@wtfalch/auth 0.24.0 → 0.26.0

package/dist/namespace-browser.js

@@ -1,15 +1,10 @@
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 import { resolveNamespaceContext } from './namespaces.js';
 import { safeLoginHint, safeNextPath } from './redirect.js';
+import { base64url } from './util.js';
 const OWNER = 'urn:zitadel:iam:user:resourceowner:id';
 const ttl = 10 * 60_000;
 const random = () => base64url(crypto.getRandomValues(new Uint8Array(32)));
-function base64url(bytes) {
-    return btoa(String.fromCharCode(...bytes))
-        .replaceAll('+', '-')
-        .replaceAll('/', '_')
-        .replace(/=+$/, '');
-}
 function read(storage, key) {
     try {
         return JSON.parse(storage.getItem(key) ?? 'null');

package/dist/namespace-session.d.ts

@@ -11,10 +11,6 @@ export declare const STATUS_STALE_IF_ERROR_MS: number;
 export type SessionRead = {
     kind: 'none';
 }
-/** A cookie for another binding, revision or format. */
- | {
-    kind: 'changed';
-}
 /** The binding is suspended, or its status cannot be confirmed. */
  | {
     kind: 'unavailable';
@@ -36,7 +32,7 @@ export declare function namespaceSessions(deps: {
 }): {
     bindingActive: () => Promise<boolean>;
     create: (tokens: Tokens, requestHeaders?: Headers) => Promise<SetCookie>;
-    end: (value: string | undefined) => Promise<"ended" | "changed" | "none">;
+    end: (value: string | undefined) => Promise<"ended" | "none">;
     read: (value: string | undefined, force?: boolean) => Promise<SessionRead>;
     revokeSubject: (subject: string) => Promise<number>;
     listSessions: (subject: string) => Promise<SessionRecord[]>;

package/dist/namespace-session.js

@@ -2,7 +2,8 @@ import { sleep } from '@wtfalch/utils/datetime';
 import * as client from 'openid-client';
 import { BrokerError } from './broker.js';
 import { contextDigest, digest, openHandle, openRecord, sealHandle, sealRecord, } from './cookies.js';
-import { AuthError, isOAuthRefusal } from './oidc.js';
+import { AuthError, isOAuthRefusal, rejected } from './oidc.js';
+import { expiryOf, issuedAtOf } from './util.js';
 /** How long a binding status answer is trusted. The propagation bound for a suspension. */
 export const STATUS_FRESH_MS = 60_000;
 /** How long the last good answer carries on while the service cannot be asked. */
@@ -158,7 +159,7 @@ export function namespaceSessions(deps) {
             return 'none';
         const key = await keyOf(value);
         if (!key)
-            return 'changed';
+            return 'none';
         const loaded = await load(key);
         await store().revoke(key, now());
         revokeToken(loaded?.tokens.rt);
@@ -423,8 +424,9 @@ export function namespaceSessions(deps) {
         if (!value)
             return { kind: 'none' };
         const key = await keyOf(value);
+        // A handle that does not open (another binding's, an older revision's, or damaged) is nobody: sign in again replaces it.
         if (!key)
-            return { kind: 'changed' };
+            return { kind: 'none' };
         if (!(await bindingActive()))
             return { kind: 'unavailable' };
         let loaded = await load(key);
@@ -443,8 +445,12 @@ export function namespaceSessions(deps) {
         try {
             return { kind: 'user', claims: await deps.oidc().verify(loaded.tokens.idt) };
         }
-        catch {
-            return { kind: 'none' };
+        catch (error) {
+            if (rejected(error))
+                return { kind: 'none' };
+            // The issuer's keys could not be fetched: not a verdict on this session.
+            console.error('@wtfalch/auth: could not verify the session id token', error instanceof Error ? error.name : 'unknown');
+            return { kind: 'unavailable' };
         }
     };
     return {
@@ -483,25 +489,3 @@ function ipFrom(headers) {
         .filter(Boolean);
     return hops.length > 0 ? hops[hops.length - 1] : null;
 }
-function expiryOf(idToken) {
-    try {
-        const [, payload] = idToken.split('.');
-        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-        return typeof json.exp === 'number' ? json.exp : null;
-    }
-    catch {
-        return null;
-    }
-}
-// Age, not time left: a disabled or revoked account must not ride out a
-// long-lived token just because it still has plenty of time on the clock.
-function issuedAtOf(idToken) {
-    try {
-        const [, payload] = idToken.split('.');
-        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-        return typeof json.iat === 'number' ? json.iat : null;
-    }
-    catch {
-        return null;
-    }
-}

