@wtfalch/auth 0.23.0 → 0.25.0

package/dist/cookies.d.ts

@@ -32,10 +32,9 @@ export interface LinkPayload extends JWTPayload {
     stk: string;
     ar: string;
 }
-/** The QR device-grant transaction: the device_code, never handed to the caller, and the interval the issuer asked us to poll at. Its own `exp` -- set to the issuer's `expires_in` -- is what makes an unsealed-past-expiry cookie fail open with the others below. */
+/** The QR device-grant transaction: the device_code, never handed to the caller, and nothing else: the issuer answers `slow_down` to a client that polls too fast, and `pollQrSignIn` passes that on. Its own `exp` -- set to the issuer's `expires_in` -- is what makes an unsealed-past-expiry cookie fail open with the others below. */
 export interface QrTransactionPayload extends JWTPayload {
     dc: string;
-    iv: number;
 }
 export interface SetCookie {
     name: string;

package/dist/cookies.js

@@ -1,6 +1,7 @@
 import { EncryptJWT, jwtDecrypt } from 'jose';
 import { deriveCookieKey } from './config.js';
 import { AuthError } from './oidc.js';
+import { base64url } from './util.js';
 // `options.cookieKey` decodes once per `ResolvedOptions` (config.ts) and is
 // always the same `Uint8Array` reference after that, so keying the derived
 // key's own cache off it means every seal/open after the first reuses it
@@ -78,10 +79,7 @@ export async function contextDigest(options) {
 /** SHA-256, base64url. */
 export async function digest(value) {
     const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
-    return btoa(String.fromCharCode(...new Uint8Array(bytes)))
-        .replaceAll('+', '-')
-        .replaceAll('/', '_')
-        .replace(/=+$/, '');
+    return base64url(bytes);
 }
 export async function sealTransaction(options, payload) {
     const value = await seal(options, 'transaction', payload, TRANSACTION_TTL);
@@ -125,9 +123,7 @@ export async function sealQrTransaction(options, payload, ttl) {
 }
 export async function openQrTransaction(options, value) {
     const payload = await open(options, 'qr', value);
-    return payload && typeof payload.dc === 'string' && typeof payload.iv === 'number'
-        ? payload
-        : null;
+    return payload && typeof payload.dc === 'string' ? payload : null;
 }
 export function clearQrTransaction(options) {
     return setCookie(qrTransactionCookieName(options), '', 0, options.secure);

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-export { type Auth, type AuthRequest, type Gate, type GateRules, type Intent, type MaxAge, type NewUser, type PasskeyRegistrationResult, type PasswordChangeRequired, type PasskeyRegistrationStart, type PasskeySignInStart, type Prompt, type QrPollResult, type QrPollStatus, type QrSignInStart, type ReadResult, type ResetError, type SetNewPasswordError, type SetNewPasswordResult, type SignInError, type SignInResult, type SignUpError, type SignUpResult, type SignedIn, type User, STEP_UP_MAX_AGE, createAuth, } from './auth.js';
+export { type Auth, type AuthRequest, type ChangePasswordError, type ChangePasswordResult, type Completed, type DeletePasskeyResult, type EmailChangeError, type EmailChangeResult, type Gate, type GateRules, type Intent, type MaxAge, type NewUser, type Passkey, type PasskeyRegistrationResult, type PasswordChangeRequired, type PasskeyRegistrationStart, type PasskeySignInStart, type Prompt, type QrPollResult, type QrPollStatus, type QrSignInStart, type ReadResult, type ResetError, type SetNewPasswordError, type SetNewPasswordResult, type SignInError, type SignInResult, type SignUpError, type SignUpResult, type SignedIn, type User, STEP_UP_MAX_AGE, createAuth, } from './auth.js';
 export type { AccessTokenReason, AccessTokenResult, AuthEvent, AuthOptions } from './config.js';
 export type { SetCookie } from './cookies.js';
 export type { SessionRecord, SessionStore, SessionUpdate } from './sessions.js';
 export type { PersonTokenConfig, PersonTokenVerifier } from './person-token.js';
-export { BrokerError } from './broker.js';
+export { BrokerError, type PeoplePage, type Person } from './broker.js';
 export { AuthError, type AuthErrorReason, ORG_CLAIM } from './oidc.js';
-export { safeNextPath } from './redirect.js';
+export { safeLoginHint, safeNextPath } from './redirect.js';

