@voyant-travel/auth 0.113.3

package/dist/auth-facades.d.ts

@@ -0,0 +1,62 @@
+import type { getDb } from "@voyant-travel/db";
+import { type ApiTokenRotationOptions, type ApiTokenRotationStore } from "./api-token-rotation.js";
+import { type CurrentUser, type UpdateCurrentUserProfileInput } from "./workspace.js";
+type BetterAuthApiKeySession = {
+    user: {
+        id: string;
+    };
+};
+type BetterAuthApiKeyApi = {
+    getSession: (args: {
+        headers: Headers;
+    }) => Promise<BetterAuthApiKeySession | null>;
+    listApiKeys: (args: {
+        query?: Record<string, unknown>;
+        headers: Headers;
+    }) => Promise<unknown>;
+    createApiKey: (args: {
+        body: Record<string, unknown>;
+        headers?: Headers;
+    }) => Promise<unknown>;
+    updateApiKey: (args: {
+        body: Record<string, unknown>;
+        headers?: Headers;
+    }) => Promise<unknown>;
+    deleteApiKey: (args: {
+        body: Record<string, unknown>;
+        headers: Headers;
+    }) => Promise<unknown>;
+};
+export type BetterAuthApiTokenManagement = {
+    api: BetterAuthApiKeyApi;
+};
+export interface HandleApiTokenManagementRequestOptions extends ApiTokenRotationOptions {
+    /**
+     * Auth route mount path. Voyant operator APIs mount Better Auth under
+     * `/auth`, which makes the facade routes `/auth/api-tokens`.
+     */
+    basePath?: string;
+}
+export interface HandleAccountProfileRequestOptions {
+    /**
+     * Auth route mount path. Voyant operator APIs mount Better Auth under
+     * `/auth`, which makes the account profile route `/auth/me`.
+     */
+    basePath?: string;
+    db: ReturnType<typeof getDb>;
+    updateProfile?: AccountProfileUpdateHandler;
+}
+export type AccountProfileUpdateHandler = (db: ReturnType<typeof getDb>, input: UpdateCurrentUserProfileInput) => Promise<CurrentUser | null>;
+export type { ApiTokenRotationStore };
+/** Handles Voyant's stable `PATCH /auth/me` account-profile facade. */
+export declare function handleAccountProfileRequest(request: Request, auth: {
+    api: unknown;
+}, options: HandleAccountProfileRequestOptions): Promise<Response | null>;
+/**
+ * Handles Voyant's stable `/auth/api-tokens` management facade, including
+ * create, list, update, delete, and secret rotation.
+ */
+export declare function handleApiTokenManagementRequest(request: Request, auth: {
+    api: unknown;
+}, options?: HandleApiTokenManagementRequestOptions): Promise<Response | null>;
+//# sourceMappingURL=auth-facades.d.ts.map

package/dist/auth-facades.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-facades.d.ts","sourceRoot":"","sources":["../src/auth-facades.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9C,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAE3B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,6BAA6B,EAEnC,MAAM,gBAAgB,CAAA;AAEvB,KAAK,uBAAuB,GAAG;IAC7B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;KACX,CAAA;CACF,CAAA;AAED,KAAK,mBAAmB,GAAG;IACzB,UAAU,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAA;IACnF,WAAW,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9F,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9F,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9F,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9F,CAAA;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,GAAG,EAAE,mBAAmB,CAAA;CACzB,CAAA;AAED,MAAM,WAAW,sCAAuC,SAAQ,uBAAuB;IACrF;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,EAAE,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAA;IAC5B,aAAa,CAAC,EAAE,2BAA2B,CAAA;CAC5C;AAED,MAAM,MAAM,2BAA2B,GAAG,CACxC,EAAE,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,EAC5B,KAAK,EAAE,6BAA6B,KACjC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;AAiChC,YAAY,EAAE,qBAAqB,EAAE,CAAA;AA+IrC,uEAAuE;AACvE,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;IAAE,GAAG,EAAE,OAAO,CAAA;CAAE,EACtB,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyB1B;AAED;;;GAGG;AACH,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;IAAE,GAAG,EAAE,OAAO,CAAA;CAAE,EACtB,OAAO,GAAE,sCAA2C,GACnD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA2F1B"}

