aui-auth 0.0.1 → 0.0.2

package/dist/accounts.d.ts

@@ -0,0 +1,30 @@
+import { f as RevalidateInput, p as SignInInput } from "./types-CRiqvt6N.js";
+//#region src/accounts.d.ts
+type AccountsOrganization = {
+  id: string;
+  name: string;
+  slug: string;
+  logo: string | null;
+  role: string;
+  hasAccess?: boolean;
+};
+type OrganizationSessionData = {
+  activeOrganization: AccountsOrganization | null;
+};
+type OrganizationHooksOptions = {
+  issuer: string;
+  fetch?: typeof fetch;
+  preferredSlug?: (redirectPath: string) => string | null;
+};
+declare function fetchOrganizations(options: {
+  issuer: string;
+  fetch?: typeof fetch;
+}, accessToken: string): Promise<AccountsOrganization[]>;
+declare function selectOrganization(organizations: AccountsOrganization[], preferredSlug?: string | null): AccountsOrganization | null;
+declare function preferredOrganizationSlug(redirectPath: string): string | null;
+declare function organizationHooks(options: OrganizationHooksOptions): {
+  onSignIn: (input: SignInInput<OrganizationSessionData>) => Promise<OrganizationSessionData>;
+  onRevalidate: (input: RevalidateInput<OrganizationSessionData>) => Promise<OrganizationSessionData | null>;
+};
+//#endregion
+export { AccountsOrganization, OrganizationHooksOptions, OrganizationSessionData, fetchOrganizations, organizationHooks, preferredOrganizationSlug, selectOrganization };

package/dist/accounts.js

@@ -0,0 +1 @@
+import{t as e,u as t}from"./oidc-BIfcHoyS.js";async function n(n,r){let i=await(n.fetch??globalThis.fetch.bind(globalThis))(e(n.issuer,`/api/oidc/organizations`),{headers:{Authorization:`Bearer ${r}`},cache:`no-store`});if(!i.ok)throw new t(`Failed to load organizations: ${i.status}`,i.status);return await i.json()}function r(e,t){if(t){let n=e.find(e=>e.slug===t);if(n)return n}return e[0]??null}function i(e){let[,t]=new URL(e,`http://localhost`).pathname.split(`/`);return t&&t!==`org`?t:null}function a(e){let a=e.preferredSlug??i;async function o(t){return{activeOrganization:r(await n(e,t.accessToken),a(t.redirectPath))}}async function s(i){let a;try{a=await n(e,i.accessToken)}catch(e){if(e instanceof t&&e.status>=400&&e.status<500)return null;throw e}let o=i.session.data.activeOrganization;if(!o)return{activeOrganization:r(a)};let s=a.find(e=>e.id===o.id)??null;return s?{activeOrganization:s}:null}return{onSignIn:o,onRevalidate:s}}export{n as fetchOrganizations,a as organizationHooks,i as preferredOrganizationSlug,r as selectOrganization};

package/dist/{index-BDndKDqC.d.ts → index-CICWi97l.d.ts}

@@ -1,4 +1,4 @@
-import { a as AccountsSession, c as AccountsTokens, d as ResolvedAccountsAuthConfig, l as AccountsUser, s as AccountsSessionStore, t as AccountsAuthConfig } from "./types-DdCYMKxG.js";
+import { a as AccountsSession, c as AccountsTokens, d as ResolvedAccountsAuthConfig, l as AccountsUser, s as AccountsSessionStore, t as AccountsAuthConfig } from "./types-CRiqvt6N.js";
 //#region src/guard.d.ts
 type GuardOptions = {
   publicPaths?: string[];

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { a as AccountsSession, c as AccountsTokens, f as RevalidateInput, i as AccountsRequestError, l as AccountsUser, n as AccountsLifetimes, o as AccountsSessionPatch, p as SignInInput, r as AccountsPaths, s as AccountsSessionStore, t as AccountsAuthConfig, u as OAuthTokenError } from "./types-DdCYMKxG.js";
-import { a as requestOrigin, c as GuardResult, i as accountsEndpoint, n as createAccountsAuth, o as sanitizeRedirectPath, r as createMemorySessionStore, s as GuardOptions, t as AccountsAuth } from "./index-BDndKDqC.js";
+import { a as AccountsSession, c as AccountsTokens, f as RevalidateInput, i as AccountsRequestError, l as AccountsUser, n as AccountsLifetimes, o as AccountsSessionPatch, p as SignInInput, r as AccountsPaths, s as AccountsSessionStore, t as AccountsAuthConfig, u as OAuthTokenError } from "./types-CRiqvt6N.js";
+import { a as requestOrigin, c as GuardResult, i as accountsEndpoint, n as createAccountsAuth, o as sanitizeRedirectPath, r as createMemorySessionStore, s as GuardOptions, t as AccountsAuth } from "./index-CICWi97l.js";
 export { AccountsAuth, type AccountsAuthConfig, type AccountsLifetimes, type AccountsPaths, AccountsRequestError, type AccountsSession, type AccountsSessionPatch, type AccountsSessionStore, type AccountsTokens, type AccountsUser, type GuardOptions, type GuardResult, OAuthTokenError, type RevalidateInput, type SignInInput, accountsEndpoint, createAccountsAuth, createMemorySessionStore, requestOrigin, sanitizeRedirectPath };

