@wtfalch/auth 0.24.0 → 0.25.0

package/dist/auth.d.ts

@@ -1,4 +1,4 @@
-import { type JWTPayload } from 'jose';
+import type { JWTPayload } from 'jose';
 import { type AuthRequest, type NewUser, type PeoplePage } from './broker.js';
 import { type AccessTokenResult, type AuthOptions } from './config.js';
 import { type SetCookie } from './cookies.js';
@@ -28,7 +28,7 @@ export interface User {
     claims: JWTPayload;
 }
 export interface ReadResult {
-    /** A cookie exists for another binding/revision or cannot be opened. Do not auto-switch. */
+    /** @deprecated Never set. A cookie that cannot be opened (another binding's, an older revision's) reads as no session. */
     accountChanged?: true;
     /** Namespace mode: the binding is suspended or its status cannot be confirmed. Do not start a sign-in. */
     unavailable?: true;
@@ -287,6 +287,8 @@ export interface Auth {
         givenName: string;
         familyName: string;
         next?: string;
+        /** See `NewUser['personalEmail']`. */
+        personalEmail?: string;
     }): Promise<{
         userId: string;
         invited: boolean;
@@ -419,8 +421,8 @@ export interface Auth {
     /**
      * Starts registering a passkey on this app's own domain, for whoever is
      * signed in on `request` -- never for a stranger. Throws `AuthError` when
-     * nobody is: `account_changed`/`unavailable` exactly as `read` reports
-     * them, `unauthenticated` otherwise.
+     * nobody is: `unavailable` exactly as `read` reports it,
+     * `unauthenticated` otherwise.
      */
     startPasskeyRegistration(request: Request): Promise<PasskeyRegistrationStart>;
     /** The second half of `startPasskeyRegistration`. Same signed-in requirement. */

