@voltro/plugin-auth 0.85.0 → 0.87.0

package/dist/strategy-XaGjSicX.js

@@ -1,353 +0,0 @@
-import { sessionSecretsOf as e } from "./session.js";
-import { Data as t, Effect as n } from "effect";
-import { readSessionValue as r, resolveSessionSecret as i, verifySessionKeyed as a } from "@voltro/protocol/session";
-import { generateId as o } from "@voltro/database";
-//#region src/revocation.ts
-var s = 3e4, c = 1e4, l = (e, t = {}) => {
-	let r = t.ttlMs ?? s, i = t.maxEntries ?? c, a = t.now ?? Date.now, o = /* @__PURE__ */ new Map(), l = () => {
-		if (o.size <= i) return;
-		let e = a();
-		for (let [t, n] of o) n.freshUntil <= e && o.delete(t);
-		for (let e of o.keys()) {
-			if (o.size <= i) break;
-			o.delete(e);
-		}
-	}, u = (e) => e !== null && e.expiresAt.getTime() > a();
-	return {
-		ttlMs: r,
-		invalidate: (e) => {
-			o.delete(e);
-		},
-		isLive: (t) => n.gen(function* () {
-			let n = a();
-			if (r > 0) {
-				let e = o.get(t);
-				if (e && e.freshUntil > n) return e.live;
-			}
-			let i = yield* e.findSession(t), s = u(i);
-			return r > 0 && (o.set(t, {
-				live: s,
-				freshUntil: n + r
-			}), l()), s;
-		})
-	};
-}, u = class extends t.TaggedError("UserAlreadyExistsError") {}, d = class extends t.TaggedError("UserNotFoundError") {}, f = (e) => o({
-	kind: "typeid",
-	prefix: e
-}, e), p = (e = []) => {
-	let t = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), i = [], a = [], o = [], s = [], c = [], l = [], p = [], m = /* @__PURE__ */ new Map();
-	for (let n of e) t.set(n.id, n), r.set(n.email.toLowerCase(), n);
-	let h = (e, i) => n.gen(function* () {
-		let a = t.get(e);
-		if (!a) return yield* n.fail(new d({ userId: e }));
-		let o = i(a);
-		return t.set(e, o), r.set(o.email.toLowerCase(), o), o;
-	});
-	return {
-		findByEmail: (e) => n.sync(() => r.get(e.toLowerCase()) ?? null),
-		findById: (e) => n.sync(() => t.get(e) ?? null),
-		insert: (e) => n.gen(function* () {
-			let i = e.email.toLowerCase();
-			if (r.has(i)) return yield* n.fail(new u({ email: i }));
-			let a = {
-				...e,
-				email: i,
-				createdAt: /* @__PURE__ */ new Date()
-			};
-			return t.set(a.id, a), r.set(i, a), a;
-		}),
-		updatePassword: (e, t) => h(e, (e) => ({
-			...e,
-			passwordHash: t
-		})),
-		setMfaSecret: (e, t) => h(e, (e) => ({
-			...e,
-			mfaSecret: t,
-			mfaEnrolledAt: null
-		})),
-		markMfaEnrolled: (e) => h(e, (e) => ({
-			...e,
-			mfaEnrolledAt: /* @__PURE__ */ new Date()
-		})),
-		clearMfa: (e) => h(e, (e) => ({
-			...e,
-			mfaSecret: null,
-			mfaEnrolledAt: null
-		})),
-		markEmailVerified: (e) => h(e, (e) => e.emailVerifiedAt ? e : {
-			...e,
-			emailVerifiedAt: /* @__PURE__ */ new Date()
-		}),
-		listMemberships: (e) => n.sync(() => i.filter((t) => t.userId === e)),
-		addMembership: (e) => n.sync(() => {
-			let t = i.findIndex((t) => t.userId === e.userId && t.tenantId === e.tenantId), n = {
-				...e,
-				joinedAt: /* @__PURE__ */ new Date()
-			};
-			if (t >= 0) {
-				let e = i[t], r = {
-					...n,
-					joinedAt: e.joinedAt
-				};
-				return i[t] = r, r;
-			}
-			return i.push(n), n;
-		}),
-		membershipRole: (e, t) => n.sync(() => i.find((n) => n.userId === e && n.tenantId === t)?.role ?? null),
-		listSessions: (e) => n.sync(() => a.filter((t) => t.userId === e).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
-		insertSession: (e) => n.sync(() => {
-			let t = /* @__PURE__ */ new Date(), n = {
-				...e,
-				createdAt: t,
-				lastSeenAt: t
-			};
-			return a.push(n), n;
-		}),
-		findSession: (e) => n.sync(() => a.find((t) => t.id === e) ?? null),
-		touchSession: (e, t) => n.sync(() => {
-			let n = a.findIndex((t) => t.id === e);
-			n >= 0 && (a[n] = {
-				...a[n],
-				expiresAt: t,
-				lastSeenAt: /* @__PURE__ */ new Date()
-			});
-		}),
-		revokeSession: (e, t) => n.sync(() => {
-			let n = a.findIndex((n) => n.id === t && n.userId === e);
