@voltro/plugin-auth 0.23.0 → 0.25.0

package/dist/index.d.ts

@@ -80,6 +80,20 @@ export declare interface AuthConfig {
      *  but any concern (unverified email, suspended tenant, …) can hook here.
      *  Absent / empty ⇒ every authenticated user proceeds unchanged. */
     readonly subjectGuards?: ReadonlyArray<SubjectGuard>;
+    /** Brute-force lockout. After `maxAttempts` failed credential attempts
+     *  (wrong password OR wrong MFA code) within `windowSeconds`, the account —
+     *  keyed by EMAIL, so an unknown address locks exactly like a real one and
+     *  the lock can't be used as an existence oracle — is refused with a 429 for
+     *  `lockSeconds`; a completed login clears the counter. ON by default (a
+     *  security default, not opt-in); raise `maxAttempts` very high to disable. */
+    readonly lockout?: {
+        readonly maxAttempts?: number;
+        readonly windowSeconds?: number;
+        readonly lockSeconds?: number;
+    };
+    /** Injectable clock (epoch-ms) for the lockout counter. Default `Date.now`;
+     *  tests pass a controllable one to exercise window/lock expiry. */
+    readonly now?: () => number;
 }
 
 /**
@@ -405,6 +419,26 @@ declare interface ListSessionsInput {
     readonly userId: string;
 }
 
+/**
+ * Brute-force lockout policy, resolved from `AuthConfig.lockout` and passed
+ * INTO the store on each failure so the store itself stays policy-free.
+ * Times in milliseconds; `now` everywhere is epoch-ms so tests can inject a
+ * clock. Kept keyed by EMAIL (not user id) on purpose — a locked account must
+ * not read differently from an unknown one, or the lock becomes an existence
+ * oracle. See `loginAttemptsTable`.
+ */
+declare interface LockoutPolicy {
+    readonly maxAttempts: number;
+    readonly windowMs: number;
+    readonly lockMs: number;
+}
+
+declare interface LockoutState {
+    readonly locked: boolean;
+    /** Seconds until the lock lifts; 0 when not locked. */
+    readonly retryAfterSeconds: number;
+}
+
 /** Default magic-link lifetime — short, since it's an inbox round-trip. */
 export declare const MAGIC_LINK_TTL_S: number;
 
@@ -1092,6 +1126,16 @@ export declare interface UserStore {
      *  the write are ONE atomic statement at the store, so two replicas
      *  racing the same counter can't both succeed. */
     readonly advancePasskeyCounter: (credentialId: string, newCounter: number) => Effect.Effect<boolean>;
+    /** Is this email currently locked out? Reads only — never mutates. Returns
+     *  the remaining cooldown so the handler can surface a retry-after. */
+    readonly isLockedOut: (email: string, now: number) => Effect.Effect<LockoutState>;
+    /** Record one failed credential attempt for `email`. Opens a fresh window
+     *  when the previous one (or a prior lock) has expired, otherwise increments;
+     *  sets the lock once `failedCount` reaches `policy.maxAttempts`. Called only
+     *  for a NOT-currently-locked email (the handler checks `isLockedOut` first). */
+    readonly recordLoginFailure: (email: string, now: number, policy: LockoutPolicy) => Effect.Effect<void>;
+    /** Clear the counter for `email` on a completed login. */
+    readonly clearLoginFailures: (email: string) => Effect.Effect<void>;
 }
 
 /** Verify a passkey assertion (sign-in). */

