@udibo/oauth2 0.1.0

package/esm/adapters/hono/bff/testing.js

@@ -0,0 +1,254 @@
+/**
+ * Testing helpers for the Hono BFF adapter.
+ *
+ * Lets a consumer's tests drive protected endpoints without walking
+ * through the full login → authorize → callback flow, and ages the
+ * access token in the underlying {@link SessionStore} so a follow-up
+ * request through `attachToken()` exercises the refresh path
+ * deterministically (no `setTimeout` required).
+ *
+ * The runner-style helper {@link runSessionStoreContractTests} is
+ * available for verifying custom {@link SessionStore} implementations
+ * (Postgres, Redis, DynamoDB, …) satisfy the create / read / update /
+ * destroy contract.
+ *
+ * @module
+ */
+import "../../../_dnt.polyfills.js";
+import { assert, assertEquals, assertStrictEquals } from "../../../deps/jsr.io/@std/assert/1.0.19/mod.js";
+import { delay } from "../../../deps/jsr.io/@std/async/1.5.0/delay.js";
+import { beforeEach, describe, it } from "../../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { sessionStoreMaxAgeMs, } from "./session-store.js";
+/**
+ * Seeds a session in `bff.sessionStore` and returns a `Cookie` header
+ * value (`<name>=<value>`) ready to attach to subsequent
+ * `app.request(...)` calls. Skips the authorize / callback round-trip
+ * entirely — useful for tests that only care about authenticated
+ * endpoint behavior.
+ *
+ * **Important — token recognition.** The seeded access token is random by
+ * default and is NOT registered with any resource server. That is enough for
+ * `GET /auth/session` (which reads the cached `user` claim), but a route
+ * guarded by {@link HonoBff.protect} validates the session's access token
+ * against the resource server's token service — so an unrecognized token
+ * yields 401. For protected API routes, either pre-register the token
+ * (`tokenService.save({ accessToken, ... })` then pass the same
+ * `tokens.accessToken` here), or use {@link createAuthenticatedTestSession},
+ * which does both in one call.
+ *
+ * @example
+ * ```ts
+ * // Probe-only (GET /auth/session) — no resource server involved:
+ * const cookie = await createTestSession(bff, {
+ *   user: { sub: "u1", name: "Alice" },
+ * });
+ * const res = await app.request("/auth/session", { headers: { cookie } });
+ * ```
+ */
+export async function createTestSession(bff, options = {}) {
+    const now = Date.now();
+    const data = {
+        tokens: {
+            accessToken: options.tokens?.accessToken ?? crypto.randomUUID(),
+            accessTokenExpiresAt: options.tokens?.accessTokenExpiresAt ??
+                now + 60 * 60 * 1000,
+            tokenType: options.tokens?.tokenType ?? "Bearer",
+            scope: options.tokens?.scope,
+            idToken: options.tokens?.idToken,
+        },
+        refreshToken: options.refreshToken,
+        user: options.user ?? null,
+        createdAt: options.createdAt ?? now,
+        updatedAt: options.updatedAt ?? now,
+    };
+    const cookieValue = await bff.sessionStore.create(data);
+    return `${bff.cookieName}=${cookieValue}`;
+}
+/**
+ * Mints a real access token, registers it with the resource server's token
+ * service, AND seeds a matching BFF session — the one-call setup for testing a
+ * route guarded by {@link HonoBff.protect}. Returns a `Cookie` header ready to
+ * attach to `app.request(...)`.
+ *
+ * This is the combined form of the two-step pattern (save a token, then
+ * {@link createTestSession} with the same access token) that protected-route
+ * tests otherwise hand-roll. Works with any {@link SessionStore} the BFF can
+ * `create()` into (e.g. `MemorySessionStore`,
+ * `EncryptedCookieSessionStore`); apps with a DB-backed store that mints
+ * its own cookie/secret should seed via that store directly.
