@thecodeorigin/auth 0.0.10 → 0.0.12

package/dist/runtime/app/composables/useAuth.d.ts

@@ -35,6 +35,7 @@ export declare function useAuth(): {
             name: string | null;
             picture: string | null;
         } | null;
+        expiresAt?: number | undefined;
     } | null, {
         user: {
             sub: string;
@@ -69,6 +70,7 @@ export declare function useAuth(): {
             name: string | null;
             picture: string | null;
         } | null;
+        expiresAt?: number | undefined;
     } | null>;
     user: import("vue").ComputedRef<{
         sub: string;
@@ -118,5 +120,8 @@ export declare function useAuth(): {
         prompt?: SignInPrompt;
     }) => string | false | void | import("vue-router").RouteLocationAsRelativeGeneric | import("vue-router").RouteLocationAsPathGeneric | Promise<false | void | import("vue-router").NavigationFailure>;
     signOut: () => Promise<void>;
+    logout: () => Promise<string | false | void | import("vue-router").RouteLocationAsRelativeGeneric | import("vue-router").RouteLocationAsPathGeneric | import("vue-router").NavigationFailure>;
+    switchAccount: (redirect?: string) => string | false | void | import("vue-router").RouteLocationAsRelativeGeneric | import("vue-router").RouteLocationAsPathGeneric | Promise<false | void | import("vue-router").NavigationFailure>;
     refresh: () => Promise<void>;
+    recoverSession: () => Promise<boolean>;
 };

package/dist/runtime/app/composables/useAuth.js

@@ -1,15 +1,40 @@
 import { computed } from "vue";
-import { navigateTo, useRuntimeConfig, useState } from "#app";
+import { clearNuxtData, navigateTo, useNuxtApp, useRequestFetch, useRuntimeConfig, useState } from "#app";
+import { safeReturnPath } from "../utils/return-path.js";
+import { recoverLocalSession } from "../utils/session-recovery.js";
+const pendingRecovery = /* @__PURE__ */ new WeakMap();
 export function useAuth() {
   const session = useState("tco-auth-session", () => null);
-  const routes = useRuntimeConfig().public.auth?.routes ?? {};
+  const config = useRuntimeConfig().public.auth;
+  const routes = { login: "/auth/login", signIn: "/auth/sign-in", home: "/", ...config?.routes };
+  const requestFetch = useRequestFetch();
+  const nuxtApp = useNuxtApp();
+  function broadcastSession() {
+    if (!import.meta.client)
+      return;
+    try {
+      localStorage.setItem(`${config.logoutIntentCookieName}:changed`, crypto.randomUUID());
+    } catch {
+    }
+  }
   const user = computed(() => session.value?.user ?? null);
   const loggedIn = computed(() => !!session.value);
   const abilities = computed(() => session.value?.abilities ?? []);
   const impersonator = computed(() => session.value?.impersonator ?? null);
   const isImpersonating = computed(() => !!session.value?.impersonator);
   async function refresh() {
-    session.value = await $fetch("/api/_auth/session");
+    const previous = session.value;
+    const checked = await requestFetch("/api/_auth/session");
+    if (session.value === previous)
+      session.value = checked;
+  }
+  async function recoverSession() {
+    const pending = pendingRecovery.get(nuxtApp);
+    if (pending)
+      return pending;
+    const recovery = recoverLocalSession(session, () => requestFetch("/api/_auth/session")).finally(() => pendingRecovery.delete(nuxtApp));
+    pendingRecovery.set(nuxtApp, recovery);
+    return recovery;
   }
   function getOrganizations() {
     return session.value?.organizations ?? [];
@@ -19,6 +44,8 @@ export function useAuth() {
       method: "POST",
       body: { organizationId: orgId }
     });
+    clearNuxtData();
+    broadcastSession();
   }
   function getOrganizationUsers(organizationId, query) {
     return $fetch(
@@ -34,24 +61,34 @@ export function useAuth() {
       method: "POST",
       body: { userId }
     });
+    clearNuxtData();
+    broadcastSession();
   }
   async function stopImpersonating() {
     session.value = await $fetch("/api/_auth/stop-impersonating", { method: "POST" });
+    clearNuxtData();
+    broadcastSession();
   }
   function signIn(redirect, options) {
     const params = new URLSearchParams();
-    if (redirect)
-      params.set("redirect", redirect);
-    if (options?.prompt)
-      params.set("prompt", options.prompt);
+    params.set("redirect", safeReturnPath(redirect, routes.home));
+    params.set("prompt", options?.prompt ?? "select_account");
     const qs = params.toString();
     return navigateTo(qs ? `${routes.signIn}?${qs}` : routes.signIn, { external: true });
   }
   async function signOut() {
     const signOutRoute = "/api/_auth/sign-out";
-    await $fetch(signOutRoute, { method: "POST" }).catch(() => {
-    });
+    await $fetch(signOutRoute, { method: "POST" });
     session.value = null;
+    clearNuxtData();
+    broadcastSession();
+  }
+  async function logout() {
+    await signOut();
+    return navigateTo(`${routes.login}?loggedout=1`, { external: true });
+  }
+  function switchAccount(redirect) {
+    return signIn(redirect, { prompt: "select_account" });
   }
   return {
     session,
@@ -68,6 +105,9 @@ export function useAuth() {
     stopImpersonating,
     signIn,
     signOut,
-    refresh
+    logout,
+    switchAccount,
+    refresh,
+    recoverSession
   };
 }

