aui-auth 0.0.2 → 0.0.4

package/README.md

@@ -1,3 +1,5 @@
 # aui-auth
 
-Internal session package for assistant-ui services. The documentation lives with the source in the assistant-internal repository.
+Server-side sessions for web apps that sign in through assistant-ui accounts: OpenID Connect with PKCE, tokens kept in the app's own database, single-flight refresh, and an encrypted cache cookie. Internal to assistant-ui; the manual is `docs/first-party-auth.md` and the design is `packages/aui-auth/ARCHITECTURE.md` in the assistant-internal repository.
+
+Entry points: `aui-auth`, `aui-auth/accounts`, `aui-auth/next`, `aui-auth/database`, `aui-auth/database/pg`.

package/dist/accounts.d.ts

@@ -1,5 +1,5 @@
-import { f as RevalidateInput, p as SignInInput } from "./types-CRiqvt6N.js";
-//#region src/accounts.d.ts
+import { m as SignInInput, p as RevalidateInput } from "./types-BcXM3ZEI.js";
+//#region src/accounts/index.d.ts
 type AccountsOrganization = {
   id: string;
   name: string;

package/dist/accounts.js

@@ -1 +1 @@
-import{t as e,u as t}from"./oidc-BIfcHoyS.js";async function n(n,r){let i=await(n.fetch??globalThis.fetch.bind(globalThis))(e(n.issuer,`/api/oidc/organizations`),{headers:{Authorization:`Bearer ${r}`},cache:`no-store`});if(!i.ok)throw new t(`Failed to load organizations: ${i.status}`,i.status);return await i.json()}function r(e,t){if(t){let n=e.find(e=>e.slug===t);if(n)return n}return e[0]??null}function i(e){let[,t]=new URL(e,`http://localhost`).pathname.split(`/`);return t&&t!==`org`?t:null}function a(e){let a=e.preferredSlug??i;async function o(t){return{activeOrganization:r(await n(e,t.accessToken),a(t.redirectPath))}}async function s(i){let a;try{a=await n(e,i.accessToken)}catch(e){if(e instanceof t&&e.status>=400&&e.status<500)return null;throw e}let o=i.session.data.activeOrganization;if(!o)return{activeOrganization:r(a)};let s=a.find(e=>e.id===o.id)??null;return s?{activeOrganization:s}:null}return{onSignIn:o,onRevalidate:s}}export{n as fetchOrganizations,a as organizationHooks,i as preferredOrganizationSlug,r as selectOrganization};
+import{a as e,m as t}from"./cache-BWpH93Oi.js";async function n(n,r){let i=await(n.fetch??globalThis.fetch.bind(globalThis))(e(n.issuer,`/api/oidc/organizations`),{headers:{Authorization:`Bearer ${r}`},cache:`no-store`});if(!i.ok)throw new t(`Failed to load organizations: ${i.status}`,i.status);return await i.json()}function r(e,t){if(t){let n=e.find(e=>e.slug===t);if(n)return n}return e[0]??null}function i(e){let[,t]=new URL(e,`http://localhost`).pathname.split(`/`);return t&&t!==`org`?t:null}function a(e){let a=e.preferredSlug??i;async function o(t){return{activeOrganization:r(await n(e,t.accessToken),a(t.redirectPath))}}async function s(i){let a;try{a=await n(e,i.accessToken)}catch(e){if(e instanceof t&&e.status>=400&&e.status<500)return null;throw e}let o=i.session.data.activeOrganization;if(!o)return{activeOrganization:r(a)};let s=a.find(e=>e.id===o.id)??null;return s?{activeOrganization:s}:null}return{onSignIn:o,onRevalidate:s}}export{n as fetchOrganizations,a as organizationHooks,i as preferredOrganizationSlug,r as selectOrganization};

package/dist/cache-BWpH93Oi.js

@@ -0,0 +1 @@
+import{t as e}from"./codec-BcgaGRoP.js";function t(e){if(!e)return;let t=e.split(`,`);return t[t.length-1].trim()||void 0}function n(e){let n=new URL(e.url);return`${t(e.headers.get(`x-forwarded-proto`))||n.protocol.replace(`:`,``)}://${t(e.headers.get(`x-forwarded-host`))||e.headers.get(`host`)||n.host}`}function r(e){return new URL(e).protocol===`https:`}function i(e,t){return t?`__Secure-${e}`:e}function a(e){let t=new Map;if(!e)return t;for(let n of e.split(`;`)){let e=n.indexOf(`=`);if(e===-1)continue;let r=n.slice(0,e).trim();!r||t.has(r)||t.set(r,n.slice(e+1).trim())}return t}function o(e,t){let n=a(e.headers.get(`cookie`));return n.get(i(t,!0))||n.get(i(t,!1))||null}function s(e,t,n,r){let i=[`${e}=${t}`,`Path=/`,`HttpOnly`,`SameSite=Lax`,`Max-Age=${r}`];return n&&i.push(`Secure`),i.join(`; `)}function c(e,t,n,a,o){let c=r(a);e.append(`set-cookie`,s(i(t,c),n,c,Math.floor(o/1e3)))}function l(e,t){let n=r(t);return[n,!n].map(t=>s(i(e,t),``,t,0))}function u(e,t,n){for(let r of l(t,n))e.append(`set-cookie`,r)}function d(e,t=307){return new Response(null,{status:t,headers:{location:e.toString()}})}function f(e,t){return`${e}_flow_${t}`}function p(e){return btoa(JSON.stringify(e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function m(e){if(!e)return null;try{let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=JSON.parse(atob(t));return typeof n.verifier==`string`?{verifier:n.verifier,redirectPath:typeof n.redirectPath==`string`?n.redirectPath:`/`,silent:n.silent===!0}:null}catch{return null}}function h(e,t){if(!e)return`/`;let n;try{n=new URL(e,t)}catch{return`/`}return n.origin===t?`${n.pathname}${n.search}${n.hash}`:`/`}const g={login:`/api/auth/login`,callback:`/api/auth/callback`,logout:`/api/auth/logout`,logoutComplete:`/api/auth/logout-complete`,error:`/auth/error`},_={absoluteMaxAgeMs:2592e6,idleMaxAgeMs:6048e5,revalidateIntervalMs:12e4,refreshBeforeExpiryMs:3e5,flowMaxAgeMs:6e5,refreshLeaseMs:2e4,leaseWaitMs:5e3},v=Object.freeze({});function y(e){return{...e,scope:e.scope??`openid profile email offline_access`,onSignIn:e.onSignIn??(async()=>v),onRevalidate:e.onRevalidate??(async()=>v),paths:{...g,...e.paths},lifetimes:{..._,...e.lifetimes},fetch:e.fetch??globalThis.fetch.bind(globalThis),now:e.now??Date.now,cache:e.cache?{codec:F(e.cache.secret),maxAgeMs:e.cache.maxAgeMs??6e4}:null,audience:e.audience===!1?null:e.audience??new URL(`/api/auth`,e.issuer).toString()}}var b=class extends Error{status;constructor(e,t){super(e),this.name=`AccountsRequestError`,this.status=t}},x=class extends b{code;description;constructor(e,t,n){super(`Token request failed: ${e} ${t} ${n}`,e),this.name=`OAuthTokenError`,this.code=t,this.description=n}};function S(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function C(e){return S(crypto.getRandomValues(new Uint8Array(e)))}async function w(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return S(new Uint8Array(t))}function T(e,t){return new URL(t,e).toString()}async function E(e,t){let n=C(24),r=C(32),i=new URL(T(e.issuer,`/api/auth/oauth2/authorize`));return i.searchParams.set(`client_id`,e.clientId),i.searchParams.set(`redirect_uri`,new URL(e.paths.callback,t.origin).toString()),i.searchParams.set(`response_type`,`code`),i.searchParams.set(`scope`,e.scope),i.searchParams.set(`state`,n),i.searchParams.set(`code_challenge`,await w(r)),i.searchParams.set(`code_challenge_method`,`S256`),t.silent&&i.searchParams.set(`prompt`,`none`),{url:i.toString(),state:n,verifier:r}}function D(e,t){let n=new URL(T(e.issuer,`/api/auth/oauth2/end-session`));return n.searchParams.set(`id_token_hint`,t.idToken),n.searchParams.set(`client_id`,e.clientId),n.searchParams.set(`post_logout_redirect_uri`,new URL(e.paths.logoutComplete,t.origin).toString()),n.toString()}async function O(e,t,n,r=!0){let i=new URLSearchParams({client_id:e.clientId,...t});e.clientSecret&&i.set(`client_secret`,e.clientSecret),e.audience&&r&&i.set(`resource`,e.audience);let a=n===void 0?void 0:n-Date.now();if(a!==void 0&&a<=0)throw new b(`Token request deadline passed`,0);let o=await e.fetch(T(e.issuer,`/api/auth/oauth2/token`),{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:i,cache:`no-store`,...a?{signal:AbortSignal.timeout(a)}:{}});if(!o.ok){let i=await o.text().catch(()=>``),a=`unknown_error`,s=i;try{let e=JSON.parse(i);a=e.error??a,s=e.error_description??s}catch{}if(r&&e.audience&&a===`invalid_request`&&/resource/i.test(s))return O(e,t,n,!1);throw new x(o.status,a,s)}return await o.json()}function k(e,t){return O(e,{grant_type:`authorization_code`,code:t.code,code_verifier:t.verifier,redirect_uri:t.redirectUri})}function A(e,t,n){return O(e,{grant_type:`refresh_token`,refresh_token:t},n===void 0?void 0:Date.now()+n)}async function j(e,t){let n=await(e.fetch??globalThis.fetch.bind(globalThis))(T(e.issuer,`/api/auth/oauth2/userinfo`),{headers:{Authorization:`Bearer ${t}`},cache:`no-store`});if(!n.ok)throw new b(`Failed to load user info: ${n.status}`,n.status);let r=await n.json();return{id:r.sub,email:r.email??``,name:r.name??r.email??r.sub,image:r.picture??null}}function M(e,t,n){return{accessToken:e.access_token,refreshToken:e.refresh_token??t?.refreshToken??null,idToken:e.id_token??t?.idToken??null,accessTokenExpiresAt:typeof e.expires_at==`number`?e.expires_at*1e3:n+(e.expires_in??3600)*1e3}}function N(e){return`${e}_cache`}function P(e){let t=``;for(let n of e)t+=n.toString(16).padStart(2,`0`);return t}function F(t){let n=null;return()=>n??=crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(t)).then(t=>e(P(new Uint8Array(t))))}function I(e,t,n){if(!e.cache)return 0;let{lifetimes:r}=e;return Math.min(e.cache.maxAgeMs,t.lastValidatedAt+r.revalidateIntervalMs-n,t.tokens.accessTokenExpiresAt-r.refreshBeforeExpiryMs-n,t.createdAt+r.absoluteMaxAgeMs-n,t.lastValidatedAt+r.idleMaxAgeMs-n)}async function L(e,t,n){if(!e.cache)return null;let r=I(e,t,n);if(r<1e3)return null;let i={v:1,id:t.id,u:t.user,d:t.data,at:t.tokens.accessToken,ate:t.tokens.accessTokenExpiresAt,ca:t.createdAt,lv:t.lastValidatedAt,exp:n+r};return{value:await(await e.cache.codec()).encrypt(JSON.stringify(i)),maxAgeMs:r}}async function R(e,t,n,r){if(!e.cache||!t||!n)return null;let i;try{let n=await e.cache.codec();i=JSON.parse(await n.decrypt(t))}catch{return null}return i.v!==1||typeof i.exp!=`number`||i.exp<=r||i.id!==await w(n)?null:{id:i.id,user:i.u,tokens:{accessToken:i.at,refreshToken:null,idToken:null,accessTokenExpiresAt:i.ate},data:i.d,createdAt:i.ca,lastValidatedAt:i.lv,refreshLeaseUntil:null}}async function z(e,t,n,a){let o=await L(e,t,a);if(!o)return null;let c=r(n);return s(i(N(e.cookieName),c),o.value,c,Math.floor(o.maxAgeMs/1e3))}function B(e,t){return e.cache?l(N(e.cookieName),t):[]}export{o as C,c as D,h as E,f as S,n as T,u as _,T as a,m as b,k as c,A as d,w as f,y as g,x as h,R as i,j as l,b as m,N as n,E as o,M as p,z as r,D as s,B as t,C as u,l as v,d as w,p as x,i as y};

