@wtfalch/auth 0.5.0 → 0.7.0

package/dist/namespaces.d.ts

@@ -0,0 +1,153 @@
+/** Versioned server-owned configuration. URL/email input is a lookup key, never
+ * authority. Workspace membership and session/transaction binding remain the
+ * responsibility of the consumer; this module does not establish a session. */
+export type NamespaceStatus = 'pending' | 'active' | 'suspended' | 'failed';
+export interface NamespaceDomain {
+    domain: string;
+    purpose: 'account' | 'login';
+    status: 'pending' | 'active';
+    /** Operator-owned evidence reference; this is not an automated DNS verifier. */
+    verificationRef?: string;
+}
+/** A browser service: the SDK's server or browser client at one origin. `kind` is omitted. */
+export interface NamespaceService {
+    kind?: 'web';
+    id: string;
+    serviceId: string;
+    deploymentId: string;
+    appOrigin: string;
+    redirectUris: string[];
+    postLogoutRedirectUris: string[];
+    credentialRef: string;
+    registration: boolean;
+}
+/**
+ * Installed software a person signs in to by approving on another device: a
+ * public device-code client with no secret and no redirect URIs.
+ */
+export interface NamespaceNativeService {
+    kind: 'native';
+    id: string;
+    serviceId: string;
+    deploymentId: string;
+}
+/**
+ * A resource server that checks the namespace's tokens at the introspection
+ * endpoint. Its client secret is stored under `credentialRef`, never here.
+ */
+export interface NamespaceApiService {
+    kind: 'api';
+    id: string;
+    serviceId: string;
+    deploymentId: string;
+    credentialRef: string;
+}
+/** Every client of one namespace shares its accounts: one sign-in across all of them. */
+export type NamespaceBinding = NamespaceService | NamespaceNativeService | NamespaceApiService;
+export declare function isWebService<T extends NamespaceBinding>(binding: T): binding is Extract<T, NamespaceService>;
+export interface NamespaceSpec {
+    id: string;
+    displayName: string;
+    revision: number;
+    status: Exclude<NamespaceStatus, 'failed'>;
+    /**
+     * `invitation`: nobody signs themselves up. People arrive by invitation,
+     * whether from the organization's admin or when a mailbox is created on
+     * one of its `account` domains. Omitted means open, which is how every
+     * namespace behaved before.
+     */
+    admission?: 'invitation';
+    loginOrigin: string;
+    domains: NamespaceDomain[];
+    mail: {
+        from: string;
+        productName: string;
+        locale: string;
+    };
+    services: NamespaceBinding[];
+}
+export interface NamespaceManifest {
+    version: 1;
+    issuer: string;
+    namespaces: NamespaceSpec[];
+}
+export interface NamespaceRecord extends Omit<NamespaceSpec, 'status' | 'services'> {
+    status: NamespaceStatus;
+    organizationId: string;
+    projectId: string;
+    services: (NamespaceBinding & {
+        appId: string;
+        clientId: string;
+    })[];
+}
+export interface NamespaceRegistry {
+    version: 1;
+    issuer: string;
+    namespaces: NamespaceRecord[];
+}
+export interface WorkspaceBinding {
+    serviceId: string;
+    workspaceId: string;
+    namespaceId: string;
+}
+export declare function parseNamespaceManifest(raw: unknown): NamespaceManifest;
+export declare function parseNamespaceRegistry(raw: unknown): NamespaceRegistry;
+/** Exact server-side configuration lookup. It grants no workspace membership. */