package/dist/runtime/app/composables/useAuthLogin.d.ts

@@ -0,0 +1,11 @@
+/** Shared behavior; each application keeps its own presentation and optional demo UI. */
+export declare function useAuthLogin(): {
+    error: import("vue").ComputedRef<string | null>;
+    loggedOut: import("vue").ComputedRef<boolean>;
+    loading: import("vue").Ref<boolean, boolean>;
+    redirectTo: import("vue").ComputedRef<string>;
+    restoreAvailable: import("vue").ComputedRef<boolean>;
+    handleRestoreSession: () => Promise<void>;
+    handleSignIn: () => Promise<void>;
+    handleUseAnotherAccount: () => Promise<void>;
+};

package/dist/runtime/app/composables/useAuthLogin.js

@@ -0,0 +1,73 @@
+import { computed, ref } from "vue";
+import { navigateTo, useAsyncData, useCookie, useRequestFetch, useRoute, useRuntimeConfig } from "#app";
+import { safeReturnPath } from "../utils/return-path.js";
+import { useAuth } from "./useAuth.js";
+const ERROR_MESSAGES = {
+  access_denied: "Sign-in was canceled or this account cannot access this application.",
+  invalid_state: "This sign-in attempt expired or was replaced. Please try again.",
+  invalid_id_token: "Your identity could not be verified. Please sign in again.",
+  id_token_invalid: "Your identity could not be verified. Please sign in again.",
+  id_token_missing: "Your identity could not be verified. Please sign in again.",
+  token_exchange_failed: "We could not complete sign-in. Please try again.",
+  userinfo_invalid: "Your account information could not be verified. Please try again.",
+  email_unverified: "Verify your email address in THECODEORIGIN ID, then try again."
+};
+export function useAuthLogin() {
+  const route = useRoute();
+  const { signIn, switchAccount, stopImpersonating } = useAuth();
+  const config = useRuntimeConfig().public.auth;
+  const logoutIntent = useCookie(config.logoutIntentCookieName);
+  const loading = ref(false);
+  const localError = ref(null);
+  const requestFetch = useRequestFetch();
+  const { data: restore } = useAsyncData("tco-auth-session-restore", async () => {
+    try {
+      return await requestFetch("/api/_auth/session-restore");
+    } catch {
+      return { available: false };
+    }
+  }, { default: () => ({ available: false }) });
+  const restoreAvailable = computed(() => restore.value.available);
+  const error = computed(() => localError.value ?? (typeof route.query.error === "string" ? ERROR_MESSAGES[route.query.error] ?? "Sign-in could not be completed. Please try again." : null));
+  const loggedOut = computed(() => route.query.loggedout != null || logoutIntent.value === "1");
+  const redirectTo = computed(() => {
+    const target = safeReturnPath(route.query.redirect, config.routes.home);
+    const pathname = target.split(/[?#]/u)[0];
+    return [config.routes.login, config.routes.signIn, config.routes.callback, config.routes.signOut].includes(pathname) ? config.routes.home : target;
+  });
+  async function start(anotherAccount) {
+    if (loading.value)
+      return;
+    loading.value = true;
+    localError.value = null;
+    try {
+      await (anotherAccount ? switchAccount(redirectTo.value) : signIn(redirectTo.value));
+    } catch {
+      localError.value = "Unable to open sign-in. Please try again.";
+      loading.value = false;
+    }
+  }
+  async function handleRestoreSession() {
+    if (loading.value)
+      return;
+    loading.value = true;
+    localError.value = null;
+    try {
+      await stopImpersonating();
+      await navigateTo(redirectTo.value, { external: true });
+    } catch {
+      localError.value = "Unable to restore your session. Please sign in again.";
+      loading.value = false;
+    }
+  }
+  return {
+    error,
+    loggedOut,
+    loading,
+    redirectTo,
+    restoreAvailable,
+    handleRestoreSession,
+    handleSignIn: () => start(false),
+    handleUseAnotherAccount: () => start(true)
+  };
+}