package/dist/auth.js

@@ -1,12 +1,12 @@
-import { errors } from 'jose';
 import * as client from 'openid-client';
 import { Broker, BrokerError } from './broker.js';
 import { resolveOptions, } from './config.js';
 import { clearQrTransaction, clearSession, clearTransaction, cookieFrom, openQrTransaction, openRecord, openSession, openSilent, openTransaction, qrTransactionCookieName, sealQrTransaction, sealSession, sealSilent, sealTransaction, sessionCookieName, silentCookieName, transactionCookieName, } from './cookies.js';
 import { namespaceSessions } from './namespace-session.js';
-import { AuthError, ORG_CLAIM, Oidc, isOAuthRefusal, scopeFor } from './oidc.js';
+import { AuthError, ORG_CLAIM, Oidc, isOAuthRefusal, rejected, scopeFor, } from './oidc.js';
 import { pollDeviceToken, requestDeviceAuthorization } from './qr.js';
 import { safeLoginHint, safeNextPath } from './redirect.js';
+import { expiryOf, issuedAtOf, timeoutSignal } from './util.js';
 export function createAuth(input) {
     // Resolved on first use so `next build`, which imports every route module, needs none of the values set.
     let resolved = null;
@@ -77,9 +77,19 @@ export function createAuth(input) {
         return brokerInstance;
     };
     const sessions = namespaceSessions({ options, oidc, broker });
-    const sessionCookie = (tokens, requestHeaders) => options().namespace
-        ? sessions.create(tokens, requestHeaders)
-        : sealSession(options(), { idt: tokens.idToken, rt: tokens.refreshToken });
+    // Every way in ends here, so this is the one place that reports a sign-in.
+    const sessionCookie = async (tokens, requestHeaders) => {
+        const cookie = options().namespace
+            ? await sessions.create(tokens, requestHeaders)
+            : await sealSession(options(), { idt: tokens.idToken, rt: tokens.refreshToken });
+        const email = tokens.claims.email;
+        emit({
+            type: 'signIn',
+            email: typeof email === 'string' ? email : '',
+            userId: String(tokens.claims.sub),
+        });
+        return cookie;
+    };
     /**
      * Signing in again replaces this binding's previous session outright: in
      * namespace mode, ends whatever session record `cookieHeader` already
@@ -268,9 +278,7 @@ export function createAuth(input) {
             // `sessions.end` reaches the store, which can be briefly unreachable --
             // and a sign-out that 500s over that leaves the browser's own cookie
             // standing, which is worse than the record surviving a moment longer.
-            const status = await sessions.end(value).catch(() => 'ended');
-            if (status === 'changed')
-                return new Response('Account changed', { status: 409 });
+            await sessions.end(value).catch(() => { });
             return endIssuerSession(idToken, [clearSession(options())]);
         }
         const session = await openSession(options(), value);
@@ -335,8 +343,6 @@ export function createAuth(input) {
             const result = await sessions.read(value);
             if (result.kind === 'user')
                 return { user: boundUser(result.claims), cookies: [] };
-            if (result.kind === 'changed')
-                return { user: null, cookies: [], accountChanged: true };
             if (result.kind === 'unavailable')
                 return { user: null, cookies: [], unavailable: true };
             return { user: null, cookies: [] };
@@ -389,11 +395,9 @@ export function createAuth(input) {
         const isPublic = url.pathname === options().basePath ||
             url.pathname.startsWith(`${options().basePath}/`) ||
             matches(rules.public, url.pathname);
-        const { user, cookies, accountChanged, unavailable } = await read(request);
+        const { user, cookies, unavailable } = await read(request);
         if (user || isPublic)
             return { kind: 'next', user, cookies };
-        if (accountChanged)
-            return { kind: 'deny', cookies, reason: 'account_changed' };
         if (unavailable)
             return { kind: 'deny', cookies, reason: 'unavailable' };
         if (!isNavigation(request))
@@ -411,13 +415,11 @@ export function createAuth(input) {
     /**
      * The person signed in on `request`, for the passkey routes -- never a
      * stranger. Adapts `requireUser`'s reasons for a caller that throws rather
-     * than redirects: `account_changed`/`unavailable` are read's own, and
+     * than redirects: `unavailable` is read's own, and
      * plain absence becomes `unauthenticated`, which read has no reason for.
      */
     const currentUser = async (request) => {
-        const { user, accountChanged, unavailable } = await read(request, { refresh: false });
-        if (accountChanged)
-            throw new AuthError('account_changed', 'Choose an account to continue');
+        const { user, unavailable } = await read(request, { refresh: false });
         if (unavailable)
             throw new AuthError('unavailable', 'Sign-in is unavailable for this workspace');
         if (!user)
@@ -484,8 +486,13 @@ export function createAuth(input) {
         const nonce = client.randomNonce();
         const verifier = client.randomPKCECodeVerifier();
         const target = await oidc().authorizationUrl(state, nonce, verifier);
-        const response = await options().fetch(target.href, { redirect: 'manual' });
+        const response = await options().fetch(target.href, {
+            redirect: 'manual',
+            signal: timeoutSignal(),
+        });
         const location = response.headers.get('location');
+        // Only the Location header is wanted; an unread body would hold the socket.
+        response.body?.cancel().catch(() => undefined);
         if (options().namespace &&
             location &&
             new URL(location, options().issuer).origin !== options().namespace?.loginOrigin)
@@ -542,7 +549,13 @@ export function createAuth(input) {
     const requestPasswordReset = (email, next) => quietly(() => broker().sendReset(email, safeNextPath(next, '')));
     const sendLink = (email, next) => quietly(() => broker().sendLink(email, safeNextPath(next, '')));
     const invite = async (input) => {
-        const result = await broker().invite({ ...input, next: safeNextPath(input.next, '') });
+        const result = await broker().invite({
+            email: input.email,
+            givenName: input.givenName,
+            familyName: input.familyName,
+            next: safeNextPath(input.next, ''),
+            personalEmail: input.personalEmail,
+        });
         emit({ type: 'invite', email: input.email, userId: result.userId, invited: result.invited });
         return result;
     };
@@ -618,14 +631,11 @@ export function createAuth(input) {
     const signIn = async ({ authRequestId, email, password, }) => {
         try {
             const redirectTo = await broker().signIn({ authRequestId, email, password });
-            emit({ type: 'signIn', email });
             return { ok: true, redirectTo };
         }
         catch (error) {
-            if (needsHostedLogin(error)) {
-                emit({ type: 'signIn', email });
+            if (needsHostedLogin(error))
                 return { ok: true, redirectTo: hostedUrl(authRequestId), hosted: true };
-            }
             const change = changeRequired(error);
             if (change)
                 return change;
@@ -664,7 +674,6 @@ export function createAuth(input) {
         try {
             const flow = await serverFlow();
             const completed = await finishOrHandoff(() => broker().signIn({ authRequestId: flow.id, email, password }), flow, safeNextPath(next, options().afterLogin), requestHeaders);
-            emit({ type: 'signIn', email });
             return { ok: true, ...completed };
         }
         catch (error) {
@@ -690,26 +699,7 @@ export function createAuth(input) {
             return { ok: true, ...completed };
         }
         catch (error) {
-            if (error instanceof BrokerError && error.error === 'email_taken') {
-                return { ok: false, error: 'email_taken', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'registration_closed') {
-                return { ok: false, error: 'registration_closed', message: error.detail ?? error.error };
-            }
-            // Both carry a sentence about the name, for the form to show as it is.
-            if (error instanceof BrokerError && error.error === 'username_taken') {
-                return { ok: false, error: 'username_taken', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'username_invalid') {
-                return { ok: false, error: 'username_invalid', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'request') {
-                return { ok: false, error: 'request', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.status < 500) {
-                return { ok: false, error: 'invalid', message: error.detail ?? error.error };
-            }
-            return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
+            return signUpFailure(error);
         }
     };
     const signUp = async ({ authRequestId, ...user }) => {
@@ -726,26 +716,7 @@ export function createAuth(input) {
             const change = changeRequired(error);
             if (change)
                 return { ...change, message: 'choose a new password to continue' };
-            if (error instanceof BrokerError && error.error === 'email_taken') {
-                return { ok: false, error: 'email_taken', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'registration_closed') {
-                return { ok: false, error: 'registration_closed', message: error.detail ?? error.error };
-            }
-            // Both carry a sentence about the name, for the form to show as it is.
-            if (error instanceof BrokerError && error.error === 'username_taken') {
-                return { ok: false, error: 'username_taken', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'username_invalid') {
-                return { ok: false, error: 'username_invalid', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'request') {
-                return { ok: false, error: 'request', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.status < 500) {
-                return { ok: false, error: 'invalid', message: error.detail ?? error.error };
-            }
-            return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
+            return signUpFailure(error);
         }
     };
     const startPasskeyRegistration = async (request) => {
@@ -806,7 +777,11 @@ export function createAuth(input) {
     const changePassword = async (request, input) => {
         const user = await currentFreshUser(request);
         try {
-            await broker().changePassword({ userId: user.id, ...input });
+            await broker().changePassword({
+                userId: user.id,
+                currentPassword: input.currentPassword,
+                newPassword: input.newPassword,
+            });
             return { ok: true };
         }
         catch (error) {
@@ -862,7 +837,7 @@ export function createAuth(input) {
         if (options().namespace && !(await sessions.bindingActive()))
             throw new AuthError('unavailable', 'the namespace binding is not active');
         const device = await requestDeviceAuthorization(options(), scopeFor(options().organizationId, options().extraScopes));
-        const cookie = await sealQrTransaction(options(), { dc: device.deviceCode, iv: device.interval }, device.expiresIn);
+        const cookie = await sealQrTransaction(options(), { dc: device.deviceCode }, device.expiresIn);
         return {
             url: qrVerificationUrl(options(), device.verificationUriComplete),
             userCode: device.userCode,
@@ -1032,28 +1007,6 @@ function matches(rule, pathname) {
         return pathname === entry;
     });
 }
-function expiryOf(idToken) {
-    try {
-        const [, payload] = idToken.split('.');
-        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-        return typeof json.exp === 'number' ? json.exp : null;
-    }
-    catch {
-        return null;
-    }
-}
-// Age, not time left: a disabled or revoked account must not ride out a
-// long-lived token just because it still has plenty of time on the clock.
-function issuedAtOf(idToken) {
-    try {
-        const [, payload] = idToken.split('.');
-        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-        return typeof json.iat === 'number' ? json.iat : null;
-    }
-    catch {
-        return null;
-    }
-}
 const PROMPTS = ['select_account', 'login'];
 function promptFrom(raw) {
     return PROMPTS.includes(raw ?? '') ? raw : undefined;
@@ -1117,15 +1070,6 @@ function userFrom(claims) {
     };
 }
 // The token itself is bad, as opposed to the keys being unreachable or rotating.
-function rejected(error) {
-    return (error instanceof AuthError ||
-        error instanceof errors.JWTExpired ||
-        error instanceof errors.JWTClaimValidationFailed ||
-        error instanceof errors.JWSSignatureVerificationFailed ||
-        error instanceof errors.JWSInvalid ||
-        error instanceof errors.JWTInvalid ||
-        error instanceof errors.JOSEAlgNotAllowed);
-}
 function isNavigation(request) {
     const mode = request.headers.get('sec-fetch-mode');
     if (mode && mode !== 'navigate')
@@ -1179,6 +1123,23 @@ function signInError(error) {
         return 'invalid_credentials';
     return 'unavailable';
 }
+/** The sign-up refusals the broker can name, each with its own sentence for the form to show as it is. */
+function signUpFailure(error) {
+    if (error instanceof BrokerError) {
+        const message = error.detail ?? error.error;
+        switch (error.error) {
+            case 'email_taken':
+            case 'registration_closed':
+            case 'username_taken':
+            case 'username_invalid':
+            case 'request':
+                return { ok: false, error: error.error, message };
+        }
+        if (error.status < 500)
+            return { ok: false, error: 'invalid', message };
+    }
+    return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
+}
 function reasonOf(error) {
     if (error instanceof AuthError)
         return error.reason;