-			return n < 0 ? !1 : (a.splice(n, 1), !0);
-		}),
-		revokeAllOtherSessions: (e, t) => n.sync(() => {
-			let n = 0;
-			for (let r = a.length - 1; r >= 0; r--) {
-				let i = a[r];
-				i.userId === e && i.id !== t && (a.splice(r, 1), n++);
-			}
-			return n;
-		}),
-		revokeAllSessions: (e) => n.sync(() => {
-			let t = 0;
-			for (let n = a.length - 1; n >= 0; n--) a[n].userId === e && (a.splice(n, 1), t++);
-			return t;
-		}),
-		insertToken: (e) => n.sync(() => {
-			let t = {
-				...e,
-				consumedAt: null,
-				createdAt: /* @__PURE__ */ new Date()
-			};
-			return o.push(t), t;
-		}),
-		consumeToken: (e, t) => n.sync(() => {
-			let n = Date.now(), r = o.find((r) => r.tokenHash === e && r.purpose === t && r.consumedAt === null && r.expiresAt.getTime() > n);
-			if (!r) return null;
-			let i = {
-				...r,
-				consumedAt: /* @__PURE__ */ new Date()
-			}, a = o.indexOf(r);
-			return o[a] = i, i;
-		}),
-		latestToken: (e, t) => n.sync(() => {
-			let n = null;
-			for (let r of o) r.userId === e && r.purpose === t && (n === null || r.createdAt.getTime() > n.createdAt.getTime()) && (n = r);
-			return n;
-		}),
-		insertInvitation: (e) => n.sync(() => {
-			let t = {
-				...e,
-				email: e.email.toLowerCase(),
-				acceptedAt: null,
-				acceptedByUserId: null,
-				revokedAt: null,
-				revokedByUserId: null,
-				createdAt: /* @__PURE__ */ new Date()
-			};
-			return l.push(t), t;
-		}),
-		findInvitationByHash: (e) => n.sync(() => l.find((t) => t.tokenHash === e) ?? null),
-		acceptInvitation: (e, t, r) => n.sync(() => {
-			let n = l.findIndex((t) => t.tokenHash === e && t.acceptedAt === null && t.revokedAt === null && t.expiresAt.getTime() > r.getTime());
-			if (n < 0) return null;
-			let i = {
-				...l[n],
-				acceptedAt: r,
-				acceptedByUserId: t
-			};
-			return l[n] = i, i;
-		}),
-		revokeInvitation: (e, t, r, i) => n.sync(() => {
-			let n = l.findIndex((n) => n.id === e && n.tenantId === t && n.acceptedAt === null && n.revokedAt === null);
-			return n < 0 ? !1 : (l[n] = {
-				...l[n],
-				revokedAt: i,
-				revokedByUserId: r
-			}, !0);
-		}),
-		listInvitations: (e) => n.sync(() => l.filter((t) => t.tenantId === e).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
-		countPendingInvitations: (e, t) => n.sync(() => l.filter((n) => n.tenantId === e && n.acceptedAt === null && n.revokedAt === null && n.expiresAt.getTime() > t.getTime()).length),
-		supersedePendingInvitations: (e, t, r, i) => n.sync(() => {
-			let n = t.toLowerCase(), a = 0;
-			for (let t = 0; t < l.length; t++) {
-				let o = l[t];
-				o.tenantId === e && o.email === n && o.acceptedAt === null && o.revokedAt === null && (l[t] = {
-					...o,
-					revokedAt: i,
-					revokedByUserId: r
-				}, a++);
-			}
-			return a;
-		}),
-		insertImpersonationGrant: (e) => n.sync(() => {
-			let t = {
-				...e,
-				startedAt: /* @__PURE__ */ new Date(),
-				endedAt: null,
-				endedReason: null
-			};
-			return p.push(t), t;
-		}),
-		findImpersonationGrantBySession: (e) => n.sync(() => p.find((t) => t.sessionId === e) ?? null),
-		endImpersonationGrant: (e, t, r) => n.sync(() => {
-			let n = p.findIndex((t) => t.sessionId === e && t.endedAt === null);
-			return n < 0 ? !1 : (p[n] = {
-				...p[n],
-				endedAt: r,
-				endedReason: t
-			}, !0);
-		}),
-		replaceRecoveryCodes: (e, t) => n.sync(() => {
-			for (let t = c.length - 1; t >= 0; t--) c[t].userId === e && c.splice(t, 1);
-			let n = /* @__PURE__ */ new Date();
-			for (let r of t) c.push({
-				id: f("rc"),
-				userId: e,
-				codeHash: r,
-				consumedAt: null,
-				createdAt: n
-			});
-		}),
-		consumeRecoveryCode: (e, t) => n.sync(() => {
-			let n = c.findIndex((n) => n.userId === e && n.codeHash === t && n.consumedAt === null);
-			return n < 0 ? !1 : (c[n] = {
-				...c[n],
-				consumedAt: /* @__PURE__ */ new Date()
-			}, !0);
-		}),
