@shware/security 5.0.1 → 6.0.0

package/dist/session/redis.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"redis.mjs","names":[],"sources":["../../src/session/redis.ts"],"sourcesContent":["import type { Redis } from 'ioredis';\nimport { PRINCIPAL_NAME_INDEX_NAME, SPRING_SECURITY_CONTEXT, resolveIndexesFor } from './common';\nimport { MapSession } from './map-session';\nimport type { KVRepository, Namespace, Session, SessionRepository } from './types';\n\nconst CREATION_TIME_KEY = 'creationTime';\nconst LAST_ACCESSED_TIME_KEY = 'lastAccessedTime';\nconst MAX_INACTIVE_INTERVAL_KEY = 'maxInactiveInterval';\nconst ATTRIBUTE_PREFIX = 'sessionAttr:';\nconst SESSION_EXPIRES_PREFIX = 'expires:';\n\nclass RedisSession implements Session {\n  private readonly cached: MapSession;\n\n  public isNew: boolean;\n  public delta = new Map<string, string | number | null>();\n  public originalSessionId: string;\n  public originalPrincipalName: string | null;\n  public originalLastAccessTime: number | null = null;\n\n  constructor(cached: MapSession, isNew: boolean) {\n    this.cached = cached;\n    this.isNew = isNew;\n    this.originalSessionId = cached.getId();\n    this.originalPrincipalName = resolveIndexesFor(this);\n\n    if (isNew) {\n      this.delta.set(CREATION_TIME_KEY, cached.getCreationTime());\n      this.delta.set(LAST_ACCESSED_TIME_KEY, cached.getLastAccessedTime());\n      this.delta.set(MAX_INACTIVE_INTERVAL_KEY, cached.getMaxInactiveInterval());\n      this.cached.getAttributeNames().forEach((name) => {\n        const value = this.cached.getAttribute(name);\n        if (value) this.delta.set(this.getSessionAttrNameKey(name), value);\n      });\n    }\n  }\n\n  getSessionAttrNameKey(name: string) {\n    return ATTRIBUTE_PREFIX + name;\n  }\n\n  // override\n  setLastAccessedTime(lastAccessedTime: number) {\n    this.cached.setLastAccessedTime(lastAccessedTime);\n    this.delta.set(LAST_ACCESSED_TIME_KEY, lastAccessedTime);\n  }\n\n  isExpired() {\n    return this.cached.isExpired();\n  }\n\n  getCreationTime() {\n    return this.cached.getCreationTime();\n  }\n\n  getId() {\n    return this.cached.getId();\n  }\n\n  changeSessionId() {\n    return this.cached.changeSessionId();\n  }\n\n  getLastAccessedTime() {\n    return this.cached.getLastAccessedTime();\n  }\n\n  setMaxInactiveInterval(interval: number) {\n    this.cached.setMaxInactiveInterval(interval);\n    this.delta.set(MAX_INACTIVE_INTERVAL_KEY, interval);\n  }\n\n  getMaxInactiveInterval() {\n    return this.cached.getMaxInactiveInterval();\n  }\n\n  getAttribute(name: string) {\n    return this.cached.getAttribute(name);\n  }\n\n  getAttributeNames() {\n    return this.cached.getAttributeNames();\n  }\n\n  setAttribute(name: string, value: string) {\n    this.cached.setAttribute(name, value);\n    this.delta.set(this.getSessionAttrNameKey(name), value);\n  }\n\n  removeAttribute(name: string) {\n    this.cached.removeAttribute(name);\n    this.delta.set(this.getSessionAttrNameKey(name), null);\n  }\n}\n\ninterface RedisSessionExpirationStore {\n  save(session: RedisSession): Promise<void>;\n  remove(sessionId: string): Promise<void>;\n  rename(session: RedisSession): Promise<void>;\n  cleanupExpiredSessions(cleanupCount?: number): Promise<void>;\n}\n\nclass SortedSetRedisSessionExpirationStore implements RedisSessionExpirationStore {\n  private readonly redis: Redis;\n  private readonly namespace: Namespace;\n  private readonly expirationsKey: string;\n\n  constructor(redis: Redis, namespace: Namespace) {\n    this.redis = redis;\n    this.namespace = namespace;\n    this.expirationsKey = `${this.namespace}:sessions:expirations`;\n  }\n\n  getSessionKey(sessionId: string) {\n    return `${this.namespace}:sessions:${sessionId}`;\n  }\n\n  async save(session: RedisSession) {\n    const expirationInMillis =\n      session.getLastAccessedTime() + session.getMaxInactiveInterval() * 1000;\n    await this.redis.zadd(this.expirationsKey, expirationInMillis, session.getId());\n  }\n\n  async remove(sessionId: string) {\n    await this.redis.zrem(this.expirationsKey, sessionId);\n  }\n\n  async rename(session: RedisSession) {\n    if (session.originalSessionId === session.getId()) return;\n    await this.remove(session.originalSessionId);\n    await this.save(session);\n  }\n\n  async cleanupExpiredSessions(cleanupCount = 100) {\n    const key = this.expirationsKey;\n    const score = Date.now();\n    const sessionIds = await this.redis.zrevrangebyscore(key, score, 0, 'LIMIT', 0, cleanupCount);\n    if (sessionIds.length === 0) return;\n    for (const sessionId of sessionIds) {\n      const sessionKey = this.getSessionKey(sessionId);\n      // Checks if the session exists. By trying to access the session we only trigger a deletion\n      // if the TTL is expired.\n      await this.redis.exists(sessionKey);\n    }\n  }\n}\n\n// <spring:session:sessions:uuid, hash<session>> + 300s\n// <spring:session:sessions:expirations, sorted_set<uuid>>\n// <spring:session:sessions:expires:uuid, string<empty>>: for expire check & event\nexport class RedisIndexedSessionRepository implements SessionRepository<RedisSession> {\n  private readonly redis: Redis;\n  private readonly namespace: Namespace;\n  private readonly expirationStore: RedisSessionExpirationStore;\n\n  private defaultMaxInactiveInterval = 1800;\n\n  constructor(redis: Redis, namespace: Namespace = 'spring:session') {\n    this.redis = redis;\n    this.namespace = namespace;\n    this.expirationStore = new SortedSetRedisSessionExpirationStore(redis, namespace);\n  }\n\n  setDefaultMaxInactiveInterval(interval: number) {\n    this.defaultMaxInactiveInterval = interval;\n  }\n\n  private getSessionKey(sessionId: string) {\n    return `${this.namespace}:sessions:${sessionId}`;\n  }\n\n  private getExpiredKey(sessionId: string) {\n    return `${this.namespace}:sessions:expires:${sessionId}`;\n  }\n\n  private getSessionAttrNameKey(name: string) {\n    return ATTRIBUTE_PREFIX + name;\n  }\n\n  private getPrincipalKey(principalName: string) {\n    return `${this.namespace}:index:${PRINCIPAL_NAME_INDEX_NAME}:${principalName}`;\n  }\n\n  private async getSession(id: string, allowExpired: boolean): Promise<RedisSession | null> {\n    const key = this.getSessionKey(id);\n    const entries = await this.redis.hgetall(key);\n    if (Object.keys(entries).length === 0) return null;\n    const loaded = new MapSession(id);\n    if (!entries.creationTime) throw new Error('creationTime attribute not found');\n    if (!entries.lastAccessedTime) throw new Error('lastAccessedTime attribute not found');\n    if (!entries.maxInactiveInterval) throw new Error('maxInactiveInterval attribute not found');\n\n    loaded.setCreationTime(Number(entries.creationTime));\n    loaded.setLastAccessedTime(Number(entries.lastAccessedTime));\n    loaded.setMaxInactiveInterval(Number(entries.maxInactiveInterval));\n\n    for (const [key, value] of Object.entries(entries)) {\n      if (key.startsWith(ATTRIBUTE_PREFIX)) {\n        loaded.setAttribute(key.slice(ATTRIBUTE_PREFIX.length), value);\n      }\n    }\n\n    if (!allowExpired && loaded.isExpired()) return null;\n    const result = new RedisSession(loaded, false);\n    result.originalLastAccessTime = loaded.getLastAccessedTime();\n    return result;\n  }\n\n  private async saveDelta(session: RedisSession) {\n    if (session.delta.size === 0) return;\n    const sessionId = session.getId();\n    const delta = new Map<string, string | number>();\n    const removes: string[] = [];\n    session.delta.forEach((value, key) => {\n      if (value !== null) delta.set(key, value);\n      else removes.push(key);\n    });\n\n    if (delta.size !== 0) {\n      await this.redis.hset(this.getSessionKey(sessionId), delta);\n    }\n    if (removes.length !== 0) {\n      await this.redis.hdel(this.getSessionKey(sessionId), ...removes);\n    }\n\n    const principalSessionKey = this.getSessionAttrNameKey(PRINCIPAL_NAME_INDEX_NAME);\n    const securityPrincipalSessionKey = this.getSessionAttrNameKey(SPRING_SECURITY_CONTEXT);\n    if (session.delta.has(principalSessionKey) || session.delta.has(securityPrincipalSessionKey)) {\n      if (session.originalPrincipalName !