aui-auth 0.0.9 → 0.0.10

package/dist/cache-iIzAusyV.js

@@ -0,0 +1 @@
+import{n as e}from"./encoding-BhmNmloC.js";import{o as t}from"./errors-C7IxbL16.js";function n(e){if(!e)return;let t=e.split(`,`);return t[t.length-1].trim()||void 0}function r(e){let t=new URL(e.url);return`${n(e.headers.get(`x-forwarded-proto`))||t.protocol.replace(`:`,``)}://${n(e.headers.get(`x-forwarded-host`))||e.headers.get(`host`)||t.host}`}function i(e){return new URL(e).protocol===`https:`}function a(e,t){return t?`__Secure-${e}`:e}function o(e){let t=new Map;if(!e)return t;for(let n of e.split(`;`)){let e=n.indexOf(`=`);if(e===-1)continue;let r=n.slice(0,e).trim();!r||t.has(r)||t.set(r,n.slice(e+1).trim())}return t}function s(e,t){let n=o(e.headers.get(`cookie`));return n.get(a(t,!0))||n.get(a(t,!1))||null}function c(e,t,n,r){let i=[`${e}=${t}`,`Path=/`,`HttpOnly`,`SameSite=Lax`,`Max-Age=${r}`];return n&&i.push(`Secure`),i.join(`; `)}function l(e){let[t,...n]=e.split(`;`).map(e=>e.trim()),r=t.indexOf(`=`);if(r<1)return null;let i=new Map(n.map(e=>{let[t,n=``]=e.split(`=`);return[t.toLowerCase(),n]}));return{name:t.slice(0,r),value:t.slice(r+1),options:{path:i.get(`path`)||`/`,httpOnly:i.has(`httponly`),sameSite:`lax`,secure:i.has(`secure`),maxAge:Number(i.get(`max-age`)??0)}}}function u(e,t,n,r,o){let s=i(r);e.append(`set-cookie`,c(a(t,s),n,s,Math.floor(o/1e3)))}function d(e,t){if(t.length===0)return;let n=o(e.get(`cookie`));for(let e of t){let t=l(e);t&&(t.value?n.set(t.name,t.value):n.delete(t.name))}e.set(`cookie`,[...n].map(([e,t])=>`${e}=${t}`).join(`; `))}function f(e,t){let n=t===void 0||i(t);return[n,!n].map(t=>c(a(e,t),``,t,0))}function p(e,t,n){for(let r of f(t,n))e.append(`set-cookie`,r)}function m(e,t=307){return new Response(null,{status:t,headers:{location:e.toString()}})}function h(e,t){return`${e}_flow_${t}`}function g(e){return btoa(JSON.stringify(e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function _(e){if(!e)return null;try{let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=JSON.parse(atob(t));return typeof n.verifier==`string`?{verifier:n.verifier,redirectPath:typeof n.redirectPath==`string`?n.redirectPath:`/`,silent:n.silent===!0}:null}catch{return null}}function v(e,t){if(!e)return`/`;let n;try{n=new URL(e,t)}catch{return`/`}return n.origin!==t||n.pathname.startsWith(`//`)?`/`:`${n.pathname}${n.search}${n.hash}`}const y=4096;function b(e){return`${e}_cache`}function x(e,t,n){if(!e.cache)return 0;let{lifetimes:r}=e,i=Math.min(t.lastValidatedAt+r.revalidateIntervalMs,t.tokens.accessTokenExpiresAt-r.refreshBeforeExpiryMs);return Math.min(e.cache.maxAgeMs,(i>n?i:n+r.retryIntervalMs)-n,t.createdAt+r.absoluteMaxAgeMs-n,t.lastValidatedAt+r.idleMaxAgeMs-n)}async function S(e,t,n){if(!e.cache)return null;let r=x(e,t,n);if(r<1e3)return null;let i={v:1,id:t.id,u:t.user,d:t.data,at:t.tokens.accessToken,ate:t.tokens.accessTokenExpiresAt,ca:t.createdAt,lv:t.lastValidatedAt,exp:n+r};return{value:await(await e.cache.codec()).encrypt(JSON.stringify(i)),maxAgeMs:r}}async function C(t,n,r,i){if(!t.cache||!n||!r)return null;let a;try{let e=await t.cache.codec();a=JSON.parse(await e.decrypt(n))}catch{return null}return a.v!==1||typeof a.exp!=`number`||a.exp<=i||a.id!==await e(r)?null:{id:a.id,user:a.u,tokens:{accessToken:a.at,refreshToken:null,idToken:null,accessTokenExpiresAt:a.ate},data:a.d,createdAt:a.ca,lastValidatedAt:a.lv,refreshLeaseUntil:null}}async function w(e,n,r,o){try{let t=await S(e,n,o);if(!t)return null;let s=i(r),l=c(a(b(e.cookieName),s),t.value,s,Math.floor(t.maxAgeMs/1e3));if(l.length>y)throw Error(`Cache cookie is ${l.length} bytes and browsers drop cookies over ${y}; the session data is too large to cache`);return l}catch(n){return t(e,`cache_cookie`,n),null}}function T(e,t){return e.cache?f(b(e.cookieName),t):[]}export{v as _,p as a,_ as c,d,o as f,r as g,m as h,C as i,g as l,s as m,b as n,f as o,l as p,w as r,a as s,T as t,h as u,c as v,u as y};

package/dist/{index-CNcSwzgU.d.ts → index-DdBQue0N.d.ts}

@@ -1,5 +1,15 @@
 import { a as AccountsLifetimes, d as AccountsUser, l as AccountsSessionStore, s as AccountsSession, t as AccountsAuthConfig } from "./types-B13HPcs5.js";
 import { t as AccountsFetchOptions } from "./fetch-C0ojJu8c.js";
+//#region src/core/resolve.d.ts
+type SessionResolution<Data> = {
+  session: AccountsSession<Data> | null;
+  /**
+   * The Set-Cookie headers to attach to the response: the cache cookie while
+   * the session is alive, the cookies that clear a session that is gone.