package/dist/codec-BcgaGRoP.js

@@ -0,0 +1 @@
+function e(e){let t=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)t[n/2]=Number.parseInt(e.slice(n,n+2),16);return t}function t(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function n(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=t+`=`.repeat((4-t.length%4)%4),r;try{r=atob(n)}catch{throw Error(`Malformed encrypted value`)}let i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function r(r){if(!/^[0-9a-fA-F]{64}$/.test(r))throw Error(`AES-GCM codec key must be 64 hex characters (32 bytes)`);let i=e(r),a=null,o=()=>a??=crypto.subtle.importKey(`raw`,i,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`]);return{async encrypt(e){let n=crypto.getRandomValues(new Uint8Array(12)),r=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},await o(),new TextEncoder().encode(e))),i=new Uint8Array(12+r.length);return i.set(n),i.set(r,12),t(i)},async decrypt(e){let t=n(e);if(t.length<28)throw Error(`Malformed encrypted value`);let r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:t.subarray(0,12)},await o(),t.subarray(12));return new TextDecoder().decode(r)}}}export{r as t};

package/dist/database/index.d.ts

@@ -0,0 +1,2 @@
+import { c as AccountsSessionStore, g as createAesGcmCodec, h as SessionCodec, l as AccountsTokens, o as AccountsSession, s as AccountsSessionPatch, u as AccountsUser } from "../types-BcXM3ZEI.js";
+export { type AccountsSession, type AccountsSessionPatch, type AccountsSessionStore, type AccountsTokens, type AccountsUser, type SessionCodec, createAesGcmCodec };

package/dist/database/index.js

@@ -0,0 +1 @@
+import{t as e}from"../codec-BcgaGRoP.js";export{e as createAesGcmCodec};

package/dist/{pg.d.ts → database/pg.d.ts}

@@ -1,15 +1,12 @@
-import { s as AccountsSessionStore } from "./types-CRiqvt6N.js";
-//#region src/pg.d.ts
+import { c as AccountsSessionStore, h as SessionCodec } from "../types-BcXM3ZEI.js";
+//#region src/database/pg.d.ts
 type PgQuery = (text: string, values?: unknown[]) => Promise<{
   rows: Record<string, unknown>[];
 }>;
 type PgSessionStoreOptions = {
   query: PgQuery;
   table?: string;
-  codec?: {
-    encrypt(value: string): Promise<string>;
-    decrypt(value: string): Promise<string>;
-  };
+  codec?: SessionCodec;
 };
 declare const PG_SESSION_TABLE_SQL = "CREATE TABLE \"accounts_sessions\" (\n  \"id\" text PRIMARY KEY,\n  \"user_id\" text NOT NULL,\n  \"user\" jsonb NOT NULL,\n  \"access_token\" text NOT NULL,\n  \"refresh_token\" text,\n  \"id_token\" text,\n  \"access_token_expires_at\" timestamp with time zone NOT NULL,\n  \"data\" jsonb NOT NULL,\n  \"created_at\" timestamp with time zone NOT NULL,\n  \"last_validated_at\" timestamp with time zone NOT NULL,\n  \"refresh_lease_until\" timestamp with time zone\n);\nCREATE INDEX \"accounts_sessions_user_id_idx\" ON \"accounts_sessions\" (\"user_id\");";
 declare function createPgSessionStore<Data>(options: PgSessionStoreOptions): AccountsSessionStore<Data>;