== null) {\n        const originalPrincipalRedisKey = this.getPrincipalKey(session.originalPrincipalName);\n        await this.redis.srem(originalPrincipalRedisKey, sessionId);\n      }\n      const principal = resolveIndexesFor(session);\n      session.originalPrincipalName = principal;\n      if (principal !== null) {\n        const principalRedisKey = this.getPrincipalKey(principal);\n        await this.redis.sadd(principalRedisKey, sessionId);\n      }\n    }\n\n    if (session.isNew) {\n      // here your can send session created message to channel\n      session.isNew = false;\n    }\n\n    const sessionExpireInSeconds = session.getMaxInactiveInterval();\n\n    // createShadowKey start\n    const keyToExpire = SESSION_EXPIRES_PREFIX + session.getId();\n    const sessionKey = this.getSessionKey(keyToExpire);\n\n    if (sessionExpireInSeconds < 0) {\n      await this.redis.append(sessionKey, '');\n      await this.redis.persist(sessionKey);\n      await this.redis.persist(this.getSessionKey(session.getId()));\n    } else if (sessionExpireInSeconds === 0) {\n      await this.redis.del(sessionKey);\n    } else {\n      await this.redis.append(sessionKey, '');\n      await this.redis.expire(sessionKey, sessionExpireInSeconds);\n    }\n    // createShadowKey end\n\n    if (sessionExpireInSeconds > 0) {\n      const fiveMinutesAfterExpires = sessionExpireInSeconds + 5 * 60;\n      await this.redis.expire(this.getSessionKey(session.getId()), fiveMinutesAfterExpires);\n    }\n\n    await this.expirationStore.save(session);\n    session.delta.clear();\n  }\n\n  private async saveChangeSessionId(session: RedisSession) {\n    const sessionId = session.getId();\n    if (sessionId === session.originalSessionId) return;\n    if (!session.isNew) {\n      const originalSessionIdKey = this.getSessionKey(session.originalSessionId);\n      const sessionIdKey = this.getSessionKey(sessionId);\n      const originalExpiredKey = this.getExpiredKey(session.originalSessionId);\n      const expiredKey = this.getExpiredKey(sessionId);\n\n      await this.redis.rename(originalSessionIdKey, sessionIdKey);\n      await this.redis.rename(originalExpiredKey, expiredKey);\n\n      if (session.originalPrincipalName !== null) {\n        const originalPrincipalRedisKey = this.getPrincipalKey(session.originalPrincipalName);\n        await this.redis.srem(originalPrincipalRedisKey, session.originalSessionId);\n        await this.redis.sadd(originalPrincipalRedisKey, sessionId);\n      }\n      await this.expirationStore.rename(session);\n    }\n    session.originalSessionId = sessionId;\n  }\n\n  // override\n  createSession() {\n    const cached = new MapSession();\n    cached.setMaxInactiveInterval(this.defaultMaxInactiveInterval);\n    return new RedisSession(cached, true);\n  }\n\n  async save(session: RedisSession) {\n    await this.saveChangeSessionId(session);\n    await this.saveDelta(session);\n  }\n\n  async findById(sessionId: string): Promise<RedisSession | null> {\n    return this.getSession(sessionId, false);\n  }\n\n  async deleteById(sessionId: string) {\n    const session = await this.getSession(sessionId, true);\n    if (!session) return;\n    // 1. cleanup index\n    const principal = resolveIndexesFor(session);\n    if (principal !== null) {\n      await this.redis.srem(this.getPrincipalKey(principal), sessionId);\n    }\n    // 2. delete in set\n    await this.expirationStore.remove(sessionId);\n    // 3. delete expired key\n    const expiredKey = this.getExpiredKey(sessionId);\n    await this.redis.del(expiredKey);\n\n    session.setMaxInactiveInterval(0);\n    await this.save(session);\n  }\n\n  async findByIndexNameAndIndexValue(indexName: string, indexValue: string) {\n    if (indexName !== PRINCIPAL_NAME_INDEX_NAME) {\n      return new Map<string, RedisSession>();\n    }\n\n    const principalKey = this.getPrincipalKey(indexValue);\n    const sessionIds = await this.redis.smembers(principalKey);\n    if (sessionIds.length === 0) {\n      return new Map<string, RedisSession>();\n    }\n    const sessions = new Map<string, RedisSession>();\n    for (const sessionId of sessionIds) {\n      const session = await this.findById(sessionId);\n      if (session !== null) {\n        sessions.set(sessionId, session);\n      }\n    }\n    return sessions;\n  }\n\n  async findByPrincipalName(principalName: string) {\n    return this.findByIndexNameAndIndexValue(PRINCIPAL_NAME_INDEX_NAME, principalName);\n  }\n\n  async cleanupExpiredSessions(cleanupCount?: number) {\n    await this.expirationStore.cleanupExpiredSessions(cleanupCount);\n  }\n}\n\nexport class RedisKVRepository implements KVRepository {\n  private readonly redis: Redis;\n\n  constructor(redis: Redis) {\n    this.redis = redis;\n  }\n\n  async setItem(key: string, value: string, expiresIn?: number) {\n    if (expiresIn) {\n      await this.redis.set(key, value, 'EX', expiresIn);\n    } else {\n      await this.redis.set(key, value);\n    }\n  }\n\n  async getItem(key: string): Promise<string | null> {\n    return this.redis.get(key);\n  }\n\n  async removeItem(key: string) {\n    await this.redis.del(key);\n  }\n}\n"],"mappings":";;;AAKA,MAAM,oBAAoB;AAC1B,MAAM,yBAAyB;AAC/B,MAAM,4BAA4B;AAClC,MAAM,mBAAmB;AACzB,MAAM,yBAAyB;AAE/B,IAAM,eAAN,MAAsC;CACpC;CAEA;CACA,wBAAe,IAAI,IAAoC;CACvD;CACA;CACA,yBAA+C;CAE/C,YAAY,QAAoB,OAAgB;EAC9C,KAAK,SAAS;EACd,KAAK,QAAQ;EACb,KAAK,oBAAoB,OAAO,MAAM;EACtC,KAAK,wBAAwB,kBAAkB,IAAI;EAEnD,IAAI,OAAO;GACT,KAAK,MAAM,IAAI,mBAAmB,OAAO,gBAAgB,CAAC;GAC1D,KAAK,MAAM,IAAI,wBAAwB,OAAO,oBAAoB,CAAC;GACnE,KAAK,MAAM,IAAI,2BAA2B,OAAO,uBAAuB,CAAC;GACzE,KAAK,OAAO,kBAAkB,CAAC,CAAC,SAAS,SAAS;IAChD,MAAM,QAAQ,KAAK,OAAO,aAAa,IAAI;IAC3C,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,KAAK;GACnE,CAAC;EACH;CACF;CAEA,sBAAsB,MAAc;EAClC,OAAO,mBAAmB;CAC5B;CAGA,oBAAoB,kBAA0B;EAC5C,KAAK,OAAO,oBAAoB,gBAAgB;EAChD,KAAK,MAAM,IAAI,wBAAwB,gBAAgB;CACzD;CAEA,YAAY;EACV,OAAO,KAAK,OAAO,UAAU;CAC/B;CAEA,kBAAkB;EAChB,OAAO,KAAK,OAAO,gBAAgB;CACrC;CAEA,QAAQ;EACN,OAAO,KAAK,OAAO,MAAM;CAC3B;CAEA,kBAAkB;EAChB,OAAO,KAAK,OAAO,gBAAgB;CACrC;CAEA,sBAAsB;EACpB,OAAO,KAAK,OAAO,oBAAoB;CACzC;CAEA,uBAAuB,UAAkB;EACvC,KAAK,OAAO,uBAAuB,QAAQ;EAC3C,KAAK,MAAM,IAAI,2BAA2B,QAAQ;CACpD;CAEA,yBAAyB;EACvB,OAAO,KAAK,OAAO,uBAAuB;CAC5C;CAEA,aAAa,MAAc;EACzB,OAAO,KAAK,OAAO,aAAa,IAAI;CACtC;CAEA,oBAAoB;EAClB,OAAO,KAAK,OAAO,kBAAkB;CACvC;CAEA,aAAa,MAAc,OAAe;EACxC,KAAK,OAAO,aAAa,MAAM,KAAK;EACpC,KAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,KAAK;CACxD;CAEA,gBAAgB,MAAc;EAC5B,KAAK,OAAO,gBAAgB,IAAI;EAChC,KAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,IAAI;CACvD;AACF;AASA,IAAM,uCAAN,MAAkF;CAChF;CACA;CACA;CAEA,YAAY,OAAc,WAAsB;EAC9C,KAAK,QAAQ;EACb,KAAK,YAAY;EACjB,KAAK,iBAAiB,GAAG,KAAK,UAAU;CAC1C;CAEA,cAAc,WAAmB;EAC/B,OAAO,GAAG,KAAK,UAAU,YAAY;CACvC;CAEA,MAAM,KAAK,SAAuB;EAChC,MAAM,qBACJ,QAAQ,oBAAoB,IAAI,QAAQ,uBAAuB,IAAI;EACrE,MAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,oBAAoB,QAAQ,MAAM,CAAC;CAChF;CAEA,MAAM,OAAO,WAAmB;EAC9B,MAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,SAAS;CACtD;CAEA,MAAM,OAAO,SAAuB;EAClC,IAAI,QAAQ,sBAAsB,QAAQ,MAAM,GAAG;EACnD,MAAM,KAAK,OAAO,QAAQ,iBAAiB;EAC3C,MAAM,KAAK,KAAK,OAAO;CACzB;CAEA,MAAM,uBAAuB,eAAe,KAAK;EAC/C,MAAM,MAAM,KAAK;EACjB,MAAM,QAAQ,KAAK,IAAI;EACvB,MAAM,aAAa,MAAM,KAAK,MAAM,iBAAiB,KAAK,OAAO,GAAG,SAAS,GAAG,YAAY;EAC5F,IAAI,WAAW,WAAW,GAAG;EAC7B,KAAK,MAAM,aAAa,YAAY;GAClC,MAAM,aAAa,KAAK,cAAc,SAAS;GAG/C,MAAM,KAAK,MAAM,OAAO,UAAU;EACpC;CACF;AACF;AAKA,IAAa,gCAAb,MAAsF;CACpF;CACA;CACA;CAEA,6BAAqC;CAErC,YAAY,OAAc,YAAuB,kBAAkB;EACjE,KAAK,QAAQ;EACb,KAAK,YAAY;EACjB,KAAK,kBAAkB,IAAI,qCAAqC,OAAO,SAAS;CAClF;CAEA,8BAA8B,UAAkB;EAC9C,KAAK,6BAA6B;CACpC;CAEA,cAAsB,WAAmB;EACvC,OAAO,GAAG,KAAK,UAAU,YAAY;CACvC;CAEA,cAAsB,WAAmB;EACvC,OAAO,GAAG,KAAK,UAAU,oBAAoB;CAC/C;CAEA,sBAA8B,MAAc;EAC1C,OAAO,mBAAmB;CAC5B;CAEA,gBAAwB,eAAuB;EAC7C,OAAO,GAAG,KAAK,UAAU,SAAS,0BAA0B,GAAG;CACjE;CAEA,MAAc,WAAW,IAAY,cAAqD;EACxF,MAAM,MAAM,KAAK,cAAc,EAAE;EACjC,MAAM,UAAU,MAAM,KAAK,MAAM,QAAQ,GAAG;EAC5C,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAAG,OAAO;EAC9C,MAAM,SAAS,IAAI,WAAW,EAAE;EAChC,IAAI,CAAC,QAAQ,cAAc,MAAM,IAAI,MAAM,kCAAkC;EAC7E,IAAI,CAAC,QAAQ,kBAAkB,MAAM,IAAI,MAAM,sCAAsC;EACrF,IAAI,CAAC,QAAQ,qBAAqB,MAAM,IAAI,MAAM,yCAAyC;EAE3F,OAAO,gBAAgB,OAAO,QAAQ,YAAY,CAAC;EACnD,OAAO,oBAAoB,OAAO,QAAQ,gBAAgB,CAAC;EAC3D,OAAO,uBAAuB,OAAO,QAAQ,mBAAmB,CAAC;EAEjE,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAC/C,IAAI,IAAI,WAAW,gBAAgB,GACjC,OAAO,aAAa,IAAI,MAAM,EAAuB,GAAG,KAAK;EAIjE,IAAI,CAAC,gBAAgB,OAAO,UAAU,GAAG,OAAO;EAChD,MAAM,SAAS,IAAI,aAAa,QAAQ,KAAK;EAC7C,OAAO,yBAAyB,OAAO,oBAAoB;EAC3D,OAAO;CACT;CAEA,MAAc,UAAU,SAAuB;EAC7C,IAAI,QAAQ,MAAM,SAAS,GAAG;EAC9B,MAAM,YAAY,QAAQ,MAAM;EAChC,MAAM,wBAAQ,IAAI,IAA6B;EAC/C,MAAM,UAAoB,CAAC;EAC3B,QAAQ,MAAM,SAAS,OAAO,QAAQ;GACpC,IAAI,UAAU,MAAM,MAAM,IAAI,KAAK,KAAK;QACnC,QAAQ,KAAK,GAAG;EACvB,CAAC;EAED,IAAI,MAAM,SAAS,GACjB,MAAM,KAAK,MAAM,KAAK,KAAK,cAAc,SAAS,GAAG,KAAK;EAE5D,IAAI,QAAQ,WAAW,GACrB,MAAM,KAAK,MAAM,KAAK,KAAK,cAAc,SAAS,GAAG,GAAG,OAAO;EAGjE,MAAM,sBAAsB,KAAK,sBAAsB,yBAAyB;EAChF,MAAM,8BAA8B,KAAK,sBAAsB,uBAAuB;EACtF,IAAI,QAAQ,MAAM,IAAI,mBAAmB,KAAK,QAAQ,MAAM,IAAI,2BAA2B,GAAG;GAC5F,IAAI,QAAQ,0BAA0B,MAAM;IAC1C,MAAM,4BAA4B,KAAK,gBAAgB,QAAQ,qBAAqB;IACpF,MAAM,KAAK,MAAM,KAAK,2BAA2B,SAAS;GAC5D;GACA,MAAM,YAAY,kBAAkB,OAAO;GAC3C,QAAQ,wBAAwB;GAChC,IAAI,cAAc,MAAM;IACtB,MAAM,oBAAoB,KAAK,gBAAgB,SAAS;IACxD,MAAM,KAAK,MAAM,KAAK,mBAAmB,SAAS;GACpD;EACF;EAEA,IAAI,QAAQ,OAEV,QAAQ,QAAQ;EAGlB,MAAM,yBAAyB,QAAQ,uBAAuB;EAG9D,MAAM,cAAc,yBAAyB,QAAQ,MAAM;EAC3D,MAAM,aAAa,KAAK,cAAc,WAAW;EAEjD,IAAI,yBAAyB,GAAG;GAC9B,MAAM,KAAK,MAAM,OAAO,YAAY,EAAE;GACtC,MAAM,KAAK,MAAM,QAAQ,UAAU;GACnC,MAAM,KAAK,MAAM,QAAQ,KAAK,cAAc,QAAQ,MAAM,CAAC,CAAC;EAC9D,OAAO,IAAI,2BAA2B,GACpC,MAAM,KAAK,MAAM,IAAI,UAAU;OAC1B;GACL,MAAM,KAAK,MAAM,OAAO,YAAY,EAAE;GACtC,MAAM,KAAK,MAAM,OAAO,YAAY,sBAAsB;EAC5D;EAGA,IAAI,yBAAyB,GAAG;GAC9B,MAAM,0BAA0B,yBAAyB;GACzD,MAAM,KAAK,MAAM,OAAO,KAAK,cAAc,QAAQ,MAAM,CAAC,GAAG,uBAAuB;EACtF;EAEA,MAAM,KAAK,gBAAgB,KAAK,OAAO;EACvC,QAAQ,MAAM,MAAM;CACtB;CAEA,MAAc,oBAAoB,SAAuB;EACvD,MAAM,YAAY,QAAQ,MAAM;EAChC,IAAI,cAAc,QAAQ,mBAAmB;EAC7C,IAAI,CAAC,QAAQ,OAAO;GAClB,MAAM,uBAAuB,KAAK,cAAc,QAAQ,iBAAiB;GACzE,MAAM,eAAe,KAAK,cAAc,SAAS;GACjD,MAAM,qBAAqB,KAAK,cAAc,QAAQ,iBAAiB;GACvE,MAAM,aAAa,KAAK,cAAc,SAAS;GAE/C,MAAM,KAAK,MAAM,OAAO,sBAAsB,YAAY;GAC1D,MAAM,KAAK,MAAM,OAAO,oBAAoB,UAAU;GAEtD,IAAI,QAAQ,0BAA0B,MAAM;IAC1C,MAAM,4BAA4B,KAAK,gBAAgB,QAAQ,qBAAqB;IACpF,MAAM,KAAK,MAAM,KAAK,2BAA2B,QAAQ,iBAAiB;IAC1E,MAAM,KAAK,MAAM,KAAK,2BAA2B,SAAS;GAC5D;GACA,MAAM,KAAK,gBAAgB,OAAO,OAAO;EAC3C;EACA,QAAQ,oBAAoB;CAC9B;CAGA,gBAAgB;EACd,MAAM,SAAS,IAAI,WAAW;EAC9B,OAAO,uBAAuB,KAAK,0BAA0B;EAC7D,OAAO,IAAI,aAAa,QAAQ,IAAI;CACtC;CAEA,MAAM,KAAK,SAAuB;EAChC,MAAM,KAAK,oBAAoB,OAAO;EACtC,MAAM,KAAK,UAAU,OAAO;CAC9B;CAEA,MAAM,SAAS,WAAiD;EAC9D,OAAO,KAAK,WAAW,WAAW,KAAK;CACzC;CAEA,MAAM,WAAW,WAAmB;EAClC,MAAM,UAAU,MAAM,KAAK,WAAW,WAAW,IAAI;EACrD,IAAI,CAAC,SAAS;EAEd,MAAM,YAAY,kBAAkB,OAAO;EAC3C,IAAI,cAAc,MAChB,MAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,SAAS,GAAG,SAAS;EAGlE,MAAM,KAAK,gBAAgB,OAAO,SAAS;EAE3C,MAAM,aAAa,KAAK,cAAc,SAAS;EAC/C,MAAM,KAAK,MAAM,IAAI,UAAU;EAE/B,QAAQ,uBAAuB,CAAC;EAChC,MAAM,KAAK,KAAK,OAAO;CACzB;CAEA,MAAM,6BAA6B,WAAmB,YAAoB;EACxE,IAAI,cAAA,0FACF,uBAAO,IAAI,IAA0B;EAGvC,MAAM,eAAe,KAAK,gBAAgB,UAAU;EACpD,MAAM,aAAa,MAAM,KAAK,MAAM,SAAS,YAAY;EACzD,IAAI,WAAW,WAAW,GACxB,uBAAO,IAAI,IAA0B;EAEvC,MAAM,2BAAW,IAAI,IAA0B;EAC/C,KAAK,MAAM,aAAa,YAAY;GAClC,MAAM,UAAU,MAAM,KAAK,SAAS,SAAS;GAC7C,IAAI,YAAY,MACd,SAAS,IAAI,WAAW,OAAO;EAEnC;EACA,OAAO;CACT;CAEA,MAAM,oBAAoB,eAAuB;EAC/C,OAAO,KAAK,6BAA6B,2BAA2B,aAAa;CACnF;CAEA,MAAM,uBAAuB,cAAuB;EAClD,MAAM,KAAK,gBAAgB,uBAAuB,YAAY;CAChE;AACF;AAEA,IAAa,oBAAb,MAAuD;CACrD;CAEA,YAAY,OAAc;EACxB,KAAK,QAAQ;CACf;CAEA,MAAM,QAAQ,KAAa,OAAe,WAAoB;EAC5D,IAAI,WACF,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,SAAS;OAEhD,MAAM,KAAK,MAAM,IAAI,KAAK,KAAK;CAEnC;CAEA,MAAM,QAAQ,KAAqC;EACjD,OAAO,KAAK,MAAM,IAAI,GAAG;CAC3B;CAEA,MAAM,WAAW,KAAa;EAC5B,MAAM,KAAK,MAAM,IAAI,GAAG;CAC1B;AACF"}
+{"version":3,"file":"redis.mjs","names":[],"sources":["../../src/session/redis.ts"],"sourcesContent":["import type { Redis } from 'ioredis';\nimport { PRINCIPAL_NAME_INDEX_NAME, SPRING_SECURITY_CONTEXT, resolveIndexesFor } from './common';\nimport { MapSession } from './map-session';\nimport type { KVRepository, Namespace, Session, SessionRepository } from './types';\n\nconst CREATION_TIME_KEY = 'creationTime';\nconst LAST_ACCESSED_TIME_KEY = 'lastAccessedTime';\nconst MAX_INACTIVE_INTERVAL_KEY = 'maxInactiveInterval';\nconst ATTRIBUTE_PREFIX = 'sessionAttr:';\nconst SESSION_EXPIRES_PREFIX = 'expires:';\n\nclass RedisSession implements Session {\n  private readonly cached: MapSession;\n\n  public isNew: boolean;\n  public delta = new Map<string, string | number | null>();\n  public originalSessionId: string;\n  public originalPrincipalName: string | null;\n  public originalLastAccessTime: number | null = null;\n\n  constructor(cached: MapSession, isNew: boolean) {\n    this.cached = cached;\n    this.isNew = isNew;\n    this.originalSessionId = cached.getId();\n    this.originalPrincipalName = resolveIndexesFor(this);\n\n    if (isNew) {\n      this.delta.set(CREATION_TIME_KEY, cached.getCreationTime());\n      this.delta.set(LAST_ACCESSED_TIME_KEY, cached.getLastAccessedTime());\n      this.delta.set(MAX_INACTIVE_INTERVAL_KEY, cached.getMaxInactiveInterval());\n      this.cached.getAttributeNames().forEach((name) => {\n        const value = this.cached.getAttribute(name);\n        if (value) this.delta.set(this.getSessionAttrNameKey(name), value);\n      });\n    }\n  }\n\n  getSessionAttrNameKey(name: string) {\n    return ATTRIBUTE_PREFIX + name;\n  }\n\n  // override\n  setLastAccessedTime(lastAccessedTime: number) {\n    this.cached.setLastAccessedTime(lastAccessedTime);\n    this.delta.set(LAST_ACCESSED_TIME_KEY, lastAccessedTime);\n  }\n\n  isExpired() {\n    return this.cached.isExpired();\n  }\n\n  getCreationTime() {\n    return this.cached.getCreationTime();\n  }\n\n  getId() {\n    return this.cached.getId();\n  }\n\n  changeSessionId() {\n    return this.cached.changeSessionId();\n  }\n\n  getLastAccessedTime() {\n    return this.cached.getLastAccessedTime();\n  }\n\n  setMaxInactiveInterval(interval: number) {\n    this.cached.setMaxInactiveInterval(interval);\n    this.delta.set(MAX_INACTIVE_INTERVAL_KEY, interval);\n  }\n\n  getMaxInactiveInterval() {\n    return this.cached.getMaxInactiveInterval();\n  }\n\n  getAttribute(name: string) {\n    return this.cached.getAttribute(name);\n  }\n\n  getAttributeNames() {\n    return this.cached.getAttributeNames();\n  }\n\n  setAttribute(name: string, value: string) {\n    this.cached.setAttribute(name, value);\n    this.delta.set(this.getSessionAttrNameKey(name), value);\n  }\n\n  removeAttribute(name: string) {\n    this.cached.removeAttribute(name);\n    this.delta.set(this.getSessionAttrNameKey(name), null);\n  }\n}\n\ninterface RedisSessionExpirationStore {\n  save(session: RedisSession): Promise<void>;\n  remove(sessionId: string): Promise<void>;\n  rename(session: RedisSession): Promise<void>;\n  cleanupExpiredSessions(cleanupCount?: number): Promise<void>;\n}\n\nclass SortedSetRedisSessionExpirationStore implements RedisSessionExpirationStore {\n  private readonly redis: Redis;\n  private readonly namespace: Namespace;\n  private readonly expirationsKey: string;\n\n  constructor(redis: Redis, namespace: Namespace) {\n    this.redis = redis;\n    this.namespace = namespace;\n    this.expirationsKey = `${this.namespace}:sessions:expirations`;\n  }\n\n  getSessionKey(sessionId: string) {\n    return `${this.namespace}:sessions:${sessionId}`;\n  }\n\n  async save(session: RedisSession) {\n    const expirationInMillis =\n      session.getLastAccessedTime() + session.getMaxInactiveInterval() * 1000;\n    await this.redis.zadd(this.expirationsKey, expirationInMillis, session.getId());\n  }\n\n  async remove(sessionId: string) {\n    await this.redis.zrem(this.expirationsKey, sessionId);\n  }\n\n  async rename(session: RedisSession) {\n    if (session.originalSessionId === session.getId()) return;\n    await this.remove(session.originalSessionId);\n    await this.save(session);\n  }\n\n  async cleanupExpiredSessions(cleanupCount = 100) {\n    const key = this.expirationsKey;\n    const score = Date.now();\n    const sessionIds = await this.redis.zrevrangebyscore(key, score, 0, 'LIMIT', 0, cleanupCount);\n    if (sessionIds.length === 0) return;\n    for (const sessionId of sessionIds) {\n      const sessionKey = this.getSessionKey(sessionId);\n      // Checks if the session exists. By trying to access the session we only trigger a deletion\n      // if the TTL is expired.