@wtfalch/auth 0.14.0 → 0.16.0

package/dist/auth.d.ts

@@ -131,15 +131,21 @@ export interface Completed {
     location: string;
     cookies: SetCookie[];
 }
-/** A person signed in from a link rather than from a flow the browser started. */
-export type SignedIn = {
+/**
+ * A person signed in without the browser driving the flow -- from a link, a
+ * password reset, or headless credentials. `E` is whichever entry point's
+ * own error vocabulary applies: `ResetError` for a link or reset code (the
+ * default, so `followLink` and `resetPassword` are unchanged), `SignInError`
+ * for a password.
+ */
+export type SignedIn<E = ResetError> = {
     ok: true;
     location: string;
     cookies: SetCookie[];
     hosted?: true;
 } | {
     ok: false;
-    error: ResetError;
+    error: E;
     message: string;
 };
 export interface QrSignInStart {
@@ -202,6 +208,21 @@ export interface Auth {
         code: string;
         next?: string;
     }, requestHeaders?: Headers): Promise<SignedIn>;
+    /**
+     * `signIn` as data, for a caller with no browser to carry through the OIDC
+     * redirect -- a CLI, a desktop app, or a server signing in on a person's
+     * behalf. There is no `authRequestId` to receive, because this runs its
+     * own transaction and finishes it itself: `ok: true` already carries the
+     * session, with no `complete()` call left to make. The same two checks as
+     * `followLink` apply -- an `ok: true` with an empty `cookies` means the
+     * issuer handed off to hosted login, and the cookie name is fixed, so the
+     * caller decides where the session goes.
+     */
+    signInWithPassword(input: {
+        email: string;
+        password: string;
+        next?: string;
+    }, requestHeaders?: Headers): Promise<SignedIn<SignInError>>;
     /** Emails a fresh verification link. Says nothing about whether the address exists. */
     resendVerification(email: string, next?: string): Promise<void>;
     /** Emails a password-reset link to {basePath}/reset?userId=&code=. Says nothing about whether the address exists. */

package/dist/auth.js

@@ -541,6 +541,25 @@ export function createAuth(input) {
             return { ok: false, error: signInError(error) };
         }
     };
+    const signInWithPassword = async ({ email, password, next }, requestHeaders) => {
+        try {
+            const flow = await serverFlow();
+            const completed = await finishOrHandoff(() => broker().signIn({ authRequestId: flow.id, email, password }), flow, safeNextPath(next, options().afterLogin), requestHeaders);
+            emit({ type: 'signIn', email });
+            return { ok: true, ...completed };
+        }
+        catch (error) {
+            const code = signInError(error);
+            // `signInError` collapses everything the broker can say into one of
+            // four codes; only a real `BrokerError` carries a sentence worth
+            // showing; a transient failure gets the same generic message every
+            // other headless entry point uses for `unavailable`.
+            const message = code !== 'unavailable' && error instanceof BrokerError
+                ? (error.detail ?? error.error)
+                : 'the sign-in service did not answer';
+            return { ok: false, error: code, message };
+        }
+    };
     const signUp = async ({ authRequestId, ...user }) => {
         try {
             const redirectTo = await broker().signUp({ authRequestId, ...user });
@@ -814,6 +833,7 @@ export function createAuth(input) {
         endSession,
         authRequest,
         signIn,
+        signInWithPassword,
         signUp,
         startPasskeyRegistration,
         finishPasskeyRegistration,

package/dist/names.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Whether a name somebody chose for themselves may be theirs here.