package/dist/{pg.js → database/pg.js}

@@ -11,4 +11,4 @@ const e=`CREATE TABLE "accounts_sessions" (
   "last_validated_at" timestamp with time zone NOT NULL,
   "refresh_lease_until" timestamp with time zone
 );
-CREATE INDEX "accounts_sessions_user_id_idx" ON "accounts_sessions" ("user_id");`,t={encrypt:async e=>e,decrypt:async e=>e};function n(e){if(e instanceof Date)return e.getTime();if(typeof e==`string`)return new Date(e).getTime();if(typeof e==`number`)return e;throw Error(`Unexpected timestamp value in accounts session row`)}function r(e){return new Date(e)}function i(e){let i=e.table??`accounts_sessions`;if(!/^[a-z_][a-z0-9_]*$/.test(i))throw Error(`Invalid accounts session table name: ${i}`);let a=`"${i}"`,o=e.codec??t;async function s(e){return{accessToken:await o.encrypt(e.accessToken),refreshToken:e.refreshToken?await o.encrypt(e.refreshToken):null,idToken:e.idToken?await o.encrypt(e.idToken):null}}async function c(e){return{id:e.id,user:e.user,tokens:{accessToken:await o.decrypt(e.access_token),refreshToken:e.refresh_token?await o.decrypt(e.refresh_token):null,idToken:e.id_token?await o.decrypt(e.id_token):null,accessTokenExpiresAt:n(e.access_token_expires_at)},data:e.data,createdAt:n(e.created_at),lastValidatedAt:n(e.last_validated_at),refreshLeaseUntil:e.refresh_lease_until===null||e.refresh_lease_until===void 0?null:n(e.refresh_lease_until)}}return{async create(t){let n=await s(t.tokens);await e.query(`INSERT INTO ${a} ("id", "user_id", "user", "access_token", "refresh_token", "id_token", "access_token_expires_at", "data", "created_at", "last_validated_at", "refresh_lease_until") VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, NULL)`,[t.id,t.user.id,JSON.stringify(t.user),n.accessToken,n.refreshToken,n.idToken,r(t.tokens.accessTokenExpiresAt),JSON.stringify(t.data),r(t.createdAt),r(t.lastValidatedAt)])},async read(t){let{rows:n}=await e.query(`SELECT * FROM ${a} WHERE "id" = $1`,[t]);return n[0]?c(n[0]):null},async update(t,n,i){let o=[],l=[t],u=(e,t)=>{l.push(t),o.push(`"${e}" = $${l.length}`)};if(n.user!==void 0&&(u(`user_id`,n.user.id),u(`user`,JSON.stringify(n.user))),n.tokens!==void 0){let e=await s(n.tokens);u(`access_token`,e.accessToken),u(`refresh_token`,e.refreshToken),u(`id_token`,e.idToken),u(`access_token_expires_at`,r(n.tokens.accessTokenExpiresAt))}if(n.data!==void 0&&u(`data`,JSON.stringify(n.data)),n.lastValidatedAt!==void 0&&u(`last_validated_at`,r(n.lastValidatedAt)),n.refreshLeaseUntil!==void 0&&u(`refresh_lease_until`,n.refreshLeaseUntil===null?null:r(n.refreshLeaseUntil)),o.length===0)return this.read(t);let d=`"id" = $1`;i!==void 0&&(l.push(r(i)),d+=` AND "refresh_lease_until" = $${l.length}`);let{rows:f}=await e.query(`UPDATE ${a} SET ${o.join(`, `)} WHERE ${d} RETURNING *`,l);return f[0]?c(f[0]):null},async claimRefreshLease(t,n,i){let{rows:o}=await e.query(`UPDATE ${a} SET "refresh_lease_until" = $2 WHERE "id" = $1 AND ("refresh_lease_until" IS NULL OR "refresh_lease_until" <= $3) RETURNING *`,[t,r(n),r(i)]);return o[0]?c(o[0]):null},async delete(t,n){if(n===void 0){await e.query(`DELETE FROM ${a} WHERE "id" = $1`,[t]);return}await e.query(`DELETE FROM ${a} WHERE "id" = $1 AND "refresh_lease_until" = $2`,[t,r(n)])}}}export{e as PG_SESSION_TABLE_SQL,i as createPgSessionStore};
+CREATE INDEX "accounts_sessions_user_id_idx" ON "accounts_sessions" ("user_id");`,t={encrypt:async e=>e,decrypt:async e=>e};function n(e){if(e instanceof Date)return e.getTime();if(typeof e==`string`)return new Date(e).getTime();if(typeof e==`number`)return e;throw Error(`Unexpected timestamp value in accounts session row`)}function r(e){return new Date(e)}function i(e){let i=e.table??`accounts_sessions`;if(!/^[a-z_][a-z0-9_]*$/.test(i))throw Error(`Invalid accounts session table name: ${i}`);let a=`"${i}"`,o=e.codec??t;async function s(e){return{accessToken:await o.encrypt(e.accessToken),refreshToken:e.refreshToken?await o.encrypt(e.refreshToken):null,idToken:e.idToken?await o.encrypt(e.idToken):null}}async function c(e){return{id:e.id,user:e.user,tokens:{accessToken:await o.decrypt(e.access_token),refreshToken:e.refresh_token?await o.decrypt(e.refresh_token):null,idToken:e.id_token?await o.decrypt(e.id_token):null,accessTokenExpiresAt:n(e.access_token_expires_at)},data:e.data,createdAt:n(e.created_at),lastValidatedAt:n(e.last_validated_at),refreshLeaseUntil:e.refresh_lease_until===null||e.refresh_lease_until===void 0?null:n(e.refresh_lease_until)}}return{async create(t){let n=await s(t.tokens);await e.query(`INSERT INTO ${a} ("id", "user_id", "user", "access_token", "refresh_token", "id_token", "access_token_expires_at", "data", "created_at", "last_validated_at", "refresh_lease_until") VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, NULL)`,[t.id,t.user.id,t.user,n.accessToken,n.refreshToken,n.idToken,r(t.tokens.accessTokenExpiresAt),t.data,r(t.createdAt),r(t.lastValidatedAt)])},async read(t){let{rows:n}=await e.query(`SELECT * FROM ${a} WHERE "id" = $1`,[t]);return n[0]?c(n[0]):null},async update(t,n,i){let o=[],l=[t],u=(e,t)=>{l.push(t),o.push(`"${e}" = $${l.length}`)};if(n.user!==void 0&&(u(`user_id`,n.user.id),u(`user`,n.user)),n.tokens!==void 0){let e=await s(n.tokens);u(`access_token`,e.accessToken),u(`refresh_token`,e.refreshToken),u(`id_token`,e.idToken),u(`access_token_expires_at`,r(n.tokens.accessTokenExpiresAt))}if(n.data!==void 0&&u(`data`,n.data),n.lastValidatedAt!==void 0&&u(`last_validated_at`,r(n.lastValidatedAt)),n.refreshLeaseUntil!==void 0&&u(`refresh_lease_until`,n.refreshLeaseUntil===null?null:r(n.refreshLeaseUntil)),o.length===0)return this.read(t);let d=`"id" = $1`;i!==void 0&&(l.push(r(i)),d+=` AND "refresh_lease_until" = $${l.length}`);let{rows:f}=await e.query(`UPDATE ${a} SET ${o.join(`, `)} WHERE ${d} RETURNING *`,l);return f[0]?c(f[0]):null},async claimRefreshLease(t,n,i){let{rows:o}=await e.query(`UPDATE ${a} SET "refresh_lease_until" = $2 WHERE "id" = $1 AND ("refresh_lease_until" IS NULL OR "refresh_lease_until" <= $3) RETURNING *`,[t,r(n),r(i)]);return o[0]?c(o[0]):null},async delete(t,n){if(n===void 0){let{rows:n}=await e.query(`DELETE FROM ${a} WHERE "id" = $1 RETURNING "id"`,[t]);return n.length>0}let{rows:i}=await e.query(`DELETE FROM ${a} WHERE "id" = $1 AND "refresh_lease_until" = $2 RETURNING "id"`,[t,r(n)]);return i.length>0}}}export{e as PG_SESSION_TABLE_SQL,i as createPgSessionStore};

package/dist/database/redis.d.ts

@@ -0,0 +1,34 @@
+import { c as AccountsSessionStore, h as SessionCodec } from "../types-BcXM3ZEI.js";
+//#region src/database/redis.d.ts
+/**
+ * The slice of a Redis client this store uses, so the package takes no Redis
+ * dependency of its own. The shape is `@upstash/redis`, which satisfies it
+ * directly. A client whose `eval` takes a key count and a flat argument list,
+ * ioredis for one, needs an adapter:
+ *
+ * ```ts
+ * const redis = {
+ *   hgetall: (key) => client.hgetall(key),
+ *   eval: (script, keys, args) =>
+ *     client.eval(script, keys.length, ...keys, ...args),
+ * };
+ * ```
+ */
+type RedisSessionClient = {
+  hgetall(key: string): Promise<Record<string, unknown> | null>;
+  eval(script: string, keys: string[], args: string[]): Promise<unknown>;
+};
+type RedisSessionStoreOptions = {
+  redis: RedisSessionClient;
+  codec?: SessionCodec;
+  /** Key prefix. One prefix per app, the way one table is one app. */
+  prefix?: string;
+  /**
+   * Key expiry, garbage collection only: it is renewed on every write and
+   * sessions carry their own limits, so it only has to exceed `idleMaxAgeMs`.
+   */
+  ttlMs?: number;
+};
+declare function createRedisSessionStore<Data>(options: RedisSessionStoreOptions): AccountsSessionStore<Data>;
+//#endregion
+export { RedisSessionClient, RedisSessionStoreOptions, createRedisSessionStore };

package/dist/database/redis.js

@@ -0,0 +1,43 @@
+const e=`refreshLeaseUntil`,t=`
+local key, checkLease, expectedLease, ttl = KEYS[1], ARGV[1], ARGV[2], ARGV[3]
+if redis.call('EXISTS', key) == 0 then return 0 end
+if checkLease == '1' then
+  local current = redis.call('HGET', key, '${e}')
+  if (current or '') ~= expectedLease then return 0 end
+end
+for index = 4, #ARGV, 2 do
+  if ARGV[index + 1] == '' then
+    redis.call('HDEL', key, ARGV[index])
+  else
+    redis.call('HSET', key, ARGV[index], ARGV[index + 1])
+  end
+end
+redis.call('PEXPIRE', key, ttl)
+return 1
+`,n=`
+local key, leaseUntil, now, ttl = KEYS[1], ARGV[1], ARGV[2], ARGV[3]
+if redis.call('EXISTS', key) == 0 then return nil end
+local current = redis.call('HGET', key, '${e}')
+if current and current ~= '' and tonumber(current) > tonumber(now) then
+  return nil
+end
+redis.call('HSET', key, '${e}', leaseUntil)
+redis.call('PEXPIRE', key, ttl)
+return redis.call('HGETALL', key)
+`,r=`
+local key, checkLease, expectedLease = KEYS[1], ARGV[1], ARGV[2]
+if redis.call('EXISTS', key) == 0 then return 0 end
+if checkLease == '1' then
+  local current = redis.call('HGET', key, '${e}')
+  if (current or '') ~= expectedLease then return 0 end
+end
+redis.call('DEL', key)
+return 1
+`,i={encrypt:async e=>e,decrypt:async e=>e};function a(e){return e==null||e===``?null:typeof e==`string`?e:JSON.stringify(e)}function o(e){let t=a(e),n=t===null?NaN:Number(t);if(!Number.isFinite(n))throw Error(`Unexpected timestamp in accounts session hash`);return n}function s(e){if(typeof e!=`string`)return e;try{return JSON.parse(e)}catch{return e}}function c(e){if(!e)return null;if(Array.isArray(e)){if(e.length===0)return null;let t={};for(let n=0;n<e.length;n+=2)t[String(e[n])]=e[n+1];return t}let t=e;return Object.keys(t).length>0?t:null}function l(l){let{redis:u}=l,d=l.codec??i,f=l.prefix??`accounts_sessions:`,p=l.ttlMs??26784e5,m=e=>`${f}${e}`;async function h(t){let n={};if(t.user&&(n.user=JSON.stringify(t.user)),t.data!==void 0&&(n.data=JSON.stringify(t.data)),t.lastValidatedAt!==void 0&&(n.lastValidatedAt=String(t.lastValidatedAt)),t.refreshLeaseUntil!==void 0&&(n[e]=t.refreshLeaseUntil===null?``:String(t.refreshLeaseUntil)),t.tokens){let{accessToken:e,refreshToken:r,idToken:i,accessTokenExpiresAt:a}=t.tokens;n.accessToken=await d.encrypt(e),n.refreshToken=r?await d.encrypt(r):``,n.idToken=i?await d.encrypt(i):``,n.accessTokenExpiresAt=String(a)}return n}async function g(t,n){let r=a(n.refreshToken),i=a(n.idToken),c=a(n[e]);return{id:t,user:s(n.user),tokens:{accessToken:await d.decrypt(a(n.accessToken)??``),refreshToken:r?await d.decrypt(r):null,idToken:i?await d.decrypt(i):null,accessTokenExpiresAt:o(n.accessTokenExpiresAt)},data:s(n.data),createdAt:o(n.createdAt),lastValidatedAt:o(n.lastValidatedAt),refreshLeaseUntil:c===null?null:Number(c)}}async function _(e){let t=c(await u.hgetall(m(e)));return t?g(e,t):null}return{async create(e){let t=await h(e);t.createdAt=String(e.createdAt);let n=Object.entries(t).filter(([,e])=>e!==``);await u.eval(`
+local key, ttl = KEYS[1], ARGV[1]
+for index = 2, #ARGV, 2 do
+  redis.call('HSET', key, ARGV[index], ARGV[index + 1])
+end
+redis.call('PEXPIRE', key, ttl)
+return 1
+`,[m(e.id)],[String(p),...n.flat()])},read:_,async update(e,n,r){let i=await h(n),a=await u.eval(t,[m(e)],[r===void 0?`0`:`1`,r===void 0?``:String(r),String(p),...Object.entries(i).flat()]);return Number(a)===1?_(e):null},async claimRefreshLease(e,t,r){let i=c(await u.eval(n,[m(e)],[String(t),String(r),String(p)]));return i?g(e,i):null},async delete(e,t){let n=await u.eval(r,[m(e)],[t===void 0?`0`:`1`,t===void 0?``:String(t)]);return Number(n)===1}}}export{l as createRedisSessionStore};

