@shware/security 1.2.1 → 1.2.2

package/dist/auth/index.cjs

@@ -249,6 +249,38 @@ var Auth = class {
     setTiming(response);
     return response;
   };
+  kick = async (principal) => {
+    const sessions = await this.repository.findByPrincipalName(principal.name);
+    for (const sessionId of sessions.keys()) {
+      await this.repository.deleteById(sessionId);
+    }
+  };
+  getSession = async (request, create) => {
+    const sessionId = (0, import_http.getCookie)(request, this.cookieName);
+    if (!sessionId) {
+      if (create) {
+        const session2 = this.repository.createSession();
+        await this.repository.save(session2);
+        return session2;
+      } else {
+        return null;
+      }
+    }
+    const session = await this.repository.findById(sessionId);
+    if (!session) {
+      if (create) {
+        const session2 = this.repository.createSession();
+        await this.repository.save(session2);
+        return session2;
+      } else {
+        return null;
+      }
+    }
+    return session;
+  };
+  deleteSession = async (sessionId) => {
+    await this.repository.deleteById(sessionId);
+  };
   cleanupExpiredSessions = async (cleanupCount) => {
     await this.repository.cleanupExpiredSessions(cleanupCount);
     return Response.json({});

package/dist/auth/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport {\n  param,\n  query,\n  getCookie,\n  setCookie,\n  deleteCookie,\n  type CookieOptions,\n} from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport { timing } from '../utils/timing';\nimport type { KVRepository, SessionRepository } from '../session/types';\nimport type {\n  NativeCredentials,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n} from '../oauth2/types';\nimport type {\n  AuthConfig,\n  AuthService,\n  LoggedHandler,\n  OAuth2AuthorizedHandler,\n  OAuth2State,\n} from './types';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n\n  public readonly PATH_CLEANUP_EXPIRED_SESSIONS = '/sessions/expired/cleanup' as const;\n\n  constructor({ sessionRepository, kvRepository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const state = randomUUID();\n    const nonce = randomUUID();\n    const pkce = this.createPkceParameters();\n    const value: OAuth2State = { state, nonce, registrationId, ...pkce };\n    await this.kv.setItem(this.getOauth2StateKey(state), JSON.stringify(value), 10 * 60);\n    return Response.json({\n      state,\n      nonce,\n      code_challenge: pkce.code_challenge,\n      code_challenge_method: pkce.code_challenge_method,\n    });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n    mark('validate_session');\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('exchange_code');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredentials;\n    const key = this.getOauth2StateKey(credentials.state);\n    const value = await this.kv.getItem(key);\n    const cached = value ? (JSON.parse(value) as OAuth2State) : null;\n    if (!cached) {\n      const json = { error: 'invalid_request', error_description: 'oauth2 state not found' };\n      return Response.json(json, { status: 400 });\n    }\n    if (cached.registrationId !== registrationId) {\n      const json = { error: 'invalid_request', error_description: 'registration mismatch' };\n      return Response.json(json, { status: 400 });\n    }\n    mark('validate_state');\n\n    const pkce = {\n      code_verifier: cached.code_verifier,\n      code_challenge: cached.code_challenge,\n      code_challenge_method: cached.code_challenge_method,\n    };\n\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n      pkce,\n    });\n    mark('login_oauth2_native');\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAuC;AACvC,4BAAsB;AACtB,oBAA0C;AAC1C,kBAOO;AACP,oBAAwD;AAExD,oBAAuB;AAehB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA,oCAAoC;AAAA,EAErC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAE3B,gCAAgC;AAAA,EAEhD,YAAY,EAAE,mBAAmB,cAAc,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AACnF,SAAK,SAASA,WAAU;AACxB,SAAK,KAAK;AACV,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,2BAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,kCAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,uCAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,oBAAgB,0BAAW;AACjC,UAAM,qBAAiB,0BAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,iBAAiB;AAChE,8BAAAC,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,YAAQ,0BAAW;AACzB,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,QAAqB,EAAE,OAAO,OAAO,gBAAgB,GAAG,KAAK;AACnE,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,KAAK,UAAU,KAAK,GAAG,KAAK,EAAE;AACnF,WAAO,SAAS,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,uBAAuB,KAAK;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,iBAAO,mBAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,wCAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AACA,SAAK,kBAAkB;AAGvB,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,eAAe;AAGpB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,yCAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,MAAM,KAAK,kBAAkB,YAAY,KAAK;AACpD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,GAAG;AACvC,UAAM,SAAS,QAAS,KAAK,MAAM,KAAK,IAAoB;AAC5D,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,yBAAyB;AACrF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,QAAI,OAAO,mBAAmB,gBAAgB;AAC5C,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,wBAAwB;AACpF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,SAAK,gBAAgB;AAErB,UAAM,OAAO;AAAA,MACX,eAAe,OAAO;AAAA,MACtB,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,yCAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,yBAAyB,OAAO,iBAA6C;AAC3E,UAAM,KAAK,WAAW,uBAAuB,YAAY;AACzD,WAAO,SAAS,KAAK,CAAC,CAAC;AAAA,EACzB;AACF;","names":["timing","invariant"]}
+{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport {\n  param,\n  query,\n  getCookie,\n  setCookie,\n  deleteCookie,\n  type CookieOptions,\n} from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport { timing } from '../utils/timing';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport type {\n  NativeCredentials,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n} from '../oauth2/types';\nimport type {\n  AuthConfig,\n  AuthService,\n  LoggedHandler,\n  OAuth2AuthorizedHandler,\n  OAuth2State,\n} from './types';\nimport { Principal } from '../core';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n\n  public readonly PATH_CLEANUP_EXPIRED_SESSIONS = '/sessions/expired/cleanup' as const;\n\n  constructor({ sessionRepository, kvRepository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const state = randomUUID();\n    const nonce = randomUUID();\n    const pkce = this.createPkceParameters();\n    const value: OAuth2State = { state, nonce, registrationId, ...pkce };\n    await this.kv.setItem(this.getOauth2StateKey(state), JSON.stringify(value), 10 * 60);\n    return Response.json({\n      state,\n      nonce,\n      code_challenge: pkce.code_challenge,\n      code_challenge_method: pkce.code_challenge_method,\n    });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n    mark('validate_session');\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('exchange_code');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredentials;\n    const key = this.getOauth2StateKey(credentials.state);\n    const value = await this.kv.getItem(key);\n    const cached = value ? (JSON.parse(value) as OAuth2State) : null;\n    if (!cached) {\n      const json = { error: 'invalid_request', error_description: 'oauth2 state not found' };\n      return Response.json(json, { status: 400 });\n    }\n    if (cached.registrationId !== registrationId) {\n      const json = { error: 'invalid_request', error_description: 'registration mismatch' };\n      return Response.json(json, { status: 400 });\n    }\n    mark('validate_state');\n\n    const pkce = {\n      code_verifier: cached.code_verifier,\n      code_challenge: cached.code_challenge,\n      code_challenge_method: cached.code_challenge_method,\n    };\n\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n      pkce,\n    });\n    mark('login_oauth2_native');\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) {\n      if (create) {\n        const session = this.repository.createSession();\n        await this.repository.save(session);\n        return session;\n      } else {\n        return null as T extends true ? Session : Session | null;\n      }\n    }\n    const session = await this.repository.findById(sessionId);\n    if (!session) {\n      if (create) {\n        const session = this.repository.createSession();\n        await this.repository.save(session);\n        return session;\n      } else {\n        return null as T extends true ? Session : Session | null;\n      }\n    }\n    return session;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAuC;AACvC,4BAAsB;AACtB,oBAA0C;AAC1C,kBAOO;AACP,oBAAwD;AAExD,oBAAuB;AAgBhB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA,oCAAoC;AAAA,EAErC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAE3B,gCAAgC;AAAA,EAEhD,YAAY,EAAE,mBAAmB,cAAc,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AACnF,SAAK,SAASA,WAAU;AACxB,SAAK,KAAK;AACV,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,2BAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,kCAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,uCAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,oBAAgB,0BAAW;AACjC,UAAM,qBAAiB,0BAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,iBAAiB;AAChE,8BAAAC,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,YAAQ,0BAAW;AACzB,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,QAAqB,EAAE,OAAO,OAAO,gBAAgB,GAAG,KAAK;AACnE,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,KAAK,UAAU,KAAK,GAAG,KAAK,EAAE;AACnF,WAAO,SAAS,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,uBAAuB,KAAK;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,YAAQ,0BAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,iBAAO,mBAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,wCAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AACA,SAAK,kBAAkB;AAGvB,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,eAAe;AAGpB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,yCAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,8BAAAA,SAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,QAAI,sBAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,QAAI,mBAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,MAAM,KAAK,kBAAkB,YAAY,KAAK;AACpD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,GAAG;AACvC,UAAM,SAAS,QAAS,KAAK,MAAM,KAAK,IAAoB;AAC5D,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,yBAAyB;AACrF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,QAAI,OAAO,mBAAmB,gBAAgB;AAC5C,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,wBAAwB;AACpF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,SAAK,gBAAgB;AAErB,UAAM,OAAO;AAAA,MACX,eAAe,OAAO;AAAA,MACtB,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,yCAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,+BAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,OAAO,cAAwC;AACpD,UAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;AACzE,eAAW,aAAa,SAAS,KAAK,GAAG;AACvC,YAAM,KAAK,WAAW,WAAW,SAAS;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,aAAa,OACX,SACA,WACuD;AACvD,UAAM,gBAAY,uBAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,WAAW;AACd,UAAI,QAAQ;AACV,cAAMC,WAAU,KAAK,WAAW,cAAc;AAC9C,cAAM,KAAK,WAAW,KAAKA,QAAO;AAClC,eAAOA;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,SAAS;AACZ,UAAI,QAAQ;AACV,cAAMA,WAAU,KAAK,WAAW,cAAc;AAC9C,cAAM,KAAK,WAAW,KAAKA,QAAO;AAClC,eAAOA;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,gBAAgB,OAAO,cAAqC;AAC1D,UAAM,KAAK,WAAW,WAAW,SAAS;AAAA,EAC5C;AAAA,EAEA,yBAAyB,OAAO,iBAA6C;AAC3E,UAAM,KAAK,WAAW,uBAAuB,YAAY;AACzD,WAAO,SAAS,KAAK,CAAC,CAAC;AAAA,EACzB;AACF;","names":["timing","invariant","session"]}

package/dist/auth/index.d.cts

@@ -1,7 +1,7 @@
+import { Session } from '../session/types.cjs';
 import { AuthService, AuthConfig, LoggedHandler, OAuth2AuthorizedHandler } from './types.cjs';
-import '../core/index.cjs';
+import { Principal } from '../core/index.cjs';
 import '../oauth2/types.cjs';
-import '../session/types.cjs';
 import '../utils/http.cjs';
 import 'cookie';
 
@@ -31,6 +31,9 @@ declare class Auth implements AuthService {
     private redirect;
     loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
     loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
+    kick: (principal: Principal) => Promise<void>;
+    getSession: <T extends boolean>(request: Request, create: T) => Promise<T extends true ? Session : Session | null>;
+    deleteSession: (sessionId: string) => Promise<void>;
     cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
 }
 

package/dist/auth/index.d.ts

@@ -1,7 +1,7 @@
+import { Session } from '../session/types.js';
 import { AuthService, AuthConfig, LoggedHandler, OAuth2AuthorizedHandler } from './types.js';
-import '../core/index.js';
+import { Principal } from '../core/index.js';
 import '../oauth2/types.js';
-import '../session/types.js';
 import '../utils/http.js';
 import 'cookie';
 
@@ -31,6 +31,9 @@ declare class Auth implements AuthService {
     private redirect;
     loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
     loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
+    kick: (principal: Principal) => Promise<void>;
+    getSession: <T extends boolean>(request: Request, create: T) => Promise<T extends true ? Session : Session | null>;
+    deleteSession: (sessionId: string) => Promise<void>;
     cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
 }
 

package/dist/auth/index.mjs

@@ -221,6 +221,38 @@ var Auth = class {
     setTiming(response);
     return response;
   };
+  kick = async (principal) => {
+    const sessions = await this.repository.findByPrincipalName(principal.name);
+    for (const sessionId of sessions.keys()) {
+      await this.repository.deleteById(sessionId);
+    }
+  };
+  getSession = async (request, create) => {
+    const sessionId = getCookie(request, this.cookieName);
+    if (!sessionId) {
+      if (create) {
+        const session2 = this.repository.createSession();
+        await this.repository.save(session2);
+        return session2;
+      } else {
+        return null;
+      }
+    }
+    const session = await this.repository.findById(sessionId);
+    if (!session) {
+      if (create) {
+        const session2 = this.repository.createSession();
+        await this.repository.save(session2);
+        return session2;
+      } else {
+        return null;
+      }
+    }
+    return session;
+  };
+  deleteSession = async (sessionId) => {
+    await this.repository.deleteById(sessionId);
+  };
   cleanupExpiredSessions = async (cleanupCount) => {
     await this.repository.cleanupExpiredSessions(cleanupCount);
     return Response.json({});

