@uln/auth 0.4.2 → 0.6.1

package/dist/hono.js

@@ -33,6 +33,8 @@ function base64urlEncode(data) {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 function base64urlDecode(str) {
+  if (!/^[A-Za-z0-9_-]*$/.test(str))
+    throw new Error("Invalid base64url");
   const padded = str.replace(/-/g, "+").replace(/_/g, "/");
   const binary = atob(padded);
   const bytes = new Uint8Array(binary.length);
@@ -60,8 +62,8 @@ async function importPrivateKey(jwk) {
 async function importPublicKey(jwk) {
   return crypto.subtle.importKey("jwk", jwk, ECDSA_PARAMS, false, ["verify"]);
 }
-async function createToken(config, user) {
-  const now = Math.floor(Date.now() / 1000);
+async function createToken(config, user, options = {}) {
+  const now = options.issuedAt ?? Math.floor(Date.now() / 1000);
   const payload = {
     sub: user.id,
     email: user.email,
@@ -71,7 +73,10 @@ async function createToken(config, user) {
     flags: user.flags,
     kid: config.kid,
     iat: now,
-    exp: now + config.maxAgeSeconds
+    exp: now + config.maxAgeSeconds,
+    ...user.audience === undefined ? {} : { aud: user.audience },
+    ...user.sessionId === undefined ? {} : { sid: user.sessionId },
+    ...user.deviceBound ? { dbsc: true } : {}
   };
   const payloadB64 = base64urlEncode(encoder.encode(JSON.stringify(payload)));
   const payloadBytes = encoder.encode(payloadB64);
@@ -79,25 +84,46 @@ async function createToken(config, user) {
   const sigB64 = base64urlEncode(new Uint8Array(signature));
   return `${payloadB64}.${sigB64}`;
 }
+var CLOCK_SKEW_SECONDS = 60;
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((v) => typeof v === "string");
+}
+function isFlags(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  return Object.values(value).every(isStringArray);
+}
+function isTokenPayload(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  if (!("sub" in value) || !("email" in value) || !("name" in value) || !("admin" in value) || !("scopes" in value) || !("flags" in value) || !("kid" in value) || !("iat" in value) || !("exp" in value)) {
+    return false;
+  }
+  return typeof value.sub === "string" && typeof value.email === "string" && typeof value.name === "string" && typeof value.admin === "boolean" && isStringArray(value.scopes) && isFlags(value.flags) && typeof value.kid === "string" && Number.isSafeInteger(value.iat) && Number.isSafeInteger(value.exp) && (!("aud" in value) || value.aud === undefined || typeof value.aud === "string") && (!("sid" in value) || value.sid === undefined || typeof value.sid === "string") && (!("dbsc" in value) || value.dbsc === undefined || typeof value.dbsc === "boolean");
+}
 async function validateToken(config, token) {
-  const dotIndex = token.indexOf(".");
-  if (dotIndex === -1)
+  const parts = token.split(".");
+  if (parts.length !== 2)
+    return null;
+  const [payloadB64 = "", sigB64 = ""] = parts;
+  if (!payloadB64 || !sigB64)
     return null;
-  const payloadB64 = token.substring(0, dotIndex);
-  const sigB64 = token.substring(dotIndex + 1);
-  let payload;
+  let decoded;
   try {
-    const decoded = new TextDecoder().decode(base64urlDecode(payloadB64));
-    payload = JSON.parse(decoded);
+    decoded = JSON.parse(new TextDecoder().decode(base64urlDecode(payloadB64)));
   } catch {
     return null;
   }
-  if (typeof payload.sub !== "string" || typeof payload.exp !== "number" || typeof payload.kid !== "string") {
+  if (!isTokenPayload(decoded))
     return null;
-  }
+  const payload = decoded;
   const now = Math.floor(Date.now() / 1000);
   if (now > payload.exp)
     return null;
+  if (payload.iat > now + CLOCK_SKEW_SECONDS)
+    return null;
+  if (now - payload.iat > config.maxAgeSeconds)
+    return null;
   const entry = config.publicKeys.find((k) => k.kid === payload.kid);
   if (!entry)
     return null;
