@wizeworks/lens-cloud 0.3.0-alpha.1 → 0.3.0-alpha.2

package/dist/auth/roles.d.ts

@@ -1,8 +1,48 @@
+import { type OrgRole } from "@wizeworks/lens-core";
 /** Roles in an organization, from most to least power. */
 export declare const ROLES: readonly ["owner", "admin", "member", "viewer"];
-export type Role = (typeof ROLES)[number];
-export declare const isRole: (v: unknown) => v is Role;
-/** What each role may do. Read: data, members. Write: alerts, shares. Manage: projects, keys, members, settings. */
+export type Role = OrgRole;
+export declare const isRole: (v: unknown) => v is OrgRole;
+/** Better Auth access control, built from the shared role data. */
+export declare const ac: {
+    newRole<const TRoleStatements extends import("better-auth/plugins/access").Statements>(statements: import("better-auth/plugins/access").RoleInput<{
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+        readonly project: readonly ["read", "create", "update", "delete"];
+        readonly key: readonly ["read", "create", "revoke"];
+        readonly alert: readonly ["read", "create", "update", "delete"];
+        readonly share: readonly ["create", "revoke"];
+        readonly audit: readonly ["read"];
+    }, TRoleStatements>): import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<TRoleStatements>, {
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+        readonly project: readonly ["read", "create", "update", "delete"];
+        readonly key: readonly ["read", "create", "revoke"];
+        readonly alert: readonly ["read", "create", "update", "delete"];
+        readonly share: readonly ["create", "revoke"];
+        readonly audit: readonly ["read"];
+    }>;
+    statements: {
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+        readonly project: readonly ["read", "create", "update", "delete"];
+        readonly key: readonly ["read", "create", "revoke"];
+        readonly alert: readonly ["read", "create", "update", "delete"];
+        readonly share: readonly ["create", "revoke"];
+        readonly audit: readonly ["read"];
+    };
+};
+export declare const authRoles: Record<Role, ReturnType<typeof ac.newRole>>;
+/** What our own routes check. Read: data, members. Write: alerts, shares. Manage: projects, keys, settings. Own: delete the organization. */
 export type Permission = "read" | "write" | "manage" | "own";
 export declare const can: (role: Role, permission: Permission) => boolean;
 /** An admin may not give a role above their own. */

package/dist/auth/roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,eAAO,MAAM,KAAK,YAAI,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AACrE,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1C,eAAO,MAAM,MAAM,MAAO,OAAO,KAAG,CAAC,IAAI,IAAyE,CAAC;AAEnH,oHAAoH;AACpH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAK7D,eAAO,MAAM,GAAG,SAAU,IAAI,cAAc,UAAU,KAAG,OAA2C,CAAC;AAErG,oDAAoD;AACpD,eAAO,MAAM,QAAQ,UAAW,IAAI,UAAU,IAAI,KAAG,OAAwC,CAAC"}
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6D,KAAK,OAAO,EAAsC,MAAM,sBAAsB,CAAC;AAGnJ,0DAA0D;AAC1D,eAAO,MAAM,KAAK,iDAAY,CAAC;AAC/B,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC;AAC3B,eAAO,MAAM,MAAM,8BAAY,CAAC;AAEhC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAyC,CAAC;AACzD,eAAO,MAAM,SAAS,EAAgH,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AAElL,6IAA6I;AAC7I,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAS7D,eAAO,MAAM,GAAG,SAAU,IAAI,cAAc,UAAU,KAAG,OAA8C,CAAC;AAExG,oDAAoD;AACpD,eAAO,MAAM,QAAQ,UAAW,IAAI,UAAU,IAAI,KAAG,OAAgD,CAAC"}

package/dist/auth/roles.js

@@ -1,9 +1,18 @@
+import { ACCESS_STATEMENTS, isOrgRole, ORG_ROLES, ROLE_GRANTS, ROLE_RANK, roleAllows } from "@wizeworks/lens-core";
+import { createAccessControl } from "better-auth/plugins/access";
 /** Roles in an organization, from most to least power. */
-export const ROLES = ["owner", "admin", "member", "viewer"];
-export const isRole = (v) => typeof v === "string" && ROLES.includes(v);
-const LEVEL = { owner: 3, admin: 2, member: 1, viewer: 0 };
-const NEEDS = { read: 0, write: 1, manage: 2, own: 3 };
-export const can = (role, permission) => LEVEL[role] >= NEEDS[permission];
+export const ROLES = ORG_ROLES;
+export const isRole = isOrgRole;
+/** Better Auth access control, built from the shared role data. */
+export const ac = createAccessControl(ACCESS_STATEMENTS);
+export const authRoles = Object.fromEntries(ROLES.map((r) => [r, ac.newRole(ROLE_GRANTS[r])]));
+const NEEDS = {
+    read: { project: ["read"] },
+    write: { alert: ["create"], share: ["create"] },
+    manage: { project: ["create"], key: ["create"] },
+    own: { organization: ["delete"] },
+};
+export const can = (role, permission) => roleAllows(role, NEEDS[permission]);
 /** An admin may not give a role above their own. */
-export const canGrant = (actor, target) => LEVEL[actor] >= LEVEL[target];
+export const canGrant = (actor, target) => ROLE_RANK[actor] >= ROLE_RANK[target];
 //# sourceMappingURL=roles.js.map

