@warlock.js/auth 5.19.1 → 5.21.0

package/CHANGELOG.md

@@ -1,9 +1,33 @@
-# Changelog — @warlock.js/auth
+# Changelog — @warlock.js/auth
 
 All notable changes to `@warlock.js/auth` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
 
+## 5.21.0 - 2026-09-25
+
+### Added
+
+- Page sessions: `pageSession` / `sessionMiddleware` give pages a renewing session (renewal on by default). `session.maxAge` bounds the token family from its creation (default `"30d"`); a family past it is revoked and renewal returns `null`.
+- `setSessionCookies` / `clearSessionCookies` write HttpOnly, SameSite=Lax, `Path=/` cookies, ignoring `auth.cookie.path`. `authService.loginWithSessionCookies()` logs in and sets them.
+- `resolveRequestUser` memoizes on `request.locals.session`: repeat or concurrent callers in one request share a single verify, DB lookup and renewal (the first caller's options win).
+
+### Changed
+
+- **BREAKING:** `loginWithSessionCookies()` requires a same-origin `Origin`/`Referer` even with no cookies, otherwise it throws `CsrfOriginMismatchError`. Send the header from non-browser clients.
+- **BREAKING:** `authMiddleware` takes an ordered header/cookie `sources` list; a present Authorization header always wins and never falls back to the cookie, so an invalid header now returns `401`.
+- JWTs carry a random `jti`, so tokens issued in the same second differ.
+
+
+### Changed
+
+- Lockstep release maintenance and dependency refresh.
+## 5.20.0 - 2026-09-24
+
+### Changed
+
+- `loginThrottleMiddleware` now counts failures with an atomic `cache.increment`. The first failure opens the window with a create-only `cache.set` carrying the TTL, so counts are exact across servers on the redis/pg cache drivers (concurrent failures are no longer lost to a read-modify-write). Thresholds, window and lockout behaviour are unchanged. The memory cache driver is per-process, so counts there are per-process too.
+
 ## 5.19.0 - 2026-09-23
 
 ### Added

package/esm/contracts/request-locals.d.mts

@@ -36,6 +36,11 @@ interface RequestUser {}
 declare module "@warlock.js/core" {
   interface RequestLocals {
     user?: RequestUser;
+    /**
+     * The in-flight or settled result of `resolveRequestUser`, memoised per
+     * request so every caller shares one verify, one lookup and one renewal.
+     */
+    session?: Promise<any>;
   }
 } //# sourceMappingURL=request-locals.d.ts.map
 //#endregion

package/esm/contracts/request-locals.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-locals.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/request-locals.ts"],"mappings":";;AAyBA;;;;AAA4B;AAAG;;;;;;;;;AAYT;;;;;;;;;;UAZL,WAAA;;;;;;;;;;YAWL,aAAA;IACR,IAAA,GAAO,WAAW;EAAA;AAAA"}
+{"version":3,"file":"request-locals.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/request-locals.ts"],"mappings":";;AAyBA;;;;AAA4B;AAAG;;;;;;;;;;;AAiBV;;;;;;;;UAjBJ,WAAA;;;;;;;;;;YAWL,aAAA;IACR,IAAA,GAAO,WAAA;;;;;IAKP,OAAA,GAAU,OAAO;EAAA;AAAA"}

package/esm/contracts/types.d.mts

@@ -48,6 +48,14 @@ interface AuthRefreshCredentialDescriptor extends AuthCredentialDescriptor {
 /** Per-route authentication behavior for the object middleware overload. */
 interface AuthMiddlewareOptions extends Partial<AuthCredentialDescriptor> {
   optional?: boolean;
+  /**
+   * Accept both a header and a cookie credential (at most one of each).
+   * Precedence is fixed and independent of array order: a present
+   * `Authorization` header wins, an invalid header rejects and never falls back
+   * to the cookie, and renewal plus the CSRF Origin check apply only when the
+   * cookie is the credential actually used. Cannot be combined with `source`.
+   */
+  sources?: AuthCredentialDescriptor[];
   /** Opt-in automatic renewal credential. Cookie sources only. */
   refresh?: AuthRefreshCredentialDescriptor;
   redirect?: {
@@ -380,6 +388,11 @@ type CookieAuthConfig = {
    * @default "access_token"
    */
   name?: string;
+  /**
+   * Cookie name the session helpers write and clear for the refresh token.
+   * @default "refresh_token"
+   */
+  refreshName?: string;
   /**
    * Cookie `Path` attribute.
    * @default "/"

package/esm/contracts/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"mappings":";;;;;;;;;;;;;;AA2BA;;;;AAA0B;AAO1B;;;;AAAsC;AAGtC;;;;cAVa,aAAA;AAab;;;;AAEK;AAFL,KANY,0BAAA;;KAGA,SAAA;;UAGK,wBAAA;EACf,MAAA;EACA,GAAG;AAAA;;UAIY,+BAAA,SAAwC,wBAAwB;EAMlC;EAJ7C,SAAS;AAAA;;UAIM,qBAAA,SAA8B,OAAA,CAAQ,wBAAA;EACrD,QAAA;EAEA;EAAA,OAAA,GAAU,+BAAA;EACV,QAAA;IAAa,EAAA;IAAY,cAAA;EAAA;AAAA;AAI3B;AAAA,KAAY,eAAA,IAAmB,IAAA,EAAM,IAAA,eAAmB,OAAO;;KAGnD,eAAA,GAAkB,MAAM;EAClC,QAAQ;AAAA;;;AAJqD;AAG/D;;;KAUY,iBAAA;EATF;AASV;;;;EAME,KAAA,UAAe,WAAA;EAAA;;;EAIf,MAAA;EAeA;;AAAS;AAMX;EAhBE,SAAA,GAAY,SAAS;;;;;;;;;;EAUrB,SAAA;AAAA;;AA4C+C;AASjD;KA/CY,kBAAA;;;;;EAKV,KAAA,UAAe,YAAA;EA6Cf;;;;EAxCA,OAAA;EA6CE;;;;EAxCF,MAAA;EA0CiD;AAYnD;;;;AAYgB;AAMhB;EAhEE,SAAA;;;;;EAKA,QAAA;EAiEA;;AAAG;AAOL;EAnEE,UAAA;;;;;EAKA,kBAAA,GAAqB,0BAA0B;AAAA;;;AA+DI;AAIrD;;;KA1DY,eAAA;EACV,MAAA;EACA,SAAA,GAAY,SAAA;EACZ,SAAA;EACA,OAAA;IACE,MAAA;IACA,OAAA;IACA,SAAA;IACA,QAAA;IACA,UAAA;IACA,kBAAA,GAAqB,0BAA0B;EAAA;AAAA;;;AAmD+B;AAKlF;;;;;KA5CY,cAAA;EAyDV;;;;;EAnDA,SAAA;EA2DU;;;;;EArDV,cAAc;AAAA;;;;KAMJ,4BAAA;EA2DK,iFAzDf,KAAA,UA2DM;EAzDN,SAAA,EAAW,IAAI,EAgED;EA9Dd,GAAA;AAAA;AAoEF;;;;AAAA,KA7DY,gBAAA;EACV,IAAA,GAAO,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,4BAA4B;AAAA;;KAIzC,sBAAA,IAA0B,KAAA,UAAe,IAAA,EAAM,IAAI;;KAGnD,cAAA,IAAkB,IAAA,EAAM,IAAA,EAAM,aAAA,oBAAiC,OAAO;;;;KAKtE,uBAAA;EA2FH;;;;EAtFP,SAAA;EA0GW;;;;;EApGX,KAAA,WAgDG;EA9CH,YAAA,GAAe,gBAAA,EA8CkB;EA5CjC,GAAA,GAAM,sBAAsB;AAAA;;;;KAMlB,mBAAA;EAsDK;;;;EAjDf,SAAA;EAiEA;;;;EA5DA,eAAA,WAoEgB;EAlEhB,YAAA,GAAe,gBAAA,EAsEA;EApEf,GAAA,GAAM,sBAAA;EAwEM;;;;;;EAjEZ,WAAA,GAAc,cAAA;AAAA;AA6EO;AAGvB;;AAHuB,KAvEX,kBAAA;EA8EV,kEA5EA,KAAA,UAAe,YAAY;AAAA;AAAA,KAGjB,kBAAA;;;;;EAKV,QAAA;IAAA,CACG,QAAA,WAAmB,UAAA,CAAW,IAAA;EAAA,GAqFD;EAlFhC,eAAA;EAwFoB;;;;EAnFpB,eAAA,GAAkB,eAAA;EA+FlB;;;EA3FA,WAAA,GAAc,iBAAA;EAoGE;AAAA;AAGlB;EAnGE,YAAA,GAAe,kBAAA;EAmGM;;;;;EA7FrB,QAAA,GAAW,cAAA;EA6FW;;;;;EAvFtB,MAAA,GAAS,gBAAA;EAyFQ;AAAA;AAWnB;EAhGE,IAAA,GAAO,UAAA;;;AA2GH;EAvGJ,YAAA,GAAe,uBAAA;EA8GK;;;EA1GpB,aAAA,GAAgB,mBAAA;EAyHN;;;EArHV,YAAA,GAAe,kBAAA;EAuHf;;;EAnHA,SAAA,GAAY,eAAA;EA4HN;AAIR;;EA5HE,QAAA,GAAW,cAAA;EA8HX;AAEI;;EA5HJ,GAAA,GAAM,SAAA;;;;EAIN,GAAA,GAAM,eAAA;AAAA;AAAA,KAGI,iBAAA;;;;EAIV,KAAA;;;;EAIA,SAAS;AAAA;;;;KAMC,SAAA;;;;EAIV,WAAA,EAAa,iBAAA;;;;EAIb,YAAA,GAAe,iBAAiB;AAAA;;;;KAMtB,UAAA;;;;EAIV,SAAA;;;;EAIA,EAAA;;;;EAIA,QAAA;;;;;EAKA,QAAA;;;;EAIA,OAAA,GAAU,MAAM;AAAA;AAAA,KAGN,WAAA,kBAA6B,IAAA;EACvC,IAAA,EAAM,QAAA;EACN,MAAA,EAAQ,SAAA;AAAA;;;;;;;;;KAWE,gBAAA;;;;;;EAMV,IAAA;;;;;EAKA,IAAI;AAAA;;;;;KAOM,UAAA;;;;;;EAMV,cAAc;AAAA;;;;;;;KASJ,oBAAA;wFAEV,IAAA;EAEA,IAAA;;;;;;;EAOA,MAAA;AAAA;;KAIU,sBAAA;wFAEV,IAAA;EAEA,IAAI;AAAA"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"mappings":";;;;;;;;;;;;;;AA2BA;;;;AAA0B;AAO1B;;;;AAAsC;AAGtC;;;;cAVa,aAAA;AAab;;;;AAEK;AAFL,KANY,0BAAA;;KAGA,SAAA;;UAGK,wBAAA;EACf,MAAA;EACA,GAAG;AAAA;;UAIY,+BAAA,SAAwC,wBAAwB;EAiBrE;EAfV,SAAS;AAAA;;UAIM,qBAAA,SAA8B,OAAA,CAAQ,wBAAA;EACrD,QAAA;EAAA;;;;;;;EAQA,OAAA,GAAU,wBAAA;EAG6B;EADvC,OAAA,GAAU,+BAAA;EACV,QAAA;IAAa,EAAA;IAAY,cAAA;EAAA;AAAA;;KAIf,eAAA,IAAmB,IAAA,EAAM,IAAA,eAAmB,OAAO;;KAGnD,eAAA,GAAkB,MAAM;EAClC,QAAQ;AAAA;;;AAAA;AASV;;;KAAY,iBAAA;EAMV;;;;;EAAA,KAAA,UAAe,WAAA;EAmBN;AAAA;AAMX;EArBE,MAAA;;;;;EAKA,SAAA,GAAY,SAAS;EA+BrB;;;;;;;AAuB+C;AASjD;EArDE,SAAA;AAAA;;;;KAMU,kBAAA;EAkDV;;;;EA7CA,KAAA,UAAe,YAAA;EAkDb;;;;EA7CF,OAAA;EA+CiD;AAYnD;;;EAtDE,MAAA;EAkEc;AAMhB;;;;;;EAhEE,SAAA;EAsEA;;AAAG;AAOL;EAxEE,QAAA;;;;;EAKA,UAAA;EAoEuB;;;AAA4B;EA/DnD,kBAAA,GAAqB,0BAA0B;AAAA;;;;;;;KASrC,eAAA;EACV,MAAA;EACA,SAAA,GAAY,SAAA;EACZ,SAAA;EACA,OAAA;IACE,MAAA;IACA,OAAA;IACA,SAAA;IACA,QAAA;IACA,UAAA;IACA,kBAAA,GAAqB,0BAA0B;EAAA;AAAA;;;;;;;;;KAYvC,cAAA;EA2DkB;AAM9B;;;;EA3DE,SAAA;EAgFc;;;;;EA1Ed,cAAc;AAAA;;;;KAMJ,4BAAA;EAoEkB,iFAlE5B,KAAA,UAwEU;EAtEV,SAAA,EAAW,IAAI;EAEf,GAAA;AAAA;AAyEF;;;;AAAA,KAlEY,gBAAA;EACV,IAAA,GAAO,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,4BAA4B;AAAA;;KAIzC,sBAAA,IAA0B,KAAA,UAAe,IAAA,EAAM,IAAI;;KAGnD,cAAA,IAAkB,IAAA,EAAM,IAAA,EAAM,aAAA,oBAAiC,OAAO;;;;KAKtE,uBAAA;EA+GC;;;;EA1GX,SAAA;EAqDA;;;;;EA/CA,KAAA,WAwDkB;EAtDlB,YAAA,GAAe,gBAAA,EA0DD;EAxDd,GAAA,GAAM,sBAAsB;AAAA;;;;KAMlB,mBAAA;EAsEV;;;;EAjEA,SAAA;EAyEgB;;;;EApEhB,eAAA,WAgFA;EA9EA,YAAA,GAAe,gBAAA,EAkFf;EAhFA,GAAA,GAAM,sBAAA;EAoFN;;;AAAqB;AAGvB;;EAhFE,WAAA,GAAc,cAAA;AAAA;AAwFL;AAMX;;AANW,KAlFC,kBAAA;EAgGsB,kEA9FhC,KAAA,UAAe,YAAY;AAAA;AAAA,KAGjB,kBAAA;EA2FK;;AAAiB;AAMlC;EA5FE,QAAA;IAAA,CACG,QAAA,WAAmB,UAAA,CAAW,IAAA;EAAA,GA+FjC;EA5FA,eAAA;EAoGA;;;;EA/FA,eAAA,GAAkB,eAAA;EAwGF;AAGlB;;EAvGE,WAAA,GAAc,iBAAA;EAuGyB;;;EAnGvC,YAAA,GAAe,kBAAA;EAqGE;;;;;EA/FjB,QAAA,GAAW,cAAA;EA+FH;;AAAS;AAWnB;;EApGE,MAAA,GAAS,gBAAA;EAoGiB;;;EAhG1B,IAAA,GAAO,UAAA;EAgHH;AAAA;AAON;EAnHE,YAAA,GAAe,uBAAA;;;AAyHD;EArHd,aAAA,GAAgB,mBAAA;EA8Hc;;;EA1H9B,YAAA,GAAe,kBAAA;EA8Hf;;;EA1HA,SAAA,GAAY,eAAA;EAqIF;;;EAjIV,QAAA,GAAW,cAAA;EAqIP;;;EAjIJ,GAAA,GAAM,SAAA;;;;EAIN,GAAA,GAAM,eAAA;AAAA;AAAA,KAGI,iBAAA;;;;EAIV,KAAA;;;;EAIA,SAAS;AAAA;;;;KAMC,SAAA;;;;EAIV,WAAA,EAAa,iBAAA;;;;EAIb,YAAA,GAAe,iBAAiB;AAAA;;;;KAMtB,UAAA;;;;EAIV,SAAA;;;;EAIA,EAAA;;;;EAIA,QAAA;;;;;EAKA,QAAA;;;;EAIA,OAAA,GAAU,MAAM;AAAA;AAAA,KAGN,WAAA,kBAA6B,IAAA;EACvC,IAAA,EAAM,QAAA;EACN,MAAA,EAAQ,SAAA;AAAA;;;;;;;;;KAWE,gBAAA;;;;;;EAMV,IAAA;;;;;EAKA,WAAA;;;;;EAKA,IAAA;AAAA;;;;;KAOU,UAAA;;;;;;EAMV,cAAc;AAAA;;;;;;;KASJ,oBAAA;wFAEV,IAAA;EAEA,IAAA;;;;;;;EAOA,MAAA;AAAA;;KAIU,sBAAA;wFAEV,IAAA;EAEA,IAAI;AAAA"}