+export declare function resolveNamespaceBinding(registry: NamespaceRegistry, input: {
+    namespaceId: string;
+    serviceId: string;
+    deploymentId: string;
+    appOrigin: string;
+}): {
+    kind?: "web";
+    id: string;
+    serviceId: string;
+    deploymentId: string;
+    appOrigin: string;
+    redirectUris: string[];
+    postLogoutRedirectUris: string[];
+    credentialRef: string;
+    registration: boolean;
+    appId: string;
+    clientId: string;
+    issuer: string;
+    namespaceId: string;
+    organizationId: string;
+    revision: number;
+    loginOrigin: string;
+};
+/** Apps store these mappings themselves; email addresses are deliberately absent. */
+export declare function parseWorkspaceBindings(raw: unknown, registry: NamespaceRegistry): WorkspaceBinding[];
+/** Trusted server configuration, or its public projection for a browser client. */
+export interface NamespaceSelection {
+    registry: NamespaceRegistry;
+    namespaceId: string;
+    serviceId: string;
+    deploymentId: string;
+}
+/** A deterministic binding used inside protected cookies and browser transactions. */
+export declare function resolveNamespaceContext(selection: NamespaceSelection, options: {
+    issuer: string;
+    clientId: string;
+    appOrigin: string;
+    redirectUri: string;
+    organizationId?: string;
+}): {
+    context: string;
+    kind?: "web";
+    id: string;
+    serviceId: string;
+    deploymentId: string;
+    appOrigin: string;
+    redirectUris: string[];
+    postLogoutRedirectUris: string[];
+    credentialRef: string;
+    registration: boolean;
+    appId: string;
+    clientId: string;
+    issuer: string;
+    namespaceId: string;
+    organizationId: string;
+    revision: number;
+    loginOrigin: string;
+};

package/dist/namespaces.js

@@ -0,0 +1,280 @@
+export function isWebService(binding) {
+    return binding.kind === undefined || binding.kind === 'web';
+}
+function invalid(field) {
+    throw new Error(`Invalid namespace configuration: ${field}`);
+}
+function object(value, field) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        invalid(field);
+    return value;
+}
+function string(value, field) {
+    if (typeof value !== 'string' ||
+        !value ||
+        value.trim() !== value ||
+        value.length > 250 ||
+        [...value].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
+        invalid(field);
+    return value;
+}
+function id(value, field) {
+    const result = string(value, field);
+    if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(result) ||
+        ['constructor', 'prototype', '__proto__'].includes(result))
+        invalid(field);
+    return result;
+}
+function array(value, field) {
+    if (!Array.isArray(value) || value.length > 1000)
+        invalid(field);
+    return value;
+}
+function oneOf(value, choices, field) {
+    if (!choices.includes(value))
+        invalid(field);
+    return value;
+}
+function url(value, field, originOnly, allowLocal = false) {
+    const raw = string(value, field);
+    let result;
+    try {
+        result = new URL(raw);
+    }
+    catch {
+        return invalid(field);
+    }
+    const local = ['localhost', '127.0.0.1', '[::1]'].includes(result.hostname) ||
+        result.hostname.endsWith('.localhost');
+    if ((result.protocol !== 'https:' && !(allowLocal && local && result.protocol === 'http:')) ||
+        result.username ||
+        result.password ||
+        result.hash ||
+        result.hostname.endsWith('.'))
