@voltro/plugin-auth 0.84.0 → 0.86.0

package/dist/impersonation.js

@@ -0,0 +1,175 @@
+import { newAuthId as e, subjectFromUser as t } from "./userStore.js";
+import { Effect as n } from "effect";
+import { IMPERSONATION_METADATA_KEY as r, rawImpersonationMark as i } from "@voltro/protocol";
+//#region src/impersonation.ts
+var a = 900, o = [
+	"/mfa/enroll/start",
+	"/mfa/enroll/verify",
+	"/mfa/unenroll",
+	"/mfa/recovery-codes/regenerate",
+	"/passkey/register/options",
+	"/passkey/register/verify",
+	"/sessions/revoke-others",
+	"/switch-tenant",
+	"/impersonate/start"
+], s = (e) => {
+	if (typeof e != "object" || !e) return null;
+	let t = e;
+	return typeof t.actorUserId != "string" || t.actorUserId.length === 0 || typeof t.grantId != "string" || typeof t.expiresAt != "string" || typeof t.actorSessionId != "string" || typeof t.startedAt != "string" ? null : {
+		actorUserId: t.actorUserId,
+		actorSessionId: t.actorSessionId,
+		grantId: t.grantId,
+		startedAt: t.startedAt,
+		expiresAt: t.expiresAt,
+		...typeof t.reason == "string" ? { reason: t.reason } : {}
+	};
+}, c = (e) => e.type === "user" ? s(i(e)) : null, l = (e) => c(e) !== null, u = () => (e) => {
+	if (e.type !== "user" || e.metadata === void 0) return e;
+	let t = s(e.metadata[r]), { metadata: n, ...i } = e;
+	return {
+		...i,
+		metadata: t === null ? { __redacted: "all" } : {
+			__redacted: "all-except-impersonation",
+			[r]: t
+		}
+	};
+}, d = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8",
+	...n
+}), f = (e, t) => n.suspend(() => {
+	let r = e.audit(t);
+	return r === void 0 ? n.void : n.isEffect(r) ? r : n.tryPromise({
+		try: () => Promise.resolve(r),
+		catch: (e) => e
+	});
+}).pipe(n.catchCause(() => n.void)), p = (i, a, o) => n.gen(function* () {
+	let s = o.impersonation, c = (o.now ?? Date.now)(), u = new Date(c), p = i.actorSubject, m = (e, t, r = {}) => f(s, {
+		kind: "refused",
+		at: u,
+		actorUserId: r.actorUser?.id ?? (p.type === "user" ? p.id : null),
+		actorEmail: r.actorUser?.email ?? null,
+		targetUserId: r.target?.id ?? null,
+		targetEmail: r.target?.email ?? null,
+		tenantId: p.tenantId ?? null,
+		reason: i.reason ?? null,
+		refusal: t,
+		ipAddress: i.ipAddress ?? null,
+		userAgent: i.userAgent ?? null
+	}).pipe(n.as(d(e, {
+		error: t,
+		...r.message === void 0 ? {} : { message: r.message }
+	})));
+	if (p.type !== "user") return yield* m(401, "unauthenticated");
+	if (l(p)) return yield* m(403, "nested_impersonation", { message: "An impersonated session may not start another impersonation. Stop the current one first." });
+	if (!i.actorSessionId) return yield* m(400, "no_actor_session");
+	let h = yield* a.findById(p.id);
+	if (!h) return yield* m(401, "unauthenticated");
+	if (!i.targetUserId && !i.targetEmail) return yield* m(400, "target_required", { actorUser: h });
+	let g = i.targetUserId ? yield* a.findById(i.targetUserId) : yield* a.findByEmail(i.targetEmail);
+	if (!g) return yield* m(404, "target_not_found", { actorUser: h });
+	if (g.id === h.id) return yield* m(400, "self_impersonation", {
+		actorUser: h,
+		target: g
+	});
+	let _ = i.reason?.trim() ?? "";
+	if ((s.requireReason ?? !0) && _.length === 0) return yield* m(400, "reason_required", {
+		actorUser: h,
+		target: g,
+		message: "A reason is required to impersonate a user."
+	});
+	if (!(yield* s.authority({
+		actor: p,
+		actorUser: h,
+		target: g
+	}).pipe(n.catchCause(() => n.succeed(!1))))) return yield* m(403, "not_permitted", {
+		actorUser: h,
+		target: g
+	});
+	if (yield* s.authority({
+		actor: t(g),
+		actorUser: g,
+		target: h
+	}).pipe(n.catchCause(() => n.succeed(!0)))) return yield* m(403, "target_may_impersonate", {
+		actorUser: h,
+		target: g,
+		message: "This user may themselves impersonate others and cannot be impersonated."
+	});
+	let v = s.maxDurationSeconds ?? 900, y = Math.max(1, Math.min(i.durationSeconds ?? v, v)), b = new Date(c + y * 1e3), x = e("sess"), S = yield* a.insertImpersonationGrant({
+		id: e("imp"),
+		sessionId: x,
+		actorUserId: h.id,
+		actorSessionId: i.actorSessionId,
+		targetUserId: g.id,
+		tenantId: g.tenantId,
+		reason: _.length > 0 ? _ : null,
+		expiresAt: b,
+		ipAddress: i.ipAddress ?? null,
+		userAgent: i.userAgent ?? null
+	}), C = {
+		actorUserId: h.id,
+		actorSessionId: i.actorSessionId,
+		grantId: S.id,
+		startedAt: S.startedAt.toISOString(),
+		expiresAt: b.toISOString(),
+		..._.length > 0 ? { reason: _ } : {}
+	}, w = yield* o.issuer.issue(g, {
+		sessionId: x,
+		ttlSeconds: y,
+		metadata: { [r]: C },
+		ipAddress: i.ipAddress ?? null,
+		userAgent: i.userAgent ?? null
+	});
+	return yield* f(s, {
+		kind: "started",
+		at: u,
+		actorUserId: h.id,
+		actorEmail: h.email,
+		targetUserId: g.id,
+		targetEmail: g.email,
+		tenantId: g.tenantId,
+		sessionId: x,
+		grantId: S.id,
+		reason: _.length > 0 ? _ : null,
+		expiresAt: b,
+		ipAddress: i.ipAddress ?? null,
+		userAgent: i.userAgent ?? null
+	}), d(200, {
+		ok: !0,
+		impersonation: C,
+		subject: w.subject
+	}, { setCookie: w.setCookie });
+}), m = (e, t, r) => n.gen(function* () {
+	let i = r.impersonation, a = (r.now ?? Date.now)(), o = new Date(a), s = c(e.subject);
+	if (!s || !e.sessionId) return d(400, { error: "not_impersonating" });
+	let l = yield* t.findImpersonationGrantBySession(e.sessionId);
+	yield* t.endImpersonationGrant(e.sessionId, "stopped", o).pipe(n.ignore), e.subject.type === "user" && (yield* t.revokeSession(e.subject.id, e.sessionId).pipe(n.ignore)), r.invalidateSession?.(e.sessionId);
+	let u = yield* t.findById(s.actorUserId), p = yield* t.findSession(s.actorSessionId), m = p ? Math.floor((p.expiresAt.getTime() - a) / 1e3) : 0;
+	if (yield* f(i, {
+		kind: "stopped",
+		at: o,
+		actorUserId: s.actorUserId,
+		actorEmail: u?.email ?? null,
+		targetUserId: e.subject.type === "user" ? e.subject.id : null,
+		targetEmail: null,
+		tenantId: l?.tenantId ?? e.subject.tenantId ?? null,
+		sessionId: e.sessionId,
+		...l ? { grantId: l.id } : {},
+		reason: l?.reason ?? null
+	}), !u || !p || m <= 0) return d(200, {
+		ok: !0,
+		restored: !1
+	}, { setCookie: r.issuer.clear() });
+	let h = yield* r.issuer.reissue(u, {
+		sessionId: s.actorSessionId,
+		ttlSeconds: m
+	});
+	return d(200, {
+		ok: !0,
+		restored: !0,
+		subject: h.subject
+	}, { setCookie: h.setCookie });
+});
+//#endregion
+export { a as IMPERSONATION_DEFAULT_DURATION_S, o as IMPERSONATION_FORBIDDEN_SUBPATHS, p as handleImpersonationStart, m as handleImpersonationStop, u as impersonationAuditRedactor, c as impersonationOf, l as isImpersonated };

