dauth-md-node 3.0.2 → 4.0.0

package/dist/chunk-4A7BR4EM.mjs

@@ -0,0 +1,82 @@
+// src/api/utils/config.ts
+var apiVersion = "v1";
+var serverDomain = "dauth.ovh";
+function getServerBasePath() {
+  if (process.env.DAUTH_URL) {
+    const base = process.env.DAUTH_URL.replace(/\/+$/, "");
+    return `${base}/api/${apiVersion}`;
+  }
+  const isLocalhost = process.env.NODE_ENV === "development";
+  const serverPort = 4012;
+  const serverLocalUrl = `http://localhost:${serverPort}/api/${apiVersion}`;
+  const serverProdUrl = `https://${serverDomain}/api/${apiVersion}`;
+  return isLocalhost ? serverLocalUrl : serverProdUrl;
+}
+
+// src/session.ts
+import crypto from "crypto";
+var INFO = "dauth-cookie-enc-v1";
+var DEFAULT_SALT = Buffer.from(
+  "a3f8c1d7e9b24f6081c5d3a7e2f49b0653d81f7a2e94c0b6d8f3a5e1c7b09d42",
+  "hex"
+);
+async function deriveEncryptionKey(tsk, salt) {
+  const saltBuf = salt ? Buffer.from(salt, "hex") : DEFAULT_SALT;
+  return new Promise((resolve, reject) => {
+    crypto.hkdf(
+      "sha256",
+      Buffer.from(tsk),
+      saltBuf,
+      INFO,
+      32,
+      (err, derivedKey) => {
+        if (err) return reject(err);
+        resolve(Buffer.from(derivedKey));
+      }
+    );
+  });
+}
+function encryptSession(payload, key) {
+  const nonce = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv("aes-256-gcm", key, nonce);
+  const plaintext = JSON.stringify(payload);
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext, "utf8"),
+    cipher.final()
+  ]);
+  const authTag = cipher.getAuthTag();
+  return Buffer.concat([nonce, encrypted, authTag]).toString("base64");
+}
+function decryptSession(ciphertext, key) {
+  try {
+    const buf = Buffer.from(ciphertext, "base64");
+    if (buf.length < 12 + 16) return null;
+    const nonce = buf.subarray(0, 12);
+    const authTag = buf.subarray(buf.length - 16);
+    const encrypted = buf.subarray(12, buf.length - 16);
+    const decipher = crypto.createDecipheriv("aes-256-gcm", key, nonce);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([
+      decipher.update(encrypted),
+      decipher.final()
+    ]);
+    return JSON.parse(decrypted.toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function decryptSessionWithKeys(ciphertext, keys) {
+  for (const key of keys) {
+    const result = decryptSession(ciphertext, key);
+    if (result) return result;
+  }
+  return null;
+}
+
+export {
+  getServerBasePath,
+  deriveEncryptionKey,
+  encryptSession,
+  decryptSessionWithKeys
+};
+//# sourceMappingURL=chunk-4A7BR4EM.mjs.map

package/dist/chunk-4A7BR4EM.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/api/utils/config.ts","../src/session.ts"],"sourcesContent":["export const apiVersion = 'v1';\nexport const serverDomain = 'dauth.ovh';\n\nexport function getServerBasePath(): string {\n  if (process.env.DAUTH_URL) {\n    const base = process.env.DAUTH_URL.replace(/\\/+$/, '');\n    return `${base}/api/${apiVersion}`;\n  }\n\n  const isLocalhost = process.env.NODE_ENV === 'development';\n  const serverPort = 4012;\n  const serverLocalUrl = `http://localhost:${serverPort}/api/${apiVersion}`;\n  const serverProdUrl = `https://${serverDomain}/api/${apiVersion}`;\n  return isLocalhost ? serverLocalUrl : serverProdUrl;\n}\n","import crypto from 'crypto';\n\nexport interface SessionPayload {\n  accessToken: string;\n  refreshToken: string;\n}\n\nconst INFO = 'dauth-cookie-enc-v1';\nconst DEFAULT_SALT = Buffer.from(\n  'a3f8c1d7e9b24f6081c5d3a7e2f49b0653d81f7a2e94c0b6d8f3a5e1c7b09d42',\n  'hex'\n);\n\nexport async function deriveEncryptionKey(\n  tsk: string,\n  salt?: string\n): Promise<Buffer> {\n  const saltBuf = salt ? Buffer.from(salt, 'hex') : DEFAULT_SALT;\n  return new Promise((resolve, reject) => {\n    crypto.hkdf(\n      'sha256',\n      Buffer.from(tsk),\n      saltBuf,\n      INFO,\n      32,\n      (err, derivedKey) => {\n        if (err) return reject(err);\n        resolve(Buffer.from(derivedKey));\n      }\n    );\n  });\n}\n\nexport function encryptSession(\n  payload: SessionPayload,\n  key: Buffer\n): string {\n  const nonce = crypto.randomBytes(12);\n  const cipher = crypto.createCipheriv('aes-256-gcm', key, nonce);\n  const plaintext = JSON.stringify(payload);\n  const encrypted = Buffer.concat([\n    cipher.update(plaintext, 'utf8'),\n    cipher.final(),\n  ]);\n  const authTag = cipher.getAuthTag();\n  // Format: base64(nonce + ciphertext + authTag)\n  return