cauthy-auth 0.5.1 → 0.8.0

package/dist/index.mjs

@@ -109,10 +109,92 @@ function applies(d, o) {
     if (o.mode === "dark" && LIGHT.test(scope)) return false;
     const named = NAMED.exec(scope);
     if (named && !/^(dark|light)$/i.test(named[1]) && named[1] !== o.theme) return false;
-    if (!scope.startsWith("@") && !/:root|^html\b|^body\b|\[data-|^\*$|:host/.test(scope)) return false;
+    if (!scope.startsWith("@") && !/:root|^html\b|^body\b|\[data-|^\*$|:host|^\.(dark|light)\b/.test(scope)) return false;
   }
   return true;
 }
+var TOKEN_CHARS = /^[A-Za-z0-9 #%.,()/'"_+*-]+$/;
+var TOKEN_FUNCS = /* @__PURE__ */ new Set([
+  "var",
+  "calc",
+  "min",
+  "max",
+  "clamp",
+  "rgb",
+  "rgba",
+  "hsl",
+  "hsla",
+  "hwb",
+  "lab",
+  "lch",
+  "oklab",
+  "oklch",
+  "color",
+  "color-mix",
+  "light-dark",
+  "cubic-bezier",
+  "steps",
+  "linear",
+  "linear-gradient",
+  "radial-gradient",
+  "conic-gradient",
+  "repeating-linear-gradient",
+  "repeating-radial-gradient",
+  "drop-shadow",
+  "blur",
+  "translate",
+  "translatex",
+  "translatey",
+  "scale",
+  "rotate"
+]);
+function tokenValue(value) {
+  const v = value.replace(/\s+/g, " ").trim();
+  if (v === "" || v.length > 400 || !TOKEN_CHARS.test(v)) return null;
+  for (const m of v.matchAll(/([A-Za-z-]+)\(/g)) if (!TOKEN_FUNCS.has(m[1].toLowerCase())) return null;
+  if (/^\(|[ ,(]\(/.test(v)) return null;
+  return v;
+}
+var THEME_SCOPE = /^(?:\s*(?::root|html|body|\[data-(?:theme|mode|color-scheme)(?:=["']?[\w-]+["']?)?\])\s*,?)+$/i;
+function tokensFromStackmyth(css, options = {}) {
+  const mode = options.mode ?? "light";
+  const all = (Array.isArray(css) ? css : [css]).flatMap(declarations);
+  const named = options.theme ?? all.map((d) => d.within.map((w) => NAMED.exec(w)?.[1]).find((n) => n && !/^(dark|light)$/i.test(n))).find(Boolean);
+  const vars = /* @__PURE__ */ new Map();
+  for (const d of all) {
+    if (!applies(d, { mode, theme: named })) continue;
+    if (!d.within.every((w) => w.startsWith("@") || THEME_SCOPE.test(w))) continue;
+    vars.set(d.name, d.value);
+  }
+  const inline = (value, depth = 0) => {
+    if (depth > 16) return null;
+    let failed = false;
+    let out2 = value;
+    for (let guard = 0; guard < 64; guard++) {
+      const next = out2.replace(/var\(\s*(--(?!sm-)[\w-]+)\s*(?:,\s*([^()]*(?:\([^()]*\)[^()]*)*))?\)/, (_m, name, fallback) => {
+        const known = vars.get(name);
+        const got = known !== void 0 ? inline(known, depth + 1) : fallback !== void 0 ? inline(fallback.trim(), depth + 1) : null;
+        if (got === null) failed = true;
+        return got ?? "";
+      });
+      if (failed) return null;
+      if (next === out2) break;
+      out2 = next;
+    }
+    return out2;
+  };
+  const tokens = {};
+  const warnings = [];
+  for (const [name, raw] of vars) {
+    if (!/^--sm-[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name)) continue;
+    const written = inline(raw);
+    const value = written === null ? null : tokenValue(written);
+    if (value === null) warnings.push(`${name}: "${raw.length > 60 ? raw.slice(0, 57) + "\u2026" : raw}" is not a value Cauthy takes`);
+    else tokens[name] = value;
+  }
+  if (Object.keys(tokens).length === 0) warnings.push("no --sm-* token was found in these stylesheets");
+  return { tokens, warnings };
+}
 function resolve(value, vars, seen = 0) {
   if (seen > 16) return null;
   let unresolved = false;
@@ -257,7 +339,10 @@ function toWire(theme) {
     panelColors: "panel_colors",
     panelText: "panel_text",
     panelIconUrl: "panel_icon_url",
-    texts: "texts"
+    texts: "texts",
+    inputBackground: "input_background",
+    inputBorder: "input_border",
+    tokens: "tokens"
   };
   const wire = {};
   for (const [k, v] of Object.entries(theme)) {
@@ -289,18 +374,21 @@ function fromWire(wire) {
     panel_colors: "panelColors",
     panel_text: "panelText",
     panel_icon_url: "panelIconUrl",
-    texts: "texts"
+    texts: "texts",
+    input_background: "inputBackground",
+    input_border: "inputBorder",
+    tokens: "tokens"
   };
   const theme = {};
   for (const [k, v] of Object.entries(wire ?? {})) if (names[k] && v !== void 0 && v !== null && v !== "") theme[names[k]] = v;
   return theme;
 }
 async function pushTheme(o) {
-  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const clientId = o.clientId ?? env3("CAUTHY_CLIENT_ID") ?? "";
-  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
+  const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env4("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = o.clientId ?? env4("CAUTHY_CLIENT_ID") ?? "";
+  const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
   for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_CLIENT_ID: clientId, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
     if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a theme`);
   }
@@ -480,6 +568,11 @@ function createSystem(given = {}) {
         return fromWire(await data("GET", `/v1/oauth/clients/${id(of)}/theme`));
       }
     },
+    policy: {
+      async get(system) {
+        return (await data("GET", `/v1/systems/${id(system)}/policy`)).roles ?? [];
+      }
+    },
     async publicJwks() {
       if (!key) return { keys: [] };
       const { kty, n, e } = asJwk(key) ?? await exportJWK(await signingKey());
@@ -488,6 +581,45 @@ function createSystem(given = {}) {
