@shware/security 1.1.0 → 1.2.0

package/README.md

@@ -1 +1,49 @@
 # Auth lib
+
+## Hono example
+
+```ts
+import { Hono } from 'hono';
+import { Auth, RedisIndexedSessionRepository } from '@shware/security';
+import { github } from '@shware/security/oauth2/provider';
+import { env, type Env } from '../env';
+import { redis } from '../db';
+import { onAuthorized } from '../services/auth';
+
+// ------------------------------------------------- ⬇️ ioredis ⬇️ namespace
+const repository = new RedisIndexedSessionRepository(redis, 'mywebsite:session');
+repository.setDefaultMaxInactiveInterval(30 * 24 * 60 * 60);
+
+const auth = new Auth({
+  timing: true,
+  repository,
+  oauth2: {
+    client: {
+      baseUri: 'https://api.mywebsite.com', // backend
+      errorUri: 'https://mywebsite.com', // frontend with query: error=string&error_description=string
+      successUri: 'https://mywebsite.com',
+      provider: { github },
+      registration: {
+        github: {
+          clientId: env.OAUTH2_GITHUB_CLIENT_ID,
+          clientSecret: env.OAUTH2_GITHUB_CLIENT_SECRET,
+        },
+      },
+    },
+  },
+});
+
+const app = new Hono<Env>();
+
+app.get('/auth', (c) => c.json({ test: 'test' }));
+app.get(auth.PATH_LOGGED, (c) => auth.logged(c.req.raw));
+app.post(auth.PATH_LOGOUT, (c) => auth.logout(c.req.raw));
+
+app.get(auth.PATH_OAUTH2_STATE, (c) => auth.oauth2State(c.req.raw));
+app.get(auth.PATH_OAUTH2_AUTHORIZATION, (c) => auth.oauth2Authorization(c.req.raw));
+app.get(auth.PATH_LOGIN_OAUTH2_CODE, (c) => auth.loginOAuth2Code(c.req.raw, onAuthorized));
+app.post(auth.PATH_LOGIN_OAUTH2_CODE, (c) => auth.loginOAuth2Code(c.req.raw, onAuthorized));
+app.post(auth.PATH_LOGIN_OAUTH2_NATIVE, (c) => auth.loginOAuth2Native(c.req.raw, onAuthorized));
+
+export default app;
+```