package/dist/auth/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGrE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAU,EAAa,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAK,KAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAKnH,MAAM,KAAK,GAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACjF,MAAM,KAAK,GAA+B,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAEnF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAU,EAAE,UAAsB,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;AAErG,oDAAoD;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAW,EAAE,MAAY,EAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoB,SAAS,EAAE,SAAS,EAAgB,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACnJ,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC;AAE/B,MAAM,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC;AAEhC,mEAAmE;AACnE,MAAM,CAAC,MAAM,EAAE,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAqC,CAAC,CAAC,CAAC,CAAgD,CAAC;AAKlL,MAAM,KAAK,GAAoC;IAC7C,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE;IAC3B,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC/C,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE;IAChD,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAC,EAAE;CAClC,CAAC;AAEF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAU,EAAE,UAAsB,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;AAExG,oDAAoD;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAW,EAAE,MAAY,EAAW,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC"}

package/dist/auth/schema-names.d.ts

@@ -0,0 +1,130 @@
+export declare const userNames: {
+    modelName: string;
+    fields: {
+        emailVerified: string;
+        createdAt: string;
+        updatedAt: string;
+    };
+};
+export declare const sessionNames: {
+    modelName: string;
+    fields: {
+        expiresAt: string;
+        createdAt: string;
+        updatedAt: string;
+        ipAddress: string;
+        userAgent: string;
+        userId: string;
+    };
+};
+export declare const accountNames: {
+    modelName: string;
+    fields: {
+        accountId: string;
+        providerId: string;
+        userId: string;
+        accessToken: string;
+        refreshToken: string;
+        idToken: string;
+        accessTokenExpiresAt: string;
+        refreshTokenExpiresAt: string;
+        createdAt: string;
+        updatedAt: string;
+    };
+};
+export declare const verificationNames: {
+    modelName: string;
+    fields: {
+        expiresAt: string;
+        createdAt: string;
+        updatedAt: string;
+    };
+};
+export declare const rateLimitNames: {
+    modelName: string;
+    fields: {
+        lastRequest: string;
+    };
+};
+export declare const orgSchema: {
+    readonly session: {
+        readonly fields: {
+            readonly activeOrganizationId: "active_org_id";
+        };
+    };
+    readonly organization: {
+        readonly modelName: "orgs";
+        readonly fields: {
+            readonly createdAt: "created_at";
+        };
+        readonly additionalFields: {
+            readonly retentionDays: {
+                readonly type: "number";
+                readonly required: true;
+                readonly defaultValue: 30;
+                readonly input: false;
+                readonly fieldName: "retention_days";
+            };
+        };
+    };
+    readonly member: {
+        readonly modelName: "members";
+        readonly fields: {
+            readonly organizationId: "org_id";
+            readonly userId: "user_id";
+            readonly createdAt: "created_at";
+        };
+    };
+    readonly invitation: {
+        readonly modelName: "invites";
+        readonly fields: {
+            readonly organizationId: "org_id";
+            readonly expiresAt: "expires_at";
+            readonly createdAt: "created_at";
+            readonly inviterId: "inviter_id";
+        };
+    };
+};
+export declare const twoFactorSchema: {
+    user: {
+        fields: {
+            twoFactorEnabled: string;
+        };
+    };
+    twoFactor: {
+        modelName: string;
+        fields: {
+            backupCodes: string;
+            userId: string;
+            failedVerificationCount: string;
+            lockedUntil: string;
+        };
+    };
+};
+export declare const passkeySchema: {
+    passkey: {
+        modelName: string;
+        fields: {
+            publicKey: string;
+            userId: string;
+            credentialID: string;
+            deviceType: string;
+            backedUp: string;
+            createdAt: string;
+        };
+    };
+};
+export declare const ssoSchema: {
+    ssoProvider: {
+        modelName: string;
+        fields: {
+            providerId: string;
+            oidcConfig: string;
+            samlConfig: string;
+            userId: string;
+            organizationId: string;
+            domainVerified: string;
+        };
+    };
+};
+//# sourceMappingURL=schema-names.d.ts.map