package/dist/{index-CICWi97l.d.ts → index-CZZ3DRlf.d.ts}

@@ -1,5 +1,19 @@
-import { a as AccountsSession, c as AccountsTokens, d as ResolvedAccountsAuthConfig, l as AccountsUser, s as AccountsSessionStore, t as AccountsAuthConfig } from "./types-CRiqvt6N.js";
-//#region src/guard.d.ts
+import { c as AccountsSessionStore, f as ResolvedAccountsAuthConfig, l as AccountsTokens, o as AccountsSession, t as AccountsAuthConfig, u as AccountsUser } from "./types-BcXM3ZEI.js";
+//#region src/core/cookies.d.ts
+declare function requestOrigin(request: Request): string;
+declare function sanitizeRedirectPath(rawRedirect: string | null | undefined, origin: string): string;
+//#endregion
+//#region src/core/oidc.d.ts
+declare function accountsEndpoint(issuer: string, path: string): string;
+declare function fetchUserInfo(options: {
+  issuer: string;
+  fetch?: typeof fetch;
+}, accessToken: string): Promise<AccountsUser>;
+//#endregion
+//#region src/core/cache.d.ts
+declare function cacheCookieBase(sessionCookie: string): string;
+//#endregion
+//#region src/core/guard.d.ts
 type GuardOptions = {
   publicPaths?: string[];
   apiPaths?: string[];
@@ -8,24 +22,32 @@ type GuardOptions = {
 type GuardResult<Data> = {
   kind: "ok";
   session: AccountsSession<Data> | null;
+  cookies?: string[];
 } | {
   kind: "response";
   response: Response;
 };
 //#endregion
-//#region src/cookies.d.ts
-declare function requestOrigin(request: Request): string;
-declare function sanitizeRedirectPath(rawRedirect: string | null | undefined, origin: string): string;
-//#endregion
-//#region src/oidc.d.ts
-declare function accountsEndpoint(issuer: string, path: string): string;
+//#region src/core/resolve.d.ts
+type SessionResolution<Data> = {
+  session: AccountsSession<Data> | null;
+  /**
+   * The Set-Cookie headers to attach to the response: the cache cookie while
+   * the session is alive, the cookies that clear a session that is gone.
+   */
+  cookies: string[];
+};
 //#endregion
-//#region src/store/memory.d.ts
+//#region src/core/store/memory.d.ts
 declare function createMemorySessionStore<Data>(): AccountsSessionStore<Data> & {
   rows: Map<string, AccountsSession<Data>>;
 };
 //#endregion
 //#region src/index.d.ts
+type SessionCookies = {
+  session: string | null;
+  cache: string | null;
+};
 declare function createAccountsAuth<Data>(input: AccountsAuthConfig<Data>): {
   config: ResolvedAccountsAuthConfig<Data>;
   sessions: {
@@ -48,12 +70,15 @@ declare function createAccountsAuth<Data>(input: AccountsAuthConfig<Data>): {
     logout: (request: Request) => Promise<Response>;
   };
   guard: (request: Request, options?: GuardOptions) => Promise<GuardResult<Data>>;
+  resolveSession: (request: Request) => Promise<SessionResolution<Data>>;
   sessionFromCookie: (cookieValue: string | null) => Promise<AccountsSession<Data> | null>;
+  sessionFromCookies: (cookies: SessionCookies) => Promise<AccountsSession<Data> | null>;
   sessionFromRequest: (request: Request) => Promise<AccountsSession<Data> | null>;
   accessTokenFromCookie: (cookieValue: string | null) => Promise<string | null>;
+  accessTokenFromCookies: (cookies: SessionCookies) => Promise<string | null>;
   accessTokenFromRequest: (request: Request) => Promise<string | null>;
   updateSessionData: (cookieValue: string | null, update: (data: Data) => Data) => Promise<AccountsSession<Data> | null>;
 };
 type AccountsAuth<Data> = ReturnType<typeof createAccountsAuth<Data>>;
 //#endregion
-export { requestOrigin as a, GuardResult as c, accountsEndpoint as i, createAccountsAuth as n, sanitizeRedirectPath as o, createMemorySessionStore as r, GuardOptions as s, AccountsAuth as t };
+export { SessionResolution as a, cacheCookieBase as c, requestOrigin as d, sanitizeRedirectPath as f, createMemorySessionStore as i, accountsEndpoint as l, SessionCookies as n, GuardOptions as o, createAccountsAuth as r, GuardResult as s, AccountsAuth as t, fetchUserInfo as u };

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { a as AccountsSession, c as AccountsTokens, f as RevalidateInput, i as AccountsRequestError, l as AccountsUser, n as AccountsLifetimes, o as AccountsSessionPatch, p as SignInInput, r as AccountsPaths, s as AccountsSessionStore, t as AccountsAuthConfig, u as OAuthTokenError } from "./types-CRiqvt6N.js";
-import { a as requestOrigin, c as GuardResult, i as accountsEndpoint, n as createAccountsAuth, o as sanitizeRedirectPath, r as createMemorySessionStore, s as GuardOptions, t as AccountsAuth } from "./index-CICWi97l.js";
-export { AccountsAuth, type AccountsAuthConfig, type AccountsLifetimes, type AccountsPaths, AccountsRequestError, type AccountsSession, type AccountsSessionPatch, type AccountsSessionStore, type AccountsTokens, type AccountsUser, type GuardOptions, type GuardResult, OAuthTokenError, type RevalidateInput, type SignInInput, accountsEndpoint, createAccountsAuth, createMemorySessionStore, requestOrigin, sanitizeRedirectPath };
+import { a as AccountsRequestError, c as AccountsSessionStore, d as OAuthTokenError, i as AccountsPaths, l as AccountsTokens, m as SignInInput, n as AccountsCacheConfig, o as AccountsSession, p as RevalidateInput, r as AccountsLifetimes, s as AccountsSessionPatch, t as AccountsAuthConfig, u as AccountsUser } from "./types-BcXM3ZEI.js";
+import { a as SessionResolution, c as cacheCookieBase, d as requestOrigin, f as sanitizeRedirectPath, i as createMemorySessionStore, l as accountsEndpoint, n as SessionCookies, o as GuardOptions, r as createAccountsAuth, s as GuardResult, t as AccountsAuth, u as fetchUserInfo } from "./index-CZZ3DRlf.js";
+export { AccountsAuth, type AccountsAuthConfig, type AccountsCacheConfig, type AccountsLifetimes, type AccountsPaths, AccountsRequestError, type AccountsSession, type AccountsSessionPatch, type AccountsSessionStore, type AccountsTokens, type AccountsUser, type GuardOptions, type GuardResult, OAuthTokenError, type RevalidateInput, SessionCookies, type SessionResolution, type SignInInput, accountsEndpoint, cacheCookieBase, createAccountsAuth, createMemorySessionStore, fetchUserInfo, requestOrigin, sanitizeRedirectPath };