package/dist/index.d.ts

@@ -5,7 +5,7 @@ import { Effect } from 'effect';
 import { KeyedSecret } from '@voltro/protocol/session';
 import { MembershipsSource } from '@voltro/protocol';
 import { SessionSecrets } from '@voltro/protocol/session';
-import { SqlClient } from '@effect/sql/SqlClient';
+import { SqlClient } from 'effect/sql/SqlClient';
 import { Subject } from '@voltro/protocol';
 import { SubjectIdentity } from '@voltro/protocol';
 import { VerifyOptions } from '@voltro/protocol/session';
@@ -310,7 +310,7 @@ export declare const dataStoreChallengeStore: (sql: SqlClient) => ChallengeStore
  * and writes go through the store the framework opened, so there is no second
  * pool and no second schema.
  */
-export declare const dataStoreSessionRegistry: (store: DataStore) => SessionRegistry;
+export declare const dataStoreSessionRegistry: (store: DataStore, options?: SessionRegistryStoreOptions) => SessionRegistry;
 
 /** Default set of roles allowed to invite at all. */
 export declare const DEFAULT_INVITER_ROLES: ReadonlyArray<string>;
@@ -1234,11 +1234,6 @@ export declare interface IssuedSession {
     readonly setCookie: string;
 }
 