package/dist/index.js

@@ -1 +1 @@
-import{a as e,c as t,i as n,l as r,o as i,r as a,s as o,t as s,u as c}from"./cookies-D3lpM5ER.js";function l(e,n){return async function(t,a={}){let o=new URL(t.url);if((a.publicPaths??[e.paths.login,e.paths.callback,e.paths.error]).some(e=>o.pathname.startsWith(e)))return{kind:`ok`,session:null};let s=i(t,e.cookieName),c=await n.load(s);if(!c)return r(t,a,s!==null);let l=c;try{let e=await n.revalidate(c);if(!e)return r(t,a,!0);l=e}catch{return{kind:`ok`,session:l}}if(l.tokens.accessTokenExpiresAt<=e.now()){let e=await n.ensureFreshTokens(l).catch(()=>l);if(!e)return r(t,a,!0);l=e}return{kind:`ok`,session:l}};function r(n,r,i){let a=t(n),c=new URL(n.url);if((r.apiPaths??[`/api`,`/trpc`]).some(e=>c.pathname.startsWith(e))){let t=Response.json({error:`Unauthorized`},{status:401});return i&&s(t.headers,e.cookieName,a),{kind:`response`,response:t}}let l=r.redirectPath?.(n)??`${c.pathname}${c.search}`,u=new URL(e.paths.login,a);u.searchParams.set(`redirect`,l),i&&u.searchParams.set(`silent`,`1`);let d=o(u);return i&&s(d.headers,e.cookieName,a),{kind:`response`,response:d}}}const u={login:`/api/auth/login`,callback:`/api/auth/callback`,logout:`/api/auth/logout`,logoutComplete:`/api/auth/logout-complete`,error:`/auth/error`},d={absoluteMaxAgeMs:2592e6,idleMaxAgeMs:6048e5,revalidateIntervalMs:12e4,refreshBeforeExpiryMs:3e5,flowMaxAgeMs:6e5,refreshLeaseMs:2e4,leaseWaitMs:5e3};function f(e){return{...e,scope:e.scope??`openid profile email offline_access`,paths:{...u,...e.paths},lifetimes:{...d,...e.lifetimes},fetch:e.fetch??globalThis.fetch.bind(globalThis),now:e.now??Date.now}}var p=class extends Error{status;constructor(e,t){super(e),this.name=`AccountsRequestError`,this.status=t}},m=class extends p{code;constructor(e,t,n){super(`Token request failed: ${e} ${t} ${n}`,e),this.name=`OAuthTokenError`,this.code=t}};function h(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function g(e){return h(crypto.getRandomValues(new Uint8Array(e)))}async function _(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return h(new Uint8Array(t))}function v(e,t){return new URL(t,e).toString()}async function y(e,t){let n=g(24),r=g(32),i=new URL(v(e.issuer,`/api/auth/oauth2/authorize`));return i.searchParams.set(`client_id`,e.clientId),i.searchParams.set(`redirect_uri`,new URL(e.paths.callback,t.origin).toString()),i.searchParams.set(`response_type`,`code`),i.searchParams.set(`scope`,e.scope),i.searchParams.set(`state`,n),i.searchParams.set(`code_challenge`,await _(r)),i.searchParams.set(`code_challenge_method`,`S256`),t.silent&&i.searchParams.set(`prompt`,`none`),{url:i.toString(),state:n,verifier:r}}function b(e,t){let n=new URL(v(e.issuer,`/api/auth/oauth2/end-session`));return n.searchParams.set(`id_token_hint`,t.idToken),n.searchParams.set(`client_id`,e.clientId),n.searchParams.set(`post_logout_redirect_uri`,new URL(e.paths.logoutComplete,t.origin).toString()),n.toString()}async function x(e,t){let n=new URLSearchParams({client_id:e.clientId,...t});e.clientSecret&&n.set(`client_secret`,e.clientSecret);let r=await e.fetch(v(e.issuer,`/api/auth/oauth2/token`),{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:n,cache:`no-store`});if(!r.ok){let e=await r.text().catch(()=>``),t=`unknown_error`,n=e;try{let r=JSON.parse(e);t=r.error??t,n=r.error_description??n}catch{}throw new m(r.status,t,n)}return await r.json()}function S(e,t){return x(e,{grant_type:`authorization_code`,code:t.code,code_verifier:t.verifier,redirect_uri:t.redirectUri})}function C(e,t){return x(e,{grant_type:`refresh_token`,refresh_token:t})}async function w(e,t){let n=await e.fetch(v(e.issuer,`/api/auth/oauth2/userinfo`),{headers:{Authorization:`Bearer ${t}`},cache:`no-store`});if(!n.ok)throw new p(`Failed to load user info: ${n.status}`,n.status);let r=await n.json();return{id:r.sub,email:r.email??