   };
 }
 
+// src/validate.ts
+var MIN_PASSWORD = 8;
+var MAX_PASSWORD = 256;
+var MAX_NAME = 120;
+var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function checkEmail(value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return { field: "email", code: "required", message: "Enter your email address." };
+  if (v.length > 254 || !EMAIL.test(v)) return { field: "email", code: "invalid_email", message: "That does not look like an email address." };
+  return null;
+}
+function checkPassword(value) {
+  if (typeof value !== "string" || value === "") return { field: "password", code: "required", message: "Enter your password." };
+  if (value.length > MAX_PASSWORD) return { field: "password", code: "too_long", message: "That password is too long." };
+  return null;
+}
+function checkNewPassword(value) {
+  const basic = checkPassword(value);
+  if (basic) return basic;
+  if (value.length < MIN_PASSWORD) {
+    return { field: "password", code: "too_short", message: `Use at least ${MIN_PASSWORD} characters.` };
+  }
+  return null;
+}
+function checkName(value) {
+  if (value === void 0 || value === null || value === "") return null;
+  if (typeof value !== "string" || value.trim().length > MAX_NAME) return { field: "name", code: "too_long", message: `Use at most ${MAX_NAME} characters.` };
+  return null;
+}
+function checkCode(value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return { field: "code", code: "required", message: "Enter the code." };
+  if (v.length > 40) return { field: "code", code: "too_long", message: "That is not a code." };
+  return null;
+}
+function firstProblem(...checks) {
+  return checks.find((c) => c !== null) ?? null;
+}
+
 // src/webhook.ts
 import { createRemoteJWKSet, jwtVerify } from "jose";
 var CauthyWebhookError = class extends Error {
@@ -509,8 +641,8 @@ function keysOf(issuer) {
 }
 var hex = (s) => typeof s === "string" && s !== "" ? s : void 0;
 async function verifyWebhook(request, options = {}) {
-  const env3 = typeof process !== "undefined" ? process.env?.CAUTHY_ISSUER : void 0;
-  const issuer = (options.issuer ?? env3 ?? "").replace(/\/+$/, "");
+  const env4 = typeof process !== "undefined" ? process.env?.CAUTHY_ISSUER : void 0;
+  const issuer = (options.issuer ?? env4 ?? "").replace(/\/+$/, "");
   if (issuer === "") throw new CauthyWebhookError("issuer (CAUTHY_ISSUER) is not set");
   const signature = request.headers.get("x-cauthy-signature-jwt");
   if (!signature) throw new CauthyWebhookError("no signature");
@@ -561,9 +693,19 @@ async function verifyWebhook(request, options = {}) {
 
 // src/cauthy.ts
 var SESSION_DAYS = 30;
-var FLOW_SECONDS = 600;
+var FLOW_SECONDS = 3600;
+var AGAIN_SECONDS = 120;
 var SKEW_SECONDS = 30;
 var ORGANIZATIONS_TTL_MS = 6e4;
+var LOOK_TTL_MS = 6e4;
+var PROVIDER_ID = /^(custom:)?[a-z0-9_-]{1,40}$/;
+function providerIn(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return "";
+  }
+}
 function env2(name) {
   return typeof process !== "undefined" ? process.env?.[name] : void 0;
 }
@@ -596,6 +738,7 @@ function createCauthy(given = {}) {
   const clientSecret = given.clientSecret ?? env2("CAUTHY_CLIENT_SECRET");
   const secret = given.secret ?? env2("CAUTHY_SECRET") ?? "";
   const system = given.system ?? env2("CAUTHY_SYSTEM") ?? "";
+  const tenant = given.tenant ?? env2("CAUTHY_TENANT") ?? "";
   if (!/^https?:\/\//.test(issuer)) throw new CauthyConfigError("issuer (CAUTHY_ISSUER) must be Cauthy's address, e.g. https://id.example.com");
   if (clientId === "") throw new CauthyConfigError("clientId (CAUTHY_CLIENT_ID) is required");
   if (secret.length < 32) throw new CauthyConfigError("secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie");
@@ -604,18 +747,26 @@ function createCauthy(given = {}) {
   const afterSignOut = localPath(given.afterSignOut, "/");
   const cookieName = given.cookieName ?? "cauthy_session";
   const flowCookie = `${cookieName}_flow`;
+  const againCookie = `${cookieName}_again`;
+  const stepCookie = `${cookieName}_step`;
   const doFetch = (...args) => (given.fetch ?? fetch)(...args);
   const key = keyOf(secret);
+  const pages = {
+    signIn: given.pages?.signIn ? localPath(given.pages.signIn, "/") : void 0,
+    resetPassword: given.pages?.resetPassword ? localPath(given.pages.resetPassword, "/") : void 0,
+    verifyEmail: given.pages?.verifyEmail ? localPath(given.pages.verifyEmail, "/") : void 0
+  };
+  const ownSystem = createSystem({ issuer, clientId, clientSecret, key: given.systemKey, fetch: given.fetch });
   const originOf = (request) => (given.baseURL ?? new URL(request.url).origin).replace(/\/+$/, "");
   const attrs = (request, maxAge) => ({ secure: originOf(request).startsWith("https://"), maxAge });
   async function token(form) {
-    const body = new URLSearchParams({ client_id: clientId, ...form });
-    if (clientSecret) body.set("client_secret", clientSecret);
+    const body2 = new URLSearchParams({ client_id: clientId, ...form });
+    if (clientSecret) body2.set("client_secret", clientSecret);
     try {
       const res = await doFetch(`${issuer}/v1/oauth/token`, {
         method: "POST",
         headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
-        body
+        body: body2
       });
       if (res.ok) return { ok: true, body: await res.json() };
       return { ok: false, ended: res.status >= 400 && res.status < 500 };