package/dist/index.js

@@ -1,7 +1,7 @@
 import { PasswordEmptyError as e, PasswordHashError as t, hashPassword as n, needsRehash as r, parseScryptParams as i, verifyPassword as a, verifyPasswordWithRehash as o } from "./password.js";
-import { SESSION_COOKIE_NAME as s, clearSessionCookie as ee, issueSession as te, readSession as c, readSessionKeyed as l, resolveSessionSecret as u, resolveSessionSecrets as d, sessionSecretsOf as f } from "./session.js";
-import { a as p, c as m, i as h, l as g, n as _, o as v, r as y, s as b, t as x } from "./strategy-D345j4df.js";
-import { A as S, C, D as w, E as T, F as E, I as D, L as O, M as k, N as A, O as j, P as M, S as N, T as P, _ as F, a as I, b as L, c as R, d as z, f as B, g as V, h as H, i as U, j as ne, k as W, l as G, m as K, n as q, o as J, p as Y, r as X, s as Z, t as re, u as ie, v as ae, w as oe, x as se, y as ce } from "./plugin-HgTMFY3m.js";
+import { SESSION_COOKIE_NAME as s, clearSessionCookie as c, issueSession as l, readSession as u, readSessionKeyed as d, resolveSessionSecret as f, resolveSessionSecrets as p, sessionSecretsOf as m } from "./session.js";
+import { a as h, c as g, i as _, l as v, n as y, o as b, r as x, s as S, t as C } from "./strategy-Ce4FlGi4.js";
+import { A as w, C as T, D as E, E as D, F as O, I as k, L as A, M as ee, N as te, O as j, P as M, S as N, T as P, _ as F, a as I, b as L, c as R, d as z, f as B, g as V, h as H, i as U, j as W, k as G, l as K, m as q, n as J, o as Y, p as X, r as ne, s as Z, t as re, u as ie, v as ae, w as oe, x as se, y as ce } from "./plugin-ZXs8LFn0.js";
 import { MAGIC_LINK_TTL_S as le, PASSWORD_RESET_TTL_S as ue, hashToken as de, mintToken as fe } from "./tokens.js";
 import { CSRF_COOKIE_NAME as pe, CSRF_HEADER_NAME as me, isCsrfTokenWellFormed as Q, issueCsrfToken as he, verifyCsrf as ge } from "./csrf.js";
 import { generateChallenge as _e, verifyAssertion as ve, verifyRegistration as ye } from "./webauthn.js";
@@ -36,147 +36,128 @@ var be = (e) => {
 			...t,
 			email: n,
 			createdAt: r
-		})), $.catchAll((e) => be(e) === "23505" ? $.fail(new _({ email: n })) : $.die(e)));
+		})), $.catchAll((e) => be(e) === "23505" ? $.fail(new y({ email: n })) : $.die(e)));
 	}), i = (t) => $.gen(function* () {
 		return (yield* e`
         SELECT id, email, "passwordHash", "tenantId", "createdAt", "mfaSecret", "mfaEnrolledAt"
         FROM users WHERE id = ${t} LIMIT 1
-      `)[0] || (yield* $.fail(new y({ userId: t })));
-	}).pipe($.catchTag("SqlError", (e) => $.die(e)));
-	return {
-		findByEmail: t,
-		findById: n,
-		insert: r,
-		updatePassword: (t, n) => $.gen(function* () {
-			return yield* e`
+      `)[0] || (yield* $.fail(new x({ userId: t })));
+	}).pipe($.catchTag("SqlError", (e) => $.die(e))), a = (t, n) => $.gen(function* () {
+		return yield* e`
         UPDATE users SET "passwordHash" = ${n}, "updatedAt" = ${/* @__PURE__ */ new Date()}
          WHERE id = ${t}
       `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
-		}),
-		setMfaSecret: (t, n) => $.gen(function* () {
-			return yield* e`
+	}), o = (t, n) => $.gen(function* () {
+		return yield* e`
         UPDATE users
            SET "mfaSecret" = ${n}, "mfaEnrolledAt" = ${null}
          WHERE id = ${t}
       `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