package/dist/index.js

@@ -1 +1 @@
-import{a as e,c as t,i as n,l as r,o as i,r as a,s as o,t as s,u as c}from"./cookies-D3lpM5ER.js";import{a as l,c as u,d,f,i as p,l as m,n as h,o as g,r as _,s as v,t as y,u as b}from"./oidc-BIfcHoyS.js";function x(e,n){return async function(t,a={}){let o=new URL(t.url);if((a.publicPaths??[e.paths.login,e.paths.callback,e.paths.error]).some(e=>o.pathname.startsWith(e)))return{kind:`ok`,session:null};let s=i(t,e.cookieName),c=await n.load(s);if(!c)return r(t,a,s!==null);let l=c;try{let e=await n.revalidate(c);if(!e)return r(t,a,!0);l=e}catch{return{kind:`ok`,session:l}}if(l.tokens.accessTokenExpiresAt<=e.now()){let e=await n.ensureFreshTokens(l).catch(()=>l);if(!e)return r(t,a,!0);l=e}return{kind:`ok`,session:l}};function r(n,r,i){let a=t(n),c=new URL(n.url);if((r.apiPaths??[`/api`,`/trpc`]).some(e=>c.pathname.startsWith(e))){let t=Response.json({error:`Unauthorized`},{status:401});return i&&s(t.headers,e.cookieName,a),{kind:`response`,response:t}}let l=r.redirectPath?.(n)??`${c.pathname}${c.search}`,u=new URL(e.paths.login,a);u.searchParams.set(`redirect`,l),i&&u.searchParams.set(`silent`,`1`);let d=o(u);return i&&s(d.headers,e.cookieName,a),{kind:`response`,response:d}}}const S=/^[A-Za-z0-9_-]{1,128}$/,C=new Set([`login_required`,`consent_required`,`interaction_required`,`account_selection_required`]);function w(u,d){function f(e,t){let n=new URL(u.paths.login,e);return n.searchParams.set(`redirect`,t),n}function g(e,t,n){let r=new URL(u.paths.error,e);return r.searchParams.set(`reason`,t),n&&r.searchParams.set(`description`,n),r}async function v(i){let a=t(i),s=new URL(i.url).searchParams,l=r(s.get(`redirect`),a),d=s.get(`silent`)===`1`,{url:f,state:p,verifier:m}=await h(u,{origin:a,silent:d}),g=o(f);return c(g.headers,e(u.cookieName,p),n({verifier:m,redirectPath:l,silent:d}),a,u.lifetimes.flowMaxAgeMs),g}async function y(n){let h=t(n),_=new URL(n.url).searchParams,v=_.get(`state`),y=v&&S.test(v)?e(u.cookieName,v):null,b=y?a(i(n,y)):null,x=e=>(y&&s(e.headers,y,h),e);if(!b)return x(o(g(h,`invalid_state`,null)));let w=r(b.redirectPath,h),T=_.get(`error`);if(T)return b.silent&&C.has(T)?x(o(f(h,w))):x(o(g(h,T,_.get(`error_description`))));let E=_.get(`code`);if(!E)return x(o(g(h,`invalid_request`,null)));let D=await p(u,{code:E,verifier:b.verifier,redirectUri:new URL(u.paths.callback,h).toString()}),O=m(D,null,u.now()),k=await l(u,O.accessToken),A=await u.onSignIn({user:k,accessToken:O.accessToken,redirectPath:w,previous:null});if(A===null)return x(o(g(h,`access_denied`,null)));let{cookieValue:j}=await d.start({user:k,tokens:O,data:A}),M=o(new URL(w,h));return c(M.headers,u.cookieName,j,h,u.lifetimes.absoluteMaxAgeMs),x(M)}async function b(e){let n=t(e),r=await d.load(i(e,u.cookieName));r&&await d.end(r);let a=r?.tokens.idToken?_(u,{origin:n,idToken:r.tokens.idToken}):new URL(u.paths.logoutComplete,n).toString(),c=o(a,303);return s(c.headers,u.cookieName,n),c}return{login:v,callback:y,logout:b}}const T=e=>new Promise(t=>setTimeout(t,e));function E(e){let{store:t,lifetimes:n}=e;function r(e,t){return t-e.createdAt>=n.absoluteMaxAgeMs||t-e.lastValidatedAt>=n.idleMaxAgeMs}function i(e,t){return e.accessTokenExpiresAt-t<=n.refreshBeforeExpiryMs}async function a(n){if(!n)return null;let i=await t.read(await u(n));return i?r(i,e.now())?(await t.delete(i.id),null):i:null}async function o(n){let r=g(32),i=e.now(),a={id:await u(r),user:n.user,tokens:n.tokens,data:n.data,createdAt:i,lastValidatedAt:i,refreshLeaseUntil:null};return await t.create(a),{session:a,cookieValue:r}}async function s(r){let a=e.now();if(!i(r.tokens,a))return r;if(!r.tokens.refreshToken)return await t.delete(r.id),null;let o=await t.claimRefreshLease(r.id,a+n.refreshLeaseMs,a);if(!o)return c(r.id,a);let s=o.refreshLeaseUntil??void 0;if(!i(o.tokens,a))return await t.update(o.id,{refreshLeaseUntil:null},s)??t.read(o.id);try{let r=await v(e,o.tokens.refreshToken,Math.max(n.refreshLeaseMs-1e3,n.refreshLeaseMs/2));return await t.update(o.id,{tokens:m(r,o.tokens,e.now()),refreshLeaseUntil:null},s)??t.read(o.id)}catch(n){if(n instanceof d&&n.code===`invalid_grant`)return await t.delete(o.id,s),await t.read(o.id)??null;let r=await t.update(o.id,{refreshLeaseUntil:null},s);if(o.tokens.accessTokenExpiresAt>e.now())return r??o;throw n}}async function c(r,a){for(;;){await T(100);let o=await t.read(r);if(!o)return null;let c=e.now();if(!i(o.tokens,c))return o;if(o.refreshLeaseUntil===null||o.refreshLeaseUntil<=c)return s(o);if(c-a>=n.leaseWaitMs){if(o.tokens.accessTokenExpiresAt>c)return o;throw new b(`Timed out waiting for the session refresh lease`,0)}}}async function l(r){if(e.now()-r.lastValidatedAt<n.revalidateIntervalMs)return r;let i=await s(r);if(!i)return null;let a=await e.onRevalidate({session:i,accessToken:i.tokens.accessToken});return a===null?(await t.delete(i.id),null):t.update(i.id,{data:a,lastValidatedAt:e.now()})}async function f(e){await t.delete(e.id)}return{load:a,start:o,ensureFreshTokens:s,revalidate:l,end:f}}function D(){let e=new Map;return{rows:e,async create(t){e.set(t.id,structuredClone(t))},async read(t){let n=e.get(t);return n?structuredClone(n):null},async update(t,n,r){let i=e.get(t);if(!i||r!==void 0&&i.refreshLeaseUntil!==r)return null;let a=structuredClone({...i,...n});return e.set(t,a),structuredClone(a)},async claimRefreshLease(t,n,r){let i=e.get(t);if(!i||i.refreshLeaseUntil!==null&&i.refreshLeaseUntil>r)return null;let a={...i,refreshLeaseUntil:n};return e.set(t,a),structuredClone(a)},async delete(t,n){let r=e.get(t);r&&(n===void 0||r.refreshLeaseUntil===n)&&e.delete(t)}}}function O(e){let t=f(e),n=E(t),r=w(t,n),a=x(t,n);async function o(e){return n.load(e)}async function s(e){return o(i(e,t.cookieName))}async function c(e){let t=await n.load(e);return t?(await n.ensureFreshTokens(t))?.tokens.accessToken??null:null}async function l(e){return c(i(e,t.cookieName))}async function u(e,r){let i=await n.load(e);return i?t.store.update(i.id,{data:r(i.data)}):null}return{config:t,sessions:n,handlers:r,guard:a,sessionFromCookie:o,sessionFromRequest:s,accessTokenFromCookie:c,accessTokenFromRequest:l,updateSessionData:u}}export{b as AccountsRequestError,d as OAuthTokenError,y as accountsEndpoint,O as createAccountsAuth,D as createMemorySessionStore,t as requestOrigin,r as sanitizeRedirectPath};
+import{C as e,D as t,E as n,S as r,T as i,_ as a,a as o,b as s,c,d as l,f as u,g as d,h as f,i as p,l as m,m as h,n as g,o as _,p as v,r as y,s as b,t as x,u as S,v as C,w,x as T}from"./cache-BWpH93Oi.js";function E(e,t){return[...C(e.cookieName,t),...x(e,t)]}function D(t,n){return async function(r){let a=i(r),o=e(r,t.cookieName),s=e(r,g(t.cookieName)),c=await p(t,s,o,t.now());if(c)return{session:c,cookies:[]};let l={session:null,cookies:o!==null||s!==null?E(t,a):[]},u=await n.load(o);if(!u)return l;let d=u;try{let e=await n.revalidate(u);if(!e)return l;d=e}catch{return{session:d,cookies:[]}}if(d.tokens.accessTokenExpiresAt<=t.now()){let e=await n.ensureFreshTokens(d).catch(()=>d);if(!e)return l;d=e}let f=await y(t,d,a,t.now());return{session:d,cookies:f?[f]:[]}}}function O(e,t){let n=D(e,t);return async function(t,i={}){let a=new URL(t.url);if((i.publicPaths??[e.paths.login,e.paths.callback,e.paths.error]).some(e=>a.pathname.startsWith(e)))return{kind:`ok`,session:null};let{session:o,cookies:s}=await n(t);return o?s.length>0?{kind:`ok`,session:o,cookies:s}:{kind:`ok`,session:o}:r(t,i,s)};function r(e,t,n){let r=n.length>0,i=new URL(e.url),o=(t.apiPaths??[`/api`,`/trpc`]).some(e=>i.pathname.startsWith(e))?Response.json({error:`Unauthorized`},{status:401}):w(a(e,t,r));for(let e of n)o.headers.append(`set-cookie`,e);return{kind:`response`,response:o}}function a(t,n,r){let a=new URL(t.url),o=new URL(e.paths.login,i(t));return o.searchParams.set(`redirect`,n.redirectPath?.(t)??`${a.pathname}${a.search}`),r&&o.searchParams.set(`silent`,`1`),o}}const k=/^[A-Za-z0-9_-]{1,128}$/,A=new Set([`login_required`,`consent_required`,`interaction_required`,`account_selection_required`]);function j(o,l){function u(e,t){let n=new URL(o.paths.login,e);return n.searchParams.set(`redirect`,t),n}function d(e,t,n){let r=new URL(o.paths.error,e);return r.searchParams.set(`reason`,t),n&&r.searchParams.set(`description`,n),r}async function p(e){let a=i(e),s=new URL(e.url).searchParams,c=n(s.get(`redirect`),a),l=s.get(`silent`)===`1`,{url:u,state:d,verifier:f}=await _(o,{origin:a,silent:l}),p=w(u);return t(p.headers,r(o.cookieName,d),T({verifier:f,redirectPath:c,silent:l}),a,o.lifetimes.flowMaxAgeMs),p}async function h(p){let h=i(p),g=new URL(p.url).searchParams,_=g.get(`state`),b=_&&k.test(_)?r(o.cookieName,_):null,S=b?s(e(p,b)):null,C=e=>(b&&a(e.headers,b,h),e);if(!S)return C(w(d(h,`invalid_state`,null)));let T=n(S.redirectPath,h),E=g.get(`error`);if(E)return S.silent&&A.has(E)?C(w(u(h,T))):C(w(d(h,E,g.get(`error_description`))));let D=g.get(`code`);if(!D)return C(w(d(h,`invalid_request`,null)));let O,j,M;try{let e=await c(o,{code:D,verifier:S.verifier,redirectUri:new URL(o.paths.callback,h).toString()});O=v(e,null,o.now()),j=await m(o,O.accessToken),M=await o.onSignIn({user:j,accessToken:O.accessToken,redirectPath:T,previous:null})}catch(e){return e instanceof f?C(w(d(h,e.code,e.description||null))):C(w(d(h,`accounts_unavailable`,null)))}if(M===null){let t=w(d(h,`access_denied`,null)),n=e(p,o.cookieName),r=await l.load(n);r&&await l.end(r),n!==null&&a(t.headers,o.cookieName,h);for(let e of x(o,h))t.headers.append(`set-cookie`,e);return C(t)}let N,P;try{({cookieValue:N,session:P}=await l.start({user:j,tokens:O,data:M}))}catch{return C(w(d(h,`session_store_error`,null)))}let F=w(new URL(T,h));t(F.headers,o.cookieName,N,h,o.lifetimes.absoluteMaxAgeMs);let I=await y(o,P,h,o.now()).catch(()=>null);return I&&F.headers.append(`set-cookie`,I),C(F)}async function g(t){let n=i(t),r=await l.load(e(t,o.cookieName));r&&await l.end(r);let a=r?.tokens.idToken?b(o,{origin:n,idToken:r.tokens.idToken}):new URL(o.paths.logoutComplete,n).toString(),s=w(a,303);for(let e of E(o,n))s.headers.append(`set-cookie`,e);return s}return{login:p,callback:h,logout:g}}const M=e=>new Promise(t=>setTimeout(t,e));function N(e){let{store:t,lifetimes:n}=e;function r(e,t){return t-e.createdAt>=n.absoluteMaxAgeMs||t-e.lastValidatedAt>=n.idleMaxAgeMs}function i(e,t){return e.accessTokenExpiresAt-t<=n.refreshBeforeExpiryMs}async function a(n){if(!n)return null;let i=await t.read(await u(n));return i?r(i,e.now())?(await t.delete(i.id),null):i:null}async function o(n){let r=S(32),i=e.now(),a={id:await u(r),user:n.user,tokens:n.tokens,data:n.data,createdAt:i,lastValidatedAt:i,refreshLeaseUntil:null};return await t.create(a),{session:a,cookieValue:r}}async function s(r){let a=e.now();if(!i(r.tokens,a))return r;if(!r.tokens.refreshToken)return await t.delete(r.id),null;let o=await t.claimRefreshLease(r.id,a+n.refreshLeaseMs,a);if(!o)return c(r.id,a);let s=o.refreshLeaseUntil??void 0;if(!i(o.tokens,a))return await t.update(o.id,{refreshLeaseUntil:null},s)??t.read(o.id);try{let r=await l(e,o.tokens.refreshToken,Math.max(n.refreshLeaseMs-1e3,n.refreshLeaseMs/2));return await t.update(o.id,{tokens:v(r,o.tokens,e.now()),refreshLeaseUntil:null},s)??t.read(o.id)}catch(n){if(n instanceof f&&n.code===`invalid_grant`)return await t.delete(o.id,s)?null:await t.read(o.id)??null;let r=await t.update(o.id,{refreshLeaseUntil:null},s);if(o.tokens.accessTokenExpiresAt>e.now())return r??o;throw n}}async function c(r,a){for(;;){await M(100);let o=await t.read(r);if(!o)return null;let c=e.now();if(!i(o.tokens,c))return o;if(o.refreshLeaseUntil===null||o.refreshLeaseUntil<=c)return s(o);if(c-a>=n.leaseWaitMs){if(o.tokens.accessTokenExpiresAt>c)return o;throw new h(`Timed out waiting for the session refresh lease`,0)}}}async function d(r){if(e.now()-r.lastValidatedAt<n.revalidateIntervalMs)return r;let i=await s(r);if(!i)return null;let a=await e.onRevalidate({session:i,accessToken:i.tokens.accessToken});return a===null?(await t.delete(i.id),null):t.update(i.id,{data:a,lastValidatedAt:e.now()})}async function p(e){await t.delete(e.id)}return{load:a,start:o,ensureFreshTokens:s,revalidate:d,end:p}}function P(){let e=new Map;return{rows:e,async create(t){e.set(t.id,structuredClone(t))},async read(t){let n=e.get(t);return n?structuredClone(n):null},async update(t,n,r){let i=e.get(t);if(!i||r!==void 0&&i.refreshLeaseUntil!==r)return null;let a=structuredClone({...i,...n});return e.set(t,a),structuredClone(a)},async claimRefreshLease(t,n,r){let i=e.get(t);if(!i||i.refreshLeaseUntil!==null&&i.refreshLeaseUntil>r)return null;let a={...i,refreshLeaseUntil:n};return e.set(t,a),structuredClone(a)},async delete(t,n){let r=e.get(t);return!r||n!==void 0&&r.refreshLeaseUntil!==n?!1:(e.delete(t),!0)}}}function F(t){let n=d(t),r=N(n),i=j(n,r),a=O(n,r),o=D(n,r);function s(t){return{session:e(t,n.cookieName),cache:e(t,g(n.cookieName))}}async function c(e){return r.load(e)}async function l(e){return await p(n,e.cache,e.session,n.now())??r.load(e.session)}async function u(e){return l(s(e))}async function f(e){let t=await r.load(e);return t?(await r.ensureFreshTokens(t))?.tokens.accessToken??null:null}async function m(e){let t=await p(n,e.cache,e.session,n.now());return t&&t.tokens.accessTokenExpiresAt-n.now()>n.lifetimes.refreshBeforeExpiryMs?t.tokens.accessToken:f(e.session)}async function h(e){return m(s(e))}async function _(e,t){let i=await r.load(e);return i?n.store.update(i.id,{data:t(i.data)}):null}return{config:n,sessions:r,handlers:i,guard:a,resolveSession:o,sessionFromCookie:c,sessionFromCookies:l,sessionFromRequest:u,accessTokenFromCookie:f,accessTokenFromCookies:m,accessTokenFromRequest:h,updateSessionData:_}}export{h as AccountsRequestError,f as OAuthTokenError,o as accountsEndpoint,g as cacheCookieBase,F as createAccountsAuth,P as createMemorySessionStore,m as fetchUserInfo,i as requestOrigin,n as sanitizeRedirectPath};