+ *
+ * @example
+ * ```ts
+ * const cookie = await createAuthenticatedTestSession(bff, {
+ *   tokenService,
+ *   client: { id: "spa" },
+ *   user: { id: "u1", username: "alice" },
+ *   scope: new BasicScope("read write"),
+ *   claims: { sub: "u1", name: "Alice" },
+ * });
+ * const res = await app.request("/api/me", { headers: { cookie } });
+ * ```
+ */
+export async function createAuthenticatedTestSession(bff, options) {
+    const accessToken = crypto.randomUUID();
+    const accessTokenExpiresAt = new Date(Date.now() + (options.accessTokenLifetime ?? 60 * 60) * 1000);
+    await options.tokenService.save({
+        accessToken,
+        accessTokenExpiresAt,
+        client: options.client,
+        user: options.user,
+        scope: options.scope,
+    });
+    return createTestSession(bff, {
+        tokens: {
+            accessToken,
+            accessTokenExpiresAt: accessTokenExpiresAt.getTime(),
+        },
+        user: options.claims ?? null,
+    });
+}
+/**
+ * Ages the access token in the underlying session so the next request
+ * through {@link HonoBff.attachToken} sees it as expired and triggers
+ * the refresh path.
+ *
+ * Returns a fresh `Cookie` header. For stateful stores
+ * (`MemorySessionStore` and DB-backed variants) the cookie value
+ * is unchanged. For stateless stores
+ * (`EncryptedCookieSessionStore`) the value is re-encrypted and
+ * differs from the input — use the returned header for subsequent
+ * requests.
+ *
+ * @param expiredAt Optional time to set the access token's expiry to
+ * (epoch ms). Defaults to one second in the past.
+ */
+export async function forceTokenExpiry(bff, cookieHeader, expiredAt) {
+    const value = parseCookieHeader(cookieHeader, bff.cookieName);
+    const data = await bff.sessionStore.read(value);
+    if (!data) {
+        throw new Error(`forceTokenExpiry: no session found for cookie value "${value}"`);
+    }
+    const aged = {
+        ...data,
+        tokens: {
+            ...data.tokens,
+            accessTokenExpiresAt: expiredAt ?? Date.now() - 1000,
+        },
+        updatedAt: Date.now(),
+    };
+    const newValue = await bff.sessionStore.update(value, aged);
+    return `${bff.cookieName}=${newValue}`;
+}
+/**
+ * Returns the session data currently stored under the given cookie
+ * header, or `null` if there is none. Convenience wrapper around
+ * `bff.sessionStore.read` that handles cookie parsing.
+ */
+export function readTestSession(bff, cookieHeader) {
+    const value = parseCookieHeader(cookieHeader, bff.cookieName);
+    return Promise.resolve(bff.sessionStore.read(value));
+}
+function parseCookieHeader(header, name) {
+    if (!header.includes("="))
+        return header;
+    const cookies = header.split(/;\s*/);
+    for (const cookie of cookies) {
+        const idx = cookie.indexOf("=");
+        if (idx < 0)
+            continue;
+        const k = cookie.slice(0, idx).trim();
+        if (k === name)
+            return cookie.slice(idx + 1).trim();
+    }
+    throw new Error(`parseCookieHeader: cookie "${name}" not found in header "${header}"`);
+}
+const BOUND_MS = 1000;
+/** Contract test suite for {@link SessionStore} implementations. */
+export function runSessionStoreContractTests(options) {
+    const destroyClearsRead = options.destroyClearsRead ?? true;
+    const makeBoundedStore = options.makeBoundedStore;
+    describe(options.describeName ?? "SessionStore contract", () => {
+        let store;
+        beforeEach(async () => {
+            store = await options.makeStore();
+        });
+        function sampleSession() {
+            const now = Date.now();
+            return {
+                tokens: {
+                    accessToken: "access-1",
+                    accessTokenExpiresAt: now + 60_000,
+                    tokenType: "Bearer",
+                },
+                refreshToken: "refresh-1",
+                user: { sub: "u1" },
+                createdAt: now,
+                updatedAt: now,
+            };
+        }
+        it("create returns a non-empty cookie value", async () => {
+            const value = await store.create(sampleSession());
+            assertEquals(typeof value, "string");
+            assert(value.length > 0);
+        });
+        it("read returns null for an unknown cookie value", async () => {
+            assertStrictEquals(await store.read("no-such-session"), null);
+        });
+        it("create + read round-trips the session data", async () => {
+            const original = sampleSession();