package/dist/auth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport {\n  param,\n  query,\n  getCookie,\n  setCookie,\n  deleteCookie,\n  type CookieOptions,\n} from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport { timing } from '../utils/timing';\nimport type { KVRepository, SessionRepository } from '../session/types';\nimport type {\n  NativeCredentials,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n} from '../oauth2/types';\nimport type {\n  AuthConfig,\n  AuthService,\n  LoggedHandler,\n  OAuth2AuthorizedHandler,\n  OAuth2State,\n} from './types';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n\n  public readonly PATH_CLEANUP_EXPIRED_SESSIONS = '/sessions/expired/cleanup' as const;\n\n  constructor({ sessionRepository, kvRepository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const state = randomUUID();\n    const nonce = randomUUID();\n    const pkce = this.createPkceParameters();\n    const value: OAuth2State = { state, nonce, registrationId, ...pkce };\n    await this.kv.setItem(this.getOauth2StateKey(state), JSON.stringify(value), 10 * 60);\n    return Response.json({\n      state,\n      nonce,\n      code_challenge: pkce.code_challenge,\n      code_challenge_method: pkce.code_challenge_method,\n    });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n    mark('validate_session');\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('exchange_code');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredentials;\n    const key = this.getOauth2StateKey(credentials.state);\n    const value = await this.kv.getItem(key);\n    const cached = value ? (JSON.parse(value) as OAuth2State) : null;\n    if (!cached) {\n      const json = { error: 'invalid_request', error_description: 'oauth2 state not found' };\n      return Response.json(json, { status: 400 });\n    }\n    if (cached.registrationId !== registrationId) {\n      const json = { error: 'invalid_request', error_description: 'registration mismatch' };\n      return Response.json(json, { status: 400 });\n    }\n    mark('validate_state');\n\n    const pkce = {\n      code_verifier: cached.code_verifier,\n      code_challenge: cached.code_challenge,\n      code_challenge_method: cached.code_challenge_method,\n    };\n\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n      pkce,\n    });\n    mark('login_oauth2_native');\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";AAAA,SAAS,YAAY,kBAAkB;AACvC,OAAO,eAAe;AACtB,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,cAAc,iCAAiC;AAExD,SAAS,cAAc;AAehB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA,oCAAoC;AAAA,EAErC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAE3B,gCAAgC;AAAA,EAEhD,YAAY,EAAE,mBAAmB,cAAc,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AACnF,SAAK,SAASA,WAAU;AACxB,SAAK,KAAK;AACV,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,aAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,iBAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,yBAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,gBAAgB,WAAW;AACjC,UAAM,iBAAiB,WAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,iBAAiB;AAChE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,QAAQ,WAAW;AACzB,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,QAAqB,EAAE,OAAO,OAAO,gBAAgB,GAAG,KAAK;AACnE,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,KAAK,UAAU,KAAK,GAAG,KAAK,EAAE;AACnF,WAAO,SAAS,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,uBAAuB,KAAK;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,aAAO,MAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AACA,SAAK,kBAAkB;AAGvB,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,eAAe;AAGpB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,MAAM,KAAK,kBAAkB,YAAY,KAAK;AACpD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,GAAG;AACvC,UAAM,SAAS,QAAS,KAAK,MAAM,KAAK,IAAoB;AAC5D,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,yBAAyB;AACrF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,QAAI,OAAO,mBAAmB,gBAAgB;AAC5C,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,wBAAwB;AACpF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,SAAK,gBAAgB;AAErB,UAAM,OAAO;AAAA,MACX,eAAe,OAAO;AAAA,MACtB,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,yBAAyB,OAAO,iBAA6C;AAC3E,UAAM,KAAK,WAAW,uBAAuB,YAAY;AACzD,WAAO,SAAS,KAAK,CAAC,CAAC;AAAA,EACzB;AACF;","names":["timing"]}
+{"version":3,"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'crypto';\nimport invariant from 'tiny-invariant';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport {\n  param,\n  query,\n  getCookie,\n  setCookie,\n  deleteCookie,\n  type CookieOptions,\n} from '../utils/http';\nimport { OAuth2Client, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2ErrorType } from '../oauth2/error';\nimport { timing } from '../utils/timing';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport type {\n  NativeCredentials,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n} from '../oauth2/types';\nimport type {\n  AuthConfig,\n  AuthService,\n  LoggedHandler,\n  OAuth2AuthorizedHandler,\n  OAuth2State,\n} from './types';\nimport { Principal } from '../core';\n\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  public readonly PATH_CSRF = '/csrf' as const;\n  public readonly PATH_LOGOUT = '/logout' as const;\n  public readonly PATH_LOGGED = '/logged' as const;\n\n  public readonly PATH_OAUTH2_STATE = '/oauth2/state/:registrationId' as const;\n  public readonly PATH_OAUTH2_AUTHORIZATION = '/oauth2/authorization/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_CODE = '/login/oauth2/code/:registrationId' as const;\n  public readonly PATH_LOGIN_OAUTH2_NATIVE = '/login/oauth2/native/:registrationId' as const;\n\n  public readonly PATH_CLEANUP_EXPIRED_SESSIONS = '/sessions/expired/cleanup' as const;\n\n  constructor({ sessionRepository, kvRepository, oauth2, cookie, timing }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n  }\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    deleteCookie(response, this.cookieName);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) return Response.json({ data: false });\n    const session = await this.repository.findById(sessionId);\n    if (!session) return Response.json({ data: false });\n\n    // 2. get principal name from session\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    // 3. call onLogged\n    if (name !== null) await onLogged?.({ name: String(name) });\n\n    // 4. renew cookie\n    const response = Response.json({ data: name !== null });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    return response;\n  };\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { registrationId } = param(request, this.PATH_OAUTH2_STATE);\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const state = randomUUID();\n    const nonce = randomUUID();\n    const pkce = this.createPkceParameters();\n    const value: OAuth2State = { state, nonce, registrationId, ...pkce };\n    await this.kv.setItem(this.getOauth2StateKey(state), JSON.stringify(value), 10 * 60);\n    return Response.json({\n      state,\n      nonce,\n      code_challenge: pkce.code_challenge,\n      code_challenge_method: pkce.code_challenge_method,\n    });\n  };\n\n  oauth2Authorization = async (request: Request): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_OAUTH2_AUTHORIZATION);\n    const state = randomUUID();\n    const pkce = this.createPkceParameters();\n    const uri = this.oauth2Client.createAuthorizationUri({ registrationId, state, pkce });\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId\n      ? ((await this.repository.findById(sessionId)) ?? this.repository.createSession())\n      : this.repository.createSession();\n    mark('fetch_session');\n\n    const authorizationRequest: OAuth2AuthorizationRequest = {\n      state,\n      registrationId,\n      authorizationRequestUri: uri.href,\n      additionalParameters: pkce,\n    };\n\n    const value = JSON.stringify(authorizationRequest);\n    session.setAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST, value);\n    await this.repository.save(session);\n    mark('save_session');\n\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  private redirect = (error: OAuth2ErrorType, description?: string): Response => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    uri.searchParams.set('error', error);\n    if (description) uri.searchParams.set('error_description', description);\n    return Response.redirect(uri.href, 302);\n  };\n\n  loginOAuth2Code = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. get session from cookie\n    const sessionId = getCookie(request, this.cookieName);\n    const session = sessionId ? await this.repository.findById(sessionId) : null;\n    if (!session) {\n      return this.redirect('invalid_request', 'session not found');\n    }\n    mark('load_session');\n\n    // 2. get cached authorization request from session\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) {\n      return this.redirect('invalid_request', 'authorization request not  found');\n    }\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 3. validate redirect query/formdata\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_CODE);\n    let data: Record<string, string>;\n    // apple redirect: response_mode=form_post\n    if (\n      request.method === 'POST' &&\n      request.headers.get('content-type')?.toLowerCase() === 'application/x-www-form-urlencoded'\n    ) {\n      const params = new URLSearchParams(await request.text());\n      data = Object.fromEntries(params.entries());\n    } else {\n      data = query(request);\n    }\n\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (!parsed.data.code || !parsed.data.state) {\n      return this.redirect('invalid_request', 'invalid redirect query');\n    }\n    if (parsed.data.state !== cached.state) {\n      return this.redirect('invalid_request', 'redirect state mismatch');\n    }\n    if (registrationId !== cached.registrationId) {\n      return this.redirect('invalid_request', 'redirect registration mismatch');\n    }\n    mark('validate_session');\n\n    // 4. exchange authorization code for token and get user info\n    const { code } = parsed.data;\n\n    const token = await this.oauth2Client.exchangeAuthorizationCode({\n      registrationId,\n      code,\n      pkce: cached.additionalParameters,\n    });\n    const userInfo = await this.oauth2Client.getUserInfo({ registrationId, token });\n    mark('exchange_code');\n\n    // 5. create or update principal\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    // 6. update session\n    session.setLastAccessedTime(Date.now());\n    session.removeAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST);\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    mark('update_session');\n\n    const response = new Response(null, {\n      status: 302,\n      headers: { location: this.oauth2Client.successUri },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  loginOAuth2Native = async (\n    request: Request,\n    onAuthorized: OAuth2AuthorizedHandler\n  ): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n    const { registrationId } = param(request, this.PATH_LOGIN_OAUTH2_NATIVE);\n    const credentials = (await request.json()) as NativeCredentials;\n    const key = this.getOauth2StateKey(credentials.state);\n    const value = await this.kv.getItem(key);\n    const cached = value ? (JSON.parse(value) as OAuth2State) : null;\n    if (!cached) {\n      const json = { error: 'invalid_request', error_description: 'oauth2 state not found' };\n      return Response.json(json, { status: 400 });\n    }\n    if (cached.registrationId !== registrationId) {\n      const json = { error: 'invalid_request', error_description: 'registration mismatch' };\n      return Response.json(json, { status: 400 });\n    }\n    mark('validate_state');\n\n    const pkce = {\n      code_verifier: cached.code_verifier,\n      code_challenge: cached.code_challenge,\n      code_challenge_method: cached.code_challenge_method,\n    };\n\n    const { userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n      registrationId,\n      credentials,\n      pkce,\n    });\n    mark('login_oauth2_native');\n\n    const principal = await onAuthorized(request, registrationId, userInfo, token);\n    mark('save_principal');\n\n    const session = this.repository.createSession();\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    const response = new Response(JSON.stringify(principal), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    });\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), { ...this.cookieOptions, maxAge });\n    setTiming(response);\n\n    return response;\n  };\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    const sessionId = getCookie(request, this.cookieName);\n    if (!sessionId) {\n      if (create) {\n        const session = this.repository.createSession();\n        await this.repository.save(session);\n        return session;\n      } else {\n        return null as T extends true ? Session : Session | null;\n      }\n    }\n    const session = await this.repository.findById(sessionId);\n    if (!session) {\n      if (create) {\n        const session = this.repository.createSession();\n        await this.repository.save(session);\n        return session;\n      } else {\n        return null as T extends true ? Session : Session | null;\n      }\n    }\n    return session;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";AAAA,SAAS,YAAY,kBAAkB;AACvC,OAAO,eAAe;AACtB,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,cAAc,iCAAiC;AAExD,SAAS,cAAc;AAgBhB,IAAM,OAAN,MAAkC;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA,oCAAoC;AAAA,EAErC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EAEd,oBAAoB;AAAA,EACpB,4BAA4B;AAAA,EAC5B,yBAAyB;AAAA,EACzB,2BAA2B;AAAA,EAE3B,gCAAgC;AAAA,EAEhD,YAAY,EAAE,mBAAmB,cAAc,QAAQ,QAAQ,QAAAA,QAAO,GAAe;AACnF,SAAK,SAASA,WAAU;AACxB,SAAK,KAAK;AACV,SAAK,aAAa;AAClB,UAAM,EAAE,MAAM,GAAG,cAAc,IAAI,UAAU,CAAC;AAC9C,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AAAA,MACnB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AACA,SAAK,eAAe,QAAQ,SAAS,IAAI,aAAa,OAAO,MAAM,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,OAAO,YAAwC;AACtD,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,UAAW,OAAM,KAAK,WAAW,WAAW,SAAS;AACzD,UAAM,WAAW,SAAS,KAAK,CAAC,CAAC;AACjC,iBAAa,UAAU,KAAK,UAAU;AACtC,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,OAAO,SAAkB,aAAgD;AAEhF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,UAAW,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AACpD,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,QAAS,QAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;AAGlD,UAAM,OAAO,QAAQ,aAAa,yBAAyB;AAC3D,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,UAAM,KAAK,WAAW,KAAK,OAAO;AAGlC,QAAI,SAAS,KAAM,OAAM,WAAW,EAAE,MAAM,OAAO,IAAI,EAAE,CAAC;AAG1D,UAAM,WAAW,SAAS,KAAK,EAAE,MAAM,SAAS,KAAK,CAAC;AACtD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,WAAO;AAAA,EACT;AAAA,EAEQ,uBAAuC;AAC7C,UAAM,gBAAgB,WAAW;AACjC,UAAM,iBAAiB,WAAW,QAAQ,EACvC,OAAO,aAAa,EACpB,OAAO,EACP,SAAS,WAAW;AAEvB,WAAO,EAAE,eAAe,gBAAgB,uBAAuB,OAAO;AAAA,EACxE;AAAA,EAEQ,kBAAkB,OAAe;AACvC,WAAO,gBAAgB,KAAK;AAAA,EAC9B;AAAA,EAEA,cAAc,OAAO,YAAwC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,iBAAiB;AAChE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,QAAQ,WAAW;AACzB,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,QAAqB,EAAE,OAAO,OAAO,gBAAgB,GAAG,KAAK;AACnE,UAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,KAAK,UAAU,KAAK,GAAG,KAAK,EAAE;AACnF,WAAO,SAAS,KAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,uBAAuB,KAAK;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EAEA,sBAAsB,OAAO,YAAwC;AACnE,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,yBAAyB;AACxE,UAAM,QAAQ,WAAW;AACzB,UAAM,OAAO,KAAK,qBAAqB;AACvC,UAAM,MAAM,KAAK,aAAa,uBAAuB,EAAE,gBAAgB,OAAO,KAAK,CAAC;AACpF,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YACV,MAAM,KAAK,WAAW,SAAS,SAAS,KAAM,KAAK,WAAW,cAAc,IAC9E,KAAK,WAAW,cAAc;AAClC,SAAK,eAAe;AAEpB,UAAM,uBAAmD;AAAA,MACvD;AAAA,MACA;AAAA,MACA,yBAAyB,IAAI;AAAA,MAC7B,sBAAsB;AAAA,IACxB;AAEA,UAAM,QAAQ,KAAK,UAAU,oBAAoB;AACjD,YAAQ,aAAa,KAAK,mCAAmC,KAAK;AAClE,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,cAAc;AAEnB,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,IAAI,KAAK,EAAE,CAAC;AACpF,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,CAAC,OAAwB,gBAAmC;AAC7E,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;AAC9C,QAAI,aAAa,IAAI,SAAS,KAAK;AACnC,QAAI,YAAa,KAAI,aAAa,IAAI,qBAAqB,WAAW;AACtE,WAAO,SAAS,SAAS,IAAI,MAAM,GAAG;AAAA,EACxC;AAAA,EAEA,kBAAkB,OAChB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAG3D,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,UAAM,UAAU,YAAY,MAAM,KAAK,WAAW,SAAS,SAAS,IAAI;AACxE,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,SAAS,mBAAmB,mBAAmB;AAAA,IAC7D;AACA,SAAK,cAAc;AAGnB,UAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;AACxE,QAAI,CAAC,MAAM;AACT,aAAO,KAAK,SAAS,mBAAmB,kCAAkC;AAAA,IAC5E;AACA,UAAM,SAAqC,KAAK,MAAM,IAAI;AAG1D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,sBAAsB;AACrE,QAAI;AAEJ,QACE,QAAQ,WAAW,UACnB,QAAQ,QAAQ,IAAI,cAAc,GAAG,YAAY,MAAM,qCACvD;AACA,YAAM,SAAS,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC;AACvD,aAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,IAC5C,OAAO;AACL,aAAO,MAAM,OAAO;AAAA,IACtB;AAEA,UAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,KAAK,OAAO;AAC3C,aAAO,KAAK,SAAS,mBAAmB,wBAAwB;AAAA,IAClE;AACA,QAAI,OAAO,KAAK,UAAU,OAAO,OAAO;AACtC,aAAO,KAAK,SAAS,mBAAmB,yBAAyB;AAAA,IACnE;AACA,QAAI,mBAAmB,OAAO,gBAAgB;AAC5C,aAAO,KAAK,SAAS,mBAAmB,gCAAgC;AAAA,IAC1E;AACA,SAAK,kBAAkB;AAGvB,UAAM,EAAE,KAAK,IAAI,OAAO;AAExB,UAAM,QAAQ,MAAM,KAAK,aAAa,0BAA0B;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,MAAM,OAAO;AAAA,IACf,CAAC;AACD,UAAM,WAAW,MAAM,KAAK,aAAa,YAAY,EAAE,gBAAgB,MAAM,CAAC;AAC9E,SAAK,eAAe;AAGpB,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAGrB,YAAQ,oBAAoB,KAAK,IAAI,CAAC;AACtC,YAAQ,gBAAgB,KAAK,iCAAiC;AAC9D,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,SAAK,gBAAgB;AAErB,UAAM,WAAW,IAAI,SAAS,MAAM;AAAA,MAClC,QAAQ;AAAA,MACR,SAAS,EAAE,UAAU,KAAK,aAAa,WAAW;AAAA,IACpD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,oBAAoB,OAClB,SACA,iBACsB;AACtB,cAAU,KAAK,cAAc,iCAAiC;AAC9D,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;AAC3D,UAAM,EAAE,eAAe,IAAI,MAAM,SAAS,KAAK,wBAAwB;AACvE,UAAM,cAAe,MAAM,QAAQ,KAAK;AACxC,UAAM,MAAM,KAAK,kBAAkB,YAAY,KAAK;AACpD,UAAM,QAAQ,MAAM,KAAK,GAAG,QAAQ,GAAG;AACvC,UAAM,SAAS,QAAS,KAAK,MAAM,KAAK,IAAoB;AAC5D,QAAI,CAAC,QAAQ;AACX,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,yBAAyB;AACrF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,QAAI,OAAO,mBAAmB,gBAAgB;AAC5C,YAAM,OAAO,EAAE,OAAO,mBAAmB,mBAAmB,wBAAwB;AACpF,aAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5C;AACA,SAAK,gBAAgB;AAErB,UAAM,OAAO;AAAA,MACX,eAAe,OAAO;AAAA,MACtB,gBAAgB,OAAO;AAAA,MACvB,uBAAuB,OAAO;AAAA,IAChC;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI,MAAM,KAAK,aAAa,kBAAkB;AAAA,MACpE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,qBAAqB;AAE1B,UAAM,YAAY,MAAM,aAAa,SAAS,gBAAgB,UAAU,KAAK;AAC7E,SAAK,gBAAgB;AAErB,UAAM,UAAU,KAAK,WAAW,cAAc;AAC9C,YAAQ,aAAa,2BAA2B,UAAU,IAAI;AAC9D,UAAM,KAAK,WAAW,KAAK,OAAO;AAClC,UAAM,WAAW,IAAI,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC;AACD,UAAM,SAAS,QAAQ,uBAAuB;AAC9C,cAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG,EAAE,GAAG,KAAK,eAAe,OAAO,CAAC;AACvF,cAAU,QAAQ;AAElB,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,OAAO,cAAwC;AACpD,UAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;AACzE,eAAW,aAAa,SAAS,KAAK,GAAG;AACvC,YAAM,KAAK,WAAW,WAAW,SAAS;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,aAAa,OACX,SACA,WACuD;AACvD,UAAM,YAAY,UAAU,SAAS,KAAK,UAAU;AACpD,QAAI,CAAC,WAAW;AACd,UAAI,QAAQ;AACV,cAAMC,WAAU,KAAK,WAAW,cAAc;AAC9C,cAAM,KAAK,WAAW,KAAKA,QAAO;AAClC,eAAOA;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;AACxD,QAAI,CAAC,SAAS;AACZ,UAAI,QAAQ;AACV,cAAMA,WAAU,KAAK,WAAW,cAAc;AAC9C,cAAM,KAAK,WAAW,KAAKA,QAAO;AAClC,eAAOA;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,gBAAgB,OAAO,cAAqC;AAC1D,UAAM,KAAK,WAAW,WAAW,SAAS;AAAA,EAC5C;AAAA,EAEA,yBAAyB,OAAO,iBAA6C;AAC3E,UAAM,KAAK,WAAW,uBAAuB,YAAY;AACzD,WAAO,SAAS,KAAK,CAAC,CAAC;AAAA,EACzB;AACF;","names":["timing","session"]}

package/dist/auth/types.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { Principal } from '../core';\nimport type { OAuth2Token, OAuth2ClientConfig, PkceParameters, UserInfo } from '../oauth2/types';\nimport type { KVRepository, SessionRepository } from '../session/types';\nimport type { CookieOptions } from '../utils/http';\n\nexport type LoggedHandler = (principal: Principal) => Promise<void>;\nexport type OAuth2AuthorizedHandler = (\n  request: Request,\n  registrationId: string,\n  userInfo: UserInfo,\n  token: OAuth2Token\n) => Promise<Principal>;\n\nexport interface OAuth2State extends PkceParameters {\n  state: string;\n  nonce: string;\n  registrationId: string;\n}\n\nexport interface AuthConfig {\n  timing?: boolean;\n  kvRepository: KVRepository;\n  sessionRepository: SessionRepository;\n  cookie?: CookieOptions & { name?: string };\n  oauth2?: {\n    client?: OAuth2ClientConfig;\n  };\n}\n\nexport interface AuthService {\n  logout: (request: Request) => Promise<Response>;\n  logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;\n\n  oauth2State: (request: Request) => Promise<Response>;\n  oauth2Authorization: (request: Request) => Promise<Response>;\n  loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n  loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}
+{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { Principal } from '../core';\nimport type { OAuth2Token, OAuth2ClientConfig, PkceParameters, UserInfo } from '../oauth2/types';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport type { CookieOptions } from '../utils/http';\n\nexport type LoggedHandler = (principal: Principal) => Promise<void>;\nexport type OAuth2AuthorizedHandler = (\n  request: Request,\n  registrationId: string,\n  userInfo: UserInfo,\n  token: OAuth2Token\n) => Promise<Principal>;\n\nexport interface OAuth2State extends PkceParameters {\n  state: string;\n  nonce: string;\n  registrationId: string;\n}\n\nexport interface AuthConfig {\n  timing?: boolean;\n  kvRepository: KVRepository;\n  sessionRepository: SessionRepository;\n  cookie?: CookieOptions & { name?: string };\n  oauth2?: {\n    client?: OAuth2ClientConfig;\n  };\n}\n\nexport interface AuthService {\n  // basic\n  logout: (request: Request) => Promise<Response>;\n  logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;\n\n  // oauth2\n  oauth2State: (request: Request) => Promise<Response>;\n  oauth2Authorization: (request: Request) => Promise<Response>;\n  loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n  loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;\n\n  // session management\n  kick: (principal: Principal) => Promise<void>;\n  getSession: <T extends boolean>(\n    request: Request,\n    create: T\n  ) => Promise<T extends true ? Session : Session | null>;\n  deleteSession: (sessionId: string) => Promise<void>;\n  cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/dist/auth/types.d.cts

@@ -1,6 +1,6 @@
 import { Principal } from '../core/index.cjs';
 import { UserInfo, OAuth2Token, OAuth2ClientConfig, PkceParameters } from '../oauth2/types.cjs';
-import { KVRepository, SessionRepository } from '../session/types.cjs';
+import { Session, KVRepository, SessionRepository } from '../session/types.cjs';
 import { CookieOptions } from '../utils/http.cjs';
 import 'cookie';
 
@@ -29,6 +29,10 @@ interface AuthService {
     oauth2Authorization: (request: Request) => Promise<Response>;
     loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
     loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
+    kick: (principal: Principal) => Promise<void>;
+    getSession: <T extends boolean>(request: Request, create: T) => Promise<T extends true ? Session : Session | null>;
+    deleteSession: (sessionId: string) => Promise<void>;
+    cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
 }
 
 export type { AuthConfig, AuthService, LoggedHandler, OAuth2AuthorizedHandler, OAuth2State };

package/dist/auth/types.d.ts

@@ -1,6 +1,6 @@
 import { Principal } from '../core/index.js';
 import { UserInfo, OAuth2Token, OAuth2ClientConfig, PkceParameters } from '../oauth2/types.js';
-import { KVRepository, SessionRepository } from '../session/types.js';
+import { Session, KVRepository, SessionRepository } from '../session/types.js';
 import { CookieOptions } from '../utils/http.js';
 import 'cookie';
 
