@zeyolabs/kit 2026.11.5 → 2026.11.7

package/auth/accounts/invites.ts

@@ -0,0 +1,149 @@
+import { and, asc, eq, gt, isNull } from 'drizzle-orm';
+
+import type { AuthDb } from '../config';
+import type { AccountSummary, Membership } from './accounts';
+import type { PermissionCatalogue } from './permissions';
+
+import { Crypto } from '../../utils/crypto';
+import { Error400, Error403, Error404, Error409 } from '../../utils/errors';
+import { accountInvites, accountMembers, accounts, users } from '../schema';
+import { Accounts } from './accounts';
+
+// Invitations to join an account: an emailed single-use link, accepted only by a session for the
+// invited email.
+
+const INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+
+const OWNER = 'owner';
+
+/** Invites `email` with `policy`; replaces any earlier pending invite for that email. Returns the
+ *  token for the emailed link. */
+async function createInvite(
+	db: AuthDb,
+	catalogue: PermissionCatalogue,
+	actor: Membership,
+	input: { email: string; policy: string },
+	now = Date.now()
+): Promise<string> {
+	Accounts.assertCan(actor, 'members.invite');
+	const email = input.email.trim().toLowerCase();
+	if (input.policy === OWNER && actor.policy.key !== OWNER) {
+		throw Error403('Only an owner can invite an owner');
+	}
+	if (!(await Accounts.findPolicy(db, catalogue, actor.accountId, input.policy))) {
+		throw Error400('Unknown policy');
+	}
+	const [member] = await db
+		.select({ userId: accountMembers.userId })
+		.from(accountMembers)
+		.innerJoin(users, eq(users.id, accountMembers.userId))
+		.where(and(eq(accountMembers.accountId, actor.accountId), eq(users.email, email)))
+		.limit(1);
+	if (member) throw Error409('Already a member');
+
+	await db
+		.delete(accountInvites)
+		.where(
+			and(
+				eq(accountInvites.accountId, actor.accountId),
+				eq(accountInvites.email, email),
+				isNull(accountInvites.acceptedAt)
+			)
+		);
+	const token = Crypto.getRandomSecret(32);
+	await db.insert(accountInvites).values({
+		accountId: actor.accountId,
+		createdAt: now,
+		email,
+		expiresAt: now + INVITE_TTL_MS,
+		invitedBy: actor.userId,
+		policy: input.policy,
+		tokenHash: Crypto.hashSecret(token),
+	});
+	return token;
+}
+
+async function listInvites(db: AuthDb, actor: Membership, now = Date.now()) {
+	Accounts.assertCan(actor, 'members.read');
+	return db
+		.select({
+			email: accountInvites.email,
+			expiresAt: accountInvites.expiresAt,
+			policy: accountInvites.policy,
+		})
+		.from(accountInvites)
+		.where(
+			and(
+				eq(accountInvites.accountId, actor.accountId),
+				isNull(accountInvites.acceptedAt),
+				gt(accountInvites.expiresAt, now)
+			)
+		)
+		.orderBy(asc(accountInvites.email));
+}
+
+async function revokeInvite(db: AuthDb, actor: Membership, email: string): Promise<void> {
+	Accounts.assertCan(actor, 'members.invite');
+	await db
+		.delete(accountInvites)
+		.where(
+			and(
+				eq(accountInvites.accountId, actor.accountId),
+				eq(accountInvites.email, email.trim().toLowerCase()),
+				isNull(accountInvites.acceptedAt)
+			)
+		);
+}
+
+/** A live (pending, unexpired) invite and its account, for the invite page. */
+async function findInvite(db: AuthDb, token: string, now = Date.now()) {
+	if (!/^[0-9a-f]{64}$/.test(token)) return null;
+	const [row] = await db
+		.select({ account: accounts, email: accountInvites.email, policy: accountInvites.policy })
+		.from(accountInvites)
+		.innerJoin(accounts, eq(accounts.id, accountInvites.accountId))
+		.where(
+			and(
+				eq(accountInvites.tokenHash, Crypto.hashSecret(token)),
+				isNull(accountInvites.acceptedAt),
+				gt(accountInvites.expiresAt, now)
+			)
+		)
+		.limit(1);
+	if (!row) return null;
+	const { id, name, slug } = row.account;
+	return { account: { id, name, slug }, email: row.email, policy: row.policy };
+}
+
+/** Accepts an invite for the signed-in `user`, whose email must be the invited one. Single use. */
+async function acceptInvite(
+	db: AuthDb,
+	token: string,
+	user: { email: string; id: number },
+	now = Date.now()
+): Promise<AccountSummary> {
+	const invite = await findInvite(db, token, now);
+	if (!invite) throw Error404('This invite has expired or was already used');
+	if (invite.email !== user.email.toLowerCase()) {
+		throw Error403(`This invite is for ${invite.email}. Sign in with that email to accept it.`);
+	}
+	const [used] = await db
+		.update(accountInvites)
+		.set({ acceptedAt: now })
+		.where(
+			and(eq(accountInvites.tokenHash, Crypto.hashSecret(token)), isNull(accountInvites.acceptedAt))
+		)
+		.returning({ policy: accountInvites.policy });
+	if (!used) throw Error404('This invite has expired or was already used');
+	await Accounts.addMember(db, invite.account.id, user.id, used.policy, now);
+	return invite.account;
+}
+
+export const Invites = {
+	accept: acceptInvite,
+	create: createInvite,
+	find: findInvite,
+	list: listInvites,
+	revoke: revokeInvite,
+	TTL_MS: INVITE_TTL_MS,
+};