package/dist/broker.js

@@ -1,3 +1,4 @@
+import { timeoutSignal } from './util.js';
 export class BrokerError extends Error {
     status;
     error;
@@ -34,7 +35,7 @@ export class Broker {
                 url.searchParams.set(k, String(v));
         const response = await this.options.fetch(url.href, {
             method,
-            signal,
+            signal: timeoutSignal(signal),
             headers: {
                 authorization: `Bearer ${this.options.appKey}`,
                 'content-type': 'application/json',
@@ -84,8 +85,16 @@ export class Broker {
         return callbackUrl;
     }
     async signUp(input) {
+        // Named fields: `input` can come from a form a client controls.
         const { callbackUrl } = await this.call('POST', '/sign-up', {
-            ...input,
+            authRequestId: input.authRequestId,
+            email: input.email,
+            password: input.password,
+            givenName: input.givenName,
+            familyName: input.familyName,
+            username: input.username,
+            changeRequired: input.changeRequired,
+            personalEmail: input.personalEmail,
         });
         return callbackUrl;
     }
@@ -113,7 +122,13 @@ export class Broker {
         return callbackUrl;
     }
     invite(input) {
-        return this.call('POST', '/invite', input);
+        return this.call('POST', '/invite', {
+            email: input.email,
+            givenName: input.givenName,
+            familyName: input.familyName,
+            next: input.next,
+            personalEmail: input.personalEmail,
+        });
     }
     sendLink(email, next) {
         return this.call('POST', '/link/send', { email, next });
@@ -148,7 +163,11 @@ export class Broker {
         return this.call('POST', '/email/change/complete', { userId, code });
     }
     changePassword(input) {
-        return this.call('POST', '/password/change', input);
+        return this.call('POST', '/password/change', {
+            userId: input.userId,
+            currentPassword: input.currentPassword,
+            newPassword: input.newPassword,
+        });
     }
     passkeys(userId) {
         return this.call('GET', '/passkeys', { userId });
@@ -158,14 +177,26 @@ export class Broker {
     }
     /** A public client revoking its own token: no key, no service. */
     async revoke(refreshToken) {
-        await this.options.fetch(`${this.options.issuer}/oauth/v2/revoke`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({
-                token: refreshToken,
-                token_type_hint: 'refresh_token',
-                client_id: this.options.clientId,
-            }),
-        });
+        let response;
+        try {
+            response = await this.options.fetch(`${this.options.issuer}/oauth/v2/revoke`, {
+                method: 'POST',
+                signal: timeoutSignal(),
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    token: refreshToken,
+                    token_type_hint: 'refresh_token',
+                    client_id: this.options.clientId,
+                }),
+            });
+        }
+        catch (error) {
+            console.error('@wtfalch/auth: the revoke request failed', error instanceof Error ? error.name : 'unknown');
+            throw error;
+        }
+        if (!response.ok) {
+            console.error('@wtfalch/auth: the issuer refused to revoke a refresh token', response.status);
+            throw new BrokerError(response.status, 'unavailable', 'the issuer did not revoke the token');
+        }
     }
 }

package/dist/browser.d.ts

@@ -125,8 +125,9 @@ export type RefreshOutcome = {
     kind: 'no-refresh-token';
 }
 /**
- * The issuer refused rotation, or this operation was cancelled. An issuer
- * refusal drops the held session because the old refresh token was spent.
+ * The issuer refused rotation, or this operation was cancelled. A 4xx other
+ * than 429 drops the held session because the old refresh token was spent;
+ * a 429 or 5xx keeps it.
  * Cancellation discards the old response and preserves any newer session.
  */
  | {