-		}),
-		markMfaEnrolled: (t) => $.gen(function* () {
-			return yield* e`
+	}), s = (t) => $.gen(function* () {
+		return yield* e`
         UPDATE users
            SET "mfaEnrolledAt" = ${/* @__PURE__ */ new Date()}
          WHERE id = ${t}
       `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
-		}),
-		clearMfa: (t) => $.gen(function* () {
-			return yield* e`
+	}), c = (t) => $.gen(function* () {
+		return yield* e`
         UPDATE users
            SET "mfaSecret" = ${null}, "mfaEnrolledAt" = ${null}
          WHERE id = ${t}
       `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
-		}),
-		listMemberships: (t) => $.gen(function* () {
-			return (yield* e`
+	}), l = (t) => $.gen(function* () {
+		return (yield* e`
         SELECT "userId", "tenantId", role, "joinedAt"
           FROM memberships WHERE "userId" = ${t}
           ORDER BY "joinedAt" ASC
       `).map((e) => ({ ...e }));
-		}).pipe($.orElseSucceed(() => [])),
-		addMembership: (t) => $.gen(function* () {
-			let n = /* @__PURE__ */ new Date();
-			yield* e`
+	}).pipe($.orElseSucceed(() => [])), u = (t) => $.gen(function* () {
+		let n = /* @__PURE__ */ new Date();
+		yield* e`
         UPDATE memberships SET role = ${t.role}
          WHERE "userId" = ${t.userId} AND "tenantId" = ${t.tenantId}
       `;
-			let r = yield* e`
+		let r = yield* e`
         SELECT "userId", "tenantId", role, "joinedAt"
           FROM memberships
          WHERE "userId" = ${t.userId} AND "tenantId" = ${t.tenantId}
          LIMIT 1
       `;
-			return r[0] ? { ...r[0] } : (yield* e`
+		return r[0] ? { ...r[0] } : (yield* e`
         INSERT INTO memberships (id, "userId", "tenantId", role, "joinedAt")
-        VALUES (${p("mem")}, ${t.userId}, ${t.tenantId}, ${t.role}, ${n})
+        VALUES (${h("mem")}, ${t.userId}, ${t.tenantId}, ${t.role}, ${n})
       `, {
-				...t,
-				joinedAt: n
-			});
-		}).pipe($.catchAll(() => $.succeed({
 			...t,
-			joinedAt: /* @__PURE__ */ new Date()
-		}))),
-		membershipRole: (t, n) => $.gen(function* () {
-			return (yield* e`
+			joinedAt: n
+		});
+	}).pipe($.catchAll(() => $.succeed({
+		...t,
+		joinedAt: /* @__PURE__ */ new Date()
+	}))), d = (t, n) => $.gen(function* () {
+		return (yield* e`
         SELECT role FROM memberships
          WHERE "userId" = ${t} AND "tenantId" = ${n} LIMIT 1
       `)[0]?.role ?? null;
-		}).pipe($.orElseSucceed(() => null)),
-		listSessions: (t) => $.gen(function* () {
-			return (yield* e`
+	}).pipe($.orElseSucceed(() => null)), f = (t) => $.gen(function* () {
+		return (yield* e`
         SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt"
           FROM sessions WHERE "userId" = ${t}
           ORDER BY "createdAt" DESC
       `).map((e) => ({ ...e }));
-		}).pipe($.orElseSucceed(() => [])),
-		insertSession: (t) => $.gen(function* () {
-			let n = /* @__PURE__ */ new Date();
-			return yield* e`
+	}).pipe($.orElseSucceed(() => [])), p = (t) => $.gen(function* () {
+		let n = /* @__PURE__ */ new Date();
+		return yield* e`
         INSERT INTO sessions (id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt")
         VALUES (
           ${t.id}, ${t.userId}, ${t.tenantId}, ${t.expiresAt},
           ${t.ipAddress ?? null}, ${t.userAgent ?? null}, ${n}, ${n}
         )