package/auth/accounts/permissions.ts

@@ -0,0 +1,90 @@
+// Permissions and policies. Pure (no db), so pages can use them too, e.g. to hide a button.
+//
+// A permission is a key like `projects.edit`: `<resource>.<action>`. A policy is a named set of
+// keys; every account member has exactly one. A key may be a wildcard: `*` grants everything,
+// `projects.*` every action on projects.
+//
+// Three policies are built in and exist in every account:
+//   owner  - everything, including policies and conferring ownership; can't be edited
+//   admin  - everything except managing policies
+//   member - the app's `memberPermissions`
+// An account can add its own policies (`account_policies`), made of the app's permission keys.
+
+/** The permissions this module itself checks, for account management. */
+const ACCOUNT_PERMISSIONS = [
+	'account.edit',
+	'members.read',
+	'members.invite',
+	'members.manage',
+	'policies.manage',
+] as const;
+
+export const BUILT_IN_POLICY_KEYS = ['owner', 'admin', 'member'] as const;
+export type BuiltInPolicyKey = (typeof BUILT_IN_POLICY_KEYS)[number];
+
+export type Policy = {
+	builtIn: boolean;
+	key: string;
+	name: string;
+	permissions: readonly string[];
+};
+
+/** The app's permission catalogue: every key a policy may grant, besides the account ones. */
+export type PermissionCatalogue = {
+	/** What a plain member gets. */
+	memberPermissions: readonly string[];
+	/** Every app permission key, e.g. `['projects.read', 'projects.edit', ...]`. */
+	permissions: readonly string[];
+};
+
+function isBuiltInPolicy(key: string): key is BuiltInPolicyKey {
+	return (BUILT_IN_POLICY_KEYS as readonly string[]).includes(key);
+}
+
+function builtInPolicies(catalogue: PermissionCatalogue): Record<BuiltInPolicyKey, Policy> {
+	const everything = [...ACCOUNT_PERMISSIONS, ...catalogue.permissions];
+	return {
+		admin: {
+			builtIn: true,
+			key: 'admin',
+			name: 'Admin',
+			permissions: everything.filter((p) => p !== 'policies.manage'),
+		},
+		member: {
+			builtIn: true,
+			key: 'member',
+			name: 'Member',
+			permissions: catalogue.memberPermissions,
+		},
+		owner: { builtIn: true, key: 'owner', name: 'Owner', permissions: ['*'] },
+	};
+}
+
+/** Whether `granted` (a policy's keys, wildcards allowed) includes `permission`. */
+function grants(granted: readonly string[], permission: string): boolean {
+	const resource = permission.split('.')[0];
+	return granted.some((g) => g === '*' || g === permission || g === `${resource}.*`);
+}
+
+/** Every key a custom policy may contain: exact catalogue keys, or `<resource>.*` for a resource
+ *  in it. Never `*`, which only the owner policy holds. */
+function isGrantableKey(catalogue: PermissionCatalogue, key: string): boolean {
+	const all = [...ACCOUNT_PERMISSIONS, ...catalogue.permissions];
+	if (all.includes(key)) return true;
+	const match = /^([a-z][a-z0-9-]*)\.\*$/.exec(key);
+	return !!match && all.some((p) => p.startsWith(`${match[1]}.`));
+}
+
+/** Keys and names for a custom policy: `[a-z0-9-]`, 1-40 chars, not a built-in key. */
+function isValidPolicyKey(key: string): boolean {
+	return /^[a-z0-9][a-z0-9-]{0,39}$/.test(key) && !isBuiltInPolicy(key);
+}
+
+export const Permissions = {
+	ACCOUNT: ACCOUNT_PERMISSIONS,
+	builtIns: builtInPolicies,
+	grants,
+	isBuiltIn: isBuiltInPolicy,
+	isGrantable: isGrantableKey,
+	isValidKey: isValidPolicyKey,
+};