package/dist/next.d.ts

@@ -128,7 +128,7 @@ export interface NextAuth {
     /**
      * Registers a passkey on this app's own domain for the person signed in
      * here. Throws `AuthError('unauthenticated', ...)` for nobody, exactly as
-     * `requireUser` throws `account_changed`/`unavailable` for those.
+     * `requireUser` throws `unavailable` for a suspended binding.
      */
     startPasskeyRegistration: () => Promise<PasskeyRegistrationStart>;
     /** The second half of `startPasskeyRegistration`. Same signed-in requirement. */

package/dist/next.js

@@ -31,13 +31,9 @@ export function nextAuth(options) {
             response = NextResponse.redirect(gate.location, 303);
         }
         else if (gate.kind === 'deny') {
-            response = new NextResponse(gate.reason === 'account_changed'
-                ? 'Account changed; choose an account to continue'
-                : gate.reason === 'unavailable'
-                    ? 'Sign-in is unavailable for this workspace'
-                    : 'Unauthorized', {
-                status: gate.reason === 'account_changed' ? 409 : gate.reason === 'unavailable' ? 503 : 401,
-            });
+            response = new NextResponse(gate.reason === 'unavailable'
+                ? 'Sign-in is unavailable for this workspace'
+                : 'Unauthorized', { status: gate.reason === 'unavailable' ? 503 : 401 });
         }
         else if (gate.cookies.length > 0) {
             const headers = new Headers(request.headers);
@@ -60,9 +56,9 @@ export function nextAuth(options) {
     };
     const requireUser = async (next) => {
         const store = await cookies();
-        const { user, accountChanged, unavailable } = await auth.readCookie(store.get(auth.sessionCookieName)?.value, { refresh: false });
-        if (accountChanged)
-            throw new AuthError('account_changed', 'Choose an account to continue');
+        const { user, unavailable } = await auth.readCookie(store.get(auth.sessionCookieName)?.value, {
+            refresh: false,
+        });
         if (unavailable)
             throw new AuthError('unavailable', 'Sign-in is unavailable for this workspace');
         if (!user)
@@ -213,10 +209,16 @@ export function nextAuth(options) {
     };
     const setNewPassword = async (input) => {
         // Named fields: a Server Action's argument is whatever the client sent.
+        // A field that is not text is refused here and never reaches the broker.
+        if (typeof input?.authRequestId !== 'string' || typeof input.changeToken !== 'string') {
+            return { error: 'invalid_token' };
+        }
+        if (typeof input.newPassword !== 'string')
+            return { error: 'invalid_password' };
         const result = await auth.setNewPassword({
-            authRequestId: String(input?.authRequestId),
-            changeToken: String(input?.changeToken),
-            newPassword: String(input?.newPassword),
+            authRequestId: input.authRequestId,
+            changeToken: input.changeToken,
+            newPassword: input.newPassword,
         });
         if (result.ok) {
             if (result.hosted)
@@ -226,7 +228,24 @@ export function nextAuth(options) {
         return { error: result.error };
     };
     const signUp = async (input) => {
-        const result = await auth.signUp(input);
+        // Named fields: a Server Action's argument is whatever the client sent, so
+        // `changeRequired` and `personalEmail`, which only a server may set, are not read.
+        if (typeof input?.authRequestId !== 'string' ||
+            typeof input.email !== 'string' ||
+            typeof input.password !== 'string' ||
+            typeof input.givenName !== 'string' ||
+            typeof input.familyName !== 'string' ||
+            (input.username !== undefined && typeof input.username !== 'string')) {
+            return { error: 'invalid', message: 'Fill in every field.' };
+        }
+        const result = await auth.signUp({
+            authRequestId: input.authRequestId,
+            email: input.email,
+            password: input.password,
+            givenName: input.givenName,
+            familyName: input.familyName,
+            username: input.username,
+        });
         if (result.ok) {
             if (result.hosted)
                 redirect(result.redirectTo);

