@webtypen/webframez-core 0.3.73 → 0.3.74

package/dist/Auth/Auth.d.ts

@@ -0,0 +1,19 @@
+import type { Request } from "../Router/Request";
+import type { Response } from "../Router/Response";
+import { AuthScope, AuthScopeOptions, AuthOperation, AuthRouteOptions } from "./ModelAuth";
+export type AuthConfig = {
+    /** Disable automatic main creation; explicitly configured scopes remain available. */
+    main?: boolean;
+    defaults?: Partial<AuthScopeOptions>;
+    scopes?: Record<string, AuthScopeOptions>;
+};
+/** Application-wide registry of named browser-authentication scopes. */
+export declare class AuthFacade {
+    private readonly scopes;
+    private initialized;
+    init(): void;
+    scope(key?: string): AuthScope;
+    registerScope(key: string, config: Partial<AuthScopeOptions>): AuthScope;
+}
+export declare const Auth: AuthFacade;
+export declare function authRoute(operation: AuthOperation, options: AuthRouteOptions): (req: Request, res: Response) => Promise<Response>;

package/dist/Auth/Auth.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authRoute = exports.Auth = exports.AuthFacade = void 0;
+const Config_1 = require("../Config");
+const Model_1 = require("../Database/Model");
+const ModelAuth_1 = require("./ModelAuth");
+function mergeOptions(base, config) {
+    return Object.assign(Object.assign(Object.assign({ model: Model_1.Model }, base), config), { fields: Object.assign(Object.assign({}, base.fields), config.fields), session: Object.assign(Object.assign({}, base.session), config.session), messages: Object.assign(Object.assign({}, base.messages), config.messages) });
+}
+/** Application-wide registry of named browser-authentication scopes. */
+class AuthFacade {
+    constructor() {
+        this.scopes = new Map();
+        this.initialized = false;
+    }
+    init() {
+        if (this.initialized)
+            return;
+        const config = Config_1.Config.get("auth") || {};
+        const configured = new Map();
+        for (const [key, options] of Object.entries(config.scopes || {})) {
+            configured.set(key, new ModelAuth_1.AuthScope(Object.assign(Object.assign({}, mergeOptions(config.defaults || {}, options)), { key })));
+        }
+        if (config.main !== false && !configured.has("main")) {
+            configured.set("main", new ModelAuth_1.AuthScope(Object.assign(Object.assign({}, mergeOptions(config.defaults || {}, {})), { key: "main" })));
+        }
+        for (const [key, scope] of configured)
+            this.scopes.set(key, scope);
+        this.initialized = true;
+    }
+    scope(key = "main") {
+        this.init();
+        const scope = this.scopes.get(key);
+        if (!scope)
+            throw new Error(`Auth scope "${key}" is not registered.`);
+        return scope;
+    }
+    registerScope(key, config) {
+        var _a;
+        this.init();
+        const defaults = Config_1.Config.get("auth.defaults") || {};
+        const base = ((_a = this.scopes.get(key)) === null || _a === void 0 ? void 0 : _a.configuration) || defaults;
+        const scope = new ModelAuth_1.AuthScope(Object.assign(Object.assign({}, mergeOptions(base, config)), { key }));
+        this.scopes.set(key, scope);
+        return scope;
+    }
+}
+exports.AuthFacade = AuthFacade;
+exports.Auth = new AuthFacade();
+function authRoute(operation, options) {
+    return (req, res) => exports.Auth.scope(options.auth || "main").handle(operation, req, res, options.loginResponse);
+}
+exports.authRoute = authRoute;

package/dist/Auth/ModelAuth.d.ts

@@ -11,13 +11,14 @@ export type AuthSnapshot<TUser = Record<string, unknown>> = {
     user: TUser;
     session: AuthSession;
 };
-export type AuthErrorCode = "missing_login" | "invalid_login" | "inactive_user" | "invalid_origin" | "invalid_csrf" | "unauthorized" | "server_error";
+export type AuthErrorCode = "missing_login" | "invalid_login" | "inactive_user" | "invalid_origin" | "invalid_csrf" | "unauthorized" | "server_error" | "login_blocked" | "logout_blocked";
 export declare class AuthLoginError extends WebAuthError {
     readonly code: AuthErrorCode;
     constructor(code: AuthErrorCode, status: 401 | 403, message: string);
 }
 export type ModelAuthOptions = Partial<WebAuthOptions> & {
     model: typeof Model;
+    key?: string;
     /** Takes precedence over session.audience; defaults to the configured origin. */
     audience?: string;
     locale?: "en" | "de";
@@ -33,31 +34,39 @@ export type ModelAuthOptions = Partial<WebAuthOptions> & {
     csrfDisabled?: false;
     verifyPassword?: (password: string, storedHash: string) => boolean | Promise<boolean>;
     isUserAllowed?: (user: Model) => boolean | Promise<boolean>;
+    beforeLogin?: AuthActionHook;
+    afterLogin?: AuthActionHook;
+    beforeLogout?: AuthActionHook;
+    afterLogout?: AuthActionHook;
     onLogin?: (session: AuthSession, req: Request) => void | Promise<void>;
     publicUserFields?: readonly string[];
     onAuthenticate?: (auth: AuthContext, req: Request) => void | Promise<void>;
     messages?: Partial<Record<AuthErrorCode, string>>;
 };
+export type AuthActionHook = (req: Request, user: Model, scope: AuthScope) => void | Promise<void>;
 export type AuthOperation = "csrf" | "login" | "logout" | "refresh";
 export type AuthRouteOptions = Partial<ModelAuthOptions> & {
-    auth?: ModelAuth | (() => ModelAuth);
+    auth?: string;
     loginPath?: string;
     loginResponse?: (req: Request, session: AuthSession) => object | Promise<object>;
     middleware?: string[];
     domains?: string[];
 };
 /** Model-backed browser authentication with secure default routes and revocable sessions. */
-export declare class ModelAuth extends WebAuth {
+export declare class AuthScope extends WebAuth {
     private readonly modelOptions;
+    readonly key: string;
     private readonly model;
     private readonly sessionUsers;
     private readonly fields;
     constructor(modelOptions: ModelAuthOptions);
+    get configuration(): ModelAuthOptions;
     private message;
     /** Use this when creating users; existing bcrypt hashes are supported without migration. */
     static hashPassword(password: string): Promise<string>;
     verifyCredentials(req: Request): Promise<string>;
     login(req: Request, res: Response, verifyCredentials?: () => Promise<string | null>): Promise<AuthSession>;
+    logout(req: Request, res: Response): Promise<void>;
     /** Resolve a fresh validated session and its model; never trusts a client-supplied req.auth. */
     resolve<TUser extends Model = Model>(req: Request): Promise<AuthContext<TUser> | null>;
     resolveCookies<TUser extends Model = Model>(cookies: Record<string, string | undefined>): Promise<AuthContext<TUser> | null>;
@@ -69,4 +78,6 @@ export declare class ModelAuth extends WebAuth {
     }): (next: Function, reject: Function, req: Request, res: Response) => Promise<any>;
     handle(operation: AuthOperation, req: Request, res: Response, loginResponse?: AuthRouteOptions["loginResponse"]): Promise<Response>;
 }
-export declare function authRoute(operation: AuthOperation, options: AuthRouteOptions): (req: Request, res: Response) => Promise<Response>;
+/** Compatibility name for existing integrations. Prefer Auth.scope(). */
+export { AuthScope as ModelAuth };
+export type AuthScopeOptions = ModelAuthOptions;

