@tinyrack/issuary-server 0.31.0 → 0.32.2

package/dist/middleware/auth-budget.js

@@ -0,0 +1,80 @@
+import { createMiddleware } from 'hono/factory';
+import { z } from 'zod';
+import { requestIp } from '../lib/request-ip.js';
+import { e } from '../schemas/error.js';
+import { clearAuthBudget, consumeAuthBudget, } from '../services/auth-budget.service.js';
+const EMAIL_PATHS = new Set([
+    '/api/auth/login',
+    '/api/auth/register',
+    '/api/auth/password/forgot',
+    '/api/auth/email/resend',
+]);
+const OTP_PATHS = new Set([
+    '/api/auth/totp/verify',
+    '/api/auth/totp/recovery/verify',
+    '/api/user/totp/verify',
+    '/api/user/totp/recovery/regenerate',
+    '/api/user/totp',
+]);
+export const authBudget = createMiddleware(async (c, next) => {
+    const path = c.req.path;
+    const requestedAt = Date.now();
+    if (!['POST', 'PUT', 'DELETE'].includes(c.req.method))
+        return next();
+    const peer = requestIp(c.env, c.req.header('x-forwarded-for'), c.var.services.config.server.trust_proxy);
+    const sensitive = path.startsWith('/api/auth/') ||
+        path.startsWith('/api/user/') ||
+        path.startsWith('/oauth/');
+    if (peer && sensitive) {
+        const retryAfter = await consumeAuthBudget(c.var.services.mikro, c.var.services.securityService, `source:${peer}`, 600, 60);
+        if (retryAfter !== null) {
+            c.header('Retry-After', String(retryAfter));
+            throw new e.TooManyRequests.Error();
+        }
+    }
+    let key;
+    let limit = 20;
+    let windowSeconds = 600;
+    if (EMAIL_PATHS.has(path)) {
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return next();
+        }
+        const input = z.object({ email: z.email().max(320) }).safeParse(body);
+        if (input.success) {
+            key = `${path}:${input.data.email.toLowerCase()}`;
+            if (path.endsWith('/resend') || path.endsWith('/forgot')) {
+                limit = 3;
+                windowSeconds = 60;
+            }
+        }
+    }
+    else if (OTP_PATHS.has(path)) {
+        const subject = path.startsWith('/api/auth/')
+            ? c.var.session.get('pending2FAUser')?.sub
+            : path === '/api/user/totp/verify'
+                ? (c.var.session.get('pending2FASetup')?.sub ??
+                    c.var.session.get('user')?.sub)
+                : c.var.session.get('user')?.sub;
+        if (subject) {
+            key = `otp:${subject}`;
+            limit = 10;
+            windowSeconds = 300;
+        }
+    }
+    if (key) {
+        const retryAfter = await consumeAuthBudget(c.var.services.mikro, c.var.services.securityService, key, limit, windowSeconds);
+        if (retryAfter !== null) {
+            c.header('Retry-After', String(retryAfter));
+            throw new e.TooManyRequests.Error();
+        }
+    }
+    await next();
+    if (key && path === '/api/auth/login' && c.res.status === 200) {
+        await clearAuthBudget(c.var.services.mikro, c.var.services.securityService, key, windowSeconds, requestedAt);
+    }
+});
+//# sourceMappingURL=auth-budget.js.map

package/dist/middleware/auth-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-budget.js","sourceRoot":"","sources":["../../src/middleware/auth-budget.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AACxC,OAAO,EACL,eAAe,EACf,iBAAiB,GAClB,MAAM,oCAAoC,CAAC;AAE5C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,iBAAiB;IACjB,oBAAoB;IACpB,2BAA2B;IAC3B,wBAAwB;CACzB,CAAC,CAAC;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,uBAAuB;IACvB,gCAAgC;IAChC,uBAAuB;IACvB,oCAAoC;IACpC,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAS,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACrE,MAAM,IAAI,GAAG,SAAS,CACpB,CAAC,CAAC,GAAG,EACL,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CACzC,CAAC;IACF,MAAM,SAAS,GACb,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,MAAM,iBAAiB,CACxC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EACpB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,EAC9B,UAAU,IAAI,EAAE,EAChB,GAAG,EACH,EAAE,CACH,CAAC;QACF,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5C,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IACD,IAAI,GAAuB,CAAC;IAC5B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,aAAa,GAAG,GAAG,CAAC;IACxB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzD,KAAK,GAAG,CAAC,CAAC;gBACV,aAAa,GAAG,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAC3C,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,GAAG;YAC1C,CAAC,CAAC,IAAI,KAAK,uBAAuB;gBAChC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,GAAG;oBAC1C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC;gBACjC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,GAAG,OAAO,OAAO,EAAE,CAAC;YACvB,KAAK,GAAG,EAAE,CAAC;YACX,aAAa,GAAG,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,UAAU,GAAG,MAAM,iBAAiB,CACxC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EACpB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,EAC9B,GAAG,EACH,KAAK,EACL,aAAa,CACd,CAAC;QACF,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5C,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;IACb,IAAI,GAAG,IAAI,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9D,MAAM,eAAe,CACnB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EACpB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,EAC9B,GAAG,EACH,aAAa,EACb,WAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/middleware/session.d.ts