-/**
- * `issueSession` with a row behind it: writes the session to the registry,
- * stamps its id into the cookie and signs. A cookie issued here can be killed
- * before its `exp`; one issued with plain `issueSession` cannot.
- */
 export declare const issueRegisteredSession: (registry: Pick<SessionRegistry, "insertSession">, subject: Subject | SubjectIdentity, secret: SessionSecretInput, options?: IssueRegisteredSessionOptions) => Promise<IssuedRegisteredSession>;
 
 export declare interface IssueRegisteredSessionOptions extends IssueSessionOptions {
@@ -1799,6 +1794,9 @@ export declare interface RecoveryCodeRecord {
     readonly createdAt: Date;
 }
 
+export declare interface RegisteredSessionRotationOptions extends IssueRegisteredSessionOptions, SessionRegistryStoreOptions {
+}
+
 export declare type RegistrationOutcome = {
     readonly ok: true;
     readonly result: RegistrationResult;
@@ -1846,6 +1844,11 @@ declare interface RevokeSessionInput {
     readonly sessionId: string;
 }
 
+/** Rotate one live credential atomically. Retained inactive aliases let
+ * sign-out using an earlier signed cookie revoke this device's successor.
+ * The caller must separately validate current account and tenant authority. */
+export declare const rotateRegisteredSession: (store: DataStore, subject: Subject | SubjectIdentity, presentedSessionId: string, secret: SessionSecretInput, options?: RegisteredSessionRotationOptions) => Promise<IssuedRegisteredSession | null>;
+
 /**
  * Run the guards in order against `user`, short-circuiting on the FIRST
  * rejection. With no guards (or all allowing) it resolves `{ ok: true }`.
@@ -1891,6 +1894,10 @@ export declare const sessionIdOfSubject: (subject: Subject) => string | null;
 /** A server-side session row — enumerated so apps can list active
  *  devices + revoke them. Written on sign-in; deleted on revoke. */
 export declare interface SessionRecord {
+    /** Stable device lineage. The original row is its transaction lock anchor. */
+    readonly familyId?: string | null;
+    /** A replaced credential remains an inert revocation alias until the device ends. */
+    readonly rotatedAt?: Date | null;
     readonly id: string;
     readonly userId: string;
     readonly tenantId: string;
@@ -1905,6 +1912,11 @@ export declare interface SessionRecord {
  *  `UserStore`, usable without the rest of it. */
 export declare type SessionRegistry = SessionStore;
 
+export declare interface SessionRegistryStoreOptions {
+    /** Borrow an already owned transaction; otherwise registry writes open one. */
+    readonly transaction?: 'existing';
+}
+
 export declare interface SessionRevocationChecker {
     /** Is this session still live? `false` means the row was revoked (or
      *  is past its `expiresAt`) — the caller rejects the cookie. Verdicts

