@warlock.js/auth 5.29.0 → 5.30.0

package/esm/index.d.mts

@@ -22,7 +22,7 @@ import { authDefaultTranslations } from "./localization/auth-default-translation
 import { registerAuthTranslations } from "./localization/register-auth-translations.mjs";
 import { AUTH_MIDDLEWARE_DESCRIPTOR, AuthMiddlewareDescriptor, AuthMiddlewareDescriptorSource, authMiddleware } from "./middleware/auth.middleware.mjs";
 import { CsrfOriginMismatchError, CsrfOriginMismatchReason, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./middleware/csrf-origin-check.mjs";
-import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware } from "./middleware/login-throttle.middleware.mjs";
+import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware, throttleIdentifierHash } from "./middleware/login-throttle.middleware.mjs";
 import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./middleware/one-time-token-throttle.middleware.mjs";
 import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./middleware/otp-throttle.middleware.mjs";
 import { requireVerifiedEmail } from "./middleware/require-verified-email.middleware.mjs";
@@ -54,5 +54,5 @@ import { RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, read
 import { PageSessionOptions, PageSessionResolver, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, pageSession, sessionMiddleware } from "./session/page-session.mjs";
 import { safeEqual } from "./utils/safe-equal.mjs";
 import { isNeverExpiring, isUsableExpiry, tokenHasExpClaim } from "./utils/token-expiry.mjs";
-export { APPLE_AUTH_FEATURE, AUTH_MIDDLEWARE_DESCRIPTOR, AccessToken, AccessTokenConfig, AccessTokenOutput, AppleJoseModule, AppleProvider, AppleProviderConfig, Auth, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthErrorCodes, AuthErrorTranslations, AuthEventCallback, AuthEventName, AuthEventPayloads, AuthMiddlewareDescriptor, AuthMiddlewareDescriptorSource, AuthMiddlewareOptions, AuthNotification, AuthProvider, AuthProviderSdkMissingError, AuthRefreshCredentialDescriptor, AuthTokenFamily, AuthTranslations, Authenticable, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CookieDomainRequestRequiredError, CookieDomainResolver, CsrfConfig, CsrfOriginMismatchError, CsrfOriginMismatchReason, DeviceInfo, DiscordProvider, DiscordProviderConfig, EmailNotVerifiedError, EmailVerificationConfig, FacebookProvider, FacebookProviderConfig, GOOGLE_AUTH_FEATURE, GitHubProvider, GitHubProviderConfig, GoogleProvider, GoogleProviderConfig, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, IssuedOneTimeToken, JoseModule, LINKEDIN_AUTH_FEATURE, LegacyJwtConfig, LinkedInProvider, LinkedInProviderConfig, LoginResult, LoginThrottleIdentifier, LoginThrottleOptions, LogoutWithoutTokenBehavior, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenPurpose, OneTimeTokenUrlBuilder, OtpConfig, OtpMessage, OtpSender, PageAuthConfig, PageSessionOptions, PageSessionResolver, PasskeyCredential, type PasskeyOptionsJSON, type PasskeyResponseJSON, PasskeysConfig, PasswordResetConfig, PasswordSetter, ProviderAccount, ProviderAuthorizationState, ProviderCallbackParams, ProviderEmailNotVerifiedError, ProviderProfile, ProviderUserCreator, ProvidersConfig, RefreshToken, RefreshTokenConfig, RefreshTokenIssueOptions, RequestUser, RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, SetAuthCookieOptions, TokenFrom, TokenPair, TokenType, TokenTypeError, XProvider, XProviderConfig, accessTokenSchema, assertCsrfOriginAllowed, authDefaultTranslations, authEvents, authMiddleware, authMigrations, authService, authTokenFamilySchema, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, pageSession, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, readCredential, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerAuthTranslations, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, resolveRequestUser, resolveRequestUserOutcome, safeEqual, sendEmailVerification, sessionMiddleware, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
+export { APPLE_AUTH_FEATURE, AUTH_MIDDLEWARE_DESCRIPTOR, AccessToken, AccessTokenConfig, AccessTokenOutput, AppleJoseModule, AppleProvider, AppleProviderConfig, Auth, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthErrorCodes, AuthErrorTranslations, AuthEventCallback, AuthEventName, AuthEventPayloads, AuthMiddlewareDescriptor, AuthMiddlewareDescriptorSource, AuthMiddlewareOptions, AuthNotification, AuthProvider, AuthProviderSdkMissingError, AuthRefreshCredentialDescriptor, AuthTokenFamily, AuthTranslations, Authenticable, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CookieDomainRequestRequiredError, CookieDomainResolver, CsrfConfig, CsrfOriginMismatchError, CsrfOriginMismatchReason, DeviceInfo, DiscordProvider, DiscordProviderConfig, EmailNotVerifiedError, EmailVerificationConfig, FacebookProvider, FacebookProviderConfig, GOOGLE_AUTH_FEATURE, GitHubProvider, GitHubProviderConfig, GoogleProvider, GoogleProviderConfig, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, IssuedOneTimeToken, JoseModule, LINKEDIN_AUTH_FEATURE, LegacyJwtConfig, LinkedInProvider, LinkedInProviderConfig, LoginResult, LoginThrottleIdentifier, LoginThrottleOptions, LogoutWithoutTokenBehavior, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenPurpose, OneTimeTokenUrlBuilder, OtpConfig, OtpMessage, OtpSender, PageAuthConfig, PageSessionOptions, PageSessionResolver, PasskeyCredential, type PasskeyOptionsJSON, type PasskeyResponseJSON, PasskeysConfig, PasswordResetConfig, PasswordSetter, ProviderAccount, ProviderAuthorizationState, ProviderCallbackParams, ProviderEmailNotVerifiedError, ProviderProfile, ProviderUserCreator, ProvidersConfig, RefreshToken, RefreshTokenConfig, RefreshTokenIssueOptions, RequestUser, RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, SetAuthCookieOptions, TokenFrom, TokenPair, TokenType, TokenTypeError, XProvider, XProviderConfig, accessTokenSchema, assertCsrfOriginAllowed, authDefaultTranslations, authEvents, authMiddleware, authMigrations, authService, authTokenFamilySchema, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, pageSession, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, readCredential, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerAuthTranslations, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, resolveRequestUser, resolveRequestUserOutcome, safeEqual, sendEmailVerification, sessionMiddleware, startProviderLogin, throttleIdentifierHash, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
 import "./contracts/request-locals.mjs";

package/esm/index.mjs

@@ -27,7 +27,7 @@ import "./errors/index.mjs";
 import "./localization/index.mjs";
 import { readCredential, resolveRequestUser, resolveRequestUserOutcome } from "./services/resolve-request-user.mjs";
 import { AUTH_MIDDLEWARE_DESCRIPTOR, authMiddleware } from "./middleware/auth.middleware.mjs";
-import { loginThrottleMiddleware } from "./middleware/login-throttle.middleware.mjs";
+import { loginThrottleMiddleware, throttleIdentifierHash } from "./middleware/login-throttle.middleware.mjs";
 import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./middleware/one-time-token-throttle.middleware.mjs";
 import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./middleware/otp-throttle.middleware.mjs";
 import { requireVerifiedEmail } from "./middleware/require-verified-email.middleware.mjs";
@@ -60,4 +60,4 @@ import { pageSession, sessionMiddleware } from "./session/page-session.mjs";
 import "./session/index.mjs";
 import "./utils/index.mjs";
 
-export { APPLE_AUTH_FEATURE, AUTH_MIDDLEWARE_DESCRIPTOR, AccessToken, AppleProvider, Auth, AuthErrorCodes, AuthProviderSdkMissingError, AuthTokenFamily, CookieDomainRequestRequiredError, CsrfOriginMismatchError, DiscordProvider, EmailNotVerifiedError, FacebookProvider, GOOGLE_AUTH_FEATURE, GitHubProvider, GoogleProvider, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, LINKEDIN_AUTH_FEATURE, LinkedInProvider, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, PasskeyCredential, ProviderAccount, ProviderEmailNotVerifiedError, RefreshToken, TokenTypeError, XProvider, accessTokenSchema, assertCsrfOriginAllowed, authDefaultTranslations, authEvents, authMiddleware, authMigrations, authService, authTokenFamilySchema, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, pageSession, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, readCredential, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerAuthTranslations, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, resolveRequestUser, resolveRequestUserOutcome, safeEqual, sendEmailVerification, sessionMiddleware, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
+export { APPLE_AUTH_FEATURE, AUTH_MIDDLEWARE_DESCRIPTOR, AccessToken, AppleProvider, Auth, AuthErrorCodes, AuthProviderSdkMissingError, AuthTokenFamily, CookieDomainRequestRequiredError, CsrfOriginMismatchError, DiscordProvider, EmailNotVerifiedError, FacebookProvider, GOOGLE_AUTH_FEATURE, GitHubProvider, GoogleProvider, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, LINKEDIN_AUTH_FEATURE, LinkedInProvider, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, PasskeyCredential, ProviderAccount, ProviderEmailNotVerifiedError, RefreshToken, TokenTypeError, XProvider, accessTokenSchema, assertCsrfOriginAllowed, authDefaultTranslations, authEvents, authMiddleware, authMigrations, authService, authTokenFamilySchema, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, pageSession, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, readCredential, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerAuthTranslations, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, resolveRequestUser, resolveRequestUserOutcome, safeEqual, sendEmailVerification, sessionMiddleware, startProviderLogin, throttleIdentifierHash, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };

package/esm/localization/ar.translations.mjs

@@ -1,4 +1,4 @@
-//#region ../auth/src/localization/ar.translations.ts
+//#region ../../packages/auth/src/localization/ar.translations.ts
 /**
 * Built-in Arabic text for auth's translation keys. Applications override
 * any of these by registering the same key in their own locale files.

package/esm/localization/ar.translations.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ar.translations.mjs","names":[],"sources":["../../../../../../../auth/src/localization/ar.translations.ts"],"sourcesContent":["import type { AuthTranslations } from \"./auth-translations.type\";\n\n/**\n * Built-in Arabic text for auth's translation keys. Applications override\n * any of these by registering the same key in their own locale files.\n */\nexport const authArabicTranslations: AuthTranslations = {\n  auth: {\n    errors: {\n      missingAccessToken: \"رمز الوصول مفقود.\",\n      invalidAccessToken: \"رمز الوصول غير صالح أو منتهي الصلاحية.\",\n      unauthorized: \"غير مصرح لك بالوصول إلى هذا المورد.\",\n      csrfOriginMismatch: \"مصدر الطلب غير مسموح به.\",\n      tooManyAttempts: \"محاولات كثيرة جدًا. يرجى المحاولة مرة أخرى لاحقًا.\",\n    },\n  },\n};\n"],"mappings":";;;;;AAMA,MAAa,yBAA2C,EACtD,MAAM,EACJ,QAAQ;CACN,oBAAoB;CACpB,oBAAoB;CACpB,cAAc;CACd,oBAAoB;CACpB,iBAAiB;AACnB,EACF,EACF"}
+{"version":3,"file":"ar.translations.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/localization/ar.translations.ts"],"sourcesContent":["import type { AuthTranslations } from \"./auth-translations.type\";\n\n/**\n * Built-in Arabic text for auth's translation keys. Applications override\n * any of these by registering the same key in their own locale files.\n */\nexport const authArabicTranslations: AuthTranslations = {\n  auth: {\n    errors: {\n      missingAccessToken: \"رمز الوصول مفقود.\",\n      invalidAccessToken: \"رمز الوصول غير صالح أو منتهي الصلاحية.\",\n      unauthorized: \"غير مصرح لك بالوصول إلى هذا المورد.\",\n      csrfOriginMismatch: \"مصدر الطلب غير مسموح به.\",\n      tooManyAttempts: \"محاولات كثيرة جدًا. يرجى المحاولة مرة أخرى لاحقًا.\",\n    },\n  },\n};\n"],"mappings":";;;;;AAMA,MAAa,yBAA2C,EACtD,MAAM,EACJ,QAAQ;CACN,oBAAoB;CACpB,oBAAoB;CACpB,cAAc;CACd,oBAAoB;CACpB,iBAAiB;AACnB,EACF,EACF"}

package/esm/localization/auth-default-translations.d.mts

@@ -1,6 +1,6 @@
 import { AuthTranslations } from "./auth-translations.type.mjs";
 