package/esm/contracts/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"sourcesContent":["import { type ChildModel } from \"@warlock.js/cascade\";\r\nimport { type Algorithm } from \"fast-jwt\";\r\nimport type { AccessToken } from \"../models/access-token\";\r\nimport type { Auth } from \"../models/auth.model\";\r\nimport type { OneTimeToken } from \"../models/one-time-token\";\r\nimport type { OtpConfig, PasskeysConfig, ProvidersConfig } from \"./providers\";\r\nimport type { RefreshToken } from \"../models/refresh-token\";\r\n\r\n/**\r\n * Symbol to indicate no expiration for tokens\r\n * Use this when you explicitly want tokens to never expire\r\n *\r\n * @example\r\n * ```typescript\r\n * // src/config/auth.ts\r\n * import { NO_EXPIRATION, type AuthConfigurations } from \"@warlock.js/auth\";\r\n *\r\n * const authConfigurations: AuthConfigurations = {\r\n *   accessToken: {\r\n *     secret: env(\"JWT_SECRET\"),\r\n *     expiresIn: NO_EXPIRATION,  // Token expires within 100 years\r\n *   },\r\n * };\r\n *\r\n * export default authConfigurations;\r\n * ```\r\n */\r\nexport const NO_EXPIRATION = \"100y\";\r\n\r\n/**\r\n * Behavior when logout is called without a refresh token\r\n * - \"revoke-all\": Revoke all refresh tokens for the user (secure default)\r\n * - \"error\": Return an error requiring the refresh token\r\n */\r\nexport type LogoutWithoutTokenBehavior = \"revoke-all\" | \"error\";\r\n\r\n/** The single request credential source an auth middleware instance accepts. */\r\nexport type TokenFrom = \"header\" | `cookie:${string}`;\r\n\r\n/** One explicitly named credential location accepted by auth middleware. */\r\nexport interface AuthCredentialDescriptor {\r\n  source: \"header\" | \"cookie\";\r\n  key?: string;\r\n}\r\n\r\n/** Cookie credential and bounded duplicate window for automatic renewal. */\r\nexport interface AuthRefreshCredentialDescriptor extends AuthCredentialDescriptor {\r\n  /** Milliseconds; the service clamps this to the 0–10 second range (default 5 seconds). */\r\n  overlapMs?: number;\r\n}\r\n\r\n/** Per-route authentication behavior for the object middleware overload. */\r\nexport interface AuthMiddlewareOptions extends Partial<AuthCredentialDescriptor> {\r\n  optional?: boolean;\r\n  /** Opt-in automatic renewal credential. Cookie sources only. */\r\n  refresh?: AuthRefreshCredentialDescriptor;\r\n  redirect?: { to: string; returnUrlParam?: string };\r\n}\r\n\r\n/** Application policy that decides whether a resolved user may authenticate. */\r\nexport type CanAuthenticate = (user: Auth) => boolean | Promise<boolean>;\r\n\r\n/** Password credentials plus the application-defined identity fields. */\r\nexport type AuthCredentials = Record<string, unknown> & {\r\n  password: string;\r\n};\r\n\r\n/**\r\n * Access-token configuration.\r\n *\r\n * `secret` may also be supplied via the deprecated `jwt.secret` (resolved by a\r\n * backward-compatible shim); one of the two is required at runtime.\r\n */\r\nexport type AccessTokenConfig = {\r\n  /**\r\n   * Override the persisted access-token model — extend {@link AccessToken} to\r\n   * add columns (e.g. a tenant key) or rename them, then register the subclass\r\n   * here. Defaults to the package's `AccessToken`.\r\n   */\r\n  model?: typeof AccessToken;\r\n  /**\r\n   * Secret used to sign access tokens.\r\n   */\r\n  secret?: string;\r\n  /**\r\n   * JWT algorithm.\r\n   * @default \"HS256\"\r\n   */\r\n  algorithm?: Algorithm;\r\n  /**\r\n   * Access-token lifetime — a duration string `ms` parses to a **positive**\r\n   * number of milliseconds. A value `ms` cannot parse (`\"30dayz\"`), a\r\n   * non-positive one (`\"0d\"`), or a bare number throws naming this key on the\r\n   * first token issue: each of them would otherwise sign a token with no `exp`\r\n   * claim at all.\r\n   * @example \"1h\" or NO_EXPIRATION\r\n   * @default \"1h\"\r\n   */\r\n  expiresIn?: string;\r\n};\r\n\r\n/**\r\n * Refresh-token configuration.\r\n */\r\nexport type RefreshTokenConfig = {\r\n  /**\r\n   * Override the persisted refresh-token model — extend {@link RefreshToken}.\r\n   * Defaults to the package's `RefreshToken`.\r\n   */\r\n  model?: typeof RefreshToken;\r\n  /**\r\n   * Enable refresh tokens.\r\n   * @default true\r\n   */\r\n  enabled?: boolean;\r\n  /**\r\n   * Separate secret for refresh tokens (recommended for security). Falls back\r\n   * to the access-token secret when omitted.\r\n   */\r\n  secret?: string;\r\n  /**\r\n   * Refresh-token lifetime — a duration string `ms` parses to a **positive**\r\n   * number of milliseconds; an unusable value throws naming this key on issue\r\n   * (see {@link AccessTokenConfig.expiresIn}).\r\n   * @example \"7d\" or \"1w\"\r\n   * @default \"7d\"\r\n   */\r\n  expiresIn?: string;\r\n  /**\r\n   * Rotate the refresh token on each use (old token revoked, replay detected).\r\n   * @default true\r\n   */\r\n  rotation?: boolean;\r\n  /**\r\n   * Maximum active refresh tokens per user; the oldest are revoked past it.\r\n   * @default 5\r\n   */\r\n  maxPerUser?: number;\r\n  /**\r\n   * Behavior when logout is called without a refresh token.\r\n   * @default \"revoke-all\"\r\n   */\r\n  logoutWithoutToken?: LogoutWithoutTokenBehavior;\r\n};\r\n\r\n/**\r\n * Legacy JWT configuration shape. Still honored by the resolver shim with a\r\n * deprecation warning.\r\n *\r\n * @deprecated Use the top-level `accessToken` / `refreshToken` blocks.\r\n */\r\nexport type LegacyJwtConfig = {\r\n  secret?: string;\r\n  algorithm?: Algorithm;\r\n  expiresIn?: string;\r\n  refresh?: {\r\n    secret?: string;\r\n    enabled?: boolean;\r\n    expiresIn?: string;\r\n    rotation?: boolean;\r\n    maxPerUser?: number;\r\n    logoutWithoutToken?: LogoutWithoutTokenBehavior;\r\n  };\r\n};\r\n\r\n/**\r\n * Page-route auth-failure behavior. When a guarded PAGE route (a React-SSR page,\r\n * `route.isPage`) rejects a logged-out browser, this decides whether it redirects\r\n * to a login page instead of returning the API-style JSON 401.\r\n *\r\n * Read at runtime through `authConfig.pageAuth` (`auth.pageAuth.*`). API routes\r\n * always keep the JSON 401 contract regardless of this setting.\r\n */\r\nexport type PageAuthConfig = {\r\n  /**\r\n   * Login path a guarded page route redirects a logged-out browser to (e.g.\r\n   * `\"/login\"`). Unset ⇒ page-route auth failures keep the JSON 401, so the\r\n   * behavior is opt-in and backward-compatible.\r\n   */\r\n  loginPath?: string;\r\n  /**\r\n   * Query parameter the redirect carries the originally-requested path in, so\r\n   * the login flow can send the user back where they were headed.\r\n   * @default \"returnUrl\"\r\n   */\r\n  returnUrlParam?: string;\r\n};\r\n\r\n/**\r\n * Data every email-verification / password-reset notification receives.\r\n */\r\nexport type OneTimeTokenNotificationData = {\r\n  /** The raw token — the only place it exists; only its SHA-256 hash is stored. */\r\n  token: string;\r\n  /** When the token stops working. */\r\n  expiresAt: Date;\r\n  /** The link built by `auth.verification.url` / `auth.passwordReset.url`, when configured. */\r\n  url?: string;\r\n};\r\n\r\n/**\r\n * Anything auth can deliver a token through — a `defineNotification(...)`\r\n * result satisfies it, as does any object with a compatible `send`.\r\n */\r\nexport type AuthNotification = {\r\n  send: (to: Auth, data: OneTimeTokenNotificationData) => unknown;\r\n};\r\n\r\n/** Builds the link a token notification points at. */\r\nexport type OneTimeTokenUrlBuilder = (token: string, user: Auth) => string;\r\n\r\n/** Persists a new plaintext password for a user during a password reset. */\r\nexport type PasswordSetter = (user: Auth, plainPassword: string) => void | Promise<void>;\r\n\r\n/**\r\n * Email-verification configuration (`auth.verification`).\r\n */\r\nexport type EmailVerificationConfig = {\r\n  /**\r\n   * Token lifetime — a positive `ms` duration string.\r\n   * @default \"24h\"\r\n   */\r\n  expiresIn?: string;\r\n  /**\r\n   * User attribute stamped with the verification `Date`. Declare it in the\r\n   * user schema (e.g. `emailVerifiedAt: v.date().optional()`).\r\n   * @default \"emailVerifiedAt\"\r\n   */\r\n  field?: string;\r\n  /** Replace the default verification email. */\r\n  notification?: AuthNotification;\r\n  /** Build the verification link passed to the notification as `url`. */\r\n  url?: OneTimeTokenUrlBuilder;\r\n};\r\n\r\n/**\r\n * Password-reset configuration (`auth.passwordReset`).\r\n */\r\nexport type PasswordResetConfig = {\r\n  /**\r\n   * Token lifetime — a positive `ms` duration string.\r\n   * @default \"60m\"\r\n   */\r\n  expiresIn?: string;\r\n  /**\r\n   * User attribute `requestPasswordReset` looks the account up by.\r\n   * @default \"email\"\r\n   */\r\n  identifierField?: string;\r\n  /** Replace the default reset email. */\r\n  notification?: AuthNotification;\r\n  /** Build the reset link passed to the notification as `url`. */\r\n  url?: OneTimeTokenUrlBuilder;\r\n  /**\r\n   * Persist the new password yourself. By default auth saves a hash made by\r\n   * the same `hashPassword` login verifies against, and falls back to the\r\n   * plaintext when the model hashes on save (`useHashedPassword()`), checking\r\n   * the stored value with `verifyPassword` either way.\r\n   */\r\n  setPassword?: PasswordSetter;\r\n};\r\n\r\n/**\r\n * One-time token storage configuration (`auth.oneTimeToken`).\r\n */\r\nexport type OneTimeTokenConfig = {\r\n  /** Override the persisted model — extend {@link OneTimeToken}. */\r\n  model?: typeof OneTimeToken;\r\n};\r\n\r\nexport type AuthConfigurations = {\r\n  /**\r\n   * Define all user types — maps a user-type slug to its `Auth` model class so\r\n   * tokens and the middleware can resolve the right model.\r\n   */\r\n  userType: {\r\n    [userType: string]: ChildModel<Auth>;\r\n  };\r\n  /** Default user type used by `authMiddleware()` and options-only overloads. */\r\n  defaultUserType?: string;\r\n  /**\r\n   * Decide whether a resolved user may authenticate or receive new tokens.\r\n   * @default () => true\r\n   */\r\n  canAuthenticate?: CanAuthenticate;\r\n  /**\r\n   * Access-token configuration (secret, expiry, algorithm, model override).\r\n   */\r\n  accessToken?: AccessTokenConfig;\r\n  /**\r\n   * Refresh-token configuration (rotation, lifetime, cap, model override).\r\n   */\r\n  refreshToken?: RefreshTokenConfig;\r\n  /**\r\n   * Page-route auth-failure behavior — set `loginPath` to redirect a logged-out\r\n   * browser on a guarded PAGE route to a login page instead of the JSON 401.\r\n   * Opt-in; API routes are unaffected. Read via `authConfig.pageAuth`.\r\n   */\r\n  pageAuth?: PageAuthConfig;\r\n  /**\r\n   * Cookie auth session config — read by `authService.setAuthCookie` /\r\n   * `clearAuthCookie`. Opt-in: unset ⇒ the helpers fall back to their own\r\n   * defaults (`name: \"access_token\"`, `path: \"/\"`).\r\n   */\r\n  cookie?: CookieAuthConfig;\r\n  /**\r\n   * CSRF Origin-check config for cookie-authenticated unsafe-method requests.\r\n   */\r\n  csrf?: CsrfConfig;\r\n  /**\r\n   * Email verification — token lifetime, verified field, notification override.\r\n   */\r\n  verification?: EmailVerificationConfig;\r\n  /**\r\n   * Password reset — token lifetime, lookup field, notification and password-writer overrides.\r\n   */\r\n  passwordReset?: PasswordResetConfig;\r\n  /**\r\n   * One-time token (verification / reset) storage — model override.\r\n   */\r\n  oneTimeToken?: OneTimeTokenConfig;\r\n  /**\r\n   * Redirect login providers (`google`, `custom`) and account-linking policy.\r\n   */\r\n  providers?: ProvidersConfig;\r\n  /**\r\n   * Passkey (WebAuthn) relying-party settings. Requires `@simplewebauthn/server`.\r\n   */\r\n  passkeys?: PasskeysConfig;\r\n  /**\r\n   * Phone one-time-code login — channel, lifetime, attempts, delivery.\r\n   */\r\n  otp?: OtpConfig;\r\n  /**\r\n   * @deprecated Use `accessToken` / `refreshToken`. Read via a backward-compatible shim.\r\n   */\r\n  jwt?: LegacyJwtConfig;\r\n};\r\n\r\nexport type AccessTokenOutput = {\r\n  /**\r\n   * JWT Token\r\n   */\r\n  token: string;\r\n  /**\r\n   * Exprie time in ISO format UTC time\r\n   */\r\n  expiresAt: string;\r\n};\r\n\r\n/**\r\n * Token pair returned after login or token refresh\r\n */\r\nexport type TokenPair = {\r\n  /**\r\n   * JWT access token (short-lived)\r\n   */\r\n  accessToken: AccessTokenOutput;\r\n  /**\r\n   * JWT refresh token (long-lived)\r\n   */\r\n  refreshToken?: AccessTokenOutput;\r\n};\r\n\r\n/**\r\n * Device information for session tracking\r\n */\r\nexport type DeviceInfo = {\r\n  /**\r\n   * User agent string from request\r\n   */\r\n  userAgent?: string;\r\n  /**\r\n   * Client IP address\r\n   */\r\n  ip?: string;\r\n  /**\r\n   * Optional device identifier\r\n   */\r\n  deviceId?: string;\r\n  /**\r\n   * Token family ID (for rotation tracking)\r\n   * @internal\r\n   */\r\n  familyId?: string;\r\n  /**\r\n   * Access token payload\r\n   */\r\n  payload?: Record<string, unknown>;\r\n};\r\n\r\nexport type LoginResult<UserType extends Auth> = {\r\n  user: UserType;\r\n  tokens: TokenPair;\r\n};\r\n\r\n/**\r\n * Configuration for the cookie an app opts into via `authService.setAuthCookie`\r\n * / `clearAuthCookie` and reads back with `authMiddleware([], \"cookie:<name>\")`.\r\n * Attribute flags (`httpOnly` / `sameSite` / `secure`) are deliberately NOT\r\n * configurable here — they come from core's `secureCookieDefaults()`, the\r\n * same floor every `response.cookie()` call gets, so a cookie auth session can\r\n * never be weakened to a laxer policy than the framework default.\r\n */\r\nexport type CookieAuthConfig = {\r\n  /**\r\n   * Cookie name `setAuthCookie`/`clearAuthCookie` write and clear, and that a\r\n   * `cookie:<name>` token source must match to read it back.\r\n   * @default \"access_token\"\r\n   */\r\n  name?: string;\r\n  /**\r\n   * Cookie `Path` attribute.\r\n   * @default \"/\"\r\n   */\r\n  path?: string;\r\n};\r\n\r\n/**\r\n * CSRF Origin-check configuration. Read via\r\n * `authConfig.csrf.allowedOrigins()`.\r\n */\r\nexport type CsrfConfig = {\r\n  /**\r\n   * Extra origins allowed on a cookie-authenticated unsafe-method request,\r\n   * in addition to the request's own origin.\r\n   * @default []\r\n   */\r\n  allowedOrigins?: string[];\r\n};\r\n\r\n/**\r\n * Per-call overrides for {@link AuthService.setAuthCookie}. Anything omitted\r\n * falls back to `auth.cookie.*` config, then the package default. Cookie\r\n * *attribute* flags (`httpOnly`/`sameSite`/`secure`) are never settable here —\r\n * see {@link CookieAuthConfig}.\r\n */\r\nexport type SetAuthCookieOptions = {\r\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\r\n  name?: string;\r\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). */\r\n  path?: string;\r\n  /**\r\n   * `Max-Age`, in seconds. Overrides the expiry `setAuthCookie` would\r\n   * otherwise derive from an `AccessTokenOutput`'s `expiresAt`. Passing a\r\n   * bare token string with no `maxAge` produces a session cookie (cleared\r\n   * when the browser closes).\r\n   */\r\n  maxAge?: number;\r\n};\r\n\r\n/** Per-call overrides for {@link AuthService.clearAuthCookie}. */\r\nexport type ClearAuthCookieOptions = {\r\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\r\n  name?: string;\r\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). Must match the `Path` the cookie was set with. */\r\n  path?: string;\r\n};\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2BA,MAAa,gBAAgB"}
