@ultimabase/auth 0.1.2-canary.20261030145550 → 0.2.0

package/CHANGELOG.md

@@ -1,11 +1,30 @@
 # @ultimabase/auth
 
-## 0.1.2-canary.20261030145550
+## 0.2.0
+
+### Minor Changes
+
+- fcca799: `User.closeAccount({ id }, { as })` closes an account and keeps its row: it ends the user's sessions, unlinks their accounts, and runs the listeners sign-in methods register with `AuthApi.onCloseAccount`. password's deletes the hash, the tokens and the email requests, and sets `emailVerified` to `false`, so the email signs up again.
+- 99cdfec: `password()` adds a unique `email` field to the user model, which the user and Master read and only Master writes; the password account follows it. `requestEmailChange` and `confirmEmailChange` change the email from a link sent to the new address, and `sendEmail` tells the old one with an `'emailChanged'` email. `AuthApi.unlinkAccount` unlinks one method's account.
+
+  Breaking: `Email` is a union, so read `token` after checking `kind`; a user model that declares its own `email` stops startup; users stored before this release read `email: null` until a Master `User.update({ where: { id }, data: { email } })` writes their account's email.
+
+- fd1263e: A plugin's context gives `dependents`, the plugins that require it, and auth warns at start when no sign-in method requires it (D-164).
+- 6d4f980: `authPlugin({ sessions: { lifetime, longest } })` sets how long sessions last, in milliseconds: 30 days after the last use and 365 days after the sign-in by default (D-165). A session is renewed with less than half its lifetime left. The session cookie's `Max-Age` is now the longest, 365 days by default instead of 400.
+
+### Patch Changes
+
+- Updated dependencies [2c3bf4e]
+- Updated dependencies [fd1263e]
+  - ultimabase@0.2.0
+  - @ultimabase/http@0.2.0
+
+## 0.1.2
 
 ### Patch Changes
 
-- @ultimabase/http@0.1.2-canary.20261030145550
-  - ultimabase@0.1.2-canary.20261030145550
+- @ultimabase/http@0.1.2
+  - ultimabase@0.1.2
 
 ## 0.1.1
 

package/dist/accounts.d.ts

@@ -16,5 +16,7 @@ export declare function accountOf(method: string, subject: string): Promise<{
 export declare function subjectOf(userId: string, method: string): Promise<string | undefined>;
 /** Unlinks every account of a user. */
 export declare function unlinkAccounts(userId: string): Promise<void>;
+/** Unlinks `userId`'s account of `method`; none linked is no error (D-162). */
+export declare function unlinkAccount(userId: string, method: string): Promise<void>;
 export {};
 //# sourceMappingURL=accounts.d.ts.map

package/dist/accounts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../src/accounts.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAK/D,KAAK,aAAa,GAAG;IACpB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CACtD,CAAA;AAED,gCAAgC;AAChC,eAAO,MAAM,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,CAY/D,CAAA;AAEH,qFAAqF;AACrF,wBAAsB,WAAW,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,0DAA0D;AAC1D,wBAAsB,SAAS,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAMlD;AAED,uEAAuE;AACvE,wBAAsB,SAAS,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAM7B;AAED,uCAAuC;AACvC,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE"}
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../src/accounts.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAK/D,KAAK,aAAa,GAAG;IACpB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CACtD,CAAA;AAED,gCAAgC;AAChC,eAAO,MAAM,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,CAY/D,CAAA;AAEH,qFAAqF;AACrF,wBAAsB,WAAW,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,0DAA0D;AAC1D,wBAAsB,SAAS,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAMlD;AAED,uEAAuE;AACvE,wBAAsB,SAAS,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAM7B;AAED,uCAAuC;AACvC,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED,+EAA+E;AAC/E,wBAAsB,aAAa,CAClC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/accounts.js

@@ -31,3 +31,7 @@ export async function subjectOf(userId, method) {
 export async function unlinkAccounts(userId) {
     await AuthAccount.deleteMany({ where: { userId } }, M);
 }
+/** Unlinks `userId`'s account of `method`; none linked is no error (D-162). */
+export async function unlinkAccount(userId, method) {
+    await AuthAccount.deleteMany({ where: { userId, method } }, M);
+}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { defineUser } from './define-user.ts';
-export type { Auth, AuthApi, AuthCommands, Opened } from './plugin.ts';
+export type { Auth, AuthApi, AuthCommands, AuthOptions, Opened, } from './plugin.ts';
 export { authPlugin } from './plugin.ts';
 export { currentUser, isAuthenticated, isOwner, isSelf, signedIn, } from './rules.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EACN,WAAW,EACX,eAAe,EACf,OAAO,EACP,MAAM,EACN,QAAQ,GACR,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,YAAY,EACX,IAAI,EACJ,OAAO,EACP,YAAY,EACZ,WAAW,EACX,MAAM,GACN,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EACN,WAAW,EACX,eAAe,EACf,OAAO,EACP,MAAM,EACN,QAAQ,GACR,MAAM,YAAY,CAAA"}

