@uln/auth 0.1.0

package/dist/client.d.ts

@@ -0,0 +1,4 @@
+export type { TokenPayload, TokenConfig, CookieConfig } from "./types.ts";
+export { createToken, validateToken } from "./token.ts";
+export { makeSessionCookie, makeClearCookie, extractCookie } from "./cookie.ts";
+export { getAuthUser, redirectToLogin, getClientIP, checkBearerToken } from "./middleware.ts";

package/dist/client.js

@@ -0,0 +1,129 @@
+// @bun
+// src/cookie.ts
+function makeSessionCookie(config, token) {
+  const parts = [`${config.name}=${token}`, `Max-Age=${config.maxAgeSeconds}`, "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+function makeClearCookie(config) {
+  const parts = [`${config.name}=`, "Max-Age=0", "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+function extractCookie(cookieHeader, name) {
+  const prefix = `${name}=`;
+  for (const cookie of cookieHeader.split(";")) {
+    const trimmed = cookie.trim();
+    if (trimmed.startsWith(prefix)) {
+      return trimmed.substring(prefix.length);
+    }
+  }
+  return null;
+}
+
+// src/token.ts
+var encoder = new TextEncoder;
+function base64urlEncode(data) {
+  let binary = "";
+  for (const byte of data) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlDecode(str) {
+  const padded = str.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0;i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+async function hmacSign(secret, data) {
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+    "sign"
+  ]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+  return base64urlEncode(new Uint8Array(signature));
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+async function createToken(config, user) {
+  const now = Math.floor(Date.now() / 1000);
+  const payload = {
+    sub: user.id,
+    email: user.email,
+    name: user.name,
+    admin: user.isAdmin,
+    scopes: user.scopes,
+    iat: now,
+    exp: now + config.maxAgeSeconds
+  };
+  const payloadB64 = base64urlEncode(encoder.encode(JSON.stringify(payload)));
+  const sig = await hmacSign(config.secret, payloadB64);
+  return `${payloadB64}.${sig}`;
+}
+async function validateToken(config, token) {
+  const dotIndex = token.indexOf(".");
+  if (dotIndex === -1)
+    return null;
+  const payloadB64 = token.substring(0, dotIndex);
+  const sig = token.substring(dotIndex + 1);
+  const expectedSig = await hmacSign(config.secret, payloadB64);
+  if (!timingSafeEqual(sig, expectedSig))
+    return null;
+  try {
+    const decoded = new TextDecoder().decode(base64urlDecode(payloadB64));
+    const payload = JSON.parse(decoded);
+    if (typeof payload.sub !== "string" || typeof payload.exp !== "number")
+      return null;
+    const now = Math.floor(Date.now() / 1000);
+    if (now > payload.exp)
+      return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+// src/middleware.ts
+function getClientIP(request) {
+  return request.headers.get("cf-connecting-ip") ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+}
+function checkBearerToken(request, expectedToken) {
+  const header = request.headers.get("Authorization");
+  return header === `Bearer ${expectedToken}`;
+}
+async function getAuthUser(request, tokenConfig, cookieConfig) {
+  const cookieHeader = request.headers.get("Cookie");
+  if (!cookieHeader)
+    return null;
+  const token = extractCookie(cookieHeader, cookieConfig.name);
+  if (!token)
+    return null;
+  return validateToken(tokenConfig, token);
+}
+function redirectToLogin(currentUrl) {
+  const loginUrl = `https://auth.uln.industries/login?redirect=${encodeURIComponent(currentUrl)}`;
+  return Response.redirect(loginUrl, 302);
+}
+export {
+  validateToken,
+  redirectToLogin,
+  makeSessionCookie,
+  makeClearCookie,
+  getClientIP,
+  getAuthUser,
+  extractCookie,
+  createToken,
+  checkBearerToken
+};

package/dist/cookie.d.ts

@@ -0,0 +1,4 @@
+import type { CookieConfig } from "./types.ts";
+export declare function makeSessionCookie(config: CookieConfig, token: string): string;
+export declare function makeClearCookie(config: CookieConfig): string;
+export declare function extractCookie(cookieHeader: string, name: string): string | null;

package/dist/cookie.js

@@ -0,0 +1,29 @@
+// @bun
+// src/cookie.ts
+function makeSessionCookie(config, token) {
+  const parts = [`${config.name}=${token}`, `Max-Age=${config.maxAgeSeconds}`, "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+function makeClearCookie(config) {
+  const parts = [`${config.name}=`, "Max-Age=0", "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+function extractCookie(cookieHeader, name) {
+  const prefix = `${name}=`;
+  for (const cookie of cookieHeader.split(";")) {
+    const trimmed = cookie.trim();
+    if (trimmed.startsWith(prefix)) {
+      return trimmed.substring(prefix.length);
+    }
+  }
+  return null;
+}
+export {
+  makeSessionCookie,
+  makeClearCookie,
+  extractCookie
+};