+{"version":3,"file":"types.mjs","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"sourcesContent":["import { type ChildModel } from \"@warlock.js/cascade\";\r\nimport { type Algorithm } from \"fast-jwt\";\r\nimport type { AccessToken } from \"../models/access-token\";\r\nimport type { Auth } from \"../models/auth.model\";\r\nimport type { OneTimeToken } from \"../models/one-time-token\";\r\nimport type { OtpConfig, PasskeysConfig, ProvidersConfig } from \"./providers\";\r\nimport type { RefreshToken } from \"../models/refresh-token\";\r\n\r\n/**\r\n * Symbol to indicate no expiration for tokens\r\n * Use this when you explicitly want tokens to never expire\r\n *\r\n * @example\r\n * ```typescript\r\n * // src/config/auth.ts\r\n * import { NO_EXPIRATION, type AuthConfigurations } from \"@warlock.js/auth\";\r\n *\r\n * const authConfigurations: AuthConfigurations = {\r\n *   accessToken: {\r\n *     secret: env(\"JWT_SECRET\"),\r\n *     expiresIn: NO_EXPIRATION,  // Token expires within 100 years\r\n *   },\r\n * };\r\n *\r\n * export default authConfigurations;\r\n * ```\r\n */\r\nexport const NO_EXPIRATION = \"100y\";\r\n\r\n/**\r\n * Behavior when logout is called without a refresh token\r\n * - \"revoke-all\": Revoke all refresh tokens for the user (secure default)\r\n * - \"error\": Return an error requiring the refresh token\r\n */\r\nexport type LogoutWithoutTokenBehavior = \"revoke-all\" | \"error\";\r\n\r\n/** The single request credential source an auth middleware instance accepts. */\r\nexport type TokenFrom = \"header\" | `cookie:${string}`;\r\n\r\n/** One explicitly named credential location accepted by auth middleware. */\r\nexport interface AuthCredentialDescriptor {\r\n  source: \"header\" | \"cookie\";\r\n  key?: string;\r\n}\r\n\r\n/** Cookie credential and bounded duplicate window for automatic renewal. */\r\nexport interface AuthRefreshCredentialDescriptor extends AuthCredentialDescriptor {\r\n  /** Milliseconds; the service clamps this to the 0–10 second range (default 5 seconds). */\r\n  overlapMs?: number;\r\n}\r\n\r\n/** Per-route authentication behavior for the object middleware overload. */\r\nexport interface AuthMiddlewareOptions extends Partial<AuthCredentialDescriptor> {\r\n  optional?: boolean;\r\n  /**\r\n   * Accept both a header and a cookie credential (at most one of each).\r\n   * Precedence is fixed and independent of array order: a present\r\n   * `Authorization` header wins, an invalid header rejects and never falls back\r\n   * to the cookie, and renewal plus the CSRF Origin check apply only when the\r\n   * cookie is the credential actually used. Cannot be combined with `source`.\r\n   */\r\n  sources?: AuthCredentialDescriptor[];\r\n  /** Opt-in automatic renewal credential. Cookie sources only. */\r\n  refresh?: AuthRefreshCredentialDescriptor;\r\n  redirect?: { to: string; returnUrlParam?: string };\r\n}\r\n\r\n/** Application policy that decides whether a resolved user may authenticate. */\r\nexport type CanAuthenticate = (user: Auth) => boolean | Promise<boolean>;\r\n\r\n/** Password credentials plus the application-defined identity fields. */\r\nexport type AuthCredentials = Record<string, unknown> & {\r\n  password: string;\r\n};\r\n\r\n/**\r\n * Access-token configuration.\r\n *\r\n * `secret` may also be supplied via the deprecated `jwt.secret` (resolved by a\r\n * backward-compatible shim); one of the two is required at runtime.\r\n */\r\nexport type AccessTokenConfig = {\r\n  /**\r\n   * Override the persisted access-token model — extend {@link AccessToken} to\r\n   * add columns (e.g. a tenant key) or rename them, then register the subclass\r\n   * here. Defaults to the package's `AccessToken`.\r\n   */\r\n  model?: typeof AccessToken;\r\n  /**\r\n   * Secret used to sign access tokens.\r\n   */\r\n  secret?: string;\r\n  /**\r\n   * JWT algorithm.\r\n   * @default \"HS256\"\r\n   */\r\n  algorithm?: Algorithm;\r\n  /**\r\n   * Access-token lifetime — a duration string `ms` parses to a **positive**\r\n   * number of milliseconds. A value `ms` cannot parse (`\"30dayz\"`), a\r\n   * non-positive one (`\"0d\"`), or a bare number throws naming this key on the\r\n   * first token issue: each of them would otherwise sign a token with no `exp`\r\n   * claim at all.\r\n   * @example \"1h\" or NO_EXPIRATION\r\n   * @default \"1h\"\r\n   */\r\n  expiresIn?: string;\r\n};\r\n\r\n/**\r\n * Refresh-token configuration.\r\n */\r\nexport type RefreshTokenConfig = {\r\n  /**\r\n   * Override the persisted refresh-token model — extend {@link RefreshToken}.\r\n   * Defaults to the package's `RefreshToken`.\r\n   */\r\n  model?: typeof RefreshToken;\r\n  /**\r\n   * Enable refresh tokens.\r\n   * @default true\r\n   */\r\n  enabled?: boolean;\r\n  /**\r\n   * Separate secret for refresh tokens (recommended for security). Falls back\r\n   * to the access-token secret when omitted.\r\n   */\r\n  secret?: string;\r\n  /**\r\n   * Refresh-token lifetime — a duration string `ms` parses to a **positive**\r\n   * number of milliseconds; an unusable value throws naming this key on issue\r\n   * (see {@link AccessTokenConfig.expiresIn}).\r\n   * @example \"7d\" or \"1w\"\r\n   * @default \"7d\"\r\n   */\r\n  expiresIn?: string;\r\n  /**\r\n   * Rotate the refresh token on each use (old token revoked, replay detected).\r\n   * @default true\r\n   */\r\n  rotation?: boolean;\r\n  /**\r\n   * Maximum active refresh tokens per user; the oldest are revoked past it.\r\n   * @default 5\r\n   */\r\n  maxPerUser?: number;\r\n  /**\r\n   * Behavior when logout is called without a refresh token.\r\n   * @default \"revoke-all\"\r\n   */\r\n  logoutWithoutToken?: LogoutWithoutTokenBehavior;\r\n};\r\n\r\n/**\r\n * Legacy JWT configuration shape. Still honored by the resolver shim with a\r\n * deprecation warning.\r\n *\r\n * @deprecated Use the top-level `accessToken` / `refreshToken` blocks.\r\n */\r\nexport type LegacyJwtConfig = {\r\n  secret?: string;\r\n  algorithm?: Algorithm;\r\n  expiresIn?: string;\r\n  refresh?: {\r\n    secret?: string;\r\n    enabled?: boolean;\r\n    expiresIn?: string;\r\n    rotation?: boolean;\r\n    maxPerUser?: number;\r\n    logoutWithoutToken?: LogoutWithoutTokenBehavior;\r\n  };\r\n};\r\n\r\n/**\r\n * Page-route auth-failure behavior. When a guarded PAGE route (a React-SSR page,\r\n * `route.isPage`) rejects a logged-out browser, this decides whether it redirects\r\n * to a login page instead of returning the API-style JSON 401.\r\n *\r\n * Read at runtime through `authConfig.pageAuth` (`auth.pageAuth.*`). API routes\r\n * always keep the JSON 401 contract regardless of this setting.\r\n */\r\nexport type PageAuthConfig = {\r\n  /**\r\n   * Login path a guarded page route redirects a logged-out browser to (e.g.\r\n   * `\"/login\"`). Unset ⇒ page-route auth failures keep the JSON 401, so the\r\n   * behavior is opt-in and backward-compatible.\r\n   */\r\n  loginPath?: string;\r\n  /**\r\n   * Query parameter the redirect carries the originally-requested path in, so\r\n   * the login flow can send the user back where they were headed.\r\n   * @default \"returnUrl\"\r\n   */\r\n  returnUrlParam?: string;\r\n};\r\n\r\n/**\r\n * Data every email-verification / password-reset notification receives.\r\n */\r\nexport type OneTimeTokenNotificationData = {\r\n  /** The raw token — the only place it exists; only its SHA-256 hash is stored. */\r\n  token: string;\r\n  /** When the token stops working. */\r\n  expiresAt: Date;\r\n  /** The link built by `auth.verification.url` / `auth.passwordReset.url`, when configured. */\r\n  url?: string;\r\n};\r\n\r\n/**\r\n * Anything auth can deliver a token through — a `defineNotification(...)`\r\n * result satisfies it, as does any object with a compatible `send`.\r\n */\r\nexport type AuthNotification = {\r\n  send: (to: Auth, data: OneTimeTokenNotificationData) => unknown;\r\n};\r\n\r\n/** Builds the link a token notification points at. */\r\nexport type OneTimeTokenUrlBuilder = (token: string, user: Auth) => string;\r\n\r\n/** Persists a new plaintext password for a user during a password reset. */\r\nexport type PasswordSetter = (user: Auth, plainPassword: string) => void | Promise<void>;\r\n\r\n/**\r\n * Email-verification configuration (`auth.verification`).\r\n */\r\nexport type EmailVerificationConfig = {\r\n  /**\r\n   * Token lifetime — a positive `ms` duration string.\r\n   * @default \"24h\"\r\n   */\r\n  expiresIn?: string;\r\n  /**\r\n   * User attribute stamped with the verification `Date`. Declare it in the\r\n   * user schema (e.g. `emailVerifiedAt: v.date().optional()`).\r\n   * @default \"emailVerifiedAt\"\r\n   */\r\n  field?: string;\r\n  /** Replace the default verification email. */\r\n  notification?: AuthNotification;\r\n  /** Build the verification link passed to the notification as `url`. */\r\n  url?: OneTimeTokenUrlBuilder;\r\n};\r\n\r\n/**\r\n * Password-reset configuration (`auth.passwordReset`).\r\n */\r\nexport type PasswordResetConfig = {\r\n  /**\r\n   * Token lifetime — a positive `ms` duration string.\r\n   * @default \"60m\"\r\n   */\r\n  expiresIn?: string;\r\n  /**\r\n   * User attribute `requestPasswordReset` looks the account up by.\r\n   * @default \"email\"\r\n   */\r\n  identifierField?: string;\r\n  /** Replace the default reset email. */\r\n  notification?: AuthNotification;\r\n  /** Build the reset link passed to the notification as `url`. */\r\n  url?: OneTimeTokenUrlBuilder;\r\n  /**\r\n   * Persist the new password yourself. By default auth saves a hash made by\r\n   * the same `hashPassword` login verifies against, and falls back to the\r\n   * plaintext when the model hashes on save (`useHashedPassword()`), checking\r\n   * the stored value with `verifyPassword` either way.\r\n   */\r\n  setPassword?: PasswordSetter;\r\n};\r\n\r\n/**\r\n * One-time token storage configuration (`auth.oneTimeToken`).\r\n */\r\nexport type OneTimeTokenConfig = {\r\n  /** Override the persisted model — extend {@link OneTimeToken}. */\r\n  model?: typeof OneTimeToken;\r\n};\r\n\r\nexport type AuthConfigurations = {\r\n  /**\r\n   * Define all user types — maps a user-type slug to its `Auth` model class so\r\n   * tokens and the middleware can resolve the right model.\r\n   */\r\n  userType: {\r\n    [userType: string]: ChildModel<Auth>;\r\n  };\r\n  /** Default user type used by `authMiddleware()` and options-only overloads. */\r\n  defaultUserType?: string;\r\n  /**\r\n   * Decide whether a resolved user may authenticate or receive new tokens.\r\n   * @default () => true\r\n   */\r\n  canAuthenticate?: CanAuthenticate;\r\n  /**\r\n   * Access-token configuration (secret, expiry, algorithm, model override).\r\n   */\r\n  accessToken?: AccessTokenConfig;\r\n  /**\r\n   * Refresh-token configuration (rotation, lifetime, cap, model override).\r\n   */\r\n  refreshToken?: RefreshTokenConfig;\r\n  /**\r\n   * Page-route auth-failure behavior — set `loginPath` to redirect a logged-out\r\n   * browser on a guarded PAGE route to a login page instead of the JSON 401.\r\n   * Opt-in; API routes are unaffected. Read via `authConfig.pageAuth`.\r\n   */\r\n  pageAuth?: PageAuthConfig;\r\n  /**\r\n   * Cookie auth session config — read by `authService.setAuthCookie` /\r\n   * `clearAuthCookie`. Opt-in: unset ⇒ the helpers fall back to their own\r\n   * defaults (`name: \"access_token\"`, `path: \"/\"`).\r\n   */\r\n  cookie?: CookieAuthConfig;\r\n  /**\r\n   * CSRF Origin-check config for cookie-authenticated unsafe-method requests.\r\n   */\r\n  csrf?: CsrfConfig;\r\n  /**\r\n   * Email verification — token lifetime, verified field, notification override.\r\n   */\r\n  verification?: EmailVerificationConfig;\r\n  /**\r\n   * Password reset — token lifetime, lookup field, notification and password-writer overrides.\r\n   */\r\n  passwordReset?: PasswordResetConfig;\r\n  /**\r\n   * One-time token (verification / reset) storage — model override.\r\n   */\r\n  oneTimeToken?: OneTimeTokenConfig;\r\n  /**\r\n   * Redirect login providers (`google`, `custom`) and account-linking policy.\r\n   */\r\n  providers?: ProvidersConfig;\r\n  /**\r\n   * Passkey (WebAuthn) relying-party settings. Requires `@simplewebauthn/server`.\r\n   */\r\n  passkeys?: PasskeysConfig;\r\n  /**\r\n   * Phone one-time-code login — channel, lifetime, attempts, delivery.\r\n   */\r\n  otp?: OtpConfig;\r\n  /**\r\n   * @deprecated Use `accessToken` / `refreshToken`. Read via a backward-compatible shim.\r\n   */\r\n  jwt?: LegacyJwtConfig;\r\n};\r\n\r\nexport type AccessTokenOutput = {\r\n  /**\r\n   * JWT Token\r\n   */\r\n  token: string;\r\n  /**\r\n   * Exprie time in ISO format UTC time\r\n   */\r\n  expiresAt: string;\r\n};\r\n\r\n/**\r\n * Token pair returned after login or token refresh\r\n */\r\nexport type TokenPair = {\r\n  /**\r\n   * JWT access token (short-lived)\r\n   */\r\n  accessToken: AccessTokenOutput;\r\n  /**\r\n   * JWT refresh token (long-lived)\r\n   */\r\n  refreshToken?: AccessTokenOutput;\r\n};\r\n\r\n/**\r\n * Device information for session tracking\r\n */\r\nexport type DeviceInfo = {\r\n  /**\r\n   * User agent string from request\r\n   */\r\n  userAgent?: string;\r\n  /**\r\n   * Client IP address\r\n   */\r\n  ip?: string;\r\n  /**\r\n   * Optional device identifier\r\n   */\r\n  deviceId?: string;\r\n  /**\r\n   * Token family ID (for rotation tracking)\r\n   * @internal\r\n   */\r\n  familyId?: string;\r\n  /**\r\n   * Access token payload\r\n   */\r\n  payload?: Record<string, unknown>;\r\n};\r\n\r\nexport type LoginResult<UserType extends Auth> = {\r\n  user: UserType;\r\n  tokens: TokenPair;\r\n};\r\n\r\n/**\r\n * Configuration for the cookie an app opts into via `authService.setAuthCookie`\r\n * / `clearAuthCookie` and reads back with `authMiddleware([], \"cookie:<name>\")`.\r\n * Attribute flags (`httpOnly` / `sameSite` / `secure`) are deliberately NOT\r\n * configurable here — they come from core's `secureCookieDefaults()`, the\r\n * same floor every `response.cookie()` call gets, so a cookie auth session can\r\n * never be weakened to a laxer policy than the framework default.\r\n */\r\nexport type CookieAuthConfig = {\r\n  /**\r\n   * Cookie name `setAuthCookie`/`clearAuthCookie` write and clear, and that a\r\n   * `cookie:<name>` token source must match to read it back.\r\n   * @default \"access_token\"\r\n   */\r\n  name?: string;\r\n  /**\r\n   * Cookie name the session helpers write and clear for the refresh token.\r\n   * @default \"refresh_token\"\r\n   */\r\n  refreshName?: string;\r\n  /**\r\n   * Cookie `Path` attribute.\r\n   * @default \"/\"\r\n   */\r\n  path?: string;\r\n};\r\n\r\n/**\r\n * CSRF Origin-check configuration. Read via\r\n * `authConfig.csrf.allowedOrigins()`.\r\n */\r\nexport type CsrfConfig = {\r\n  /**\r\n   * Extra origins allowed on a cookie-authenticated unsafe-method request,\r\n   * in addition to the request's own origin.\r\n   * @default []\r\n   */\r\n  allowedOrigins?: string[];\r\n};\r\n\r\n/**\r\n * Per-call overrides for {@link AuthService.setAuthCookie}. Anything omitted\r\n * falls back to `auth.cookie.*` config, then the package default. Cookie\r\n * *attribute* flags (`httpOnly`/`sameSite`/`secure`) are never settable here —\r\n * see {@link CookieAuthConfig}.\r\n */\r\nexport type SetAuthCookieOptions = {\r\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\r\n  name?: string;\r\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). */\r\n  path?: string;\r\n  /**\r\n   * `Max-Age`, in seconds. Overrides the expiry `setAuthCookie` would\r\n   * otherwise derive from an `AccessTokenOutput`'s `expiresAt`. Passing a\r\n   * bare token string with no `maxAge` produces a session cookie (cleared\r\n   * when the browser closes).\r\n   */\r\n  maxAge?: number;\r\n};\r\n\r\n/** Per-call overrides for {@link AuthService.clearAuthCookie}. */\r\nexport type ClearAuthCookieOptions = {\r\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\r\n  name?: string;\r\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). Must match the `Path` the cookie was set with. */\r\n  path?: string;\r\n};\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2BA,MAAa,gBAAgB"}