package/dist/plugin.d.ts

@@ -1,6 +1,6 @@
 import type { Http } from '@ultimabase/http';
 import type { Client, Identity, OutputSpec, PluginOf, PluginTypes, UseOf } from 'ultimabase';
-import type { Opened } from './sessions.ts';
+import type { Durations, Opened } from './sessions.ts';
 export type { Opened } from './sessions.ts';
 /** What auth offers the sign-in methods (D-33, D-112, D-113). */
 export interface AuthApi {
@@ -19,6 +19,18 @@ export interface AuthApi {
     } | undefined>;
     /** The subject `userId` is known by to `method`, if linked (D-117). */
     subjectOf(userId: string, method: string): Promise<string | undefined>;
+    /** Unlinks `userId`'s account of `method`; none linked is no error (D-162). */
+    unlinkAccount(userId: string, method: string): Promise<void>;
+    /**
+     * Runs `listener` in the transaction of each `User.closeAccount`, after
+     * the user's accounts are unlinked: a method deletes what it keeps.
+     */
+    onCloseAccount(listener: (userId: string) => Promise<void>): void;
+}
+/** `authPlugin()`'s options (D-165). */
+export interface AuthOptions {
+    /** How long sessions last, in milliseconds: 30 and 365 days by default. */
+    readonly sessions?: Partial<Durations>;
 }
 /** auth's commands on the user model (D-113). */
 export interface AuthCommands {
@@ -28,11 +40,21 @@ export interface AuthCommands {
     }, options?: {
         readonly as?: Identity;
     }): Promise<void>;
+    /**
+     * Ends every session of the user and unlinks every account, keeping the
+     * row, as Master or as the user (D-160).
+     */
+    closeAccount(where: {
+        readonly id: string;
+    }, options?: {
+        readonly as?: Identity;
+    }): Promise<void>;
 }
 /** auth's types (D-57). */
 export interface Auth extends PluginTypes {
     readonly name: 'auth';
     readonly requires: Http;
+    readonly appOptions: AuthOptions;
     readonly api: AuthApi;
     readonly commands: AuthCommands;
 }

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAE5C,OAAO,KAAK,EACX,MAAM,EACN,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,WAAW,EAEX,KAAK,EAEL,MAAM,YAAY,CAAA;AAmBnB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAW3C,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAE3C,iEAAiE;AACjE,MAAM,WAAW,OAAO;IACvB;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACxD,oCAAoC;IACpC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,qFAAqF;IACrF,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3E,0DAA0D;IAC1D,SAAS,CACR,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACnD,uEAAuE;IACvE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CACtE;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC5B,gEAAgE;IAChE,cAAc,CACb,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAC9B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAA;KAAE,GAClC,OAAO,CAAC,IAAI,CAAC,CAAA;CAChB;AAED,2BAA2B;AAC3B,MAAM,WAAW,IAAK,SAAQ,WAAW;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;IACvB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;CAC/B;AAED,gFAAgF;AAChF,eAAO,MAAM,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,CAAiB,CAAA;AA6IpE,2EAA2E;AAC3E,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAe,CAAA;AACrD,uEAAuE;AACvE,eAAO,MAAM,OAAO,EAAE,KAAK,CAAC,IAAI,CAAY,CAAA"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAE5C,OAAO,KAAK,EACX,MAAM,EACN,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,WAAW,EAEX,KAAK,EAEL,MAAM,YAAY,CAAA;AAsBnB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAYtD,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAE3C,iEAAiE;AACjE,MAAM,WAAW,OAAO;IACvB;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACxD,oCAAoC;IACpC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,qFAAqF;IACrF,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3E,0DAA0D;IAC1D,SAAS,CACR,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACnD,uEAAuE;IACvE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACtE,+EAA+E;IAC/E,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5D;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CACjE;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;CACtC;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC5B,gEAAgE;IAChE,cAAc,CACb,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAC9B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAA;KAAE,GAClC,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB;;;OAGG;IACH,YAAY,CACX,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAC9B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAA;KAAE,GAClC,OAAO,CAAC,IAAI,CAAC,CAAA;CAChB;AAED,2BAA2B;AAC3B,MAAM,WAAW,IAAK,SAAQ,WAAW;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAA;IAChC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;CAC/B;AAED,gFAAgF;AAChF,eAAO,MAAM,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,CAAiB,CAAA;AA8LpE,2EAA2E;AAC3E,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAe,CAAA;AACrD,uEAAuE;AACvE,eAAO,MAAM,OAAO,EAAE,KAAK,CAAC,IAAI,CAAY,CAAA"}

