@warlock.js/auth 5.25.0 → 5.27.0

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `@warlock.js/auth` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
 
+## 5.27.0 - 2026-10-01
+
+### Added
+
+- `authMiddleware()` now tags the middleware it returns with a non-enumerable, frozen, JSON-safe descriptor under `Symbol.for("warlock.auth")` (`{ sources, userTypes }`), exported as `AUTH_MIDDLEWARE_DESCRIPTOR` / `AuthMiddlewareDescriptor`, so other tooling can read a route's resolved credential sources and allowed user types without changing runtime behavior.
+
+## 5.26.0 - 2026-09-30
+
+### Added
+
+- Cookie sessions now support `auth.cookie.cookieDomain(request)` and `pageSession`/`sessionMiddleware`'s `cookieDomain(request)` override. Returning a Domain scopes issued and renewed cookies to it; returning `undefined` preserves host-only cookies. Clearing a Domain-scoped session also clears the legacy host-only cookie names. When configured, pass `request` to `setSessionCookies(response, tokens, request)`, `clearSessionCookies(response, request)`, and `clearAuthCookie(response, options, request)`; omitting it throws `CookieDomainRequestRequiredError` rather than issuing or clearing a host-only cookie.
+
+### Notes
+
+- A page session configured with multiple `userTypes` cannot renew its cookie: the resolver only supplies a renewal user type when exactly one type is allowed, so it reads the session but skips automatic renewal.
+
 ## 5.25.0 - 2026-09-28
 
 ### Fixed
@@ -65,10 +81,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - **BREAKING:** `authMiddleware` takes an ordered header/cookie `sources` list; a present Authorization header always wins and never falls back to the cookie, so an invalid header now returns `401`.
 - JWTs carry a random `jti`, so tokens issued in the same second differ.
 
-
 ### Changed
 
 - Lockstep release maintenance and dependency refresh.
+
 ## 5.20.0 - 2026-09-24
 
 ### Changed
@@ -258,17 +274,17 @@ changelogs.
 
 - **A token with no `exp` claim is now rejected instead of being accepted forever.** `fast-jwt` has no deadline to check on such a token, so verification simply succeeds — measured against `fast-jwt@6.2.4`, a token with no `exp` verifies unchanged at `clockTimestamp` + 100 years. Both `jwt.verify` and `jwt.verifyRefreshToken` now require an `exp` claim.
 
-  This is deliberately on the *verify* side rather than the issue side: the tokens that lack an `exp` were minted by a version that no longer runs, so a guard on issue would not reach a single one of them. A caller may add to `requiredClaims`, never subtract — `jwt.verify(token, { requiredClaims: ["iat"] })` still requires `exp` too.
+  This is deliberately on the _verify_ side rather than the issue side: the tokens that lack an `exp` were minted by a version that no longer runs, so a guard on issue would not reach a single one of them. A caller may add to `requiredClaims`, never subtract — `jwt.verify(token, { requiredClaims: ["iat"] })` still requires `exp` too.
 
-- **The persisted `expires_at` is now enforced on every request.** `authMiddleware` previously checked only that the access-token row *existed*; a row whose own expiry had passed still opened the gate, because nothing ever asked. The row is now checked against the clock and deleted on rejection.
+- **The persisted `expires_at` is now enforced on every request.** `authMiddleware` previously checked only that the access-token row _existed_; a row whose own expiry had passed still opened the gate, because nothing ever asked. The row is now checked against the clock and deleted on rejection.
 
-  These are two independent defences. The first catches a token whose *claims* carry no deadline; the second catches a token whose *row* says the deadline has passed (a logged-out or expired session whose JWT is still within its own lifetime). Neither subsumes the other.
+  These are two independent defences. The first catches a token whose _claims_ carry no deadline; the second catches a token whose _row_ says the deadline has passed (a logged-out or expired session whose JWT is still within its own lifetime). Neither subsumes the other.
 
 ### Added
 
 - **`warlock auth.purge-never-expiring`** — remediation for rows written by the `expiresIn` defect below. Finds every access- and refresh-token row that can never retire itself, on two independent signals: an `expires_at` that is missing or unparseable, and a persisted token carrying no `exp` claim. Reports `id`, `user_id`, `user_type` and `expires_at` per row (never the token string — it is a live credential until the command removes it), then deletes them. Pass `--dry-run` to report without deleting.
 
-  `auth.cleanup` cannot find these rows and never could: its predicate is `expires_at < now`, and an `Invalid Date` compares `false` against *every* date, so such a row satisfies neither `< now` nor `> now`. It is outside the reach of every date predicate rather than merely wrong. The "no `exp` claim" signal is not in a column at all.
+  `auth.cleanup` cannot find these rows and never could: its predicate is `expires_at < now`, and an `Invalid Date` compares `false` against _every_ date, so such a row satisfies neither `< now` nor `> now`. It is outside the reach of every date predicate rather than merely wrong. The "no `exp` claim" signal is not in a column at all.
 
   Exposed programmatically as `authService.findNeverExpiringTokens()` (read-only) and `authService.purgeNeverExpiringTokens()`, and per model as `findNeverExpiring()` / `purgeNeverExpiring()`.
 
@@ -288,8 +304,8 @@ Affected users must log in again. To check **without deploying anything**, the r
 - **MongoDB** — `bson` serialises an `Invalid Date` to **epoch 0**, so the row reads `1970-01-01T00:00:00Z` rather than an invalid value:
 
   ```js
-  db.access_tokens.find({ expires_at: { $lte: new Date(0) } })
-  db.refresh_tokens.find({ expires_at: { $lte: new Date(0) } })
+  db.access_tokens.find({ expires_at: { $lte: new Date(0) } });
+  db.refresh_tokens.find({ expires_at: { $lte: new Date(0) } });
   ```
 