@@ -1,3 +1,4 @@
+import type { SessionStore } from '../services/browser-session.service.js';
 export type SessionEnv = {
     Variables: {
         session: SessionHelper;
@@ -27,6 +28,17 @@ export interface ReauthenticationSession {
     request_fingerprint?: string;
 }
 export interface SessionData {
+    totpSetupVerification?: {
+        sub: string;
+        totpId: string;
+        step: number;
+    };
+    security?: {
+        grants: Record<string, string>;
+        pendingExpiresAt?: number;
+        challengeExpiresAt?: number;
+        oauthExpiresAt?: number;
+    };
     /**
      * Fully authenticated user session.
      * Set after successful login (password, OAuth, passkey) and 2FA verification.
@@ -40,7 +52,7 @@ export interface SessionData {
     };
     /**
      * Browser-local remembered authenticated accounts for OIDC account selection.
-     * This is stored only in the encrypted session cookie and must never be
+     * This is stored only in the server-side session and must never be
      * treated as an authoritative user directory.
      */
     accounts?: SessionAccount[];
@@ -83,6 +95,8 @@ export interface SessionData {
         codeVerifier: string;
         providerId: string;
         mode: 'login' | 'register' | 'link';
+        linkSubject?: string;
+        linkEpoch?: string;
         returnUrl?: string | undefined;
     };
     /**
@@ -93,15 +107,19 @@ export interface SessionData {
     passkey_challenge?: string;
 }
 export interface SessionHelper {
+    readonly id: string;
+    readonly revision: number;
+    readonly authorization: Readonly<SessionData>;
+    atomic<T>(operation: () => Promise<T>): Promise<T>;
     get<K extends keyof SessionData>(key: K): SessionData[K];
     set<K extends keyof SessionData>(key: K, value: SessionData[K]): void;
     delete(): void;
-    setUserSession(userSub: string, authenticatedAt?: number): void;
+    setUserSession(userSub: string, epoch: string, authenticatedAt?: number): void;
     selectUserSession(userSub: string): boolean;
     removeRememberedUserSession(userSub: string): boolean;
-    setPending2FASession(userSub: string, authenticatedAt?: number): void;
-    setPending2FASetupSession(userSub: string): void;
+    setPending2FASession(userSub: string, epoch: string, authenticatedAt?: number): void;
+    setPending2FASetupSession(userSub: string, epoch: string): void;
     clearAuthSessions(): void;
 }
-export declare function sessionMiddleware(cookieSecret: string, isSecure: boolean, rememberedAccountsOptions?: RememberedAccountsOptions): import("hono").MiddlewareHandler<SessionEnv, string, {}, Response>;
+export declare function sessionMiddleware(cookieSecret: string, isSecure: boolean, rememberedAccountsOptions: RememberedAccountsOptions | undefined, store: SessionStore): import("hono").MiddlewareHandler<SessionEnv, string, {}, Response>;
 //# sourceMappingURL=session.d.ts.map

package/dist/middleware/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,UAAU,GAAG;IAAE,SAAS,EAAE;QAAE,OAAO,EAAE,aAAa,CAAA;KAAE,CAAA;CAAE,CAAC;AAInE,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAqCD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;OAGG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,eAAe,CAAC,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;QACpC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE,MAAM,IAAI,IAAI,CAAC;IACf,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChE,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5C,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtE,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,iBAAiB,IAAI,IAAI,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,OAAO,EACjB,yBAAyB,CAAC,EAAE,yBAAyB,sEA8LtD"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,YAAY,EAEb,MAAM,wCAAwC,CAAC;AAEhD,MAAM,MAAM,UAAU,GAAG;IAAE,SAAS,EAAE;QAAE,OAAO,EAAE,aAAa,CAAA;KAAE,CAAA;CAAE,CAAC;AAInE,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAqCD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,qBAAqB,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;OAMG;IACH,IAAI,CAAC,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;OAGG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,eAAe,CAAC,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;QACpC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACnD,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE,MAAM,IAAI,IAAI,CAAC;IACf,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,eAAe,CAAC,EAAE,MAAM,GACvB,IAAI,CAAC;IACR,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5C,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,oBAAoB,CAClB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,eAAe,CAAC,EAAE,MAAM,GACvB,IAAI,CAAC;IACR,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAChE,iBAAiB,IAAI,IAAI,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,OAAO,EACjB,yBAAyB,EAAE,yBAAyB,GAAG,SAAS,EAChE,KAAK,EAAE,YAAY,sEAsVpB"}

