@voult/core 0.0.0 → 0.2.0

package/src/index.d.ts

@@ -0,0 +1,100 @@
+/** The per-request `@voult/sdk` VoultClient (the parts adapters use). */
+export interface VoultClient {
+  accessToken: string | null;
+  refreshToken: string | null;
+  user: unknown;
+  isAuthenticated(): boolean;
+  getCurrentUser(): unknown;
+  setSession(user: unknown, accessToken: string, refreshToken?: string | null): void;
+  clearSession(): void;
+}
+
+export type SessionStrategy = 'cookie' | 'bearer';
+
+/** Where hosted OAuth sends the browser, relative to `appUrl`. Each must start with "/". */
+export interface VoultOAuthPaths {
+  /** Default `/`. After sign-in (unless `returnTo` was given) or linking. */
+  successPath?: string;
+  /** Default `/mfa`. User has MFA: prompt for a code and POST /mfa/verify { mfaToken }. */
+  mfaPath?: string;
+  /** Default `/login`. Receives `?voult_error=<CODE>&voult_error_description=<text>`. */
+  errorPath?: string;
+}
+
+export interface VoultConfig {
+  baseURL?: string;
+  clientId: string;
+  clientSecret: string;
+  sessionSecret?: string;
+  appUrl?: string;
+  /** Override the computed hosted-OAuth callback URL (e.g. behind a proxy). */
+  oauthCallbackUrl?: string;
+  oauth?: VoultOAuthPaths;
+  session?: { strategy?: SessionStrategy };
+}
+
+export interface LoadConfigFromEnvOptions {
+  env?: Record<string, string | undefined>;
+  overrides?: Partial<VoultConfig>;
+}
+
+export interface ResolveConfigOptions extends LoadConfigFromEnvOptions {
+  config?: VoultConfig;
+  oauth?: VoultOAuthPaths;
+}
+
+export interface CookieToSet {
+  name: string;
+  value: string;
+  options: Record<string, unknown>;
+}
+
+export type ReadCookie = (name: string) => unknown;
+
+export interface IncomingSession {
+  accessToken: string | null;
+  refreshToken: string | null;
+}
+
+export interface HandleOptions {
+  /** Where the router is mounted, e.g. `/api/auth`. */
+  basePath?: string;
+  /** Answer for paths with no route. Default: 404 JSON. Return null to fall through. */
+  notFound?: (request: Request) => Response | null;
+}
+
+export type VoultHandler = (request: Request, options?: HandleOptions) => Promise<Response | null>;
+
+export function createVoultHandler(config: VoultConfig): VoultHandler;
+export function loadConfigFromEnv(options?: LoadConfigFromEnvOptions): VoultConfig;
+export function resolveConfig(options?: ResolveConfigOptions): VoultConfig;
+export function normalizeVoultError(err: unknown): { error: { code: string; message: string; status: number; field?: string; fields?: unknown } };
+
+export const COOKIE_ACCESS: 'voult_access';
+export const COOKIE_REFRESH: 'voult_refresh';
+export const COOKIE_USER: 'voult_user';
+export const COOKIE_OAUTH: 'voult_oauth';
+export const COOKIE_MFA_PENDING: 'voult_mfa_pending';
+
+export function createVoultClient(config: VoultConfig): VoultClient;
+export function getSessionFromRequest(
+  request: Request,
+  config: VoultConfig,
+  options?: { body?: Record<string, unknown> }
+): Promise<{ client: VoultClient; incoming: IncomingSession; read: ReadCookie }>;
+export function restoreSession(
+  client: VoultClient,
+  incoming: { read: ReadCookie; authorization?: string | null; refreshToken?: unknown },
+  config: VoultConfig
+): IncomingSession;
+export function sessionCookies(client: VoultClient, incoming: IncomingSession, config: VoultConfig): CookieToSet[];
+export function renewSession(client: VoultClient, read: ReadCookie, config: VoultConfig): Promise<CookieToSet[]>;
+
+export function readCookieHeader(header: string | null | undefined, secret?: string): Promise<{
+  cookies: Record<string, string>;
+  signedCookies: Record<string, string | false>;
+}>;
+export function serializeCookie(name: string, value: string, options?: Record<string, unknown>): string;
+export function setCookieHeader(cookie: CookieToSet, secret?: string): Promise<string>;
+export function sign(value: string, secret: string): Promise<string>;
+export function unsign(signed: string, secret: string): Promise<string | false>;

package/src/index.js

@@ -0,0 +1,18 @@
+// @voult/core: the Voult router on the Fetch API, for adapters (@voult/express, @voult/next).