+   */
+  cookies: string[];
+};
+//#endregion
 //#region src/core/config.d.ts
 declare const DEFAULT_LIFETIMES: AccountsLifetimes;
 //#endregion
@@ -36,16 +46,6 @@ type GuardResult<Data> = {
   response: Response;
 };
 //#endregion
-//#region src/core/resolve.d.ts
-type SessionResolution<Data> = {
-  session: AccountsSession<Data> | null;
-  /**
-   * The Set-Cookie headers to attach to the response: the cache cookie while
-   * the session is alive, the cookies that clear a session that is gone.
-   */
-  cookies: string[];
-};
-//#endregion
 //#region src/core/store/memory.d.ts
 declare function createMemorySessionStore<Data>(): AccountsSessionStore<Data> & {
   rows: Map<string, AccountsSession<Data>>;
@@ -69,9 +69,9 @@ declare function createAccountsAuth<Data>(input: AccountsAuthConfig<Data>): {
   sessionFromRequest: (request: Request) => Promise<AccountsSession<Data> | null>;
   accessTokenFromCookies: (cookies: SessionCookies) => Promise<string | null>;
   accessTokenFromRequest: (request: Request) => Promise<string | null>;
-  updateSessionData: (cookies: SessionCookies, update: (data: Data) => Data) => Promise<AccountsSession<Data> | null>;
+  updateSessionData: (cookies: SessionCookies, update: (data: Data) => Data) => Promise<SessionResolution<Data>>;
   sweepSessions: () => Promise<number>;
 };
 type AccountsAuth<Data> = ReturnType<typeof createAccountsAuth<Data>>;
 //#endregion
-export { SessionResolution as a, cacheCookieBase as c, requestOrigin as d, sanitizeRedirectPath as f, createMemorySessionStore as i, fetchUserInfo as l, SessionCookies as n, GuardOptions as o, DEFAULT_LIFETIMES as p, createAccountsAuth as r, GuardResult as s, AccountsAuth as t, forwardCookies as u };
+export { GuardOptions as a, fetchUserInfo as c, sanitizeRedirectPath as d, DEFAULT_LIFETIMES as f, createMemorySessionStore as i, forwardCookies as l, SessionCookies as n, GuardResult as o, SessionResolution as p, createAccountsAuth as r, cacheCookieBase as s, AccountsAuth as t, requestOrigin as u };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { a as AccountsLifetimes, c as AccountsSessionPatch, d as AccountsUser, f as RevalidateInput, i as AccountsErrorPhase, l as AccountsSessionStore, m as SignInInput, n as AccountsCacheConfig, o as AccountsPaths, p as SessionSweepCutoffs, r as AccountsErrorEvent, s as AccountsSession, t as AccountsAuthConfig, u as AccountsTokens } from "./types-B13HPcs5.js";
 import { n as accountsEndpoint, t as AccountsFetchOptions } from "./fetch-C0ojJu8c.js";
 import { i as isAccessDenied, n as OAuthTokenError, r as SessionDecodeError, t as AccountsRequestError } from "./errors-DpQsDn4O.js";
-import { a as SessionResolution, c as cacheCookieBase, d as requestOrigin, f as sanitizeRedirectPath, i as createMemorySessionStore, l as fetchUserInfo, n as SessionCookies, o as GuardOptions, p as DEFAULT_LIFETIMES, r as createAccountsAuth, s as GuardResult, t as AccountsAuth, u as forwardCookies } from "./index-CNcSwzgU.js";
+import { a as GuardOptions, c as fetchUserInfo, d as sanitizeRedirectPath, f as DEFAULT_LIFETIMES, i as createMemorySessionStore, l as forwardCookies, n as SessionCookies, o as GuardResult, p as SessionResolution, r as createAccountsAuth, s as cacheCookieBase, t as AccountsAuth, u as requestOrigin } from "./index-DdBQue0N.js";
 export { AccountsAuth, type AccountsAuthConfig, type AccountsCacheConfig, type AccountsErrorEvent, type AccountsErrorPhase, type AccountsFetchOptions, type AccountsLifetimes, type AccountsPaths, AccountsRequestError, type AccountsSession, type AccountsSessionPatch, type AccountsSessionStore, type AccountsTokens, type AccountsUser, DEFAULT_LIFETIMES, type GuardOptions, type GuardResult, OAuthTokenError, type RevalidateInput, SessionCookies, SessionDecodeError, type SessionResolution, type SessionSweepCutoffs, type SignInInput, accountsEndpoint, cacheCookieBase, createAccountsAuth, createMemorySessionStore, fetchUserInfo, forwardCookies, isAccessDenied, requestOrigin, sanitizeRedirectPath };

package/dist/index.js

@@ -1 +1 @@
