@wtfalch/auth 0.19.0 → 0.22.0

package/README.md

@@ -94,6 +94,15 @@ Auth-request lookup failures lead to the configured error page with
 `auth_error=request` or `auth_error=unavailable`. That page should show a
 retry link; it must not automatically restart authorization.
 
+When a sign-in fails after it started (reasons such as `state`, `unavailable`,
+`exchange`, `denied`, `organization`, `cookie`), the error URL is
+`<onError>?auth_error=<reason>&next=<path>`. `next` is the page the person came
+for, always a path starting with one `/`, URL-encoded as a single parameter, and
+present only when the sealed value is a safe same-origin path. An `onError` that
+already has a query string keeps it. `expired` and `request` carry no `next`:
+there is no transaction to read it from. Use it for the retry link
+(`/auth/start?next=<path>`); a page that ignores it behaves as before.
+
 ## In a browser app
 
 `@wtfalch/auth/browser` is the other half: a public PKCE client for an app that
@@ -248,7 +257,7 @@ refresh token to begin with.
 | `appUrl` | This app's origin. Every URL the SDK builds starts here, never from the request's `Host`. |
 | `clientId` | The OIDC client for this origin. Each URL an app runs at is its own client, because the issuer holds one login URL per application. |
 | `organizationId` | Scopes every sign-in, and is checked on every token. |
-| `cookieSecret` | 32 bytes, `openssl rand -base64 32`. One per app. |
+| `cookieSecret` | 32 bytes, `openssl rand -base64 32`. **Each app needs its own** -- see below. |
 | `appKey` | This app's key for the sign-in service. Needed for anything that checks or creates a credential. |
 
 Values are read on first use rather than at import, so `next build` needs none
@@ -260,6 +269,13 @@ unset: the error waits until something actually reaches for the key. A secret
 that is *supplied and wrong* still throws at startup, because that is a typo
 rather than a deployment that does not need one.
 
+**Each app's `cookieSecret` must be its own, not shared with another app.**
+The AES key `cookies.ts` actually encrypts and decrypts with is HKDF-SHA256
+derived from `cookieSecret` using a fixed info string common to every
+consumer of this package -- two apps given the same `cookieSecret` would
+derive the identical key and could open each other's session cookies.
+Foundry already mints a distinct secret per app.
+
 ## What the app key can do
 
 It reaches the sign-in service, which holds ZITADEL's login client. Scoped to

package/dist/auth.d.ts

@@ -251,6 +251,18 @@ export interface Auth {
     }, requestHeaders?: Headers): Promise<SignedIn<SignInError> | (PasswordChangeRequired & {
         message: string;
     })>;
+    /**
+     * `signUp` as data, run over the same server-started transaction as
+     * `signInWithPassword` -- for a caller with no browser to carry through
+     * the OIDC redirect. Unlike `signUp`, which needs an `authRequestId` a
+     * browser flow already started with `start()`, this starts and finishes
+     * its own transaction, exactly as `signInWithPassword` does. Same two
+     * checks apply: an `ok: true` with an empty `cookies` means hosted
+     * login, and the cookie name is fixed.
+     */
+    signUpWithPassword(input: {
+        next?: string;
+    } & NewUser, requestHeaders?: Headers): Promise<SignedIn<SignUpError>>;
     /** Emails a fresh verification link. Says nothing about whether the address exists. */
     resendVerification(email: string, next?: string): Promise<void>;
     /** Emails a password-reset link to {basePath}/reset?userId=&code=. Says nothing about whether the address exists. */
@@ -278,6 +290,21 @@ export interface Auth {
     }): Promise<{
         userId: string;
         invited: boolean;
+        personalEmailStored: boolean;
+    }>;
+    /**
+     * A company's own test user: a new person, marked in the sign-in service
+     * so nothing it does is read as a real customer. Refused for an address
+     * that already has a user, and for an entry that acts as another (stage,
+     * a laptop) -- a test user is made from production's entry.
+     */
+    createTestUser(input: {
+        email: string;
+        givenName: string;
+        familyName: string;
+        username?: string;
+    }): Promise<{
+        userId: string;
     }>;
     handle(request: Request): Promise<Response>;
     /**
@@ -331,6 +358,17 @@ export interface Auth {
         userId: string;
         state: string;
     }>;
+    /**
+     * An admin's reset for somebody in this app's own organisation whom
+     * `requestPasswordReset` cannot otherwise get back in -- returns a fresh
+     * one-time password the caller is trusted to deliver some other way,
+     * rather than mailing it. Refused for a user outside this app's
+     * organisation.
+     */
+    adminResetPassword(userId: string): Promise<{
+        userId: string;
+        password: string;
+    }>;
     /**
      * Namespace mode: end every session this person has in this service, on
      * every replica, at their next request. Deactivating someone does this too.

