@voltro/plugin-auth 0.86.0 → 0.87.0

package/dist/index.d.ts

@@ -1,13 +1,17 @@
 import { AuthStrategy } from '@voltro/protocol';
+import { ColumnBuilder } from '@voltro/database';
 import { ConnectionCredential } from '@voltro/protocol';
 import { DataStore } from '@voltro/database';
+import { Duration } from 'effect';
 import { Effect } from 'effect';
+import { FieldDefinitions } from '@voltro/database';
 import { KeyedSecret } from '@voltro/protocol/session';
 import { MembershipsSource } from '@voltro/protocol';
 import { SessionSecrets } from '@voltro/protocol/session';
 import { SqlClient } from 'effect/sql/SqlClient';
 import { Subject } from '@voltro/protocol';
 import { SubjectIdentity } from '@voltro/protocol';
+import { Table } from '@voltro/database';
 import { VerifyOptions } from '@voltro/protocol/session';
 import { VerifyResult } from '@voltro/protocol/session';
 import { VoidIfEmpty } from 'effect/Types';
@@ -42,6 +46,9 @@ export declare interface AdmissionRefusal {
 /** Decide whether a person may join a tenant — `null` to let them in. */
 export declare type AdmitJoining = (joining: Joining, context: AdmissionContext) => Effect.Effect<AdmissionRefusal | null> | Promise<AdmissionRefusal | null>;
 
+/** The page a ticket may open: same-origin, below an allowed path, no traversal. */
+export declare const allowedOverlayPage: (next: string, paths: ReadonlyArray<string>) => boolean;
+
 /**
  * Keep users in the app's own database.
  *
@@ -83,6 +90,16 @@ export declare interface AssertionVerifyInput {
     readonly storedCounter: number;
 }
 
+/** General authentication extensions; install `auth.guest(...)` or `auth.overlay(...)` in plugins. */
+export declare const auth: {
+    readonly guest: (options: GuestPluginOptions) => GuestAuthPlugin;
+    readonly overlay: (options: OverlayPluginOptions) => VoltroPlugin;
+};
+
+/** Non-session handoffs have separate signature domains. A signed OAuth
+ * cookie must never become a native login code or a registered session. */
+export declare type AuthClaimsPurpose = 'native-pending' | 'native-code' | 'social-login' | 'social-upgrade' | 'social-native-upgrade' | 'account-merge';
+
 export declare interface AuthConfig {
     /**
      * The session-signing key. OMIT IT and the value is read from
@@ -175,6 +192,27 @@ export declare interface AuthConfig {
     readonly emailVerification?: EmailVerificationConfig;
 }
 
+/** Device credentials never appear in SQL, logs, exports or session claims. */
+export declare const authGuestDevicesTable: Table<"authGuestDevices", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly guestId: ColumnBuilder<string, "text", boolean>;
+    readonly tenantId: ColumnBuilder<string, "text", boolean>;
+    readonly secretHash: ColumnBuilder<string, "text", boolean>;
+    readonly generation: ColumnBuilder<number, "integer", boolean>;
+    readonly expiresAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+}>, true, never>;
+
+/** Guest identity is independent of the password user's email record. */
+export declare const authGuestsTable: Table<"authGuests", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly tenantId: ColumnBuilder<string, "text", boolean>;
+    readonly upgradeable: ColumnBuilder<boolean, "boolean", boolean>;
+    readonly expiresAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly lastSeenAt: ColumnBuilder<Date, "timestamp", boolean>;
+}>, true, never>;
+
 export declare const authMemberships: (store: UserStore) => MembershipsSource;
 
 /**
@@ -183,7 +221,7 @@ export declare const authMemberships: (store: UserStore) => MembershipsSource;
  * routes use) so the framework's serve pipeline can slot it into the
  * per-app auth chain — the rpc/WS path then rejects revoked sessions
  * exactly like the `/auth/*` routes. Read it via
- * `getAuthSessionStrategy`.
+ * `getAuthSessionStrategies`.
  */
 export declare interface AuthPlugin extends VoltroPlugin {
     readonly auth: {
@@ -233,6 +271,15 @@ export declare interface AuthRoutesPluginOptions extends AuthConfig {
      * otherwise get 500s from a route it never asked for.
      */
     readonly invitations?: InvitationsConfig;
+    /**
+     * Guest → account with email and password. PRESENT mounts `POST /auth/upgrade-guest`
+     * (`{ credential, email, password }`, CSRF): the guest becomes a registered account under its
+     * own subject ID, so what it owns stays its own. Pass the installed guest lifecycle port,
+     * e.g. `{ service: () => guestPlugin.guest.service() }`. ABSENT mounts nothing.
+     */
+    readonly guestUpgrade?: {
+        readonly service: () => GuestAuthService;
+    };
     /**
      * User impersonation ("log in as"). PRESENT mounts `/auth/impersonate/start`
      * + `/stop`, arms the retention bound on `impersonationGrants`, and closes
@@ -267,6 +314,10 @@ export declare interface ChallengeStore {
  */
 export declare const clearSessionCookie: (options?: IssueSessionOptions) => string;
 
+/** Upgrade the presented guest to an email/password account under the same subject ID. An email
+ * that already has an account refuses (`email_taken`); this never merges accounts. */
+export declare const completeGuestPasswordUpgrade: (options: GuestPasswordUpgradeOptions) => Effect.Effect<GuestPasswordUpgradeResult>;
+
 /** The keyed secret set a handler signs/verifies with — the explicit
  *  `config.secrets` when set, else `config.secret` widened with the
  *  rotation env vars. */
@@ -304,6 +355,10 @@ export declare const CSRF_HEADER_NAME: "x-csrf-token";
  */
 export declare const dataStoreChallengeStore: (sql: SqlClient) => ChallengeStore;
 