\n      await this.redis.exists(sessionKey);\n    }\n  }\n}\n\n// <spring:session:sessions:uuid, hash<session>> + 300s\n// <spring:session:sessions:expirations, sorted_set<uuid>>\n// <spring:session:sessions:expires:uuid, string<empty>>: for expire check & event\nexport class RedisIndexedSessionRepository implements SessionRepository<RedisSession> {\n  private readonly redis: Redis;\n  private readonly namespace: Namespace;\n  private readonly expirationStore: RedisSessionExpirationStore;\n\n  private defaultMaxInactiveInterval = 1800;\n\n  constructor(redis: Redis, namespace: Namespace = 'spring:session') {\n    this.redis = redis;\n    this.namespace = namespace;\n    this.expirationStore = new SortedSetRedisSessionExpirationStore(redis, namespace);\n  }\n\n  setDefaultMaxInactiveInterval(interval: number) {\n    this.defaultMaxInactiveInterval = interval;\n  }\n\n  private getSessionKey(sessionId: string) {\n    return `${this.namespace}:sessions:${sessionId}`;\n  }\n\n  private getExpiredKey(sessionId: string) {\n    return `${this.namespace}:sessions:expires:${sessionId}`;\n  }\n\n  private getSessionAttrNameKey(name: string) {\n    return ATTRIBUTE_PREFIX + name;\n  }\n\n  private getPrincipalKey(principalName: string) {\n    return `${this.namespace}:index:${PRINCIPAL_NAME_INDEX_NAME}:${principalName}`;\n  }\n\n  private async getSession(id: string, allowExpired: boolean): Promise<RedisSession | null> {\n    const key = this.getSessionKey(id);\n    const entries = await this.redis.hgetall(key);\n    if (Object.keys(entries).length === 0) return null;\n    const loaded = new MapSession(id);\n    if (!entries.creationTime) throw new Error('creationTime attribute not found');\n    if (!entries.lastAccessedTime) throw new Error('lastAccessedTime attribute not found');\n    if (!entries.maxInactiveInterval) throw new Error('maxInactiveInterval attribute not found');\n\n    loaded.setCreationTime(Number(entries.creationTime));\n    loaded.setLastAccessedTime(Number(entries.lastAccessedTime));\n    loaded.setMaxInactiveInterval(Number(entries.maxInactiveInterval));\n\n    for (const [key, value] of Object.entries(entries)) {\n      if (key.startsWith(ATTRIBUTE_PREFIX)) {\n        loaded.setAttribute(key.slice(ATTRIBUTE_PREFIX.length), value);\n      }\n    }\n\n    if (!allowExpired && loaded.isExpired()) return null;\n    const result = new RedisSession(loaded, false);\n    result.originalLastAccessTime = loaded.getLastAccessedTime();\n    return result;\n  }\n\n  private async saveDelta(session: RedisSession) {\n    if (session.delta.size === 0) return;\n    const sessionId = session.getId();\n    const delta = new Map<string, string | number>();\n    const removes: string[] = [];\n    session.delta.forEach((value, key) => {\n      if (value !== null) delta.set(key, value);\n      else removes.push(key);\n    });\n\n    if (delta.size !== 0) {\n      await this.redis.hset(this.getSessionKey(sessionId), delta);\n    }\n    if (removes.length !== 0) {\n      await this.redis.hdel(this.getSessionKey(sessionId), ...removes);\n    }\n\n    const principalSessionKey = this.getSessionAttrNameKey(PRINCIPAL_NAME_INDEX_NAME);\n    const securityPrincipalSessionKey = this.getSessionAttrNameKey(SPRING_SECURITY_CONTEXT);\n    if (session.delta.has(principalSessionKey) || session.delta.has(securityPrincipalSessionKey)) {\n      if (session.originalPrincipalName !== null) {\n        const originalPrincipalRedisKey = this.getPrincipalKey(session.originalPrincipalName);\n        await this.redis.srem(originalPrincipalRedisKey, sessionId);\n      }\n      const principal = resolveIndexesFor(session);\n      session.originalPrincipalName = principal;\n      if (principal !== null) {\n        const principalRedisKey = this.getPrincipalKey(principal);\n        await this.redis.sadd(principalRedisKey, sessionId);\n      }\n    }\n\n    if (session.isNew) {\n      // here your can send session created message to channel\n      session.isNew = false;\n    }\n\n    const sessionExpireInSeconds = session.getMaxInactiveInterval();\n\n    // createShadowKey start\n    const keyToExpire = SESSION_EXPIRES_PREFIX + session.getId();\n    const sessionKey = this.getSessionKey(keyToExpire);\n\n    if (sessionExpireInSeconds < 0) {\n      await this.redis.append(sessionKey, '');\n      await this.redis.persist(sessionKey);\n      await this.redis.persist(this.getSessionKey(session.getId()));\n    } else if (sessionExpireInSeconds === 0) {\n      await this.redis.del(sessionKey);\n    } else {\n      await this.redis.append(sessionKey, '');\n      await this.redis.expire(sessionKey, sessionExpireInSeconds);\n    }\n    // createShadowKey end\n\n    if (sessionExpireInSeconds > 0) {\n      const fiveMinutesAfterExpires = sessionExpireInSeconds + 5 * 60;\n      await this.redis.expire(this.getSessionKey(session.getId()), fiveMinutesAfterExpires);\n    }\n\n    await this.expirationStore.save(session);\n    session.delta.clear();\n  }\n\n  private async saveChangeSessionId(session: RedisSession) {\n    const sessionId = session.getId();\n    if (sessionId === session.originalSessionId) return;\n    if (!session.isNew) {\n      const originalSessionIdKey = this.getSessionKey(session.originalSessionId);\n      const sessionIdKey = this.getSessionKey(sessionId);\n      const originalExpiredKey = this.getExpiredKey(session.originalSessionId);\n      const expiredKey = this.getExpiredKey(sessionId);\n\n      await this.redis.rename(originalSessionIdKey, sessionIdKey);\n      await this.redis.rename(originalExpiredKey, expiredKey);\n\n      if (session.originalPrincipalName !== null) {\n        const originalPrincipalRedisKey = this.getPrincipalKey(session.originalPrincipalName);\n        await this.redis.srem(originalPrincipalRedisKey, session.originalSessionId);\n        await this.redis.sadd(originalPrincipalRedisKey, sessionId);\n      }\n      await this.expirationStore.rename(session);\n    }\n    session.originalSessionId = sessionId;\n  }\n\n  // override\n  createSession() {\n    const cached = new MapSession();\n    cached.setMaxInactiveInterval(this.defaultMaxInactiveInterval);\n    return new RedisSession(cached, true);\n  }\n\n  async save(session: RedisSession) {\n    await this.saveChangeSessionId(session);\n    await this.saveDelta(session);\n  }\n\n  async findById(sessionId: string): Promise<RedisSession | null> {\n    return this.getSession(sessionId, false);\n  }\n\n  async deleteById(sessionId: string) {\n    const session = await this.getSession(sessionId, true);\n    if (!session) return;\n    // 1. cleanup index\n    const principal = resolveIndexesFor(session);\n    if (principal !== null) {\n      await this.redis.srem(this.getPrincipalKey(principal), sessionId);\n    }\n    // 2. delete in set\n    await this.expirationStore.remove(sessionId);\n    // 3. delete expired key\n    const expiredKey = this.getExpiredKey(sessionId);\n    await this.redis.del(expiredKey);\n\n    session.setMaxInactiveInterval(0);\n    await this.save(session);\n  }\n\n  async findByIndexNameAndIndexValue(indexName: string, indexValue: string) {\n    if (indexName !== PRINCIPAL_NAME_INDEX_NAME) {\n      return new Map<string, RedisSession>();\n    }\n\n    const principalKey = this.getPrincipalKey(indexValue);\n    const sessionIds = await this.redis.smembers(principalKey);\n    if (sessionIds.length === 0) {\n      return new Map<string, RedisSession>();\n    }\n    const sessions = new Map<string, RedisSession>();\n    for (const sessionId of sessionIds) {\n      const session = await this.findById(sessionId);\n      if (session !