``,name:r.name??r.email??r.sub,image:r.picture??null}}function T(e,t,n){return{accessToken:e.access_token,refreshToken:e.refresh_token??t?.refreshToken??null,idToken:e.id_token??t?.idToken??null,accessTokenExpiresAt:typeof e.expires_at==`number`?e.expires_at*1e3:n+(e.expires_in??3600)*1e3}}const E=new Set([`login_required`,`consent_required`,`interaction_required`,`account_selection_required`]);function D(l,u){function d(e,t){let n=new URL(l.paths.login,e);return n.searchParams.set(`redirect`,t),n}function f(e,t,n){let r=new URL(l.paths.error,e);return r.searchParams.set(`reason`,t),n&&r.searchParams.set(`description`,n),r}async function p(i){let a=t(i),s=new URL(i.url).searchParams,u=r(s.get(`redirect`),a),d=s.get(`silent`)===`1`,{url:f,state:p,verifier:m}=await y(l,{origin:a,silent:d}),h=o(f);return c(h.headers,e(l.cookieName,p),n({verifier:m,redirectPath:u,silent:d}),a,l.lifetimes.flowMaxAgeMs),h}async function m(n){let r=t(n),p=new URL(n.url).searchParams,m=p.get(`state`),h=m?e(l.cookieName,m):null,g=h?a(i(n,h)):null,_=e=>(h&&s(e.headers,h,r),e);if(!g)return _(o(f(r,`invalid_state`,null)));let v=p.get(`error`);if(v)return g.silent&&E.has(v)?_(o(d(r,g.redirectPath))):_(o(f(r,v,p.get(`error_description`))));let y=p.get(`code`);if(!y)return _(o(f(r,`invalid_request`,null)));let b=T(await S(l,{code:y,verifier:g.verifier,redirectUri:new URL(l.paths.callback,r).toString()}),null,l.now()),x=await w(l,b.accessToken),C=await l.onSignIn({user:x,accessToken:b.accessToken,redirectPath:g.redirectPath,previous:null});if(C===null)return _(o(f(r,`access_denied`,null)));let{cookieValue:D}=await u.start({user:x,tokens:b,data:C}),O=o(new URL(g.redirectPath,r));return c(O.headers,l.cookieName,D,r,l.lifetimes.absoluteMaxAgeMs),_(O)}async function h(e){let n=t(e),r=await u.load(i(e,l.cookieName));r&&await u.end(r);let a=r?.tokens.idToken?b(l,{origin:n,idToken:r.tokens.idToken}):new URL(l.paths.logoutComplete,n).toString(),c=o(a,303);return s(c.headers,l.cookieName,n),c}return{login:p,callback:m,logout:h}}const O=e=>new Promise(t=>setTimeout(t,e));function k(e){let{store:t,lifetimes:n}=e;function r(e,t){return t-e.createdAt>=n.absoluteMaxAgeMs||t-e.lastValidatedAt>=n.idleMaxAgeMs}function i(e,t){return e.accessTokenExpiresAt-t<=n.refreshBeforeExpiryMs}async function a(n){if(!n)return null;let i=await t.read(await _(n));return i?r(i,e.now())?(await t.delete(i.id),null):i:null}async function o(n){let r=g(32),i=e.now(),a={id:await _(r),user:n.user,tokens:n.tokens,data:n.data,createdAt:i,lastValidatedAt:i,refreshLeaseUntil:null};return await t.create(a),{session:a,cookieValue:r}}async function s(r){let a=e.now();if(!i(r.tokens,a))return r;if(!r.tokens.refreshToken)return await t.delete(r.id),null;let o=await t.claimRefreshLease(r.id,a+n.refreshLeaseMs,a);if(!o)return c(r.id,a);if(!i(o.tokens,a))return t.update(o.id,{refreshLeaseUntil:null});try{let n=await C(e,o.tokens.refreshToken);return await t.update(o.id,{tokens:T(n,o.tokens,e.now()),refreshLeaseUntil:null})}catch(n){if(n instanceof m&&n.code===`invalid_grant`)return await t.delete(o.id),null;let r=await t.update(o.id,{refreshLeaseUntil:null});if(o.tokens.accessTokenExpiresAt>e.now())return r??o;throw n}}async function c(r,a){for(;;){await O(100);let o=await t.read(r);if(!o)return null;let c=e.now();if(!i(o.tokens,c))return o;if(o.refreshLeaseUntil===null||o.refreshLeaseUntil<=c)return s(o);if(c-a>=n.leaseWaitMs)return o}}async function l(r){if(e.now()-r.lastValidatedAt<n.revalidateIntervalMs)return r;let i=await s(r);if(!i)return null;let a=await e.onRevalidate({session:i,accessToken:i.tokens.accessToken});return a===null?