package/dist/auth.js

@@ -159,9 +159,9 @@ export function createAuth(input) {
             return failure('expired', options().namespace ? [] : [cleared]);
         const params = new URL(callbackUrl).searchParams;
         if (params.get('state') !== transaction.st)
-            return failure('state', options().namespace ? [] : [cleared]);
+            return failure('state', options().namespace ? [] : [cleared], transaction.nx);
         if (options().namespace && !(await sessions.bindingActive()))
-            return failure('unavailable', [cleared]);
+            return failure('unavailable', [cleared], transaction.nx);
         // A silent pass the issuer refused (login_required, interaction_required,
         // consent_required, or any other error) is not a failure: sign in the normal
         // way, once. `done` is already set, so `/start` will not go silent again.
@@ -181,7 +181,7 @@ export function createAuth(input) {
             session = await sessionCookie(tokens, requestHeaders);
         }
         catch (error) {
-            return failure(reasonOf(error), [cleared]);
+            return failure(reasonOf(error), [cleared], transaction.nx);
         }
         await replacePreviousSession(cookieHeader);
         return {
@@ -539,6 +539,25 @@ export function createAuth(input) {
         emit({ type: 'invite', email: input.email, userId: result.userId, invited: result.invited });
         return result;
     };
+    const createTestUser = async (input) => {
+        const result = await broker().createTestUser(input);
+        emit({ type: 'createTestUser', email: input.email, userId: result.userId });
+        return result;
+    };
+    /**
+     * An admin's reset for somebody in this app's own organisation whom
+     * `requestPasswordReset` cannot otherwise get back in -- nobody at the
+     * mailbox a personal address or the login address itself would reach.
+     * Refused for a user outside this app's organisation, exactly as
+     * `setPersonActive` is. The password is a one-time one: the person must
+     * choose their own at next sign-in, same as an invite's. Audited with the
+     * target's id and never the password itself.
+     */
+    const adminResetPassword = async (userId) => {
+        const result = await broker().adminResetPassword(userId);
+        emit({ type: 'adminResetPassword', userId: result.userId });
+        return result;
+    };
     const resetPassword = async ({ userId, code, password, next, }, requestHeaders) => {
         try {
             const flow = await serverFlow();
@@ -656,6 +675,36 @@ export function createAuth(input) {
             return { ok: false, error: code, message };
         }
     };
+    const signUpWithPassword = async ({ next, ...user }, requestHeaders) => {
+        try {
+            const flow = await serverFlow();
+            const completed = await finishOrHandoff(() => broker().signUp({ authRequestId: flow.id, ...user }), flow, safeNextPath(next, options().afterLogin), requestHeaders);
+            emit({ type: 'signUp', email: user.email });
+            return { ok: true, ...completed };
+        }
+        catch (error) {
+            if (error instanceof BrokerError && error.error === 'email_taken') {
+                return { ok: false, error: 'email_taken', message: error.detail ?? error.error };
+            }
+            if (error instanceof BrokerError && error.error === 'registration_closed') {
+                return { ok: false, error: 'registration_closed', message: error.detail ?? error.error };
+            }
+            // Both carry a sentence about the name, for the form to show as it is.
+            if (error instanceof BrokerError && error.error === 'username_taken') {
+                return { ok: false, error: 'username_taken', message: error.detail ?? error.error };
+            }
+            if (error instanceof BrokerError && error.error === 'username_invalid') {
+                return { ok: false, error: 'username_invalid', message: error.detail ?? error.error };
+            }
+            if (error instanceof BrokerError && error.error === 'request') {
+                return { ok: false, error: 'request', message: error.detail ?? error.error };
+            }
+            if (error instanceof BrokerError && error.status < 500) {
+                return { ok: false, error: 'invalid', message: error.detail ?? error.error };
+            }
+            return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
+        }
+    };
     const signUp = async ({ authRequestId, ...user }) => {
         try {
             const redirectTo = await broker().signUp({ authRequestId, ...user });
@@ -891,9 +940,13 @@ export function createAuth(input) {
             cookies,
         };
     };
-    const failure = (reason, cookies) => {
+    /** `next`, when it is a safe same-origin path, rides on the error URL so the error page can offer a retry to it. */
+    const failure = (reason, cookies, next) => {
         const url = new URL(options().onError, options().appUrl);
         url.searchParams.set('auth_error', reason);
+        const retry = safeNextPath(next, '');
+        if (retry)
+            url.searchParams.set('next', retry);
         return { location: url.href, cookies };
     };
     /** `failure`'s location on its own, for a caller that redirects rather than answering. */
@@ -918,6 +971,7 @@ export function createAuth(input) {
         resetPassword,
         sendLink,
         invite,
+        createTestUser,
         handle,
         read,
         readCookie,
@@ -927,6 +981,7 @@ export function createAuth(input) {
         errorUrl,
         people,
         setPersonActive,
+        adminResetPassword,
         revokeSessions,
         sessions: listSessions,
         endSession,
@@ -935,6 +990,7 @@ export function createAuth(input) {
         setNewPassword,
         setNewPasswordHeadless,
         signInWithPassword,
+        signUpWithPassword,
         signUp,
         startPasskeyRegistration,
         finishPasskeyRegistration,