 - **PostgreSQL** — `pg` serialises an `Invalid Date` to the literal `0NaN-NaN-NaNTNaN:NaN:NaN.NaN+NaN:NaN`, which a `timestamp` column rejects, so the `INSERT` most likely failed and no row was written (the token was still signed and returned to the client — it is then rejected by the row check, since it has no row). Any rows that did land are visible as:
@@ -299,7 +315,7 @@ Affected users must log in again. To check **without deploying anything**, the r
   SELECT id, user_id, user_type, expires_at FROM refresh_tokens WHERE expires_at IS NULL OR expires_at <= 'epoch';
   ```
 
-These queries find the row-level shape only. The definitive test — *does the stored token carry an `exp` claim at all* — reads the JWT rather than a column, which is why the command exists and why it is the recommended path.
+These queries find the row-level shape only. The definitive test — _does the stored token carry an `exp` claim at all_ — reads the JWT rather than a column, which is why the command exists and why it is the recommended path.
 
 ### Fixed
 
@@ -315,7 +331,7 @@ These queries find the row-level shape only. The definitive test — *does the s
 
 - **`expiresIn: "0d"` (and any non-positive duration) is rejected too.** It is truthy and parses cleanly to `0`, so it survived any guard that only rejects `undefined` — and `fast-jwt` skips its own validation for `0`, emitting a token with **no `exp` claim** while the persisted row claims it expired immediately.
 
-- A bare number (`expiresIn: 2592000`) is now rejected instead of silently corrupting the expiry. `ms` *formats* numbers rather than parsing them (`2592000` ⇒ `"43m"`), which then poisoned `Date.now() + expiresIn` into `Invalid Date`. Write `"30d"`.
+- A bare number (`expiresIn: 2592000`) is now rejected instead of silently corrupting the expiry. `ms` _formats_ numbers rather than parsing them (`2592000` ⇒ `"43m"`), which then poisoned `Date.now() + expiresIn` into `Invalid Date`. Write `"30d"`.
 
 ### Changed
 

package/esm/contracts/index.d.mts

@@ -1,4 +1,4 @@
 import { AppleProviderConfig, AuthProvider, DiscordProviderConfig, FacebookProviderConfig, GitHubProviderConfig, GoogleProviderConfig, LinkedInProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig, XProviderConfig } from "./providers.mjs";
-import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthMiddlewareOptions, AuthNotification, AuthRefreshCredentialDescriptor, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair } from "./types.mjs";
+import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthMiddlewareOptions, AuthNotification, AuthRefreshCredentialDescriptor, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CookieDomainResolver, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair } from "./types.mjs";
 import { Authenticable } from "./auth-contract.mjs";
 import { RequestUser } from "./request-locals.mjs";

package/esm/contracts/request-locals.d.mts

@@ -4,7 +4,7 @@
  * `request.locals.user`.
  *
  * Moved here from `@warlock.js/core` in 5.12.0 (core's `Request` no longer
- * has a `user` property at all — see `RequestUserMovedError`). Empty by
+ * has a `user` property at all). Empty by
  * default, exactly as it was in core, so any shape is assignable at the
  * declaration site; an app narrows it via module augmentation:
  *

package/esm/contracts/types.d.mts

@@ -3,6 +3,7 @@ import { AccessToken } from "../models/access-token/access-token.model.mjs";
 import { OneTimeToken } from "../models/one-time-token/one-time-token.model.mjs";
 import { OtpConfig, PasskeysConfig, ProvidersConfig } from "./providers.mjs";
 import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
+import { Request } from "@warlock.js/core";
 import { ChildModel } from "@warlock.js/cascade";
 import { Algorithm } from "fast-jwt";
 
@@ -373,6 +374,8 @@ type LoginResult<UserType extends Auth> = {
   user: UserType;
   tokens: TokenPair;
 };
+/** Selects a cookie Domain for one request; return `undefined` for a host-only cookie. */
+type CookieDomainResolver = (request: Request) => string | undefined;
 /**
  * Configuration for the cookie an app opts into via `authService.setAuthCookie`
  * / `clearAuthCookie` and reads back with `authMiddleware([], "cookie:<name>")`.
@@ -397,7 +400,8 @@ type CookieAuthConfig = {
    * Cookie `Path` attribute.
    * @default "/"
    */
-  path?: string;
+  path?: string; /** Select a request-scoped Domain; `undefined` keeps the cookie host-only. */
+  cookieDomain?: CookieDomainResolver;
 };
 /**
  * CSRF Origin-check configuration. Read via
@@ -419,7 +423,8 @@ type CsrfConfig = {
  */
 type SetAuthCookieOptions = {
   /** Cookie name; defaults to `auth.cookie.name` (package default `"access_token"`). */name?: string; /** Cookie `Path`; defaults to `auth.cookie.path` (package default `"/"`). */
-  path?: string;
+  path?: string; /** Cookie `Domain` attribute. Omit for a host-only cookie. */
+  domain?: string;
   /**
    * `Max-Age`, in seconds. Overrides the expiry `setAuthCookie` would
    * otherwise derive from an `AccessTokenOutput`'s `expiresAt`. Passing a
@@ -434,5 +439,5 @@ type ClearAuthCookieOptions = {
   path?: string;
 };
 //#endregion
-export { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthMiddlewareOptions, AuthNotification, AuthRefreshCredentialDescriptor, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair };
+export { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthMiddlewareOptions, AuthNotification, AuthRefreshCredentialDescriptor, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CookieDomainResolver, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair };
 //# sourceMappingURL=types.d.mts.map

package/esm/contracts/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"mappings":";;;;;;;;;;;;;;AA2BA;;;;AAA0B;AAO1B;;;;AAAsC;AAGtC;;;;cAVa,aAAA;AAab;;;;AAEK;AAFL,KANY,0BAAA;;KAGA,SAAA;;UAGK,wBAAA;EACf,MAAA;EACA,GAAG;AAAA;;UAIY,+BAAA,SAAwC,wBAAwB;EAiBrE;EAfV,SAAS;AAAA;;UAIM,qBAAA,SAA8B,OAAA,CAAQ,wBAAA;EACrD,QAAA;EAAA;;;;;;;EAQA,OAAA,GAAU,wBAAA;EAG6B;EADvC,OAAA,GAAU,+BAAA;EACV,QAAA;IAAa,EAAA;IAAY,cAAA;EAAA;AAAA;;KAIf,eAAA,IAAmB,IAAA,EAAM,IAAA,eAAmB,OAAO;;KAGnD,eAAA,GAAkB,MAAM;EAClC,QAAQ;AAAA;;;AAAA;AASV;;;KAAY,iBAAA;EAMV;;;;;EAAA,KAAA,UAAe,WAAA;EAmBN;AAAA;AAMX;EArBE,MAAA;;;;;EAKA,SAAA,GAAY,SAAS;EA+BrB;;;;;;;AAuB+C;AASjD;EArDE,SAAA;AAAA;;;;KAMU,kBAAA;EAkDV;;;;EA7CA,KAAA,UAAe,YAAA;EAkDb;;;;EA7CF,OAAA;EA+CiD;AAYnD;;;EAtDE,MAAA;EAkEc;AAMhB;;;;;;EAhEE,SAAA;EAsEA;;AAAG;AAOL;EAxEE,QAAA;;;;;EAKA,UAAA;EAoEuB;;;AAA4B;EA/DnD,kBAAA,GAAqB,0BAA0B;AAAA;;;;;;;KASrC,eAAA;EACV,MAAA;EACA,SAAA,GAAY,SAAA;EACZ,SAAA;EACA,OAAA;IACE,MAAA;IACA,OAAA;IACA,SAAA;IACA,QAAA;IACA,UAAA;IACA,kBAAA,GAAqB,0BAA0B;EAAA;AAAA;;;;;;;;;KAYvC,cAAA;EA2DkB;AAM9B;;;;EA3DE,SAAA;EAgFc;;;;;EA1Ed,cAAc;AAAA;;;;KAMJ,4BAAA;EAoEkB,iFAlE5B,KAAA,UAwEU;EAtEV,SAAA,EAAW,IAAI;EAEf,GAAA;AAAA;AAyEF;;;;AAAA,KAlEY,gBAAA;EACV,IAAA,GAAO,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,4BAA4B;AAAA;;KAIzC,sBAAA,IAA0B,KAAA,UAAe,IAAA,EAAM,IAAI;;KAGnD,cAAA,IAAkB,IAAA,EAAM,IAAA,EAAM,aAAA,oBAAiC,OAAO;;;;KAKtE,uBAAA;EA+GC;;;;EA1GX,SAAA;EAqDA;;;;;EA/CA,KAAA,WAwDkB;EAtDlB,YAAA,GAAe,gBAAA,EA0DD;EAxDd,GAAA,GAAM,sBAAsB;AAAA;;;;KAMlB,mBAAA;EAsEV;;;;EAjEA,SAAA;EAyEgB;;;;EApEhB,eAAA,WAgFA;EA9EA,YAAA,GAAe,gBAAA,EAkFf;EAhFA,GAAA,GAAM,sBAAA;EAoFN;;;AAAqB;AAGvB;;EAhFE,WAAA,GAAc,cAAA;AAAA;AAwFL;AAMX;;AANW,KAlFC,kBAAA;EAgGsB,kEA9FhC,KAAA,UAAe,YAAY;AAAA;AAAA,KAGjB,kBAAA;EA2FK;;AAAiB;AAMlC;EA5FE,QAAA;IAAA,CACG,QAAA,WAAmB,UAAA,CAAW,IAAA;EAAA,GA+FjC;EA5FA,eAAA;EAoGA;;;;EA/FA,eAAA,GAAkB,eAAA;EAwGF;AAGlB;;EAvGE,WAAA,GAAc,iBAAA;EAuGyB;;;EAnGvC,YAAA,GAAe,kBAAA;EAqGE;;;;;EA/FjB,QAAA,GAAW,cAAA;EA+FH;;AAAS;AAWnB;;EApGE,MAAA,GAAS,gBAAA;EAoGiB;;;EAhG1B,IAAA,GAAO,UAAA;EAgHH;AAAA;AAON;EAnHE,YAAA,GAAe,uBAAA;;;AAyHD;EArHd,aAAA,GAAgB,mBAAA;EA8Hc;;;EA1H9B,YAAA,GAAe,kBAAA;EA8Hf;;;EA1HA,SAAA,GAAY,eAAA;EAqIF;;;EAjIV,QAAA,GAAW,cAAA;EAqIP;;;EAjIJ,GAAA,GAAM,SAAA;;;;EAIN,GAAA,GAAM,eAAA;AAAA;AAAA,KAGI,iBAAA;;;;EAIV,KAAA;;;;EAIA,SAAS;AAAA;;;;KAMC,SAAA;;;;EAIV,WAAA,EAAa,iBAAA;;;;EAIb,YAAA,GAAe,iBAAiB;AAAA;;;;KAMtB,UAAA;;;;EAIV,SAAA;;;;EAIA,EAAA;;;;EAIA,QAAA;;;;;EAKA,QAAA;;;;EAIA,OAAA,GAAU,MAAM;AAAA;AAAA,KAGN,WAAA,kBAA6B,IAAA;EACvC,IAAA,EAAM,QAAA;EACN,MAAA,EAAQ,SAAA;AAAA;;;;;;;;;KAWE,gBAAA;;;;;;EAMV,IAAA;;;;;EAKA,WAAA;;;;;EAKA,IAAA;AAAA;;;;;KAOU,UAAA;;;;;;EAMV,cAAc;AAAA;;;;;;;KASJ,oBAAA;wFAEV,IAAA;EAEA,IAAA;;;;;;;EAOA,MAAA;AAAA;;KAIU,sBAAA;wFAEV,IAAA;EAEA,IAAI;AAAA"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"mappings":";;;;;;;;;;;;;;;AA4BA;;;;AAA0B;AAO1B;;;;AAAsC;AAGtC;;;;cAVa,aAAA;AAab;;;;AAEK;AAFL,KANY,0BAAA;;KAGA,SAAA;;UAGK,wBAAA;EACf,MAAA;EACA,GAAG;AAAA;;UAIY,+BAAA,SAAwC,wBAAwB;EAiBrE;EAfV,SAAS;AAAA;;UAIM,qBAAA,SAA8B,OAAA,CAAQ,wBAAA;EACrD,QAAA;EAAA;;;;;;;EAQA,OAAA,GAAU,wBAAA;EAG6B;EADvC,OAAA,GAAU,+BAAA;EACV,QAAA;IAAa,EAAA;IAAY,cAAA;EAAA;AAAA;;KAIf,eAAA,IAAmB,IAAA,EAAM,IAAA,eAAmB,OAAO;;KAGnD,eAAA,GAAkB,MAAM;EAClC,QAAQ;AAAA;;;AAAA;AASV;;;KAAY,iBAAA;EAMV;;;;;EAAA,KAAA,UAAe,WAAA;EAmBN;AAAA;AAMX;EArBE,MAAA;;;;;EAKA,SAAA,GAAY,SAAS;EA+BrB;;;;;;;AAuB+C;AASjD;EArDE,SAAA;AAAA;;;;KAMU,kBAAA;EAkDV;;;;EA7CA,KAAA,UAAe,YAAA;EAkDb;;;;EA7CF,OAAA;EA+CiD;AAYnD;;;EAtDE,MAAA;EAkEc;AAMhB;;;;;;EAhEE,SAAA;EAsEA;;AAAG;AAOL;EAxEE,QAAA;;;;;EAKA,UAAA;EAoEuB;;;AAA4B;EA/DnD,kBAAA,GAAqB,0BAA0B;AAAA;;;;;;;KASrC,eAAA;EACV,MAAA;EACA,SAAA,GAAY,SAAA;EACZ,SAAA;EACA,OAAA;IACE,MAAA;IACA,OAAA;IACA,SAAA;IACA,QAAA;IACA,UAAA;IACA,kBAAA,GAAqB,0BAA0B;EAAA;AAAA;;;;;;;;;KAYvC,cAAA;EA2DkB;AAM9B;;;;EA3DE,SAAA;EAgFc;;;;;EA1Ed,cAAc;AAAA;;;;KAMJ,4BAAA;EAoEkB,iFAlE5B,KAAA,UAwEU;EAtEV,SAAA,EAAW,IAAI;EAEf,GAAA;AAAA;AAyEF;;;;AAAA,KAlEY,gBAAA;EACV,IAAA,GAAO,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,4BAA4B;AAAA;;KAIzC,sBAAA,IAA0B,KAAA,UAAe,IAAA,EAAM,IAAI;;KAGnD,cAAA,IAAkB,IAAA,EAAM,IAAA,EAAM,aAAA,oBAAiC,OAAO;;;;KAKtE,uBAAA;EA+GC;;;;EA1GX,SAAA;EAqDA;;;;;EA/CA,KAAA,WAwDkB;EAtDlB,YAAA,GAAe,gBAAA,EA0DD;EAxDd,GAAA,GAAM,sBAAsB;AAAA;;;;KAMlB,mBAAA;EAsEV;;;;EAjEA,SAAA;EAyEgB;;;;EApEhB,eAAA,WAgFA;EA9EA,YAAA,GAAe,gBAAA,EAkFf;EAhFA,GAAA,GAAM,sBAAA;EAoFN;;;AAAqB;AAGvB;;EAhFE,WAAA,GAAc,cAAA;AAAA;AAwFL;AAMX;;AANW,KAlFC,kBAAA;EAgGsB,kEA9FhC,KAAA,UAAe,YAAY;AAAA;AAAA,KAGjB,kBAAA;EA2FK;;AAAiB;AAMlC;EA5FE,QAAA;IAAA,CACG,QAAA,WAAmB,UAAA,CAAW,IAAA;EAAA,GA+FjC;EA5FA,eAAA;EAoGA;;;;EA/FA,eAAA,GAAkB,eAAA;EAwGF;AAGlB;;EAvGE,WAAA,GAAc,iBAAA;EAuGyB;;;EAnGvC,YAAA,GAAe,kBAAA;EAqGE;;;;;EA/FjB,QAAA,GAAW,cAAA;EA+FH;;AAAS;AAInB;;EA7FE,MAAA,GAAS,gBAAA;EA6FkC;AAAO;AAUpD;EAnGE,IAAA,GAAO,UAAA;;;;EAIP,YAAA,GAAe,uBAAA;EA+Gf;;;EA3GA,aAAA,GAAgB,mBAAA;EA6GmB;AAOrC;;EAhHE,YAAA,GAAe,kBAAA;EAsHD;AAAA;AAShB;EA3HE,SAAA,GAAY,eAAA;;;;EAIZ,QAAA,GAAW,cAAA;EA6HX;;;EAzHA,GAAA,GAAM,SAAA;EAoII;;;EAhIV,GAAA,GAAM,eAAA;AAAA;AAAA,KAGI,iBAAA;;;;EAIV,KAAA;;;;EAIA,SAAS;AAAA;;;;KAMC,SAAA;;;;EAIV,WAAA,EAAa,iBAAA;;;;EAIb,YAAA,GAAe,iBAAiB;AAAA;;;;KAMtB,UAAA;;;;EAIV,SAAA;;;;EAIA,EAAA;;;;EAIA,QAAA;;;;;EAKA,QAAA;;;;EAIA,OAAA,GAAU,MAAM;AAAA;AAAA,KAGN,WAAA,kBAA6B,IAAA;EACvC,IAAA,EAAM,QAAA;EACN,MAAA,EAAQ,SAAA;AAAA;;KAIE,oBAAA,IAAwB,OAAgB,EAAP,OAAO;;;;;;;;;KAUxC,gBAAA;;;;;;EAMV,IAAA;;;;;EAKA,WAAA;;;;;EAKA,IAAA;EAEA,YAAA,GAAe,oBAAoB;AAAA;;;;;KAOzB,UAAA;;;;;;EAMV,cAAc;AAAA;;;;;;;KASJ,oBAAA;wFAEV,IAAA;EAEA,IAAA;EAEA,MAAA;;;;;;;EAOA,MAAA;AAAA;;KAIU,sBAAA;wFAEV,IAAA;EAEA,IAAI;AAAA"}