package/dist/plugin.js

@@ -1,15 +1,18 @@
 import { httpPlugin } from '@ultimabase/http';
-import { definePlugin, isLocalHost, isMaster, master, PublicError, Refused, } from 'ultimabase';
+import { definePlugin, isLocalHost, isMaster, master, PublicError, Refused, transaction, } from 'ultimabase';
+import { runningApi } from 'ultimabase/internal';
 import manifest from '../package.json' with { type: 'json' };
-import { accountOf, AuthAccount, linkAccount, subjectOf, unlinkAccounts, } from './accounts.js';
+import { accountOf, AuthAccount, linkAccount, subjectOf, unlinkAccount, unlinkAccounts, } from './accounts.js';
 import { authFunctions, callerTokens } from './functions.js';
-import { AuthSession, closeSession, openSession, revokeSessions, sessionOf, } from './sessions.js';
+import { AuthSession, closeSession, durationsOf, openSession, revokeSessions, sessionOf, } from './sessions.js';
 import { bearerOf, cookieAge, cookieOf, cookieTokenOf } from './token.js';
 /** The models `defineUser` returned, each with its output `User`, or `null`. */
 export const userModels = new WeakMap();
 const states = new WeakMap();
 /** The contexts whose insecure cookie was warned about (D-115). */
 const warned = new WeakSet();
+/** What `onCloseAccount` was given, by auth's API. */
+const closers = new WeakMap();
 const M = { as: master };
 function stateOf(context) {
     const state = states.get(context);
@@ -17,6 +20,19 @@ function stateOf(context) {
         throw new Error('auth has not started.');
     return state;
 }
+/** Refuses a caller that is neither Master nor the user `id`. */
+function selfOrMaster(caller, id, command) {
+    const self = caller?.kind === 'user' && caller.user.id === id;
+    if (!self && (caller === undefined || !isMaster(caller))) {
+        throw new PublicError('ACCESS_DENIED', `User.${command} runs as Master or as the user.`);
+    }
+}
+/** The listeners the running application's methods gave `onCloseAccount`. */
+function closersOf() {
+    const api = runningApi('auth');
+    const listeners = typeof api === 'object' && api !== null ? closers.get(api) : undefined;
+    return listeners ?? [];
+}
 /** The one user model among the application's models (D-62). */
 function usersOf(models) {
     const [first, second] = models.flatMap(({ queries }) => {
@@ -32,8 +48,8 @@ function usersOf(models) {
     return first;
 }
 /** A session token's caller, until it ends; `undefined` for an unknown one. */
-async function callerOf(token, users, expires) {
-    const session = await sessionOf(token);
+async function callerOf(token, { users, durations }, expires) {
+    const session = await sessionOf(token, durations);
     if (session === undefined)
         return undefined;
     // A transport's queries are untyped; this is the user model's row.
@@ -61,11 +77,19 @@ const auth = definePlugin({
     },
     commands: () => ({
         revokeSessions: async ({ id }, options) => {
-            const caller = options?.as;
-            const self = caller?.kind === 'user' && caller.user.id === id;
-            if (!self && (caller === undefined || !isMaster(caller))) {
-                throw new PublicError('ACCESS_DENIED', 'User.revokeSessions runs as Master or as the user.');
-            }
+            selfOrMaster(options?.as, id, 'revokeSessions');
+            await revokeSessions(id);
+        },
+        closeAccount: async ({ id }, options) => {
+            selfOrMaster(options?.as, id, 'closeAccount');
+            await transaction(async () => {
+                await revokeSessions(id);
+                await unlinkAccounts(id);
+                for (const listener of closersOf())
+                    await listener(id);
+            });
+            // Again once the accounts are gone: a sign-in that read one before
+            // opened its session before this ends it.
             await revokeSessions(id);
         },
     }),
@@ -74,17 +98,22 @@ const auth = definePlugin({
     // Built before any plugin starts, so before the server listens.
     api: (context) => {
         const cookie = cookieOf();
-        states.set(context, { cookie, users: usersOf(context.models) });
-        return {
+        const durations = durationsOf(context.options.sessions);
+        const users = usersOf(context.models);
+        states.set(context, { cookie, users, durations });
+        // The cookie goes when its session can live no longer.
+        const maxAge = Math.min(Math.ceil(durations.longest / 1000), cookieAge);
+        const listeners = [];
+        const api = {
             signIn: async (userId, client) => {
                 // The cookie it replaces would leave a session nobody can end (D-115).
                 const replaced = client?.cookies.get(cookie.name);
                 if (replaced !== undefined)
                     await closeSession(replaced);
-                const opened = await openSession(userId);
+                const opened = await openSession(userId, durations);
                 client?.cookies.set(cookie.name, opened.token, {
                     ...cookie.options,
-                    maxAge: cookieAge,
+                    maxAge,
                 });
                 return opened;
             },
@@ -92,10 +121,23 @@ const auth = definePlugin({
             linkAccount,
             accountOf,
             subjectOf,
+            unlinkAccount,
+            onCloseAccount: (listener) => {
+                listeners.push(listener);
+            },
         };
+        closers.set(api, listeners);
+        return api;
+    },
+    // A sign-in method requires auth: without one, nobody signs in (D-164).
+    start: ({ dependents, logger }) => {
+        if (dependents.length > 0)
+            return;
+        logger.warn('authPlugin() has no sign-in method: add one, as passwordPlugin().');
     },
     identify: async (request, context) => {
-        const { cookie, users } = stateOf(context);
+        const state = stateOf(context);
+        const { cookie } = state;
         const { hostname } = new URL(request.url);
         if (!cookie.options.secure &&
             !warned.has(context) &&
@@ -105,7 +147,7 @@ const auth = definePlugin({
         }
         const bearer = bearerOf(request);
         if (bearer !== undefined) {
-            const caller = await callerOf(bearer, users, context.expires);
+            const caller = await callerOf(bearer, state, context.expires);
             if (caller !== undefined)
                 return caller;
             throw new PublicError('UNAUTHENTICATED', 'The session expired or was revoked: sign in again.');
@@ -115,7 +157,7 @@ const auth = definePlugin({
         const token = cookieTokenOf(request, cookie);
         if (token === undefined)
             return undefined;
-        return callerOf(token, users, context.expires);
+        return callerOf(token, state, context.expires);
     },
 });
 /** Sessions and the caller of each request; it requires `httpPlugin()`. */

