,
-  RedisIndexedSessionRepository: () => import_redis_session.RedisIndexedSessionRepository,
+  PRINCIPAL_NAME_INDEX_NAME: () => import_redis.PRINCIPAL_NAME_INDEX_NAME,
+  RedisSessionRepository: () => import_redis.RedisSessionRepository,
   oauth2RedirectQuerySchema: () => import_client.oauth2RedirectQuerySchema
 });
 module.exports = __toCommonJS(index_exports);
 var import_auth = require("./auth/index.cjs");
 var import_client = require("./oauth2/client.cjs");
-var import_redis_session = require("./session/redis-session.cjs");
+var import_redis = require("./session/redis.cjs");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Auth,
   OAuth2Client,
   PRINCIPAL_NAME_INDEX_NAME,
-  RedisIndexedSessionRepository,
+  RedisSessionRepository,
   oauth2RedirectQuerySchema
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { Auth } from './auth/index';\nexport { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client';\nexport { RedisIndexedSessionRepository, PRINCIPAL_NAME_INDEX_NAME } from './session/redis-session';\n\nexport type { Namespace, SessionRepository } from './session/types';\nexport type { StandardClaims, OAuth2Token, UserInfo, OidcToken, OidcScopes } from './oauth2/types';\nexport type { Principal } from './core/index';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAqB;AACrB,oBAAwD;AACxD,2BAAyE;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { Auth } from './auth/index';\nexport { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client';\nexport { RedisSessionRepository, PRINCIPAL_NAME_INDEX_NAME } from './session/redis';\n\nexport type { Namespace, SessionRepository } from './session/types';\nexport type { StandardClaims, OAuth2Token, UserInfo, OidcToken, OidcScopes } from './oauth2/types';\nexport type { Principal } from './core/index';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAqB;AACrB,oBAAwD;AACxD,mBAAkE;","names":[]}

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 export { Auth } from './auth/index.cjs';
 export { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client.cjs';
-export { PRINCIPAL_NAME_INDEX_NAME, RedisIndexedSessionRepository } from './session/redis-session.cjs';
+export { PRINCIPAL_NAME_INDEX_NAME, RedisSessionRepository } from './session/redis.cjs';
 export { Namespace, SessionRepository } from './session/types.cjs';
 export { OAuth2Token, OidcScopes, OidcToken, StandardClaims, UserInfo } from './oauth2/types.cjs';
 export { Principal } from './core/index.cjs';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { Auth } from './auth/index.js';
 export { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client.js';
-export { PRINCIPAL_NAME_INDEX_NAME, RedisIndexedSessionRepository } from './session/redis-session.js';
+export { PRINCIPAL_NAME_INDEX_NAME, RedisSessionRepository } from './session/redis.js';
 export { Namespace, SessionRepository } from './session/types.js';
 export { OAuth2Token, OidcScopes, OidcToken, StandardClaims, UserInfo } from './oauth2/types.js';
 export { Principal } from './core/index.js';

package/dist/index.mjs

@@ -1,12 +1,12 @@
 // src/index.ts
 import { Auth } from "./auth/index.mjs";
 import { OAuth2Client, oauth2RedirectQuerySchema } from "./oauth2/client.mjs";
-import { RedisIndexedSessionRepository, PRINCIPAL_NAME_INDEX_NAME } from "./session/redis-session.mjs";
+import { RedisSessionRepository, PRINCIPAL_NAME_INDEX_NAME } from "./session/redis.mjs";
 export {
   Auth,
   OAuth2Client,
   PRINCIPAL_NAME_INDEX_NAME,
-  RedisIndexedSessionRepository,
+  RedisSessionRepository,
   oauth2RedirectQuerySchema
 };
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { Auth } from './auth/index';\nexport { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client';\nexport { RedisIndexedSessionRepository, PRINCIPAL_NAME_INDEX_NAME } from './session/redis-session';\n\nexport type { Namespace, SessionRepository } from './session/types';\nexport type { StandardClaims, OAuth2Token, UserInfo, OidcToken, OidcScopes } from './oauth2/types';\nexport type { Principal } from './core/index';\n"],"mappings":";AAAA,SAAS,YAAY;AACrB,SAAS,cAAc,iCAAiC;AACxD,SAAS,+BAA+B,iCAAiC;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { Auth } from './auth/index';\nexport { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client';\nexport { RedisSessionRepository, PRINCIPAL_NAME_INDEX_NAME } from './session/redis';\n\nexport type { Namespace, SessionRepository } from './session/types';\nexport type { StandardClaims, OAuth2Token, UserInfo, OidcToken, OidcScopes } from './oauth2/types';\nexport type { Principal } from './core/index';\n"],"mappings":";AAAA,SAAS,YAAY;AACrB,SAAS,cAAc,iCAAiC;AACxD,SAAS,wBAAwB,iCAAiC;","names":[]}