@@ -645,12 +796,12 @@ function createCauthy(given = {}) {
       return null;
     }
   }
-  async function stored(body) {
-    if (typeof body?.access_token !== "string" || typeof body?.refresh_token !== "string") return null;
-    const who = await userinfo(body.access_token);
+  async function stored(body2) {
+    if (typeof body2?.access_token !== "string" || typeof body2?.refresh_token !== "string") return null;
+    const who = await userinfo(body2.access_token);
     if (who === null || who.u.id === "") return null;
-    const lifetime = typeof body.expires_in === "number" && body.expires_in > 0 ? body.expires_in : 300;
-    return { at: body.access_token, rt: body.refresh_token, exp: Math.floor(Date.now() / 1e3) + lifetime, ...who };
+    const lifetime = typeof body2.expires_in === "number" && body2.expires_in > 0 ? body2.expires_in : 300;
+    return { at: body2.access_token, rt: body2.refresh_token, exp: Math.floor(Date.now() / 1e3) + lifetime, ...who };
   }
   function toSession(s) {
     return { user: s.u, tenantId: s.tid, roles: s.roles, accessToken: s.at, expiresAt: new Date(s.exp * 1e3).toISOString() };
@@ -724,8 +875,8 @@ function createCauthy(given = {}) {
     const url = `${issuer}/v1/oauth/organizations${system ? `?system=${encodeURIComponent(system)}` : ""}`;
     const res = await doFetch(url, { headers: { authorization: `Bearer ${session.accessToken}` } });
     if (!res.ok) throw new Error(`cauthy-auth: reading organizations: ${res.status}`);
-    const body = await res.json();
-    const value = (body.data ?? []).map(
+    const body2 = await res.json();
+    const value = (body2.data ?? []).map(
       (o) => ({
         id: String(o.id),
         system: String(o.system ?? ""),
@@ -770,20 +921,28 @@ function createCauthy(given = {}) {
     if (prompt === "login" || prompt === "none") q.set("prompt", prompt);
     const locale = url.searchParams.get("locale") ?? url.searchParams.get("ui_locales");
     if (locale && /^[a-zA-Z-]{2,10}$/.test(locale)) q.set("ui_locales", locale);
-    return redirect(`${issuer}/v1/oauth/authorize?${q}`, [
+    const passkey = url.searchParams.get("method") === "passkey" ? "#passkey" : "";
+    return redirect(`${issuer}/v1/oauth/authorize?${q}${passkey}`, [
       writeCookie(flowCookie, await seal(flow, await key), attrs(request, FLOW_SECONDS))
     ]);
   }
   function failed(request, reason) {
     const h = new Headers({ "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" });
     h.append("set-cookie", writeCookie(flowCookie, "", attrs(request, 0)));
+    h.append("set-cookie", writeCookie(againCookie, "", attrs(request, 0)));
     return new Response(`Sign-in could not be completed (${reason}). Go back and try again.`, { status: 400, headers: h });
   }
   async function callback(request, url) {
     const had = readCookies(request.headers.get("cookie"));
     const sealed = had.get(flowCookie);
     const flow = sealed ? await unseal(sealed, await key) : null;
-    if (flow === null || url.searchParams.get("state") !== flow.state) return failed(request, "state_mismatch");
+    if (flow === null || url.searchParams.get("state") !== flow.state) {
+      if (had.get(againCookie) === void 0) {
+        const back = flow?.returnTo ?? afterSignIn;
+        return redirect(`${basePath}/login?return_to=${encodeURIComponent(back)}`, [writeCookie(againCookie, "1", attrs(request, AGAIN_SECONDS))]);
+      }
+      return failed(request, "state_mismatch");
+    }
     const error = url.searchParams.get("error");
     if (error !== null) {
       if (error === "login_required") return redirect(flow.returnTo, [writeCookie(flowCookie, "", attrs(request, 0))]);
@@ -799,28 +958,332 @@ function createCauthy(given = {}) {
     });
     const s = res.ok ? await stored(res.body) : null;
     if (s === null) return failed(request, "exchange_failed");
-    return redirect(flow.returnTo, [...await write(request, s, had), writeCookie(flowCookie, "", attrs(request, 0))]);
+    return redirect(flow.returnTo, [...await write(request, s, had), writeCookie(flowCookie, "", attrs(request, 0)), writeCookie(againCookie, "", attrs(request, 0))]);
   }
   async function logout(request) {
     const { had, value } = await read(request);
     if (value !== null) {
-      const body = new URLSearchParams({ client_id: clientId, token: value.rt });
-      if (clientSecret) body.set("client_secret", clientSecret);
+      const body2 = new URLSearchParams({ client_id: clientId, token: value.rt });
+      if (clientSecret) body2.set("client_secret", clientSecret);
       await doFetch(`${issuer}/v1/oauth/revoke`, {
         method: "POST",
         headers: { "content-type": "application/x-www-form-urlencoded" },
-        body
+        body: body2
       }).catch(() => void 0);
       orgCache.delete(value.at);
     }
     const q = new URLSearchParams({ client_id: clientId, post_logout_redirect_uri: `${originOf(request)}${afterSignOut}` });
     return redirect(`${issuer}/v1/oauth/logout?${q}`, clearParts(cookieName, attrs(request, 0), had));
   }
+  const STEP_SECONDS = 600;
+  const problem = (status2, code, message, field, headers) => json({ error: { code, message, ...field ? { field } : {} } }, status2, headers);
+  const invalid = (p) => problem(400, p.code, p.message, p.field);
+  function ownRequest(request) {
+    const origin = request.headers.get("origin");