package/dist/Auth/ModelAuth.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authRoute = exports.ModelAuth = exports.AuthLoginError = void 0;
+exports.ModelAuth = exports.AuthScope = exports.AuthLoginError = void 0;
 const bcryptjs_1 = require("bcryptjs");
 const Config_1 = require("../Config");
 const Request_1 = require("../Router/Request");
@@ -23,6 +23,11 @@ class AuthLoginError extends WebAuth_1.WebAuthError {
     }
 }
 exports.AuthLoginError = AuthLoginError;
+class AuthHookError extends AuthLoginError {
+    constructor(code, error) {
+        super(code, error instanceof WebAuth_1.WebAuthError ? error.status : 403, error instanceof Error ? error.message : typeof error === "string" ? error : "Authentication action was blocked.");
+    }
+}
 const defaultMessages = {
     en: {
         missing_login: "Please provide your login and password.",
@@ -32,6 +37,8 @@ const defaultMessages = {
         invalid_csrf: "Please reload the page and try logging in again.",
         unauthorized: "Please log in.",
         server_error: "Authentication could not be processed.",
+        login_blocked: "Login was blocked.",
+        logout_blocked: "Logout was blocked.",
     },
     de: {
         missing_login: "Bitte gib E-Mail-Adresse und Passwort an.",
@@ -41,19 +48,24 @@ const defaultMessages = {
         invalid_csrf: "Der Login konnte gerade nicht verarbeitet werden. Bitte lade die Seite neu.",
         unauthorized: "Bitte melde dich an.",
         server_error: "Die Anmeldung konnte gerade nicht verarbeitet werden.",
+        login_blocked: "Die Anmeldung wurde abgelehnt.",
+        logout_blocked: "Die Abmeldung wurde abgelehnt.",
     },
 };
 // Verify a dummy password hash for unknown accounts as well.
 let dummyHash;
 /** Model-backed browser authentication with secure default routes and revocable sessions. */
-class ModelAuth extends WebAuth_1.WebAuth {
+class AuthScope extends WebAuth_1.WebAuth {
     constructor(modelOptions) {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _e, _f, _g;
         if (modelOptions.csrfDisabled)
             throw new Error("Browser auth routes require CSRF protection.");
         if (!modelOptions.model)
             throw new Error("Route.auth requires a Model class.");
         const origin = new URL(modelOptions.origin || Config_1.Config.get("auth.origin") || Config_1.Config.get("website.baseUrl") || Config_1.Config.get("application.website.baseUrl") || process.env.WEBSITE_URL || process.env.PUBLIC_BASE_URL || `http://localhost:${process.env.PORT || 3035}`).origin;
+        const key = (_a = modelOptions.key) !== null && _a !== void 0 ? _a : "main";
+        if (!/^[A-Za-z0-9_-]+$/.test(key))
+            throw new Error("Invalid auth scope key.");
         const model = modelOptions.model;
         const fields = Object.assign({ identifier: "email", password: "password", active: "is_active", primaryKey: new model().__primaryKey || "_id" }, modelOptions.fields);
         const allowed = (user) => __awaiter(this, void 0, void 0, function* () {
@@ -61,7 +73,7 @@ class ModelAuth extends WebAuth_1.WebAuth {
                 && (!modelOptions.isUserAllowed || (yield modelOptions.isUserAllowed(user))));
         });
         const sessionUsers = new WeakMap();
-        const sessions = new SessionAuth_1.SessionAuth(Object.assign(Object.assign({ accessTokenSeconds: 30 * 86400, sessionSeconds: 30 * 86400 }, modelOptions.session), { issuer: origin, audience: (_c = (_a = modelOptions.audience) !== null && _a !== void 0 ? _a : (_b = modelOptions.session) === null || _b === void 0 ? void 0 : _b.audience) !== null && _c !== void 0 ? _c : origin, connection: ((_d = modelOptions.session) === null || _d === void 0 ? void 0 : _d.connection) || new model().__connection, isSessionAllowed: (session) => __awaiter(this, void 0, void 0, function* () {
+        const sessions = new SessionAuth_1.SessionAuth(Object.assign(Object.assign({ accessTokenSeconds: 30 * 86400, sessionSeconds: 30 * 86400 }, modelOptions.session), { issuer: origin, scope: key, audience: (_d = (_b = modelOptions.audience) !== null && _b !== void 0 ? _b : (_c = modelOptions.session) === null || _c === void 0 ? void 0 : _c.audience) !== null && _d !== void 0 ? _d : origin, connection: ((_e = modelOptions.session) === null || _e === void 0 ? void 0 : _e.connection) || new model().__connection, isSessionAllowed: (session) => __awaiter(this, void 0, void 0, function* () {
                 const id = fields.primaryKey === "_id" ? yield model.objectId(session.subject, { noExceptions: true }) : session.subject;
                 const user = id !== null && id !== undefined ? yield model.where(fields.primaryKey, "=", id).first() : null;
                 if (!(yield allowed(user)))
@@ -69,12 +81,16 @@ class ModelAuth extends WebAuth_1.WebAuth {
                 sessionUsers.set(session, user);
                 return true;
             }) }));
-        super(sessions, Object.assign(Object.assign({}, modelOptions), { origin, allowInsecureLocalhost: (_e = modelOptions.allowInsecureLocalhost) !== null && _e !== void 0 ? _e : true }));
+        super(sessions, Object.assign(Object.assign({}, modelOptions), { origin, cookiePrefix: (_f = modelOptions.cookiePrefix) !== null && _f !== void 0 ? _f : (key === "main" ? undefined : `${origin.startsWith("https:") ? "__Host-wf_" : "wf_dev_"}${key}_`), allowInsecureLocalhost: (_g = modelOptions.allowInsecureLocalhost) !== null && _g !== void 0 ? _g : true }));
         this.modelOptions = modelOptions;
+        this.key = key;
         this.sessionUsers = sessionUsers;
         this.model = model;
         this.fields = fields;
     }
+    get configuration() {
+        return this.modelOptions;
+    }
     message(code) {
         var _a, _b;
         return (_b = (_a = this.modelOptions.messages) === null || _a === void 0 ? void 0 : _a[code]) !== null && _b !== void 0 ? _b : defaultMessages[this.modelOptions.locale || "en"][code];
@@ -112,14 +128,53 @@ class ModelAuth extends WebAuth_1.WebAuth {
             login: { get: () => super.login }
         });
         return __awaiter(this, void 0, void 0, function* () {
-            const session = yield _super.login.call(this, req, res, verifyCredentials);
+            let user = null;
+            const session = yield _super.login.call(this, req, res, () => __awaiter(this, void 0, void 0, function* () {
+                const subject = yield verifyCredentials();
+                if (subject && (this.modelOptions.beforeLogin || this.modelOptions.afterLogin)) {
+                    const id = this.fields.primaryKey === "_id" ? yield this.model.objectId(subject, { noExceptions: true }) : subject;
+                    user = id == null ? null : yield this.model.where(this.fields.primaryKey, "=", id).first();
+                    if (!user)
+                        throw new AuthLoginError("invalid_login", 401, this.message("invalid_login"));
+                    if (this.modelOptions.beforeLogin) {
+                        try {
+                            yield this.modelOptions.beforeLogin(req, user, this);
+                        }
+                        catch (error) {
+                            throw new AuthHookError("login_blocked", error);
+                        }
+                    }
+                }
+                return subject;
+            }));
             if (this.modelOptions.trackActivity !== false)
                 yield this.sessions.recordLogin(session, (0, AuthSecurity_1.authHeader)(req, "user-agent"));
             if (this.modelOptions.onLogin)
                 yield this.modelOptions.onLogin(session, req);
+            if (this.modelOptions.afterLogin)
+                yield this.modelOptions.afterLogin(req, user, this);
             return session;
         });
     }
+    logout(req, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const session = yield this.logoutSession(req);
+            const user = this.sessionUsers.get(session);
+            if (!user)
+                throw new AuthLoginError("unauthorized", 401, this.message("unauthorized"));
+            if (this.modelOptions.beforeLogout) {
+                try {
+                    yield this.modelOptions.beforeLogout(req, user, this);
+                }
+                catch (error) {
+                    throw new AuthHookError("logout_blocked", error);
+                }
+            }
+            yield this.finishLogout(session, res);
+            if (this.modelOptions.afterLogout)
+                yield this.modelOptions.afterLogout(req, user, this);
+        });
+    }
     /** Resolve a fresh validated session and its model; never trusts a client-supplied req.auth. */
     resolve(req) {
         const _super = Object.create(null, {
@@ -188,6 +243,7 @@ class ModelAuth extends WebAuth_1.WebAuth {
         });
     }
     handle(operation, req, res, loginResponse) {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
             res.header("Cache-Control", "no-store");
             try {
@@ -210,17 +266,10 @@ class ModelAuth extends WebAuth_1.WebAuth {
                 if (!(error instanceof WebAuth_1.WebAuthError))
                     console.error(error);
                 return res.status(error instanceof WebAuth_1.WebAuthError ? error.status : 500).send({ status: "error", code,
-                    message: this.message(code) });
+                    message: error instanceof AuthHookError ? (_b = (_a = this.modelOptions.messages) === null || _a === void 0 ? void 0 : _a[code]) !== null && _b !== void 0 ? _b : error.message : this.message(code) });
             }
         });
     }
 }
-exports.ModelAuth = ModelAuth;
-function authRoute(operation, options) {
-    let auth;
-    return (req, res) => {
-        auth || (auth = typeof options.auth === "function" ? options.auth() : options.auth || new ModelAuth(options));
-        return auth.handle(operation, req, res, options.loginResponse);
-    };
-}
-exports.authRoute = authRoute;
+exports.AuthScope = AuthScope;
+exports.ModelAuth = AuthScope;