package/dist/oidc.d.ts

@@ -86,4 +86,6 @@ export declare class AuthError extends Error {
  * is never a statement that the grant is dead, and this issuer's own rate
  * limiting must not permanently revoke a session.
  */
+/** An id token the issuer's keys or claims refuse, as opposed to keys that could not be fetched. */
+export declare function rejected(error: unknown): boolean;
 export declare function isOAuthRefusal(error: unknown): boolean;

package/dist/oidc.js

@@ -107,6 +107,10 @@ export class Oidc {
         return this.tokensFrom(response);
     }
     // Parallel requests holding the same refresh token share one grant; the issuer rotates it, so a second grant would fail.
+    // The rotated result is kept for ROTATION_CACHE_MS and keyed by the OLD refresh token, so a request that lost the race gets the
+    // winner's tokens. The cost: a copy of the old cookie (same refresh token) gets those tokens too in that window. Keying on
+    // the session does not help, since the copy is the same session; the only fix is a shorter window, which would break the race
+    // it exists for. The copy still needs the sealed cookie, so this exposes nothing a live cookie did not already hold.
     refresh(refreshToken) {
         const asked = Date.now();
         for (const [token, entry] of this.rotated)
@@ -221,6 +225,16 @@ export class AuthError extends Error {
  * is never a statement that the grant is dead, and this issuer's own rate
  * limiting must not permanently revoke a session.
  */
+/** An id token the issuer's keys or claims refuse, as opposed to keys that could not be fetched. */
+export function rejected(error) {
+    return (error instanceof AuthError ||
+        error instanceof jose.errors.JWTExpired ||
+        error instanceof jose.errors.JWTClaimValidationFailed ||
+        error instanceof jose.errors.JWSSignatureVerificationFailed ||
+        error instanceof jose.errors.JWSInvalid ||
+        error instanceof jose.errors.JWTInvalid ||
+        error instanceof jose.errors.JOSEAlgNotAllowed);
+}
 export function isOAuthRefusal(error) {
     const status = statusOf(error);
     return status !== undefined && status >= 400 && status < 500 && status !== 429;

package/dist/person-token.d.ts

@@ -1,3 +1,4 @@
+import { type JWTPayload } from 'jose';
 /**
  * Verifies a signed-in person's own `@wtfalch/auth`/ZITADEL access token,
  * server-side, for a service that wants to accept one directly rather than
@@ -58,4 +59,12 @@ export interface PersonTokenConfig {
      *  real cooldown. */
     jwksCooldownMs?: number;
 }
+/** @internal Shared by `createPersonTokenVerifier` and `./mcp`: one discovery
+ *  document and one JWKS cache per core. Not part of the public contract. */
+export interface PersonTokenCore extends PersonTokenVerifier {
+    /** JWT path only, no introspection: the verified claims, or null. */
+    verifyJwtClaims(accessToken: string): Promise<JWTPayload | null>;
+}
+/** @internal */
+export declare function createPersonTokenCore(config: PersonTokenConfig): PersonTokenCore;
 export declare function createPersonTokenVerifier(config: PersonTokenConfig): PersonTokenVerifier;