package/dist/auth/schema-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-names.d.ts","sourceRoot":"","sources":["../../src/auth/schema-names.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,SAAS;IAAK,SAAS;IAAW,MAAM;QAAI,aAAa;QAAoB,SAAS;QAAgB,SAAS;;CAAkB,CAAC;AAE/I,eAAO,MAAM,YAAY;IACvB,SAAS;IACT,MAAM;QAAI,SAAS;QAAgB,SAAS;QAAgB,SAAS;QAAgB,SAAS;QAAgB,SAAS;QAAgB,MAAM;;CAC9I,CAAC;AAEF,eAAO,MAAM,YAAY;IACvB,SAAS;IACT,MAAM;QACJ,SAAS;QACT,UAAU;QACV,MAAM;QACN,WAAW;QACX,YAAY;QACZ,OAAO;QACP,oBAAoB;QACpB,qBAAqB;QACrB,SAAS;QACT,SAAS;;CAEZ,CAAC;AAEF,eAAO,MAAM,iBAAiB;IAAK,SAAS;IAAmB,MAAM;QAAI,SAAS;QAAgB,SAAS;QAAgB,SAAS;;CAAkB,CAAC;AAEvJ,eAAO,MAAM,cAAc;IAAK,SAAS;IAAiB,MAAM;QAAI,WAAW;;CAAoB,CAAC;AAEpG,eAAO,MAAM,SAAS;aACpB,OAAO;iBAAI,MAAM;qBAAI,oBAAoB,EAAE,eAAe;;;aAC1D,YAAY;iBACV,SAAS,EAAE,MAAM;iBACjB,MAAM;qBAAI,SAAS,EAAE,YAAY;;iBACjC,gBAAgB;qBAAI,aAAa;yBAAI,IAAI,EAAE,QAAQ;yBAAE,QAAQ;yBAAQ,YAAY,EAAE,EAAE;yBAAE,KAAK;yBAAS,SAAS,EAAE,gBAAgB;;;;aAElI,MAAM;iBAAI,SAAS,EAAE,SAAS;iBAAE,MAAM;qBAAI,cAAc,EAAE,QAAQ;qBAAE,MAAM,EAAE,SAAS;qBAAE,SAAS,EAAE,YAAY;;;aAC9G,UAAU;iBAAI,SAAS,EAAE,SAAS;iBAAE,MAAM;qBAAI,cAAc,EAAE,QAAQ;qBAAE,SAAS,EAAE,YAAY;qBAAE,SAAS,EAAE,YAAY;qBAAE,SAAS,EAAE,YAAY;;;CACzI,CAAC;AAEX,eAAO,MAAM,eAAe;IAC1B,IAAI;QAAI,MAAM;YAAI,gBAAgB;;;IAClC,SAAS;QACP,SAAS;QACT,MAAM;YAAI,WAAW;YAAkB,MAAM;YAAa,uBAAuB;YAA+B,WAAW;;;CAE9H,CAAC;AAEF,eAAO,MAAM,aAAa;IACxB,OAAO;QACL,SAAS;QACT,MAAM;YAAI,SAAS;YAAgB,MAAM;YAAa,YAAY;YAAmB,UAAU;YAAiB,QAAQ;YAAe,SAAS;;;CAEnJ,CAAC;AAEF,eAAO,MAAM,SAAS;IACpB,WAAW;QACT,SAAS;QACT,MAAM;YAAI,UAAU;YAAiB,UAAU;YAAiB,UAAU;YAAiB,MAAM;YAAa,cAAc;YAAY,cAAc;;;CAEzJ,CAAC"}

package/dist/auth/schema-names.js

@@ -0,0 +1,53 @@
+// Better Auth's models mapped onto our snake_case tables (db/schema-auth.ts). A test checks Better Auth finds nothing to change.
+export const userNames = { modelName: "users", fields: { emailVerified: "email_verified", createdAt: "created_at", updatedAt: "updated_at" } };
+export const sessionNames = {
+    modelName: "sessions",
+    fields: { expiresAt: "expires_at", createdAt: "created_at", updatedAt: "updated_at", ipAddress: "ip_address", userAgent: "user_agent", userId: "user_id" },
+};
+export const accountNames = {
+    modelName: "accounts",
+    fields: {
+        accountId: "account_id",
+        providerId: "provider_id",
+        userId: "user_id",
+        accessToken: "access_token",
+        refreshToken: "refresh_token",
+        idToken: "id_token",
+        accessTokenExpiresAt: "access_token_expires_at",
+        refreshTokenExpiresAt: "refresh_token_expires_at",
+        createdAt: "created_at",
+        updatedAt: "updated_at",
+    },
+};
+export const verificationNames = { modelName: "verifications", fields: { expiresAt: "expires_at", createdAt: "created_at", updatedAt: "updated_at" } };
+export const rateLimitNames = { modelName: "rate_limits", fields: { lastRequest: "last_request" } };
+export const orgSchema = {
+    session: { fields: { activeOrganizationId: "active_org_id" } },
+    organization: {
+        modelName: "orgs",
+        fields: { createdAt: "created_at" },
+        additionalFields: { retentionDays: { type: "number", required: true, defaultValue: 30, input: false, fieldName: "retention_days" } },
+    },
+    member: { modelName: "members", fields: { organizationId: "org_id", userId: "user_id", createdAt: "created_at" } },
+    invitation: { modelName: "invites", fields: { organizationId: "org_id", expiresAt: "expires_at", createdAt: "created_at", inviterId: "inviter_id" } },
+};
+export const twoFactorSchema = {
+    user: { fields: { twoFactorEnabled: "two_factor_enabled" } },
+    twoFactor: {
+        modelName: "two_factors",
+        fields: { backupCodes: "backup_codes", userId: "user_id", failedVerificationCount: "failed_verification_count", lockedUntil: "locked_until" },
+    },
+};
+export const passkeySchema = {
+    passkey: {
+        modelName: "passkeys",
+        fields: { publicKey: "public_key", userId: "user_id", credentialID: "credential_id", deviceType: "device_type", backedUp: "backed_up", createdAt: "created_at" },
+    },
+};
+export const ssoSchema = {
+    ssoProvider: {
+        modelName: "sso_providers",
+        fields: { providerId: "provider_id", oidcConfig: "oidc_config", samlConfig: "saml_config", userId: "user_id", organizationId: "org_id", domainVerified: "domain_verified" },
+    },
+};
+//# sourceMappingURL=schema-names.js.map