(await t.delete(i.id),null):t.update(i.id,{data:a,lastValidatedAt:e.now()})}async function u(e){await t.delete(e.id)}return{load:a,start:o,ensureFreshTokens:s,revalidate:l,end:u}}function A(){let e=new Map;return{rows:e,async create(t){e.set(t.id,structuredClone(t))},async read(t){let n=e.get(t);return n?structuredClone(n):null},async update(t,n){let r=e.get(t);if(!r)return null;let i={...r,...n};return e.set(t,i),structuredClone(i)},async claimRefreshLease(t,n,r){let i=e.get(t);if(!i||i.refreshLeaseUntil!==null&&i.refreshLeaseUntil>r)return null;let a={...i,refreshLeaseUntil:n};return e.set(t,a),structuredClone(a)},async delete(t){e.delete(t)}}}function j(e){let t=f(e),n=k(t),r=D(t,n),a=l(t,n);async function o(e){return n.load(e)}async function s(e){return o(i(e,t.cookieName))}async function c(e){let t=await n.load(e);return t?(await n.ensureFreshTokens(t))?.tokens.accessToken??null:null}async function u(e){return c(i(e,t.cookieName))}async function d(e,r){let i=await n.load(e);return i?t.store.update(i.id,{data:r(i.data)}):null}return{config:t,sessions:n,handlers:r,guard:a,sessionFromCookie:o,sessionFromRequest:s,accessTokenFromCookie:c,accessTokenFromRequest:u,updateSessionData:d}}export{p as AccountsRequestError,m as OAuthTokenError,v as accountsEndpoint,j as createAccountsAuth,A as createMemorySessionStore,t as requestOrigin,r as sanitizeRedirectPath};
+import{a as e,c as t,i as n,l as r,o as i,r as a,s as o,t as s,u as c}from"./cookies-D3lpM5ER.js";import{a as l,c as u,d,f,i as p,l as m,n as h,o as g,r as _,s as v,t as y,u as b}from"./oidc-BIfcHoyS.js";function x(e,n){return async function(t,a={}){let o=new URL(t.url);if((a.publicPaths??[e.paths.login,e.paths.callback,e.paths.error]).some(e=>o.pathname.startsWith(e)))return{kind:`ok`,session:null};let s=i(t,e.cookieName),c=await n.load(s);if(!c)return r(t,a,s!==null);let l=c;try{let e=await n.revalidate(c);if(!e)return r(t,a,!0);l=e}catch{return{kind:`ok`,session:l}}if(l.tokens.accessTokenExpiresAt<=e.now()){let e=await n.ensureFreshTokens(l).catch(()=>l);if(!e)return r(t,a,!0);l=e}return{kind:`ok`,session:l}};function r(n,r,i){let a=t(n),c=new URL(n.url);if((r.apiPaths??[`/api`,`/trpc`]).some(e=>c.pathname.startsWith(e))){let t=Response.json({error:`Unauthorized`},{status:401});return i&&s(t.headers,e.cookieName,a),{kind:`response`,response:t}}let l=r.redirectPath?.(n)??`${c.pathname}${c.search}`,u=new URL(e.paths.login,a);u.searchParams.set(`redirect`,l),i&&u.searchParams.set(`silent`,`1`);let d=o(u);return i&&s(d.headers,e.cookieName,a),{kind:`response`,response:d}}}const S=/^[A-Za-z0-9_-]{1,128}$/,C=new Set([`login_required`,`consent_required`,`interaction_required`,`account_selection_required`]);function w(u,d){function f(e,t){let n=new URL(u.paths.login,e);return n.searchParams.set(`redirect`,t),n}function g(e,t,n){let r=new URL(u.paths.error,e);return r.searchParams.set(`reason`,t),n&&r.searchParams.set(`description`,n),r}async function v(i){let a=t(i),s=new URL(i.url).searchParams,l=r(s.get(`redirect`),a),d=s.get(`silent`)===`1`,{url:f,state:p,verifier:m}=await h(u,{origin:a,silent:d}),g=o(f);return c(g.headers,e(u.cookieName,p),n({verifier:m,redirectPath:l,silent:d}),a,u.lifetimes.flowMaxAgeMs),g}async function y(n){let h=t(n),_=new URL(n.url).searchParams,v=_.get(`state`),y=v&&S.test(v)?e(u.cookieName,v):null,b=y?a(i(n,y)):null,x=e=>(y&&s(e.headers,y,h),e);if(!b)return x(o(g(h,`invalid_state`,null)));let w=r(b.redirectPath,h),T=_.get(`error`);if(T)return b.silent&&C.has(T)?x(o(f(h,w))):x(o(g(h,T,_.get(`error_description`))));let E=_.get(`code`);if(!E)return x(o(g(h,`invalid_request`,null)));let D=await p(u,{code:E,verifier:b.verifier,redirectUri:new URL(u.paths.callback,h).toString()}),O=m(D,null,u.now()),k=await l(u,O.accessToken),A=await u.onSignIn({user:k,accessToken:O.accessToken,redirectPath:w,previous:null});if(A===null)return x(o(g(h,`access_denied`,null)));let{cookieValue:j}=await d.start({user:k,tokens:O,data:A}),M=o(new URL(w,h));return c(M.headers,u.cookieName,j,h,u.lifetimes.absoluteMaxAgeMs),x(M)}async function b(e){let n=t(e),r=await d.load(i(e,u.cookieName));r&&await d.end(r);let a=r?.tokens.idToken?