== null) {\n        sessions.set(sessionId, session);\n      }\n    }\n    return sessions;\n  }\n\n  async findByPrincipalName(principalName: string) {\n    return this.findByIndexNameAndIndexValue(PRINCIPAL_NAME_INDEX_NAME, principalName);\n  }\n\n  async cleanupExpiredSessions(cleanupCount?: number) {\n    await this.expirationStore.cleanupExpiredSessions(cleanupCount);\n  }\n}\n\nconst INCREMENT_SCRIPT = `\nlocal count = redis.call('INCR', KEYS[1])\nif count == 1 then redis.call('EXPIRE', KEYS[1], ARGV[1]) end\nreturn count\n`;\n\nexport class RedisKVRepository implements KVRepository {\n  private readonly redis: Redis;\n\n  constructor(redis: Redis) {\n    this.redis = redis;\n  }\n\n  async setItem(key: string, value: string, expiresIn?: number) {\n    if (expiresIn) {\n      await this.redis.set(key, value, 'EX', expiresIn);\n    } else {\n      await this.redis.set(key, value);\n    }\n  }\n\n  async getItem(key: string): Promise<string | null> {\n    return this.redis.get(key);\n  }\n\n  async removeItem(key: string) {\n    await this.redis.del(key);\n  }\n\n  async increment(key: string, expiresIn: number): Promise<number> {\n    // INCR and the creating EXPIRE run as one script, so the key never exists without a TTL and\n    // an existing key keeps its expiry.\n    const count = await this.redis.eval(INCREMENT_SCRIPT, 1, key, expiresIn);\n    return Number(count);\n  }\n}\n"],"mappings":";;;AAKA,MAAM,oBAAoB;AAC1B,MAAM,yBAAyB;AAC/B,MAAM,4BAA4B;AAClC,MAAM,mBAAmB;AACzB,MAAM,yBAAyB;AAE/B,IAAM,eAAN,MAAsC;CACpC;CAEA;CACA,wBAAe,IAAI,IAAoC;CACvD;CACA;CACA,yBAA+C;CAE/C,YAAY,QAAoB,OAAgB;EAC9C,KAAK,SAAS;EACd,KAAK,QAAQ;EACb,KAAK,oBAAoB,OAAO,MAAM;EACtC,KAAK,wBAAwB,kBAAkB,IAAI;EAEnD,IAAI,OAAO;GACT,KAAK,MAAM,IAAI,mBAAmB,OAAO,gBAAgB,CAAC;GAC1D,KAAK,MAAM,IAAI,wBAAwB,OAAO,oBAAoB,CAAC;GACnE,KAAK,MAAM,IAAI,2BAA2B,OAAO,uBAAuB,CAAC;GACzE,KAAK,OAAO,kBAAkB,CAAC,CAAC,SAAS,SAAS;IAChD,MAAM,QAAQ,KAAK,OAAO,aAAa,IAAI;IAC3C,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,KAAK;GACnE,CAAC;EACH;CACF;CAEA,sBAAsB,MAAc;EAClC,OAAO,mBAAmB;CAC5B;CAGA,oBAAoB,kBAA0B;EAC5C,KAAK,OAAO,oBAAoB,gBAAgB;EAChD,KAAK,MAAM,IAAI,wBAAwB,gBAAgB;CACzD;CAEA,YAAY;EACV,OAAO,KAAK,OAAO,UAAU;CAC/B;CAEA,kBAAkB;EAChB,OAAO,KAAK,OAAO,gBAAgB;CACrC;CAEA,QAAQ;EACN,OAAO,KAAK,OAAO,MAAM;CAC3B;CAEA,kBAAkB;EAChB,OAAO,KAAK,OAAO,gBAAgB;CACrC;CAEA,sBAAsB;EACpB,OAAO,KAAK,OAAO,oBAAoB;CACzC;CAEA,uBAAuB,UAAkB;EACvC,KAAK,OAAO,uBAAuB,QAAQ;EAC3C,KAAK,MAAM,IAAI,2BAA2B,QAAQ;CACpD;CAEA,yBAAyB;EACvB,OAAO,KAAK,OAAO,uBAAuB;CAC5C;CAEA,aAAa,MAAc;EACzB,OAAO,KAAK,OAAO,aAAa,IAAI;CACtC;CAEA,oBAAoB;EAClB,OAAO,KAAK,OAAO,kBAAkB;CACvC;CAEA,aAAa,MAAc,OAAe;EACxC,KAAK,OAAO,aAAa,MAAM,KAAK;EACpC,KAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,KAAK;CACxD;CAEA,gBAAgB,MAAc;EAC5B,KAAK,OAAO,gBAAgB,IAAI;EAChC,KAAK,MAAM,IAAI,KAAK,sBAAsB,IAAI,GAAG,IAAI;CACvD;AACF;AASA,IAAM,uCAAN,MAAkF;CAChF;CACA;CACA;CAEA,YAAY,OAAc,WAAsB;EAC9C,KAAK,QAAQ;EACb,KAAK,YAAY;EACjB,KAAK,iBAAiB,GAAG,KAAK,UAAU;CAC1C;CAEA,cAAc,WAAmB;EAC/B,OAAO,GAAG,KAAK,UAAU,YAAY;CACvC;CAEA,MAAM,KAAK,SAAuB;EAChC,MAAM,qBACJ,QAAQ,oBAAoB,IAAI,QAAQ,uBAAuB,IAAI;EACrE,MAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,oBAAoB,QAAQ,MAAM,CAAC;CAChF;CAEA,MAAM,OAAO,WAAmB;EAC9B,MAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,SAAS;CACtD;CAEA,MAAM,OAAO,SAAuB;EAClC,IAAI,QAAQ,sBAAsB,QAAQ,MAAM,GAAG;EACnD,MAAM,KAAK,OAAO,QAAQ,iBAAiB;EAC3C,MAAM,KAAK,KAAK,OAAO;CACzB;CAEA,MAAM,uBAAuB,eAAe,KAAK;EAC/C,MAAM,MAAM,KAAK;EACjB,MAAM,QAAQ,KAAK,IAAI;EACvB,MAAM,aAAa,MAAM,KAAK,MAAM,iBAAiB,KAAK,OAAO,GAAG,SAAS,GAAG,YAAY;EAC5F,IAAI,WAAW,WAAW,GAAG;EAC7B,KAAK,MAAM,aAAa,YAAY;GAClC,MAAM,aAAa,KAAK,cAAc,SAAS;GAG/C,MAAM,KAAK,MAAM,OAAO,UAAU;EACpC;CACF;AACF;AAKA,IAAa,gCAAb,MAAsF;CACpF;CACA;CACA;CAEA,6BAAqC;CAErC,YAAY,OAAc,YAAuB,kBAAkB;EACjE,KAAK,QAAQ;EACb,KAAK,YAAY;EACjB,KAAK,kBAAkB,IAAI,qCAAqC,OAAO,SAAS;CAClF;CAEA,8BAA8B,UAAkB;EAC9C,KAAK,6BAA6B;CACpC;CAEA,cAAsB,WAAmB;EACvC,OAAO,GAAG,KAAK,UAAU,YAAY;CACvC;CAEA,cAAsB,WAAmB;EACvC,OAAO,GAAG,KAAK,UAAU,oBAAoB;CAC/C;CAEA,sBAA8B,MAAc;EAC1C,OAAO,mBAAmB;CAC5B;CAEA,gBAAwB,eAAuB;EAC7C,OAAO,GAAG,KAAK,UAAU,SAAS,0BAA0B,GAAG;CACjE;CAEA,MAAc,WAAW,IAAY,cAAqD;EACxF,MAAM,MAAM,KAAK,cAAc,EAAE;EACjC,MAAM,UAAU,MAAM,KAAK,MAAM,QAAQ,GAAG;EAC5C,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAAG,OAAO;EAC9C,MAAM,SAAS,IAAI,WAAW,EAAE;EAChC,IAAI,CAAC,QAAQ,cAAc,MAAM,IAAI,MAAM,kCAAkC;EAC7E,IAAI,CAAC,QAAQ,kBAAkB,MAAM,IAAI,MAAM,sCAAsC;EACrF,IAAI,CAAC,QAAQ,qBAAqB,MAAM,IAAI,MAAM,yCAAyC;EAE3F,OAAO,gBAAgB,OAAO,QAAQ,YAAY,CAAC;EACnD,OAAO,oBAAoB,OAAO,QAAQ,gBAAgB,CAAC;EAC3D,OAAO,uBAAuB,OAAO,QAAQ,mBAAmB,CAAC;EAEjE,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAC/C,IAAI,IAAI,WAAW,gBAAgB,GACjC,OAAO,aAAa,IAAI,MAAM,EAAuB,GAAG,KAAK;EAIjE,IAAI,CAAC,gBAAgB,OAAO,UAAU,GAAG,OAAO;EAChD,MAAM,SAAS,IAAI,aAAa,QAAQ,KAAK;EAC7C,OAAO,yBAAyB,OAAO,oBAAoB;EAC3D,OAAO;CACT;CAEA,MAAc,UAAU,SAAuB;EAC7C,IAAI,QAAQ,MAAM,SAAS,GAAG;EAC9B,MAAM,YAAY,QAAQ,MAAM;EAChC,MAAM,wBAAQ,IAAI,IAA6B;EAC/C,MAAM,UAAoB,CAAC;EAC3B,QAAQ,MAAM,SAAS,OAAO,QAAQ;GACpC,IAAI,UAAU,MAAM,MAAM,IAAI,KAAK,KAAK;QACnC,QAAQ,KAAK,GAAG;EACvB,CAAC;EAED,IAAI,MAAM,SAAS,GACjB,MAAM,KAAK,MAAM,KAAK,KAAK,cAAc,SAAS,GAAG,KAAK;EAE5D,IAAI,QAAQ,WAAW,GACrB,MAAM,KAAK,MAAM,KAAK,KAAK,cAAc,SAAS,GAAG,GAAG,OAAO;EAGjE,MAAM,sBAAsB,KAAK,sBAAsB,yBAAyB;EAChF,MAAM,8BAA8B,KAAK,sBAAsB,uBAAuB;EACtF,IAAI,QAAQ,MAAM,IAAI,mBAAmB,KAAK,QAAQ,MAAM,IAAI,2BAA2B,GAAG;GAC5F,IAAI,QAAQ,0BAA0B,MAAM;IAC1C,MAAM,4BAA4B,KAAK,gBAAgB,QAAQ,qBAAqB;IACpF,MAAM,KAAK,MAAM,KAAK,2BAA2B,SAAS;GAC5D;GACA,MAAM,YAAY,kBAAkB,OAAO;GAC3C,QAAQ,wBAAwB;GAChC,IAAI,cAAc,MAAM;IACtB,MAAM,oBAAoB,KAAK,gBAAgB,SAAS;IACxD,MAAM,KAAK,MAAM,KAAK,mBAAmB,SAAS;GACpD;EACF;EAEA,IAAI,QAAQ,OAEV,QAAQ,QAAQ;EAGlB,MAAM,yBAAyB,QAAQ,uBAAuB;EAG9D,MAAM,cAAc,yBAAyB,QAAQ,MAAM;EAC3D,MAAM,aAAa,KAAK,cAAc,WAAW;EAEjD,IAAI,yBAAyB,GAAG;GAC9B,MAAM,KAAK,MAAM,OAAO,YAAY,EAAE;GACtC,MAAM,KAAK,MAAM,QAAQ,UAAU;GACnC,MAAM,KAAK,MAAM,QAAQ,KAAK,cAAc,QAAQ,MAAM,CAAC,CAAC;EAC9D,OAAO,IAAI,2BAA2B,GACpC,MAAM,KAAK,MAAM,IAAI,UAAU;OAC1B;GACL,MAAM,KAAK,MAAM,OAAO,YAAY,EAAE;GACtC,MAAM,KAAK,MAAM,OAAO,YAAY,sBAAsB;EAC5D;EAGA,IAAI,yBAAyB,GAAG;GAC9B,MAAM,0BAA0B,yBAAyB;GACzD,MAAM,KAAK,MAAM,OAAO,KAAK,cAAc,QAAQ,MAAM,CAAC,GAAG,uBAAuB;EACtF;EAEA,MAAM,KAAK,gBAAgB,KAAK,OAAO;EACvC,QAAQ,MAAM,MAAM;CACtB;CAEA,MAAc,oBAAoB,SAAuB;EACvD,MAAM,YAAY,QAAQ,MAAM;EAChC,IAAI,cAAc,QAAQ,mBAAmB;EAC7C,IAAI,CAAC,QAAQ,OAAO;GAClB,MAAM,uBAAuB,KAAK,cAAc,QAAQ,iBAAiB;GACzE,MAAM,eAAe,KAAK,cAAc,SAAS;GACjD,MAAM,qBAAqB,KAAK,cAAc,QAAQ,iBAAiB;GACvE,MAAM,aAAa,KAAK,cAAc,SAAS;GAE/C,MAAM,KAAK,MAAM,OAAO,sBAAsB,YAAY;GAC1D,MAAM,KAAK,MAAM,OAAO,oBAAoB,UAAU;GAEtD,IAAI,QAAQ,0BAA0B,MAAM;IAC1C,MAAM,4BAA4B,KAAK,gBAAgB,QAAQ,qBAAqB;IACpF,MAAM,KAAK,MAAM,KAAK,2BAA2B,QAAQ,iBAAiB;IAC1E,MAAM,KAAK,MAAM,KAAK,2BAA2B,SAAS;GAC5D;GACA,MAAM,KAAK,gBAAgB,OAAO,OAAO;EAC3C;EACA,QAAQ,oBAAoB;CAC9B;CAGA,gBAAgB;EACd,MAAM,SAAS,IAAI,WAAW;EAC9B,OAAO,uBAAuB,KAAK,0BAA0B;EAC7D,OAAO,IAAI,aAAa,QAAQ,IAAI;CACtC;CAEA,MAAM,KAAK,SAAuB;EAChC,MAAM,KAAK,oBAAoB,OAAO;EACtC,MAAM,KAAK,UAAU,OAAO;CAC9B;CAEA,MAAM,SAAS,WAAiD;EAC9D,OAAO,KAAK,WAAW,WAAW,KAAK;CACzC;CAEA,MAAM,WAAW,WAAmB;EAClC,MAAM,UAAU,MAAM,KAAK,WAAW,WAAW,IAAI;EACrD,IAAI,CAAC,SAAS;EAEd,MAAM,YAAY,kBAAkB,OAAO;EAC3C,IAAI,cAAc,MAChB,MAAM,KAAK,MAAM,KAAK,KAAK,gBAAgB,SAAS,GAAG,SAAS;EAGlE,MAAM,KAAK,gBAAgB,OAAO,SAAS;EAE3C,MAAM,aAAa,KAAK,cAAc,SAAS;EAC/C,MAAM,KAAK,MAAM,IAAI,UAAU;EAE/B,QAAQ,uBAAuB,CAAC;EAChC,MAAM,KAAK,KAAK,OAAO;CACzB;CAEA,MAAM,6BAA6B,WAAmB,YAAoB;EACxE,IAAI,cAAA,0FACF,uBAAO,IAAI,IAA0B;EAGvC,MAAM,eAAe,KAAK,gBAAgB,UAAU;EACpD,MAAM,aAAa,MAAM,KAAK,MAAM,SAAS,YAAY;EACzD,IAAI,WAAW,WAAW,GACxB,uBAAO,IAAI,IAA0B;EAEvC,MAAM,2BAAW,IAAI,IAA0B;EAC/C,KAAK,MAAM,aAAa,YAAY;GAClC,MAAM,UAAU,MAAM,KAAK,SAAS,SAAS;GAC7C,IAAI,YAAY,MACd,SAAS,IAAI,WAAW,OAAO;EAEnC;EACA,OAAO;CACT;CAEA,MAAM,oBAAoB,eAAuB;EAC/C,OAAO,KAAK,6BAA6B,2BAA2B,aAAa;CACnF;CAEA,MAAM,uBAAuB,cAAuB;EAClD,MAAM,KAAK,gBAAgB,uBAAuB,YAAY;CAChE;AACF;AAEA,MAAM,mBAAmB;;;;;AAMzB,IAAa,oBAAb,MAAuD;CACrD;CAEA,YAAY,OAAc;EACxB,KAAK,QAAQ;CACf;CAEA,MAAM,QAAQ,KAAa,OAAe,WAAoB;EAC5D,IAAI,WACF,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,SAAS;OAEhD,MAAM,KAAK,MAAM,IAAI,KAAK,KAAK;CAEnC;CAEA,MAAM,QAAQ,KAAqC;EACjD,OAAO,KAAK,MAAM,IAAI,GAAG;CAC3B;CAEA,MAAM,WAAW,KAAa;EAC5B,MAAM,KAAK,MAAM,IAAI,GAAG;CAC1B;CAEA,MAAM,UAAU,KAAa,WAAoC;EAG/D,MAAM,QAAQ,MAAM,KAAK,MAAM,KAAK,kBAAkB,GAAG,KAAK,SAAS;EACvE,OAAO,OAAO,KAAK;CACrB;AACF"}