+    if (origin !== null) return origin === originOf(request) || origin === new URL(request.url).origin;
+    return (request.headers.get("sec-fetch-site") ?? "same-origin") === "same-origin";
+  }
+  async function body(request) {
+    if (!(request.headers.get("content-type") ?? "").includes("application/json")) return null;
+    try {
+      const b = await request.json();
+      return typeof b === "object" && b !== null && !Array.isArray(b) ? b : null;
+    } catch {
+      return null;
+    }
+  }
+  const clientIp = given.clientIp ?? ((request) => request.headers.get("x-forwarded-for")?.split(",").pop()?.trim() || void 0);
+  let noProofUntil = 0;
+  async function passedOn(request) {
+    const ip = clientIp(request);
+    if (!ip || Date.now() < noProofUntil) return {};
+    try {
+      return { "x-cauthy-client-ip": ip, "x-cauthy-system-token": await ownSystem.token() };
+    } catch {
+      noProofUntil = Date.now() + 5 * 6e4;
+      return {};
+    }
+  }
+  async function ask(request, method, path, payload, page, bearer2) {
+    try {
+      const res = await doFetch(`${issuer}${path}`, {
+        method,
+        headers: {
+          "x-tenant-key": tenant,
+          accept: "application/json",
+          // A link Cauthy mails opens the application's page for it when it
+          // has one; otherwise Cauthy's own. Either way in the reader's language.
+          ...page ? { "x-cauthy-link-to": `${originOf(request)}${page}`, "x-cauthy-client-id": clientId } : { "x-cauthy-links": "hosted" },
+          ...await passedOn(request),
+          ...bearer2 ? { authorization: `Bearer ${bearer2}` } : {},
+          ...request.headers.get("accept-language") ? { "accept-language": request.headers.get("accept-language") } : {},
+          ...request.headers.get("user-agent") ? { "user-agent": request.headers.get("user-agent") } : {},
+          ...payload === void 0 ? {} : { "content-type": "application/json" }
+        },
+        body: payload === void 0 ? void 0 : JSON.stringify(payload)
+      });
+      const b = res.status === 204 || res.status === 202 ? null : await res.json().catch(() => null);
+      if (res.ok) return { status: res.status, data: b?.data ?? b };
+      const first = b?.errors?.[0];
+      return { status: res.status, data: null, error: { code: String(first?.code ?? "error"), message: String(first?.message ?? "The request could not be completed.") } };
+    } catch {
+      return { status: 503, data: null, error: { code: "unavailable", message: "Sign-in is unavailable right now. Try again in a moment." } };
+    }
+  }
+  const accountOf = (d) => ({
+    id: String(d?.id ?? ""),
+    email: String(d?.email ?? ""),
+    name: String(d?.name ?? ""),
+    emailVerified: d?.email_verified === true,
+    hasPassword: d?.has_password === true,
+    mfaEnabled: d?.mfa_enabled === true
+  });
+  async function signedInAs(request) {
+    const r = await resolve2(request);
+    const headers = new Headers();
+    for (const c of r.cookies) headers.append("set-cookie", c);
+    if (r.session === null) return { response: problem(401, "unauthenticated", "Sign in first.", void 0, headers) };
+    return { token: r.session.accessToken, kept: r.cookies.length === 0 ? (await read(request)).value : null, headers };
+  }
+  async function signedIn(request, tokens, extra = []) {
+    const s = await stored(tokens);
+    if (s === null) return problem(502, "unavailable", "Sign-in is unavailable right now. Try again in a moment.");
+    const h = new Headers();
+    for (const c of [...await write(request, s, readCookies(request.headers.get("cookie"))), ...extra]) h.append("set-cookie", c);
+    return json({ status: "signed_in", session: await toPublic(toSession(s)) }, 200, h);
+  }
+  let lookCache = null;
+  async function ownRoute(request, url, route) {
+    const post = request.method === "POST";
+    const own = ["/sign-in/email", "/sign-in/mfa", "/sign-up/email", "/forgot-password", "/reset-password", "/verify-email", "/sign-in/magic-link", "/sign-in/magic-link/verify", "/sign-in/email-code", "/me", "/me/password", "/me/mfa/setup", "/me/mfa/verify", "/me/mfa/disable", "/me/mfa/recovery-codes", "/me/sessions", "/me/sessions/end", "/sign-out", "/methods", "/look"].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/");
+    if (!own) return null;
+    if (tenant === "") {
+      return problem(500, "not_configured", "cauthy-auth: tenant (CAUTHY_TENANT) is required for the application's own sign-in screens");
+    }
+    if (route === "/look" && !post) {
+      if (lookCache === null || lookCache.until < Date.now()) {
+        const res = await ask(request, "GET", `/v1/auth/look/${encodeURIComponent(clientId)}`);
+        lookCache = { until: Date.now() + LOOK_TTL_MS, look: res.error ? {} : res.data ?? {} };
+      }
+      return json(lookCache.look);
+    }
+    if (route === "/methods" && !post) {
+      const [providers, settings] = await Promise.all([ask(request, "GET", "/v1/auth/social/providers"), ask(request, "GET", "/v1/auth/settings")]);
+      const list = Array.isArray(providers.data) ? providers.data : [];
+      return json({
+        providers: list.map((p) => ({ id: String(p.provider ?? p.id ?? ""), name: String(p.label ?? p.name ?? p.provider ?? "") })).filter((p) => p.id !== ""),
+        signUp: settings.data?.allow_signup !== false,
+        // A sign-in link needs a page of the application to open.