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export type { User, UserStore, RateLimitEntry, RateLimitStore, RateLimitConfig, TokenPayload, TokenConfig, CookieConfig, } from "./types.ts";
+export { hashPassword, verifyPassword } from "./password.ts";
+export { createToken, validateToken } from "./token.ts";
+export type { CreateTokenInput } from "./token.ts";
+export { makeSessionCookie, makeClearCookie, extractCookie } from "./cookie.ts";
+export { checkRateLimit, recordFailedAttempt, clearRateLimit } from "./rate-limit.ts";
+export type { RateLimitResult } from "./rate-limit.ts";
+export { getClientIP, checkBearerToken, getAuthUser, redirectToLogin } from "./middleware.ts";
+export { createUser, verifyUserCredentials, changePassword } from "./users.ts";

package/dist/index.js

@@ -0,0 +1,250 @@
+// @bun
+// src/cookie.ts
+function makeSessionCookie(config, token) {
+  const parts = [`${config.name}=${token}`, `Max-Age=${config.maxAgeSeconds}`, "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+function makeClearCookie(config) {
+  const parts = [`${config.name}=`, "Max-Age=0", "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+function extractCookie(cookieHeader, name) {
+  const prefix = `${name}=`;
+  for (const cookie of cookieHeader.split(";")) {
+    const trimmed = cookie.trim();
+    if (trimmed.startsWith(prefix)) {
+      return trimmed.substring(prefix.length);
+    }
+  }
+  return null;
+}
+
+// src/token.ts
+var encoder = new TextEncoder;
+function base64urlEncode(data) {
+  let binary = "";
+  for (const byte of data) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlDecode(str) {
+  const padded = str.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0;i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+async function hmacSign(secret, data) {
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+    "sign"
+  ]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+  return base64urlEncode(new Uint8Array(signature));
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+async function createToken(config, user) {
+  const now = Math.floor(Date.now() / 1000);
+  const payload = {
+    sub: user.id,
+    email: user.email,
+    name: user.name,
+    admin: user.isAdmin,
+    scopes: user.scopes,
+    iat: now,
+    exp: now + config.maxAgeSeconds
+  };
+  const payloadB64 = base64urlEncode(encoder.encode(JSON.stringify(payload)));
+  const sig = await hmacSign(config.secret, payloadB64);
+  return `${payloadB64}.${sig}`;
+}
+async function validateToken(config, token) {
+  const dotIndex = token.indexOf(".");
+  if (dotIndex === -1)
+    return null;
+  const payloadB64 = token.substring(0, dotIndex);
+  const sig = token.substring(dotIndex + 1);
+  const expectedSig = await hmacSign(config.secret, payloadB64);
+  if (!timingSafeEqual(sig, expectedSig))
+    return null;
+  try {
+    const decoded = new TextDecoder().decode(base64urlDecode(payloadB64));
+    const payload = JSON.parse(decoded);
+    if (typeof payload.sub !== "string" || typeof payload.exp !== "number")
+      return null;
+    const now = Math.floor(Date.now() / 1000);
+    if (now > payload.exp)
+      return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+// src/middleware.ts
+function getClientIP(request) {
+  return request.headers.get("cf-connecting-ip") ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+}
+function checkBearerToken(request, expectedToken) {
+  const header = request.headers.get("Authorization");
+  return header === `Bearer ${expectedToken}`;
+}
+async function getAuthUser(request, tokenConfig, cookieConfig) {
+  const cookieHeader = request.headers.get("Cookie");
+  if (!cookieHeader)
+    return null;
+  const token = extractCookie(cookieHeader, cookieConfig.name);
+  if (!token)
+    return null;
+  return validateToken(tokenConfig, token);
+}
+function redirectToLogin(currentUrl) {
+  const loginUrl = `https://auth.uln.industries/login?redirect=${encodeURIComponent(currentUrl)}`;
+  return Response.redirect(loginUrl, 302);
+}
+
+// src/password.ts
+var SALT_LENGTH = 32;