package/esm/index.d.mts

@@ -50,7 +50,9 @@ import { TokenType, TokenTypeError, isInvalidCredentialError, jwt } from "./serv
 import { isEmailVerified, sendEmailVerification, verifyEmail } from "./services/email-verification.mjs";
 import { IssuedOneTimeToken, consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel } from "./services/one-time-tokens.mjs";
 import { requestPasswordReset, resetPassword } from "./services/password-reset.mjs";
+import { RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, readCredential, resolveRequestUser, resolveRequestUserOutcome } from "./services/resolve-request-user.mjs";
+import { PageSessionOptions, PageSessionResolver, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, pageSession, sessionMiddleware } from "./session/page-session.mjs";
 import { safeEqual } from "./utils/safe-equal.mjs";
 import { isNeverExpiring, isUsableExpiry, tokenHasExpClaim } from "./utils/token-expiry.mjs";
-export { APPLE_AUTH_FEATURE, AccessToken, AccessTokenConfig, AccessTokenOutput, AppleJoseModule, AppleProvider, AppleProviderConfig, Auth, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthErrorCodes, AuthErrorTranslations, AuthEventCallback, AuthEventName, AuthEventPayloads, AuthMiddlewareOptions, AuthNotification, AuthProvider, AuthProviderSdkMissingError, AuthRefreshCredentialDescriptor, AuthTokenFamily, AuthTranslations, Authenticable, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, CsrfOriginMismatchError, CsrfOriginMismatchReason, DeviceInfo, DiscordProvider, DiscordProviderConfig, EmailNotVerifiedError, EmailVerificationConfig, FacebookProvider, FacebookProviderConfig, GOOGLE_AUTH_FEATURE, GitHubProvider, GitHubProviderConfig, GoogleProvider, GoogleProviderConfig, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, IssuedOneTimeToken, JoseModule, LINKEDIN_AUTH_FEATURE, LegacyJwtConfig, LinkedInProvider, LinkedInProviderConfig, LoginResult, LoginThrottleIdentifier, LoginThrottleOptions, LogoutWithoutTokenBehavior, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenPurpose, OneTimeTokenUrlBuilder, OtpConfig, OtpMessage, OtpSender, PageAuthConfig, PasskeyCredential, type PasskeyOptionsJSON, type PasskeyResponseJSON, PasskeysConfig, PasswordResetConfig, PasswordSetter, ProviderAccount, ProviderAuthorizationState, ProviderCallbackParams, ProviderEmailNotVerifiedError, ProviderProfile, ProviderUserCreator, ProvidersConfig, RefreshToken, RefreshTokenConfig, RefreshTokenIssueOptions, RequestUser, SetAuthCookieOptions, TokenFrom, TokenPair, TokenType, TokenTypeError, XProvider, XProviderConfig, accessTokenSchema, assertCsrfOriginAllowed, authDefaultTranslations, authEvents, authMiddleware, authMigrations, authService, authTokenFamilySchema, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerAuthTranslations, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, safeEqual, sendEmailVerification, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
+export { APPLE_AUTH_FEATURE, AccessToken, AccessTokenConfig, AccessTokenOutput, AppleJoseModule, AppleProvider, AppleProviderConfig, Auth, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthErrorCodes, AuthErrorTranslations, AuthEventCallback, AuthEventName, AuthEventPayloads, AuthMiddlewareOptions, AuthNotification, AuthProvider, AuthProviderSdkMissingError, AuthRefreshCredentialDescriptor, AuthTokenFamily, AuthTranslations, Authenticable, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, CsrfOriginMismatchError, CsrfOriginMismatchReason, DeviceInfo, DiscordProvider, DiscordProviderConfig, EmailNotVerifiedError, EmailVerificationConfig, FacebookProvider, FacebookProviderConfig, GOOGLE_AUTH_FEATURE, GitHubProvider, GitHubProviderConfig, GoogleProvider, GoogleProviderConfig, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, IssuedOneTimeToken, JoseModule, LINKEDIN_AUTH_FEATURE, LegacyJwtConfig, LinkedInProvider, LinkedInProviderConfig, LoginResult, LoginThrottleIdentifier, LoginThrottleOptions, LogoutWithoutTokenBehavior, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenPurpose, OneTimeTokenUrlBuilder, OtpConfig, OtpMessage, OtpSender, PageAuthConfig, PageSessionOptions, PageSessionResolver, PasskeyCredential, type PasskeyOptionsJSON, type PasskeyResponseJSON, PasskeysConfig, PasswordResetConfig, PasswordSetter, ProviderAccount, ProviderAuthorizationState, ProviderCallbackParams, ProviderEmailNotVerifiedError, ProviderProfile, ProviderUserCreator, ProvidersConfig, RefreshToken, RefreshTokenConfig, RefreshTokenIssueOptions, RequestUser, RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, SetAuthCookieOptions, TokenFrom, TokenPair, TokenType, TokenTypeError, XProvider, XProviderConfig, accessTokenSchema, assertCsrfOriginAllowed, authDefaultTranslations, authEvents, authMiddleware, authMigrations, authService, authTokenFamilySchema, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, pageSession, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, readCredential, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerAuthTranslations, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, resolveRequestUser, resolveRequestUserOutcome, safeEqual, sendEmailVerification, sessionMiddleware, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
 import "./contracts/request-locals.mjs";

package/esm/index.mjs

@@ -1,13 +1,14 @@
 import { authDefaultTranslations } from "./localization/auth-default-translations.mjs";
 import { registerAuthTranslations } from "./localization/register-auth-translations.mjs";
 import "./localization/init.mjs";
+import { AuthErrorCodes } from "./utils/auth-error-codes.mjs";
+import { CsrfOriginMismatchError, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./middleware/csrf-origin-check.mjs";
 import { isNeverExpiring, isUsableExpiry, tokenHasExpClaim } from "./utils/token-expiry.mjs";
 import { AccessToken, accessTokenSchema } from "./models/access-token/access-token.model.mjs";
 import { AuthTokenFamily, authTokenFamilySchema } from "./models/auth-token-family/auth-token-family.model.mjs";
 import { OneTimeToken, oneTimeTokenSchema } from "./models/one-time-token/one-time-token.model.mjs";
 import { RefreshToken, refreshTokenSchema } from "./models/refresh-token/refresh-token.model.mjs";
 import { authEvents } from "./services/auth-events.mjs";
-import { AuthErrorCodes } from "./utils/auth-error-codes.mjs";
 import { TokenTypeError, isInvalidCredentialError, jwt } from "./services/jwt.mjs";
 import { authService } from "./services/auth.service.mjs";
 import { registerAuthCleanupCommand } from "./commands/auth-cleanup-command.mjs";
@@ -24,7 +25,7 @@ import { NotificationsUnavailableError } from "./errors/notifications-unavailabl
 import { ProviderEmailNotVerifiedError } from "./errors/provider-email-not-verified.error.mjs";
 import "./errors/index.mjs";
 import "./localization/index.mjs";
-import { CsrfOriginMismatchError, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./middleware/csrf-origin-check.mjs";
+import { readCredential, resolveRequestUser, resolveRequestUserOutcome } from "./services/resolve-request-user.mjs";
 import { authMiddleware } from "./middleware/auth.middleware.mjs";
 import { loginThrottleMiddleware } from "./middleware/login-throttle.middleware.mjs";
 import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./middleware/one-time-token-throttle.middleware.mjs";
@@ -55,6 +56,8 @@ import { LINKEDIN_AUTH_FEATURE, LinkedInProvider } from "./providers/linkedin-pr
 import { XProvider } from "./providers/x-provider.mjs";
 import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./providers/provider-login.mjs";
 import "./providers/index.mjs";
+import { pageSession, sessionMiddleware } from "./session/page-session.mjs";
+import "./session/index.mjs";
 import "./utils/index.mjs";
 
-export { APPLE_AUTH_FEATURE, AccessToken, AppleProvider, Auth, AuthErrorCodes, AuthProviderSdkMissingError, AuthTokenFamily, CsrfOriginMismatchError, DiscordProvider, EmailNotVerifiedError, FacebookProvider, GOOGLE_AUTH_FEATURE, GitHubProvider, GoogleProvider, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, LINKEDIN_AUTH_FEATURE, LinkedInProvider, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, PasskeyCredential, ProviderAccount, ProviderEmailNotVerifiedError, RefreshToken, TokenTypeError, XProvider, accessTokenSchema, assertCsrfOriginAllowed, authDefaultTranslations, authEvents, authMiddleware, authMigrations, authService, authTokenFamilySchema, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerAuthTranslations, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, safeEqual, sendEmailVerification, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
+export { APPLE_AUTH_FEATURE, AccessToken, AppleProvider, Auth, AuthErrorCodes, AuthProviderSdkMissingError, AuthTokenFamily, CsrfOriginMismatchError, DiscordProvider, EmailNotVerifiedError, FacebookProvider, GOOGLE_AUTH_FEATURE, GitHubProvider, GoogleProvider, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, LINKEDIN_AUTH_FEATURE, LinkedInProvider, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, PasskeyCredential, ProviderAccount, ProviderEmailNotVerifiedError, RefreshToken, TokenTypeError, XProvider, accessTokenSchema, assertCsrfOriginAllowed, authDefaultTranslations, authEvents, authMiddleware, authMigrations, authService, authTokenFamilySchema, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, pageSession, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, readCredential, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerAuthTranslations, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, resolveRequestUser, resolveRequestUserOutcome, safeEqual, sendEmailVerification, sessionMiddleware, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };

package/esm/middleware/auth.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"mappings":";;;;;;AAsJA;;;;AAA4C;AAC5C;;;;;;;;AAA0E;AAC1E;;;;;iBAFgB,cAAA,IAAkB,UAAU;AAAA,iBAC5B,cAAA,CAAe,OAAA,EAAS,qBAAA,GAAwB,UAAU;AAAA,iBAC1D,cAAA,CACd,eAAA,qBACA,OAAA,GAAU,qBAAA,GACT,UAAU;AAAA,iBACG,cAAA,CACd,eAAA,qBACA,SAAA,GAAY,SAAA,GACX,UAAU"}
+{"version":3,"file":"auth.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"mappings":";;;;;;AA8GA;;;;AAA4C;AAC5C;;;;;;;;AAA0E;AAC1E;;;;;iBAFgB,cAAA,IAAkB,UAAU;AAAA,iBAC5B,cAAA,CAAe,OAAA,EAAS,qBAAA,GAAwB,UAAU;AAAA,iBAC1D,cAAA,CACd,eAAA,qBACA,OAAA,GAAU,qBAAA,GACT,UAAU;AAAA,iBACG,cAAA,CACd,eAAA,qBACA,SAAA,GAAY,SAAA,GACX,UAAU"}

package/esm/middleware/auth.middleware.mjs

@@ -1,10 +1,7 @@
-import { AccessToken } from "../models/access-token/access-token.model.mjs";
-import "../models/access-token/index.mjs";
-import { authConfig } from "../services/auth-config.mjs";
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
-import { isInvalidCredentialError, jwt } from "../services/jwt.mjs";
-import { authService } from "../services/auth.service.mjs";
 import { CsrfOriginMismatchError, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./csrf-origin-check.mjs";
+import { authConfig } from "../services/auth-config.mjs";
+import { readCredential, resolveRequestUserOutcome } from "../services/resolve-request-user.mjs";
 import { localizedLoginPath } from "./localized-login-path.mjs";
 import { config, t } from "@warlock.js/core";
 import { log } from "@warlock.js/logger";
@@ -39,29 +36,6 @@ function rejectUnauthorized({ request, response }, payload, redirect) {
 	}
 	return response.unauthorized(payload);
 }
-/**
-* Whether the persisted row says the token is dead.
-*
-* The answer belongs to the model (`AccessToken.isExpired`), so a registered
-* override that renames or reshapes its expiry column stays authoritative and
-* the middleware never touches a column name. A row that cannot answer at all —
-* an override that dropped the getter — is treated as **expired**: the failure
-* mode of this whole defect class was a check that quietly answered "fine" when
-* it had nothing to check, and that is not repeated here.
-*
-* This is independent of the `exp` claim required by `jwt.verify`. That guard
-* catches a token whose *claims* carry no deadline; this one catches a token
-* whose *row* says the deadline has passed — a logged-out or expired session
-* whose JWT is still within its own lifetime. Neither subsumes the other.
-*/
-function accessTokenRowIsExpired(accessToken) {
-	return typeof accessToken.isExpired === "boolean" ? accessToken.isExpired : true;
-}
-function readCredential(request, tokenFrom) {
-	if (tokenFrom === "header") return request.authorizationValue;
-	const value = request.cookie(tokenFrom.slice(7));
-	return value ? String(value) : "";
-}
 function tokenFromDescriptor(descriptor) {
 	if (!descriptor.source || descriptor.source === "header") return "header";
 	if (!descriptor.key) throw new Error("authMiddleware cookie credentials require a cookie key.");
@@ -79,7 +53,13 @@ function resolveAllowedTypes(value) {
 function authMiddleware(userTypeOrOptions, legacyTokenFromOrOptions) {
 	const options = typeof userTypeOrOptions === "object" && !Array.isArray(userTypeOrOptions) ? userTypeOrOptions : typeof legacyTokenFromOrOptions === "object" ? legacyTokenFromOrOptions : void 0;
 	const allowedTypes = resolveAllowedTypes(typeof userTypeOrOptions === "string" || Array.isArray(userTypeOrOptions) ? userTypeOrOptions : void 0);
-	const tokenFrom = options ? tokenFromDescriptor(options) : (typeof legacyTokenFromOrOptions === "string" ? legacyTokenFromOrOptions : void 0) ?? "header";
+	const legacyTokenFrom = typeof legacyTokenFromOrOptions === "string" ? legacyTokenFromOrOptions : void 0;
+	const dualSources = options?.sources?.length ? options.sources.map(tokenFromDescriptor) : void 0;
+	if (dualSources && options?.source) throw new Error("authMiddleware accepts either `source` or `sources`, not both.");
+	const dualHeader = dualSources?.includes("header") ?? false;
+	const dualCookies = dualSources?.filter((source) => source !== "header") ?? [];
+	if (dualSources && (dualCookies.length > 1 || dualSources.length - dualCookies.length > 1)) throw new Error("authMiddleware `sources` accepts at most one header and one cookie.");
+	const tokenFrom = dualSources ? dualCookies[0] ?? "header" : options ? tokenFromDescriptor(options) : legacyTokenFrom ?? "header";
 	const refreshCredential = options?.refresh ? tokenFromDescriptor(options.refresh) : void 0;
 	const renewalUserType = allowedTypes.length === 1 ? allowedTypes[0] : void 0;
 	if (refreshCredential && (tokenFrom === "header" || refreshCredential === "header" || !renewalUserType)) throw new Error("authMiddleware automatic renewal requires one allowed user type and cookie access and refresh credentials.");
@@ -89,9 +69,10 @@ function authMiddleware(userTypeOrOptions, legacyTokenFromOrOptions) {
 			request,
 			response
 		}, payload, options?.redirect);
-		let authorizationValue = readCredential(request, tokenFrom);
-		let renewalAttempted = false;
-		if ((authorizationValue || refreshCredential) && requiresCsrfOriginCheck(tokenFrom, request.method)) try {
+		const headerWins = dualHeader && Boolean(request.authorizationValue);
+		const usedTokenFrom = headerWins ? "header" : tokenFrom;
+		const usedRefresh = headerWins ? void 0 : refreshCredential;
+		if ((readCredential(request, usedTokenFrom) || usedRefresh) && requiresCsrfOriginCheck(usedTokenFrom, request.method)) try {
 			assertCsrfOriginAllowed(request);
 		} catch (error) {
 			if (!(error instanceof CsrfOriginMismatchError)) throw error;
@@ -101,92 +82,34 @@ function authMiddleware(userTypeOrOptions, legacyTokenFromOrOptions) {
 				errorCode: "EC006"
 			});
 		}
-		const renew = async () => {
-			if (!refreshCredential || renewalAttempted) return false;
-			renewalAttempted = true;
-			const refreshToken = readCredential(request, refreshCredential);
-			if (!refreshToken) return false;
-			const pair = await authService.renewAutomaticSession(refreshToken, renewalUserType, { overlapMs: options?.refresh?.overlapMs });
-			if (!pair?.refreshToken) return false;
-			authService.setAuthCookie(response, pair.accessToken, { name: tokenFrom.slice(7) });
-			authService.setAuthCookie(response, pair.refreshToken, { name: refreshCredential.slice(7) });
-			authorizationValue = pair.accessToken.token;
-			return true;
-		};
-		let decoded;
-		let accessToken;
-		while (true) {
-			if (!authorizationValue) {
-				request.locals.user = void 0;
-				if (await renew()) continue;
-				if (optional) return;
-				return reject({
-					error: t("auth.errors.missingAccessToken"),
-					errorCode: "EC001"
-				});
-			}
-			try {
-				decoded = await jwt.verify(authorizationValue);
-			} catch (error) {
-				if (!isInvalidCredentialError(error)) throw error;
-				log.error("http", "auth", error);
-				request.locals.user = void 0;
-				if (await renew()) continue;
-				if (optional) return;
-				return reject({
-					error: t("auth.errors.invalidAccessToken"),
-					errorCode: "EC002"
-				});
-			}
-			request.decodedAccessToken = decoded;
-			accessToken = await config.key("auth.accessToken.model", AccessToken).findByToken(authorizationValue);
-			if (!accessToken) {
-				request.locals.user = void 0;
-				if (await renew()) continue;
-				if (optional) return;
-				return reject({
-					error: t("auth.errors.invalidAccessToken"),
-					errorCode: "EC002"
-				});
-			}
-			if (accessTokenRowIsExpired(accessToken)) {
-				await accessToken.destroy();
-				request.locals.user = void 0;
-				if (await renew()) continue;
-				if (optional) return;
-				return reject({
-					error: t("auth.errors.invalidAccessToken"),
-					errorCode: "EC002"
-				});
-			}
-			break;
+		const outcome = await resolveRequestUserOutcome(request, response, {
+			tokenFrom: usedTokenFrom,
+			refreshCredential: usedRefresh,
+			overlapMs: options?.refresh?.overlapMs,
+			allowedTypes,
+			renewalUserType
+		});
+		if (outcome.user) {
+			request.locals.user = outcome.user;
+			return;
 		}
-		const userType = decoded.userType ?? accessToken.userType;
-		if (allowedTypes.length && !allowedTypes.includes(userType)) return response.forbidden({
+		if (outcome.failure === "forbidden") return response.forbidden({
 			error: t("auth.errors.unauthorized"),
 			errorCode: "EC003"
 		});
-		const UserModel = config.key(`auth.userType.${userType}`);
-		if (!UserModel) throw new Error(`User type ${userType} is unknown type.`);
-		const currentUser = await UserModel.find(decoded.id);
-		if (!currentUser) {
-			await accessToken.destroy();
-			request.locals.user = void 0;
-			if (optional) return;
-			return reject({
-				error: t("auth.errors.invalidAccessToken"),
-				errorCode: "EC002"
-			});
-		}
-		if (!await authService.canAuthenticate(currentUser)) {
-			request.locals.user = void 0;
-			if (optional) return;
-			return reject({
-				error: t("auth.errors.unauthorized"),
-				errorCode: "EC003"
-			});
-		}
-		request.locals.user = currentUser;
+		if (optional) return;
+		if (outcome.failure === "missing") return reject({
+			error: t("auth.errors.missingAccessToken"),
+			errorCode: "EC001"
+		});
+		if (outcome.failure === "unauthorized") return reject({
+			error: t("auth.errors.unauthorized"),
+			errorCode: "EC003"
+		});
+		return reject({
+			error: t("auth.errors.invalidAccessToken"),
+			errorCode: "EC002"
+		});
 	};
 	return auth;
 }