package/dist/broker.d.ts

@@ -21,6 +21,12 @@ export interface NewUser {
      * `password_change_required`, then `setNewPassword`).
      */
     changeRequired?: boolean;
+    /**
+     * Where this person's reset links go instead of their own login address --
+     * for somebody who cannot yet open the mailbox that address names. See
+     * `Auth['adminResetPassword']` for the person this does not cover.
+     */
+    personalEmail?: string;
 }
 /** One of the organisation's people, as the sign-in service reports them. */
 export interface Person {
@@ -64,6 +70,11 @@ export declare class Broker {
         userId: string;
         state: string;
     }>;
+    /** An admin's reset for somebody requestPasswordReset cannot get back in: see `Auth['adminResetPassword']`. */
+    adminResetPassword(userId: string): Promise<{
+        userId: string;
+        password: string;
+    }>;
     authRequest(id: string): Promise<AuthRequest>;
     signIn(input: {
         authRequestId: string;
@@ -119,11 +130,22 @@ export declare class Broker {
         givenName: string;
         familyName: string;
         next: string;
+        personalEmail?: string;
     }): Promise<{
         userId: string;
         invited: boolean;
+        personalEmailStored: boolean;
     }>;
     sendLink(email: string, next: string): Promise<unknown>;
+    /** A company's own test user, marked in the sign-in service. See `Auth['createTestUser']`. */
+    createTestUser(input: {
+        email: string;
+        givenName: string;
+        familyName: string;
+        username?: string;
+    }): Promise<{
+        userId: string;
+    }>;
     sendReset(email: string, next: string): Promise<unknown>;
     sendVerification(email: string, next: string): Promise<unknown>;
     /**

package/dist/broker.js

@@ -67,6 +67,10 @@ export class Broker {
     setPersonActive(userId, active) {
         return this.call('POST', active ? '/people/reactivate' : '/people/deactivate', { userId });
     }
+    /** An admin's reset for somebody requestPasswordReset cannot get back in: see `Auth['adminResetPassword']`. */
+    adminResetPassword(userId) {
+        return this.call('POST', '/people/reset-password', { userId });
+    }
     authRequest(id) {
         return this.call('GET', '/auth-request', { id });
     }
@@ -114,6 +118,10 @@ export class Broker {
     sendLink(email, next) {
         return this.call('POST', '/link/send', { email, next });
     }
+    /** A company's own test user, marked in the sign-in service. See `Auth['createTestUser']`. */
+    createTestUser(input) {
+        return this.call('POST', '/test-users', input);
+    }
     sendReset(email, next) {
         return this.call('POST', '/reset/send', { email, next });
     }