package/auth/accounts/schemas.ts

@@ -0,0 +1,22 @@
+import { z } from 'zod';
+
+import { Schema } from '../../utils/schema';
+
+// Inputs of the account-management remote functions, shared with the app's forms (a remote module
+// may only export remote functions).
+
+const InviteSchema = z.object({
+	email: Schema.Email,
+	policy: z.string().min(1).max(40),
+});
+
+const PolicySchema = z.object({
+	key: z.string().min(1).max(40),
+	name: z.string().trim().min(1).max(60),
+	permissions: z.array(z.string().max(80)).max(200),
+});
+
+export const AccountSchemas = {
+	Invite: InviteSchema,
+	Policy: PolicySchema,
+};

package/auth/config.ts

@@ -0,0 +1,82 @@
+import type { BaseSQLiteDatabase } from 'drizzle-orm/sqlite-core';
+
+import type { IEmailClient } from '../cloudflare/email/base';
+import type { EmailBrand } from '../utils/email';
+import type { PermissionCatalogue } from './accounts/permissions';
+import type { AuthUser } from './sessions/sessions';
+
+/** Any async drizzle SQLite client (D1 in prod). A consumer's larger, schema-bound `Db` is
+ *  assignable. */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export type AuthDb = BaseSQLiteDatabase<'async', any, any>;
+
+export type MagicLinkMessage = {
+	/** The email the link was requested for (already lower-cased). */
+	email: string;
+	expiresInMinutes: number;
+	url: string;
+};
+
+export type AuthConfig = {
+	/** The app's permission keys and what plain members get (see `accounts/permissions.ts`). */
+	accounts: PermissionCatalogue;
+	/** Shown by the browser's passkey prompt and in the magic-link email. */
+	appName: string;
+	/** Share the session cookie with every subdomain of this domain (e.g. `example.com` for
+	 *  `app.example.com` and `mcp.example.com`), so one sign-in covers them all. Every subdomain's
+	 *  server then receives the cookie, so only set it when you control all of them. Default:
+	 *  host-only. Changing it signs everyone out once (the old cookie no longer matches). */
+	cookieDomain?: string;
+	db: () => AuthDb;
+	/** Sends the sign-in email (`magicLinkEmail`): any `IEmailClient`, e.g. `SmtpClient`, or
+	 *  `DevEmailClient` locally (it prints the link). Called per request. */
+	email: () => IEmailClient;
+	/** Name and colours for the sign-in email. */
+	emailBrand: EmailBrand;
+	/** Who may sign in at all. Checked when a link is requested, when it is used, and on every
+	 *  request, so removing someone signs them out. Unknown emails get the same "check your email"
+	 *  answer as known ones but no email. Invite-only apps use `hasAccountAccess` (a member of
+	 *  some account, or invited to one). */
+	isAllowed: (email: string) => boolean | Promise<boolean>;
+	/** Runs after each sign-in, e.g. to make bootstrap emails owners of the app's account. */
+	onSignIn?: (user: AuthUser) => Promise<void>;
+	/** The passkey domain (WebAuthn RP id). Default: the request's hostname. Set a parent domain