package/esm/contracts/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"sourcesContent":["import { type ChildModel } from \"@warlock.js/cascade\";\nimport { type Algorithm } from \"fast-jwt\";\nimport type { AccessToken } from \"../models/access-token\";\nimport type { Auth } from \"../models/auth.model\";\nimport type { OneTimeToken } from \"../models/one-time-token\";\nimport type { OtpConfig, PasskeysConfig, ProvidersConfig } from \"./providers\";\nimport type { RefreshToken } from \"../models/refresh-token\";\n\n/**\n * Symbol to indicate no expiration for tokens\n * Use this when you explicitly want tokens to never expire\n *\n * @example\n * ```typescript\n * // src/config/auth.ts\n * import { NO_EXPIRATION, type AuthConfigurations } from \"@warlock.js/auth\";\n *\n * const authConfigurations: AuthConfigurations = {\n *   accessToken: {\n *     secret: env(\"JWT_SECRET\"),\n *     expiresIn: NO_EXPIRATION,  // Token expires within 100 years\n *   },\n * };\n *\n * export default authConfigurations;\n * ```\n */\nexport const NO_EXPIRATION = \"100y\";\n\n/**\n * Behavior when logout is called without a refresh token\n * - \"revoke-all\": Revoke all refresh tokens for the user (secure default)\n * - \"error\": Return an error requiring the refresh token\n */\nexport type LogoutWithoutTokenBehavior = \"revoke-all\" | \"error\";\n\n/** The single request credential source an auth middleware instance accepts. */\nexport type TokenFrom = \"header\" | `cookie:${string}`;\n\n/** One explicitly named credential location accepted by auth middleware. */\nexport interface AuthCredentialDescriptor {\n  source: \"header\" | \"cookie\";\n  key?: string;\n}\n\n/** Cookie credential and bounded duplicate window for automatic renewal. */\nexport interface AuthRefreshCredentialDescriptor extends AuthCredentialDescriptor {\n  /** Milliseconds; the service clamps this to the 0–10 second range (default 5 seconds). */\n  overlapMs?: number;\n}\n\n/** Per-route authentication behavior for the object middleware overload. */\nexport interface AuthMiddlewareOptions extends Partial<AuthCredentialDescriptor> {\n  optional?: boolean;\n  /**\n   * Accept both a header and a cookie credential (at most one of each).\n   * Precedence is fixed and independent of array order: a present\n   * `Authorization` header wins, an invalid header rejects and never falls back\n   * to the cookie, and renewal plus the CSRF Origin check apply only when the\n   * cookie is the credential actually used. Cannot be combined with `source`.\n   */\n  sources?: AuthCredentialDescriptor[];\n  /** Opt-in automatic renewal credential. Cookie sources only. */\n  refresh?: AuthRefreshCredentialDescriptor;\n  redirect?: { to: string; returnUrlParam?: string };\n}\n\n/** Application policy that decides whether a resolved user may authenticate. */\nexport type CanAuthenticate = (user: Auth) => boolean | Promise<boolean>;\n\n/** Password credentials plus the application-defined identity fields. */\nexport type AuthCredentials = Record<string, unknown> & {\n  password: string;\n};\n\n/**\n * Access-token configuration.\n *\n * `secret` may also be supplied via the deprecated `jwt.secret` (resolved by a\n * backward-compatible shim); one of the two is required at runtime.\n */\nexport type AccessTokenConfig = {\n  /**\n   * Override the persisted access-token model — extend {@link AccessToken} to\n   * add columns (e.g. a tenant key) or rename them, then register the subclass\n   * here. Defaults to the package's `AccessToken`.\n   */\n  model?: typeof AccessToken;\n  /**\n   * Secret used to sign access tokens.\n   */\n  secret?: string;\n  /**\n   * JWT algorithm.\n   * @default \"HS256\"\n   */\n  algorithm?: Algorithm;\n  /**\n   * Access-token lifetime — a duration string `ms` parses to a **positive**\n   * number of milliseconds. A value `ms` cannot parse (`\"30dayz\"`), a\n   * non-positive one (`\"0d\"`), or a bare number throws naming this key on the\n   * first token issue: each of them would otherwise sign a token with no `exp`\n   * claim at all.\n   * @example \"1h\" or NO_EXPIRATION\n   * @default \"1h\"\n   */\n  expiresIn?: string;\n};\n\n/**\n * Refresh-token configuration.\n */\nexport type RefreshTokenConfig = {\n  /**\n   * Override the persisted refresh-token model — extend {@link RefreshToken}.\n   * Defaults to the package's `RefreshToken`.\n   */\n  model?: typeof RefreshToken;\n  /**\n   * Enable refresh tokens.\n   * @default true\n   */\n  enabled?: boolean;\n  /**\n   * Separate secret for refresh tokens (recommended for security). Falls back\n   * to the access-token secret when omitted.\n   */\n  secret?: string;\n  /**\n   * Refresh-token lifetime — a duration string `ms` parses to a **positive**\n   * number of milliseconds; an unusable value throws naming this key on issue\n   * (see {@link AccessTokenConfig.expiresIn}).\n   * @example \"7d\" or \"1w\"\n   * @default \"7d\"\n   */\n  expiresIn?: string;\n  /**\n   * Rotate the refresh token on each use (old token revoked, replay detected).\n   * @default true\n   */\n  rotation?: boolean;\n  /**\n   * Maximum active refresh tokens per user; the oldest are revoked past it.\n   * @default 5\n   */\n  maxPerUser?: number;\n  /**\n   * Behavior when logout is called without a refresh token.\n   * @default \"revoke-all\"\n   */\n  logoutWithoutToken?: LogoutWithoutTokenBehavior;\n};\n\n/**\n * Legacy JWT configuration shape. Still honored by the resolver shim with a\n * deprecation warning.\n *\n * @deprecated Use the top-level `accessToken` / `refreshToken` blocks.\n */\nexport type LegacyJwtConfig = {\n  secret?: string;\n  algorithm?: Algorithm;\n  expiresIn?: string;\n  refresh?: {\n    secret?: string;\n    enabled?: boolean;\n    expiresIn?: string;\n    rotation?: boolean;\n    maxPerUser?: number;\n    logoutWithoutToken?: LogoutWithoutTokenBehavior;\n  };\n};\n\n/**\n * Page-route auth-failure behavior. When a guarded PAGE route (a React-SSR page,\n * `route.isPage`) rejects a logged-out browser, this decides whether it redirects\n * to a login page instead of returning the API-style JSON 401.\n *\n * Read at runtime through `authConfig.pageAuth` (`auth.pageAuth.*`). API routes\n * always keep the JSON 401 contract regardless of this setting.\n */\nexport type PageAuthConfig = {\n  /**\n   * Login path a guarded page route redirects a logged-out browser to (e.g.\n   * `\"/login\"`). Unset ⇒ page-route auth failures keep the JSON 401, so the\n   * behavior is opt-in and backward-compatible.\n   */\n  loginPath?: string;\n  /**\n   * Query parameter the redirect carries the originally-requested path in, so\n   * the login flow can send the user back where they were headed.\n   * @default \"returnUrl\"\n   */\n  returnUrlParam?: string;\n};\n\n/**\n * Data every email-verification / password-reset notification receives.\n */\nexport type OneTimeTokenNotificationData = {\n  /** The raw token — the only place it exists; only its SHA-256 hash is stored. */\n  token: string;\n  /** When the token stops working. */\n  expiresAt: Date;\n  /** The link built by `auth.verification.url` / `auth.passwordReset.url`, when configured. */\n  url?: string;\n};\n\n/**\n * Anything auth can deliver a token through — a `defineNotification(...)`\n * result satisfies it, as does any object with a compatible `send`.\n */\nexport type AuthNotification = {\n  send: (to: Auth, data: OneTimeTokenNotificationData) => unknown;\n};\n\n/** Builds the link a token notification points at. */\nexport type OneTimeTokenUrlBuilder = (token: string, user: Auth) => string;\n\n/** Persists a new plaintext password for a user during a password reset. */\nexport type PasswordSetter = (user: Auth, plainPassword: string) => void | Promise<void>;\n\n/**\n * Email-verification configuration (`auth.verification`).\n */\nexport type EmailVerificationConfig = {\n  /**\n   * Token lifetime — a positive `ms` duration string.\n   * @default \"24h\"\n   */\n  expiresIn?: string;\n  /**\n   * User attribute stamped with the verification `Date`. Declare it in the\n   * user schema (e.g. `emailVerifiedAt: v.date().optional()`).\n   * @default \"emailVerifiedAt\"\n   */\n  field?: string;\n  /** Replace the default verification email. */\n  notification?: AuthNotification;\n  /** Build the verification link passed to the notification as `url`. */\n  url?: OneTimeTokenUrlBuilder;\n};\n\n/**\n * Password-reset configuration (`auth.passwordReset`).\n */\nexport type PasswordResetConfig = {\n  /**\n   * Token lifetime — a positive `ms` duration string.\n   * @default \"60m\"\n   */\n  expiresIn?: string;\n  /**\n   * User attribute `requestPasswordReset` looks the account up by.\n   * @default \"email\"\n   */\n  identifierField?: string;\n  /** Replace the default reset email. */\n  notification?: AuthNotification;\n  /** Build the reset link passed to the notification as `url`. */\n  url?: OneTimeTokenUrlBuilder;\n  /**\n   * Persist the new password yourself. By default auth saves a hash made by\n   * the same `hashPassword` login verifies against, and falls back to the\n   * plaintext when the model hashes on save (`useHashedPassword()`), checking\n   * the stored value with `verifyPassword` either way.\n   */\n  setPassword?: PasswordSetter;\n};\n\n/**\n * One-time token storage configuration (`auth.oneTimeToken`).\n */\nexport type OneTimeTokenConfig = {\n  /** Override the persisted model — extend {@link OneTimeToken}. */\n  model?: typeof OneTimeToken;\n};\n\nexport type AuthConfigurations = {\n  /**\n   * Define all user types — maps a user-type slug to its `Auth` model class so\n   * tokens and the middleware can resolve the right model.\n   */\n  userType: {\n    [userType: string]: ChildModel<Auth>;\n  };\n  /** Default user type used by `authMiddleware()` and options-only overloads. */\n  defaultUserType?: string;\n  /**\n   * Decide whether a resolved user may authenticate or receive new tokens.\n   * @default () => true\n   */\n  canAuthenticate?: CanAuthenticate;\n  /**\n   * Access-token configuration (secret, expiry, algorithm, model override).\n   */\n  accessToken?: AccessTokenConfig;\n  /**\n   * Refresh-token configuration (rotation, lifetime, cap, model override).\n   */\n  refreshToken?: RefreshTokenConfig;\n  /**\n   * Page-route auth-failure behavior — set `loginPath` to redirect a logged-out\n   * browser on a guarded PAGE route to a login page instead of the JSON 401.\n   * Opt-in; API routes are unaffected. Read via `authConfig.pageAuth`.\n   */\n  pageAuth?: PageAuthConfig;\n  /**\n   * Cookie auth session config — read by `authService.setAuthCookie` /\n   * `clearAuthCookie`. Opt-in: unset ⇒ the helpers fall back to their own\n   * defaults (`name: \"access_token\"`, `path: \"/\"`).\n   */\n  cookie?: CookieAuthConfig;\n  /**\n   * CSRF Origin-check config for cookie-authenticated unsafe-method requests.\n   */\n  csrf?: CsrfConfig;\n  /**\n   * Email verification — token lifetime, verified field, notification override.\n   */\n  verification?: EmailVerificationConfig;\n  /**\n   * Password reset — token lifetime, lookup field, notification and password-writer overrides.\n   */\n  passwordReset?: PasswordResetConfig;\n  /**\n   * One-time token (verification / reset) storage — model override.\n   */\n  oneTimeToken?: OneTimeTokenConfig;\n  /**\n   * Redirect login providers (`google`, `custom`) and account-linking policy.\n   */\n  providers?: ProvidersConfig;\n  /**\n   * Passkey (WebAuthn) relying-party settings. Requires `@simplewebauthn/server`.\n   */\n  passkeys?: PasskeysConfig;\n  /**\n   * Phone one-time-code login — channel, lifetime, attempts, delivery.\n   */\n  otp?: OtpConfig;\n  /**\n   * @deprecated Use `accessToken` / `refreshToken`. Read via a backward-compatible shim.\n   */\n  jwt?: LegacyJwtConfig;\n};\n\nexport type AccessTokenOutput = {\n  /**\n   * JWT Token\n   */\n  token: string;\n  /**\n   * Exprie time in ISO format UTC time\n   */\n  expiresAt: string;\n};\n\n/**\n * Token pair returned after login or token refresh\n */\nexport type TokenPair = {\n  /**\n   * JWT access token (short-lived)\n   */\n  accessToken: AccessTokenOutput;\n  /**\n   * JWT refresh token (long-lived)\n   */\n  refreshToken?: AccessTokenOutput;\n};\n\n/**\n * Device information for session tracking\n */\nexport type DeviceInfo = {\n  /**\n   * User agent string from request\n   */\n  userAgent?: string;\n  /**\n   * Client IP address\n   */\n  ip?: string;\n  /**\n   * Optional device identifier\n   */\n  deviceId?: string;\n  /**\n   * Token family ID (for rotation tracking)\n   * @internal\n   */\n  familyId?: string;\n  /**\n   * Access token payload\n   */\n  payload?: Record<string, unknown>;\n};\n\nexport type LoginResult<UserType extends Auth> = {\n  user: UserType;\n  tokens: TokenPair;\n};\n\n/**\n * Configuration for the cookie an app opts into via `authService.setAuthCookie`\n * / `clearAuthCookie` and reads back with `authMiddleware([], \"cookie:<name>\")`.\n * Attribute flags (`httpOnly` / `sameSite` / `secure`) are deliberately NOT\n * configurable here — they come from core's `secureCookieDefaults()`, the\n * same floor every `response.cookie()` call gets, so a cookie auth session can\n * never be weakened to a laxer policy than the framework default.\n */\nexport type CookieAuthConfig = {\n  /**\n   * Cookie name `setAuthCookie`/`clearAuthCookie` write and clear, and that a\n   * `cookie:<name>` token source must match to read it back.\n   * @default \"access_token\"\n   */\n  name?: string;\n  /**\n   * Cookie name the session helpers write and clear for the refresh token.\n   * @default \"refresh_token\"\n   */\n  refreshName?: string;\n  /**\n   * Cookie `Path` attribute.\n   * @default \"/\"\n   */\n  path?: string;\n};\n\n/**\n * CSRF Origin-check configuration. Read via\n * `authConfig.csrf.allowedOrigins()`.\n */\nexport type CsrfConfig = {\n  /**\n   * Extra origins allowed on a cookie-authenticated unsafe-method request,\n   * in addition to the request's own origin.\n   * @default []\n   */\n  allowedOrigins?: string[];\n};\n\n/**\n * Per-call overrides for {@link AuthService.setAuthCookie}. Anything omitted\n * falls back to `auth.cookie.*` config, then the package default. Cookie\n * *attribute* flags (`httpOnly`/`sameSite`/`secure`) are never settable here —\n * see {@link CookieAuthConfig}.\n */\nexport type SetAuthCookieOptions = {\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\n  name?: string;\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). */\n  path?: string;\n  /**\n   * `Max-Age`, in seconds. Overrides the expiry `setAuthCookie` would\n   * otherwise derive from an `AccessTokenOutput`'s `expiresAt`. Passing a\n   * bare token string with no `maxAge` produces a session cookie (cleared\n   * when the browser closes).\n   */\n  maxAge?: number;\n};\n\n/** Per-call overrides for {@link AuthService.clearAuthCookie}. */\nexport type ClearAuthCookieOptions = {\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\n  name?: string;\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). Must match the `Path` the cookie was set with. */\n  path?: string;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2BA,MAAa,gBAAgB"}