-//#region ../auth/src/localization/auth-default-translations.d.ts
+//#region ../../packages/auth/src/localization/auth-default-translations.d.ts
 /**
  * Every locale auth ships default text for, keyed by locale code.
  */

package/esm/localization/auth-default-translations.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-default-translations.d.mts","names":[],"sources":["../../../../../../../auth/src/localization/auth-default-translations.ts"],"mappings":";;;;;AAOA;cAAa,uBAAA,EAAyB,MAAM,SAAS,gBAAA"}
+{"version":3,"file":"auth-default-translations.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/localization/auth-default-translations.ts"],"mappings":";;;;;AAOA;cAAa,uBAAA,EAAyB,MAAM,SAAS,gBAAA"}

package/esm/localization/auth-default-translations.mjs

@@ -1,7 +1,7 @@
 import { authArabicTranslations } from "./ar.translations.mjs";
 import { authEnglishTranslations } from "./en.translations.mjs";
 
-//#region ../auth/src/localization/auth-default-translations.ts
+//#region ../../packages/auth/src/localization/auth-default-translations.ts
 /**
 * Every locale auth ships default text for, keyed by locale code.
 */

package/esm/localization/auth-default-translations.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-default-translations.mjs","names":[],"sources":["../../../../../../../auth/src/localization/auth-default-translations.ts"],"sourcesContent":["import { authArabicTranslations } from \"./ar.translations\";\nimport type { AuthTranslations } from \"./auth-translations.type\";\nimport { authEnglishTranslations } from \"./en.translations\";\n\n/**\n * Every locale auth ships default text for, keyed by locale code.\n */\nexport const authDefaultTranslations: Record<string, AuthTranslations> = {\n  en: authEnglishTranslations,\n  ar: authArabicTranslations,\n};\n"],"mappings":";;;;;;;AAOA,MAAa,0BAA4D;CACvE,IAAI;CACJ,IAAI;AACN"}
+{"version":3,"file":"auth-default-translations.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/localization/auth-default-translations.ts"],"sourcesContent":["import { authArabicTranslations } from \"./ar.translations\";\nimport type { AuthTranslations } from \"./auth-translations.type\";\nimport { authEnglishTranslations } from \"./en.translations\";\n\n/**\n * Every locale auth ships default text for, keyed by locale code.\n */\nexport const authDefaultTranslations: Record<string, AuthTranslations> = {\n  en: authEnglishTranslations,\n  ar: authArabicTranslations,\n};\n"],"mappings":";;;;;;;AAOA,MAAa,0BAA4D;CACvE,IAAI;CACJ,IAAI;AACN"}

package/esm/localization/auth-translations.type.d.mts

@@ -1,4 +1,4 @@
-//#region ../auth/src/localization/auth-translations.type.d.ts
+//#region ../../packages/auth/src/localization/auth-translations.type.d.ts
 /**
  * Text for every error key auth passes to `t()`.
  *

package/esm/localization/auth-translations.type.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-translations.type.d.mts","names":[],"sources":["../../../../../../../auth/src/localization/auth-translations.type.ts"],"mappings":";;AAOA;;;;;;KAAY,qBAAA;EAQV,oCANA,kBAAA,UAQe;EANf,kBAAA,UAaU;EAXV,YAAA;EAEA,kBAAA,UAUA;EARA,eAAA;AAAA;;AAS+B;;;KAFrB,gBAAA;EACV,IAAA;IACE,MAAA,EAAQ,qBAAqB;EAAA;AAAA"}
+{"version":3,"file":"auth-translations.type.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/localization/auth-translations.type.ts"],"mappings":";;AAOA;;;;;;KAAY,qBAAA;EAQV,oCANA,kBAAA,UAQe;EANf,kBAAA,UAaU;EAXV,YAAA;EAEA,kBAAA,UAUA;EARA,eAAA;AAAA;;AAS+B;;;KAFrB,gBAAA;EACV,IAAA;IACE,MAAA,EAAQ,qBAAqB;EAAA;AAAA"}

package/esm/localization/en.translations.mjs

@@ -1,4 +1,4 @@
-//#region ../auth/src/localization/en.translations.ts
+//#region ../../packages/auth/src/localization/en.translations.ts
 /**
 * Built-in English text for auth's translation keys. Applications override
 * any of these by registering the same key in their own locale files.

package/esm/localization/en.translations.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"en.translations.mjs","names":[],"sources":["../../../../../../../auth/src/localization/en.translations.ts"],"sourcesContent":["import type { AuthTranslations } from \"./auth-translations.type\";\n\n/**\n * Built-in English text for auth's translation keys. Applications override\n * any of these by registering the same key in their own locale files.\n */\nexport const authEnglishTranslations: AuthTranslations = {\n  auth: {\n    errors: {\n      missingAccessToken: \"Missing access token.\",\n      invalidAccessToken: \"Invalid or expired access token.\",\n      unauthorized: \"You are not authorized to access this resource.\",\n      csrfOriginMismatch: \"Request origin is not allowed.\",\n      tooManyAttempts: \"Too many attempts. Please try again later.\",\n    },\n  },\n};\n"],"mappings":";;;;;AAMA,MAAa,0BAA4C,EACvD,MAAM,EACJ,QAAQ;CACN,oBAAoB;CACpB,oBAAoB;CACpB,cAAc;CACd,oBAAoB;CACpB,iBAAiB;AACnB,EACF,EACF"}
+{"version":3,"file":"en.translations.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/localization/en.translations.ts"],"sourcesContent":["import type { AuthTranslations } from \"./auth-translations.type\";\n\n/**\n * Built-in English text for auth's translation keys. Applications override\n * any of these by registering the same key in their own locale files.\n */\nexport const authEnglishTranslations: AuthTranslations = {\n  auth: {\n    errors: {\n      missingAccessToken: \"Missing access token.\",\n      invalidAccessToken: \"Invalid or expired access token.\",\n      unauthorized: \"You are not authorized to access this resource.\",\n      csrfOriginMismatch: \"Request origin is not allowed.\",\n      tooManyAttempts: \"Too many attempts. Please try again later.\",\n    },\n  },\n};\n"],"mappings":";;;;;AAMA,MAAa,0BAA4C,EACvD,MAAM,EACJ,QAAQ;CACN,oBAAoB;CACpB,oBAAoB;CACpB,cAAc;CACd,oBAAoB;CACpB,iBAAiB;AACnB,EACF,EACF"}

package/esm/localization/init.mjs

@@ -1,6 +1,6 @@
 import { registerAuthTranslations } from "./register-auth-translations.mjs";
 
-//#region ../auth/src/localization/init.ts
+//#region ../../packages/auth/src/localization/init.ts
 registerAuthTranslations();
 
 //#endregion

package/esm/localization/init.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"init.mjs","names":[],"sources":["../../../../../../../auth/src/localization/init.ts"],"sourcesContent":["import { registerAuthTranslations } from \"./register-auth-translations\";\n\n// Side-effect module: importing `@warlock.js/auth` registers its default\n// translations, so `t(\"auth.errors.*\")` never returns the raw key.\nregisterAuthTranslations();\n"],"mappings":";;;AAIA,yBAAyB"}
+{"version":3,"file":"init.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/localization/init.ts"],"sourcesContent":["import { registerAuthTranslations } from \"./register-auth-translations\";\n\n// Side-effect module: importing `@warlock.js/auth` registers its default\n// translations, so `t(\"auth.errors.*\")` never returns the raw key.\nregisterAuthTranslations();\n"],"mappings":";;;AAIA,yBAAyB"}

package/esm/localization/register-auth-translations.d.mts

@@ -1,4 +1,4 @@
-//#region ../auth/src/localization/register-auth-translations.d.ts
+//#region ../../packages/auth/src/localization/register-auth-translations.d.ts
 /**
  * Register auth's built-in translations with `@mongez/localization`, the
  * same store `t()` from `@warlock.js/core` reads.

package/esm/localization/register-auth-translations.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"register-auth-translations.d.mts","names":[],"sources":["../../../../../../../auth/src/localization/register-auth-translations.ts"],"mappings":";;AAgBA;;;;AAAwC;;;;;;;iBAAxB,wBAAA"}
+{"version":3,"file":"register-auth-translations.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/localization/register-auth-translations.ts"],"mappings":";;AAgBA;;;;AAAwC;;;;;;;iBAAxB,wBAAA"}

package/esm/localization/register-auth-translations.mjs

@@ -2,7 +2,7 @@ import { authDefaultTranslations } from "./auth-default-translations.mjs";
 import { flatten, get, set } from "@mongez/reinforcements";
 import { extend, getKeywordsListOf } from "@warlock.js/core";
 
-//#region ../auth/src/localization/register-auth-translations.ts
+//#region ../../packages/auth/src/localization/register-auth-translations.ts
 /**
 * Register auth's built-in translations with `@mongez/localization`, the
 * same store `t()` from `@warlock.js/core` reads.

package/esm/localization/register-auth-translations.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"register-auth-translations.mjs","names":[],"sources":["../../../../../../../auth/src/localization/register-auth-translations.ts"],"sourcesContent":["import { flatten, get, set } from \"@mongez/reinforcements\";\nimport { extend, getKeywordsListOf, type Keywords } from \"@warlock.js/core\";\nimport { authDefaultTranslations } from \"./auth-default-translations\";\n\n/**\n * Register auth's built-in translations with `@mongez/localization`, the\n * same store `t()` from `@warlock.js/core` reads.\n *\n * Only keys the application has NOT already translated are added, so an app\n * translation wins regardless of load order: registered before this runs, it\n * is left untouched; registered after, `extend()` merges it over the default.\n * An app locale file that predates a newer auth key therefore gets the\n * default text for that key instead of the raw key string.\n *\n * Runs once at import of `@warlock.js/auth`; safe to call again.\n */\nexport function registerAuthTranslations(): void {\n  for (const [localeCode, translations] of Object.entries(authDefaultTranslations)) {\n    const existing = getKeywordsListOf(localeCode) ?? {};\n    const missing: Keywords = {};\n\n    for (const [key, text] of Object.entries(flatten(translations))) {\n      if (get(existing, key) === undefined) {\n        set(missing, key, text);\n      }\n    }\n\n    if (Object.keys(missing).length > 0) {\n      extend(localeCode, missing);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAgBA,SAAgB,2BAAiC;CAC/C,KAAK,MAAM,CAAC,YAAY,iBAAiB,OAAO,QAAQ,uBAAuB,GAAG;EAChF,MAAM,WAAW,kBAAkB,UAAU,KAAK,CAAC;EACnD,MAAM,UAAoB,CAAC;EAE3B,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,QAAQ,YAAY,CAAC,GAC5D,IAAI,IAAI,UAAU,GAAG,MAAM,QACzB,IAAI,SAAS,KAAK,IAAI;EAI1B,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,GAChC,OAAO,YAAY,OAAO;CAE9B;AACF"}
+{"version":3,"file":"register-auth-translations.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/localization/register-auth-translations.ts"],"sourcesContent":["import { flatten, get, set } from \"@mongez/reinforcements\";\nimport { extend, getKeywordsListOf, type Keywords } from \"@warlock.js/core\";\nimport { authDefaultTranslations } from \"./auth-default-translations\";\n\n/**\n * Register auth's built-in translations with `@mongez/localization`, the\n * same store `t()` from `@warlock.js/core` reads.\n *\n * Only keys the application has NOT already translated are added, so an app\n * translation wins regardless of load order: registered before this runs, it\n * is left untouched; registered after, `extend()` merges it over the default.\n * An app locale file that predates a newer auth key therefore gets the\n * default text for that key instead of the raw key string.\n *\n * Runs once at import of `@warlock.js/auth`; safe to call again.\n */\nexport function registerAuthTranslations(): void {\n  for (const [localeCode, translations] of Object.entries(authDefaultTranslations)) {\n    const existing = getKeywordsListOf(localeCode) ?? {};\n    const missing: Keywords = {};\n\n    for (const [key, text] of Object.entries(flatten(translations))) {\n      if (get(existing, key) === undefined) {\n        set(missing, key, text);\n      }\n    }\n\n    if (Object.keys(missing).length > 0) {\n      extend(localeCode, missing);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAgBA,SAAgB,2BAAiC;CAC/C,KAAK,MAAM,CAAC,YAAY,iBAAiB,OAAO,QAAQ,uBAAuB,GAAG;EAChF,MAAM,WAAW,kBAAkB,UAAU,KAAK,CAAC;EACnD,MAAM,UAAoB,CAAC;EAE3B,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,QAAQ,YAAY,CAAC,GAC5D,IAAI,IAAI,UAAU,GAAG,MAAM,QACzB,IAAI,SAAS,KAAK,IAAI;EAI1B,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,GAChC,OAAO,YAAY,OAAO;CAE9B;AACF"}

package/esm/middleware/auth.middleware.d.mts

@@ -1,7 +1,7 @@
 import { AuthMiddlewareOptions, TokenFrom } from "../contracts/types.mjs";
 import { Middleware } from "@warlock.js/core";
 