package/dist/browser.js

@@ -1,5 +1,6 @@
 import { createNamespaceBrowserAuth } from './namespace-browser.js';
 import { safeLoginHint } from './redirect.js';
+import { base64url, decodeJwtPayload, timeoutSignal } from './util.js';
 const TOKEN = 'wtfalch.auth.token';
 const VERIFIER = 'wtfalch.auth.verifier';
 /** CSRF protection on the callback: checked before the code exchange, never persisted past it. */
@@ -37,12 +38,6 @@ const defaultStore = {
         }
     },
 };
-function base64url(bytes) {
-    return btoa(String.fromCharCode(...new Uint8Array(bytes)))
-        .replace(/\+/g, '-')
-        .replace(/\//g, '_')
-        .replace(/=+$/, '');
-}
 async function challengeFor(verifier) {
     const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
     return base64url(digest);
@@ -53,22 +48,6 @@ function verifier() {
     // too -- a random, unguessable token is exactly what each of the three is.
     return base64url(crypto.getRandomValues(new Uint8Array(32)).buffer);
 }
-/** The payload of a JWT, read without verifying its signature -- the ID token here comes straight
- *  from the token endpoint over TLS, which OIDC Core 1.0 3.1.3.7 allows in place of a signature
- *  check for the authorization code flow. Never used to trust a claim from anywhere else. */
-function decodeJwtPayload(jwt) {
-    try {
-        const part = jwt.split('.')[1];
-        if (!part)
-            return null;
-        const base64 = part.replace(/-/g, '+').replace(/_/g, '/');
-        const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
-        return JSON.parse(atob(padded));
-    }
-    catch {
-        return null;
-    }
-}
 function publicSession(session) {
     const { refreshToken, ...rest } = session;
     return rest;
@@ -212,6 +191,7 @@ export function createBrowserAuth(options) {
             return { kind: 'no-refresh-token' };
         const response = await fetch(`${options.issuer}/oauth/v2/token`, {
             method: 'POST',
+            signal: timeoutSignal(),
             headers: { 'content-type': 'application/x-www-form-urlencoded' },
             body: new URLSearchParams({
                 grant_type: 'refresh_token',
@@ -223,10 +203,13 @@ export function createBrowserAuth(options) {
             return cancelledRefresh();
         if (!response.ok) {
             const body = await response.text();
+            // A 5xx or 429 says the issuer is struggling, not that the grant is gone: keep the session for the next try.
+            const definitive = response.status >= 400 && response.status < 500 && response.status !== 429;
             return mutate(async () => {
                 if (!current(generation))
                     return cancelledRefresh();
-                await store.drop(tokenKey);
+                if (definitive)
+                    await store.drop(tokenKey);
                 if (!current(generation))
                     return cancelledRefresh();
                 return {
@@ -322,6 +305,7 @@ export function createBrowserAuth(options) {
                 };
             const response = await fetch(`${options.issuer}/oauth/v2/token`, {
                 method: 'POST',
+                signal: timeoutSignal(),
                 headers: { 'content-type': 'application/x-www-form-urlencoded' },
                 body: new URLSearchParams({
                     grant_type: 'authorization_code',

package/dist/config.d.ts

@@ -8,9 +8,12 @@ import type { SessionStore } from './sessions.js';
  * to offer there; `invite` calls the broker's own endpoint, which returns
  * one.
  */
-export type AuthEvent = {
+export type AuthEvent = 
+/** A session was established, by any method: password, passkey, link, reset, QR or the hosted login. `email` is empty when the id token carries none. */
+{
     type: 'signIn';
     email: string;
+    userId: string;
 } | {
     type: 'signUp';
     email: string;

package/dist/cookies.d.ts

@@ -32,10 +32,9 @@ export interface LinkPayload extends JWTPayload {
     stk: string;
     ar: string;
 }
-/** The QR device-grant transaction: the device_code, never handed to the caller, and the interval the issuer asked us to poll at. Its own `exp` -- set to the issuer's `expires_in` -- is what makes an unsealed-past-expiry cookie fail open with the others below. */
+/** The QR device-grant transaction: the device_code, never handed to the caller, and nothing else: the issuer answers `slow_down` to a client that polls too fast, and `pollQrSignIn` passes that on. Its own `exp` -- set to the issuer's `expires_in` -- is what makes an unsealed-past-expiry cookie fail open with the others below. */
 export interface QrTransactionPayload extends JWTPayload {
     dc: string;
-    iv: number;
 }
 export interface SetCookie {
     name: string;

package/dist/cookies.js

@@ -1,6 +1,7 @@
 import { EncryptJWT, jwtDecrypt } from 'jose';
 import { deriveCookieKey } from './config.js';
 import { AuthError } from './oidc.js';
+import { base64url } from './util.js';
 // `options.cookieKey` decodes once per `ResolvedOptions` (config.ts) and is
 // always the same `Uint8Array` reference after that, so keying the derived
 // key's own cache off it means every seal/open after the first reuses it
@@ -78,10 +79,7 @@ export async function contextDigest(options) {
 /** SHA-256, base64url. */
 export async function digest(value) {
     const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
-    return btoa(String.fromCharCode(...new Uint8Array(bytes)))
-        .replaceAll('+', '-')
-        .replaceAll('/', '_')
-        .replace(/=+$/, '');
+    return base64url(bytes);
 }
 export async function sealTransaction(options, payload) {
     const value = await seal(options, 'transaction', payload, TRANSACTION_TTL);
@@ -125,9 +123,7 @@ export async function sealQrTransaction(options, payload, ttl) {
 }
 export async function openQrTransaction(options, value) {
     const payload = await open(options, 'qr', value);
-    return payload && typeof payload.dc === 'string' && typeof payload.iv === 'number'
-        ? payload
-        : null;
+    return payload && typeof payload.dc === 'string' ? payload : null;
 }
 export function clearQrTransaction(options) {
     return setCookie(qrTransactionCookieName(options), '', 0, options.secure);