+/** Uses the app's existing DataStore and session issuer. Device proof grants
+ * guest identity only; provider linking is a separate trusted-account operation. */
+export declare const dataStoreGuestAuth: (store: DataStore, options: GuestAuthOptions) => GuestAuthService;
+
 /**
  * Session rows in the app's own database — the `sessions` table from
  * `@voltro/plugin-auth/schema`, which the app registers like any other. Reads
@@ -450,11 +505,12 @@ export declare const generateTotpCode: (secretBase32: string, nowMs?: number) =>
 export declare const generateTotpSecret: () => string;
 
 /**
- * Pull the pre-wired session strategy off a plugin list (the framework's
- * serve pipeline calls this when composing the auth chain). Returns the
- * FIRST auth plugin's strategy, or null when no auth plugin is present.
+ * Collect pre-wired session strategies in plugin declaration order. The
+ * framework inserts each original strategy into its shared auth chain, so
+ * prefix ordering, collision diagnostics and boot verification see them all.
+ * Only `skip` advances; rejected credentials never get another attempt.
  */
-export declare const getAuthSessionStrategy: (plugins: ReadonlyArray<VoltroPlugin>) => AuthStrategy | null;
+export declare const getAuthSessionStrategies: (plugins: ReadonlyArray<VoltroPlugin>) => ReadonlyArray<AuthStrategy>;
 
 export declare interface GrantRoleContext {
     /** The inviter's role in THIS tenant, as read from `memberships`. */
@@ -477,6 +533,149 @@ export declare interface GrantRoleContext {
  */
 export declare const guardSubject: (user: UserRecord, config: AuthConfig) => Effect.Effect<HandlerResult | null>;
 
+export declare class GuestAuthError extends GuestAuthError_base<{
+    readonly code: 'credential_rejected' | 'store_unavailable' | 'upgrade_conflict';
+}> {
+}
+
+declare const GuestAuthError_base: new <A extends Record<string, any> = {}>(args: VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => YieldableError & {
+    readonly _tag: "GuestAuthError";
+} & Readonly<A>;
+
+export declare interface GuestAuthOptions {
+    /** Server-owned tenant selection; never copied from a device or request body. */
+    readonly tenantId: string;
+    readonly secret: SessionSecretInput | (() => SessionSecretInput);
+    readonly upgradeable?: boolean;
+    readonly ttlSeconds?: number;
+    readonly sessionTtlSeconds?: number;
+    readonly secure?: boolean;
+    readonly now?: () => number;
+}
+
+export declare interface GuestAuthPlugin extends AuthPlugin {
+    readonly guest: {
+        /** Server-side lifecycle/privacy port, available after normal store binding. */
+        readonly service: () => GuestAuthService;
+    };
+}
+
+export declare const guestAuthPlugin: (options: GuestPluginOptions) => GuestAuthPlugin;
+
+/** Durable guest lifecycle port. Implementations must serialize every write
+ * against the guest identity and commit session rows before returning credentials. */
+export declare interface GuestAuthService {
+    readonly create: () => Effect.Effect<GuestSession, GuestAuthError>;
+    readonly resume: (credential: string) => Effect.Effect<GuestSession, GuestAuthError>;
+    /** Propose a fresh server-minted proof without replacing the active proof. */
+    readonly prepareRotation: (credential: string) => Effect.Effect<{
+        readonly deviceCredential: string;
+    }, GuestAuthError>;
+    /** The caller durably journals both proofs before this atomic replacement. */
+    readonly rotate: (credential: string, nextCredential: string) => Effect.Effect<GuestSession, GuestAuthError>;
+    readonly revoke: (credential: string) => Effect.Effect<void, GuestAuthError>;
+    /** Server-side privacy hook: the caller must authorize this subject ID. */
+    readonly erase: (subjectId: string) => Effect.Effect<boolean, GuestAuthError>;
+    /** Server-side privacy hook: excludes credential hashes and credential bytes. */
+    readonly export: (subjectId: string) => Effect.Effect<GuestExport | null, GuestAuthError>;
+    readonly isLive: (subject: SubjectIdentity) => Effect.Effect<boolean, GuestAuthError>;
+    /** Trusted server operation. The writer must use this transaction to create
+     * the registered `users` row with exactly the guest ID and tenant. The guest
+     * fence, writer, device removal and guest-session revocation commit together.
+     * No client-supplied kind/state can authorize an upgrade. */
+    readonly upgrade: <A>(credential: string, writer: GuestUpgradeWriter<A>) => Effect.Effect<A, GuestAuthError>;
+    /** Trusted, separately confirmed merge into an EXISTING registered subject.
+     * The coordinator must prove target ownership and run all data hooks through
+     * this same transaction. A device proof alone never proves target ownership. */
+    readonly mergeInto: <A>(credential: string, targetId: string, writer: GuestMergeWriter<A>) => Effect.Effect<A, GuestAuthError>;
+}
+
+export declare interface GuestExport {
+    readonly subject: {
+        readonly id: string;
+        readonly tenantId: string;
+        readonly kind: 'guest';
+        readonly upgradeable: boolean;
+        readonly createdAt: number;
+        readonly expiresAt: number;
+    };
+    readonly devices: ReadonlyArray<{
+        readonly id: string;
+        readonly generation: number;
+        readonly createdAt: number;
+        readonly expiresAt: number;
+    }>;
+    readonly sessions: ReadonlyArray<{
+        readonly id: string;
+        readonly expiresAt: number;
+    }>;
+}
+
+export declare type GuestIdentity = Extract<SubjectIdentity, {
+    readonly type: 'user';
+}> & {
+    readonly kind: 'guest';
+};
+
+export declare interface GuestMergeContext extends GuestUpgradeContext {
+    readonly targetId: string;
+}
+
+export declare type GuestMergeWriter<A> = (context: GuestMergeContext) => Promise<A>;
+
+export declare interface GuestPasswordUpgradeOptions {
+    /** The guest's device proof, as the guest client presents it. */
+    readonly credential: string;
+    readonly email: string;
+    readonly password: string;
+    /** The installed guest lifecycle port (`guestPlugin.guest.service()`). */
+    readonly service: GuestAuthService;
+    readonly users: UserStore;
+    readonly config: AuthConfig;
+    readonly ipAddress?: string | null;
+    readonly userAgent?: string | null;
+}
+
+export declare type GuestPasswordUpgradeResult = {
+    readonly kind: 'ok';
+    readonly userId: string;
+    readonly subject: unknown;
+    readonly setCookie: string;
+} | {
+    readonly kind: 'refused';
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+};
+
+export declare interface GuestPluginOptions {
+    /** Server-owned tenant, required; client headers and device proof cannot pick it. */
+    readonly tenantId: string;
+    readonly upgradeable?: boolean;
+    readonly ttl?: Duration.Input;
+    readonly sessionTtl?: Duration.Input;
+    readonly secret?: SessionSecretInput;
+    readonly secure?: boolean;
+    readonly prefix?: string;
+    /** Inject a complete durable lifecycle port; never an ephemeral credential fallback. */
+    readonly service?: (store: DataStore) => GuestAuthService;
+}
+
+export declare interface GuestSession extends IssuedRegisteredSession {
+    readonly subject: GuestIdentity;
+    /** Opaque proof returned only on creation or explicit credential rotation. */
+    readonly deviceCredential?: string;
+}
+
+export declare interface GuestUpgradeContext {
+    readonly store: DataStore;
+    readonly subjectId: string;
+    readonly tenantId: string;
+    readonly createdAt: Date;
+}
+
+export declare type GuestUpgradeWriter<A> = (context: GuestUpgradeContext) => Promise<A>;
+
 /**
  * Accept an invitation as an ALREADY-AUTHENTICATED user.
  *
@@ -1370,6 +1569,13 @@ export declare interface LockoutStore {
     readonly clearLoginFailures: (email: string) => Effect.Effect<void>;
 }
 