package/dist/auth/index.cjs

@@ -35,7 +35,7 @@ __export(auth_exports, {
 module.exports = __toCommonJS(auth_exports);
 var import_crypto = require("crypto");
 var import_tiny_invariant = __toESM(require("tiny-invariant"), 1);
-var import_session = require("../session/index.cjs");
+var import_common = require("../session/common.cjs");
 var import_http = require("../utils/http.cjs");
 var import_client = require("../oauth2/client.cjs");
 var import_timing = require("../utils/timing.cjs");
@@ -43,8 +43,10 @@ var Auth = class {
   timing;
   cookieName;
   cookieOptions;
+  kv;
   repository;
   oauth2Client;
+  ATTR_OAUTH2_AUTHORIZATION_REQUEST = "oauth2AuthorizationRequest";
   PATH_CSRF = "/csrf";
   PATH_LOGOUT = "/logout";
   PATH_LOGGED = "/logged";
@@ -52,10 +54,11 @@ var Auth = class {
   PATH_OAUTH2_AUTHORIZATION = "/oauth2/authorization/:registrationId";
   PATH_LOGIN_OAUTH2_CODE = "/login/oauth2/code/:registrationId";
   PATH_LOGIN_OAUTH2_NATIVE = "/login/oauth2/native/:registrationId";
-  ATTR_OAUTH2_AUTHORIZATION_REQUEST = "oauth2AuthorizationRequest";
-  constructor({ repository, oauth2, cookie, timing: timing2 }) {
+  PATH_CLEANUP_EXPIRED_SESSIONS = "/sessions/expired/cleanup";
+  constructor({ sessionRepository, kvRepository, oauth2, cookie, timing: timing2 }) {
     this.timing = timing2 ?? false;
-    this.repository = repository;
+    this.kv = kvRepository;
+    this.repository = sessionRepository;
     const { name, ...cookieOptions } = cookie ?? {};
     this.cookieName = name ?? "SESSION";
     this.cookieOptions = {
@@ -79,7 +82,7 @@ var Auth = class {
     if (!sessionId) return Response.json({ data: false });
     const session = await this.repository.findById(sessionId);
     if (!session) return Response.json({ data: false });
-    const name = session.getAttribute(import_session.PRINCIPAL_NAME_INDEX_NAME);
+    const name = session.getAttribute(import_common.PRINCIPAL_NAME_INDEX_NAME);
     session.setLastAccessedTime(Date.now());
     await this.repository.save(session);
     if (name !== null) await onLogged?.({ name: String(name) });
@@ -103,7 +106,7 @@ var Auth = class {
     const nonce = (0, import_crypto.randomUUID)();
     const pkce = this.createPkceParameters();
     const value = { state, nonce, registrationId, ...pkce };
-    await this.repository.setItem(this.getOauth2StateKey(state), value, 10 * 60);
+    await this.kv.setItem(this.getOauth2StateKey(state), JSON.stringify(value), 10 * 60);
     return Response.json({
       state,
       nonce,
@@ -179,6 +182,7 @@ var Auth = class {
     if (registrationId !== cached.registrationId) {
       return this.redirect("invalid_request", "redirect registration mismatch");
     }
+    mark("validate_session");
     const { code } = parsed.data;
     const token = await this.oauth2Client.exchangeAuthorizationCode({
       registrationId,
@@ -186,12 +190,12 @@ var Auth = class {
       pkce: cached.additionalParameters
     });
     const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });
-    mark("validate_session");
+    mark("exchange_code");
     const principal = await onAuthorized(request, registrationId, userInfo, token);
     mark("save_principal");
     session.setLastAccessedTime(Date.now());
     session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);
-    session.setAttribute(import_session.PRINCIPAL_NAME_INDEX_NAME, principal.name);
+    session.setAttribute(import_common.PRINCIPAL_NAME_INDEX_NAME, principal.name);
     await this.repository.save(session);
     mark("update_session");
     const response = new Response(null, {
@@ -209,7 +213,8 @@ var Auth = class {
     const { registrationId } = (0, import_http.param)(request, this.PATH_LOGIN_OAUTH2_NATIVE);
     const credentials = await request.json();
     const key = this.getOauth2StateKey(credentials.state);
-    const cached = await this.repository.getItem(key);
+    const value = await this.kv.getItem(key);
+    const cached = value ? JSON.parse(value) : null;
     if (!cached) {
       const json = { error: "invalid_request", error_description: "oauth2 state not found" };
       return Response.json(json, { status: 400 });
@@ -233,7 +238,7 @@ var Auth = class {
     const principal = await onAuthorized(request, registrationId, userInfo, token);
     mark("save_principal");
     const session = this.repository.createSession();
-    session.setAttribute(import_session.PRINCIPAL_NAME_INDEX_NAME, principal.name);
+    session.setAttribute(import_common.PRINCIPAL_NAME_INDEX_NAME, principal.name);
     await this.repository.save(session);
     const response = new Response(JSON.stringify(principal), {
       status: 200,
@@ -244,6 +249,10 @@ var Auth = class {
     setTiming(response);
     return response;
   };
+  cleanupExpiredSessions = async (cleanupCount) => {
+    await this.repository.cleanupExpiredSessions(cleanupCount);
+    return Response.json({});
+  };
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/auth/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME, type SessionRepository } from '../session/index';\nimport {\n  param,\n  query,\n  getCookie,\n  setCookie,\n  deleteCookie,\n  type CookieOptions,\n} from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredentials,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n} from '../oauth2/types';\nimport type {\n  AuthConfig,\n  AuthService,\n  LoggedHandler,\n  OAuth2AuthorizedHandler,\n  OAuth2State,\n} from './types';\nimport { timing } from '../utils/timing';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly repository: SessionRepository;\n  private readonly oauth2Client: OAuth2Client | null;\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n\n  public readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({ repository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.repository = repository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const state = randomUUID();\n    const nonce = randomUUID();\n    const pkce = this.createPkceParameters();\n    const value: OAuth2State = { state, nonce, registrationId, ...pkce };\n    await this.repository.setItem(this.getOauth2StateKey(state), value, 10 * 60);\n    return Response.json({\n      state,\n      nonce,\n      code_challenge: pkce.code_challenge,\n      code_challenge_method: pkce.code_challenge_method,\n    });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('validate_session');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredentials;\n    const key = this.getOauth2StateKey(credentials.state);\n    const cached = await this.repository.getItem<OAuth2State>(key);\n    if (!cached) {\n      const json = { error: 'invalid_request', error_description: 'oauth2 state not found' };\n      return Response.json(json, { status: 400 });\n    }\n    if (cached.registrationId !