+        magicLink: settings.data?.allow_magic_link === true && pages.signIn !== void 0,
+        // Asked for on Cauthy's page: the person goes there for that step and comes back.
+        passkey: true
+      });
+    }
+    if (route.startsWith("/sign-in/social/") && !post) {
+      const provider = providerIn(route.slice("/sign-in/social/".length));
+      if (!PROVIDER_ID.test(provider)) return new Response("Not found", { status: 404 });
+      const returnTo = localPath(url.searchParams.get("return_to"), afterSignIn);
+      const callback2 = `${basePath}/callback/${provider}`;
+      const started = await ask(request, "GET", `/v1/auth/social/${provider}?redirect_uri=${encodeURIComponent(`${originOf(request)}${callback2}`)}`, void 0, callback2);
+      if (started.error || typeof started.data?.redirect_url !== "string") {
+        return redirect(`${returnTo}${returnTo.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(started.error?.code ?? "provider_unavailable")}`);
+      }
+      const step = { kind: "social", token: String(started.data.state ?? ""), provider, returnTo };
+      return redirect(started.data.redirect_url, [writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS))]);
+    }
+    if (route.startsWith("/callback/") && !post) {
+      const provider = providerIn(route.slice("/callback/".length));
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unseal(sealed, await key) : null;
+      const clear = writeCookie(stepCookie, "", attrs(request, 0));
+      const back = step?.returnTo ?? afterSignIn;
+      const failedTo = (code2) => redirect(`${back}${back.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code2)}`, [clear]);
+      if (step === null || step.kind !== "social" || step.provider !== provider || url.searchParams.get("state") !== step.token) return failedTo("state_mismatch");
+      const code = url.searchParams.get("code");
+      if (!code) return failedTo(url.searchParams.get("error") === "access_denied" ? "cancelled" : "provider_refused");
+      const q = new URLSearchParams({ code, state: step.token, redirect_uri: `${originOf(request)}${basePath}/callback/${provider}` });
+      const done = await ask(request, "GET", `/v1/auth/social/${provider}/callback?${q}`);
+      if (done.error) return failedTo(done.error.code);
+      const s = await stored(done.data);
+      if (s === null) return failedTo("unavailable");
+      return redirect(back, [...await write(request, s, readCookies(request.headers.get("cookie"))), clear]);
+    }
+    if ((route === "/me" || route === "/me/sessions") && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      const res = await ask(request, "GET", route === "/me" ? "/v1/auth/me" : "/v1/auth/me/sessions", void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      if (route === "/me/sessions") {
+        const list = Array.isArray(res.data) ? res.data : [];
+        return json({ sessions: list.map((x) => ({ device: String(x.device ?? ""), ip: String(x.ip ?? ""), createdAt: String(x.created_at ?? ""), expiresAt: String(x.expires_at ?? "") })) }, 200, mine.headers);
+      }
+      return json({ account: accountOf(res.data) }, 200, mine.headers);
+    }
+    if (!post) return new Response("Method not allowed", { status: 405, headers: { allow: "POST" } });
+    if (!ownRequest(request)) return problem(403, "cross_site", "This request did not come from this application.");
+    if (route === "/sign-out") {
+      const { had, value } = await read(request);
+      if (value !== null) {
+        const form = new URLSearchParams({ client_id: clientId, token: value.rt });
+        if (clientSecret) form.set("client_secret", clientSecret);
+        await doFetch(`${issuer}/v1/oauth/revoke`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form }).catch(() => void 0);
+        orgCache.delete(value.at);
+      }
+      const h = new Headers();
+      for (const c of clearParts(cookieName, attrs(request, 0), had)) h.append("set-cookie", c);
+      return json({ status: "signed_out" }, 200, h);
+    }
+    const b = await body(request);
+    if (b === null) return problem(400, "bad_request", "Send the form as JSON.");
+    if (route === "/sign-in/email") {
+      const bad = firstProblem(checkEmail(b.email), checkPassword(b.password));
+      if (bad) return invalid(bad);
+      const res = await ask(request, "POST", "/v1/auth/login", { email: String(b.email).trim(), password: b.password });
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      if (res.data?.mfa_required === true) {
+        const step = { kind: "mfa", token: String(res.data.mfa_token ?? ""), returnTo: afterSignIn };
+        return json({ status: "mfa_required" }, 200, new Headers({ "set-cookie": writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS)) }));
+      }
+      return signedIn(request, res.data);
+    }
+    if (route === "/sign-in/mfa") {
+      const bad = checkCode(b.code);
+      if (bad) return invalid(bad);
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unseal(sealed, await key) : null;
+      if (step === null || step.kind !== "mfa") return problem(400, "step_expired", "Sign in again: the code was asked for too long ago.");
+      const res = await ask(request, "POST", "/v1/auth/mfa/challenge", { mfa_token: step.token, code: String(b.code).trim() });
+      if (res.error) return problem(res.status, res.error.code, res.error.message, "code");
+      return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))]);
+    }