_(u,{origin:n,idToken:r.tokens.idToken}):new URL(u.paths.logoutComplete,n).toString(),c=o(a,303);return s(c.headers,u.cookieName,n),c}return{login:v,callback:y,logout:b}}const T=e=>new Promise(t=>setTimeout(t,e));function E(e){let{store:t,lifetimes:n}=e;function r(e,t){return t-e.createdAt>=n.absoluteMaxAgeMs||t-e.lastValidatedAt>=n.idleMaxAgeMs}function i(e,t){return e.accessTokenExpiresAt-t<=n.refreshBeforeExpiryMs}async function a(n){if(!n)return null;let i=await t.read(await u(n));return i?r(i,e.now())?(await t.delete(i.id),null):i:null}async function o(n){let r=g(32),i=e.now(),a={id:await u(r),user:n.user,tokens:n.tokens,data:n.data,createdAt:i,lastValidatedAt:i,refreshLeaseUntil:null};return await t.create(a),{session:a,cookieValue:r}}async function s(r){let a=e.now();if(!i(r.tokens,a))return r;if(!r.tokens.refreshToken)return await t.delete(r.id),null;let o=await t.claimRefreshLease(r.id,a+n.refreshLeaseMs,a);if(!o)return c(r.id,a);let s=o.refreshLeaseUntil??void 0;if(!i(o.tokens,a))return await t.update(o.id,{refreshLeaseUntil:null},s)??t.read(o.id);try{let r=await v(e,o.tokens.refreshToken,Math.max(n.refreshLeaseMs-1e3,n.refreshLeaseMs/2));return await t.update(o.id,{tokens:m(r,o.tokens,e.now()),refreshLeaseUntil:null},s)??t.read(o.id)}catch(n){if(n instanceof d&&n.code===`invalid_grant`)return await t.delete(o.id,s),await t.read(o.id)??null;let r=await t.update(o.id,{refreshLeaseUntil:null},s);if(o.tokens.accessTokenExpiresAt>e.now())return r??o;throw n}}async function c(r,a){for(;;){await T(100);let o=await t.read(r);if(!o)return null;let c=e.now();if(!i(o.tokens,c))return o;if(o.refreshLeaseUntil===null||o.refreshLeaseUntil<=c)return s(o);if(c-a>=n.leaseWaitMs){if(o.tokens.accessTokenExpiresAt>c)return o;throw new b(`Timed out waiting for the session refresh lease`,0)}}}async function l(r){if(e.now()-r.lastValidatedAt<n.revalidateIntervalMs)return r;let i=await s(r);if(!i)return null;let a=await e.onRevalidate({session:i,accessToken:i.tokens.accessToken});return a===null?(await t.delete(i.id),null):t.update(i.id,{data:a,lastValidatedAt:e.now()})}async function f(e){await t.delete(e.id)}return{load:a,start:o,ensureFreshTokens:s,revalidate:l,end:f}}function D(){let e=new Map;return{rows:e,async create(t){e.set(t.id,structuredClone(t))},async read(t){let n=e.get(t);return n?structuredClone(n):null},async update(t,n,r){let i=e.get(t);if(!i||r!==void 0&&i.refreshLeaseUntil!==r)return null;let a=structuredClone({...i,...n});return e.set(t,a),structuredClone(a)},async claimRefreshLease(t,n,r){let i=e.get(t);if(!i||i.refreshLeaseUntil!==null&&i.refreshLeaseUntil>r)return null;let a={...i,refreshLeaseUntil:n};return e.set(t,a),structuredClone(a)},async delete(t,n){let r=e.get(t);r&&(n===void 0||r.refreshLeaseUntil===n)&&e.delete(t)}}}function O(e){let t=f(e),n=E(t),r=w(t,n),a=x(t,n);async function o(e){return n.load(e)}async function s(e){return o(i(e,t.cookieName))}async function c(e){let t=await n.load(e);return t?(await n.ensureFreshTokens(t))?.tokens.accessToken??null:null}async function l(e){return c(i(e,t.cookieName))}async function u(e,r){let i=await n.load(e);return i?t.store.update(i.id,{data:r(i.data)}):null}return{config:t,sessions:n,handlers:r,guard:a,sessionFromCookie:o,sessionFromRequest:s,accessTokenFromCookie:c,accessTokenFromRequest:l,updateSessionData:u}}export{b as AccountsRequestError,d as OAuthTokenError,y as accountsEndpoint,O as createAccountsAuth,D as createMemorySessionStore,t as requestOrigin,r as sanitizeRedirectPath};