+            const value = await store.create(original);
+            const fetched = await store.read(value);
+            assert(fetched !== null, "read should return data for a created session");
+            assertEquals(fetched.tokens.accessToken, original.tokens.accessToken);
+            assertEquals(fetched.refreshToken, original.refreshToken);
+            assertEquals(fetched.user, original.user);
+        });
+        it("preserves createdAt, which carries the session's absolute age", async () => {
+            const original = sampleSession();
+            const value = await store.create(original);
+            const fetched = await store.read(value);
+            assert(fetched !== null, "read should return data for a created session");
+            assertEquals(fetched.createdAt, original.createdAt, "a store that drops createdAt silently opts its sessions out of " +
+                "HonoBffOptions.sessionMaxAgeMs, so they never age out");
+        });
+        it("update reflects changes on subsequent read", async () => {
+            const value = await store.create(sampleSession());
+            const updated = {
+                ...sampleSession(),
+                user: { sub: "u1", role: "admin" },
+                updatedAt: Date.now(),
+            };
+            const newValue = await store.update(value, updated);
+            const fetched = await store.read(newValue);
+            assertEquals(fetched?.user, { sub: "u1", role: "admin" });
+        });
+        if (destroyClearsRead) {
+            it("destroy removes the session", async () => {
+                const value = await store.create(sampleSession());
+                await store.destroy(value);
+                assertStrictEquals(await store.read(value), null);
+            });
+        }
+        it("never advertises a max age without proving it enforces one", () => {
+            const advertised = sessionStoreMaxAgeMs(store);
+            assertEquals(advertised !== undefined && makeBoundedStore === undefined, false, `this store advertises maxAgeMs=${advertised}, which HonoBff trusts ` +
+                "when it refuses a session cookie that would expire before the " +
+                "session does. Supply makeBoundedStore so the contract can prove " +
+                "the bound is real.");
+        });
+        if (makeBoundedStore) {
+            it("reports the max age it was built with, so a BFF can outlive it", async () => {
+                const bounded = await makeBoundedStore(BOUND_MS);
+                assertStrictEquals(sessionStoreMaxAgeMs(bounded), BOUND_MS, "a store that hides its bound gets no divergence check from HonoBff");
+            });
+            it("stops reading a session older than the max age it enforces", async () => {
+                const bounded = await makeBoundedStore(BOUND_MS);
+                const value = await bounded.create(sampleSession());
+                assert(await bounded.read(value) !== null, "a session created moments ago must still read");
+                await delay(BOUND_MS + 500);
+                assertStrictEquals(await bounded.read(value), null, "a session past the store's own bound must stop reading, or a " +
+                    "captured cookie outlives the window the bound promises");
+            });
+        }
+    });
+}

package/esm/adapters/hono/identity.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Thin, optional Hono route factory over {@link IdentityService} for the
+ * **password-credential** flows.
+ *
+ * `honoIdentityRoutes(service, opts)` mounts exactly five POST endpoints —
+ * `/signup`, `/signin`, `/password/reset-request`, `/password/reset`, and
+ * `/email/verify` — by delegating to the service's methods. It is deliberately
+ * **not** an opinionated framework: the service methods are the real API, and
+ * this just wires the password path to routes for apps that want them mounted
+ * (the `IdentityService` stays usable directly from your own
+ * routes/loaders/actions).
+ *
+ * **Scope — password path only, by design.** The newer flows are intentionally
+ * *not* mounted here, because their safe wiring carries app-owned policy the
+ * factory can't guess. Drive them by calling the service methods from your own
+ * handlers, as each guide shows:
+ * - **MFA** (enroll / confirm / verify / disable / regenerate, via `MfaService`):
+ *   *when* a challenge is required, where the pending challenge state lives, and
+ *   the cookie shape are all yours — see `docs/guides/add-mfa.md`.