package/dist/Auth/SessionAuth.d.ts

@@ -1,9 +1,10 @@
-import type { DocumentDatabase } from "../Database/DatabaseAdapter";
+import type { DatabaseIdAdapter, DocumentDatabase } from "../Database/DatabaseAdapter";
 export type AuthSession = {
     id: string;
     subject: string;
     issuer: string;
     audience: string;
+    scope: string;
     environment: string | null;
     userAgent?: string;
     lastActiveAt?: number;
@@ -27,6 +28,7 @@ export type CreatedAuthSession = SessionTokenPair & {
 export type SessionAuthOptions = {
     issuer: string;
     audience: string;
+    scope?: string;
     environment?: string;
     connection?: string;
     collection?: string;
@@ -37,6 +39,8 @@ export type SessionAuthOptions = {
     isSessionAllowed: (session: AuthSession) => boolean | Promise<boolean>;
     /** Dependency injection for a document-capable driver. Atomic findOneAndUpdate is required. */
     database?: () => Promise<DocumentDatabase>;
+    /** ID handling for an injected document store; otherwise the selected driver owns IDs. */
+    idAdapter?: DatabaseIdAdapter;
 };
 /** Revocable, hashed, independently addressable device sessions. Legacy UserAuth is unaffected. */
 export declare class SessionAuth {
@@ -45,6 +49,8 @@ export declare class SessionAuth {
     private readonly accessSeconds;
     private readonly sessionSeconds;
     constructor(options: SessionAuthOptions);
+    private ids;
+    private sessionId;
     private rows;
     private allowed;
     private pair;