+/** Read an owned, unrotated credential under its canonical family fence.
+ * Call only inside the caller's existing transaction, after any application
+ * account/tenant fences. Locks remain held until that transaction ends. This
+ * checks persistence identity, not the signed credential, expiry or permissions.
+ * Locking-read conflicts follow the selected store's transaction semantics. */
+export declare const lockRegisteredSession: (store: DataStore, userId: string, sessionId: string) => Promise<SessionRecord | null>;
+
 /** Default magic-link lifetime — short, since it's an inbox round-trip. */
 export declare const MAGIC_LINK_TTL_S: number;
 
@@ -1611,6 +1817,32 @@ export declare const otpauthUrl: (params: {
     readonly secret: string;
 }) => string;
 
+/**
+ * Mount the web overlay handoff: an engine client trades its header session
+ * for a one-time URL that signs an embedded browser in to `paths` of the web
+ * app with the same session row. Install as `auth.overlay({ paths: ['/overlay'] })`.
+ */
+export declare const overlayAuthPlugin: (options: OverlayPluginOptions) => VoltroPlugin;
+
+/** Options of `auth.overlay(...)`, the web overlay handoff for engine clients. */
+export declare interface OverlayPluginOptions {
+    /** Pages a ticket may open, e.g. `['/overlay']`. A page is allowed when its
+     *  path equals one of these or lies below it. Required: the handoff signs
+     *  the embedded browser in, so it lands only where the app expects it. */
+    readonly paths: ReadonlyArray<string>;
+    /** Lifetime of a ticket. Default 60 seconds, at most 5 minutes. */
+    readonly ttl?: Duration.Input;
+    /** Signing keys of the sessions this handoff accepts. Default: the
+     *  project's `VOLTRO_SESSION_SECRET` (and `_PREVIOUS`). */
+    readonly secret?: SessionSecretInput;
+    /** `Secure` on the cookie. Default `true`; `false` only for plain-http development. */
+    readonly secure?: boolean;
+    /** Cookie `Domain`, when the web app and the API share a parent domain. */
+    readonly domain?: string;
+    /** Route prefix. Default `/auth/overlay`. */
+    readonly prefix?: string;
+}
+
 declare interface ParsedHash {
     readonly N: number;
     readonly r: number;
@@ -1618,6 +1850,13 @@ declare interface ParsedHash {
     readonly keyLen: number;
 }
 
+/** Browser-safe shape only. Possession is verified against SQL on the server. */
+export declare const parseGuestCredential: (credential: string) => {
+    readonly guestId: string;
+    readonly deviceId: string;
+    readonly secret: string;
+} | null;
+
 /** Parse the scrypt parameters out of a stored hash. Returns null when the
  *  string isn't a well-formed `scrypt$N$r$p$salt$derived`, or when its
  *  parameters exceed the derivation ceiling. */
@@ -1913,15 +2152,18 @@ export declare interface SessionRecord {
 export declare type SessionRegistry = SessionStore;
 
 export declare interface SessionRegistryStoreOptions {
-    /** Borrow an already owned transaction; otherwise registry writes open one. */
+    /** Borrow an already owned transaction; otherwise registry writes open one.
+     * Account-wide revocation needs the application's real owner fence. With an
+     * older repeatable-read snapshot, root issuance must also change that owner's
+     * persisted revision so a conflicting old transaction retries or aborts. */
     readonly transaction?: 'existing';
 }
 
 export declare interface SessionRevocationChecker {
-    /** Is this session still live? `false` means the row was revoked (or
-     *  is past its `expiresAt`) — the caller rejects the cookie. Verdicts
-     *  are cached for `ttlMs`. */
-    readonly isLive: (sessionId: string) => Effect.Effect<boolean>;
+    /** Is this exact session credential live for the signed subject's user ID?
+     * Refuse a missing/rotated/expired row or a different stored owner. Cache
+     * verdicts retain native owner identity, never the requested owner. */
+    readonly isLiveFor: (sessionId: string, userId: string) => Effect.Effect<boolean>;
     /** Drop the cached verdict for one session — called inline by
      *  sign-out / revoke handlers so the kill is immediate on THIS
      *  process (other replicas converge within `ttlMs`). */
@@ -1967,13 +2209,14 @@ export declare const sessionSecretsOf: (secret: SessionSecretInput) => SessionSe
 