@@ -112,10 +138,257 @@ async function validateToken(config, token) {
   }
   return payload;
 }
+function peekTokenPayload(token) {
+  const payloadB64 = token.split(".")[0];
+  if (!payloadB64)
+    return null;
+  try {
+    const decoded = JSON.parse(new TextDecoder().decode(base64urlDecode(payloadB64)));
+    return isTokenPayload(decoded) ? decoded : null;
+  } catch {
+    return null;
+  }
+}
+function peekTokenKid(token) {
+  const payloadB64 = token.split(".")[0];
+  if (!payloadB64)
+    return null;
+  try {
+    const decoded = JSON.parse(new TextDecoder().decode(base64urlDecode(payloadB64)));
+    if (typeof decoded !== "object" || decoded === null || !("kid" in decoded))
+      return null;
+    return typeof decoded.kid === "string" ? decoded.kid : null;
+  } catch {
+    return null;
+  }
+}
 
-// src/hono.ts
+// src/remote.ts
+function publicFetcher(authUrl) {
+  return { fetch: (path, init) => fetch(new URL(path, authUrl), init) };
+}
+function bindingFetcher(binding) {
+  return { fetch: (path, init) => binding.fetch(new URL(path, "https://auth").toString(), init) };
+}
+function isLoopbackHostname(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function toOrigin(value) {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return null;
+  }
+}
+function hasSiteAccess(payload, origin) {
+  return hasSiteAccessFor(payload, { audiences: [origin], scopeOrigin: origin });
+}
+function hasSiteAccessFor(payload, site) {
+  const scopeOrigin = toOrigin(site.scopeOrigin);
+  if (!scopeOrigin || payload.aud === undefined)
+    return false;
+  if (!site.audiences.some((audience) => toOrigin(audience) === payload.aud))
+    return false;
+  if (payload.admin)
+    return true;
+  if (isLoopbackHostname(new URL(scopeOrigin).hostname))
+    return true;
+  return payload.scopes.includes(scopeOrigin);
+}
+async function readJsonObject(res) {
+  try {
+    const body = await res.json();
+    return typeof body === "object" && body !== null ? body : null;
+  } catch {
+    return null;
+  }
+}
+async function exchangeAuthCode(auth, code, redirectOrigin, codeVerifier) {
+  const res = await auth.fetch("/api/exchange-code", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(codeVerifier === undefined ? { code, redirectOrigin } : { code, redirectOrigin, codeVerifier })
+  });
+  if (!res.ok)
+    return null;
+  const body = await readJsonObject(res);
+  if (!body || !("token" in body) || typeof body.token !== "string")
+    return null;
+  return body.token;
+}
+async function checkTokenRemote(auth, token, audience) {
+  let res;
+  try {
+    res = await auth.fetch("/api/verify-token", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(audience === undefined ? { token } : { token, audience })
+    });
+  } catch {
+    return { status: "unavailable" };
+  }
+  if (res.status >= 500)
+    return { status: "unavailable" };
+  if (!res.ok)
+    return { status: "invalid" };
+  const body = await readJsonObject(res);
+  if (!body || !("user" in body) || typeof body.user !== "object" || body.user === null)
+    return { status: "invalid" };
+  const user = body.user;
+  if (!("id" in user))
+    return { status: "invalid" };
+  const candidate = { ...user, sub: user.id, iat: "iat" in user ? user.iat : 0, exp: "exp" in user ? user.exp : 0 };
+  if (!isTokenPayload(candidate))
+    return { status: "invalid" };
+  return {
+    status: "valid",
+    payload: {
+      sub: candidate.sub,
+      email: candidate.email,
+      name: candidate.name,
+      admin: candidate.admin,
+      scopes: candidate.scopes,
+      flags: candidate.flags,
+      kid: candidate.kid,
+      iat: candidate.iat,
+      exp: candidate.exp,
+      ...candidate.aud === undefined ? {} : { aud: candidate.aud }
+    }
+  };
+}
+async function verifyTokenRemote(auth, token, audience) {