-import{_ as e,a as t,c as n,d as r,f as i,g as a,h as o,i as s,l as c,m as l,n as u,o as d,p as f,r as p,t as m,u as h,v as g}from"./cache-vq-5GFN7.js";import{n as _,t as v}from"./encoding-BhmNmloC.js";import{i as y,n as b,o as x,r as S,t as C}from"./errors-C7IxbL16.js";import{a as w,i as T,o as E,r as D,t as O}from"./fetch-CM1mVzPm.js";import{a as k,i as A,l as j,n as M,r as N,t as P}from"./oidc-qInr-2mE.js";function F(e,t){return[...d(e.cookieName,t),...m(e,t)]}function I(e,t){return async function(n){let r=o(n),i=f(n,e.cookieName),a=f(n,u(e.cookieName)),c=await s(e,a,i,e.now());if(c)return{session:c,cookies:[]};let l={session:null,cookies:i!==null||a!==null?F(e,r):[]},d=await t.load(i);if(!d)return l;let{deferRevalidation:m}=e;if(m&&t.revalidationDue(d)&&L(e,m,t,d)){let t=await p(e,d,r,e.now());return{session:d,cookies:t?[t]:[]}}let h=d;try{let e=await t.revalidate(d);if(!e)return l;h=e}catch(t){x(e,`revalidate`,t)}let g=await p(e,h,r,e.now());return{session:h,cookies:g?[g]:[]}}}function L(e,t,n,r){try{return t(async()=>{try{await n.revalidate(r)}catch(t){x(e,`revalidate`,t)}}),!0}catch(t){return x(e,`revalidate`,t),!1}}function R(e,t){let n=I(e,t);return async function(t,i={}){let a=new URL(t.url);if([e.paths.login,e.paths.callback,e.paths.logout,e.paths.logoutComplete,e.paths.error,...i.publicPaths??[]].some(e=>a.pathname.startsWith(e)))return{kind:`ok`,session:null};let{session:o,cookies:s}=await n(t);return o?s.length>0?{kind:`ok`,session:o,cookies:s}:{kind:`ok`,session:o}:r(t,i,s)};function r(e,t,n){let r=n.length>0,a=new URL(e.url),o=(t.apiPaths??[`/api`,`/trpc`]).some(e=>a.pathname.startsWith(e))?Response.json({error:`Unauthorized`},{status:401}):l(i(e,t,r));for(let e of n)o.headers.append(`set-cookie`,e);return{kind:`response`,response:o}}function i(t,n,r){let i=new URL(t.url),a=new URL(e.paths.login,o(t));return a.searchParams.set(`redirect`,n.redirectPath?.(t)??`${i.pathname}${i.search}`),r&&a.searchParams.set(`silent`,`1`),a}}const z=/^[A-Za-z0-9_-]{1,128}$/,B=new Set([`login_required`,`consent_required`,`interaction_required`,`account_selection_required`]);function V(r,s){function u(e,t){let n=new URL(r.paths.login,e);return n.searchParams.set(`redirect`,t),n}function d(e,t,n){let i=new URL(r.paths.error,e);return i.searchParams.set(`reason`,t),n&&i.searchParams.set(`description`,n),i}function _(t,n){let a=h(r.cookieName,``),o=[...i(t.headers.get(`cookie`)).keys()].filter(e=>e.replace(/^__Secure-/,``).startsWith(a)),s=o.length-4;for(let t of o.slice(0,Math.max(0,s)))n.headers.append(`set-cookie`,e(t,``,t.startsWith(`__Secure-`),0))}async function v(e){try{let t=await s.load(e);t&&await s.end(t)}catch(e){x(r,`session_store`,e)}}async function y(e){let t=o(e),n=new URL(e.url).searchParams,i=a(n.get(`redirect`),t),s=n.get(`silent`)===`1`,{url:u,state:d,verifier:f}=await P(r,{origin:t,silent:s}),p=l(u);return _(e,p),g(p.headers,h(r.cookieName,d),c({verifier:f,redirectPath:i,silent:s}),t,r.lifetimes.flowMaxAgeMs),p}async function S(e){let i=o(e),c=new URL(e.url).searchParams,_=c.get(`state`),y=_&&z.test(_)?h(r.cookieName,_):null,S=y?n(f(e,y)):null,C=e=>(y&&t(e.headers,y,i),e);if(!S)return C(l(d(i,`invalid_state`,null)));let w=a(S.redirectPath,i),E=c.get(`iss`);if(E!==null&&E!==D(r.issuer))return C(l(d(i,`invalid_issuer`,null)));let O=c.get(`error`);if(O)return S.silent&&B.has(O)?C(l(u(i,w))):C(l(d(i,O,c.get(`error_description`))));let k=c.get(`code`);if(!k)return C(l(d(i,`invalid_request`,null)));let M,P,F;try{let e=await N(r,{code:k,verifier:S.verifier,redirectUri:new URL(r.paths.callback,i).toString()});M=j(e,null,r.now()),P=await A(T(r),M.accessToken),F=await r.onSignIn({user:P,accessToken:M.accessToken,redirectPath:w,previous:null})}catch(e){return x(r,`sign_in`,e),e instanceof b?C(l(d(i,e.code,e.description||null))):C(l(d(i,`accounts_unavailable`,null)))}let I=f(e,r.cookieName);if(F===null){let e=l(d(i,`access_denied`,null));I!==null&&(await v(I),t(e.headers,r.cookieName,i));for(let t of m(r,i))e.headers.append(`set-cookie`,t);return C(e)}let L,R;try{({cookieValue:L,session:R}=await s.start({user:P,tokens:M,data:F}))}catch(e){return x(r,`session_store`,e),C(l(d(i,`session_store_error`,null)))}I!