package/dist/index.js

@@ -1,4 +1,4 @@
 export { STEP_UP_MAX_AGE, createAuth, } from './auth.js';
 export { BrokerError } from './broker.js';
 export { AuthError, ORG_CLAIM } from './oidc.js';
-export { safeNextPath } from './redirect.js';
+export { safeLoginHint, safeNextPath } from './redirect.js';

package/dist/namespace-browser.js

@@ -1,15 +1,10 @@
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 import { resolveNamespaceContext } from './namespaces.js';
-import { safeNextPath } from './redirect.js';
+import { safeLoginHint, safeNextPath } from './redirect.js';
+import { base64url } from './util.js';
 const OWNER = 'urn:zitadel:iam:user:resourceowner:id';
 const ttl = 10 * 60_000;
 const random = () => base64url(crypto.getRandomValues(new Uint8Array(32)));
-function base64url(bytes) {
-    return btoa(String.fromCharCode(...bytes))
-        .replaceAll('+', '-')
-        .replaceAll('/', '_')
-        .replace(/=+$/, '');
-}
 function read(storage, key) {
     try {
         return JSON.parse(storage.getItem(key) ?? 'null');
@@ -75,7 +70,7 @@ export function createNamespaceBrowserAuth(options, selection) {
             : null;
     };
     const silentSignInAvailable = () => !accountChanged() && !currentSession() && !sessionStorage.getItem(triedKey);
-    const authorize = async (prompt, returnTo) => {
+    const authorize = async (prompt, returnTo, loginHint) => {
         const transaction = {
             context: binding.context,
             state: random(),
@@ -99,6 +94,7 @@ export function createNamespaceBrowserAuth(options, selection) {
             code_challenge: base64url(new Uint8Array(digest)),
             code_challenge_method: 'S256',
             ...(prompt ? { prompt } : {}),
+            ...(safeLoginHint(loginHint) ? { login_hint: safeLoginHint(loginHint) } : {}),
         }).toString();
         if (!ownsPending(transaction.state))
             throw new Error('Another sign-in replaced this attempt');
@@ -220,9 +216,9 @@ export function createNamespaceBrowserAuth(options, selection) {
             await authorize('none', returnTo);
             return true;
         },
-        async signIn(returnTo = window.location.pathname) {
+        async signIn(returnTo = window.location.pathname, opts) {
             sessionStorage.removeItem(triedKey);
-            await authorize(undefined, returnTo);
+            await authorize(undefined, returnTo, opts?.loginHint);
         },
         // Matches BrowserAuth.forget()'s Promise<void> signature; this path's
         // storage is always synchronous, so there is nothing to await.

package/dist/namespace-session.d.ts

@@ -11,10 +11,6 @@ export declare const STATUS_STALE_IF_ERROR_MS: number;
 export type SessionRead = {
     kind: 'none';
 }
-/** A cookie for another binding, revision or format. */
- | {
-    kind: 'changed';
-}
 /** The binding is suspended, or its status cannot be confirmed. */
  | {
     kind: 'unavailable';
@@ -36,7 +32,7 @@ export declare function namespaceSessions(deps: {
 }): {
     bindingActive: () => Promise<boolean>;
     create: (tokens: Tokens, requestHeaders?: Headers) => Promise<SetCookie>;
-    end: (value: string | undefined) => Promise<"ended" | "changed" | "none">;
+    end: (value: string | undefined) => Promise<"ended" | "none">;
     read: (value: string | undefined, force?: boolean) => Promise<SessionRead>;
     revokeSubject: (subject: string) => Promise<number>;
     listSessions: (subject: string) => Promise<SessionRecord[]>;