+  const result = await checkTokenRemote(auth, token, audience);
+  return result.status === "valid" ? result.payload : null;
+}
+async function fetchJwks(auth) {
+  const res = await auth.fetch("/.well-known/jwk.json");
+  if (!res.ok)
+    throw new Error(`Failed to fetch JWKS: ${res.status}`);
+  const body = await readJsonObject(res);
+  if (!body || !("keys" in body) || !Array.isArray(body.keys))
+    throw new Error("Malformed JWKS response");
+  const entries = [];
+  for (const jwk of body.keys) {
+    if (typeof jwk !== "object" || jwk === null || !("kid" in jwk) || typeof jwk.kid !== "string")
+      continue;
+    if (!("kty" in jwk) || typeof jwk.kty !== "string")
+      continue;
+    const { kid, ...keyData } = jwk;
+    entries.push({ kid, key: await importPublicKey({ ...keyData, kty: jwk.kty }) });
+  }
+  return entries;
+}
+
+// src/version.ts
+var LIBRARY_VERSION = "0.6.1";
+
+// src/flow.ts
 var DEFAULT_AUTH_URL = "https://auth.uln.industries";
-var DEFAULT_COOKIE = "uln_auth";
+var STATE_COOKIE = "__Host-uln_auth_state";
+var INSECURE_STATE_COOKIE = "uln_auth_state";
+var STATE_PARAM = "uln_state";
+var CHALLENGE_PARAM = "uln_challenge";
+var VERSION_PARAM = "uln_v";
+var STATE_MAX_AGE_SECONDS = 600;
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken() {
+  return base64url(crypto.getRandomValues(new Uint8Array(32)));
+}
+async function pkceChallenge(verifier) {
+  return base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+}
+function stateCookie(value, secure, maxAgeSeconds) {
+  const name = secure ? STATE_COOKIE : INSECURE_STATE_COOKIE;
+  const parts = [`${name}=${value}`, `Max-Age=${maxAgeSeconds}`, "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+function readStateCookie(request, secure) {
+  const name = secure ? STATE_COOKIE : INSECURE_STATE_COOKIE;
+  const [state = "", verifier = "", ...rest] = (extractCookie(request.headers.get("Cookie") ?? "", name) ?? "").split(".");
+  return state && verifier && rest.length === 0 ? { state, verifier } : null;
+}
+function stripCallbackParams(url) {
+  url.searchParams.delete("code");
+  url.searchParams.delete(STATE_PARAM);
+  url.searchParams.delete(CHALLENGE_PARAM);
+  url.searchParams.delete(VERSION_PARAM);
+}
+async function redirectToLogin(currentUrl, authUrl = DEFAULT_AUTH_URL) {
+  const returnUrl = new URL(currentUrl);
+  stripCallbackParams(returnUrl);
+  const state = randomToken();
+  const verifier = randomToken();
+  returnUrl.searchParams.set(STATE_PARAM, state);
+  returnUrl.searchParams.set(CHALLENGE_PARAM, await pkceChallenge(verifier));
+  returnUrl.searchParams.set(VERSION_PARAM, LIBRARY_VERSION);
+  const loginUrl = new URL("/login", authUrl);
+  loginUrl.searchParams.set("redirect", returnUrl.toString());
+  loginUrl.searchParams.set("response_type", "code");
+  const headers = new Headers({ Location: loginUrl.toString() });
+  headers.append("Set-Cookie", stateCookie(`${state}.${verifier}`, returnUrl.protocol === "https:", STATE_MAX_AGE_SECONDS));
+  return new Response(null, { status: 302, headers });
+}
+async function handleLoginCallback(request, options) {
+  const url = new URL(request.url);
+  const code = url.searchParams.get("code");
+  if (!code)
+    return null;
+  const state = url.searchParams.get(STATE_PARAM);
+  const secure = url.protocol === "https:";
+  const expected = readStateCookie(request, secure);
+  stripCallbackParams(url);
+  const startOver = () => redirectToLogin(url.toString(), options.authUrl);
+  if (!state || !expected || state !== expected.state)
+    return startOver();
+  const token = await exchangeAuthCode(options.auth, code, url.origin, expected.verifier);
+  if (!token)
+    return startOver();
+  const payload = await options.validate(token);
+  if (!payload)
+    return startOver();