package/dist/person-token.js

@@ -1,4 +1,5 @@
 import { createRemoteJWKSet, customFetch, jwtVerify } from 'jose';
+import { timeoutSignal } from './util.js';
 /** A JWT is three base64url segments; a ZITADEL opaque token is not shaped
  *  like that at all, so this is enough to route between `jwtVerify` and
  *  introspection without ever trying to parse either kind as the other. */
@@ -23,7 +24,7 @@ function sameOriginEndpoint(value, name, issuerOrigin) {
 async function discoverDocument(issuer, fetchImpl) {
     const discoveryUrl = `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
     const issuerOrigin = new URL(issuer).origin;
-    const response = await fetchImpl(discoveryUrl);
+    const response = await fetchImpl(discoveryUrl, { signal: timeoutSignal() });
     if (!response.ok) {
         throw new Error(`person-token: discovery document request failed with ${response.status}`);
     }
@@ -76,7 +77,8 @@ class PositiveIntrospectionCache {
         this.entries.set(token, { payload, expiresAt });
     }
 }
-export function createPersonTokenVerifier(config) {
+/** @internal */
+export function createPersonTokenCore(config) {
     const fetchImpl = config.fetch ?? fetch;
     let discovery = null;
     let jwks = null;
@@ -108,6 +110,7 @@ export function createPersonTokenVerifier(config) {
                 audience: config.audience,
                 algorithms: ['RS256'],
                 clockTolerance: 60,
+                requiredClaims: ['exp', 'sub'],
             });
             return payload;
         }
@@ -150,6 +153,7 @@ export function createPersonTokenVerifier(config) {
                     authorization: `Basic ${credentials}`,
                 },
                 body: new URLSearchParams({ token: accessToken }).toString(),
+                signal: timeoutSignal(),
             });
         }
         catch {
@@ -179,6 +183,9 @@ export function createPersonTokenVerifier(config) {
         return payload;
     }
     return {
+        async verifyJwtClaims(accessToken) {
+            return JWT_SHAPE.test(accessToken) ? verifyJwt(accessToken) : null;
+        },
         async verify(accessToken) {
             const payload = JWT_SHAPE.test(accessToken)
                 ? await verifyJwt(accessToken)
@@ -189,3 +196,7 @@ export function createPersonTokenVerifier(config) {
         },
     };
 }
+export function createPersonTokenVerifier(config) {
+    const { verify } = createPersonTokenCore(config);
+    return { verify };
+}

package/dist/qr.js

@@ -1,4 +1,5 @@
 import { AuthError } from './oidc.js';
+import { timeoutSignal } from './util.js';
 /**
  * The OAuth device authorization grant (RFC 8628), for signing in a new
  * device from a QR code a phone that is already signed in approves. Raw
@@ -11,6 +12,7 @@ const DEVICE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
 export async function requestDeviceAuthorization(options, scope) {
     const response = await options.fetch(`${options.issuer}/oauth/v2/device_authorization`, {
         method: 'POST',
+        signal: timeoutSignal(),
         headers: { 'content-type': 'application/x-www-form-urlencoded' },
         body: new URLSearchParams({ client_id: options.clientId, scope }),
     });
@@ -36,6 +38,7 @@ export async function requestDeviceAuthorization(options, scope) {
 export async function pollDeviceToken(options, oidc, deviceCode) {
     const response = await options.fetch(`${options.issuer}/oauth/v2/token`, {
         method: 'POST',
+        signal: timeoutSignal(),
         headers: { 'content-type': 'application/x-www-form-urlencoded' },
         body: new URLSearchParams({
             grant_type: DEVICE_GRANT_TYPE,

package/dist/testing.d.ts

@@ -1,9 +1,11 @@
 import type { Auth, User } from './auth.js';
+import type { NextAuth } from './next.js';
 export declare function setSessionUser(user: User | null): void;
 /** A User shaped like the SDK's, for `setSessionUser`. */
 export declare function testUser(id: string, overrides?: Partial<User>): User;
 export declare function getUser(): Promise<User | null>;
 export declare function requireUser(_next?: string): Promise<User>;
+export declare const requireFreshUser: NextAuth['requireFreshUser'];
 export declare const handlers: () => never;
 export declare const proxy: () => never;
 export declare const authRequest: () => never;
@@ -13,6 +15,24 @@ export declare const requestPasswordReset: () => never;
 export declare const resetPassword: () => never;
 export declare const sendLink: () => never;
 export declare const resendVerification: () => never;
+export declare const setNewPassword: () => never;
+export declare const invite: () => never;
+export declare const people: () => never;
+export declare const setPersonActive: () => never;
+export declare const adminResetPassword: () => never;
+export declare const sessions: () => never;
+export declare const endSession: () => never;
+export declare const startPasskeyRegistration: () => never;
+export declare const finishPasskeyRegistration: () => never;
+export declare const startEmailChange: () => never;
+export declare const completeEmailChange: () => never;
+export declare const changePassword: () => never;
+export declare const passkeys: () => never;
+export declare const deletePasskey: () => never;
+export declare const startPasskeySignIn: () => never;
+export declare const finishPasskeySignIn: () => never;
+export declare const startQrSignIn: () => never;
+export declare const pollQrSignIn: () => never;
 /**
  * The core SDK instance, as far as a device sign-in module reaches into it.
  *
@@ -29,3 +49,9 @@ export declare const sentLinks: {
 export declare function setFollowLinkResult(result: unknown): void;
 export declare function setCookieUser(user: User | null): void;
 export declare const auth: Auth;
+/**
+ * Every member of `NextAuth`, so the compiler fails here when the real
+ * surface gains one this stub lacks. `export const { getUser } = nextAuthStub`
+ * is the same as importing the named exports above.
+ */
+export declare const nextAuthStub: NextAuth;