+    if (route === "/sign-up/email") {
+      const bad = firstProblem(checkName(b.name), checkEmail(b.email), checkNewPassword(b.password));
+      if (bad) return invalid(bad);
+      const email = String(b.email).trim();
+      const made = await ask(request, "POST", "/v1/auth/register", { email, password: b.password, display_name: typeof b.name === "string" ? b.name.trim() : "" }, pages.verifyEmail);
+      if (made.error) return problem(made.status, made.error.code, made.error.message);
+      if (made.data?.verification_required === true) return json({ status: "verification_required", email });
+      const res = await ask(request, "POST", "/v1/auth/login", { email, password: b.password });
+      if (res.error || res.data?.mfa_required === true) return json({ status: "verification_required", email });
+      return signedIn(request, res.data);
+    }
+    if (route === "/forgot-password") {
+      const bad = checkEmail(b.email);
+      if (bad) return invalid(bad);
+      await ask(request, "POST", "/v1/auth/password/reset", { email: String(b.email).trim() }, pages.resetPassword);
+      return json({ status: "sent" });
+    }
+    if (route.startsWith("/me")) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      const as = (path, payload, method = "POST") => ask(request, method, path, payload, void 0, mine.token);
+      const refused = (res, field) => problem(res.status, res.error.code, res.error.message, field, mine.headers);
+      const password = typeof b.password === "string" ? b.password : "";
+      if (route === "/me") {
+        const bad = checkName(b.name);
+        if (bad) return invalid(bad);
+        const res = await as("/v1/auth/me", { name: typeof b.name === "string" ? b.name.trim() : "" }, "PATCH");
+        if (res.error) return refused(res, "name");
+        const h = mine.headers;
+        if (mine.kept !== null) {
+          const again = await stored({ access_token: mine.kept.at, refresh_token: mine.kept.rt, expires_in: Math.max(1, mine.kept.exp - Math.floor(Date.now() / 1e3)) });
+          if (again !== null) for (const c of await write(request, again, readCookies(request.headers.get("cookie")))) h.append("set-cookie", c);
+        }
+        return json({ status: "saved", account: accountOf(res.data) }, 200, h);
+      }
+      if (route === "/me/password") {
+        const bad = checkNewPassword(b.newPassword);
+        if (bad) return problem(400, bad.code, bad.message, "newPassword");
+        const res = await as("/v1/auth/me/password", { current_password: password, new_password: b.newPassword });
+        if (res.error) return refused(res, res.error.code === "wrong_password" ? "password" : res.error.code === "weak_password" ? "newPassword" : void 0);
+        const next = await stored(res.data);
+        const h = new Headers();
+        const had = readCookies(request.headers.get("cookie"));
+        for (const c of next !== null ? await write(request, next, had) : clearParts(cookieName, attrs(request, 0), had)) h.append("set-cookie", c);
+        return json({ status: "changed", signedIn: next !== null }, 200, h);
+      }
+      if (route === "/me/mfa/setup") {
+        const res = await as("/v1/auth/mfa/setup", { password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
+        return json({ status: "started", secret: String(res.data?.secret ?? ""), otpauthUri: String(res.data?.otpauth_uri ?? "") }, 200, mine.headers);
+      }
+      if (route === "/me/mfa/verify") {
+        const bad = checkCode(b.code);
+        if (bad) return invalid(bad);
+        const res = await as("/v1/auth/mfa/verify", { code: String(b.code).trim() });
+        if (res.error) return refused(res, "code");
+        return json({ status: "enabled", recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers);
+      }
+      if (route === "/me/mfa/disable") {
+        const res = await as("/v1/auth/me/mfa/disable", { password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
+        return json({ status: "disabled" }, 200, mine.headers);
+      }
+      if (route === "/me/mfa/recovery-codes") {
+        const res = await as("/v1/auth/me/mfa/recovery-codes", { password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
+        return json({ status: "renewed", recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers);
+      }
+      if (route === "/me/sessions/end") {
+        const res = await as("/v1/auth/me/sessions", void 0, "DELETE");
+        if (res.error) return refused(res);
+        const h = new Headers();
+        for (const c of clearParts(cookieName, attrs(request, 0), readCookies(request.headers.get("cookie")))) h.append("set-cookie", c);
+        orgCache.delete(mine.token);
+        return json({ status: "signed_out" }, 200, h);
+      }
+      return null;
+    }
+    const isToken = (v) => typeof v === "string" && v !== "" && v.length <= 512;
+    const badLink = () => problem(422, "invalid_token", "This link is not valid, or it has expired.");
+    if (route === "/reset-password") {
+      if (!isToken(b.token)) return badLink();
+      const bad = checkNewPassword(b.password);
+      if (bad) return invalid(bad);
+      const res = await ask(request, "POST", "/v1/auth/password/change", { token: String(b.token), new_password: b.password });
+      if (res.error) return problem(res.status, res.error.code, res.error.message, res.error.code === "weak_password" ? "password" : void 0);
+      return json({ status: "changed" });
+    }