==null&&await v(I);let V=l(new URL(w,i));g(V.headers,r.cookieName,L,i,r.lifetimes.absoluteMaxAgeMs);let H=await p(r,R,i,r.now());return H&&V.headers.append(`set-cookie`,H),C(V)}async function C(e){let t=o(e),n=await s.load(f(e,r.cookieName));n&&await s.end(n);let i=n?.tokens.idToken&&r.logout===`global`?M(r,{origin:t,idToken:n.tokens.idToken}):new URL(r.paths.logoutComplete,t).toString(),a=l(i,303);for(let e of F(r,t))a.headers.append(`set-cookie`,e);return a}return{login:y,callback:S,logout:C}}const H=e=>new Promise(t=>setTimeout(t,e));function U(e){let{store:t,lifetimes:n}=e;function r(e,t){return t-e.createdAt>=n.absoluteMaxAgeMs||t-e.lastValidatedAt>=n.idleMaxAgeMs}function i(e,t){return e.accessTokenExpiresAt-t<=n.refreshBeforeExpiryMs}function a(t){let r=e.now();return!i(t.tokens,r)&&r-t.lastValidatedAt>=n.revalidateIntervalMs}async function o(n){if(!n)return null;let i=await _(n),a;try{a=await t.read(i)}catch(n){if(!(n instanceof S))throw n;return x(e,`session_store`,n),await t.delete(i),null}return a?r(a,e.now())?(await t.delete(a.id),null):a:null}async function s(n){let r=v(32),i=e.now(),a={id:await _(r),user:n.user,tokens:n.tokens,data:n.data,createdAt:i,lastValidatedAt:i,refreshLeaseUntil:null};return await t.create(a),{session:a,cookieValue:r}}async function c(r){let a=e.now();if(!i(r.tokens,a))return r;if(!r.tokens.refreshToken)return await t.delete(r.id),null;let o=await t.claimRefreshLease(r.id,a+n.refreshLeaseMs,a);if(!o)return l(r.id,a);let s=o.refreshLeaseUntil??void 0;if(!i(o.tokens,a))return await t.update(o.id,{refreshLeaseUntil:null},s)??t.read(o.id);try{let r=await k(e,o.tokens.refreshToken,Math.max(n.refreshLeaseMs-1e3,n.refreshLeaseMs/2));return await t.update(o.id,{tokens:j(r,o.tokens,e.now()),refreshLeaseUntil:null},s)??t.read(o.id)}catch(n){if(y(n))return await t.delete(o.id,s)?null:await t.read(o.id)??null;let r=await t.update(o.id,{refreshLeaseUntil:null},s);if(o.tokens.accessTokenExpiresAt>e.now())return x(e,`refresh`,n),r??o;throw n}}async function l(r,a){for(;;){await H(100);let o=await t.read(r);if(!o)return null;let s=e.now();if(!i(o.tokens,s))return o;if(o.refreshLeaseUntil===null||o.refreshLeaseUntil<=s)return c(o);if(s-a>=n.leaseWaitMs){if(o.tokens.accessTokenExpiresAt>s)return o;throw new C(`Timed out waiting for the session refresh lease`,0)}}}async function u(r){let i;try{i=await c(r)}catch(t){x(e,`refresh`,t),i=r}if(!i)return null;if(e.now()-i.lastValidatedAt<n.revalidateIntervalMs||!d(i.tokens))return i;let a=e.revalidateUser?await p(i):i.user;if(!a)return f(i);if(!d(i.tokens))return i;let o=await e.onRevalidate({session:i,accessToken:i.tokens.accessToken,user:a});if(o===null)return f(i);let s={data:o,lastValidatedAt:e.now()};return a!==i.user&&(s.user=a),t.update(i.id,s)}function d(t){return t.accessTokenExpiresAt-e.now()>n.requestTimeoutMs}async function f(n){return n.tokens.accessTokenExpiresAt<=e.now()?n:(await t.delete(n.id),null)}async function p(t){try{return await A(T(e),t.tokens.accessToken)}catch(n){return y(n)?null:(x(e,`revalidate`,n),t.user)}}async function m(e){await t.delete(e.id)}async function h(){if(!t.sweep)return 0;let r=e.now();return t.sweep({createdBefore:r-n.absoluteMaxAgeMs,validatedBefore:r-n.idleMaxAgeMs})}return{load:o,start:s,ensureFreshTokens:c,revalidate:u,revalidationDue:a,end:m,sweep:h}}function W(){let e=new Map;return{rows:e,async create(t){e.set(t.id,structuredClone(t))},async read(t){let n=e.get(t);return n?structuredClone(n):null},async update(t,n,r){let i=e.get(t);if(!i||r!==void 0&&i.refreshLeaseUntil!==r)return null;let a=structuredClone({...i,...n});return e.set(t,a),structuredClone(a)},async claimRefreshLease(t,n,r){let i=e.get(t);if(!i||i.refreshLeaseUntil!==null&&i.refreshLeaseUntil>r)return null;let a={...i,refreshLeaseUntil:n};return e.set(t,a),structuredClone(a)},async delete(t,n){let r=e.get(t);return!r||n!==void 0&&r.refreshLeaseUntil!==n?!1:(e.delete(t),!0)},async sweep(t){let n=0;for(let[r,i]of e)(i.createdAt<t.createdBefore||i.lastValidatedAt<t.validatedBefore)&&(e.delete(r),n+=1);return n}}}function G(e){let t=E(e),n=U(t),r=V(t,n),i=R(t,n),a=I(t,n);function o(e){return{session:f(e,t.cookieName),cache:f(e,u(t.cookieName))}}async function c(e){return await s(t,e.cache,e.session,t.now())??n.load(e.session)}async function l(e){return c(o(e))}async function d(e){let r=await s(t,e.cache,e.session,t.now());if(r&&r.tokens.accessTokenExpiresAt>t.now())return r.tokens.accessToken;let i=await n.load(e.session);return i?