package/dist/testing.js

@@ -39,6 +39,7 @@ export async function requireUser(_next) {
         throw new Error('requireUser: no session set; call setSessionUser first');
     return current;
 }
+export const requireFreshUser = async () => requireUser();
 function unavailable(name) {
     return () => {
         throw new Error(`${name} is not available in the integration tier`);
@@ -53,6 +54,24 @@ export const requestPasswordReset = unavailable('requestPasswordReset');
 export const resetPassword = unavailable('resetPassword');
 export const sendLink = unavailable('sendLink');
 export const resendVerification = unavailable('resendVerification');
+export const setNewPassword = unavailable('setNewPassword');
+export const invite = unavailable('invite');
+export const people = unavailable('people');
+export const setPersonActive = unavailable('setPersonActive');
+export const adminResetPassword = unavailable('adminResetPassword');
+export const sessions = unavailable('sessions');
+export const endSession = unavailable('endSession');
+export const startPasskeyRegistration = unavailable('startPasskeyRegistration');
+export const finishPasskeyRegistration = unavailable('finishPasskeyRegistration');
+export const startEmailChange = unavailable('startEmailChange');
+export const completeEmailChange = unavailable('completeEmailChange');
+export const changePassword = unavailable('changePassword');
+export const passkeys = unavailable('passkeys');
+export const deletePasskey = unavailable('deletePasskey');
+export const startPasskeySignIn = unavailable('startPasskeySignIn');
+export const finishPasskeySignIn = unavailable('finishPasskeySignIn');
+export const startQrSignIn = unavailable('startQrSignIn');
+export const pollQrSignIn = unavailable('pollQrSignIn');
 /**
  * The core SDK instance, as far as a device sign-in module reaches into it.
  *
@@ -79,3 +98,41 @@ export const auth = {
     followLink: async () => linkResult,
     readCookie: async () => ({ user: cookieUser, cookies: [] }),
 };
+/**
+ * Every member of `NextAuth`, so the compiler fails here when the real
+ * surface gains one this stub lacks. `export const { getUser } = nextAuthStub`
+ * is the same as importing the named exports above.
+ */
+export const nextAuthStub = {
+    auth,
+    handlers: handlers,
+    proxy,
+    getUser,
+    requireUser,
+    requireFreshUser,
+    authRequest,
+    signIn,
+    setNewPassword,
+    signUp,
+    resendVerification,
+    requestPasswordReset,
+    sendLink,
+    invite,
+    people,
+    setPersonActive,
+    adminResetPassword,
+    sessions,
+    endSession,
+    resetPassword,
+    startPasskeyRegistration,
+    finishPasskeyRegistration,
+    startEmailChange,
+    completeEmailChange,
+    changePassword,
+    passkeys,
+    deletePasskey,
+    startPasskeySignIn,
+    finishPasskeySignIn,
+    startQrSignIn,
+    pollQrSignIn,
+};

package/dist/util.d.ts

@@ -0,0 +1,13 @@
+/** Helpers shared by the server and browser entry points. No Node-only imports: the browser bundle uses this file too. */
+/** How long an SDK request to the broker or issuer may take before it is abandoned. */
+export declare const FETCH_TIMEOUT_MS = 15000;
+/** `signal` if the caller brought one, otherwise a 15 second timeout. */
+export declare function timeoutSignal(signal?: AbortSignal): AbortSignal;
+/** Bytes as unpadded base64url. */
+export declare function base64url(bytes: ArrayBuffer | Uint8Array): string;
+/** The payload of a JWT, read without verifying it. Only for tokens that were verified, or came straight from the token endpoint. */
+export declare function decodeJwtPayload(jwt: string): Record<string, unknown> | null;
+/** The `exp` claim of an ID token, or null. */
+export declare function expiryOf(idToken: string): number | null;
+/** The `iat` claim of an ID token, or null. */
+export declare function issuedAtOf(idToken: string): number | null;