 /** Server-side sessions — enumeration + revocation. */
 export declare interface SessionStore {
-    /** Active sessions for a user (most recent first). */
+    /** Unrotated credentials with an existing canonical root owned by the same user, most recent first. */
     readonly listSessions: (userId: string) => Effect.Effect<ReadonlyArray<SessionRecord>>;
     /** Record a session on sign-in. */
     readonly insertSession: (session: Omit<SessionRecord, 'createdAt' | 'lastSeenAt'>) => Effect.Effect<SessionRecord>;
-    /** Look up one session row by id. The request-time revocation check
-     *  (`makeSessionRevocationChecker`) calls this — a missing row means
-     *  the session was revoked. */
+    /** Look up an unrotated credential only while its canonical family root
+     * exists and belongs to the same user. A rotated root remains an anchor;
+     * its tenant does not replace the credential tenant. Custom stores must
+     * enforce this before returning a row to request-time revocation checks. */
     readonly findSession: (sessionId: string) => Effect.Effect<SessionRecord | null>;
     /** Slide a session row forward: bump `expiresAt` + `lastSeenAt`. Called
      *  when the sliding-window renewal re-issues the cookie, so the row
@@ -1992,6 +2235,8 @@ export declare interface SessionStore {
     readonly revokeAllSessions: (userId: string) => Effect.Effect<number>;
 }
 
+export declare const signAuthClaims: (claims: Readonly<Record<string, unknown>>, secret: string, purpose: AuthClaimsPurpose) => string;
+
 export declare interface SignInInput {
     readonly email: string;
     readonly password: string;
@@ -2171,7 +2416,7 @@ declare const UserNotFoundError_base: new <A extends Record<string, any> = {}>(a
 
 export declare interface UserRecord {
     readonly id: string;
-    readonly email: string;
+    readonly email: string | null;
     /**
      * The stored scrypt hash — OPTIONAL, because not every identity has a
      * password. An SSO-only, magic-link-only, passkey-only, or provider-PAT
@@ -2236,6 +2481,8 @@ export declare type UserStoreResolver = (ctx: UserStoreBindContext) => UserStore
 /** Verify a passkey assertion (sign-in). */
 export declare const verifyAssertion: (input: AssertionVerifyInput) => AssertionOutcome;
 
+export declare const verifyAuthClaims: (value: string | undefined, secret: string, purpose: AuthClaimsPurpose, now?: () => number) => Record<string, unknown> | null;
+
 /**
  * Verify a state-changing request's CSRF protection. Both the header
  * value and the cookie value must (a) be the SAME token and (b) carry a
@@ -2321,6 +2568,9 @@ export declare interface VoltroPasswordStrategyOptions {
      *  (stateless); with it, nothing but a registered session authenticates,
      *  and every session can be revoked. */
     readonly requireSessionId?: boolean;
+    /** Verified user identity kinds owned by this carrier. Other verified kinds
+     * skip to their own carrier; malformed, forged or expired values still fail. */
+    readonly userKinds?: ReadonlyArray<'registered' | 'guest'>;
 }
 
 export declare type WebAuthnError = 'bad-client-data' | 'wrong-type' | 'challenge-mismatch' | 'origin-mismatch' | 'rpid-mismatch' | 'user-not-present' | 'bad-auth-data' | 'no-credential' | 'unsupported-key' | 'bad-signature' | 'counter-replay';