+ * - **Passwordless** (`requestSignInLink` / `consumeSignInLink`,
+ *   `requestSignInCode` / `verifySignInCode`): the enumeration-safe response
+ *   shape, whether `rate_limited` is swallowed, and IP throttling are yours —
+ *   see `docs/guides/passwordless.md`.
+ * - **Social / OIDC** (start / callback, via `@udibo/oauth2/identity/external`):
+ *   transient `state`/PKCE custody and the account-resolution/linking policy
+ *   (where the account-takeover bugs live) are yours — see
+ *   `docs/guides/social-sign-in.md`.
+ *
+ * Session creation stays in your app: the `signup`/`signin` routes call your
+ * `onAuthenticated(c, user)` hook on success, where you mint your session and
+ * return a `Response` (e.g. a redirect via `bff.loginContinuation`). Omit the
+ * hook to mount only the stateless reset/verify routes.
+ *
+ * Accepts JSON or form-encoded bodies. Responses are simple JSON
+ * (`{ ok: true }` / `{ error }`); render your own UI around them. Because a
+ * form-encoded POST is exactly what a cross-site page can forge, the routes
+ * refuse requests a browser reports as cross-site — see
+ * {@link HonoIdentityOptions.csrf}.
+ *
+ * @module
+ */
+import "../../_dnt.polyfills.js";
+import { Hono } from "hono";
+import type { Context } from "hono";
+import type { IdentityService, IdentityUser } from "../../identity/service.js";
+/** Paths for the routes mounted by {@link honoIdentityRoutes}. */
+export interface HonoIdentityPaths {
+    /** `POST` sign-up. Default `/signup`. */
+    signUp?: string;
+    /** `POST` sign-in. Default `/signin`. */
+    signIn?: string;
+    /** `POST` password-reset request (enumeration-safe). Default `/password/reset-request`. */
+    requestPasswordReset?: string;
+    /** `POST` password reset (consume token). Default `/password/reset`. */
+    resetPassword?: string;
+    /** `POST` email verification (consume token). Default `/email/verify`. */
+    verifyEmail?: string;
+}
+/**
+ * Tunes the same-origin guard {@link honoIdentityRoutes} mounts by default.
+ * Pass `csrf: false` instead to turn the guard off entirely — only when
+ * something in front of these routes already stops cross-site requests.
+ */
+export interface HonoIdentityCsrfOptions {
+    /**
+     * Additional origins allowed to post to these routes, as exact
+     * `scheme://host[:port]` strings (e.g. `"https://app.example.com"`). Use it
+     * when the page holding your sign-in form is served from a different origin
+     * than the routes. The origin serving the routes is always allowed.
+     */
+    allowedOrigins?: string[];
+}
+/** Options for {@link honoIdentityRoutes}. */
+export interface HonoIdentityOptions<User extends IdentityUser> {
+    /**
+     * Cross-site request protection, **on by default**. These routes carry no
+     * token of their own, so the guard reads what the browser states about the
+     * request: a `Sec-Fetch-Site` of `same-origin`/`none` passes, any other value
+     * is refused, and browsers too old to send it fall back to matching the
+     * `Origin` header's host against the request's. A request with neither header
+     * — curl, a server-side call, a native app — passes, since cross-site request
+     * forgery needs a browser.
+     *
+     * Refusals get `403` `{ error: "forbidden_origin" }` before any handler runs.
+     * Set {@link HonoIdentityCsrfOptions.allowedOrigins} for a legitimate
+     * cross-origin caller, or `false` to disable the guard when a proxy or an
+     * outer middleware already terminates CSRF.
+     */
+    csrf?: HonoIdentityCsrfOptions | false;
+    /**
+     * Called after `signup`/`signin` authenticates a user. Your app owns what
+     * happens next — create your session and return a `Response` (e.g. a redirect
+     * via `bff.loginContinuation`). **Required to mount the signup/signin routes**;
+     * omit it to mount only the stateless reset/verify routes.