+    if (route === "/verify-email") {
+      if (!isToken(b.token)) return badLink();
+      const res = await ask(request, "POST", "/v1/auth/email/verify", { token: String(b.token) });
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return json({ status: "verified" });
+    }
+    if (route === "/sign-in/magic-link") {
+      const bad = checkEmail(b.email);
+      if (bad) return invalid(bad);
+      if (pages.signIn === void 0) return problem(500, "not_configured", "cauthy-auth: pages.signIn is required for sign-in links: it is the page the link opens");
+      const email = String(b.email).trim();
+      await ask(request, "POST", "/v1/auth/magic-link/request", { email }, pages.signIn);
+      const step = { kind: "code", token: email, returnTo: afterSignIn };
+      return json({ status: "sent" }, 200, new Headers({ "set-cookie": writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS)) }));
+    }
+    if (route === "/sign-in/email-code") {
+      const bad = checkCode(b.code);
+      if (bad) return invalid(bad);
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unseal(sealed, await key) : null;
+      if (step === null || step.kind !== "code") return problem(400, "step_expired", "Ask for a new link: this one was asked for too long ago.");
+      const res = await ask(request, "POST", "/v1/auth/magic-link/verify-code", { email: step.token, code: String(b.code).trim() });
+      if (res.error) return problem(res.status, res.error.code, res.error.message, "code");
+      return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))]);
+    }
+    if (route === "/sign-in/magic-link/verify") {
+      if (!isToken(b.token)) return badLink();
+      const res = await ask(request, "POST", "/v1/auth/magic-link/verify", { token: String(b.token) });
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return signedIn(request, res.data);
+    }
+    return null;
+  }
   async function handler(request) {
     const url = new URL(request.url);
     if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) return new Response("Not found", { status: 404 });
     const route = url.pathname.slice(basePath.length).replace(/\/+$/, "") || "/";
     const get = request.method === "GET" || request.method === "HEAD";
+    const mine = await ownRoute(request, url, route);
+    if (mine !== null) return mine;
     if (route === "/login" && get) return login(request, url);
     if (route === "/callback" && get) return callback(request, url);
     if (route === "/logout" && (get || request.method === "POST")) return logout(request);
@@ -864,7 +1327,7 @@ function createCauthy(given = {}) {
   return {
     handler,
     webhook,
-    system: createSystem({ issuer, clientId, clientSecret, key: given.systemKey, fetch: given.fetch }),
+    system: ownSystem,
     getSession,
     status,
     resolve: resolve2,
@@ -889,12 +1352,101 @@ function can(organization, resource, action) {
   if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false;
   return organization.permissions.some((p) => matches(p, resource, action));
 }
+function definePolicy(roles) {
+  const entry = (p) => `${p.resource}:${p.action}`;
+  const byName = new Map(roles.map((r) => [r.role, r]));
+  const split = (permission) => {
+    const i = permission.lastIndexOf(":");
+    return i < 0 ? [permission, ""] : [permission.slice(0, i), permission.slice(i + 1)];
+  };
+  return {
+    roles: roles.map((r) => ({
+      role: r.role,
+      ...r.name !== void 0 ? { name: r.name } : {},
+      ...r.description !== void 0 ? { description: r.description } : {},
+      ...r.inherits ? { inherits: [...r.inherits] } : {},
+      ...r.permissions ? { permissions: r.permissions.map((p) => ({ ...p })) } : {}
+    })),
+    roleNames: roles.map((r) => r.role),
+    permissions: [...new Set(roles.flatMap((r) => (r.permissions ?? []).map(entry)))],
+    can(organization, permission) {
+      const [resource, action] = split(permission);
+      return can(organization, resource, action);
+    },
+    hasRole(organization, ...wanted) {
+      return organization != null && wanted.includes(organization.role);
+    },
+    permissionsOf(role) {
+      const seen = /* @__PURE__ */ new Set();
+      const out2 = /* @__PURE__ */ new Set();
+      const walk = (name) => {
+        if (seen.has(name)) return;
+        seen.add(name);
+        const r = byName.get(name);
+        for (const p of r?.permissions ?? []) out2.add(entry(p));
+        for (const parent of r?.inherits ?? []) walk(parent);
+      };
+      walk(role);
+      return [...out2];
+    }
+  };
+}
+var IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+function policySource(system, roles) {
+  const text = (v) => JSON.stringify(v);
+  const key = (k) => IDENT.test(k) ? k : text(k);
+  const one = (r) => {
+    const parts = [`role: ${text(r.role)}`];
+    if (r.name) parts.push(`name: ${text(r.name)}`);
+    if (r.description) parts.push(`description: ${text(r.description)}`);
+    if (r.inherits?.length) parts.push(`inherits: [${r.inherits.map(text).join(", ")}]`);
+    if (r.permissions?.length) {
+      const list = r.permissions.map((p) => `      { ${[...p.kind && p.kind !== "*" ? [`${key("kind")}: ${text(p.kind)}`] : [], `resource: ${text(p.resource)}`, `action: ${text(p.action)}`].join(", ")} },`);
+      parts.push(`permissions: [
+${list.join("\n")}
+    ]`);
+    }
+    return `  {
+    ${parts.join(",\n    ")},
+  },`;
+  };
+  return `// The catalog of roles of ${text(system)}, as Cauthy has it.