@@ -29,6 +29,10 @@ interface AuthService {
     oauth2Authorization: (request: Request) => Promise<Response>;
     loginOAuth2Code: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
     loginOAuth2Native: (request: Request, onAuthorized: OAuth2AuthorizedHandler) => Promise<Response>;
+    kick: (principal: Principal) => Promise<void>;
+    getSession: <T extends boolean>(request: Request, create: T) => Promise<T extends true ? Session : Session | null>;
+    deleteSession: (sessionId: string) => Promise<void>;
+    cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
 }
 
 export type { AuthConfig, AuthService, LoggedHandler, OAuth2AuthorizedHandler, OAuth2State };

package/dist/session/redis.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/session/redis.ts"],"sourcesContent":["import { resolveIndexesFor, PRINCIPAL_NAME_INDEX_NAME, SPRING_SECURITY_CONTEXT } from './common';\nimport { MapSession } from './map-session';\nimport type { Redis } from 'ioredis';\nimport type { KVRepository, Namespace, Session, SessionRepository } from './types';\n\nconst CREATION_TIME_KEY = 'creationTime';\nconst LAST_ACCESSED_TIME_KEY = 'lastAccessedTime';\nconst MAX_INACTIVE_INTERVAL_KEY = 'maxInactiveInterval';\nconst ATTRIBUTE_PREFIX = 'sessionAttr:';\nconst SESSION_EXPIRES_PREFIX = 'expires:';\n\nclass RedisSession implements Session {\n  private readonly cached: MapSession;\n\n  public isNew: boolean;\n  public delta = new Map<string, string | number | null>();\n  public originalSessionId: string;\n  public originalPrincipalName: string | null;\n  public originalLastAccessTime: number | null = null;\n\n  constructor(cached: MapSession, isNew: boolean) {\n    this.cached = cached;\n    this.isNew = isNew;\n    this.originalSessionId = cached.getId();\n    this.originalPrincipalName = resolveIndexesFor(this);\n\n    if (isNew) {\n      this.delta.set(CREATION_TIME_KEY, cached.getCreationTime());\n      this.delta.set(LAST_ACCESSED_TIME_KEY, cached.getLastAccessedTime());\n      this.delta.set(MAX_INACTIVE_INTERVAL_KEY, cached.getMaxInactiveInterval());\n      this.cached.getAttributeNames().forEach((name) => {\n        const value = this.cached.getAttribute(name);\n        if (value) this.delta.set(this.getSessionAttrNameKey(name), value);\n      });\n    }\n  }\n\n  getSessionAttrNameKey(name: string) {\n    return ATTRIBUTE_PREFIX + name;\n  }\n\n  // override\n  setLastAccessedTime(lastAccessedTime: number) {\n    this.cached.setLastAccessedTime(lastAccessedTime);\n    this.delta.set(LAST_ACCESSED_TIME_KEY, lastAccessedTime);\n  }\n\n  isExpired() {\n    return this.cached.isExpired();\n  }\n\n  getCreationTime() {\n    return this.cached.getCreationTime();\n  }\n\n  getId() {\n    return this.cached.getId();\n  }\n\n  changeSessionId() {\n    return this.cached.changeSessionId();\n  }\n\n  getLastAccessedTime() {\n    return this.cached.getLastAccessedTime();\n  }\n\n  setMaxInactiveInterval(interval: number) {\n    this.cached.setMaxInactiveInterval(interval);\n    this.delta.set(MAX_INACTIVE_INTERVAL_KEY, interval);\n  }\n\n  getMaxInactiveInterval() {\n    return this.cached.getMaxInactiveInterval();\n  }\n\n  getAttribute(name: string) {\n    return this.cached.getAttribute(name);\n  }\n\n  getAttributeNames() {\n    return this.cached.getAttributeNames();\n  }\n\n  setAttribute(name: string, value: string) {\n    this.cached.setAttribute(name, value);\n    this.delta.set(this.getSessionAttrNameKey(name), value);\n  }\n\n  removeAttribute(name: string) {\n    this.cached.removeAttribute(name);\n    this.delta.set(this.getSessionAttrNameKey(name), null);\n  }\n}\n\ninterface RedisSessionExpirationStore {\n  save(session: RedisSession): Promise<void>;\n  remove(sessionId: string): Promise<void>;\n  rename(session: RedisSession): Promise<void>;\n  cleanupExpiredSessions(cleanupCount?: number): Promise<void>;\n}\n\nclass SortedSetRedisSessionExpirationStore implements RedisSessionExpirationStore {\n  private readonly redis: Redis;\n  private readonly namespace: Namespace;\n  private readonly expirationsKey: string;\n\n  constructor(redis: Redis, namespace: Namespace) {\n    this.redis = redis;\n    this.namespace = namespace;\n    this.expirationsKey = `${this.namespace}:sessions:expirations`;\n  }\n\n  getSessionKey(sessionId: string) {\n    return `${this.namespace}:sessions:${sessionId}`;\n  }\n\n  async save(session: RedisSession) {\n    const expirationInMillis =\n      session.getLastAccessedTime() + session.getMaxInactiveInterval() * 1000;\n    await this.redis.zadd(this.expirationsKey, expirationInMillis, session.getId());\n  }\n\n  async remove(sessionId: string) {\n    await this.redis.zrem(this.expirationsKey, sessionId);\n  }\n\n  async rename(session: RedisSession) {\n    if (session.originalSessionId === null || session.originalSessionId === session.getId()) return;\n    await this.remove(session.originalSessionId);\n    await this.save(session);\n  }\n\n  async cleanupExpiredSessions(cleanupCount: number = 100) {\n    const key = this.expirationsKey;\n    const score = Date.now();\n    const sessionIds = await this.redis.zrevrangebyscore(key, score, 0, 'LIMIT', 0, cleanupCount);\n    if (sessionIds.length === 0) return;\n    for (const sessionId of sessionIds) {\n      const sessionKey = this.getSessionKey(sessionId);\n      // Checks if the session exists. By trying to access the session we only trigger a deletion\n      // if the TTL is expired.\n      await this.redis.exists(sessionKey);\n    }\n  }\n}\n\n// 15549130 <spring:session:sessions:uuid, hash<session>> + 300s\n// 15549147 <spring:session:sessions:expirations, sorted_set<uuid>> + 300s\n// 15548839 <spring:session:sessions:expires:uuid, string<empty>>\nexport class RedisIndexedSessionRepository implements SessionRepository<RedisSession> {\n  private readonly redis: Redis;\n  private readonly namespace: Namespace;\n  private readonly expirationStore: RedisSessionExpirationStore;\n\n  private defaultMaxInactiveInterval = 1800;\n\n  constructor(redis: Redis, namespace: Namespace = 'spring:session') {\n    this.redis = redis;\n    this.namespace = namespace;\n    this.expirationStore = new SortedSetRedisSessionExpirationStore(redis, namespace);\n  }\n\n  setDefaultMaxInactiveInterval(interval: number) {\n    this.defaultMaxInactiveInterval = interval;\n  }\n\n  private getSessionKey(sessionId: string) {\n    return `${this.namespace}:sessions:${sessionId}`;\n  }\n\n  private getExpiredKey(sessionId: string) {\n    return `${this.namespace}:sessions:expires:${sessionId}`;\n  }\n\n  private getSessionAttrNameKey(name: string) {\n    return ATTRIBUTE_PREFIX + name;\n  }\n\n  private getPrincipalKey(principalName: string) {\n    return `${this.namespace}:index:${PRINCIPAL_NAME_INDEX_NAME}:${principalName}`;\n  }\n\n  private async getSession(id: string, allowExpired: boolean): Promise<RedisSession | null> {\n    const key = this.getSessionKey(id);\n    const entries = await this.redis.hgetall(key);\n    if (!entries || Object.keys(entries).length === 0) return null;\n    const loaded = new MapSession(id);\n    if (!entries.creationTime) throw new Error('creationTime attribute not found');\n    if (!entries.lastAccessedTime) throw new Error('lastAccessedTime attribute not found');\n    if (!entries.maxInactiveInterval) throw new Error('maxInactiveInterval attribute not found');\n\n    loaded.setCreationTime(Number(entries.creationTime));\n    loaded.setLastAccessedTime(Number(entries.lastAccessedTime));\n    loaded.setMaxInactiveInterval(Number(entries.maxInactiveInterval));\n\n    for (const [key, value] of Object.entries(entries)) {\n      if (key.startsWith(ATTRIBUTE_PREFIX)) {\n        loaded.setAttribute(key.slice(ATTRIBUTE_PREFIX.length), value);\n      }\n    }\n\n    if (!allowExpired && loaded.isExpired()) return null;\n    const result = new RedisSession(loaded, false);\n    result.originalLastAccessTime = loaded.getLastAccessedTime();\n    return result;\n  }\n\n  private async saveDelta(session: RedisSession) {\n    if (session.delta.size === 0) return;\n    const sessionId = session.getId();\n    const delta = new Map<string, string | number>();\n    const removes: string[] = [];\n    session.delta.forEach((value, key) => {\n      if (value !== null) delta.set(key, value);\n      else removes.push(key);\n    });\n\n    if (delta.size !== 0) {\n      await this.redis.hset(this.getSessionKey(sessionId), delta);\n    }\n    if (removes.length !== 0) {\n      await this.redis.hdel(this.getSessionKey(sessionId), ...removes);\n    }\n\n    const principalSessionKey = this.getSessionAttrNameKey(PRINCIPAL_NAME_INDEX_NAME);\n    const securityPrincipalSessionKey = this.getSessionAttrNameKey(SPRING_SECURITY_CONTEXT);\n    if (session.delta.has(principalSessionKey) || session.delta.has(securityPrincipalSessionKey)) {\n      if (session.originalPrincipalName !== null) {\n        const originalPrincipalRedisKey = this.getPrincipalKey(session.originalPrincipalName);\n        await this.redis.srem(originalPrincipalRedisKey, sessionId);\n      }\n      const principal = resolveIndexesFor(session);\n      session.originalPrincipalName = principal;\n      if (principal !== null) {\n        const principalRedisKey = this.getPrincipalKey(principal);\n        await this.redis.sadd(principalRedisKey, sessionId);\n      }\n    }\n\n    if (session.isNew) {\n      // here your can send session created message to channel\n      session.isNew = false;\n    }\n\n    const sessionExpireInSeconds = session.getMaxInactiveInterval();\n\n    // createShadowKey start\n    const keyToExpire = SESSION_EXPIRES_PREFIX + session.getId();\n    const sessionKey = this.getSessionKey(keyToExpire);\n\n    if (sessionExpireInSeconds < 0) {\n      await this.redis.append(sessionKey, '');\n      await this.redis.persist(sessionKey);\n      await this.redis.persist(this.getSessionKey(session.getId()));\n    } else if (sessionExpireInSeconds === 0) {\n      await this.redis.del(sessionKey);\n    } else {\n      await this.redis.append(sessionKey, '');\n      await this.redis.expire(sessionKey, sessionExpireInSeconds);\n    }\n    // createShadowKey end\n\n    if (sessionExpireInSeconds > 0) {\n      const fiveMinutesAfterExpires = sessionExpireInSeconds + 5 * 60;\n      await this.redis.expire(this.getSessionKey(session.getId()), fiveMinutesAfterExpires);\n    }\n\n    await this.expirationStore.save(session);\n    session.delta.clear();\n  }\n\n  private async saveChangeSessionId(session: RedisSession) {\n    const sessionId = session.getId();\n    if (sessionId === session.originalSessionId) return;\n    if (!session.isNew) {\n      const originalSessionIdKey = this.getSessionKey(session.originalSessionId);\n      const sessionIdKey = this.getSessionKey(sessionId);\n      const originalExpiredKey = this.getExpiredKey(session.originalSessionId);\n      const expiredKey = this.getExpiredKey(sessionId);\n\n      await this.redis.rename(originalSessionIdKey, sessionIdKey);\n      await this.redis.rename(originalExpiredKey, expiredKey);\n\n      if (session.originalPrincipalName !== null) {\n        const originalPrincipalRedisKey = this.getPrincipalKey(session.originalPrincipalName);\n        await this.redis.srem(originalPrincipalRedisKey, session.originalSessionId);\n        await this.redis.sadd(originalPrincipalRedisKey, sessionId);\n      }\n      await this.expirationStore.rename(session);\n    }\n    session.originalSessionId = sessionId;\n  }\n\n  // override\n  createSession() {\n    const cached = new MapSession();\n    cached.setMaxInactiveInterval(this.defaultMaxInactiveInterval);\n    return new RedisSession(cached, true);\n  }\n\n  async save(session: RedisSession) {\n    await this.saveChangeSessionId(session);\n    await this.saveDelta(session);\n  }\n\n  async findById(sessionId: string): Promise<RedisSession | null> {\n    return this.getSession(sessionId, false);\n  }\n\n  async deleteById(sessionId: string) {\n    const session = await this.getSession(sessionId, true);\n    if (!session) return;\n    // 1. cleanup index\n    const principal = resolveIndexesFor(session);\n    if (principal !== null) {\n      await this.redis.srem(this.getPrincipalKey(principal), sessionId);\n    }\n    // 2. delete in set\n    await this.expirationStore.remove(sessionId);\n    // 3. delete expired key\n    const expiredKey = this.getExpiredKey(sessionId);\n    await this.redis.del(expiredKey);\n\n    session.setMaxInactiveInterval(0);\n    await this.save(session);\n  }\n\n  async findByIndexNameAndIndexValue(indexName: string, indexValue: string) {\n    if (indexName !== PRINCIPAL_NAME_INDEX_NAME) {\n      return new Map<string, RedisSession>();\n    }\n\n    const principalKey = this.getPrincipalKey(indexValue);\n    const sessionIds = await this.redis.smembers(principalKey);\n    if (!sessionIds || sessionIds.length === 0) {\n      return new Map<string, RedisSession>();\n    }\n    const sessions = new Map<string, RedisSession>();\n    for (const sessionId of sessionIds) {\n      const session = await this.findById(sessionId);\n      if (session !