package/dist/session/__test__/{redis-session.test.cjs → redis.test.cjs}

@@ -22,20 +22,20 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// src/session/__test__/redis-session.test.ts
+// src/session/__test__/redis.test.ts
 var import_ioredis = __toESM(require("ioredis"), 1);
-var import_redis_session = require("../redis-session.cjs");
+var import_redis = require("../redis.cjs");
 var redis = new import_ioredis.default("redis://default:123456@localhost:6379");
-var repository = new import_redis_session.RedisIndexedSessionRepository(redis, "myapp:session");
+var repository = new import_redis.RedisSessionRepository(redis, "myapp:session");
 describe("redis session crud", () => {
   const principalName = "user_123456";
   test("should create a session", async () => {
     const session = repository.createSession();
     const sessionId = session.getId();
-    session.setAttribute(import_redis_session.PRINCIPAL_NAME_INDEX_NAME, principalName);
+    session.setAttribute(import_redis.PRINCIPAL_NAME_INDEX_NAME, principalName);
     await repository.save(session);
     const foundSession = await repository.findById(sessionId);
-    expect(foundSession?.getAttribute(import_redis_session.PRINCIPAL_NAME_INDEX_NAME)).toBe(principalName);
+    expect(foundSession?.getAttribute(import_redis.PRINCIPAL_NAME_INDEX_NAME)).toBe(principalName);
   });
   test("should find a session by principal name", async () => {
     const sessions = await repository.findByPrincipalName(principalName);
@@ -68,7 +68,7 @@ describe("redis session attributes", () => {
   test("should change session id", async () => {
     const session = repository.createSession();
     session.setAttribute("test_key", "test_value");
-    session.setAttribute(import_redis_session.PRINCIPAL_NAME_INDEX_NAME, "user_123");
+    session.setAttribute(import_redis.PRINCIPAL_NAME_INDEX_NAME, "user_123");
     const oldSessionId = session.getId();
     await repository.save(session);
     const oldSession = await repository.findById(oldSessionId);
@@ -91,4 +91,4 @@ describe("redis session config", () => {
     expect(session.getMaxInactiveInterval()).toBe(maxInactiveInterval);
   });
 });
-//# sourceMappingURL=redis-session.test.cjs.map
+//# sourceMappingURL=redis.test.cjs.map