+        invalid(field);
+    if (originOnly && (result.pathname !== '/' || result.search))
+        invalid(field);
+    return originOnly ? result.origin : result.href;
+}
+function unique(values, field) {
+    if (new Set(values).size !== values.length)
+        invalid(`duplicate ${field}`);
+}
+function uris(value, origin, field) {
+    const result = array(value, field).map((v) => url(v, field, false, true));
+    if (!result.length || result.some((v) => new URL(v).origin !== origin || v.includes('*')))
+        invalid(field);
+    unique(result, field);
+    return result;
+}
+function domain(value) {
+    const d = object(value, 'domain');
+    const name = string(d.domain, 'domain').toLowerCase();
+    if (name.length > 253 ||
+        !name.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)))
+        invalid('domain');
+    const purpose = oneOf(d.purpose, ['account', 'login'], 'domain purpose');
+    const status = oneOf(d.status, ['pending', 'active'], 'domain status');
+    const verificationRef = d.verificationRef === undefined ? undefined : string(d.verificationRef, 'verificationRef');
+    if (status === 'active' && !verificationRef)
+        invalid('active domain needs verificationRef');
+    return { domain: name, purpose, status, ...(verificationRef ? { verificationRef } : {}) };
+}
+function credential(value) {
+    const credentialRef = string(value, 'credentialRef');
+    if (!/^[A-Z][A-Z0-9_]{2,100}$/.test(credentialRef) || credentialRef.endsWith('_PAT'))
+        invalid('credentialRef');
+    return credentialRef;
+}
+const WEB_FIELDS = ['appOrigin', 'redirectUris', 'postLogoutRedirectUris', 'registration'];
+function service(value) {
+    const s = object(value, 'service');
+    const kind = s.kind === undefined ? 'web' : oneOf(s.kind, ['web', 'native', 'api'], 'kind');
+    const identity = {
+        id: id(s.id, 'binding id'),
+        serviceId: id(s.serviceId, 'serviceId'),
+        deploymentId: id(s.deploymentId, 'deploymentId'),
+    };
+    if (kind !== 'web') {
+        // Nothing is redirected to installed software or a resource server; a
+        // stray browser field is a mistaken kind, not something to ignore.
+        if (WEB_FIELDS.some((field) => s[field] !== undefined))
+            invalid(`${kind} service web fields`);
+        if (kind === 'native') {
+            if (s.credentialRef !== undefined)
+                invalid('native service credentialRef');
+            return { kind, ...identity };
+        }
+        return { kind, ...identity, credentialRef: credential(s.credentialRef) };
+    }
+    const appOrigin = url(s.appOrigin, 'appOrigin', true, true);
+    const credentialRef = credential(s.credentialRef);
+    if (s.registration !== undefined && typeof s.registration !== 'boolean')
+        invalid('registration');
+    return {
+        ...identity,
+        appOrigin,
+        redirectUris: uris(s.redirectUris, appOrigin, 'redirectUris'),
+        postLogoutRedirectUris: uris(s.postLogoutRedirectUris, appOrigin, 'postLogoutRedirectUris'),
+        credentialRef,
+        registration: s.registration === true,
+    };
+}
+function parse(raw, resolved) {
+    const input = object(raw, 'document');
+    if (input.version !== 1)
+        invalid('version');
+    const issuer = url(input.issuer, 'issuer', true);
+    const namespaces = array(input.namespaces, 'namespaces').map((value) => {
+        const n = object(value, 'namespace');
+        const mail = object(n.mail, 'mail');
+        if (!Number.isSafeInteger(n.revision) || n.revision < 1)
+            invalid('revision');
+        const loginOrigin = url(n.loginOrigin, 'loginOrigin', true);
+        const domains = array(n.domains, 'domains').map(domain);
+        unique(domains.map((d) => `${d.purpose}:${d.domain}`), 'domain purpose');
+        const status = oneOf(n.status, resolved
+            ? ['pending', 'active', 'suspended', 'failed']
+            : ['pending', 'active', 'suspended'], 'status');
+        const loginDomain = domains.find((d) => d.purpose === 'login' && d.domain === new URL(loginOrigin).hostname);
+        if (loginOrigin !== issuer && !loginDomain)
+            invalid('custom login origin needs a domain binding');
+        if (status === 'active' &&
+            (domains.some((d) => d.status !== 'active') ||
+                (loginOrigin !== issuer && loginDomain?.status !== 'active')))
+            invalid('active namespace has unverified domains');
+        const services = array(n.services, 'services').map((value) => {
+            const spec = service(value);
+            if (!resolved)
+                return spec;
+            const r = object(value, 'resolved service');
+            return { ...spec, appId: string(r.appId, 'appId'), clientId: string(r.clientId, 'clientId') };
+        });
+        if (!services.length)
+            invalid('namespace needs a service');
+        unique(services.map((s) => `${s.serviceId}:${s.deploymentId}`), 'namespace service/deployment');
+        const admission = oneOf(n.admission ?? 'open', ['open', 'invitation'], 'admission');
+        if (admission === 'invitation') {
+            // The organization's addresses are what an invitation-only namespace
+            // is for: mail provisioning invites from them.