== null) {\n        sessions.set(sessionId, session);\n      }\n    }\n    return sessions;\n  }\n\n  async findByPrincipalName(principalName: string) {\n    return this.findByIndexNameAndIndexValue(PRINCIPAL_NAME_INDEX_NAME, principalName);\n  }\n\n  async cleanupExpiredSessions(cleanupCount?: number) {\n    await this.expirationStore.cleanupExpiredSessions(cleanupCount);\n  }\n}\n\nexport class RedisKVRepository implements KVRepository {\n  private readonly redis: Redis;\n\n  constructor(redis: Redis) {\n    this.redis = redis;\n  }\n\n  async setItem(key: string, value: string, expiresIn?: number) {\n    if (expiresIn) {\n      await this.redis.set(key, value, 'EX', expiresIn);\n    } else {\n      await this.redis.set(key, value);\n    }\n  }\n\n  async getItem(key: string): Promise<string | null> {\n    return await this.redis.get(key);\n  }\n\n  async removeItem(key: string) {\n    await this.redis.del(key);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAsF;AACtF,yBAA2B;AAI3B,IAAM,oBAAoB;AAC1B,IAAM,yBAAyB;AAC/B,IAAM,4BAA4B;AAClC,IAAM,mBAAmB;AACzB,IAAM,yBAAyB;AAE/B,IAAM,eAAN,MAAsC;AAAA,EACnB;AAAA,EAEV;AAAA,EACA,QAAQ,oBAAI,IAAoC;AAAA,EAChD;AAAA,EACA;AAAA,EACA,yBAAwC;AAAA,EAE/C,YAAY,QAAoB,OAAgB;AAC9C,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,SAAK,oBAAoB,OAAO,MAAM;AACtC,SAAK,4BAAwB,iCAAkB,IAAI;AAEnD,QAAI,OAAO;AACT,WAAK,MAAM,IAAI,mBAAmB,OAAO,gBAAgB,CAAC;AAC1D,WAAK,MAAM,IAAI,wBAAwB,OAAO,oBAAoB,CAAC;AACnE,WAAK,MAAM,IAAI,2BAA2B,OAAO,uBAAuB,CAAC;AACzE,WAAK,OAAO,kBAAkB,EAAE,QAAQ,CAAC,SAAS;AAChD,cAAM,QAAQ,KAAK,OAAO,aAAa,IAAI;AAC3C,YAAI,MAAO,MAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,KAAK;AAAA,MACnE,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,sBAAsB,MAAc;AAClC,WAAO,mBAAmB;AAAA,EAC5B;AAAA;AAAA,EAGA,oBAAoB,kBAA0B;AAC5C,SAAK,OAAO,oBAAoB,gBAAgB;AAChD,SAAK,MAAM,IAAI,wBAAwB,gBAAgB;AAAA,EACzD;AAAA,EAEA,YAAY;AACV,WAAO,KAAK,OAAO,UAAU;AAAA,EAC/B;AAAA,EAEA,kBAAkB;AAChB,WAAO,KAAK,OAAO,gBAAgB;AAAA,EACrC;AAAA,EAEA,QAAQ;AACN,WAAO,KAAK,OAAO,MAAM;AAAA,EAC3B;AAAA,EAEA,kBAAkB;AAChB,WAAO,KAAK,OAAO,gBAAgB;AAAA,EACrC;AAAA,EAEA,sBAAsB;AACpB,WAAO,KAAK,OAAO,oBAAoB;AAAA,EACzC;AAAA,EAEA,uBAAuB,UAAkB;AACvC,SAAK,OAAO,uBAAuB,QAAQ;AAC3C,SAAK,MAAM,IAAI,2BAA2B,QAAQ;AAAA,EACpD;AAAA,EAEA,yBAAyB;AACvB,WAAO,KAAK,OAAO,uBAAuB;AAAA,EAC5C;AAAA,EAEA,aAAa,MAAc;AACzB,WAAO,KAAK,OAAO,aAAa,IAAI;AAAA,EACtC;AAAA,EAEA,oBAAoB;AAClB,WAAO,KAAK,OAAO,kBAAkB;AAAA,EACvC;AAAA,EAEA,aAAa,MAAc,OAAe;AACxC,SAAK,OAAO,aAAa,MAAM,KAAK;AACpC,SAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,KAAK;AAAA,EACxD;AAAA,EAEA,gBAAgB,MAAc;AAC5B,SAAK,OAAO,gBAAgB,IAAI;AAChC,SAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,IAAI;AAAA,EACvD;AACF;AASA,IAAM,uCAAN,MAAkF;AAAA,EAC/D;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,OAAc,WAAsB;AAC9C,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,iBAAiB,GAAG,KAAK,SAAS;AAAA,EACzC;AAAA,EAEA,cAAc,WAAmB;AAC/B,WAAO,GAAG,KAAK,SAAS,aAAa,SAAS;AAAA,EAChD;AAAA,EAEA,MAAM,KAAK,SAAuB;AAChC,UAAM,qBACJ,QAAQ,oBAAoB,IAAI,QAAQ,uBAAuB,IAAI;AACrE,UAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,oBAAoB,QAAQ,MAAM,CAAC;AAAA,EAChF;AAAA,EAEA,MAAM,OAAO,WAAmB;AAC9B,UAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,SAAS;AAAA,EACtD;AAAA,EAEA,MAAM,OAAO,SAAuB;AAClC,QAAI,QAAQ,sBAAsB,QAAQ,QAAQ,sBAAsB,QAAQ,MAAM,EAAG;AACzF,UAAM,KAAK,OAAO,QAAQ,iBAAiB;AAC3C,UAAM,KAAK,KAAK,OAAO;AAAA,EACzB;AAAA,EAEA,MAAM,uBAAuB,eAAuB,KAAK;AACvD,UAAM,MAAM,KAAK;AACjB,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,aAAa,MAAM,KAAK,MAAM,iBAAiB,KAAK,OAAO,GAAG,SAAS,GAAG,YAAY;AAC5F,QAAI,WAAW,WAAW,EAAG;AAC7B,eAAW,aAAa,YAAY;AAClC,YAAM,aAAa,KAAK,cAAc,SAAS;AAG/C,YAAM,KAAK,MAAM,OAAO,UAAU;AAAA,IACpC;AAAA,EACF;AACF;AAKO,IAAM,gCAAN,MAA+E;AAAA,EACnE;AAAA,EACA;AAAA,EACA;AAAA,EAET,6BAA6B;AAAA,EAErC,YAAY,OAAc,YAAuB,kBAAkB;AACjE,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,kBAAkB,IAAI,qCAAqC,OAAO,SAAS;AAAA,EAClF;AAAA,EAEA,8BAA8B,UAAkB;AAC9C,SAAK,6BAA6B;AAAA,EACpC;AAAA,EAEQ,cAAc,WAAmB;AACvC,WAAO,GAAG,KAAK,SAAS,aAAa,SAAS;AAAA,EAChD;AAAA,EAEQ,cAAc,WAAmB;AACvC,WAAO,GAAG,KAAK,SAAS,qBAAqB,SAAS;AAAA,EACxD;AAAA,EAEQ,sBAAsB,MAAc;AAC1C,WAAO,mBAAmB;AAAA,EAC5B;AAAA,EAEQ,gBAAgB,eAAuB;AAC7C,WAAO,GAAG,KAAK,SAAS,UAAU,uCAAyB,IAAI,aAAa;AAAA,EAC9E;AAAA,EAEA,MAAc,WAAW,IAAY,cAAqD;AACxF,UAAM,MAAM,KAAK,cAAc,EAAE;AACjC,UAAM,UAAU,MAAM,KAAK,MAAM,QAAQ,GAAG;AAC5C,QAAI,CAAC,WAAW,OAAO,KAAK,OAAO,EAAE,WAAW,EAAG,QAAO;AAC1D,UAAM,SAAS,IAAI,8BAAW,EAAE;AAChC,QAAI,CAAC,QAAQ,aAAc,OAAM,IAAI,MAAM,kCAAkC;AAC7E,QAAI,CAAC,QAAQ,iBAAkB,OAAM,IAAI,MAAM,sCAAsC;AACrF,QAAI,CAAC,QAAQ,oBAAqB,OAAM,IAAI,MAAM,yCAAyC;AAE3F,WAAO,gBAAgB,OAAO,QAAQ,YAAY,CAAC;AACnD,WAAO,oBAAoB,OAAO,QAAQ,gBAAgB,CAAC;AAC3D,WAAO,uBAAuB,OAAO,QAAQ,mBAAmB,CAAC;AAEjE,eAAW,CAACA,MAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,UAAIA,KAAI,WAAW,gBAAgB,GAAG;AACpC,eAAO,aAAaA,KAAI,MAAM,iBAAiB,MAAM,GAAG,KAAK;AAAA,MAC/D;AAAA,IACF;AAEA,QAAI,CAAC,gBAAgB,OAAO,UAAU,EAAG,QAAO;AAChD,UAAM,SAAS,IAAI,aAAa,QAAQ,KAAK;AAC7C,WAAO,yBAAyB,OAAO,oBAAoB;AAC3D,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,UAAU,SAAuB;AAC7C,QAAI,QAAQ,MAAM,SAAS,EAAG;AAC9B,UAAM,YAAY,QAAQ,MAAM;AAChC,UAAM,QAAQ,oBAAI,IAA6B;AAC/C,UAAM,UAAoB,CAAC;AAC3B,YAAQ,MAAM,QAAQ,CAAC,OAAO,QAAQ;AACpC,UAAI,UAAU,KAAM,OAAM,IAAI,KAAK,KAAK;AAAA,UACnC,SAAQ,KAAK,GAAG;AAAA,IACvB,CAAC;AAED,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,KAAK,MAAM,KAAK,KAAK,cAAc,SAAS,GAAG,KAAK;AAAA,IAC5D;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,YAAM,KAAK,MAAM,KAAK,KAAK,cAAc,SAAS,GAAG,GAAG,OAAO;AAAA,IACjE;AAEA,UAAM,sBAAsB,KAAK,sBAAsB,uCAAyB;AAChF,UAAM,8BAA8B,KAAK,sBAAsB,qCAAuB;AACtF,QAAI,QAAQ,MAAM,IAAI,mBAAmB,KAAK,QAAQ,MAAM,IAAI,2BAA2B,GAAG;AAC5F,UAAI,QAAQ,0BAA0B,MAAM;AAC1C,cAAM,4BAA4B,KAAK,gBAAgB,QAAQ,qBAAqB;AACpF,cAAM,KAAK,MAAM,KAAK,2BAA2B,SAAS;AAAA,MAC5D;AACA,YAAM,gBAAY,iCAAkB,OAAO;AAC3C,cAAQ,wBAAwB;AAChC,UAAI,cAAc,MAAM;AACtB,cAAM,oBAAoB,KAAK,gBAAgB,SAAS;AACxD,cAAM,KAAK,MAAM,KAAK,mBAAmB,SAAS;AAAA,MACpD;AAAA,IACF;AAEA,QAAI,QAAQ,OAAO;AAEjB,cAAQ,QAAQ;AAAA,IAClB;AAEA,UAAM,yBAAyB,QAAQ,uBAAuB;AAG9D,UAAM,cAAc,yBAAyB,QAAQ,MAAM;AAC3D,UAAM,aAAa,KAAK,cAAc,WAAW;AAEjD,QAAI,yBAAyB,GAAG;AAC9B,YAAM,KAAK,MAAM,OAAO,YAAY,EAAE;AACtC,YAAM,KAAK,MAAM,QAAQ,UAAU;AACnC,YAAM,KAAK,MAAM,QAAQ,KAAK,cAAc,QAAQ,MAAM,CAAC,CAAC;AAAA,IAC9D,WAAW,2BAA2B,GAAG;AACvC,YAAM,KAAK,MAAM,IAAI,UAAU;AAAA,IACjC,OAAO;AACL,YAAM,KAAK,MAAM,OAAO,YAAY,EAAE;AACtC,YAAM,KAAK,MAAM,OAAO,YAAY,sBAAsB;AAAA,IAC5D;AAGA,QAAI,yBAAyB,GAAG;AAC9B,YAAM,0BAA0B,yBAAyB,IAAI;AAC7D,YAAM,KAAK,MAAM,OAAO,KAAK,cAAc,QAAQ,MAAM,CAAC,GAAG,uBAAuB;AAAA,IACtF;AAEA,UAAM,KAAK,gBAAgB,KAAK,OAAO;AACvC,YAAQ,MAAM,MAAM;AAAA,EACtB;AAAA,EAEA,MAAc,oBAAoB,SAAuB;AACvD,UAAM,YAAY,QAAQ,MAAM;AAChC,QAAI,cAAc,QAAQ,kBAAmB;AAC7C,QAAI,CAAC,QAAQ,OAAO;AAClB,YAAM,uBAAuB,KAAK,cAAc,QAAQ,iBAAiB;AACzE,YAAM,eAAe,KAAK,cAAc,SAAS;AACjD,YAAM,qBAAqB,KAAK,cAAc,QAAQ,iBAAiB;AACvE,YAAM,aAAa,KAAK,cAAc,SAAS;AAE/C,YAAM,KAAK,MAAM,OAAO,sBAAsB,YAAY;AAC1D,YAAM,KAAK,MAAM,OAAO,oBAAoB,UAAU;AAEtD,UAAI,QAAQ,0BAA0B,MAAM;AAC1C,cAAM,4BAA4B,KAAK,gBAAgB,QAAQ,qBAAqB;AACpF,cAAM,KAAK,MAAM,KAAK,2BAA2B,QAAQ,iBAAiB;AAC1E,cAAM,KAAK,MAAM,KAAK,2BAA2B,SAAS;AAAA,MAC5D;AACA,YAAM,KAAK,gBAAgB,OAAO,OAAO;AAAA,IAC3C;AACA,YAAQ,oBAAoB;AAAA,EAC9B;AAAA;AAAA,EAGA,gBAAgB;AACd,UAAM,SAAS,IAAI,8BAAW;AAC9B,WAAO,uBAAuB,KAAK,0BAA0B;AAC7D,WAAO,IAAI,aAAa,QAAQ,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,KAAK,SAAuB;AAChC,UAAM,KAAK,oBAAoB,OAAO;AACtC,UAAM,KAAK,UAAU,OAAO;AAAA,EAC9B;AAAA,EAEA,MAAM,SAAS,WAAiD;AAC9D,WAAO,KAAK,WAAW,WAAW,KAAK;AAAA,EACzC;AAAA,EAEA,MAAM,WAAW,WAAmB;AAClC,UAAM,UAAU,MAAM,KAAK,WAAW,WAAW,IAAI;AACrD,QAAI,CAAC,QAAS;AAEd,UAAM,gBAAY,iCAAkB,OAAO;AAC3C,QAAI,cAAc,MAAM;AACtB,YAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,SAAS,GAAG,SAAS;AAAA,IAClE;AAEA,UAAM,KAAK,gBAAgB,OAAO,SAAS;AAE3C,UAAM,aAAa,KAAK,cAAc,SAAS;AAC/C,UAAM,KAAK,MAAM,IAAI,UAAU;AAE/B,YAAQ,uBAAuB,CAAC;AAChC,UAAM,KAAK,KAAK,OAAO;AAAA,EACzB;AAAA,EAEA,MAAM,6BAA6B,WAAmB,YAAoB;AACxE,QAAI,cAAc,yCAA2B;AAC3C,aAAO,oBAAI,IAA0B;AAAA,IACvC;AAEA,UAAM,eAAe,KAAK,gBAAgB,UAAU;AACpD,UAAM,aAAa,MAAM,KAAK,MAAM,SAAS,YAAY;AACzD,QAAI,CAAC,cAAc,WAAW,WAAW,GAAG;AAC1C,aAAO,oBAAI,IAA0B;AAAA,IACvC;AACA,UAAM,WAAW,oBAAI,IAA0B;AAC/C,eAAW,aAAa,YAAY;AAClC,YAAM,UAAU,MAAM,KAAK,SAAS,SAAS;AAC7C,UAAI,YAAY,MAAM;AACpB,iBAAS,IAAI,WAAW,OAAO;AAAA,MACjC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,oBAAoB,eAAuB;AAC/C,WAAO,KAAK,6BAA6B,yCAA2B,aAAa;AAAA,EACnF;AAAA,EAEA,MAAM,uBAAuB,cAAuB;AAClD,UAAM,KAAK,gBAAgB,uBAAuB,YAAY;AAAA,EAChE;AACF;AAEO,IAAM,oBAAN,MAAgD;AAAA,EACpC;AAAA,EAEjB,YAAY,OAAc;AACxB,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAM,QAAQ,KAAa,OAAe,WAAoB;AAC5D,QAAI,WAAW;AACb,YAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,SAAS;AAAA,IAClD,OAAO;AACL,YAAM,KAAK,MAAM,IAAI,KAAK,KAAK;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,KAAqC;AACjD,WAAO,MAAM,KAAK,MAAM,IAAI,GAAG;AAAA,EACjC;AAAA,EAEA,MAAM,WAAW,KAAa;AAC5B,UAAM,KAAK,MAAM,IAAI,GAAG;AAAA,EAC1B;AACF;","names":["key"]}
+{"version":3,"sources":["../../src/session/redis.ts"],"sourcesContent":["import { resolveIndexesFor, PRINCIPAL_NAME_INDEX_NAME, SPRING_SECURITY_CONTEXT } from './common';\nimport { MapSession } from './map-session';\nimport type { Redis } from 'ioredis';\nimport type { KVRepository, Namespace, Session, SessionRepository } from './types';\n\nconst CREATION_TIME_KEY = 'creationTime';\nconst LAST_ACCESSED_TIME_KEY = 'lastAccessedTime';\nconst MAX_INACTIVE_INTERVAL_KEY = 'maxInactiveInterval';\nconst ATTRIBUTE_PREFIX = 'sessionAttr:';\nconst SESSION_EXPIRES_PREFIX = 'expires:';\n\nclass RedisSession implements Session {\n  private readonly cached: MapSession;\n\n  public isNew: boolean;\n  public delta = new Map<string, string | number | null>();\n  public originalSessionId: string;\n  public originalPrincipalName: string | null;\n  public originalLastAccessTime: number | null = null;\n\n  constructor(cached: MapSession, isNew: boolean) {\n    this.cached = cached;\n    this.isNew = isNew;\n    this.originalSessionId = cached.getId();\n    this.originalPrincipalName = resolveIndexesFor(this);\n\n    if (isNew) {\n      this.delta.set(CREATION_TIME_KEY, cached.getCreationTime());\n      this.delta.set(LAST_ACCESSED_TIME_KEY, cached.getLastAccessedTime());\n      this.delta.set(MAX_INACTIVE_INTERVAL_KEY, cached.getMaxInactiveInterval());\n      this.cached.getAttributeNames().forEach((name) => {\n        const value = this.cached.getAttribute(name);\n        if (value) this.delta.set(this.getSessionAttrNameKey(name), value);\n      });\n    }\n  }\n\n  getSessionAttrNameKey(name: string) {\n    return ATTRIBUTE_PREFIX + name;\n  }\n\n  // override\n  setLastAccessedTime(lastAccessedTime: number) {\n    this.cached.setLastAccessedTime(lastAccessedTime);\n    this.delta.set(LAST_ACCESSED_TIME_KEY, lastAccessedTime);\n  }\n\n  isExpired() {\n    return this.cached.isExpired();\n  }\n\n  getCreationTime() {\n    return this.cached.getCreationTime();\n  }\n\n  getId() {\n    return this.cached.getId();\n  }\n\n  changeSessionId() {\n    return this.cached.changeSessionId();\n  }\n\n  getLastAccessedTime() {\n    return this.cached.getLastAccessedTime();\n  }\n\n  setMaxInactiveInterval(interval: number) {\n    this.cached.setMaxInactiveInterval(interval);\n    this.delta.set(MAX_INACTIVE_INTERVAL_KEY, interval);\n  }\n\n  getMaxInactiveInterval() {\n    return this.cached.getMaxInactiveInterval();\n  }\n\n  getAttribute(name: string) {\n    return this.cached.getAttribute(name);\n  }\n\n  getAttributeNames() {\n    return this.cached.getAttributeNames();\n  }\n\n  setAttribute(name: string, value: string) {\n    this.cached.setAttribute(name, value);\n    this.delta.set(this.getSessionAttrNameKey(name), value);\n  }\n\n  removeAttribute(name: string) {\n    this.cached.removeAttribute(name);\n    this.delta.set(this.getSessionAttrNameKey(name), null);\n  }\n}\n\ninterface RedisSessionExpirationStore {\n  save(session: RedisSession): Promise<void>;\n  remove(sessionId: string): Promise<void>;\n  rename(session: RedisSession): Promise<void>;\n  cleanupExpiredSessions(cleanupCount?: number): Promise<void>;\n}\n\nclass SortedSetRedisSessionExpirationStore implements RedisSessionExpirationStore {\n  private readonly redis: Redis;\n  private readonly namespace: Namespace;\n  private readonly expirationsKey: string;\n\n  constructor(redis: Redis, namespace: Namespace) {\n    this.redis = redis;\n    this.namespace = namespace;\n    this.expirationsKey = `${this.namespace}:sessions:expirations`;\n  }\n\n  getSessionKey(sessionId: string) {\n    return `${this.namespace}:sessions:${sessionId}`;\n  }\n\n  async save(session: RedisSession) {\n    const expirationInMillis =\n      session.getLastAccessedTime() + session.getMaxInactiveInterval() * 1000;\n    await this.redis.zadd(this.expirationsKey, expirationInMillis, session.getId());\n  }\n\n  async remove(sessionId: string) {\n    await this.redis.zrem(this.expirationsKey, sessionId);\n  }\n\n  async rename(session: RedisSession) {\n    if (session.originalSessionId === null || session.originalSessionId === session.getId()) return;\n    await this.remove(session.originalSessionId);\n    await this.save(session);\n  }\n\n  async cleanupExpiredSessions(cleanupCount: number = 100) {\n    const key = this.expirationsKey;\n    const score = Date.now();\n    const sessionIds = await this.redis.zrevrangebyscore(key, score, 0, 'LIMIT', 0, cleanupCount);\n    if (sessionIds.length === 0) return;\n    for (const sessionId of sessionIds) {\n      const sessionKey = this.getSessionKey(sessionId);\n      // Checks if the session exists. By trying to access the session we only trigger a deletion\n      // if the TTL is expired.\n      await this.redis.exists(sessionKey);\n    }\n  }\n}\n\n// <spring:session:sessions:uuid, hash<session>> + 300s\n// <spring:session:sessions:expirations, sorted_set<uuid>>\n// <spring:session:sessions:expires:uuid, string<empty>>: for expire check & event\nexport class RedisIndexedSessionRepository implements SessionRepository<RedisSession> {\n  private readonly redis: Redis;\n  private readonly namespace: Namespace;\n  private readonly expirationStore: RedisSessionExpirationStore;\n\n  private defaultMaxInactiveInterval = 1800;\n\n  constructor(redis: Redis, namespace: Namespace = 'spring:session') {\n    this.redis = redis;\n    this.namespace = namespace;\n    this.expirationStore = new SortedSetRedisSessionExpirationStore(redis, namespace);\n  }\n\n  setDefaultMaxInactiveInterval(interval: number) {\n    this.defaultMaxInactiveInterval = interval;\n  }\n\n  private getSessionKey(sessionId: string) {\n    return `${this.namespace}:sessions:${sessionId}`;\n  }\n\n  private getExpiredKey(sessionId: string) {\n    return `${this.namespace}:sessions:expires:${sessionId}`;\n  }\n\n  private getSessionAttrNameKey(name: string) {\n    return ATTRIBUTE_PREFIX + name;\n  }\n\n  private getPrincipalKey(principalName: string) {\n    return `${this.namespace}:index:${PRINCIPAL_NAME_INDEX_NAME}:${principalName}`;\n  }\n\n  private async getSession(id: string, allowExpired: boolean): Promise<RedisSession | null> {\n    const key = this.getSessionKey(id);\n    const entries = await this.redis.hgetall(key);\n    if (!entries || Object.keys(entries).length === 0) return null;\n    const loaded = new MapSession(id);\n    if (!entries.creationTime) throw new Error('creationTime attribute not found');\n    if (!entries.lastAccessedTime) throw new Error('lastAccessedTime attribute not found');\n    if (!entries.maxInactiveInterval) throw new Error('maxInactiveInterval attribute not found');\n\n    loaded.setCreationTime(Number(entries.creationTime));\n    loaded.setLastAccessedTime(Number(entries.lastAccessedTime));\n    loaded.setMaxInactiveInterval(Number(entries.maxInactiveInterval));\n\n    for (const [key, value] of Object.entries(entries)) {\n      if (key.startsWith(ATTRIBUTE_PREFIX)) {\n        loaded.setAttribute(key.slice(ATTRIBUTE_PREFIX.length), value);\n      }\n    }\n\n    if (!allowExpired && loaded.isExpired()) return null;\n    const result = new RedisSession(loaded, false);\n    result.originalLastAccessTime = loaded.getLastAccessedTime();\n    return result;\n  }\n\n  private async saveDelta(session: RedisSession) {\n    if (session.delta.size === 0) return;\n    const sessionId = session.getId();\n    const delta = new Map<string, string | number>();\n    const removes: string[] = [];\n    session.delta.forEach((value, key) => {\n      if (value !