package/dist/browser.js

@@ -1,6 +1,10 @@
 import { createNamespaceBrowserAuth } from './namespace-browser.js';
 const TOKEN = 'wtfalch.auth.token';
 const VERIFIER = 'wtfalch.auth.verifier';
+/** CSRF protection on the callback: checked before the code exchange, never persisted past it. */
+const STATE = 'wtfalch.auth.state';
+/** Replay protection on the ID token: checked against its own claim after the exchange, never persisted past it. */
+const NONCE = 'wtfalch.auth.nonce';
 const RETURN = 'wtfalch.auth.return';
 /** Set before a silent attempt leaves, so a refusal cannot become a loop. */
 const TRIED = 'wtfalch.auth.silent-tried';
@@ -44,9 +48,26 @@ async function challengeFor(verifier) {
 }
 function verifier() {
     // 32 bytes is RFC 7636's recommendation; base64url of it is 43 characters,
-    // inside the 43..128 the spec allows.
+    // inside the 43..128 the spec allows. Reused below for `state` and `nonce`
+    // too -- a random, unguessable token is exactly what each of the three is.
     return base64url(crypto.getRandomValues(new Uint8Array(32)).buffer);
 }
+/** The payload of a JWT, read without verifying its signature -- the ID token here comes straight
+ *  from the token endpoint over TLS, which OIDC Core 1.0 3.1.3.7 allows in place of a signature
+ *  check for the authorization code flow. Never used to trust a claim from anywhere else. */
+function decodeJwtPayload(jwt) {
+    try {
+        const part = jwt.split('.')[1];
+        if (!part)
+            return null;
+        const base64 = part.replace(/-/g, '+').replace(/_/g, '/');
+        const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+        return JSON.parse(atob(padded));
+    }
+    catch {
+        return null;
+    }
+}
 function publicSession(session) {
     const { refreshToken, ...rest } = session;
     return rest;
@@ -86,6 +107,8 @@ export function createBrowserAuth(options) {
     const key = (name) => (context ? `wtfalch.auth.browser.v1:${context}:${name}` : name);
     const tokenKey = key(TOKEN);
     const verifierKey = key(VERIFIER);
+    const stateKey = key(STATE);
+    const nonceKey = key(NONCE);
     const returnKey = key(RETURN);
     const triedKey = key(TRIED);
     let contexts = coordinators.get(store);
@@ -117,6 +140,8 @@ export function createBrowserAuth(options) {
     const authorize = async (prompt, returnTo) => {
         const generation = ++coordinator.generation;
         const proof = verifier();
+        const state = verifier();
+        const nonce = verifier();
         await mutate(async () => {
             if (!current(generation))
                 return;
@@ -127,6 +152,12 @@ export function createBrowserAuth(options) {
             if (!current(generation))
                 return;
             await store.set(verifierKey, proof);
+            if (!current(generation))
+                return;
+            await store.set(stateKey, state);
+            if (!current(generation))
+                return;
+            await store.set(nonceKey, nonce);
             if (!current(generation))
                 return;
             await store.set(returnKey, returnTo);
@@ -140,6 +171,8 @@ export function createBrowserAuth(options) {
         url.searchParams.set('scope', scope);
         url.searchParams.set('code_challenge', await challengeFor(proof));
         url.searchParams.set('code_challenge_method', 'S256');
+        url.searchParams.set('state', state);
+        url.searchParams.set('nonce', nonce);
         if (prompt)
             url.searchParams.set('prompt', prompt);
         if (!current(generation))
@@ -240,16 +273,27 @@ export function createBrowserAuth(options) {
                 if (!current(generation))
                     return null;
                 const proof = store.get(verifierKey);
+                const expectedState = store.get(stateKey);
+                const expectedNonce = store.get(nonceKey);
                 const returnTo = store.get(returnKey) ?? '/';
+                // Cleared together, unconditionally, before any check below runs --
+                // a mismatch is refused on its own terms, not merely by virtue of a
+                // transaction that cannot be replayed a second time either way.
                 await store.drop(verifierKey);
+                if (!current(generation))
+                    return null;
+                await store.drop(stateKey);
+                if (!current(generation))
+                    return null;
+                await store.drop(nonceKey);
                 if (!current(generation))
                     return null;
                 await store.drop(returnKey);
-                return { proof, returnTo };
+                return { proof, expectedState, expectedNonce, returnTo };
             });
             if (!transaction || !current(generation))
                 return cancelled();
-            const { proof, returnTo } = transaction;
+            const { proof, expectedState, expectedNonce, returnTo } = transaction;
             const issuerError = params.get('error');
             if (issuerError) {
                 if (['login_required', 'interaction_required', 'consent_required'].includes(issuerError)) {
@@ -257,6 +301,13 @@ export function createBrowserAuth(options) {
                 }
                 return { kind: 'error', error: params.get('error_description') ?? issuerError };
             }
+            // Checked before the code exchange: a callback whose `state` does not
+            // match this tab's own sign-in is refused before it ever reaches the
+            // issuer, exactly as a cross-site request forgery on this callback
+            // would need it not to be.
+            if (params.get('state') !== expectedState) {
+                return { kind: 'error', error: 'the callback state does not match this sign-in' };
+            }
             const code = params.get('code');
             if (!code)
                 return { kind: 'error', error: 'the issuer sent no code' };
@@ -293,6 +344,14 @@ export function createBrowserAuth(options) {
                     return cancelled();
                 if (!token.access_token)
                     return { kind: 'error', error: 'the issuer returned no access token' };
+                // Checked against the ID token's own claim, after the exchange: a
+                // code this flow never requested cannot be replayed into a session
+                // here even if it were otherwise accepted, because the token minted
+                // for it carries a different nonce.
+                const idTokenClaims = token.id_token ? decodeJwtPayload(token.id_token) : null;
+                if (idTokenClaims?.nonce !== expectedNonce) {
+                    return { kind: 'error', error: 'the ID token nonce does not match this sign-in' };
+                }
                 const session = {
                     accessToken: token.access_token,
                     expiresAt: Date.now() + (token.expires_in ?? 3600) * 1000,
@@ -326,6 +385,8 @@ export function createBrowserAuth(options) {
             await mutate(async () => {
                 await store.drop(tokenKey);
                 await store.drop(verifierKey);
+                await store.drop(stateKey);
+                await store.drop(nonceKey);
                 await store.drop(returnKey);
                 await store.set(triedKey, '1');
             });