-		countRecoveryCodes: (e) => n.sync(() => c.filter((t) => t.userId === e && t.consumedAt === null).length),
-		listPasskeys: (e) => n.sync(() => s.filter((t) => t.userId === e)),
-		findPasskey: (e) => n.sync(() => s.find((t) => t.credentialId === e) ?? null),
-		insertPasskey: (e) => n.sync(() => {
-			let t = /* @__PURE__ */ new Date(), n = {
-				...e,
-				createdAt: t,
-				lastUsedAt: null
-			};
-			return s.push(n), n;
-		}),
-		advancePasskeyCounter: (e, t) => n.sync(() => {
-			let n = s.findIndex((t) => t.credentialId === e);
-			return n < 0 || t <= s[n].counter ? !1 : (s[n] = {
-				...s[n],
-				counter: t,
-				lastUsedAt: /* @__PURE__ */ new Date()
-			}, !0);
-		}),
-		isLockedOut: (e, t) => n.sync(() => {
-			let n = m.get(e.toLowerCase());
-			return n?.lockedUntil != null && t < n.lockedUntil ? {
-				locked: !0,
-				retryAfterSeconds: Math.ceil((n.lockedUntil - t) / 1e3)
-			} : {
-				locked: !1,
-				retryAfterSeconds: 0
-			};
-		}),
-		recordLoginFailure: (e, t, r) => n.sync(() => {
-			let n = e.toLowerCase(), i = m.get(n), a = i?.windowStartedAt == null || t - i.windowStartedAt >= r.windowMs, o = i?.lockedUntil != null && t >= i.lockedUntil, s = !i || a || o, c = s ? 1 : i.failedCount + 1, l = s ? t : i.windowStartedAt, u = c >= r.maxAttempts ? t + r.lockMs : null;
-			m.set(n, {
-				failedCount: c,
-				windowStartedAt: l,
-				lockedUntil: u
-			});
-		}),
-		clearLoginFailures: (e) => n.sync(() => {
-			m.delete(e.toLowerCase());
-		})
-	};
-}, m = (e, t = {}) => {
-	let n = { ...t.metadata };
-	return t.memberships && (n.memberships = t.memberships.map((e) => ({
-		tenantId: e.tenantId,
-		role: e.role
-	}))), {
-		type: "user",
-		id: e.id,
-		tenantId: t.tenantId ?? e.tenantId,
-		...Object.keys(n).length > 0 ? { metadata: n } : {}
-	};
-}, h = (e) => {
-	if (e.type !== "user") return null;
-	let t = e.metadata?.sessionId;
-	return typeof t == "string" && t.length > 0 ? t : null;
-}, g = (e) => {
-	if (e.type !== "user") return [];
-	let t = e.metadata?.memberships;
-	return Array.isArray(t) ? t.filter((e) => typeof e == "object" && !!e && typeof e.tenantId == "string" && typeof e.role == "string") : [];
-}, _ = (e) => typeof e.isLive == "function", v = (e) => e.revocation && _(e.revocation) ? e.revocation : e.store ? l(e.store, e.revocation ?? {}) : null, y = (t = {}) => {
-	let o = t.cookieName ?? "voltro:session", s = v(t), c = t.revocation && !_(t.revocation) ? t.revocation : {}, u = /* @__PURE__ */ new WeakMap(), d = (e) => {
-		if (s) return s;
-		let n = t.sessionRegistry;
-		if (n === void 0) return null;
-		if (typeof n != "function") return l(n, c);
-		if (e === void 0) return null;
-		let r = u.get(e);
-		if (r) return r;
-		let i = l(n(e), c);
-		return u.set(e, i), i;
-	};
-	return {
-		id: "voltro-password",
-		resolve: (s) => {
-			let c = r(s.headers, o);
-			if (!c) return { kind: "skip" };
-			let l = e(t.secret ?? i()), u = a(c, l);
-			if (!u) return {
-				kind: "failed",
-				reason: "voltro session cookie failed verification"
-			};
-			let f = b(u.subject, "voltro-password"), p = h(f);
-			if (!p) return t.requireSessionId === !0 ? {
-				kind: "failed",
-				reason: "voltro session cookie carries no session id"
-			} : {
-				kind: "matched",
-				subject: f
-			};
-			let m = d(s.store);
-			return m ? n.runPromise(m.isLive(p)).then((e) => e ? {
-				kind: "matched",
-				subject: f
-			} : {
-				kind: "failed",
-				reason: "voltro session revoked"
-			}) : t.requireSessionId === !0 && t.sessionRegistry !== void 0 ? {
-				kind: "failed",
-				reason: "session registry not available yet"
-			} : {
-				kind: "matched",
-				subject: f
-			};
-		}
-	};
-}, b = (e, t) => {
-	if (e.type === "anonymous") return e;
-	let n = e.metadata ?? {};
-	return {
-		...e,
-		metadata: {
-			...n,
-			provider: t
-		}
-	};
-};
-//#endregion
-export { f as a, g as c, p as i, l, u as n, h as o, d as r, m as s, y as t };