== null) delta.set(key, value);\n      else removes.push(key);\n    });\n\n    if (delta.size !== 0) {\n      await this.redis.hset(this.getSessionKey(sessionId), delta);\n    }\n    if (removes.length !== 0) {\n      await this.redis.hdel(this.getSessionKey(sessionId), ...removes);\n    }\n\n    const principalSessionKey = this.getSessionAttrNameKey(PRINCIPAL_NAME_INDEX_NAME);\n    const securityPrincipalSessionKey = this.getSessionAttrNameKey(SPRING_SECURITY_CONTEXT);\n    if (session.delta.has(principalSessionKey) || session.delta.has(securityPrincipalSessionKey)) {\n      if (session.originalPrincipalName !== null) {\n        const originalPrincipalRedisKey = this.getPrincipalKey(session.originalPrincipalName);\n        await this.redis.srem(originalPrincipalRedisKey, sessionId);\n      }\n      const principal = resolveIndexesFor(session);\n      session.originalPrincipalName = principal;\n      if (principal !== null) {\n        const principalRedisKey = this.getPrincipalKey(principal);\n        await this.redis.sadd(principalRedisKey, sessionId);\n      }\n    }\n\n    if (session.isNew) {\n      // here your can send session created message to channel\n      session.isNew = false;\n    }\n\n    const sessionExpireInSeconds = session.getMaxInactiveInterval();\n\n    // createShadowKey start\n    const keyToExpire = SESSION_EXPIRES_PREFIX + session.getId();\n    const sessionKey = this.getSessionKey(keyToExpire);\n\n    if (sessionExpireInSeconds < 0) {\n      await this.redis.append(sessionKey, '');\n      await this.redis.persist(sessionKey);\n      await this.redis.persist(this.getSessionKey(session.getId()));\n    } else if (sessionExpireInSeconds === 0) {\n      await this.redis.del(sessionKey);\n    } else {\n      await this.redis.append(sessionKey, '');\n      await this.redis.expire(sessionKey, sessionExpireInSeconds);\n    }\n    // createShadowKey end\n\n    if (sessionExpireInSeconds > 0) {\n      const fiveMinutesAfterExpires = sessionExpireInSeconds + 5 * 60;\n      await this.redis.expire(this.getSessionKey(session.getId()), fiveMinutesAfterExpires);\n    }\n\n    await this.expirationStore.save(session);\n    session.delta.clear();\n  }\n\n  private async saveChangeSessionId(session: RedisSession) {\n    const sessionId = session.getId();\n    if (sessionId === session.originalSessionId) return;\n    if (!session.isNew) {\n      const originalSessionIdKey = this.getSessionKey(session.originalSessionId);\n      const sessionIdKey = this.getSessionKey(sessionId);\n      const originalExpiredKey = this.getExpiredKey(session.originalSessionId);\n      const expiredKey = this.getExpiredKey(sessionId);\n\n      await this.redis.rename(originalSessionIdKey, sessionIdKey);\n      await this.redis.rename(originalExpiredKey, expiredKey);\n\n      if (session.originalPrincipalName !== null) {\n        const originalPrincipalRedisKey = this.getPrincipalKey(session.originalPrincipalName);\n        await this.redis.srem(originalPrincipalRedisKey, session.originalSessionId);\n        await this.redis.sadd(originalPrincipalRedisKey, sessionId);\n      }\n      await this.expirationStore.rename(session);\n    }\n    session.originalSessionId = sessionId;\n  }\n\n  // override\n  createSession() {\n    const cached = new MapSession();\n    cached.setMaxInactiveInterval(this.defaultMaxInactiveInterval);\n    return new RedisSession(cached, true);\n  }\n\n  async save(session: RedisSession) {\n    await this.saveChangeSessionId(session);\n    await this.saveDelta(session);\n  }\n\n  async findById(sessionId: string): Promise<RedisSession | null> {\n    return this.getSession(sessionId, false);\n  }\n\n  async deleteById(sessionId: string) {\n    const session = await this.getSession(sessionId, true);\n    if (!session) return;\n    // 1. cleanup index\n    const principal = resolveIndexesFor(session);\n    if (principal !== null) {\n      await this.redis.srem(this.getPrincipalKey(principal), sessionId);\n    }\n    // 2. delete in set\n    await this.expirationStore.remove(sessionId);\n    // 3. delete expired key\n    const expiredKey = this.getExpiredKey(sessionId);\n    await this.redis.del(expiredKey);\n\n    session.setMaxInactiveInterval(0);\n    await this.save(session);\n  }\n\n  async findByIndexNameAndIndexValue(indexName: string, indexValue: string) {\n    if (indexName !== PRINCIPAL_NAME_INDEX_NAME) {\n      return new Map<string, RedisSession>();\n    }\n\n    const principalKey = this.getPrincipalKey(indexValue);\n    const sessionIds = await this.redis.smembers(principalKey);\n    if (!sessionIds || sessionIds.length === 0) {\n      return new Map<string, RedisSession>();\n    }\n    const sessions = new Map<string, RedisSession>();\n    for (const sessionId of sessionIds) {\n      const session = await this.findById(sessionId);\n      if (session !== null) {\n        sessions.set(sessionId, session);\n      }\n    }\n    return sessions;\n  }\n\n  async findByPrincipalName(principalName: string) {\n    return this.findByIndexNameAndIndexValue(PRINCIPAL_NAME_INDEX_NAME, principalName);\n  }\n\n  async cleanupExpiredSessions(cleanupCount?: number) {\n    await this.expirationStore.cleanupExpiredSessions(cleanupCount);\n  }\n}\n\nexport class RedisKVRepository implements KVRepository {\n  private readonly redis: Redis;\n\n  constructor(redis: Redis) {\n    this.redis = redis;\n  }\n\n  async setItem(key: string, value: string, expiresIn?: number) {\n    if (expiresIn) {\n      await this.redis.set(key, value, 'EX', expiresIn);\n    } else {\n      await this.redis.set(key, value);\n    }\n  }\n\n  async getItem(key: string): Promise<string | null> {\n    return await this.redis.get(key);\n  }\n\n  async removeItem(key: string) {\n    await this.redis.del(key);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAsF;AACtF,yBAA2B;AAI3B,IAAM,oBAAoB;AAC1B,IAAM,yBAAyB;AAC/B,IAAM,4BAA4B;AAClC,IAAM,mBAAmB;AACzB,IAAM,yBAAyB;AAE/B,IAAM,eAAN,MAAsC;AAAA,EACnB;AAAA,EAEV;AAAA,EACA,QAAQ,oBAAI,IAAoC;AAAA,EAChD;AAAA,EACA;AAAA,EACA,yBAAwC;AAAA,EAE/C,YAAY,QAAoB,OAAgB;AAC9C,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,SAAK,oBAAoB,OAAO,MAAM;AACtC,SAAK,4BAAwB,iCAAkB,IAAI;AAEnD,QAAI,OAAO;AACT,WAAK,MAAM,IAAI,mBAAmB,OAAO,gBAAgB,CAAC;AAC1D,WAAK,MAAM,IAAI,wBAAwB,OAAO,oBAAoB,CAAC;AACnE,WAAK,MAAM,IAAI,2BAA2B,OAAO,uBAAuB,CAAC;AACzE,WAAK,OAAO,kBAAkB,EAAE,QAAQ,CAAC,SAAS;AAChD,cAAM,QAAQ,KAAK,OAAO,aAAa,IAAI;AAC3C,YAAI,MAAO,MAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,KAAK;AAAA,MACnE,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,sBAAsB,MAAc;AAClC,WAAO,mBAAmB;AAAA,EAC5B;AAAA;AAAA,EAGA,oBAAoB,kBAA0B;AAC5C,SAAK,OAAO,oBAAoB,gBAAgB;AAChD,SAAK,MAAM,IAAI,wBAAwB,gBAAgB;AAAA,EACzD;AAAA,EAEA,YAAY;AACV,WAAO,KAAK,OAAO,UAAU;AAAA,EAC/B;AAAA,EAEA,kBAAkB;AAChB,WAAO,KAAK,OAAO,gBAAgB;AAAA,EACrC;AAAA,EAEA,QAAQ;AACN,WAAO,KAAK,OAAO,MAAM;AAAA,EAC3B;AAAA,EAEA,kBAAkB;AAChB,WAAO,KAAK,OAAO,gBAAgB;AAAA,EACrC;AAAA,EAEA,sBAAsB;AACpB,WAAO,KAAK,OAAO,oBAAoB;AAAA,EACzC;AAAA,EAEA,uBAAuB,UAAkB;AACvC,SAAK,OAAO,uBAAuB,QAAQ;AAC3C,SAAK,MAAM,IAAI,2BAA2B,QAAQ;AAAA,EACpD;AAAA,EAEA,yBAAyB;AACvB,WAAO,KAAK,OAAO,uBAAuB;AAAA,EAC5C;AAAA,EAEA,aAAa,MAAc;AACzB,WAAO,KAAK,OAAO,aAAa,IAAI;AAAA,EACtC;AAAA,EAEA,oBAAoB;AAClB,WAAO,KAAK,OAAO,kBAAkB;AAAA,EACvC;AAAA,EAEA,aAAa,MAAc,OAAe;AACxC,SAAK,OAAO,aAAa,MAAM,KAAK;AACpC,SAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,KAAK;AAAA,EACxD;AAAA,EAEA,gBAAgB,MAAc;AAC5B,SAAK,OAAO,gBAAgB,IAAI;AAChC,SAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,IAAI;AAAA,EACvD;AACF;AASA,IAAM,uCAAN,MAAkF;AAAA,EAC/D;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,OAAc,WAAsB;AAC9C,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,iBAAiB,GAAG,KAAK,SAAS;AAAA,EACzC;AAAA,EAEA,cAAc,WAAmB;AAC/B,WAAO,GAAG,KAAK,SAAS,aAAa,SAAS;AAAA,EAChD;AAAA,EAEA,MAAM,KAAK,SAAuB;AAChC,UAAM,qBACJ,QAAQ,oBAAoB,IAAI,QAAQ,uBAAuB,IAAI;AACrE,UAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,oBAAoB,QAAQ,MAAM,CAAC;AAAA,EAChF;AAAA,EAEA,MAAM,OAAO,WAAmB;AAC9B,UAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,SAAS;AAAA,EACtD;AAAA,EAEA,MAAM,OAAO,SAAuB;AAClC,QAAI,QAAQ,sBAAsB,QAAQ,QAAQ,sBAAsB,QAAQ,MAAM,EAAG;AACzF,UAAM,KAAK,OAAO,QAAQ,iBAAiB;AAC3C,UAAM,KAAK,KAAK,OAAO;AAAA,EACzB;AAAA,EAEA,MAAM,uBAAuB,eAAuB,KAAK;AACvD,UAAM,MAAM,KAAK;AACjB,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,aAAa,MAAM,KAAK,MAAM,iBAAiB,KAAK,OAAO,GAAG,SAAS,GAAG,YAAY;AAC5F,QAAI,WAAW,WAAW,EAAG;AAC7B,eAAW,aAAa,YAAY;AAClC,YAAM,aAAa,KAAK,cAAc,SAAS;AAG/C,YAAM,KAAK,MAAM,OAAO,UAAU;AAAA,IACpC;AAAA,EACF;AACF;AAKO,IAAM,gCAAN,MAA+E;AAAA,EACnE;AAAA,EACA;AAAA,EACA;AAAA,EAET,6BAA6B;AAAA,EAErC,YAAY,OAAc,YAAuB,kBAAkB;AACjE,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,kBAAkB,IAAI,qCAAqC,OAAO,SAAS;AAAA,EAClF;AAAA,EAEA,8BAA8B,UAAkB;AAC9C,SAAK,6BAA6B;AAAA,EACpC;AAAA,EAEQ,cAAc,WAAmB;AACvC,WAAO,GAAG,KAAK,SAAS,aAAa,SAAS;AAAA,EAChD;AAAA,EAEQ,cAAc,WAAmB;AACvC,WAAO,GAAG,KAAK,SAAS,qBAAqB,SAAS;AAAA,EACxD;AAAA,EAEQ,sBAAsB,MAAc;AAC1C,WAAO,mBAAmB;AAAA,EAC5B;AAAA,EAEQ,gBAAgB,eAAuB;AAC7C,WAAO,GAAG,KAAK,SAAS,UAAU,uCAAyB,IAAI,aAAa;AAAA,EAC9E;AAAA,EAEA,MAAc,WAAW,IAAY,cAAqD;AACxF,UAAM,MAAM,KAAK,cAAc,EAAE;AACjC,UAAM,UAAU,MAAM,KAAK,MAAM,QAAQ,GAAG;AAC5C,QAAI,CAAC,WAAW,OAAO,KAAK,OAAO,EAAE,WAAW,EAAG,QAAO;AAC1D,UAAM,SAAS,IAAI,8BAAW,EAAE;AAChC,QAAI,CAAC,QAAQ,aAAc,OAAM,IAAI,MAAM,kCAAkC;AAC7E,QAAI,CAAC,QAAQ,iBAAkB,OAAM,IAAI,MAAM,sCAAsC;AACrF,QAAI,CAAC,QAAQ,oBAAqB,OAAM,IAAI,MAAM,yCAAyC;AAE3F,WAAO,gBAAgB,OAAO,QAAQ,YAAY,CAAC;AACnD,WAAO,oBAAoB,OAAO,QAAQ,gBAAgB,CAAC;AAC3D,WAAO,uBAAuB,OAAO,QAAQ,mBAAmB,CAAC;AAEjE,eAAW,CAACA,MAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,UAAIA,KAAI,WAAW,gBAAgB,GAAG;AACpC,eAAO,aAAaA,KAAI,MAAM,iBAAiB,MAAM,GAAG,KAAK;AAAA,MAC/D;AAAA,IACF;AAEA,QAAI,CAAC,gBAAgB,OAAO,UAAU,EAAG,QAAO;AAChD,UAAM,SAAS,IAAI,aAAa,QAAQ,KAAK;AAC7C,WAAO,yBAAyB,OAAO,oBAAoB;AAC3D,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,UAAU,SAAuB;AAC7C,QAAI,QAAQ,MAAM,SAAS,EAAG;AAC9B,UAAM,YAAY,QAAQ,MAAM;AAChC,UAAM,QAAQ,oBAAI,IAA6B;AAC/C,UAAM,UAAoB,CAAC;AAC3B,YAAQ,MAAM,QAAQ,CAAC,OAAO,QAAQ;AACpC,UAAI,UAAU,KAAM,OAAM,IAAI,KAAK,KAAK;AAAA,UACnC,SAAQ,KAAK,GAAG;AAAA,IACvB,CAAC;AAED,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,KAAK,MAAM,KAAK,KAAK,cAAc,SAAS,GAAG,KAAK;AAAA,IAC5D;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,YAAM,KAAK,MAAM,KAAK,KAAK,cAAc,SAAS,GAAG,GAAG,OAAO;AAAA,IACjE;AAEA,UAAM,sBAAsB,KAAK,sBAAsB,uCAAyB;AAChF,UAAM,8BAA8B,KAAK,sBAAsB,qCAAuB;AACtF,QAAI,QAAQ,MAAM,IAAI,mBAAmB,KAAK,QAAQ,MAAM,IAAI,2BAA2B,GAAG;AAC5F,UAAI,QAAQ,0BAA0B,MAAM;AAC1C,cAAM,4BAA4B,KAAK,gBAAgB,QAAQ,qBAAqB;AACpF,cAAM,KAAK,MAAM,KAAK,2BAA2B,SAAS;AAAA,MAC5D;AACA,YAAM,gBAAY,iCAAkB,OAAO;AAC3C,cAAQ,wBAAwB;AAChC,UAAI,cAAc,MAAM;AACtB,cAAM,oBAAoB,KAAK,gBAAgB,SAAS;AACxD,cAAM,KAAK,MAAM,KAAK,mBAAmB,SAAS;AAAA,MACpD;AAAA,IACF;AAEA,QAAI,QAAQ,OAAO;AAEjB,cAAQ,QAAQ;AAAA,IAClB;AAEA,UAAM,yBAAyB,QAAQ,uBAAuB;AAG9D,UAAM,cAAc,yBAAyB,QAAQ,MAAM;AAC3D,UAAM,aAAa,KAAK,cAAc,WAAW;AAEjD,QAAI,yBAAyB,GAAG;AAC9B,YAAM,KAAK,MAAM,OAAO,YAAY,EAAE;AACtC,YAAM,KAAK,MAAM,QAAQ,UAAU;AACnC,YAAM,KAAK,MAAM,QAAQ,KAAK,cAAc,QAAQ,MAAM,CAAC,CAAC;AAAA,IAC9D,WAAW,2BAA2B,GAAG;AACvC,YAAM,KAAK,MAAM,IAAI,UAAU;AAAA,IACjC,OAAO;AACL,YAAM,KAAK,MAAM,OAAO,YAAY,EAAE;AACtC,YAAM,KAAK,MAAM,OAAO,YAAY,sBAAsB;AAAA,IAC5D;AAGA,QAAI,yBAAyB,GAAG;AAC9B,YAAM,0BAA0B,yBAAyB,IAAI;AAC7D,YAAM,KAAK,MAAM,OAAO,KAAK,cAAc,QAAQ,MAAM,CAAC,GAAG,uBAAuB;AAAA,IACtF;AAEA,UAAM,KAAK,gBAAgB,KAAK,OAAO;AACvC,YAAQ,MAAM,MAAM;AAAA,EACtB;AAAA,EAEA,MAAc,oBAAoB,SAAuB;AACvD,UAAM,YAAY,QAAQ,MAAM;AAChC,QAAI,cAAc,QAAQ,kBAAmB;AAC7C,QAAI,CAAC,QAAQ,OAAO;AAClB,YAAM,uBAAuB,KAAK,cAAc,QAAQ,iBAAiB;AACzE,YAAM,eAAe,KAAK,cAAc,SAAS;AACjD,YAAM,qBAAqB,KAAK,cAAc,QAAQ,iBAAiB;AACvE,YAAM,aAAa,KAAK,cAAc,SAAS;AAE/C,YAAM,KAAK,MAAM,OAAO,sBAAsB,YAAY;AAC1D,YAAM,KAAK,MAAM,OAAO,oBAAoB,UAAU;AAEtD,UAAI,QAAQ,0BAA0B,MAAM;AAC1C,cAAM,4BAA4B,KAAK,gBAAgB,QAAQ,qBAAqB;AACpF,cAAM,KAAK,MAAM,KAAK,2BAA2B,QAAQ,iBAAiB;AAC1E,cAAM,KAAK,MAAM,KAAK,2BAA2B,SAAS;AAAA,MAC5D;AACA,YAAM,KAAK,gBAAgB,OAAO,OAAO;AAAA,IAC3C;AACA,YAAQ,oBAAoB;AAAA,EAC9B;AAAA;AAAA,EAGA,gBAAgB;AACd,UAAM,SAAS,IAAI,8BAAW;AAC9B,WAAO,uBAAuB,KAAK,0BAA0B;AAC7D,WAAO,IAAI,aAAa,QAAQ,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,KAAK,SAAuB;AAChC,UAAM,KAAK,oBAAoB,OAAO;AACtC,UAAM,KAAK,UAAU,OAAO;AAAA,EAC9B;AAAA,EAEA,MAAM,SAAS,WAAiD;AAC9D,WAAO,KAAK,WAAW,WAAW,KAAK;AAAA,EACzC;AAAA,EAEA,MAAM,WAAW,WAAmB;AAClC,UAAM,UAAU,MAAM,KAAK,WAAW,WAAW,IAAI;AACrD,QAAI,CAAC,QAAS;AAEd,UAAM,gBAAY,iCAAkB,OAAO;AAC3C,QAAI,cAAc,MAAM;AACtB,YAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,SAAS,GAAG,SAAS;AAAA,IAClE;AAEA,UAAM,KAAK,gBAAgB,OAAO,SAAS;AAE3C,UAAM,aAAa,KAAK,cAAc,SAAS;AAC/C,UAAM,KAAK,MAAM,IAAI,UAAU;AAE/B,YAAQ,uBAAuB,CAAC;AAChC,UAAM,KAAK,KAAK,OAAO;AAAA,EACzB;AAAA,EAEA,MAAM,6BAA6B,WAAmB,YAAoB;AACxE,QAAI,cAAc,yCAA2B;AAC3C,aAAO,oBAAI,IAA0B;AAAA,IACvC;AAEA,UAAM,eAAe,KAAK,gBAAgB,UAAU;AACpD,UAAM,aAAa,MAAM,KAAK,MAAM,SAAS,YAAY;AACzD,QAAI,CAAC,cAAc,WAAW,WAAW,GAAG;AAC1C,aAAO,oBAAI,IAA0B;AAAA,IACvC;AACA,UAAM,WAAW,oBAAI,IAA0B;AAC/C,eAAW,aAAa,YAAY;AAClC,YAAM,UAAU,MAAM,KAAK,SAAS,SAAS;AAC7C,UAAI,YAAY,MAAM;AACpB,iBAAS,IAAI,WAAW,OAAO;AAAA,MACjC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,oBAAoB,eAAuB;AAC/C,WAAO,KAAK,6BAA6B,yCAA2B,aAAa;AAAA,EACnF;AAAA,EAEA,MAAM,uBAAuB,cAAuB;AAClD,UAAM,KAAK,gBAAgB,uBAAuB,YAAY;AAAA,EAChE;AACF;AAEO,IAAM,oBAAN,MAAgD;AAAA,EACpC;AAAA,EAEjB,YAAY,OAAc;AACxB,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAM,QAAQ,KAAa,OAAe,WAAoB;AAC5D,QAAI,WAAW;AACb,YAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,SAAS;AAAA,IAClD,OAAO;AACL,YAAM,KAAK,MAAM,IAAI,KAAK,KAAK;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,KAAqC;AACjD,WAAO,MAAM,KAAK,MAAM,IAAI,GAAG;AAAA,EACjC;AAAA,EAEA,MAAM,WAAW,KAAa;AAC5B,UAAM,KAAK,MAAM,IAAI,GAAG;AAAA,EAC1B;AACF;","names":["key"]}