package/dist/next.d.ts

@@ -1,5 +1,5 @@
-import { a as AccountsSession } from "./types-DdCYMKxG.js";
-import { t as AccountsAuth } from "./index-BDndKDqC.js";
+import { a as AccountsSession } from "./types-CRiqvt6N.js";
+import { t as AccountsAuth } from "./index-CICWi97l.js";
 //#region src/next.d.ts
 declare function withNextRequestScope<Data>(auth: AccountsAuth<Data>): {
   getSession(): Promise<AccountsSession<Data> | null>;

package/dist/oidc-BIfcHoyS.js

@@ -0,0 +1 @@
+const e={login:`/api/auth/login`,callback:`/api/auth/callback`,logout:`/api/auth/logout`,logoutComplete:`/api/auth/logout-complete`,error:`/auth/error`},t={absoluteMaxAgeMs:2592e6,idleMaxAgeMs:6048e5,revalidateIntervalMs:12e4,refreshBeforeExpiryMs:3e5,flowMaxAgeMs:6e5,refreshLeaseMs:2e4,leaseWaitMs:5e3};function n(n){return{...n,scope:n.scope??`openid profile email offline_access`,paths:{...e,...n.paths},lifetimes:{...t,...n.lifetimes},fetch:n.fetch??globalThis.fetch.bind(globalThis),now:n.now??Date.now}}var r=class extends Error{status;constructor(e,t){super(e),this.name=`AccountsRequestError`,this.status=t}},i=class extends r{code;constructor(e,t,n){super(`Token request failed: ${e} ${t} ${n}`,e),this.name=`OAuthTokenError`,this.code=t}};function a(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function o(e){return a(crypto.getRandomValues(new Uint8Array(e)))}async function s(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return a(new Uint8Array(t))}function c(e,t){return new URL(t,e).toString()}async function l(e,t){let n=o(24),r=o(32),i=new URL(c(e.issuer,`/api/auth/oauth2/authorize`));return i.searchParams.set(`client_id`,e.clientId),i.searchParams.set(`redirect_uri`,new URL(e.paths.callback,t.origin).toString()),i.searchParams.set(`response_type`,`code`),i.searchParams.set(`scope`,e.scope),i.searchParams.set(`state`,n),i.searchParams.set(`code_challenge`,await s(r)),i.searchParams.set(`code_challenge_method`,`S256`),t.silent&&i.searchParams.set(`prompt`,`none`),{url:i.toString(),state:n,verifier:r}}function u(e,t){let n=new URL(c(e.issuer,`/api/auth/oauth2/end-session`));return n.searchParams.set(`id_token_hint`,t.idToken),n.searchParams.set(`client_id`,e.clientId),n.searchParams.set(`post_logout_redirect_uri`,new URL(e.paths.logoutComplete,t.origin).toString()),n.toString()}async function d(e,t,n){let r=new URLSearchParams({client_id:e.clientId,...t});e.clientSecret&&r.set(`client_secret`,e.clientSecret);let a=await e.fetch(c(e.issuer,`/api/auth/oauth2/token`),{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:r,cache:`no-store`,...n?{signal:AbortSignal.timeout(n)}:{}});if(!a.ok){let e=await a.text().catch(()=>``),t=`unknown_error`,n=e;try{let r=JSON.parse(e);t=r.error??t,n=r.error_description??n}catch{}throw new i(a.status,t,n)}return await a.json()}function f(e,t){return d(e,{grant_type:`authorization_code`,code:t.code,code_verifier:t.verifier,redirect_uri:t.redirectUri})}function p(e,t,n){return d(e,{grant_type:`refresh_token`,refresh_token:t},n)}async function m(e,t){let n=await e.fetch(c(e.issuer,`/api/auth/oauth2/userinfo`),{headers:{Authorization:`Bearer ${t}`},cache:`no-store`});if(!n.ok)throw new r(`Failed to load user info: ${n.status}`,n.status);let i=await n.json();return{id:i.sub,email:i.email??``,name:i.name??i.email??i.sub,image:i.picture??null}}function h(e,t,n){return{accessToken:e.access_token,refreshToken:e.refresh_token??t?.refreshToken??null,idToken:e.id_token??t?.idToken??null,accessTokenExpiresAt:typeof e.expires_at==`number`?e.expires_at*1e3:n+(e.expires_in??3600)*1e3}}export{m as a,s as c,i as d,n as f,f as i,h as l,l as n,o,u as r,p as s,c as t,r as u};