(await n.ensureFreshTokens(i))?.tokens.accessToken??null:null}async function p(e){return d(o(e))}async function m(e,r){let i=await n.load(e.session);return i?t.store.update(i.id,{data:r(i.data)}):null}function h(){return n.sweep()}return{cookieName:t.cookieName,handlers:r,guard:i,resolveSession:a,sessionFromCookies:c,sessionFromRequest:l,accessTokenFromCookies:d,accessTokenFromRequest:p,updateSessionData:m,sweepSessions:h}}export{C as AccountsRequestError,w as DEFAULT_LIFETIMES,b as OAuthTokenError,S as SessionDecodeError,O as accountsEndpoint,u as cacheCookieBase,G as createAccountsAuth,W as createMemorySessionStore,A as fetchUserInfo,r as forwardCookies,y as isAccessDenied,o as requestOrigin,a as sanitizeRedirectPath};
+import{_ as e,a as t,c as n,d as r,f as i,g as a,h as o,i as s,l as c,m as l,n as u,o as d,r as f,t as p,u as m,v as h,y as g}from"./cache-iIzAusyV.js";import{n as _,t as v}from"./encoding-BhmNmloC.js";import{i as y,n as b,o as x,r as S,t as C}from"./errors-C7IxbL16.js";import{a as w,i as T,o as E,r as D,t as O}from"./fetch-CM1mVzPm.js";import{a as k,i as A,l as j,n as M,r as N,t as P}from"./oidc-qInr-2mE.js";function F(e,t){return[...d(e.cookieName,t),...p(e,t)]}function I(e,t){return async function(n){let r=a(n),i=l(n,e.cookieName),o=l(n,u(e.cookieName)),c=await s(e,o,i,e.now());if(c)return{session:c,cookies:[]};let d={session:null,cookies:i!==null||o!==null?F(e,r):[]},p=await t.load(i);if(!p)return d;let{deferRevalidation:m}=e;if(m&&t.revalidationDue(p)&&L(e,m,t,p)){let t=await f(e,p,r,e.now());return{session:p,cookies:t?[t]:[]}}let h=p;try{let e=await t.revalidate(p);if(!e)return d;h=e}catch(t){x(e,`revalidate`,t)}let g=await f(e,h,r,e.now());return{session:h,cookies:g?[g]:[]}}}function L(e,t,n,r){try{return t(async()=>{try{await n.revalidate(r)}catch(t){x(e,`revalidate`,t)}}),!0}catch(t){return x(e,`revalidate`,t),!1}}function R(e,t){let n=I(e,t);return async function(t,i={}){let a=new URL(t.url);if([e.paths.login,e.paths.callback,e.paths.logout,e.paths.logoutComplete,e.paths.error,...i.publicPaths??[]].some(e=>a.pathname.startsWith(e)))return{kind:`ok`,session:null};let{session:o,cookies:s}=await n(t);return o?s.length>0?{kind:`ok`,session:o,cookies:s}:{kind:`ok`,session:o}:r(t,i,s)};function r(e,t,n){let r=n.length>0,a=new URL(e.url),s=(t.apiPaths??[`/api`,`/trpc`]).some(e=>a.pathname.startsWith(e))?Response.json({error:`Unauthorized`},{status:401}):o(i(e,t,r));for(let e of n)s.headers.append(`set-cookie`,e);return{kind:`response`,response:s}}function i(t,n,r){let i=new URL(t.url),o=new URL(e.paths.login,a(t));return o.searchParams.set(`redirect`,n.redirectPath?.(t)??`${i.pathname}${i.search}`),r&&o.searchParams.set(`silent`,`1`),o}}const z=/^[A-Za-z0-9_-]{1,128}$/,B=new Set([`login_required`,`consent_required`,`interaction_required`,`account_selection_required`]);function V(r,s){function u(e,t){let n=new URL(r.paths.login,e);return n.searchParams.set(`redirect`,t),n}function d(e,t,n){let i=new URL(r.paths.error,e);return i.searchParams.set(`reason`,t),n&&i.searchParams.set(`description`,n),i}function _(e,t){let n=m(r.cookieName,``),a=[...i(e.headers.get(`cookie`)).keys()].filter(e=>e.replace(/^__Secure-/,``).startsWith(n)),o=a.length-4;for(let e of a.slice(0,Math.max(0,o)))t.headers.append(`set-cookie`,h(e,``,e.startsWith(`__Secure-`),0))}async function v(e){try{let t=await s.load(e);t&&await s.end(t)}catch(e){x(r,`session_store`,e)}}async function y(t){let n=a(t),i=new URL(t.url).searchParams,s=e(i.get(`redirect`),n),l=i.get(`silent`)===`1`,{url:u,state:d,verifier:f}=await P(r,{origin:n,silent:l}),p=o(u);return _(t,p),g(p.headers,m(r.cookieName,d),c({verifier:f,redirectPath:s,silent:l}),n,r.lifetimes.flowMaxAgeMs),p}async function S(i){let c=a(i),h=new URL(i.url).searchParams,_=h.get(`state`),y=_&&z.test(_)?m(r.cookieName,_):null,S=y?n(l(i,y)):null,C=e=>(y&&t(e.headers,y,c),e);if(!S)return C(o(d(c,`invalid_state`,null)));let w=e(S.redirectPath,c),E=h.get(`iss`);if(E!