-//#region ../auth/src/middleware/auth.middleware.d.ts
+//#region ../../packages/auth/src/middleware/auth.middleware.d.ts
 /**
  * Well-known symbol under which `authMiddleware()` tags the middleware it
  * returns. Shared via the global symbol registry so other packages can read the

package/esm/middleware/auth.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"mappings":";;;;;;AAsBA;;;cAAa,0BAAA;AAAuD;AAAA,KAGxD,8BAAA;EAA8C,MAAM;AAAA;;AAAA;AAMhE;;KAAY,wBAAA;EAE6B,6EAAvC,OAAA,EAAS,8BAA8B,IAA9B;EAET,SAAA;AAAA;AAAS;AAoGX;;;;AAA4C;AAC5C;;;;;;;;AAA0E;AAC1E;;;;;;AAtGW,iBAoGK,cAAA,IAAkB,UAAU;AAAA,iBAC5B,cAAA,CAAe,OAAA,EAAS,qBAAA,GAAwB,UAAU;AAAA,iBAC1D,cAAA,CACd,eAAA,qBACA,OAAA,GAAU,qBAAA,GACT,UAAU;AAAA,iBACG,cAAA,CACd,eAAA,qBACA,SAAA,GAAY,SAAA,GACX,UAAU"}
+{"version":3,"file":"auth.middleware.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/auth.middleware.ts"],"mappings":";;;;;;AAsBA;;;cAAa,0BAAA;AAAuD;AAAA,KAGxD,8BAAA;EAA8C,MAAM;AAAA;;AAAA;AAMhE;;KAAY,wBAAA;EAE6B,6EAAvC,OAAA,EAAS,8BAA8B,IAA9B;EAET,SAAA;AAAA;AAAS;AAoGX;;;;AAA4C;AAC5C;;;;;;;;AAA0E;AAC1E;;;;;;AAtGW,iBAoGK,cAAA,IAAkB,UAAU;AAAA,iBAC5B,cAAA,CAAe,OAAA,EAAS,qBAAA,GAAwB,UAAU;AAAA,iBAC1D,cAAA,CACd,eAAA,qBACA,OAAA,GAAU,qBAAA,GACT,UAAU;AAAA,iBACG,cAAA,CACd,eAAA,qBACA,SAAA,GAAY,SAAA,GACX,UAAU"}

package/esm/middleware/auth.middleware.mjs

@@ -6,7 +6,7 @@ import { localizedLoginPath } from "./localized-login-path.mjs";
 import { config, t } from "@warlock.js/core";
 import { log } from "@warlock.js/logger";
 
-//#region ../auth/src/middleware/auth.middleware.ts
+//#region ../../packages/auth/src/middleware/auth.middleware.ts
 /**
 * Well-known symbol under which `authMiddleware()` tags the middleware it
 * returns. Shared via the global symbol registry so other packages can read the