+var KEY_LENGTH = 64;
+var ITERATIONS = 1e5;
+function toHex(buffer) {
+  return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function fromHex(hex) {
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0;i < hex.length; i += 2) {
+    bytes[i / 2] = Number.parseInt(hex.substring(i, i + 2), 16);
+  }
+  return bytes;
+}
+async function deriveKey(password, salt) {
+  const encoder2 = new TextEncoder;
+  const keyMaterial = await crypto.subtle.importKey("raw", encoder2.encode(password), "PBKDF2", false, ["deriveBits"]);
+  return crypto.subtle.deriveBits({
+    name: "PBKDF2",
+    salt,
+    iterations: ITERATIONS,
+    hash: "SHA-256"
+  }, keyMaterial, KEY_LENGTH * 8);
+}
+async function hashPassword(password) {
+  const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
+  const derived = await deriveKey(password, salt);
+  return `${toHex(salt.buffer)}:${toHex(derived)}`;
+}
+async function verifyPassword(password, storedHash) {
+  const separatorIndex = storedHash.indexOf(":");
+  if (separatorIndex === -1)
+    return false;
+  const saltHex = storedHash.substring(0, separatorIndex);
+  const keyHex = storedHash.substring(separatorIndex + 1);
+  const salt = fromHex(saltHex);
+  const expectedKey = fromHex(keyHex);
+  const derived = new Uint8Array(await deriveKey(password, salt));
+  if (derived.length !== expectedKey.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < derived.length; i++) {
+    diff |= (derived[i] ?? 0) ^ (expectedKey[i] ?? 0);
+  }
+  return diff === 0;
+}
+
+// src/users.ts
+async function createUser(store, input) {
+  const existing = await store.getUserByEmail(input.email);
+  if (existing)
+    throw new Error(`User with email ${input.email} already exists`);
+  const now = new Date().toISOString();
+  const passwordHash = input.password ? await hashPassword(input.password) : await hashPassword(crypto.randomUUID());
+  const user = {
+    id: crypto.randomUUID(),
+    email: input.email.toLowerCase(),
+    name: input.name,
+    passwordHash,
+    isAdmin: input.isAdmin ?? false,
+    emailVerified: input.isAdmin ?? false,
+    createdAt: now,
+    updatedAt: now
+  };
+  await store.saveUser(user);
+  return user;
+}
+async function verifyUserCredentials(store, email, password) {
+  const user = await store.getUserByEmail(email.toLowerCase());
+  if (!user)
+    return null;
+  const valid = await verifyPassword(password, user.passwordHash);
+  return valid ? user : null;
+}
+async function changePassword(store, userId, newPassword) {
+  const user = await store.getUser(userId);
+  if (!user)
+    throw new Error(`User ${userId} not found`);
+  const updated = {
+    ...user,
+    passwordHash: await hashPassword(newPassword),
+    updatedAt: new Date().toISOString()
+  };
+  await store.saveUser(updated);
+}
+
+// src/rate-limit.ts
+async function checkRateLimit(store, key, config) {
+  const entry = await store.get(key);
+  if (!entry)
+    return { blocked: false };
+  if (entry.attempts >= config.maxAttempts) {
+    const elapsed = Math.floor((Date.now() - entry.firstAttempt) / 1000);
+    const remaining = config.windowSeconds - elapsed;
+    if (remaining > 0)
+      return { blocked: true, remainingSeconds: remaining };
+    await store.delete(key);
+    return { blocked: false };
+  }
+  return { blocked: false };
+}
+async function recordFailedAttempt(store, key, config) {
+  const entry = await store.get(key);
+  if (entry) {
+    await store.set(key, { attempts: entry.attempts + 1, firstAttempt: entry.firstAttempt }, config.windowSeconds);
+  } else {
+    await store.set(key, { attempts: 1, firstAttempt: Date.now() }, config.windowSeconds);
+  }
+}
+async function clearRateLimit(store, key) {
+  await store.delete(key);
+}
+export {
+  verifyUserCredentials,
+  verifyPassword,
+  validateToken,
+  redirectToLogin,
+  recordFailedAttempt,
+  makeSessionCookie,
+  makeClearCookie,
+  hashPassword,
+  getClientIP,
+  getAuthUser,
+  extractCookie,
+  createUser,
+  createToken,
+  clearRateLimit,
+  checkRateLimit,
+  checkBearerToken,
+  changePassword
+};