package/dist/session/__test__/redis.test.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/session/__test__/redis.test.ts"],"sourcesContent":["import Redis from 'ioredis';\nimport { PRINCIPAL_NAME_INDEX_NAME, RedisSessionRepository } from '../redis';\n\n// docker run -d -p 6379:6379 --name my-redis -e REDIS_PASSWORD=123456 redis\nconst redis = new Redis('redis://default:123456@localhost:6379');\nconst repository = new RedisSessionRepository(redis, 'myapp:session');\n\ndescribe('redis session crud', () => {\n  const principalName = 'user_123456';\n\n  test('should create a session', async () => {\n    const session = repository.createSession();\n    const sessionId = session.getId();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principalName);\n    await repository.save(session);\n    const foundSession = await repository.findById(sessionId);\n    expect(foundSession?.getAttribute(PRINCIPAL_NAME_INDEX_NAME)).toBe(principalName);\n  });\n\n  test('should find a session by principal name', async () => {\n    const sessions = await repository.findByPrincipalName(principalName);\n    expect(sessions.size).toBeGreaterThan(0);\n  });\n\n  test('should delete a session by id', async () => {\n    const sessions = await repository.findByPrincipalName(principalName);\n    for (const session of sessions.values()) {\n      const sessionId = session.getId();\n      await repository.deleteById(sessionId);\n      const foundSession = await repository.findById(sessionId);\n      expect(foundSession).toBeNull();\n    }\n  });\n});\n\ndescribe('redis session attributes', () => {\n  test('should set and get attributes', async () => {\n    const session = repository.createSession();\n    session.setAttribute('test_key', 'test_value');\n    const sessionId = session.getId();\n    await repository.save(session);\n\n    const foundSession = await repository.findById(sessionId);\n    expect(foundSession).not.toBeNull();\n    expect(foundSession?.getAttribute('test_key')).toBe('test_value');\n\n    foundSession?.removeAttribute('test_key');\n    await repository.save(foundSession!);\n\n    const foundSession2 = await repository.findById(sessionId);\n    expect(foundSession2?.getAttribute('test_key')).toBeNull();\n  });\n\n  test('should change session id', async () => {\n    const session = repository.createSession();\n    session.setAttribute('test_key', 'test_value');\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, 'user_123');\n    const oldSessionId = session.getId();\n    await repository.save(session);\n\n    const oldSession = await repository.findById(oldSessionId);\n    expect(oldSession).not.toBeNull();\n    if (!oldSession) throw new Error('Not found session id');\n\n    const newSessionId = oldSession.changeSessionId();\n    await repository.save(oldSession);\n\n    const foundSession1 = await repository.findById(oldSessionId);\n    expect(foundSession1).toBeNull();\n\n    const foundSession2 = await repository.findById(newSessionId);\n    expect(foundSession2).not.toBeNull();\n  });\n});\n\ndescribe('redis session config', () => {\n  const maxInactiveInterval = 24 * 60 * 60;\n  repository.setDefaultMaxInactiveInterval(maxInactiveInterval);\n\n  