package/esm/middleware/auth.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"sourcesContent":["import { config, type HttpContext, t, type Middleware } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport type {\n  AuthCredentialDescriptor,\n  AuthMiddlewareOptions,\n  TokenFrom,\n} from \"../contracts/types\";\nimport { authConfig } from \"../services/auth-config\";\nimport { readCredential, resolveRequestUserOutcome } from \"../services/resolve-request-user\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\nimport {\n  assertCsrfOriginAllowed,\n  CsrfOriginMismatchError,\n  requiresCsrfOriginCheck,\n} from \"./csrf-origin-check\";\nimport { localizedLoginPath } from \"./localized-login-path\";\n\n/**\n * Well-known symbol under which `authMiddleware()` tags the middleware it\n * returns. Shared via the global symbol registry so other packages can read the\n * descriptor structurally (`Symbol.for(\"warlock.auth\")`) without importing auth.\n */\nexport const AUTH_MIDDLEWARE_DESCRIPTOR = Symbol.for(\"warlock.auth\");\n\n/** A credential source an auth middleware reads: the Authorization header or a named cookie. */\nexport type AuthMiddlewareDescriptorSource = \"header\" | { cookie: string };\n\n/**\n * Frozen, JSON-safe description of how an `authMiddleware()` instance\n * authenticates, stored (non-enumerably) under {@link AUTH_MIDDLEWARE_DESCRIPTOR}.\n */\nexport type AuthMiddlewareDescriptor = {\n  /** Resolved credential sources; with dual sources the header comes first. */\n  sources: AuthMiddlewareDescriptorSource[];\n  /** Resolved allowed user types; an empty array means any authenticated user. */\n  userTypes: string[];\n};\n\n/** The 401 body shape every rejection in this middleware carries. */\ntype UnauthorizedPayload = { error: string; errorCode: string };\n\n/**\n * Reject an unauthenticated request, choosing the representation by ROUTE KIND.\n *\n * An API route always gets the JSON 401 it has always gotten. A PAGE route\n * (`request.route.isPage` — the React-SSR pages) instead redirects a logged-out\n * browser to the configured login path with a `returnUrl`, so a human\n * navigating to a guarded page lands on the login screen rather than reading a\n * raw JSON error blob — the defect in finding b9ab9804.\n *\n * The redirect is OPT-IN and backward-compatible: with no `auth.pageAuth.loginPath`\n * configured, even a page route falls back to the JSON 401, so an app that has\n * not asked for page-login UX keeps exactly its current behavior. The API 401\n * contract is never changed for API routes.\n *\n * `returnUrl` carries `request.url` — the relative path + query the browser was\n * on — never the absolute URL: a relative target cannot be turned into an\n * open-redirect off this app's origin.\n */\nfunction rejectUnauthorized(\n  { request, response }: HttpContext,\n  payload: UnauthorizedPayload,\n  redirect?: AuthMiddlewareOptions[\"redirect\"],\n) {\n  const loginPath = redirect?.to ?? authConfig.pageAuth.loginPath();\n  const returnUrlParam = redirect?.returnUrlParam ?? authConfig.pageAuth.returnUrlParam();\n\n  if (loginPath && request.route?.isPage) {\n    // Under an active `web.localeRouting` strategy, the login destination\n    // itself must carry the request's locale prefix — otherwise an anonymous\n    // `/ar/admin` bounces to the DEFAULT locale's `/login` rather than\n    // `/ar/login`, even though `returnUrl` below correctly points back at\n    // `/ar/admin`. See `./localized-login-path.ts`.\n    const destination = localizedLoginPath(loginPath, request.locale);\n    const separator = destination.includes(\"?\") ? \"&\" : \"?\";\n    const returnUrl = encodeURIComponent(request.url);\n\n    return response.redirect(`${destination}${separator}${returnUrlParam}=${returnUrl}`);\n  }\n\n  return response.unauthorized(payload);\n}\n\nfunction tokenFromDescriptor(descriptor: Partial<AuthCredentialDescriptor>): TokenFrom {\n  if (!descriptor.source || descriptor.source === \"header\") return \"header\";\n\n  if (!descriptor.key) {\n    throw new Error(\"authMiddleware cookie credentials require a cookie key.\");\n  }\n\n  return `cookie:${descriptor.key}`;\n}\n\nfunction descriptorSource(tokenFrom: TokenFrom): AuthMiddlewareDescriptorSource {\n  return tokenFrom === \"header\" ? \"header\" : { cookie: tokenFrom.slice(\"cookie:\".length) };\n}\n\nfunction resolveAllowedTypes(value: string | string[] | undefined): string[] {\n  if (value !== undefined) return Array.isArray(value) ? value : [value];\n\n  const configuredDefault = config.key(\"auth.defaultUserType\") as string | undefined;\n\n  if (configuredDefault) return [configuredDefault];\n\n  const userTypes = config.key(\"auth.userType\", {}) as Record<string, unknown>;\n  const configuredTypes = Object.keys(userTypes);\n\n  if (configuredTypes.length === 1) return configuredTypes;\n\n  throw new Error(\n    \"authMiddleware requires a user type when auth.defaultUserType is unset and multiple user types exist.\",\n  );\n}\n\n/**\n * Build a route gate. Authentication is required unless optional is explicit.\n *\n * An omitted user type selects the configured default; an explicit argument\n * selects which user types may pass:\n * - `[]` — any authenticated user (token required, type not checked).\n * - `\"admin\"` / `[\"admin\", \"staff\"]` — token required AND the user's\n *   `userType` must be one of the listed types.\n *\n * `{ optional: true }` allows anonymous requests. All other forms reject\n * missing or invalid credentials with 401, or a configured page redirect.\n *\n * `tokenFrom` selects one credential source and defaults to `\"header\"`.\n * A single source avoids making credential precedence depend on array order.\n *\n * @example\n * router.get(\"/account\", authMiddleware([]), accountController);\n * router.get(\"/admin\", authMiddleware(\"admin\"), adminController);\n * router.get(\"/back-office\", authMiddleware([\"admin\", \"staff\"]), backOfficeController);\n * router.get(\"/browser-account\", authMiddleware([], \"cookie:token\"), accountController);\n */\nexport function authMiddleware(): Middleware;\nexport function authMiddleware(options: AuthMiddlewareOptions): Middleware;\nexport function authMiddleware(\n  allowedUserType: string | string[],\n  options?: AuthMiddlewareOptions,\n): Middleware;\nexport function authMiddleware(\n  allowedUserType: string | string[],\n  tokenFrom?: TokenFrom,\n): Middleware;\nexport function authMiddleware(\n  userTypeOrOptions?: string | string[] | AuthMiddlewareOptions,\n  legacyTokenFromOrOptions?: TokenFrom | AuthMiddlewareOptions,\n): Middleware {\n  const options =\n    typeof userTypeOrOptions === \"object\" && !Array.isArray(userTypeOrOptions)\n      ? userTypeOrOptions\n      : typeof legacyTokenFromOrOptions === \"object\"\n        ? legacyTokenFromOrOptions\n        : undefined;\n  const selectedUserType =\n    typeof userTypeOrOptions === \"string\" || Array.isArray(userTypeOrOptions)\n      ? userTypeOrOptions\n      : undefined;\n  const allowedTypes = resolveAllowedTypes(selectedUserType);\n  const legacyTokenFrom =\n    typeof legacyTokenFromOrOptions === \"string\" ? legacyTokenFromOrOptions : undefined;\n  const dualSources = options?.sources?.length ? options.sources.map(tokenFromDescriptor) : undefined;\n\n  if (dualSources && options?.source) {\n    throw new Error(\"authMiddleware accepts either `source` or `sources`, not both.\");\n  }\n\n  const dualHeader = dualSources?.includes(\"header\") ?? false;\n  const dualCookies = dualSources?.filter(source => source !== \"header\") ?? [];\n\n  if (dualSources && (dualCookies.length > 1 || dualSources.length - dualCookies.length > 1)) {\n    throw new Error(\"authMiddleware `sources` accepts at most one header and one cookie.\");\n  }\n\n  // With dual sources the configured cookie is the base credential; the header\n  // is chosen per request, ahead of it.\n  const cookieTokenFrom: TokenFrom = dualSources\n    ? (dualCookies[0] ?? \"header\")\n    : options\n      ? tokenFromDescriptor(options)\n      : (legacyTokenFrom ?? \"header\");\n  const tokenFrom = cookieTokenFrom;\n  const refreshCredential = options?.refresh ? tokenFromDescriptor(options.refresh) : undefined;\n  const renewalUserType = allowedTypes.length === 1 ? allowedTypes[0] : undefined;\n\n  if (\n    refreshCredential &&\n    (tokenFrom === \"header\" || refreshCredential === \"header\" || !renewalUserType)\n  ) {\n    throw new Error(\n      \"authMiddleware automatic renewal requires one allowed user type and cookie access and refresh credentials.\",\n    );\n  }\n\n  const optional = options?.optional === true;\n\n  const auth: Middleware = async ({ request, response }) => {\n    const reject = (payload: UnauthorizedPayload) =>\n      rejectUnauthorized({ request, response }, payload, options?.redirect);\n\n    // A present Authorization header always wins and never falls back to the\n    // cookie: the credential used is the header, so no renewal and no CSRF check.\n    const headerWins = dualHeader && Boolean(request.authorizationValue);\n    const usedTokenFrom: TokenFrom = headerWins ? \"header\" : tokenFrom;\n    const usedRefresh = headerWins ? undefined : refreshCredential;\n\n    // Renewal can mint cookies, so a cookie-authenticated unsafe request must\n    // pass the same CSRF check even when its access cookie is missing.\n    if (\n      (readCredential(request, usedTokenFrom) ||\n        (usedRefresh && readCredential(request, usedRefresh))) &&\n      requiresCsrfOriginCheck(usedTokenFrom, request.method)\n    ) {\n      try {\n        assertCsrfOriginAllowed(request);\n      } catch (error) {\n        if (!(error instanceof CsrfOriginMismatchError)) throw error;\n\n        log.error(\"http\", \"auth\", error);\n        return response.forbidden({\n          error: t(\"auth.errors.csrfOriginMismatch\"),\n          errorCode: AuthErrorCodes.CsrfOriginMismatch,\n        });\n      }\n    }\n\n    const outcome = await resolveRequestUserOutcome(request, response, {\n      tokenFrom: usedTokenFrom,\n      refreshCredential: usedRefresh,\n      overlapMs: options?.refresh?.overlapMs,\n      allowedTypes,\n      renewalUserType,\n    });\n\n    if (outcome.user) {\n      request.locals.user = outcome.user;\n      return;\n    }\n\n    if (outcome.failure === \"forbidden\") {\n      return response.forbidden({\n        error: t(\"auth.errors.unauthorized\"),\n        errorCode: AuthErrorCodes.Unauthorized,\n      });\n    }\n\n    if (optional) return;\n\n    if (outcome.failure === \"missing\") {\n      return reject({\n        error: t(\"auth.errors.missingAccessToken\"),\n        errorCode: AuthErrorCodes.MissingAccessToken,\n      });\n    }\n\n    if (outcome.failure === \"unauthorized\") {\n      return reject({\n        error: t(\"auth.errors.unauthorized\"),\n        errorCode: AuthErrorCodes.Unauthorized,\n      });\n    }\n\n    return reject({\n      error: t(\"auth.errors.invalidAccessToken\"),\n      errorCode: AuthErrorCodes.InvalidAccessToken,\n    });\n  };\n\n  const descriptorSources: AuthMiddlewareDescriptorSource[] = dualSources\n    ? [...(dualHeader ? ([\"header\"] as const) : []), ...dualCookies.map(descriptorSource)]\n    : [descriptorSource(tokenFrom)];\n  const descriptor: AuthMiddlewareDescriptor = Object.freeze({\n    sources: Object.freeze(descriptorSources.map(source =>\n      typeof source === \"string\" ? source : Object.freeze({ ...source }),\n    )) as AuthMiddlewareDescriptorSource[],\n    userTypes: Object.freeze([...allowedTypes]) as string[],\n  });\n\n  // Non-enumerable so the tag never shows up in logs, spreads or JSON.\n  Object.defineProperty(auth, AUTH_MIDDLEWARE_DESCRIPTOR, { value: descriptor, enumerable: false });\n\n  return auth;\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,MAAa,6BAA6B,OAAO,IAAI,cAAc;;;;;;;;;;;;;;;;;;;AAqCnE,SAAS,mBACP,EAAE,SAAS,YACX,SACA,UACA;CACA,MAAM,YAAY,UAAU,MAAM,WAAW,SAAS,UAAU;CAChE,MAAM,iBAAiB,UAAU,kBAAkB,WAAW,SAAS,eAAe;CAEtF,IAAI,aAAa,QAAQ,OAAO,QAAQ;EAMtC,MAAM,cAAc,mBAAmB,WAAW,QAAQ,MAAM;EAChE,MAAM,YAAY,YAAY,SAAS,GAAG,IAAI,MAAM;EACpD,MAAM,YAAY,mBAAmB,QAAQ,GAAG;EAEhD,OAAO,SAAS,SAAS,GAAG,cAAc,YAAY,eAAe,GAAG,WAAW;CACrF;CAEA,OAAO,SAAS,aAAa,OAAO;AACtC;AAEA,SAAS,oBAAoB,YAA0D;CACrF,IAAI,CAAC,WAAW,UAAU,WAAW,WAAW,UAAU,OAAO;CAEjE,IAAI,CAAC,WAAW,KACd,MAAM,IAAI,MAAM,yDAAyD;CAG3E,OAAO,UAAU,WAAW;AAC9B;AAEA,SAAS,iBAAiB,WAAsD;CAC9E,OAAO,cAAc,WAAW,WAAW,EAAE,QAAQ,UAAU,MAAM,CAAgB,EAAE;AACzF;AAEA,SAAS,oBAAoB,OAAgD;CAC3E,IAAI,UAAU,QAAW,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;CAErE,MAAM,oBAAoB,OAAO,IAAI,sBAAsB;CAE3D,IAAI,mBAAmB,OAAO,CAAC,iBAAiB;CAEhD,MAAM,YAAY,OAAO,IAAI,iBAAiB,CAAC,CAAC;CAChD,MAAM,kBAAkB,OAAO,KAAK,SAAS;CAE7C,IAAI,gBAAgB,WAAW,GAAG,OAAO;CAEzC,MAAM,IAAI,MACR,uGACF;AACF;AAiCA,SAAgB,eACd,mBACA,0BACY;CACZ,MAAM,UACJ,OAAO,sBAAsB,YAAY,CAAC,MAAM,QAAQ,iBAAiB,IACrE,oBACA,OAAO,6BAA6B,WAClC,2BACA;CAKR,MAAM,eAAe,oBAHnB,OAAO,sBAAsB,YAAY,MAAM,QAAQ,iBAAiB,IACpE,oBACA,MACmD;CACzD,MAAM,kBACJ,OAAO,6BAA6B,WAAW,2BAA2B;CAC5E,MAAM,cAAc,SAAS,SAAS,SAAS,QAAQ,QAAQ,IAAI,mBAAmB,IAAI;CAE1F,IAAI,eAAe,SAAS,QAC1B,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAM,aAAa,aAAa,SAAS,QAAQ,KAAK;CACtD,MAAM,cAAc,aAAa,QAAO,WAAU,WAAW,QAAQ,KAAK,CAAC;CAE3E,IAAI,gBAAgB,YAAY,SAAS,KAAK,YAAY,SAAS,YAAY,SAAS,IACtF,MAAM,IAAI,MAAM,qEAAqE;CAUvF,MAAM,YAL6B,cAC9B,YAAY,MAAM,WACnB,UACE,oBAAoB,OAAO,IAC1B,mBAAmB;CAE1B,MAAM,oBAAoB,SAAS,UAAU,oBAAoB,QAAQ,OAAO,IAAI;CACpF,MAAM,kBAAkB,aAAa,WAAW,IAAI,aAAa,KAAK;CAEtE,IACE,sBACC,cAAc,YAAY,sBAAsB,YAAY,CAAC,kBAE9D,MAAM,IAAI,MACR,4GACF;CAGF,MAAM,WAAW,SAAS,aAAa;CAEvC,MAAM,OAAmB,OAAO,EAAE,SAAS,eAAe;EACxD,MAAM,UAAU,YACd,mBAAmB;GAAE;GAAS;EAAS,GAAG,SAAS,SAAS,QAAQ;EAItE,MAAM,aAAa,cAAc,QAAQ,QAAQ,kBAAkB;EACnE,MAAM,gBAA2B,aAAa,WAAW;EACzD,MAAM,cAAc,aAAa,SAAY;EAI7C,KACG,eAAe,SAAS,aAAa,KACnC,eAAe,eAAe,SAAS,WAAW,MACrD,wBAAwB,eAAe,QAAQ,MAAM,GAErD,IAAI;GACF,wBAAwB,OAAO;EACjC,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,0BAA0B,MAAM;GAEvD,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAC/B,OAAO,SAAS,UAAU;IACxB,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAGF,MAAM,UAAU,MAAM,0BAA0B,SAAS,UAAU;GACjE,WAAW;GACX,mBAAmB;GACnB,WAAW,SAAS,SAAS;GAC7B;GACA;EACF,CAAC;EAED,IAAI,QAAQ,MAAM;GAChB,QAAQ,OAAO,OAAO,QAAQ;GAC9B;EACF;EAEA,IAAI,QAAQ,YAAY,aACtB,OAAO,SAAS,UAAU;GACxB,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,IAAI,UAAU;EAEd,IAAI,QAAQ,YAAY,WACtB,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;EAGH,IAAI,QAAQ,YAAY,gBACtB,OAAO,OAAO;GACZ,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;CACH;CAEA,MAAM,oBAAsD,cACxD,CAAC,GAAI,aAAc,CAAC,QAAQ,IAAc,CAAC,GAAI,GAAG,YAAY,IAAI,gBAAgB,CAAC,IACnF,CAAC,iBAAiB,SAAS,CAAC;CAChC,MAAM,aAAuC,OAAO,OAAO;EACzD,SAAS,OAAO,OAAO,kBAAkB,KAAI,WAC3C,OAAO,WAAW,WAAW,SAAS,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC,CACnE,CAAC;EACD,WAAW,OAAO,OAAO,CAAC,GAAG,YAAY,CAAC;CAC5C,CAAC;CAGD,OAAO,eAAe,MAAM,4BAA4B;EAAE,OAAO;EAAY,YAAY;CAAM,CAAC;CAEhG,OAAO;AACT"}