package/dist/next.d.ts

@@ -1,6 +1,6 @@
-import { a as AccountsSession } from "./types-CRiqvt6N.js";
-import { t as AccountsAuth } from "./index-CICWi97l.js";
-//#region src/next.d.ts
+import { o as AccountsSession } from "./types-BcXM3ZEI.js";
+import { t as AccountsAuth } from "./index-CZZ3DRlf.js";
+//#region src/next/index.d.ts
 declare function withNextRequestScope<Data>(auth: AccountsAuth<Data>): {
   getSession(): Promise<AccountsSession<Data> | null>;
   getAccessToken(): Promise<string | null>;

package/dist/next.js

@@ -1 +1 @@
-import{n as e}from"./cookies-D3lpM5ER.js";import{cookies as t}from"next/headers";async function n(n){let r=await t();return r.get(e(n,!0))?.value||r.get(e(n,!1))?.value||null}function r(e){let t=e.config.cookieName;return{async getSession(){return e.sessionFromCookie(await n(t))},async getAccessToken(){return e.accessTokenFromCookie(await n(t))},async updateSessionData(r){return e.updateSessionData(await n(t),r)}}}export{r as withNextRequestScope};
+import{n as e,y as t}from"./cache-BWpH93Oi.js";import{cookies as n}from"next/headers";import{connection as r}from"next/server";async function i(i){await r();let a=await n(),o=e=>a.get(t(e,!0))?.value||a.get(t(e,!1))?.value||null;return{session:o(i),cache:o(e(i))}}async function a(r){let i=await n(),a=e(r);for(let e of[t(a,!0),t(a,!1)])try{i.delete(e)}catch{}}function o(e){let t=e.config.cookieName;return{async getSession(){return e.sessionFromCookies(await i(t))},async getAccessToken(){return e.accessTokenFromCookies(await i(t))},async updateSessionData(n){let r=await e.updateSessionData((await i(t)).session,n);return r&&await a(t),r}}}export{o as withNextRequestScope};