package/dist/pg.d.ts

@@ -1,4 +1,4 @@
-import { s as AccountsSessionStore } from "./types-DdCYMKxG.js";
+import { s as AccountsSessionStore } from "./types-CRiqvt6N.js";
 //#region src/pg.d.ts
 type PgQuery = (text: string, values?: unknown[]) => Promise<{
   rows: Record<string, unknown>[];

package/dist/pg.js

@@ -11,4 +11,4 @@ const e=`CREATE TABLE "accounts_sessions" (
   "last_validated_at" timestamp with time zone NOT NULL,
   "refresh_lease_until" timestamp with time zone
 );
-CREATE INDEX "accounts_sessions_user_id_idx" ON "accounts_sessions" ("user_id");`,t={encrypt:async e=>e,decrypt:async e=>e};function n(e){if(e instanceof Date)return e.getTime();if(typeof e==`string`)return new Date(e).getTime();if(typeof e==`number`)return e;throw Error(`Unexpected timestamp value in accounts session row`)}function r(e){return new Date(e)}function i(e){let i=e.table??`accounts_sessions`;if(!/^[a-z_][a-z0-9_]*$/.test(i))throw Error(`Invalid accounts session table name: ${i}`);let a=`"${i}"`,o=e.codec??t;async function s(e){return{accessToken:await o.encrypt(e.accessToken),refreshToken:e.refreshToken?await o.encrypt(e.refreshToken):null,idToken:e.idToken?await o.encrypt(e.idToken):null}}async function c(e){return{id:e.id,user:e.user,tokens:{accessToken:await o.decrypt(e.access_token),refreshToken:e.refresh_token?await o.decrypt(e.refresh_token):null,idToken:e.id_token?await o.decrypt(e.id_token):null,accessTokenExpiresAt:n(e.access_token_expires_at)},data:e.data,createdAt:n(e.created_at),lastValidatedAt:n(e.last_validated_at),refreshLeaseUntil:e.refresh_lease_until===null||e.refresh_lease_until===void 0?null:n(e.refresh_lease_until)}}return{async create(t){let n=await s(t.tokens);await e.query(`INSERT INTO ${a} ("id", "user_id", "user", "access_token", "refresh_token", "id_token", "access_token_expires_at", "data", "created_at", "last_validated_at", "refresh_lease_until") VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, NULL)`,[t.id,t.user.id,JSON.stringify(t.user),n.accessToken,n.refreshToken,n.idToken,r(t.tokens.accessTokenExpiresAt),JSON.stringify(t.data),r(t.createdAt),r(t.lastValidatedAt)])},async read(t){let{rows:n}=await e.query(`SELECT * FROM ${a} WHERE "id" = $1`,[t]);return n[0]?c(n[0]):null},async update(t,n){let i=[],o=[t],l=(e,t)=>{o.push(t),i.push(`"${e}" = $${o.length}`)};if(n.user!==void 0&&(l(`user_id`,n.user.id),l(`user`,JSON.stringify(n.user))),n.tokens!==void 0){let e=await s(n.tokens);l(`access_token`,e.accessToken),l(`refresh_token`,e.refreshToken),l(`id_token`,e.idToken),l(`access_token_expires_at`,r(n.tokens.accessTokenExpiresAt))}if(n.data!==void 0&&l(`data`,JSON.stringify(n.data)),n.lastValidatedAt!==void 0&&l(`last_validated_at`,r(n.lastValidatedAt)),n.refreshLeaseUntil!==void 0&&l(`refresh_lease_until`,n.refreshLeaseUntil===null?null:r(n.refreshLeaseUntil)),i.length===0)return this.read(t);let{rows:u}=await e.query(`UPDATE ${a} SET ${i.join(`, `)} WHERE "id" = $1 RETURNING *`,o);return u[0]?c(u[0]):null},async claimRefreshLease(t,n,i){let{rows:o}=await e.query(`UPDATE ${a} SET "refresh_lease_until" = $2 WHERE "id" = $1 AND ("refresh_lease_until" IS NULL OR "refresh_lease_until" <= $3) RETURNING *`,[t,r(n),r(i)]);return o[0]?c(o[0]):null},async delete(t){await e.query(`DELETE FROM ${a} WHERE "id" = $1`,[t])}}}export{e as PG_SESSION_TABLE_SQL,i as createPgSessionStore};
+CREATE INDEX "accounts_sessions_user_id_idx" ON "accounts_sessions" ("user_id");`,t={encrypt:async e=>e,decrypt:async e=>e};function n(e){if(e instanceof Date)return e.getTime();if(typeof e==`string`)return new Date(e).getTime();if(typeof e==`number`)return e;throw Error(`Unexpected timestamp value in accounts session row`)}function r(e){return new Date(e)}function i(e){let i=e.table??`accounts_sessions`;if(!/^[a-z_][a-z0-9_]*$/.test(i))throw Error(`Invalid accounts session table name: ${i}`);let a=`"${i}"`,o=e.codec??t;async function s(e){return{accessToken:await o.encrypt(e.accessToken),refreshToken:e.refreshToken?await o.encrypt(e.refreshToken):null,idToken:e.idToken?await o.encrypt(e.idToken):null}}async function c(e){return{id:e.id,user:e.user,tokens:{accessToken:await o.decrypt(e.access_token),refreshToken:e.refresh_token?await o.decrypt(e.refresh_token):null,idToken:e.id_token?await o.decrypt(e.id_token):null,accessTokenExpiresAt:n(e.access_token_expires_at)},data:e.data,createdAt:n(e.created_at),lastValidatedAt:n(e.last_validated_at),refreshLeaseUntil:e.refresh_lease_until===null||e.refresh_lease_until===void 0?null:n(e.refresh_lease_until)}}return{async create(t){let n=await s(t.tokens);await e.query(`INSERT INTO ${a} ("id", "user_id", "user", "access_token", "refresh_token", "id_token", "access_token_expires_at", "data", "created_at", "last_validated_at", "refresh_lease_until") VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, NULL)`,[t.id,t.user.id,JSON.stringify(t.user),n.accessToken,n.refreshToken,n.idToken,r(t.tokens.accessTokenExpiresAt),JSON.stringify(t.data),r(t.createdAt),r(t.lastValidatedAt)])},async read(t){let{rows:n}=await e.query(`SELECT * FROM ${a} WHERE "id" = $1`,[t]);return n[0]?c(n[0]):null},async update(t,n,i){let o=[],l=[t],u=(e,t)=>{l.push(t),o.push(`"${e}" = $${l.length}`)};if(n.user!==void 0&&(u(`user_id`,n.user.id),u(`user`,JSON.stringify(n.user))),n.tokens!==void 0){let e=await s(n.tokens);u(`access_token`,e.accessToken),u(`refresh_token`,e.refreshToken),u(`id_token`,e.idToken),u(`access_token_expires_at`,r(n.tokens.accessTokenExpiresAt))}if(n.data!==void 0&&u(`data`,JSON.stringify(n.data)),n.lastValidatedAt!==void 0&&u(`last_validated_at`,r(n.lastValidatedAt)),n.refreshLeaseUntil!==void 0&&u(`refresh_lease_until`,n.refreshLeaseUntil===null?null:r(n.refreshLeaseUntil)),o.length===0)return this.read(t);let d=`"id" = $1`;i!==void 0&&(l.push(r(i)),d+=` AND "refresh_lease_until" = $${l.length}`);let{rows:f}=await e.query(`UPDATE ${a} SET ${o.join(`, `)} WHERE ${d} RETURNING *`,l);return f[0]?c(f[0]):null},async claimRefreshLease(t,n,i){let{rows:o}=await e.query(`UPDATE ${a} SET "refresh_lease_until" = $2 WHERE "id" = $1 AND ("refresh_lease_until" IS NULL OR "refresh_lease_until" <= $3) RETURNING *`,[t,r(n),r(i)]);return o[0]?c(o[0]):null},async delete(t,n){if(n===void 0){await e.query(`DELETE FROM ${a} WHERE "id" = $1`,[t]);return}await e.query(`DELETE FROM ${a} WHERE "id" = $1 AND "refresh_lease_until" = $2`,[t,r(n)])}}}export{e as PG_SESSION_TABLE_SQL,i as createPgSessionStore};