+{"version":3,"file":"auth.middleware.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/auth.middleware.ts"],"sourcesContent":["import { config, type HttpContext, t, type Middleware } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport type {\n  AuthCredentialDescriptor,\n  AuthMiddlewareOptions,\n  TokenFrom,\n} from \"../contracts/types\";\nimport { authConfig } from \"../services/auth-config\";\nimport { readCredential, resolveRequestUserOutcome } from \"../services/resolve-request-user\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\nimport {\n  assertCsrfOriginAllowed,\n  CsrfOriginMismatchError,\n  requiresCsrfOriginCheck,\n} from \"./csrf-origin-check\";\nimport { localizedLoginPath } from \"./localized-login-path\";\n\n/**\n * Well-known symbol under which `authMiddleware()` tags the middleware it\n * returns. Shared via the global symbol registry so other packages can read the\n * descriptor structurally (`Symbol.for(\"warlock.auth\")`) without importing auth.\n */\nexport const AUTH_MIDDLEWARE_DESCRIPTOR = Symbol.for(\"warlock.auth\");\n\n/** A credential source an auth middleware reads: the Authorization header or a named cookie. */\nexport type AuthMiddlewareDescriptorSource = \"header\" | { cookie: string };\n\n/**\n * Frozen, JSON-safe description of how an `authMiddleware()` instance\n * authenticates, stored (non-enumerably) under {@link AUTH_MIDDLEWARE_DESCRIPTOR}.\n */\nexport type AuthMiddlewareDescriptor = {\n  /** Resolved credential sources; with dual sources the header comes first. */\n  sources: AuthMiddlewareDescriptorSource[];\n  /** Resolved allowed user types; an empty array means any authenticated user. */\n  userTypes: string[];\n};\n\n/** The 401 body shape every rejection in this middleware carries. */\ntype UnauthorizedPayload = { error: string; errorCode: string };\n\n/**\n * Reject an unauthenticated request, choosing the representation by ROUTE KIND.\n *\n * An API route always gets the JSON 401 it has always gotten. A PAGE route\n * (`request.route.isPage` — the React-SSR pages) instead redirects a logged-out\n * browser to the configured login path with a `returnUrl`, so a human\n * navigating to a guarded page lands on the login screen rather than reading a\n * raw JSON error blob — the defect in finding b9ab9804.\n *\n * The redirect is OPT-IN and backward-compatible: with no `auth.pageAuth.loginPath`\n * configured, even a page route falls back to the JSON 401, so an app that has\n * not asked for page-login UX keeps exactly its current behavior. The API 401\n * contract is never changed for API routes.\n *\n * `returnUrl` carries `request.url` — the relative path + query the browser was\n * on — never the absolute URL: a relative target cannot be turned into an\n * open-redirect off this app's origin.\n */\nfunction rejectUnauthorized(\n  { request, response }: HttpContext,\n  payload: UnauthorizedPayload,\n  redirect?: AuthMiddlewareOptions[\"redirect\"],\n) {\n  const loginPath = redirect?.to ?? authConfig.pageAuth.loginPath();\n  const returnUrlParam = redirect?.returnUrlParam ?? authConfig.pageAuth.returnUrlParam();\n\n  if (loginPath && request.route?.isPage) {\n    // Under an active `web.localeRouting` strategy, the login destination\n    // itself must carry the request's locale prefix — otherwise an anonymous\n    // `/ar/admin` bounces to the DEFAULT locale's `/login` rather than\n    // `/ar/login`, even though `returnUrl` below correctly points back at\n    // `/ar/admin`. See `./localized-login-path.ts`.\n    const destination = localizedLoginPath(loginPath, request.locale);\n    const separator = destination.includes(\"?\") ? \"&\" : \"?\";\n    const returnUrl = encodeURIComponent(request.url);\n\n    return response.redirect(`${destination}${separator}${returnUrlParam}=${returnUrl}`);\n  }\n\n  return response.unauthorized(payload);\n}\n\nfunction tokenFromDescriptor(descriptor: Partial<AuthCredentialDescriptor>): TokenFrom {\n  if (!descriptor.source || descriptor.source === \"header\") return \"header\";\n\n  if (!descriptor.key) {\n    throw new Error(\"authMiddleware cookie credentials require a cookie key.\");\n  }\n\n  return `cookie:${descriptor.key}`;\n}\n\nfunction descriptorSource(tokenFrom: TokenFrom): AuthMiddlewareDescriptorSource {\n  return tokenFrom === \"header\" ? \"header\" : { cookie: tokenFrom.slice(\"cookie:\".length) };\n}\n\nfunction resolveAllowedTypes(value: string | string[] | undefined): string[] {\n  if (value !== undefined) return Array.isArray(value) ? value : [value];\n\n  const configuredDefault = config.key(\"auth.defaultUserType\") as string | undefined;\n\n  if (configuredDefault) return [configuredDefault];\n\n  const userTypes = config.key(\"auth.userType\", {}) as Record<string, unknown>;\n  const configuredTypes = Object.keys(userTypes);\n\n  if (configuredTypes.length === 1) return configuredTypes;\n\n  throw new Error(\n    \"authMiddleware requires a user type when auth.defaultUserType is unset and multiple user types exist.\",\n  );\n}\n\n/**\n * Build a route gate. Authentication is required unless optional is explicit.\n *\n * An omitted user type selects the configured default; an explicit argument\n * selects which user types may pass:\n * - `[]` — any authenticated user (token required, type not checked).\n * - `\"admin\"` / `[\"admin\", \"staff\"]` — token required AND the user's\n *   `userType` must be one of the listed types.\n *\n * `{ optional: true }` allows anonymous requests. All other forms reject\n * missing or invalid credentials with 401, or a configured page redirect.\n *\n * `tokenFrom` selects one credential source and defaults to `\"header\"`.\n * A single source avoids making credential precedence depend on array order.\n *\n * @example\n * router.get(\"/account\", authMiddleware([]), accountController);\n * router.get(\"/admin\", authMiddleware(\"admin\"), adminController);\n * router.get(\"/back-office\", authMiddleware([\"admin\", \"staff\"]), backOfficeController);\n * router.get(\"/browser-account\", authMiddleware([], \"cookie:token\"), accountController);\n */\nexport function authMiddleware(): Middleware;\nexport function authMiddleware(options: AuthMiddlewareOptions): Middleware;\nexport function authMiddleware(\n  allowedUserType: string | string[],\n  options?: AuthMiddlewareOptions,\n): Middleware;\nexport function authMiddleware(\n  allowedUserType: string | string[],\n  tokenFrom?: TokenFrom,\n): Middleware;\nexport function authMiddleware(\n  userTypeOrOptions?: string | string[] | AuthMiddlewareOptions,\n  legacyTokenFromOrOptions?: TokenFrom | AuthMiddlewareOptions,\n): Middleware {\n  const options =\n    typeof userTypeOrOptions === \"object\" && !Array.isArray(userTypeOrOptions)\n      ? userTypeOrOptions\n      : typeof legacyTokenFromOrOptions === \"object\"\n        ? legacyTokenFromOrOptions\n        : undefined;\n  const selectedUserType =\n    typeof userTypeOrOptions === \"string\" || Array.isArray(userTypeOrOptions)\n      ? userTypeOrOptions\n      : undefined;\n  const allowedTypes = resolveAllowedTypes(selectedUserType);\n  const legacyTokenFrom =\n    typeof legacyTokenFromOrOptions === \"string\" ? legacyTokenFromOrOptions : undefined;\n  const dualSources = options?.sources?.length ? options.sources.map(tokenFromDescriptor) : undefined;\n\n  if (dualSources && options?.source) {\n    throw new Error(\"authMiddleware accepts either `source` or `sources`, not both.\");\n  }\n\n  const dualHeader = dualSources?.includes(\"header\") ?? false;\n  const dualCookies = dualSources?.filter(source => source !== \"header\") ?? [];\n\n  if (dualSources && (dualCookies.length > 1 || dualSources.length - dualCookies.length > 1)) {\n    throw new Error(\"authMiddleware `sources` accepts at most one header and one cookie.\");\n  }\n\n  // With dual sources the configured cookie is the base credential; the header\n  // is chosen per request, ahead of it.\n  const cookieTokenFrom: TokenFrom = dualSources\n    ? (dualCookies[0] ?? \"header\")\n    : options\n      ? tokenFromDescriptor(options)\n      : (legacyTokenFrom ?? \"header\");\n  const tokenFrom = cookieTokenFrom;\n  const refreshCredential = options?.refresh ? tokenFromDescriptor(options.refresh) : undefined;\n  const renewalUserType = allowedTypes.length === 1 ? allowedTypes[0] : undefined;\n\n  if (\n    refreshCredential &&\n    (tokenFrom === \"header\" || refreshCredential === \"header\" || !renewalUserType)\n  ) {\n    throw new Error(\n      \"authMiddleware automatic renewal requires one allowed user type and cookie access and refresh credentials.\",\n    );\n  }\n\n  const optional = options?.optional === true;\n\n  const auth: Middleware = async ({ request, response }) => {\n    const reject = (payload: UnauthorizedPayload) =>\n      rejectUnauthorized({ request, response }, payload, options?.redirect);\n\n    // A present Authorization header always wins and never falls back to the\n    // cookie: the credential used is the header, so no renewal and no CSRF check.\n    const headerWins = dualHeader && Boolean(request.authorizationValue);\n    const usedTokenFrom: TokenFrom = headerWins ? \"header\" : tokenFrom;\n    const usedRefresh = headerWins ? undefined : refreshCredential;\n\n    // Renewal can mint cookies, so a cookie-authenticated unsafe request must\n    // pass the same CSRF check even when its access cookie is missing.\n    if (\n      (readCredential(request, usedTokenFrom) ||\n        (usedRefresh && readCredential(request, usedRefresh))) &&\n      requiresCsrfOriginCheck(usedTokenFrom, request.method)\n    ) {\n      try {\n        assertCsrfOriginAllowed(request);\n      } catch (error) {\n        if (!(error instanceof CsrfOriginMismatchError)) throw error;\n\n        log.error(\"http\", \"auth\", error);\n        return response.forbidden({\n          error: t(\"auth.errors.csrfOriginMismatch\"),\n          errorCode: AuthErrorCodes.CsrfOriginMismatch,\n        });\n      }\n    }\n\n    const outcome = await resolveRequestUserOutcome(request, response, {\n      tokenFrom: usedTokenFrom,\n      refreshCredential: usedRefresh,\n      overlapMs: options?.refresh?.overlapMs,\n      allowedTypes,\n      renewalUserType,\n    });\n\n    if (outcome.user) {\n      request.locals.user = outcome.user;\n      return;\n    }\n\n    if (outcome.failure === \"forbidden\") {\n      return response.forbidden({\n        error: t(\"auth.errors.unauthorized\"),\n        errorCode: AuthErrorCodes.Unauthorized,\n      });\n    }\n\n    if (optional) return;\n\n    if (outcome.failure === \"missing\") {\n      return reject({\n        error: t(\"auth.errors.missingAccessToken\"),\n        errorCode: AuthErrorCodes.MissingAccessToken,\n      });\n    }\n\n    if (outcome.failure === \"unauthorized\") {\n      return reject({\n        error: t(\"auth.errors.unauthorized\"),\n        errorCode: AuthErrorCodes.Unauthorized,\n      });\n    }\n\n    return reject({\n      error: t(\"auth.errors.invalidAccessToken\"),\n      errorCode: AuthErrorCodes.InvalidAccessToken,\n    });\n  };\n\n  const descriptorSources: AuthMiddlewareDescriptorSource[] = dualSources\n    ? [...(dualHeader ? ([\"header\"] as const) : []), ...dualCookies.map(descriptorSource)]\n    : [descriptorSource(tokenFrom)];\n  const descriptor: AuthMiddlewareDescriptor = Object.freeze({\n    sources: Object.freeze(descriptorSources.map(source =>\n      typeof source === \"string\" ? source : Object.freeze({ ...source }),\n    )) as AuthMiddlewareDescriptorSource[],\n    userTypes: Object.freeze([...allowedTypes]) as string[],\n  });\n\n  // Non-enumerable so the tag never shows up in logs, spreads or JSON.\n  Object.defineProperty(auth, AUTH_MIDDLEWARE_DESCRIPTOR, { value: descriptor, enumerable: false });\n\n  return auth;\n}\n"],"mappings":";;;;;;;;;;;;;;AAsBA,MAAa,6BAA6B,OAAO,IAAI,cAAc;;;;;;;;;;;;;;;;;;;AAqCnE,SAAS,mBACP,EAAE,SAAS,YACX,SACA,UACA;CACA,MAAM,YAAY,UAAU,MAAM,WAAW,SAAS,UAAU;CAChE,MAAM,iBAAiB,UAAU,kBAAkB,WAAW,SAAS,eAAe;CAEtF,IAAI,aAAa,QAAQ,OAAO,QAAQ;EAMtC,MAAM,cAAc,mBAAmB,WAAW,QAAQ,MAAM;EAChE,MAAM,YAAY,YAAY,SAAS,GAAG,IAAI,MAAM;EACpD,MAAM,YAAY,mBAAmB,QAAQ,GAAG;EAEhD,OAAO,SAAS,SAAS,GAAG,cAAc,YAAY,eAAe,GAAG,WAAW;CACrF;CAEA,OAAO,SAAS,aAAa,OAAO;AACtC;AAEA,SAAS,oBAAoB,YAA0D;CACrF,IAAI,CAAC,WAAW,UAAU,WAAW,WAAW,UAAU,OAAO;CAEjE,IAAI,CAAC,WAAW,KACd,MAAM,IAAI,MAAM,yDAAyD;CAG3E,OAAO,UAAU,WAAW;AAC9B;AAEA,SAAS,iBAAiB,WAAsD;CAC9E,OAAO,cAAc,WAAW,WAAW,EAAE,QAAQ,UAAU,MAAM,CAAgB,EAAE;AACzF;AAEA,SAAS,oBAAoB,OAAgD;CAC3E,IAAI,UAAU,QAAW,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;CAErE,MAAM,oBAAoB,OAAO,IAAI,sBAAsB;CAE3D,IAAI,mBAAmB,OAAO,CAAC,iBAAiB;CAEhD,MAAM,YAAY,OAAO,IAAI,iBAAiB,CAAC,CAAC;CAChD,MAAM,kBAAkB,OAAO,KAAK,SAAS;CAE7C,IAAI,gBAAgB,WAAW,GAAG,OAAO;CAEzC,MAAM,IAAI,MACR,uGACF;AACF;AAiCA,SAAgB,eACd,mBACA,0BACY;CACZ,MAAM,UACJ,OAAO,sBAAsB,YAAY,CAAC,MAAM,QAAQ,iBAAiB,IACrE,oBACA,OAAO,6BAA6B,WAClC,2BACA;CAKR,MAAM,eAAe,oBAHnB,OAAO,sBAAsB,YAAY,MAAM,QAAQ,iBAAiB,IACpE,oBACA,MACmD;CACzD,MAAM,kBACJ,OAAO,6BAA6B,WAAW,2BAA2B;CAC5E,MAAM,cAAc,SAAS,SAAS,SAAS,QAAQ,QAAQ,IAAI,mBAAmB,IAAI;CAE1F,IAAI,eAAe,SAAS,QAC1B,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAM,aAAa,aAAa,SAAS,QAAQ,KAAK;CACtD,MAAM,cAAc,aAAa,QAAO,WAAU,WAAW,QAAQ,KAAK,CAAC;CAE3E,IAAI,gBAAgB,YAAY,SAAS,KAAK,YAAY,SAAS,YAAY,SAAS,IACtF,MAAM,IAAI,MAAM,qEAAqE;CAUvF,MAAM,YAL6B,cAC9B,YAAY,MAAM,WACnB,UACE,oBAAoB,OAAO,IAC1B,mBAAmB;CAE1B,MAAM,oBAAoB,SAAS,UAAU,oBAAoB,QAAQ,OAAO,IAAI;CACpF,MAAM,kBAAkB,aAAa,WAAW,IAAI,aAAa,KAAK;CAEtE,IACE,sBACC,cAAc,YAAY,sBAAsB,YAAY,CAAC,kBAE9D,MAAM,IAAI,MACR,4GACF;CAGF,MAAM,WAAW,SAAS,aAAa;CAEvC,MAAM,OAAmB,OAAO,EAAE,SAAS,eAAe;EACxD,MAAM,UAAU,YACd,mBAAmB;GAAE;GAAS;EAAS,GAAG,SAAS,SAAS,QAAQ;EAItE,MAAM,aAAa,cAAc,QAAQ,QAAQ,kBAAkB;EACnE,MAAM,gBAA2B,aAAa,WAAW;EACzD,MAAM,cAAc,aAAa,SAAY;EAI7C,KACG,eAAe,SAAS,aAAa,KACnC,eAAe,eAAe,SAAS,WAAW,MACrD,wBAAwB,eAAe,QAAQ,MAAM,GAErD,IAAI;GACF,wBAAwB,OAAO;EACjC,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,0BAA0B,MAAM;GAEvD,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAC/B,OAAO,SAAS,UAAU;IACxB,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAGF,MAAM,UAAU,MAAM,0BAA0B,SAAS,UAAU;GACjE,WAAW;GACX,mBAAmB;GACnB,WAAW,SAAS,SAAS;GAC7B;GACA;EACF,CAAC;EAED,IAAI,QAAQ,MAAM;GAChB,QAAQ,OAAO,OAAO,QAAQ;GAC9B;EACF;EAEA,IAAI,QAAQ,YAAY,aACtB,OAAO,SAAS,UAAU;GACxB,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,IAAI,UAAU;EAEd,IAAI,QAAQ,YAAY,WACtB,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;EAGH,IAAI,QAAQ,YAAY,gBACtB,OAAO,OAAO;GACZ,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;CACH;CAEA,MAAM,oBAAsD,cACxD,CAAC,GAAI,aAAc,CAAC,QAAQ,IAAc,CAAC,GAAI,GAAG,YAAY,IAAI,gBAAgB,CAAC,IACnF,CAAC,iBAAiB,SAAS,CAAC;CAChC,MAAM,aAAuC,OAAO,OAAO;EACzD,SAAS,OAAO,OAAO,kBAAkB,KAAI,WAC3C,OAAO,WAAW,WAAW,SAAS,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC,CACnE,CAAC;EACD,WAAW,OAAO,OAAO,CAAC,GAAG,YAAY,CAAC;CAC5C,CAAC;CAGD,OAAO,eAAe,MAAM,4BAA4B;EAAE,OAAO;EAAY,YAAY;CAAM,CAAC;CAEhG,OAAO;AACT"}