+// Apps install an adapter, not this package.
+export { createVoultHandler } from './handler.js';
+export { loadConfigFromEnv, resolveConfig } from './config.js';
+export { normalizeVoultError } from './errors.js';
+export {
+  COOKIE_ACCESS,
+  COOKIE_MFA_PENDING,
+  COOKIE_OAUTH,
+  COOKIE_REFRESH,
+  COOKIE_USER,
+  createVoultClient,
+  getSessionFromRequest,
+  renewSession,
+  restoreSession,
+  sessionCookies,
+} from './session.js';
+export { readCookieHeader, serializeCookie, setCookieHeader, sign, unsign } from './cookies.js';

package/src/oauth.js

@@ -0,0 +1,199 @@
+import {
+  exchangeOAuthCode,
+  getAppInfo,
+  getOAuthAuthorizationUrl,
+  linkOAuthProvider,
+} from '@voult/sdk';
+import { base64 } from './cookies.js';
+import { json, redirect } from './routes.js';
+import {
+  COOKIE_MFA_PENDING,
+  COOKIE_OAUTH,
+  MFA_PENDING_MAX_AGE_MS,
+  OAUTH_COOKIE_MAX_AGE_MS,
+  clearCookie,
+  setCookie,
+} from './session.js';
+
+// Hosted OAuth: provider credentials live in the Voult dashboard, never in this server's env.
+//   GET /oauth/providers          → which providers the app can use
+//   GET /oauth/:provider/start    → 302 to the provider (via Voult)
+//   GET /oauth/callback           → Voult sends the browser back here; we set the session
+
+/**
+ * @typedef {import('./handler.js').Context} Context
+ * @typedef {import('./handler.js').Route} Route
+ * @typedef {import('./index.js').VoultConfig} VoultConfig
+ */
+
+const PROVIDERS_CACHE_MS = 60 * 1000;
+const INTENTS = ['authenticate', 'login', 'register', 'link'];
+
+/**
+ * Only same-site relative paths, so `returnTo` can't send users to another site.
+ * @param {unknown} value
+ * @param {string} fallback
+ */
+export function safeReturnTo(value, fallback) {
+  return typeof value === 'string'
+    && value.length <= 2048
+    && value.startsWith('/')
+    && !value.startsWith('//')
+    && !value.includes('\\')
+    ? value
+    : fallback;
+}
+
+/**
+ * A browser URL on the integrator's frontend (VOULT_APP_URL), or same-origin when unset.
+ * @param {VoultConfig} config
+ * @param {string} path
+ * @param {Record<string, string | undefined>} [params]
+ */
+export function appLocation(config, path, params = {}) {
+  const query = new URLSearchParams(
+    Object.entries(params).filter(([, value]) => value != null && value !== '')
+  ).toString();
+  const base = config.appUrl ? config.appUrl.replace(/\/$/, '') : '';
+  const joiner = path.includes('?') ? '&' : '?';
+  return `${base}${path}${query ? `${joiner}${query}` : ''}`;
+}
+
+/**
+ * The URL Voult sends the browser back to. Must be on the app's callback allowlist.