+	 *  (e.g. `example.com` for `app.example.com`) to share passkeys across its subdomains; it can't
+	 *  change later without orphaning every passkey. */
+	passkeyRpId?: string;
+};
+
+export type ResolvedAuthConfig = AuthConfig & {
+	/** Where an accepted invite lands. Default: `/<slug>`. */
+	accountHome: (slug: string) => string;
+	cookieName: string;
+	/** The page that shows an invite (`inviteLoad`). Default: `/invite`. */
+	invitePath: string;
+	loginPath: string;
+};
+
+let current: null | ResolvedAuthConfig = null;
+
+/** Registers the app's auth config. Call once at module scope (e.g. next to `secretNames`), so
+ *  importing the hooks file registers it. */
+function configureAuth(
+	config: AuthConfig & Partial<Omit<ResolvedAuthConfig, keyof AuthConfig>>
+): void {
+	current = {
+		accountHome: (slug) => `/${slug}`,
+		cookieName: 'session',
+		invitePath: '/invite',
+		loginPath: '/login',
+		...config,
+	};
+}
+
+function auth(): ResolvedAuthConfig {
+	if (!current) throw new Error('configureAuth() has not been called');
+	return current;
+}
+
+export const Auth = {
+	config: auth,
+	configure: configureAuth,
+};

package/auth/emails.ts

@@ -0,0 +1,57 @@
+import type { EmailBrand } from '../utils/email';
+import type { MagicLinkMessage } from './config';
+
+import { renderEmail, renderEmailText } from '../utils/email';
+
+/** The sign-in email: subject, HTML and plain text. */
+function magicLinkEmail(brand: EmailBrand, message: MagicLinkMessage) {
+	const params = {
+		brand,
+		cta: { href: message.url, label: `Sign in to ${brand.name}` },
+		eyebrow: 'Sign in',
+		footnote: `If you didn't ask to sign in, ignore this email: nobody can use the link without access to your inbox.`,
+		heading: `Sign in to ${brand.name}`,
+		intro: [
+			`Use the button below to sign in as ${message.email}.`,
+			`The link works once and expires in ${message.expiresInMinutes} minutes.`,
+		],
+		preheader: `Your sign-in link for ${brand.name}`,
+		sections: [],
+	};
+	return {
+		html: renderEmail(params),
+		subject: `Sign in to ${brand.name}`,
+		text: renderEmailText(params),
+	};
+}
+
+/** An invitation to join an account. */
+function inviteEmail(
+	brand: EmailBrand,
+	invite: { accountName: string; inviter: string; url: string }
+) {
+	const params = {
+		brand,
+		cta: { href: invite.url, label: `Join ${invite.accountName}` },
+		eyebrow: 'Invitation',
+		footnote:
+			'The invitation works once and expires in 7 days. Ignore this email if you were not expecting it.',
+		heading: `Join ${invite.accountName} on ${brand.name}`,
+		intro: [
+			`${invite.inviter} invited you to ${invite.accountName}.`,
+			'Sign in with this email address to accept.',
+		],
+		preheader: `${invite.inviter} invited you to ${invite.accountName}`,
+		sections: [],
+	};
+	return {
+		html: renderEmail(params),
+		subject: `Join ${invite.accountName} on ${brand.name}`,
+		text: renderEmailText(params),
+	};
+}
+
+export const AuthEmails = {
+	invite: inviteEmail,
+	magicLink: magicLinkEmail,
+};