+     */
+    onAuthenticated?: (c: Context, user: User, action: "signUp" | "signIn") => Response | Promise<Response>;
+    /** Override the default paths. */
+    paths?: HonoIdentityPaths;
+}
+/**
+ * Build a Hono app mounting the password-credential endpoints
+ * (`/signup`, `/signin`, `/password/reset-request`, `/password/reset`,
+ * `/email/verify`) over `service`. Mount it wherever you like, e.g.
+ * `app.route("/auth", honoIdentityRoutes(service, …))`.
+ *
+ * A JSON body keeps each field's type except `password`, `identifier`, `email`,
+ * and `token`, which are coerced to strings when present; on the sign-up route
+ * every other field is passed to `service.signUp` as `profile`. A form-encoded
+ * body is all strings.
+ *
+ * Every mounted route sits behind the same-origin guard described in
+ * {@link HonoIdentityOptions.csrf}, which is on unless you pass `csrf: false`.
+ *
+ * Passwordless, MFA, and social are intentionally not mounted — see the module
+ * doc for why and where to hand-wire each.
+ */
+export declare function honoIdentityRoutes<User extends IdentityUser>(service: IdentityService<User>, options?: HonoIdentityOptions<User>): Hono;

package/esm/adapters/hono/identity.js

@@ -0,0 +1,215 @@
+/**
+ * Thin, optional Hono route factory over {@link IdentityService} for the
+ * **password-credential** flows.
+ *
+ * `honoIdentityRoutes(service, opts)` mounts exactly five POST endpoints —
+ * `/signup`, `/signin`, `/password/reset-request`, `/password/reset`, and
+ * `/email/verify` — by delegating to the service's methods. It is deliberately
+ * **not** an opinionated framework: the service methods are the real API, and
+ * this just wires the password path to routes for apps that want them mounted
+ * (the `IdentityService` stays usable directly from your own
+ * routes/loaders/actions).
+ *
+ * **Scope — password path only, by design.** The newer flows are intentionally
+ * *not* mounted here, because their safe wiring carries app-owned policy the
+ * factory can't guess. Drive them by calling the service methods from your own
+ * handlers, as each guide shows:
+ * - **MFA** (enroll / confirm / verify / disable / regenerate, via `MfaService`):
+ *   *when* a challenge is required, where the pending challenge state lives, and
+ *   the cookie shape are all yours — see `docs/guides/add-mfa.md`.
+ * - **Passwordless** (`requestSignInLink` / `consumeSignInLink`,
+ *   `requestSignInCode` / `verifySignInCode`): the enumeration-safe response
+ *   shape, whether `rate_limited` is swallowed, and IP throttling are yours —
+ *   see `docs/guides/passwordless.md`.
+ * - **Social / OIDC** (start / callback, via `@udibo/oauth2/identity/external`):
+ *   transient `state`/PKCE custody and the account-resolution/linking policy
+ *   (where the account-takeover bugs live) are yours — see
+ *   `docs/guides/social-sign-in.md`.
+ *
+ * Session creation stays in your app: the `signup`/`signin` routes call your
+ * `onAuthenticated(c, user)` hook on success, where you mint your session and
+ * return a `Response` (e.g. a redirect via `bff.loginContinuation`). Omit the
+ * hook to mount only the stateless reset/verify routes.
+ *
+ * Accepts JSON or form-encoded bodies. Responses are simple JSON
+ * (`{ ok: true }` / `{ error }`); render your own UI around them. Because a
+ * form-encoded POST is exactly what a cross-site page can forge, the routes
+ * refuse requests a browser reports as cross-site — see
+ * {@link HonoIdentityOptions.csrf}.
