authhero 8.5.0 → 8.6.0

package/dist/authhero.mjs

@@ -5134,7 +5134,7 @@ var Jee = (e, t) => {
 }, Uo = (e, t, n, r) => {
 	let i = Ho(t, n, r);
 	e.header("Set-Cookie", i, { append: !0 });
-}, Wo = "mqmg4m5t", Go = /* @__PURE__ */ p({
+}, Wo = "mqoyl2ij", Go = /* @__PURE__ */ p({
 	common: () => Ko,
 	consent: () => qo,
 	default: () => ts,
@@ -30025,32 +30025,38 @@ async function GM(e, { user: t, client: n, loginSession: r, existingSessionId: i
 		if (s.session_id) return s.session_id;
 		throw new _(500, { message: "Login session is authenticated but has no session_id" });
 	}
-	let l;
+	let l, u;
 	if (i) {
 		let a = await e.env.data.sessions.get(n.tenant.id, i);
-		!a || a.revoked_at ? l = (await WM(e, {
+		if (!a || a.revoked_at) {
+			let i = await WM(e, {
+				user: t,
+				client: n,
+				loginSession: r
+			});
+			l = i.id, u = i.authenticated_at;
+		} else l = i, u = a.authenticated_at, a.clients.includes(n.client_id) || await e.env.data.sessions.update(n.tenant.id, i, { clients: [...a.clients, n.client_id] });
+	} else {
+		let i = await WM(e, {
 			user: t,
 			client: n,
 			loginSession: r
-		})).id : (l = i, a.clients.includes(n.client_id) || await e.env.data.sessions.update(n.tenant.id, i, { clients: [...a.clients, n.client_id] }));
-	} else l = (await WM(e, {
-		user: t,
-		client: n,
-		loginSession: r
-	})).id;
-	let { state: u } = IM(c === N.EXPIRED ? N.PENDING : c, {
+		});
+		l = i.id, u = i.authenticated_at;
+	}
+	let { state: d } = IM(c === N.EXPIRED ? N.PENDING : c, {
 		type: PM.AUTHENTICATE,
 		userId: t.user_id
-	}), d = vA({
+	}), f = vA({
 		authConnection: a,
 		ctxConnection: e.var.connection
 	});
 	return await e.env.data.loginSessions.update(n.tenant.id, r.id, {
 		session_id: l,
-		state: u,
+		state: d,
 		user_id: t.user_id,
-		authenticated_at: (/* @__PURE__ */ new Date()).toISOString(),
-		...d ? { auth_connection: d } : {},
+		authenticated_at: u,
+		...f ? { auth_connection: f } : {},
 		...o ? { auth_strategy: o } : {},
 		...c === N.EXPIRED ? { expires_at: new Date(Date.now() + SD * 1e3).toISOString() } : {}
 	}), l;
@@ -50739,7 +50745,7 @@ function uY(t) {
 			let n = e.var.tenant_id || e.req.header("tenant-id");
 			n && (await r.clients.list(n, {})).clients.flatMap((e) => e.web_origins || []).includes(a) && o(a);
 		}
-	}), n.onError((e, t) => {
+	}), t.tenantDispatch && n.use(t.tenantDispatch), n.onError((e, t) => {
 		if (!(e instanceof _)) throw e;
 		let n = e.status;
 		if (n < 400 || n >= 500) throw e;
@@ -54059,14 +54065,30 @@ function a$(e, t = [], n = {}) {
 }
 function o$(e, t, n = {}) {
 	if (e.protocol !== t.protocol) return !1;
-	if (n.allowPathWildcards && t.pathname.includes("*")) {
+	let r = !!n.allowPathWildcards && t.pathname.includes("*");
+	if (r) {
 		let n = t.pathname.replace(/\*/g, ".*").replace(/\//g, "\\/");
 		if (!RegExp(`^${n}$`).test(e.pathname)) return !1;
 	} else if (e.pathname !== t.pathname) return !1;
-	if (t.search) {
-		for (let [n, r] of t.searchParams) if (e.searchParams.get(n) !== r) return !1;
+	let i = !!n.allowSubDomainWildcards && t.hostname.startsWith("*.") && t.hostname.split(".").length > 2 && ["http:", "https:"].includes(t.protocol), a = !r && !i;
+	for (let n of new Set(t.searchParams.keys())) {
+		let r = t.searchParams.getAll(n).sort(), i = e.searchParams.getAll(n);
+		if (a) {
+			let e = i.slice().sort();
+			if (r.length !== e.length || !r.every((t, n) => t === e[n])) return !1;
+		} else {
+			let e = i.slice();
+			for (let t of r) {
+				let n = e.indexOf(t);
+				if (n === -1) return !1;
+				e.splice(n, 1);
+			}
+		}
+	}
+	if (a) {
+		for (let n of e.searchParams.keys()) if (!t.searchParams.has(n)) return !1;
 	}
-	if (n.allowSubDomainWildcards && t.hostname.startsWith("*.") && t.hostname.split(".").length > 2 && ["http:", "https:"].includes(t.protocol)) {
+	if (i) {
 		let n = t.hostname.split(".").slice(1).join(".");
 		return e.hostname === n || e.hostname.endsWith("." + n);
 	}