+ * Behind a proxy, let the adapter see the public URL (Express: `app.set('trust proxy', 1)`)
+ * or set VOULT_OAUTH_CALLBACK_URL.
+ * @param {Context} ctx
+ */
+export function oauthCallbackUrl(ctx) {
+  return ctx.config.oauthCallbackUrl || `${ctx.url.protocol}//${ctx.url.host}${ctx.basePath}/oauth/callback`;
+}
+
+export function redirectWithError(config, code, description) {
+  return redirect(appLocation(config, config.oauth.errorPath, {
+    voult_error: code,
+    voult_error_description: description,
+  }));
+}
+
+export function errorCode(err) {
+  return err?.apiCode || err?.code || 'OAUTH_FAILED';
+}
+
+function newNonce() {
+  return base64(globalThis.crypto.getRandomValues(new Uint8Array(24)))
+    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+function readOAuthCookie(ctx) {
+  const raw = ctx.read(COOKIE_OAUTH);
+  if (typeof raw !== 'string') return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+/** One provider cache per handler. @returns {Route[]} */
+export function oauthRoutes() {
+  let providersCache = { at: 0, value: null };
+
+  return [
+    ['GET', '/oauth/providers', async (ctx) => {
+      if (!providersCache.value || Date.now() - providersCache.at > PROVIDERS_CACHE_MS) {
+        const info = await getAppInfo(ctx.client);
+        const providers = Object.fromEntries(
+          Object.entries(info.providers || {}).map(([name, s]) => [name, Boolean(s.enabled && s.configured)])
+        );
+        providersCache = { at: Date.now(), value: { providers } };
+      }
+      return json(providersCache.value);
+    }],
+
+    ['GET', '/oauth/:provider/start', async (ctx) => {
+      const { config, client } = ctx;
+      if (config.session.strategy !== 'cookie') {
+        return json({
+          error: {
+            code: 'OAUTH_REQUIRES_COOKIE_SESSION',
+            message: 'Hosted OAuth sets the session in a cookie. Use VOULT_SESSION_STRATEGY=cookie, or call the @voult/sdk OAuth functions yourself.',
+            status: 400,
+          },
+        }, 400);
+      }
+
+      const provider = String(ctx.params.provider).toLowerCase();
+      const intent = ctx.query('intent') ?? 'authenticate';
+      if (!INTENTS.includes(intent)) {
+        return redirectWithError(config, 'INVALID_INTENT', `intent must be one of: ${INTENTS.join(', ')}`);
+      }
+      if (intent === 'link' && !client.accessToken) {
+        return redirectWithError(config, 'LOGIN_REQUIRED', 'Sign in before linking another account.');
+      }
+
+      const nonce = newNonce();
+      const redirectUri = oauthCallbackUrl(ctx);
+      const returnTo = safeReturnTo(ctx.query('returnTo'), config.oauth.successPath);
+
+      let authUrl;
+      try {
+        ({ authUrl } = intent === 'link'
+          ? await linkOAuthProvider(provider, { redirectUri, state: nonce }, client)
+          : await getOAuthAuthorizationUrl(provider, { intent, redirectUri, state: nonce }, client));
+      } catch (err) {
+        return redirectWithError(config, errorCode(err), err.message);
+      }
+
+      // Ties the callback to this browser: Voult echoes `state`, we compare it to this cookie.
+      ctx.cookies.push(setCookie(
+        config,
+        COOKIE_OAUTH,
+        JSON.stringify({ nonce, provider, intent, returnTo, redirectUri }),
+        { maxAge: OAUTH_COOKIE_MAX_AGE_MS }
+      ));
+      return redirect(authUrl);
+    }],
+
+    ['GET', '/oauth/callback', async (ctx) => {
+      const { config, client } = ctx;
+      const saved = readOAuthCookie(ctx);
+      ctx.cookies.push(clearCookie(config, COOKIE_OAUTH));
+
+      if (!saved?.nonce || ctx.query('state') !== saved.nonce) {
+        return redirectWithError(
+          config, 'INVALID_OAUTH_STATE',
+          'This sign-in expired or was started in another browser. Please try again.'