+ *
+ * @module
+ */
+import "../../_dnt.polyfills.js";
+import { Hono } from "hono";
+import { identityErrorStatus, isIdentityError, } from "../../identity/errors.js";
+/**
+ * Wrap a handler so a thrown {@link IdentityError} (e.g. `identifier_taken` from
+ * your user store, or `weak_password` from a policy check) becomes a consistent
+ * `{ error: code }` response with the conventional status; other errors
+ * propagate untouched.
+ */
+function handle(fn) {
+    return async (c) => {
+        try {
+            return await fn(c);
+        }
+        catch (error) {
+            if (!isIdentityError(error))
+                throw error;
+            if (error.retryAfterMs !== undefined) {
+                c.header("Retry-After", String(Math.ceil(error.retryAfterMs / 1000)));
+            }
+            return c.json({ error: error.code }, identityErrorStatus(error.code));
+        }
+    };
+}
+const STRING_FIELDS = new Set(["password", "identifier", "email", "token"]);
+/**
+ * Reads a JSON or form-encoded request body. A JSON body keeps each value's
+ * type except for {@link STRING_FIELDS}; a body that is not a JSON object
+ * (array, string, `null`) reads as empty. A form-encoded body is all strings by
+ * construction.
+ */
+async function readBody(c) {
+    const contentType = c.req.header("content-type") ?? "";
+    if (contentType.includes("application/json")) {
+        try {
+            const body = await c.req.json();
+            if (typeof body !== "object" || body === null || Array.isArray(body)) {
+                return {};
+            }
+            const out = {};
+            for (const [key, value] of Object.entries(body)) {
+                out[key] = STRING_FIELDS.has(key) && value !== null &&
+                    value !== undefined
+                    ? String(value)
+                    : value;
+            }
+            return out;
+        }
+        catch {
+            return {};
+        }
+    }
+    try {
+        const form = await c.req.formData();
+        const out = {};
+        for (const [key, value] of form)
+            out[key] = String(value);
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+const FORBIDDEN_ORIGIN = "forbidden_origin";
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+function hostOf(origin) {
+    try {
+        return new URL(origin).host;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isTrustedOrigin(c, allowedOrigins) {
+    const origin = c.req.header("origin");
+    const site = c.req.header("sec-fetch-site");
+    if (site) {
+        return site === "same-origin" || site === "none" ||
+            (!!origin && allowedOrigins.has(origin));
+    }
+    if (!origin)
+        return true;
+    return allowedOrigins.has(origin) ||
+        hostOf(origin) === new URL(c.req.url).host;
+}
+/**
+ * Refuses an unsafe-method request a browser reports as coming from another
+ * site, per {@link HonoIdentityOptions.csrf}.
+ */
+function sameOriginGuard(options) {
+    const allowedOrigins = new Set(options.allowedOrigins ?? []);
+    return async (c, next) => {
+        if (!SAFE_METHODS.has(c.req.method) && !isTrustedOrigin(c, allowedOrigins)) {
+            return c.json({ error: FORBIDDEN_ORIGIN }, identityErrorStatus(FORBIDDEN_ORIGIN));
+        }
+        await next();
+    };
+}
+/**
+ * Build a Hono app mounting the password-credential endpoints
+ * (`/signup`, `/signin`, `/password/reset-request`, `/password/reset`,
+ * `/email/verify`) over `service`. Mount it wherever you like, e.g.
+ * `app.route("/auth", honoIdentityRoutes(service, …))`.
+ *
+ * A JSON body keeps each field's type except `password`, `identifier`, `email`,
+ * and `token`, which are coerced to strings when present; on the sign-up route
+ * every other field is passed to `service.signUp` as `profile`. A form-encoded
+ * body is all strings.
+ *
+ * Every mounted route sits behind the same-origin guard described in
+ * {@link HonoIdentityOptions.csrf}, which is on unless you pass `csrf: false`.
+ *
+ * Passwordless, MFA, and social are intentionally not mounted — see the module
+ * doc for why and where to hand-wire each.