+ *
+ * The words are obscenity's English set plus names.list.ts, matched the way
+ * obscenity matches: look-alikes from other scripts become the Latin letter
+ * they imitate, numbers and symbols standing for letters become the letter
+ * (`n1gg3r`, `f4gg0t`, `$hit`), case is dropped and repeats collapse. Two
+ * matchers, because one cannot do both jobs: the STRICT one keeps the word
+ * boundaries obscenity's patterns rely on, so `cunt` is refused and
+ * `scunthorpe` is not; the LOOSE one skips everything that is not a letter and
+ * carries only the words that are slurs wherever they appear, so `n.i.g.g.e.r`
+ * and `xX_n1gg3r_Xx` are refused too. The strict one is shown the name in a
+ * few shapes -- as typed, split at case changes, with digits taken off the ends
+ * of its parts, and with its separators removed -- so `BigCunt`, `cunt69` and
+ * `c.u.n.t` are all one word to it.
+ *
+ * Reserved names are the ones that would let somebody pass as us or as a
+ * resource path, and the ones held for particular people (names.reserved.ts),
+ * compared on a flattened form so `adm1n` is as reserved as `admin`. A `1` is
+ * read as an `i` and as an `l`, so `wa1id` is `walid` too.
+ *
+ * The letter rules -- what characters, how long -- are the caller's: this is a
+ * login name in ZITADEL and one part of `name@tf.auth.wtfalch.dev`, so the
+ * default is ASCII letters, digits, `_`, `.` and `-`, three to thirty of them.
+ */
+export type Refusal = 'too_short' | 'too_long' | 'characters' | 'reserved' | 'disallowed';
+export type Verdict = {
+    ok: true;
+} | {
+    ok: false;
+    reason: Refusal;
+};
+export interface NameRules {
+    minLength: number;
+    maxLength: number;
+    /** Tested against the name as typed. */
+    pattern: RegExp;
+}
+export declare const DEFAULT_RULES: NameRules;
+/** The refusal as a sentence the person can act on. */
+export declare function explain(reason: Refusal, rules?: NameRules): string;
+export declare function checkName(name: string, rules?: NameRules): Verdict;

package/dist/names.js

@@ -0,0 +1,146 @@
+import { DataSet, RegExpMatcher, collapseDuplicatesTransformer, englishDataset, englishRecommendedTransformers, parseRawPattern, resolveConfusablesTransformer, resolveLeetSpeakTransformer, skipNonAlphabeticTransformer, toAsciiLowerCaseTransformer, } from 'obscenity';
+import reservedUsernames from 'reserved-usernames' with { type: 'json' };
+import { NUMERIC, PHRASES, WHITELIST } from './names.list.js';
+import { PEOPLE, SYSTEM } from './names.reserved.js';
+export const DEFAULT_RULES = {
+    minLength: 3,
+    maxLength: 30,
+    pattern: /^[A-Za-z0-9][A-Za-z0-9._-]*$/,
+};
+const spellings = (entry) => [entry.word, ...(entry.also ?? [])];
+/**
+ * Obscenity collapses repeated letters in the INPUT and matches the patterns
+ * as written, so a pattern has to be written the way its word looks after
+ * collapsing: `fitte` is met as `fite`. The English set allows two of a few
+ * letters (ni_gg_er, a_ss_); the loose matcher allows one of anything.