package/dist/namespace-session.js

@@ -2,7 +2,8 @@ import { sleep } from '@wtfalch/utils/datetime';
 import * as client from 'openid-client';
 import { BrokerError } from './broker.js';
 import { contextDigest, digest, openHandle, openRecord, sealHandle, sealRecord, } from './cookies.js';
-import { AuthError, isOAuthRefusal } from './oidc.js';
+import { AuthError, isOAuthRefusal, rejected } from './oidc.js';
+import { expiryOf, issuedAtOf } from './util.js';
 /** How long a binding status answer is trusted. The propagation bound for a suspension. */
 export const STATUS_FRESH_MS = 60_000;
 /** How long the last good answer carries on while the service cannot be asked. */
@@ -158,7 +159,7 @@ export function namespaceSessions(deps) {
             return 'none';
         const key = await keyOf(value);
         if (!key)
-            return 'changed';
+            return 'none';
         const loaded = await load(key);
         await store().revoke(key, now());
         revokeToken(loaded?.tokens.rt);
@@ -423,8 +424,9 @@ export function namespaceSessions(deps) {
         if (!value)
             return { kind: 'none' };
         const key = await keyOf(value);
+        // A handle that does not open (another binding's, an older revision's, or damaged) is nobody: sign in again replaces it.
         if (!key)
-            return { kind: 'changed' };
+            return { kind: 'none' };
         if (!(await bindingActive()))
             return { kind: 'unavailable' };
         let loaded = await load(key);
@@ -443,8 +445,12 @@ export function namespaceSessions(deps) {
         try {
             return { kind: 'user', claims: await deps.oidc().verify(loaded.tokens.idt) };
         }
-        catch {
-            return { kind: 'none' };
+        catch (error) {
+            if (rejected(error))
+                return { kind: 'none' };
+            // The issuer's keys could not be fetched: not a verdict on this session.
+            console.error('@wtfalch/auth: could not verify the session id token', error instanceof Error ? error.name : 'unknown');
+            return { kind: 'unavailable' };
         }
     };
     return {
@@ -483,25 +489,3 @@ function ipFrom(headers) {
         .filter(Boolean);
     return hops.length > 0 ? hops[hops.length - 1] : null;
 }
-function expiryOf(idToken) {
-    try {
-        const [, payload] = idToken.split('.');
-        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-        return typeof json.exp === 'number' ? json.exp : null;
-    }
-    catch {
-        return null;
-    }
-}
-// Age, not time left: a disabled or revoked account must not ride out a
-// long-lived token just because it still has plenty of time on the clock.
-function issuedAtOf(idToken) {
-    try {
-        const [, payload] = idToken.split('.');
-        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-        return typeof json.iat === 'number' ? json.iat : null;
-    }
-    catch {
-        return null;
-    }
-}

package/dist/next.d.ts

@@ -49,6 +49,7 @@ export interface NextAuth {
         next?: string;
         intent?: Intent;
         prompt?: Prompt;
+        loginHint?: string;
     }) => Promise<AuthRequest>;
     /** For a server action: redirects into the app on success, returns the error otherwise. */
     signIn: (input: {
@@ -127,7 +128,7 @@ export interface NextAuth {
     /**
      * Registers a passkey on this app's own domain for the person signed in
      * here. Throws `AuthError('unauthenticated', ...)` for nobody, exactly as
-     * `requireUser` throws `account_changed`/`unavailable` for those.
+     * `requireUser` throws `unavailable` for a suspended binding.
      */
     startPasskeyRegistration: () => Promise<PasskeyRegistrationStart>;
     /** The second half of `startPasskeyRegistration`. Same signed-in requirement. */