package/dist/runtime/app/middleware/auth.global.js

@@ -6,6 +6,8 @@ export default defineNuxtRouteMiddleware((to) => {
   const routes = authConfig?.routes;
   const logoutIntentCookieName = authConfig?.logoutIntentCookieName ?? "tco_auth_logout";
   const logoutIntent = useCookie(logoutIntentCookieName);
+  if (session.value?.expiresAt && session.value.expiresAt <= Date.now())
+    session.value = null;
   const authed = !!session.value;
   const isPublic = to.meta.public === true || to.meta.unauthenticatedOnly === true;
   if (authed && to.meta.unauthenticatedOnly)

package/dist/runtime/app/plugins/session-sync.client.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/app").Plugin<Record<string, unknown>> & import("nuxt/app").ObjectPlugin<Record<string, unknown>>;
+export default _default;

package/dist/runtime/app/plugins/session-sync.client.js

@@ -0,0 +1,47 @@
+import { watch } from "vue";
+import { defineNuxtPlugin, useRuntimeConfig, useState } from "#app";
+function identity(session) {
+  return JSON.stringify([session?.user.sub, session?.activeOrg, session?.impersonator?.sub, session?.expiresAt]);
+}
+export default defineNuxtPlugin((nuxtApp) => {
+  const session = useState("tco-auth-session", () => null);
+  const config = useRuntimeConfig().public.auth;
+  const key = `${config.logoutIntentCookieName}:changed`;
+  let checking = false;
+  let expiryTimer;
+  watch(() => session.value?.expiresAt, (expiresAt) => {
+    clearTimeout(expiryTimer);
+    if (expiresAt)
+      expiryTimer = setTimeout(() => window.location.reload(), Math.max(0, expiresAt - Date.now()));
+  }, { immediate: true });
+  async function revalidate() {
+    if (checking || document.visibilityState === "hidden")
+      return;
+    checking = true;
+    const previous = session.value;
+    try {
+      const checked = await $fetch("/api/_auth/session");
+      if (session.value === previous && identity(checked) !== identity(previous))
+        window.location.reload();
+    } catch {
+    } finally {
+      checking = false;
+    }
+  }
+  window.addEventListener("focus", revalidate);
+  document.addEventListener("visibilitychange", revalidate);
+  window.addEventListener("storage", (event) => {
+    if (event.key === key)
+      void revalidate();
+  });
+  nuxtApp.hook("app:mounted", () => {
+    try {
+      const current = identity(session.value);
+      if (localStorage.getItem(`${key}:identity`) !== current) {
+        localStorage.setItem(`${key}:identity`, current);
+        localStorage.setItem(key, crypto.randomUUID());
+      }
+    } catch {
+    }
+  });
+});

package/dist/runtime/app/utils/return-path.d.ts

@@ -0,0 +1 @@
+export declare function safeReturnPath(target: unknown, fallback?: string): string;

package/dist/runtime/app/utils/return-path.js

@@ -0,0 +1,18 @@
+function containsUnsafeCharacters(value) {
+  return [...value].some((character) => character === "\\" || character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
+}
+export function safeReturnPath(target, fallback = "/") {
+  if (typeof target !== "string" || !target.startsWith("/") || target.startsWith("//") || containsUnsafeCharacters(target))
+    return fallback;
+  try {
+    const decoded = decodeURIComponent(target);
+    if (decoded.startsWith("//") || containsUnsafeCharacters(decoded))
+      return fallback;
+    const url = new URL(target, "https://application.invalid");
+    if (url.origin !== "https://application.invalid")
+      return fallback;
+    return `${url.pathname}${url.search}${url.hash}`;
+  } catch {
+    return fallback;
+  }
+}