== registrationId) {\n      const json = { error: 'invalid_request', error_description: 'registration mismatch' };\n      return Response.json(json, { status: 400 });\n    }\n    mark('validate_state');\n\n    const pkce = {\n      code_verifier: cached.code_verifier,\n      code_challenge: cached.code_challenge,\n      code_challenge_method: cached.code_challenge_method,\n    };\n\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n      pkce,\n    });\n    mark('login_oauth2_native');\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAuC;AACvC,4BAAsB;AACtB,qBAAkE;AAClE,kBAOO;AACP,oBAAwD;AAcxD,oBAAuB;AAEhB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAED,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAE3B,oCAAoC;AAAA,EAEpD,YAAY,EAAE,YAAY,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AAC9D,SAAK,SAASA,WAAU;AACxB,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,2BAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,kCAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,wCAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,oBAAgB,0BAAW;AACjC,UAAM,qBAAiB,0BAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,iBAAiB;AAChE,8BAAAC,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,YAAQ,0BAAW;AACzB,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,QAAqB,EAAE,OAAO,OAAO,gBAAgB,GAAG,KAAK;AACnE,UAAM,KAAK,WAAW,QAAQ,KAAK,kBAAkB,KAAK,GAAG,OAAO,KAAK,EAAE;AAC3E,WAAO,SAAS,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,uBAAuB,KAAK;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,iBAAO,mBAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,wCAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AAGA,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,kBAAkB;AAGvB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,0CAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,MAAM,KAAK,kBAAkB,YAAY,KAAK;AACpD,UAAM,SAAS,MAAM,KAAK,WAAW,QAAqB,GAAG;AAC7D,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,yBAAyB;AACrF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,QAAI,OAAO,mBAAmB,gBAAgB;AAC5C,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,wBAAwB;AACpF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,SAAK,gBAAgB;AAErB,UAAM,OAAO;AAAA,MACX,eAAe,OAAO;AAAA,MACtB,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,0CAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AACF;","names":["timing","invariant"]}
+{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport {\n  param,\n  query,\n  getCookie,\n  setCookie,\n  deleteCookie,\n  type CookieOptions,\n} from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport { timing } from '../utils/timing';\nimport type { KVRepository, SessionRepository } from '../session/types';\nimport type {\n  NativeCredentials,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n} from '../oauth2/types';\nimport type {\n  AuthConfig,\n  AuthService,\n  LoggedHandler,\n  OAuth2AuthorizedHandler,\n  OAuth2State,\n} from './types';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n\n  public readonly PATH_CLEANUP_EXPIRED_SESSIONS = '/sessions/expired/cleanup' as const;\n\n  constructor({ sessionRepository, kvRepository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const state = randomUUID();\n    const nonce = randomUUID();\n    const pkce = this.createPkceParameters();\n    const value: OAuth2State = { state, nonce, registrationId, ...pkce };\n    await this.kv.setItem(this.getOauth2StateKey(state), JSON.stringify(value), 10 * 60);\n    return Response.json({\n      state,\n      nonce,\n      code_challenge: pkce.code_challenge,\n      code_challenge_method: pkce.code_challenge_method,\n    });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n    mark('validate_session');\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('exchange_code');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredentials;\n    const key = this.getOauth2StateKey(credentials.state);\n    const value = await this.kv.getItem(key);\n    const cached = value ? (JSON.parse(value) as OAuth2State) : null;\n    if (!cached) {\n      const json = { error: 'invalid_request', error_description: 'oauth2 state not found' };\n      return Response.json(json, { status: 400 });\n    }\n    if (cached.registrationId !== registrationId) {\n      const json = { error: 'invalid_request', error_description: 'registration mismatch' };\n      return Response.json(json, { status: 400 });\n    }\n    mark('validate_state');\n\n    const pkce = {\n      code_verifier: cached.code_verifier,\n      code_challenge: cached.code_challenge,\n      code_challenge_method: cached.code_challenge_method,\n    };\n\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n      pkce,\n    });\n    mark('login_oauth2_native');\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAuC;AACvC,4BAAsB;AACtB,oBAA0C;AAC1C,kBAOO;AACP,oBAAwD;AAExD,oBAAuB;AAehB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA,oCAAoC;AAAA,EAErC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAE3B,gCAAgC;AAAA,EAEhD,YAAY,EAAE,mBAAmB,cAAc,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AACnF,SAAK,SAASA,WAAU;AACxB,SAAK,KAAK;AACV,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,2BAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,kCAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,uCAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,oBAAgB,0BAAW;AACjC,UAAM,qBAAiB,0BAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,iBAAiB;AAChE,8BAAAC,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,YAAQ,0BAAW;AACzB,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,QAAqB,EAAE,OAAO,OAAO,gBAAgB,GAAG,KAAK;AACnE,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,KAAK,UAAU,KAAK,GAAG,KAAK,EAAE;AACnF,WAAO,SAAS,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,uBAAuB,KAAK;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,iBAAO,mBAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,wCAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AACA,SAAK,kBAAkB;AAGvB,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,eAAe;AAGpB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,yCAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,MAAM,KAAK,kBAAkB,YAAY,KAAK;AACpD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,GAAG;AACvC,UAAM,SAAS,QAAS,KAAK,MAAM,KAAK,IAAoB;AAC5D,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,yBAAyB;AACrF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,QAAI,OAAO,mBAAmB,gBAAgB;AAC5C,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,wBAAwB;AACpF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,SAAK,gBAAgB;AAErB,UAAM,OAAO;AAAA,MACX,eAAe,OAAO;AAAA,MACtB,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,yCAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,yBAAyB,OAAO,iBAA6C;AAC3E,UAAM,KAAK,WAAW,uBAAuB,YAAY;AACzD,WAAO,SAAS,KAAK,CAAC,CAAC;AAAA,EACzB;AACF;","names":["timing","invariant"]}