+ */
+function collapsed(word, twice) {
+    return word.replace(/(.)\1+/g, (run, letter) => twice.includes(letter) ? run.slice(0, 2) : letter);
+}
+const ENGLISH_TWICE = 'beolsg';
+/** Obscenity's English words and ours, with the boundaries each asks for. */
+const strictWords = new DataSet().addAll(englishDataset);
+for (const entry of PHRASES) {
+    strictWords.addPhrase((phrase) => {
+        phrase.setMetadata({ originalWord: entry.word });
+        for (const word of spellings(entry)) {
+            const written = collapsed(word, ENGLISH_TWICE);
+            phrase.addPattern(parseRawPattern(entry.anywhere ? written : `|${written}|`));
+        }
+        return phrase;
+    });
+}
+strictWords.addPhrase((phrase) => {
+    for (const term of WHITELIST)
+        phrase.addWhitelistedTerm(term);
+    return phrase;
+});
+const strict = new RegExpMatcher({ ...strictWords.build(), ...englishRecommendedTransformers });
+/** Only the words that are slurs wherever they appear, read with everything between the letters skipped. */
+const looseWords = new DataSet();
+for (const entry of [
+    ...PHRASES.filter((entry) => entry.anywhere),
+    { word: 'nigger', also: ['nigga'] },
+    { word: 'kike' },
+    { word: 'retard' },
+    { word: 'tranny' },
+]) {
+    looseWords.addPhrase((phrase) => {
+        phrase.setMetadata({ originalWord: entry.word });
+        for (const word of spellings(entry))
+            phrase.addPattern(parseRawPattern(collapsed(word, '')));
+        return phrase;
+    });
+}
+const loose = new RegExpMatcher({
+    ...looseWords.build(),
+    blacklistMatcherTransformers: [
+        resolveConfusablesTransformer(),
+        resolveLeetSpeakTransformer(),
+        toAsciiLowerCaseTransformer(),
+        skipNonAlphabeticTransformer(),
+        collapseDuplicatesTransformer({ defaultThreshold: 1 }),
+    ],
+});
+/** What a digit or symbol stands for when it is standing for a letter. */
+const LETTERS = {
+    '0': ['o'],
+    '1': ['i', 'l'],
+    '!': ['i', 'l'],
+    '|': ['i', 'l'],
+    '2': ['z'],
+    '3': ['e'],
+    '4': ['a'],
+    '@': ['a'],
+    '5': ['s'],
+    $: ['s'],
+    '6': ['g', 'b'],
+    '7': ['t'],
+    '8': ['b'],
+    '9': ['g'],
+};
+/**
+ * Lowercase letters with the digits read as letters and nothing else, runs
+ * collapsed. Every reading, since `1` may be an `i` or an `l`; the first is
+ * the one a list entry is stored under.
+ */
+function flattenings(name) {
+    let forms = [''];
+    for (const char of name.toLowerCase()) {
+        const readings = /[a-z]/.test(char) ? [char] : (LETTERS[char] ?? []);
+        if (readings.length === 0)
+            continue;
+        // Bounded: a name of nothing but `1`s would otherwise double at every one.
+        const next = forms.length * readings.length > 64 ? readings.slice(0, 1) : readings;
+        forms = forms.flatMap((form) => next.map((letter) => form + letter));
+    }
+    return [...new Set(forms.map((form) => form.replace(/(.)\1+/g, '$1')))];
+}
+const reserved = new Set([...reservedUsernames, ...SYSTEM, ...PEOPLE].map((entry) => flattenings(entry)[0]));
+/** The name in the shapes a word might hide in. */
+function shapes(name) {
+    const parts = name.split(/[^A-Za-z0-9æøåÆØÅ]+/).filter(Boolean);
+    return [
+        name,
+        name.replace(/([a-zæøå])([A-ZÆØÅ])/g, '$1 $2'),
+        parts.map((part) => part.replace(/^\d+|\d+$/g, '')).join(' '),
+        parts.join(''),
+    ];
+}
+/** The refusal as a sentence the person can act on. */
+export function explain(reason, rules = DEFAULT_RULES) {
+    switch (reason) {
+        case 'too_short':
+            return `A username needs at least ${rules.minLength} characters.`;
+        case 'too_long':
+            return `A username can have at most ${rules.maxLength} characters.`;
+        case 'characters':
+            return 'A username is letters, digits, dots, dashes and underscores, and starts with a letter or digit.';
+        case 'reserved':
+            return 'That username is reserved.';
+        case 'disallowed':
+            return 'That username is not allowed.';
+    }
+}
+export function checkName(name, rules = DEFAULT_RULES) {
+    const typed = name.trim();
+    if (typed.length < rules.minLength)
+        return { ok: false, reason: 'too_short' };
+    if (typed.length > rules.maxLength)
+        return { ok: false, reason: 'too_long' };
+    if (!rules.pattern.test(typed))
+        return { ok: false, reason: 'characters' };
+    const digitsKept = typed.toLowerCase().replace(/[^a-z0-9]/g, '');
+    if (NUMERIC.some((entry) => digitsKept.includes(entry)))
+        return { ok: false, reason: 'disallowed' };
+    if (loose.hasMatch(typed))
+        return { ok: false, reason: 'disallowed' };
+    if (shapes(typed).some((shape) => strict.hasMatch(shape))) {
+        return { ok: false, reason: 'disallowed' };
+    }
+    // Last, so that a number that means something (`14.88` reads as `lab`) is refused for what it is.