package/dist/next.js

@@ -31,13 +31,9 @@ export function nextAuth(options) {
             response = NextResponse.redirect(gate.location, 303);
         }
         else if (gate.kind === 'deny') {
-            response = new NextResponse(gate.reason === 'account_changed'
-                ? 'Account changed; choose an account to continue'
-                : gate.reason === 'unavailable'
-                    ? 'Sign-in is unavailable for this workspace'
-                    : 'Unauthorized', {
-                status: gate.reason === 'account_changed' ? 409 : gate.reason === 'unavailable' ? 503 : 401,
-            });
+            response = new NextResponse(gate.reason === 'unavailable'
+                ? 'Sign-in is unavailable for this workspace'
+                : 'Unauthorized', { status: gate.reason === 'unavailable' ? 503 : 401 });
         }
         else if (gate.cookies.length > 0) {
             const headers = new Headers(request.headers);
@@ -60,9 +56,9 @@ export function nextAuth(options) {
     };
     const requireUser = async (next) => {
         const store = await cookies();
-        const { user, accountChanged, unavailable } = await auth.readCookie(store.get(auth.sessionCookieName)?.value, { refresh: false });
-        if (accountChanged)
-            throw new AuthError('account_changed', 'Choose an account to continue');
+        const { user, unavailable } = await auth.readCookie(store.get(auth.sessionCookieName)?.value, {
+            refresh: false,
+        });
         if (unavailable)
             throw new AuthError('unavailable', 'Sign-in is unavailable for this workspace');
         if (!user)
@@ -123,7 +119,7 @@ export function nextAuth(options) {
         // Nobody has started a flow yet. This cannot loop: the issuer always
         // sends the browser back carrying an id.
         if (!id)
-            redirect(auth.startUrl(opts.next, opts.intent, opts.prompt));
+            redirect(auth.startUrl(opts.next, opts.intent, opts.prompt, undefined, opts.loginHint));
         try {
             return await auth.authRequest(id);
         }
@@ -213,10 +209,16 @@ export function nextAuth(options) {
     };
     const setNewPassword = async (input) => {
         // Named fields: a Server Action's argument is whatever the client sent.
+        // A field that is not text is refused here and never reaches the broker.
+        if (typeof input?.authRequestId !== 'string' || typeof input.changeToken !== 'string') {
+            return { error: 'invalid_token' };
+        }
+        if (typeof input.newPassword !== 'string')
+            return { error: 'invalid_password' };
         const result = await auth.setNewPassword({
-            authRequestId: String(input?.authRequestId),
-            changeToken: String(input?.changeToken),
-            newPassword: String(input?.newPassword),
+            authRequestId: input.authRequestId,
+            changeToken: input.changeToken,
+            newPassword: input.newPassword,
         });
         if (result.ok) {
             if (result.hosted)
@@ -226,7 +228,24 @@ export function nextAuth(options) {
         return { error: result.error };
     };
     const signUp = async (input) => {
-        const result = await auth.signUp(input);
+        // Named fields: a Server Action's argument is whatever the client sent, so
+        // `changeRequired` and `personalEmail`, which only a server may set, are not read.
+        if (typeof input?.authRequestId !== 'string' ||
+            typeof input.email !== 'string' ||
+            typeof input.password !== 'string' ||
+            typeof input.givenName !== 'string' ||
+            typeof input.familyName !== 'string' ||
+            (input.username !== undefined && typeof input.username !== 'string')) {
+            return { error: 'invalid', message: 'Fill in every field.' };
+        }
+        const result = await auth.signUp({
+            authRequestId: input.authRequestId,
+            email: input.email,
+            password: input.password,
+            givenName: input.givenName,
+            familyName: input.familyName,
+            username: input.username,
+        });
         if (result.ok) {
             if (result.hosted)
                 redirect(result.redirectTo);

package/dist/oidc.d.ts

@@ -42,10 +42,11 @@ export declare class Oidc {
     private config;
     private keys;
     get redirectUri(): URL;
-    authorizationUrl(state: string, nonce: string, codeVerifier: string, { create, prompt, maxAge, }?: {
+    authorizationUrl(state: string, nonce: string, codeVerifier: string, { create, prompt, maxAge, loginHint, }?: {
         create?: boolean;
         prompt?: 'select_account' | 'login' | 'none';
         maxAge?: number;
+        loginHint?: string;
     }): Promise<URL>;
     exchange(callbackParams: URLSearchParams, transaction: {
         state: string;
@@ -85,4 +86,6 @@ export declare class AuthError extends Error {
  * is never a statement that the grant is dead, and this issuer's own rate
  * limiting must not permanently revoke a session.
  */
+/** An id token the issuer's keys or claims refuse, as opposed to keys that could not be fetched. */
+export declare function rejected(error: unknown): boolean;
 export declare function isOAuthRefusal(error: unknown): boolean;