package/dist/config.d.ts

@@ -19,6 +19,15 @@ export type AuthEvent = {
     email: string;
     userId: string;
     invited: boolean;
+}
+/** Never the password: an audit record of who was reset, not a copy of the credential. */
+ | {
+    type: 'adminResetPassword';
+    userId: string;
+} | {
+    type: 'createTestUser';
+    email: string;
+    userId: string;
 };
 /**
  * Why `accessToken` refused: no session (no cookie in cookie mode, no live
@@ -153,3 +162,14 @@ export interface ResolvedOptions {
     onAuthEvent: ((event: AuthEvent) => void) | null;
 }
 export declare function resolveOptions(options: AuthOptions): ResolvedOptions;
+/**
+ * The actual AES-256 key `cookies.ts` encrypts and decrypts with -- HKDF-SHA256
+ * over the decoded `cookieSecret`, never the secret's bytes directly. A secret an
+ * operator can read (an env var, a value pasted into a terminal) is weaker key
+ * material than a key meant to be used as one; HKDF's job is exactly this gap.
+ * No fallback to the raw key: decided as a hard cut (auth#255), so the only
+ * way a cookie sealed before this shipped keeps validating is if it already
+ * carries no more than its own session's worth of trust -- which is what every
+ * cookie here already assumes of `sessionMaxAge`/`TRANSACTION_TTL`/etc.
+ */
+export declare function deriveCookieKey(secret: Uint8Array): Promise<Uint8Array>;