package/dist/index.js

@@ -2,22 +2,30 @@ import { PasswordEmptyError as e, PasswordHashError as t, hashPassword as n, nee
 import { SESSION_COOKIE_NAME as s, clearSessionCookie as c, issueSession as l, readSession as u, readSessionFromHeaders as d, readSessionKeyed as f, resolveSessionSecret as p, resolveSessionSecrets as m, sessionSecretsOf as h } from "./session.js";
 import { makeSessionRevocationChecker as g } from "./revocation.js";
 import { UserAlreadyExistsError as _, UserNotFoundError as v, memoryUserStore as y, newAuthId as b, sessionIdOfSubject as x, subjectFromUser as S, subjectMemberships as C } from "./userStore.js";
-import { dataStoreSessionRegistry as w, issueRegisteredSession as T, rotateRegisteredSession as E, withSessionId as D } from "./sessionRegistry.js";
-import { authMemberships as O } from "./memberships.js";
-import { postgresUserStore as k } from "./postgresUserStore.js";
-import { appUserStore as A } from "./appUserStore.js";
-import { runSubjectGuards as j } from "./subjectGuard.js";
-import { TotpVerifyError as M, generateRecoveryCodes as N, generateTotpCode as P, generateTotpSecret as F, otpauthUrl as I, verifyTotpCode as L } from "./totp.js";
-import { EMAIL_VERIFY_TTL_S as R, MAGIC_LINK_TTL_S as z, MFA_PENDING_TTL_S as B, NATIVE_CODE_TTL_S as V, PASSWORD_RESET_TTL_S as H, hashToken as U, mintSecret as W, mintToken as G } from "./tokens.js";
-import { CSRF_COOKIE_NAME as K, CSRF_HEADER_NAME as q, isCsrfTokenWellFormed as J, issueCsrfToken as Y, verifyCsrf as X } from "./csrf.js";
-import { EMAIL_NOT_VERIFIED_CODE as Z, EMAIL_VERIFIED_METADATA_KEY as Q, EMAIL_VERIFY_RESEND_COOLDOWN_S as $, emailVerificationActive as ee, emailVerificationGuard as te, handleEmailVerifyConfirm as ne, handleEmailVerifyRequest as re, isEmailVerified as ie, sendEmailVerification as ae, userEmailVerified as oe } from "./emailVerification.js";
-import { configSessionSecrets as se, guardSubject as ce, handleCsrf as le, handleListMemberships as ue, handleListSessions as de, handleMagicLinkConsume as fe, handleMagicLinkRequest as pe, handleMfaEnrollStart as me, handleMfaEnrollVerify as he, handleMfaRegenerateRecoveryCodes as ge, handleMfaUnenroll as _e, handleMfaVerify as ve, handlePasswordResetConfirm as ye, handlePasswordResetRequest as be, handleRevokeAllOtherSessions as xe, handleRevokeSession as Se, handleSignIn as Ce, handleSignOut as we, handleSignUp as Te, handleSwitchTenant as Ee, issueUserSession as De } from "./handlers.js";
-import { generateChallenge as Oe, verifyAssertion as ke, verifyRegistration as Ae } from "./webauthn.js";
-import { dataStoreChallengeStore as je, handlePasskeyAssertOptions as Me, handlePasskeyAssertVerify as Ne, handlePasskeyRegisterOptions as Pe, handlePasskeyRegisterVerify as Fe, memoryChallengeStore as Ie } from "./passkeyHandlers.js";
-import { DEFAULT_INVITER_ROLES as Le, DEFAULT_ROLE_RANK as Re, INVITATION_MAX_PENDING as ze, INVITATION_TTL_S as Be, defaultCanGrantRole as Ve, handleAcceptInvitation as He, handleAcceptInvitationWithSignUp as Ue, handleCreateInvitation as We, handleListInvitations as Ge, handlePreviewInvitation as Ke, handleRevokeInvitation as qe } from "./invitations.js";
-import { IMPERSONATION_DEFAULT_DURATION_S as Je, IMPERSONATION_FORBIDDEN_SUBPATHS as Ye, handleImpersonationStart as Xe, handleImpersonationStop as Ze, impersonationAuditRedactor as Qe, impersonationOf as $e, isImpersonated as et } from "./impersonation.js";
-import { NATIVE_PENDING_COOKIE as tt, handleNativeAuthorize as nt, handleNativeComplete as rt, handleNativeExchange as it, isAllowedRedirectUri as at, nativeLoginRedirect as ot } from "./nativeRoutes.js";
-import { voltroPasswordStrategy as st } from "./strategy.js";
-import { authRoutesPlugin as ct, getAuthSessionStrategy as lt } from "./plugin.js";
-import { mailSender as ut } from "./mail.js";
-export { K as CSRF_COOKIE_NAME, q as CSRF_HEADER_NAME, Le as DEFAULT_INVITER_ROLES, Re as DEFAULT_ROLE_RANK, Z as EMAIL_NOT_VERIFIED_CODE, Q as EMAIL_VERIFIED_METADATA_KEY, $ as EMAIL_VERIFY_RESEND_COOLDOWN_S, R as EMAIL_VERIFY_TTL_S, Je as IMPERSONATION_DEFAULT_DURATION_S, Ye as IMPERSONATION_FORBIDDEN_SUBPATHS, ze as INVITATION_MAX_PENDING, Be as INVITATION_TTL_S, z as MAGIC_LINK_TTL_S, B as MFA_PENDING_TTL_S, V as NATIVE_CODE_TTL_S, tt as NATIVE_PENDING_COOKIE, H as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, s as SESSION_COOKIE_NAME, M as TotpVerifyError, _ as UserAlreadyExistsError, v as UserNotFoundError, A as appUserStore, O as authMemberships, ct as authRoutesPlugin, c as clearSessionCookie, se as configSessionSecrets, je as dataStoreChallengeStore, w as dataStoreSessionRegistry, Ve as defaultCanGrantRole, ee as emailVerificationActive, te as emailVerificationGuard, Oe as generateChallenge, N