package/dist/index.js

@@ -1,89 +1,23 @@
 import { PasswordEmptyError as e, PasswordHashError as t, hashPassword as n, needsRehash as r, parseScryptParams as i, verifyPassword as a, verifyPasswordWithRehash as o } from "./password.js";
-import { SESSION_COOKIE_NAME as ee, clearSessionCookie as te, issueSession as s, readSession as c, readSessionFromHeaders as ne, readSessionKeyed as re, resolveSessionSecret as ie, resolveSessionSecrets as ae, sessionSecretsOf as oe } from "./session.js";
-import { a as l, c as se, i as u, l as d, n as f, o as p, r as m, s as h, t as g } from "./strategy-XaGjSicX.js";
-import { $ as _, A as v, B as y, C as b, D as x, E as S, F as C, G as w, H as T, I as E, J as D, K as O, L as k, M as A, N as j, O as M, P as N, Q as P, R as F, S as I, T as L, U as R, V as z, W as B, X as V, Y as H, Z as U, _ as W, _t as G, a as K, at as ce, b as le, c as ue, ct as de, d as fe, dt as pe, et as me, f as he, ft as ge, g as _e, gt as ve, h as ye, ht as be, i as xe, it as Se, j as Ce, k as we, l as Te, lt as Ee, m as De, mt as Oe, n as ke, nt as Ae, o as je, ot as Me, p as Ne, pt as Pe, q as Fe, r as Ie, rt as Le, s as Re, st as ze, t as Be, tt as Ve, u as He, ut as Ue, v as We, vt as Ge, w as Ke, x as qe, y as Je, z as Ye } from "./plugin-CNW-X70p.js";
-import { EMAIL_VERIFY_TTL_S as Xe, MAGIC_LINK_TTL_S as Ze, MFA_PENDING_TTL_S as Qe, NATIVE_CODE_TTL_S as $e, PASSWORD_RESET_TTL_S as et, hashToken as tt, mintSecret as nt, mintToken as rt } from "./tokens.js";
-import { CSRF_COOKIE_NAME as it, CSRF_HEADER_NAME as at, isCsrfTokenWellFormed as ot, issueCsrfToken as st, verifyCsrf as q } from "./csrf.js";
-import { generateChallenge as ct, verifyAssertion as lt, verifyRegistration as ut } from "./webauthn.js";
-import { Effect as J } from "effect";
-import { eq as Y } from "@voltro/database";
-//#region src/sessionRegistry.ts
-var X = "sessions", dt = 604800, Z = (e) => ({
-	...e,
-	expiresAt: new Date(e.expiresAt),
-	createdAt: new Date(e.createdAt),
-	lastSeenAt: new Date(e.lastSeenAt)
-}), Q = async (e, t) => await e.query({
-	table: X,
-	predicate: t,
-	order: [],
-	take: void 0,
-	skip: void 0,
-	projection: void 0
-}), ft = (e) => ({
-	listSessions: (t) => J.promise(async () => (await Q(e, Y("userId", t))).map(Z).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
-	insertSession: (t) => J.promise(async () => {
-		let n = /* @__PURE__ */ new Date(), r = {
-			...t,
-			createdAt: n,
-			lastSeenAt: n
-		};
-		return await e.insert(X, r), r;
-	}),
-	findSession: (t) => J.promise(async () => {
-		let n = (await Q(e, Y("id", t)))[0];
-		return n === void 0 ? null : Z(n);
-	}),
-	touchSession: (t, n) => J.promise(async () => {
-		await e.update(X, t, {
-			expiresAt: n,
-			lastSeenAt: /* @__PURE__ */ new Date()
-		});
-	}),
-	revokeSession: (t, n) => J.promise(async () => {
-		let r = (await Q(e, Y("id", n)))[0];
-		return r === void 0 || r.userId !== t ? !1 : e.delete(X, n);
-	}),
-	revokeAllOtherSessions: (t, n) => J.promise(async () => {
-		let r = 0;
-		for (let i of await Q(e, Y("userId", t))) i.id !== n && await e.delete(X, i.id) && (r += 1);
-		return r;
-	}),
-	revokeAllSessions: (t) => J.promise(async () => {
-		let n = 0;
-		for (let r of await Q(e, Y("userId", t))) await e.delete(X, r.id) && (n += 1);
-		return n;
-	})
-}), $ = (e, t) => e.type === "user" ? {
-	...e,
-	metadata: {
-		...e.metadata ?? {},
-		sessionId: t
-	}
-} : e, pt = async (e, t, n, r = {}) => {
-	if (t.type !== "user") throw Error("issueRegisteredSession: only a user subject has a session row");
-	let i = l("sess"), a = r.ttlSeconds ?? dt, o = (r.now ?? Date.now)();
-	await J.runPromise(e.insertSession({
-		id: i,
-		userId: t.id,
-		tenantId: t.tenantId ?? "",
-		expiresAt: new Date(o + a * 1e3),
-		ipAddress: r.ipAddress ?? null,
-		userAgent: r.userAgent ?? null
-	}));
-	let { ipAddress: ee, userAgent: te, ...c } = r;
-	return {
-		...s($(t, i), n, c),
-		sessionId: i
-	};
-}, mt = (e) => async (t) => t.type === "user" ? (await J.runPromise(e.listMemberships(t.id))).map((e) => ({
-	tenantId: e.tenantId,
-	role: e.role
-})) : [], ht = (e) => (t) => J.runPromise(e.send({
-	to: t.to,
-	subject: t.subject,
-	html: t.html,
-	text: t.text
-}).pipe(J.asVoid, J.orElseSucceed(() => void 0)));
-//#endregion