package/auth/schema.ts

@@ -0,0 +1,152 @@
+import {
+	blob,
+	index,
+	integer,
+	primaryKey,
+	sqliteTable,
+	text,
+	uniqueIndex,
+} from 'drizzle-orm/sqlite-core';
+
+// Auth tables (D1/SQLite). Timestamps are epoch-ms integers. The app includes this file in its
+// drizzle-kit `schema` list and generates the migrations; nothing here runs DDL itself.
+
+export const users = sqliteTable('users', {
+	avatarUrl: text('avatar_url'),
+	createdAt: integer('created_at')
+		.notNull()
+		.$defaultFn(() => Date.now()),
+	/** Always lower-cased: the one identity both sign-in methods resolve to. */
+	email: text('email').notNull().unique(),
+	id: integer('id').primaryKey({ autoIncrement: true }),
+	name: text('name').notNull(),
+});
+
+/** A signed-in browser. The cookie holds `<id>.<secret>`; only sha256(secret) is stored. */
+export const sessions = sqliteTable(
+	'sessions',
+	{
+		createdAt: integer('created_at')
+			.notNull()
+			.$defaultFn(() => Date.now()),
+		expiresAt: integer('expires_at').notNull(),
+		id: text('id').primaryKey(),
+		lastUsedAt: integer('last_used_at')
+			.notNull()
+			.$defaultFn(() => Date.now()),
+		secretHash: text('secret_hash').notNull(),
+		userId: integer('user_id')
+			.notNull()
+			.references(() => users.id),
+	},
+	(table) => [index('sessions_user_id_idx').on(table.userId)]
+);
+
+/** Magic-link tokens: sha256 of the emailed secret, single use, short-lived. Keyed by email rather
+ *  than user, so a first sign-in can create the user only once the link is used. */
+export const authTokens = sqliteTable(
+	'auth_tokens',
+	{
+		createdAt: integer('created_at').notNull(),
+		email: text('email').notNull(),
+		expiresAt: integer('expires_at').notNull(),
+		tokenHash: text('token_hash').primaryKey(),
+		usedAt: integer('used_at'),
+	},
+	(table) => [index('auth_tokens_email_idx').on(table.email)]
+);
+
+/** WebAuthn credentials. `publicKey` is SEC1 (ES256) or PKCS#1 (RS256), per `algorithm`. */
+export const passkeys = sqliteTable(
+	'passkeys',
+	{
+		algorithm: integer('algorithm').notNull(),
+		createdAt: integer('created_at').notNull(),
+		/** The credential id, base64url without padding. */
+		id: text('id').primaryKey(),
+		lastUsedAt: integer('last_used_at'),
+		name: text('name').notNull(),
+		publicKey: blob('public_key', { mode: 'buffer' }).$type<Uint8Array>().notNull(),
+		signCount: integer('sign_count').notNull(),
+		/** Comma-separated `AuthenticatorTransport` hints from registration. */
+		transports: text('transports').notNull().default(''),
+		userId: integer('user_id')
+			.notNull()
+			.references(() => users.id, { onDelete: 'cascade' }),
+	},
+	(table) => [index('passkeys_user_id_idx').on(table.userId)]
+);
+
+/** What owns resources. Users sign in; accounts own things, and users reach them by membership.