package/esm/middleware/auth.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"sourcesContent":["import { config, type HttpContext, t, type Middleware, type Request } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport type {\r\n  AuthCredentialDescriptor,\r\n  AuthMiddlewareOptions,\r\n  TokenFrom,\r\n} from \"../contracts/types\";\r\nimport { AccessToken } from \"../models/access-token\";\r\nimport { authConfig } from \"../services/auth-config\";\r\nimport { authService } from \"../services/auth.service\";\r\nimport { isInvalidCredentialError, jwt } from \"../services/jwt\";\r\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\r\nimport {\r\n  assertCsrfOriginAllowed,\r\n  CsrfOriginMismatchError,\r\n  requiresCsrfOriginCheck,\r\n} from \"./csrf-origin-check\";\r\nimport { localizedLoginPath } from \"./localized-login-path\";\r\n\r\n/** The 401 body shape every rejection in this middleware carries. */\r\ntype UnauthorizedPayload = { error: string; errorCode: string };\r\n\r\n/**\r\n * Reject an unauthenticated request, choosing the representation by ROUTE KIND.\r\n *\r\n * An API route always gets the JSON 401 it has always gotten. A PAGE route\r\n * (`request.route.isPage` — the React-SSR pages) instead redirects a logged-out\r\n * browser to the configured login path with a `returnUrl`, so a human\r\n * navigating to a guarded page lands on the login screen rather than reading a\r\n * raw JSON error blob — the defect in finding b9ab9804.\r\n *\r\n * The redirect is OPT-IN and backward-compatible: with no `auth.pageAuth.loginPath`\r\n * configured, even a page route falls back to the JSON 401, so an app that has\r\n * not asked for page-login UX keeps exactly its current behavior. The API 401\r\n * contract is never changed for API routes.\r\n *\r\n * `returnUrl` carries `request.url` — the relative path + query the browser was\r\n * on — never the absolute URL: a relative target cannot be turned into an\r\n * open-redirect off this app's origin.\r\n */\r\nfunction rejectUnauthorized(\r\n  { request, response }: HttpContext,\r\n  payload: UnauthorizedPayload,\r\n  redirect?: AuthMiddlewareOptions[\"redirect\"],\r\n) {\r\n  const loginPath = redirect?.to ?? authConfig.pageAuth.loginPath();\r\n  const returnUrlParam = redirect?.returnUrlParam ?? authConfig.pageAuth.returnUrlParam();\r\n\r\n  if (loginPath && request.route?.isPage) {\r\n    // Under an active `web.localeRouting` strategy, the login destination\r\n    // itself must carry the request's locale prefix — otherwise an anonymous\r\n    // `/ar/admin` bounces to the DEFAULT locale's `/login` rather than\r\n    // `/ar/login`, even though `returnUrl` below correctly points back at\r\n    // `/ar/admin`. See `./localized-login-path.ts`.\r\n    const destination = localizedLoginPath(loginPath, request.locale);\r\n    const separator = destination.includes(\"?\") ? \"&\" : \"?\";\r\n    const returnUrl = encodeURIComponent(request.url);\r\n\r\n    return response.redirect(`${destination}${separator}${returnUrlParam}=${returnUrl}`);\r\n  }\r\n\r\n  return response.unauthorized(payload);\r\n}\r\n\r\n/**\r\n * Decoded access-token claims the middleware reads. The full payload carries\r\n * more (`created_at`, `tokenType`, `iat`, `exp`) but only these drive routing.\r\n */\r\ntype DecodedAccessToken = {\r\n  id: string | number;\r\n  userType?: string;\r\n};\r\n\r\n/**\r\n * Whether the persisted row says the token is dead.\r\n *\r\n * The answer belongs to the model (`AccessToken.isExpired`), so a registered\r\n * override that renames or reshapes its expiry column stays authoritative and\r\n * the middleware never touches a column name. A row that cannot answer at all —\r\n * an override that dropped the getter — is treated as **expired**: the failure\r\n * mode of this whole defect class was a check that quietly answered \"fine\" when\r\n * it had nothing to check, and that is not repeated here.\r\n *\r\n * This is independent of the `exp` claim required by `jwt.verify`. That guard\r\n * catches a token whose *claims* carry no deadline; this one catches a token\r\n * whose *row* says the deadline has passed — a logged-out or expired session\r\n * whose JWT is still within its own lifetime. Neither subsumes the other.\r\n */\r\nfunction accessTokenRowIsExpired(accessToken: AccessToken): boolean {\r\n  return typeof accessToken.isExpired === \"boolean\" ? accessToken.isExpired : true;\r\n}\r\n\r\nfunction readCredential(request: Request, tokenFrom: TokenFrom): string {\r\n  if (tokenFrom === \"header\") {\r\n    return request.authorizationValue;\r\n  }\r\n\r\n  const value = request.cookie(tokenFrom.slice(\"cookie:\".length));\r\n\r\n  return value ? String(value) : \"\";\r\n}\r\n\r\nfunction tokenFromDescriptor(descriptor: Partial<AuthCredentialDescriptor>): TokenFrom {\r\n  if (!descriptor.source || descriptor.source === \"header\") return \"header\";\r\n\r\n  if (!descriptor.key) {\r\n    throw new Error(\"authMiddleware cookie credentials require a cookie key.\");\r\n  }\r\n\r\n  return `cookie:${descriptor.key}`;\r\n}\r\n\r\nfunction resolveAllowedTypes(value: string | string[] | undefined): string[] {\r\n  if (value !== undefined) return Array.isArray(value) ? value : [value];\r\n\r\n  const configuredDefault = config.key(\"auth.defaultUserType\") as string | undefined;\r\n\r\n  if (configuredDefault) return [configuredDefault];\r\n\r\n  const userTypes = config.key(\"auth.userType\", {}) as Record<string, unknown>;\r\n  const configuredTypes = Object.keys(userTypes);\r\n\r\n  if (configuredTypes.length === 1) return configuredTypes;\r\n\r\n  throw new Error(\r\n    \"authMiddleware requires a user type when auth.defaultUserType is unset and multiple user types exist.\",\r\n  );\r\n}\r\n\r\n/**\r\n * Build a route gate. Authentication is required unless optional is explicit.\r\n *\r\n * An omitted user type selects the configured default; an explicit argument\r\n * selects which user types may pass:\r\n * - `[]` — any authenticated user (token required, type not checked).\r\n * - `\"admin\"` / `[\"admin\", \"staff\"]` — token required AND the user's\r\n *   `userType` must be one of the listed types.\r\n *\r\n * `{ optional: true }` allows anonymous requests. All other forms reject\r\n * missing or invalid credentials with 401, or a configured page redirect.\r\n *\r\n * `tokenFrom` selects one credential source and defaults to `\"header\"`.\r\n * A single source avoids making credential precedence depend on array order.\r\n *\r\n * @example\r\n * router.get(\"/account\", authMiddleware([]), accountController);\r\n * router.get(\"/admin\", authMiddleware(\"admin\"), adminController);\r\n * router.get(\"/back-office\", authMiddleware([\"admin\", \"staff\"]), backOfficeController);\r\n * router.get(\"/browser-account\", authMiddleware([], \"cookie:token\"), accountController);\r\n */\r\nexport function authMiddleware(): Middleware;\r\nexport function authMiddleware(options: AuthMiddlewareOptions): Middleware;\r\nexport function authMiddleware(\r\n  allowedUserType: string | string[],\r\n  options?: AuthMiddlewareOptions,\r\n): Middleware;\r\nexport function authMiddleware(\r\n  allowedUserType: string | string[],\r\n  tokenFrom?: TokenFrom,\r\n): Middleware;\r\nexport function authMiddleware(\r\n  userTypeOrOptions?: string | string[] | AuthMiddlewareOptions,\r\n  legacyTokenFromOrOptions?: TokenFrom | AuthMiddlewareOptions,\r\n): Middleware {\r\n  const options =\r\n    typeof userTypeOrOptions === \"object\" && !Array.isArray(userTypeOrOptions)\r\n      ? userTypeOrOptions\r\n      : typeof legacyTokenFromOrOptions === \"object\"\r\n        ? legacyTokenFromOrOptions\r\n        : undefined;\r\n  const selectedUserType =\r\n    typeof userTypeOrOptions === \"string\" || Array.isArray(userTypeOrOptions)\r\n      ? userTypeOrOptions\r\n      : undefined;\r\n  const allowedTypes = resolveAllowedTypes(selectedUserType);\r\n  const legacyTokenFrom =\r\n    typeof legacyTokenFromOrOptions === \"string\" ? legacyTokenFromOrOptions : undefined;\r\n  const tokenFrom = options ? tokenFromDescriptor(options) : (legacyTokenFrom ?? \"header\");\r\n  const refreshCredential = options?.refresh ? tokenFromDescriptor(options.refresh) : undefined;\r\n  const renewalUserType = allowedTypes.length === 1 ? allowedTypes[0] : undefined;\r\n\r\n  if (\r\n    refreshCredential &&\r\n    (tokenFrom === \"header\" || refreshCredential === \"header\" || !renewalUserType)\r\n  ) {\r\n    throw new Error(\r\n      \"authMiddleware automatic renewal requires one allowed user type and cookie access and refresh credentials.\",\r\n    );\r\n  }\r\n\r\n  const optional = options?.optional === true;\r\n\r\n  const auth: Middleware = async ({ request, response }) => {\r\n    const reject = (payload: UnauthorizedPayload) =>\r\n      rejectUnauthorized({ request, response }, payload, options?.redirect);\r\n    let authorizationValue = readCredential(request, tokenFrom);\r\n    let renewalAttempted = false;\r\n\r\n    // Renewal can mint cookies, so a cookie-authenticated unsafe request must\r\n    // pass the same CSRF check even when its access cookie is missing.\r\n    if (\r\n      (authorizationValue || refreshCredential) &&\r\n      requiresCsrfOriginCheck(tokenFrom, request.method)\r\n    ) {\r\n      try {\r\n        assertCsrfOriginAllowed(request);\r\n      } catch (error) {\r\n        if (!(error instanceof CsrfOriginMismatchError)) throw error;\r\n\r\n        log.error(\"http\", \"auth\", error);\r\n        return response.forbidden({\r\n          error: t(\"auth.errors.csrfOriginMismatch\"),\r\n          errorCode: AuthErrorCodes.CsrfOriginMismatch,\r\n        });\r\n      }\r\n    }\r\n\r\n    const renew = async (): Promise<boolean> => {\r\n      if (!refreshCredential || renewalAttempted) return false;\r\n\r\n      renewalAttempted = true;\r\n      const refreshToken = readCredential(request, refreshCredential);\r\n      if (!refreshToken) return false;\r\n\r\n      const pair = await authService.renewAutomaticSession(refreshToken, renewalUserType!, {\r\n        overlapMs: options?.refresh?.overlapMs,\r\n      });\r\n      if (!pair?.refreshToken) return false;\r\n\r\n      authService.setAuthCookie(response, pair.accessToken, {\r\n        name: tokenFrom.slice(\"cookie:\".length),\r\n      });\r\n      authService.setAuthCookie(response, pair.refreshToken, {\r\n        name: refreshCredential.slice(\"cookie:\".length),\r\n      });\r\n      authorizationValue = pair.accessToken.token;\r\n\r\n      return true;\r\n    };\r\n\r\n    let decoded: DecodedAccessToken;\r\n    let accessToken: AccessToken | null;\r\n\r\n    // At most one renewal is attempted per request. The renewed access token\r\n    // is checked through this normal path; no handler or unsafe request replay\r\n    // is performed.\r\n    while (true) {\r\n      if (!authorizationValue) {\r\n        request.locals.user = undefined;\r\n        if (await renew()) continue;\r\n        if (optional) return;\r\n        return reject({\r\n          error: t(\"auth.errors.missingAccessToken\"),\r\n          errorCode: AuthErrorCodes.MissingAccessToken,\r\n        });\r\n      }\r\n\r\n      try {\r\n        decoded = await jwt.verify<DecodedAccessToken>(authorizationValue);\r\n      } catch (error) {\r\n        if (!isInvalidCredentialError(error)) throw error;\r\n        log.error(\"http\", \"auth\", error);\r\n        request.locals.user = undefined;\r\n        if (await renew()) continue;\r\n        if (optional) return;\r\n        return reject({\r\n          error: t(\"auth.errors.invalidAccessToken\"),\r\n          errorCode: AuthErrorCodes.InvalidAccessToken,\r\n        });\r\n      }\r\n\r\n      request.decodedAccessToken = decoded;\r\n      const AccessTokenModel = config.key(\"auth.accessToken.model\", AccessToken);\r\n      accessToken = await AccessTokenModel.findByToken(authorizationValue);\r\n\r\n      if (!accessToken) {\r\n        request.locals.user = undefined;\r\n        if (await renew()) continue;\r\n        if (optional) return;\r\n        return reject({\r\n          error: t(\"auth.errors.invalidAccessToken\"),\r\n          errorCode: AuthErrorCodes.InvalidAccessToken,\r\n        });\r\n      }\r\n\r\n      if (accessTokenRowIsExpired(accessToken)) {\r\n        await accessToken.destroy();\r\n        request.locals.user = undefined;\r\n        if (await renew()) continue;\r\n        if (optional) return;\r\n        return reject({\r\n          error: t(\"auth.errors.invalidAccessToken\"),\r\n          errorCode: AuthErrorCodes.InvalidAccessToken,\r\n        });\r\n      }\r\n\r\n      break;\r\n    }\r\n    const userType = decoded.userType ?? accessToken.userType;\r\n\r\n    if (allowedTypes.length && !allowedTypes.includes(userType)) {\r\n      return response.forbidden({\r\n        error: t(\"auth.errors.unauthorized\"),\r\n        errorCode: AuthErrorCodes.Unauthorized,\r\n      });\r\n    }\r\n\r\n    const UserModel = config.key(`auth.userType.${userType}`);\r\n\r\n    if (!UserModel) {\r\n      // Configuration, not credentials. Throwing keeps a mis-registered app\r\n      // loudly broken instead of quietly rejecting every request of this type.\r\n      throw new Error(`User type ${userType} is unknown type.`);\r\n    }\r\n\r\n    const currentUser = await UserModel.find(decoded.id);\r\n\r\n    if (!currentUser) {\r\n      await accessToken.destroy();\r\n      request.locals.user = undefined;\r\n      if (optional) return;\r\n\r\n      return reject({\r\n        error: t(\"auth.errors.invalidAccessToken\"),\r\n        errorCode: AuthErrorCodes.InvalidAccessToken,\r\n      });\r\n    }\r\n\r\n    if (!