+    if (flattenings(typed).some((form) => reserved.has(form))) {
+        return { ok: false, reason: 'reserved' };
+    }
+    return { ok: true };
+}

package/dist/names.list.d.ts

@@ -0,0 +1,19 @@
+/**
+ * What obscenity's English set does not know, and what is ours. Edit freely.
+ *
+ * `anywhere` words are refused wherever they appear, however spelled -- so
+ * only words with no innocent containing word belong there; `coon` (raccoon)
+ * and `paki` (Pakistan) do not. The rest are refused as a whole name or as a
+ * part of one split at separators and case changes: `nazi` and `big_nazi`
+ * are out, `ashkenazi` is not. `also` lists other spellings of the same word.
+ */
+export interface Entry {
+    word: string;
+    anywhere?: boolean;
+    also?: string[];
+}
+export declare const PHRASES: Entry[];
+/** Innocent names obscenity's English patterns would otherwise catch. */
+export declare const WHITELIST: string[];
+/** Read on the name with its digits kept, for the things that are numbers. */
+export declare const NUMERIC: string[];

package/dist/names.list.js

@@ -0,0 +1,42 @@
+export const PHRASES = [
+    // en, beyond obscenity's set
+    { word: 'faggot', anywhere: true },
+    { word: 'chink', anywhere: true },
+    { word: 'wetback', anywhere: true },
+    { word: 'raghead', anywhere: true },
+    { word: 'towelhead', anywhere: true },
+    { word: 'hitler', anywhere: true },
+    { word: 'gook' },
+    { word: 'spic' },
+    { word: 'coon' },
+    { word: 'paki' },
+    { word: 'nazi' },
+    { word: 'pedo', also: ['paedo', 'pedophile', 'paedophile'] },
+    { word: 'rapist' },
+    { word: 'homo' },
+    // no
+    { word: 'neger', anywhere: true },
+    { word: 'svarting', anywhere: true },
+    { word: 'sotrør', anywhere: true, also: ['sotror'] },
+    { word: 'morraknuller', anywhere: true },
+    { word: 'morrapuler', anywhere: true },
+    { word: 'pakkis' }, // collapsed to `pakis`, it would hide in pakistan; whole word only
+    { word: 'faen' },
+    { word: 'fitte' },
+    { word: 'kuk' },
+    { word: 'pikk' },
+    { word: 'hore' },
+    { word: 'ræva', also: ['raeva', 'reva'] },
+    { word: 'helvete' },
+    { word: 'jævla', also: ['jaevla', 'jevla', 'jævlig', 'jaevlig', 'jevlig'] },
+    { word: 'drittsekk' },
+    { word: 'soper' },
+    { word: 'homse' },
+    { word: 'mongo', also: ['mongis'] },
+    { word: 'tater' },
+    { word: 'sigøyner', also: ['sigoyner'] },
+];
+/** Innocent names obscenity's English patterns would otherwise catch. */
+export const WHITELIST = ['shiitake', 'fager'];
+/** Read on the name with its digits kept, for the things that are numbers. */
+export const NUMERIC = ['kkk', '1488'];

package/dist/names.reserved.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Names nobody may choose. Edit freely; order and duplicates do not matter.
+ *
+ * Both lists are compared on a flattened form: lower case, digits and symbols
+ * read as the letters they stand for, repeated letters collapsed. So `adm1n`,
+ * `Admin`, `a.d.m.i.n` and `aadmin` are all `admin`, and `K4i` is `kai`.