package/dist/middleware.d.ts

@@ -0,0 +1,5 @@
+import type { CookieConfig, TokenConfig, TokenPayload } from "./types.ts";
+export declare function getClientIP(request: Request): string;
+export declare function checkBearerToken(request: Request, expectedToken: string): boolean;
+export declare function getAuthUser(request: Request, tokenConfig: TokenConfig, cookieConfig: CookieConfig): Promise<TokenPayload | null>;
+export declare function redirectToLogin(currentUrl: string): Response;

package/dist/middleware.js

@@ -0,0 +1,124 @@
+// @bun
+// src/cookie.ts
+function makeSessionCookie(config, token) {
+  const parts = [`${config.name}=${token}`, `Max-Age=${config.maxAgeSeconds}`, "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+function makeClearCookie(config) {
+  const parts = [`${config.name}=`, "Max-Age=0", "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+function extractCookie(cookieHeader, name) {
+  const prefix = `${name}=`;
+  for (const cookie of cookieHeader.split(";")) {
+    const trimmed = cookie.trim();
+    if (trimmed.startsWith(prefix)) {
+      return trimmed.substring(prefix.length);
+    }
+  }
+  return null;
+}
+
+// src/token.ts
+var encoder = new TextEncoder;
+function base64urlEncode(data) {
+  let binary = "";
+  for (const byte of data) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlDecode(str) {
+  const padded = str.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0;i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+async function hmacSign(secret, data) {
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+    "sign"
+  ]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+  return base64urlEncode(new Uint8Array(signature));
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+async function createToken(config, user) {
+  const now = Math.floor(Date.now() / 1000);
+  const payload = {
+    sub: user.id,
+    email: user.email,
+    name: user.name,
+    admin: user.isAdmin,
+    scopes: user.scopes,
+    iat: now,
+    exp: now + config.maxAgeSeconds
+  };
+  const payloadB64 = base64urlEncode(encoder.encode(JSON.stringify(payload)));
+  const sig = await hmacSign(config.secret, payloadB64);
+  return `${payloadB64}.${sig}`;
+}
+async function validateToken(config, token) {
+  const dotIndex = token.indexOf(".");
+  if (dotIndex === -1)
+    return null;
+  const payloadB64 = token.substring(0, dotIndex);
+  const sig = token.substring(dotIndex + 1);
+  const expectedSig = await hmacSign(config.secret, payloadB64);
+  if (!timingSafeEqual(sig, expectedSig))
+    return null;
+  try {
+    const decoded = new TextDecoder().decode(base64urlDecode(payloadB64));
+    const payload = JSON.parse(decoded);
+    if (typeof payload.sub !== "string" || typeof payload.exp !== "number")
+      return null;
+    const now = Math.floor(Date.now() / 1000);
+    if (now > payload.exp)
+      return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+// src/middleware.ts
+function getClientIP(request) {
+  return request.headers.get("cf-connecting-ip") ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+}
+function checkBearerToken(request, expectedToken) {
+  const header = request.headers.get("Authorization");
+  return header === `Bearer ${expectedToken}`;
+}
+async function getAuthUser(request, tokenConfig, cookieConfig) {
+  const cookieHeader = request.headers.get("Cookie");
+  if (!cookieHeader)
+    return null;
+  const token = extractCookie(cookieHeader, cookieConfig.name);
+  if (!token)
+    return null;
+  return validateToken(tokenConfig, token);
+}
+function redirectToLogin(currentUrl) {
+  const loginUrl = `https://auth.uln.industries/login?redirect=${encodeURIComponent(currentUrl)}`;
+  return Response.redirect(loginUrl, 302);
+}
+export {
+  redirectToLogin,
+  getClientIP,
+  getAuthUser,
+  checkBearerToken
+};

package/dist/password.d.ts

@@ -0,0 +1,2 @@
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(password: string, storedHash: string): Promise<boolean>;