+{"version":3,"file":"types.mjs","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"sourcesContent":["import { type ChildModel } from \"@warlock.js/cascade\";\nimport type { Request } from \"@warlock.js/core\";\nimport { type Algorithm } from \"fast-jwt\";\nimport type { AccessToken } from \"../models/access-token\";\nimport type { Auth } from \"../models/auth.model\";\nimport type { OneTimeToken } from \"../models/one-time-token\";\nimport type { OtpConfig, PasskeysConfig, ProvidersConfig } from \"./providers\";\nimport type { RefreshToken } from \"../models/refresh-token\";\n\n/**\n * Symbol to indicate no expiration for tokens\n * Use this when you explicitly want tokens to never expire\n *\n * @example\n * ```typescript\n * // src/config/auth.ts\n * import { NO_EXPIRATION, type AuthConfigurations } from \"@warlock.js/auth\";\n *\n * const authConfigurations: AuthConfigurations = {\n *   accessToken: {\n *     secret: env(\"JWT_SECRET\"),\n *     expiresIn: NO_EXPIRATION,  // Token expires within 100 years\n *   },\n * };\n *\n * export default authConfigurations;\n * ```\n */\nexport const NO_EXPIRATION = \"100y\";\n\n/**\n * Behavior when logout is called without a refresh token\n * - \"revoke-all\": Revoke all refresh tokens for the user (secure default)\n * - \"error\": Return an error requiring the refresh token\n */\nexport type LogoutWithoutTokenBehavior = \"revoke-all\" | \"error\";\n\n/** The single request credential source an auth middleware instance accepts. */\nexport type TokenFrom = \"header\" | `cookie:${string}`;\n\n/** One explicitly named credential location accepted by auth middleware. */\nexport interface AuthCredentialDescriptor {\n  source: \"header\" | \"cookie\";\n  key?: string;\n}\n\n/** Cookie credential and bounded duplicate window for automatic renewal. */\nexport interface AuthRefreshCredentialDescriptor extends AuthCredentialDescriptor {\n  /** Milliseconds; the service clamps this to the 0–10 second range (default 5 seconds). */\n  overlapMs?: number;\n}\n\n/** Per-route authentication behavior for the object middleware overload. */\nexport interface AuthMiddlewareOptions extends Partial<AuthCredentialDescriptor> {\n  optional?: boolean;\n  /**\n   * Accept both a header and a cookie credential (at most one of each).\n   * Precedence is fixed and independent of array order: a present\n   * `Authorization` header wins, an invalid header rejects and never falls back\n   * to the cookie, and renewal plus the CSRF Origin check apply only when the\n   * cookie is the credential actually used. Cannot be combined with `source`.\n   */\n  sources?: AuthCredentialDescriptor[];\n  /** Opt-in automatic renewal credential. Cookie sources only. */\n  refresh?: AuthRefreshCredentialDescriptor;\n  redirect?: { to: string; returnUrlParam?: string };\n}\n\n/** Application policy that decides whether a resolved user may authenticate. */\nexport type CanAuthenticate = (user: Auth) => boolean | Promise<boolean>;\n\n/** Password credentials plus the application-defined identity fields. */\nexport type AuthCredentials = Record<string, unknown> & {\n  password: string;\n};\n\n/**\n * Access-token configuration.\n *\n * `secret` may also be supplied via the deprecated `jwt.secret` (resolved by a\n * backward-compatible shim); one of the two is required at runtime.\n */\nexport type AccessTokenConfig = {\n  /**\n   * Override the persisted access-token model — extend {@link AccessToken} to\n   * add columns (e.g. a tenant key) or rename them, then register the subclass\n   * here. Defaults to the package's `AccessToken`.\n   */\n  model?: typeof AccessToken;\n  /**\n   * Secret used to sign access tokens.\n   */\n  secret?: string;\n  /**\n   * JWT algorithm.\n   * @default \"HS256\"\n   */\n  algorithm?: Algorithm;\n  /**\n   * Access-token lifetime — a duration string `ms` parses to a **positive**\n   * number of milliseconds. A value `ms` cannot parse (`\"30dayz\"`), a\n   * non-positive one (`\"0d\"`), or a bare number throws naming this key on the\n   * first token issue: each of them would otherwise sign a token with no `exp`\n   * claim at all.\n   * @example \"1h\" or NO_EXPIRATION\n   * @default \"1h\"\n   */\n  expiresIn?: string;\n};\n\n/**\n * Refresh-token configuration.\n */\nexport type RefreshTokenConfig = {\n  /**\n   * Override the persisted refresh-token model — extend {@link RefreshToken}.\n   * Defaults to the package's `RefreshToken`.\n   */\n  model?: typeof RefreshToken;\n  /**\n   * Enable refresh tokens.\n   * @default true\n   */\n  enabled?: boolean;\n  /**\n   * Separate secret for refresh tokens (recommended for security). Falls back\n   * to the access-token secret when omitted.\n   */\n  secret?: string;\n  /**\n   * Refresh-token lifetime — a duration string `ms` parses to a **positive**\n   * number of milliseconds; an unusable value throws naming this key on issue\n   * (see {@link AccessTokenConfig.expiresIn}).\n   * @example \"7d\" or \"1w\"\n   * @default \"7d\"\n   */\n  expiresIn?: string;\n  /**\n   * Rotate the refresh token on each use (old token revoked, replay detected).\n   * @default true\n   */\n  rotation?: boolean;\n  /**\n   * Maximum active refresh tokens per user; the oldest are revoked past it.\n   * @default 5\n   */\n  maxPerUser?: number;\n  /**\n   * Behavior when logout is called without a refresh token.\n   * @default \"revoke-all\"\n   */\n  logoutWithoutToken?: LogoutWithoutTokenBehavior;\n};\n\n/**\n * Legacy JWT configuration shape. Still honored by the resolver shim with a\n * deprecation warning.\n *\n * @deprecated Use the top-level `accessToken` / `refreshToken` blocks.\n */\nexport type LegacyJwtConfig = {\n  secret?: string;\n  algorithm?: Algorithm;\n  expiresIn?: string;\n  refresh?: {\n    secret?: string;\n    enabled?: boolean;\n    expiresIn?: string;\n    rotation?: boolean;\n    maxPerUser?: number;\n    logoutWithoutToken?: LogoutWithoutTokenBehavior;\n  };\n};\n\n/**\n * Page-route auth-failure behavior. When a guarded PAGE route (a React-SSR page,\n * `route.isPage`) rejects a logged-out browser, this decides whether it redirects\n * to a login page instead of returning the API-style JSON 401.\n *\n * Read at runtime through `authConfig.pageAuth` (`auth.pageAuth.*`). API routes\n * always keep the JSON 401 contract regardless of this setting.\n */\nexport type PageAuthConfig = {\n  /**\n   * Login path a guarded page route redirects a logged-out browser to (e.g.\n   * `\"/login\"`). Unset ⇒ page-route auth failures keep the JSON 401, so the\n   * behavior is opt-in and backward-compatible.\n   */\n  loginPath?: string;\n  /**\n   * Query parameter the redirect carries the originally-requested path in, so\n   * the login flow can send the user back where they were headed.\n   * @default \"returnUrl\"\n   */\n  returnUrlParam?: string;\n};\n\n/**\n * Data every email-verification / password-reset notification receives.\n */\nexport type OneTimeTokenNotificationData = {\n  /** The raw token — the only place it exists; only its SHA-256 hash is stored. */\n  token: string;\n  /** When the token stops working. */\n  expiresAt: Date;\n  /** The link built by `auth.verification.url` / `auth.passwordReset.url`, when configured. */\n  url?: string;\n};\n\n/**\n * Anything auth can deliver a token through — a `defineNotification(...)`\n * result satisfies it, as does any object with a compatible `send`.\n */\nexport type AuthNotification = {\n  send: (to: Auth, data: OneTimeTokenNotificationData) => unknown;\n};\n\n/** Builds the link a token notification points at. */\nexport type OneTimeTokenUrlBuilder = (token: string, user: Auth) => string;\n\n/** Persists a new plaintext password for a user during a password reset. */\nexport type PasswordSetter = (user: Auth, plainPassword: string) => void | Promise<void>;\n\n/**\n * Email-verification configuration (`auth.verification`).\n */\nexport type EmailVerificationConfig = {\n  /**\n   * Token lifetime — a positive `ms` duration string.\n   * @default \"24h\"\n   */\n  expiresIn?: string;\n  /**\n   * User attribute stamped with the verification `Date`. Declare it in the\n   * user schema (e.g. `emailVerifiedAt: v.date().optional()`).\n   * @default \"emailVerifiedAt\"\n   */\n  field?: string;\n  /** Replace the default verification email. */\n  notification?: AuthNotification;\n  /** Build the verification link passed to the notification as `url`. */\n  url?: OneTimeTokenUrlBuilder;\n};\n\n/**\n * Password-reset configuration (`auth.passwordReset`).\n */\nexport type PasswordResetConfig = {\n  /**\n   * Token lifetime — a positive `ms` duration string.\n   * @default \"60m\"\n   */\n  expiresIn?: string;\n  /**\n   * User attribute `requestPasswordReset` looks the account up by.\n   * @default \"email\"\n   */\n  identifierField?: string;\n  /** Replace the default reset email. */\n  notification?: AuthNotification;\n  /** Build the reset link passed to the notification as `url`. */\n  url?: OneTimeTokenUrlBuilder;\n  /**\n   * Persist the new password yourself. By default auth saves a hash made by\n   * the same `hashPassword` login verifies against, and falls back to the\n   * plaintext when the model hashes on save (`useHashedPassword()`), checking\n   * the stored value with `verifyPassword` either way.\n   */\n  setPassword?: PasswordSetter;\n};\n\n/**\n * One-time token storage configuration (`auth.oneTimeToken`).\n */\nexport type OneTimeTokenConfig = {\n  /** Override the persisted model — extend {@link OneTimeToken}. */\n  model?: typeof OneTimeToken;\n};\n\nexport type AuthConfigurations = {\n  /**\n   * Define all user types — maps a user-type slug to its `Auth` model class so\n   * tokens and the middleware can resolve the right model.\n   */\n  userType: {\n    [userType: string]: ChildModel<Auth>;\n  };\n  /** Default user type used by `authMiddleware()` and options-only overloads. */\n  defaultUserType?: string;\n  /**\n   * Decide whether a resolved user may authenticate or receive new tokens.\n   * @default () => true\n   */\n  canAuthenticate?: CanAuthenticate;\n  /**\n   * Access-token configuration (secret, expiry, algorithm, model override).\n   */\n  accessToken?: AccessTokenConfig;\n  /**\n   * Refresh-token configuration (rotation, lifetime, cap, model override).\n   */\n  refreshToken?: RefreshTokenConfig;\n  /**\n   * Page-route auth-failure behavior — set `loginPath` to redirect a logged-out\n   * browser on a guarded PAGE route to a login page instead of the JSON 401.\n   * Opt-in; API routes are unaffected. Read via `authConfig.pageAuth`.\n   */\n  pageAuth?: PageAuthConfig;\n  /**\n   * Cookie auth session config — read by `authService.setAuthCookie` /\n   * `clearAuthCookie`. Opt-in: unset ⇒ the helpers fall back to their own\n   * defaults (`name: \"access_token\"`, `path: \"/\"`).\n   */\n  cookie?: CookieAuthConfig;\n  /**\n   * CSRF Origin-check config for cookie-authenticated unsafe-method requests.\n   */\n  csrf?: CsrfConfig;\n  /**\n   * Email verification — token lifetime, verified field, notification override.\n   */\n  verification?: EmailVerificationConfig;\n  /**\n   * Password reset — token lifetime, lookup field, notification and password-writer overrides.