-export { it as CSRF_COOKIE_NAME, at as CSRF_HEADER_NAME, _e as DEFAULT_INVITER_ROLES, W as DEFAULT_ROLE_RANK, me as EMAIL_NOT_VERIFIED_CODE, Ve as EMAIL_VERIFIED_METADATA_KEY, Ae as EMAIL_VERIFY_RESEND_COOLDOWN_S, Xe as EMAIL_VERIFY_TTL_S, Te as IMPERSONATION_DEFAULT_DURATION_S, He as IMPERSONATION_FORBIDDEN_SUBPATHS, We as INVITATION_MAX_PENDING, Je as INVITATION_TTL_S, Ze as MAGIC_LINK_TTL_S, Qe as MFA_PENDING_TTL_S, $e as NATIVE_CODE_TTL_S, Ie as NATIVE_PENDING_COOKIE, et as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, ee as SESSION_COOKIE_NAME, Ue as TotpVerifyError, f as UserAlreadyExistsError, m as UserNotFoundError, G as appUserStore, mt as authMemberships, Be as authRoutesPlugin, te as clearSessionCookie, j as configSessionSecrets, x as dataStoreChallengeStore, ft as dataStoreSessionRegistry, le as defaultCanGrantRole, Le as emailVerificationActive, Se as emailVerificationGuard, ct as generateChallenge, pe as generateRecoveryCodes, ge as generateTotpCode, Pe as generateTotpSecret, ke as getAuthSessionStrategy, N as guardSubject, qe as handleAcceptInvitation, I as handleAcceptInvitationWithSignUp, b as handleCreateInvitation, C as handleCsrf, ce as handleEmailVerifyConfirm, Me as handleEmailVerifyRequest, fe as handleImpersonationStart, he as handleImpersonationStop, Ke as handleListInvitations, E as handleListMemberships, k as handleListSessions, F as handleMagicLinkConsume, Ye as handleMagicLinkRequest, y as handleMfaEnrollStart, z as handleMfaEnrollVerify, T as handleMfaRegenerateRecoveryCodes, R as handleMfaUnenroll, B as handleMfaVerify, xe as handleNativeAuthorize, K as handleNativeComplete, je as handleNativeExchange, M as handlePasskeyAssertOptions, we as handlePasskeyAssertVerify, v as handlePasskeyRegisterOptions, Ce as handlePasskeyRegisterVerify, w as handlePasswordResetConfirm, O as handlePasswordResetRequest, L as handlePreviewInvitation, Fe as handleRevokeAllOtherSessions, S as handleRevokeInvitation, D as handleRevokeSession, H as handleSignIn, V as handleSignOut, U as handleSignUp, P as handleSwitchTenant, n as hashPassword, tt as hashToken, Ne as impersonationAuditRedactor, De as impersonationOf, Re as isAllowedRedirectUri, ot as isCsrfTokenWellFormed, ze as isEmailVerified, ye as isImpersonated, st as issueCsrfToken, pt as issueRegisteredSession, s as issueSession, _ as issueUserSession, ht as mailSender, d as makeSessionRevocationChecker, A as memoryChallengeStore, u as memoryUserStore, nt as mintSecret, rt as mintToken, ue as nativeLoginRedirect, r as needsRehash, l as newAuthId, Oe as otpauthUrl, i as parseScryptParams, Ge as postgresUserStore, c as readSession, ne as readSessionFromHeaders, re as readSessionKeyed, ie as resolveSessionSecret, ae as resolveSessionSecrets, ve as runSubjectGuards, de as sendEmailVerification, p as sessionIdOfSubject, oe as sessionSecretsOf, h as subjectFromUser, se as subjectMemberships, Ee as userEmailVerified, lt as verifyAssertion, q as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, ut as verifyRegistration, be as verifyTotpCode, g as voltroPasswordStrategy, $ as withSessionId };
+import { SESSION_COOKIE_NAME as s, clearSessionCookie as c, issueSession as l, readSession as u, readSessionFromHeaders as d, readSessionKeyed as f, resolveSessionSecret as p, resolveSessionSecrets as m, sessionSecretsOf as h } from "./session.js";
+import { makeSessionRevocationChecker as g } from "./revocation.js";
+import { UserAlreadyExistsError as _, UserNotFoundError as v, memoryUserStore as y, newAuthId as b, sessionIdOfSubject as x, subjectFromUser as S, subjectMemberships as C } from "./userStore.js";
+import { dataStoreSessionRegistry as w, issueRegisteredSession as T, rotateRegisteredSession as E, withSessionId as D } from "./sessionRegistry.js";
+import { authMemberships as O } from "./memberships.js";
+import { postgresUserStore as k } from "./postgresUserStore.js";
+import { appUserStore as A } from "./appUserStore.js";
+import { runSubjectGuards as j } from "./subjectGuard.js";
+import { TotpVerifyError as M, generateRecoveryCodes as N, generateTotpCode as P, generateTotpSecret as F, otpauthUrl as I, verifyTotpCode as L } from "./totp.js";
+import { EMAIL_VERIFY_TTL_S as R, MAGIC_LINK_TTL_S as z, MFA_PENDING_TTL_S as B, NATIVE_CODE_TTL_S as V, PASSWORD_RESET_TTL_S as H, hashToken as U, mintSecret as W, mintToken as G } from "./tokens.js";
+import { CSRF_COOKIE_NAME as K, CSRF_HEADER_NAME as q, isCsrfTokenWellFormed as J, issueCsrfToken as Y, verifyCsrf as X } from "./csrf.js";
+import { EMAIL_NOT_VERIFIED_CODE as Z, EMAIL_VERIFIED_METADATA_KEY as Q, EMAIL_VERIFY_RESEND_COOLDOWN_S as $, emailVerificationActive as ee, emailVerificationGuard as te, handleEmailVerifyConfirm as ne, handleEmailVerifyRequest as re, isEmailVerified as ie, sendEmailVerification as ae, userEmailVerified as oe } from "./emailVerification.js";
+import { configSessionSecrets as se, guardSubject as ce, handleCsrf as le, handleListMemberships as ue, handleListSessions as de, handleMagicLinkConsume as fe, handleMagicLinkRequest as pe, handleMfaEnrollStart as me, handleMfaEnrollVerify as he, handleMfaRegenerateRecoveryCodes as ge, handleMfaUnenroll as _e, handleMfaVerify as ve, handlePasswordResetConfirm as ye, handlePasswordResetRequest as be, handleRevokeAllOtherSessions as xe, handleRevokeSession as Se, handleSignIn as Ce, handleSignOut as we, handleSignUp as Te, handleSwitchTenant as Ee, issueUserSession as De } from "./handlers.js";