package/dist/session/types.d.cts

@@ -35,10 +35,21 @@ export interface SessionRepository<S extends Session = Session> {
   findByPrincipalName(principalName: string): Promise<Map<string, S>>;
   cleanupExpiredSessions(cleanupCount?: number): Promise<void>;
 }
+/**
+ * Short-lived values: OAuth2 state/nonce, verification codes and their counters, desktop codes.
+ * `expiresIn` is in seconds; an expired key must read as absent.
+ */
 export interface KVRepository {
   setItem(key: string, value: string, expiresIn?: number): Promise<void>;
   getItem(key: string): Promise<string | null>;
   removeItem(key: string): Promise<void>;
+  /**
+   * Atomically increments the integer counter at `key` and returns the new count. An absent or
+   * expired key starts over at 1 and expires in `expiresIn` seconds; an existing key keeps its
+   * expiry. Must be atomic under concurrent calls: verification attempt limits rely on every
+   * caller seeing a distinct count.
+   */
+  increment(key: string, expiresIn: number): Promise<number>;
 }
 //#endregion
 //# sourceMappingURL=types.d.cts.map

package/dist/session/types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.cts","names":[],"sources":["../../src/session/types.ts"],"mappings":";;iBAEiB,uBAAuB;EACtC;EACA,YAAY;EACZ;EACA;EACA;;iBAGe;EACf;EACA,iBAAiB;;YAGP;iBAGK;EACf;EACA;EAEA,aAAa;EACb;EACA,aAAa,cAAc;EAC3B,gBAAgB;EAEhB;EACA;EACA,oBAAoB;EAEpB;EACA,uBAAuB;EAEvB;;iBAGe,kBAAkB,UAAU,UAAU;EACrD,iBAAiB;EACjB,KAAK,SAAS,IAAI;EAClB,SAAS,oBAAoB,QAAQ;EACrC,WAAW,oBAAoB;EAG/B,6BAA6B,mBAAmB,qBAAqB,QAAQ,YAAY;EACzF,oBAAoB,wBAAwB,QAAQ,YAAY;EAGhE,uBAAuB,wBAAwB;;iBAGhC;EACf,QAAQ,aAAa,eAAe,qBAAqB;EACzD,QAAQ,cAAc;EACtB,WAAW,cAAc"}
+{"version":3,"file":"types.d.cts","names":[],"sources":["../../src/session/types.ts"],"mappings":";;iBAEiB,uBAAuB;EACtC;EACA,YAAY;EACZ;EACA;EACA;;iBAGe;EACf;EACA,iBAAiB;;YAGP;iBAGK;EACf;EACA;EAEA,aAAa;EACb;EACA,aAAa,cAAc;EAC3B,gBAAgB;EAEhB;EACA;EACA,oBAAoB;EAEpB;EACA,uBAAuB;EAEvB;;iBAGe,kBAAkB,UAAU,UAAU;EACrD,iBAAiB;EACjB,KAAK,SAAS,IAAI;EAClB,SAAS,oBAAoB,QAAQ;EACrC,WAAW,oBAAoB;EAG/B,6BAA6B,mBAAmB,qBAAqB,QAAQ,YAAY;EACzF,oBAAoB,wBAAwB,QAAQ,YAAY;EAGhE,uBAAuB,wBAAwB;;;;;;iBAOhC;EACf,QAAQ,aAAa,eAAe,qBAAqB;EACzD,QAAQ,cAAc;EACtB,WAAW,cAAc;;;;;;;EAOzB,UAAU,aAAa,oBAAoB"}

package/dist/session/types.d.mts

@@ -35,10 +35,21 @@ export interface SessionRepository<S extends Session = Session> {
   findByPrincipalName(principalName: string): Promise<Map<string, S>>;
   cleanupExpiredSessions(cleanupCount?: number): Promise<void>;
 }
+/**
+ * Short-lived values: OAuth2 state/nonce, verification codes and their counters, desktop codes.
+ * `expiresIn` is in seconds; an expired key must read as absent.
+ */
 export interface KVRepository {
   setItem(key: string, value: string, expiresIn?: number): Promise<void>;
   getItem(key: string): Promise<string | null>;
   removeItem(key: string): Promise<void>;
+  /**
+   * Atomically increments the integer counter at `key` and returns the new count. An absent or
+   * expired key starts over at 1 and expires in `expiresIn` seconds; an existing key keeps its
+   * expiry. Must be atomic under concurrent calls: verification attempt limits rely on every
+   * caller seeing a distinct count.
+   */
+  increment(key: string, expiresIn: number): Promise<number>;
 }
 //#endregion
 //# sourceMappingURL=types.d.mts.map

package/dist/session/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../src/session/types.ts"],"mappings":";;iBAEiB,uBAAuB;EACtC;EACA,YAAY;EACZ;EACA;EACA;;iBAGe;EACf;EACA,iBAAiB;;YAGP;iBAGK;EACf;EACA;EAEA,aAAa;EACb;EACA,aAAa,cAAc;EAC3B,gBAAgB;EAEhB;EACA;EACA,oBAAoB;EAEpB;EACA,uBAAuB;EAEvB;;iBAGe,kBAAkB,UAAU,UAAU;EACrD,iBAAiB;EACjB,KAAK,SAAS,IAAI;EAClB,SAAS,oBAAoB,QAAQ;EACrC,WAAW,oBAAoB;EAG/B,6BAA6B,mBAAmB,qBAAqB,QAAQ,YAAY;EACzF,oBAAoB,wBAAwB,QAAQ,YAAY;EAGhE,uBAAuB,wBAAwB;;iBAGhC;EACf,QAAQ,aAAa,eAAe,qBAAqB;EACzD,QAAQ,cAAc;EACtB,WAAW,cAAc"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../src/session/types.ts"],"mappings":";;iBAEiB,uBAAuB;EACtC;EACA,YAAY;EACZ;EACA;EACA;;iBAGe;EACf;EACA,iBAAiB;;YAGP;iBAGK;EACf;EACA;EAEA,aAAa;EACb;EACA,aAAa,cAAc;EAC3B,gBAAgB;EAEhB;EACA;EACA,oBAAoB;EAEpB;EACA,uBAAuB;EAEvB;;iBAGe,kBAAkB,UAAU,UAAU;EACrD,iBAAiB;EACjB,KAAK,SAAS,IAAI;EAClB,SAAS,oBAAoB,QAAQ;EACrC,WAAW,oBAAoB;EAG/B,6BAA6B,mBAAmB,qBAAqB,QAAQ,YAAY;EACzF,oBAAoB,wBAAwB,QAAQ,YAAY;EAGhE,uBAAuB,wBAAwB;;;;;;iBAOhC;EACf,QAAQ,aAAa,eAAe,qBAAqB;EACzD,QAAQ,cAAc;EACtB,WAAW,cAAc;;;;;;;EAOzB,UAAU,aAAa,oBAAoB"}