+ */
+export function honoIdentityRoutes(service, options = {}) {
+    const app = new Hono();
+    const paths = {
+        signUp: "/signup",
+        signIn: "/signin",
+        requestPasswordReset: "/password/reset-request",
+        resetPassword: "/password/reset",
+        verifyEmail: "/email/verify",
+        ...options.paths,
+    };
+    const onAuthenticated = options.onAuthenticated;
+    if (options.csrf !== false) {
+        app.use("*", sameOriginGuard(options.csrf ?? {}));
+    }
+    if (onAuthenticated) {
+        app.post(paths.signUp, handle(async (c) => {
+            const { password, ...profile } = await readBody(c);
+            if (typeof password !== "string" || !password) {
+                return c.json({ error: "invalid_request" }, 400);
+            }
+            const user = await service.signUp({ password, profile });
+            return await onAuthenticated(c, user, "signUp");
+        }));
+        app.post(paths.signIn, handle(async (c) => {
+            const body = await readBody(c);
+            const user = await service.signIn({
+                identifier: String(body.identifier ?? ""),
+                password: String(body.password ?? ""),
+            });
+            if (!user)
+                return c.json({ error: "invalid_credentials" }, 401);
+            return await onAuthenticated(c, user, "signIn");
+        }));
+    }
+    app.post(paths.requestPasswordReset, handle(async (c) => {
+        const body = await readBody(c);
+        await service.requestPasswordReset(String(body.email ?? ""));
+        return c.json({ ok: true });
+    }));
+    app.post(paths.resetPassword, handle(async (c) => {
+        const body = await readBody(c);
+        const result = await service.resetPassword({
+            token: String(body.token ?? ""),
+            password: String(body.password ?? ""),
+        });
+        return result
+            ? c.json({ ok: true })
+            : c.json({ error: "invalid_token" }, 400);
+    }));
+    app.post(paths.verifyEmail, handle(async (c) => {
+        const body = await readBody(c);
+        const result = await service.verifyEmail(String(body.token ?? ""));
+        if (result.status === "success") {
+            return c.json({ ok: true, userId: result.userId });
+        }
+        return c.json({ error: `token_${result.status}` }, 400);
+    }));
+    return app;
+}

package/esm/adapters/hono/log.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Request logging that removes query values, including OAuth callback credentials.
+ *
+ * @module hono/log
+ */
+import "../../_dnt.polyfills.js";
+import type { MiddlewareHandler } from "hono";
+/**
+ * Produces a request target with every query value replaced by `[redacted]`.
+ * Keeps the pathname and percent-encoded parameter names, including repeats,
+ * and drops the origin and fragment. Use it before recording a request URL.
+ * Paths and parameter names must themselves contain no secrets.
+ *
+ * @param url An absolute request URL.
+ * @returns The pathname followed by redacted query parameters, if any.
+ * @throws TypeError if `url` is not a valid absolute URL.
+ *
+ * @example
+ * ```ts
+ * import { redactedRequestTarget } from "@udibo/oauth2/hono/log";
+ *
+ * const target = redactedRequestTarget(
+ *   "https://app.example.com/auth/callback?code=secret&state=nonce",
+ * );
+ * // "/auth/callback?code=[redacted]&state=[redacted]"
+ * ```
+ */
+export declare function redactedRequestTarget(url: string | URL): string;
+/**
+ * Logs Hono requests and responses without any query values. Mount before
+ * authentication routes so OAuth callback codes and state stay out of logs.
+ * Logs method, redacted target, response status, and elapsed milliseconds;
+ * does not log headers or bodies. Paths and parameter names remain visible.
+ *
+ * @param print Receives each log line; defaults to `console.log`, resolved per line.
+ * @returns Middleware emitting a request line and, after downstream completion,
+ * a response line.
+ *
+ * @example
+ * ```ts
+ * import { Hono } from "hono";
+ * import { requestLogger } from "@udibo/oauth2/hono/log";
+ *
+ * const app = new Hono();
+ * app.use(requestLogger());
+ * app.get("/", (c) => c.text("Hello"));
+ * ```
+ */
+export declare function requestLogger(print?: (line: string) => void): MiddlewareHandler;