+import { generateChallenge as Oe, verifyAssertion as ke, verifyRegistration as Ae } from "./webauthn.js";
+import { dataStoreChallengeStore as je, handlePasskeyAssertOptions as Me, handlePasskeyAssertVerify as Ne, handlePasskeyRegisterOptions as Pe, handlePasskeyRegisterVerify as Fe, memoryChallengeStore as Ie } from "./passkeyHandlers.js";
+import { DEFAULT_INVITER_ROLES as Le, DEFAULT_ROLE_RANK as Re, INVITATION_MAX_PENDING as ze, INVITATION_TTL_S as Be, defaultCanGrantRole as Ve, handleAcceptInvitation as He, handleAcceptInvitationWithSignUp as Ue, handleCreateInvitation as We, handleListInvitations as Ge, handlePreviewInvitation as Ke, handleRevokeInvitation as qe } from "./invitations.js";
+import { IMPERSONATION_DEFAULT_DURATION_S as Je, IMPERSONATION_FORBIDDEN_SUBPATHS as Ye, handleImpersonationStart as Xe, handleImpersonationStop as Ze, impersonationAuditRedactor as Qe, impersonationOf as $e, isImpersonated as et } from "./impersonation.js";
+import { NATIVE_PENDING_COOKIE as tt, handleNativeAuthorize as nt, handleNativeComplete as rt, handleNativeExchange as it, isAllowedRedirectUri as at, nativeLoginRedirect as ot } from "./nativeRoutes.js";
+import { voltroPasswordStrategy as st } from "./strategy.js";
+import { authRoutesPlugin as ct, getAuthSessionStrategy as lt } from "./plugin.js";
+import { mailSender as ut } from "./mail.js";
+export { K as CSRF_COOKIE_NAME, q as CSRF_HEADER_NAME, Le as DEFAULT_INVITER_ROLES, Re as DEFAULT_ROLE_RANK, Z as EMAIL_NOT_VERIFIED_CODE, Q as EMAIL_VERIFIED_METADATA_KEY, $ as EMAIL_VERIFY_RESEND_COOLDOWN_S, R as EMAIL_VERIFY_TTL_S, Je as IMPERSONATION_DEFAULT_DURATION_S, Ye as IMPERSONATION_FORBIDDEN_SUBPATHS, ze as INVITATION_MAX_PENDING, Be as INVITATION_TTL_S, z as MAGIC_LINK_TTL_S, B as MFA_PENDING_TTL_S, V as NATIVE_CODE_TTL_S, tt as NATIVE_PENDING_COOKIE, H as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, s as SESSION_COOKIE_NAME, M as TotpVerifyError, _ as UserAlreadyExistsError, v as UserNotFoundError, A as appUserStore, O as authMemberships, ct as authRoutesPlugin, c as clearSessionCookie, se as configSessionSecrets, je as dataStoreChallengeStore, w as dataStoreSessionRegistry, Ve as defaultCanGrantRole, ee as emailVerificationActive, te as emailVerificationGuard, Oe as generateChallenge, N as generateRecoveryCodes, P as generateTotpCode, F as generateTotpSecret, lt as getAuthSessionStrategy, ce as guardSubject, He as handleAcceptInvitation, Ue as handleAcceptInvitationWithSignUp, We as handleCreateInvitation, le as handleCsrf, ne as handleEmailVerifyConfirm, re as handleEmailVerifyRequest, Xe as handleImpersonationStart, Ze as handleImpersonationStop, Ge as handleListInvitations, ue as handleListMemberships, de as handleListSessions, fe as handleMagicLinkConsume, pe as handleMagicLinkRequest, me as handleMfaEnrollStart, he as handleMfaEnrollVerify, ge as handleMfaRegenerateRecoveryCodes, _e as handleMfaUnenroll, ve as handleMfaVerify, nt as handleNativeAuthorize, rt as handleNativeComplete, it as handleNativeExchange, Me as handlePasskeyAssertOptions, Ne as handlePasskeyAssertVerify, Pe as handlePasskeyRegisterOptions, Fe as handlePasskeyRegisterVerify, ye as handlePasswordResetConfirm, be as handlePasswordResetRequest, Ke as handlePreviewInvitation, xe as handleRevokeAllOtherSessions, qe as handleRevokeInvitation, Se as handleRevokeSession, Ce as handleSignIn, we as handleSignOut, Te as handleSignUp, Ee as handleSwitchTenant, n as hashPassword, U as hashToken, Qe as impersonationAuditRedactor, $e as impersonationOf, at as isAllowedRedirectUri, J as isCsrfTokenWellFormed, ie as isEmailVerified, et as isImpersonated, Y as issueCsrfToken, T as issueRegisteredSession, l as issueSession, De as issueUserSession, ut as mailSender, g as makeSessionRevocationChecker, Ie as memoryChallengeStore, y as memoryUserStore, W as mintSecret, G as mintToken, ot as nativeLoginRedirect, r as needsRehash, b as newAuthId, I as otpauthUrl, i as parseScryptParams, k as postgresUserStore, u as readSession, d as readSessionFromHeaders, f as readSessionKeyed, p as resolveSessionSecret, m as resolveSessionSecrets, E as rotateRegisteredSession, j as runSubjectGuards, ae as sendEmailVerification, x as sessionIdOfSubject, h as sessionSecretsOf, S as subjectFromUser, C as subjectMemberships, oe as userEmailVerified, ke as verifyAssertion, X as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, Ae as verifyRegistration, L as verifyTotpCode, st as voltroPasswordStrategy, D as withSessionId };