package/dist/auth/index.d.cts

@@ -9,8 +9,10 @@ declare class Auth implements AuthService {
     private readonly timing;
     private readonly cookieName;
     private readonly cookieOptions;
+    private readonly kv;
     private readonly repository;
     private readonly oauth2Client;
+    private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST;
     readonly PATH_CSRF: "/csrf";
     readonly PATH_LOGOUT: "/logout";
     readonly PATH_LOGGED: "/logged";
@@ -18,8 +20,8 @@ declare class Auth implements AuthService {
     readonly PATH_OAUTH2_AUTHORIZATION: "/oauth2/authorization/:registrationId";
     readonly PATH_LOGIN_OAUTH2_CODE: "/login/oauth2/code/:registrationId";
     readonly PATH_LOGIN_OAUTH2_NATIVE: "/login/oauth2/native/:registrationId";
-    readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = "oauth2AuthorizationRequest";
-    constructor({ repository, oauth2, cookie, timing }: AuthConfig);
+    readonly PATH_CLEANUP_EXPIRED_SESSIONS: "/sessions/expired/cleanup";
+    constructor({ sessionRepository, kvRepository, oauth2, cookie, timing }: AuthConfig);
     logout: (request: Request) => Promise<Response>;
     logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;
     private createPkceParameters;
@@ -29,6 +31,7 @@ declare class Auth implements AuthService {
     private redirect;
     loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
     loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
+    cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
 }
 
 export { Auth };

package/dist/auth/index.d.ts

@@ -9,8 +9,10 @@ declare class Auth implements AuthService {
     private readonly timing;
     private readonly cookieName;
     private readonly cookieOptions;
+    private readonly kv;
     private readonly repository;
     private readonly oauth2Client;
+    private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST;
     readonly PATH_CSRF: "/csrf";
     readonly PATH_LOGOUT: "/logout";
     readonly PATH_LOGGED: "/logged";
@@ -18,8 +20,8 @@ declare class Auth implements AuthService {
     readonly PATH_OAUTH2_AUTHORIZATION: "/oauth2/authorization/:registrationId";
     readonly PATH_LOGIN_OAUTH2_CODE: "/login/oauth2/code/:registrationId";
     readonly PATH_LOGIN_OAUTH2_NATIVE: "/login/oauth2/native/:registrationId";
-    readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = "oauth2AuthorizationRequest";
-    constructor({ repository, oauth2, cookie, timing }: AuthConfig);
+    readonly PATH_CLEANUP_EXPIRED_SESSIONS: "/sessions/expired/cleanup";
+    constructor({ sessionRepository, kvRepository, oauth2, cookie, timing }: AuthConfig);
     logout: (request: Request) => Promise<Response>;
     logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;
     private createPkceParameters;
@@ -29,6 +31,7 @@ declare class Auth implements AuthService {
     private redirect;
     loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
     loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
+    cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
 }
 
 export { Auth };