package/esm/middleware/csrf-origin-check.d.mts

@@ -2,7 +2,7 @@ import { TokenFrom } from "../contracts/types.mjs";
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { Request } from "@warlock.js/core";
 
-//#region ../auth/src/middleware/csrf-origin-check.d.ts
+//#region ../../packages/auth/src/middleware/csrf-origin-check.d.ts
 /** Why {@link assertCsrfOriginAllowed} refused a request. */
 type CsrfOriginMismatchReason = "origin-mismatch" | "referer-mismatch" | "missing-origin-and-referer";
 /**

package/esm/middleware/csrf-origin-check.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-origin-check.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/csrf-origin-check.ts"],"mappings":";;;;;;KAQY,wBAAA;AAAZ;;;;AAAoC;AAWpC;AAXA,cAWa,uBAAA,SAAgC,KAAA;EAAA,SAGf,MAAA,EAAQ,wBAAA;EAAA,SAF3B,IAAA,GAAI,cAAA,CAAA,kBAAA;cAEe,MAAA,EAAQ,wBAAA;AAAA;;;;;;;;iBAatB,uBAAA,CAAwB,SAAA,EAAW,SAAS,EAAE,MAAA;;;;;;AAbA;AAa9D;;;;;;;;AAA4E;AAuB5E;;;;iBAAgB,uBAAA,CAAwB,OAAgB,EAAP,OAAO"}
+{"version":3,"file":"csrf-origin-check.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/csrf-origin-check.ts"],"mappings":";;;;;;KAQY,wBAAA;AAAZ;;;;AAAoC;AAWpC;AAXA,cAWa,uBAAA,SAAgC,KAAA;EAAA,SAGf,MAAA,EAAQ,wBAAA;EAAA,SAF3B,IAAA,GAAI,cAAA,CAAA,kBAAA;cAEe,MAAA,EAAQ,wBAAA;AAAA;;;;;;;;iBAatB,uBAAA,CAAwB,SAAA,EAAW,SAAS,EAAE,MAAA;;;;;;AAbA;AAa9D;;;;;;;;AAA4E;AAuB5E;;;;iBAAgB,uBAAA,CAAwB,OAAgB,EAAP,OAAO"}

package/esm/middleware/csrf-origin-check.mjs

@@ -1,7 +1,7 @@
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { resolveCsrfOriginVerdict } from "@warlock.js/core";
 
-//#region ../auth/src/middleware/csrf-origin-check.ts
+//#region ../../packages/auth/src/middleware/csrf-origin-check.ts
 /** HTTP methods the CSRF Origin check exempts — reads, never state changes. */
 const SAFE_METHODS = new Set([
 	"GET",