       `, {
-				...t,
-				createdAt: n,
-				lastSeenAt: n
-			};
-		}).pipe($.catchAll(() => $.succeed({
 			...t,
-			createdAt: /* @__PURE__ */ new Date(),
-			lastSeenAt: /* @__PURE__ */ new Date()
-		}))),
-		findSession: (t) => $.gen(function* () {
-			let n = yield* e`
+			createdAt: n,
+			lastSeenAt: n
+		};
+	}).pipe($.catchAll(() => $.succeed({
+		...t,
+		createdAt: /* @__PURE__ */ new Date(),
+		lastSeenAt: /* @__PURE__ */ new Date()
+	}))), m = (t) => $.gen(function* () {
+		let n = yield* e`
         SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt"
           FROM sessions WHERE id = ${t} LIMIT 1
       `;
-			return n[0] ? { ...n[0] } : null;
-		}).pipe($.orElseSucceed(() => null)),
-		touchSession: (t, n) => $.gen(function* () {
-			yield* e`
+		return n[0] ? { ...n[0] } : null;
+	}).pipe($.orElseSucceed(() => null)), g = (t, n) => $.gen(function* () {
+		yield* e`
         UPDATE sessions SET "expiresAt" = ${n}, "lastSeenAt" = ${/* @__PURE__ */ new Date()}
          WHERE id = ${t}
       `;
-		}).pipe($.asVoid, $.orElseSucceed(() => void 0)),
-		revokeSession: (t, n) => $.gen(function* () {
-			return (yield* e`
+	}).pipe($.asVoid, $.orElseSucceed(() => void 0)), _ = (t, n) => $.gen(function* () {
+		return (yield* e`
         DELETE FROM sessions WHERE id = ${n} AND "userId" = ${t}
         RETURNING id
       `).length > 0;
-		}).pipe($.orElseSucceed(() => !1)),
-		revokeAllOtherSessions: (t, n) => $.gen(function* () {
-			return (yield* e`
+	}).pipe($.orElseSucceed(() => !1)), v = (t, n) => $.gen(function* () {
+		return (yield* e`
         DELETE FROM sessions WHERE "userId" = ${t} AND id <> ${n}
         RETURNING id
       `).length;
-		}).pipe($.orElseSucceed(() => 0)),
-		insertToken: (t) => $.gen(function* () {
-			let n = /* @__PURE__ */ new Date();
-			return yield* e`
+	}).pipe($.orElseSucceed(() => 0)), b = (t) => $.gen(function* () {
+		let n = /* @__PURE__ */ new Date();
+		return yield* e`
         INSERT INTO "authTokens" (id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt")
         VALUES (${t.id}, ${t.tokenHash}, ${t.userId}, ${t.purpose}, ${t.expiresAt}, ${null}, ${n})
       `, {
-				...t,
-				consumedAt: null,
-				createdAt: n
-			};
-		}).pipe($.catchAll(() => $.succeed({
 			...t,
 			consumedAt: null,
-			createdAt: /* @__PURE__ */ new Date()
-		}))),
-		consumeToken: (t, n) => $.gen(function* () {
-			let r = yield* e`
+			createdAt: n
+		};
+	}).pipe($.catchAll(() => $.succeed({
+		...t,
+		consumedAt: null,
+		createdAt: /* @__PURE__ */ new Date()
+	}))), S = (t, n) => $.gen(function* () {
+		let r = yield* e`
         UPDATE "authTokens"
            SET "consumedAt" = ${/* @__PURE__ */ new Date()}
          WHERE "tokenHash" = ${t}
@@ -185,72 +166,125 @@ var be = (e) => {
            AND "expiresAt" > ${/* @__PURE__ */ new Date()}
         RETURNING id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
       `;
-			return r[0] ? { ...r[0] } : null;
-		}).pipe($.orElseSucceed(() => null)),
-		replaceRecoveryCodes: (t, n) => $.gen(function* () {
-			let r = /* @__PURE__ */ new Date();
-			yield* e`DELETE FROM "recoveryCodes" WHERE "userId" = ${t}`;
-			for (let i of n) yield* e`
-          INSERT INTO "recoveryCodes" (id, "userId", "codeHash", "consumedAt", "createdAt")