==null&&E!==D(r.issuer))return C(o(d(c,`invalid_issuer`,null)));let O=h.get(`error`);if(O)return S.silent&&B.has(O)?C(o(u(c,w))):C(o(d(c,O,h.get(`error_description`))));let k=h.get(`code`);if(!k)return C(o(d(c,`invalid_request`,null)));let M,P,F;try{let e=await N(r,{code:k,verifier:S.verifier,redirectUri:new URL(r.paths.callback,c).toString()});M=j(e,null,r.now()),P=await A(T(r),M.accessToken),F=await r.onSignIn({user:P,accessToken:M.accessToken,redirectPath:w,previous:null})}catch(e){return x(r,`sign_in`,e),e instanceof b?C(o(d(c,e.code,e.description||null))):C(o(d(c,`accounts_unavailable`,null)))}let I=l(i,r.cookieName);if(F===null){let e=o(d(c,`access_denied`,null));I!==null&&(await v(I),t(e.headers,r.cookieName,c));for(let t of p(r,c))e.headers.append(`set-cookie`,t);return C(e)}let L,R;try{({cookieValue:L,session:R}=await s.start({user:P,tokens:M,data:F}))}catch(e){return x(r,`session_store`,e),C(o(d(c,`session_store_error`,null)))}I!==null&&await v(I);let V=o(new URL(w,c));g(V.headers,r.cookieName,L,c,r.lifetimes.absoluteMaxAgeMs);let H=await f(r,R,c,r.now());return H&&V.headers.append(`set-cookie`,H),C(V)}async function C(e){let t=a(e),n=await s.load(l(e,r.cookieName));n&&await s.end(n);let i=n?.tokens.idToken&&r.logout===`global`?M(r,{origin:t,idToken:n.tokens.idToken}):new URL(r.paths.logoutComplete,t).toString(),c=o(i,303);for(let e of F(r,t))c.headers.append(`set-cookie`,e);return c}return{login:y,callback:S,logout:C}}const H=e=>new Promise(t=>setTimeout(t,e));function U(e){let{store:t,lifetimes:n}=e;function r(e,t){return t-e.createdAt>=n.absoluteMaxAgeMs||t-e.lastValidatedAt>=n.idleMaxAgeMs}function i(e,t){return e.accessTokenExpiresAt-t<=n.refreshBeforeExpiryMs}function a(t){let r=e.now();return!i(t.tokens,r)&&r-t.lastValidatedAt>=n.revalidateIntervalMs}async function o(n){if(!n)return null;let i=await _(n),a;try{a=await t.read(i)}catch(n){if(!(n instanceof S))throw n;return x(e,`session_store`,n),await t.delete(i),null}return a?r(a,e.now())?(await t.delete(a.id),null):a:null}async function s(n){let r=v(32),i=e.now(),a={id:await _(r),user:n.user,tokens:n.tokens,data:n.data,createdAt:i,lastValidatedAt:i,refreshLeaseUntil:null};return await t.create(a),{session:a,cookieValue:r}}async function c(r){let a=e.now();if(!i(r.tokens,a))return r;if(!r.tokens.refreshToken)return await t.delete(r.id),null;let o=await t.claimRefreshLease(r.id,a+n.refreshLeaseMs,a);if(!o)return l(r.id,a);let s=o.refreshLeaseUntil??void 0;if(!i(o.tokens,a))return await t.update(o.id,{refreshLeaseUntil:null},s)??t.read(o.id);try{let r=await k(e,o.tokens.refreshToken,Math.max(n.refreshLeaseMs-1e3,n.refreshLeaseMs/2));return await t.update(o.id,{tokens:j(r,o.tokens,e.now()),refreshLeaseUntil:null},s)??t.read(o.id)}catch(n){if(y(n))return await t.delete(o.id,s)?null:await t.read(o.id)??null;let r=await t.update(o.id,{refreshLeaseUntil:null},s);if(o.tokens.accessTokenExpiresAt>e.now())return x(e,`refresh`,n),r??o;throw n}}async function l(r,a){for(;;){await H(100);let o=await t.read(r);if(!o)return null;let s=e.now();if(!i(o.tokens,s))return o;if(o.refreshLeaseUntil===null||o.refreshLeaseUntil<=s)return c(o);if(s-a>=n.leaseWaitMs){if(o.tokens.accessTokenExpiresAt>s)return o;throw new C(`Timed out waiting for the session refresh lease`,0)}}}async function u(r){let i;try{i=await c(r)}catch(t){x(e,`refresh`,t),i=r}if(!i)return null;if(e.now()-i.lastValidatedAt<n.revalidateIntervalMs||!d(i.tokens))return i;let a=e.revalidateUser?await p(i):i.user;if(!a)return f(i);if(!d(i.tokens))return i;let o=await e.onRevalidate({session:i,accessToken:i.tokens.accessToken,user:a});if(o===null)return f(i);let s={data:o,lastValidatedAt:e.now()};return a!