package/dist/auth-facades.js

@@ -0,0 +1,252 @@
+import { rotateApiTokenSecret, } from "./api-token-rotation.js";
+import { updateCurrentUserProfile, } from "./workspace.js";
+const API_TOKEN_QUERY_FIELDS = [
+    "configId",
+    "organizationId",
+    "limit",
+    "offset",
+    "sortBy",
+    "sortDirection",
+];
+const API_TOKEN_CREATE_FIELDS = [
+    "configId",
+    "name",
+    "expiresIn",
+    "remaining",
+    "prefix",
+    "organizationId",
+    "metadata",
+    "permissions",
+];
+const API_TOKEN_UPDATE_FIELDS = [
+    "configId",
+    "name",
+    "enabled",
+    "expiresIn",
+    "metadata",
+    "permissions",
+];
+function normalizeApiTokenErrorStatus(status) {
+    if (status === 401 ||
+        status === 403 ||
+        status === 404 ||
+        status === 405 ||
+        status === 429 ||
+        status === 500) {
+        return status;
+    }
+    return 400;
+}
+function authApiErrorResponse(error) {
+    const candidate = error;
+    const status = normalizeApiTokenErrorStatus(candidate.status ?? candidate.statusCode);
+    return jsonResponse({ error: candidate.message ?? "API token request failed" }, status);
+}
+function jsonResponse(body, status = 200, headers) {
+    return Response.json(body, { status, headers });
+}
+function methodNotAllowed(allowed) {
+    return jsonResponse({ error: "Method not allowed" }, 405, { Allow: allowed.join(", ") });
+}
+function apiTokenFacadePath(pathname, basePath) {
+    const trimmedBase = basePath.replace(/^\/+|\/+$/g, "");
+    const normalizedBase = trimmedBase ? `/${trimmedBase}` : "";
+    const normalizedPath = pathname.replace(/\/+$/g, "") || "/";
+    if (normalizedPath === `${normalizedBase}/api-tokens`) {
+        return "/api-tokens";
+    }
+    if (normalizedPath.startsWith(`${normalizedBase}/api-tokens/`)) {
+        return normalizedPath.slice(normalizedBase.length);
+    }
+    return null;
+}
+function accountProfileFacadePath(pathname, basePath) {
+    const trimmedBase = basePath.replace(/^\/+|\/+$/g, "");
+    const normalizedBase = trimmedBase ? `/${trimmedBase}` : "";
+    const normalizedPath = pathname.replace(/\/+$/g, "") || "/";
+    return normalizedPath === `${normalizedBase}/me` ? "/me" : null;
+}
+function readApiKeyQuery(request) {
+    const query = {};
+    const params = new URL(request.url).searchParams;
+    for (const key of API_TOKEN_QUERY_FIELDS) {
+        const value = params.get(key);
+        if (value === null)
+            continue;
+        query[key] = key === "limit" || key === "offset" ? Number(value) : value;
+    }
+    return query;
+}
+function readProfileUpdate(body) {
+    const input = {};
+    for (const field of [
+        "firstName",
+        "lastName",
+        "locale",
+        "timezone",
+        "profilePictureUrl",
+    ]) {
+        const value = body[field];
+        if (value === undefined)
+            continue;
+        if (value !== null && typeof value !== "string") {
+            throw Object.assign(new Error(`${field} must be a string or null`), { status: 400 });
+        }
+        const maxLength = field === "locale"
+            ? 10
+            : field === "timezone"
+                ? 64
+                : field === "profilePictureUrl"
+                    ? 2048
+                    : 200;
+        if (typeof value === "string" && value.length > maxLength) {
+            throw Object.assign(new Error(`${field} must be ${maxLength} characters or fewer`), {
+                status: 400,
+            });
+        }
+        input[field] = value;
+    }
+    return input;
+}
+async function readOptionalJson(request) {
+    const text = await request.text();
+    if (!text)
+        return {};
+    const parsed = JSON.parse(text);
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+        ? parsed
+        : {};
+}
+function pickFields(body, fields) {
+    const next = {};
+    for (const field of fields) {
+        if (body[field] !== undefined)
+            next[field] = body[field];
+    }
+    return next;
+}
+async function requireApiTokenSession(auth, headers) {
+    const session = await auth.api.getSession({ headers });
+    if (!session) {
+        throw Object.assign(new Error("Unauthorized"), { status: 401 });
+    }
+    return session;
+}
+async function requireAccountProfileSession(auth, headers) {
+    const session = await auth.api.getSession({ headers });
+    if (!session) {
+        throw Object.assign(new Error("Unauthorized"), { status: 401 });
+    }
+    return session;
+}
+/** Handles Voyant's stable `PATCH /auth/me` account-profile facade. */