package/esm/middleware/csrf-origin-check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-origin-check.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/csrf-origin-check.ts"],"sourcesContent":["import { resolveCsrfOriginVerdict, type Request } from \"@warlock.js/core\";\nimport type { TokenFrom } from \"../contracts/types\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/** HTTP methods the CSRF Origin check exempts — reads, never state changes. */\nconst SAFE_METHODS = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/** Why {@link assertCsrfOriginAllowed} refused a request. */\nexport type CsrfOriginMismatchReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/**\n * A cookie-authenticated, unsafe-method request whose `Origin`/`Referer`\n * failed the check. `reason` names exactly why,\n * so an error transformer or an incident log never has to string-match the\n * message.\n */\nexport class CsrfOriginMismatchError extends Error {\n  readonly code = AuthErrorCodes.CsrfOriginMismatch;\n\n  constructor(public readonly reason: CsrfOriginMismatchReason) {\n    super(`CSRF Origin check failed: ${reason}`);\n    this.name = \"CsrfOriginMismatchError\";\n  }\n}\n\n/**\n * Whether a request is in scope for the CSRF Origin check at all — only a\n * `cookie:`-sourced credential on an unsafe method (POST/PUT/PATCH/DELETE) is.\n * Header-token auth and safe methods (GET/HEAD/OPTIONS) are always exempt:\n * only a cookie-sourced credential can be silently replayed cross-site by a\n * browser, so only it needs the check.\n */\nexport function requiresCsrfOriginCheck(tokenFrom: TokenFrom, method: string): boolean {\n  return tokenFrom.startsWith(\"cookie:\") && !SAFE_METHODS.has(method.toUpperCase());\n}\n\n/**\n * CSRF Origin check for a cookie-authenticated unsafe-method request (lead\n * decision 3). Allowed when `Origin` — or, when `Origin` is absent, `Referer`\n * — names the request's own origin or an entry in `auth.csrf.allowedOrigins`.\n * Throws {@link CsrfOriginMismatchError} otherwise, including when BOTH\n * headers are absent.\n *\n * Delegates the actual same-origin/allowedOrigins/trustProxy-aware\n * comparison to `@warlock.js/core`'s `resolveCsrfOriginVerdict`\n * (`core/src/http/csrf-origin-policy.ts`) — SECURITY card 8a752ab2 moved that\n * logic down into `core` so this middleware's check and core's own default\n * CSRF-Origin guard (`core/src/http/csrf-default-guard.ts`, which now runs\n * even earlier, ahead of this middleware, for cookie-carrying unsafe-method\n * requests generally) share one implementation instead of two copies that\n * could drift apart.\n *\n * Callers gate this behind {@link requiresCsrfOriginCheck} — this function\n * itself does not re-check the token source or the method.\n */\nexport function assertCsrfOriginAllowed(request: Request): void {\n  const verdict = resolveCsrfOriginVerdict(request);\n\n  if (!verdict.allowed) {\n    throw new CsrfOriginMismatchError(verdict.reason);\n  }\n}\n"],"mappings":";;;;;AAKA,MAAM,eAAe,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;;;;;;;AAcvD,IAAa,0BAAb,cAA6C,MAAM;CAGjD,YAAY,AAAgB,QAAkC;EAC5D,MAAM,6BAA6B,QAAQ;EADjB;;EAE1B,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,wBAAwB,WAAsB,QAAyB;CACrF,OAAO,UAAU,WAAW,SAAS,KAAK,CAAC,aAAa,IAAI,OAAO,YAAY,CAAC;AAClF;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,wBAAwB,SAAwB;CAC9D,MAAM,UAAU,yBAAyB,OAAO;CAEhD,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,wBAAwB,QAAQ,MAAM;AAEpD"}
+{"version":3,"file":"csrf-origin-check.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/csrf-origin-check.ts"],"sourcesContent":["import { resolveCsrfOriginVerdict, type Request } from \"@warlock.js/core\";\nimport type { TokenFrom } from \"../contracts/types\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/** HTTP methods the CSRF Origin check exempts — reads, never state changes. */\nconst SAFE_METHODS = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/** Why {@link assertCsrfOriginAllowed} refused a request. */\nexport type CsrfOriginMismatchReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/**\n * A cookie-authenticated, unsafe-method request whose `Origin`/`Referer`\n * failed the check. `reason` names exactly why,\n * so an error transformer or an incident log never has to string-match the\n * message.\n */\nexport class CsrfOriginMismatchError extends Error {\n  readonly code = AuthErrorCodes.CsrfOriginMismatch;\n\n  constructor(public readonly reason: CsrfOriginMismatchReason) {\n    super(`CSRF Origin check failed: ${reason}`);\n    this.name = \"CsrfOriginMismatchError\";\n  }\n}\n\n/**\n * Whether a request is in scope for the CSRF Origin check at all — only a\n * `cookie:`-sourced credential on an unsafe method (POST/PUT/PATCH/DELETE) is.\n * Header-token auth and safe methods (GET/HEAD/OPTIONS) are always exempt:\n * only a cookie-sourced credential can be silently replayed cross-site by a\n * browser, so only it needs the check.\n */\nexport function requiresCsrfOriginCheck(tokenFrom: TokenFrom, method: string): boolean {\n  return tokenFrom.startsWith(\"cookie:\") && !SAFE_METHODS.has(method.toUpperCase());\n}\n\n/**\n * CSRF Origin check for a cookie-authenticated unsafe-method request (lead\n * decision 3). Allowed when `Origin` — or, when `Origin` is absent, `Referer`\n * — names the request's own origin or an entry in `auth.csrf.allowedOrigins`.\n * Throws {@link CsrfOriginMismatchError} otherwise, including when BOTH\n * headers are absent.\n *\n * Delegates the actual same-origin/allowedOrigins/trustProxy-aware\n * comparison to `@warlock.js/core`'s `resolveCsrfOriginVerdict`\n * (`core/src/http/csrf-origin-policy.ts`) — SECURITY card 8a752ab2 moved that\n * logic down into `core` so this middleware's check and core's own default\n * CSRF-Origin guard (`core/src/http/csrf-default-guard.ts`, which now runs\n * even earlier, ahead of this middleware, for cookie-carrying unsafe-method\n * requests generally) share one implementation instead of two copies that\n * could drift apart.\n *\n * Callers gate this behind {@link requiresCsrfOriginCheck} — this function\n * itself does not re-check the token source or the method.\n */\nexport function assertCsrfOriginAllowed(request: Request): void {\n  const verdict = resolveCsrfOriginVerdict(request);\n\n  if (!verdict.allowed) {\n    throw new CsrfOriginMismatchError(verdict.reason);\n  }\n}\n"],"mappings":";;;;;AAKA,MAAM,eAAe,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;;;;;;;AAcvD,IAAa,0BAAb,cAA6C,MAAM;CAGjD,YAAY,AAAgB,QAAkC;EAC5D,MAAM,6BAA6B,QAAQ;EADjB;;EAE1B,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,wBAAwB,WAAsB,QAAyB;CACrF,OAAO,UAAU,WAAW,SAAS,KAAK,CAAC,aAAa,IAAI,OAAO,YAAY,CAAC;AAClF;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,wBAAwB,SAAwB;CAC9D,MAAM,UAAU,yBAAyB,OAAO;CAEhD,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,wBAAwB,QAAQ,MAAM;AAEpD"}

package/esm/middleware/index.d.mts

@@ -1,6 +1,6 @@
 import { AUTH_MIDDLEWARE_DESCRIPTOR, AuthMiddlewareDescriptor, AuthMiddlewareDescriptorSource, authMiddleware } from "./auth.middleware.mjs";
 import { CsrfOriginMismatchError, CsrfOriginMismatchReason, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./csrf-origin-check.mjs";
-import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
+import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware, throttleIdentifierHash } from "./login-throttle.middleware.mjs";
 import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./one-time-token-throttle.middleware.mjs";
 import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./otp-throttle.middleware.mjs";
 import { requireVerifiedEmail } from "./require-verified-email.middleware.mjs";

package/esm/middleware/index.mjs

@@ -1,6 +1,6 @@
 import { CsrfOriginMismatchError, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./csrf-origin-check.mjs";
 import { AUTH_MIDDLEWARE_DESCRIPTOR, authMiddleware } from "./auth.middleware.mjs";
-import { loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
+import { loginThrottleMiddleware, throttleIdentifierHash } from "./login-throttle.middleware.mjs";
 import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./one-time-token-throttle.middleware.mjs";
 import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./otp-throttle.middleware.mjs";
 import { requireVerifiedEmail } from "./require-verified-email.middleware.mjs";

package/esm/middleware/localized-login-path.mjs

@@ -1,6 +1,6 @@
 import { config } from "@warlock.js/core";
 
-//#region ../auth/src/middleware/localized-login-path.ts
+//#region ../../packages/auth/src/middleware/localized-login-path.ts
 /**
 * Prefixes `loginPath` with `locale` when `web`'s locale-URL routing is
 * active for that locale — so a guarded `/ar/admin` page redirects an

package/esm/middleware/localized-login-path.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"localized-login-path.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/localized-login-path.ts"],"sourcesContent":["import { config } from \"@warlock.js/core\";\n\n/**\n * Prefixes `loginPath` with `locale` when `web`'s locale-URL routing is\n * active for that locale — so a guarded `/ar/admin` page redirects an\n * anonymous request to `/ar/login`, not the bare `/login` (finding: the\n * `returnUrl` carried the locale, the login destination itself did not).\n *\n * `auth` is not on `web`'s dependency graph, and `web` is not on `auth`'s\n * (neither package declares the other, in either `dependencies` or\n * `peerDependencies`) — so this cannot import `web`'s\n * `resolveLocaleRouting()` / `withLocalePrefix()` / `isPrefixedLocale()`\n * (`web/src/routing/locale-routing.ts`, `web/src/routing/locale-prefixed-paths.ts`).\n * Instead it reads the SAME config keys those read — `web.localeRouting.strategy`,\n * `app.localeCodes`, `app.localeCode` — by convention rather than by import,\n * the same pattern `web/src/server/auth-cookie-name.ts` uses in the other\n * direction for `auth.cookie.name`.\n *\n * Left alone (returned unchanged) when:\n * - `loginPath` is absolute (`http://…`, `https://…`) — a redirect target\n *   outside this app has no \"locale prefix\" to add.\n * - `loginPath` is already prefixed with a known locale code (an app that\n *   configured `auth.pageAuth.loginPath` as `/ar/login` itself).\n * - `web.localeRouting.strategy` is `\"none\"` (the default) or unset.\n * - `locale` is not one of `app.localeCodes`, or — under\n *   `\"prefix-except-default\"` — `locale` is the default locale.\n */\nexport function localizedLoginPath(loginPath: string, locale: string): string {\n  if (/^[a-z][a-z0-9+.-]*:\\/\\//i.test(loginPath)) return loginPath;\n\n  const strategy = config.key<string>(\"web.localeRouting.strategy\", \"none\");\n\n  if (strategy !== \"prefix\" && strategy !== \"prefix-except-default\") return loginPath;\n\n  const codes = config.key<string[]>(\"app.localeCodes\", []) ?? [];\n\n  if (isAlreadyPrefixed(loginPath, codes)) return loginPath;\n\n  if (!codes.includes(locale)) return loginPath;\n\n  if (strategy === \"prefix-except-default\") {\n    const defaultLocale = config.key<string>(\"app.localeCode\", \"\");\n\n    if (locale === defaultLocale) return loginPath;\n  }\n\n  return loginPath === \"/\" ? `/${locale}` : `/${locale}${loginPath}`;\n}\n\n/** `true` when `path` already starts with one of `codes` as its own URL segment. */\nfunction isAlreadyPrefixed(path: string, codes: readonly string[]): boolean {\n  return codes.some((code) => path === `/${code}` || path.startsWith(`/${code}/`));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,mBAAmB,WAAmB,QAAwB;CAC5E,IAAI,2BAA2B,KAAK,SAAS,GAAG,OAAO;CAEvD,MAAM,WAAW,OAAO,IAAY,8BAA8B,MAAM;CAExE,IAAI,aAAa,YAAY,aAAa,yBAAyB,OAAO;CAE1E,MAAM,QAAQ,OAAO,IAAc,mBAAmB,CAAC,CAAC,KAAK,CAAC;CAE9D,IAAI,kBAAkB,WAAW,KAAK,GAAG,OAAO;CAEhD,IAAI,CAAC,MAAM,SAAS,MAAM,GAAG,OAAO;CAEpC,IAAI,aAAa,yBAGf;MAAI,WAFkB,OAAO,IAAY,kBAAkB,EAEhC,GAAG,OAAO;CAAS;CAGhD,OAAO,cAAc,MAAM,IAAI,WAAW,IAAI,SAAS;AACzD;;AAGA,SAAS,kBAAkB,MAAc,OAAmC;CAC1E,OAAO,MAAM,MAAM,SAAS,SAAS,IAAI,UAAU,KAAK,WAAW,IAAI,KAAK,EAAE,CAAC;AACjF"}
+{"version":3,"file":"localized-login-path.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/localized-login-path.ts"],"sourcesContent":["import { config } from \"@warlock.js/core\";\n\n/**\n * Prefixes `loginPath` with `locale` when `web`'s locale-URL routing is\n * active for that locale — so a guarded `/ar/admin` page redirects an\n * anonymous request to `/ar/login`, not the bare `/login` (finding: the\n * `returnUrl` carried the locale, the login destination itself did not).\n *\n * `auth` is not on `web`'s dependency graph, and `web` is not on `auth`'s\n * (neither package declares the other, in either `dependencies` or\n * `peerDependencies`) — so this cannot import `web`'s\n * `resolveLocaleRouting()` / `withLocalePrefix()` / `isPrefixedLocale()`\n * (`web/src/routing/locale-routing.ts`, `web/src/routing/locale-prefixed-paths.ts`).\n * Instead it reads the SAME config keys those read — `web.localeRouting.strategy`,\n * `app.localeCodes`, `app.localeCode` — by convention rather than by import,\n * the same pattern `web/src/server/auth-cookie-name.ts` uses in the other\n * direction for `auth.cookie.name`.\n *\n * Left alone (returned unchanged) when:\n * - `loginPath` is absolute (`http://…`, `https://…`) — a redirect target\n *   outside this app has no \"locale prefix\" to add.\n * - `loginPath` is already prefixed with a known locale code (an app that\n *   configured `auth.pageAuth.loginPath` as `/ar/login` itself).\n * - `web.localeRouting.strategy` is `\"none\"` (the default) or unset.\n * - `locale` is not one of `app.localeCodes`, or — under\n *   `\"prefix-except-default\"` — `locale` is the default locale.\n */\nexport function localizedLoginPath(loginPath: string, locale: string): string {\n  if (/^[a-z][a-z0-9+.-]*:\\/\\//i.test(loginPath)) return loginPath;\n\n  const strategy = config.key<string>(\"web.localeRouting.strategy\", \"none\");\n\n  if (strategy !== \"prefix\" && strategy !== \"prefix-except-default\") return loginPath;\n\n  const codes = config.key<string[]>(\"app.localeCodes\", []) ?? [];\n\n  if (isAlreadyPrefixed(loginPath, codes)) return loginPath;\n\n  if (!codes.includes(locale)) return loginPath;\n\n  if (strategy === \"prefix-except-default\") {\n    const defaultLocale = config.key<string>(\"app.localeCode\", \"\");\n\n    if (locale === defaultLocale) return loginPath;\n  }\n\n  return loginPath === \"/\" ? `/${locale}` : `/${locale}${loginPath}`;\n}\n\n/** `true` when `path` already starts with one of `codes` as its own URL segment. */\nfunction isAlreadyPrefixed(path: string, codes: readonly string[]): boolean {\n  return codes.some((code) => path === `/${code}` || path.startsWith(`/${code}/`));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,mBAAmB,WAAmB,QAAwB;CAC5E,IAAI,2BAA2B,KAAK,SAAS,GAAG,OAAO;CAEvD,MAAM,WAAW,OAAO,IAAY,8BAA8B,MAAM;CAExE,IAAI,aAAa,YAAY,aAAa,yBAAyB,OAAO;CAE1E,MAAM,QAAQ,OAAO,IAAc,mBAAmB,CAAC,CAAC,KAAK,CAAC;CAE9D,IAAI,kBAAkB,WAAW,KAAK,GAAG,OAAO;CAEhD,IAAI,CAAC,MAAM,SAAS,MAAM,GAAG,OAAO;CAEpC,IAAI,aAAa,yBAGf;MAAI,WAFkB,OAAO,IAAY,kBAAkB,EAEhC,GAAG,OAAO;CAAS;CAGhD,OAAO,cAAc,MAAM,IAAI,WAAW,IAAI,SAAS;AACzD;;AAGA,SAAS,kBAAkB,MAAc,OAAmC;CAC1E,OAAO,MAAM,MAAM,SAAS,SAAS,IAAI,UAAU,KAAK,WAAW,IAAI,KAAK,EAAE,CAAC;AACjF"}