package/dist/sessions.d.ts

@@ -1,4 +1,13 @@
 import type { Field, ModelOf, ScalarOptions } from 'ultimabase';
+/** How long sessions last, in milliseconds (D-165). */
+export interface Durations {
+    /** After the last use; a session used with less than half left is renewed. */
+    readonly lifetime: number;
+    /** After the sign-in, which no renewal goes past (D-115). */
+    readonly longest: number;
+}
+/** `authPlugin`'s `sessions`, checked, with 30 and 365 days by default. */
+export declare function durationsOf(sessions?: Partial<Durations>): Durations;
 type SessionFields = {
     readonly tokenHash: Field<string, {
         readonly unique: true;
@@ -14,13 +23,13 @@ export interface Opened {
     readonly expiresAt: Date;
 }
 /** Opens a session for `userId`, ending every expired one (D-115). */
-export declare function openSession(userId: string): Promise<Opened>;
+export declare function openSession(userId: string, { lifetime }: Durations): Promise<Opened>;
 /**
- * The session `token` opened, renewed when it has less than 15 days left, up
- * to one year after its sign-in; `undefined` for an unknown one, or an
- * expired one, deleted.
+ * The session `token` opened, renewed when it has less than half its lifetime
+ * left, up to the longest after its sign-in; `undefined` for an unknown one,
+ * or an expired one, deleted.
  */
-export declare function sessionOf(token: string): Promise<{
+export declare function sessionOf(token: string, { lifetime, longest }: Durations): Promise<{
     readonly userId: string;
     readonly expiresAt: Date;
 } | undefined>;

package/dist/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAW/D,KAAK,aAAa,GAAG;IACpB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IAC5D,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;CACpD,CAAA;AAED,gCAAgC;AAChC,eAAO,MAAM,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,CAS/D,CAAA;AAKH,oDAAoD;AACpD,MAAM,WAAW,MAAM;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACxB;AAED,sEAAsE;AACtE,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAajE;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC9B,KAAK,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,CAAC,CA2B5E;AAED,+CAA+C;AAC/C,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/D;AAED,oCAAoC;AACpC,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAM/D,uDAAuD;AACvD,MAAM,WAAW,SAAS;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAID,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,QAAQ,GAAE,OAAO,CAAC,SAAS,CAAM,GAAG,SAAS,CAWxE;AAED,KAAK,aAAa,GAAG;IACpB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IAC5D,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;CACpD,CAAA;AAED,gCAAgC;AAChC,eAAO,MAAM,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,CAS/D,CAAA;AAKH,oDAAoD;AACpD,MAAM,WAAW,MAAM;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACxB;AAED,sEAAsE;AACtE,wBAAsB,WAAW,CAChC,MAAM,EAAE,MAAM,EACd,EAAE,QAAQ,EAAE,EAAE,SAAS,GACrB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC9B,KAAK,EAAE,MAAM,EACb,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,SAAS,GAC9B,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,CAAC,CA2B5E;AAED,+CAA+C;AAC/C,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/D;AAED,oCAAoC;AACpC,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE"}