package/dist/runtime/app/utils/session-recovery.d.ts

@@ -0,0 +1,5 @@
+import type { PublicSession } from '../../../contract/index.js';
+/** A failed request cannot prove that authentication has ended. */
+export declare function recoverLocalSession(state: {
+    value: PublicSession | null;
+}, fetchSession: () => Promise<PublicSession | null>, wait?: (ms: number) => Promise<void>): Promise<boolean>;

package/dist/runtime/app/utils/session-recovery.js

@@ -0,0 +1,23 @@
+export async function recoverLocalSession(state, fetchSession, wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+  const previous = state.value;
+  for (const delay of [0, 250, 750]) {
+    if (delay)
+      await wait(delay);
+    if (state.value !== previous)
+      return state.value !== null;
+    let checked;
+    try {
+      checked = await fetchSession();
+    } catch {
+      return true;
+    }
+    if (state.value !== previous)
+      return state.value !== null;
+    if (checked) {
+      state.value = checked;
+      return true;
+    }
+  }
+  state.value = null;
+  return false;
+}

package/dist/runtime/server/api/_auth/impersonate.post.d.ts

@@ -32,5 +32,6 @@ declare const _default: import("h3").EventHandler<import("h3").EventHandlerReque
         name: string | null;
         picture: string | null;
     } | null;
+    expiresAt?: number | undefined;
 }>>;
 export default _default;

package/dist/runtime/server/api/_auth/impersonate.post.js

@@ -1,38 +1,58 @@
 import { createError, defineEventHandler, readValidatedBody } from "h3";
 import { z } from "zod";
+import { UserinfoClaimsSchema } from "../../../../contract";
 import { idpFetch } from "../../utils/idp.js";
-import { newSessionId, readSessionRecord, toPublicSession, writeSessionRecord } from "../../utils/session.js";
-const bodySchema = z.object({ userId: z.string() });
+import { requireSameOrigin } from "../../utils/oidc.js";
+import { deleteSessionBackup, issueSession, newSessionId, readSessionRecord, setSessionRestoreCookie, toPublicSession, writeSessionRecord } from "../../utils/session.js";
+const bodySchema = z.object({ userId: z.string().min(1) });
+const responseSchema = z.object({
+  accessToken: z.string().min(1),
+  expiresAt: z.number().finite(),
+  user: z.object({ sub: z.string().min(1), email: z.email(), name: z.string().nullable().optional(), picture: z.string().nullable().optional() }),
+  claims: UserinfoClaimsSchema
+});
 export default defineEventHandler(async (event) => {
-  const s = await readSessionRecord(event);
-  if (!s)
+  requireSameOrigin(event);
+  const session = await readSessionRecord(event);
+  if (!session)
     throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
-  if (s.rec.isImpersonation)
+  if (session.rec.isImpersonation)
     throw createError({ statusCode: 400, statusMessage: "Already impersonating" });
+  if (session.rec.systemRole !== "admin")
+    throw createError({ statusCode: 403, statusMessage: "Forbidden" });
   const { userId } = await readValidatedBody(event, bodySchema.parse);
-  const res = await idpFetch(event, s.id, s.rec, "/api/auth/rp/impersonate", {
+  const res = responseSchema.parse(await idpFetch(event, session.id, session.rec, "/api/auth/rp/impersonate", {
     method: "POST",
     body: { userId }
-  });
+  }));
+  if (res.user.sub !== userId)
+    throw createError({ statusCode: 502, statusMessage: "Identity service returned a different user" });
   const backupId = newSessionId();
-  await writeSessionRecord(backupId, { ...s.rec, isImpersonation: false });
-  s.rec = {
-    sub: res.user.sub,
-    user: { sub: res.user.sub, email: res.user.email, name: res.user.name ?? null, picture: res.user.picture ?? null },
-    abilities: res.claims.abilities,
-    systemRole: null,
-    organizations: res.claims.organizations,
-    activeOrg: res.claims.org,
-    entitlement: res.claims.entitlement,
-    accessToken: res.accessToken,
-    refreshToken: null,
-    idToken: null,
-    accessExpiresAt: res.expiresAt,
-    authorizationRefreshedAt: Date.now(),
-    isImpersonation: true,
-    impersonator: { sub: s.rec.user.sub, email: s.rec.user.email, name: s.rec.user.name, picture: s.rec.user.picture },
-    backupId
-  };
-  await writeSessionRecord(s.id, s.rec);
-  return toPublicSession(s.rec);
+  await writeSessionRecord(backupId, session.rec);
+  try {
+    const organizationAuthorizations = { ...res.claims.organizationAuthorizations };
+    if (res.claims.org && !Object.hasOwn(organizationAuthorizations, res.claims.org))
+      organizationAuthorizations[res.claims.org] = res.claims.abilities;
+    const next = await issueSession(event, {
+      sub: res.user.sub,
+      user: { sub: res.user.sub, email: res.user.email, name: res.user.name ?? null, picture: res.user.picture ?? null },
+      abilities: res.claims.abilities,
+      organizationAuthorizations,
+      systemRole: null,
+      organizations: res.claims.organizations,
+      activeOrg: res.claims.org,
+      entitlement: res.claims.entitlement,
+      accessToken: res.accessToken,
+      accessExpiresAt: res.expiresAt,
+      expiresAt: Math.min(session.rec.expiresAt, res.expiresAt),
+      isImpersonation: true,
+      impersonator: session.rec.user,
+      backupId
+    }, { expectedPreviousId: session.id });
+    await setSessionRestoreCookie(event, backupId, session.rec);
+    return toPublicSession(next.rec);
+  } catch (error) {
+    await deleteSessionBackup(backupId);
+    throw error;
+  }
 });