+ *
+ * SYSTEM is every name that would let somebody pass as us, as the software,
+ * as a mailbox that means something, or as a path an app is likely to have.
+ * The `reserved-usernames` package is applied as well, so this list is the
+ * one we can read and vouch for rather than the only one.
+ *
+ * PEOPLE are names held for particular people. They are refused like the
+ * system ones, so the person they are held for gets them by being given
+ * them, not by racing for them.
+ */
+export declare const SYSTEM: string[];
+export declare const PEOPLE: string[];

package/dist/names.reserved.js

@@ -0,0 +1,732 @@
+/**
+ * Names nobody may choose. Edit freely; order and duplicates do not matter.
+ *
+ * Both lists are compared on a flattened form: lower case, digits and symbols
+ * read as the letters they stand for, repeated letters collapsed. So `adm1n`,
+ * `Admin`, `a.d.m.i.n` and `aadmin` are all `admin`, and `K4i` is `kai`.
+ *
+ * SYSTEM is every name that would let somebody pass as us, as the software,
+ * as a mailbox that means something, or as a path an app is likely to have.
+ * The `reserved-usernames` package is applied as well, so this list is the
+ * one we can read and vouch for rather than the only one.
+ *
+ * PEOPLE are names held for particular people. They are refused like the
+ * system ones, so the person they are held for gets them by being given
+ * them, not by racing for them.
+ */
+export const SYSTEM = [
+    // Who runs the place
+    'admin',
+    'admins',
+    'administrator',
+    'administrators',
+    'sysadmin',
+    'sysop',
+    'root',
+    'superuser',
+    'su',
+    'sudo',
+    'owner',
+    'owners',
+    'master',
+    'manager',
+    'managers',
+    'management',
+    'operator',
+    'operators',
+    'moderator',
+    'moderators',
+    'mod',
+    'mods',
+    'staff',
+    'team',
+    'teams',
+    'crew',
+    'official',
+    'officials',
+    'founder',
+    'founders',
+    'ceo',
+    'cto',
+    'cfo',
+    'coo',
+    'boss',
+    'chief',
+    'director',
+    'employee',
+    'employees',
+    'agent',
+    'agents',
+    'representative',
+    'rep',
+    'verified',
+    'trusted',
+    'vip',
+    // The software and the machines
+    'system',
+    'sys',
+    'daemon',
+    'service',
+    'services',
+    'server',
+    'servers',
+    'host',
+    'hosts',
+    'hostname',
+    'localhost',
+    'local',
+    'bot',
+    'bots',
+    'robot',
+    'robots',
+    'automation',
+    'cron',
+    'scheduler',
+    'worker',
+    'workers',
+    'job',
+    'jobs',
+    'queue',
+    'cache',
+    'db',
+    'database',
+    'databases',
+    'sql',
+    'postgres',
+    'postgresql',
+    'redis',
+    'backup',
+    'backups',
+    'storage',
+    'bucket',
+    'cdn',
+    'static',
+    'assets',
+    'public',
+    'private',
+    'internal',
+    'external',
+    'default',
+    'config',
+    'configuration',
+    'settings',
+    'preferences',
+    'options',
+    'env',
+    'environment',
+    'dev',
+    'development',
+    'staging',
+    'stage',
+    'prod',
+    'production',
+    'test',
+    'tests',
+    'testing',
+    'tester',
+    'demo',
+    'sandbox',
+    'alpha',
+    'beta',
+    'preview',
+    'canary',
+    'nightly',
+    'debug',
+    'trace',
+    'log',
+    'logs',
+    'metrics',
+    'monitor',