package/dist/sessions.js

@@ -1,15 +1,22 @@
 // Sessions (D-112): an opaque token, of which the database keeps only the
-// SHA-256 digest, ending 30 days after its last use and one year after its
-// sign-in (D-115).
+// SHA-256 digest, ending a lifetime after its last use and at the longest
+// after its sign-in (D-115), both the application's (D-165).
 import { createHash, randomBytes } from 'node:crypto';
-import { defineModel, master, PublicError } from 'ultimabase';
+import { defineModel, master, PublicError, Refused } from 'ultimabase';
 const M = { as: master };
 const day = 24 * 60 * 60 * 1000;
-const lifetime = 30 * day;
-/** A session used with less left gets its lifetime again. */
-const renewal = 15 * day;
-/** No renewal takes a session past this long after its sign-in (D-115). */
-const longest = 365 * day;
+const positive = (value) => Number.isFinite(value) && value > 0;
+/** `authPlugin`'s `sessions`, checked, with 30 and 365 days by default. */
+export function durationsOf(sessions = {}) {
+    const { lifetime = 30 * day, longest = 365 * day } = sessions;
+    if (!positive(lifetime) || !positive(longest)) {
+        throw new Refused('authPlugin() sessions: lifetime and longest are positive numbers of milliseconds.');
+    }
+    if (lifetime > longest) {
+        throw new Refused('authPlugin() sessions: lifetime is longer than longest.');
+    }
+    return { lifetime, longest };
+}
 /** auth's own model (D-110). */
 export const AuthSession = defineModel({
     name: 'AuthSession',
@@ -22,7 +29,7 @@ export const AuthSession = defineModel({
 });
 const digest = (token) => createHash('sha256').update(token).digest('base64url');
 /** Opens a session for `userId`, ending every expired one (D-115). */
-export async function openSession(userId) {
+export async function openSession(userId, { lifetime }) {
     const now = Date.now();
     await AuthSession.deleteMany({ where: { expiresAt: { lte: new Date(now) } } }, M);
     const token = randomBytes(32).toString('base64url');
@@ -31,11 +38,11 @@ export async function openSession(userId) {
     return { token, expiresAt };
 }
 /**
- * The session `token` opened, renewed when it has less than 15 days left, up
- * to one year after its sign-in; `undefined` for an unknown one, or an
- * expired one, deleted.
+ * The session `token` opened, renewed when it has less than half its lifetime
+ * left, up to the longest after its sign-in; `undefined` for an unknown one,
+ * or an expired one, deleted.
  */
-export async function sessionOf(token) {
+export async function sessionOf(token, { lifetime, longest }) {
     const tokenHash = digest(token);
     const session = await AuthSession.findUnique({ where: { tokenHash } }, M);
     if (session === null)
@@ -47,7 +54,7 @@ export async function sessionOf(token) {
         return undefined;
     }
     const end = Math.min(now + lifetime, session.createdAt.getTime() + longest);
-    if (left < renewal && end > session.expiresAt.getTime()) {
+    if (left < lifetime / 2 && end > session.expiresAt.getTime()) {
         try {
             await AuthSession.update({ where: { tokenHash }, data: { expiresAt: new Date(end) } }, M);
         }

package/dist/token.d.ts

@@ -1,5 +1,5 @@
 import type { CookieOptions } from 'ultimabase';
-/** The longest a browser keeps a cookie: 400 days. */
+/** The longest a browser keeps a cookie: 400 days, in seconds. */
 export declare const cookieAge: number;
 /** The cookie's name and attributes, read once when the application starts. */
 export interface Cookie {

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,sDAAsD;AACtD,eAAO,MAAM,SAAS,EAAE,MAA2B,CAAA;AAEnD,+EAA+E;AAC/E,MAAM,WAAW,MAAM;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAC/B;AAED,6EAA6E;AAC7E,wBAAgB,QAAQ,IAAI,MAAM,CAOjC;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAK7D;AAED,0CAA0C;AAC1C,wBAAgB,aAAa,CAC5B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAOpB"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,kEAAkE;AAClE,eAAO,MAAM,SAAS,EAAE,MAA2B,CAAA;AAEnD,+EAA+E;AAC/E,MAAM,WAAW,MAAM;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAC/B;AAED,6EAA6E;AAC7E,wBAAgB,QAAQ,IAAI,MAAM,CAOjC;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAK7D;AAED,0CAA0C;AAC1C,wBAAgB,aAAa,CAC5B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAOpB"}