package/dist/testing.d.ts

@@ -0,0 +1,35 @@
+import { c as AccountsSessionStore } from "./types-BcXM3ZEI.js";
+//#region src/testing/index.d.ts
+/**
+ * A behavioural conformance suite for the session store contract.
+ *
+ * The store is the one piece every deployment reimplements, and its hardest
+ * part is invisible from the type: the takeover comparison in
+ * `claimRefreshLease` is not the equality fence `update` and `delete` use,
+ * and getting it wrong means two workers refresh at once, which accounts
+ * answers by revoking the whole token family. This suite is the contract, so
+ * a new store is checked rather than derived by reading the shipped ones.
+ *
+ * It returns cases instead of registering them, so it runs under node:test,
+ * vitest, or anything else:
+ *
+ * ```ts
+ * for (const c of sessionStoreConformance({ createStore })) {
+ *   test(c.name, c.run);
+ * }
+ * ```
+ */
+type ConformanceCase = {
+  name: string;
+  run: () => Promise<void>;
+};
+type StoreConformanceOptions<Data> = {
+  /** A store backed by empty storage. Called once per case. */
+  createStore: () => AccountsSessionStore<Data> | Promise<AccountsSessionStore<Data>>;
+  /** Two distinguishable app payloads. Defaults suit a store generic in Data. */
+  data?: Data;
+  otherData?: Data;
+};
+declare function sessionStoreConformance<Data = Record<string, never>>(options: StoreConformanceOptions<Data>): ConformanceCase[];
+//#endregion
+export { ConformanceCase, StoreConformanceOptions, sessionStoreConformance };

package/dist/testing.js

@@ -0,0 +1 @@
+import e from"node:assert/strict";const t=17e11;function n(e,n){return{id:e,user:{id:`user_1`,email:`u@test`,name:`U`,image:null},tokens:{accessToken:`at_1`,refreshToken:`rt_1`,idToken:`idt_1`,accessTokenExpiresAt:17000036e5},data:n,createdAt:t,lastValidatedAt:t,refreshLeaseUntil:null}}function r(r){let i=r.data??{seed:1},a=r.otherData??{seed:2},o=()=>Promise.resolve(r.createStore()),s=async(e=`sess_1`)=>{let t=await o();return await t.create(n(e,i)),t};return[{name:`read returns every field create was given`,run:async()=>{let t=await s();e.deepEqual(await t.read(`sess_1`),n(`sess_1`,i))}},{name:`read answers null for an id that was never created`,run:async()=>{let t=await o();e.equal(await t.read(`missing`),null)}},{name:`create keeps a null refresh token null rather than empty`,run:async()=>{let t=await o(),r=n(`sess_1`,i);r.tokens={...r.tokens,refreshToken:null,idToken:null},await t.create(r);let a=await t.read(`sess_1`);e.equal(a?.tokens.refreshToken,null),e.equal(a?.tokens.idToken,null)}},{name:`update writes only the patched fields`,run:async()=>{let n=await(await s()).update(`sess_1`,{data:a});e.deepEqual(n?.data,a),e.equal(n?.lastValidatedAt,t),e.equal(n?.tokens.accessToken,`at_1`)}},{name:`update answers null for an id that is not there`,run:async()=>{let t=await o();e.equal(await t.update(`missing`,{lastValidatedAt:1}),null)}},{name:`update applies when ifLeaseUntil is the lease on the row`,run:async()=>{let n=await s();await n.claimRefreshLease(`sess_1`,170000002e4,t);let r=await n.update(`sess_1`,{lastValidatedAt:1700000000005},170000002e4);e.equal(r?.lastValidatedAt,1700000000005)}},{name:`update writes nothing when ifLeaseUntil is not the lease on the row`,run:async()=>{let n=await s();await n.claimRefreshLease(`sess_1`,170000002e4,t);let r=await n.update(`sess_1`,{lastValidatedAt:1700000000005},1700000999999);e.equal(r,null),e.equal((await n.read(`sess_1`))?.lastValidatedAt,t)}},{name:`update releases the lease when the patch sets it null`,run:async()=>{let n=await s();await n.claimRefreshLease(`sess_1`,170000002e4,t),await n.update(`sess_1`,{refreshLeaseUntil:null},170000002e4),e.equal((await n.read(`sess_1`))?.refreshLeaseUntil,null)}},{name:`claimRefreshLease takes a lease when the row holds none`,run:async()=>{let n=await s(),r=await n.claimRefreshLease(`sess_1`,170000002e4,t);e.equal(r?.refreshLeaseUntil,170000002e4),e.equal((await n.read(`sess_1`))?.refreshLeaseUntil,170000002e4)}},{name:`claimRefreshLease refuses while another lease is still live`,run:async()=>{let n=await s();await n.claimRefreshLease(`sess_1`,170000002e4,t),e.equal(await n.claimRefreshLease(`sess_1`,170000004e4,1700000001e3),null),e.equal((await n.read(`sess_1`))?.refreshLeaseUntil,170000002e4)}},{name:`claimRefreshLease takes over a lease that has expired`,run:async()=>{let n=await s();await n.claimRefreshLease(`sess_1`,170000002e4,t);let r=await n.claimRefreshLease(`sess_1`,170000006e4,1700000020001);e.equal(r?.refreshLeaseUntil,170000006e4)}},{name:`claimRefreshLease answers null for an id that is not there`,run:async()=>{let n=await o();e.equal(await n.claimRefreshLease(`missing`,170000002e4,t),null)}},{name:`delete without a lease removes the session and reports true`,run:async()=>{let t=await s();e.equal(await t.delete(`sess_1`),!0),e.equal(await t.read(`sess_1`),null)}},{name:`delete reports false for an id that is not there`,run:async()=>{let t=await o();e.equal(await t.delete(`missing`),!1)}},{name:`delete applies when ifLeaseUntil is the lease on the row`,run:async()=>{let n=await s();await n.claimRefreshLease(`sess_1`,170000002e4,t),e.equal(await n.delete(`sess_1`,170000002e4),!0),e.equal(await n.read(`sess_1`),null)}},{name:`delete keeps the session when ifLeaseUntil is not its lease`,run:async()=>{let n=await s();await n.claimRefreshLease(`sess_1`,170000002e4,t),e.equal(await n.delete(`sess_1`,1700000999999),!1),e.notEqual(await n.read(`sess_1`),null)}},{name:`sessions are addressed independently`,run:async()=>{let t=await s(`sess_1`);await t.create(n(`sess_2`,a)),await t.delete(`sess_1`),e.equal(await t.read(`sess_1`),null),e.deepEqual((await t.read(`sess_2`))?.data,a)}}]}export{r as sessionStoreConformance};