+            if (!domains.some((d) => d.purpose === 'account'))
+                invalid('invitation namespace needs an account domain');
+            if (services.some((s) => isWebService(s) && s.registration))
+                invalid('invitation namespace cannot open registration');
+        }
+        const common = {
+            id: id(n.id, 'namespace id'),
+            displayName: string(n.displayName, 'displayName'),
+            revision: n.revision,
+            status,
+            ...(admission === 'invitation' ? { admission } : {}),
+            loginOrigin,
+            domains,
+            services,
+            mail: {
+                from: string(mail.from, 'mail.from'),
+                productName: string(mail.productName, 'mail.productName'),
+                locale: string(mail.locale, 'mail.locale'),
+            },
+        };
+        return resolved
+            ? {
+                ...common,
+                organizationId: string(n.organizationId, 'organizationId'),
+                projectId: string(n.projectId, 'projectId'),
+            }
+            : common;
+    });
+    unique(namespaces.map((n) => n.id), 'namespace id');
+    unique(namespaces.flatMap((n) => n.services.map((s) => s.id)), 'binding id');
+    unique(namespaces.flatMap((n) => n.services.flatMap((s) => ('credentialRef' in s ? [s.credentialRef] : []))), 'credential reference');
+    const domains = new Map();
+    for (const n of namespaces)
+        for (const d of n.domains) {
+            const owner = domains.get(d.domain);
+            // Pending and suspended claims also reserve ownership until an explicit
+            // migration releases them. A registry edit cannot silently reassign a domain.
+            if (owner && owner !== n.id)
+                invalid('domain belongs to multiple namespaces');
+            domains.set(d.domain, n.id);
+        }
+    if (resolved) {
+        const records = namespaces;
+        unique(records.map((n) => n.organizationId), 'organizationId');
+        unique(records.flatMap((n) => n.services.map((s) => s.clientId)), 'clientId');
+    }
+    return { version: 1, issuer, namespaces };
+}
+export function parseNamespaceManifest(raw) {
+    return parse(raw, false);
+}
+export function parseNamespaceRegistry(raw) {
+    return parse(raw, true);
+}
+/** Exact server-side configuration lookup. It grants no workspace membership. */
+export function resolveNamespaceBinding(registry, input) {
+    const validated = parseNamespaceRegistry(registry);
+    const namespace = validated.namespaces.find((n) => n.id === input.namespaceId);
+    if (!namespace || namespace.status !== 'active')
+        invalid('namespace unavailable');
+    const binding = namespace.services
+        .filter(isWebService)
+        .find((s) => s.serviceId === input.serviceId && s.deploymentId === input.deploymentId);
+    if (!binding || binding.appOrigin !== url(input.appOrigin, 'appOrigin', true, true))
+        invalid('service binding mismatch');
+    return {
+        issuer: validated.issuer,
+        namespaceId: namespace.id,
+        organizationId: namespace.organizationId,
+        revision: namespace.revision,
+        loginOrigin: namespace.loginOrigin,
+        ...binding,
+    };
+}
+/** Apps store these mappings themselves; email addresses are deliberately absent. */
+export function parseWorkspaceBindings(raw, registry) {
+    const validated = parseNamespaceRegistry(registry);
+    const result = array(raw, 'workspace bindings').map((value) => {
+        const w = object(value, 'workspace binding');
+        const binding = {
+            serviceId: id(w.serviceId, 'serviceId'),
+            workspaceId: id(w.workspaceId, 'workspaceId'),
+            namespaceId: id(w.namespaceId, 'namespaceId'),
+        };
+        const namespace = validated.namespaces.find((n) => n.id === binding.namespaceId);
+        if (!namespace?.services.some((s) => isWebService(s) && s.serviceId === binding.serviceId))
+            invalid('workspace service/namespace mismatch');
+        return binding;
+    });