package/dist/token.js

@@ -1,4 +1,4 @@
-/** The longest a browser keeps a cookie: 400 days. */
+/** The longest a browser keeps a cookie: 400 days, in seconds. */
 export const cookieAge = 400 * 24 * 60 * 60;
 /** Secure and `__Host-` in production, so it works on `http://localhost`. */
 export function cookieOf() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimabase/auth",
-  "version": "0.1.2-canary.20261030145550",
+  "version": "0.2.0",
   "description": "Authentication for UltimaBase: the user model, sessions and the caller of each request.",
   "type": "module",
   "license": "Apache-2.0",
@@ -31,18 +31,18 @@
     }
   },
   "peerDependencies": {
-    "@ultimabase/http": "0.1.2-canary.20261030145550",
-    "ultimabase": "0.1.2-canary.20261030145550"
+    "@ultimabase/http": "^0.2.0",
+    "ultimabase": "^0.2.0"
   },
   "devDependencies": {
     "@types/pg": "8.23.1",
-    "@ultimabase/graphql": "0.1.2-canary.20261030145550",
-    "@ultimabase/http": "0.1.2-canary.20261030145550",
-    "@ultimabase/postgres": "0.1.2-canary.20261030145550",
-    "@ultimabase/testing": "0.1.2-canary.20261030145550",
+    "@ultimabase/graphql": "0.2.0",
+    "@ultimabase/http": "0.2.0",
+    "@ultimabase/postgres": "0.2.0",
+    "@ultimabase/testing": "0.2.0",
     "graphql": "17.0.2",
     "pg": "8.23.1",
-    "ultimabase": "0.1.2-canary.20261030145550",
+    "ultimabase": "0.2.0",
     "vite": "8.3.4",
     "vitest": "5.0.5"
   }

package/src/accounts.ts

@@ -63,3 +63,11 @@ export async function subjectOf(
 export async function unlinkAccounts(userId: string): Promise<void> {
 	await AuthAccount.deleteMany({ where: { userId } }, M)
 }
+
+/** Unlinks `userId`'s account of `method`; none linked is no error (D-162). */
+export async function unlinkAccount(
+	userId: string,
+	method: string,
+): Promise<void> {
+	await AuthAccount.deleteMany({ where: { userId, method } }, M)
+}

package/src/index.ts

@@ -1,7 +1,13 @@
 // `@ultimabase/auth` (D-112, D-113): the user model, sessions, linked
 // accounts, the caller of each request, and the rules that read it.
 export { defineUser } from './define-user.ts'
-export type { Auth, AuthApi, AuthCommands, Opened } from './plugin.ts'
+export type {
+	Auth,
+	AuthApi,
+	AuthCommands,
+	AuthOptions,
+	Opened,
+} from './plugin.ts'
 export { authPlugin } from './plugin.ts'
 export {
 	currentUser,

package/src/plugin.ts

@@ -20,21 +20,25 @@ import {
 	master,
 	PublicError,
 	Refused,
+	transaction,
 } from 'ultimabase'
+import { runningApi } from 'ultimabase/internal'
 import manifest from '../package.json' with { type: 'json' }
 import {
 	accountOf,
 	AuthAccount,
 	linkAccount,
 	subjectOf,
+	unlinkAccount,
 	unlinkAccounts,
 } from './accounts.ts'
 import type { Users } from './functions.ts'
 import { authFunctions, callerTokens } from './functions.ts'
-import type { Opened } from './sessions.ts'
+import type { Durations, Opened } from './sessions.ts'
 import {
 	AuthSession,
 	closeSession,
+	durationsOf,
 	openSession,
 	revokeSessions,
 	sessionOf,
@@ -62,6 +66,19 @@ export interface AuthApi {
 	): Promise<{ readonly userId: string } | undefined>
 	/** The subject `userId` is known by to `method`, if linked (D-117). */
 	subjectOf(userId: string, method: string): Promise<string | undefined>
+	/** Unlinks `userId`'s account of `method`; none linked is no error (D-162). */
+	unlinkAccount(userId: string, method: string): Promise<void>
+	/**
+	 * Runs `listener` in the transaction of each `User.closeAccount`, after
+	 * the user's accounts are unlinked: a method deletes what it keeps.
+	 */
+	onCloseAccount(listener: (userId: string) => Promise<void>): void
+}
+
+/** `authPlugin()`'s options (D-165). */
+export interface AuthOptions {
+	/** How long sessions last, in milliseconds: 30 and 365 days by default. */
+	readonly sessions?: Partial<Durations>
 }
 
 /** auth's commands on the user model (D-113). */
@@ -71,12 +88,21 @@ export interface AuthCommands {
 		where: { readonly id: string },
 		options?: { readonly as?: Identity },
 	): Promise<void>
+	/**
+	 * Ends every session of the user and unlinks every account, keeping the
+	 * row, as Master or as the user (D-160).
+	 */
+	closeAccount(
+		where: { readonly id: string },
+		options?: { readonly as?: Identity },
+	): Promise<void>
 }
 