package/dist/session/redis.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/session/redis.ts"],"sourcesContent":["import { resolveIndexesFor, PRINCIPAL_NAME_INDEX_NAME, SPRING_SECURITY_CONTEXT } from './common';\nimport { MapSession } from './map-session';\nimport type { Redis } from 'ioredis';\nimport type { KVRepository, Namespace, Session, SessionRepository } from './types';\n\nconst CREATION_TIME_KEY = 'creationTime';\nconst LAST_ACCESSED_TIME_KEY = 'lastAccessedTime';\nconst MAX_INACTIVE_INTERVAL_KEY = 'maxInactiveInterval';\nconst ATTRIBUTE_PREFIX = 'sessionAttr:';\nconst SESSION_EXPIRES_PREFIX = 'expires:';\n\nclass RedisSession implements Session {\n  private readonly cached: MapSession;\n\n  public isNew: boolean;\n  public delta = new Map<string, string | number | null>();\n  public originalSessionId: string;\n  public originalPrincipalName: string | null;\n  public originalLastAccessTime: number | null = null;\n\n  constructor(cached: MapSession, isNew: boolean) {\n    this.cached = cached;\n    this.isNew = isNew;\n    this.originalSessionId = cached.getId();\n    this.originalPrincipalName = resolveIndexesFor(this);\n\n    if (isNew) {\n      this.delta.set(CREATION_TIME_KEY, cached.getCreationTime());\n      this.delta.set(LAST_ACCESSED_TIME_KEY, cached.getLastAccessedTime());\n      this.delta.set(MAX_INACTIVE_INTERVAL_KEY, cached.getMaxInactiveInterval());\n      this.cached.getAttributeNames().forEach((name) => {\n        const value = this.cached.getAttribute(name);\n        if (value) this.delta.set(this.getSessionAttrNameKey(name), value);\n      });\n    }\n  }\n\n  getSessionAttrNameKey(name: string) {\n    return ATTRIBUTE_PREFIX + name;\n  }\n\n  // override\n  setLastAccessedTime(lastAccessedTime: number) {\n    this.cached.setLastAccessedTime(lastAccessedTime);\n    this.delta.set(LAST_ACCESSED_TIME_KEY, lastAccessedTime);\n  }\n\n  isExpired() {\n    return this.cached.isExpired();\n  }\n\n  getCreationTime() {\n    return this.cached.getCreationTime();\n  }\n\n  getId() {\n    return this.cached.getId();\n  }\n\n  changeSessionId() {\n    return this.cached.changeSessionId();\n  }\n\n  getLastAccessedTime() {\n    return this.cached.getLastAccessedTime();\n  }\n\n  setMaxInactiveInterval(interval: number) {\n    this.cached.setMaxInactiveInterval(interval);\n    this.delta.set(MAX_INACTIVE_INTERVAL_KEY, interval);\n  }\n\n  getMaxInactiveInterval() {\n    return this.cached.getMaxInactiveInterval();\n  }\n\n  getAttribute(name: string) {\n    return this.cached.getAttribute(name);\n  }\n\n  getAttributeNames() {\n    return this.cached.getAttributeNames();\n  }\n\n  setAttribute(name: string, value: string) {\n    this.cached.setAttribute(name, value);\n    this.delta.set(this.getSessionAttrNameKey(name), value);\n  }\n\n  removeAttribute(name: string) {\n    this.cached.removeAttribute(name);\n    this.delta.set(this.getSessionAttrNameKey(name), null);\n  }\n}\n\ninterface RedisSessionExpirationStore {\n  save(session: RedisSession): Promise<void>;\n  remove(sessionId: string): Promise<void>;\n  rename(session: RedisSession): Promise<void>;\n  cleanupExpiredSessions(cleanupCount?: number): Promise<void>;\n}\n\nclass SortedSetRedisSessionExpirationStore implements RedisSessionExpirationStore {\n  private readonly redis: Redis;\n  private readonly namespace: Namespace;\n  private readonly expirationsKey: string;\n\n  constructor(redis: Redis, namespace: Namespace) {\n    this.redis = redis;\n    this.namespace = namespace;\n    this.expirationsKey = `${this.namespace}:sessions:expirations`;\n  }\n\n  getSessionKey(sessionId: string) {\n    return `${this.namespace}:sessions:${sessionId}`;\n  }\n\n  async save(session: RedisSession) {\n    const expirationInMillis =\n      session.getLastAccessedTime() + session.getMaxInactiveInterval() * 1000;\n    await this.redis.zadd(this.expirationsKey, expirationInMillis, session.getId());\n  }\n\n  async remove(sessionId: string) {\n    await this.redis.zrem(this.expirationsKey, sessionId);\n  }\n\n  async rename(session: RedisSession) {\n    if (session.originalSessionId === null || session.originalSessionId === session.getId()) return;\n    await this.remove(session.originalSessionId);\n    await this.save(session);\n  }\n\n  async cleanupExpiredSessions(cleanupCount: number = 100) {\n    const key = this.expirationsKey;\n    const score = Date.now();\n    const sessionIds = await this.redis.zrevrangebyscore(key, score, 0, 'LIMIT', 0, cleanupCount);\n    if (sessionIds.length === 0) return;\n    for (const sessionId of sessionIds) {\n      const sessionKey = this.getSessionKey(sessionId);\n      // Checks if the session exists. By trying to access the session we only trigger a deletion\n      // if the TTL is expired.\n      await this.redis.exists(sessionKey);\n    }\n  }\n}\n\n// 15549130 <spring:session:sessions:uuid, hash<session>> + 300s\n// 15549147 <spring:session:sessions:expirations, sorted_set<uuid>> + 300s\n// 15548839 <spring:session:sessions:expires:uuid, string<empty>>\nexport class RedisIndexedSessionRepository implements SessionRepository<RedisSession> {\n  private readonly redis: Redis;\n  private readonly namespace: Namespace;\n  private readonly expirationStore: RedisSessionExpirationStore;\n\n  private defaultMaxInactiveInterval = 1800;\n\n  constructor(redis: Redis, namespace: Namespace = 'spring:session') {\n    this.redis = redis;\n    this.namespace = namespace;\n    this.expirationStore = new SortedSetRedisSessionExpirationStore(redis, namespace);\n  }\n\n  setDefaultMaxInactiveInterval(interval: number) {\n    this.defaultMaxInactiveInterval = interval;\n  }\n\n  private getSessionKey(sessionId: string) {\n    return `${this.namespace}:sessions:${sessionId}`;\n  }\n\n  private getExpiredKey(sessionId: string) {\n    return `${this.namespace}:sessions:expires:${sessionId}`;\n  }\n\n  private getSessionAttrNameKey(name: string) {\n    return ATTRIBUTE_PREFIX + name;\n  }\n\n  private getPrincipalKey(principalName: string) {\n    return `${this.namespace}:index:${PRINCIPAL_NAME_INDEX_NAME}:${principalName}`;\n  }\n\n  private async getSession(id: string, allowExpired: boolean): Promise<RedisSession | null> {\n    const key = this.getSessionKey(id);\n    const entries = await this.redis.hgetall(key);\n    if (!entries || Object.keys(entries).length === 0) return null;\n    const loaded = new MapSession(id);\n    if (!entries.creationTime) throw new Error('creationTime attribute not found');\n    if (!entries.lastAccessedTime) throw new Error('lastAccessedTime attribute not found');\n    if (!entries.maxInactiveInterval) throw new Error('maxInactiveInterval attribute not found');\n\n    loaded.setCreationTime(Number(entries.creationTime));\n    loaded.setLastAccessedTime(Number(entries.lastAccessedTime));\n    loaded.setMaxInactiveInterval(Number(entries.maxInactiveInterval));\n\n    for (const [key, value] of Object.entries(entries)) {\n      if (key.startsWith(ATTRIBUTE_PREFIX)) {\n        loaded.setAttribute(key.slice(ATTRIBUTE_PREFIX.length), value);\n      }\n    }\n\n    if (!allowExpired && loaded.isExpired()) return null;\n    const result = new RedisSession(loaded, false);\n    result.originalLastAccessTime = loaded.getLastAccessedTime();\n    return result;\n  }\n\n  private async saveDelta(session: RedisSession) {\n    if (session.delta.size === 0) return;\n    const sessionId = session.getId();\n    const delta = new Map<string, string | number>();\n    const removes: string[] = [];\n    session.delta.forEach((value, key) => {\n      if (value !== null) delta.set(key, value);\n      else removes.push(key);\n    });\n\n    if (delta.size !== 0) {\n      await this.redis.hset(this.getSessionKey(sessionId), delta);\n    }\n    if (removes.length !== 0) {\n      await this.redis.hdel(this.getSessionKey(sessionId), ...removes);\n    }\n\n    const principalSessionKey = this.getSessionAttrNameKey(PRINCIPAL_NAME_INDEX_NAME);\n    const securityPrincipalSessionKey = this.getSessionAttrNameKey(SPRING_SECURITY_CONTEXT);\n    if (session.delta.has(principalSessionKey) || session.delta.has(securityPrincipalSessionKey)) {\n      if (session.originalPrincipalName !== null) {\n        const originalPrincipalRedisKey = this.getPrincipalKey(session.originalPrincipalName);\n        await this.redis.srem(originalPrincipalRedisKey, sessionId);\n      }\n      const principal = resolveIndexesFor(session);\n      session.originalPrincipalName = principal;\n      if (principal !== null) {\n        const principalRedisKey = this.getPrincipalKey(principal);\n        await this.redis.sadd(principalRedisKey, sessionId);\n      }\n    }\n\n    if (session.isNew) {\n      // here your can send session created message to channel\n      session.isNew = false;\n    }\n\n    const sessionExpireInSeconds = session.getMaxInactiveInterval();\n\n    // createShadowKey start\n    const keyToExpire = SESSION_EXPIRES_PREFIX + session.getId();\n    const sessionKey = this.getSessionKey(keyToExpire);\n\n    if (sessionExpireInSeconds < 0) {\n      await this.redis.append(sessionKey, '');\n      await this.redis.persist(sessionKey);\n      await this.redis.persist(this.getSessionKey(session.getId()));\n    } else if (sessionExpireInSeconds === 0) {\n      await this.redis.del(sessionKey);\n    } else {\n      await this.redis.append(sessionKey, '');\n      await this.redis.expire(sessionKey, sessionExpireInSeconds);\n    }\n    // createShadowKey end\n\n    if (sessionExpireInSeconds > 0) {\n      const fiveMinutesAfterExpires = sessionExpireInSeconds + 5 * 60;\n      await this.redis.expire(this.getSessionKey(session.getId()), fiveMinutesAfterExpires);\n    }\n\n    await this.expirationStore.save(session);\n    session.delta.clear();\n  }\n\n  private async saveChangeSessionId(session: RedisSession) {\n    const sessionId = session.getId();\n    if (sessionId === session.originalSessionId) return;\n    if (!session.isNew) {\n      const originalSessionIdKey = this.getSessionKey(session.originalSessionId);\n      const sessionIdKey = this.getSessionKey(sessionId);\n      const originalExpiredKey = this.getExpiredKey(session.originalSessionId);\n      const expiredKey = this.getExpiredKey(sessionId);\n\n      await this.redis.rename(originalSessionIdKey, sessionIdKey);\n      await this.redis.rename(originalExpiredKey, expiredKey);\n\n      if (session.originalPrincipalName !== null) {\n        const originalPrincipalRedisKey = this.getPrincipalKey(session.originalPrincipalName);\n        await this.redis.srem(originalPrincipalRedisKey, session.originalSessionId);\n        await this.redis.sadd(originalPrincipalRedisKey, sessionId);\n      }\n      await this.expirationStore.rename(session);\n    }\n    session.originalSessionId = sessionId;\n  }\n\n  // override\n  createSession() {\n    const cached = new MapSession();\n    cached.setMaxInactiveInterval(this.defaultMaxInactiveInterval);\n    return new RedisSession(cached, true);\n  }\n\n  async save(session: RedisSession) {\n    await this.saveChangeSessionId(session);\n    await this.saveDelta(session);\n  }\n\n  async findById(sessionId: string): Promise<RedisSession | null> {\n    return this.getSession(sessionId, false);\n  }\n\n  async deleteById(sessionId: string) {\n    const session = await this.getSession(sessionId, true);\n    if (!session) return;\n    // 1. cleanup index\n    const principal = resolveIndexesFor(session);\n    if (principal !== null) {\n      await this.redis.srem(this.getPrincipalKey(principal), sessionId);\n    }\n    // 2. delete in set\n    await this.expirationStore.remove(sessionId);\n    // 3. delete expired key\n    const expiredKey = this.getExpiredKey(sessionId);\n    await this.redis.del(expiredKey);\n\n    session.setMaxInactiveInterval(0);\n    await this.save(session);\n  }\n\n  async findByIndexNameAndIndexValue(indexName: string, indexValue: string) {\n    if (indexName !== PRINCIPAL_NAME_INDEX_NAME) {\n      return new Map<string, RedisSession>();\n    }\n\n    const principalKey = this.getPrincipalKey(indexValue);\n    const sessionIds = await this.redis.smembers(principalKey);\n    if (!sessionIds || sessionIds.length === 0) {\n      return new Map<string, RedisSession>();\n    }\n    const sessions = new Map<string, RedisSession>();\n    for (const sessionId of sessionIds) {\n      const session = await this.findById(sessionId);\n      if (session !