package/dist/Auth/SessionAuth.js

@@ -13,22 +13,32 @@ exports.SessionAuth = void 0;
 const DBConnection_1 = require("../Database/DBConnection");
 const AuthSecurity_1 = require("./AuthSecurity");
 function publicSession(record) {
-    return Object.assign(Object.assign({ id: record.id, subject: record.subject, issuer: record.issuer, audience: record.audience, environment: record.environment, createdAt: record.createdAt, expiresAt: record.expiresAt, parent: record.parent }, (record.userAgent !== undefined ? { userAgent: record.userAgent } : {})), (record.lastActiveAt !== undefined ? { lastActiveAt: record.lastActiveAt } : {}));
+    return Object.assign(Object.assign({ id: String(record._id), subject: String(record._subject), issuer: record.issuer, audience: record.audience, scope: record.scope, environment: record.environment, createdAt: record.createdAt, expiresAt: record.expiresAt, parent: record.parent }, (record.userAgent !== undefined ? { userAgent: record.userAgent } : {})), (record.lastActiveAt !== undefined ? { lastActiveAt: record.lastActiveAt } : {}));
 }
 function tokenSessionId(token) {
-    return typeof token === "string" && /^[A-Za-z0-9_-]{43}\.[A-Za-z0-9_-]{43}$/.test(token) ? token.split(".")[0] : null;
+    return typeof token === "string" && /^[A-Za-z0-9_-]{1,128}\.[A-Za-z0-9_-]{43}$/.test(token) ? token.split(".")[0] : null;
 }
 /** Revocable, hashed, independently addressable device sessions. Legacy UserAuth is unaffected. */
 class SessionAuth {
     constructor(options) {
+        var _a;
         this.options = options;
-        this.scope = { issuer: (0, AuthSecurity_1.authText)(options.issuer, "issuer"), audience: (0, AuthSecurity_1.authText)(options.audience, "audience"),
+        this.scope = { issuer: (0, AuthSecurity_1.authText)(options.issuer, "issuer"), audience: (0, AuthSecurity_1.authText)(options.audience, "audience"), scope: (0, AuthSecurity_1.authText)((_a = options.scope) !== null && _a !== void 0 ? _a : "main", "scope"),
             environment: options.environment === undefined ? null : (0, AuthSecurity_1.authText)(options.environment, "environment") };
         this.accessSeconds = (0, AuthSecurity_1.authLifetime)(options.accessTokenSeconds, 15 * 60);
         this.sessionSeconds = (0, AuthSecurity_1.authLifetime)(options.sessionSeconds, 30 * 86400);
         if (typeof options.isSessionAllowed !== "function")
             throw new Error("SessionAuth requires isSessionAllowed.");
     }
+    ids() {
+        return this.options.idAdapter || DBConnection_1.DBConnection.getIdAdapter(this.options.connection);
+    }
+    sessionId(value) {
+        const adapter = this.ids();
+        const native = adapter.normalize(value);
+        // Converted legacy MongoDB sessions keep working with their existing opaque token prefix.
+        return native !== null && native !== void 0 ? native : (/^[A-Za-z0-9_-]{43}$/.test(value) ? adapter.normalize((0, AuthSecurity_1.hashAuthToken)(value).slice(0, 24)) : null);
+    }
     rows() {
         return __awaiter(this, void 0, void 0, function* () {
             const db = yield (this.options.database ? this.options.database() : DBConnection_1.DBConnection.getDocumentStore(this.options.connection));
@@ -54,9 +64,9 @@ class SessionAuth {
                 (0, AuthSecurity_1.authText)(parent.issuer, "parent issuer");
                 (0, AuthSecurity_1.authText)(parent.sessionId, "parent session");
             }
-            const now = Date.now(), id = (0, AuthSecurity_1.randomAuthToken)();
+            const now = Date.now(), id = this.ids().create();
             const access = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`, refresh = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`, csrf = (0, AuthSecurity_1.randomAuthToken)();
-            const record = Object.assign(Object.assign({ _id: id, id, subject }, this.scope), { parent: parent ? Object.assign({}, parent) : null, createdAt: now, expiresAt: now + this.sessionSeconds * 1000, accessExpiresAt: now + Math.min(this.accessSeconds, this.sessionSeconds) * 1000, accessHash: (0, AuthSecurity_1.hashAuthToken)(access), refreshHash: (0, AuthSecurity_1.hashAuthToken)(refresh), csrfHash: (0, AuthSecurity_1.hashAuthToken)(csrf), usedRefreshHashes: [], revokedAt: null });
+            const record = Object.assign(Object.assign({ _id: id, _subject: this.ids().create(subject) }, this.scope), { parent: parent ? Object.assign({}, parent) : null, createdAt: now, expiresAt: now + this.sessionSeconds * 1000, accessExpiresAt: now + Math.min(this.accessSeconds, this.sessionSeconds) * 1000, accessHash: (0, AuthSecurity_1.hashAuthToken)(access), refreshHash: (0, AuthSecurity_1.hashAuthToken)(refresh), csrfHash: (0, AuthSecurity_1.hashAuthToken)(csrf), usedRefreshHashes: [], revokedAt: null });
             if (!(yield this.allowed(record)))
                 throw new Error("Session is not allowed.");
             yield (yield this.rows()).insertOne(record);
@@ -68,16 +78,16 @@ class SessionAuth {
             const id = tokenSessionId(token);
             if (!id)
                 return null;
-            const row = yield (yield this.rows()).findOne(Object.assign(Object.assign({ _id: id }, this.scope), { accessHash: (0, AuthSecurity_1.hashAuthToken)(token), accessExpiresAt: { $gt: Date.now() } }));
+            const row = yield (yield this.rows()).findOne(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { accessHash: (0, AuthSecurity_1.hashAuthToken)(token), accessExpiresAt: { $gt: Date.now() } }));
             return this.allowed(row);
         });
     }
     /** Trusted-server introspection; never expose this method as an unauthenticated endpoint. */
     inspect(sessionId) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (typeof sessionId !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(sessionId))
+            if (typeof sessionId !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(sessionId))
                 return null;
-            return this.allowed(yield (yield this.rows()).findOne(Object.assign({ _id: sessionId }, this.scope)));
+            return this.allowed(yield (yield this.rows()).findOne(Object.assign({ _id: this.sessionId(sessionId) }, this.scope)));
         });
     }
     verifyCsrf(token, csrf, kind = "access") {
@@ -85,7 +95,7 @@ class SessionAuth {