package/dist/password.js

@@ -0,0 +1,51 @@
+// @bun
+// src/password.ts
+var SALT_LENGTH = 32;
+var KEY_LENGTH = 64;
+var ITERATIONS = 1e5;
+function toHex(buffer) {
+  return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function fromHex(hex) {
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0;i < hex.length; i += 2) {
+    bytes[i / 2] = Number.parseInt(hex.substring(i, i + 2), 16);
+  }
+  return bytes;
+}
+async function deriveKey(password, salt) {
+  const encoder = new TextEncoder;
+  const keyMaterial = await crypto.subtle.importKey("raw", encoder.encode(password), "PBKDF2", false, ["deriveBits"]);
+  return crypto.subtle.deriveBits({
+    name: "PBKDF2",
+    salt,
+    iterations: ITERATIONS,
+    hash: "SHA-256"
+  }, keyMaterial, KEY_LENGTH * 8);
+}
+async function hashPassword(password) {
+  const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
+  const derived = await deriveKey(password, salt);
+  return `${toHex(salt.buffer)}:${toHex(derived)}`;
+}
+async function verifyPassword(password, storedHash) {
+  const separatorIndex = storedHash.indexOf(":");
+  if (separatorIndex === -1)
+    return false;
+  const saltHex = storedHash.substring(0, separatorIndex);
+  const keyHex = storedHash.substring(separatorIndex + 1);
+  const salt = fromHex(saltHex);
+  const expectedKey = fromHex(keyHex);
+  const derived = new Uint8Array(await deriveKey(password, salt));
+  if (derived.length !== expectedKey.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < derived.length; i++) {
+    diff |= (derived[i] ?? 0) ^ (expectedKey[i] ?? 0);
+  }
+  return diff === 0;
+}
+export {
+  verifyPassword,
+  hashPassword
+};

package/dist/rate-limit.d.ts

@@ -0,0 +1,8 @@
+import type { RateLimitConfig, RateLimitStore } from "./types.ts";
+export interface RateLimitResult {
+    blocked: boolean;
+    remainingSeconds?: number;
+}
+export declare function checkRateLimit(store: RateLimitStore, key: string, config: RateLimitConfig): Promise<RateLimitResult>;
+export declare function recordFailedAttempt(store: RateLimitStore, key: string, config: RateLimitConfig): Promise<void>;
+export declare function clearRateLimit(store: RateLimitStore, key: string): Promise<void>;

package/dist/rate-limit.js

@@ -0,0 +1,32 @@
+// @bun
+// src/rate-limit.ts
+async function checkRateLimit(store, key, config) {
+  const entry = await store.get(key);
+  if (!entry)
+    return { blocked: false };
+  if (entry.attempts >= config.maxAttempts) {
+    const elapsed = Math.floor((Date.now() - entry.firstAttempt) / 1000);
+    const remaining = config.windowSeconds - elapsed;
+    if (remaining > 0)
+      return { blocked: true, remainingSeconds: remaining };
+    await store.delete(key);
+    return { blocked: false };
+  }
+  return { blocked: false };
+}
+async function recordFailedAttempt(store, key, config) {
+  const entry = await store.get(key);
+  if (entry) {
+    await store.set(key, { attempts: entry.attempts + 1, firstAttempt: entry.firstAttempt }, config.windowSeconds);
+  } else {
+    await store.set(key, { attempts: 1, firstAttempt: Date.now() }, config.windowSeconds);
+  }
+}
+async function clearRateLimit(store, key) {
+  await store.delete(key);
+}
+export {
+  recordFailedAttempt,
+  clearRateLimit,
+  checkRateLimit
+};

package/dist/service.d.ts

@@ -0,0 +1,17 @@
+import type { CookieConfig, TokenPayload } from "./types.ts";
+export { makeSessionCookie, makeClearCookie } from "./cookie.ts";
+export type { TokenPayload, CookieConfig } from "./types.ts";
+/**
+ * Validate a raw token string via the auth service binding.
+ * Returns the token payload or null if invalid.
+ */
+export declare function verifyToken(authService: Fetcher, token: string): Promise<TokenPayload | null>;
+/**
+ * Get the authenticated user from the session cookie via the auth service binding.
+ * Returns the token payload or null if not authenticated.
+ */
+export declare function getAuthUser(request: Request, authService: Fetcher, cookieConfig: CookieConfig): Promise<TokenPayload | null>;
+/**
+ * Redirect to the centralized login page at auth.uln.industries.
+ */
+export declare function redirectToLogin(currentUrl: string): Response;