+export async function handleAccountProfileRequest(request, auth, options) {
+    const path = accountProfileFacadePath(new URL(request.url).pathname, options.basePath ?? "/auth");
+    if (path === null)
+        return null;
+    try {
+        if (request.method !== "PATCH")
+            return null;
+        const session = await requireAccountProfileSession({ api: auth.api }, request.headers);
+        const body = await readOptionalJson(request);
+        const profile = await (options.updateProfile ?? updateCurrentUserProfile)(options.db, {
+            userId: session.user.id,
+            ...readProfileUpdate(body),
+        });
+        if (!profile) {
+            return jsonResponse({ error: "User not found" }, 404);
+        }
+        return jsonResponse(profile);
+    }
+    catch (error) {
+        return authApiErrorResponse(error);
+    }
+}
+/**
+ * Handles Voyant's stable `/auth/api-tokens` management facade, including
+ * create, list, update, delete, and secret rotation.
+ */
+export async function handleApiTokenManagementRequest(request, auth, options = {}) {
+    const path = apiTokenFacadePath(new URL(request.url).pathname, options.basePath ?? "/auth");
+    if (path === null)
+        return null;
+    const api = auth.api;
+    const rotateMatch = path.match(/^\/api-tokens\/([^/]+)\/rotate$/);
+    const keyMatch = path.match(/^\/api-tokens\/([^/]+)$/);
+    try {
+        if (path === "/api-tokens") {
+            if (request.method === "GET") {
+                const result = await api.listApiKeys({
+                    query: readApiKeyQuery(request),
+                    headers: request.headers,
+                });
+                return jsonResponse(result);
+            }
+            if (request.method === "POST") {
+                const body = await readOptionalJson(request);
+                const session = await requireApiTokenSession({ api }, request.headers);
+                const result = await api.createApiKey({
+                    body: {
+                        ...pickFields(body, API_TOKEN_CREATE_FIELDS),
+                        userId: session.user.id,
+                    },
+                });
+                return jsonResponse(result, 201);
+            }
+            return methodNotAllowed(["GET", "POST"]);
+        }
+        if (rotateMatch?.[1]) {
+            if (request.method !== "POST")
+                return methodNotAllowed(["POST"]);
+            const keyId = decodeURIComponent(rotateMatch[1]);
+            const body = await readOptionalJson(request);
+            const session = await requireApiTokenSession({ api }, request.headers);
+            const result = await rotateApiTokenSecret({
+                keyId,
+                body,
+                userId: session.user.id,
+                options,
+                authorize: async ({ configId, enabled, keyId, userId }) => {
+                    await api.updateApiKey({
+                        body: {
+                            ...(configId ? { configId } : {}),
+                            keyId,
+                            enabled,
+                            userId,
+                        },
+                    });
+                },
+            });
+            return jsonResponse(result);
+        }
+        if (keyMatch?.[1]) {
+            const keyId = decodeURIComponent(keyMatch[1]);
+            if (request.method === "POST") {
+                const body = await readOptionalJson(request);
+                const session = await requireApiTokenSession({ api }, request.headers);
+                const result = await api.updateApiKey({
+                    body: {
+                        ...pickFields(body, API_TOKEN_UPDATE_FIELDS),
+                        keyId,
+                        userId: session.user.id,
+                    },
+                });
+                return jsonResponse(result);
+            }
+            if (request.method === "DELETE") {
+                const body = await readOptionalJson(request);
+                const result = await api.deleteApiKey({
+                    body: { ...pickFields(body, ["configId"]), keyId },
+                    headers: request.headers,
+                });
+                return jsonResponse(result);
+            }
+            return methodNotAllowed(["POST", "DELETE"]);
+        }
+        return jsonResponse({ error: "Not found" }, 404);
+    }
+    catch (error) {
+        return authApiErrorResponse(error);
+    }
+}
+//# sourceMappingURL=auth-facades.js.map