== null) {\n        sessions.set(sessionId, session);\n      }\n    }\n    return sessions;\n  }\n\n  async findByPrincipalName(principalName: string) {\n    return this.findByIndexNameAndIndexValue(PRINCIPAL_NAME_INDEX_NAME, principalName);\n  }\n\n  async cleanupExpiredSessions(cleanupCount?: number) {\n    await this.expirationStore.cleanupExpiredSessions(cleanupCount);\n  }\n}\n\nexport class RedisKVRepository implements KVRepository {\n  private readonly redis: Redis;\n\n  constructor(redis: Redis) {\n    this.redis = redis;\n  }\n\n  async setItem(key: string, value: string, expiresIn?: number) {\n    if (expiresIn) {\n      await this.redis.set(key, value, 'EX', expiresIn);\n    } else {\n      await this.redis.set(key, value);\n    }\n  }\n\n  async getItem(key: string): Promise<string | null> {\n    return await this.redis.get(key);\n  }\n\n  async removeItem(key: string) {\n    await this.redis.del(key);\n  }\n}\n"],"mappings":";AAAA,SAAS,mBAAmB,2BAA2B,+BAA+B;AACtF,SAAS,kBAAkB;AAI3B,IAAM,oBAAoB;AAC1B,IAAM,yBAAyB;AAC/B,IAAM,4BAA4B;AAClC,IAAM,mBAAmB;AACzB,IAAM,yBAAyB;AAE/B,IAAM,eAAN,MAAsC;AAAA,EACnB;AAAA,EAEV;AAAA,EACA,QAAQ,oBAAI,IAAoC;AAAA,EAChD;AAAA,EACA;AAAA,EACA,yBAAwC;AAAA,EAE/C,YAAY,QAAoB,OAAgB;AAC9C,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,SAAK,oBAAoB,OAAO,MAAM;AACtC,SAAK,wBAAwB,kBAAkB,IAAI;AAEnD,QAAI,OAAO;AACT,WAAK,MAAM,IAAI,mBAAmB,OAAO,gBAAgB,CAAC;AAC1D,WAAK,MAAM,IAAI,wBAAwB,OAAO,oBAAoB,CAAC;AACnE,WAAK,MAAM,IAAI,2BAA2B,OAAO,uBAAuB,CAAC;AACzE,WAAK,OAAO,kBAAkB,EAAE,QAAQ,CAAC,SAAS;AAChD,cAAM,QAAQ,KAAK,OAAO,aAAa,IAAI;AAC3C,YAAI,MAAO,MAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,KAAK;AAAA,MACnE,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,sBAAsB,MAAc;AAClC,WAAO,mBAAmB;AAAA,EAC5B;AAAA;AAAA,EAGA,oBAAoB,kBAA0B;AAC5C,SAAK,OAAO,oBAAoB,gBAAgB;AAChD,SAAK,MAAM,IAAI,wBAAwB,gBAAgB;AAAA,EACzD;AAAA,EAEA,YAAY;AACV,WAAO,KAAK,OAAO,UAAU;AAAA,EAC/B;AAAA,EAEA,kBAAkB;AAChB,WAAO,KAAK,OAAO,gBAAgB;AAAA,EACrC;AAAA,EAEA,QAAQ;AACN,WAAO,KAAK,OAAO,MAAM;AAAA,EAC3B;AAAA,EAEA,kBAAkB;AAChB,WAAO,KAAK,OAAO,gBAAgB;AAAA,EACrC;AAAA,EAEA,sBAAsB;AACpB,WAAO,KAAK,OAAO,oBAAoB;AAAA,EACzC;AAAA,EAEA,uBAAuB,UAAkB;AACvC,SAAK,OAAO,uBAAuB,QAAQ;AAC3C,SAAK,MAAM,IAAI,2BAA2B,QAAQ;AAAA,EACpD;AAAA,EAEA,yBAAyB;AACvB,WAAO,KAAK,OAAO,uBAAuB;AAAA,EAC5C;AAAA,EAEA,aAAa,MAAc;AACzB,WAAO,KAAK,OAAO,aAAa,IAAI;AAAA,EACtC;AAAA,EAEA,oBAAoB;AAClB,WAAO,KAAK,OAAO,kBAAkB;AAAA,EACvC;AAAA,EAEA,aAAa,MAAc,OAAe;AACxC,SAAK,OAAO,aAAa,MAAM,KAAK;AACpC,SAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,KAAK;AAAA,EACxD;AAAA,EAEA,gBAAgB,MAAc;AAC5B,SAAK,OAAO,gBAAgB,IAAI;AAChC,SAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,IAAI;AAAA,EACvD;AACF;AASA,IAAM,uCAAN,MAAkF;AAAA,EAC/D;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,OAAc,WAAsB;AAC9C,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,iBAAiB,GAAG,KAAK,SAAS;AAAA,EACzC;AAAA,EAEA,cAAc,WAAmB;AAC/B,WAAO,GAAG,KAAK,SAAS,aAAa,SAAS;AAAA,EAChD;AAAA,EAEA,MAAM,KAAK,SAAuB;AAChC,UAAM,qBACJ,QAAQ,oBAAoB,IAAI,QAAQ,uBAAuB,IAAI;AACrE,UAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,oBAAoB,QAAQ,MAAM,CAAC;AAAA,EAChF;AAAA,EAEA,MAAM,OAAO,WAAmB;AAC9B,UAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,SAAS;AAAA,EACtD;AAAA,EAEA,MAAM,OAAO,SAAuB;AAClC,QAAI,QAAQ,sBAAsB,QAAQ,QAAQ,sBAAsB,QAAQ,MAAM,EAAG;AACzF,UAAM,KAAK,OAAO,QAAQ,iBAAiB;AAC3C,UAAM,KAAK,KAAK,OAAO;AAAA,EACzB;AAAA,EAEA,MAAM,uBAAuB,eAAuB,KAAK;AACvD,UAAM,MAAM,KAAK;AACjB,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,aAAa,MAAM,KAAK,MAAM,iBAAiB,KAAK,OAAO,GAAG,SAAS,GAAG,YAAY;AAC5F,QAAI,WAAW,WAAW,EAAG;AAC7B,eAAW,aAAa,YAAY;AAClC,YAAM,aAAa,KAAK,cAAc,SAAS;AAG/C,YAAM,KAAK,MAAM,OAAO,UAAU;AAAA,IACpC;AAAA,EACF;AACF;AAKO,IAAM,gCAAN,MAA+E;AAAA,EACnE;AAAA,EACA;AAAA,EACA;AAAA,EAET,6BAA6B;AAAA,EAErC,YAAY,OAAc,YAAuB,kBAAkB;AACjE,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,kBAAkB,IAAI,qCAAqC,OAAO,SAAS;AAAA,EAClF;AAAA,EAEA,8BAA8B,UAAkB;AAC9C,SAAK,6BAA6B;AAAA,EACpC;AAAA,EAEQ,cAAc,WAAmB;AACvC,WAAO,GAAG,KAAK,SAAS,aAAa,SAAS;AAAA,EAChD;AAAA,EAEQ,cAAc,WAAmB;AACvC,WAAO,GAAG,KAAK,SAAS,qBAAqB,SAAS;AAAA,EACxD;AAAA,EAEQ,sBAAsB,MAAc;AAC1C,WAAO,mBAAmB;AAAA,EAC5B;AAAA,EAEQ,gBAAgB,eAAuB;AAC7C,WAAO,GAAG,KAAK,SAAS,UAAU,yBAAyB,IAAI,aAAa;AAAA,EAC9E;AAAA,EAEA,MAAc,WAAW,IAAY,cAAqD;AACxF,UAAM,MAAM,KAAK,cAAc,EAAE;AACjC,UAAM,UAAU,MAAM,KAAK,MAAM,QAAQ,GAAG;AAC5C,QAAI,CAAC,WAAW,OAAO,KAAK,OAAO,EAAE,WAAW,EAAG,QAAO;AAC1D,UAAM,SAAS,IAAI,WAAW,EAAE;AAChC,QAAI,CAAC,QAAQ,aAAc,OAAM,IAAI,MAAM,kCAAkC;AAC7E,QAAI,CAAC,QAAQ,iBAAkB,OAAM,IAAI,MAAM,sCAAsC;AACrF,QAAI,CAAC,QAAQ,oBAAqB,OAAM,IAAI,MAAM,yCAAyC;AAE3F,WAAO,gBAAgB,OAAO,QAAQ,YAAY,CAAC;AACnD,WAAO,oBAAoB,OAAO,QAAQ,gBAAgB,CAAC;AAC3D,WAAO,uBAAuB,OAAO,QAAQ,mBAAmB,CAAC;AAEjE,eAAW,CAACA,MAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,UAAIA,KAAI,WAAW,gBAAgB,GAAG;AACpC,eAAO,aAAaA,KAAI,MAAM,iBAAiB,MAAM,GAAG,KAAK;AAAA,MAC/D;AAAA,IACF;AAEA,QAAI,CAAC,gBAAgB,OAAO,UAAU,EAAG,QAAO;AAChD,UAAM,SAAS,IAAI,aAAa,QAAQ,KAAK;AAC7C,WAAO,yBAAyB,OAAO,oBAAoB;AAC3D,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,UAAU,SAAuB;AAC7C,QAAI,QAAQ,MAAM,SAAS,EAAG;AAC9B,UAAM,YAAY,QAAQ,MAAM;AAChC,UAAM,QAAQ,oBAAI,IAA6B;AAC/C,UAAM,UAAoB,CAAC;AAC3B,YAAQ,MAAM,QAAQ,CAAC,OAAO,QAAQ;AACpC,UAAI,UAAU,KAAM,OAAM,IAAI,KAAK,KAAK;AAAA,UACnC,SAAQ,KAAK,GAAG;AAAA,IACvB,CAAC;AAED,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,KAAK,MAAM,KAAK,KAAK,cAAc,SAAS,GAAG,KAAK;AAAA,IAC5D;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,YAAM,KAAK,MAAM,KAAK,KAAK,cAAc,SAAS,GAAG,GAAG,OAAO;AAAA,IACjE;AAEA,UAAM,sBAAsB,KAAK,sBAAsB,yBAAyB;AAChF,UAAM,8BAA8B,KAAK,sBAAsB,uBAAuB;AACtF,QAAI,QAAQ,MAAM,IAAI,mBAAmB,KAAK,QAAQ,MAAM,IAAI,2BAA2B,GAAG;AAC5F,UAAI,QAAQ,0BAA0B,MAAM;AAC1C,cAAM,4BAA4B,KAAK,gBAAgB,QAAQ,qBAAqB;AACpF,cAAM,KAAK,MAAM,KAAK,2BAA2B,SAAS;AAAA,MAC5D;AACA,YAAM,YAAY,kBAAkB,OAAO;AAC3C,cAAQ,wBAAwB;AAChC,UAAI,cAAc,MAAM;AACtB,cAAM,oBAAoB,KAAK,gBAAgB,SAAS;AACxD,cAAM,KAAK,MAAM,KAAK,mBAAmB,SAAS;AAAA,MACpD;AAAA,IACF;AAEA,QAAI,QAAQ,OAAO;AAEjB,cAAQ,QAAQ;AAAA,IAClB;AAEA,UAAM,yBAAyB,QAAQ,uBAAuB;AAG9D,UAAM,cAAc,yBAAyB,QAAQ,MAAM;AAC3D,UAAM,aAAa,KAAK,cAAc,WAAW;AAEjD,QAAI,yBAAyB,GAAG;AAC9B,YAAM,KAAK,MAAM,OAAO,YAAY,EAAE;AACtC,YAAM,KAAK,MAAM,QAAQ,UAAU;AACnC,YAAM,KAAK,MAAM,QAAQ,KAAK,cAAc,QAAQ,MAAM,CAAC,CAAC;AAAA,IAC9D,WAAW,2BAA2B,GAAG;AACvC,YAAM,KAAK,MAAM,IAAI,UAAU;AAAA,IACjC,OAAO;AACL,YAAM,KAAK,MAAM,OAAO,YAAY,EAAE;AACtC,YAAM,KAAK,MAAM,OAAO,YAAY,sBAAsB;AAAA,IAC5D;AAGA,QAAI,yBAAyB,GAAG;AAC9B,YAAM,0BAA0B,yBAAyB,IAAI;AAC7D,YAAM,KAAK,MAAM,OAAO,KAAK,cAAc,QAAQ,MAAM,CAAC,GAAG,uBAAuB;AAAA,IACtF;AAEA,UAAM,KAAK,gBAAgB,KAAK,OAAO;AACvC,YAAQ,MAAM,MAAM;AAAA,EACtB;AAAA,EAEA,MAAc,oBAAoB,SAAuB;AACvD,UAAM,YAAY,QAAQ,MAAM;AAChC,QAAI,cAAc,QAAQ,kBAAmB;AAC7C,QAAI,CAAC,QAAQ,OAAO;AAClB,YAAM,uBAAuB,KAAK,cAAc,QAAQ,iBAAiB;AACzE,YAAM,eAAe,KAAK,cAAc,SAAS;AACjD,YAAM,qBAAqB,KAAK,cAAc,QAAQ,iBAAiB;AACvE,YAAM,aAAa,KAAK,cAAc,SAAS;AAE/C,YAAM,KAAK,MAAM,OAAO,sBAAsB,YAAY;AAC1D,YAAM,KAAK,MAAM,OAAO,oBAAoB,UAAU;AAEtD,UAAI,QAAQ,0BAA0B,MAAM;AAC1C,cAAM,4BAA4B,KAAK,gBAAgB,QAAQ,qBAAqB;AACpF,cAAM,KAAK,MAAM,KAAK,2BAA2B,QAAQ,iBAAiB;AAC1E,cAAM,KAAK,MAAM,KAAK,2BAA2B,SAAS;AAAA,MAC5D;AACA,YAAM,KAAK,gBAAgB,OAAO,OAAO;AAAA,IAC3C;AACA,YAAQ,oBAAoB;AAAA,EAC9B;AAAA;AAAA,EAGA,gBAAgB;AACd,UAAM,SAAS,IAAI,WAAW;AAC9B,WAAO,uBAAuB,KAAK,0BAA0B;AAC7D,WAAO,IAAI,aAAa,QAAQ,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,KAAK,SAAuB;AAChC,UAAM,KAAK,oBAAoB,OAAO;AACtC,UAAM,KAAK,UAAU,OAAO;AAAA,EAC9B;AAAA,EAEA,MAAM,SAAS,WAAiD;AAC9D,WAAO,KAAK,WAAW,WAAW,KAAK;AAAA,EACzC;AAAA,EAEA,MAAM,WAAW,WAAmB;AAClC,UAAM,UAAU,MAAM,KAAK,WAAW,WAAW,IAAI;AACrD,QAAI,CAAC,QAAS;AAEd,UAAM,YAAY,kBAAkB,OAAO;AAC3C,QAAI,cAAc,MAAM;AACtB,YAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,SAAS,GAAG,SAAS;AAAA,IAClE;AAEA,UAAM,KAAK,gBAAgB,OAAO,SAAS;AAE3C,UAAM,aAAa,KAAK,cAAc,SAAS;AAC/C,UAAM,KAAK,MAAM,IAAI,UAAU;AAE/B,YAAQ,uBAAuB,CAAC;AAChC,UAAM,KAAK,KAAK,OAAO;AAAA,EACzB;AAAA,EAEA,MAAM,6BAA6B,WAAmB,YAAoB;AACxE,QAAI,cAAc,2BAA2B;AAC3C,aAAO,oBAAI,IAA0B;AAAA,IACvC;AAEA,UAAM,eAAe,KAAK,gBAAgB,UAAU;AACpD,UAAM,aAAa,MAAM,KAAK,MAAM,SAAS,YAAY;AACzD,QAAI,CAAC,cAAc,WAAW,WAAW,GAAG;AAC1C,aAAO,oBAAI,IAA0B;AAAA,IACvC;AACA,UAAM,WAAW,oBAAI,IAA0B;AAC/C,eAAW,aAAa,YAAY;AAClC,YAAM,UAAU,MAAM,KAAK,SAAS,SAAS;AAC7C,UAAI,YAAY,MAAM;AACpB,iBAAS,IAAI,WAAW,OAAO;AAAA,MACjC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,oBAAoB,eAAuB;AAC/C,WAAO,KAAK,6BAA6B,2BAA2B,aAAa;AAAA,EACnF;AAAA,EAEA,MAAM,uBAAuB,cAAuB;AAClD,UAAM,KAAK,gBAAgB,uBAAuB,YAAY;AAAA,EAChE;AACF;AAEO,IAAM,oBAAN,MAAgD;AAAA,EACpC;AAAA,EAEjB,YAAY,OAAc;AACxB,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAM,QAAQ,KAAa,OAAe,WAAoB;AAC5D,QAAI,WAAW;AACb,YAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,SAAS;AAAA,IAClD,OAAO;AACL,YAAM,KAAK,MAAM,IAAI,KAAK,KAAK;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,KAAqC;AACjD,WAAO,MAAM,KAAK,MAAM,IAAI,GAAG;AAAA,EACjC;AAAA,EAEA,MAAM,WAAW,KAAa;AAC5B,UAAM,KAAK,MAAM,IAAI,GAAG;AAAA,EAC1B;AACF;","names":["key"]}
+{"version":3,"sources":["../../src/session/redis.ts"],"sourcesContent":["import { resolveIndexesFor, PRINCIPAL_NAME_INDEX_NAME, SPRING_SECURITY_CONTEXT } from './common';\nimport { MapSession } from './map-session';\nimport type { Redis } from 'ioredis';\nimport type { KVRepository, Namespace, Session, SessionRepository } from './types';\n\nconst CREATION_TIME_KEY = 'creationTime';\nconst LAST_ACCESSED_TIME_KEY = 'lastAccessedTime';\nconst MAX_INACTIVE_INTERVAL_KEY = 'maxInactiveInterval';\nconst ATTRIBUTE_PREFIX = 'sessionAttr:';\nconst SESSION_EXPIRES_PREFIX = 'expires:';\n\nclass RedisSession implements Session {\n  private readonly cached: MapSession;\n\n  public isNew: boolean;\n  public delta = new Map<string, string | number | null>();\n  public originalSessionId: string;\n  public originalPrincipalName: string | null;\n  public originalLastAccessTime: number | null = null;\n\n  constructor(cached: MapSession, isNew: boolean) {\n    this.cached = cached;\n    this.isNew = isNew;\n    this.originalSessionId = cached.getId();\n    this.originalPrincipalName = resolveIndexesFor(this);\n\n    if (isNew) {\n      this.delta.set(CREATION_TIME_KEY, cached.getCreationTime());\n      this.delta.set(LAST_ACCESSED_TIME_KEY, cached.getLastAccessedTime());\n      this.delta.set(MAX_INACTIVE_INTERVAL_KEY, cached.getMaxInactiveInterval());\n      this.cached.getAttributeNames().forEach((name) => {\n        const value = this.cached.getAttribute(name);\n        if (value) this.delta.set(this.getSessionAttrNameKey(name), value);\n      });\n    }\n  }\n\n  getSessionAttrNameKey(name: string) {\n    return ATTRIBUTE_PREFIX + name;\n  }\n\n  // override\n  setLastAccessedTime(lastAccessedTime: number) {\n    this.cached.setLastAccessedTime(lastAccessedTime);\n    this.delta.set(LAST_ACCESSED_TIME_KEY, lastAccessedTime);\n  }\n\n  isExpired() {\n    return this.cached.isExpired();\n  }\n\n  getCreationTime() {\n    return this.cached.getCreationTime();\n  }\n\n  getId() {\n    return this.cached.getId();\n  }\n\n  changeSessionId() {\n    return this.cached.changeSessionId();\n  }\n\n  getLastAccessedTime() {\n    return this.cached.getLastAccessedTime();\n  }\n\n  setMaxInactiveInterval(interval: number) {\n    this.cached.setMaxInactiveInterval(interval);\n    this.delta.set(MAX_INACTIVE_INTERVAL_KEY, interval);\n  }\n\n  getMaxInactiveInterval() {\n    return this.cached.getMaxInactiveInterval();\n  }\n\n  getAttribute(name: string) {\n    return this.cached.getAttribute(name);\n  }\n\n  getAttributeNames() {\n    return this.cached.getAttributeNames();\n  }\n\n  setAttribute(name: string, value: string) {\n    this.cached.setAttribute(name, value);\n    this.delta.set(this.getSessionAttrNameKey(name), value);\n  }\n\n  removeAttribute(name: string) {\n    this.cached.removeAttribute(name);\n    this.delta.set(this.getSessionAttrNameKey(name), null);\n  }\n}\n\ninterface RedisSessionExpirationStore {\n  save(session: RedisSession): Promise<void>;\n  remove(sessionId: string): Promise<void>;\n  rename(session: RedisSession): Promise<void>;\n  cleanupExpiredSessions(cleanupCount?: number): Promise<void>;\n}\n\nclass SortedSetRedisSessionExpirationStore implements RedisSessionExpirationStore {\n  private readonly redis: Redis;\n  private readonly namespace: Namespace;\n  private readonly expirationsKey: string;\n\n  constructor(redis: Redis, namespace: Namespace) {\n    this.redis = redis;\n    this.namespace = namespace;\n    this.expirationsKey = `${this.namespace}:sessions:expirations`;\n  }\n\n  getSessionKey(sessionId: string) {\n    return `${this.namespace}:sessions:${sessionId}`;\n  }\n\n  async save(session: RedisSession) {\n    const expirationInMillis =\n      session.getLastAccessedTime() + session.getMaxInactiveInterval() * 1000;\n    await this.redis.zadd(this.expirationsKey, expirationInMillis, session.getId());\n  }\n\n  async remove(sessionId: string) {\n    await this.redis.zrem(this.expirationsKey, sessionId);\n  }\n\n  async rename(session: RedisSession) {\n    if (session.originalSessionId === null || session.originalSessionId === session.getId()) return;\n    await this.remove(session.originalSessionId);\n    await this.save(session);\n  }\n\n  async cleanupExpiredSessions(cleanupCount: number = 100) {\n    const key = this.expirationsKey;\n    const score = Date.now();\n    const sessionIds = await this.redis.zrevrangebyscore(key, score, 0, 'LIMIT', 0, cleanupCount);\n    if (sessionIds.length === 0) return;\n    for (const sessionId of sessionIds) {\n      const sessionKey = this.getSessionKey(sessionId);\n      // Checks if the session exists. By trying to access the session we only trigger a deletion\n      // if the TTL is expired.\n      await this.redis.exists(sessionKey);\n    }\n  }\n}\n\n// <spring:session:sessions:uuid, hash<session>> + 300s\n// <spring:session:sessions:expirations, sorted_set<uuid>>\n// <spring:session:sessions:expires:uuid, string<empty>>: for expire check & event\nexport class RedisIndexedSessionRepository implements SessionRepository<RedisSession> {\n  private readonly redis: Redis;\n  private readonly namespace: Namespace;\n  private readonly expirationStore: RedisSessionExpirationStore;\n\n  private defaultMaxInactiveInterval = 1800;\n\n  constructor(redis: Redis, namespace: Namespace = 'spring:session') {\n    this.redis = redis;\n    this.namespace = namespace;\n    this.expirationStore = new SortedSetRedisSessionExpirationStore(redis, namespace);\n  }\n\n  setDefaultMaxInactiveInterval(interval: number) {\n    this.defaultMaxInactiveInterval = interval;\n  }\n\n  private getSessionKey(sessionId: string) {\n    return `${this.namespace}:sessions:${sessionId}`;\n  }\n\n  private getExpiredKey(sessionId: string) {\n    return `${this.namespace}:sessions:expires:${sessionId}`;\n  }\n\n  private getSessionAttrNameKey(name: string) {\n    return ATTRIBUTE_PREFIX + name;\n  }\n\n  private getPrincipalKey(principalName: string) {\n    return `${this.namespace}:index:${PRINCIPAL_NAME_INDEX_NAME}:${principalName}`;\n  }\n\n  private async getSession(id: string, allowExpired: boolean): Promise<RedisSession | null> {\n    const key = this.getSessionKey(id);\n    const entries = await this.redis.hgetall(key);\n    if (!entries || Object.keys(entries).length === 0) return null;\n    const loaded = new MapSession(id);\n    if (!entries.creationTime) throw new Error('creationTime attribute not found');\n    if (!entries.lastAccessedTime) throw new Error('lastAccessedTime attribute not found');\n    if (!entries.maxInactiveInterval) throw new Error('maxInactiveInterval attribute not found');\n\n    loaded.setCreationTime(Number(entries.creationTime));\n    loaded.setLastAccessedTime(Number(entries.lastAccessedTime));\n    loaded.setMaxInactiveInterval(Number(entries.maxInactiveInterval));\n\n    for (const [key, value] of Object.entries(entries)) {\n      if (key.startsWith(ATTRIBUTE_PREFIX)) {\n        loaded.setAttribute(key.slice(ATTRIBUTE_PREFIX.length), value);\n      }\n    }\n\n    if (!allowExpired && loaded.isExpired()) return null;\n    const result = new RedisSession(loaded, false);\n    result.originalLastAccessTime = loaded.getLastAccessedTime();\n    return result;\n  }\n\n  private async saveDelta(session: RedisSession) {\n    if (session.delta.size === 0) return;\n    const sessionId = session.getId();\n    const delta = new Map<string, string | number>();\n    const removes: string[] = [];\n    session.delta.forEach((value, key) => {\n      if (value !