package/dist/auth/schema-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-names.js","sourceRoot":"","sources":["../../src/auth/schema-names.ts"],"names":[],"mappings":"AAAA,iIAAiI;AACjI,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;AAE/I,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE;CAC3J,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE;QACN,SAAS,EAAE,YAAY;QACvB,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,cAAc;QAC3B,YAAY,EAAE,eAAe;QAC7B,OAAO,EAAE,UAAU;QACnB,oBAAoB,EAAE,yBAAyB;QAC/C,qBAAqB,EAAE,0BAA0B;QACjD,SAAS,EAAE,YAAY;QACvB,SAAS,EAAE,YAAY;KACxB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;AAEvJ,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,CAAC;AAEpG,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,eAAe,EAAE,EAAE;IAC9D,YAAY,EAAE;QACZ,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE;QACnC,gBAAgB,EAAE,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE;KACrI;IACD,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;IAClH,UAAU,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;CAC7I,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,EAAE;IAC5D,SAAS,EAAE;QACT,SAAS,EAAE,aAAa;QACxB,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,WAAW,EAAE,cAAc,EAAE;KAC9I;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE;QACP,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE;KACjK;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,WAAW,EAAE;QACX,SAAS,EAAE,eAAe;QAC1B,MAAM,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,iBAAiB,EAAE;KAC5K;CACF,CAAC"}

package/dist/auth/secret.d.ts

@@ -0,0 +1,12 @@
+import type { Db } from "../db/db.js";
+export interface AuthSecret {
+    version: number;
+    value: string;
+}
+/** "value", or "2:new,1:old" to rotate (newest first). Rotating signs everyone out; encrypted 2FA data still opens with the old one. */
+export declare function parseSecrets(text: string): AuthSecret[];
+/** The configured secrets. A trial on PGlite without one gets a random secret kept in its own database; Postgres must be given one. */
+export declare function resolveSecrets(db: Db, configured: string | undefined): Promise<AuthSecret[]>;
+/** Better Auth reads these over its options; clear them so only our config counts. */
+export declare function clearAuthEnv(env?: NodeJS.ProcessEnv): void;
+//# sourceMappingURL=secret.d.ts.map

package/dist/auth/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../../src/auth/secret.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAID,wIAAwI;AACxI,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,CAQvD;AAED,uIAAuI;AACvI,wBAAsB,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAQlG;AAED,sFAAsF;AACtF,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAEvE"}

package/dist/auth/secret.js

@@ -0,0 +1,32 @@
+import { randomBytes } from "node:crypto";
+const MIN_LENGTH = 32;
+/** "value", or "2:new,1:old" to rotate (newest first). Rotating signs everyone out; encrypted 2FA data still opens with the old one. */
+export function parseSecrets(text) {
+    const parts = text.split(",").map((s) => s.trim()).filter(Boolean);
+    const secrets = parts.map((p, i) => {
+        const m = /^(\d+):(.+)$/.exec(p);
+        return m ? { version: Number(m[1]), value: m[2] } : { version: parts.length - i, value: p };
+    });
+    if (secrets.length === 0 || secrets.some((s) => s.value.length < MIN_LENGTH))
+        throw new Error(`Each auth secret needs at least ${MIN_LENGTH} characters (try: openssl rand -base64 32).`);
+    return secrets;
+}
+/** The configured secrets. A trial on PGlite without one gets a random secret kept in its own database; Postgres must be given one. */
+export async function resolveSecrets(db, configured) {
+    if (configured)
+        return parseSecrets(configured);
+    if (db.kind === "postgres")
+        throw new Error("Set --auth-secret (or WIZELENS_CLOUD_AUTH_SECRET) to 32 or more random characters: it signs sessions and encrypts 2FA secrets.");
+    const [row] = await db.query("SELECT value FROM cloud_meta WHERE key = 'auth_secret'");
+    if (row)
+        return parseSecrets(row.value);
+    const value = randomBytes(36).toString("base64url");
+    await db.query("INSERT INTO cloud_meta (key, value) VALUES ('auth_secret', $1) ON CONFLICT (key) DO NOTHING", [value]);
+    return resolveSecrets(db, undefined);
+}
+/** Better Auth reads these over its options; clear them so only our config counts. */
+export function clearAuthEnv(env = process.env) {
+    for (const k of ["BETTER_AUTH_TELEMETRY", "BETTER_AUTH_TELEMETRY_ENDPOINT", "BETTER_AUTH_TELEMETRY_DEBUG", "BETTER_AUTH_SECRET", "BETTER_AUTH_SECRETS", "AUTH_SECRET", "BETTER_AUTH_URL"])
+        delete env[k];
+}
+//# sourceMappingURL=secret.js.map