package/dist/auth-facades.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-facades.js","sourceRoot":"","sources":["../src/auth-facades.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,oBAAoB,GACrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAGL,wBAAwB,GACzB,MAAM,gBAAgB,CAAA;AA6CvB,MAAM,sBAAsB,GAAG;IAC7B,UAAU;IACV,gBAAgB;IAChB,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,eAAe;CACP,CAAA;AAEV,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,MAAM;IACN,WAAW;IACX,WAAW;IACX,QAAQ;IACR,gBAAgB;IAChB,UAAU;IACV,aAAa;CACL,CAAA;AAEV,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,MAAM;IACN,SAAS;IACT,WAAW;IACX,UAAU;IACV,aAAa;CACL,CAAA;AAIV,SAAS,4BAA4B,CAAC,MAA0B;IAC9D,IACE,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG,EACd,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,SAAS,GAAG,KAAmE,CAAA;IACrF,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,CAAA;IACrF,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,IAAI,0BAA0B,EAAE,EAAE,MAAM,CAAC,CAAA;AACzF,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,OAAqB;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAiB;IACzC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC1F,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,QAAgB;IAC5D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACtD,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;IAE3D,IAAI,cAAc,KAAK,GAAG,cAAc,aAAa,EAAE,CAAC;QACtD,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,cAAc,cAAc,CAAC,EAAE,CAAC;QAC/D,OAAO,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;IACpD,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB,EAAE,QAAgB;IAClE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACtD,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;IAE3D,OAAO,cAAc,KAAK,GAAG,cAAc,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,KAAK,GAA4B,EAAE,CAAA;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAA;IAEhD,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,KAAK,KAAK,IAAI;YAAE,SAAQ;QAC5B,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC1E,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,IAA6B;IAE7B,MAAM,KAAK,GAAkD,EAAE,CAAA;IAE/D,KAAK,MAAM,KAAK,IAAI;QAClB,WAAW;QACX,UAAU;QACV,QAAQ;QACR,UAAU;QACV,mBAAmB;KACX,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACzB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QAEjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACtF,CAAC;QAED,MAAM,SAAS,GACb,KAAK,KAAK,QAAQ;YAChB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,KAAK,KAAK,UAAU;gBACpB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,KAAK,KAAK,mBAAmB;oBAC7B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,GAAG,CAAA;QACb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC1D,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,YAAY,SAAS,sBAAsB,CAAC,EAAE;gBAClF,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;IACtB,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;IAC1C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5E,CAAC,CAAE,MAAkC;QACrC,CAAC,CAAC,EAAE,CAAA;AACR,CAAC;AAED,SAAS,UAAU,CACjB,IAA6B,EAC7B,MAAyB;IAEzB,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAkC,EAAE,OAAgB;IACxF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,IAAkC,EAAE,OAAgB;IAC9F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,IAAsB,EACtB,OAA2C;IAE3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAA;IACjG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAE9B,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QAE3C,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAChD,EAAE,GAAG,EAAE,IAAI,CAAC,GAA0B,EAAE,EACxC,OAAO,CAAC,OAAO,CAChB,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE;YACpF,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,GAAG,iBAAiB,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAgB,EAChB,IAAsB,EACtB,UAAkD,EAAE;IAEpD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAA;IAC3F,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAA0B,CAAA;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAEtD,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC;oBACnC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC;oBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAA;gBACF,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;YAC7B,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;gBAC5C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;gBACtE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC;oBACpC,IAAI,EAAE;wBACJ,GAAG,UAAU,CAAC,IAAI,EAAE,uBAAuB,CAAC;wBAC5C,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;qBACxB;iBACF,CAAC,CAAA;gBACF,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAClC,CAAC;YAED,OAAO,gBAAgB,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;QAC1C,CAAC;QAED,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YAEhE,MAAM,KAAK,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;YAChD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;YAC5C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;YACtE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;gBACxC,KAAK;gBACL,IAAI;gBACJ,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,OAAO;gBACP,SAAS,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;oBACxD,MAAM,GAAG,CAAC,YAAY,CAAC;wBACrB,IAAI,EAAE;4BACJ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACjC,KAAK;4BACL,OAAO;4BACP,MAAM;yBACP;qBACF,CAAC,CAAA;gBACJ,CAAC;aACF,CAAC,CAAA;YAEF,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;YAE7C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;gBAC5C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;gBACtE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC;oBACpC,IAAI,EAAE;wBACJ,GAAG,UAAU,CAAC,IAAI,EAAE,uBAAuB,CAAC;wBAC5C,KAAK;wBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;qBACxB;iBACF,CAAC,CAAA;gBACF,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;YAC7B,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;gBAC5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC;oBACpC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE;oBAClD,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAA;gBACF,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;YAC7B,CAAC;YAED,OAAO,gBAAgB,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC7C,CAAC;QAED,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;AACH,CAAC"}