package/dist/oidc.js

@@ -81,10 +81,11 @@ export class Oidc {
     get redirectUri() {
         return new URL(`${this.options.basePath}/callback`, this.options.appUrl);
     }
-    async authorizationUrl(state, nonce, codeVerifier, { create = false, prompt, maxAge, } = {}) {
+    async authorizationUrl(state, nonce, codeVerifier, { create = false, prompt, maxAge, loginHint, } = {}) {
         return client.buildAuthorizationUrl(await this.config(), {
             ...(create ? { prompt: 'create' } : prompt ? { prompt } : {}),
             ...(maxAge === undefined ? {} : { max_age: String(maxAge) }),
+            ...(loginHint ? { login_hint: loginHint } : {}),
             redirect_uri: this.redirectUri.href,
             scope: scopeFor(this.options.organizationId, this.options.extraScopes),
             state,
@@ -106,6 +107,10 @@ export class Oidc {
         return this.tokensFrom(response);
     }
     // Parallel requests holding the same refresh token share one grant; the issuer rotates it, so a second grant would fail.
+    // The rotated result is kept for ROTATION_CACHE_MS and keyed by the OLD refresh token, so a request that lost the race gets the
+    // winner's tokens. The cost: a copy of the old cookie (same refresh token) gets those tokens too in that window. Keying on
+    // the session does not help, since the copy is the same session; the only fix is a shorter window, which would break the race
+    // it exists for. The copy still needs the sealed cookie, so this exposes nothing a live cookie did not already hold.
     refresh(refreshToken) {
         const asked = Date.now();
         for (const [token, entry] of this.rotated)
@@ -220,6 +225,16 @@ export class AuthError extends Error {
  * is never a statement that the grant is dead, and this issuer's own rate
  * limiting must not permanently revoke a session.
  */
+/** An id token the issuer's keys or claims refuse, as opposed to keys that could not be fetched. */
+export function rejected(error) {
+    return (error instanceof AuthError ||
+        error instanceof jose.errors.JWTExpired ||
+        error instanceof jose.errors.JWTClaimValidationFailed ||
+        error instanceof jose.errors.JWSSignatureVerificationFailed ||
+        error instanceof jose.errors.JWSInvalid ||
+        error instanceof jose.errors.JWTInvalid ||
+        error instanceof jose.errors.JOSEAlgNotAllowed);
+}
 export function isOAuthRefusal(error) {
     const status = statusOf(error);
     return status !== undefined && status >= 400 && status < 500 && status !== 429;

package/dist/person-token.js

@@ -1,4 +1,5 @@
 import { createRemoteJWKSet, customFetch, jwtVerify } from 'jose';
+import { timeoutSignal } from './util.js';
 /** A JWT is three base64url segments; a ZITADEL opaque token is not shaped
  *  like that at all, so this is enough to route between `jwtVerify` and
  *  introspection without ever trying to parse either kind as the other. */
@@ -23,7 +24,7 @@ function sameOriginEndpoint(value, name, issuerOrigin) {
 async function discoverDocument(issuer, fetchImpl) {
     const discoveryUrl = `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
     const issuerOrigin = new URL(issuer).origin;
-    const response = await fetchImpl(discoveryUrl);
+    const response = await fetchImpl(discoveryUrl, { signal: timeoutSignal() });
     if (!response.ok) {
         throw new Error(`person-token: discovery document request failed with ${response.status}`);
     }
@@ -108,6 +109,7 @@ export function createPersonTokenVerifier(config) {
                 audience: config.audience,
                 algorithms: ['RS256'],
                 clockTolerance: 60,
+                requiredClaims: ['exp', 'sub'],
             });
             return payload;
         }
@@ -150,6 +152,7 @@ export function createPersonTokenVerifier(config) {
                     authorization: `Basic ${credentials}`,
                 },
                 body: new URLSearchParams({ token: accessToken }).toString(),
+                signal: timeoutSignal(),
             });
         }
         catch {

package/dist/qr.js

@@ -1,4 +1,5 @@
 import { AuthError } from './oidc.js';
+import { timeoutSignal } from './util.js';
 /**
  * The OAuth device authorization grant (RFC 8628), for signing in a new
  * device from a QR code a phone that is already signed in approves. Raw
@@ -11,6 +12,7 @@ const DEVICE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
 export async function requestDeviceAuthorization(options, scope) {
     const response = await options.fetch(`${options.issuer}/oauth/v2/device_authorization`, {
         method: 'POST',
+        signal: timeoutSignal(),
         headers: { 'content-type': 'application/x-www-form-urlencoded' },
         body: new URLSearchParams({ client_id: options.clientId, scope }),
     });
@@ -36,6 +38,7 @@ export async function requestDeviceAuthorization(options, scope) {
 export async function pollDeviceToken(options, oidc, deviceCode) {
     const response = await options.fetch(`${options.issuer}/oauth/v2/token`, {
         method: 'POST',
+        signal: timeoutSignal(),
         headers: { 'content-type': 'application/x-www-form-urlencoded' },
         body: new URLSearchParams({
             grant_type: DEVICE_GRANT_TYPE,

package/dist/redirect.d.ts

@@ -1,2 +1,9 @@
 /** A path on this app, or the fallback. Refuses absolute, scheme-relative and backslash forms. */
 export declare function safeNextPath(next: string | null | undefined, fallback: string): string;
+/**
+ * An email address fit to send as the OIDC `login_hint`: at most 254
+ * characters, one `@`, a dotted domain, no whitespace or control characters.
+ * Anything else is `undefined` -- a bad hint is dropped, never a failure,
+ * because the person can still type their address at the issuer.
+ */
+export declare function safeLoginHint(raw: string | null | undefined): string | undefined;