+ *  Resource tables carry `account_id`, never `user_id`. */
+export const accounts = sqliteTable('accounts', {
+	createdAt: integer('created_at').notNull(),
+	id: integer('id').primaryKey({ autoIncrement: true }),
+	name: text('name').notNull(),
+	/** URL id, `[a-z0-9-]`, unique. */
+	slug: text('slug').notNull().unique(),
+});
+
+/** A user's membership of an account. `policy` is a built-in policy key (`owner`, `admin`,
+ *  `member`) or the key of one of the account's custom `account_policies`. */
+export const accountMembers = sqliteTable(
+	'account_members',
+	{
+		accountId: integer('account_id')
+			.notNull()
+			.references(() => accounts.id, { onDelete: 'cascade' }),
+		createdAt: integer('created_at').notNull(),
+		policy: text('policy').notNull(),
+		userId: integer('user_id')
+			.notNull()
+			.references(() => users.id, { onDelete: 'cascade' }),
+	},
+	(table) => [
+		primaryKey({ columns: [table.accountId, table.userId] }),
+		index('account_members_user_id_idx').on(table.userId),
+	]
+);
+
+/** An account's own policies: a named set of permission keys, on top of the built-in ones. */
+export const accountPolicies = sqliteTable(
+	'account_policies',
+	{
+		accountId: integer('account_id')
+			.notNull()
+			.references(() => accounts.id, { onDelete: 'cascade' }),
+		createdAt: integer('created_at').notNull(),
+		id: integer('id').primaryKey({ autoIncrement: true }),
+		/** `[a-z0-9-]`, unique per account, never a built-in key. */
+		key: text('key').notNull(),
+		name: text('name').notNull(),
+		permissions: text('permissions', { mode: 'json' }).$type<string[]>().notNull(),
+	},
+	(table) => [uniqueIndex('account_policies_account_key_idx').on(table.accountId, table.key)]
+);
+
+/** An emailed invitation to join an account with a policy. Only sha256(token) is stored; it is
+ *  single use and can only be accepted by a session for the invited email. */
+export const accountInvites = sqliteTable(
+	'account_invites',
+	{
+		acceptedAt: integer('accepted_at'),
+		accountId: integer('account_id')
+			.notNull()
+			.references(() => accounts.id, { onDelete: 'cascade' }),
+		createdAt: integer('created_at').notNull(),
+		email: text('email').notNull(),
+		expiresAt: integer('expires_at').notNull(),
+		invitedBy: integer('invited_by').references(() => users.id, { onDelete: 'set null' }),
+		policy: text('policy').notNull(),
+		tokenHash: text('token_hash').primaryKey(),
+	},
+	(table) => [
+		index('account_invites_account_id_idx').on(table.accountId),
+		index('account_invites_email_idx').on(table.email),
+	]
+);
+
+export type AccountRow = typeof accounts.$inferSelect;
+export type PasskeyRow = typeof passkeys.$inferSelect;
+export type SessionRow = typeof sessions.$inferSelect;
+export type UserRow = typeof users.$inferSelect;