             const id = tokenSessionId(token);
             if (!id || typeof csrf !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(csrf))
                 return false;
-            const row = yield (yield this.rows()).findOne(Object.assign(Object.assign(Object.assign(Object.assign({ _id: id }, this.scope), (kind === "access" ? { accessHash: (0, AuthSecurity_1.hashAuthToken)(token) } : { $or: [{ refreshHash: (0, AuthSecurity_1.hashAuthToken)(token) }, { usedRefreshHashes: (0, AuthSecurity_1.hashAuthToken)(token) }] })), { csrfHash: (0, AuthSecurity_1.hashAuthToken)(csrf) }), (kind === "access" ? { accessExpiresAt: { $gt: Date.now() } } : {})));
+            const row = yield (yield this.rows()).findOne(Object.assign(Object.assign(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), (kind === "access" ? { accessHash: (0, AuthSecurity_1.hashAuthToken)(token) } : { $or: [{ refreshHash: (0, AuthSecurity_1.hashAuthToken)(token) }, { usedRefreshHashes: (0, AuthSecurity_1.hashAuthToken)(token) }] })), { csrfHash: (0, AuthSecurity_1.hashAuthToken)(csrf) }), (kind === "access" ? { accessExpiresAt: { $gt: Date.now() } } : {})));
             return !!(yield this.allowed(row));
         });
     }
@@ -96,7 +106,7 @@ class SessionAuth {
             if (!id)
                 return null;
             const rows = yield this.rows(), hash = (0, AuthSecurity_1.hashAuthToken)(token);
-            const row = yield rows.findOne(Object.assign({ _id: id }, this.scope));
+            const row = yield rows.findOne(Object.assign({ _id: this.sessionId(id) }, this.scope));
             if (!(yield this.allowed(row)) || !row)
                 return null;
             if (row.refreshHash !== hash) {
@@ -110,12 +120,12 @@ class SessionAuth {
                 return null;
             }
             const access = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`, refresh = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`;
-            const next = yield rows.findOneAndUpdate(Object.assign(Object.assign({ _id: id }, this.scope), { refreshHash: hash, revokedAt: null, expiresAt: { $gt: Date.now() } }), { $set: { accessHash: (0, AuthSecurity_1.hashAuthToken)(access), refreshHash: (0, AuthSecurity_1.hashAuthToken)(refresh),
+            const next = yield rows.findOneAndUpdate(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { refreshHash: hash, revokedAt: null, expiresAt: { $gt: Date.now() } }), { $set: { accessHash: (0, AuthSecurity_1.hashAuthToken)(access), refreshHash: (0, AuthSecurity_1.hashAuthToken)(refresh),
                     accessExpiresAt: Math.min(Date.now() + this.accessSeconds * 1000, row.expiresAt),
                     usedRefreshHashes: [...row.usedRefreshHashes, hash] } }, { returnDocument: "after" });
             if (!next) {
                 // Also detect simultaneous replay that lost the compare-and-swap.
-                yield rows.updateOne(Object.assign(Object.assign({ _id: id }, this.scope), { usedRefreshHashes: hash, revokedAt: null }), { $set: { revokedAt: Date.now() } });
+                yield rows.updateOne(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { usedRefreshHashes: hash, revokedAt: null }), { $set: { revokedAt: Date.now() } });
                 return null;
             }
             return this.pair(next, access, refresh);
@@ -125,7 +135,7 @@ class SessionAuth {
     recordLogin(session, userAgent) {
         return __awaiter(this, void 0, void 0, function* () {
             const metadata = { userAgent: userAgent.slice(0, 512), lastActiveAt: session.createdAt };
-            yield (yield this.rows()).updateOne(Object.assign(Object.assign({ _id: session.id }, this.scope), { revokedAt: null }), { $set: metadata });
+            yield (yield this.rows()).updateOne(Object.assign(Object.assign({ _id: this.sessionId(session.id) }, this.scope), { revokedAt: null }), { $set: metadata });
             Object.assign(session, metadata);
         });
     }
@@ -136,26 +146,26 @@ class SessionAuth {
             const now = Date.now();
             if (((_a = session.lastActiveAt) !== null && _a !== void 0 ? _a : session.createdAt) >= now - 60000)
                 return;
-            yield (yield this.rows()).updateOne(Object.assign(Object.assign({ _id: session.id }, this.scope), { revokedAt: null, expiresAt: { $gt: now } }), { $set: { lastActiveAt: now } });
+            yield (yield this.rows()).updateOne(Object.assign(Object.assign({ _id: this.sessionId(session.id) }, this.scope), { revokedAt: null, expiresAt: { $gt: now } }), { $set: { lastActiveAt: now } });
             session.lastActiveAt = now;
         });
     }
     revoke(sessionId) {
         return __awaiter(this, void 0, void 0, function* () {
             (0, AuthSecurity_1.authText)(sessionId, "session ID");
-            yield (yield this.rows()).updateOne(Object.assign(Object.assign({ _id: sessionId }, this.scope), { revokedAt: null }), { $set: { revokedAt: Date.now() } });
+            yield (yield this.rows()).updateOne(Object.assign(Object.assign({ _id: this.sessionId(sessionId) }, this.scope), { revokedAt: null }), { $set: { revokedAt: Date.now() } });
         });
     }
     revokeAll(subject) {
         return __awaiter(this, void 0, void 0, function* () {
             (0, AuthSecurity_1.authText)(subject, "subject");
-            yield (yield this.rows()).updateMany(Object.assign(Object.assign({ subject }, this.scope), { revokedAt: null }), { $set: { revokedAt: Date.now() } });
+            yield (yield this.rows()).updateMany(Object.assign(Object.assign({ _subject: this.ids().create(subject) }, this.scope), { revokedAt: null }), { $set: { revokedAt: Date.now() } });
         });
     }
     list(subject) {
         return __awaiter(this, void 0, void 0, function* () {
             (0, AuthSecurity_1.authText)(subject, "subject");
-            const rows = yield (yield this.rows()).find(Object.assign(Object.assign({ subject }, this.scope), { revokedAt: null, expiresAt: { $gt: Date.now() } })).toArray();
+            const rows = yield (yield this.rows()).find(Object.assign(Object.assign({ _subject: this.ids().create(subject) }, this.scope), { revokedAt: null, expiresAt: { $gt: Date.now() } })).toArray();
             return rows.map(publicSession);
         });
     }