+  const scopeOrigin = options.scopeOrigin ?? url.origin;
+  if (!hasSiteAccessFor(payload, { audiences: [url.origin, scopeOrigin], scopeOrigin })) {
+    return new Response("You don't have access to this site", { status: 403 });
+  }
+  const headers = new Headers({ Location: url.toString() });
+  headers.append("Set-Cookie", makeSessionCookie(options.cookieConfig, token));
+  headers.append("Set-Cookie", stateCookie("", secure, 0));
+  return new Response(null, { status: 302, headers });
+}
+var confirmedAt = new Map;
+var MAX_CONFIRMED = 5000;
+var DEFAULT_REVALIDATE_SECONDS = 300;
+async function revalidateToken(auth, token, local, audience, intervalSeconds = DEFAULT_REVALIDATE_SECONDS) {
+  const last = confirmedAt.get(token);
+  if (last !== undefined && Date.now() - last < intervalSeconds * 1000)
+    return local;
+  const result = await checkTokenRemote(auth, token, audience);
+  if (result.status === "unavailable")
+    return local;
+  confirmedAt.delete(token);
+  if (result.status === "invalid")
+    return null;
+  if (confirmedAt.size >= MAX_CONFIRMED) {
+    const oldest = confirmedAt.keys().next();
+    if (!oldest.done)
+      confirmedAt.delete(oldest.value);
+  }
+  confirmedAt.set(token, Date.now());
+  return result.payload;
+}
+function clearRevalidationCache() {
+  confirmedAt.clear();
+}
+
+// src/hono.ts
+var DEFAULT_COOKIE = "__Host-uln_auth";
 var DEFAULT_MAX_AGE = 86400;
 function isPublicPath(pathname, patterns) {
   for (const pattern of patterns) {
@@ -129,70 +402,31 @@ function isPublicPath(pathname, patterns) {
   }
   return false;
 }
-var cachedKeys = null;
-var cachedAt = 0;
-var CACHE_TTL = 3600000;
-async function getPublicKeys(authUrl) {
-  if (cachedKeys && Date.now() - cachedAt < CACHE_TTL) {
-    return cachedKeys;
+var keyCaches = new Map;
+var CACHE_TTL = 10 * 60000;
+var MIN_REFRESH_INTERVAL = 1e4;
+async function getPublicKeys(authUrl, wantedKid) {
+  const cached = keyCaches.get(authUrl);
+  const age = cached ? Date.now() - cached.fetchedAt : Number.POSITIVE_INFINITY;
+  const hasKid = wantedKid === null || cached?.keys.some((k) => k.kid === wantedKid);
+  if (cached && age < CACHE_TTL && (hasKid || age < MIN_REFRESH_INTERVAL)) {
+    return cached.keys;
   }
-  const res = await fetch(`${authUrl}/.well-known/jwk.json`);
-  if (!res.ok)
-    throw new Error(`Failed to fetch JWKS from ${authUrl}: ${res.status}`);
-  const jwks = await res.json();
-  cachedKeys = await Promise.all(jwks.keys.map(async (jwk) => ({
-    kid: jwk.kid,
-    key: await importPublicKey(jwk)
-  })));
-  cachedAt = Date.now();
-  return cachedKeys;
-}
-async function validateWithPublicKeys(token, authUrl, maxAge) {
-  const publicKeys = await getPublicKeys(authUrl);
-  return validateToken({ publicKeys, maxAgeSeconds: maxAge }, token);
-}
-async function validateWithBinding(token, binding) {
-  const res = await binding.fetch("https://auth/api/verify-token", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ token })
-  });
-  if (!res.ok)
-    return null;
-  const data = await res.json();
-  return {
-    sub: data.user.id,
-    email: data.user.email,
-    name: data.user.name,
-    admin: data.user.admin,
-    scopes: data.user.scopes,
-    flags: data.user.flags,
-    kid: data.user.kid,
-    iat: 0,
-    exp: 0
-  };
+  const keys = await fetchJwks(publicFetcher(authUrl));
+  keyCaches.set(authUrl, { keys, fetchedAt: Date.now() });
+  return keys;
 }
-async function exchangeCodeWithPublicEndpoint(code, redirectOrigin, authUrl) {
-  const res = await fetch(`${authUrl}/api/exchange-code`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ code, redirectOrigin })
-  });
-  if (!res.ok)
-    return null;
-  const data = await res.json();
-  return typeof data.token === "string" ? data.token : null;
+function clearPublicKeyCache() {
+  keyCaches.clear();
 }