package/dist/{types-CRiqvt6N.d.ts → types-BcXM3ZEI.d.ts}

@@ -1,4 +1,11 @@
-//#region src/types.d.ts
+//#region src/core/codec.d.ts
+type SessionCodec = {
+  encrypt(value: string): Promise<string>;
+  decrypt(value: string): Promise<string>;
+};
+declare function createAesGcmCodec(hexKey: string): SessionCodec;
+//#endregion
+//#region src/core/types.d.ts
 type AccountsUser = {
   id: string;
   email: string;
@@ -26,7 +33,13 @@ interface AccountsSessionStore<Data> {
   read(id: string): Promise<AccountsSession<Data> | null>;
   update(id: string, patch: AccountsSessionPatch<Data>, ifLeaseUntil?: number): Promise<AccountsSession<Data> | null>;
   claimRefreshLease(id: string, until: number, now: number): Promise<AccountsSession<Data> | null>;
-  delete(id: string, ifLeaseUntil?: number): Promise<void>;
+  /**
+   * Removes the session. With `ifLeaseUntil`, removes it only while that
+   * refresh lease is still the one on the row, and resolves false when it is
+   * not, so a refresher that lost its lease can tell the difference between
+   * "gone" and "someone else owns it".
+   */
+  delete(id: string, ifLeaseUntil?: number): Promise<boolean>;
 }
 type AccountsPaths = {
   login: string;
@@ -63,17 +76,39 @@ type AccountsAuthConfig<Data> = {
   store: AccountsSessionStore<Data>;
   paths?: Partial<AccountsPaths>;
   lifetimes?: Partial<AccountsLifetimes>;
-  onSignIn(input: SignInInput<Data>): Promise<Data | null>;
-  onRevalidate(input: RevalidateInput<Data>): Promise<Data | null>;
+  /**
+   * Returns the app data to store on the session, or null to deny the sign-in.
+   * Omit it when the app keeps nothing of its own on the session.
+   */
+  onSignIn?(input: SignInInput<Data>): Promise<Data | null>;
+  /**
+   * Re-derives the app data, or returns null to end the session. Throwing
+   * keeps it, because a failure to reach accounts says nothing about the user.
+   * Omit it when the app keeps nothing of its own on the session.
+   */
+  onRevalidate?(input: RevalidateInput<Data>): Promise<Data | null>;
   fetch?: typeof fetch;
   now?: () => number;
+  cache?: AccountsCacheConfig;
+  audience?: string | false;
 };
-type ResolvedAccountsAuthConfig<Data> = Omit<AccountsAuthConfig<Data>, "paths" | "lifetimes" | "scope" | "fetch" | "now"> & {
+type AccountsCacheConfig = {
+  secret: string;
+  maxAgeMs?: number;
+};
+type ResolvedAccountsAuthConfig<Data> = Omit<AccountsAuthConfig<Data>, "paths" | "lifetimes" | "scope" | "fetch" | "now" | "cache" | "audience" | "onSignIn" | "onRevalidate"> & {
+  onSignIn(input: SignInInput<Data>): Promise<Data | null>;
+  onRevalidate(input: RevalidateInput<Data>): Promise<Data | null>;
   scope: string;
   paths: AccountsPaths;
   lifetimes: AccountsLifetimes;
   fetch: typeof fetch;
   now: () => number;
+  cache: {
+    codec: () => Promise<SessionCodec>;
+    maxAgeMs: number;
+  } | null;
+  audience: string | null;
 };
 declare class AccountsRequestError extends Error {
   readonly status: number;
@@ -81,7 +116,8 @@ declare class AccountsRequestError extends Error {
 }
 declare class OAuthTokenError extends AccountsRequestError {
   readonly code: string;
+  readonly description: string;
   constructor(status: number, code: string, description: string);
 }
 //#endregion
-export { AccountsSession as a, AccountsTokens as c, ResolvedAccountsAuthConfig as d, RevalidateInput as f, AccountsRequestError as i, AccountsUser as l, AccountsLifetimes as n, AccountsSessionPatch as o, SignInInput as p, AccountsPaths as r, AccountsSessionStore as s, AccountsAuthConfig as t, OAuthTokenError as u };
+export { AccountsRequestError as a, AccountsSessionStore as c, OAuthTokenError as d, ResolvedAccountsAuthConfig as f, createAesGcmCodec as g, SessionCodec as h, AccountsPaths as i, AccountsTokens as l, SignInInput as m, AccountsCacheConfig as n, AccountsSession as o, RevalidateInput as p, AccountsLifetimes as r, AccountsSessionPatch as s, AccountsAuthConfig as t, AccountsUser as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aui-auth",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "description": "Server side sessions for web apps that sign in through assistant-ui accounts: OIDC code flow with PKCE, tokens kept in the app's database, single flight refresh",
   "license": "MIT",
   "type": "module",
@@ -13,17 +13,29 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./accounts": {
+      "types": "./dist/accounts.d.ts",
+      "default": "./dist/accounts.js"
+    },
     "./next": {
       "types": "./dist/next.d.ts",
       "default": "./dist/next.js"
     },
-    "./pg": {
-      "types": "./dist/pg.d.ts",
-      "default": "./dist/pg.js"
+    "./database": {
+      "types": "./dist/database/index.d.ts",
+      "default": "./dist/database/index.js"
     },
-    "./accounts": {
-      "types": "./dist/accounts.d.ts",
-      "default": "./dist/accounts.js"
+    "./database/pg": {
+      "types": "./dist/database/pg.d.ts",
+      "default": "./dist/database/pg.js"
+    },
+    "./database/redis": {
+      "types": "./dist/database/redis.d.ts",
+      "default": "./dist/database/redis.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "default": "./dist/testing.js"
     }
   },
   "peerDependencies": {
@@ -36,6 +48,7 @@
   },
   "devDependencies": {
     "@types/node": "^26.1.2",
+    "ioredis": "^6.0.0",
     "next": "^16.3.0",
     "tsdown": "^0.22.14",
     "typescript": "^7.0.2"

package/dist/cookies-D3lpM5ER.js

@@ -1 +0,0 @@
-function e(e){if(!e)return;let t=e.split(`,`);return t[t.length-1].trim()||void 0}function t(t){let n=new URL(t.url);return`${e(t.headers.get(`x-forwarded-proto`))||n.protocol.replace(`:`,``)}://${e(t.headers.get(`x-forwarded-host`))||t.headers.get(`host`)||n.host}`}function n(e){return new URL(e).protocol===`https:`}function r(e,t){return t?`__Secure-${e}`:e}function i(e){let t=new Map;if(!e)return t;for(let n of e.split(`;`)){let e=n.indexOf(`=`);if(e===-1)continue;let r=n.slice(0,e).trim();!r||t.has(r)||t.set(r,n.slice(e+1).trim())}return t}function a(e,t){let n=i(e.headers.get(`cookie`));return n.get(r(t,!0))||n.get(r(t,!1))||null}function o(e,t,n,r){let i=[`${e}=${t}`,`Path=/`,`HttpOnly`,`SameSite=Lax`,`Max-Age=${r}`];return n&&i.push(`Secure`),i.join(`; `)}function s(e,t,i,a,s){let c=n(a);e.append(`set-cookie`,o(r(t,c),i,c,Math.floor(s/1e3)))}function c(e,t,i){let a=n(i);for(let n of[a,!a])e.append(`set-cookie`,o(r(t,n),``,n,0))}function l(e,t=307){return new Response(null,{status:t,headers:{location:e.toString()}})}function u(e,t){return`${e}_flow_${t}`}function d(e){return btoa(JSON.stringify(e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function f(e){if(!e)return null;try{let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=JSON.parse(atob(t));return typeof n.verifier==`string`?{verifier:n.verifier,redirectPath:typeof n.redirectPath==`string`?n.redirectPath:`/`,silent:n.silent===!0}:null}catch{return null}}function p(e,t){if(!e)return`/`;let n;try{n=new URL(e,t)}catch{return`/`}return n.origin===t?`${n.pathname}${n.search}${n.hash}`:`/`}export{u as a,t as c,d as i,p as l,r as n,a as o,f as r,l as s,c as t,s as u};

package/dist/oidc-BIfcHoyS.js

@@ -1 +0,0 @@
-const e={login:`/api/auth/login`,callback:`/api/auth/callback`,logout:`/api/auth/logout`,logoutComplete:`/api/auth/logout-complete`,error:`/auth/error`},t={absoluteMaxAgeMs:2592e6,idleMaxAgeMs:6048e5,revalidateIntervalMs:12e4,refreshBeforeExpiryMs:3e5,flowMaxAgeMs:6e5,refreshLeaseMs:2e4,leaseWaitMs:5e3};function n(n){return{...n,scope:n.scope??`openid profile email offline_access`,paths:{...e,...n.paths},lifetimes:{...t,...n.lifetimes},fetch:n.fetch??globalThis.fetch.bind(globalThis),now:n.now??Date.now}}var r=class extends Error{status;constructor(e,t){super(e),this.name=`AccountsRequestError`,this.status=t}},i=class extends r{code;constructor(e,t,n){super(`Token request failed: ${e} ${t} ${n}`,e),this.name=`OAuthTokenError`,this.code=t}};function a(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function o(e){return a(crypto.getRandomValues(new Uint8Array(e)))}async function s(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return a(new Uint8Array(t))}function c(e,t){return new URL(t,e).toString()}async function l(e,t){let n=o(24),r=o(32),i=new URL(c(e.issuer,`/api/auth/oauth2/authorize`));return i.searchParams.set(`client_id`,e.clientId),i.searchParams.set(`redirect_uri`,new URL(e.paths.callback,t.origin).toString()),i.searchParams.set(`response_type`,`code`),i.searchParams.set(`scope`,e.scope),i.searchParams.set(`state`,n),i.searchParams.set(`code_challenge`,await s(r)),i.searchParams.set(`code_challenge_method`,`S256`),t.silent&&i.searchParams.set(`prompt`,`none`),{url:i.toString(),state:n,verifier:r}}function u(e,t){let n=new URL(c(e.issuer,`/api/auth/oauth2/end-session`));return n.searchParams.set(`id_token_hint`,t.idToken),n.searchParams.set(`client_id`,e.clientId),n.searchParams.set(`post_logout_redirect_uri`,new URL(e.paths.logoutComplete,t.origin).toString()),n.toString()}async function d(e,t,n){let r=new URLSearchParams({client_id:e.clientId,...t});e.clientSecret&&r.set(`client_secret`,e.clientSecret);let a=await e.fetch(c(e.issuer,`/api/auth/oauth2/token`),{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:r,cache:`no-store`,...n?{signal:AbortSignal.timeout(n)}:{}});if(!a.ok){let e=await a.text().catch(()=>``),t=`unknown_error`,n=e;try{let r=JSON.parse(e);t=r.error??t,n=r.error_description??n}catch{}throw new i(a.status,t,n)}return await a.json()}function f(e,t){return d(e,{grant_type:`authorization_code`,code:t.code,code_verifier:t.verifier,redirect_uri:t.redirectUri})}function p(e,t,n){return d(e,{grant_type:`refresh_token`,refresh_token:t},n)}async function m(e,t){let n=await e.fetch(c(e.issuer,`/api/auth/oauth2/userinfo`),{headers:{Authorization:`Bearer ${t}`},cache:`no-store`});if(!n.ok)throw new r(`Failed to load user info: ${n.status}`,n.status);let i=await n.json();return{id:i.sub,email:i.email??``,name:i.name??i.email??i.sub,image:i.picture??null}}function h(e,t,n){return{accessToken:e.access_token,refreshToken:e.refresh_token??t?.refreshToken??null,idToken:e.id_token??t?.idToken??null,accessTokenExpiresAt:typeof e.expires_at==`number`?e.expires_at*1e3:n+(e.expires_in??3600)*1e3}}export{m as a,s as c,i as d,n as f,f as i,h as l,l as n,o,u as r,p as s,c as t,r as u};