package/dist/config.js

@@ -105,3 +105,29 @@ function decodeKey(secret) {
     }
     return bytes;
 }
+// Fixed, not random: every server sealing or opening a cookie must derive
+// the same AES key from the same `cookieSecret`, so there is nowhere to
+// store a per-process salt even if one were generated. `COOKIE_KEY_INFO`
+// scopes the derivation to this one use of the secret, the same way a
+// derived key's `info` is meant to -- a future second use of `cookieSecret`
+// (there is none today) would derive under a different info string and
+// never collide with this key.
+const COOKIE_KEY_SALT = new TextEncoder().encode('@wtfalch/auth cookie salt v1');
+const COOKIE_KEY_INFO = new TextEncoder().encode('@wtfalch/auth cookie v1');
+/**
+ * The actual AES-256 key `cookies.ts` encrypts and decrypts with -- HKDF-SHA256
+ * over the decoded `cookieSecret`, never the secret's bytes directly. A secret an
+ * operator can read (an env var, a value pasted into a terminal) is weaker key
+ * material than a key meant to be used as one; HKDF's job is exactly this gap.
+ * No fallback to the raw key: decided as a hard cut (auth#255), so the only
+ * way a cookie sealed before this shipped keeps validating is if it already
+ * carries no more than its own session's worth of trust -- which is what every
+ * cookie here already assumes of `sessionMaxAge`/`TRANSACTION_TTL`/etc.
+ */
+export async function deriveCookieKey(secret) {
+    const keyMaterial = await crypto.subtle.importKey('raw', secret, 'HKDF', false, [
+        'deriveBits',
+    ]);
+    const bits = await crypto.subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: COOKIE_KEY_SALT, info: COOKIE_KEY_INFO }, keyMaterial, 256);
+    return new Uint8Array(bits);
+}

package/dist/cookies.d.ts

@@ -1,5 +1,7 @@
 import { type JWTPayload } from 'jose';
-import type { ResolvedOptions } from './config.js';
+import { type ResolvedOptions } from './config.js';
+/** Exported for `namespace-server.ts`, which decrypts a transaction cookie itself to read its `ns` claim before any binding is chosen. */
+export declare function cookieKeyFor(options: ResolvedOptions): Promise<Uint8Array>;
 export interface SessionPayload extends JWTPayload {
     idt: string;
     rt?: string;

package/dist/cookies.js

@@ -1,5 +1,21 @@
 import { EncryptJWT, jwtDecrypt } from 'jose';
+import { deriveCookieKey } from './config.js';
 import { AuthError } from './oidc.js';
+// `options.cookieKey` decodes once per `ResolvedOptions` (config.ts) and is
+// always the same `Uint8Array` reference after that, so keying the derived
+// key's own cache off it means every seal/open after the first reuses it
+// rather than re-running HKDF per call.
+const derivedKeyCache = new WeakMap();
+/** Exported for `namespace-server.ts`, which decrypts a transaction cookie itself to read its `ns` claim before any binding is chosen. */
+export function cookieKeyFor(options) {
+    const raw = options.cookieKey;
+    let derived = derivedKeyCache.get(raw);
+    if (!derived) {
+        derived = deriveCookieKey(raw);
+        derivedKeyCache.set(raw, derived);
+    }
+    return derived;
+}
 const SESSION = 'wtfalch_auth';
 const TRANSACTION = 'wtfalch_auth_tx';
 const LINK = 'wtfalch_auth_link';
@@ -152,17 +168,21 @@ async function seal(options, kind, payload, ttl) {
         .setAudience(await audience(options, kind))
         .setIssuedAt()
         .setExpirationTime(Math.floor(Date.now() / 1000) + ttl)
-        .encrypt(options.cookieKey);
+        .encrypt(await cookieKeyFor(options));
 }
 async function open(options, kind, value) {
     if (!value)
         return null;
     try {
-        const { payload } = await jwtDecrypt(value, options.cookieKey, {
+        const { payload } = await jwtDecrypt(value, await cookieKeyFor(options), {
             issuer: options.appUrl.origin,
             audience: await audience(options, kind),
             contentEncryptionAlgorithms: ['A256GCM'],
             keyManagementAlgorithms: ['dir'],
+            // Every cookie `seal` makes already sets `exp` (the call's own `ttl`),
+            // so requiring it here signs nobody out -- it only refuses the one
+            // thing a cookie with none could otherwise be: unbounded.
+            requiredClaims: ['exp'],
         });
         return payload;
     }