-async function exchangeCodeWithBinding(code, redirectOrigin, binding) {
-  const res = await binding.fetch("https://auth/api/exchange-code", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ code, redirectOrigin })
-  });
-  if (!res.ok)
-    return null;
-  const data = await res.json();
-  return typeof data.token === "string" ? data.token : null;
+function isFetcher(value) {
+  return typeof value === "object" && value !== null && "fetch" in value && typeof value.fetch === "function";
+}
+function getBinding(env, name) {
+  const binding = typeof env === "object" && env !== null ? Reflect.get(env, name) : undefined;
+  if (!isFetcher(binding))
+    throw new Error(`Service binding "${name}" not found in env`);
+  return bindingFetcher(binding);
 }
 function auth(options) {
   const authUrl = options?.authUrl ?? DEFAULT_AUTH_URL;
@@ -200,55 +434,51 @@ function auth(options) {
   const maxAge = options?.maxAge ?? DEFAULT_MAX_AGE;
   const publicPaths = options?.public ?? [];
   const bindingName = options?.binding;
+  const revalidateSeconds = options?.revalidateSeconds ?? DEFAULT_REVALIDATE_SECONDS;
   const cookieConf = { name: cookieName, maxAgeSeconds: maxAge, secure: true };
-  async function validate(token, env) {
-    if (bindingName) {
-      const binding = env[bindingName];
-      if (!binding)
-        throw new Error(`Service binding "${bindingName}" not found in env`);
-      return validateWithBinding(token, binding);
-    }
-    return validateWithPublicKeys(token, authUrl, maxAge);
+  function authService(env) {
+    return bindingName ? getBinding(env, bindingName) : publicFetcher(authUrl);
   }
-  async function exchangeCode(code, redirectOrigin, env) {
+  async function validate(token, env, audiences) {
     if (bindingName) {
-      const binding = env[bindingName];
-      if (!binding)
-        throw new Error(`Service binding "${bindingName}" not found in env`);
-      return exchangeCodeWithBinding(code, redirectOrigin, binding);
+      const audience = peekTokenPayload(token)?.aud;
+      if (audience === undefined || !audiences.includes(audience))
+        return null;
+      return verifyTokenRemote(getBinding(env, bindingName), token, audience);
     }
-    return exchangeCodeWithPublicEndpoint(code, redirectOrigin, authUrl);
+    const publicKeys = await getPublicKeys(authUrl, peekTokenKid(token));
+    const local = await validateToken({ publicKeys, maxAgeSeconds: maxAge }, token);
+    if (!local || local.aud === undefined || !audiences.includes(local.aud))
+      return null;
+    if (revalidateSeconds <= 0)
+      return local;
+    return revalidateToken(publicFetcher(authUrl), token, local, local.aud, revalidateSeconds);
   }
   return async (c, next) => {
     const url = new URL(c.req.url);
+    const scopeOrigin = options?.siteOrigin ?? url.origin;
+    const site = { audiences: [url.origin, scopeOrigin], scopeOrigin };
     if (isPublicPath(url.pathname, publicPaths)) {
       return next();
     }
-    const incomingCode = url.searchParams.get("code");
-    if (incomingCode) {
-      const token = await exchangeCode(incomingCode, url.origin, c.env);
-      if (!token) {
-        return c.text("Invalid code", 401);
-      }
-      const payload = await validate(token, c.env);
-      if (!payload) {
-        return c.text("Invalid token", 401);
-      }
-      url.searchParams.delete("code");
-      return new Response(null, {
-        status: 302,
-        headers: {
-          Location: url.toString(),
-          "Set-Cookie": makeSessionCookie(cookieConf, token)
-        }
-      });
-    }
+    const callback = await handleLoginCallback(c.req.raw, {
+      auth: authService(c.env),
+      authUrl,
+      cookieConfig: cookieConf,
+      validate: (token) => validate(token, c.env, site.audiences),
+      scopeOrigin: site.scopeOrigin