(await authService.canAuthenticate(currentUser))) {\r\n      request.locals.user = undefined;\r\n      if (optional) return;\r\n\r\n      return reject({\r\n        error: t(\"auth.errors.unauthorized\"),\r\n        errorCode: AuthErrorCodes.Unauthorized,\r\n      });\r\n    }\r\n\r\n    request.locals.user = currentUser;\r\n  };\r\n\r\n  return auth;\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,SAAS,mBACP,EAAE,SAAS,YACX,SACA,UACA;CACA,MAAM,YAAY,UAAU,MAAM,WAAW,SAAS,UAAU;CAChE,MAAM,iBAAiB,UAAU,kBAAkB,WAAW,SAAS,eAAe;CAEtF,IAAI,aAAa,QAAQ,OAAO,QAAQ;EAMtC,MAAM,cAAc,mBAAmB,WAAW,QAAQ,MAAM;EAChE,MAAM,YAAY,YAAY,SAAS,GAAG,IAAI,MAAM;EACpD,MAAM,YAAY,mBAAmB,QAAQ,GAAG;EAEhD,OAAO,SAAS,SAAS,GAAG,cAAc,YAAY,eAAe,GAAG,WAAW;CACrF;CAEA,OAAO,SAAS,aAAa,OAAO;AACtC;;;;;;;;;;;;;;;;AA0BA,SAAS,wBAAwB,aAAmC;CAClE,OAAO,OAAO,YAAY,cAAc,YAAY,YAAY,YAAY;AAC9E;AAEA,SAAS,eAAe,SAAkB,WAA8B;CACtE,IAAI,cAAc,UAChB,OAAO,QAAQ;CAGjB,MAAM,QAAQ,QAAQ,OAAO,UAAU,MAAM,CAAgB,CAAC;CAE9D,OAAO,QAAQ,OAAO,KAAK,IAAI;AACjC;AAEA,SAAS,oBAAoB,YAA0D;CACrF,IAAI,CAAC,WAAW,UAAU,WAAW,WAAW,UAAU,OAAO;CAEjE,IAAI,CAAC,WAAW,KACd,MAAM,IAAI,MAAM,yDAAyD;CAG3E,OAAO,UAAU,WAAW;AAC9B;AAEA,SAAS,oBAAoB,OAAgD;CAC3E,IAAI,UAAU,QAAW,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;CAErE,MAAM,oBAAoB,OAAO,IAAI,sBAAsB;CAE3D,IAAI,mBAAmB,OAAO,CAAC,iBAAiB;CAEhD,MAAM,YAAY,OAAO,IAAI,iBAAiB,CAAC,CAAC;CAChD,MAAM,kBAAkB,OAAO,KAAK,SAAS;CAE7C,IAAI,gBAAgB,WAAW,GAAG,OAAO;CAEzC,MAAM,IAAI,MACR,uGACF;AACF;AAiCA,SAAgB,eACd,mBACA,0BACY;CACZ,MAAM,UACJ,OAAO,sBAAsB,YAAY,CAAC,MAAM,QAAQ,iBAAiB,IACrE,oBACA,OAAO,6BAA6B,WAClC,2BACA;CAKR,MAAM,eAAe,oBAHnB,OAAO,sBAAsB,YAAY,MAAM,QAAQ,iBAAiB,IACpE,oBACA,MACmD;CAGzD,MAAM,YAAY,UAAU,oBAAoB,OAAO,KADrD,OAAO,6BAA6B,WAAW,2BAA2B,WACG;CAC/E,MAAM,oBAAoB,SAAS,UAAU,oBAAoB,QAAQ,OAAO,IAAI;CACpF,MAAM,kBAAkB,aAAa,WAAW,IAAI,aAAa,KAAK;CAEtE,IACE,sBACC,cAAc,YAAY,sBAAsB,YAAY,CAAC,kBAE9D,MAAM,IAAI,MACR,4GACF;CAGF,MAAM,WAAW,SAAS,aAAa;CAEvC,MAAM,OAAmB,OAAO,EAAE,SAAS,eAAe;EACxD,MAAM,UAAU,YACd,mBAAmB;GAAE;GAAS;EAAS,GAAG,SAAS,SAAS,QAAQ;EACtE,IAAI,qBAAqB,eAAe,SAAS,SAAS;EAC1D,IAAI,mBAAmB;EAIvB,KACG,sBAAsB,sBACvB,wBAAwB,WAAW,QAAQ,MAAM,GAEjD,IAAI;GACF,wBAAwB,OAAO;EACjC,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,0BAA0B,MAAM;GAEvD,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAC/B,OAAO,SAAS,UAAU;IACxB,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAGF,MAAM,QAAQ,YAA8B;GAC1C,IAAI,CAAC,qBAAqB,kBAAkB,OAAO;GAEnD,mBAAmB;GACnB,MAAM,eAAe,eAAe,SAAS,iBAAiB;GAC9D,IAAI,CAAC,cAAc,OAAO;GAE1B,MAAM,OAAO,MAAM,YAAY,sBAAsB,cAAc,iBAAkB,EACnF,WAAW,SAAS,SAAS,UAC/B,CAAC;GACD,IAAI,CAAC,MAAM,cAAc,OAAO;GAEhC,YAAY,cAAc,UAAU,KAAK,aAAa,EACpD,MAAM,UAAU,MAAM,CAAgB,EACxC,CAAC;GACD,YAAY,cAAc,UAAU,KAAK,cAAc,EACrD,MAAM,kBAAkB,MAAM,CAAgB,EAChD,CAAC;GACD,qBAAqB,KAAK,YAAY;GAEtC,OAAO;EACT;EAEA,IAAI;EACJ,IAAI;EAKJ,OAAO,MAAM;GACX,IAAI,CAAC,oBAAoB;IACvB,QAAQ,OAAO,OAAO;IACtB,IAAI,MAAM,MAAM,GAAG;IACnB,IAAI,UAAU;IACd,OAAO,OAAO;KACZ,OAAO,EAAE,gCAAgC;KACzC;IACF,CAAC;GACH;GAEA,IAAI;IACF,UAAU,MAAM,IAAI,OAA2B,kBAAkB;GACnE,SAAS,OAAO;IACd,IAAI,CAAC,yBAAyB,KAAK,GAAG,MAAM;IAC5C,IAAI,MAAM,QAAQ,QAAQ,KAAK;IAC/B,QAAQ,OAAO,OAAO;IACtB,IAAI,MAAM,MAAM,GAAG;IACnB,IAAI,UAAU;IACd,OAAO,OAAO;KACZ,OAAO,EAAE,gCAAgC;KACzC;IACF,CAAC;GACH;GAEA,QAAQ,qBAAqB;GAE7B,cAAc,MADW,OAAO,IAAI,0BAA0B,WAC3B,CAAC,CAAC,YAAY,kBAAkB;GAEnE,IAAI,CAAC,aAAa;IAChB,QAAQ,OAAO,OAAO;IACtB,IAAI,MAAM,MAAM,GAAG;IACnB,IAAI,UAAU;IACd,OAAO,OAAO;KACZ,OAAO,EAAE,gCAAgC;KACzC;IACF,CAAC;GACH;GAEA,IAAI,wBAAwB,WAAW,GAAG;IACxC,MAAM,YAAY,QAAQ;IAC1B,QAAQ,OAAO,OAAO;IACtB,IAAI,MAAM,MAAM,GAAG;IACnB,IAAI,UAAU;IACd,OAAO,OAAO;KACZ,OAAO,EAAE,gCAAgC;KACzC;IACF,CAAC;GACH;GAEA;EACF;EACA,MAAM,WAAW,QAAQ,YAAY,YAAY;EAEjD,IAAI,aAAa,UAAU,CAAC,aAAa,SAAS,QAAQ,GACxD,OAAO,SAAS,UAAU;GACxB,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,MAAM,YAAY,OAAO,IAAI,iBAAiB,UAAU;EAExD,IAAI,CAAC,WAGH,MAAM,IAAI,MAAM,aAAa,SAAS,kBAAkB;EAG1D,MAAM,cAAc,MAAM,UAAU,KAAK,QAAQ,EAAE;EAEnD,IAAI,CAAC,aAAa;GAChB,MAAM,YAAY,QAAQ;GAC1B,QAAQ,OAAO,OAAO;GACtB,IAAI,UAAU;GAEd,OAAO,OAAO;IACZ,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAEA,IAAI,CAAE,MAAM,YAAY,gBAAgB,WAAW,GAAI;GACrD,QAAQ,OAAO,OAAO;GACtB,IAAI,UAAU;GAEd,OAAO,OAAO;IACZ,OAAO,EAAE,0BAA0B;IACnC;GACF,CAAC;EACH;EAEA,QAAQ,OAAO,OAAO;CACxB;CAEA,OAAO;AACT"}
+{"version":3,"file":"auth.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"sourcesContent":["import { config, type HttpContext, t, type Middleware } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport type {\r\n  AuthCredentialDescriptor,\r\n  AuthMiddlewareOptions,\r\n  TokenFrom,\r\n} from \"../contracts/types\";\r\nimport { authConfig } from \"../services/auth-config\";\r\nimport { readCredential, resolveRequestUserOutcome } from \"../services/resolve-request-user\";\r\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\r\nimport {\r\n  assertCsrfOriginAllowed,\r\n  CsrfOriginMismatchError,\r\n  requiresCsrfOriginCheck,\r\n} from \"./csrf-origin-check\";\r\nimport { localizedLoginPath } from \"./localized-login-path\";\r\n\r\n/** The 401 body shape every rejection in this middleware carries. */\r\ntype UnauthorizedPayload = { error: string; errorCode: string };\r\n\r\n/**\r\n * Reject an unauthenticated request, choosing the representation by ROUTE KIND.\r\n *\r\n * An API route always gets the JSON 401 it has always gotten. A PAGE route\r\n * (`request.route.isPage` — the React-SSR pages) instead redirects a logged-out\r\n * browser to the configured login path with a `returnUrl`, so a human\r\n * navigating to a guarded page lands on the login screen rather than reading a\r\n * raw JSON error blob — the defect in finding b9ab9804.\r\n *\r\n * The redirect is OPT-IN and backward-compatible: with no `auth.pageAuth.loginPath`\r\n * configured, even a page route falls back to the JSON 401, so an app that has\r\n * not asked for page-login UX keeps exactly its current behavior. The API 401\r\n * contract is never changed for API routes.\r\n *\r\n * `returnUrl` carries `request.url` — the relative path + query the browser was\r\n * on — never the absolute URL: a relative target cannot be turned into an\r\n * open-redirect off this app's origin.\r\n */\r\nfunction rejectUnauthorized(\r\n  { request, response }: HttpContext,\r\n  payload: UnauthorizedPayload,\r\n  redirect?: AuthMiddlewareOptions[\"redirect\"],\r\n) {\r\n  const loginPath = redirect?.to ?? authConfig.pageAuth.loginPath();\r\n  const returnUrlParam = redirect?.returnUrlParam ?? authConfig.pageAuth.returnUrlParam();\r\n\r\n  if (loginPath && request.route?.isPage) {\r\n    // Under an active `web.localeRouting` strategy, the login destination\r\n    // itself must carry the request's locale prefix — otherwise an anonymous\r\n    // `/ar/admin` bounces to the DEFAULT locale's `/login` rather than\r\n    // `/ar/login`, even though `returnUrl` below correctly points back at\r\n    // `/ar/admin`. See `./localized-login-path.ts`.\r\n    const destination = localizedLoginPath(loginPath, request.locale);\r\n    const separator = destination.includes(\"?\") ? \"&\" : \"?\";\r\n    const returnUrl = encodeURIComponent(request.url);\r\n\r\n    return response.redirect(`${destination}${separator}${returnUrlParam}=${returnUrl}`);\r\n  }\r\n\r\n  return response.unauthorized(payload);\r\n}\r\n\r\nfunction tokenFromDescriptor(descriptor: Partial<AuthCredentialDescriptor>): TokenFrom {\r\n  if (!descriptor.source || descriptor.source === \"header\") return \"header\";\r\n\r\n  if (!descriptor.key) {\r\n    throw new Error(\"authMiddleware cookie credentials require a cookie key.\");\r\n  }\r\n\r\n  return `cookie:${descriptor.key}`;\r\n}\r\n\r\nfunction resolveAllowedTypes(value: string | string[] | undefined): string[] {\r\n  if (value !== undefined) return Array.isArray(value) ? value : [value];\r\n\r\n  const configuredDefault = config.key(\"auth.defaultUserType\") as string | undefined;\r\n\r\n  if (configuredDefault) return [configuredDefault];\r\n\r\n  const userTypes = config.key(\"auth.userType\", {}) as Record<string, unknown>;\r\n  const configuredTypes = Object.keys(userTypes);\r\n\r\n  if (configuredTypes.length === 1) return configuredTypes;\r\n\r\n  throw new Error(\r\n    \"authMiddleware requires a user type when auth.defaultUserType is unset and multiple user types exist.\",\r\n  );\r\n}\r\n\r\n/**\r\n * Build a route gate. Authentication is required unless optional is explicit.\r\n *\r\n * An omitted user type selects the configured default; an explicit argument\r\n * selects which user types may pass:\r\n * - `[]` — any authenticated user (token required, type not checked).\r\n * - `\"admin\"` / `[\"admin\", \"staff\"]` — token required AND the user's\r\n *   `userType` must be one of the listed types.\r\n *\r\n * `{ optional: true }` allows anonymous requests. All other forms reject\r\n * missing or invalid credentials with 401, or a configured page redirect.\r\n *\r\n * `tokenFrom` selects one credential source and defaults to `\"header\"`.\r\n * A single source avoids making credential precedence depend on array order.\r\n *\r\n * @example\r\n * router.get(\"/account\", authMiddleware([]), accountController);\r\n * router.get(\"/admin\", authMiddleware(\"admin\"), adminController);\r\n * router.get(\"/back-office\", authMiddleware([\"admin\", \"staff\"]), backOfficeController);\r\n * router.get(\"/browser-account\", authMiddleware([], \"cookie:token\"), accountController);\r\n */\r\nexport function authMiddleware(): Middleware;\r\nexport function authMiddleware(options: AuthMiddlewareOptions): Middleware;\r\nexport function authMiddleware(\r\n  allowedUserType: string | string[],\r\n  options?: AuthMiddlewareOptions,\r\n): Middleware;\r\nexport function authMiddleware(\r\n  allowedUserType: string | string[],\r\n  tokenFrom?: TokenFrom,\r\n): Middleware;\r\nexport function authMiddleware(\r\n  userTypeOrOptions?: string | string[] | AuthMiddlewareOptions,\r\n  legacyTokenFromOrOptions?: TokenFrom | AuthMiddlewareOptions,\r\n): Middleware {\r\n  const options =\r\n    typeof userTypeOrOptions === \"object\" && !Array.isArray(userTypeOrOptions)\r\n      ? userTypeOrOptions\r\n      : typeof legacyTokenFromOrOptions === \"object\"\r\n        ? legacyTokenFromOrOptions\r\n        : undefined;\r\n  const selectedUserType =\r\n    typeof userTypeOrOptions === \"string\" || Array.isArray(userTypeOrOptions)\r\n      ? userTypeOrOptions\r\n      : undefined;\r\n  const allowedTypes = resolveAllowedTypes(selectedUserType);\r\n  const legacyTokenFrom =\r\n    typeof legacyTokenFromOrOptions === \"string\" ? legacyTokenFromOrOptions : undefined;\r\n  const dualSources = options?.sources?.length ? options.sources.map(tokenFromDescriptor) : undefined;\r\n\r\n  if (dualSources && options?.source) {\r\n    throw new Error(\"authMiddleware accepts either `source` or `sources`, not both.\");\r\n  }\r\n\r\n  const dualHeader = dualSources?.includes(\"header\") ?? false;\r\n  const dualCookies = dualSources?.filter(source => source !== \"header\") ?? [];\r\n\r\n  if (dualSources && (dualCookies.length > 1 || dualSources.length - dualCookies.length > 1)) {\r\n    throw new Error(\"authMiddleware `sources` accepts at most one header and one cookie.\");\r\n  }\r\n\r\n  // With dual sources the configured cookie is the base credential; the header\r\n  // is chosen per request, ahead of it.\r\n  const cookieTokenFrom: TokenFrom = dualSources\r\n    ? (dualCookies[0] ?? \"header\")\r\n    : options\r\n      ? tokenFromDescriptor(options)\r\n      : (legacyTokenFrom ?? \"header\");\r\n  const tokenFrom = cookieTokenFrom;\r\n  const refreshCredential = options?.refresh ? tokenFromDescriptor(options.refresh) : undefined;\r\n  const renewalUserType = allowedTypes.length === 1 ? allowedTypes[0] : undefined;\r\n\r\n  if (\r\n    refreshCredential &&\r\n    (tokenFrom === \"header\" || refreshCredential === \"header\" || !renewalUserType)\r\n  ) {\r\n    throw new Error(\r\n      \"authMiddleware automatic renewal requires one allowed user type and cookie access and refresh credentials.\",\r\n    );\r\n  }\r\n\r\n  const optional = options?.optional === true;\r\n\r\n  const auth: Middleware = async ({ request, response }) => {\r\n    const reject = (payload: UnauthorizedPayload) =>\r\n      rejectUnauthorized({ request, response }, payload, options?.redirect);\r\n\r\n    // A present Authorization header always wins and never falls back to the\r\n    // cookie: the credential used is the header, so no renewal and no CSRF check.\r\n    const headerWins = dualHeader && Boolean(request.authorizationValue);\r\n    const usedTokenFrom: TokenFrom = headerWins ? \"header\" : tokenFrom;\r\n    const usedRefresh = headerWins ? undefined : refreshCredential;\r\n\r\n    // Renewal can mint cookies, so a cookie-authenticated unsafe request must\r\n    // pass the same CSRF check even when its access cookie is missing.\r\n    if (\r\n      (readCredential(request, usedTokenFrom) || usedRefresh) &&\r\n      requiresCsrfOriginCheck(usedTokenFrom, request.method)\r\n    ) {\r\n      try {\r\n        assertCsrfOriginAllowed(request);\r\n      } catch (error) {\r\n        if (!(error instanceof CsrfOriginMismatchError)) throw error;\r\n\r\n        log.error(\"http\", \"auth\", error);\r\n        return response.forbidden({\r\n          error: t(\"auth.errors.csrfOriginMismatch\"),\r\n          errorCode: AuthErrorCodes.CsrfOriginMismatch,\r\n        });\r\n      }\r\n    }\r\n\r\n    const outcome = await resolveRequestUserOutcome(request, response, {\r\n      tokenFrom: usedTokenFrom,\r\n      refreshCredential: usedRefresh,\r\n      overlapMs: options?.refresh?.overlapMs,\r\n      allowedTypes,\r\n      renewalUserType,\r\n    });\r\n\r\n    if (outcome.user) {\r\n      request.locals.user = outcome.user;\r\n      return;\r\n    }\r\n\r\n    if (outcome.failure === \"forbidden\") {\r\n      return response.forbidden({\r\n        error: t(\"auth.errors.unauthorized\"),\r\n        errorCode: AuthErrorCodes.Unauthorized,\r\n      });\r\n    }\r\n\r\n    if (optional) return;\r\n\r\n    if (outcome.failure === \"missing\") {\r\n      return reject({\r\n        error: t(\"auth.errors.missingAccessToken\"),\r\n        errorCode: AuthErrorCodes.MissingAccessToken,\r\n      });\r\n    }\r\n\r\n    if (outcome.failure === \"unauthorized\") {\r\n      return reject({\r\n        error: t(\"auth.errors.unauthorized\"),\r\n        errorCode: AuthErrorCodes.Unauthorized,\r\n      });\r\n    }\r\n\r\n    return reject({\r\n      error: t(\"auth.errors.invalidAccessToken\"),\r\n      errorCode: AuthErrorCodes.InvalidAccessToken,\r\n    });\r\n  };\r\n\r\n  return auth;\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAS,mBACP,EAAE,SAAS,YACX,SACA,UACA;CACA,MAAM,YAAY,UAAU,MAAM,WAAW,SAAS,UAAU;CAChE,MAAM,iBAAiB,UAAU,kBAAkB,WAAW,SAAS,eAAe;CAEtF,IAAI,aAAa,QAAQ,OAAO,QAAQ;EAMtC,MAAM,cAAc,mBAAmB,WAAW,QAAQ,MAAM;EAChE,MAAM,YAAY,YAAY,SAAS,GAAG,IAAI,MAAM;EACpD,MAAM,YAAY,mBAAmB,QAAQ,GAAG;EAEhD,OAAO,SAAS,SAAS,GAAG,cAAc,YAAY,eAAe,GAAG,WAAW;CACrF;CAEA,OAAO,SAAS,aAAa,OAAO;AACtC;AAEA,SAAS,oBAAoB,YAA0D;CACrF,IAAI,CAAC,WAAW,UAAU,WAAW,WAAW,UAAU,OAAO;CAEjE,IAAI,CAAC,WAAW,KACd,MAAM,IAAI,MAAM,yDAAyD;CAG3E,OAAO,UAAU,WAAW;AAC9B;AAEA,SAAS,oBAAoB,OAAgD;CAC3E,IAAI,UAAU,QAAW,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;CAErE,MAAM,oBAAoB,OAAO,IAAI,sBAAsB;CAE3D,IAAI,mBAAmB,OAAO,CAAC,iBAAiB;CAEhD,MAAM,YAAY,OAAO,IAAI,iBAAiB,CAAC,CAAC;CAChD,MAAM,kBAAkB,OAAO,KAAK,SAAS;CAE7C,IAAI,gBAAgB,WAAW,GAAG,OAAO;CAEzC,MAAM,IAAI,MACR,uGACF;AACF;AAiCA,SAAgB,eACd,mBACA,0BACY;CACZ,MAAM,UACJ,OAAO,sBAAsB,YAAY,CAAC,MAAM,QAAQ,iBAAiB,IACrE,oBACA,OAAO,6BAA6B,WAClC,2BACA;CAKR,MAAM,eAAe,oBAHnB,OAAO,sBAAsB,YAAY,MAAM,QAAQ,iBAAiB,IACpE,oBACA,MACmD;CACzD,MAAM,kBACJ,OAAO,6BAA6B,WAAW,2BAA2B;CAC5E,MAAM,cAAc,SAAS,SAAS,SAAS,QAAQ,QAAQ,IAAI,mBAAmB,IAAI;CAE1F,IAAI,eAAe,SAAS,QAC1B,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAM,aAAa,aAAa,SAAS,QAAQ,KAAK;CACtD,MAAM,cAAc,aAAa,QAAO,WAAU,WAAW,QAAQ,KAAK,CAAC;CAE3E,IAAI,gBAAgB,YAAY,SAAS,KAAK,YAAY,SAAS,YAAY,SAAS,IACtF,MAAM,IAAI,MAAM,qEAAqE;CAUvF,MAAM,YAL6B,cAC9B,YAAY,MAAM,WACnB,UACE,oBAAoB,OAAO,IAC1B,mBAAmB;CAE1B,MAAM,oBAAoB,SAAS,UAAU,oBAAoB,QAAQ,OAAO,IAAI;CACpF,MAAM,kBAAkB,aAAa,WAAW,IAAI,aAAa,KAAK;CAEtE,IACE,sBACC,cAAc,YAAY,sBAAsB,YAAY,CAAC,kBAE9D,MAAM,IAAI,MACR,4GACF;CAGF,MAAM,WAAW,SAAS,aAAa;CAEvC,MAAM,OAAmB,OAAO,EAAE,SAAS,eAAe;EACxD,MAAM,UAAU,YACd,mBAAmB;GAAE;GAAS;EAAS,GAAG,SAAS,SAAS,QAAQ;EAItE,MAAM,aAAa,cAAc,QAAQ,QAAQ,kBAAkB;EACnE,MAAM,gBAA2B,aAAa,WAAW;EACzD,MAAM,cAAc,aAAa,SAAY;EAI7C,KACG,eAAe,SAAS,aAAa,KAAK,gBAC3C,wBAAwB,eAAe,QAAQ,MAAM,GAErD,IAAI;GACF,wBAAwB,OAAO;EACjC,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,0BAA0B,MAAM;GAEvD,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAC/B,OAAO,SAAS,UAAU;IACxB,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAGF,MAAM,UAAU,MAAM,0BAA0B,SAAS,UAAU;GACjE,WAAW;GACX,mBAAmB;GACnB,WAAW,SAAS,SAAS;GAC7B;GACA;EACF,CAAC;EAED,IAAI,QAAQ,MAAM;GAChB,QAAQ,OAAO,OAAO,QAAQ;GAC9B;EACF;EAEA,IAAI,QAAQ,YAAY,aACtB,OAAO,SAAS,UAAU;GACxB,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,IAAI,UAAU;EAEd,IAAI,QAAQ,YAAY,WACtB,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;EAGH,IAAI,QAAQ,YAAY,gBACtB,OAAO,OAAO;GACZ,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;CACH;CAEA,OAAO;AACT"}