+    unique(result.map((w) => `${w.serviceId}:${w.workspaceId}`), 'workspace binding');
+    return result;
+}
+/** A deterministic binding used inside protected cookies and browser transactions. */
+export function resolveNamespaceContext(selection, options) {
+    const binding = resolveNamespaceBinding(selection.registry, {
+        ...selection,
+        appOrigin: options.appOrigin,
+    });
+    if (binding.issuer !== options.issuer ||
+        binding.clientId !== options.clientId ||
+        (options.organizationId !== undefined && binding.organizationId !== options.organizationId) ||
+        !binding.redirectUris.includes(options.redirectUri))
+        invalid('authentication options disagree with binding');
+    return {
+        ...binding,
+        context: JSON.stringify([
+            1,
+            binding.namespaceId,
+            binding.id,
+            binding.serviceId,
+            binding.deploymentId,
+            binding.revision,
+            binding.issuer,
+            binding.organizationId,
+            binding.clientId,
+            binding.appOrigin,
+            options.redirectUri,
+            binding.loginOrigin,
+        ]),
+    };
+}

package/dist/next.js

@@ -4,6 +4,7 @@ import { NextResponse } from 'next/server';
 import { createAuth, } from './auth.js';
 import { BrokerError } from './broker.js';
 import { withCookies } from './cookies.js';
+import { AuthError } from './oidc.js';
 /**
  * Which of the two failures it was, in the vocabulary `auth_error` already
  * uses. A refusal under 500 is about this request — the broker says unknown,
@@ -24,7 +25,13 @@ export function nextAuth(options) {
             response = NextResponse.redirect(gate.location, 303);
         }
         else if (gate.kind === 'deny') {
-            response = new NextResponse('Unauthorized', { status: 401 });
+            response = new NextResponse(gate.reason === 'account_changed'
+                ? 'Account changed; choose an account to continue'
+                : gate.reason === 'unavailable'
+                    ? 'Sign-in is unavailable for this workspace'
+                    : 'Unauthorized', {
+                status: gate.reason === 'account_changed' ? 409 : gate.reason === 'unavailable' ? 503 : 401,
+            });
         }
         else if (gate.cookies.length > 0) {
             const headers = new Headers(request.headers);
@@ -46,7 +53,12 @@ export function nextAuth(options) {
         return user;
     };
     const requireUser = async (next) => {
-        const user = await getUser();
+        const store = await cookies();
+        const { user, accountChanged, unavailable } = await auth.readCookie(store.get(auth.sessionCookieName)?.value, { refresh: false });
+        if (accountChanged)
+            throw new AuthError('account_changed', 'Choose an account to continue');
+        if (unavailable)
+            throw new AuthError('unavailable', 'Sign-in is unavailable for this workspace');
         if (!user)
             redirect(auth.startUrl(next));
         return user;

package/dist/oidc.d.ts

@@ -28,7 +28,7 @@ export declare class Oidc {
     verify(idToken: string): Promise<jose.JWTPayload>;
     private assertOrganization;
 }
-export type AuthErrorReason = 'expired' | 'state' | 'denied' | 'exchange' | 'organization' | 'cookie' | 'request';
+export type AuthErrorReason = 'expired' | 'state' | 'denied' | 'exchange' | 'organization' | 'cookie' | 'request' | 'account_changed' | 'unavailable';
 export declare class AuthError extends Error {
     readonly reason: AuthErrorReason;
     constructor(reason: AuthErrorReason, message: string);

package/dist/sessions.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Server-side records behind namespace sessions.
+ *
+ * The browser holds a sealed handle that never changes after sign-in; the
+ * tokens live here. That is what makes three things possible that a sealed
+ * token cookie cannot do: a logout that also kills copies of the cookie, a
+ * refresh that no late response can undo by setting an older cookie, and two
+ * replicas refreshing the same session without logging the person out.