package/dist/redirect.js

@@ -21,3 +21,14 @@ export function safeNextPath(next, fallback) {
     }
     return path;
 }
+/**
+ * An email address fit to send as the OIDC `login_hint`: at most 254
+ * characters, one `@`, a dotted domain, no whitespace or control characters.
+ * Anything else is `undefined` -- a bad hint is dropped, never a failure,
+ * because the person can still type their address at the issuer.
+ */
+export function safeLoginHint(raw) {
+    if (typeof raw !== 'string' || raw.length > 254)
+        return undefined;
+    return /^[^\s@\p{Cc}]+@[^\s@\p{Cc}]+\.[^\s@\p{Cc}]+$/u.test(raw) ? raw : undefined;
+}

package/dist/testing.d.ts

@@ -1,9 +1,11 @@
 import type { Auth, User } from './auth.js';
+import type { NextAuth } from './next.js';
 export declare function setSessionUser(user: User | null): void;
 /** A User shaped like the SDK's, for `setSessionUser`. */
 export declare function testUser(id: string, overrides?: Partial<User>): User;
 export declare function getUser(): Promise<User | null>;
 export declare function requireUser(_next?: string): Promise<User>;
+export declare const requireFreshUser: NextAuth['requireFreshUser'];
 export declare const handlers: () => never;
 export declare const proxy: () => never;
 export declare const authRequest: () => never;
@@ -13,6 +15,24 @@ export declare const requestPasswordReset: () => never;
 export declare const resetPassword: () => never;
 export declare const sendLink: () => never;
 export declare const resendVerification: () => never;
+export declare const setNewPassword: () => never;
+export declare const invite: () => never;
+export declare const people: () => never;
+export declare const setPersonActive: () => never;
+export declare const adminResetPassword: () => never;
+export declare const sessions: () => never;
+export declare const endSession: () => never;
+export declare const startPasskeyRegistration: () => never;
+export declare const finishPasskeyRegistration: () => never;
+export declare const startEmailChange: () => never;
+export declare const completeEmailChange: () => never;
+export declare const changePassword: () => never;
+export declare const passkeys: () => never;
+export declare const deletePasskey: () => never;
+export declare const startPasskeySignIn: () => never;
+export declare const finishPasskeySignIn: () => never;
+export declare const startQrSignIn: () => never;
+export declare const pollQrSignIn: () => never;
 /**
  * The core SDK instance, as far as a device sign-in module reaches into it.
  *
@@ -29,3 +49,9 @@ export declare const sentLinks: {
 export declare function setFollowLinkResult(result: unknown): void;
 export declare function setCookieUser(user: User | null): void;
 export declare const auth: Auth;
+/**
+ * Every member of `NextAuth`, so the compiler fails here when the real
+ * surface gains one this stub lacks. `export const { getUser } = nextAuthStub`
+ * is the same as importing the named exports above.
+ */
+export declare const nextAuthStub: NextAuth;