package/dist/auth/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/auth/secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQ1C,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,wIAAwI;AACxI,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC/F,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,6CAA6C,CAAC,CAAC;IAC1L,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uIAAuI;AACvI,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAM,EAAE,UAA8B;IACzE,IAAI,UAAU;QAAE,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,EAAE,CAAC,IAAI,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gIAAgI,CAAC,CAAC;IAC9K,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAoB,wDAAwD,CAAC,CAAC;IAC1G,IAAI,GAAG;QAAE,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,KAAK,CAAC,6FAA6F,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACvH,OAAO,cAAc,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,aAAa,EAAE,iBAAiB,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3M,CAAC"}

package/dist/auth/security-notices.d.ts

@@ -0,0 +1,34 @@
+import { getSessionFromCtx } from "better-auth/api";
+import type { BetterAuthOptions } from "better-auth";
+import type { EmailContent } from "../mail/content.js";
+import * as security from "../mail/emails-security.js";
+import type { AuthDeps } from "./deps.js";
+type DbHooks = NonNullable<BetterAuthOptions["databaseHooks"]>;
+/** "Chrome on Windows". Versions are left out, so a browser update is not a new device. */
+export declare function deviceOf(ua: string | null | undefined): string;
+export declare const linksOf: (deps: Pick<AuthDeps, "publicUrl">) => security.SecurityLinks;
+/** One security notice to the person's address now. */
+export declare function sendSecurity(deps: AuthDeps, userId: string, content: (l: security.SecurityLinks) => EmailContent, to?: string): Promise<void>;
+/** Database hooks for sessions and user changes: new devices, two-step sign-in on or off, and a changed email. */
+export declare function securityDbHooks(deps: AuthDeps): Pick<DbHooks, "session" | "user">;
+/** Before a passkey goes, keep its name for the notice. */
+export declare function rememberPasskey(ctx: {
+    request?: Request;
+    body?: unknown;
+    context: {
+        adapter: {
+            findOne<T>(a: unknown): Promise<T | null>;
+        };
+    };
+}): Promise<void>;
+type AfterCtx = Parameters<typeof getSessionFromCtx>[0] & {
+    path: string;
+    request?: Request;
+    context: {
+        returned?: unknown;
+    };
+};
+/** Notices from endpoints: a changed password, a passkey added or removed, new backup codes. */
+export declare function securityAfter(deps: AuthDeps, ctx: AfterCtx): Promise<void>;
+export {};
+//# sourceMappingURL=security-notices.d.ts.map

package/dist/auth/security-notices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-notices.d.ts","sourceRoot":"","sources":["../../src/auth/security-notices.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,QAAQ,MAAM,4BAA4B,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C,KAAK,OAAO,GAAG,WAAW,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC,CAAC;AAM/D,2FAA2F;AAC3F,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAI9D;AAED,eAAO,MAAM,OAAO,SAAU,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAG,QAAQ,CAAC,aAGnE,CAAC;AAEH,uDAAuD;AACvD,wBAAsB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,aAAa,KAAK,YAAY,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGnJ;AAwBD,kHAAkH;AAClH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC,CAUjF;AAID,2DAA2D;AAC3D,wBAAsB,eAAe,CAAC,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE;QAAE,OAAO,EAAE;YAAE,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpK;AAED,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC;AAE/H,gGAAgG;AAChG,wBAAsB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhF"}