package/dist/auth/index.mjs

@@ -1,7 +1,7 @@
 // src/auth/index.ts
 import { createHash, randomUUID } from "crypto";
 import invariant from "tiny-invariant";
-import { PRINCIPAL_NAME_INDEX_NAME } from "../session/index.mjs";
+import { PRINCIPAL_NAME_INDEX_NAME } from "../session/common.mjs";
 import {
   param,
   query,
@@ -15,8 +15,10 @@ var Auth = class {
   timing;
   cookieName;
   cookieOptions;
+  kv;
   repository;
   oauth2Client;
+  ATTR_OAUTH2_AUTHORIZATION_REQUEST = "oauth2AuthorizationRequest";
   PATH_CSRF = "/csrf";
   PATH_LOGOUT = "/logout";
   PATH_LOGGED = "/logged";
@@ -24,10 +26,11 @@ var Auth = class {
   PATH_OAUTH2_AUTHORIZATION = "/oauth2/authorization/:registrationId";
   PATH_LOGIN_OAUTH2_CODE = "/login/oauth2/code/:registrationId";
   PATH_LOGIN_OAUTH2_NATIVE = "/login/oauth2/native/:registrationId";
-  ATTR_OAUTH2_AUTHORIZATION_REQUEST = "oauth2AuthorizationRequest";
-  constructor({ repository, oauth2, cookie, timing: timing2 }) {
+  PATH_CLEANUP_EXPIRED_SESSIONS = "/sessions/expired/cleanup";
+  constructor({ sessionRepository, kvRepository, oauth2, cookie, timing: timing2 }) {
     this.timing = timing2 ?? false;
-    this.repository = repository;
+    this.kv = kvRepository;
+    this.repository = sessionRepository;
     const { name, ...cookieOptions } = cookie ?? {};
     this.cookieName = name ?? "SESSION";
     this.cookieOptions = {
@@ -75,7 +78,7 @@ var Auth = class {
     const nonce = randomUUID();
     const pkce = this.createPkceParameters();
     const value = { state, nonce, registrationId, ...pkce };
-    await this.repository.setItem(this.getOauth2StateKey(state), value, 10 * 60);
+    await this.kv.setItem(this.getOauth2StateKey(state), JSON.stringify(value), 10 * 60);
     return Response.json({
       state,
       nonce,
@@ -151,6 +154,7 @@ var Auth = class {
     if (registrationId !== cached.registrationId) {
       return this.redirect("invalid_request", "redirect registration mismatch");
     }
+    mark("validate_session");
     const { code } = parsed.data;
     const token = await this.oauth2Client.exchangeAuthorizationCode({
       registrationId,
@@ -158,7 +162,7 @@ var Auth = class {
       pkce: cached.additionalParameters
     });
     const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });
-    mark("validate_session");
+    mark("exchange_code");
     const principal = await onAuthorized(request, registrationId, userInfo, token);
     mark("save_principal");
     session.setLastAccessedTime(Date.now());
@@ -181,7 +185,8 @@ var Auth = class {
     const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);
     const credentials = await request.json();
     const key = this.getOauth2StateKey(credentials.state);
-    const cached = await this.repository.getItem(key);
+    const value = await this.kv.getItem(key);
+    const cached = value ? JSON.parse(value) : null;
     if (!cached) {
       const json = { error: "invalid_request", error_description: "oauth2 state not found" };
       return Response.json(json, { status: 400 });
@@ -216,6 +221,10 @@ var Auth = class {
     setTiming(response);
     return response;
   };
+  cleanupExpiredSessions = async (cleanupCount) => {
+    await this.repository.cleanupExpiredSessions(cleanupCount);
+    return Response.json({});
+  };
 };
 export {
   Auth