as generateRecoveryCodes, P as generateTotpCode, F as generateTotpSecret, lt as getAuthSessionStrategy, ce as guardSubject, He as handleAcceptInvitation, Ue as handleAcceptInvitationWithSignUp, We as handleCreateInvitation, le as handleCsrf, ne as handleEmailVerifyConfirm, re as handleEmailVerifyRequest, Xe as handleImpersonationStart, Ze as handleImpersonationStop, Ge as handleListInvitations, ue as handleListMemberships, de as handleListSessions, fe as handleMagicLinkConsume, pe as handleMagicLinkRequest, me as handleMfaEnrollStart, he as handleMfaEnrollVerify, ge as handleMfaRegenerateRecoveryCodes, _e as handleMfaUnenroll, ve as handleMfaVerify, nt as handleNativeAuthorize, rt as handleNativeComplete, it as handleNativeExchange, Me as handlePasskeyAssertOptions, Ne as handlePasskeyAssertVerify, Pe as handlePasskeyRegisterOptions, Fe as handlePasskeyRegisterVerify, ye as handlePasswordResetConfirm, be as handlePasswordResetRequest, Ke as handlePreviewInvitation, xe as handleRevokeAllOtherSessions, qe as handleRevokeInvitation, Se as handleRevokeSession, Ce as handleSignIn, we as handleSignOut, Te as handleSignUp, Ee as handleSwitchTenant, n as hashPassword, U as hashToken, Qe as impersonationAuditRedactor, $e as impersonationOf, at as isAllowedRedirectUri, J as isCsrfTokenWellFormed, ie as isEmailVerified, et as isImpersonated, Y as issueCsrfToken, T as issueRegisteredSession, l as issueSession, De as issueUserSession, ut as mailSender, g as makeSessionRevocationChecker, Ie as memoryChallengeStore, y as memoryUserStore, W as mintSecret, G as mintToken, ot as nativeLoginRedirect, r as needsRehash, b as newAuthId, I as otpauthUrl, i as parseScryptParams, k as postgresUserStore, u as readSession, d as readSessionFromHeaders, f as readSessionKeyed, p as resolveSessionSecret, m as resolveSessionSecrets, E as rotateRegisteredSession, j as runSubjectGuards, ae as sendEmailVerification, x as sessionIdOfSubject, h as sessionSecretsOf, S as subjectFromUser, C as subjectMemberships, oe as userEmailVerified, ke as verifyAssertion, X as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, Ae as verifyRegistration, L as verifyTotpCode, st as voltroPasswordStrategy, D as withSessionId };
+import { dataStoreSessionRegistry as w, issueRegisteredSession as T, lockRegisteredSession as E, rotateRegisteredSession as D, withSessionId as O } from "./sessionRegistry.js";
+import { CSRF_COOKIE_NAME as k, CSRF_HEADER_NAME as A, isCsrfTokenWellFormed as j, issueCsrfToken as M, verifyCsrf as N } from "./csrf.js";
+import { parseGuestCredential as P } from "./guestCredential.js";
+import { GuestAuthError as F, dataStoreGuestAuth as I } from "./guestService.js";
+import { authGuestDevicesTable as L, authGuestsTable as R } from "./guestSchema.js";
+import { guestAuthPlugin as z } from "./guestPlugin.js";
+import { allowedOverlayPage as B, overlayAuthPlugin as V } from "./overlayPlugin.js";
+import { auth as H } from "./authExtensions.js";
+import { TotpVerifyError as U, generateRecoveryCodes as W, generateTotpCode as G, generateTotpSecret as K, otpauthUrl as q, verifyTotpCode as J } from "./totp.js";
+import { EMAIL_VERIFY_TTL_S as Y, MAGIC_LINK_TTL_S as X, MFA_PENDING_TTL_S as Z, NATIVE_CODE_TTL_S as Q, PASSWORD_RESET_TTL_S as $, hashToken as ee, mintSecret as te, mintToken as ne } from "./tokens.js";
+import { runSubjectGuards as re } from "./subjectGuard.js";
+import { EMAIL_NOT_VERIFIED_CODE as ie, EMAIL_VERIFIED_METADATA_KEY as ae, EMAIL_VERIFY_RESEND_COOLDOWN_S as oe, emailVerificationActive as se, emailVerificationGuard as ce, handleEmailVerifyConfirm as le, handleEmailVerifyRequest as ue, isEmailVerified as de, sendEmailVerification as fe, userEmailVerified as pe } from "./emailVerification.js";
+import { configSessionSecrets as me, guardSubject as he, handleCsrf as ge, handleListMemberships as _e, handleListSessions as ve, handleMagicLinkConsume as ye, handleMagicLinkRequest as be, handleMfaEnrollStart as xe, handleMfaEnrollVerify as Se, handleMfaRegenerateRecoveryCodes as Ce, handleMfaUnenroll as we, handleMfaVerify as Te, handlePasswordResetConfirm as Ee, handlePasswordResetRequest as De, handleRevokeAllOtherSessions as Oe, handleRevokeSession as ke, handleSignIn as Ae, handleSignOut as je, handleSignUp as Me, handleSwitchTenant as Ne, issueUserSession as Pe } from "./handlers.js";
+import { completeGuestPasswordUpgrade as Fe } from "./guestPasswordUpgrade.js";
+import { authMemberships as Ie } from "./memberships.js";
+import { postgresUserStore as Le } from "./postgresUserStore.js";
+import { appUserStore as Re } from "./appUserStore.js";
+import { generateChallenge as ze, verifyAssertion as Be, verifyRegistration as Ve } from "./webauthn.js";