+// Written by \`cauthy-auth policy --pull\`: run it again after the catalog
+// changes, and do not edit this file by hand.
+
+import { definePolicy, type PermissionOf, type RoleOf } from 'cauthy-auth'
+
+export const policy = definePolicy([
+${roles.map(one).join("\n")}
+])
+
+export const { can, hasRole } = policy
+export type Role = RoleOf<typeof policy>
+export type Permission = PermissionOf<typeof policy>
+`;
+}
+async function pullPolicy(o = {}) {
+  const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env4("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const system = o.system ?? env4("CAUTHY_SYSTEM") ?? "";
+  const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_SYSTEM: system, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to read a policy`);
+  }
+  const res = await (o.fetch ?? fetch)(`${issuer}/v1/systems/${encodeURIComponent(system)}/policy`, {
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, accept: "application/json" }
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok) throw new Error(`cauthy-auth: Cauthy refused to give the policy (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
+  return body?.data?.roles ?? [];
+}
 async function pushPolicy(o) {
-  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const system = o.system ?? env3("CAUTHY_SYSTEM") ?? "";
-  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
+  const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env4("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const system = o.system ?? env4("CAUTHY_SYSTEM") ?? "";
+  const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
   for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_SYSTEM: system, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
     if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a policy`);
   }
@@ -917,10 +1469,10 @@ function sessionSecret() {
   return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 async function connectSystem(o) {
-  const env3 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
-  const issuer = (o.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
-  const tenant = o.tenant ?? env3("CAUTHY_TENANT") ?? "";
-  const token = o.token ?? env3("CAUTHY_TOKEN") ?? "";
+  const env4 = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env4("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const tenant = o.tenant ?? env4("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env4("CAUTHY_TOKEN") ?? "";
   for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
     if (v === "") throw new Error(`cauthy-auth: ${name} is required to connect a system`);
   }
@@ -952,17 +1504,88 @@ async function connectSystem(o) {
     env: { ...d.env, CAUTHY_SECRET: sessionSecret() }
   };
 }
+
+// src/verify.ts
+import { createRemoteJWKSet as createRemoteJWKSet2, jwtVerify as jwtVerify2 } from "jose";
+var CauthyTokenError = class extends Error {
+  constructor(reason) {
+    super(`cauthy-auth: token refused: ${reason}`);
+    this.reason = reason;
+    this.name = "CauthyTokenError";
+  }
+  reason;
+};
+var keys2 = /* @__PURE__ */ new Map();
+function keysOf2(issuer) {
+  let set = keys2.get(issuer);
+  if (set === void 0) {
+    set = createRemoteJWKSet2(new URL(`${issuer}/.well-known/jwks.json`), { cooldownDuration: 3e4 });
+    keys2.set(issuer, set);
+  }
+  return set;
+}
+function env3(name) {
+  return typeof process !== "undefined" ? process.env?.[name] : void 0;
+}
+function bearer(from) {
+  if (typeof from === "string") return from.replace(/^Bearer\s+/i, "").trim();
+  const header = (from instanceof Headers ? from : from.headers).get("authorization") ?? "";
+  return /^Bearer\s+/i.test(header) ? header.replace(/^Bearer\s+/i, "").trim() : "";
+}
+async function verifyToken(from, options = {}) {
+  const issuer = (options.issuer ?? env3("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  if (issuer === "") throw new CauthyTokenError("issuer (CAUTHY_ISSUER) is not set");
+  const token = bearer(from);
+  if (token === "") throw new CauthyTokenError("no token");
+  let claims;
+  try {
+    const verified = await jwtVerify2(token, options.jwks ?? keysOf2(issuer), {
+      algorithms: ["RS256"],
+      issuer,
+      audience: options.audience ?? env3("CAUTHY_AUDIENCE"),
+      requiredClaims: ["exp", "sub"],
+      currentDate: options.now
+    });
+    claims = verified.payload;
+  } catch (err) {
+    throw new CauthyTokenError(err instanceof Error ? err.message : "bad signature");
+  }
+  const tenantId = typeof claims.tid === "string" ? claims.tid : "";
+  const wanted = options.tenantId ?? env3("CAUTHY_TENANT_ID");
+  if (wanted && tenantId !== wanted) throw new CauthyTokenError("issued for another workspace");
+  return {
+    userId: String(claims.sub),
+    tenantId,
+    ...typeof claims.email === "string" && claims.email !== "" ? { email: claims.email } : {},
+    roles: Array.isArray(claims.roles) ? claims.roles.filter((r) => typeof r === "string") : [],
+    ...typeof claims.sys === "string" && claims.sys !== "" ? { system: claims.sys } : {},
+    expiresAt: new Date(claims.exp * 1e3).toISOString(),
+    token
+  };
+}
 export {
   CauthyApiError,
   CauthyConfigError,
+  CauthyTokenError,
   CauthyWebhookError,
+  MIN_PASSWORD,
   can,
+  checkCode,
+  checkEmail,
+  checkName,
+  checkNewPassword,
+  checkPassword,
   connectSystem,
   createCauthy,
   createSystem,
+  definePolicy,
+  policySource,
+  pullPolicy,
   pushPolicy,
   pushTheme,
   themeFromStackmyth,
+  tokensFromStackmyth,
+  verifyToken,
   verifyWebhook
 };
 //# sourceMappingURL=index.mjs.map