\n   */\n  passwordReset?: PasswordResetConfig;\n  /**\n   * One-time token (verification / reset) storage — model override.\n   */\n  oneTimeToken?: OneTimeTokenConfig;\n  /**\n   * Redirect login providers (`google`, `custom`) and account-linking policy.\n   */\n  providers?: ProvidersConfig;\n  /**\n   * Passkey (WebAuthn) relying-party settings. Requires `@simplewebauthn/server`.\n   */\n  passkeys?: PasskeysConfig;\n  /**\n   * Phone one-time-code login — channel, lifetime, attempts, delivery.\n   */\n  otp?: OtpConfig;\n  /**\n   * @deprecated Use `accessToken` / `refreshToken`. Read via a backward-compatible shim.\n   */\n  jwt?: LegacyJwtConfig;\n};\n\nexport type AccessTokenOutput = {\n  /**\n   * JWT Token\n   */\n  token: string;\n  /**\n   * Exprie time in ISO format UTC time\n   */\n  expiresAt: string;\n};\n\n/**\n * Token pair returned after login or token refresh\n */\nexport type TokenPair = {\n  /**\n   * JWT access token (short-lived)\n   */\n  accessToken: AccessTokenOutput;\n  /**\n   * JWT refresh token (long-lived)\n   */\n  refreshToken?: AccessTokenOutput;\n};\n\n/**\n * Device information for session tracking\n */\nexport type DeviceInfo = {\n  /**\n   * User agent string from request\n   */\n  userAgent?: string;\n  /**\n   * Client IP address\n   */\n  ip?: string;\n  /**\n   * Optional device identifier\n   */\n  deviceId?: string;\n  /**\n   * Token family ID (for rotation tracking)\n   * @internal\n   */\n  familyId?: string;\n  /**\n   * Access token payload\n   */\n  payload?: Record<string, unknown>;\n};\n\nexport type LoginResult<UserType extends Auth> = {\n  user: UserType;\n  tokens: TokenPair;\n};\n\n/** Selects a cookie Domain for one request; return `undefined` for a host-only cookie. */\nexport type CookieDomainResolver = (request: Request) => string | undefined;\n\n/**\n * Configuration for the cookie an app opts into via `authService.setAuthCookie`\n * / `clearAuthCookie` and reads back with `authMiddleware([], \"cookie:<name>\")`.\n * Attribute flags (`httpOnly` / `sameSite` / `secure`) are deliberately NOT\n * configurable here — they come from core's `secureCookieDefaults()`, the\n * same floor every `response.cookie()` call gets, so a cookie auth session can\n * never be weakened to a laxer policy than the framework default.\n */\nexport type CookieAuthConfig = {\n  /**\n   * Cookie name `setAuthCookie`/`clearAuthCookie` write and clear, and that a\n   * `cookie:<name>` token source must match to read it back.\n   * @default \"access_token\"\n   */\n  name?: string;\n  /**\n   * Cookie name the session helpers write and clear for the refresh token.\n   * @default \"refresh_token\"\n   */\n  refreshName?: string;\n  /**\n   * Cookie `Path` attribute.\n   * @default \"/\"\n   */\n  path?: string;\n  /** Select a request-scoped Domain; `undefined` keeps the cookie host-only. */\n  cookieDomain?: CookieDomainResolver;\n};\n\n/**\n * CSRF Origin-check configuration. Read via\n * `authConfig.csrf.allowedOrigins()`.\n */\nexport type CsrfConfig = {\n  /**\n   * Extra origins allowed on a cookie-authenticated unsafe-method request,\n   * in addition to the request's own origin.\n   * @default []\n   */\n  allowedOrigins?: string[];\n};\n\n/**\n * Per-call overrides for {@link AuthService.setAuthCookie}. Anything omitted\n * falls back to `auth.cookie.*` config, then the package default. Cookie\n * *attribute* flags (`httpOnly`/`sameSite`/`secure`) are never settable here —\n * see {@link CookieAuthConfig}.\n */\nexport type SetAuthCookieOptions = {\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\n  name?: string;\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). */\n  path?: string;\n  /** Cookie `Domain` attribute. Omit for a host-only cookie. */\n  domain?: string;\n  /**\n   * `Max-Age`, in seconds. Overrides the expiry `setAuthCookie` would\n   * otherwise derive from an `AccessTokenOutput`'s `expiresAt`. Passing a\n   * bare token string with no `maxAge` produces a session cookie (cleared\n   * when the browser closes).\n   */\n  maxAge?: number;\n};\n\n/** Per-call overrides for {@link AuthService.clearAuthCookie}. */\nexport type ClearAuthCookieOptions = {\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\n  name?: string;\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). Must match the `Path` the cookie was set with. */\n  path?: string;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4BA,MAAa,gBAAgB"}

package/esm/index.d.mts

@@ -5,7 +5,7 @@ import { Auth } from "./models/auth.model.mjs";
 import { AccessToken, accessTokenSchema } from "./models/access-token/access-token.model.mjs";
 import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./models/one-time-token/one-time-token.model.mjs";
 import { AppleProviderConfig, AuthProvider, DiscordProviderConfig, FacebookProviderConfig, GitHubProviderConfig, GoogleProviderConfig, LinkedInProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig, XProviderConfig } from "./contracts/providers.mjs";
-import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthMiddlewareOptions, AuthNotification, AuthRefreshCredentialDescriptor, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair } from "./contracts/types.mjs";
+import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthMiddlewareOptions, AuthNotification, AuthRefreshCredentialDescriptor, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CookieDomainResolver, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair } from "./contracts/types.mjs";
 import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./models/refresh-token/refresh-token.model.mjs";
 import { Authenticable } from "./contracts/auth-contract.mjs";
 import { RequestUser } from "./contracts/request-locals.mjs";
@@ -20,7 +20,7 @@ import { ProviderEmailNotVerifiedError } from "./errors/provider-email-not-verif
 import { AuthErrorTranslations, AuthTranslations } from "./localization/auth-translations.type.mjs";
 import { authDefaultTranslations } from "./localization/auth-default-translations.mjs";
 import { registerAuthTranslations } from "./localization/register-auth-translations.mjs";
-import { authMiddleware } from "./middleware/auth.middleware.mjs";
+import { AUTH_MIDDLEWARE_DESCRIPTOR, AuthMiddlewareDescriptor, AuthMiddlewareDescriptorSource, authMiddleware } from "./middleware/auth.middleware.mjs";
 import { CsrfOriginMismatchError, CsrfOriginMismatchReason, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./middleware/csrf-origin-check.mjs";
 import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware } from "./middleware/login-throttle.middleware.mjs";
 import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./middleware/one-time-token-throttle.middleware.mjs";
@@ -43,7 +43,7 @@ import { LINKEDIN_AUTH_FEATURE, LinkedInProvider } from "./providers/linkedin-pr
 import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./providers/provider-login.mjs";
 import { XProvider } from "./providers/x-provider.mjs";
 import { AuthEventCallback, AuthEventName, AuthEventPayloads, authEvents } from "./services/auth-events.mjs";
-import { authService } from "./services/auth.service.mjs";
+import { CookieDomainRequestRequiredError, authService } from "./services/auth.service.mjs";
 import { currentUser } from "./services/current-user.mjs";
 import { generateJWTSecret } from "./services/generate-jwt-secret.mjs";
 import { TokenType, TokenTypeError, isInvalidCredentialError, jwt } from "./services/jwt.mjs";
@@ -54,5 +54,5 @@ import { RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, read
 import { PageSessionOptions, PageSessionResolver, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, pageSession, sessionMiddleware } from "./session/page-session.mjs";
 import { safeEqual } from "./utils/safe-equal.mjs";
 import { isNeverExpiring, isUsableExpiry, tokenHasExpClaim } from "./utils/token-expiry.mjs";
-export { APPLE_AUTH_FEATURE, AccessToken, AccessTokenConfig, AccessTokenOutput, AppleJoseModule, AppleProvider, AppleProviderConfig, Auth, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthErrorCodes, AuthErrorTranslations, AuthEventCallback, AuthEventName, AuthEventPayloads, AuthMiddlewareOptions, AuthNotification, AuthProvider, AuthProviderSdkMissingError, AuthRefreshCredentialDescriptor, AuthTokenFamily, AuthTranslations, Authenticable, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, CsrfOriginMismatchError, CsrfOriginMismatchReason, DeviceInfo, DiscordProvider, DiscordProviderConfig, EmailNotVerifiedError, EmailVerificationConfig, FacebookProvider, FacebookProviderConfig, GOOGLE_AUTH_FEATURE, GitHubProvider, GitHubProviderConfig, GoogleProvider, GoogleProviderConfig, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, IssuedOneTimeToken, JoseModule, LINKEDIN_AUTH_FEATURE, LegacyJwtConfig, LinkedInProvider, LinkedInProviderConfig, LoginResult, LoginThrottleIdentifier, LoginThrottleOptions, LogoutWithoutTokenBehavior, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenPurpose, OneTimeTokenUrlBuilder, OtpConfig, OtpMessage, OtpSender, PageAuthConfig, PageSessionOptions, PageSessionResolver, PasskeyCredential, type PasskeyOptionsJSON, type PasskeyResponseJSON, PasskeysConfig, PasswordResetConfig, PasswordSetter, ProviderAccount, ProviderAuthorizationState, ProviderCallbackParams, ProviderEmailNotVerifiedError, ProviderProfile, ProviderUserCreator, ProvidersConfig, RefreshToken, RefreshTokenConfig, RefreshTokenIssueOptions, RequestUser, RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, SetAuthCookieOptions, TokenFrom, TokenPair, TokenType, TokenTypeError, XProvider, XProviderConfig, accessTokenSchema, assertCsrfOriginAllowed, authDefaultTranslations, authEvents, authMiddleware, authMigrations, authService, authTokenFamilySchema, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, pageSession, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, readCredential, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerAuthTranslations, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, resolveRequestUser, resolveRequestUserOutcome, safeEqual, sendEmailVerification, sessionMiddleware, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
+export { APPLE_AUTH_FEATURE, AUTH_MIDDLEWARE_DESCRIPTOR, AccessToken, AccessTokenConfig, AccessTokenOutput, AppleJoseModule, AppleProvider, AppleProviderConfig, Auth, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthErrorCodes, AuthErrorTranslations, AuthEventCallback, AuthEventName, AuthEventPayloads, AuthMiddlewareDescriptor, AuthMiddlewareDescriptorSource, AuthMiddlewareOptions, AuthNotification, AuthProvider, AuthProviderSdkMissingError, AuthRefreshCredentialDescriptor, AuthTokenFamily, AuthTranslations, Authenticable, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CookieDomainRequestRequiredError, CookieDomainResolver, CsrfConfig, CsrfOriginMismatchError, CsrfOriginMismatchReason, DeviceInfo, DiscordProvider, DiscordProviderConfig, EmailNotVerifiedError, EmailVerificationConfig, FacebookProvider, FacebookProviderConfig, GOOGLE_AUTH_FEATURE, GitHubProvider, GitHubProviderConfig, GoogleProvider, GoogleProviderConfig, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, IssuedOneTimeToken, JoseModule, LINKEDIN_AUTH_FEATURE, LegacyJwtConfig, LinkedInProvider, LinkedInProviderConfig, LoginResult, LoginThrottleIdentifier, LoginThrottleOptions, LogoutWithoutTokenBehavior, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenPurpose, OneTimeTokenUrlBuilder, OtpConfig, OtpMessage, OtpSender, PageAuthConfig, PageSessionOptions, PageSessionResolver, PasskeyCredential, type PasskeyOptionsJSON, type PasskeyResponseJSON, PasskeysConfig, PasswordResetConfig, PasswordSetter, ProviderAccount, ProviderAuthorizationState, ProviderCallbackParams, ProviderEmailNotVerifiedError, ProviderProfile, ProviderUserCreator, ProvidersConfig, RefreshToken, RefreshTokenConfig, RefreshTokenIssueOptions, RequestUser, RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, SetAuthCookieOptions, TokenFrom, TokenPair, TokenType, TokenTypeError, XProvider, XProviderConfig, accessTokenSchema, assertCsrfOriginAllowed, authDefaultTranslations, authEvents, authMiddleware, authMigrations, authService, authTokenFamilySchema, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, pageSession, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, readCredential, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerAuthTranslations, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, resolveRequestUser, resolveRequestUserOutcome, safeEqual, sendEmailVerification, sessionMiddleware, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