+ *
+ * The store is the app's. It sees a digest of the handle, never the handle,
+ * and tokens sealed with the app's cookie secret, never the tokens.
+ */
+export interface SessionRecord {
+    /** SHA-256 of the handle, base64url. */
+    key: string;
+    /** Digest of the namespace binding and revision the session was made under. */
+    context: string;
+    /** The issuer's user id. */
+    subject: string;
+    /** Bumped by every write. `advance` only succeeds from the current value. */
+    generation: number;
+    /**
+     * Unix seconds until which one request holds the right to refresh, or null.
+     * The issuer rotates refresh tokens, so two replicas refreshing at once
+     * would spend the same token and one would be refused. The lease is how
+     * exactly one of them asks.
+     */
+    leaseUntil: number | null;
+    /** The tokens, sealed by the SDK. Opaque here. */
+    payload: string;
+    /** Unix seconds. Slides forward on every refresh. */
+    expiresAt: number;
+    /** Unix seconds, or null while the session is live. */
+    revokedAt: number | null;
+}
+export type SessionUpdate = Pick<SessionRecord, 'payload' | 'expiresAt' | 'leaseUntil'>;
+export interface SessionStore {
+    create(record: SessionRecord): Promise<void>;
+    get(key: string): Promise<SessionRecord | null>;
+    /**
+     * Replace the payload, expiry and lease, and bump the generation, only if the
+     * record is still at `generation` and not revoked. Resolves whether it did.
+     */
+    advance(key: string, generation: number, next: SessionUpdate): Promise<boolean>;
+    revoke(key: string, at: number): Promise<void>;
+    /** Revoke every live record for this subject under this binding context. Resolves how many. */
+    revokeSubject(context: string, subject: string, at: number): Promise<number>;
+}
+/**
+ * One process only. For tests and a single-instance development server: two
+ * replicas with separate memory stores do not share revocations.
+ */
+export declare function createMemorySessionStore(): SessionStore;
+/** The table `createPostgresSessionStore` expects. Run it in the app's own migrations. */
+export declare const POSTGRES_SESSION_TABLE = "create table if not exists wtfalch_auth_sessions (\n  key text primary key,\n  context text not null,\n  subject text not null,\n  generation integer not null,\n  payload text not null,\n  expires_at bigint not null,\n  lease_until bigint,\n  revoked_at bigint\n);\ncreate index if not exists wtfalch_auth_sessions_subject on wtfalch_auth_sessions (context, subject);\ncreate index if not exists wtfalch_auth_sessions_expiry on wtfalch_auth_sessions (expires_at);";
+type Row = Record<string, unknown>;
+/**
+ * Postgres through whatever driver the app already has. `query` runs one
+ * parameterised statement and resolves its rows:
+ *
+ * - node-postgres: `(text, values) => pool.query(text, values).then((r) => r.rows)`
+ * - postgres.js: `(text, values) => sql.unsafe(text, values)`
+ *
+ * Expired rows are removed a few at a time on each sign-in.
+ */
+export declare function createPostgresSessionStore(input: {
+    query: (text: string, values: unknown[]) => Promise<Row[]>;
+}): SessionStore;
+export {};

package/dist/sessions.js

@@ -0,0 +1,119 @@
+/**
+ * One process only. For tests and a single-instance development server: two
+ * replicas with separate memory stores do not share revocations.