package/dist/util.js

@@ -0,0 +1,44 @@
+/** Helpers shared by the server and browser entry points. No Node-only imports: the browser bundle uses this file too. */
+/** How long an SDK request to the broker or issuer may take before it is abandoned. */
+export const FETCH_TIMEOUT_MS = 15_000;
+/** `signal` if the caller brought one, otherwise a 15 second timeout. */
+export function timeoutSignal(signal) {
+    return signal ?? AbortSignal.timeout(FETCH_TIMEOUT_MS);
+}
+/** Bytes as unpadded base64url. */
+export function base64url(bytes) {
+    const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    return btoa(String.fromCharCode(...view))
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replace(/=+$/, '');
+}
+/** The payload of a JWT, read without verifying it. Only for tokens that were verified, or came straight from the token endpoint. */
+export function decodeJwtPayload(jwt) {
+    try {
+        const part = jwt.split('.')[1];
+        if (!part)
+            return null;
+        const base64 = part.replace(/-/g, '+').replace(/_/g, '/');
+        const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+        const json = JSON.parse(atob(padded));
+        return json && typeof json === 'object' && !Array.isArray(json)
+            ? json
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The `exp` claim of an ID token, or null. */
+export function expiryOf(idToken) {
+    const exp = decodeJwtPayload(idToken)?.exp;
+    return typeof exp === 'number' ? exp : null;
+}
+// Age, not time left: a disabled or revoked account must not ride out a
+// long-lived token just because it still has plenty of time on the clock.
+/** The `iat` claim of an ID token, or null. */
+export function issuedAtOf(idToken) {
+    const iat = decodeJwtPayload(idToken)?.iat;
+    return typeof iat === 'number' ? iat : null;
+}

package/dist/worker-session.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The same OIDC sign-in the Next apps use, for a Cloudflare Worker: Request in,
+ * Response out, no `next`, no `node:`. It is `createAuth` with the app's origin
+ * taken from each request, so the session cookie (id token + refresh token,
+ * never an access token), the PKCE and state transaction, the organisation
+ * check and the refresh rules are the Next path's own code, not a copy.
+ */
+export interface WorkerSessionOptions {
+    /** The org's login host, e.g. `https://login.candorfx.com`. */
+    issuer: string;
+    /** The entry's client id. */
+    clientId: string;
+    /** The org's ZITADEL organisation id. A person from any other organisation is refused. */
+    orgId: string;
+    /** Where the issuer sends the browser back, e.g. `/auth/callback`. Must end in `/callback` and have a prefix; the app routes it to `callback`. */
+    redirectPath: string;
+    /** 32 bytes, base64 or hex. Never logged. */
+    cookieSecret: string;
+    /** Test seam. */
+    fetch?: typeof fetch;
+}
+export interface WorkerSignedIn {
+    userId: string;
+    orgId: string;
+    /**
+     * `Set-Cookie` header values to add to the app's response. Empty unless the
+     * session was refreshed on this request. The refresh token is single use:
+     * an app that drops these signs the person out at the next refresh.
+     */
+    setCookies: string[];
+}
+export interface WorkerSession {
+    /** Redirects to the issuer. `register` opens registration, `returnTo` is a path on this app. */
+    signIn(req: Request, o?: {
+        register?: boolean;
+        returnTo?: string;
+    }): Promise<Response>;
+    /** Route `redirectPath` here. Always a redirect: to `returnTo` on success, to `/?auth_error=<reason>` otherwise. */
+    callback(req: Request): Promise<Response>;
+    currentUser(req: Request): Promise<WorkerSignedIn | null>;
+    /** POST from the app's own origin only. */
+    signOut(req: Request): Promise<Response>;
+}
+export declare function createWorkerSession(opts: WorkerSessionOptions): WorkerSession;