package/dist/runtime/server/api/_auth/organizations/switch.post.d.ts

@@ -32,5 +32,6 @@ declare const _default: import("h3").EventHandler<import("h3").EventHandlerReque
         name: string | null;
         picture: string | null;
     } | null;
+    expiresAt?: number | undefined;
 }>>;
 export default _default;

package/dist/runtime/server/api/_auth/organizations/switch.post.js

@@ -1,26 +1,21 @@
 import { createError, defineEventHandler, readValidatedBody } from "h3";
 import { z } from "zod";
-import { idpFetch } from "../../../utils/idp.js";
-import { readSessionRecord, toPublicSession, writeSessionRecord } from "../../../utils/session.js";
+import { requireSameOrigin } from "../../../utils/oidc.js";
+import { issueSession, readSessionRecord, toPublicSession } from "../../../utils/session.js";
 const bodySchema = z.object({ organizationId: z.string().min(1) });
 export default defineEventHandler(async (event) => {
+  requireSameOrigin(event);
   const session = await readSessionRecord(event);
   if (!session)
     throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
   const { organizationId } = await readValidatedBody(event, bodySchema.parse);
-  const context = await idpFetch(
-    event,
-    session.id,
-    session.rec,
-    "/api/auth/rp/organizations/switch",
-    { method: "POST", body: { organizationId } }
-  );
-  session.rec.activeOrg = context.organization.id;
-  session.rec.organizations = context.organizations;
-  session.rec.abilities = context.abilities;
-  session.rec.systemRole = context.systemRole;
-  session.rec.entitlement = context.entitlement;
-  session.rec.authorizationRefreshedAt = Date.now();
-  await writeSessionRecord(session.id, session.rec);
-  return toPublicSession(session.rec);
+  if (!session.rec.organizations.some((organization) => organization.id === organizationId) || !Object.hasOwn(session.rec.organizationAuthorizations, organizationId)) {
+    throw createError({ statusCode: 403, statusMessage: "Sign in again to access this organization" });
+  }
+  const next = await issueSession(event, {
+    ...session.rec,
+    activeOrg: organizationId,
+    abilities: session.rec.organizationAuthorizations[organizationId]
+  }, { expectedPreviousId: session.id });
+  return toPublicSession(next.rec);
 });

package/dist/runtime/server/api/_auth/session-restore.get.d.ts

@@ -0,0 +1,5 @@
+/** Expose availability only; restoring identity requires the same-origin POST. */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    available: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/api/_auth/session-restore.get.js