+import { dataStoreChallengeStore as He, handlePasskeyAssertOptions as Ue, handlePasskeyAssertVerify as We, handlePasskeyRegisterOptions as Ge, handlePasskeyRegisterVerify as Ke, memoryChallengeStore as qe } from "./passkeyHandlers.js";
+import { DEFAULT_INVITER_ROLES as Je, DEFAULT_ROLE_RANK as Ye, INVITATION_MAX_PENDING as Xe, INVITATION_TTL_S as Ze, defaultCanGrantRole as Qe, handleAcceptInvitation as $e, handleAcceptInvitationWithSignUp as et, handleCreateInvitation as tt, handleListInvitations as nt, handlePreviewInvitation as rt, handleRevokeInvitation as it } from "./invitations.js";
+import { IMPERSONATION_DEFAULT_DURATION_S as at, IMPERSONATION_FORBIDDEN_SUBPATHS as ot, handleImpersonationStart as st, handleImpersonationStop as ct, impersonationAuditRedactor as lt, impersonationOf as ut, isImpersonated as dt } from "./impersonation.js";
+import { signAuthClaims as ft, verifyAuthClaims as pt } from "./signedClaims.js";
+import { NATIVE_PENDING_COOKIE as mt, handleNativeAuthorize as ht, handleNativeComplete as gt, handleNativeExchange as _t, isAllowedRedirectUri as vt, nativeLoginRedirect as yt } from "./nativeRoutes.js";
+import { voltroPasswordStrategy as bt } from "./strategy.js";
+import { authRoutesPlugin as xt, getAuthSessionStrategies as St } from "./plugin.js";
+import { mailSender as Ct } from "./mail.js";
+export { k as CSRF_COOKIE_NAME, A as CSRF_HEADER_NAME, Je as DEFAULT_INVITER_ROLES, Ye as DEFAULT_ROLE_RANK, ie as EMAIL_NOT_VERIFIED_CODE, ae as EMAIL_VERIFIED_METADATA_KEY, oe as EMAIL_VERIFY_RESEND_COOLDOWN_S, Y as EMAIL_VERIFY_TTL_S, F as GuestAuthError, at as IMPERSONATION_DEFAULT_DURATION_S, ot as IMPERSONATION_FORBIDDEN_SUBPATHS, Xe as INVITATION_MAX_PENDING, Ze as INVITATION_TTL_S, X as MAGIC_LINK_TTL_S, Z as MFA_PENDING_TTL_S, Q as NATIVE_CODE_TTL_S, mt as NATIVE_PENDING_COOKIE, $ as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, s as SESSION_COOKIE_NAME, U as TotpVerifyError, _ as UserAlreadyExistsError, v as UserNotFoundError, B as allowedOverlayPage, Re as appUserStore, H as auth, L as authGuestDevicesTable, R as authGuestsTable, Ie as authMemberships, xt as authRoutesPlugin, c as clearSessionCookie, Fe as completeGuestPasswordUpgrade, me as configSessionSecrets, He as dataStoreChallengeStore, I as dataStoreGuestAuth, w as dataStoreSessionRegistry, Qe as defaultCanGrantRole, se as emailVerificationActive, ce as emailVerificationGuard, ze as generateChallenge, W as generateRecoveryCodes, G as generateTotpCode, K as generateTotpSecret, St as getAuthSessionStrategies, he as guardSubject, z as guestAuthPlugin, $e as handleAcceptInvitation, et as handleAcceptInvitationWithSignUp, tt as handleCreateInvitation, ge as handleCsrf, le as handleEmailVerifyConfirm, ue as handleEmailVerifyRequest, st as handleImpersonationStart, ct as handleImpersonationStop, nt as handleListInvitations, _e as handleListMemberships, ve as handleListSessions, ye as handleMagicLinkConsume, be as handleMagicLinkRequest, xe as handleMfaEnrollStart, Se as handleMfaEnrollVerify, Ce as handleMfaRegenerateRecoveryCodes, we as handleMfaUnenroll, Te as handleMfaVerify, ht as handleNativeAuthorize, gt as handleNativeComplete, _t as handleNativeExchange, Ue as handlePasskeyAssertOptions, We as handlePasskeyAssertVerify, Ge as handlePasskeyRegisterOptions, Ke as handlePasskeyRegisterVerify, Ee as handlePasswordResetConfirm, De as handlePasswordResetRequest, rt as handlePreviewInvitation, Oe as handleRevokeAllOtherSessions, it as handleRevokeInvitation, ke as handleRevokeSession, Ae as handleSignIn, je as handleSignOut, Me as handleSignUp, Ne as handleSwitchTenant, n as hashPassword, ee as hashToken, lt as impersonationAuditRedactor, ut as impersonationOf, vt as isAllowedRedirectUri, j as isCsrfTokenWellFormed, de as isEmailVerified, dt as isImpersonated, M as issueCsrfToken, T as issueRegisteredSession, l as issueSession, Pe as issueUserSession, E as lockRegisteredSession, Ct as mailSender, g as makeSessionRevocationChecker, qe as memoryChallengeStore, y as memoryUserStore, te as mintSecret, ne as mintToken, yt as nativeLoginRedirect, r as needsRehash, b as newAuthId, q as otpauthUrl, V as overlayAuthPlugin, P as parseGuestCredential, i as parseScryptParams, Le as postgresUserStore, u as readSession, d as readSessionFromHeaders, f as readSessionKeyed, p as resolveSessionSecret, m as resolveSessionSecrets, D as rotateRegisteredSession, re as runSubjectGuards, fe as sendEmailVerification, x as sessionIdOfSubject, h as sessionSecretsOf, ft as signAuthClaims, S as subjectFromUser, C as subjectMemberships, pe as userEmailVerified, Be as verifyAssertion, pt as verifyAuthClaims, N as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, Ve as verifyRegistration, J as verifyTotpCode, bt as voltroPasswordStrategy, O as withSessionId };