Buffer.concat([nonce, encrypted, authTag]).toString('base64');\n}\n\nexport function decryptSession(\n  ciphertext: string,\n  key: Buffer\n): SessionPayload | null {\n  try {\n    const buf = Buffer.from(ciphertext, 'base64');\n    if (buf.length < 12 + 16) return null; // nonce(12) + authTag(16) minimum\n    const nonce = buf.subarray(0, 12);\n    const authTag = buf.subarray(buf.length - 16);\n    const encrypted = buf.subarray(12, buf.length - 16);\n    const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonce);\n    decipher.setAuthTag(authTag);\n    const decrypted = Buffer.concat([\n      decipher.update(encrypted),\n      decipher.final(),\n    ]);\n    return JSON.parse(decrypted.toString('utf8')) as SessionPayload;\n  } catch {\n    return null;\n  }\n}\n\nexport function decryptSessionWithKeys(\n  ciphertext: string,\n  keys: Buffer[]\n): SessionPayload | null {\n  for (const key of keys) {\n    const result = decryptSession(ciphertext, key);\n    if (result) return result;\n  }\n  return null;\n}\n"],"mappings":";AAAO,IAAM,aAAa;AACnB,IAAM,eAAe;AAErB,SAAS,oBAA4B;AAC1C,MAAI,QAAQ,IAAI,WAAW;AACzB,UAAM,OAAO,QAAQ,IAAI,UAAU,QAAQ,QAAQ,EAAE;AACrD,WAAO,GAAG,IAAI,QAAQ,UAAU;AAAA,EAClC;AAEA,QAAM,cAAc,QAAQ,IAAI,aAAa;AAC7C,QAAM,aAAa;AACnB,QAAM,iBAAiB,oBAAoB,UAAU,QAAQ,UAAU;AACvE,QAAM,gBAAgB,WAAW,YAAY,QAAQ,UAAU;AAC/D,SAAO,cAAc,iBAAiB;AACxC;;;ACdA,OAAO,YAAY;AAOnB,IAAM,OAAO;AACb,IAAM,eAAe,OAAO;AAAA,EAC1B;AAAA,EACA;AACF;AAEA,eAAsB,oBACpB,KACA,MACiB;AACjB,QAAM,UAAU,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI;AAClD,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,WAAO;AAAA,MACL;AAAA,MACA,OAAO,KAAK,GAAG;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAC,KAAK,eAAe;AACnB,YAAI,IAAK,QAAO,OAAO,GAAG;AAC1B,gBAAQ,OAAO,KAAK,UAAU,CAAC;AAAA,MACjC;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,SAAS,eACd,SACA,KACQ;AACR,QAAM,QAAQ,OAAO,YAAY,EAAE;AACnC,QAAM,SAAS,OAAO,eAAe,eAAe,KAAK,KAAK;AAC9D,QAAM,YAAY,KAAK,UAAU,OAAO;AACxC,QAAM,YAAY,OAAO,OAAO;AAAA,IAC9B,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACf,CAAC;AACD,QAAM,UAAU,OAAO,WAAW;AAElC,SAAO,OAAO,OAAO,CAAC,OAAO,WAAW,OAAO,CAAC,EAAE,SAAS,QAAQ;AACrE;AAEO,SAAS,eACd,YACA,KACuB;AACvB,MAAI;AACF,UAAM,MAAM,OAAO,KAAK,YAAY,QAAQ;AAC5C,QAAI,IAAI,SAAS,KAAK,GAAI,QAAO;AACjC,UAAM,QAAQ,IAAI,SAAS,GAAG,EAAE;AAChC,UAAM,UAAU,IAAI,SAAS,IAAI,SAAS,EAAE;AAC5C,UAAM,YAAY,IAAI,SAAS,IAAI,IAAI,SAAS,EAAE;AAClD,UAAM,WAAW,OAAO,iBAAiB,eAAe,KAAK,KAAK;AAClE,aAAS,WAAW,OAAO;AAC3B,UAAM,YAAY,OAAO,OAAO;AAAA,MAC9B,SAAS,OAAO,SAAS;AAAA,MACzB,SAAS,MAAM;AAAA,IACjB,CAAC;AACD,WAAO,KAAK,MAAM,UAAU,SAAS,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,uBACd,YACA,MACuB;AACvB,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,eAAe,YAAY,GAAG;AAC7C,QAAI,OAAQ,QAAO;AAAA,EACrB;AACA,SAAO;AACT;","names":[]}

package/dist/index.d.mts

@@ -51,16 +51,23 @@ interface IRequestDauth extends Request {
         authorization: string;
     };
 }
+interface SessionOptions {
+    cookieName?: string;
+    secure?: boolean;
+    previousTsk?: string;
+    sessionSalt?: string;
+}
 interface DauthOptions {
     domainName: string;
     tsk: string;
     cache?: CacheOptions;
+    session?: SessionOptions;
 }
 interface TCustomResponse extends Response {
     status(code: number): this;
     send(body?: unknown): this;
 }
 
-declare const dauth: ({ domainName, tsk, cache }: DauthOptions) => (req: IRequestDauth, res: TCustomResponse, next: NextFunction) => Promise<void | TCustomResponse>;
+declare const dauth: ({ domainName, tsk, cache, session, }: DauthOptions) => (req: IRequestDauth, res: TCustomResponse, next: NextFunction) => Promise<void | TCustomResponse>;
 
-export { type AuthMethodType, type CacheOptions, type DauthOptions, type IDauthUser, type IRequestDauth, UserCache, dauth };
+export { type AuthMethodType, type CacheOptions, type DauthOptions, type IDauthUser, type IRequestDauth, type SessionOptions, UserCache, dauth };

package/dist/index.d.ts

@@ -51,16 +51,23 @@ interface IRequestDauth extends Request {
         authorization: string;
     };
 }
+interface SessionOptions {
+    cookieName?: string;
+    secure?: boolean;
+    previousTsk?: string;
+    sessionSalt?: string;
+}
 interface DauthOptions {
     domainName: string;
     tsk: string;
     cache?: CacheOptions;
+    session?: SessionOptions;
 }
 interface TCustomResponse extends Response {
     status(code: number): this;
     send(body?: unknown): this;
 }
 
-declare const dauth: ({ domainName, tsk, cache }: DauthOptions) => (req: IRequestDauth, res: TCustomResponse, next: NextFunction) => Promise<void | TCustomResponse>;