package/dist/invitations.js

@@ -0,0 +1,187 @@
+import { newAuthId as e } from "./userStore.js";
+import { hashToken as t, mintSecret as n } from "./tokens.js";
+import { decideAdmission as r } from "./admission.js";
+import { Effect as i } from "effect";
+//#region src/invitations.ts
+var a = 604800, o = 500, s = [
+	"owner",
+	"admin",
+	"member",
+	"viewer"
+], c = ["owner", "admin"], l = (e, t) => t.indexOf(e), u = (e, t = s) => {
+	let n = l(e.inviterRole, t);
+	if (n < 0) return !1;
+	let r = l(e.requestedRole, t);
+	return r < 0 ? n === 0 : r >= n;
+}, d = (e) => {
+	let t = e?.roleRank ?? s;
+	return e?.canGrantRole ?? ((e) => u(e, t));
+}, f = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8",
+	...n
+}), p = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, m = (e) => ({
+	id: e.id,
+	email: e.email,
+	tenantId: e.tenantId,
+	role: e.role,
+	invitedByUserId: e.invitedByUserId,
+	expiresAt: e.expiresAt.toISOString(),
+	acceptedAt: e.acceptedAt?.toISOString() ?? null,
+	revokedAt: e.revokedAt?.toISOString() ?? null,
+	createdAt: e.createdAt.toISOString()
+}), h = (e, t, n, r) => i.gen(function* () {
+	let i = yield* n.membershipRole(e, t);
+	return i === null || !(r?.inviterRoles ?? c).includes(i) ? f(403, { error: "not_permitted" }) : { role: i };
+}), g = (e) => "status" in e, _ = (t, r, a) => i.gen(function* () {
+	let o = t.email.trim().toLowerCase();
+	if (!o || !o.includes("@")) return f(400, { error: "a valid email is required" });
+	if (!t.tenantId) return f(400, { error: "tenantId required" });
+	if (!t.role) return f(400, { error: "role required" });
+	let s = a.invitations, c = yield* h(t.inviterUserId, t.tenantId, r, s);
+	if (g(c)) return c;
+	if (!d(s)({
+		inviterRole: c.role,
+		requestedRole: t.role,
+		tenantId: t.tenantId
+	})) return f(403, {
+		error: "role_not_grantable",
+		message: `A '${c.role}' may not invite a '${t.role}'.`
+	});
+	let l = new Date((a.now ?? Date.now)());
+	if ((yield* r.countPendingInvitations(t.tenantId, l)) >= (s?.maxPending ?? 500)) return f(429, { error: "too_many_pending_invitations" });
+	yield* r.supersedePendingInvitations(t.tenantId, o, t.inviterUserId, l).pipe(i.ignore);
+	let u = s?.ttlSeconds ?? 604800, _ = n(u), v = yield* r.insertInvitation({
+		id: e("inv"),
+		tokenHash: _.tokenHash,
+		email: o,
+		tenantId: t.tenantId,
+		role: t.role,
+		invitedByUserId: t.inviterUserId,
+		expiresAt: new Date(l.getTime() + u * 1e3)
+	});
+	if (a.sendEmail) {
+		let e = p(a.appBaseUrl ?? "", s?.callbackPath ?? "/auth/invitations/accept", _.token);
+		yield* i.tryPromise(() => a.sendEmail({
+			to: o,
+			kind: "invitation",
+			actionUrl: e,
+			subject: "You have been invited",
+			text: `You have been invited to join as ${t.role}: ${e}`,
+			html: `<p>You have been invited to join as <strong>${t.role}</strong>. <a href="${e}">Accept the invitation</a> — this link expires.</p>`
+		})).pipe(i.ignore);
+	}
+	return f(201, {
+		ok: !0,
+		invitation: m(v)
+	});
+}), v = (e, t, n) => i.gen(function* () {
+	let r = yield* h(e.callerUserId, e.tenantId, t, n.invitations);
+	return g(r) ? r : f(200, { invitations: (yield* t.listInvitations(e.tenantId)).map(m) });
+}), y = (e, t, n) => i.gen(function* () {
+	if (!e.invitationId) return f(400, { error: "invitationId required" });
+	let r = yield* h(e.callerUserId, e.tenantId, t, n.invitations);
+	if (g(r)) return r;
+	let i = new Date((n.now ?? Date.now)());
+	return (yield* t.revokeInvitation(e.invitationId, e.tenantId, e.callerUserId, i)) ? f(200, {
+		ok: !0,
+		revoked: 1
+	}) : f(404, { error: "invitation_not_found" });
+}), b = (e, n, r = {}) => i.gen(function* () {
+	if (!e.token) return f(400, { error: "token required" });
+	let i = yield* n.findInvitationByHash(t(e.token));
+	if (!i) return f(404, { error: "invalid_invitation" });
+	let a = new Date((r.now ?? Date.now)());
+	return f(200, {
+		ok: !0,