package/dist/backend.d.ts

@@ -0,0 +1,10 @@
+export type VerifyTokenOptions = {
+    secretKey: string;
+    clockSkewInMs?: number;
+};
+export declare function verifyToken(token: string, options: VerifyTokenOptions): Promise<{
+    sub: string;
+    sid?: string;
+}>;
+export declare function createApiTokenFromUserId(userId: string, secret: string): Promise<string>;
+//# sourceMappingURL=backend.d.ts.map

package/dist/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC;IACT,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAC,CAUD;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9F"}

package/dist/backend.js

@@ -0,0 +1,15 @@
+import { signSessionClaims, verifySessionClaims } from "@voyant-travel/utils/session-claims";
+export async function verifyToken(token, options) {
+    const claims = await verifySessionClaims(token, options.secretKey);
+    if (!claims) {
+        throw new Error("Invalid or expired token");
+    }
+    return {
+        sub: claims.userId,
+        sid: claims.sessionId,
+    };
+}
+export async function createApiTokenFromUserId(userId, secret) {
+    return signSessionClaims(userId, `session:${userId}`, secret);
+}
+//# sourceMappingURL=backend.js.map

package/dist/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAA;AAO5F,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,OAA2B;IAK3B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,SAAS;KACtB,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAc,EAAE,MAAc;IAC3E,OAAO,iBAAiB,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;AAC/D,CAAC"}

package/dist/cloud-admin-session-public.d.ts

@@ -0,0 +1,67 @@
+import type { getDb } from "@voyant-travel/db";
+import type { BetterAuthPlugin } from "better-auth/types";
+import type { CloudAdminAssertion, CloudAdminAuthExchangeConfig, CloudAdminAuthRevalidateConfig } from "./cloud-broker.js";
+export type CloudAdminProvisionedUser = {
+    id: string;
+    name: string;
+    email: string;
+    emailVerified: boolean;
+    image?: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+};
+export type CloudAdminUserProvisioningInput = {
+    db: ReturnType<typeof getDb>;
+    assertion: CloudAdminAssertion;
+    user: CloudAdminProvisionedUser;
+    isNewUser: boolean;
+    provider: {
+        providerId: "voyant-cloud";
+        providerAccountId: string;
+    };
+};
+export type CloudAdminUserProvisioningHandler = (input: CloudAdminUserProvisioningInput) => Promise<void> | void;
+export interface VoyantCloudAdminAuthPluginOptions {
+    db: ReturnType<typeof getDb>;
+    cookieSecret: string;
+    exchange: CloudAdminAuthExchangeConfig;
+    fetch?: typeof fetch;
+    revalidateAfterSeconds?: number;
+    onUserProvisioning?: CloudAdminUserProvisioningHandler;
+}
+export declare function createVoyantCloudAdminAuthPlugin(options: VoyantCloudAdminAuthPluginOptions): BetterAuthPlugin;
+export type VoyantCloudAdminSessionRevalidationInput = {
+    db: ReturnType<typeof getDb>;
+    sessionId: string;
+    config: CloudAdminAuthRevalidateConfig;
+    fetch?: typeof fetch;
+    now?: Date;
+    revalidateAfterSeconds?: number;
+};
+export type VoyantCloudAdminSessionRevalidationResult = {
+    ok: true;
+    status: "active" | "cached";
+} | {
+    ok: false;
+    status: "revoked";
+    reason?: string;
+};
+export declare function revalidateVoyantCloudAdminAuthSession(input: VoyantCloudAdminSessionRevalidationInput): Promise<VoyantCloudAdminSessionRevalidationResult>;
+export type VoyantCloudAdminUserRevalidationInput = {
+    db: ReturnType<typeof getDb>;
+    userId: string;
+    config: CloudAdminAuthRevalidateConfig;
+    fetch?: typeof fetch;
+    now?: Date;
+    revalidateAfterSeconds?: number;
+};
+export type VoyantCloudAdminUserRevalidationResult = {
+    ok: true;
+    status: "active" | "cached";
+} | {
+    ok: false;
+    status: "revoked";
+    reason?: string;
+};
+export declare function revalidateVoyantCloudAdminAuthUser(input: VoyantCloudAdminUserRevalidationInput): Promise<VoyantCloudAdminUserRevalidationResult>;
+//# sourceMappingURL=cloud-admin-session-public.d.ts.map