package/dist/middleware/session.js

@@ -1,6 +1,8 @@
 import { deleteCookie, getCookie, setCookie } from 'hono/cookie';
 import { createMiddleware } from 'hono/factory';
+import { z } from 'zod';
 import { decrypt, encrypt } from '../lib/crypto.js';
+import { e } from '../schemas/error.js';
 const DEFAULT_MAX_REMEMBERED_ACCOUNTS = 5;
 function nowSeconds() {
     return Math.floor(Date.now() / 1000);
@@ -19,25 +21,53 @@ function pruneRememberedAccounts(accounts, options) {
         : accounts.filter((account) => nowSeconds() - account.last_used_at <= ttlSeconds);
     return freshAccounts.slice(-options.maxAccounts);
 }
-export function sessionMiddleware(cookieSecret, isSecure, rememberedAccountsOptions) {
+export function sessionMiddleware(cookieSecret, isSecure, rememberedAccountsOptions, store) {
     const rememberedOptions = resolveRememberedAccountsOptions(rememberedAccountsOptions);
     return createMiddleware(async (c, next) => {
-        const cookieValue = getCookie(c, 'session');
+        const requestStartedAt = Date.now();
+        const mainCookie = getCookie(c, 'session');
+        const isFormPostCallback = c.req.method === 'POST' &&
+            /^\/api\/oauth\/[^/]+\/callback$/.test(c.req.path);
+        const cookieValue = mainCookie ??
+            (isFormPostCallback ? getCookie(c, 'oauth_state') : undefined);
+        let stored = null;
         let sessionData = {};
+        let locatorId;
         if (cookieValue) {
             const decrypted = await decrypt(cookieValue, cookieSecret);
             if (decrypted) {
                 try {
-                    // Cast is acceptable: we encrypt/decrypt our own
-                    // SessionData, so the parsed shape is trusted.
-                    sessionData = JSON.parse(decrypted);
+                    const locator = z
+                        .object({
+                        sid: z.uuid(),
+                        kind: z.literal(mainCookie ? 'session' : 'oauth'),
+                    })
+                        .parse(JSON.parse(decrypted));
+                    locatorId = locator.sid;
                 }
                 catch {
                     sessionData = {};
                 }
             }
         }
+        if (store && locatorId) {
+            stored = await store.load(locatorId);
+            sessionData = stored?.data ?? {};
+        }
+        const sessionId = stored?.id ?? crypto.randomUUID();
         let changed = false;
+        let elevated = false;
+        if (store && sessionData.security) {
+            const security = sessionData.security;
+            if ((security.pendingExpiresAt ?? 0) <= requestStartedAt) {
+                delete sessionData.pending2FAUser;
+                delete sessionData.pending2FASetup;
+            }
+            if ((security.challengeExpiresAt ?? 0) <= requestStartedAt)
+                delete sessionData.passkey_challenge;
+            if ((security.oauthExpiresAt ?? 0) <= requestStartedAt)
+                delete sessionData.oauth;
+        }
         const data = new Proxy(sessionData, {
             set(target, prop, value) {
                 changed = true;
@@ -59,25 +89,121 @@ export function sessionMiddleware(cookieSecret, isSecure, rememberedAccountsOpti
                 data.accounts = prunedAccounts;
             }
         }
+        // A primary-authentication proof cannot renew an older MFA-completed grant.
+        const replaceSubjectEpoch = (sub, epoch) => {
+            if (data.security?.grants[sub] !== epoch) {
+                if (data.user?.sub === sub)
+                    delete data.user;
+                if (data.pending2FAUser?.sub === sub)
+                    delete data.pending2FAUser;
+                if (data.pending2FASetup?.sub === sub)
+                    delete data.pending2FASetup;
+                if (data.reauthentication?.sub === sub)
+                    delete data.reauthentication;
+                if (data.totpSetupVerification?.sub === sub)
+                    delete data.totpSetupVerification;
+                if (data.accounts)
+                    data.accounts = data.accounts.filter((account) => account.sub !== sub);
+                if (data.accountSelection)
+                    data.accountSelection = {
+                        ...data.accountSelection,
+                        allowed_subs: data.accountSelection.allowed_subs.filter((value) => value !== sub),
+                    };
+            }
+            data.security ??= { grants: {} };
+            data.security.grants[sub] = epoch;
+        };
+        let committed = false;
+        let committedRecord = null;
+        const persistSession = async () => {
+            const hasData = Object.entries(sessionData).some(([key, value]) => key !== 'security' && value !== undefined);
+            if (!hasData) {
+                if (stored)
+                    await store.remove(stored.id);
+                return null;
+            }
+            const record = stored
+                ? { ...stored, data: sessionData }
+                : {
+                    id: sessionId,
+                    data: sessionData,
+                    revision: 0,
+                    expires_at: new Date(requestStartedAt + 86_400_000),
+                };
+            const previous = elevated && stored
+                ? { id: stored.id, revision: stored.revision }
+                : undefined;
+            if (previous) {
+                record.id = crypto.randomUUID();
+                record.revision = 0;
+            }
+            if (!(await store.save(record, !stored, previous)))
+                throw new e.Unauthorized.Error();
+            return record;
+        };
         c.set('session', {
+            id: sessionId,
+            revision: stored?.revision ?? 0,
+            authorization: structuredClone(sessionData),