 /** auth's types (D-57). */
 export interface Auth extends PluginTypes {
 	readonly name: 'auth'
 	readonly requires: Http
+	readonly appOptions: AuthOptions
 	readonly api: AuthApi
 	readonly commands: AuthCommands
 }
@@ -88,10 +114,13 @@ export const userModels: WeakMap<object, OutputSpec> = new WeakMap()
 interface State {
 	readonly cookie: Cookie
 	readonly users: Users
+	readonly durations: Durations
 }
 const states = new WeakMap<object, State>()
 /** The contexts whose insecure cookie was warned about (D-115). */
 const warned = new WeakSet<object>()
+/** What `onCloseAccount` was given, by auth's API. */
+const closers = new WeakMap<object, ((userId: string) => Promise<void>)[]>()
 
 const M = { as: master }
 
@@ -101,6 +130,29 @@ function stateOf(context: object): State {
 	return state
 }
 
+/** Refuses a caller that is neither Master nor the user `id`. */
+function selfOrMaster(
+	caller: Identity | undefined,
+	id: string,
+	command: string,
+): void {
+	const self = caller?.kind === 'user' && caller.user.id === id
+	if (!self && (caller === undefined || !isMaster(caller))) {
+		throw new PublicError(
+			'ACCESS_DENIED',
+			`User.${command} runs as Master or as the user.`,
+		)
+	}
+}
+
+/** The listeners the running application's methods gave `onCloseAccount`. */
+function closersOf(): readonly ((userId: string) => Promise<void>)[] {
+	const api = runningApi('auth')
+	const listeners =
+		typeof api === 'object' && api !== null ? closers.get(api) : undefined
+	return listeners ?? []
+}
+
 /** The one user model among the application's models (D-62). */
 function usersOf(
 	models: readonly { readonly queries: Users['queries'] }[],
@@ -125,10 +177,10 @@ function usersOf(
 /** A session token's caller, until it ends; `undefined` for an unknown one. */
 async function callerOf(
 	token: string,
-	users: Users,
+	{ users, durations }: State,
 	expires: (at: Date) => void,
 ): Promise<Identity | undefined> {
-	const session = await sessionOf(token)
+	const session = await sessionOf(token, durations)
 	if (session === undefined) return undefined
 	// A transport's queries are untyped; this is the user model's row.
 	const user: unknown = await users.queries.findUnique(
@@ -158,14 +210,18 @@ const auth = definePlugin<Auth>({
 	},
 	commands: () => ({
 		revokeSessions: async ({ id }, options) => {
-			const caller = options?.as
-			const self = caller?.kind === 'user' && caller.user.id === id
-			if (!self && (caller === undefined || !isMaster(caller))) {
-				throw new PublicError(
-					'ACCESS_DENIED',
-					'User.revokeSessions runs as Master or as the user.',
-				)
-			}
+			selfOrMaster(options?.as, id, 'revokeSessions')
+			await revokeSessions(id)
+		},
+		closeAccount: async ({ id }, options) => {
+			selfOrMaster(options?.as, id, 'closeAccount')
+			await transaction(async () => {
+				await revokeSessions(id)
+				await unlinkAccounts(id)
+				for (const listener of closersOf()) await listener(id)
+			})
+			// Again once the accounts are gone: a sign-in that read one before
+			// opened its session before this ends it.
 			await revokeSessions(id)
 		},
 	}),
@@ -174,16 +230,21 @@ const auth = definePlugin<Auth>({
 	// Built before any plugin starts, so before the server listens.
 	api: (context) => {
 		const cookie = cookieOf()
-		states.set(context, { cookie, users: usersOf(context.models) })
-		return {
+		const durations = durationsOf(context.options.sessions)
+		const users = usersOf(context.models)
+		states.set(context, { cookie, users, durations })
+		// The cookie goes when its session can live no longer.
+		const maxAge = Math.min(Math.ceil(durations.longest / 1000), cookieAge)
+		const listeners: ((userId: string) => Promise<void>)[] = []
+		const api: AuthApi = {
 			signIn: async (userId, client) => {
 				// The cookie it replaces would leave a session nobody can end (D-115).
 				const replaced = client?.cookies.get(cookie.name)
 				if (replaced !== undefined) await closeSession(replaced)
-				const opened = await openSession(userId)
+				const opened = await openSession(userId, durations)
 				client?.cookies.set(cookie.name, opened.token, {
 					...cookie.options,
-					maxAge: cookieAge,
+					maxAge,
 				})
 				return opened
 			},
@@ -191,10 +252,24 @@ const auth = definePlugin<Auth>({
 			linkAccount,
 			accountOf,
 			subjectOf,
+			unlinkAccount,
+			onCloseAccount: (listener) => {
+				listeners.push(listener)
+			},
 		}
+		closers.set(api, listeners)
+		return api
+	},
+	// A sign-in method requires auth: without one, nobody signs in (D-164).
+	start: ({ dependents, logger }) => {
+		if (dependents.length > 0) return
+		logger.warn(
+			'authPlugin() has no sign-in method: add one, as passwordPlugin().',
+		)
 	},
 	identify: async (request, context) => {
-		const { cookie, users } = stateOf(context)
+		const state = stateOf(context)
+		const { cookie } = state
 		const { hostname } = new URL(request.url)
 		if (
 			!cookie.options.secure &&
@@ -208,7 +283,7 @@ const auth = definePlugin<Auth>({
 		}
 		const bearer = bearerOf(request)
 		if (bearer !== undefined) {
-			const caller = await callerOf(bearer, users, context.expires)
+			const caller = await callerOf(bearer, state, context.expires)
 			if (caller !== undefined) return caller
 			throw new PublicError(
 				'UNAUTHENTICATED',
@@ -219,7 +294,7 @@ const auth = definePlugin<Auth>({
 		// signing in again (D-112).
 		const token = cookieTokenOf(request, cookie)
 		if (token === undefined) return undefined
-		return callerOf(token, users, context.expires)
+		return callerOf(token, state, context.expires)
 	},
 })
 