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-export { type Auth, type AuthRequest, type Gate, type GateRules, type Intent, type MaxAge, type NewUser, type PasskeyRegistrationResult, type PasswordChangeRequired, type PasskeyRegistrationStart, type PasskeySignInStart, type Prompt, type QrPollResult, type QrPollStatus, type QrSignInStart, type ReadResult, type ResetError, type SetNewPasswordError, type SetNewPasswordResult, type SignInError, type SignInResult, type SignUpError, type SignUpResult, type SignedIn, type User, STEP_UP_MAX_AGE, createAuth, } from './auth.js';
+export { type Auth, type AuthRequest, type ChangePasswordError, type ChangePasswordResult, type Completed, type DeletePasskeyResult, type EmailChangeError, type EmailChangeResult, type Gate, type GateRules, type Intent, type MaxAge, type NewUser, type Passkey, type PasskeyRegistrationResult, type PasswordChangeRequired, type PasskeyRegistrationStart, type PasskeySignInStart, type Prompt, type QrPollResult, type QrPollStatus, type QrSignInStart, type ReadResult, type ResetError, type SetNewPasswordError, type SetNewPasswordResult, type SignInError, type SignInResult, type SignUpError, type SignUpResult, type SignedIn, type User, STEP_UP_MAX_AGE, createAuth, } from './auth.js';
 export type { AccessTokenReason, AccessTokenResult, AuthEvent, AuthOptions } from './config.js';
 export type { SetCookie } from './cookies.js';
 export type { SessionRecord, SessionStore, SessionUpdate } from './sessions.js';
 export type { PersonTokenConfig, PersonTokenVerifier } from './person-token.js';
-export { BrokerError } from './broker.js';
+export { BrokerError, type PeoplePage, type Person } from './broker.js';
 export { AuthError, type AuthErrorReason, ORG_CLAIM } from './oidc.js';
 export { safeLoginHint, safeNextPath } from './redirect.js';

package/dist/namespace-browser.js

@@ -1,15 +1,10 @@
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 import { resolveNamespaceContext } from './namespaces.js';
 import { safeLoginHint, safeNextPath } from './redirect.js';
+import { base64url } from './util.js';
 const OWNER = 'urn:zitadel:iam:user:resourceowner:id';
 const ttl = 10 * 60_000;
 const random = () => base64url(crypto.getRandomValues(new Uint8Array(32)));
-function base64url(bytes) {
-    return btoa(String.fromCharCode(...bytes))
-        .replaceAll('+', '-')
-        .replaceAll('/', '_')
-        .replace(/=+$/, '');
-}
 function read(storage, key) {
     try {
         return JSON.parse(storage.getItem(key) ?? 'null');

package/dist/namespace-session.d.ts

@@ -11,10 +11,6 @@ export declare const STATUS_STALE_IF_ERROR_MS: number;
 export type SessionRead = {
     kind: 'none';
 }
-/** A cookie for another binding, revision or format. */
- | {
-    kind: 'changed';
-}
 /** The binding is suspended, or its status cannot be confirmed. */
  | {
     kind: 'unavailable';
@@ -36,7 +32,7 @@ export declare function namespaceSessions(deps: {
 }): {
     bindingActive: () => Promise<boolean>;
     create: (tokens: Tokens, requestHeaders?: Headers) => Promise<SetCookie>;
-    end: (value: string | undefined) => Promise<"ended" | "changed" | "none">;
+    end: (value: string | undefined) => Promise<"ended" | "none">;
     read: (value: string | undefined, force?: boolean) => Promise<SessionRead>;
     revokeSubject: (subject: string) => Promise<number>;
     listSessions: (subject: string) => Promise<SessionRecord[]>;

package/dist/namespace-session.js

@@ -2,7 +2,8 @@ import { sleep } from '@wtfalch/utils/datetime';
 import * as client from 'openid-client';
 import { BrokerError } from './broker.js';
 import { contextDigest, digest, openHandle, openRecord, sealHandle, sealRecord, } from './cookies.js';
-import { AuthError, isOAuthRefusal } from './oidc.js';
+import { AuthError, isOAuthRefusal, rejected } from './oidc.js';
+import { expiryOf, issuedAtOf } from './util.js';
 /** How long a binding status answer is trusted. The propagation bound for a suspension. */
 export const STATUS_FRESH_MS = 60_000;
 /** How long the last good answer carries on while the service cannot be asked. */
@@ -158,7 +159,7 @@ export function namespaceSessions(deps) {
             return 'none';
         const key = await keyOf(value);
         if (!key)
-            return 'changed';
+            return 'none';
         const loaded = await load(key);
         await store().revoke(key, now());
         revokeToken(loaded?.tokens.rt);
@@ -423,8 +424,9 @@ export function namespaceSessions(deps) {
         if (!value)
             return { kind: 'none' };
         const key = await keyOf(value);
+        // A handle that does not open (another binding's, an older revision's, or damaged) is nobody: sign in again replaces it.
         if (!key)
-            return { kind: 'changed' };
+            return { kind: 'none' };
         if (!(await bindingActive()))
             return { kind: 'unavailable' };
         let loaded = await load(key);
@@ -443,8 +445,12 @@ export function namespaceSessions(deps) {
         try {
             return { kind: 'user', claims: await deps.oidc().verify(loaded.tokens.idt) };
         }
-        catch {
-            return { kind: 'none' };
+        catch (error) {
+            if (rejected(error))
+                return { kind: 'none' };
+            // The issuer's keys could not be fetched: not a verdict on this session.
+            console.error('@wtfalch/auth: could not verify the session id token', error instanceof Error ? error.name : 'unknown');
+            return { kind: 'unavailable' };
         }
     };
     return {
@@ -483,25 +489,3 @@ function ipFrom(headers) {
         .filter(Boolean);
     return hops.length > 0 ? hops[hops.length - 1] : null;
 }
-function expiryOf(idToken) {
-    try {
-        const [, payload] = idToken.split('.');
-        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-        return typeof json.exp === 'number' ? json.exp : null;
-    }
-    catch {
-        return null;
-    }
-}
-// Age, not time left: a disabled or revoked account must not ride out a
-// long-lived token just because it still has plenty of time on the clock.
-function issuedAtOf(idToken) {
-    try {
-        const [, payload] = idToken.split('.');
-        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-        return typeof json.iat === 'number' ? json.iat : null;
-    }
-    catch {
-        return null;
-    }
-}