package/dist/cloud-admin-session-public.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-admin-session-public.d.ts","sourceRoot":"","sources":["../src/cloud-admin-session-public.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEzD,OAAO,KAAK,EACV,mBAAmB,EACnB,4BAA4B,EAC5B,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAE1B,MAAM,MAAM,yBAAyB,GAAG;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,OAAO,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,+BAA+B,GAAG;IAC5C,EAAE,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAA;IAC5B,SAAS,EAAE,mBAAmB,CAAA;IAC9B,IAAI,EAAE,yBAAyB,CAAA;IAC/B,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE;QACR,UAAU,EAAE,cAAc,CAAA;QAC1B,iBAAiB,EAAE,MAAM,CAAA;KAC1B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,iCAAiC,GAAG,CAC9C,KAAK,EAAE,+BAA+B,KACnC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAEzB,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAA;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,4BAA4B,CAAA;IACtC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,kBAAkB,CAAC,EAAE,iCAAiC,CAAA;CACvD;AAED,MAAM,CAAC,OAAO,UAAU,gCAAgC,CACtD,OAAO,EAAE,iCAAiC,GACzC,gBAAgB,CAAA;AAEnB,MAAM,MAAM,wCAAwC,GAAG;IACrD,EAAE,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,8BAA8B,CAAA;IACtC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,GAAG,CAAC,EAAE,IAAI,CAAA;IACV,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,yCAAyC,GACjD;IACE,EAAE,EAAE,IAAI,CAAA;IACR,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAC5B,GACD;IACE,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAEL,MAAM,CAAC,OAAO,UAAU,qCAAqC,CAC3D,KAAK,EAAE,wCAAwC,GAC9C,OAAO,CAAC,yCAAyC,CAAC,CAAA;AAErD,MAAM,MAAM,qCAAqC,GAAG;IAClD,EAAE,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAA;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,8BAA8B,CAAA;IACtC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,GAAG,CAAC,EAAE,IAAI,CAAA;IACV,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,sCAAsC,GAC9C;IACE,EAAE,EAAE,IAAI,CAAA;IACR,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAC5B,GACD;IACE,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAEL,MAAM,CAAC,OAAO,UAAU,kCAAkC,CACxD,KAAK,EAAE,qCAAqC,GAC3C,OAAO,CAAC,sCAAsC,CAAC,CAAA"}

package/dist/cloud-admin-session-public.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cloud-admin-session-public.js.map

package/dist/cloud-admin-session-public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-admin-session-public.js","sourceRoot":"","sources":["../src/cloud-admin-session-public.ts"],"names":[],"mappings":""}

package/dist/cloud-admin-session-revalidation-store.d.ts

@@ -0,0 +1,17 @@
+import type { getDb } from "@voyant-travel/db";
+export declare function markCloudAuthSessionRevalidated(db: ReturnType<typeof getDb>, input: {
+    sessionId: string;
+    userId: string;
+    now: Date;
+    revalidateAfterSeconds: number;
+}): Promise<void>;
+export declare function revokeCloudAuthUserAccess(db: ReturnType<typeof getDb>, input: {
+    sessionId?: string;
+    userId: string;
+    now: Date;
+}): Promise<void>;
+export declare function markCloudAuthUserRevalidated(db: ReturnType<typeof getDb>, input: {
+    userId: string;
+    now: Date;
+}): Promise<void>;
+//# sourceMappingURL=cloud-admin-session-revalidation-store.d.ts.map

package/dist/cloud-admin-session-revalidation-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-admin-session-revalidation-store.d.ts","sourceRoot":"","sources":["../src/cloud-admin-session-revalidation-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAQ9C,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,EAC5B,KAAK,EAAE;IACL,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,IAAI,CAAA;IACT,sBAAsB,EAAE,MAAM,CAAA;CAC/B,GACA,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,EAC5B,KAAK,EAAE;IACL,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,IAAI,CAAA;CACV,GACA,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,EAC5B,KAAK,EAAE;IACL,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,IAAI,CAAA;CACV,GACA,OAAO,CAAC,IAAI,CAAC,CASf"}