+declare const dauth: ({ domainName, tsk, cache, session, }: DauthOptions) => (req: IRequestDauth, res: TCustomResponse, next: NextFunction) => Promise<void | TCustomResponse>;
 
-export { type AuthMethodType, type CacheOptions, type DauthOptions, type IDauthUser, type IRequestDauth, UserCache, dauth };
+export { type AuthMethodType, type CacheOptions, type DauthOptions, type IDauthUser, type IRequestDauth, type SessionOptions, UserCache, dauth };

package/dist/index.js

@@ -102,14 +102,118 @@ var UserCache = class {
   }
 };
 
+// src/session.ts
+var import_crypto = __toESM(require("crypto"));
+var INFO = "dauth-cookie-enc-v1";
+var DEFAULT_SALT = Buffer.from(
+  "a3f8c1d7e9b24f6081c5d3a7e2f49b0653d81f7a2e94c0b6d8f3a5e1c7b09d42",
+  "hex"
+);
+async function deriveEncryptionKey(tsk, salt) {
+  const saltBuf = salt ? Buffer.from(salt, "hex") : DEFAULT_SALT;
+  return new Promise((resolve, reject) => {
+    import_crypto.default.hkdf(
+      "sha256",
+      Buffer.from(tsk),
+      saltBuf,
+      INFO,
+      32,
+      (err, derivedKey) => {
+        if (err) return reject(err);
+        resolve(Buffer.from(derivedKey));
+      }
+    );
+  });
+}
+function decryptSession(ciphertext, key) {
+  try {
+    const buf = Buffer.from(ciphertext, "base64");
+    if (buf.length < 12 + 16) return null;
+    const nonce = buf.subarray(0, 12);
+    const authTag = buf.subarray(buf.length - 16);
+    const encrypted = buf.subarray(12, buf.length - 16);
+    const decipher = import_crypto.default.createDecipheriv("aes-256-gcm", key, nonce);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([
+      decipher.update(encrypted),
+      decipher.final()
+    ]);
+    return JSON.parse(decrypted.toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function decryptSessionWithKeys(ciphertext, keys) {
+  for (const key of keys) {
+    const result = decryptSession(ciphertext, key);
+    if (result) return result;
+  }
+  return null;
+}
+
 // src/index.ts
-var dauth = ({ domainName, tsk, cache }) => {
+var dauth = ({
+  domainName,
+  tsk,
+  cache,
+  session
+}) => {
   const userCache = cache ? new UserCache(cache) : null;
+  let keysPromise = null;
+  async function getEncKeys() {
+    if (!keysPromise) {
+      keysPromise = (async () => {
+        const keys = [];
+        keys.push(
+          await deriveEncryptionKey(tsk, session?.sessionSalt)
+        );
+        if (session?.previousTsk) {
+          keys.push(
+            await deriveEncryptionKey(
+              session.previousTsk,
+              session.sessionSalt
+            )
+          );
+        }
+        return keys;
+      })();
+    }
+    return keysPromise;
+  }
+  function getSessionCookieName() {
+    if (session?.cookieName) return session.cookieName;
+    const secure = session?.secure ?? process.env.NODE_ENV !== "development";
+    return secure ? "__Host-dauth-session" : "dauth-session";
+  }
   return async (req, res, next) => {
-    if (!req.headers.authorization) {
-      return res.status(403).send({ status: "token-not-found", message: "Token not found" });
+    let token;
+    if (session) {
+      const cookieName = getSessionCookieName();
+      const cookie = req.cookies?.[cookieName];
+      if (!cookie) {
+        return res.status(401).send({
+          status: "no-session",
+          message: "Not authenticated"
+        });
+      }
+      const keys = await getEncKeys();
+      const payload = decryptSessionWithKeys(cookie, keys);
+      if (!payload) {
+        return res.status(401).send({
+          status: "session-invalid",
+          message: "Invalid session"
+        });
+      }
+      token = payload.accessToken;
+    } else {
+      if (!req.headers.authorization) {
+        return res.status(403).send({
+          status: "token-not-found",
+          message: "Token not found"
+        });
+      }
+      token = req.headers.authorization.replace(/['"]+/g, "");
     }
-    const token = req.headers.authorization.replace(/['"]+/g, "");
     try {
       import_jsonwebtoken.default.verify(token, tsk);