package/dist/next.d.ts

@@ -128,7 +128,7 @@ export interface NextAuth {
     /**
      * Registers a passkey on this app's own domain for the person signed in
      * here. Throws `AuthError('unauthenticated', ...)` for nobody, exactly as
-     * `requireUser` throws `account_changed`/`unavailable` for those.
+     * `requireUser` throws `unavailable` for a suspended binding.
      */
     startPasskeyRegistration: () => Promise<PasskeyRegistrationStart>;
     /** The second half of `startPasskeyRegistration`. Same signed-in requirement. */

package/dist/next.js

@@ -31,13 +31,9 @@ export function nextAuth(options) {
             response = NextResponse.redirect(gate.location, 303);
         }
         else if (gate.kind === 'deny') {
-            response = new NextResponse(gate.reason === 'account_changed'
-                ? 'Account changed; choose an account to continue'
-                : gate.reason === 'unavailable'
-                    ? 'Sign-in is unavailable for this workspace'
-                    : 'Unauthorized', {
-                status: gate.reason === 'account_changed' ? 409 : gate.reason === 'unavailable' ? 503 : 401,
-            });
+            response = new NextResponse(gate.reason === 'unavailable'
+                ? 'Sign-in is unavailable for this workspace'
+                : 'Unauthorized', { status: gate.reason === 'unavailable' ? 503 : 401 });
         }
         else if (gate.cookies.length > 0) {
             const headers = new Headers(request.headers);
@@ -60,9 +56,9 @@ export function nextAuth(options) {
     };
     const requireUser = async (next) => {
         const store = await cookies();
-        const { user, accountChanged, unavailable } = await auth.readCookie(store.get(auth.sessionCookieName)?.value, { refresh: false });
-        if (accountChanged)
-            throw new AuthError('account_changed', 'Choose an account to continue');
+        const { user, unavailable } = await auth.readCookie(store.get(auth.sessionCookieName)?.value, {
+            refresh: false,
+        });
         if (unavailable)
             throw new AuthError('unavailable', 'Sign-in is unavailable for this workspace');
         if (!user)
@@ -213,10 +209,16 @@ export function nextAuth(options) {
     };
     const setNewPassword = async (input) => {
         // Named fields: a Server Action's argument is whatever the client sent.
+        // A field that is not text is refused here and never reaches the broker.
+        if (typeof input?.authRequestId !== 'string' || typeof input.changeToken !== 'string') {
+            return { error: 'invalid_token' };
+        }
+        if (typeof input.newPassword !== 'string')
+            return { error: 'invalid_password' };
         const result = await auth.setNewPassword({
-            authRequestId: String(input?.authRequestId),
-            changeToken: String(input?.changeToken),
-            newPassword: String(input?.newPassword),
+            authRequestId: input.authRequestId,
+            changeToken: input.changeToken,
+            newPassword: input.newPassword,
         });
         if (result.ok) {
             if (result.hosted)
@@ -226,7 +228,24 @@ export function nextAuth(options) {
         return { error: result.error };
     };
     const signUp = async (input) => {
-        const result = await auth.signUp(input);
+        // Named fields: a Server Action's argument is whatever the client sent, so
+        // `changeRequired` and `personalEmail`, which only a server may set, are not read.
+        if (typeof input?.authRequestId !== 'string' ||
+            typeof input.email !== 'string' ||
+            typeof input.password !== 'string' ||
+            typeof input.givenName !== 'string' ||
+            typeof input.familyName !== 'string' ||
+            (input.username !== undefined && typeof input.username !== 'string')) {
+            return { error: 'invalid', message: 'Fill in every field.' };
+        }
+        const result = await auth.signUp({
+            authRequestId: input.authRequestId,
+            email: input.email,
+            password: input.password,
+            givenName: input.givenName,
+            familyName: input.familyName,
+            username: input.username,
+        });
         if (result.ok) {
             if (result.hosted)
                 redirect(result.redirectTo);

package/dist/oidc.d.ts

@@ -86,4 +86,6 @@ export declare class AuthError extends Error {
  * is never a statement that the grant is dead, and this issuer's own rate
  * limiting must not permanently revoke a session.
  */
+/** An id token the issuer's keys or claims refuse, as opposed to keys that could not be fetched. */
+export declare function rejected(error: unknown): boolean;
 export declare function isOAuthRefusal(error: unknown): boolean;