package/dist/auth/security-notices.js

@@ -0,0 +1,81 @@
+import { getSessionFromCtx } from "better-auth/api";
+import * as security from "../mail/emails-security.js";
+import { renderMail } from "../mail/templates.js";
+import { changeOf } from "./email-token.js";
+const BROWSERS = [[/Edg\//, "Edge"], [/OPR\//, "Opera"], [/Firefox\//, "Firefox"], [/Chrome\//, "Chrome"], [/Safari\//, "Safari"]];
+const SYSTEMS = [[/iPhone|iPad/, "iOS"], [/Android/, "Android"], [/Windows/, "Windows"], [/Mac OS X|Macintosh/, "macOS"], [/CrOS/, "ChromeOS"], [/Linux/, "Linux"]];
+/** "Chrome on Windows". Versions are left out, so a browser update is not a new device. */
+export function deviceOf(ua) {
+    const browser = BROWSERS.find(([r]) => r.test(ua ?? ""))?.[1];
+    const system = SYSTEMS.find(([r]) => r.test(ua ?? ""))?.[1];
+    return browser && system ? `${browser} on ${system}` : browser || system || "an unknown device";
+}
+export const linksOf = (deps) => ({
+    account: `${deps.publicUrl}/_wizelens/#/account`,
+    forgot: `${deps.publicUrl}/_wizelens/#/forgot-password`,
+});
+/** One security notice to the person's address now. */
+export async function sendSecurity(deps, userId, content, to) {
+    const [u] = to ? [{ email: to }] : await deps.db.query("SELECT email FROM users WHERE id = $1", [userId]);
+    if (u)
+        deps.mailer.send(renderMail(u.email, content(linksOf(deps))));
+}
+/** A sign-in on a browser and system this person never used gets a notice. The first device (sign-up) does not. */
+async function onSession(deps, s) {
+    const device = deviceOf(s.userAgent);
+    const now = Date.now();
+    const fresh = await deps.db.query("INSERT INTO known_devices (user_id, device, first_ms, last_ms) VALUES ($1, $2, $3, $3) ON CONFLICT DO NOTHING RETURNING device", [s.userId, device, now]);
+    if (fresh.length === 0)
+        return void (await deps.db.query("UPDATE known_devices SET last_ms = $3 WHERE user_id = $1 AND device = $2", [s.userId, device, now]));
+    const [n] = await deps.db.query("SELECT count(*)::int AS n FROM known_devices WHERE user_id = $1", [s.userId]);
+    if ((n?.n ?? 0) > 1)
+        await sendSecurity(deps, s.userId, (l) => security.newSignIn(l, device, s.ipAddress ?? "", now));
+}
+/** What a user update is about to change, kept until it is saved. */
+const pending = new WeakMap();
+async function onUserUpdated(deps, user, ctx) {
+    const change = ctx ? pending.get(ctx) : undefined;
+    if (!change)
+        return;
+    const now = Date.now();
+    if (typeof change.twoFactorEnabled === "boolean")
+        await sendSecurity(deps, user.id, (l) => security.twoFactorChanged(l, change.twoFactorEnabled, now));
+    const moved = changeOf(ctx?.query?.token);
+    if (typeof change.email === "string" && moved && moved.from !== user.email)
+        await sendSecurity(deps, user.id, (l) => security.emailChanged(l, user.email, now), moved.from);
+}
+/** Database hooks for sessions and user changes: new devices, two-step sign-in on or off, and a changed email. */
+export function securityDbHooks(deps) {
+    return {
+        session: { create: { after: async (s) => onSession(deps, s) } },
+        user: {
+            update: {
+                before: async (data, ctx) => void (ctx && pending.set(ctx, data)),
+                after: async (user, ctx) => onUserUpdated(deps, user, ctx),
+            },
+        },
+    };
+}
+const PASSKEY_NAMES = new WeakMap();
+/** Before a passkey goes, keep its name for the notice. */
+export async function rememberPasskey(ctx) {
+    const id = ctx.body?.id;
+    if (!ctx.request || typeof id !== "string")
+        return;
+    const row = await ctx.context.adapter.findOne({ model: "passkey", where: [{ field: "id", value: id }] });
+    PASSKEY_NAMES.set(ctx.request, row?.name ?? "");
+}
+/** Notices from endpoints: a changed password, a passkey added or removed, new backup codes. */
+export async function securityAfter(deps, ctx) {
+    const notices = {
+        "/change-password": (l, now) => security.passwordChanged(l, now),
+        "/passkey/verify-registration": (l, now) => security.passkeyChanged(l, true, ctx.context.returned?.name ?? "", now),
+        "/passkey/delete-passkey": (l, now) => security.passkeyChanged(l, false, (ctx.request && PASSKEY_NAMES.get(ctx.request)) ?? "", now),
+        "/two-factor/generate-backup-codes": (l, now) => security.backupCodesMade(l, now),
+    };
+    const make = notices[ctx.path];
+    const user = make && (await getSessionFromCtx(ctx))?.user;
+    if (make && user)
+        await sendSecurity(deps, user.id, (l) => make(l, Date.now()));
+}
+//# sourceMappingURL=security-notices.js.map