package/dist/worker-session.js

@@ -0,0 +1,106 @@
+import { createAuth } from './auth.js';
+import { resolveOptions } from './config.js';
+import { FETCH_TIMEOUT_MS } from './util.js';
+const CALLBACK = /^(\/[A-Za-z0-9._~-]+)+\/callback$/;
+/** The fetch the SDK is given: every outside call (discovery, token, JWKS, revoke) is abandoned after FETCH_TIMEOUT_MS unless the caller set its own signal. */
+function withTimeout(fetchImpl) {
+    return (input, init) => fetchImpl(input, { ...init, signal: init?.signal ?? AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+}
+export function createWorkerSession(opts) {
+    for (const name of ['issuer', 'clientId', 'orgId', 'redirectPath', 'cookieSecret']) {
+        if (typeof opts[name] !== 'string' || !opts[name]) {
+            throw new Error(`@wtfalch/auth: ${name} is required`);
+        }
+    }
+    if (!CALLBACK.test(opts.redirectPath)) {
+        throw new Error('@wtfalch/auth: redirectPath must be a path ending in /callback, like /auth/callback');
+    }
+    let issuerUrl;
+    try {
+        issuerUrl = new URL(opts.issuer);
+    }
+    catch {
+        throw new Error('@wtfalch/auth: issuer must be an absolute URL');
+    }
+    if (issuerUrl.protocol !== 'https:' && issuerUrl.hostname !== 'localhost') {
+        throw new Error('@wtfalch/auth: issuer must be https');
+    }
+    const basePath = opts.redirectPath.slice(0, -'/callback'.length);
+    const fetchImpl = withTimeout(opts.fetch ?? globalThis.fetch);
+    const config = (appUrl) => ({
+        appUrl,
+        clientId: opts.clientId,
+        organizationId: opts.orgId,
+        issuer: opts.issuer,
+        cookieSecret: opts.cookieSecret,
+        basePath,
+        fetch: fetchImpl,
+    });
+    // A bad secret or client is a startup error, not the first visitor's.
+    resolveOptions(config('https://placeholder.invalid'));
+    // One Auth per origin, so the discovery document, JWKS and refresh dedupe are shared across requests in an isolate.
+    const byOrigin = new Map();
+    const authFor = (req) => {
+        const origin = new URL(req.url).origin;
+        let auth = byOrigin.get(origin);
+        if (!auth) {
+            auth = createAuth(config(origin));
+            byOrigin.set(origin, auth);
+        }
+        return auth;
+    };
+    // An outside failure is logged by its class only: messages can carry URLs and token fragments.
+    const unavailable = (what, error) => {
+        console.error(`@wtfalch/auth: worker session ${what} failed`, error instanceof Error ? error.name : 'unknown');
+        return new Response('Sign-in is unavailable', { status: 503 });
+    };
+    return {
+        async signIn(req, o = {}) {
+            const url = new URL(`${basePath}/start`, req.url);
+            if (o.register)
+                url.searchParams.set('intent', 'register');
+            if (o.returnTo !== undefined)
+                url.searchParams.set('next', o.returnTo);
+            try {
+                return await authFor(req).start(new Request(url, { headers: req.headers }));
+            }
+            catch (error) {
+                return unavailable('start', error);
+            }
+        },
+        async callback(req) {
+            try {
+                return await authFor(req).callback(req);
+            }
+            catch (error) {
+                return unavailable('callback', error);
+            }
+        },
+        async currentUser(req) {
+            try {
+                const { user, cookies } = await authFor(req).read(req);
+                if (!user)
+                    return null;
+                return {
+                    userId: user.id,
+                    orgId: user.organizationId,
+                    setCookies: cookies.map((c) => c.header),
+                };
+            }
+            catch (error) {
+                unavailable('session read', error);
+                return null;
+            }
+        },
+        async signOut(req) {
+            if (req.method !== 'POST')
+                return new Response('Method not allowed', { status: 405 });
+            try {
+                return await authFor(req).logout(req);
+            }
+            catch (error) {
+                return unavailable('sign-out', error);
+            }
+        },
+    };
+}