package/dist/oidc.js

@@ -107,6 +107,10 @@ export class Oidc {
         return this.tokensFrom(response);
     }
     // Parallel requests holding the same refresh token share one grant; the issuer rotates it, so a second grant would fail.
+    // The rotated result is kept for ROTATION_CACHE_MS and keyed by the OLD refresh token, so a request that lost the race gets the
+    // winner's tokens. The cost: a copy of the old cookie (same refresh token) gets those tokens too in that window. Keying on
+    // the session does not help, since the copy is the same session; the only fix is a shorter window, which would break the race
+    // it exists for. The copy still needs the sealed cookie, so this exposes nothing a live cookie did not already hold.
     refresh(refreshToken) {
         const asked = Date.now();
         for (const [token, entry] of this.rotated)
@@ -221,6 +225,16 @@ export class AuthError extends Error {
  * is never a statement that the grant is dead, and this issuer's own rate
  * limiting must not permanently revoke a session.
  */
+/** An id token the issuer's keys or claims refuse, as opposed to keys that could not be fetched. */
+export function rejected(error) {
+    return (error instanceof AuthError ||
+        error instanceof jose.errors.JWTExpired ||
+        error instanceof jose.errors.JWTClaimValidationFailed ||
+        error instanceof jose.errors.JWSSignatureVerificationFailed ||
+        error instanceof jose.errors.JWSInvalid ||
+        error instanceof jose.errors.JWTInvalid ||
+        error instanceof jose.errors.JOSEAlgNotAllowed);
+}
 export function isOAuthRefusal(error) {
     const status = statusOf(error);
     return status !== undefined && status >= 400 && status < 500 && status !== 429;

package/dist/person-token.js

@@ -1,4 +1,5 @@
 import { createRemoteJWKSet, customFetch, jwtVerify } from 'jose';
+import { timeoutSignal } from './util.js';
 /** A JWT is three base64url segments; a ZITADEL opaque token is not shaped
  *  like that at all, so this is enough to route between `jwtVerify` and
  *  introspection without ever trying to parse either kind as the other. */
@@ -23,7 +24,7 @@ function sameOriginEndpoint(value, name, issuerOrigin) {
 async function discoverDocument(issuer, fetchImpl) {
     const discoveryUrl = `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
     const issuerOrigin = new URL(issuer).origin;
-    const response = await fetchImpl(discoveryUrl);
+    const response = await fetchImpl(discoveryUrl, { signal: timeoutSignal() });
     if (!response.ok) {
         throw new Error(`person-token: discovery document request failed with ${response.status}`);
     }
@@ -108,6 +109,7 @@ export function createPersonTokenVerifier(config) {
                 audience: config.audience,
                 algorithms: ['RS256'],
                 clockTolerance: 60,
+                requiredClaims: ['exp', 'sub'],
             });
             return payload;
         }
@@ -150,6 +152,7 @@ export function createPersonTokenVerifier(config) {
                     authorization: `Basic ${credentials}`,
                 },
                 body: new URLSearchParams({ token: accessToken }).toString(),
+                signal: timeoutSignal(),
             });
         }
         catch {

package/dist/qr.js

@@ -1,4 +1,5 @@
 import { AuthError } from './oidc.js';
+import { timeoutSignal } from './util.js';
 /**
  * The OAuth device authorization grant (RFC 8628), for signing in a new
  * device from a QR code a phone that is already signed in approves. Raw
@@ -11,6 +12,7 @@ const DEVICE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
 export async function requestDeviceAuthorization(options, scope) {
     const response = await options.fetch(`${options.issuer}/oauth/v2/device_authorization`, {
         method: 'POST',
+        signal: timeoutSignal(),
         headers: { 'content-type': 'application/x-www-form-urlencoded' },
         body: new URLSearchParams({ client_id: options.clientId, scope }),
     });
@@ -36,6 +38,7 @@ export async function requestDeviceAuthorization(options, scope) {
 export async function pollDeviceToken(options, oidc, deviceCode) {
     const response = await options.fetch(`${options.issuer}/oauth/v2/token`, {
         method: 'POST',
+        signal: timeoutSignal(),
         headers: { 'content-type': 'application/x-www-form-urlencoded' },
         body: new URLSearchParams({
             grant_type: DEVICE_GRANT_TYPE,

package/dist/testing.d.ts

@@ -1,9 +1,11 @@
 import type { Auth, User } from './auth.js';
+import type { NextAuth } from './next.js';
 export declare function setSessionUser(user: User | null): void;
 /** A User shaped like the SDK's, for `setSessionUser`. */
 export declare function testUser(id: string, overrides?: Partial<User>): User;
 export declare function getUser(): Promise<User | null>;
 export declare function requireUser(_next?: string): Promise<User>;
+export declare const requireFreshUser: NextAuth['requireFreshUser'];
 export declare const handlers: () => never;
 export declare const proxy: () => never;
 export declare const authRequest: () => never;
@@ -13,6 +15,24 @@ export declare const requestPasswordReset: () => never;
 export declare const resetPassword: () => never;
 export declare const sendLink: () => never;
 export declare const resendVerification: () => never;
+export declare const setNewPassword: () => never;
+export declare const invite: () => never;
+export declare const people: () => never;
+export declare const setPersonActive: () => never;
+export declare const adminResetPassword: () => never;
+export declare const sessions: () => never;
+export declare const endSession: () => never;
+export declare const startPasskeyRegistration: () => never;
+export declare const finishPasskeyRegistration: () => never;
+export declare const startEmailChange: () => never;
+export declare const completeEmailChange: () => never;
+export declare const changePassword: () => never;
+export declare const passkeys: () => never;
+export declare const deletePasskey: () => never;
+export declare const startPasskeySignIn: () => never;
+export declare const finishPasskeySignIn: () => never;
+export declare const startQrSignIn: () => never;
+export declare const pollQrSignIn: () => never;
 /**
  * The core SDK instance, as far as a device sign-in module reaches into it.
  *
@@ -29,3 +49,9 @@ export declare const sentLinks: {
 export declare function setFollowLinkResult(result: unknown): void;
 export declare function setCookieUser(user: User | null): void;
 export declare const auth: Auth;
+/**
+ * Every member of `NextAuth`, so the compiler fails here when the real
+ * surface gains one this stub lacks. `export const { getUser } = nextAuthStub`
+ * is the same as importing the named exports above.
+ */
+export declare const nextAuthStub: NextAuth;