test('should set default max inactive interval', () => {\n    const session = repository.createSession();\n    expect(session.isExpired()).toBe(false);\n    expect(session.getMaxInactiveInterval()).toBe(maxInactiveInterval);\n  });\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qBAAkB;AAClB,mBAAkE;AAGlE,IAAM,QAAQ,IAAI,eAAAA,QAAM,uCAAuC;AAC/D,IAAM,aAAa,IAAI,oCAAuB,OAAO,eAAe;AAEpE,SAAS,sBAAsB,MAAM;AACnC,QAAM,gBAAgB;AAEtB,OAAK,2BAA2B,YAAY;AAC1C,UAAM,UAAU,WAAW,cAAc;AACzC,UAAM,YAAY,QAAQ,MAAM;AAChC,YAAQ,aAAa,wCAA2B,aAAa;AAC7D,UAAM,WAAW,KAAK,OAAO;AAC7B,UAAM,eAAe,MAAM,WAAW,SAAS,SAAS;AACxD,WAAO,cAAc,aAAa,sCAAyB,CAAC,EAAE,KAAK,aAAa;AAAA,EAClF,CAAC;AAED,OAAK,2CAA2C,YAAY;AAC1D,UAAM,WAAW,MAAM,WAAW,oBAAoB,aAAa;AACnE,WAAO,SAAS,IAAI,EAAE,gBAAgB,CAAC;AAAA,EACzC,CAAC;AAED,OAAK,iCAAiC,YAAY;AAChD,UAAM,WAAW,MAAM,WAAW,oBAAoB,aAAa;AACnE,eAAW,WAAW,SAAS,OAAO,GAAG;AACvC,YAAM,YAAY,QAAQ,MAAM;AAChC,YAAM,WAAW,WAAW,SAAS;AACrC,YAAM,eAAe,MAAM,WAAW,SAAS,SAAS;AACxD,aAAO,YAAY,EAAE,SAAS;AAAA,IAChC;AAAA,EACF,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,MAAM;AACzC,OAAK,iCAAiC,YAAY;AAChD,UAAM,UAAU,WAAW,cAAc;AACzC,YAAQ,aAAa,YAAY,YAAY;AAC7C,UAAM,YAAY,QAAQ,MAAM;AAChC,UAAM,WAAW,KAAK,OAAO;AAE7B,UAAM,eAAe,MAAM,WAAW,SAAS,SAAS;AACxD,WAAO,YAAY,EAAE,IAAI,SAAS;AAClC,WAAO,cAAc,aAAa,UAAU,CAAC,EAAE,KAAK,YAAY;AAEhE,kBAAc,gBAAgB,UAAU;AACxC,UAAM,WAAW,KAAK,YAAa;AAEnC,UAAM,gBAAgB,MAAM,WAAW,SAAS,SAAS;AACzD,WAAO,eAAe,aAAa,UAAU,CAAC,EAAE,SAAS;AAAA,EAC3D,CAAC;AAED,OAAK,4BAA4B,YAAY;AAC3C,UAAM,UAAU,WAAW,cAAc;AACzC,YAAQ,aAAa,YAAY,YAAY;AAC7C,YAAQ,aAAa,wCAA2B,UAAU;AAC1D,UAAM,eAAe,QAAQ,MAAM;AACnC,UAAM,WAAW,KAAK,OAAO;AAE7B,UAAM,aAAa,MAAM,WAAW,SAAS,YAAY;AACzD,WAAO,UAAU,EAAE,IAAI,SAAS;AAChC,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,sBAAsB;AAEvD,UAAM,eAAe,WAAW,gBAAgB;AAChD,UAAM,WAAW,KAAK,UAAU;AAEhC,UAAM,gBAAgB,MAAM,WAAW,SAAS,YAAY;AAC5D,WAAO,aAAa,EAAE,SAAS;AAE/B,UAAM,gBAAgB,MAAM,WAAW,SAAS,YAAY;AAC5D,WAAO,aAAa,EAAE,IAAI,SAAS;AAAA,EACrC,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,MAAM;AACrC,QAAM,sBAAsB,KAAK,KAAK;AACtC,aAAW,8BAA8B,mBAAmB;AAE5D,OAAK,4CAA4C,MAAM;AACrD,UAAM,UAAU,WAAW,cAAc;AACzC,WAAO,QAAQ,UAAU,CAAC,EAAE,KAAK,KAAK;AACtC,WAAO,QAAQ,uBAAuB,CAAC,EAAE,KAAK,mBAAmB;AAAA,EACnE,CAAC;AACH,CAAC;","names":["Redis"]}

package/dist/session/__test__/{redis-session.test.mjs → redis.test.mjs}

@@ -1,8 +1,8 @@
-// src/session/__test__/redis-session.test.ts
+// src/session/__test__/redis.test.ts
 import Redis from "ioredis";
-import { PRINCIPAL_NAME_INDEX_NAME, RedisIndexedSessionRepository } from "../redis-session.mjs";
+import { PRINCIPAL_NAME_INDEX_NAME, RedisSessionRepository } from "../redis.mjs";
 var redis = new Redis("redis://default:123456@localhost:6379");
-var repository = new RedisIndexedSessionRepository(redis, "myapp:session");
+var repository = new RedisSessionRepository(redis, "myapp:session");
 describe("redis session crud", () => {
   const principalName = "user_123456";
   test("should create a session", async () => {
@@ -67,4 +67,4 @@ describe("redis session config", () => {
     expect(session.getMaxInactiveInterval()).toBe(maxInactiveInterval);
   });
 });
-//# sourceMappingURL=redis-session.test.mjs.map
+//# sourceMappingURL=redis.test.mjs.map