package/dist/auth/security-notices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-notices.js","sourceRoot":"","sources":["../../src/auth/security-notices.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,KAAK,QAAQ,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAK5C,MAAM,QAAQ,GAAuB,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvJ,MAAM,OAAO,GAAuB,CAAC,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,oBAAoB,EAAE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAExL,2FAA2F;AAC3F,MAAM,UAAU,QAAQ,CAAC,EAA6B;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,MAAM,IAAI,mBAAmB,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAiC,EAA0B,EAAE,CAAC,CAAC;IACrF,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,sBAAsB;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,8BAA8B;CACxD,CAAC,CAAC;AAEH,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc,EAAE,MAAc,EAAE,OAAoD,EAAE,EAAW;IAClI,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAoB,uCAAuC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7H,IAAI,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,mHAAmH;AACnH,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,CAA2E;IAClH,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,gIAAgI,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7L,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,0EAA0E,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/J,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAgB,iEAAiE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AACxH,CAAC;AAED,qEAAqE;AACrE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAmC,CAAC;AAE/D,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,IAAmC,EAAE,GAAY;IAC5F,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,SAAS;QAAE,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAAE,MAAM,CAAC,gBAA2B,EAAE,GAAG,CAAC,CAAC,CAAC;IAClK,MAAM,KAAK,GAAG,QAAQ,CAAE,GAAG,EAAE,KAA6C,EAAE,KAAK,CAAC,CAAC;IACnF,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK;QAAE,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AAC9K,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,OAAO;QACL,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;QAC/D,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACjE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;aAC3D;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,OAAO,EAAkB,CAAC;AAEpD,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAA+G;IACnJ,MAAM,EAAE,GAAI,GAAG,CAAC,IAAqC,EAAE,EAAE,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO;IACnD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAA2B,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACnI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAID,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,GAAa;IAC/D,MAAM,OAAO,GAA6E;QACxF,kBAAkB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC;QAChE,8BAA8B,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,EAAG,GAAG,CAAC,OAAO,CAAC,QAA0C,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,CAAC;QACtJ,yBAAyB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC;QACpI,mCAAmC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC;KAClF,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC;IAC1D,IAAI,IAAI,IAAI,IAAI;QAAE,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC"}

package/dist/auth/signup.d.ts

@@ -0,0 +1,23 @@
+import { type BetterAuthOptions } from "better-auth";
+import type { AuthDeps } from "./deps.js";
+type UserOptions = NonNullable<BetterAuthOptions["user"]>;
+type Validate = NonNullable<UserOptions["validateUserInfo"]>;
+export declare const SETUP_HEADER = "x-wizelens-setup-token";
+export declare const INVITE_HEADER = "x-wizelens-invite";
+/** Who may make an account: by SSO, only from a proven domain; the first needs the setup token; then the invited, or anyone with open sign-up. */
+export declare function signupGate(deps: AuthDeps): Validate;
+/** The provider proved the domain and the gate checked the email, so an SSO account starts confirmed. */
+export declare function confirmSsoEmail<U extends {
+    email: string;
+    emailVerified?: boolean;
+}>(user: U, ctx: unknown): Promise<{
+    data: U;
+} | undefined>;
+/** Runs after the new user is saved: the first account and open sign-ups get their own organization and project. */
+export declare function afterSignup(deps: AuthDeps, createOrg: (userId: string, name: string) => Promise<unknown>): (user: {
+    id: string;
+    name: string;
+    email: string;
+}, ctx: unknown) => Promise<void>;
+export {};
+//# sourceMappingURL=signup.d.ts.map

package/dist/auth/signup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../src/auth/signup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,iBAAiB,EAAqB,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C,KAAK,WAAW,GAAG,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,KAAK,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAG7D,eAAO,MAAM,YAAY,2BAA2B,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAmBjD,kJAAkJ;AAClJ,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAcnD;AAKD,yGAAyG;AACzG,wBAAsB,eAAe,CAAC,CAAC,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,GAAG,SAAS,CAAC,CAKnJ;AAED,oHAAoH;AACpH,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,UACnF;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,OAAO,OAAO,KAAG,OAAO,CAAC,IAAI,CAAC,CAW9F"}