package/dist/testing.js

@@ -39,6 +39,7 @@ export async function requireUser(_next) {
         throw new Error('requireUser: no session set; call setSessionUser first');
     return current;
 }
+export const requireFreshUser = async () => requireUser();
 function unavailable(name) {
     return () => {
         throw new Error(`${name} is not available in the integration tier`);
@@ -53,6 +54,24 @@ export const requestPasswordReset = unavailable('requestPasswordReset');
 export const resetPassword = unavailable('resetPassword');
 export const sendLink = unavailable('sendLink');
 export const resendVerification = unavailable('resendVerification');
+export const setNewPassword = unavailable('setNewPassword');
+export const invite = unavailable('invite');
+export const people = unavailable('people');
+export const setPersonActive = unavailable('setPersonActive');
+export const adminResetPassword = unavailable('adminResetPassword');
+export const sessions = unavailable('sessions');
+export const endSession = unavailable('endSession');
+export const startPasskeyRegistration = unavailable('startPasskeyRegistration');
+export const finishPasskeyRegistration = unavailable('finishPasskeyRegistration');
+export const startEmailChange = unavailable('startEmailChange');
+export const completeEmailChange = unavailable('completeEmailChange');
+export const changePassword = unavailable('changePassword');
+export const passkeys = unavailable('passkeys');
+export const deletePasskey = unavailable('deletePasskey');
+export const startPasskeySignIn = unavailable('startPasskeySignIn');
+export const finishPasskeySignIn = unavailable('finishPasskeySignIn');
+export const startQrSignIn = unavailable('startQrSignIn');
+export const pollQrSignIn = unavailable('pollQrSignIn');
 /**
  * The core SDK instance, as far as a device sign-in module reaches into it.
  *
@@ -79,3 +98,41 @@ export const auth = {
     followLink: async () => linkResult,
     readCookie: async () => ({ user: cookieUser, cookies: [] }),
 };
+/**
+ * Every member of `NextAuth`, so the compiler fails here when the real
+ * surface gains one this stub lacks. `export const { getUser } = nextAuthStub`
+ * is the same as importing the named exports above.
+ */
+export const nextAuthStub = {
+    auth,
+    handlers: handlers,
+    proxy,
+    getUser,
+    requireUser,
+    requireFreshUser,
+    authRequest,
+    signIn,
+    setNewPassword,
+    signUp,
+    resendVerification,
+    requestPasswordReset,
+    sendLink,
+    invite,
+    people,
+    setPersonActive,
+    adminResetPassword,
+    sessions,
+    endSession,
+    resetPassword,
+    startPasskeyRegistration,
+    finishPasskeyRegistration,
+    startEmailChange,
+    completeEmailChange,
+    changePassword,
+    passkeys,
+    deletePasskey,
+    startPasskeySignIn,
+    finishPasskeySignIn,
+    startQrSignIn,
+    pollQrSignIn,
+};

package/dist/util.d.ts

@@ -0,0 +1,13 @@
+/** Helpers shared by the server and browser entry points. No Node-only imports: the browser bundle uses this file too. */
+/** How long an SDK request to the broker or issuer may take before it is abandoned. */
+export declare const FETCH_TIMEOUT_MS = 15000;
+/** `signal` if the caller brought one, otherwise a 15 second timeout. */
+export declare function timeoutSignal(signal?: AbortSignal): AbortSignal;
+/** Bytes as unpadded base64url. */
+export declare function base64url(bytes: ArrayBuffer | Uint8Array): string;
+/** The payload of a JWT, read without verifying it. Only for tokens that were verified, or came straight from the token endpoint. */
+export declare function decodeJwtPayload(jwt: string): Record<string, unknown> | null;
+/** The `exp` claim of an ID token, or null. */
+export declare function expiryOf(idToken: string): number | null;
+/** The `iat` claim of an ID token, or null. */
+export declare function issuedAtOf(idToken: string): number | null;

package/dist/util.js

@@ -0,0 +1,44 @@
+/** Helpers shared by the server and browser entry points. No Node-only imports: the browser bundle uses this file too. */
+/** How long an SDK request to the broker or issuer may take before it is abandoned. */
+export const FETCH_TIMEOUT_MS = 15_000;
+/** `signal` if the caller brought one, otherwise a 15 second timeout. */
+export function timeoutSignal(signal) {
+    return signal ?? AbortSignal.timeout(FETCH_TIMEOUT_MS);
+}
+/** Bytes as unpadded base64url. */
+export function base64url(bytes) {
+    const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    return btoa(String.fromCharCode(...view))
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replace(/=+$/, '');
+}
+/** The payload of a JWT, read without verifying it. Only for tokens that were verified, or came straight from the token endpoint. */
+export function decodeJwtPayload(jwt) {
+    try {
+        const part = jwt.split('.')[1];
+        if (!part)
+            return null;
+        const base64 = part.replace(/-/g, '+').replace(/_/g, '/');
+        const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+        const json = JSON.parse(atob(padded));
+        return json && typeof json === 'object' && !Array.isArray(json)
+            ? json
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The `exp` claim of an ID token, or null. */
+export function expiryOf(idToken) {
+    const exp = decodeJwtPayload(idToken)?.exp;
+    return typeof exp === 'number' ? exp : null;
+}
+// Age, not time left: a disabled or revoked account must not ride out a
+// long-lived token just because it still has plenty of time on the clock.
+/** The `iat` claim of an ID token, or null. */
+export function issuedAtOf(idToken) {
+    const iat = decodeJwtPayload(idToken)?.iat;
+    return typeof iat === 'number' ? iat : null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Sign in against a self-hosted ZITADEL issuer: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",