package/dist/auth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME, type SessionRepository } from '../session/index';\nimport {\n  param,\n  query,\n  getCookie,\n  setCookie,\n  deleteCookie,\n  type CookieOptions,\n} from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredentials,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n} from '../oauth2/types';\nimport type {\n  AuthConfig,\n  AuthService,\n  LoggedHandler,\n  OAuth2AuthorizedHandler,\n  OAuth2State,\n} from './types';\nimport { timing } from '../utils/timing';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly repository: SessionRepository;\n  private readonly oauth2Client: OAuth2Client | null;\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n\n  public readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({ repository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.repository = repository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const state = randomUUID();\n    const nonce = randomUUID();\n    const pkce = this.createPkceParameters();\n    const value: OAuth2State = { state, nonce, registrationId, ...pkce };\n    await this.repository.setItem(this.getOauth2StateKey(state), value, 10 * 60);\n    return Response.json({\n      state,\n      nonce,\n      code_challenge: pkce.code_challenge,\n      code_challenge_method: pkce.code_challenge_method,\n    });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('validate_session');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredentials;\n    const key = this.getOauth2StateKey(credentials.state);\n    const cached = await this.repository.getItem<OAuth2State>(key);\n    if (!cached) {\n      const json = { error: 'invalid_request', error_description: 'oauth2 state not found' };\n      return Response.json(json, { status: 400 });\n    }\n    if (cached.registrationId !== registrationId) {\n      const json = { error: 'invalid_request', error_description: 'registration mismatch' };\n      return Response.json(json, { status: 400 });\n    }\n    mark('validate_state');\n\n    const pkce = {\n      code_verifier: cached.code_verifier,\n      code_challenge: cached.code_challenge,\n      code_challenge_method: cached.code_challenge_method,\n    };\n\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n      pkce,\n    });\n    mark('login_oauth2_native');\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n}\n"],"mappings":";AAAA,SAAS,YAAY,kBAAkB;AACvC,OAAO,eAAe;AACtB,SAAS,iCAAyD;AAClE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,cAAc,iCAAiC;AAcxD,SAAS,cAAc;AAEhB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAED,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAE3B,oCAAoC;AAAA,EAEpD,YAAY,EAAE,YAAY,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AAC9D,SAAK,SAASA,WAAU;AACxB,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,aAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,iBAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,yBAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,gBAAgB,WAAW;AACjC,UAAM,iBAAiB,WAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,iBAAiB;AAChE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,QAAQ,WAAW;AACzB,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,QAAqB,EAAE,OAAO,OAAO,gBAAgB,GAAG,KAAK;AACnE,UAAM,KAAK,WAAW,QAAQ,KAAK,kBAAkB,KAAK,GAAG,OAAO,KAAK,EAAE;AAC3E,WAAO,SAAS,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,uBAAuB,KAAK;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,aAAO,MAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AAGA,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,kBAAkB;AAGvB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,MAAM,KAAK,kBAAkB,YAAY,KAAK;AACpD,UAAM,SAAS,MAAM,KAAK,WAAW,QAAqB,GAAG;AAC7D,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,yBAAyB;AACrF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,QAAI,OAAO,mBAAmB,gBAAgB;AAC5C,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,wBAAwB;AACpF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,SAAK,gBAAgB;AAErB,UAAM,OAAO;AAAA,MACX,eAAe,OAAO;AAAA,MACtB,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AACF;","names":["timing"]}
+{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport {\n  param,\n  query,\n  getCookie,\n  setCookie,\n  deleteCookie,\n  type CookieOptions,\n} from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport { timing } from '../utils/timing';\nimport type { KVRepository, SessionRepository } from '../session/types';\nimport type {\n  NativeCredentials,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n} from '../oauth2/types';\nimport type {\n  AuthConfig,\n  AuthService,\n  LoggedHandler,\n  OAuth2AuthorizedHandler,\n  OAuth2State,\n} from './types';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n\n  public readonly PATH_CLEANUP_EXPIRED_SESSIONS = '/sessions/expired/cleanup' as const;\n\n  constructor({ sessionRepository, kvRepository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const state = randomUUID();\n    const nonce = randomUUID();\n    const pkce = this.createPkceParameters();\n    const value: OAuth2State = { state, nonce, registrationId, ...pkce };\n    await this.kv.setItem(this.getOauth2StateKey(state), JSON.stringify(value), 10 * 60);\n    return Response.json({\n      state,\n      nonce,\n      code_challenge: pkce.code_challenge,\n      code_challenge_method: pkce.code_challenge_method,\n    });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n    mark('validate_session');\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('exchange_code');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredentials;\n    const key = this.getOauth2StateKey(credentials.state);\n    const value = await this.kv.getItem(key);\n    const cached = value ? (JSON.parse(value) as OAuth2State) : null;\n    if (!cached) {\n      const json = { error: 'invalid_request', error_description: 'oauth2 state not found' };\n      return Response.json(json, { status: 400 });\n    }\n    if (cached.registrationId !== registrationId) {\n      const json = { error: 'invalid_request', error_description: 'registration mismatch' };\n      return Response.json(json, { status: 400 });\n    }\n    mark('validate_state');\n\n    const pkce = {\n      code_verifier: cached.code_verifier,\n      code_challenge: cached.code_challenge,\n      code_challenge_method: cached.code_challenge_method,\n    };\n\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n      pkce,\n    });\n    mark('login_oauth2_native');\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";AAAA,SAAS,YAAY,kBAAkB;AACvC,OAAO,eAAe;AACtB,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,cAAc,iCAAiC;AAExD,SAAS,cAAc;AAehB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA,oCAAoC;AAAA,EAErC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAE3B,gCAAgC;AAAA,EAEhD,YAAY,EAAE,mBAAmB,cAAc,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AACnF,SAAK,SAASA,WAAU;AACxB,SAAK,KAAK;AACV,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,aAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,iBAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,yBAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,gBAAgB,WAAW;AACjC,UAAM,iBAAiB,WAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,iBAAiB;AAChE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,QAAQ,WAAW;AACzB,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,QAAqB,EAAE,OAAO,OAAO,gBAAgB,GAAG,KAAK;AACnE,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,KAAK,UAAU,KAAK,GAAG,KAAK,EAAE;AACnF,WAAO,SAAS,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,uBAAuB,KAAK;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,aAAO,MAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AACA,SAAK,kBAAkB;AAGvB,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,eAAe;AAGpB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,MAAM,KAAK,kBAAkB,YAAY,KAAK;AACpD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,GAAG;AACvC,UAAM,SAAS,QAAS,KAAK,MAAM,KAAK,IAAoB;AAC5D,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,yBAAyB;AACrF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,QAAI,OAAO,mBAAmB,gBAAgB;AAC5C,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,wBAAwB;AACpF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,SAAK,gBAAgB;AAErB,UAAM,OAAO;AAAA,MACX,eAAe,OAAO;AAAA,MACtB,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,yBAAyB,OAAO,iBAA6C;AAC3E,UAAM,KAAK,WAAW,uBAAuB,YAAY;AACzD,WAAO,SAAS,KAAK,CAAC,CAAC;AAAA,EACzB;AACF;","names":["timing"]}