package/dist/auth/signup.js

@@ -0,0 +1,61 @@
+import { timingSafeEqual } from "node:crypto";
+import { getCurrentAdapter } from "better-auth";
+import { ssoProviderOf, ssoTrusts } from "./sso.js";
+export const SETUP_HEADER = "x-wizelens-setup-token";
+export const INVITE_HEADER = "x-wizelens-invite";
+const same = (a, b) => a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+/** An open invite for this email (read through Better Auth's adapter, inside its transaction); without real mail, its id too. */
+async function invitedNow(deps, ctx, email) {
+    const db = await getCurrentAdapter(ctx.context.adapter);
+    const rows = await db.findMany({ model: "invitation", where: [{ field: "email", value: email.toLowerCase() }, { field: "status", value: "pending" }] });
+    const open = rows.filter((r) => new Date(r.expiresAt).getTime() > Date.now());
+    if (deps.mailer.live)
+        return open.length > 0;
+    const id = ctx.headers?.get(INVITE_HEADER) ?? "";
+    return open.some((r) => same(r.id, id));
+}
+/** Who may make an account: by SSO, only from a proven domain; the first needs the setup token; then the invited, or anyone with open sign-up. */
+export function signupGate(deps) {
+    return async ({ user, source }, ctx) => {
+        if (source.action !== "create-user")
+            return;
+        const db = await getCurrentAdapter(ctx.context.adapter);
+        const viaSso = ssoProviderOf(source);
+        if (viaSso)
+            return (await ssoTrusts(db, viaSso, String(user.email ?? ""))) ? undefined : { error: "sso_domain", errorDescription: "Single sign-on works only for emails at the provider's verified domain." };
+        if ((await db.count({ model: "user" })) === 0) {
+            const want = deps.setup.token();
+            if (want && same(ctx.headers?.get(SETUP_HEADER) ?? "", want))
+                return;
+            return { error: "setup_token", errorDescription: "The first account needs the setup link printed when the cloud started." };
+        }
+        if (deps.signup === "open" || (await invitedNow(deps, ctx, String(user.email ?? ""))))
+            return;
+        return { error: "signup_closed", errorDescription: "Sign-up needs an invite. Ask your team for one." };
+    };
+}
+/** A new account from single sign-on: the provider's organization takes it in. */
+const bySso = (ctx) => String(ctx?.path ?? "").startsWith("/sso/");
+/** The provider proved the domain and the gate checked the email, so an SSO account starts confirmed. */
+export async function confirmSsoEmail(user, ctx) {
+    const providerId = ctx?.params?.providerId;
+    if (!bySso(ctx) || typeof providerId !== "string")
+        return undefined;
+    const db = await getCurrentAdapter(ctx.context.adapter);
+    return (await ssoTrusts(db, providerId, user.email)) ? { data: { ...user, emailVerified: true } } : undefined;
+}
+/** Runs after the new user is saved: the first account and open sign-ups get their own organization and project. */
+export function afterSignup(deps, createOrg) {
+    return async (user, ctx) => {
+        if (!ctx || bySso(ctx))
+            return;
+        const [count] = await deps.db.query("SELECT count(*)::int AS n FROM users");
+        const [pending] = await deps.db.query("SELECT EXISTS (SELECT 1 FROM invites WHERE email = $1 AND status = 'pending' AND expires_at > now()) AS invited", [user.email.toLowerCase()]);
+        const first = count?.n === 1;
+        if (first)
+            deps.setup.done();
+        if (first || (deps.signup === "open" && !pending?.invited))
+            await createOrg(user.id, `${user.name.trim()}'s team`);
+    };
+}
+//# sourceMappingURL=signup.js.map

package/dist/auth/signup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup.js","sourceRoot":"","sources":["../../src/auth/signup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAA0B,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAMpD,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEjD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAOhH,iIAAiI;AACjI,KAAK,UAAU,UAAU,CAAC,IAAc,EAAE,GAAQ,EAAE,KAAa;IAC/D,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACnK,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,kJAAkJ;AAClJ,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,OAAO,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE;QACrC,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO;QAC5C,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,yEAAyE,EAAE,CAAC;QAC9M,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC;gBAAE,OAAO;YACrE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,wEAAwE,EAAE,CAAC;QAC9H,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO;QAC9F,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,iDAAiD,EAAE,CAAC;IACzG,CAAC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,KAAK,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAE,GAAiC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAE3G,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAuD,IAAO,EAAE,GAAY;IAC/G,MAAM,UAAU,GAAI,GAAoD,EAAE,MAAM,EAAE,UAAU,CAAC;IAC7F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAE,GAAyE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/H,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChH,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,SAA6D;IACvG,OAAO,KAAK,EAAE,IAAiD,EAAE,GAAY,EAAiB,EAAE;QAC9F,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO;QAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAgB,sCAAsC,CAAC,CAAC;QAC3F,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACnC,iHAAiH,EACjH,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAC3B,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/sso.d.ts

@@ -0,0 +1,21 @@
+import type { BetterAuthPlugin } from "better-auth";
+import type { AuthDeps } from "./deps.js";
+/** The DNS record that proves a domain: `_wizelens-sso-<providerId>.<domain>` TXT `<token>`. */
+export declare const SSO_TOKEN_PREFIX = "wizelens-sso";
+interface Finder {
+    findOne<T>(a: {
+        model: string;
+        where: {
+            field: string;
+            value: string;
+        }[];
+    }): Promise<T | null>;
+}
+/** The SSO provider behind a new account, when Better Auth makes it from a single sign-on. */
+export declare function ssoProviderOf(source: unknown): string | undefined;
+/** True when an organization's provider has a proven domain and the email is at exactly that domain. */
+export declare function ssoTrusts(db: Finder, providerId: string, email: string): Promise<boolean>;
+/** Organization SSO with OIDC or SAML. Sign-in works once the domain is proven in DNS; new people join that organization as members. */
+export declare function ssoPlugin(deps: AuthDeps): BetterAuthPlugin;
+export {};
+//# sourceMappingURL=sso.d.ts.map

package/dist/auth/sso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.d.ts","sourceRoot":"","sources":["../../src/auth/sso.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C,gGAAgG;AAChG,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C,UAAU,MAAM;IACd,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAChG;AAQD,8FAA8F;AAC9F,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGjE;AAED,wGAAwG;AACxG,wBAAsB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAK/F;AAED,wIAAwI;AACxI,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,CAc1D"}