package/dist/invitations.js

@@ -1,6 +1,6 @@
 import { newAuthId as e } from "./userStore.js";
-import { hashToken as t, mintSecret as n } from "./tokens.js";
-import { decideAdmission as r } from "./admission.js";
+import { decideAdmission as t } from "./admission.js";
+import { hashToken as n, mintSecret as r } from "./tokens.js";
 import { Effect as i } from "effect";
 //#region src/invitations.ts
 var a = 604800, o = 500, s = [
@@ -34,12 +34,12 @@ var a = 604800, o = 500, s = [
 }), h = (e, t, n, r) => i.gen(function* () {
 	let i = yield* n.membershipRole(e, t);
 	return i === null || !(r?.inviterRoles ?? c).includes(i) ? f(403, { error: "not_permitted" }) : { role: i };
-}), g = (e) => "status" in e, _ = (t, r, a) => i.gen(function* () {
+}), g = (e) => "status" in e, _ = (t, n, a) => i.gen(function* () {
 	let o = t.email.trim().toLowerCase();
 	if (!o || !o.includes("@")) return f(400, { error: "a valid email is required" });
 	if (!t.tenantId) return f(400, { error: "tenantId required" });
 	if (!t.role) return f(400, { error: "role required" });
-	let s = a.invitations, c = yield* h(t.inviterUserId, t.tenantId, r, s);
+	let s = a.invitations, c = yield* h(t.inviterUserId, t.tenantId, n, s);
 	if (g(c)) return c;
 	if (!d(s)({
 		inviterRole: c.role,
@@ -50,9 +50,9 @@ var a = 604800, o = 500, s = [
 		message: `A '${c.role}' may not invite a '${t.role}'.`
 	});
 	let l = new Date((a.now ?? Date.now)());
-	if ((yield* r.countPendingInvitations(t.tenantId, l)) >= (s?.maxPending ?? 500)) return f(429, { error: "too_many_pending_invitations" });
-	yield* r.supersedePendingInvitations(t.tenantId, o, t.inviterUserId, l).pipe(i.ignore);
-	let u = s?.ttlSeconds ?? 604800, _ = n(u), v = yield* r.insertInvitation({
+	if ((yield* n.countPendingInvitations(t.tenantId, l)) >= (s?.maxPending ?? 500)) return f(429, { error: "too_many_pending_invitations" });
+	yield* n.supersedePendingInvitations(t.tenantId, o, t.inviterUserId, l).pipe(i.ignore);
+	let u = s?.ttlSeconds ?? 604800, _ = r(u), v = yield* n.insertInvitation({
 		id: e("inv"),
 		tokenHash: _.tokenHash,
 		email: o,
@@ -88,9 +88,9 @@ var a = 604800, o = 500, s = [
 		ok: !0,
 		revoked: 1
 	}) : f(404, { error: "invitation_not_found" });
-}), b = (e, n, r = {}) => i.gen(function* () {
+}), b = (e, t, r = {}) => i.gen(function* () {
 	if (!e.token) return f(400, { error: "token required" });
-	let i = yield* n.findInvitationByHash(t(e.token));
+	let i = yield* t.findInvitationByHash(n(e.token));
 	if (!i) return f(404, { error: "invalid_invitation" });
 	let a = new Date((r.now ?? Date.now)());
 	return f(200, {
@@ -101,24 +101,24 @@ var a = 604800, o = 500, s = [
 		role: i.role,
 		expiresAt: i.expiresAt.toISOString()
 	});
-}), x = (e, n, a = {}) => i.gen(function* () {
+}), x = (e, r, a = {}) => i.gen(function* () {
 	if (!e.token) return f(400, { error: "token required" });
-	let o = t(e.token), s = new Date((a.now ?? Date.now)()), c = yield* n.findInvitationByHash(o);
+	let o = n(e.token), s = new Date((a.now ?? Date.now)()), c = yield* r.findInvitationByHash(o);
 	if (!c) return f(401, { error: "invalid_or_expired_invitation" });
 	if (!e.userId) return f(401, {
 		error: "authentication_required",
 		email: c.email
 	});
-	let l = yield* n.findById(e.userId);
+	let l = yield* r.findById(e.userId);
 	if (!l) return f(401, {
 		error: "authentication_required",
 		email: c.email
 	});
-	if (l.email.toLowerCase() !== c.email.toLowerCase()) return f(403, {
+	if (l.email === null || l.email.toLowerCase() !== c.email.toLowerCase()) return f(403, {
 		error: "invitation_email_mismatch",
 		message: "This invitation was issued to a different email address. Sign in as that address to accept it."
 	});
-	let u = yield* r(a.admit, {
+	let u = yield* t(a.admit, {
 		email: c.email,
 		tenantId: c.tenantId,
 		via: "invitation"
@@ -128,14 +128,14 @@ var a = 604800, o = 500, s = [
 		reason: u.reason,
 		message: u.message
 	});
-	let d = yield* n.acceptInvitation(o, l.id, s);
+	let d = yield* r.acceptInvitation(o, l.id, s);
 	if (!d) return f(401, { error: "invalid_or_expired_invitation" });
-	let p = yield* n.addMembership({
+	let p = yield* r.addMembership({
 		userId: l.id,
 		tenantId: d.tenantId,
 		role: d.role
 	});
-	return yield* n.markEmailVerified(l.id).pipe(i.ignore), f(200, {
+	return yield* r.markEmailVerified(l.id).pipe(i.ignore), f(200, {
 		ok: !0,
 		membership: {
 			tenantId: p.tenantId,
@@ -143,18 +143,18 @@ var a = 604800, o = 500, s = [
 			joinedAt: p.joinedAt.toISOString()
 		}
 	});
-}), S = (n, a, o) => i.gen(function* () {
-	if (!n.token || !n.password) return f(400, { error: "token and password required" });
-	if (n.password.length < (o.minPasswordLength ?? 8)) return f(400, { error: "password must be at least 8 characters" });
-	let s = t(n.token), c = new Date((o.now ?? Date.now)()), l = yield* a.findInvitationByHash(s);
+}), S = (r, a, o) => i.gen(function* () {
+	if (!r.token || !r.password) return f(400, { error: "token and password required" });
+	if (r.password.length < (o.minPasswordLength ?? 8)) return f(400, { error: "password must be at least 8 characters" });
+	let s = n(r.token), c = new Date((o.now ?? Date.now)()), l = yield* a.findInvitationByHash(s);
 	if (!l) return f(401, { error: "invalid_or_expired_invitation" });
 	if (yield* a.findByEmail(l.email)) return f(409, {
 		error: "account_exists",
 		message: "An account already exists for this address. Sign in, then accept the invitation."
 	});
-	let u = yield* o.hashPassword(n.password).pipe(i.orElseSucceed(() => ""));
+	let u = yield* o.hashPassword(r.password).pipe(i.orElseSucceed(() => ""));
 	if (!u) return f(500, { error: "hash_failed" });
-	let d = yield* r(o.admit, {
+	let d = yield* t(o.admit, {
 		email: l.email,
 		tenantId: l.tenantId,
 		via: "invitation"