+        );
+      }
+
+      if (ctx.query('error')) {
+        return redirectWithError(config, ctx.query('error'), ctx.query('error_description'));
+      }
+
+      if (ctx.query('linked') === '1') {
+        return redirect(appLocation(config, saved.returnTo, { voult_linked: saved.provider }));
+      }
+
+      const voultCode = ctx.query('voult_code');
+      if (typeof voultCode !== 'string') {
+        return redirectWithError(config, 'MISSING_OAUTH_CODE', 'Voult did not return a sign-in code.');
+      }
+
+      let result;
+      try {
+        result = await exchangeOAuthCode(voultCode, { redirectUri: saved.redirectUri }, client);
+      } catch (err) {
+        return redirectWithError(config, errorCode(err), err.message);
+      }
+
+      if (result.mfaRequired) {
+        ctx.cookies.push(setCookie(config, COOKIE_MFA_PENDING, result.mfaPendingToken, { maxAge: MFA_PENDING_MAX_AGE_MS }));
+        return redirect(appLocation(config, config.oauth.mfaPath));
+      }
+
+      // The session cookies go out with this redirect (sessionCookies, in the handler).
+      return redirect(appLocation(config, saved.returnTo));
+    }],
+  ];
+}

package/src/passwordless.js

@@ -0,0 +1,94 @@
+import {
+  createPasskeyLoginOptions,
+  createPasskeyRegistrationOptions,
+  deletePasskey,
+  listPasskeys,
+  signInWithEmailLink,
+  updatePasskey,
+  verifyEmailLink,
+  verifyPasskeyLogin,
+  verifyPasskeyRegistration,
+} from '@voult/sdk';
+import { appLocation, errorCode, oauthCallbackUrl, redirectWithError, safeReturnTo } from './oauth.js';
+import { authResult, authenticated, json, redirect } from './routes.js';
+import { COOKIE_MFA_PENDING, MFA_PENDING_MAX_AGE_MS, setCookie } from './session.js';
+
+// Passkeys and magic links: sign-ins without a password.
+//   Passkeys: the page runs the WebAuthn ceremony (@simplewebauthn/browser or navigator.credentials)
+//   with the options from here, then posts the browser's credential back.
+//   Magic links: Voult emails a link to GET /magic-link/verify on this server, which sets the
+//   session and redirects like the OAuth callback.
+
+/**
+ * @typedef {import('./handler.js').Context} Context
+ * @typedef {import('./handler.js').Route} Route
+ */
+
+/**
+ * The URL magic links open: next to the OAuth callback, so the one callback URL on the app's
+ * allowlist covers it too (Voult accepts any page on an allowlisted callback's origin).
+ * @param {Context} ctx
+ */
+function magicLinkUrl(ctx) {
+  const url = new URL(oauthCallbackUrl(ctx));
+  url.pathname = url.pathname.endsWith('/oauth/callback')
+    ? url.pathname.replace(/\/oauth\/callback$/, '/magic-link/verify')
+    : `${ctx.basePath}/magic-link/verify`;
+  url.search = '';
+  return url;
+}
+
+/** @type {Route[]} */
+export const passwordlessRoutes = [
+  ['POST', '/passkeys/register/options', authenticated(async (ctx) => (
+    json(await createPasskeyRegistrationOptions({ deviceName: ctx.body.deviceName }, ctx.client))
+  ))],
+  ['POST', '/passkeys/register/verify', authenticated(async (ctx) => (
+    json(await verifyPasskeyRegistration(ctx.body.credential, { deviceName: ctx.body.deviceName }, ctx.client))
+  ))],
+  ['GET', '/passkeys', authenticated(async (ctx) => json(await listPasskeys(ctx.client)))],
+  ['PATCH', '/passkeys/:id', authenticated(async (ctx) => (
+    json(await updatePasskey(ctx.params.id, ctx.body.deviceName, ctx.client))
+  ))],
+  ['DELETE', '/passkeys/:id', authenticated(async (ctx) => json(await deletePasskey(ctx.params.id, ctx.client)))],
+
+  // Public: sign in with a passkey. Sets the session (or the MFA-pending cookie) like password sign-in.