     } catch (error) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/api/utils/config.ts","../src/api/dauth.api.ts","../src/cache.ts"],"sourcesContent":["import { Request, NextFunction, Response as ExpressResponse } from 'express';\nimport jwt from 'jsonwebtoken';\nimport { getUser } from './api/dauth.api';\nimport { UserCache } from './cache';\nimport type { CacheOptions } from './cache';\n\nexport type AuthMethodType = 'magic-link' | 'passkey';\n\nexport interface IDauthUser {\n  _id: string;\n  name: string;\n  lastname: string;\n  nickname: string;\n  email: string;\n  isVerified: boolean;\n  language: string;\n  avatar: {\n    id: string;\n    url: string;\n  };\n  role: string;\n  telPrefix: string;\n  telSuffix: string;\n  birthDate?: string;\n  country?: string;\n  metadata?: Record<string, unknown>;\n  authMethods?: AuthMethodType[];\n  createdAt: Date;\n  updatedAt: Date;\n  lastLogin: Date;\n}\n\nexport interface IRequestDauth extends Request {\n  user: IDauthUser;\n  files: {\n    image: { path: string };\n    avatar: { path: string };\n  };\n  headers: {\n    authorization: string;\n  };\n}\n\nexport interface DauthOptions {\n  domainName: string;\n  tsk: string;\n  cache?: CacheOptions;\n}\n\ninterface TCustomResponse extends ExpressResponse {\n  status(code: number): this;\n  send(body?: unknown): this;\n}\n\nexport { UserCache };\nexport type { CacheOptions };\n\nexport const dauth = ({ domainName, tsk, cache }: DauthOptions) => {\n  const userCache = cache ? new UserCache(cache) : null;\n\n  return async (\n    req: IRequestDauth,\n    res: TCustomResponse,\n    next: NextFunction\n  ) => {\n    if (!req.headers.authorization) {\n      return res\n        .status(403)\n        .send({ status: 'token-not-found', message: 'Token not found' });\n    }\n\n    const token = req.headers.authorization.replace(/['\"]+/g, '');\n\n    try {\n      jwt.verify(token, tsk);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Token invalid';\n\n      if (message === 'jwt expired') {\n        return res\n          .status(401)\n          .send({ status: 'token-expired', message: 'jwt expired' });\n      }\n      if (message === 'invalid signature') {\n        return res.status(401).send({\n          status: 'tsk-not-invalid',\n          message: 'The TSK variable in the backend middleware is not valid',\n        });\n      }\n      return res.status(401).send({ status: 'token-invalid', message });\n    }\n\n    if (userCache) {\n      const cachedUser = userCache.get(token);\n      if (cachedUser) {\n        req.user = cachedUser;\n        return next();\n      }\n    }\n\n    try {\n      const getUserFetch = await getUser(token, domainName);\n\n      if (getUserFetch.response.status === 404) {\n        return res.status(404).send({\n          status: 'user-not-found',\n          message: getUserFetch.data.message ?? 'User does not exist',\n        });\n      }\n      if (getUserFetch.response.status === 500) {\n        return res.status(500).send({\n          status: 'error',\n          message: getUserFetch.data.message ?? 'Dauth server error',\n        });\n      }\n      if (getUserFetch.response.status === 200) {\n        req.user = getUserFetch.data.user;\n        if (userCache) {\n          userCache.set(token, req.user);\n        }\n        return next();\n      }\n      return res.status(501).send({\n        status: 'request-error',\n        message: getUserFetch.data.message ?? 'Dauth server error',\n      });\n    } catch (error) {\n      const message =\n        error instanceof Error ? error.message : 'Dauth server error';\n      return res.status(500).send({ status: 'server-error', message });\n    }\n  };\n};\n","export const apiVersion = 'v1';\nexport const serverDomain = 'dauth.ovh';\n\nexport function getServerBasePath(): string {\n  if (process.env.DAUTH_URL) {\n    const base = process.env.DAUTH_URL.replace(/\\/+$/, '');\n    return `${base}/api/${apiVersion}`;\n  }\n\n  const isLocalhost = process.env.NODE_ENV === 'development';\n  const serverPort = 4012;\n  const serverLocalUrl = `http://localhost:${serverPort}/api/${apiVersion}`;\n  const serverProdUrl = `https://${serverDomain}/api/${apiVersion}`;\n  return isLocalhost ? serverLocalUrl : serverProdUrl;\n}\n","import { getServerBasePath } from './utils/config';\n\ninterface GetUserResponse {\n  response: { status: number };\n  data: { user?: any; message?: string };\n}\n\nexport async function getUser(\n  token: string,\n  domainName: string\n): Promise<GetUserResponse> {\n  const response = await fetch(\n    `${getServerBasePath()}/app/${domainName}/user`,\n    {\n      method: 'GET',\n      headers: {\n        Authorization: token,\n        'Content-Type': 'application/json',\n      },\n    }\n  );\n  const data = (await