package/dist/Auth/SingleSignOn.js

@@ -57,6 +57,10 @@ function readSsoClientCredentials(req) {
 exports.readSsoClientCredentials = readSsoClientCredentials;
 function challenge(verifier) { return (0, crypto_1.createHash)("sha256").update(verifier).digest("base64url"); }
 function verifierValid(value) { return typeof value === "string" && /^[A-Za-z0-9._~-]{43,128}$/.test(value); }
+function sessionIdValid(value) {
+    return typeof value === "string" && (/^[a-fA-F0-9]{24}$/.test(value) || /^[0-9]{1,20}$/.test(value)
+        || /^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$/.test(value) || opaqueValid(value));
+}
 function opaqueValid(value) { return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value); }
 function redirectAllowed(value, allowLocal = false) {
     const url = (0, AuthSecurity_1.authUrl)(value, allowLocal);
@@ -245,7 +249,7 @@ class SsoClient {
     identity(value, environment) {
         if (!value || value.issuer !== this.issuer || value.audience !== this.options.clientId || value.environment !== environment ||
             typeof value.subject !== "string" || !value.subject.length || value.subject.length > 512 ||
-            !opaqueValid(value.authoritySessionId) || !Number.isFinite(value.expiresAt) || value.expiresAt <= Date.now())
+            !sessionIdValid(value.authoritySessionId) || !Number.isFinite(value.expiresAt) || value.expiresAt <= Date.now())
             return null;
         return { issuer: value.issuer, audience: value.audience, subject: value.subject, environment: value.environment,
             authoritySessionId: value.authoritySessionId, expiresAt: value.expiresAt };
@@ -272,7 +276,7 @@ class SsoClient {
     }
     introspect(sessionId, environment) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (!opaqueValid(sessionId))
+            if (!sessionIdValid(sessionId))
                 return null;
             (0, AuthSecurity_1.authText)(environment, "environment");
             const response = yield postBackchannel(this.introspection, this.options.clientId, this.options.clientSecret, { session_id: sessionId, environment });

package/dist/Auth/WebAuth.d.ts

@@ -38,5 +38,7 @@ export declare class WebAuth {
     establishSession(subject: string, res: Response, parent?: AuthSession["parent"]): Promise<AuthSession>;
     authenticate(req: Request): Promise<AuthSession | null>;
     refresh(req: Request, res: Response): Promise<AuthSession>;
+    protected logoutSession(req: Request): Promise<AuthSession>;
+    protected finishLogout(session: AuthSession, res: Response): Promise<void>;
     logout(req: Request, res: Response): Promise<void>;
 }

package/dist/Auth/WebAuth.js

@@ -130,16 +130,29 @@ class WebAuth {
             return pair.session;
         });
     }
-    logout(req, res) {
+    logoutSession(req) {
         return __awaiter(this, void 0, void 0, function* () {
             this.post(req);
             const csrf = this.csrf(req), token = this.cookies.read(req, "refresh");
             if (!(yield this.sessions.verifyCsrf(token, csrf, "refresh")))
                 throw new WebAuthError(403, "Invalid session CSRF token.");
-            yield this.sessions.revoke(token.split(".")[0]);
+            const session = yield this.sessions.inspect(token.split(".")[0]);
+            if (!session)
+                throw new WebAuthError(401, "Invalid session.");
+            return session;
+        });
+    }
+    finishLogout(session, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.sessions.revoke(session.id);
             for (const key of ["access", "refresh", "csrf"])
                 this.cookies.write(res, key, "", 0, key !== "csrf");
         });
     }
+    logout(req, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.finishLogout(yield this.logoutSession(req), res);
+        });
+    }
 }
 exports.WebAuth = WebAuth;

package/dist/Auth/index.d.ts

@@ -5,3 +5,4 @@ export * from "./SessionAuth";
 export * from "./WebAuth";
 export * from "./SingleSignOn";
 export * from "./ModelAuth";
+export * from "./Auth";

package/dist/Auth/index.js

@@ -21,3 +21,4 @@ __exportStar(require("./SessionAuth"), exports);
 __exportStar(require("./WebAuth"), exports);
 __exportStar(require("./SingleSignOn"), exports);
 __exportStar(require("./ModelAuth"), exports);
+__exportStar(require("./Auth"), exports);