+  ['POST', '/passkeys/login/options', async (ctx) => (
+    json(await createPasskeyLoginOptions(ctx.body.email ? { email: ctx.body.email } : {}, ctx.client))
+  )],
+  ['POST', '/passkeys/login/verify', async (ctx) => authResult(ctx, await verifyPasskeyLogin(ctx.body.credential, ctx.client))],
+
+  // Public. Answers the same whether or not the email has an account, so it can't be used to
+  // find out who signed up. Mistakes in the request or the app's setup still come back as errors.
+  ['POST', '/magic-link', async (ctx) => {
+    const url = magicLinkUrl(ctx);
+    const returnTo = safeReturnTo(ctx.body.returnTo, '');
+    if (returnTo) url.searchParams.set('returnTo', returnTo);
+    try {
+      await signInWithEmailLink(ctx.body.email, { redirectUri: url.href }, ctx.client);
+    } catch (err) {
+      if (err?.status !== 404) throw err;
+    }
+    return json({ sent: true });
+  }],
+
+  // ponytail: a GET that spends a one-time token: mail scanners that open links can use it up first.
+  // Upgrade path: a confirm page that POSTs, if users report "link expired" on first click.
+  ['GET', '/magic-link/verify', async (ctx) => {
+    const { config } = ctx;
+    let result;
+    try {
+      result = await verifyEmailLink(ctx.query('token'), ctx.client);
+    } catch (err) {
+      return redirectWithError(config, errorCode(err), err.message);
+    }
+
+    if (result.mfaRequired) {
+      ctx.cookies.push(setCookie(config, COOKIE_MFA_PENDING, result.mfaPendingToken, { maxAge: MFA_PENDING_MAX_AGE_MS }));
+      return redirect(appLocation(config, config.oauth.mfaPath));
+    }
+
+    // The session cookies go out with this redirect (sessionCookies, in the handler).
+    return redirect(appLocation(config, safeReturnTo(ctx.query('returnTo'), config.oauth.successPath)));
+  }],
+];

package/src/routes.js

@@ -0,0 +1,204 @@
+import {
+  AuthenticationError,
+  ENDPOINTS,
+  deleteUser,
+  disableMfa,
+  enableMfa,
+  getCurrentUser,
+  getLinkedOAuthProviders,
+  getMfaStatus,
+  regenerateMfaBackupCodes,
+  revokeSession,
+  setupMfa,
+  unlinkOAuthProvider,
+  refreshSession,
+  resetPassword,
+  sendPasswordResetEmail,
+  signInWithEmailAndPassword,
+  signInWithUsernameAndPassword,
+  signOut,
+  signUpWithEmailAndPassword,
+  signUpWithUsernameAndPassword,
+  updateProfile,
+  verifyEmail,
+  verifyMfaLogin,
+} from '@voult/sdk';
+import { normalizeVoultError } from './errors.js';
+import {
+  COOKIE_MFA_PENDING,
+  MFA_PENDING_MAX_AGE_MS,
+  clearCookie,
+  clearSessionCookies,
+  setCookie,
+  toPublicAuthResult,
+} from './session.js';
+
+/**
+ * @typedef {import('./handler.js').Context} Context
+ * @typedef {import('./handler.js').Route} Route
+ */
+
+/** @param {unknown} body @param {number} [status] */
+export const json = (body, status = 200) => ({ status, body });
+/** @param {string} location */
+export const redirect = (location) => ({ status: 302, location });
+
+/**
+ * Only signed-in users get through: renews an expired access cookie from the refresh cookie
+ * first, then answers 401 JSON.