package/auth/sessions/handle.ts

@@ -0,0 +1,125 @@
+import type { RequestEvent } from '@sveltejs/kit';
+import type { Handle } from '@sveltejs/kit/hooks';
+
+import { redirect } from '@sveltejs/kit';
+
+import type { AccessConfig } from '../../cloudflare/access';
+import type { AccountLocals } from '../accounts/handle';
+import type { AuthSession, AuthUser } from './sessions';
+
+import { ACCESS_JWT_HEADER, verifyAccessJwt } from '../../cloudflare/access';
+import { Error401 } from '../../utils/errors';
+import { Auth } from '../config';
+import { Users } from '../users';
+import { Sessions } from './sessions';
+
+/** What the handle puts on `event.locals`. Apps extend it: `interface Locals extends AuthLocals`. */
+export type AuthLocals = AccountLocals & {
+	/** The Cloudflare Access email when Access sits in front, else null. */
+	accessEmail: null | string;
+	session: AuthSession | null;
+	user: AuthUser | null;
+};
+
+export type AuthHandleOptions = {
+	/** Cloudflare Access in front of the app: return its config to require a valid Access JWT whose
+	 *  email matches the session user's, or `null` when the app is public. */
+	access?: () => AccessConfig | null;
+	/** Local dev only (no Access JWT on localhost): the email Access would have vouched for. */
+	devAccessEmail?: () => null | string;
+	/** Reachable without a session. Default: the login page and `/auth/*` (the auth routes). */
+	publicPaths?: readonly string[];
+};
+
+function authLocals(event: RequestEvent): AuthLocals {
+	return event.locals as unknown as AuthLocals;
+}
+
+const matches = (pathname: string, paths: readonly string[]) =>
+	paths.some((p) => pathname === p || pathname.startsWith(`${p}/`));
+
+/** Remote calls, non-GET requests, WebSockets and other fetches (anything that isn't a browser
+ *  asking for a page) get a 401, not a redirect to a login page. */
+const isApiRequest = (event: RequestEvent) =>
+	event.request.method !== 'GET' ||
+	event.url.pathname.startsWith('/_app/remote') ||
+	!(event.request.headers.get('accept') ?? '').includes('text/html');
+
+/**
+ * The auth gate, for `sequence(...)` after the context handle:
+ *   1. With Access configured, its JWT must verify (403 otherwise, even on public paths).
+ *   2. The session cookie resolves to a live session whose user is still allowed (and matches the
+ *      Access email); anything else is dropped and the cookie cleared.
+ *   3. Without a session, public paths render; pages redirect to the login page with `next`; API
+ *      requests get a 401.
+ * A session in its second half is renewed (sliding expiry).
+ */
+function createAuthHandle(options: AuthHandleOptions = {}): Handle {
+	return async ({ event, resolve }) => {
+		const config = Auth.config();
+		const locals = authLocals(event);
+		locals.accessEmail = null;
+		locals.session = null;
+		locals.user = null;
+		locals.account = null;
+		locals.membership = null;
+
+		const devEmail = options.devAccessEmail?.() ?? null;
+		const access = devEmail ? null : (options.access?.() ?? null);
+		if (devEmail) locals.accessEmail = devEmail;
+		if (access) {
+			const jwt = event.request.headers.get(ACCESS_JWT_HEADER);
+			if (!jwt) return new Response('Forbidden', { status: 403 });
+			try {
+				locals.accessEmail = (await verifyAccessJwt(jwt, access)).email;
+			} catch {
+				return new Response('Forbidden', { status: 403 });
+			}
+		}
+
+		const db = config.db();
+		const token = event.cookies.get(config.cookieName);
+		if (token) {
+			const live = await Sessions.validate(db, token);
+			const ok =
+				live &&
+				(await config.isAllowed(live.user.email)) &&
+				(!locals.accessEmail || Users.emailsMatch(locals.accessEmail, live.user.email));
+			if (ok) {
+				locals.session = live.session;
+				locals.user = live.user;
+				if (Sessions.needsRenewal(live.session.expiresAt, Date.now())) {
+					const expiresAt = await Sessions.renew(db, live.session.id);
+					locals.session = { ...live.session, expiresAt };
+					event.cookies.set(config.cookieName, token, {
+						...Sessions.cookieAttributes,
+						domain: config.cookieDomain,
+						expires: new Date(expiresAt),
+					});
+				}
+			} else {
+				if (live) await Sessions.delete(db, live.session.id);
+				event.cookies.delete(config.cookieName, { domain: config.cookieDomain, path: '/' });
+			}
+		}
+
+		const publicPaths = options.publicPaths ?? [config.loginPath, '/auth'];
+		if (locals.user || matches(event.url.pathname, publicPaths)) return resolve(event);
+		if (isApiRequest(event)) return new Response('Unauthorized', { status: 401 });
+		const next = event.url.pathname + event.url.search;
+		redirect(303, `${config.loginPath}?next=${encodeURIComponent(next)}`);
+	};
+}
+
+/** The signed-in user, or a thrown 401 `ServiceError`. For remote functions behind the handle. */
+function requireUser(event: RequestEvent): AuthUser {
+	const { user } = authLocals(event);
+	if (!user) throw Error401('Sign in first');
+	return user;
+}
+
+export const AuthHandle = {
+	create: createAuthHandle,
+	locals: authLocals,
+	requireUser,
+};