+ */
+export function createMemorySessionStore() {
+    const records = new Map();
+    const sweep = (now) => {
+        for (const [key, record] of records)
+            if (record.expiresAt <= now)
+                records.delete(key);
+    };
+    return {
+        async create(record) {
+            sweep(Math.floor(Date.now() / 1000));
+            if (records.has(record.key))
+                throw new Error('session record already exists');
+            records.set(record.key, { ...record });
+        },
+        async get(key) {
+            const record = records.get(key);
+            return record ? { ...record } : null;
+        },
+        async advance(key, generation, next) {
+            const record = records.get(key);
+            if (!record || record.revokedAt !== null || record.generation !== generation)
+                return false;
+            records.set(key, { ...record, ...next, generation: generation + 1 });
+            return true;
+        },
+        async revoke(key, at) {
+            const record = records.get(key);
+            if (record && record.revokedAt === null)
+                record.revokedAt = at;
+        },
+        async revokeSubject(context, subject, at) {
+            let count = 0;
+            for (const record of records.values())
+                if (record.context === context && record.subject === subject && record.revokedAt === null) {
+                    record.revokedAt = at;
+                    count++;
+                }
+            return count;
+        },
+    };
+}
+/** The table `createPostgresSessionStore` expects. Run it in the app's own migrations. */
+export const POSTGRES_SESSION_TABLE = `create table if not exists wtfalch_auth_sessions (
+  key text primary key,
+  context text not null,
+  subject text not null,
+  generation integer not null,
+  payload text not null,
+  expires_at bigint not null,
+  lease_until bigint,
+  revoked_at bigint
+);
+create index if not exists wtfalch_auth_sessions_subject on wtfalch_auth_sessions (context, subject);
+create index if not exists wtfalch_auth_sessions_expiry on wtfalch_auth_sessions (expires_at);`;
+const nullable = (value) => value === null || value === undefined ? null : Number(value);
+/**
+ * Postgres through whatever driver the app already has. `query` runs one
+ * parameterised statement and resolves its rows:
+ *
+ * - node-postgres: `(text, values) => pool.query(text, values).then((r) => r.rows)`
+ * - postgres.js: `(text, values) => sql.unsafe(text, values)`
+ *
+ * Expired rows are removed a few at a time on each sign-in.
+ */
+export function createPostgresSessionStore(input) {
+    const { query } = input;
+    const record = (row) => ({
+        key: String(row.key),
+        context: String(row.context),
+        subject: String(row.subject),
+        generation: Number(row.generation),
+        payload: String(row.payload),
+        expiresAt: Number(row.expires_at),
+        leaseUntil: nullable(row.lease_until),
+        revokedAt: nullable(row.revoked_at),
+    });
+    return {
+        async create(r) {
+            await query(`delete from wtfalch_auth_sessions where key in
+           (select key from wtfalch_auth_sessions where expires_at <= $1 limit 100)`, [Math.floor(Date.now() / 1000)]);
+            await query(`insert into wtfalch_auth_sessions
+           (key, context, subject, generation, payload, expires_at, lease_until, revoked_at)
+         values ($1, $2, $3, $4, $5, $6, $7, $8)`, [
+                r.key,
+                r.context,
+                r.subject,
+                r.generation,
+                r.payload,
+                r.expiresAt,
+                r.leaseUntil,
+                r.revokedAt,
+            ]);
+        },
+        async get(key) {
+            const rows = await query('select * from wtfalch_auth_sessions where key = $1', [key]);
+            return rows[0] ? record(rows[0]) : null;
+        },
+        async advance(key, generation, next) {
+            const rows = await query(`update wtfalch_auth_sessions
+            set payload = $3, expires_at = $4, lease_until = $5, generation = generation + 1
+          where key = $1 and generation = $2 and revoked_at is null
+          returning key`, [key, generation, next.payload, next.expiresAt, next.leaseUntil]);
+            return rows.length === 1;
+        },
+        async revoke(key, at) {
+            await query('update wtfalch_auth_sessions set revoked_at = $2 where key = $1 and revoked_at is null', [key, at]);
+        },
+        async revokeSubject(context, subject, at) {
+            const rows = await query(`update wtfalch_auth_sessions set revoked_at = $3
+          where context = $1 and subject = $2 and revoked_at is null
+          returning key`, [context, subject, at]);
+            return rows.length;
+        },
+    };
+}