+ * @param {(ctx: Context) => Promise<unknown>} handler
+ */
+export function authenticated(handler) {
+  return async (ctx) => {
+    await ctx.renew();
+    if (!ctx.client.accessToken) {
+      const payload = normalizeVoultError(new AuthenticationError('Authentication required'));
+      return json(payload, payload.error.status);
+    }
+    return handler(ctx);
+  };
+}
+
+/** @param {Context} ctx @param {object} result */
+export function authResult(ctx, result) {
+  // Park the MFA pending token server-side too (as hosted OAuth does), so /mfa/verify needs only
+  // the code and a page reload doesn't lose the sign-in. The JSON still carries it for older clients.
+  if (result?.mfaRequired && result.mfaPendingToken && ctx.config.session.strategy === 'cookie') {
+    ctx.cookies.push(setCookie(ctx.config, COOKIE_MFA_PENDING, result.mfaPendingToken, { maxAge: MFA_PENDING_MAX_AGE_MS }));
+  }
+  return json(toPublicAuthResult(result, ctx.config));
+}
+
+/** The session is over on this device (account disabled, own session revoked): drop it and its cookies. */
+function endLocalSession(ctx) {
+  ctx.client.clearSession();
+  ctx.cookies.push(...clearSessionCookies(ctx.config));
+}
+
+/**
+ * The user's sessions, with `isCurrent` on this browser's. The API marks it when it sees the
+ * refresh token, which only this server holds (never the page).
+ * @param {Context} ctx
+ */
+async function listSessions(ctx) {
+  const headers = ctx.client.refreshToken ? { 'X-Refresh-Token': ctx.client.refreshToken } : {};
+  const response = await ctx.client.get(ENDPOINTS.SESSIONS, { requireAuth: true, headers });
+  return { sessions: response.sessions ?? [] };
+}
+
+/** @type {Route[]} */
+export const authRoutes = [
+  ['GET', '/session', async (ctx) => {
+    await ctx.renew();
+
+    if (!ctx.client.accessToken) {
+      // A sign-in that stopped at MFA: the page should show the code prompt.
+      const mfaPending = Boolean(ctx.read(COOKIE_MFA_PENDING));
+      return json({ authenticated: false, user: null, ...(mfaPending && { mfaPending: true }) });
+    }
+
+    const localUser = ctx.client.getCurrentUser();
+    if (localUser?.id || localUser?.email) {
+      return json({ authenticated: true, user: localUser });
+    }
+
+    try {
+      return json({ authenticated: true, user: await getCurrentUser(ctx.client) });
+    } catch {
+      return json({ authenticated: false, user: null });
+    }
+  }],
+
+  ['POST', '/register', async (ctx) => {
+    const { email, password, fullName, username } = ctx.body;
+    return authResult(ctx, await signUpWithEmailAndPassword(email, password, { fullName, username }, ctx.client));
+  }],
+
+  ['POST', '/username-register', async (ctx) => {
+    const { username, password, fullName, email } = ctx.body;
+    return authResult(ctx, await signUpWithUsernameAndPassword(username, password, { fullName, email }, ctx.client));
+  }],
+
+  ['POST', '/email-login', async (ctx) => {
+    const { email, password } = ctx.body;
+    return authResult(ctx, await signInWithEmailAndPassword(email, password, ctx.client));
+  }],
+
+  ['POST', '/username-login', async (ctx) => {
+    const { username, password } = ctx.body;
+    return authResult(ctx, await signInWithUsernameAndPassword(username, password, ctx.client));
+  }],
+
+  ['POST', '/logout', async (ctx) => json(await signOut(ctx.client))],
+