package/dist/auth/types.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { Principal } from '../core';\nimport type { OAuth2Token, OAuth2ClientConfig, PkceParameters, UserInfo } from '../oauth2/types';\nimport type { SessionRepository } from '../session';\nimport type { CookieOptions } from '../utils/http';\n\nexport type LoggedHandler = (principal: Principal) => Promise<void>;\nexport type OAuth2AuthorizedHandler = (\n  request: Request,\n  registrationId: string,\n  userInfo: UserInfo,\n  token: OAuth2Token\n) => Promise<Principal>;\n\nexport interface OAuth2State extends PkceParameters {\n  state: string;\n  nonce: string;\n  registrationId: string;\n}\n\nexport interface AuthConfig {\n  timing?: boolean;\n  repository: SessionRepository;\n  cookie?: CookieOptions & { name?: string };\n  oauth2?: {\n    client?: OAuth2ClientConfig;\n  };\n}\n\nexport interface AuthService {\n  logout: (request: Request) => Promise<Response>;\n  logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;\n\n  oauth2State: (request: Request) => Promise<Response>;\n  oauth2Authorization: (request: Request) => Promise<Response>;\n  loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n  loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}
+{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { Principal } from '../core';\nimport type { OAuth2Token, OAuth2ClientConfig, PkceParameters, UserInfo } from '../oauth2/types';\nimport type { KVRepository, SessionRepository } from '../session/types';\nimport type { CookieOptions } from '../utils/http';\n\nexport type LoggedHandler = (principal: Principal) => Promise<void>;\nexport type OAuth2AuthorizedHandler = (\n  request: Request,\n  registrationId: string,\n  userInfo: UserInfo,\n  token: OAuth2Token\n) => Promise<Principal>;\n\nexport interface OAuth2State extends PkceParameters {\n  state: string;\n  nonce: string;\n  registrationId: string;\n}\n\nexport interface AuthConfig {\n  timing?: boolean;\n  kvRepository: KVRepository;\n  sessionRepository: SessionRepository;\n  cookie?: CookieOptions & { name?: string };\n  oauth2?: {\n    client?: OAuth2ClientConfig;\n  };\n}\n\nexport interface AuthService {\n  logout: (request: Request) => Promise<Response>;\n  logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;\n\n  oauth2State: (request: Request) => Promise<Response>;\n  oauth2Authorization: (request: Request) => Promise<Response>;\n  loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n  loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/dist/auth/types.d.cts

@@ -1,6 +1,6 @@
 import { Principal } from '../core/index.cjs';
 import { UserInfo, OAuth2Token, OAuth2ClientConfig, PkceParameters } from '../oauth2/types.cjs';
-import { SessionRepository } from '../session/types.cjs';
+import { KVRepository, SessionRepository } from '../session/types.cjs';
 import { CookieOptions } from '../utils/http.cjs';
 import 'cookie';
 
@@ -13,7 +13,8 @@ interface OAuth2State extends PkceParameters {
 }
 interface AuthConfig {
     timing?: boolean;
-    repository: SessionRepository;
+    kvRepository: KVRepository;
+    sessionRepository: SessionRepository;
     cookie?: CookieOptions & {
         name?: string;
     };

package/dist/auth/types.d.ts

@@ -1,6 +1,6 @@
 import { Principal } from '../core/index.js';
 import { UserInfo, OAuth2Token, OAuth2ClientConfig, PkceParameters } from '../oauth2/types.js';
-import { SessionRepository } from '../session/types.js';
+import { KVRepository, SessionRepository } from '../session/types.js';
 import { CookieOptions } from '../utils/http.js';
 import 'cookie';
 
@@ -13,7 +13,8 @@ interface OAuth2State extends PkceParameters {
 }
 interface AuthConfig {
     timing?: boolean;
-    repository: SessionRepository;
+    kvRepository: KVRepository;
+    sessionRepository: SessionRepository;
     cookie?: CookieOptions & {
         name?: string;
     };