package/esm/middleware/login-throttle.middleware.d.mts

@@ -1,6 +1,6 @@
 import { Middleware, Request, Response } from "@warlock.js/core";
 
-//#region ../auth/src/middleware/login-throttle.middleware.d.ts
+//#region ../../packages/auth/src/middleware/login-throttle.middleware.d.ts
 /**
  * Built-in identifier kinds the throttle knows how to extract from a request.
  *
@@ -74,6 +74,21 @@ type LoginThrottleOptions = {
    */
   identify?: (request: Request) => string[];
 };
+/**
+ * Hash of a throttle identifier (`kind` is `"email"`, `"ip"`, ...). The value
+ * is trimmed and lower-cased first, so `" Sara@x.io"` and `"sara@x.io"` share
+ * one bucket.
+ *
+ * Identifiers become part of cache keys, and cache drivers log their keys: a
+ * raw email or IP there is personal data in a log line. A plain SHA-256 of an
+ * email is reversible by anyone with a list of addresses, so the hash is
+ * keyed (HMAC) with a key derived from `auth.accessToken.secret`. Without a
+ * configured secret it falls back to SHA-256, which still keeps the address
+ * out of the key.
+ *
+ * Exported for tests and for apps that inspect throttle keys.
+ */
+declare function throttleIdentifierHash(kind: string, value: string): string;
 /**
  * Failure-aware login throttle. Locks an identifier (account, IP, or both)
  * after too many failed login attempts within a window — without penalising
@@ -112,5 +127,5 @@ type LoginThrottleOptions = {
  */
 declare function loginThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
 //#endregion
-export { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware };
+export { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware, throttleIdentifierHash };
 //# sourceMappingURL=login-throttle.middleware.d.mts.map

package/esm/middleware/login-throttle.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"login-throttle.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/login-throttle.middleware.ts"],"mappings":";;;;;AAeA;;;;AAAmC;AAYnC;;;KAZY,uBAAA;;;;;;;;;;;KAYA,oBAAA;EAkDV;;;;;EA5CA,GAAA;EAmD4B;AAAA;AA6E9B;;;EAzHE,MAAA;EAyH+C;;;;AAAsC;EAlHrF,eAAA;;;;;;EAOA,EAAA,GAAK,uBAAA;;;;;;;;EASL,aAAA;;;;EAKA,YAAA;;;;;;;;EASA,SAAA,IAAa,QAAA,EAAU,QAAA;;;;;;EAOvB,QAAA,IAAY,OAAA,EAAS,OAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6EP,uBAAA,CAAwB,OAAA,GAAS,oBAAA,GAA4B,UAAU"}
+{"version":3,"file":"login-throttle.middleware.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/login-throttle.middleware.ts"],"mappings":";;;;;AAkBA;;;;AAAmC;AAYnC;;;KAZY,uBAAA;;;;;;;;;;;KAYA,oBAAA;EAkDV;;;;;EA5CA,GAAA;EAmD4B;AAAA;AAwC9B;;;EApFE,MAAA;EAoFgE;AA0IlE;;;;EAvNE,eAAA;EAuNsC;;;AAA+C;;EAhNrF,EAAA,GAAK,uBAAA;;;;;;;;EASL,aAAA;;;;EAKA,YAAA;;;;;;;;EASA,SAAA,IAAa,QAAA,EAAU,QAAA;;;;;;EAOvB,QAAA,IAAY,OAAA,EAAS,OAAA;AAAA;;;;;;;;;;;;;;;iBAwCP,sBAAA,CAAuB,IAAA,UAAc,KAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0IlD,uBAAA,CAAwB,OAAA,GAAS,oBAAA,GAA4B,UAAU"}

package/esm/middleware/login-throttle.middleware.mjs

@@ -1,14 +1,88 @@
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { authConfig } from "../services/auth-config.mjs";
 import { t } from "@warlock.js/core";
+import { createHash, createHmac } from "node:crypto";
 import { log } from "@warlock.js/logger";
+import ms from "ms";
 import { cache } from "@warlock.js/cache";
 
-//#region ../auth/src/middleware/login-throttle.middleware.ts
+//#region ../../packages/auth/src/middleware/login-throttle.middleware.ts
 const COUNTER_PREFIX = "auth.throttle.count.";
 const LOCK_PREFIX = "auth.throttle.lock.";
 const counterKey = (identifier) => `${COUNTER_PREFIX}${identifier}`;
 const lockKey = (identifier) => `${LOCK_PREFIX}${identifier}`;
 /**
+* The key a throttle identifier is hashed with: an HMAC key derived from
+* `auth.accessToken.secret` (the same root the OTP code MAC uses), or
+* `undefined` when no secret is configured.
+*/
+function throttleHashKey() {
+	let secret;
+	try {
+		secret = authConfig.accessToken.secret();
+	} catch {
+		return;
+	}
+	return createHmac("sha256", secret).update("@warlock.js/auth:throttle").digest();
+}
+/**
+* Hash of a throttle identifier (`kind` is `"email"`, `"ip"`, ...). The value
+* is trimmed and lower-cased first, so `" Sara@x.io"` and `"sara@x.io"` share
+* one bucket.
+*
+* Identifiers become part of cache keys, and cache drivers log their keys: a
+* raw email or IP there is personal data in a log line. A plain SHA-256 of an
+* email is reversible by anyone with a list of addresses, so the hash is
+* keyed (HMAC) with a key derived from `auth.accessToken.secret`. Without a
+* configured secret it falls back to SHA-256, which still keeps the address
+* out of the key.
+*
+* Exported for tests and for apps that inspect throttle keys.
+*/
+function throttleIdentifierHash(kind, value) {
+	const normalized = `${kind}:${value.trim().toLowerCase()}`;
+	const key = throttleHashKey();
+	return key ? createHmac("sha256", key).update(normalized).digest("hex") : createHash("sha256").update(normalized).digest("hex");
+}
+let warnedNullDriver = false;
+/**
+* The `null` cache driver stores nothing: every count reads back as 1 and no
+* lock is ever found, so the throttle silently never trips. Say so once.
+*/
+function warnIfNullDriver() {
+	if (warnedNullDriver) return;
+	if (cache.currentDriver?.name !== "null") return;
+	warnedNullDriver = true;
+	log.warn("auth", "login-throttle", "The cache driver is `null`, so login, token and OTP throttles never lock. Use a real cache driver (redis, pg, or memory for one process).");
+}
+/**
+* A lock value is the lockout deadline (epoch ms). `true`, written by 5.29
+* and earlier, still counts as locked until the key expires.
+*/
+function isLocked(value) {
+	if (typeof value === "number") return value > Date.now();
+	return Boolean(value);
+}
+/**
+* `ms`'s honest runtime signature (see `services/auth-config.ts`): it returns
+* `undefined` for text it cannot parse and throws for `""`.
+*/
+const parseMs = ms;
+/**
+* `"15m"` / `"1h"` / seconds as a number → seconds, or `undefined` when the
+* value cannot be parsed (the cache rejects such a TTL anyway).
+*/
+function durationSeconds(duration) {
+	if (typeof duration === "number") return Number.isFinite(duration) && duration > 0 ? duration : void 0;
+	let milliseconds;
+	try {
+		milliseconds = parseMs(duration);
+	} catch {
+		milliseconds = void 0;
+	}
+	return typeof milliseconds === "number" && Number.isFinite(milliseconds) && milliseconds > 0 ? milliseconds / 1e3 : void 0;
+}
+/**
 * Built-in identifier extractor — reads the configured credential field from
 * the request body for the per-account key, and `request.detectIp()` for the
 * per-source key. Untruthy values are dropped; a request that yields zero
@@ -18,11 +92,11 @@ function buildDefaultIdentifiers(request, tracked, credentialField) {
 	const identifiers = [];
 	if (tracked.includes("email")) {
 		const value = request.input(credentialField);
-		if (typeof value === "string" && value.length > 0) identifiers.push(`email.${value.toLowerCase()}`);
+		if (typeof value === "string" && value.trim().length > 0) identifiers.push(`email.${throttleIdentifierHash("email", value)}`);
 	}
 	if (tracked.includes("ip")) {
 		const ip = request.detectIp();
-		if (ip) identifiers.push(`ip.${ip}`);
+		if (ip) identifiers.push(`ip.${throttleIdentifierHash("ip", ip)}`);
 	}
 	return identifiers;
 }
@@ -71,8 +145,9 @@ function loginThrottleMiddleware(options = {}) {
 	return async ({ request, response }) => {
 		const identifiers = options.identify ? options.identify(request) : buildDefaultIdentifiers(request, tracked, credentialField);
 		if (identifiers.length === 0) return;
+		warnIfNullDriver();
 		try {
-			for (const identifier of identifiers) if (await cache.get(lockKey(identifier))) return response.tooManyRequests({
+			for (const identifier of identifiers) if (isLocked(await cache.get(lockKey(identifier)))) return response.tooManyRequests({
 				error: options.errorMessage ?? t("auth.errors.tooManyAttempts"),
 				errorCode: "EC004"
 			});
@@ -95,7 +170,10 @@ function loginThrottleMiddleware(options = {}) {
 						ttl: window,
 						onConflict: "create"
 					});
-					if (await cache.increment(key) >= max) await cache.set(lockKey(identifier), true, { ttl: lockoutDuration });
+					if (await cache.increment(key) >= max) {
+						const lockSeconds = durationSeconds(lockoutDuration);
+						await cache.set(lockKey(identifier), lockSeconds === void 0 ? true : Date.now() + lockSeconds * 1e3, { ttl: lockoutDuration });
+					}
 				}
 			} catch (error) {
 				log.error("auth", "login-throttle", error);
@@ -105,5 +183,5 @@ function loginThrottleMiddleware(options = {}) {
 }
 
 //#endregion
-export { loginThrottleMiddleware };
+export { loginThrottleMiddleware, throttleIdentifierHash };
 //# sourceMappingURL=login-throttle.middleware.mjs.map