+            async atomic(operation) {
+                const before = structuredClone(sessionData);
+                const wasChanged = changed;
+                const wasElevated = elevated;
+                try {
+                    const outcome = await store.transaction(async () => {
+                        const result = await operation();
+                        const record = await persistSession();
+                        return { result, record };
+                    });
+                    committed = true;
+                    committedRecord = outcome.record;
+                    changed = false;
+                    return outcome.result;
+                }
+                catch (error) {
+                    for (const key of Object.keys(sessionData))
+                        Reflect.deleteProperty(sessionData, key);
+                    Object.assign(sessionData, before);
+                    changed = wasChanged;
+                    elevated = wasElevated;
+                    throw error;
+                }
+            },
             get(key) {
                 return data[key];
             },
             set(key, value) {
                 data[key] = value;
+                if (store &&
+                    value !== undefined &&
+                    (key === 'oauth' || key === 'passkey_challenge')) {
+                    data.security ??= { grants: {} };
+                    if (key === 'oauth')
+                        data.security.oauthExpiresAt = requestStartedAt + 600_000;
+                    else
+                        data.security.challengeExpiresAt = requestStartedAt + 600_000;
+                }
             },
             delete() {
+                changed = true;
                 for (const key of Object.keys(data)) {
                     Reflect.deleteProperty(data, key);
                 }
             },
-            setUserSession(userSub, authenticatedAt) {
+            setUserSession(userSub, epoch, authenticatedAt) {
+                if ((data.pending2FAUser?.sub === userSub ||
+                    data.pending2FASetup?.sub === userSub) &&
+                    data.security?.grants[userSub] !== epoch)
+                    throw new e.Unauthorized.Error();
+                replaceSubjectEpoch(userSub, epoch);
+                elevated = data.user?.sub !== userSub;
                 const authTime = authenticatedAt ?? nowSeconds();
                 const reauthenticationRequestFingerprint = data.reauthentication?.request_fingerprint;
                 delete data.pending2FAUser;
                 delete data.pending2FASetup;
                 delete data.oauth;
                 delete data.passkey_challenge;
+                delete data.totpSetupVerification;
                 data.user = {
                     sub: userSub,
                     authenticated_at: authTime,
@@ -117,6 +243,7 @@ export function sessionMiddleware(cookieSecret, isSecure, rememberedAccountsOpti
                 delete data.pending2FASetup;
                 delete data.oauth;
                 delete data.passkey_challenge;
+                delete data.totpSetupVerification;
                 data.user = {
                     sub: account.sub,
                     authenticated_at: account.authenticated_at,
@@ -142,22 +269,35 @@ export function sessionMiddleware(cookieSecret, isSecure, rememberedAccountsOpti
                 data.accounts = nextAccounts;
                 return true;
             },
-            setPending2FASession(userSub, authenticatedAt) {
+            setPending2FASession(userSub, epoch, authenticatedAt) {
+                if (store) {
+                    replaceSubjectEpoch(userSub, epoch);
+                    data.security ??= { grants: {} };
+                    data.security.pendingExpiresAt = requestStartedAt + 600_000;
+                }
                 delete data.pending2FASetup;
                 delete data.oauth;
                 delete data.passkey_challenge;
+                delete data.totpSetupVerification;
                 data.pending2FAUser = {
                     sub: userSub,
                     authenticated_at: authenticatedAt ?? nowSeconds(),
                 };
             },
-            setPending2FASetupSession(userSub) {
+            setPending2FASetupSession(userSub, epoch) {
+                if (store) {
+                    replaceSubjectEpoch(userSub, epoch);
+                    data.security ??= { grants: {} };
+                    data.security.pendingExpiresAt = requestStartedAt + 600_000;
+                }
                 delete data.pending2FAUser;
                 delete data.oauth;
                 delete data.passkey_challenge;
+                delete data.totpSetupVerification;
                 data.pending2FASetup = { sub: userSub };
             },
             clearAuthSessions() {
+                delete data.totpSetupVerification;
                 delete data.user;
                 delete data.reauthentication;
                 delete data.pending2FAUser;
@@ -165,10 +305,10 @@ export function sessionMiddleware(cookieSecret, isSecure, rememberedAccountsOpti
             },
         });
         await next();
-        if (changed) {
-            const hasData = Object.values(sessionData).some((v) => v !== undefined);
-            if (hasData) {
-                const encrypted = await encrypt(JSON.stringify(sessionData), cookieSecret);
+        if (changed || committed) {
+            const record = committed ? committedRecord : await persistSession();
+            if (record) {
+                const encrypted = await encrypt(JSON.stringify({ sid: record.id, kind: 'session' }), cookieSecret);
                 setCookie(c, 'session', encrypted, {
                     path: '/',
                     httpOnly: true,