+    'monitoring',
+    'health',
+    'healthz',
+    'healthcheck',
+    'status',
+    'ping',
+    'uptime',
+    // The network and its protocols
+    'www',
+    'web',
+    'http',
+    'https',
+    'ftp',
+    'sftp',
+    'ssh',
+    'telnet',
+    'dns',
+    'ns',
+    'mx',
+    'vpn',
+    'proxy',
+    'gateway',
+    'router',
+    'firewall',
+    'ip',
+    'tcp',
+    'udp',
+    'smtp',
+    'imap',
+    'pop',
+    'mail',
+    'email',
+    'emails',
+    'e-mail',
+    'mailer',
+    'mailer-daemon',
+    'mailbox',
+    'inbox',
+    'outbox',
+    'postmaster',
+    'hostmaster',
+    'webmaster',
+    'listmaster',
+    'abuse',
+    'noc',
+    'security',
+    'usenet',
+    'news',
+    'uucp',
+    'noreply',
+    'no-reply',
+    'no_reply',
+    'donotreply',
+    'do-not-reply',
+    'reply',
+    'bounce',
+    'bounces',
+    'api',
+    'apis',
+    'graphql',
+    'rest',
+    'rpc',
+    'grpc',
+    'ws',
+    'wss',
+    'socket',
+    'websocket',
+    'webhook',
+    'webhooks',
+    'callback',
+    'callbacks',
+    'oauth',
+    'oauth2',
+    'oidc',
+    'openid',
+    'sso',
+    'saml',
+    'ldap',
+    'auth',
+    'authn',
+    'authz',
+    'authentication',
+    'authorization',
+    'authorize',
+    'token',
+    'tokens',
+    'jwt',
+    'key',
+    'keys',
+    'apikey',
+    'secret',
+    'secrets',
+    'cert',
+    'certs',
+    'certificate',
+    'ssl',
+    'tls',
+    'acme',
+    'well-known',
+    'robots.txt',
+    'sitemap',
+    'favicon',
+    'manifest',
+    // Getting in and out
+    'login',
+    'logon',
+    'logout',
+    'logoff',
+    'signin',
+    'sign-in',
+    'sign_in',
+    'signout',
+    'sign-out',
+    'sign_out',
+    'signup',
+    'sign-up',
+    'sign_up',
+    'register',
+    'registration',
+    'unregister',
+    'session',
+    'sessions',
+    'password',
+    'passwords',
+    'passwd',
+    'pwd',
+    'reset',
+    'recover',
+    'recovery',
+    'forgot',
+    'verify',
+    'verification',
+    'confirm',
+    'confirmation',
+    'activate',
+    'activation',
+    'deactivate',
+    'invite',
+    'invites',
+    'invitation',
+    'invitations',
+    'join',
+    'onboarding',
+    'welcome',
+    'account',
+    'accounts',
+    'profile',
+    'profiles',
+    'user',
+    'users',
+    'username',
+    'usernames',
+    'member',
+    'members',
+    'membership',
+    'people',
+    'person',
+    'identity',
+    'identities',
+    'credential',
+    'credentials',
+    // Pronouns and placeholders that read as somebody
+    'me',
+    'my',
+    'mine',
+    'myself',
+    'self',
+    'i',
+    'you',
+    'your',
+    'yours',
+    'yourself',
+    'we',
+    'us',
+    'our',
+    'ours',
+    'they',
+    'them',
+    'their',
+    'everyone',
+    'everybody',
+    'anyone',
+    'anybody',
+    'someone',
+    'somebody',
+    'nobody',
+    'noone',
+    'no-one',
+    'all',
+    'any',
+    'none',
+    'guest',
+    'guests',
+    'visitor',
+    'anonymous',
+    'anon',
+    'unknown',
+    'unnamed',
+    'noname',
+    'nobody',
+    'null',
+    'nil',
+    'nan',
+    'undefined',
+    'void',
+    'true',
+    'false',
+    'yes',
+    'no',
+    'ok',
+    'example',
+    'examples',
+    'sample',
+    'samples',
+    'placeholder',
+    'dummy',
+    'foo',