 import "./contracts/request-locals.mjs";

package/esm/index.mjs

@@ -10,7 +10,7 @@ import { OneTimeToken, oneTimeTokenSchema } from "./models/one-time-token/one-ti
 import { RefreshToken, refreshTokenSchema } from "./models/refresh-token/refresh-token.model.mjs";
 import { authEvents } from "./services/auth-events.mjs";
 import { TokenTypeError, isInvalidCredentialError, jwt } from "./services/jwt.mjs";
-import { authService } from "./services/auth.service.mjs";
+import { CookieDomainRequestRequiredError, authService } from "./services/auth.service.mjs";
 import { registerAuthCleanupCommand } from "./commands/auth-cleanup-command.mjs";
 import { registerAuthPurgeNeverExpiringCommand } from "./commands/auth-purge-never-expiring-command.mjs";
 import { generateJWTSecret } from "./services/generate-jwt-secret.mjs";
@@ -26,7 +26,7 @@ import { ProviderEmailNotVerifiedError } from "./errors/provider-email-not-verif
 import "./errors/index.mjs";
 import "./localization/index.mjs";
 import { readCredential, resolveRequestUser, resolveRequestUserOutcome } from "./services/resolve-request-user.mjs";
-import { authMiddleware } from "./middleware/auth.middleware.mjs";
+import { AUTH_MIDDLEWARE_DESCRIPTOR, authMiddleware } from "./middleware/auth.middleware.mjs";
 import { loginThrottleMiddleware } from "./middleware/login-throttle.middleware.mjs";
 import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./middleware/one-time-token-throttle.middleware.mjs";
 import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./middleware/otp-throttle.middleware.mjs";
@@ -60,4 +60,4 @@ import { pageSession, sessionMiddleware } from "./session/page-session.mjs";
 import "./session/index.mjs";
 import "./utils/index.mjs";
 
-export { APPLE_AUTH_FEATURE, AccessToken, AppleProvider, Auth, AuthErrorCodes, AuthProviderSdkMissingError, AuthTokenFamily, CsrfOriginMismatchError, DiscordProvider, EmailNotVerifiedError, FacebookProvider, GOOGLE_AUTH_FEATURE, GitHubProvider, GoogleProvider, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, LINKEDIN_AUTH_FEATURE, LinkedInProvider, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, PasskeyCredential, ProviderAccount, ProviderEmailNotVerifiedError, RefreshToken, TokenTypeError, XProvider, accessTokenSchema, assertCsrfOriginAllowed, authDefaultTranslations, authEvents, authMiddleware, authMigrations, authService, authTokenFamilySchema, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, pageSession, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, readCredential, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerAuthTranslations, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, resolveRequestUser, resolveRequestUserOutcome, safeEqual, sendEmailVerification, sessionMiddleware, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
+export { APPLE_AUTH_FEATURE, AUTH_MIDDLEWARE_DESCRIPTOR, AccessToken, AppleProvider, Auth, AuthErrorCodes, AuthProviderSdkMissingError, AuthTokenFamily, CookieDomainRequestRequiredError, CsrfOriginMismatchError, DiscordProvider, EmailNotVerifiedError, FacebookProvider, GOOGLE_AUTH_FEATURE, GitHubProvider, GoogleProvider, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, LINKEDIN_AUTH_FEATURE, LinkedInProvider, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, PasskeyCredential, ProviderAccount, ProviderEmailNotVerifiedError, RefreshToken, TokenTypeError, XProvider, accessTokenSchema, assertCsrfOriginAllowed, authDefaultTranslations, authEvents, authMiddleware, authMigrations, authService, authTokenFamilySchema, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, pageSession, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, readCredential, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerAuthTranslations, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, resolveRequestUser, resolveRequestUserOutcome, safeEqual, sendEmailVerification, sessionMiddleware, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };

package/esm/middleware/auth.middleware.d.mts

@@ -2,6 +2,24 @@ import { AuthMiddlewareOptions, TokenFrom } from "../contracts/types.mjs";
 import { Middleware } from "@warlock.js/core";
 
 //#region ../auth/src/middleware/auth.middleware.d.ts
+/**
+ * Well-known symbol under which `authMiddleware()` tags the middleware it
+ * returns. Shared via the global symbol registry so other packages can read the
+ * descriptor structurally (`Symbol.for("warlock.auth")`) without importing auth.
+ */
+declare const AUTH_MIDDLEWARE_DESCRIPTOR: unique symbol;
+/** A credential source an auth middleware reads: the Authorization header or a named cookie. */
+type AuthMiddlewareDescriptorSource = "header" | {
+  cookie: string;
+};
+/**
+ * Frozen, JSON-safe description of how an `authMiddleware()` instance
+ * authenticates, stored (non-enumerably) under {@link AUTH_MIDDLEWARE_DESCRIPTOR}.
+ */
+type AuthMiddlewareDescriptor = {
+  /** Resolved credential sources; with dual sources the header comes first. */sources: AuthMiddlewareDescriptorSource[]; /** Resolved allowed user types; an empty array means any authenticated user. */
+  userTypes: string[];
+};
 /**
  * Build a route gate. Authentication is required unless optional is explicit.
  *
@@ -28,5 +46,5 @@ declare function authMiddleware(options: AuthMiddlewareOptions): Middleware;
 declare function authMiddleware(allowedUserType: string | string[], options?: AuthMiddlewareOptions): Middleware;
 declare function authMiddleware(allowedUserType: string | string[], tokenFrom?: TokenFrom): Middleware;
 //#endregion
-export { authMiddleware };
+export { AUTH_MIDDLEWARE_DESCRIPTOR, AuthMiddlewareDescriptor, AuthMiddlewareDescriptorSource, authMiddleware };
 //# sourceMappingURL=auth.middleware.d.mts.map

package/esm/middleware/auth.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"mappings":";;;;;;AA8GA;;;;AAA4C;AAC5C;;;;;;;;AAA0E;AAC1E;;;;;iBAFgB,cAAA,IAAkB,UAAU;AAAA,iBAC5B,cAAA,CAAe,OAAA,EAAS,qBAAA,GAAwB,UAAU;AAAA,iBAC1D,cAAA,CACd,eAAA,qBACA,OAAA,GAAU,qBAAA,GACT,UAAU;AAAA,iBACG,cAAA,CACd,eAAA,qBACA,SAAA,GAAY,SAAA,GACX,UAAU"}
+{"version":3,"file":"auth.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"mappings":";;;;;;AAsBA;;;cAAa,0BAAA;AAAuD;AAAA,KAGxD,8BAAA;EAA8C,MAAM;AAAA;;AAAA;AAMhE;;KAAY,wBAAA;EAE6B,6EAAvC,OAAA,EAAS,8BAA8B,IAA9B;EAET,SAAA;AAAA;AAAS;AAoGX;;;;AAA4C;AAC5C;;;;;;;;AAA0E;AAC1E;;;;;;AAtGW,iBAoGK,cAAA,IAAkB,UAAU;AAAA,iBAC5B,cAAA,CAAe,OAAA,EAAS,qBAAA,GAAwB,UAAU;AAAA,iBAC1D,cAAA,CACd,eAAA,qBACA,OAAA,GAAU,qBAAA,GACT,UAAU;AAAA,iBACG,cAAA,CACd,eAAA,qBACA,SAAA,GAAY,SAAA,GACX,UAAU"}

package/esm/middleware/auth.middleware.mjs

@@ -8,6 +8,12 @@ import { log } from "@warlock.js/logger";
 
 //#region ../auth/src/middleware/auth.middleware.ts
 /**
+* Well-known symbol under which `authMiddleware()` tags the middleware it
+* returns. Shared via the global symbol registry so other packages can read the
+* descriptor structurally (`Symbol.for("warlock.auth")`) without importing auth.
+*/
+const AUTH_MIDDLEWARE_DESCRIPTOR = Symbol.for("warlock.auth");
+/**
 * Reject an unauthenticated request, choosing the representation by ROUTE KIND.
 *
 * An API route always gets the JSON 401 it has always gotten. A PAGE route
@@ -41,6 +47,9 @@ function tokenFromDescriptor(descriptor) {
 	if (!descriptor.key) throw new Error("authMiddleware cookie credentials require a cookie key.");
 	return `cookie:${descriptor.key}`;
 }
+function descriptorSource(tokenFrom) {
+	return tokenFrom === "header" ? "header" : { cookie: tokenFrom.slice(7) };
+}
 function resolveAllowedTypes(value) {
 	if (value !== void 0) return Array.isArray(value) ? value : [value];
 	const configuredDefault = config.key("auth.defaultUserType");
@@ -111,9 +120,18 @@ function authMiddleware(userTypeOrOptions, legacyTokenFromOrOptions) {
 			errorCode: "EC002"
 		});
 	};
+	const descriptorSources = dualSources ? [...dualHeader ? ["header"] : [], ...dualCookies.map(descriptorSource)] : [descriptorSource(tokenFrom)];
+	const descriptor = Object.freeze({
+		sources: Object.freeze(descriptorSources.map((source) => typeof source === "string" ? source : Object.freeze({ ...source }))),
+		userTypes: Object.freeze([...allowedTypes])
+	});
+	Object.defineProperty(auth, AUTH_MIDDLEWARE_DESCRIPTOR, {
+		value: descriptor,
+		enumerable: false
+	});
 	return auth;
 }
 
 //#endregion
-export { authMiddleware };
+export { AUTH_MIDDLEWARE_DESCRIPTOR, authMiddleware };
 //# sourceMappingURL=auth.middleware.mjs.map

package/esm/middleware/auth.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"sourcesContent":["import { config, type HttpContext, t, type Middleware } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport type {\n  AuthCredentialDescriptor,\n  AuthMiddlewareOptions,\n  TokenFrom,\n} from \"../contracts/types\";\nimport { authConfig } from \"../services/auth-config\";\nimport { readCredential, resolveRequestUserOutcome } from \"../services/resolve-request-user\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\nimport {\n  assertCsrfOriginAllowed,\n  CsrfOriginMismatchError,\n  requiresCsrfOriginCheck,\n} from \"./csrf-origin-check\";\nimport { localizedLoginPath } from \"./localized-login-path\";\n\n/** The 401 body shape every rejection in this middleware carries. */\ntype UnauthorizedPayload = { error: string; errorCode: string };\n\n/**\n * Reject an unauthenticated request, choosing the representation by ROUTE KIND.\n *\n * An API route always gets the JSON 401 it has always gotten. A PAGE route\n * (`request.route.isPage` — the React-SSR pages) instead redirects a logged-out\n * browser to the configured login path with a `returnUrl`, so a human\n * navigating to a guarded page lands on the login screen rather than reading a\n * raw JSON error blob — the defect in finding b9ab9804.\n *\n * The redirect is OPT-IN and backward-compatible: with no `auth.pageAuth.loginPath`\n * configured, even a page route falls back to the JSON 401, so an app that has\n * not asked for page-login UX keeps exactly its current behavior. The API 401\n * contract is never changed for API routes.\n *\n * `returnUrl` carries `request.url` — the relative path + query the browser was\n * on — never the absolute URL: a relative target cannot be turned into an\n * open-redirect off this app's origin.\n */\nfunction rejectUnauthorized(\n  { request, response }: HttpContext,\n  payload: UnauthorizedPayload,\n  redirect?: AuthMiddlewareOptions[\"redirect\"],\n) {\n  const loginPath = redirect?.to ?? authConfig.pageAuth.loginPath();\n  const returnUrlParam = redirect?.returnUrlParam ?? authConfig.pageAuth.returnUrlParam();\n\n  if (loginPath && request.route?.isPage) {\n    // Under an active `web.localeRouting` strategy, the login destination\n    // itself must carry the request's locale prefix — otherwise an anonymous\n    // `/ar/admin` bounces to the DEFAULT locale's `/login` rather than\n    // `/ar/login`, even though `returnUrl` below correctly points back at\n    // `/ar/admin`. See `./localized-login-path.ts`.\n    const destination = localizedLoginPath(loginPath, request.locale);\n    const separator = destination.includes(\"?\") ? \"&\" : \"?\";\n    const returnUrl = encodeURIComponent(request.url);\n\n    return response.redirect(`${destination}${separator}${returnUrlParam}=${returnUrl}`);\n  }\n\n  return response.unauthorized(payload);\n}\n\nfunction tokenFromDescriptor(descriptor: Partial<AuthCredentialDescriptor>): TokenFrom {\n  if (!descriptor.source || descriptor.source === \"header\") return \"header\";\n\n  if (!descriptor.key) {\n    throw new Error(\"authMiddleware cookie credentials require a cookie key.\");\n  }\n\n  return `cookie:${descriptor.key}`;\n}\n\nfunction resolveAllowedTypes(value: string | string[] | undefined): string[] {\n  if (value !== undefined) return Array.isArray(value) ? value : [value];\n\n  const configuredDefault = config.key(\"auth.defaultUserType\") as string | undefined;\n\n  if (configuredDefault) return [configuredDefault];\n\n  const userTypes = config.key(\"auth.userType\", {}) as Record<string, unknown>;\n  const configuredTypes = Object.keys(userTypes);\n\n  if (configuredTypes.length === 1) return configuredTypes;\n\n  throw new Error(\n    \"authMiddleware requires a user type when auth.defaultUserType is unset and multiple user types exist.\",\n  );\n}\n\n/**\n * Build a route gate. Authentication is required unless optional is explicit.\n *\n * An omitted user type selects the configured default; an explicit argument\n * selects which user types may pass:\n * - `[]` — any authenticated user (token required, type not checked).