package/dist/{types-DdCYMKxG.d.ts → types-CRiqvt6N.d.ts}

@@ -24,9 +24,9 @@ type AccountsSessionPatch<Data> = Partial<Pick<AccountsSession<Data>, "user" | "
 interface AccountsSessionStore<Data> {
   create(session: AccountsSession<Data>): Promise<void>;
   read(id: string): Promise<AccountsSession<Data> | null>;
-  update(id: string, patch: AccountsSessionPatch<Data>): Promise<AccountsSession<Data> | null>;
+  update(id: string, patch: AccountsSessionPatch<Data>, ifLeaseUntil?: number): Promise<AccountsSession<Data> | null>;
   claimRefreshLease(id: string, until: number, now: number): Promise<AccountsSession<Data> | null>;
-  delete(id: string): Promise<void>;
+  delete(id: string, ifLeaseUntil?: number): Promise<void>;
 }
 type AccountsPaths = {
   login: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aui-auth",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Server side sessions for web apps that sign in through assistant-ui accounts: OIDC code flow with PKCE, tokens kept in the app's database, single flight refresh",
   "license": "MIT",
   "type": "module",
@@ -20,6 +20,10 @@
     "./pg": {
       "types": "./dist/pg.d.ts",
       "default": "./dist/pg.js"
+    },
+    "./accounts": {
+      "types": "./dist/accounts.d.ts",
+      "default": "./dist/accounts.js"
     }
   },
   "peerDependencies": {