+		state: i.acceptedAt === null ? i.revokedAt === null ? i.expiresAt.getTime() <= a.getTime() ? "expired" : "pending" : "revoked" : "accepted",
+		email: i.email,
+		tenantId: i.tenantId,
+		role: i.role,
+		expiresAt: i.expiresAt.toISOString()
+	});
+}), x = (e, n, a = {}) => i.gen(function* () {
+	if (!e.token) return f(400, { error: "token required" });
+	let o = t(e.token), s = new Date((a.now ?? Date.now)()), c = yield* n.findInvitationByHash(o);
+	if (!c) return f(401, { error: "invalid_or_expired_invitation" });
+	if (!e.userId) return f(401, {
+		error: "authentication_required",
+		email: c.email
+	});
+	let l = yield* n.findById(e.userId);
+	if (!l) return f(401, {
+		error: "authentication_required",
+		email: c.email
+	});
+	if (l.email.toLowerCase() !== c.email.toLowerCase()) return f(403, {
+		error: "invitation_email_mismatch",
+		message: "This invitation was issued to a different email address. Sign in as that address to accept it."
+	});
+	let u = yield* r(a.admit, {
+		email: c.email,
+		tenantId: c.tenantId,
+		via: "invitation"
+	});
+	if (u) return f(403, {
+		error: "not_admitted",
+		reason: u.reason,
+		message: u.message
+	});
+	let d = yield* n.acceptInvitation(o, l.id, s);
+	if (!d) return f(401, { error: "invalid_or_expired_invitation" });
+	let p = yield* n.addMembership({
+		userId: l.id,
+		tenantId: d.tenantId,
+		role: d.role
+	});
+	return yield* n.markEmailVerified(l.id).pipe(i.ignore), f(200, {
+		ok: !0,
+		membership: {
+			tenantId: p.tenantId,
+			role: p.role,
+			joinedAt: p.joinedAt.toISOString()
+		}
+	});
+}), S = (n, a, o) => i.gen(function* () {
+	if (!n.token || !n.password) return f(400, { error: "token and password required" });
+	if (n.password.length < (o.minPasswordLength ?? 8)) return f(400, { error: "password must be at least 8 characters" });
+	let s = t(n.token), c = new Date((o.now ?? Date.now)()), l = yield* a.findInvitationByHash(s);
+	if (!l) return f(401, { error: "invalid_or_expired_invitation" });
+	if (yield* a.findByEmail(l.email)) return f(409, {
+		error: "account_exists",
+		message: "An account already exists for this address. Sign in, then accept the invitation."
+	});
+	let u = yield* o.hashPassword(n.password).pipe(i.orElseSucceed(() => ""));
+	if (!u) return f(500, { error: "hash_failed" });
+	let d = yield* r(o.admit, {
+		email: l.email,
+		tenantId: l.tenantId,
+		via: "invitation"
+	});
+	if (d) return f(403, {
+		error: "not_admitted",
+		reason: d.reason,
+		message: d.message
+	});
+	let p = e("user"), m = yield* a.acceptInvitation(s, p, c);
+	if (!m) return f(401, { error: "invalid_or_expired_invitation" });
+	let h = yield* a.insert({
+		id: p,
+		email: m.email,
+		passwordHash: u,
+		tenantId: m.tenantId
+	}).pipe(i.orElseSucceed(() => null));
+	return h ? (yield* a.addMembership({
+		userId: h.id,
+		tenantId: m.tenantId,
+		role: m.role
+	}), yield* a.markEmailVerified(h.id).pipe(i.ignore), f(201, {
+		ok: !0,
+		userId: h.id,
+		tenantId: m.tenantId,
+		role: m.role
+	})) : f(409, { error: "account_exists" });
+});
+//#endregion
+export { c as DEFAULT_INVITER_ROLES, s as DEFAULT_ROLE_RANK, o as INVITATION_MAX_PENDING, a as INVITATION_TTL_S, u as defaultCanGrantRole, x as handleAcceptInvitation, S as handleAcceptInvitationWithSignUp, _ as handleCreateInvitation, v as handleListInvitations, b as handlePreviewInvitation, y as handleRevokeInvitation };

package/dist/mail.js

@@ -0,0 +1,10 @@
+import { Effect as e } from "effect";
+//#region src/mail.ts
+var t = (t) => (n) => e.runPromise(t.send({
+	to: n.to,
+	subject: n.subject,
+	html: n.html,
+	text: n.text
+}).pipe(e.asVoid, e.orElseSucceed(() => void 0)));
+//#endregion
+export { t as mailSender };

package/dist/memberships.js

@@ -0,0 +1,8 @@
+import { Effect as e } from "effect";
+//#region src/memberships.ts
+var t = (t) => async (n) => n.type === "user" ? (await e.runPromise(t.listMemberships(n.id))).map((e) => ({
+	tenantId: e.tenantId,
+	role: e.role
+})) : [];
+//#endregion
+export { t as authMemberships };