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export { type Auth, type AuthRequest, type Gate, type GateRules, type Intent, ty
 export type { AccessTokenReason, AccessTokenResult, AuthEvent, AuthOptions } from './config.js';
 export type { SetCookie } from './cookies.js';
 export type { SessionRecord, SessionStore, SessionUpdate } from './sessions.js';
+export type { PersonTokenConfig, PersonTokenVerifier } from './person-token.js';
 export { BrokerError } from './broker.js';
 export { AuthError, type AuthErrorReason, ORG_CLAIM } from './oidc.js';
 export { safeNextPath } from './redirect.js';

package/dist/namespace-server.js

@@ -1,6 +1,6 @@
 import { jwtDecrypt } from 'jose';
 import { resolveOptions } from './config.js';
-import { cookieFrom, openTransaction, transactionCookieName } from './cookies.js';
+import { cookieFrom, cookieKeyFor, openTransaction, transactionCookieName } from './cookies.js';
 import { isWebService, parseNamespaceRegistry, } from './namespaces.js';
 /** Resolve a shared callback from its authenticated transaction, never a URL
  * namespace hint. The second open checks the entire current registry binding. */
@@ -46,7 +46,7 @@ export async function resolveNamespaceCallback(input) {
             return null;
         // No identity is returned based on this hint alone. It only chooses which
         // current binding's audience to validate next, so decryption is bounded.
-        const { payload } = await jwtDecrypt(value, first.cookieKey, {
+        const { payload } = await jwtDecrypt(value, await cookieKeyFor(first), {
             issuer: input.appOrigin,
             requiredClaims: ['exp', 'iat', 'aud'],
             contentEncryptionAlgorithms: ['A256GCM'],

package/dist/namespace-session.js

@@ -1,3 +1,4 @@
+import { sleep } from '@wtfalch/utils/datetime';
 import * as client from 'openid-client';
 import { BrokerError } from './broker.js';
 import { contextDigest, digest, openHandle, openRecord, sealHandle, sealRecord, } from './cookies.js';
@@ -15,7 +16,6 @@ const LEASE_SECONDS = 60;
 const WAIT_STEP_MS = 100;
 const WAIT_STEPS = 50;
 const now = () => Math.floor(Date.now() / 1000);
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**
  * Server-side sessions for namespace mode. The cookie holds a random handle;
  * the record holds the tokens. Refreshes are serialised across replicas by a

package/dist/next.d.ts

@@ -95,14 +95,18 @@ export interface NextAuth {
         givenName: string;
         familyName: string;
         next?: string;
+        personalEmail?: string;
     }) => Promise<{
         userId: string;
         invited: boolean;
+        personalEmailStored: boolean;
     }>;
     /** The organisation's people, for an operator surface. Scoped to this app's organisation by the service. */
     people: Auth['people'];
     /** Deactivate or reactivate somebody in this app's organisation. */
     setPersonActive: Auth['setPersonActive'];
+    /** An admin's reset for somebody in this app's organisation whom requestPasswordReset cannot otherwise get back in. */
+    adminResetPassword: Auth['adminResetPassword'];
     /** The devices page: the signed-in person's own live sessions, newest first. Namespace mode only. */
     sessions: () => Promise<SessionRecord[]>;
     /**

package/dist/next.js

@@ -272,6 +272,7 @@ export function nextAuth(options) {
         invite: auth.invite,
         people: auth.people,
         setPersonActive: auth.setPersonActive,
+        adminResetPassword: auth.adminResetPassword,
         sessions: sessionsList,
         endSession,
         resetPassword,