-          VALUES (${p("rc")}, ${t}, ${i}, ${null}, ${r})
-        `;
-		}).pipe($.asVoid, $.orElseSucceed(() => void 0)),
-		consumeRecoveryCode: (t, n) => $.gen(function* () {
-			return (yield* e`
-        UPDATE "recoveryCodes"
-           SET "consumedAt" = ${/* @__PURE__ */ new Date()}
-         WHERE "userId" = ${t}
-           AND "codeHash" = ${n}
-           AND "consumedAt" IS NULL
-        RETURNING id
-      `).length > 0;
-		}).pipe($.orElseSucceed(() => !1)),
-		countRecoveryCodes: (t) => $.gen(function* () {
-			return (yield* e`
-        SELECT COUNT(*)::int AS n FROM "recoveryCodes"
-         WHERE "userId" = ${t} AND "consumedAt" IS NULL
-      `)[0]?.n ?? 0;
-		}).pipe($.orElseSucceed(() => 0)),
-		listPasskeys: (t) => $.gen(function* () {
-			return (yield* e`
+		return r[0] ? { ...r[0] } : null;
+	}).pipe($.orElseSucceed(() => null)), C = (t) => $.gen(function* () {
+		return (yield* e`
         SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
           FROM passkeys WHERE "userId" = ${t}
       `).map((e) => ({ ...e }));
-		}).pipe($.orElseSucceed(() => [])),
-		findPasskey: (t) => $.gen(function* () {
-			let n = yield* e`
+	}).pipe($.orElseSucceed(() => [])), w = (t) => $.gen(function* () {
+		let n = yield* e`
         SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
           FROM passkeys WHERE "credentialId" = ${t} LIMIT 1
       `;
-			return n[0] ? { ...n[0] } : null;
-		}).pipe($.orElseSucceed(() => null)),
-		insertPasskey: (t) => $.gen(function* () {
-			let n = /* @__PURE__ */ new Date();
-			return yield* e`
+		return n[0] ? { ...n[0] } : null;
+	}).pipe($.orElseSucceed(() => null)), T = (t) => $.gen(function* () {
+		let n = /* @__PURE__ */ new Date();
+		return yield* e`
         INSERT INTO passkeys (id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt")
         VALUES (
           ${t.id}, ${t.credentialId}, ${t.userId}, ${t.publicKey},
           ${t.counter}, ${t.transports ?? null}, ${n}, ${null}
         )
       `, {
-				...t,
-				createdAt: n,
-				lastUsedAt: null
-			};
-		}).pipe($.catchAll(() => $.succeed({
 			...t,
-			createdAt: /* @__PURE__ */ new Date(),
+			createdAt: n,
 			lastUsedAt: null
-		}))),
-		advancePasskeyCounter: (t, n) => $.gen(function* () {
-			return (yield* e`
+		};
+	}).pipe($.catchAll(() => $.succeed({
+		...t,
+		createdAt: /* @__PURE__ */ new Date(),
+		lastUsedAt: null
+	}))), E = (t, n) => $.gen(function* () {
+		return (yield* e`
         UPDATE passkeys
            SET counter = ${n}, "lastUsedAt" = ${/* @__PURE__ */ new Date()}
          WHERE "credentialId" = ${t}
            AND counter < ${n}
         RETURNING id
       `).length > 0;
-		}).pipe($.orElseSucceed(() => !1))
+	}).pipe($.orElseSucceed(() => !1)), D = (t, n) => $.gen(function* () {
+		let r = /* @__PURE__ */ new Date();
+		yield* e`DELETE FROM "recoveryCodes" WHERE "userId" = ${t}`;
+		for (let i of n) yield* e`
+          INSERT INTO "recoveryCodes" (id, "userId", "codeHash", "consumedAt", "createdAt")
+          VALUES (${h("rc")}, ${t}, ${i}, ${null}, ${r})
+        `;
+	}).pipe($.asVoid, $.orElseSucceed(() => void 0)), O = (t, n) => $.gen(function* () {
+		return (yield* e`
+        UPDATE "recoveryCodes"
+           SET "consumedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE "userId" = ${t}