+    'bar',
+    'baz',
+    'tbd',
+    'tba',
+    'todo',
+    'temp',
+    'tmp',
+    'deleted',
+    'removed',
+    'banned',
+    'suspended',
+    'disabled',
+    'inactive',
+    'blocked',
+    'spam',
+    'spammer',
+    'junk',
+    'trash',
+    'fake',
+    'scam',
+    // Mailboxes and departments people write to
+    'info',
+    'information',
+    'contact',
+    'contacts',
+    'contactus',
+    'contact-us',
+    'hello',
+    'hi',
+    'hey',
+    'help',
+    'helpdesk',
+    'support',
+    'customerservice',
+    'customer-service',
+    'customercare',
+    'service-desk',
+    'servicedesk',
+    'faq',
+    'feedback',
+    'complaints',
+    'report',
+    'reports',
+    'sales',
+    'marketing',
+    'billing',
+    'invoice',
+    'invoices',
+    'payment',
+    'payments',
+    'pay',
+    'finance',
+    'accounting',
+    'legal',
+    'privacy',
+    'compliance',
+    'hr',
+    'careers',
+    'recruiting',
+    'press',
+    'media',
+    'pr',
+    'partners',
+    'partner',
+    'partnership',
+    'affiliate',
+    'affiliates',
+    'sponsor',
+    'sponsors',
+    'newsletter',
+    'newsletters',
+    'notification',
+    'notifications',
+    'alert',
+    'alerts',
+    'update',
+    'updates',
+    'announcement',
+    'announcements',
+    'digest',
+    'subscribe',
+    'unsubscribe',
+    'subscription',
+    'subscriptions',
+    // Pages an app is likely to have
+    'home',
+    'homepage',
+    'index',
+    'main',
+    'app',
+    'apps',
+    'application',
+    'applications',
+    'dashboard',
+    'console',
+    'panel',
+    'cpanel',
+    'control',
+    'about',
+    'aboutus',
+    'about-us',
+    'terms',
+    'tos',
+    'terms-of-service',
+    'policy',
+    'policies',
+    'cookie',
+    'cookies',
+    'imprint',
+    'copyright',
+    'license',
+    'licenses',
+    'licence',
+    'dmca',
+    'pricing',
+    'price',
+    'prices',
+    'plan',
+    'plans',
+    'premium',
+    'pro',
+    'plus',
+    'free',
+    'upgrade',
+    'downgrade',
+    'checkout',
+    'cart',
+    'shop',
+    'store',
+    'order',
+    'orders',
+    'receipt',
+    'refund',
+    'refunds',
+    'donate',
+    'donation',
+    'blog',
+    'blogs',
+    'article',
+    'articles',
+    'post',
+    'posts',
+    'page',
+    'pages',
+    'wiki',
+    'doc',
+    'docs',
+    'documentation',
+    'guide',
+    'guides',
+    'tutorial',
+    'tutorials',
+    'learn',
+    'community',
+    'agora',
+    'forum',
+    'forums',
+    'chat',
+    'chats',
+    'message',
+    'messages',
+    'messaging',
+    'dm',
+    'search',
+    'explore',
+    'discover',
+    'browse',
+    'trending',
+    'popular',
+    'featured',
+    'new',
+    'latest',
+    'top',
+    'best',
+    'recent',
+    'random',
+    'archive',
+    'archives',
+    'history',
+    'activity',
+    'event',
+    'events',
+    'calendar',
+    'schedule',
+    'task',
+    'tasks',
+    'project',
+    'projects',
+    'group',
+    'groups',
+    'organization',
+    'organizations',
+    'organisation',
+    'organisations',
+    'org',
+    'orgs',
+    'company',
+    'companies',
+    'enterprise',
+    'business',
+    'workspace',
+    'workspaces',
+    'site',
+    'sites',
+    'website',
+    'portal',
+    'hub',
+    'center',
+    'centre',