package/dist/middleware/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIpD,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAQ1C,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAQD,SAAS,gCAAgC,CACvC,OAA8C;IAE9C,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;QACjC,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,+BAA+B;QACpE,KAAK,EAAE,OAAO,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAA0B,EAC1B,OAA4D;IAE5D,MAAM,UAAU,GACd,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC7E,MAAM,aAAa,GACjB,UAAU,KAAK,SAAS;QACtB,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,CAAC,MAAM,CACb,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,IAAI,UAAU,CAC/D,CAAC;IACR,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AAsGD,MAAM,UAAU,iBAAiB,CAC/B,YAAoB,EACpB,QAAiB,EACjB,yBAAqD;IAErD,MAAM,iBAAiB,GAAG,gCAAgC,CACxD,yBAAyB,CAC1B,CAAC;IACF,OAAO,gBAAgB,CAAa,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACpD,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAE5C,IAAI,WAAW,GAAgB,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3D,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,iDAAiD;oBACjD,+CAA+C;oBAC/C,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAgB,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW,GAAG,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAgB,IAAI,KAAK,CAAC,WAAW,EAAE;YAC/C,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;gBACrB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,cAAc,CAAC,MAAM,EAAE,IAAI;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,QAAQ,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,uBAAuB,CAC5C,IAAI,CAAC,QAAQ,EACb,iBAAiB,CAClB,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC;YACjC,CAAC;QACH,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;YACf,GAAG,CAA8B,GAAM;gBACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,GAAG,CAA8B,GAAM,EAAE,KAAqB;gBAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,CAAC;YACD,MAAM;gBACJ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YACD,cAAc,CAAC,OAAe,EAAE,eAAwB;gBACtD,MAAM,QAAQ,GAAG,eAAe,IAAI,UAAU,EAAE,CAAC;gBACjD,MAAM,kCAAkC,GACtC,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;gBAC7C,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,IAAI,GAAG;oBACV,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,QAAQ;iBAC3B,CAAC;gBACF,IAAI,CAAC,gBAAgB,GAAG;oBACtB,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,QAAQ;iBAC3B,CAAC;gBACF,IAAI,kCAAkC,EAAE,CAAC;oBACvC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB;wBACvC,kCAAkC,CAAC;gBACvC,CAAC;gBACD,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC9B,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC;oBACF,IAAI,CAAC,QAAQ,GAAG;wBACd,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC;wBAChE;4BACE,GAAG,EAAE,OAAO;4BACZ,gBAAgB,EAAE,QAAQ;4BAC1B,YAAY,EAAE,QAAQ;yBACvB;qBACF,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,QAAQ,CAAC;gBACvB,CAAC;YACH,CAAC;YACD,iBAAiB,CAAC,OAAe;gBAC/B,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,OAAO,GAAG,uBAAuB,CACrC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;gBACzC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,IAAI,GAAG;oBACV,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;iBAC3C,CAAC;gBACF,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC7B,IAAI,CAAC,QAAQ,GAAG,uBAAuB,CACrC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACd,KAAK,CAAC,GAAG,KAAK,OAAO;oBACnB,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE;oBAC1C,CAAC,CAAC,KAAK,CACV,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,2BAA2B,CAAC,OAAe;gBACzC,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC;gBACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAC1C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CACrC,CAAC;gBACF,IAAI,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;oBACpD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,oBAAoB,CAAC,OAAe,EAAE,eAAwB;gBAC5D,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,cAAc,GAAG;oBACpB,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,eAAe,IAAI,UAAU,EAAE;iBAClD,CAAC;YACJ,CAAC;YACD,yBAAyB,CAAC,OAAe;gBACvC,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,eAAe,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC1C,CAAC;YACD,iBAAiB;gBACf,OAAO,IAAI,CAAC,IAAI,CAAC;gBACjB,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC7B,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;YAC9B,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;YACxE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAC3B,YAAY,CACb,CAAC;gBACF,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;oBACjC,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,KAAK;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAQxC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAQ1C,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAQD,SAAS,gCAAgC,CACvC,OAA8C;IAE9C