\n * - `\"admin\"` / `[\"admin\", \"staff\"]` — token required AND the user's\n *   `userType` must be one of the listed types.\n *\n * `{ optional: true }` allows anonymous requests. All other forms reject\n * missing or invalid credentials with 401, or a configured page redirect.\n *\n * `tokenFrom` selects one credential source and defaults to `\"header\"`.\n * A single source avoids making credential precedence depend on array order.\n *\n * @example\n * router.get(\"/account\", authMiddleware([]), accountController);\n * router.get(\"/admin\", authMiddleware(\"admin\"), adminController);\n * router.get(\"/back-office\", authMiddleware([\"admin\", \"staff\"]), backOfficeController);\n * router.get(\"/browser-account\", authMiddleware([], \"cookie:token\"), accountController);\n */\nexport function authMiddleware(): Middleware;\nexport function authMiddleware(options: AuthMiddlewareOptions): Middleware;\nexport function authMiddleware(\n  allowedUserType: string | string[],\n  options?: AuthMiddlewareOptions,\n): Middleware;\nexport function authMiddleware(\n  allowedUserType: string | string[],\n  tokenFrom?: TokenFrom,\n): Middleware;\nexport function authMiddleware(\n  userTypeOrOptions?: string | string[] | AuthMiddlewareOptions,\n  legacyTokenFromOrOptions?: TokenFrom | AuthMiddlewareOptions,\n): Middleware {\n  const options =\n    typeof userTypeOrOptions === \"object\" && !Array.isArray(userTypeOrOptions)\n      ? userTypeOrOptions\n      : typeof legacyTokenFromOrOptions === \"object\"\n        ? legacyTokenFromOrOptions\n        : undefined;\n  const selectedUserType =\n    typeof userTypeOrOptions === \"string\" || Array.isArray(userTypeOrOptions)\n      ? userTypeOrOptions\n      : undefined;\n  const allowedTypes = resolveAllowedTypes(selectedUserType);\n  const legacyTokenFrom =\n    typeof legacyTokenFromOrOptions === \"string\" ? legacyTokenFromOrOptions : undefined;\n  const dualSources = options?.sources?.length ? options.sources.map(tokenFromDescriptor) : undefined;\n\n  if (dualSources && options?.source) {\n    throw new Error(\"authMiddleware accepts either `source` or `sources`, not both.\");\n  }\n\n  const dualHeader = dualSources?.includes(\"header\") ?? false;\n  const dualCookies = dualSources?.filter(source => source !== \"header\") ?? [];\n\n  if (dualSources && (dualCookies.length > 1 || dualSources.length - dualCookies.length > 1)) {\n    throw new Error(\"authMiddleware `sources` accepts at most one header and one cookie.\");\n  }\n\n  // With dual sources the configured cookie is the base credential; the header\n  // is chosen per request, ahead of it.\n  const cookieTokenFrom: TokenFrom = dualSources\n    ? (dualCookies[0] ?? \"header\")\n    : options\n      ? tokenFromDescriptor(options)\n      : (legacyTokenFrom ?? \"header\");\n  const tokenFrom = cookieTokenFrom;\n  const refreshCredential = options?.refresh ? tokenFromDescriptor(options.refresh) : undefined;\n  const renewalUserType = allowedTypes.length === 1 ? allowedTypes[0] : undefined;\n\n  if (\n    refreshCredential &&\n    (tokenFrom === \"header\" || refreshCredential === \"header\" || !renewalUserType)\n  ) {\n    throw new Error(\n      \"authMiddleware automatic renewal requires one allowed user type and cookie access and refresh credentials.\",\n    );\n  }\n\n  const optional = options?.optional === true;\n\n  const auth: Middleware = async ({ request, response }) => {\n    const reject = (payload: UnauthorizedPayload) =>\n      rejectUnauthorized({ request, response }, payload, options?.redirect);\n\n    // A present Authorization header always wins and never falls back to the\n    // cookie: the credential used is the header, so no renewal and no CSRF check.\n    const headerWins = dualHeader && Boolean(request.authorizationValue);\n    const usedTokenFrom: TokenFrom = headerWins ? \"header\" : tokenFrom;\n    const usedRefresh = headerWins ? undefined : refreshCredential;\n\n    // Renewal can mint cookies, so a cookie-authenticated unsafe request must\n    // pass the same CSRF check even when its access cookie is missing.\n    if (\n      (readCredential(request, usedTokenFrom) ||\n        (usedRefresh && readCredential(request, usedRefresh))) &&\n      requiresCsrfOriginCheck(usedTokenFrom, request.method)\n    ) {\n      try {\n        assertCsrfOriginAllowed(request);\n      } catch (error) {\n        if (!(error instanceof CsrfOriginMismatchError)) throw error;\n\n        log.error(\"http\", \"auth\", error);\n        return response.forbidden({\n          error: t(\"auth.errors.csrfOriginMismatch\"),\n          errorCode: AuthErrorCodes.CsrfOriginMismatch,\n        });\n      }\n    }\n\n    const outcome = await resolveRequestUserOutcome(request, response, {\n      tokenFrom: usedTokenFrom,\n      refreshCredential: usedRefresh,\n      overlapMs: options?.refresh?.overlapMs,\n      allowedTypes,\n      renewalUserType,\n    });\n\n    if (outcome.user) {\n      request.locals.user = outcome.user;\n      return;\n    }\n\n    if (outcome.failure === \"forbidden\") {\n      return response.forbidden({\n        error: t(\"auth.errors.unauthorized\"),\n        errorCode: AuthErrorCodes.Unauthorized,\n      });\n    }\n\n    if (optional) return;\n\n    if (outcome.failure === \"missing\") {\n      return reject({\n        error: t(\"auth.errors.missingAccessToken\"),\n        errorCode: AuthErrorCodes.MissingAccessToken,\n      });\n    }\n\n    if (outcome.failure === \"unauthorized\") {\n      return reject({\n        error: t(\"auth.errors.unauthorized\"),\n        errorCode: AuthErrorCodes.Unauthorized,\n      });\n    }\n\n    return reject({\n      error: t(\"auth.errors.invalidAccessToken\"),\n      errorCode: AuthErrorCodes.InvalidAccessToken,\n    });\n  };\n\n  return auth;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAS,mBACP,EAAE,SAAS,YACX,SACA,UACA;CACA,MAAM,YAAY,UAAU,MAAM,WAAW,SAAS,UAAU;CAChE,MAAM,iBAAiB,UAAU,kBAAkB,WAAW,SAAS,eAAe;CAEtF,IAAI,aAAa,QAAQ,OAAO,QAAQ;EAMtC,MAAM,cAAc,mBAAmB,WAAW,QAAQ,MAAM;EAChE,MAAM,YAAY,YAAY,SAAS,GAAG,IAAI,MAAM;EACpD,MAAM,YAAY,mBAAmB,QAAQ,GAAG;EAEhD,OAAO,SAAS,SAAS,GAAG,cAAc,YAAY,eAAe,GAAG,WAAW;CACrF;CAEA,OAAO,SAAS,aAAa,OAAO;AACtC;AAEA,SAAS,oBAAoB,YAA0D;CACrF,IAAI,CAAC,WAAW,UAAU,WAAW,WAAW,UAAU,OAAO;CAEjE,IAAI,CAAC,WAAW,KACd,MAAM,IAAI,MAAM,yDAAyD;CAG3E,OAAO,UAAU,WAAW;AAC9B;AAEA,SAAS,oBAAoB,OAAgD;CAC3E,IAAI,UAAU,QAAW,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;CAErE,MAAM,oBAAoB,OAAO,IAAI,sBAAsB;CAE3D,IAAI,mBAAmB,OAAO,CAAC,iBAAiB;CAEhD,MAAM,YAAY,OAAO,IAAI,iBAAiB,CAAC,CAAC;CAChD,MAAM,kBAAkB,OAAO,KAAK,SAAS;CAE7C,IAAI,gBAAgB,WAAW,GAAG,OAAO;CAEzC,MAAM,IAAI,MACR,uGACF;AACF;AAiCA,SAAgB,eACd,mBACA,0BACY;CACZ,MAAM,UACJ,OAAO,sBAAsB,YAAY,CAAC,MAAM,QAAQ,iBAAiB,IACrE,oBACA,OAAO,6BAA6B,WAClC,2BACA;CAKR,MAAM,eAAe,oBAHnB,OAAO,sBAAsB,YAAY,MAAM,QAAQ,iBAAiB,IACpE,oBACA,MACmD;CACzD,MAAM,kBACJ,OAAO,6BAA6B,WAAW,2BAA2B;CAC5E,MAAM,cAAc,SAAS,SAAS,SAAS,QAAQ,QAAQ,IAAI,mBAAmB,IAAI;CAE1F,IAAI,eAAe,SAAS,QAC1B,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAM,aAAa,aAAa,SAAS,QAAQ,KAAK;CACtD,MAAM,cAAc,aAAa,QAAO,WAAU,WAAW,QAAQ,KAAK,CAAC;CAE3E,IAAI,gBAAgB,YAAY,SAAS,KAAK,YAAY,SAAS,YAAY,SAAS,IACtF,MAAM,IAAI,MAAM,qEAAqE;CAUvF,MAAM,YAL6B,cAC9B,YAAY,MAAM,WACnB,UACE,oBAAoB,OAAO,IAC1B,mBAAmB;CAE1B,MAAM,oBAAoB,SAAS,UAAU,oBAAoB,QAAQ,OAAO,IAAI;CACpF,MAAM,kBAAkB,aAAa,WAAW,IAAI,aAAa,KAAK;CAEtE,IACE,sBACC,cAAc,YAAY,sBAAsB,YAAY,CAAC,kBAE9D,MAAM,IAAI,MACR,4GACF;CAGF,MAAM,WAAW,SAAS,aAAa;CAEvC,MAAM,OAAmB,OAAO,EAAE,SAAS,eAAe;EACxD,MAAM,UAAU,YACd,mBAAmB;GAAE;GAAS;EAAS,GAAG,SAAS,SAAS,QAAQ;EAItE,MAAM,aAAa,cAAc,QAAQ,QAAQ,kBAAkB;EACnE,MAAM,gBAA2B,aAAa,WAAW;EACzD,MAAM,cAAc,aAAa,SAAY;EAI7C,KACG,eAAe,SAAS,aAAa,KACnC,eAAe,eAAe,SAAS,WAAW,MACrD,wBAAwB,eAAe,QAAQ,MAAM,GAErD,IAAI;GACF,wBAAwB,OAAO;EACjC,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,0BAA0B,MAAM;GAEvD,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAC/B,OAAO,SAAS,UAAU;IACxB,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAGF,MAAM,UAAU,MAAM,0BAA0B,SAAS,UAAU;GACjE,WAAW;GACX,mBAAmB;GACnB,WAAW,SAAS,SAAS;GAC7B;GACA;EACF,CAAC;EAED,IAAI,QAAQ,MAAM;GAChB,QAAQ,OAAO,OAAO,QAAQ;GAC9B;EACF;EAEA,IAAI,QAAQ,YAAY,aACtB,OAAO,SAAS,UAAU;GACxB,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,IAAI,UAAU;EAEd,IAAI,QAAQ,YAAY,WACtB,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;EAGH,IAAI,QAAQ,YAAY,gBACtB,OAAO,OAAO;GACZ,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;CACH;CAEA,OAAO;AACT"}
+{"version":3,"file":"auth.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"sourcesContent":["import { config, type HttpContext, t, type Middleware } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport type {\n  AuthCredentialDescriptor,\n  AuthMiddlewareOptions,\n  TokenFrom,\n} from \"../contracts/types\";\nimport { authConfig } from \"../services/auth-config\";\nimport { readCredential, resolveRequestUserOutcome } from \"../services/resolve-request-user\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\nimport {\n  assertCsrfOriginAllowed,\n  CsrfOriginMismatchError,\n  requiresCsrfOriginCheck,\n} from \"./csrf-origin-check\";\nimport { localizedLoginPath } from \"./localized-login-path\";\n\n/**\n * Well-known symbol under which `authMiddleware()` tags the middleware it\n * returns. Shared via the global symbol registry so other packages can read the\n * descriptor structurally (`Symbol.for(\"warlock.auth\")`) without importing auth.\n */\nexport const AUTH_MIDDLEWARE_DESCRIPTOR = Symbol.for(\"warlock.auth\");\n\n/** A credential source an auth middleware reads: the Authorization header or a named cookie. */\nexport type AuthMiddlewareDescriptorSource = \"header\" | { cookie: string };\n\n/**\n * Frozen, JSON-safe description of how an `authMiddleware()` instance\n * authenticates, stored (non-enumerably) under {@link AUTH_MIDDLEWARE_DESCRIPTOR}.\n */\nexport type AuthMiddlewareDescriptor = {\n  /** Resolved credential sources; with dual sources the header comes first. */\n  sources: AuthMiddlewareDescriptorSource[];\n  /** Resolved allowed user types; an empty array means any authenticated user. */\n  userTypes: string[];\n};\n\n/** The 401 body shape every rejection in this middleware carries. */\ntype UnauthorizedPayload = { error: string; errorCode: string };\n\n/**\n * Reject an unauthenticated request, choosing the representation by ROUTE KIND.\n *\n * An API route always gets the JSON 401 it has always gotten. A PAGE route\n * (`request.route.isPage` — the React-SSR pages) instead redirects a logged-out\n * browser to the configured login path with a `returnUrl`, so a human\n * navigating to a guarded page lands on the login screen rather than reading a\n * raw JSON error blob — the defect in finding b9ab9804.\n *\n * The redirect is OPT-IN and backward-compatible: with no `auth.pageAuth.loginPath`\n * configured, even a page route falls back to the JSON 401, so an app that has\n * not asked for page-login UX keeps exactly its current behavior. The API 401\n * contract is never changed for API routes.\n *\n * `returnUrl` carries `request.url` — the relative path + query the browser was\n * on — never the absolute URL: a relative target cannot be turned into an\n * open-redirect off this app's origin.\n */\nfunction rejectUnauthorized(\n  { request, response }: HttpContext,\n  payload: UnauthorizedPayload,\n  redirect?: AuthMiddlewareOptions[\"redirect\"],\n) {\n  const loginPath = redirect?.to ?? authConfig.pageAuth.loginPath();\n  const returnUrlParam = redirect?.returnUrlParam ?? authConfig.pageAuth.returnUrlParam();\n\n  if (loginPath && request.route?.isPage) {\n    // Under an active `web.localeRouting` strategy, the login destination\n    // itself must carry the request's locale prefix — otherwise an anonymous\n    // `/ar/admin` bounces to the DEFAULT locale's `/login` rather than\n    // `/ar/login`, even though `returnUrl` below correctly points back at\n    // `/ar/admin`. See `./localized-login-path.ts`.\n    const destination = localizedLoginPath(loginPath, request.locale);\n    const separator = destination.includes(\"?\") ? \"&\" : \"?\";\n    const returnUrl = encodeURIComponent(request.url);\n\n    return response.redirect(`${destination}${separator}${returnUrlParam}=${returnUrl}`);\n  }\n\n  return response.unauthorized(payload);\n}\n\nfunction tokenFromDescriptor(descriptor: Partial<AuthCredentialDescriptor>): TokenFrom {\n  if (!descriptor.source || descriptor.source === \"header\") return \"header\";\n\n  if (!descriptor.key) {\n    throw new Error(\"authMiddleware cookie credentials require a cookie key.