package/dist/utils/valid.cjs

@@ -11,6 +11,17 @@ function invalidArgument(reason) {
 		}]
 	} };
 }
+function resourceExhausted(reason, message) {
+	return { error: {
+		code: 429,
+		status: "RESOURCE_EXHAUSTED",
+		message,
+		details: [{
+			"@type": "type.googleapis.com/google.rpc.ErrorInfo",
+			reason
+		}]
+	} };
+}
 function valid(schema, json) {
 	const result = schema.safeParse(json);
 	if (result.success) return {
@@ -51,6 +62,7 @@ async function verifyTurnstileToken(secret, token) {
 }
 //#endregion
 exports.invalidArgument = invalidArgument;
+exports.resourceExhausted = resourceExhausted;
 exports.valid = valid;
 exports.verifyTurnstileToken = verifyTurnstileToken;
 

package/dist/utils/valid.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"valid.cjs","names":[],"sources":["../../src/utils/valid.ts"],"sourcesContent":["import type { ZodType, output } from 'zod';\nimport type { ZodMiniType, output as outputMini } from 'zod/mini';\n\ntype ErrorBody = {\n  error: {\n    code: number;\n    status: string;\n    message: string;\n    details: unknown[];\n  };\n};\n\nexport function invalidArgument(reason: string): ErrorBody {\n  return {\n    error: {\n      code: 400,\n      status: 'INVALID_ARGUMENT',\n      message: 'Invalid verification code',\n      details: [{ '@type': 'type.googleapis.com/google.rpc.ErrorInfo', reason }],\n    },\n  };\n}\n\ntype Result<S extends ZodType | ZodMiniType> =\n  | { error: null; data: S extends ZodType ? output<S> : outputMini<S> }\n  | { error: ErrorBody; data: null };\n\nexport function valid<S extends ZodType | ZodMiniType>(schema: S, json: unknown): Result<S> {\n  const result = schema.safeParse(json);\n  if (result.success) {\n    return {\n      error: null,\n      data: result.data as S extends ZodType ? output<S> : outputMini<S>,\n    };\n  }\n\n  const fieldViolations = result.error.issues.map(({ code, path, message }) => ({\n    field: path.join('.'),\n    description: message,\n    reason: code.toUpperCase(),\n    localizedMessage: { locale: 'en-US', message },\n  }));\n\n  const error = {\n    error: {\n      code: 400,\n      status: 'INVALID_ARGUMENT',\n      message: 'Invalid request',\n      details: [{ '@type': 'type.googleapis.com/google.rpc.BadRequest', fieldViolations }],\n    },\n  };\n\n  return { error, data: null };\n}\n\nexport async function verifyTurnstileToken(secret: string, token: string) {\n  const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({ secret, response: token }),\n  });\n\n  const data = (await response.json()) as { success: boolean };\n  if (data.success) return { error: null };\n  return { error: invalidArgument('TURNSTILE_VERIFICATION_FAILED') };\n}\n"],"mappings":";;AAYA,SAAgB,gBAAgB,QAA2B;CACzD,OAAO,EACL,OAAO;EACL,MAAM;EACN,QAAQ;EACR,SAAS;EACT,SAAS,CAAC;GAAE,SAAS;GAA4C;EAAO,CAAC;CAC3E,EACF;AACF;AAMA,SAAgB,MAAuC,QAAW,MAA0B;CAC1F,MAAM,SAAS,OAAO,UAAU,IAAI;CACpC,IAAI,OAAO,SACT,OAAO;EACL,OAAO;EACP,MAAM,OAAO;CACf;CAmBF,OAAO;EAAE,OAAA,EARP,OAAO;GACL,MAAM;GACN,QAAQ;GACR,SAAS;GACT,SAAS,CAAC;IAAE,SAAS;IAA6C,iBAZ9C,OAAO,MAAM,OAAO,KAAK,EAAE,MAAM,MAAM,eAAe;KAC5E,OAAO,KAAK,KAAK,GAAG;KACpB,aAAa;KACb,QAAQ,KAAK,YAAY;KACzB,kBAAkB;MAAE,QAAQ;MAAS;KAAQ;IAC/C,EAOoF;GAAE,CAAC;EACrF,EAGW;EAAG,MAAM;CAAK;AAC7B;AAEA,eAAsB,qBAAqB,QAAgB,OAAe;CAQxE,KAAI,OADgB,MANG,MAAM,6DAA6D;EACxF,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB;GAAE;GAAQ,UAAU;EAAM,CAAC;CACvD,CAAC,EAAA,CAE4B,KAAK,EAAA,CACzB,SAAS,OAAO,EAAE,OAAO,KAAK;CACvC,OAAO,EAAE,OAAO,gBAAgB,+BAA+B,EAAE;AACnE"}
+{"version":3,"file":"valid.cjs","names":[],"sources":["../../src/utils/valid.ts"],"sourcesContent":["import type { ZodType, output } from 'zod';\nimport type { ZodMiniType, output as outputMini } from 'zod/mini';\n\ntype ErrorBody = {\n  error: {\n    code: number;\n    status: string;\n    message: string;\n    details: unknown[];\n  };\n};\n\nexport function invalidArgument(reason: string): ErrorBody {\n  return {\n    error: {\n      code: 400,\n      status: 'INVALID_ARGUMENT',\n      message: 'Invalid verification code',\n      details: [{ '@type': 'type.googleapis.com/google.rpc.ErrorInfo', reason }],\n    },\n  };\n}\n\nexport function resourceExhausted(reason: string, message: string): ErrorBody {\n  return {\n    error: {\n      code: 429,\n      status: 'RESOURCE_EXHAUSTED',\n      message,\n      details: [{ '@type': 'type.googleapis.com/google.rpc.ErrorInfo', reason }],\n    },\n  };\n}\n\ntype Result<S extends ZodType | ZodMiniType> =\n  | { error: null; data: S extends ZodType ? output<S> : outputMini<S> }\n  | { error: ErrorBody; data: null };\n\nexport function valid<S extends ZodType | ZodMiniType>(schema: S, json: unknown): Result<S> {\n  const result = schema.safeParse(json);\n  if (result.success) {\n    return {\n      error: null,\n      data: result.data as S extends ZodType ? output<S> : outputMini<S>,\n    };\n  }\n\n  const fieldViolations = result.error.issues.map(({ code, path, message }) => ({\n    field: path.join('.'),\n    description: message,\n    reason: code.toUpperCase(),\n    localizedMessage: { locale: 'en-US', message },\n  }));\n\n  const error = {\n    error: {\n      code: 400,\n      status: 'INVALID_ARGUMENT',\n      message: 'Invalid request',\n      details: [{ '@type': 'type.googleapis.com/google.rpc.BadRequest', fieldViolations }],\n    },\n  };\n\n  return { error, data: null };\n}\n\nexport async function verifyTurnstileToken(secret: string, token: string) {\n  const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({ secret, response: token }),\n  });\n\n  const data = (await response.json()) as { success: boolean };\n  if (data.success) return { error: null };\n  return { error: invalidArgument('TURNSTILE_VERIFICATION_FAILED') };\n}\n"],"mappings":";;AAYA,SAAgB,gBAAgB,QAA2B;CACzD,OAAO,EACL,OAAO;EACL,MAAM;EACN,QAAQ;EACR,SAAS;EACT,SAAS,CAAC;GAAE,SAAS;GAA4C;EAAO,CAAC;CAC3E,EACF;AACF;AAEA,SAAgB,kBAAkB,QAAgB,SAA4B;CAC5E,OAAO,EACL,OAAO;EACL,MAAM;EACN,QAAQ;EACR;EACA,SAAS,CAAC;GAAE,SAAS;GAA4C;EAAO,CAAC;CAC3E,EACF;AACF;AAMA,SAAgB,MAAuC,QAAW,MAA0B;CAC1F,MAAM,SAAS,OAAO,UAAU,IAAI;CACpC,IAAI,OAAO,SACT,OAAO;EACL,OAAO;EACP,MAAM,OAAO;CACf;CAmBF,OAAO;EAAE,OAAA,EARP,OAAO;GACL,MAAM;GACN,QAAQ;GACR,SAAS;GACT,SAAS,CAAC;IAAE,SAAS;IAA6C,iBAZ9C,OAAO,MAAM,OAAO,KAAK,EAAE,MAAM,MAAM,eAAe;KAC5E,OAAO,KAAK,KAAK,GAAG;KACpB,aAAa;KACb,QAAQ,KAAK,YAAY;KACzB,kBAAkB;MAAE,QAAQ;MAAS;KAAQ;IAC/C,EAOoF;GAAE,CAAC;EACrF,EAGW;EAAG,MAAM;CAAK;AAC7B;AAEA,eAAsB,qBAAqB,QAAgB,OAAe;CAQxE,KAAI,OADgB,MANG,MAAM,6DAA6D;EACxF,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB;GAAE;GAAQ,UAAU;EAAM,CAAC;CACvD,CAAC,EAAA,CAE4B,KAAK,EAAA,CACzB,SAAS,OAAO,EAAE,OAAO,KAAK;CACvC,OAAO,EAAE,OAAO,gBAAgB,+BAA+B,EAAE;AACnE"}

package/dist/utils/valid.d.cts

@@ -10,6 +10,7 @@ type ErrorBody = {
   };
 };
 export declare function invalidArgument(reason: string): ErrorBody;
+export declare function resourceExhausted(reason: string, message: string): ErrorBody;
 type Result<S extends ZodType | ZodMiniType> = {
   error: null;
   data: S extends ZodType ? output<S> : output$1<S>;

package/dist/utils/valid.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"valid.d.cts","names":["outputMini"],"sources":["../../src/utils/valid.ts"],"mappings":";;;KAGK;EACH;IACE;IACA;IACA;IACA;;;wBAIY,gBAAgB,iBAAiB;KAW5C,OAAO,UAAU,UAAU;EAC1B;EAAa,MAAM,UAAU,UAAU,OAAO,KAAKA,SAAW;;EAC9D,OAAO;EAAW;;wBAER,MAAM,UAAU,UAAU,aAAa,QAAQ,GAAG,gBAAgB,OAAO;wBA4BnE,qBAAqB,gBAAgB,gBAAa"}
+{"version":3,"file":"valid.d.cts","names":["outputMini"],"sources":["../../src/utils/valid.ts"],"mappings":";;;KAGK;EACH;IACE;IACA;IACA;IACA;;;wBAIY,gBAAgB,iBAAiB;wBAWjC,kBAAkB,gBAAgB,kBAAkB;KAW/D,OAAO,UAAU,UAAU;EAC1B;EAAa,MAAM,UAAU,UAAU,OAAO,KAAKA,SAAW;;EAC9D,OAAO;EAAW;;wBAER,MAAM,UAAU,UAAU,aAAa,QAAQ,GAAG,gBAAgB,OAAO;wBA4BnE,qBAAqB,gBAAgB,gBAAa"}