,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;QACjC,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,+BAA+B;QACpE,KAAK,EAAE,OAAO,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAA0B,EAC1B,OAA4D;IAE5D,MAAM,UAAU,GACd,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC7E,MAAM,aAAa,GACjB,UAAU,KAAK,SAAS;QACtB,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,CAAC,MAAM,CACb,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,IAAI,UAAU,CAC/D,CAAC;IACR,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AA2HD,MAAM,UAAU,iBAAiB,CAC/B,YAAoB,EACpB,QAAiB,EACjB,yBAAgE,EAChE,KAAmB;IAEnB,MAAM,iBAAiB,GAAG,gCAAgC,CACxD,yBAAyB,CAC1B,CAAC;IACF,OAAO,gBAAgB,CAAa,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACpD,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,kBAAkB,GACtB,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;YACvB,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,WAAW,GACf,UAAU;YACV,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,MAAM,GAAyB,IAAI,CAAC;QACxC,IAAI,WAAW,GAAgB,EAAE,CAAC;QAClC,IAAI,SAA6B,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3D,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,CAAC;yBACd,MAAM,CAAC;wBACN,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE;wBACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;qBAClD,CAAC;yBACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;oBAChC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW,GAAG,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;YACvB,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrC,WAAW,GAAG,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,KAAK,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAC;gBACzD,OAAO,WAAW,CAAC,cAAc,CAAC;gBAClC,OAAO,WAAW,CAAC,eAAe,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,kBAAkB,IAAI,CAAC,CAAC,IAAI,gBAAgB;gBACxD,OAAO,WAAW,CAAC,iBAAiB,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,gBAAgB;gBACpD,OAAO,WAAW,CAAC,KAAK,CAAC;QAC7B,CAAC;QACD,MAAM,IAAI,GAAgB,IAAI,KAAK,CAAC,WAAW,EAAE;YAC/C,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;gBACrB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,cAAc,CAAC,MAAM,EAAE,IAAI;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,QAAQ,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,uBAAuB,CAC5C,IAAI,CAAC,QAAQ,EACb,iBAAiB,CAClB,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC;YACjC,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;YAC/D,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;gBACzC,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC;gBAC7C,IAAI,IAAI,CAAC,cAAc,EAAE,GAAG,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC,cAAc,CAAC;gBACjE,IAAI,IAAI,CAAC,eAAe,EAAE,GAAG,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC,eAAe,CAAC;gBACnE,IAAI,IAAI,CAAC,gBAAgB,EAAE,GAAG,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBACrE,IAAI,IAAI,CAAC,qBAAqB,EAAE,GAAG,KAAK,GAAG;oBACzC,OAAO,IAAI,CAAC,qBAAqB,CAAC;gBACpC,IAAI,IAAI,CAAC,QAAQ;oBACf,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAClC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,CACjC,CAAC;gBACJ,IAAI,IAAI,CAAC,gBAAgB;oBACvB,IAAI,CAAC,gBAAgB,GAAG;wBACtB,GAAG,IAAI,CAAC,gBAAgB;wBACxB,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,MAAM,CACrD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CACzB;qBACF,CAAC;YACN,CAAC;YACD,IAAI,CAAC,QAAQ,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpC,CAAC,CAAC;QAEF,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,eAAe,GAAyB,IAAI,CAAC;QACjD,MAAM,cAAc,GAAG,KAAK,IAAmC,EAAE;YAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,KAAK,KAAK,SAAS,CAC5D,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,MAAM;oBAAE,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAkB,MAAM;gBAClC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;gBAClC,CAAC,CAAC;oBACE,EAAE,EAAE,SAAS;oBACb,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,CAAC;oBACX,UAAU,EAAE,IAAI,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC;iBACpD,CAAC;YACN,MAAM,QAAQ,GACZ,QAAQ,IAAI,MAAM;gBAChB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;gBAC9C,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAChC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;YACtB,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAChD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;YACf,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,CAAC;YAC/B,aAAa,EAAE,eAAe,CAAC,WAAW,CAAC;YAC3C,KAAK,CAAC,MAAM,CAAI,SAA2B;gBACzC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC5C,MAAM,UAAU,GAAG,OAAO,CAAC;gBAC3B,MAAM,WAAW,GAAG,QAAQ,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;wBACjD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;wBACjC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;wBACtC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;oBAC5B,CAAC,CAAC,CAAC;oBACH,SAAS,GAAG,IAAI,CAAC;oBACjB,