package/dist/ConsoleApplication.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ConsoleApplication = void 0;
+const Auth_1 = require("./Auth/Auth");
 /// <reference types="node" />
 const Config_1 = require("./Config");
 const ConsoleOutputHelper_1 = require("./Commands/ConsoleOutputHelper");
@@ -63,6 +64,7 @@ class ConsoleApplication {
                 Config_1.Config.register(key, options.config[key]);
             }
         }
+        Auth_1.Auth.init();
         NotificationService_1.NotificationService.init();
         if (options && options.errorHandler) {
             if (Array.isArray(options.errorHandler)) {

package/dist/LambdaApplication.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LambdaApplication = void 0;
+const Auth_1 = require("./Auth/Auth");
 const Config_1 = require("./Config");
 const DatatableRegistry_1 = require("./Datatable/DatatableRegistry");
 const QueueJobsRegisty_1 = require("./Queue/QueueJobsRegisty");
@@ -26,6 +27,7 @@ class LambdaApplication {
                 Config_1.Config.register(key, options.config[key]);
             }
         }
+        Auth_1.Auth.init();
         if (options && options.errorHandler) {
             if (Array.isArray(options.errorHandler)) {
                 ErrorHandler_1.ErrorHandler.setHandlers(options.errorHandler);

package/dist/Router/Route.d.ts

@@ -30,7 +30,7 @@ export declare class RouteFacade {
     /** Register the existing DataBuilder POST protocol with request-local configuration. */
     databuilder(path: string, options?: DataBuilderRouteOptions): void;
     /** Register CSRF, model login, logout and refresh using the browser auth contract. */
-    auth(prefix: string, options: AuthRouteOptions): void;
+    auth(prefix: string, options?: AuthRouteOptions): void;
     /**
      * Register a POST-Method
      *

package/dist/Router/Route.js

@@ -1,10 +1,21 @@
 "use strict";
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Route = exports.RouteFacade = void 0;
 const routing_1 = require("../routing");
 const Router_1 = require("./Router");
 const DataBuilderRoute_1 = require("../DataBuilder/DataBuilderRoute");
-const ModelAuth_1 = require("../Auth/ModelAuth");
+const Auth_1 = require("../Auth/Auth");
 class RouteFacade {
     constructor() {
         this.tempGroupPrefix = null;
@@ -71,15 +82,19 @@ class RouteFacade {
         this.registerWithGroupContext("POST", path, (0, DataBuilderRoute_1.dataBuilderRoute)(options), { middleware: options.middleware, domains: options.domains });
     }
     /** Register CSRF, model login, logout and refresh using the browser auth contract. */
-    auth(prefix, options) {
-        if (!(options === null || options === void 0 ? void 0 : options.auth) && !(options === null || options === void 0 ? void 0 : options.model))
-            throw new Error("Route.auth requires a Model class or auth instance.");
+    auth(prefix, options = {}) {
+        const { auth = "main", loginPath, loginResponse, middleware, domains } = options, overrides = __rest(options, ["auth", "loginPath", "loginResponse", "middleware", "domains"]);
+        if (typeof auth !== "string" || !/^[A-Za-z0-9_-]+$/.test(auth))
+            throw new Error("Route.auth expects an auth scope key.");
+        if (Object.keys(overrides).length) {
+            Auth_1.Auth.registerScope(auth, overrides);
+        }
         const base = prefix.replace(/\/+$/, "");
         const registration = { middleware: options.middleware, domains: options.domains };
-        this.get(`${base}/csrf`, (0, ModelAuth_1.authRoute)("csrf", options), registration);
-        this.post(options.loginPath || `${base}/login`, (0, ModelAuth_1.authRoute)("login", options), registration);
-        this.post(`${base}/logout`, (0, ModelAuth_1.authRoute)("logout", options), registration);
-        this.post(`${base}/refresh`, (0, ModelAuth_1.authRoute)("refresh", options), registration);
+        this.get(`${base}/csrf`, (0, Auth_1.authRoute)("csrf", options), registration);
+        this.post(options.loginPath || `${base}/login`, (0, Auth_1.authRoute)("login", options), registration);
+        this.post(`${base}/logout`, (0, Auth_1.authRoute)("logout", options), registration);
+        this.post(`${base}/refresh`, (0, Auth_1.authRoute)("refresh", options), registration);
     }
     /**
      * Register a POST-Method

package/dist/WebApplication.js

@@ -13,6 +13,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WebApplication = void 0;
+const Auth_1 = require("./Auth/Auth");
 /// <reference types="node" />
 const http_1 = __importDefault(require("http"));
 const Config_1 = require("./Config");
@@ -47,6 +48,7 @@ class WebApplication {
                 Config_1.Config.register(key, options.config[key]);
             }
         }
+        Auth_1.Auth.init();
         NotificationService_1.NotificationService.init();
         if (options && options.errorHandler) {
             if (Array.isArray(options.errorHandler)) {

package/docs/authentication.md

@@ -283,7 +283,7 @@ configuration before rolling the new auth flow out to existing applications.
 ## Standard browser login with `Route.auth`
 
 ```ts
-import { Model, ModelAuth, Route } from "@webtypen/webframez-core";
+import { Model, AuthScope, Route } from "@webtypen/webframez-core";
 
 class User extends Model {
     __table = "users";
@@ -294,7 +294,7 @@ Route.auth("/api/auth", { model: User });
 // GET /api/auth/csrf
 // POST /api/auth/login, /api/auth/logout, /api/auth/refresh
 
-// During registration: user.password = await ModelAuth.hashPassword(password);
+// During registration: user.password = await AuthScope.hashPassword(password);
 ```
 
 Set `auth.origin` or `website.baseUrl` to the canonical public URL (including the
@@ -312,7 +312,7 @@ not trimmed. Store a bcrypt hash; existing bcrypt hashes work without migration.
 and `isUserAllowed` adds account/tenant checks on login and every session access.
 An explicit `false` in `is_active` rejects the account; `fields.active: false`
 disables this field check. Optional `session` options configure storage, scope
-and lifetimes. For `ModelAuth`, access and absolute session lifetimes default to
+and lifetimes. For `AuthScope`, access and absolute session lifetimes default to
 30 days; both remain configurable through `session.accessTokenSeconds` and
 `session.sessionSeconds`. The lower-level `SessionAuth` retains its 15-minute
 access-token default.
@@ -331,8 +331,9 @@ CSRF before login, sends `X-CSRF-Token` on same-origin mutations, and inserts
 `cookieName` supports custom cookie prefixes. For a custom Fetch implementation,
 pass it as the second argument to `createAuthFetch`.
 