@@ -0,0 +1,6 @@
+import { defineEventHandler, setResponseHeader } from "h3";
+import { readSessionRestore } from "../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  setResponseHeader(event, "cache-control", "no-store");
+  return { available: Boolean(await readSessionRestore(event)) };
+});

package/dist/runtime/server/api/_auth/session.get.d.ts

@@ -32,5 +32,6 @@ declare const _default: import("h3").EventHandler<import("h3").EventHandlerReque
         name: string | null;
         picture: string | null;
     } | null;
+    expiresAt?: number | undefined;
 } | null>>;
 export default _default;

package/dist/runtime/server/api/_auth/sign-out.post.js

@@ -1,7 +1,10 @@
 import { defineEventHandler } from "h3";
 import { setLogoutIntent } from "../../utils/logout-intent.js";
+import { clearPendingAuthentication, requireSameOrigin } from "../../utils/oidc.js";
 import { destroySession } from "../../utils/session.js";
 export default defineEventHandler(async (event) => {
+  requireSameOrigin(event);
+  await clearPendingAuthentication(event);
   await destroySession(event);
   setLogoutIntent(event);
   return { ok: true };

package/dist/runtime/server/api/_auth/stop-impersonating.post.d.ts

@@ -32,5 +32,6 @@ declare const _default: import("h3").EventHandler<import("h3").EventHandlerReque
         name: string | null;
         picture: string | null;
     } | null;
+    expiresAt?: number | undefined;
 }>>;
 export default _default;

package/dist/runtime/server/api/_auth/stop-impersonating.post.js

@@ -1,20 +1,22 @@
 import { createError, defineEventHandler } from "h3";
-import { useRuntimeConfig, useStorage } from "nitropack/runtime";
-import { idpFetch } from "../../utils/idp.js";
-import { readSessionRecord, readSessionRecordById, toPublicSession, writeSessionRecord } from "../../utils/session.js";
+import { requireSameOrigin } from "../../utils/oidc.js";
+import { clearSessionRestoreCookie, deleteSessionBackup, issueSession, readSessionRecord, readSessionRestore, toPublicSession } from "../../utils/session.js";
 export default defineEventHandler(async (event) => {
-  const s = await readSessionRecord(event);
-  if (!s || !s.rec.isImpersonation)
+  requireSameOrigin(event);
+  const session = await readSessionRecord(event);
+  const restore = await readSessionRestore(event);
+  if (session && !session.rec.isImpersonation)
     throw createError({ statusCode: 400, statusMessage: "Not impersonating" });
-  try {
-    await idpFetch(event, s.id, s.rec, "/api/auth/rp/stop-impersonating", { method: "POST" });
-  } catch {
-  }
-  const backup = s.rec.backupId ? await readSessionRecordById(s.rec.backupId) : null;
-  if (!backup)
-    throw createError({ statusCode: 500, statusMessage: "Original session missing \u2014 sign in again" });
-  await writeSessionRecord(s.id, backup);
-  const { auth: runtimeConfig } = useRuntimeConfig();
-  await useStorage(runtimeConfig.sessionStorageBase).removeItem(`session:${s.rec.backupId}`);
-  return toPublicSession(backup);
+  if (!restore || session && (session.rec.backupId !== restore.id || session.rec.impersonator?.sub !== restore.rec.sub))
+    throw createError({ statusCode: 401, statusMessage: "Original session expired; sign in again" });
+  const next = await issueSession(event, restore.rec, {
+    expectedPreviousId: session?.id ?? null,
+    validate: async () => {
+      if ((await readSessionRestore(event))?.id !== restore.id)
+        throw createError({ statusCode: 409, statusMessage: "Original session was revoked" });
+    }
+  });
+  await deleteSessionBackup(restore.id);
+  clearSessionRestoreCookie(event);
+  return toPublicSession(next.rec);
 });

package/dist/runtime/server/index.d.ts

@@ -3,5 +3,5 @@ export type { ServerAbility } from './utils/ability.js';
 export { resolveOrganizationUser } from './utils/directory.js';
 export { defineAuthorizedHandler, defineSensitiveAuthorizedHandler, } from './utils/handlers.js';
 export { verifyOrganizationIntegrationKey } from './utils/integration-key.js';
-export { getFreshServerAuthSession, getServerAuthSession } from './utils/session.js';
-export type { ServerAuthSession } from './utils/session.js';
+export { getFreshServerAuthSession, getServerAuthSession, issueSession } from './utils/session.js';
+export type { ServerAuthSession, SessionInput, SessionRecord } from './utils/session.js';

package/dist/runtime/server/index.js

@@ -10,4 +10,4 @@ export {
   defineSensitiveAuthorizedHandler
 } from "./utils/handlers.js";
 export { verifyOrganizationIntegrationKey } from "./utils/integration-key.js";
-export { getFreshServerAuthSession, getServerAuthSession } from "./utils/session.js";
+export { getFreshServerAuthSession, getServerAuthSession, issueSession } from "./utils/session.js";