package/dist/utils/valid.d.mts

@@ -10,6 +10,7 @@ type ErrorBody = {
   };
 };
 export declare function invalidArgument(reason: string): ErrorBody;
+export declare function resourceExhausted(reason: string, message: string): ErrorBody;
 type Result<S extends ZodType | ZodMiniType> = {
   error: null;
   data: S extends ZodType ? output$1<S> : output<S>;

package/dist/utils/valid.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"valid.d.mts","names":["output","outputMini"],"sources":["../../src/utils/valid.ts"],"mappings":";;;KAGK;EACH;IACE;IACA;IACA;IACA;;;wBAIY,gBAAgB,iBAAiB;KAW5C,OAAO,UAAU,UAAU;EAC1B;EAAa,MAAM,UAAU,UAAUA,SAAO,KAAKC,OAAW;;EAC9D,OAAO;EAAW;;wBAER,MAAM,UAAU,UAAU,aAAa,QAAQ,GAAG,gBAAgB,OAAO;wBA4BnE,qBAAqB,gBAAgB,gBAAa"}
+{"version":3,"file":"valid.d.mts","names":["output","outputMini"],"sources":["../../src/utils/valid.ts"],"mappings":";;;KAGK;EACH;IACE;IACA;IACA;IACA;;;wBAIY,gBAAgB,iBAAiB;wBAWjC,kBAAkB,gBAAgB,kBAAkB;KAW/D,OAAO,UAAU,UAAU;EAC1B;EAAa,MAAM,UAAU,UAAUA,SAAO,KAAKC,OAAW;;EAC9D,OAAO;EAAW;;wBAER,MAAM,UAAU,UAAU,aAAa,QAAQ,GAAG,gBAAgB,OAAO;wBA4BnE,qBAAqB,gBAAgB,gBAAa"}

package/dist/utils/valid.mjs

@@ -10,6 +10,17 @@ function invalidArgument(reason) {
 		}]
 	} };
 }
+function resourceExhausted(reason, message) {
+	return { error: {
+		code: 429,
+		status: "RESOURCE_EXHAUSTED",
+		message,
+		details: [{
+			"@type": "type.googleapis.com/google.rpc.ErrorInfo",
+			reason
+		}]
+	} };
+}
 function valid(schema, json) {
 	const result = schema.safeParse(json);
 	if (result.success) return {
@@ -49,6 +60,6 @@ async function verifyTurnstileToken(secret, token) {
 	return { error: invalidArgument("TURNSTILE_VERIFICATION_FAILED") };
 }
 //#endregion
-export { invalidArgument, valid, verifyTurnstileToken };
+export { invalidArgument, resourceExhausted, valid, verifyTurnstileToken };
 
 //# sourceMappingURL=valid.mjs.map

package/dist/utils/valid.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"valid.mjs","names":[],"sources":["../../src/utils/valid.ts"],"sourcesContent":["import type { ZodType, output } from 'zod';\nimport type { ZodMiniType, output as outputMini } from 'zod/mini';\n\ntype ErrorBody = {\n  error: {\n    code: number;\n    status: string;\n    message: string;\n    details: unknown[];\n  };\n};\n\nexport function invalidArgument(reason: string): ErrorBody {\n  return {\n    error: {\n      code: 400,\n      status: 'INVALID_ARGUMENT',\n      message: 'Invalid verification code',\n      details: [{ '@type': 'type.googleapis.com/google.rpc.ErrorInfo', reason }],\n    },\n  };\n}\n\ntype Result<S extends ZodType | ZodMiniType> =\n  | { error: null; data: S extends ZodType ? output<S> : outputMini<S> }\n  | { error: ErrorBody; data: null };\n\nexport function valid<S extends ZodType | ZodMiniType>(schema: S, json: unknown): Result<S> {\n  const result = schema.safeParse(json);\n  if (result.success) {\n    return {\n      error: null,\n      data: result.data as S extends ZodType ? output<S> : outputMini<S>,\n    };\n  }\n\n  const fieldViolations = result.error.issues.map(({ code, path, message }) => ({\n    field: path.join('.'),\n    description: message,\n    reason: code.toUpperCase(),\n    localizedMessage: { locale: 'en-US', message },\n  }));\n\n  const error = {\n    error: {\n      code: 400,\n      status: 'INVALID_ARGUMENT',\n      message: 'Invalid request',\n      details: [{ '@type': 'type.googleapis.com/google.rpc.BadRequest', fieldViolations }],\n    },\n  };\n\n  return { error, data: null };\n}\n\nexport async function verifyTurnstileToken(secret: string, token: string) {\n  const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({ secret, response: token }),\n  });\n\n  const data = (await response.json()) as { success: boolean };\n  if (data.success) return { error: null };\n  return { error: invalidArgument('TURNSTILE_VERIFICATION_FAILED') };\n}\n"],"mappings":";AAYA,SAAgB,gBAAgB,QAA2B;CACzD,OAAO,EACL,OAAO;EACL,MAAM;EACN,QAAQ;EACR,SAAS;EACT,SAAS,CAAC;GAAE,SAAS;GAA4C;EAAO,CAAC;CAC3E,EACF;AACF;AAMA,SAAgB,MAAuC,QAAW,MAA0B;CAC1F,MAAM,SAAS,OAAO,UAAU,IAAI;CACpC,IAAI,OAAO,SACT,OAAO;EACL,OAAO;EACP,MAAM,OAAO;CACf;CAmBF,OAAO;EAAE,OAAA,EARP,OAAO;GACL,MAAM;GACN,QAAQ;GACR,SAAS;GACT,SAAS,CAAC;IAAE,SAAS;IAA6C,iBAZ9C,OAAO,MAAM,OAAO,KAAK,EAAE,MAAM,MAAM,eAAe;KAC5E,OAAO,KAAK,KAAK,GAAG;KACpB,aAAa;KACb,QAAQ,KAAK,YAAY;KACzB,kBAAkB;MAAE,QAAQ;MAAS;KAAQ;IAC/C,EAOoF;GAAE,CAAC;EACrF,EAGW;EAAG,MAAM;CAAK;AAC7B;AAEA,eAAsB,qBAAqB,QAAgB,OAAe;CAQxE,KAAI,OADgB,MANG,MAAM,6DAA6D;EACxF,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB;GAAE;GAAQ,UAAU;EAAM,CAAC;CACvD,CAAC,EAAA,CAE4B,KAAK,EAAA,CACzB,SAAS,OAAO,EAAE,OAAO,KAAK;CACvC,OAAO,EAAE,OAAO,gBAAgB,+BAA+B,EAAE;AACnE"}
+{"version":3,"file":"valid.mjs","names":[],"sources":["../../src/utils/valid.ts"],"sourcesContent":["import type { ZodType, output } from 'zod';\nimport type { ZodMiniType, output as outputMini } from 'zod/mini';\n\ntype ErrorBody = {\n  error: {\n    code: number;\n    status: string;\n    message: string;\n    details: unknown[];\n  };\n};\n\nexport function invalidArgument(reason: string): ErrorBody {\n  return {\n    error: {\n      code: 400,\n      status: 'INVALID_ARGUMENT',\n      message: 'Invalid verification code',\n      details: [{ '@type': 'type.googleapis.com/google.rpc.ErrorInfo', reason }],\n    },\n  };\n}\n\nexport function resourceExhausted(reason: string, message: string): ErrorBody {\n  return {\n    error: {\n      code: 429,\n      status: 'RESOURCE_EXHAUSTED',\n      message,\n      details: [{ '@type': 'type.googleapis.com/google.rpc.ErrorInfo', reason }],\n    },\n  };\n}\n\ntype Result<S extends ZodType | ZodMiniType> =\n  | { error: null; data: S extends ZodType ? output<S> : outputMini<S> }\n  | { error: ErrorBody; data: null };\n\nexport function valid<S extends ZodType | ZodMiniType>(schema: S, json: unknown): Result<S> {\n  const result = schema.safeParse(json);\n  if (result.success) {\n    return {\n      error: null,\n      data: result.data as S extends ZodType ? output<S> : outputMini<S>,\n    };\n  }\n\n  const fieldViolations = result.error.issues.map(({ code, path, message }) => ({\n    field: path.join('.'),\n    description: message,\n    reason: code.toUpperCase(),\n    localizedMessage: { locale: 'en-US', message },\n  }));\n\n  const error = {\n    error: {\n      code: 400,\n      status: 'INVALID_ARGUMENT',\n      message: 'Invalid request',\n      details: [{ '@type': 'type.googleapis.com/google.rpc.BadRequest', fieldViolations }],\n    },\n  };\n\n  return { error, data: null };\n}\n\nexport async function verifyTurnstileToken(secret: string, token: string) {\n  const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({ secret, response: token }),\n  });\n\n  const data = (await response.json()) as { success: boolean };\n  if (data.success) return { error: null };\n  return { error: invalidArgument('TURNSTILE_VERIFICATION_FAILED') };\n}\n"],"mappings":";AAYA,SAAgB,gBAAgB,QAA2B;CACzD,OAAO,EACL,OAAO;EACL,MAAM;EACN,QAAQ;EACR,SAAS;EACT,SAAS,CAAC;GAAE,SAAS;GAA4C;EAAO,CAAC;CAC3E,EACF;AACF;AAEA,SAAgB,kBAAkB,QAAgB,SAA4B;CAC5E,OAAO,EACL,OAAO;EACL,MAAM;EACN,QAAQ;EACR;EACA,SAAS,CAAC;GAAE,SAAS;GAA4C;EAAO,CAAC;CAC3E,EACF;AACF;AAMA,SAAgB,MAAuC,QAAW,MAA0B;CAC1F,MAAM,SAAS,OAAO,UAAU,IAAI;CACpC,IAAI,OAAO,SACT,OAAO;EACL,OAAO;EACP,MAAM,OAAO;CACf;CAmBF,OAAO;EAAE,OAAA,EARP,OAAO;GACL,MAAM;GACN,QAAQ;GACR,SAAS;GACT,SAAS,CAAC;IAAE,SAAS;IAA6C,iBAZ9C,OAAO,MAAM,OAAO,KAAK,EAAE,MAAM,MAAM,eAAe;KAC5E,OAAO,KAAK,KAAK,GAAG;KACpB,aAAa;KACb,QAAQ,KAAK,YAAY;KACzB,kBAAkB;MAAE,QAAQ;MAAS;KAAQ;IAC/C,EAOoF;GAAE,CAAC;EACrF,EAGW;EAAG,MAAM;CAAK;AAC7B;AAEA,eAAsB,qBAAqB,QAAgB,OAAe;CAQxE,KAAI,OADgB,MANG,MAAM,6DAA6D;EACxF,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB;GAAE;GAAQ,UAAU;EAAM,CAAC;CACvD,CAAC,EAAA,CAE4B,KAAK,EAAA,CACzB,SAAS,OAAO,EAAE,OAAO,KAAK;CACvC,OAAO,EAAE,OAAO,gBAAgB,+BAA+B,EAAE;AACnE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/security",
-  "version": "5.0.1",
+  "version": "6.0.0",
   "private": false,
   "repository": {
     "type": "git",