== null) delta.set(key, value);\n      else removes.push(key);\n    });\n\n    if (delta.size !== 0) {\n      await this.redis.hset(this.getSessionKey(sessionId), delta);\n    }\n    if (removes.length !== 0) {\n      await this.redis.hdel(this.getSessionKey(sessionId), ...removes);\n    }\n\n    const principalSessionKey = this.getSessionAttrNameKey(PRINCIPAL_NAME_INDEX_NAME);\n    const securityPrincipalSessionKey = this.getSessionAttrNameKey(SPRING_SECURITY_CONTEXT);\n    if (session.delta.has(principalSessionKey) || session.delta.has(securityPrincipalSessionKey)) {\n      if (session.originalPrincipalName !== null) {\n        const originalPrincipalRedisKey = this.getPrincipalKey(session.originalPrincipalName);\n        await this.redis.srem(originalPrincipalRedisKey, sessionId);\n      }\n      const principal = resolveIndexesFor(session);\n      session.originalPrincipalName = principal;\n      if (principal !== null) {\n        const principalRedisKey = this.getPrincipalKey(principal);\n        await this.redis.sadd(principalRedisKey, sessionId);\n      }\n    }\n\n    if (session.isNew) {\n      // here your can send session created message to channel\n      session.isNew = false;\n    }\n\n    const sessionExpireInSeconds = session.getMaxInactiveInterval();\n\n    // createShadowKey start\n    const keyToExpire = SESSION_EXPIRES_PREFIX + session.getId();\n    const sessionKey = this.getSessionKey(keyToExpire);\n\n    if (sessionExpireInSeconds < 0) {\n      await this.redis.append(sessionKey, '');\n      await this.redis.persist(sessionKey);\n      await this.redis.persist(this.getSessionKey(session.getId()));\n    } else if (sessionExpireInSeconds === 0) {\n      await this.redis.del(sessionKey);\n    } else {\n      await this.redis.append(sessionKey, '');\n      await this.redis.expire(sessionKey, sessionExpireInSeconds);\n    }\n    // createShadowKey end\n\n    if (sessionExpireInSeconds > 0) {\n      const fiveMinutesAfterExpires = sessionExpireInSeconds + 5 * 60;\n      await this.redis.expire(this.getSessionKey(session.getId()), fiveMinutesAfterExpires);\n    }\n\n    await this.expirationStore.save(session);\n    session.delta.clear();\n  }\n\n  private async saveChangeSessionId(session: RedisSession) {\n    const sessionId = session.getId();\n    if (sessionId === session.originalSessionId) return;\n    if (!session.isNew) {\n      const originalSessionIdKey = this.getSessionKey(session.originalSessionId);\n      const sessionIdKey = this.getSessionKey(sessionId);\n      const originalExpiredKey = this.getExpiredKey(session.originalSessionId);\n      const expiredKey = this.getExpiredKey(sessionId);\n\n      await this.redis.rename(originalSessionIdKey, sessionIdKey);\n      await this.redis.rename(originalExpiredKey, expiredKey);\n\n      if (session.originalPrincipalName !== null) {\n        const originalPrincipalRedisKey = this.getPrincipalKey(session.originalPrincipalName);\n        await this.redis.srem(originalPrincipalRedisKey, session.originalSessionId);\n        await this.redis.sadd(originalPrincipalRedisKey, sessionId);\n      }\n      await this.expirationStore.rename(session);\n    }\n    session.originalSessionId = sessionId;\n  }\n\n  // override\n  createSession() {\n    const cached = new MapSession();\n    cached.setMaxInactiveInterval(this.defaultMaxInactiveInterval);\n    return new RedisSession(cached, true);\n  }\n\n  async save(session: RedisSession) {\n    await this.saveChangeSessionId(session);\n    await this.saveDelta(session);\n  }\n\n  async findById(sessionId: string): Promise<RedisSession | null> {\n    return this.getSession(sessionId, false);\n  }\n\n  async deleteById(sessionId: string) {\n    const session = await this.getSession(sessionId, true);\n    if (!session) return;\n    // 1. cleanup index\n    const principal = resolveIndexesFor(session);\n    if (principal !== null) {\n      await this.redis.srem(this.getPrincipalKey(principal), sessionId);\n    }\n    // 2. delete in set\n    await this.expirationStore.remove(sessionId);\n    // 3. delete expired key\n    const expiredKey = this.getExpiredKey(sessionId);\n    await this.redis.del(expiredKey);\n\n    session.setMaxInactiveInterval(0);\n    await this.save(session);\n  }\n\n  async findByIndexNameAndIndexValue(indexName: string, indexValue: string) {\n    if (indexName !== PRINCIPAL_NAME_INDEX_NAME) {\n      return new Map<string, RedisSession>();\n    }\n\n    const principalKey = this.getPrincipalKey(indexValue);\n    const sessionIds = await this.redis.smembers(principalKey);\n    if (!sessionIds || sessionIds.length === 0) {\n      return new Map<string, RedisSession>();\n    }\n    const sessions = new Map<string, RedisSession>();\n    for (const sessionId of sessionIds) {\n      const session = await this.findById(sessionId);\n      if (session !== null) {\n        sessions.set(sessionId, session);\n      }\n    }\n    return sessions;\n  }\n\n  async findByPrincipalName(principalName: string) {\n    return this.findByIndexNameAndIndexValue(PRINCIPAL_NAME_INDEX_NAME, principalName);\n  }\n\n  async cleanupExpiredSessions(cleanupCount?: number) {\n    await this.expirationStore.cleanupExpiredSessions(cleanupCount);\n  }\n}\n\nexport class RedisKVRepository implements KVRepository {\n  private readonly redis: Redis;\n\n  constructor(redis: Redis) {\n    this.redis = redis;\n  }\n\n  async setItem(key: string, value: string, expiresIn?: number) {\n    if (expiresIn) {\n      await this.redis.set(key, value, 'EX', expiresIn);\n    } else {\n      await this.redis.set(key, value);\n    }\n  }\n\n  async getItem(key: string): Promise<string | null> {\n    return await this.redis.get(key);\n  }\n\n  async removeItem(key: string) {\n    await this.redis.del(key);\n  }\n}\n"],"mappings":";AAAA,SAAS,mBAAmB,2BAA2B,+BAA+B;AACtF,SAAS,kBAAkB;AAI3B,IAAM,oBAAoB;AAC1B,IAAM,yBAAyB;AAC/B,IAAM,4BAA4B;AAClC,IAAM,mBAAmB;AACzB,IAAM,yBAAyB;AAE/B,IAAM,eAAN,MAAsC;AAAA,EACnB;AAAA,EAEV;AAAA,EACA,QAAQ,oBAAI,IAAoC;AAAA,EAChD;AAAA,EACA;AAAA,EACA,yBAAwC;AAAA,EAE/C,YAAY,QAAoB,OAAgB;AAC9C,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,SAAK,oBAAoB,OAAO,MAAM;AACtC,SAAK,wBAAwB,kBAAkB,IAAI;AAEnD,QAAI,OAAO;AACT,WAAK,MAAM,IAAI,mBAAmB,OAAO,gBAAgB,CAAC;AAC1D,WAAK,MAAM,IAAI,wBAAwB,OAAO,oBAAoB,CAAC;AACnE,WAAK,MAAM,IAAI,2BAA2B,OAAO,uBAAuB,CAAC;AACzE,WAAK,OAAO,kBAAkB,EAAE,QAAQ,CAAC,SAAS;AAChD,cAAM,QAAQ,KAAK,OAAO,aAAa,IAAI;AAC3C,YAAI,MAAO,MAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,KAAK;AAAA,MACnE,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,sBAAsB,MAAc;AAClC,WAAO,mBAAmB;AAAA,EAC5B;AAAA;AAAA,EAGA,oBAAoB,kBAA0B;AAC5C,SAAK,OAAO,oBAAoB,gBAAgB;AAChD,SAAK,MAAM,IAAI,wBAAwB,gBAAgB;AAAA,EACzD;AAAA,EAEA,YAAY;AACV,WAAO,KAAK,OAAO,UAAU;AAAA,EAC/B;AAAA,EAEA,kBAAkB;AAChB,WAAO,KAAK,OAAO,gBAAgB;AAAA,EACrC;AAAA,EAEA,QAAQ;AACN,WAAO,KAAK,OAAO,MAAM;AAAA,EAC3B;AAAA,EAEA,kBAAkB;AAChB,WAAO,KAAK,OAAO,gBAAgB;AAAA,EACrC;AAAA,EAEA,sBAAsB;AACpB,WAAO,KAAK,OAAO,oBAAoB;AAAA,EACzC;AAAA,EAEA,uBAAuB,UAAkB;AACvC,SAAK,OAAO,uBAAuB,QAAQ;AAC3C,SAAK,MAAM,IAAI,2BAA2B,QAAQ;AAAA,EACpD;AAAA,EAEA,yBAAyB;AACvB,WAAO,KAAK,OAAO,uBAAuB;AAAA,EAC5C;AAAA,EAEA,aAAa,MAAc;AACzB,WAAO,KAAK,OAAO,aAAa,IAAI;AAAA,EACtC;AAAA,EAEA,oBAAoB;AAClB,WAAO,KAAK,OAAO,kBAAkB;AAAA,EACvC;AAAA,EAEA,aAAa,MAAc,OAAe;AACxC,SAAK,OAAO,aAAa,MAAM,KAAK;AACpC,SAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,KAAK;AAAA,EACxD;AAAA,EAEA,gBAAgB,MAAc;AAC5B,SAAK,OAAO,gBAAgB,IAAI;AAChC,SAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,IAAI;AAAA,EACvD;AACF;AASA,IAAM,uCAAN,MAAkF;AAAA,EAC/D;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,OAAc,WAAsB;AAC9C,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,iBAAiB,GAAG,KAAK,SAAS;AAAA,EACzC;AAAA,EAEA,cAAc,WAAmB;AAC/B,WAAO,GAAG,KAAK,SAAS,aAAa,SAAS;AAAA,EAChD;AAAA,EAEA,MAAM,KAAK,SAAuB;AAChC,UAAM,qBACJ,QAAQ,oBAAoB,IAAI,QAAQ,uBAAuB,IAAI;AACrE,UAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,oBAAoB,QAAQ,MAAM,CAAC;AAAA,EAChF;AAAA,EAEA,MAAM,OAAO,WAAmB;AAC9B,UAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,SAAS;AAAA,EACtD;AAAA,EAEA,MAAM,OAAO,SAAuB;AAClC,QAAI,QAAQ,sBAAsB,QAAQ,QAAQ,sBAAsB,QAAQ,MAAM,EAAG;AACzF,UAAM,KAAK,OAAO,QAAQ,iBAAiB;AAC3C,UAAM,KAAK,KAAK,OAAO;AAAA,EACzB;AAAA,EAEA,MAAM,uBAAuB,eAAuB,KAAK;AACvD,UAAM,MAAM,KAAK;AACjB,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,aAAa,MAAM,KAAK,MAAM,iBAAiB,KAAK,OAAO,GAAG,SAAS,GAAG,YAAY;AAC5F,QAAI,WAAW,WAAW,EAAG;AAC7B,eAAW,aAAa,YAAY;AAClC,YAAM,aAAa,KAAK,cAAc,SAAS;AAG/C,YAAM,KAAK,MAAM,OAAO,UAAU;AAAA,IACpC;AAAA,EACF;AACF;AAKO,IAAM,gCAAN,MAA+E;AAAA,EACnE;AAAA,EACA;AAAA,EACA;AAAA,EAET,6BAA6B;AAAA,EAErC,YAAY,OAAc,YAAuB,kBAAkB;AACjE,SAAK,QAAQ;AACb,SAAK,YAAY;AACjB,SAAK,kBAAkB,IAAI,qCAAqC,OAAO,SAAS;AAAA,EAClF;AAAA,EAEA,8BAA8B,UAAkB;AAC9C,SAAK,6BAA6B;AAAA,EACpC;AAAA,EAEQ,cAAc,WAAmB;AACvC,WAAO,GAAG,KAAK,SAAS,aAAa,SAAS;AAAA,EAChD;AAAA,EAEQ,cAAc,WAAmB;AACvC,WAAO,GAAG,KAAK,SAAS,qBAAqB,SAAS;AAAA,EACxD;AAAA,EAEQ,sBAAsB,MAAc;AAC1C,WAAO,mBAAmB;AAAA,EAC5B;AAAA,EAEQ,gBAAgB,eAAuB;AAC7C,WAAO,GAAG,KAAK,SAAS,UAAU,yBAAyB,IAAI,aAAa;AAAA,EAC9E;AAAA,EAEA,MAAc,WAAW,IAAY,cAAqD;AACxF,UAAM,MAAM,KAAK,cAAc,EAAE;AACjC,UAAM,UAAU,MAAM,KAAK,MAAM,QAAQ,GAAG;AAC5C,QAAI,CAAC,WAAW,OAAO,KAAK,OAAO,EAAE,WAAW,EAAG,QAAO;AAC1D,UAAM,SAAS,IAAI,WAAW,EAAE;AAChC,QAAI,CAAC,QAAQ,aAAc,OAAM,IAAI,MAAM,kCAAkC;AAC7E,QAAI,CAAC,QAAQ,iBAAkB,OAAM,IAAI,MAAM,sCAAsC;AACrF,QAAI,CAAC,QAAQ,oBAAqB,OAAM,IAAI,MAAM,yCAAyC;AAE3F,WAAO,gBAAgB,OAAO,QAAQ,YAAY,CAAC;AACnD,WAAO,oBAAoB,OAAO,QAAQ,gBAAgB,CAAC;AAC3D,WAAO,uBAAuB,OAAO,QAAQ,mBAAmB,CAAC;AAEjE,eAAW,CAACA,MAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,UAAIA,KAAI,WAAW,gBAAgB,GAAG;AACpC,eAAO,aAAaA,KAAI,MAAM,iBAAiB,MAAM,GAAG,KAAK;AAAA,MAC/D;AAAA,IACF;AAEA,QAAI,CAAC,gBAAgB,OAAO,UAAU,EAAG,QAAO;AAChD,UAAM,SAAS,IAAI,aAAa,QAAQ,KAAK;AAC7C,WAAO,yBAAyB,OAAO,oBAAoB;AAC3D,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,UAAU,SAAuB;AAC7C,QAAI,QAAQ,MAAM,SAAS,EAAG;AAC9B,UAAM,YAAY,QAAQ,MAAM;AAChC,UAAM,QAAQ,oBAAI,IAA6B;AAC/C,UAAM,UAAoB,CAAC;AAC3B,YAAQ,MAAM,QAAQ,CAAC,OAAO,QAAQ;AACpC,UAAI,UAAU,KAAM,OAAM,IAAI,KAAK,KAAK;AAAA,UACnC,SAAQ,KAAK,GAAG;AAAA,IACvB,CAAC;AAED,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,KAAK,MAAM,KAAK,KAAK,cAAc,SAAS,GAAG,KAAK;AAAA,IAC5D;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,YAAM,KAAK,MAAM,KAAK,KAAK,cAAc,SAAS,GAAG,GAAG,OAAO;AAAA,IACjE;AAEA,UAAM,sBAAsB,KAAK,sBAAsB,yBAAyB;AAChF,UAAM,8BAA8B,KAAK,sBAAsB,uBAAuB;AACtF,QAAI,QAAQ,MAAM,IAAI,mBAAmB,KAAK,QAAQ,MAAM,IAAI,2BAA2B,GAAG;AAC5F,UAAI,QAAQ,0BAA0B,MAAM;AAC1C,cAAM,4BAA4B,KAAK,gBAAgB,QAAQ,qBAAqB;AACpF,cAAM,KAAK,MAAM,KAAK,2BAA2B,SAAS;AAAA,MAC5D;AACA,YAAM,YAAY,kBAAkB,OAAO;AAC3C,cAAQ,wBAAwB;AAChC,UAAI,cAAc,MAAM;AACtB,cAAM,oBAAoB,KAAK,gBAAgB,SAAS;AACxD,cAAM,KAAK,MAAM,KAAK,mBAAmB,SAAS;AAAA,MACpD;AAAA,IACF;AAEA,QAAI,QAAQ,OAAO;AAEjB,cAAQ,QAAQ;AAAA,IAClB;AAEA,UAAM,yBAAyB,QAAQ,uBAAuB;AAG9D,UAAM,cAAc,yBAAyB,QAAQ,MAAM;AAC3D,UAAM,aAAa,KAAK,cAAc,WAAW;AAEjD,QAAI,yBAAyB,GAAG;AAC9B,YAAM,KAAK,MAAM,OAAO,YAAY,EAAE;AACtC,YAAM,KAAK,MAAM,QAAQ,UAAU;AACnC,YAAM,KAAK,MAAM,QAAQ,KAAK,cAAc,QAAQ,MAAM,CAAC,CAAC;AAAA,IAC9D,WAAW,2BAA2B,GAAG;AACvC,YAAM,KAAK,MAAM,IAAI,UAAU;AAAA,IACjC,OAAO;AACL,YAAM,KAAK,MAAM,OAAO,YAAY,EAAE;AACtC,YAAM,KAAK,MAAM,OAAO,YAAY,sBAAsB;AAAA,IAC5D;AAGA,QAAI,yBAAyB,GAAG;AAC9B,YAAM,0BAA0B,yBAAyB,IAAI;AAC7D,YAAM,KAAK,MAAM,OAAO,KAAK,cAAc,QAAQ,MAAM,CAAC,GAAG,uBAAuB;AAAA,IACtF;AAEA,UAAM,KAAK,gBAAgB,KAAK,OAAO;AACvC,YAAQ,MAAM,MAAM;AAAA,EACtB;AAAA,EAEA,MAAc,oBAAoB,SAAuB;AACvD,UAAM,YAAY,QAAQ,MAAM;AAChC,QAAI,cAAc,QAAQ,kBAAmB;AAC7C,QAAI,CAAC,QAAQ,OAAO;AAClB,YAAM,uBAAuB,KAAK,cAAc,QAAQ,iBAAiB;AACzE,YAAM,eAAe,KAAK,cAAc,SAAS;AACjD,YAAM,qBAAqB,KAAK,cAAc,QAAQ,iBAAiB;AACvE,YAAM,aAAa,KAAK,cAAc,SAAS;AAE/C,YAAM,KAAK,MAAM,OAAO,sBAAsB,YAAY;AAC1D,YAAM,KAAK,MAAM,OAAO,oBAAoB,UAAU;AAEtD,UAAI,QAAQ,0BAA0B,MAAM;AAC1C,cAAM,4BAA4B,KAAK,gBAAgB,QAAQ,qBAAqB;AACpF,cAAM,KAAK,MAAM,KAAK,2BAA2B,QAAQ,iBAAiB;AAC1E,cAAM,KAAK,MAAM,KAAK,2BAA2B,SAAS;AAAA,MAC5D;AACA,YAAM,KAAK,gBAAgB,OAAO,OAAO;AAAA,IAC3C;AACA,YAAQ,oBAAoB;AAAA,EAC9B;AAAA;AAAA,EAGA,gBAAgB;AACd,UAAM,SAAS,IAAI,WAAW;AAC9B,WAAO,uBAAuB,KAAK,0BAA0B;AAC7D,WAAO,IAAI,aAAa,QAAQ,IAAI;AAAA,EACtC;AAAA,EAEA,MAAM,KAAK,SAAuB;AAChC,UAAM,KAAK,oBAAoB,OAAO;AACtC,UAAM,KAAK,UAAU,OAAO;AAAA,EAC9B;AAAA,EAEA,MAAM,SAAS,WAAiD;AAC9D,WAAO,KAAK,WAAW,WAAW,KAAK;AAAA,EACzC;AAAA,EAEA,MAAM,WAAW,WAAmB;AAClC,UAAM,UAAU,MAAM,KAAK,WAAW,WAAW,IAAI;AACrD,QAAI,CAAC,QAAS;AAEd,UAAM,YAAY,kBAAkB,OAAO;AAC3C,QAAI,cAAc,MAAM;AACtB,YAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,SAAS,GAAG,SAAS;AAAA,IAClE;AAEA,UAAM,KAAK,gBAAgB,OAAO,SAAS;AAE3C,UAAM,aAAa,KAAK,cAAc,SAAS;AAC/C,UAAM,KAAK,MAAM,IAAI,UAAU;AAE/B,YAAQ,uBAAuB,CAAC;AAChC,UAAM,KAAK,KAAK,OAAO;AAAA,EACzB;AAAA,EAEA,MAAM,6BAA6B,WAAmB,YAAoB;AACxE,QAAI,cAAc,2BAA2B;AAC3C,aAAO,oBAAI,IAA0B;AAAA,IACvC;AAEA,UAAM,eAAe,KAAK,gBAAgB,UAAU;AACpD,UAAM,aAAa,MAAM,KAAK,MAAM,SAAS,YAAY;AACzD,QAAI,CAAC,cAAc,WAAW,WAAW,GAAG;AAC1C,aAAO,oBAAI,IAA0B;AAAA,IACvC;AACA,UAAM,WAAW,oBAAI,IAA0B;AAC/C,eAAW,aAAa,YAAY;AAClC,YAAM,UAAU,MAAM,KAAK,SAAS,SAAS;AAC7C,UAAI,YAAY,MAAM;AACpB,iBAAS,IAAI,WAAW,OAAO;AAAA,MACjC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,oBAAoB,eAAuB;AAC/C,WAAO,KAAK,6BAA6B,2BAA2B,aAAa;AAAA,EACnF;AAAA,EAEA,MAAM,uBAAuB,cAAuB;AAClD,UAAM,KAAK,gBAAgB,uBAAuB,YAAY;AAAA,EAChE;AACF;AAEO,IAAM,oBAAN,MAAgD;AAAA,EACpC;AAAA,EAEjB,YAAY,OAAc;AACxB,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAM,QAAQ,KAAa,OAAe,WAAoB;AAC5D,QAAI,WAAW;AACb,YAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,SAAS;AAAA,IAClD,OAAO;AACL,YAAM,KAAK,MAAM,IAAI,KAAK,KAAK;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,KAAqC;AACjD,WAAO,MAAM,KAAK,MAAM,IAAI,GAAG;AAAA,EACjC;AAAA,EAEA,MAAM,WAAW,KAAa;AAC5B,UAAM,KAAK,MAAM,IAAI,GAAG;AAAA,EAC1B;AACF;","names":["key"]}

package/dist/session/workers-kv.cjs

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=workers-kv.cjs.map

package/dist/session/workers-kv.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/session/workers-kv.d.cts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/session/workers-kv.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/session/workers-kv.mjs

@@ -0,0 +1 @@
+//# sourceMappingURL=workers-kv.mjs.map

package/dist/session/workers-kv.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/security",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "private": false,
   "type": "module",
   "scripts": {