response.json()) as GetUserResponse['data'];\n  return { response: { status: response.status }, data };\n}\n","import { IDauthUser } from './index';\n\ninterface CacheEntry {\n  user: IDauthUser;\n  expiresAt: number;\n}\n\nexport interface CacheOptions {\n  ttlMs: number;\n}\n\nexport class UserCache {\n  private store = new Map<string, CacheEntry>();\n  private ttlMs: number;\n\n  constructor(options: CacheOptions) {\n    this.ttlMs = options.ttlMs;\n  }\n\n  get(token: string): IDauthUser | undefined {\n    const entry = this.store.get(token);\n    if (!entry) return undefined;\n\n    if (Date.now() > entry.expiresAt) {\n      this.store.delete(token);\n      return undefined;\n    }\n\n    return entry.user;\n  }\n\n  set(token: string, user: IDauthUser): void {\n    if (this.store.size > 1000) {\n      this.sweep();\n    }\n    this.store.set(token, { user, expiresAt: Date.now() + this.ttlMs });\n  }\n\n  clear(): void {\n    this.store.clear();\n  }\n\n  private sweep(): void {\n    const now = Date.now();\n    for (const [key, entry] of this.store) {\n      if (now > entry.expiresAt) {\n        this.store.delete(key);\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,0BAAgB;;;ACDT,IAAM,aAAa;AACnB,IAAM,eAAe;AAErB,SAAS,oBAA4B;AAC1C,MAAI,QAAQ,IAAI,WAAW;AACzB,UAAM,OAAO,QAAQ,IAAI,UAAU,QAAQ,QAAQ,EAAE;AACrD,WAAO,GAAG,IAAI,QAAQ,UAAU;AAAA,EAClC;AAEA,QAAM,cAAc,QAAQ,IAAI,aAAa;AAC7C,QAAM,aAAa;AACnB,QAAM,iBAAiB,oBAAoB,UAAU,QAAQ,UAAU;AACvE,QAAM,gBAAgB,WAAW,YAAY,QAAQ,UAAU;AAC/D,SAAO,cAAc,iBAAiB;AACxC;;;ACPA,eAAsB,QACpB,OACA,YAC0B;AAC1B,QAAM,WAAW,MAAM;AAAA,IACrB,GAAG,kBAAkB,CAAC,QAAQ,UAAU;AAAA,IACxC;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe;AAAA,QACf,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,SAAO,EAAE,UAAU,EAAE,QAAQ,SAAS,OAAO,GAAG,KAAK;AACvD;;;ACZO,IAAM,YAAN,MAAgB;AAAA,EACb,QAAQ,oBAAI,IAAwB;AAAA,EACpC;AAAA,EAER,YAAY,SAAuB;AACjC,SAAK,QAAQ,QAAQ;AAAA,EACvB;AAAA,EAEA,IAAI,OAAuC;AACzC,UAAM,QAAQ,KAAK,MAAM,IAAI,KAAK;AAClC,QAAI,CAAC,MAAO,QAAO;AAEnB,QAAI,KAAK,IAAI,IAAI,MAAM,WAAW;AAChC,WAAK,MAAM,OAAO,KAAK;AACvB,aAAO;AAAA,IACT;AAEA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,OAAe,MAAwB;AACzC,QAAI,KAAK,MAAM,OAAO,KAAM;AAC1B,WAAK,MAAM;AAAA,IACb;AACA,SAAK,MAAM,IAAI,OAAO,EAAE,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK,MAAM,CAAC;AAAA,EACpE;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEQ,QAAc;AACpB,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,OAAO;AACrC,UAAI,MAAM,MAAM,WAAW;AACzB,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;;;AHOO,IAAM,QAAQ,CAAC,EAAE,YAAY,KAAK,MAAM,MAAoB;AACjE,QAAM,YAAY,QAAQ,IAAI,UAAU,KAAK,IAAI;AAEjD,SAAO,OACL,KACA,KACA,SACG;AACH,QAAI,CAAC,IAAI,QAAQ,eAAe;AAC9B,aAAO,IACJ,OAAO,GAAG,EACV,KAAK,EAAE,QAAQ,mBAAmB,SAAS,kBAAkB,CAAC;AAAA,IACnE;AAEA,UAAM,QAAQ,IAAI,QAAQ,cAAc,QAAQ,UAAU,EAAE;AAE5D,QAAI;AACF,0BAAAA,QAAI,OAAO,OAAO,GAAG;AAAA,IACvB,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AAEzD,UAAI,YAAY,eAAe;AAC7B,eAAO,IACJ,OAAO,GAAG,EACV,KAAK,EAAE,QAAQ,iBAAiB,SAAS,cAAc,CAAC;AAAA,MAC7D;AACA,UAAI,YAAY,qBAAqB;AACnC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,QAAQ;AAAA,UACR,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,QAAQ,iBAAiB,QAAQ,CAAC;AAAA,IAClE;AAEA,QAAI,WAAW;AACb,YAAM,aAAa,UAAU,IAAI,KAAK;AACtC,UAAI,YAAY;AACd,YAAI,OAAO;AACX,eAAO,KAAK;AAAA,MACd;AAAA,IACF;AAEA,QAAI;AACF,YAAM,eAAe,MAAM,QAAQ,OAAO,UAAU;AAEpD,UAAI,aAAa,SAAS,WAAW,KAAK;AACxC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,QAAQ;AAAA,UACR,SAAS,aAAa,KAAK,WAAW;AAAA,QACxC,CAAC;AAAA,MACH;AACA,UAAI,aAAa,SAAS,WAAW,KAAK;AACxC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,QAAQ;AAAA,UACR,SAAS,aAAa,KAAK,WAAW;AAAA,QACxC,CAAC;AAAA,MACH;AACA,UAAI,aAAa,SAAS,WAAW,KAAK;AACxC,YAAI,OAAO,aAAa,KAAK;AAC7B,YAAI,WAAW;AACb,oBAAU,IAAI,OAAO,IAAI,IAAI;AAAA,QAC/B;AACA,eAAO,KAAK;AAAA,MACd;AACA,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QAC1B,QAAQ;AAAA,QACR,SAAS,aAAa,KAAK,WAAW;AAAA,MACxC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;AAC3C,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,QAAQ,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAAA,EACF;AACF;","names":["jwt"]}