==i.user&&(s.user=a),t.update(i.id,s)}function d(t){return t.accessTokenExpiresAt-e.now()>n.requestTimeoutMs}async function f(n){return n.tokens.accessTokenExpiresAt<=e.now()?n:(await t.delete(n.id),null)}async function p(t){try{return await A(T(e),t.tokens.accessToken)}catch(n){return y(n)?null:(x(e,`revalidate`,n),t.user)}}async function m(e){await t.delete(e.id)}async function h(){if(!t.sweep)return 0;let r=e.now();return t.sweep({createdBefore:r-n.absoluteMaxAgeMs,validatedBefore:r-n.idleMaxAgeMs})}return{load:o,start:s,ensureFreshTokens:c,revalidate:u,revalidationDue:a,end:m,sweep:h}}function W(){let e=new Map;return{rows:e,async create(t){e.set(t.id,structuredClone(t))},async read(t){let n=e.get(t);return n?structuredClone(n):null},async update(t,n,r){let i=e.get(t);if(!i||r!==void 0&&i.refreshLeaseUntil!==r)return null;let a=structuredClone({...i,...n});return e.set(t,a),structuredClone(a)},async claimRefreshLease(t,n,r){let i=e.get(t);if(!i||i.refreshLeaseUntil!==null&&i.refreshLeaseUntil>r)return null;let a={...i,refreshLeaseUntil:n};return e.set(t,a),structuredClone(a)},async delete(t,n){let r=e.get(t);return!r||n!==void 0&&r.refreshLeaseUntil!==n?!1:(e.delete(t),!0)},async sweep(t){let n=0;for(let[r,i]of e)(i.createdAt<t.createdBefore||i.lastValidatedAt<t.validatedBefore)&&(e.delete(r),n+=1);return n}}}function G(e){let t=E(e),n=U(t),r=V(t,n),i=R(t,n),a=I(t,n);function o(e){return{session:l(e,t.cookieName),cache:l(e,u(t.cookieName))}}async function c(e){return await s(t,e.cache,e.session,t.now())??n.load(e.session)}async function d(e){return c(o(e))}async function f(e){let r=await s(t,e.cache,e.session,t.now());if(r&&r.tokens.accessTokenExpiresAt>t.now())return r.tokens.accessToken;let i=await n.load(e.session);return i?(await n.ensureFreshTokens(i))?.tokens.accessToken??null:null}async function m(e){return f(o(e))}async function h(e,r){let i=await n.load(e.session),a=i&&await t.store.update(i.id,{data:r(i.data)});return a?{session:a,cookies:p(t)}:{session:null,cookies:[]}}function g(){return n.sweep()}return{cookieName:t.cookieName,handlers:r,guard:i,resolveSession:a,sessionFromCookies:c,sessionFromRequest:d,accessTokenFromCookies:f,accessTokenFromRequest:m,updateSessionData:h,sweepSessions:g}}export{C as AccountsRequestError,w as DEFAULT_LIFETIMES,b as OAuthTokenError,S as SessionDecodeError,O as accountsEndpoint,u as cacheCookieBase,G as createAccountsAuth,W as createMemorySessionStore,A as fetchUserInfo,r as forwardCookies,y as isAccessDenied,a as requestOrigin,e as sanitizeRedirectPath};

package/dist/next.d.ts

@@ -1,5 +1,5 @@
 import { s as AccountsSession } from "./types-B13HPcs5.js";
-import { t as AccountsAuth } from "./index-CNcSwzgU.js";
+import { t as AccountsAuth } from "./index-DdBQue0N.js";
 import { NextRequest, NextResponse } from "next/server";
 //#region src/next/index.d.ts
 /**

package/dist/next.js

@@ -1 +1 @@
-import{d as e,n as t,s as n}from"./cache-vq-5GFN7.js";import{io as r}from"next/cache.js";import{cookies as i}from"next/headers";import{NextResponse as a}from"next/server";function o(t,n=[]){e(t.headers,n);let r=a.next({request:{headers:t.headers}});for(let e of n)r.headers.append(`set-cookie`,e);return r}async function s(e){await r();let a=await i(),o=e=>a.get(n(e,!0))?.value||a.get(n(e,!1))?.value||null;return{session:o(e),cache:o(t(e))}}async function c(e){let r=await i(),a=t(e);for(let e of[n(a,!0),n(a,!1)])try{r.delete(e)}catch{}}function l(e){let t=e.cookieName;return{async getSession(){return e.sessionFromCookies(await s(t))},async getAccessToken(){return e.accessTokenFromCookies(await s(t))},async updateSessionData(n){let r=await e.updateSessionData(await s(t),n);return r&&await c(t),r}}}export{o as continueRequest,l as withNextRequestScope};
+import{d as e,n as t,p as n,s as r}from"./cache-iIzAusyV.js";import{io as i}from"next/cache.js";import{cookies as a}from"next/headers";import{NextResponse as o}from"next/server";function s(t,n=[]){e(t.headers,n);let r=o.next({request:{headers:t.headers}});for(let e of n)r.headers.append(`set-cookie`,e);return r}async function c(e){await i();let n=await a(),o=e=>n.get(r(e,!0))?.value||n.get(r(e,!1))?.value||null;return{session:o(e),cache:o(t(e))}}async function l(e){let t=await a();for(let r of e){let e=n(r);if(e)try{t.set(e.name,e.value,e.options)}catch{}}}function u(e){let t=e.cookieName;return{async getSession(){return e.sessionFromCookies(await c(t))},async getAccessToken(){return e.accessTokenFromCookies(await c(t))},async updateSessionData(n){let r=await e.updateSessionData(await c(t),n);return await l(r.cookies),r.session}}}export{s as continueRequest,u as withNextRequestScope};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aui-auth",