+    });
+    if (callback)
+      return callback;
     const cookieHeader = c.req.header("Cookie");
     if (cookieHeader) {
       const token = extractCookie(cookieHeader, cookieName);
       if (token) {
-        const payload = await validate(token, c.env);
+        const payload = await validate(token, c.env, site.audiences);
         if (payload) {
+          if (!hasSiteAccessFor(payload, site)) {
+            return c.text("You don't have access to this site", 403);
+          }
           c.set("user", payload);
           return next();
         }
@@ -257,23 +487,25 @@ function auth(options) {
     const authHeader = c.req.header("Authorization");
     if (authHeader?.startsWith("Bearer ")) {
       const token = authHeader.substring(7);
-      const payload = await validate(token, c.env);
-      if (payload) {
-        c.set("user", payload);
-        return next();
-      }
-      return c.json({ error: "Invalid token" }, 401);
+      const payload = await validate(token, c.env, site.audiences);
+      if (!payload)
+        return c.json({ error: "Invalid token" }, 401);
+      if (!hasSiteAccessFor(payload, site))
+        return c.json({ error: "Forbidden" }, 403);
+      c.set("user", payload);
+      return next();
     }
-    const loginUrl = new URL("/login", authUrl);
-    loginUrl.searchParams.set("redirect", c.req.url);
-    loginUrl.searchParams.set("response_type", "code");
-    return c.redirect(loginUrl.toString(), 302);
+    return redirectToLogin(c.req.url, authUrl);
   };
 }
 function getUser(c) {
-  return c.get("user");
+  const user = c.get("user");
+  if (!user)
+    throw new Error("getUser() called on a route that is not behind the auth() middleware");
+  return user;
 }
 export {
-  getUser,
-  auth
+  auth,
+  clearPublicKeyCache,
+  getUser
 };

package/dist/index.d.ts

@@ -1,10 +1,11 @@
-export type { User, UserStore, RateLimitEntry, RateLimitStore, RateLimitConfig, TokenPayload, SigningConfig, VerifyConfig, PublicKeyEntry, CookieConfig, } from "./types.ts";
-export { hashPassword, verifyPassword } from "./password.ts";
-export { createToken, validateToken, generateKeyPair, importPrivateKey, importPublicKey } from "./token.ts";
-export type { CreateTokenInput } from "./token.ts";
-export { makeSessionCookie, makeClearCookie, extractCookie } from "./cookie.ts";
-export { checkRateLimit, recordFailedAttempt, clearRateLimit } from "./rate-limit.ts";
+export { extractCookie, makeClearCookie, makeSessionCookie } from "./cookie.ts";
+export { checkBearerToken, getAuthUser, getClientIP, redirectToLogin } from "./middleware.ts";
+export { hashPassword, MAX_PASSWORD_LENGTH, needsRehash, verifyPassword } from "./password.ts";
 export type { RateLimitResult } from "./rate-limit.ts";
-export { getClientIP, checkBearerToken, getAuthUser, redirectToLogin } from "./middleware.ts";
-export { createUser, verifyUserCredentials, changePassword, isValidEmail } from "./users.ts";
-export { generateTotpSecret, getTotpUri, verifyTotpCode, base32Encode, generateBackupCodes, hashBackupCode, } from "./totp.ts";
+export { checkRateLimit, clearRateLimit, consumeRateLimit, recordFailedAttempt } from "./rate-limit.ts";
+export { hasSiteAccess } from "./remote.ts";
+export type { CreateTokenInput } from "./token.ts";
+export { createToken, generateKeyPair, importPrivateKey, importPublicKey, isTokenPayload, validateToken, } from "./token.ts";
+export { base32Encode, generateBackupCodes, generateTotpSecret, getTotpUri, hashBackupCode, verifyTotpCode, verifyTotpStep, } from "./totp.ts";
+export type { CookieConfig, PublicKeyEntry, RateLimitConfig, RateLimitEntry, RateLimitStore, SigningConfig, TokenPayload, User, UserStore, VerifyConfig, } from "./types.ts";
+export { changePassword, createUser, isValidEmail, verifyUserCredentials } from "./users.ts";