+{"version":3,"sources":["../src/index.ts","../src/api/utils/config.ts","../src/api/dauth.api.ts","../src/cache.ts","../src/session.ts"],"sourcesContent":["import { Request, NextFunction, Response as ExpressResponse } from 'express';\nimport jwt from 'jsonwebtoken';\nimport { getUser } from './api/dauth.api';\nimport { UserCache } from './cache';\nimport type { CacheOptions } from './cache';\nimport { deriveEncryptionKey, decryptSessionWithKeys } from './session';\n\nexport type AuthMethodType = 'magic-link' | 'passkey';\n\nexport interface IDauthUser {\n  _id: string;\n  name: string;\n  lastname: string;\n  nickname: string;\n  email: string;\n  isVerified: boolean;\n  language: string;\n  avatar: {\n    id: string;\n    url: string;\n  };\n  role: string;\n  telPrefix: string;\n  telSuffix: string;\n  birthDate?: string;\n  country?: string;\n  metadata?: Record<string, unknown>;\n  authMethods?: AuthMethodType[];\n  createdAt: Date;\n  updatedAt: Date;\n  lastLogin: Date;\n}\n\nexport interface IRequestDauth extends Request {\n  user: IDauthUser;\n  files: {\n    image: { path: string };\n    avatar: { path: string };\n  };\n  headers: {\n    authorization: string;\n  };\n}\n\nexport interface SessionOptions {\n  cookieName?: string;\n  secure?: boolean;\n  previousTsk?: string;\n  sessionSalt?: string;\n}\n\nexport interface DauthOptions {\n  domainName: string;\n  tsk: string;\n  cache?: CacheOptions;\n  session?: SessionOptions;\n}\n\ninterface TCustomResponse extends ExpressResponse {\n  status(code: number): this;\n  send(body?: unknown): this;\n}\n\nexport { UserCache };\nexport type { CacheOptions };\n\nexport const dauth = ({\n  domainName,\n  tsk,\n  cache,\n  session,\n}: DauthOptions) => {\n  const userCache = cache ? new UserCache(cache) : null;\n\n  // Lazy-init encryption keys for session cookie mode\n  let keysPromise: Promise<Buffer[]> | null = null;\n  async function getEncKeys(): Promise<Buffer[]> {\n    if (!keysPromise) {\n      keysPromise = (async () => {\n        const keys: Buffer[] = [];\n        keys.push(\n          await deriveEncryptionKey(tsk, session?.sessionSalt)\n        );\n        if (session?.previousTsk) {\n          keys.push(\n            await deriveEncryptionKey(\n              session.previousTsk,\n              session.sessionSalt\n            )\n          );\n        }\n        return keys;\n      })();\n    }\n    return keysPromise;\n  }\n\n  function getSessionCookieName(): string {\n    if (session?.cookieName) return session.cookieName;\n    const secure =\n      session?.secure ?? process.env.NODE_ENV !== 'development';\n    return secure ? '__Host-dauth-session' : 'dauth-session';\n  }\n\n  return async (\n    req: IRequestDauth,\n    res: TCustomResponse,\n    next: NextFunction\n  ) => {\n    let token: string;\n\n    if (session) {\n      // Session cookie mode: read encrypted cookie\n      const cookieName = getSessionCookieName();\n      const cookie = req.cookies?.[cookieName];\n      if (!cookie) {\n        return res\n          .status(401)\n          .send({\n            status: 'no-session',\n            message: 'Not authenticated',\n          });\n      }\n      const keys = await getEncKeys();\n      const payload = decryptSessionWithKeys(cookie, keys);\n      if (!payload) {\n        return res\n          .status(401)\n          .send({\n            status: 'session-invalid',\n            message: 'Invalid session',\n          });\n      }\n      token = payload.accessToken;\n    } else {\n      // Authorization header mode\n      if (!req.headers.authorization) {\n        return res\n          .status(403)\n          .send({\n            status: 'token-not-found',\n            message: 'Token not found',\n          });\n      }\n      token = req.headers.authorization.replace(/['\"]+/g, '');\n    }\n\n    try {\n      jwt.verify(token, tsk);\n    } catch (error) {\n      const message =\n        error instanceof Error ? error.message : 'Token invalid';\n\n      if (message === 'jwt expired') {\n        return res\n          .status(401)\n          .send({ status: 'token-expired', message: 'jwt expired' });\n      }\n      if (message === 'invalid signature') {\n        return res.status(401).send({\n          status: 'tsk-not-invalid',\n          message:\n            'The TSK variable in the backend middleware is not valid',\n        });\n      }\n      return res\n        .status(401)\n        .send({ status: 'token-invalid', message });\n    }\n\n    if (userCache) {\n      const cachedUser = userCache.get(token);\n      if (cachedUser) {\n        req.user = cachedUser;\n        return next();\n      }\n    }\n\n    try {\n      const getUserFetch = await getUser(token, domainName);\n\n      if (getUserFetch.response.status === 404) {\n        return res.status(404).send({\n          status: 'user-not-found',\n          message:\n            getUserFetch.data.message ?? 