package/dist/testing.js

@@ -39,6 +39,7 @@ export async function requireUser(_next) {
         throw new Error('requireUser: no session set; call setSessionUser first');
     return current;
 }
+export const requireFreshUser = async () => requireUser();
 function unavailable(name) {
     return () => {
         throw new Error(`${name} is not available in the integration tier`);
@@ -53,6 +54,24 @@ export const requestPasswordReset = unavailable('requestPasswordReset');
 export const resetPassword = unavailable('resetPassword');
 export const sendLink = unavailable('sendLink');
 export const resendVerification = unavailable('resendVerification');
+export const setNewPassword = unavailable('setNewPassword');
+export const invite = unavailable('invite');
+export const people = unavailable('people');
+export const setPersonActive = unavailable('setPersonActive');
+export const adminResetPassword = unavailable('adminResetPassword');
+export const sessions = unavailable('sessions');
+export const endSession = unavailable('endSession');
+export const startPasskeyRegistration = unavailable('startPasskeyRegistration');
+export const finishPasskeyRegistration = unavailable('finishPasskeyRegistration');
+export const startEmailChange = unavailable('startEmailChange');
+export const completeEmailChange = unavailable('completeEmailChange');
+export const changePassword = unavailable('changePassword');
+export const passkeys = unavailable('passkeys');
+export const deletePasskey = unavailable('deletePasskey');
+export const startPasskeySignIn = unavailable('startPasskeySignIn');
+export const finishPasskeySignIn = unavailable('finishPasskeySignIn');
+export const startQrSignIn = unavailable('startQrSignIn');
+export const pollQrSignIn = unavailable('pollQrSignIn');
 /**
  * The core SDK instance, as far as a device sign-in module reaches into it.
  *
@@ -79,3 +98,41 @@ export const auth = {
     followLink: async () => linkResult,
     readCookie: async () => ({ user: cookieUser, cookies: [] }),
 };
+/**
+ * Every member of `NextAuth`, so the compiler fails here when the real
+ * surface gains one this stub lacks. `export const { getUser } = nextAuthStub`
+ * is the same as importing the named exports above.
+ */
+export const nextAuthStub = {
+    auth,
+    handlers: handlers,
+    proxy,
+    getUser,
+    requireUser,
+    requireFreshUser,
+    authRequest,
+    signIn,
+    setNewPassword,
+    signUp,
+    resendVerification,
+    requestPasswordReset,
+    sendLink,
+    invite,
+    people,
+    setPersonActive,
+    adminResetPassword,
+    sessions,
+    endSession,
+    resetPassword,
+    startPasskeyRegistration,
+    finishPasskeyRegistration,
+    startEmailChange,
+    completeEmailChange,
+    changePassword,
+    passkeys,
+    deletePasskey,
+    startPasskeySignIn,
+    finishPasskeySignIn,
+    startQrSignIn,
+    pollQrSignIn,
+};

package/dist/util.d.ts

@@ -0,0 +1,13 @@
+/** Helpers shared by the server and browser entry points. No Node-only imports: the browser bundle uses this file too. */
+/** How long an SDK request to the broker or issuer may take before it is abandoned. */
+export declare const FETCH_TIMEOUT_MS = 15000;
+/** `signal` if the caller brought one, otherwise a 15 second timeout. */
+export declare function timeoutSignal(signal?: AbortSignal): AbortSignal;
+/** Bytes as unpadded base64url. */
+export declare function base64url(bytes: ArrayBuffer | Uint8Array): string;
+/** The payload of a JWT, read without verifying it. Only for tokens that were verified, or came straight from the token endpoint. */
+export declare function decodeJwtPayload(jwt: string): Record<string, unknown> | null;
+/** The `exp` claim of an ID token, or null. */
+export declare function expiryOf(idToken: string): number | null;
+/** The `iat` claim of an ID token, or null. */
+export declare function issuedAtOf(idToken: string): number | null;

package/dist/util.js

@@ -0,0 +1,44 @@
+/** Helpers shared by the server and browser entry points. No Node-only imports: the browser bundle uses this file too. */
+/** How long an SDK request to the broker or issuer may take before it is abandoned. */
+export const FETCH_TIMEOUT_MS = 15_000;
+/** `signal` if the caller brought one, otherwise a 15 second timeout. */
+export function timeoutSignal(signal) {
+    return signal ?? AbortSignal.timeout(FETCH_TIMEOUT_MS);
+}
+/** Bytes as unpadded base64url. */
+export function base64url(bytes) {
+    const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    return btoa(String.fromCharCode(...view))
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replace(/=+$/, '');
+}
+/** The payload of a JWT, read without verifying it. Only for tokens that were verified, or came straight from the token endpoint. */
+export function decodeJwtPayload(jwt) {
+    try {
+        const part = jwt.split('.')[1];
+        if (!part)
+            return null;
+        const base64 = part.replace(/-/g, '+').replace(/_/g, '/');
+        const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+        const json = JSON.parse(atob(padded));
+        return json && typeof json === 'object' && !Array.isArray(json)
+            ? json
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The `exp` claim of an ID token, or null. */
+export function expiryOf(idToken) {
+    const exp = decodeJwtPayload(idToken)?.exp;
+    return typeof exp === 'number' ? exp : null;
+}
+// Age, not time left: a disabled or revoked account must not ride out a
+// long-lived token just because it still has plenty of time on the clock.
+/** The `iat` claim of an ID token, or null. */
+export function issuedAtOf(idToken) {
+    const iat = decodeJwtPayload(idToken)?.iat;
+    return typeof iat === 'number' ? iat : null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "Sign in against a self-hosted ZITADEL issuer: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",