+  ['POST', '/sessions/refresh', async (ctx) => {
+    if (ctx.body.refreshToken) {
+      ctx.client.refreshToken = ctx.body.refreshToken;
+    }
+    return authResult(ctx, await refreshSession(ctx.client));
+  }],
+
+  ['GET', '/user/me', authenticated(async (ctx) => json({ user: await getCurrentUser(ctx.client) }))],
+
+  ['PATCH', '/user/me', authenticated(async (ctx) => json(await updateProfile(ctx.body, ctx.client)))],
+
+  ['POST', '/user/forgot-password', async (ctx) => json(await sendPasswordResetEmail(ctx.body.email, ctx.client))],
+
+  ['POST', '/user/reset-password', async (ctx) => {
+    const { token, appId } = ctx.body;
+    const newPassword = ctx.body.newPassword ?? ctx.body.password;
+    return json(await resetPassword(token, newPassword, { appId }, ctx.client));
+  }],
+
+  ['GET', '/user/verify-email', async (ctx) => (
+    json(await verifyEmail(ctx.query('token'), { appId: ctx.query('appId') }, ctx.client))
+  )],
+
+  ['POST', '/mfa/verify', async (ctx) => {
+    const { mfaToken } = ctx.body;
+    // Password sign-in hands the token to the page; hosted OAuth keeps it in a cookie.
+    const mfaPendingToken = ctx.body.mfaPendingToken ?? ctx.read(COOKIE_MFA_PENDING);
+    const result = await verifyMfaLogin(mfaPendingToken, mfaToken, ctx.client);
+    ctx.cookies.push(clearCookie(ctx.config, COOKIE_MFA_PENDING));
+    return authResult(ctx, result);
+  }],
+
+  ['GET', '/mfa/status', authenticated(async (ctx) => json(await getMfaStatus(ctx.client)))],
+
+  // MFA enrolment: setup returns the secret, QR code and backup codes; enable confirms with a code.
+  ['POST', '/mfa/setup', authenticated(async (ctx) => json(await setupMfa(ctx.client)))],
+  ['POST', '/mfa/enable', authenticated(async (ctx) => json(await enableMfa(ctx.body.code, ctx.client)))],
+  // `password` is optional so accounts created with Google/GitHub (no password) can turn MFA off.
+  ['POST', '/mfa/disable', authenticated(async (ctx) => (
+    json(await disableMfa(ctx.body.password, ctx.body.code, ctx.client))
+  ))],
+  ['POST', '/mfa/backup-codes', authenticated(async (ctx) => (
+    json(await regenerateMfaBackupCodes(ctx.body.code, ctx.client))
+  ))],
+  // Abandon a sign-in waiting for its MFA code (there's no session yet, so /logout can't).
+  ['POST', '/mfa/cancel', async (ctx) => {
+    ctx.cookies.push(clearCookie(ctx.config, COOKIE_MFA_PENDING));
+    return json({ success: true });
+  }],
+
+  ['GET', '/sessions', authenticated(async (ctx) => json(await listSessions(ctx)))],
+  ['DELETE', '/sessions/:id', authenticated(async (ctx) => {
+    const { sessions } = await listSessions(ctx);
+    const current = sessions.some((session) => String(session.id) === ctx.params.id && session.isCurrent);
+    const result = await revokeSession(ctx.params.id, ctx.client);
+    if (current) endLocalSession(ctx);
+    return json({ ...result, current });
+  })],
+
+  ['GET', '/oauth/linked', authenticated(async (ctx) => json(await getLinkedOAuthProviders(ctx.client)))],
+  ['DELETE', '/oauth/linked/:provider', authenticated(async (ctx) => (
+    json(await unlinkOAuthProvider(ctx.params.provider, ctx.client))
+  ))],
+
+  // Voult disables the account (it can be re-enabled), and this browser is signed out.
+  ['DELETE', '/user/me', authenticated(async (ctx) => {
+    const result = await deleteUser(ctx.client);
+    endLocalSession(ctx);
+    return json(result);
+  })],
+];