'User does not exist',\n        });\n      }\n      if (getUserFetch.response.status === 500) {\n        return res.status(500).send({\n          status: 'error',\n          message:\n            getUserFetch.data.message ?? 'Dauth server error',\n        });\n      }\n      if (getUserFetch.response.status === 200) {\n        req.user = getUserFetch.data.user;\n        if (userCache) {\n          userCache.set(token, req.user);\n        }\n        return next();\n      }\n      return res.status(501).send({\n        status: 'request-error',\n        message:\n          getUserFetch.data.message ?? 'Dauth server error',\n      });\n    } catch (error) {\n      const message =\n        error instanceof Error\n          ? error.message\n          : 'Dauth server error';\n      return res\n        .status(500)\n        .send({ status: 'server-error', message });\n    }\n  };\n};\n","export const apiVersion = 'v1';\nexport const serverDomain = 'dauth.ovh';\n\nexport function getServerBasePath(): string {\n  if (process.env.DAUTH_URL) {\n    const base = process.env.DAUTH_URL.replace(/\\/+$/, '');\n    return `${base}/api/${apiVersion}`;\n  }\n\n  const isLocalhost = process.env.NODE_ENV === 'development';\n  const serverPort = 4012;\n  const serverLocalUrl = `http://localhost:${serverPort}/api/${apiVersion}`;\n  const serverProdUrl = `https://${serverDomain}/api/${apiVersion}`;\n  return isLocalhost ? serverLocalUrl : serverProdUrl;\n}\n","import { getServerBasePath } from './utils/config';\n\ninterface GetUserResponse {\n  response: { status: number };\n  data: { user?: any; message?: string };\n}\n\nexport async function getUser(\n  token: string,\n  domainName: string\n): Promise<GetUserResponse> {\n  const response = await fetch(\n    `${getServerBasePath()}/app/${domainName}/user`,\n    {\n      method: 'GET',\n      headers: {\n        Authorization: token,\n        'Content-Type': 'application/json',\n      },\n    }\n  );\n  const data = (await response.json()) as GetUserResponse['data'];\n  return { response: { status: response.status }, data };\n}\n","import { IDauthUser } from './index';\n\ninterface CacheEntry {\n  user: IDauthUser;\n  expiresAt: number;\n}\n\nexport interface CacheOptions {\n  ttlMs: number;\n}\n\nexport class UserCache {\n  private store = new Map<string, CacheEntry>();\n  private ttlMs: number;\n\n  constructor(options: CacheOptions) {\n    this.ttlMs = options.ttlMs;\n  }\n\n  get(token: string): IDauthUser | undefined {\n    const entry = this.store.get(token);\n    if (!entry) return undefined;\n\n    if (Date.now() > entry.expiresAt) {\n      this.store.delete(token);\n      return undefined;\n    }\n\n    return entry.user;\n  }\n\n  set(token: string, user: IDauthUser): void {\n    if (this.store.size > 1000) {\n      this.sweep();\n    }\n    this.store.set(token, { user, expiresAt: Date.now() + this.ttlMs });\n  }\n\n  clear(): void {\n    this.store.clear();\n  }\n\n  private sweep(): void {\n    const now = Date.now();\n    for (const [key, entry] of this.store) {\n      if (now > entry.expiresAt) {\n        this.store.delete(key);\n      }\n    }\n  }\n}\n","import crypto from 'crypto';\n\nexport interface SessionPayload {\n  accessToken: string;\n  refreshToken: string;\n}\n\nconst INFO = 'dauth-cookie-enc-v1';\nconst DEFAULT_SALT = Buffer.from(\n  'a3f8c1d7e9b24f6081c5d3a7e2f49b0653d81f7a2e94c0b6d8f3a5e1c7b09d42',\n  'hex'\n);\n\nexport async function deriveEncryptionKey(\n  tsk: string,\n  salt?: string\n): Promise<Buffer> {\n  const saltBuf = salt ? Buffer.from(salt, 'hex') : DEFAULT_SALT;\n  return new Promise((resolve, reject) => {\n    crypto.hkdf(\n      'sha256',\n      Buffer.from(tsk),\n      saltBuf,\n      INFO,\n      32,\n      (err, derivedKey) => {\n        if (err) return reject(err);\n        resolve(Buffer.from(derivedKey));\n      }\n    );\n  });\n}\n\nexport function encryptSession(\n  payload: SessionPayload,\n  key: Buffer\n): string {\n  const nonce = crypto.randomBytes(12);\n  const cipher = crypto.createCipheriv('aes-256-gcm', key, nonce);\n  const plaintext = JSON.stringify(payload);\n  const encrypted = Buffer.concat([\n    cipher.update(plaintext, 'utf8'),\n    cipher.final(),\n  ]);\n  const authTag = cipher.getAuthTag();\n  // Format: base64(nonce + ciphertext + authTag)\n  return Buffer.concat([nonce, encrypted, authTag]).toString('base64');\n}\n\nexport