package/esm/middleware/login-throttle.middleware.mjs

@@ -90,8 +90,12 @@ function loginThrottleMiddleware(options = {}) {
 					return;
 				}
 				for (const identifier of identifiers) {
-					const ttlOption = await cache.get(counterKey(identifier)) === null ? { ttl: window } : void 0;
-					if ((await cache.update(counterKey(identifier), (current) => (current ?? 0) + 1, ttlOption) ?? 0) >= max) await cache.set(lockKey(identifier), true, { ttl: lockoutDuration });
+					const key = counterKey(identifier);
+					await cache.set(key, 0, {
+						ttl: window,
+						onConflict: "create"
+					});
+					if (await cache.increment(key) >= max) await cache.set(lockKey(identifier), true, { ttl: lockoutDuration });
 				}
 			} catch (error) {
 				log.error("auth", "login-throttle", error);

package/esm/middleware/login-throttle.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"login-throttle.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/login-throttle.middleware.ts"],"sourcesContent":["import { cache } from \"@warlock.js/cache\";\r\nimport { t, type Middleware, type Request, type Response } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\r\n\r\n/**\r\n * Built-in identifier kinds the throttle knows how to extract from a request.\r\n *\r\n * - `\"email\"` tracks per-account, so an attacker can't spray one user from\r\n *   many IPs.\r\n * - `\"ip\"` tracks per-source, so an attacker can't stuff many accounts from\r\n *   one IP.\r\n *\r\n * Lockout trips when ANY tracked identifier crosses `max` — defense-in-depth.\r\n */\r\nexport type LoginThrottleIdentifier = \"email\" | \"ip\";\r\n\r\n/**\r\n * Options for {@link loginThrottleMiddleware}.\r\n *\r\n * Failure-aware by design: only counts requests whose response is non-2xx\r\n * (or whatever `isFailure` says) and resets on success, so a user who types\r\n * a wrong password three times then the right one is not penalised.\r\n *\r\n * @example\r\n * loginThrottleMiddleware({ max: 5, window: \"15m\", lockoutDuration: \"15m\" });\r\n */\r\nexport type LoginThrottleOptions = {\r\n  /**\r\n   * Failures allowed within the window before the identifier is locked.\r\n   *\r\n   * @default 5\r\n   */\r\n  max?: number;\r\n\r\n  /**\r\n   * Counting window. `ms`-format string (`\"15m\"`, `\"1h\"`) or seconds as a number.\r\n   *\r\n   * @default \"15m\"\r\n   */\r\n  window?: string | number;\r\n\r\n  /**\r\n   * Lockout duration once the threshold is tripped. `ms`-format string or seconds.\r\n   *\r\n   * @default \"15m\"\r\n   */\r\n  lockoutDuration?: string | number;\r\n\r\n  /**\r\n   * Identifiers tracked. Each is counted and locked independently.\r\n   *\r\n   * @default [\"email\", \"ip\"]\r\n   */\r\n  by?: LoginThrottleIdentifier[];\r\n\r\n  /**\r\n   * Credential field consulted when `\"email\"` is tracked. Switch to\r\n   * `\"username\"` (or any other input field) for systems that don't\r\n   * authenticate by email.\r\n   *\r\n   * @default \"email\"\r\n   */\r\n  identifierKey?: string;\r\n\r\n  /**\r\n   * Override the default error message returned with the 429 response.\r\n   */\r\n  errorMessage?: string;\r\n\r\n  /**\r\n   * Decide whether the response represents a failed login. Defaults to\r\n   * \"non-2xx is a failure\"; override if your controller signals failure\r\n   * through a 200-style body.\r\n   *\r\n   * @default (response) => !response.isOk\r\n   */\r\n  isFailure?: (response: Response) => boolean;\r\n\r\n  /**\r\n   * Compute the identifiers tracked for this request. Override to derive the\r\n   * account key from a header, a JWT subject, or any other shape that does\r\n   * not match the built-in `email` / `ip` extraction.\r\n   */\r\n  identify?: (request: Request) => string[];\r\n};\r\n\r\nconst COUNTER_PREFIX = \"auth.throttle.count.\";\r\nconst LOCK_PREFIX = \"auth.throttle.lock.\";\r\n\r\nconst counterKey = (identifier: string): string => `${COUNTER_PREFIX}${identifier}`;\r\nconst lockKey = (identifier: string): string => `${LOCK_PREFIX}${identifier}`;\r\n\r\n/**\r\n * Built-in identifier extractor — reads the configured credential field from\r\n * the request body for the per-account key, and `request.detectIp()` for the\r\n * per-source key. Untruthy values are dropped; a request that yields zero\r\n * identifiers is left untracked so the middleware no-ops for it.\r\n */\r\nfunction buildDefaultIdentifiers(\r\n  request: Request,\r\n  tracked: LoginThrottleIdentifier[],\r\n  credentialField: string,\r\n): string[] {\r\n  const identifiers: string[] = [];\r\n\r\n  if (tracked.includes(\"email\")) {\r\n    const value = request.input(credentialField);\r\n\r\n    if (typeof value === \"string\" && value.length > 0) {\r\n      identifiers.push(`email.${value.toLowerCase()}`);\r\n    }\r\n  }\r\n\r\n  if (tracked.includes(\"ip\")) {\r\n    const ip = request.detectIp();\r\n\r\n    if (ip) {\r\n      identifiers.push(`ip.${ip}`);\r\n    }\r\n  }\r\n\r\n  return identifiers;\r\n}\r\n\r\n/**\r\n * Failure-aware login throttle. Locks an identifier (account, IP, or both)\r\n * after too many failed login attempts within a window — without penalising\r\n * a user who eventually types the right password.\r\n *\r\n * Mechanism (per identifier):\r\n *\r\n * 1. **Before the controller** — reject with `429` if a lock key is set,\r\n *    skipping the DB lookup AND the bcrypt verify (this also neutralises the\r\n *    CPU-DoS angle of brute-forcing).\r\n * 2. **After the controller** — observe the outcome via `response.onSent`.\r\n *    On failure (non-2xx by default), bump a fixed-window counter; once it\r\n *    reaches `max`, set a lock key with `lockoutDuration` TTL. On success,\r\n *    clear both the counter and the lock for that identifier.\r\n *\r\n * Storage is `@warlock.js/cache` (a peer dependency of `@warlock.js/auth`,\r\n * transitively guaranteed via `@warlock.js/core`). Lockout state is shared\r\n * across replicas — correct security model, because an attacker can't bypass\r\n * by round-robin to a different pod. Every cache call is guarded so a\r\n * misconfigured driver fails open (a throttle outage must never escalate\r\n * into a full auth outage).\r\n *\r\n * @example\r\n * import { loginThrottleMiddleware } from \"@warlock.js/auth\";\r\n * import { router } from \"@warlock.js/core\";\r\n *\r\n * router.post(\"/auth/login\", loginController, {\r\n *   middleware: [loginThrottleMiddleware({ max: 5, window: \"15m\" })],\r\n * });\r\n *\r\n * @example\r\n * // Per-IP only — avoid account-lockout-as-DoS on anonymous-attack vectors\r\n * router.post(\"/auth/refresh-token\", refreshController, {\r\n *   middleware: [loginThrottleMiddleware({ by: [\"ip\"], max: 10, window: \"1m\" })],\r\n * });\r\n */\r\nexport function loginThrottleMiddleware(options: LoginThrottleOptions = {}): Middleware {\r\n  const max = options.max ?? 5;\r\n  const window = options.window ?? \"15m\";\r\n  const lockoutDuration = options.lockoutDuration ?? \"15m\";\r\n  const tracked = options.by ?? [\"email\", \"ip\"];\r\n  const credentialField = options.identifierKey ?? \"email\";\r\n\r\n  return async ({ request, response }) => {\r\n    const identifiers = options.identify\r\n      ? options.identify(request)\r\n      : buildDefaultIdentifiers(request, tracked, credentialField);\r\n\r\n    if (identifiers.length === 0) return;\r\n\r\n    try {\r\n      for (const identifier of identifiers) {\r\n        const locked = await cache.get(lockKey(identifier));\r\n\r\n        if (locked) {\r\n          return response.tooManyRequests({\r\n            error: options.errorMessage ?? t(\"auth.errors.tooManyAttempts\"),\r\n            errorCode: AuthErrorCodes.TooManyAttempts,\r\n          });\r\n        }\r\n      }\r\n    } catch (error) {\r\n      // Fail open — a cache outage (driver not initialised, network blip)\r\n      // must never escalate into a full auth outage. Log and let the request\r\n      // through; the onSent recorder below is independently guarded so an\r\n      // outage there is also harmless.\r\n      log.error(\"auth\", \"login-throttle\", error);\r\n\r\n      return;\r\n    }\r\n\r\n    response.onSent(async (resolvedResponse: Response) => {\r\n      try {\r\n        const failed = options.isFailure\r\n          ? options.isFailure(resolvedResponse)\r\n          : !resolvedResponse.isOk;\r\n\r\n        if (!failed) {\r\n          for (const identifier of identifiers) {\r\n            await cache.remove(counterKey(identifier));\r\n            await cache.remove(lockKey(identifier));\r\n          }\r\n\r\n          return;\r\n        }\r\n\r\n        for (const identifier of identifiers) {\r\n          const existing = await cache.get(counterKey(identifier));\r\n          const ttlOption = existing === null ? { ttl: window } : undefined;\r\n          const count = await cache.update<number>(\r\n            counterKey(identifier),\r\n            (current) => (current ?? 0) + 1,\r\n            ttlOption,\r\n          );\r\n\r\n          if ((count ?? 0) >= max) {\r\n            await cache.set(lockKey(identifier), true, { ttl: lockoutDuration });\r\n          }\r\n        }\r\n      } catch (error) {\r\n        log.error(\"auth\", \"login-throttle\", error);\r\n      }\r\n    });\r\n  };\r\n}\r\n"],"mappings":";;;;;;AAuFA,MAAM,iBAAiB;AACvB,MAAM,cAAc;AAEpB,MAAM,cAAc,eAA+B,GAAG,iBAAiB;AACvE,MAAM,WAAW,eAA+B,GAAG,cAAc;;;;;;;AAQjE,SAAS,wBACP,SACA,SACA,iBACU;CACV,MAAM,cAAwB,CAAC;CAE/B,IAAI,QAAQ,SAAS,OAAO,GAAG;EAC7B,MAAM,QAAQ,QAAQ,MAAM,eAAe;EAE3C,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAC9C,YAAY,KAAK,SAAS,MAAM,YAAY,GAAG;CAEnD;CAEA,IAAI,QAAQ,SAAS,IAAI,GAAG;EAC1B,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,IACF,YAAY,KAAK,MAAM,IAAI;CAE/B;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAgB,wBAAwB,UAAgC,CAAC,GAAe;CACtF,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,kBAAkB,QAAQ,mBAAmB;CACnD,MAAM,UAAU,QAAQ,MAAM,CAAC,SAAS,IAAI;CAC5C,MAAM,kBAAkB,QAAQ,iBAAiB;CAEjD,OAAO,OAAO,EAAE,SAAS,eAAe;EACtC,MAAM,cAAc,QAAQ,WACxB,QAAQ,SAAS,OAAO,IACxB,wBAAwB,SAAS,SAAS,eAAe;EAE7D,IAAI,YAAY,WAAW,GAAG;EAE9B,IAAI;GACF,KAAK,MAAM,cAAc,aAGvB,IAAI,MAFiB,MAAM,IAAI,QAAQ,UAAU,CAAC,GAGhD,OAAO,SAAS,gBAAgB;IAC9B,OAAO,QAAQ,gBAAgB,EAAE,6BAA6B;IAC9D;GACF,CAAC;EAGP,SAAS,OAAO;GAKd,IAAI,MAAM,QAAQ,kBAAkB,KAAK;GAEzC;EACF;EAEA,SAAS,OAAO,OAAO,qBAA+B;GACpD,IAAI;IAKF,IAAI,EAJW,QAAQ,YACnB,QAAQ,UAAU,gBAAgB,IAClC,CAAC,iBAAiB,OAET;KACX,KAAK,MAAM,cAAc,aAAa;MACpC,MAAM,MAAM,OAAO,WAAW,UAAU,CAAC;MACzC,MAAM,MAAM,OAAO,QAAQ,UAAU,CAAC;KACxC;KAEA;IACF;IAEA,KAAK,MAAM,cAAc,aAAa;KAEpC,MAAM,YAAY,MADK,MAAM,IAAI,WAAW,UAAU,CAAC,MACxB,OAAO,EAAE,KAAK,OAAO,IAAI;KAOxD,KAAK,MANe,MAAM,OACxB,WAAW,UAAU,IACpB,aAAa,WAAW,KAAK,GAC9B,SACF,KAEc,MAAM,KAClB,MAAM,MAAM,IAAI,QAAQ,UAAU,GAAG,MAAM,EAAE,KAAK,gBAAgB,CAAC;IAEvE;GACF,SAAS,OAAO;IACd,IAAI,MAAM,QAAQ,kBAAkB,KAAK;GAC3C;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"login-throttle.