-Existing applications can pass `auth: instance` or `auth: () => instance` instead
-of `model`; use a shared `ModelAuth` for middleware and session-management APIs.
+`Route.auth` selects a shared registered scope with `auth: "main"` (the default).
+Model and other scope options passed to `Route.auth` configure that scope in the
+same `Auth` registry, including partial nested overrides.
 `loginPath` keeps existing URLs, `loginResponse` adds application-specific response
 fields (for example a validated redirect), and `onLogin` / `onAuthenticate` add application-specific callbacks. Browser
 user-agent metadata and last activity are recorded automatically; `trackActivity: false`
@@ -342,7 +343,7 @@ be accessible before authentication; apply authentication middleware to protecte
 application routes separately.
 
 
-`audience` is a top-level option in both `Route.auth` and `ModelAuth`. It takes
+`audience` is a top-level option in both `Route.auth` and `AuthScope`. It takes
 precedence over the still-supported `session.audience`; the default is the origin.
 Standard error messages are included in English and German (`locale: "de"`);
 `messages` overrides individual entries while retaining the remaining defaults.
@@ -354,7 +355,7 @@ Route.auth("/api/auth", {
     model: User,
     audience: "simplebis-website",
     locale: "de",
-    session: { collection: "website_auth_sessions" },
+    auth: "main",
     // Optional overrides:
     messages: { invalid_login: "Bitte prüfe deine Zugangsdaten." },
 });
@@ -364,3 +365,66 @@ Session metadata stays in the existing session collection. `sessions.list(subjec
 includes `userAgent` and `lastActiveAt` when available, so applications do not need
 a second model/query or callbacks to maintain the session list. Existing records
 without metadata remain valid; last activity falls back to the creation timestamp.
+
+
+## Named auth scopes and lifecycle hooks
+
+```ts
+import { Auth, Config, Route } from "@webtypen/webframez-core";
+
+Config.register("auth", {
+    scopes: {
+        main: { model: User, audience: "website", locale: "de" },
+        admin: { model: AdminUser, audience: "administration" },
+    },
+});
+Route.auth("/api/auth", {
+    auth: "main",
+    beforeLogin: async (req, user, scope) => {
+        if (!await canLogIn(user, req)) throw new Error("Login denied by policy.");
+    },
+    afterLogin: async (req, user, scope) => { /* Login has completed. */ },
+    beforeLogout: async (req, user, scope) => { /* Throw to prevent logout. */ },
+    afterLogout: async (req, user, scope) => { /* Session revoked and cookies cleared. */ },
+});
+
+Auth.scope(); // same singleton scope as Auth.scope("main")
+Auth.scope("admin");
+Auth.registerScope("staff", { model: StaffUser });
+```
+
+Applications pass the auth configuration to the regular boot `config` object.
+Web, console and Lambda boot initialize the registry after registering Config.
+An automatic `main` scope exists unless `auth.main: false`; define its model in
+`auth.scopes.main` or in `Route.auth({ model: User })` before using login. Configured
+scopes and scopes registered at runtime remain available when automatic main is
+disabled. Unknown keys fail explicitly. `auth.defaults` supplies shared options.
+Registering an existing key updates its scope; routes resolve the current registry
+entry on each request. `ModelAuth` remains a compatibility alias of `AuthScope`.
+
+Each record in the default `auth_sessions` collection contains `scope`. Scope,
+issuer, audience and environment are checked for all session operations. Named
+scopes use separate cookie prefixes by default; configure the browser auth client
+with the selected scope's CSRF cookie name when using a non-main scope.
+The selected driver's ID adapter creates `_id` and converts `_subject`; MongoDB
+stores both as BSON ObjectId. Stored records contain no extra `id` or `subject`.
+Public session metadata still exposes string `id` and `subject` for transport.
+Injected document stores must provide `session.idAdapter` as well as `database`.
+
+The four hooks receive `(req, user, scope)` and await async callbacks. Login hooks
+receive the verified user, never a browser-supplied subject. CSRF and origin checks
+happen first. Exceptions in `beforeLogin` return `login_blocked`, and exceptions
+in `beforeLogout` return `logout_blocked`; the response includes the exception's
+message and a 403 status (or a thrown WebAuthError's status). No session/cookie
+mutation or after-hook occurs on a rejected before-hook. After-hooks run after the
+operation completes; their failures do not undo an already completed operation.
+Existing `onLogin(session, req)` and `onAuthenticate(auth, req)` callbacks remain
+supported. Individual `messages` entries can override before-hook error messages.
+
+When migrating old MongoDB sessions, convert the former opaque `_id` to ObjectId
+using the first 24 hex characters of SHA-256 of the former ID. Convert `subject`
+to `_subject`, remove duplicate `id`/`subject`, and set the correct `scope`. Keep
+hashes and expiry unchanged. SessionAuth recognizes the former token prefixes,
+so converted sessions retain their existing cookies. Applications should run
+an explicit migration while stopping auth writes, rather than changing schemas
+implicitly during a request.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@webtypen/webframez-core",
-    "version": "0.3.73",
+    "version": "0.3.74",
     "description": "The core package of the typescript based webframez (web-framework) by webtypen.de",
     "homepage": "https://webtypen.de/",
     "license": "MIT",