+           AND "codeHash" = ${n}
+           AND "consumedAt" IS NULL
+        RETURNING id
+      `).length > 0;
+	}).pipe($.orElseSucceed(() => !1)), k = (t) => $.gen(function* () {
+		return (yield* e`
+        SELECT COUNT(*)::int AS n FROM "recoveryCodes"
+         WHERE "userId" = ${t} AND "consumedAt" IS NULL
+      `)[0]?.n ?? 0;
+	}).pipe($.orElseSucceed(() => 0)), A = (e, t) => $.catchAll((n) => $.logWarning(`[auth] lockout ${e} failed — brute-force protection is not counting`).pipe($.annotateLogs("cause", String(n)), $.as(t)));
+	return {
+		findByEmail: t,
+		findById: n,
+		insert: r,
+		updatePassword: a,
+		setMfaSecret: o,
+		markMfaEnrolled: s,
+		clearMfa: c,
+		listMemberships: l,
+		addMembership: u,
+		membershipRole: d,
+		listSessions: f,
+		insertSession: p,
+		findSession: m,
+		touchSession: g,
+		revokeSession: _,
+		revokeAllOtherSessions: v,
+		insertToken: b,
+		consumeToken: S,
+		replaceRecoveryCodes: D,
+		consumeRecoveryCode: O,
+		countRecoveryCodes: k,
+		listPasskeys: C,
+		findPasskey: w,
+		insertPasskey: T,
+		advancePasskeyCounter: E,
+		isLockedOut: (t, n) => $.gen(function* () {
+			let r = (yield* e`
+        SELECT "lockedUntil" FROM "loginAttempts"
+         WHERE email = ${t.toLowerCase()} LIMIT 1
+      `)[0]?.lockedUntil ?? null;
+			return r != null && n < r.getTime() ? {
+				locked: !0,
+				retryAfterSeconds: Math.ceil((r.getTime() - n) / 1e3)
+			} : {
+				locked: !1,
+				retryAfterSeconds: 0
+			};
+		}).pipe(A("read", {
+			locked: !1,
+			retryAfterSeconds: 0
+		})),
+		recordLoginFailure: (t, n, r) => $.gen(function* () {
+			let i = t.toLowerCase(), a = (yield* e`
+        SELECT "failedCount", "windowStartedAt", "lockedUntil"
+          FROM "loginAttempts" WHERE email = ${i} LIMIT 1
+      `)[0], o = a?.windowStartedAt?.getTime() ?? null, s = a?.lockedUntil?.getTime() ?? null, c = o == null || n - o >= r.windowMs, l = !a || c || s != null && n >= s, u = l ? 1 : a.failedCount + 1, d = l ? new Date(n) : new Date(o), f = u >= r.maxAttempts ? new Date(n + r.lockMs) : null, p = new Date(n);
+			yield* e`
+        INSERT INTO "loginAttempts" (id, email, "failedCount", "windowStartedAt", "lockedUntil", "createdAt", "updatedAt")
+        VALUES (${h("la")}, ${i}, ${u}, ${d}, ${f}, ${p}, ${p})
+        ON CONFLICT (email) DO UPDATE SET
+          "failedCount" = ${u},
+          "windowStartedAt" = ${d},
+          "lockedUntil" = ${f},
+          "updatedAt" = ${p}
+      `;
+		}).pipe($.asVoid, A("record", void 0)),
+		clearLoginFailures: (t) => $.gen(function* () {
+			yield* e`DELETE FROM "loginAttempts" WHERE email = ${t.toLowerCase()}`;
+		}).pipe($.asVoid, A("clear", void 0))
 	};
 }, Se = (e) => (t) => $.runPromise(e.send({
 	to: t.to,
@@ -259,4 +293,4 @@ var be = (e) => {
 	text: t.text
 }).pipe($.asVoid, $.orElseSucceed(() => void 0)));
 //#endregion