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;oBACjC,OAAO,GAAG,KAAK,CAAC;oBAChB,OAAO,OAAO,CAAC,MAAM,CAAC;gBACxB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;wBACxC,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;oBAC3C,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;oBACnC,OAAO,GAAG,UAAU,CAAC;oBACrB,QAAQ,GAAG,WAAW,CAAC;oBACvB,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YACD,GAAG,CAA8B,GAAM;gBACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,GAAG,CAA8B,GAAM,EAAE,KAAqB;gBAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAClB,IACE,KAAK;oBACL,KAAK,KAAK,SAAS;oBACnB,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,mBAAmB,CAAC,EAChD,CAAC;oBACD,IAAI,CAAC,QAAQ,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;oBACjC,IAAI,GAAG,KAAK,OAAO;wBACjB,IAAI,CAAC,QAAQ,CAAC,cAAc,GAAG,gBAAgB,GAAG,OAAO,CAAC;;wBACvD,IAAI,CAAC,QAAQ,CAAC,kBAAkB,GAAG,gBAAgB,GAAG,OAAO,CAAC;gBACrE,CAAC;YACH,CAAC;YACD,MAAM;gBACJ,OAAO,GAAG,IAAI,CAAC;gBACf,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YACD,cAAc,CACZ,OAAe,EACf,KAAa,EACb,eAAwB;gBAExB,IACE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,KAAK,OAAO;oBACnC,IAAI,CAAC,eAAe,EAAE,GAAG,KAAK,OAAO,CAAC;oBACxC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK;oBAExC,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACnC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACpC,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC;gBACtC,MAAM,QAAQ,GAAG,eAAe,IAAI,UAAU,EAAE,CAAC;gBACjD,MAAM,kCAAkC,GACtC,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;gBAC7C,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,OAAO,IAAI,CAAC,qBAAqB,CAAC;gBAClC,IAAI,CAAC,IAAI,GAAG;oBACV,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,QAAQ;iBAC3B,CAAC;gBACF,IAAI,CAAC,gBAAgB,GAAG;oBACtB,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,QAAQ;iBAC3B,CAAC;gBACF,IAAI,kCAAkC,EAAE,CAAC;oBACvC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB;wBACvC,kCAAkC,CAAC;gBACvC,CAAC;gBACD,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC9B,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC;oBACF,IAAI,CAAC,QAAQ,GAAG;wBACd,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC;wBAChE;4BACE,GAAG,EAAE,OAAO;4BACZ,gBAAgB,EAAE,QAAQ;4BAC1B,YAAY,EAAE,QAAQ;yBACvB;qBACF,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,QAAQ,CAAC;gBACvB,CAAC;YACH,CAAC;YACD,iBAAiB,CAAC,OAAe;gBAC/B,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,OAAO,GAAG,uBAAuB,CACrC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;gBACzC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,OAAO,IAAI,CAAC,qBAAqB,CAAC;gBAClC,IAAI,CAAC,IAAI,GAAG;oBACV,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;iBAC3C,CAAC;gBACF,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC7B,IAAI,CAAC,QAAQ,GAAG,uBAAuB,CACrC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACd,KAAK,CAAC,GAAG,KAAK,OAAO;oBACnB,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE;oBAC1C,CAAC,CAAC,KAAK,CACV,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,2BAA2B,CAAC,OAAe;gBACzC,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC;gBACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAC1C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CACrC,CAAC;gBACF,IAAI,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;oBACpD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,oBAAoB,CAClB,OAAe,EACf,KAAa,EACb,eAAwB;gBAExB,IAAI,KAAK,EAAE,CAAC;oBACV,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBACpC,IAAI,CAAC,QAAQ,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;oBACjC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,GAAG,gBAAgB,GAAG,OAAO,CAAC;gBAC9D,CAAC;gBACD,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,OAAO,IAAI,CAAC,qBAAqB,CAAC;gBAClC,IAAI,CAAC,cAAc,GAAG;oBACpB,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,eAAe,IAAI,UAAU,EAAE;iBAClD,CAAC;YACJ,CAAC;YACD,yBAAyB,CAAC,OAAe,EAAE,KAAa;gBACtD,IAAI,KAAK,EAAE,CAAC;oBACV,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBACpC,IAAI,CAAC,QAAQ,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;oBACjC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,GAAG,gBAAgB,GAAG,OAAO,CAAC;gBAC9D,CAAC;gBACD,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,OAAO,IAAI,CAAC,qBAAqB,CAAC;gBAClC,IAAI,CAAC,eAAe,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC1C,CAAC;YACD,iBAAiB;gBACf,OAAO,IAAI,CAAC,qBAAqB,CAAC;gBAClC,OAAO,IAAI,CAAC,IAAI,CAAC;gBACjB,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC7B,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;YAC9B,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC;YACpE,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EACnD,YAAY,CACb,CAAC;gBACF,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;oBACjC,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,KAAK;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/middleware/strict-input.d.ts