-  "version": "0.0.9",
+  "version": "0.0.10",
   "description": "Sign in through assistant-ui accounts: server side sessions for web apps (OIDC code flow with PKCE, tokens kept in the app's store, single flight refresh), the device grant for CLIs, and token verification for resource servers",
   "license": "MIT",
   "type": "module",

package/dist/cache-vq-5GFN7.js

@@ -1 +0,0 @@
-import{n as e}from"./encoding-BhmNmloC.js";import{o as t}from"./errors-C7IxbL16.js";function n(e){if(!e)return;let t=e.split(`,`);return t[t.length-1].trim()||void 0}function r(e){let t=new URL(e.url);return`${n(e.headers.get(`x-forwarded-proto`))||t.protocol.replace(`:`,``)}://${n(e.headers.get(`x-forwarded-host`))||e.headers.get(`host`)||t.host}`}function i(e){return new URL(e).protocol===`https:`}function a(e,t){return t?`__Secure-${e}`:e}function o(e){let t=new Map;if(!e)return t;for(let n of e.split(`;`)){let e=n.indexOf(`=`);if(e===-1)continue;let r=n.slice(0,e).trim();!r||t.has(r)||t.set(r,n.slice(e+1).trim())}return t}function s(e,t){let n=o(e.headers.get(`cookie`));return n.get(a(t,!0))||n.get(a(t,!1))||null}function c(e,t,n,r){let i=[`${e}=${t}`,`Path=/`,`HttpOnly`,`SameSite=Lax`,`Max-Age=${r}`];return n&&i.push(`Secure`),i.join(`; `)}function l(e,t,n,r,o){let s=i(r);e.append(`set-cookie`,c(a(t,s),n,s,Math.floor(o/1e3)))}function u(e,t){if(t.length===0)return;let n=o(e.get(`cookie`));for(let e of t){let t=e.split(`;`)[0],r=t.indexOf(`=`);if(r<1)continue;let i=t.slice(0,r).trim(),a=t.slice(r+1).trim();a?n.set(i,a):n.delete(i)}e.set(`cookie`,[...n].map(([e,t])=>`${e}=${t}`).join(`; `))}function d(e,t){let n=i(t);return[n,!n].map(t=>c(a(e,t),``,t,0))}function f(e,t,n){for(let r of d(t,n))e.append(`set-cookie`,r)}function p(e,t=307){return new Response(null,{status:t,headers:{location:e.toString()}})}function m(e,t){return`${e}_flow_${t}`}function h(e){return btoa(JSON.stringify(e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function g(e){if(!e)return null;try{let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=JSON.parse(atob(t));return typeof n.verifier==`string`?{verifier:n.verifier,redirectPath:typeof n.redirectPath==`string`?n.redirectPath:`/`,silent:n.silent===!0}:null}catch{return null}}function _(e,t){if(!e)return`/`;let n;try{n=new URL(e,t)}catch{return`/`}return n.origin!==t||n.pathname.startsWith(`//`)?`/`:`${n.pathname}${n.search}${n.hash}`}const v=4096;function y(e){return`${e}_cache`}function b(e,t,n){if(!e.cache)return 0;let{lifetimes:r}=e,i=Math.min(t.lastValidatedAt+r.revalidateIntervalMs,t.tokens.accessTokenExpiresAt-r.refreshBeforeExpiryMs);return Math.min(e.cache.maxAgeMs,(i>n?i:n+r.retryIntervalMs)-n,t.createdAt+r.absoluteMaxAgeMs-n,t.lastValidatedAt+r.idleMaxAgeMs-n)}async function x(e,t,n){if(!e.cache)return null;let r=b(e,t,n);if(r<1e3)return null;let i={v:1,id:t.id,u:t.user,d:t.data,at:t.tokens.accessToken,ate:t.tokens.accessTokenExpiresAt,ca:t.createdAt,lv:t.lastValidatedAt,exp:n+r};return{value:await(await e.cache.codec()).encrypt(JSON.stringify(i)),maxAgeMs:r}}async function S(t,n,r,i){if(!t.cache||!n||!r)return null;let a;try{let e=await t.cache.codec();a=JSON.parse(await e.decrypt(n))}catch{return null}return a.v!==1||typeof a.exp!=`number`||a.exp<=i||a.id!==await e(r)?null:{id:a.id,user:a.u,tokens:{accessToken:a.at,refreshToken:null,idToken:null,accessTokenExpiresAt:a.ate},data:a.d,createdAt:a.ca,lastValidatedAt:a.lv,refreshLeaseUntil:null}}async function C(e,n,r,o){try{let t=await x(e,n,o);if(!t)return null;let s=i(r),l=c(a(y(e.cookieName),s),t.value,s,Math.floor(t.maxAgeMs/1e3));if(l.length>v)throw Error(`Cache cookie is ${l.length} bytes and browsers drop cookies over ${v}; the session data is too large to cache`);return l}catch(n){return t(e,`cache_cookie`,n),null}}function w(e,t){return e.cache?d(y(e.cookieName),t):[]}export{c as _,f as a,g as c,u as d,o as f,_ as g,r as h,S as i,h as l,p as m,y as n,d as o,s as p,C as r,a as s,w as t,m as u,l as v};