package/dist/cloud-admin-session-revalidation-store.js

@@ -0,0 +1,64 @@
+import { apikeyTable, cloudAuthSessionLinks, cloudAuthUserLinks, } from "@voyant-travel/db/schema/iam";
+import { eq } from "drizzle-orm";
+export async function markCloudAuthSessionRevalidated(db, input) {
+    const revalidateAfter = new Date(input.now.getTime() + input.revalidateAfterSeconds * 1000);
+    await Promise.all([
+        db
+            .update(cloudAuthSessionLinks)
+            .set({
+            lastRevalidatedAt: input.now,
+            revalidateAfter,
+            revokedAt: null,
+            updatedAt: input.now,
+        })
+            .where(eq(cloudAuthSessionLinks.sessionId, input.sessionId)),
+        db
+            .update(cloudAuthUserLinks)
+            .set({
+            lastRevalidatedAt: input.now,
+            revokedAt: null,
+            updatedAt: input.now,
+        })
+            .where(eq(cloudAuthUserLinks.userId, input.userId)),
+    ]);
+}
+export async function revokeCloudAuthUserAccess(db, input) {
+    const updates = [
+        db
+            .update(cloudAuthUserLinks)
+            .set({
+            revokedAt: input.now,
+            lastRevalidatedAt: input.now,
+            updatedAt: input.now,
+        })
+            .where(eq(cloudAuthUserLinks.userId, input.userId)),
+        db
+            .update(apikeyTable)
+            .set({
+            enabled: false,
+            updatedAt: input.now,
+        })
+            .where(eq(apikeyTable.referenceId, input.userId)),
+    ];
+    if (input.sessionId) {
+        updates.push(db
+            .update(cloudAuthSessionLinks)
+            .set({
+            revokedAt: input.now,
+            updatedAt: input.now,
+        })
+            .where(eq(cloudAuthSessionLinks.sessionId, input.sessionId)));
+    }
+    await Promise.all(updates);
+}
+export async function markCloudAuthUserRevalidated(db, input) {
+    await db
+        .update(cloudAuthUserLinks)
+        .set({
+        lastRevalidatedAt: input.now,
+        revokedAt: null,
+        updatedAt: input.now,
+    })
+        .where(eq(cloudAuthUserLinks.userId, input.userId));
+}
+//# sourceMappingURL=cloud-admin-session-revalidation-store.js.map

package/dist/cloud-admin-session-revalidation-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-admin-session-revalidation-store.js","sourceRoot":"","sources":["../src/cloud-admin-session-revalidation-store.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAEhC,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,EAA4B,EAC5B,KAKC;IAED,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAA;IAC3F,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE;aACC,MAAM,CAAC,qBAAqB,CAAC;aAC7B,GAAG,CAAC;YACH,iBAAiB,EAAE,KAAK,CAAC,GAAG;YAC5B,eAAe;YACf,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,EAAE;aACC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,iBAAiB,EAAE,KAAK,CAAC,GAAG;YAC5B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACtD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAA4B,EAC5B,KAIC;IAED,MAAM,OAAO,GAA4B;QACvC,EAAE;aACC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,iBAAiB,EAAE,KAAK,CAAC,GAAG;YAC5B,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,EAAE;aACC,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC;YACH,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACpD,CAAA;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CACV,EAAE;aACC,MAAM,CAAC,qBAAqB,CAAC;aAC7B,GAAG,CAAC;YACH,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAC/D,CAAA;IACH,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAA4B,EAC5B,KAGC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,kBAAkB,CAAC;SAC1B,GAAG,CAAC;QACH,iBAAiB,EAAE,KAAK,CAAC,GAAG;QAC5B,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,KAAK,CAAC,GAAG;KACrB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;AACvD,CAAC"}