-export { pe as CSRF_COOKIE_NAME, me as CSRF_HEADER_NAME, le as MAGIC_LINK_TTL_S, G as MFA_PENDING_TTL_S, ue as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, s as SESSION_COOKIE_NAME, ne as TotpVerifyError, _ as UserAlreadyExistsError, y as UserNotFoundError, re as authRoutesPlugin, ee as clearSessionCookie, ie as configSessionSecrets, X as dataStoreChallengeStore, _e as generateChallenge, k as generateRecoveryCodes, A as generateTotpCode, M as generateTotpSecret, q as getAuthSessionStrategy, z as guardSubject, B as handleCsrf, Y as handleListMemberships, K as handleListSessions, H as handleMagicLinkConsume, V as handleMagicLinkRequest, F as handleMfaEnrollStart, ae as handleMfaEnrollVerify, ce as handleMfaRegenerateRecoveryCodes, L as handleMfaUnenroll, se as handleMfaVerify, U as handlePasskeyAssertOptions, I as handlePasskeyAssertVerify, J as handlePasskeyRegisterOptions, Z as handlePasskeyRegisterVerify, N as handlePasswordResetConfirm, C as handlePasswordResetRequest, oe as handleRevokeAllOtherSessions, P as handleRevokeSession, T as handleSignIn, w as handleSignOut, j as handleSignUp, W as handleSwitchTenant, n as hashPassword, de as hashToken, Q as isCsrfTokenWellFormed, he as issueCsrfToken, te as issueSession, S as issueUserSession, Se as mailSender, g as makeSessionRevocationChecker, R as memoryChallengeStore, h as memoryUserStore, fe as mintToken, r as needsRehash, p as newAuthId, E as otpauthUrl, i as parseScryptParams, xe as postgresUserStore, c as readSession, l as readSessionKeyed, u as resolveSessionSecret, d as resolveSessionSecrets, O as runSubjectGuards, v as sessionIdOfSubject, f as sessionSecretsOf, b as subjectFromUser, m as subjectMemberships, ve as verifyAssertion, ge as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, ye as verifyRegistration, D as verifyTotpCode, x as voltroPasswordStrategy };
+export { pe as CSRF_COOKIE_NAME, me as CSRF_HEADER_NAME, le as MAGIC_LINK_TTL_S, K as MFA_PENDING_TTL_S, ue as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, s as SESSION_COOKIE_NAME, W as TotpVerifyError, y as UserAlreadyExistsError, x as UserNotFoundError, re as authRoutesPlugin, c as clearSessionCookie, ie as configSessionSecrets, ne as dataStoreChallengeStore, _e as generateChallenge, ee as generateRecoveryCodes, te as generateTotpCode, M as generateTotpSecret, J as getAuthSessionStrategy, z as guardSubject, B as handleCsrf, X as handleListMemberships, q as handleListSessions, H as handleMagicLinkConsume, V as handleMagicLinkRequest, F as handleMfaEnrollStart, ae as handleMfaEnrollVerify, ce as handleMfaRegenerateRecoveryCodes, L as handleMfaUnenroll, se as handleMfaVerify, U as handlePasskeyAssertOptions, I as handlePasskeyAssertVerify, Y as handlePasskeyRegisterOptions, Z as handlePasskeyRegisterVerify, N as handlePasswordResetConfirm, T as handlePasswordResetRequest, oe as handleRevokeAllOtherSessions, P as handleRevokeSession, D as handleSignIn, E as handleSignOut, j as handleSignUp, G as handleSwitchTenant, n as hashPassword, de as hashToken, Q as isCsrfTokenWellFormed, he as issueCsrfToken, l as issueSession, w as issueUserSession, Se as mailSender, v as makeSessionRevocationChecker, R as memoryChallengeStore, _ as memoryUserStore, fe as mintToken, r as needsRehash, h as newAuthId, O as otpauthUrl, i as parseScryptParams, xe as postgresUserStore, u as readSession, d as readSessionKeyed, f as resolveSessionSecret, p as resolveSessionSecrets, A as runSubjectGuards, b as sessionIdOfSubject, m as sessionSecretsOf, S as subjectFromUser, g as subjectMemberships, ve as verifyAssertion, ge as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, ye as verifyRegistration, k as verifyTotpCode, C as voltroPasswordStrategy };