@@ -0,0 +1,4 @@
+/** JSON.parse validates syntax; the second pass retains keys discarded by JSON.parse. */
+export declare function rejectDuplicateJsonKeys(source: string): void;
+export declare const strictInput: import("hono").MiddlewareHandler<any, string, {}, Response>;
+//# sourceMappingURL=strict-input.d.ts.map

package/dist/middleware/strict-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-input.d.ts","sourceRoot":"","sources":["../../src/middleware/strict-input.ts"],"names":[],"mappings":"AAOA,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAkE5D;AAaD,eAAO,MAAM,WAAW,6DAqDtB,CAAC"}

package/dist/middleware/strict-input.js

@@ -0,0 +1,144 @@
+import { createMiddleware } from 'hono/factory';
+import { e } from '../schemas/error.js';
+const MAX_BODY_BYTES = 1_048_576;
+const invalid = () => new e.ValidationError.Error('Ambiguous or invalid request encoding');
+/** JSON.parse validates syntax; the second pass retains keys discarded by JSON.parse. */
+export function rejectDuplicateJsonKeys(source) {
+    try {
+        JSON.parse(source);
+    }
+    catch {
+        throw invalid();
+    }
+    let index = 0;
+    const whitespace = () => {
+        while (/\s/.test(source[index] ?? '') && index < source.length)
+            index++;
+    };
+    const string = () => {
+        const start = index++;
+        while (index < source.length) {
+            if (source[index] === '\\') {
+                index += 2;
+                continue;
+            }
+            if (source[index++] === '"')
+                break;
+        }
+        const value = JSON.parse(source.slice(start, index));
+        if (typeof value !== 'string')
+            throw invalid();
+        return value;
+    };
+    const value = (depth) => {
+        if (depth > 128)
+            throw invalid();
+        whitespace();
+        const character = source[index];
+        if (character === '"') {
+            string();
+            return;
+        }
+        if (character === '{') {
+            index++;
+            whitespace();
+            const keys = new Set();
+            while (source[index] !== '}') {
+                whitespace();
+                const key = string();
+                if (keys.has(key))
+                    throw invalid();
+                keys.add(key);
+                whitespace();
+                index++;
+                value(depth + 1);
+                whitespace();
+                if (source[index] !== ',')
+                    break;
+                index++;
+            }
+            index++;
+            return;
+        }
+        if (character === '[') {
+            index++;
+            whitespace();
+            while (source[index] !== ']') {
+                value(depth + 1);
+                whitespace();
+                if (source[index] !== ',')
+                    break;
+                index++;
+            }
+            index++;
+            return;
+        }
+        while (index < source.length && !/[\s,}\]]/.test(source[index] ?? ''))
+            index++;
+    };
+    value(0);
+}
+function rejectDuplicateParameters(parameters, previous = new Set()) {
+    for (const key of parameters.keys()) {
+        if (previous.has(key))
+            throw invalid();
+        previous.add(key);
+    }
+    return previous;
+}
+export const strictInput = createMiddleware(async (c, next) => {
+    const oauth = c.req.path.startsWith('/oauth/') || c.req.path.startsWith('/api/oauth/');
+    const queryKeys = oauth
+        ? rejectDuplicateParameters(new URL(c.req.url).searchParams)
+        : new Set();
+    if (c.req.raw.body && !['GET', 'HEAD'].includes(c.req.method)) {
+        const reader = c.req.raw.body.getReader();
+        const chunks = [];
+        let size = 0;
+        try {
+            while (true) {
+                const result = await reader.read();
+                if (result.done)
+                    break;
+                size += result.value.byteLength;
+                if (size > MAX_BODY_BYTES) {
+                    void reader.cancel().catch(() => undefined);
+                    throw new e.RequestBodyTooLarge.Error();
+                }
+                chunks.push(result.value);
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+        const bytes = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        const contentType = c.req
+            .header('content-type')
+            ?.split(';')[0]
+            ?.trim()
+            .toLowerCase();
+        if (size &&
+            (contentType === 'application/json' ||
+                contentType === 'application/x-www-form-urlencoded')) {
+            let source;
+            try {
+                source = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+            }
+            catch {
+                throw invalid();
+            }
+            if (contentType === 'application/json')
+                rejectDuplicateJsonKeys(source);
+            else if (oauth)
+                rejectDuplicateParameters(new URLSearchParams(source), queryKeys);
+        }
+        c.req.raw = new Request(c.req.raw, { body: bytes.buffer });
+    }
+    await next();
+});
+//# sourceMappingURL=strict-input.js.map

package/dist/middleware/strict-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-input.js","sourceRoot":"","sources":["../../src/middleware/strict-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAExC,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;AAEvE,yFAAyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM;YAAE,KAAK,EAAE,CAAC;IAC1E,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,GAAW,EAAE;QAC1B,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;QACtB,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3B,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,GAAG;gBAAE,MAAM;QACrC,CAAC;QACD,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,OAAO,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,KAAa,EAAQ,EAAE;QACpC,IAAI,KAAK,GAAG,GAAG;YAAE,MAAM,OAAO,EAAE,CAAC;QACjC,UAAU,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,EAAE,CAAC;YACT,OAAO;QACT,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC7B,UAAU,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;gBACrB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,OAAO,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,UAAU,EAAE,CAAC;gBACb,KAAK,EAAE,CAAC;gBACR,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACjB,UAAU,EAAE,CAAC;gBACb,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;oBAAE,MAAM;gBACjC,KAAK,EAAE,CAAC;YACV,CAAC;YACD,KAAK,EAAE,CAAC;YACR,OAAO;QACT,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,CAAC;YACb,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC7B,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACjB,UAAU,EAAE,CAAC;gBACb,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;oBAAE,MAAM;gBACjC,KAAK,EAAE,CAAC;YACV,CAAC;YACD,KAAK,EAAE,CAAC;YACR,OAAO;QACT,CAAC;QACD,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACnE,KAAK,EAAE,CAAC;IACZ,CAAC,CAAC;IACF,KAAK,CAAC,CAAC,CAAC,CAAC;AACX,CAAC;AAED,SAAS,yBAAyB,CAChC,UAA2B,EAC3B,QAAQ,GAAG,IAAI,GAAG,EAAU;IAE5B,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,OAAO,EAAE,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAC5D,MAAM,KAAK,GACT,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,KAAK;QACrB,CAAC,CAAC,yBAAyB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;QAC5D,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;IACtB,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,MAAM,CAAC,IAAI;oBAAE,MAAM;gBACvB,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;gBAChC,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;oBAC1B,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC5C,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;gBAC1C,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;QAC7B,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG;aACtB,MAAM,CAAC,cAAc,CAAC;YACvB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACf,EAAE,IAAI,EAAE;aACP,WAAW,EAAE,CAAC;QACjB,IACE,IAAI;YACJ,CAAC,WAAW,KAAK,kBAAkB;gBACjC,WAAW,KAAK,mCAAmC,CAAC,EACtD,CAAC;YACD,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;YACD,IAAI,WAAW,KAAK,kBAAkB;gBAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;iBACnE,IAAI,KAAK;gBACZ,yBAAyB,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;QACtE,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC"}

package/dist/migrations/postgres/Migration20260910120000_api_security.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260910120000_api_security extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=Migration20260910120000_api_security.d.ts.map

package/dist/migrations/postgres/Migration20260910120000_api_security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260910120000_api_security.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260910120000_api_security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,oCAAqC,SAAQ,SAAS;IAClD,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CAsBjC;IACc,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAMnC;CACF"}