package/src/sessions.ts

@@ -1,17 +1,36 @@
 // Sessions (D-112): an opaque token, of which the database keeps only the
-// SHA-256 digest, ending 30 days after its last use and one year after its
-// sign-in (D-115).
+// SHA-256 digest, ending a lifetime after its last use and at the longest
+// after its sign-in (D-115), both the application's (D-165).
 import { createHash, randomBytes } from 'node:crypto'
 import type { Field, ModelOf, ScalarOptions } from 'ultimabase'
-import { defineModel, master, PublicError } from 'ultimabase'
+import { defineModel, master, PublicError, Refused } from 'ultimabase'
 
 const M = { as: master }
 const day = 24 * 60 * 60 * 1000
-const lifetime = 30 * day
-/** A session used with less left gets its lifetime again. */
-const renewal = 15 * day
-/** No renewal takes a session past this long after its sign-in (D-115). */
-const longest = 365 * day
+
+/** How long sessions last, in milliseconds (D-165). */
+export interface Durations {
+	/** After the last use; a session used with less than half left is renewed. */
+	readonly lifetime: number
+	/** After the sign-in, which no renewal goes past (D-115). */
+	readonly longest: number
+}
+
+const positive = (value: number): boolean => Number.isFinite(value) && value > 0
+
+/** `authPlugin`'s `sessions`, checked, with 30 and 365 days by default. */
+export function durationsOf(sessions: Partial<Durations> = {}): Durations {
+	const { lifetime = 30 * day, longest = 365 * day } = sessions
+	if (!positive(lifetime) || !positive(longest)) {
+		throw new Refused(
+			'authPlugin() sessions: lifetime and longest are positive numbers of milliseconds.',
+		)
+	}
+	if (lifetime > longest) {
+		throw new Refused('authPlugin() sessions: lifetime is longer than longest.')
+	}
+	return { lifetime, longest }
+}
 
 type SessionFields = {
 	readonly tokenHash: Field<string, { readonly unique: true }>
@@ -41,7 +60,10 @@ export interface Opened {
 }
 
 /** Opens a session for `userId`, ending every expired one (D-115). */
-export async function openSession(userId: string): Promise<Opened> {
+export async function openSession(
+	userId: string,
+	{ lifetime }: Durations,
+): Promise<Opened> {
 	const now = Date.now()
 	await AuthSession.deleteMany(
 		{ where: { expiresAt: { lte: new Date(now) } } },
@@ -57,12 +79,13 @@ export async function openSession(userId: string): Promise<Opened> {
 }
 
 /**
- * The session `token` opened, renewed when it has less than 15 days left, up
- * to one year after its sign-in; `undefined` for an unknown one, or an
- * expired one, deleted.
+ * The session `token` opened, renewed when it has less than half its lifetime
+ * left, up to the longest after its sign-in; `undefined` for an unknown one,
+ * or an expired one, deleted.
  */
 export async function sessionOf(
 	token: string,
+	{ lifetime, longest }: Durations,
 ): Promise<{ readonly userId: string; readonly expiresAt: Date } | undefined> {
 	const tokenHash = digest(token)
 	const session = await AuthSession.findUnique({ where: { tokenHash } }, M)
@@ -74,7 +97,7 @@ export async function sessionOf(
 		return undefined
 	}
 	const end = Math.min(now + lifetime, session.createdAt.getTime() + longest)
-	if (left < renewal && end > session.expiresAt.getTime()) {
+	if (left < lifetime / 2 && end > session.expiresAt.getTime()) {
 		try {
 			await AuthSession.update(
 				{ where: { tokenHash }, data: { expiresAt: new Date(end) } },

package/src/token.ts

@@ -2,7 +2,7 @@
 // the cookie, which auth sets and clears through a function's client (D-113).
 import type { CookieOptions } from 'ultimabase'
 
-/** The longest a browser keeps a cookie: 400 days. */
+/** The longest a browser keeps a cookie: 400 days, in seconds. */
 export const cookieAge: number = 400 * 24 * 60 * 60
 
 /** The cookie's name and attributes, read once when the application starts. */