package/dist/index.cjs

@@ -21,21 +21,27 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   Auth: () => import_auth.Auth,
+  DBIndexedSessionRepository: () => import_db.DBIndexedSessionRepository,
   OAuth2Client: () => import_client.OAuth2Client,
-  PRINCIPAL_NAME_INDEX_NAME: () => import_redis.PRINCIPAL_NAME_INDEX_NAME,
-  RedisSessionRepository: () => import_redis.RedisSessionRepository,
+  PRINCIPAL_NAME_INDEX_NAME: () => import_common.PRINCIPAL_NAME_INDEX_NAME,
+  RedisIndexedSessionRepository: () => import_redis.RedisIndexedSessionRepository,
+  RedisKVRepository: () => import_redis.RedisKVRepository,
   oauth2RedirectQuerySchema: () => import_client.oauth2RedirectQuerySchema
 });
 module.exports = __toCommonJS(index_exports);
 var import_auth = require("./auth/index.cjs");
 var import_client = require("./oauth2/client.cjs");
 var import_redis = require("./session/redis.cjs");
+var import_db = require("./session/db.cjs");
+var import_common = require("./session/common.cjs");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Auth,
+  DBIndexedSessionRepository,
   OAuth2Client,
   PRINCIPAL_NAME_INDEX_NAME,
-  RedisSessionRepository,
+  RedisIndexedSessionRepository,
+  RedisKVRepository,
   oauth2RedirectQuerySchema
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { Auth } from './auth/index';\nexport { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client';\nexport { RedisSessionRepository, PRINCIPAL_NAME_INDEX_NAME } from './session/redis';\n\nexport type { Namespace, SessionRepository } from './session/types';\nexport type { StandardClaims, OAuth2Token, UserInfo, OidcToken, OidcScopes } from './oauth2/types';\nexport type { Principal } from './core/index';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAqB;AACrB,oBAAwD;AACxD,mBAAkE;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { Auth } from './auth/index';\nexport { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client';\nexport { RedisIndexedSessionRepository, RedisKVRepository } from './session/redis';\nexport { DBIndexedSessionRepository } from './session/db';\nexport { PRINCIPAL_NAME_INDEX_NAME } from './session/common';\n\nexport type { Principal } from './core/index';\nexport type { DBAdapter } from './session/db';\nexport type { Namespace, SessionRepository, Session, KVRepository } from './session/types';\nexport type { StandardClaims, OAuth2Token, UserInfo, OidcToken, OidcScopes } from './oauth2/types';\nexport type { AuthConfig, AuthService } from './auth/types';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAqB;AACrB,oBAAwD;AACxD,mBAAiE;AACjE,gBAA2C;AAC3C,oBAA0C;","names":[]}

package/dist/index.d.cts

@@ -1,11 +1,14 @@
 export { Auth } from './auth/index.cjs';
 export { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client.cjs';
-export { PRINCIPAL_NAME_INDEX_NAME, RedisSessionRepository } from './session/redis.cjs';
-export { Namespace, SessionRepository } from './session/types.cjs';
-export { OAuth2Token, OidcScopes, OidcToken, StandardClaims, UserInfo } from './oauth2/types.cjs';
+export { RedisIndexedSessionRepository, RedisKVRepository } from './session/redis.cjs';
+export { DBAdapter, DBIndexedSessionRepository } from './session/db.cjs';
+export { PRINCIPAL_NAME_INDEX_NAME } from './session/common.cjs';
 export { Principal } from './core/index.cjs';
-import './auth/types.cjs';
-import './utils/http.cjs';
-import 'cookie';
+export { KVRepository, Namespace, Session, SessionRepository } from './session/types.cjs';
+export { OAuth2Token, OidcScopes, OidcToken, StandardClaims, UserInfo } from './oauth2/types.cjs';
+export { AuthConfig, AuthService } from './auth/types.cjs';
 import 'zod';
+import './session/map-session.cjs';
 import 'ioredis';
+import './utils/http.cjs';
+import 'cookie';

package/dist/index.d.ts

@@ -1,11 +1,14 @@
 export { Auth } from './auth/index.js';
 export { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client.js';
-export { PRINCIPAL_NAME_INDEX_NAME, RedisSessionRepository } from './session/redis.js';
-export { Namespace, SessionRepository } from './session/types.js';
-export { OAuth2Token, OidcScopes, OidcToken, StandardClaims, UserInfo } from './oauth2/types.js';
+export { RedisIndexedSessionRepository, RedisKVRepository } from './session/redis.js';
+export { DBAdapter, DBIndexedSessionRepository } from './session/db.js';
+export { PRINCIPAL_NAME_INDEX_NAME } from './session/common.js';
 export { Principal } from './core/index.js';
-import './auth/types.js';
-import './utils/http.js';
-import 'cookie';
+export { KVRepository, Namespace, Session, SessionRepository } from './session/types.js';
+export { OAuth2Token, OidcScopes, OidcToken, StandardClaims, UserInfo } from './oauth2/types.js';
+export { AuthConfig, AuthService } from './auth/types.js';
 import 'zod';
+import './session/map-session.js';
 import 'ioredis';
+import './utils/http.js';
+import 'cookie';

package/dist/index.mjs

@@ -1,12 +1,16 @@
 // src/index.ts
 import { Auth } from "./auth/index.mjs";
 import { OAuth2Client, oauth2RedirectQuerySchema } from "./oauth2/client.mjs";
-import { RedisSessionRepository, PRINCIPAL_NAME_INDEX_NAME } from "./session/redis.mjs";
+import { RedisIndexedSessionRepository, RedisKVRepository } from "./session/redis.mjs";
+import { DBIndexedSessionRepository } from "./session/db.mjs";
+import { PRINCIPAL_NAME_INDEX_NAME } from "./session/common.mjs";
 export {
   Auth,
+  DBIndexedSessionRepository,
   OAuth2Client,
   PRINCIPAL_NAME_INDEX_NAME,
-  RedisSessionRepository,
+  RedisIndexedSessionRepository,
+  RedisKVRepository,
   oauth2RedirectQuerySchema
 };
 //# sourceMappingURL=index.mjs.map