package/dist/cloud-admin-session.d.ts

@@ -0,0 +1,70 @@
+import type { getDb } from "@voyant-travel/db";
+import type { BetterAuthPlugin } from "better-auth/types";
+import { type CloudAdminAssertion, type CloudAdminAuthExchangeConfig, type CloudAdminAuthRevalidateConfig } from "./cloud-broker.js";
+export interface VoyantCloudAdminAuthPluginOptions {
+    db: ReturnType<typeof getDb>;
+    cookieSecret: string;
+    exchange: CloudAdminAuthExchangeConfig;
+    fetch?: typeof fetch;
+    revalidateAfterSeconds?: number;
+    onUserProvisioning?: CloudAdminUserProvisioningHandler;
+}
+export type VoyantCloudAdminSessionRevalidationInput = {
+    db: ReturnType<typeof getDb>;
+    sessionId: string;
+    config: CloudAdminAuthRevalidateConfig;
+    fetch?: typeof fetch;
+    now?: Date;
+    revalidateAfterSeconds?: number;
+};
+export type VoyantCloudAdminSessionRevalidationResult = {
+    ok: true;
+    status: "active" | "cached";
+} | {
+    ok: false;
+    status: "revoked";
+    reason?: string;
+};
+export type VoyantCloudAdminUserRevalidationInput = {
+    db: ReturnType<typeof getDb>;
+    userId: string;
+    config: CloudAdminAuthRevalidateConfig;
+    fetch?: typeof fetch;
+    now?: Date;
+    revalidateAfterSeconds?: number;
+};
+export type VoyantCloudAdminUserRevalidationResult = {
+    ok: true;
+    status: "active" | "cached";
+} | {
+    ok: false;
+    status: "revoked";
+    reason?: string;
+};
+declare const VOYANT_CLOUD_PROVIDER_ID = "voyant-cloud";
+type BetterAuthUserForCookie = {
+    id: string;
+    name: string;
+    email: string;
+    emailVerified: boolean;
+    image?: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+};
+export type CloudAdminProvisionedUser = BetterAuthUserForCookie;
+export type CloudAdminUserProvisioningInput = {
+    db: ReturnType<typeof getDb>;
+    assertion: CloudAdminAssertion;
+    user: CloudAdminProvisionedUser;
+    isNewUser: boolean;
+    provider: {
+        providerId: typeof VOYANT_CLOUD_PROVIDER_ID;
+        providerAccountId: string;
+    };
+};
+export type CloudAdminUserProvisioningHandler = (input: CloudAdminUserProvisioningInput) => Promise<void> | void;
+export declare function createVoyantCloudAdminAuthPlugin(options: VoyantCloudAdminAuthPluginOptions): BetterAuthPlugin;
+export declare function revalidateVoyantCloudAdminAuthSession({ db, sessionId, config, fetch, now, revalidateAfterSeconds, }: VoyantCloudAdminSessionRevalidationInput): Promise<VoyantCloudAdminSessionRevalidationResult>;
+export declare function revalidateVoyantCloudAdminAuthUser({ db, userId, config, fetch, now, revalidateAfterSeconds, }: VoyantCloudAdminUserRevalidationInput): Promise<VoyantCloudAdminUserRevalidationResult>;
+export {};
+//# sourceMappingURL=cloud-admin-session.d.ts.map

package/dist/cloud-admin-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-admin-session.d.ts","sourceRoot":"","sources":["../src/cloud-admin-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAS9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAOzD,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,EAIpC,MAAM,mBAAmB,CAAA;AAG1B,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAA;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,4BAA4B,CAAA;IACtC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,kBAAkB,CAAC,EAAE,iCAAiC,CAAA;CACvD;AAED,MAAM,MAAM,wCAAwC,GAAG;IACrD,EAAE,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,8BAA8B,CAAA;IACtC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,GAAG,CAAC,EAAE,IAAI,CAAA;IACV,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,yCAAyC,GACjD;IACE,EAAE,EAAE,IAAI,CAAA;IACR,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAC5B,GACD;IACE,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAEL,MAAM,MAAM,qCAAqC,GAAG;IAClD,EAAE,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAA;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,8BAA8B,CAAA;IACtC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,GAAG,CAAC,EAAE,IAAI,CAAA;IACV,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,sCAAsC,GAC9C;IACE,EAAE,EAAE,IAAI,CAAA;IACR,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAC5B,GACD;IACE,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAEL,QAAA,MAAM,wBAAwB,iBAAiB,CAAA;AAG/C,KAAK,uBAAuB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,OAAO,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAChB,CAAA;AAaD,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,CAAA;AAE/D,MAAM,MAAM,+BAA+B,GAAG;IAC5C,EAAE,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAA;IAC5B,SAAS,EAAE,mBAAmB,CAAA;IAC9B,IAAI,EAAE,yBAAyB,CAAA;IAC/B,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE;QACR,UAAU,EAAE,OAAO,wBAAwB,CAAA;QAC3C,iBAAiB,EAAE,MAAM,CAAA;KAC1B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,iCAAiC,GAAG,CAC9C,KAAK,EAAE,+BAA+B,KACnC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAEzB,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,iCAAiC,GACzC,gBAAgB,CA0DlB;AAED,wBAAsB,qCAAqC,CAAC,EAC1D,EAAE,EACF,SAAS,EACT,MAAM,EACN,KAAK,EACL,GAAgB,EAChB,sBAAuE,GACxE,EAAE,wCAAwC,GAAG,OAAO,CAAC,yCAAyC,CAAC,CA0C/F;AAED,wBAAsB,kCAAkC,CAAC,EACvD,EAAE,EACF,MAAM,EACN,MAAM,EACN,KAAK,EACL,GAAgB,EAChB,sBAAuE,GACxE,EAAE,qCAAqC,GAAG,OAAO,CAAC,sCAAsC,CAAC,CA0CzF"}