\");\n  }\n\n  return `cookie:${descriptor.key}`;\n}\n\nfunction descriptorSource(tokenFrom: TokenFrom): AuthMiddlewareDescriptorSource {\n  return tokenFrom === \"header\" ? \"header\" : { cookie: tokenFrom.slice(\"cookie:\".length) };\n}\n\nfunction resolveAllowedTypes(value: string | string[] | undefined): string[] {\n  if (value !== undefined) return Array.isArray(value) ? value : [value];\n\n  const configuredDefault = config.key(\"auth.defaultUserType\") as string | undefined;\n\n  if (configuredDefault) return [configuredDefault];\n\n  const userTypes = config.key(\"auth.userType\", {}) as Record<string, unknown>;\n  const configuredTypes = Object.keys(userTypes);\n\n  if (configuredTypes.length === 1) return configuredTypes;\n\n  throw new Error(\n    \"authMiddleware requires a user type when auth.defaultUserType is unset and multiple user types exist.\",\n  );\n}\n\n/**\n * Build a route gate. Authentication is required unless optional is explicit.\n *\n * An omitted user type selects the configured default; an explicit argument\n * selects which user types may pass:\n * - `[]` — any authenticated user (token required, type not checked).\n * - `\"admin\"` / `[\"admin\", \"staff\"]` — token required AND the user's\n *   `userType` must be one of the listed types.\n *\n * `{ optional: true }` allows anonymous requests. All other forms reject\n * missing or invalid credentials with 401, or a configured page redirect.\n *\n * `tokenFrom` selects one credential source and defaults to `\"header\"`.\n * A single source avoids making credential precedence depend on array order.\n *\n * @example\n * router.get(\"/account\", authMiddleware([]), accountController);\n * router.get(\"/admin\", authMiddleware(\"admin\"), adminController);\n * router.get(\"/back-office\", authMiddleware([\"admin\", \"staff\"]), backOfficeController);\n * router.get(\"/browser-account\", authMiddleware([], \"cookie:token\"), accountController);\n */\nexport function authMiddleware(): Middleware;\nexport function authMiddleware(options: AuthMiddlewareOptions): Middleware;\nexport function authMiddleware(\n  allowedUserType: string | string[],\n  options?: AuthMiddlewareOptions,\n): Middleware;\nexport function authMiddleware(\n  allowedUserType: string | string[],\n  tokenFrom?: TokenFrom,\n): Middleware;\nexport function authMiddleware(\n  userTypeOrOptions?: string | string[] | AuthMiddlewareOptions,\n  legacyTokenFromOrOptions?: TokenFrom | AuthMiddlewareOptions,\n): Middleware {\n  const options =\n    typeof userTypeOrOptions === \"object\" && !Array.isArray(userTypeOrOptions)\n      ? userTypeOrOptions\n      : typeof legacyTokenFromOrOptions === \"object\"\n        ? legacyTokenFromOrOptions\n        : undefined;\n  const selectedUserType =\n    typeof userTypeOrOptions === \"string\" || Array.isArray(userTypeOrOptions)\n      ? userTypeOrOptions\n      : undefined;\n  const allowedTypes = resolveAllowedTypes(selectedUserType);\n  const legacyTokenFrom =\n    typeof legacyTokenFromOrOptions === \"string\" ? legacyTokenFromOrOptions : undefined;\n  const dualSources = options?.sources?.length ? options.sources.map(tokenFromDescriptor) : undefined;\n\n  if (dualSources && options?.source) {\n    throw new Error(\"authMiddleware accepts either `source` or `sources`, not both.\");\n  }\n\n  const dualHeader = dualSources?.includes(\"header\") ?? false;\n  const dualCookies = dualSources?.filter(source => source !== \"header\") ?? [];\n\n  if (dualSources && (dualCookies.length > 1 || dualSources.length - dualCookies.length > 1)) {\n    throw new Error(\"authMiddleware `sources` accepts at most one header and one cookie.\");\n  }\n\n  // With dual sources the configured cookie is the base credential; the header\n  // is chosen per request, ahead of it.\n  const cookieTokenFrom: TokenFrom = dualSources\n    ? (dualCookies[0] ?? \"header\")\n    : options\n      ? tokenFromDescriptor(options)\n      : (legacyTokenFrom ?? \"header\");\n  const tokenFrom = cookieTokenFrom;\n  const refreshCredential = options?.refresh ? tokenFromDescriptor(options.refresh) : undefined;\n  const renewalUserType = allowedTypes.length === 1 ? allowedTypes[0] : undefined;\n\n  if (\n    refreshCredential &&\n    (tokenFrom === \"header\" || refreshCredential === \"header\" || !renewalUserType)\n  ) {\n    throw new Error(\n      \"authMiddleware automatic renewal requires one allowed user type and cookie access and refresh credentials.\",\n    );\n  }\n\n  const optional = options?.optional === true;\n\n  const auth: Middleware = async ({ request, response }) => {\n    const reject = (payload: UnauthorizedPayload) =>\n      rejectUnauthorized({ request, response }, payload, options?.redirect);\n\n    // A present Authorization header always wins and never falls back to the\n    // cookie: the credential used is the header, so no renewal and no CSRF check.\n    const headerWins = dualHeader && Boolean(request.authorizationValue);\n    const usedTokenFrom: TokenFrom = headerWins ? \"header\" : tokenFrom;\n    const usedRefresh = headerWins ? undefined : refreshCredential;\n\n    // Renewal can mint cookies, so a cookie-authenticated unsafe request must\n    // pass the same CSRF check even when its access cookie is missing.\n    if (\n      (readCredential(request, usedTokenFrom) ||\n        (usedRefresh && readCredential(request, usedRefresh))) &&\n      requiresCsrfOriginCheck(usedTokenFrom, request.method)\n    ) {\n      try {\n        assertCsrfOriginAllowed(request);\n      } catch (error) {\n        if (!(error instanceof CsrfOriginMismatchError)) throw error;\n\n        log.error(\"http\", \"auth\", error);\n        return response.forbidden({\n          error: t(\"auth.errors.csrfOriginMismatch\"),\n          errorCode: AuthErrorCodes.CsrfOriginMismatch,\n        });\n      }\n    }\n\n    const outcome = await resolveRequestUserOutcome(request, response, {\n      tokenFrom: usedTokenFrom,\n      refreshCredential: usedRefresh,\n      overlapMs: options?.refresh?.overlapMs,\n      allowedTypes,\n      renewalUserType,\n    });\n\n    if (outcome.user) {\n      request.locals.user = outcome.user;\n      return;\n    }\n\n    if (outcome.failure === \"forbidden\") {\n      return response.forbidden({\n        error: t(\"auth.errors.unauthorized\"),\n        errorCode: AuthErrorCodes.Unauthorized,\n      });\n    }\n\n    if (optional) return;\n\n    if (outcome.failure === \"missing\") {\n      return reject({\n        error: t(\"auth.errors.missingAccessToken\"),\n        errorCode: AuthErrorCodes.MissingAccessToken,\n      });\n    }\n\n    if (outcome.failure === \"unauthorized\") {\n      return reject({\n        error: t(\"auth.errors.unauthorized\"),\n        errorCode: AuthErrorCodes.Unauthorized,\n      });\n    }\n\n    return reject({\n      error: t(\"auth.errors.invalidAccessToken\"),\n      errorCode: AuthErrorCodes.InvalidAccessToken,\n    });\n  };\n\n  const descriptorSources: AuthMiddlewareDescriptorSource[] = dualSources\n    ? [...(dualHeader ? ([\"header\"] as const) : []), ...dualCookies.map(descriptorSource)]\n    : [descriptorSource(tokenFrom)];\n  const descriptor: AuthMiddlewareDescriptor = Object.freeze({\n    sources: Object.freeze(descriptorSources.map(source =>\n      typeof source === \"string\" ? source : Object.freeze({ ...source }),\n    )) as AuthMiddlewareDescriptorSource[],\n    userTypes: Object.freeze([...allowedTypes]) as string[],\n  });\n\n  // Non-enumerable so the tag never shows up in logs, spreads or JSON.\n  Object.defineProperty(auth, AUTH_MIDDLEWARE_DESCRIPTOR, { value: descriptor, enumerable: false });\n\n  return auth;\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,MAAa,6BAA6B,OAAO,IAAI,cAAc;;;;;;;;;;;;;;;;;;;AAqCnE,SAAS,mBACP,EAAE,SAAS,YACX,SACA,UACA;CACA,MAAM,YAAY,UAAU,MAAM,WAAW,SAAS,UAAU;CAChE,MAAM,iBAAiB,UAAU,kBAAkB,WAAW,SAAS,eAAe;CAEtF,IAAI,aAAa,QAAQ,OAAO,QAAQ;EAMtC,MAAM,cAAc,mBAAmB,WAAW,QAAQ,MAAM;EAChE,MAAM,YAAY,YAAY,SAAS,GAAG,IAAI,MAAM;EACpD,MAAM,YAAY,mBAAmB,QAAQ,GAAG;EAEhD,OAAO,SAAS,SAAS,GAAG,cAAc,YAAY,eAAe,GAAG,WAAW;CACrF;CAEA,OAAO,SAAS,aAAa,OAAO;AACtC;AAEA,SAAS,oBAAoB,YAA0D;CACrF,IAAI,CAAC,WAAW,UAAU,WAAW,WAAW,UAAU,OAAO;CAEjE,IAAI,CAAC,WAAW,KACd,MAAM,IAAI,MAAM,yDAAyD;CAG3E,OAAO,UAAU,WAAW;AAC9B;AAEA,SAAS,iBAAiB,WAAsD;CAC9E,OAAO,cAAc,WAAW,WAAW,EAAE,QAAQ,UAAU,MAAM,CAAgB,EAAE;AACzF;AAEA,SAAS,oBAAoB,OAAgD;CAC3E,IAAI,UAAU,QAAW,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;CAErE,MAAM,oBAAoB,OAAO,IAAI,sBAAsB;CAE3D,IAAI,mBAAmB,OAAO,CAAC,iBAAiB;CAEhD,MAAM,YAAY,OAAO,IAAI,iBAAiB,CAAC,CAAC;CAChD,MAAM,kBAAkB,OAAO,KAAK,SAAS;CAE7C,IAAI,gBAAgB,WAAW,GAAG,OAAO;CAEzC,MAAM,IAAI,MACR,uGACF;AACF;AAiCA,SAAgB,eACd,mBACA,0BACY;CACZ,MAAM,UACJ,OAAO,sBAAsB,YAAY,CAAC,MAAM,QAAQ,iBAAiB,IACrE,oBACA,OAAO,6BAA6B,WAClC,2BACA;CAKR,MAAM,eAAe,oBAHnB,OAAO,sBAAsB,YAAY,MAAM,QAAQ,iBAAiB,IACpE,oBACA,MACmD;CACzD,MAAM,kBACJ,OAAO,6BAA6B,WAAW,2BAA2B;CAC5E,MAAM,cAAc,SAAS,SAAS,SAAS,QAAQ,QAAQ,IAAI,mBAAmB,IAAI;CAE1F,IAAI,eAAe,SAAS,QAC1B,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAM,aAAa,aAAa,SAAS,QAAQ,KAAK;CACtD,MAAM,cAAc,aAAa,QAAO,WAAU,WAAW,QAAQ,KAAK,CAAC;CAE3E,IAAI,gBAAgB,YAAY,SAAS,KAAK,YAAY,SAAS,YAAY,SAAS,IACtF,MAAM,IAAI,MAAM,qEAAqE;CAUvF,MAAM,YAL6B,cAC9B,YAAY,MAAM,WACnB,UACE,oBAAoB,OAAO,IAC1B,mBAAmB;CAE1B,MAAM,oBAAoB,SAAS,UAAU,oBAAoB,QAAQ,OAAO,IAAI;CACpF,MAAM,kBAAkB,aAAa,WAAW,IAAI,aAAa,KAAK;CAEtE,IACE,sBACC,cAAc,YAAY,sBAAsB,YAAY,CAAC,kBAE9D,MAAM,IAAI,MACR,4GACF;CAGF,MAAM,WAAW,SAAS,aAAa;CAEvC,MAAM,OAAmB,OAAO,EAAE,SAAS,eAAe;EACxD,MAAM,UAAU,YACd,mBAAmB;GAAE;GAAS;EAAS,GAAG,SAAS,SAAS,QAAQ;EAItE,MAAM,aAAa,cAAc,QAAQ,QAAQ,kBAAkB;EACnE,MAAM,gBAA2B,aAAa,WAAW;EACzD,MAAM,cAAc,aAAa,SAAY;EAI7C,KACG,eAAe,SAAS,aAAa,KACnC,eAAe,eAAe,SAAS,WAAW,MACrD,wBAAwB,eAAe,QAAQ,MAAM,GAErD,IAAI;GACF,wBAAwB,OAAO;EACjC,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,0BAA0B,MAAM;GAEvD,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAC/B,OAAO,SAAS,UAAU;IACxB,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAGF,MAAM,UAAU,MAAM,0BAA0B,SAAS,UAAU;GACjE,WAAW;GACX,mBAAmB;GACnB,WAAW,SAAS,SAAS;GAC7B;GACA;EACF,CAAC;EAED,IAAI,QAAQ,MAAM;GAChB,QAAQ,OAAO,OAAO,QAAQ;GAC9B;EACF;EAEA,IAAI,QAAQ,YAAY,aACtB,OAAO,SAAS,UAAU;GACxB,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,IAAI,UAAU;EAEd,IAAI,QAAQ,YAAY,WACtB,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;EAGH,IAAI,QAAQ,YAAY,gBACtB,OAAO,OAAO;GACZ,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;CACH;CAEA,MAAM,oBAAsD,cACxD,CAAC,GAAI,aAAc,CAAC,QAAQ,IAAc,CAAC,GAAI,GAAG,YAAY,IAAI,gBAAgB,CAAC,IACnF,CAAC,iBAAiB,SAAS,CAAC;CAChC,MAAM,aAAuC,OAAO,OAAO;EACzD,SAAS,OAAO,OAAO,kBAAkB,KAAI,WAC3C,OAAO,WAAW,WAAW,SAAS,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC,CACnE,CAAC;EACD,WAAW,OAAO,OAAO,CAAC,GAAG,YAAY,CAAC;CAC5C,CAAC;CAGD,OAAO,eAAe,MAAM,4BAA4B;EAAE,OAAO;EAAY,YAAY;CAAM,CAAC;CAEhG,OAAO;AACT"}

package/esm/middleware/index.d.mts

@@ -1,4 +1,4 @@
-import { authMiddleware } from "./auth.middleware.mjs";
+import { AUTH_MIDDLEWARE_DESCRIPTOR, AuthMiddlewareDescriptor, AuthMiddlewareDescriptorSource, authMiddleware } from "./auth.middleware.mjs";
 import { CsrfOriginMismatchError, CsrfOriginMismatchReason, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./csrf-origin-check.mjs";
 import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
 import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./one-time-token-throttle.middleware.mjs";

package/esm/middleware/index.mjs

@@ -1,5 +1,5 @@
 import { CsrfOriginMismatchError, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./csrf-origin-check.mjs";
-import { authMiddleware } from "./auth.middleware.mjs";
+import { AUTH_MIDDLEWARE_DESCRIPTOR, authMiddleware } from "./auth.middleware.mjs";
 import { loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
 import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./one-time-token-throttle.middleware.mjs";
 import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./otp-throttle.middleware.mjs";

package/esm/services/auth-config.mjs

@@ -124,7 +124,9 @@ const authConfig = {
 		/** Refresh-token cookie name the session cookie helpers use. @default "refresh_token" */
 		refreshName: () => config.key("auth.cookie.refreshName", "refresh_token"),
 		/** Cookie `Path` attribute `setAuthCookie`/`clearAuthCookie` use. @default "/" */
-		path: () => config.key("auth.cookie.path", "/")
+		path: () => config.key("auth.cookie.path", "/"),
+		/** Select the request-scoped cookie Domain; undefined keeps it host-only. */
+		cookieDomain: () => config.key("auth.cookie.cookieDomain")
 	},
 	csrf: { 
 	/**