+    'lab',
+    'labs',
+    'studio',
+    'developer',
+    'developers',
+    'engineering',
+    'design',
+    'product',
+    'products',
+    'feature',
+    'features',
+    'roadmap',
+    'changelog',
+    'release',
+    'releases',
+    'version',
+    'versions',
+    'download',
+    'downloads',
+    'upload',
+    'uploads',
+    'file',
+    'files',
+    'image',
+    'images',
+    'img',
+    'photo',
+    'photos',
+    'video',
+    'videos',
+    'audio',
+    'music',
+    'stream',
+    'streams',
+    'live',
+    'play',
+    'player',
+    'game',
+    'games',
+    'install',
+    'setup',
+    'start',
+    'getting-started',
+    'connect',
+    'share',
+    'embed',
+    'widget',
+    'widgets',
+    'plugin',
+    'plugins',
+    'extension',
+    'extensions',
+    'integration',
+    'integrations',
+    'marketplace',
+    'tools',
+    'resources',
+    'library',
+    'gallery',
+    'stats',
+    'statistics',
+    'analytics',
+    'insights',
+    'export',
+    'import',
+    'sync',
+    'print',
+    'edit',
+    'delete',
+    'remove',
+    'create',
+    'add',
+    'save',
+    'cancel',
+    'submit',
+    'send',
+    'error',
+    'errors',
+    '404',
+    '500',
+    'not-found',
+    'notfound',
+    'forbidden',
+    'unauthorized',
+    // Us, and the software we run
+    'tf',
+    'offline',
+    'the',
+    'wtfalch',
+    'tallis',
+    'falch',
+    'valet',
+    'lokessmie',
+    'proach',
+    'zitadel',
+    'coolify',
+    'cloudflare',
+    'resend',
+    // The same, in Norwegian
+    'drift',
+    'driftsansvarlig',
+    'brukerstotte',
+    'hjelp',
+    'kundeservice',
+    'kundestotte',
+    'kontakt',
+    'kontakt-oss',
+    'kontaktoss',
+    'post',
+    'epost',
+    'e-post',
+    'nyheter',
+    'nyhetsbrev',
+    'personvern',
+    'vilkar',
+    'betaling',
+    'faktura',
+    'konto',
+    'kontoer',
+    'bruker',
+    'brukere',
+    'brukernavn',
+    'innlogging',
+    'logginn',
+    'logg-inn',
+    'loggut',
+    'logg-ut',
+    'registrer',
+    'registrering',
+    'passord',
+    'sikkerhet',
+    'ansatt',
+    'ansatte',
+    'ledelse',
+    'leder',
+    'eier',
+    'sjef',
+    'offisiell',
+    'tjeneste',
+    'tjenester',
+    'hjem',
+    'forside',
+    'om',
+    'om-oss',
+    'omoss',
+    'sok',
+    'alle',
+    'ingen',
+    'gjest',
+    'gjester',
+    'anonym',
+    'ukjent',
+    'slettet',
+    'sperret',
+    'prove',
+    'eksempel',
+];
+export const PEOPLE = [
+    'william',
+    'kai',
+    'alex',
+    'walid',
+    'odin',
+    'audun',
+    'peter',
+    'anne',
+];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Sign in against auth.wtfalch.dev: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",
@@ -30,6 +30,10 @@
       "types": "./dist/namespaces.d.ts",
       "default": "./dist/namespaces.js"
     },
+    "./names": {
+      "types": "./dist/names.d.ts",
+      "default": "./dist/names.js"
+    },
     "./namespace-server": {
       "types": "./dist/namespace-server.d.ts",
       "default": "./dist/namespace-server.js"
@@ -55,7 +59,9 @@
   },
   "dependencies": {
     "jose": "^6.2.10",
-    "openid-client": "6.8.7"
+    "obscenity": "^0.4.6",
+    "openid-client": "6.8.7",
+    "reserved-usernames": "^1.1.6"
   },
   "peerDependencies": {
     "next": ">=15.0.0"