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/login-throttle.middleware.ts"],"sourcesContent":["import { cache } from \"@warlock.js/cache\";\r\nimport { t, type Middleware, type Request, type Response } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\r\n\r\n/**\r\n * Built-in identifier kinds the throttle knows how to extract from a request.\r\n *\r\n * - `\"email\"` tracks per-account, so an attacker can't spray one user from\r\n *   many IPs.\r\n * - `\"ip\"` tracks per-source, so an attacker can't stuff many accounts from\r\n *   one IP.\r\n *\r\n * Lockout trips when ANY tracked identifier crosses `max` — defense-in-depth.\r\n */\r\nexport type LoginThrottleIdentifier = \"email\" | \"ip\";\r\n\r\n/**\r\n * Options for {@link loginThrottleMiddleware}.\r\n *\r\n * Failure-aware by design: only counts requests whose response is non-2xx\r\n * (or whatever `isFailure` says) and resets on success, so a user who types\r\n * a wrong password three times then the right one is not penalised.\r\n *\r\n * @example\r\n * loginThrottleMiddleware({ max: 5, window: \"15m\", lockoutDuration: \"15m\" });\r\n */\r\nexport type LoginThrottleOptions = {\r\n  /**\r\n   * Failures allowed within the window before the identifier is locked.\r\n   *\r\n   * @default 5\r\n   */\r\n  max?: number;\r\n\r\n  /**\r\n   * Counting window. `ms`-format string (`\"15m\"`, `\"1h\"`) or seconds as a number.\r\n   *\r\n   * @default \"15m\"\r\n   */\r\n  window?: string | number;\r\n\r\n  /**\r\n   * Lockout duration once the threshold is tripped. `ms`-format string or seconds.\r\n   *\r\n   * @default \"15m\"\r\n   */\r\n  lockoutDuration?: string | number;\r\n\r\n  /**\r\n   * Identifiers tracked. Each is counted and locked independently.\r\n   *\r\n   * @default [\"email\", \"ip\"]\r\n   */\r\n  by?: LoginThrottleIdentifier[];\r\n\r\n  /**\r\n   * Credential field consulted when `\"email\"` is tracked. Switch to\r\n   * `\"username\"` (or any other input field) for systems that don't\r\n   * authenticate by email.\r\n   *\r\n   * @default \"email\"\r\n   */\r\n  identifierKey?: string;\r\n\r\n  /**\r\n   * Override the default error message returned with the 429 response.\r\n   */\r\n  errorMessage?: string;\r\n\r\n  /**\r\n   * Decide whether the response represents a failed login. Defaults to\r\n   * \"non-2xx is a failure\"; override if your controller signals failure\r\n   * through a 200-style body.\r\n   *\r\n   * @default (response) => !response.isOk\r\n   */\r\n  isFailure?: (response: Response) => boolean;\r\n\r\n  /**\r\n   * Compute the identifiers tracked for this request. Override to derive the\r\n   * account key from a header, a JWT subject, or any other shape that does\r\n   * not match the built-in `email` / `ip` extraction.\r\n   */\r\n  identify?: (request: Request) => string[];\r\n};\r\n\r\nconst COUNTER_PREFIX = \"auth.throttle.count.\";\r\nconst LOCK_PREFIX = \"auth.throttle.lock.\";\r\n\r\nconst counterKey = (identifier: string): string => `${COUNTER_PREFIX}${identifier}`;\r\nconst lockKey = (identifier: string): string => `${LOCK_PREFIX}${identifier}`;\r\n\r\n/**\r\n * Built-in identifier extractor — reads the configured credential field from\r\n * the request body for the per-account key, and `request.detectIp()` for the\r\n * per-source key. Untruthy values are dropped; a request that yields zero\r\n * identifiers is left untracked so the middleware no-ops for it.\r\n */\r\nfunction buildDefaultIdentifiers(\r\n  request: Request,\r\n  tracked: LoginThrottleIdentifier[],\r\n  credentialField: string,\r\n): string[] {\r\n  const identifiers: string[] = [];\r\n\r\n  if (tracked.includes(\"email\")) {\r\n    const value = request.input(credentialField);\r\n\r\n    if (typeof value === \"string\" && value.length > 0) {\r\n      identifiers.push(`email.${value.toLowerCase()}`);\r\n    }\r\n  }\r\n\r\n  if (tracked.includes(\"ip\")) {\r\n    const ip = request.detectIp();\r\n\r\n    if (ip) {\r\n      identifiers.push(`ip.${ip}`);\r\n    }\r\n  }\r\n\r\n  return identifiers;\r\n}\r\n\r\n/**\r\n * Failure-aware login throttle. Locks an identifier (account, IP, or both)\r\n * after too many failed login attempts within a window — without penalising\r\n * a user who eventually types the right password.\r\n *\r\n * Mechanism (per identifier):\r\n *\r\n * 1. **Before the controller** — reject with `429` if a lock key is set,\r\n *    skipping the DB lookup AND the bcrypt verify (this also neutralises the\r\n *    CPU-DoS angle of brute-forcing).\r\n * 2. **After the controller** — observe the outcome via `response.onSent`.\r\n *    On failure (non-2xx by default), bump a fixed-window counter; once it\r\n *    reaches `max`, set a lock key with `lockoutDuration` TTL. On success,\r\n *    clear both the counter and the lock for that identifier.\r\n *\r\n * Storage is `@warlock.js/cache` (a peer dependency of `@warlock.js/auth`,\r\n * transitively guaranteed via `@warlock.js/core`). Lockout state is shared\r\n * across replicas — correct security model, because an attacker can't bypass\r\n * by round-robin to a different pod. Every cache call is guarded so a\r\n * misconfigured driver fails open (a throttle outage must never escalate\r\n * into a full auth outage).\r\n *\r\n * @example\r\n * import { loginThrottleMiddleware } from \"@warlock.js/auth\";\r\n * import { router } from \"@warlock.js/core\";\r\n *\r\n * router.post(\"/auth/login\", loginController, {\r\n *   middleware: [loginThrottleMiddleware({ max: 5, window: \"15m\" })],\r\n * });\r\n *\r\n * @example\r\n * // Per-IP only — avoid account-lockout-as-DoS on anonymous-attack vectors\r\n * router.post(\"/auth/refresh-token\", refreshController, {\r\n *   middleware: [loginThrottleMiddleware({ by: [\"ip\"], max: 10, window: \"1m\" })],\r\n * });\r\n */\r\nexport function loginThrottleMiddleware(options: LoginThrottleOptions = {}): Middleware {\r\n  const max = options.max ?? 5;\r\n  const window = options.window ?? \"15m\";\r\n  const lockoutDuration = options.lockoutDuration ?? \"15m\";\r\n  const tracked = options.by ?? [\"email\", \"ip\"];\r\n  const credentialField = options.identifierKey ?? \"email\";\r\n\r\n  return async ({ request, response }) => {\r\n    const identifiers = options.identify\r\n      ? options.identify(request)\r\n      : buildDefaultIdentifiers(request, tracked, credentialField);\r\n\r\n    if (identifiers.length === 0) return;\r\n\r\n    try {\r\n      for (const identifier of identifiers) {\r\n        const locked = await cache.get(lockKey(identifier));\r\n\r\n        if (locked) {\r\n          return response.tooManyRequests({\r\n            error: options.errorMessage ?? t(\"auth.errors.tooManyAttempts\"),\r\n            errorCode: AuthErrorCodes.TooManyAttempts,\r\n          });\r\n        }\r\n      }\r\n    } catch (error) {\r\n      // Fail open — a cache outage (driver not initialised, network blip)\r\n      // must never escalate into a full auth outage. Log and let the request\r\n      // through; the onSent recorder below is independently guarded so an\r\n      // outage there is also harmless.\r\n      log.error(\"auth\", \"login-throttle\", error);\r\n\r\n      return;\r\n    }\r\n\r\n    response.onSent(async (resolvedResponse: Response) => {\r\n      try {\r\n        const failed = options.isFailure\r\n          ? options.isFailure(resolvedResponse)\r\n          : !resolvedResponse.isOk;\r\n\r\n        if (!failed) {\r\n          for (const identifier of identifiers) {\r\n            await cache.remove(counterKey(identifier));\r\n            await cache.remove(lockKey(identifier));\r\n          }\r\n\r\n          return;\r\n        }\r\n\r\n        for (const identifier of identifiers) {\r\n          const key = counterKey(identifier);\r\n\r\n          // Open the window on the first failure: the create-only write means\r\n          // only one of several racing servers sets the TTL, and an existing\r\n          // window keeps its deadline (fixed window). The bump itself is an\r\n          // atomic increment, so concurrent failures across servers are never\r\n          // lost (redis INCRBY / pg upsert keep the window's TTL).\r\n          await cache.set(key, 0, { ttl: window, onConflict: \"create\" });\r\n          const count = await cache.increment(key);\r\n\r\n          if (count >= max) {\r\n            await cache.set(lockKey(identifier), true, { ttl: lockoutDuration });\r\n          }\r\n        }\r\n      } catch (error) {\r\n        log.error(\"auth\", \"login-throttle\", error);\r\n      }\r\n    });\r\n  };\r\n}\r\n"],"mappings":";;;;;;AAuFA,MAAM,iBAAiB;AACvB,MAAM,cAAc;AAEpB,MAAM,cAAc,eAA+B,GAAG,iBAAiB;AACvE,MAAM,WAAW,eAA+B,GAAG,cAAc;;;;;;;AAQjE,SAAS,wBACP,SACA,SACA,iBACU;CACV,MAAM,cAAwB,CAAC;CAE/B,IAAI,QAAQ,SAAS,OAAO,GAAG;EAC7B,MAAM,QAAQ,QAAQ,MAAM,eAAe;EAE3C,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAC9C,YAAY,KAAK,SAAS,MAAM,YAAY,GAAG;CAEnD;CAEA,IAAI,QAAQ,SAAS,IAAI,GAAG;EAC1B,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,IACF,YAAY,KAAK,MAAM,IAAI;CAE/B;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAgB,wBAAwB,UAAgC,CAAC,GAAe;CACtF,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,kBAAkB,QAAQ,mBAAmB;CACnD,MAAM,UAAU,QAAQ,MAAM,CAAC,SAAS,IAAI;CAC5C,MAAM,kBAAkB,QAAQ,iBAAiB;CAEjD,OAAO,OAAO,EAAE,SAAS,eAAe;EACtC,MAAM,cAAc,QAAQ,WACxB,QAAQ,SAAS,OAAO,IACxB,wBAAwB,SAAS,SAAS,eAAe;EAE7D,IAAI,YAAY,WAAW,GAAG;EAE9B,IAAI;GACF,KAAK,MAAM,cAAc,aAGvB,IAAI,MAFiB,MAAM,IAAI,QAAQ,UAAU,CAAC,GAGhD,OAAO,SAAS,gBAAgB;IAC9B,OAAO,QAAQ,gBAAgB,EAAE,6BAA6B;IAC9D;GACF,CAAC;EAGP,SAAS,OAAO;GAKd,IAAI,MAAM,QAAQ,kBAAkB,KAAK;GAEzC;EACF;EAEA,SAAS,OAAO,OAAO,qBAA+B;GACpD,IAAI;IAKF,IAAI,EAJW,QAAQ,YACnB,QAAQ,UAAU,gBAAgB,IAClC,CAAC,iBAAiB,OAET;KACX,KAAK,MAAM,cAAc,aAAa;MACpC,MAAM,MAAM,OAAO,WAAW,UAAU,CAAC;MACzC,MAAM,MAAM,OAAO,QAAQ,UAAU,CAAC;KACxC;KAEA;IACF;IAEA,KAAK,MAAM,cAAc,aAAa;KACpC,MAAM,MAAM,WAAW,UAAU;KAOjC,MAAM,MAAM,IAAI,KAAK,GAAG;MAAE,KAAK;MAAQ,YAAY;KAAS,CAAC;KAG7D,IAAI,MAFgB,MAAM,UAAU,GAAG,KAE1B,KACX,MAAM,MAAM,IAAI,QAAQ,UAAU,GAAG,MAAM,EAAE,KAAK,gBAAgB,CAAC;IAEvE;GACF,SAAS,OAAO;IACd,IAAI,MAAM,QAAQ,kBAAkB,KAAK;GAC3C;EACF,CAAC;CACH;AACF"}

package/esm/services/auth-config.mjs

@@ -121,6 +121,8 @@ const authConfig = {
 	cookie: {
 		/** Cookie name `setAuthCookie`/`clearAuthCookie` use. @default "access_token" */
 		name: () => config.key("auth.cookie.name", "access_token"),
+		/** Refresh-token cookie name the session cookie helpers use. @default "refresh_token" */
+		refreshName: () => config.key("auth.cookie.refreshName", "refresh_token"),
 		/** Cookie `Path` attribute `setAuthCookie`/`clearAuthCookie` use. @default "/" */
 		path: () => config.key("auth.cookie.path", "/")
 	},