function decryptSession(\n  ciphertext: string,\n  key: Buffer\n): SessionPayload | null {\n  try {\n    const buf = Buffer.from(ciphertext, 'base64');\n    if (buf.length < 12 + 16) return null; // nonce(12) + authTag(16) minimum\n    const nonce = buf.subarray(0, 12);\n    const authTag = buf.subarray(buf.length - 16);\n    const encrypted = buf.subarray(12, buf.length - 16);\n    const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonce);\n    decipher.setAuthTag(authTag);\n    const decrypted = Buffer.concat([\n      decipher.update(encrypted),\n      decipher.final(),\n    ]);\n    return JSON.parse(decrypted.toString('utf8')) as SessionPayload;\n  } catch {\n    return null;\n  }\n}\n\nexport function decryptSessionWithKeys(\n  ciphertext: string,\n  keys: Buffer[]\n): SessionPayload | null {\n  for (const key of keys) {\n    const result = decryptSession(ciphertext, key);\n    if (result) return result;\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,0BAAgB;;;ACDT,IAAM,aAAa;AACnB,IAAM,eAAe;AAErB,SAAS,oBAA4B;AAC1C,MAAI,QAAQ,IAAI,WAAW;AACzB,UAAM,OAAO,QAAQ,IAAI,UAAU,QAAQ,QAAQ,EAAE;AACrD,WAAO,GAAG,IAAI,QAAQ,UAAU;AAAA,EAClC;AAEA,QAAM,cAAc,QAAQ,IAAI,aAAa;AAC7C,QAAM,aAAa;AACnB,QAAM,iBAAiB,oBAAoB,UAAU,QAAQ,UAAU;AACvE,QAAM,gBAAgB,WAAW,YAAY,QAAQ,UAAU;AAC/D,SAAO,cAAc,iBAAiB;AACxC;;;ACPA,eAAsB,QACpB,OACA,YAC0B;AAC1B,QAAM,WAAW,MAAM;AAAA,IACrB,GAAG,kBAAkB,CAAC,QAAQ,UAAU;AAAA,IACxC;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe;AAAA,QACf,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,SAAO,EAAE,UAAU,EAAE,QAAQ,SAAS,OAAO,GAAG,KAAK;AACvD;;;ACZO,IAAM,YAAN,MAAgB;AAAA,EACb,QAAQ,oBAAI,IAAwB;AAAA,EACpC;AAAA,EAER,YAAY,SAAuB;AACjC,SAAK,QAAQ,QAAQ;AAAA,EACvB;AAAA,EAEA,IAAI,OAAuC;AACzC,UAAM,QAAQ,KAAK,MAAM,IAAI,KAAK;AAClC,QAAI,CAAC,MAAO,QAAO;AAEnB,QAAI,KAAK,IAAI,IAAI,MAAM,WAAW;AAChC,WAAK,MAAM,OAAO,KAAK;AACvB,aAAO;AAAA,IACT;AAEA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,OAAe,MAAwB;AACzC,QAAI,KAAK,MAAM,OAAO,KAAM;AAC1B,WAAK,MAAM;AAAA,IACb;AACA,SAAK,MAAM,IAAI,OAAO,EAAE,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK,MAAM,CAAC;AAAA,EACpE;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEQ,QAAc;AACpB,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,OAAO;AACrC,UAAI,MAAM,MAAM,WAAW;AACzB,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;;;AClDA,oBAAmB;AAOnB,IAAM,OAAO;AACb,IAAM,eAAe,OAAO;AAAA,EAC1B;AAAA,EACA;AACF;AAEA,eAAsB,oBACpB,KACA,MACiB;AACjB,QAAM,UAAU,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI;AAClD,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,kBAAAA,QAAO;AAAA,MACL;AAAA,MACA,OAAO,KAAK,GAAG;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAC,KAAK,eAAe;AACnB,YAAI,IAAK,QAAO,OAAO,GAAG;AAC1B,gBAAQ,OAAO,KAAK,UAAU,CAAC;AAAA,MACjC;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAkBO,SAAS,eACd,YACA,KACuB;AACvB,MAAI;AACF,UAAM,MAAM,OAAO,KAAK,YAAY,QAAQ;AAC5C,QAAI,IAAI,SAAS,KAAK,GAAI,QAAO;AACjC,UAAM,QAAQ,IAAI,SAAS,GAAG,EAAE;AAChC,UAAM,UAAU,IAAI,SAAS,IAAI,SAAS,EAAE;AAC5C,UAAM,YAAY,IAAI,SAAS,IAAI,IAAI,SAAS,EAAE;AAClD,UAAM,WAAW,cAAAC,QAAO,iBAAiB,eAAe,KAAK,KAAK;AAClE,aAAS,WAAW,OAAO;AAC3B,UAAM,YAAY,OAAO,OAAO;AAAA,MAC9B,SAAS,OAAO,SAAS;AAAA,MACzB,SAAS,MAAM;AAAA,IACjB,CAAC;AACD,WAAO,KAAK,MAAM,UAAU,SAAS,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,uBACd,YACA,MACuB;AACvB,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,eAAe,YAAY,GAAG;AAC7C,QAAI,OAAQ,QAAO;AAAA,EACrB;AACA,SAAO;AACT;;;AJdO,IAAM,QAAQ,CAAC;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,MAAoB;AAClB,QAAM,YAAY,QAAQ,IAAI,UAAU,KAAK,IAAI;AAGjD,MAAI,cAAwC;AAC5C,iBAAe,aAAgC;AAC7C,QAAI,CAAC,aAAa;AAChB,qBAAe,YAAY;AACzB,cAAM,OAAiB,CAAC;AACxB,aAAK;AAAA,UACH,MAAM,oBAAoB,KAAK,SAAS,WAAW;AAAA,QACrD;AACA,YAAI,SAAS,aAAa;AACxB,eAAK;AAAA,YACH,MAAM;AAAA,cACJ,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV;AAAA,UACF;AAAA,QACF;AACA,eAAO;AAAA,MACT,GAAG;AAAA,IACL;AACA,WAAO;AAAA,EACT;AAEA,WAAS,uBAA+B;AACtC,QAAI,SAAS,WAAY,QAAO,QAAQ;AACxC,UAAM,SACJ,SAAS,UAAU,QAAQ,IAAI,aAAa;AAC9C,WAAO,SAAS,yBAAyB;AAAA,EAC3C;AAEA,SAAO,OACL,KACA,KACA,SACG;AACH,QAAI;AAEJ,QAAI,SAAS;AAEX,YAAM,aAAa,qBAAqB;AACxC,YAAM,SAAS,IAAI,UAAU,UAAU;AACvC,UAAI,CAAC,QAAQ;AACX,eAAO,IACJ,OAAO,GAAG,EACV,KAAK;AAAA,UACJ,QAAQ;AAAA,UACR,SAAS;AAAA,QACX,CAAC;AAAA,MACL;AACA,YAAM,OAAO,MAAM,WAAW;AAC9B,YAAM,UAAU,uBAAuB,QAAQ,IAAI;AACnD,UAAI,CAAC,SAAS;AACZ,eAAO,IACJ,OAAO,GAAG,EACV,KAAK;AAAA,UACJ,QAAQ;AAAA,UACR,SAAS;AAAA,QACX,CAAC;AAAA,MACL;AACA,cAAQ,QAAQ;AAAA,IAClB,OAAO;AAEL,UAAI,CAAC,IAAI,QAAQ,eAAe;AAC9B,eAAO,IACJ,OAAO,GAAG,EACV,KAAK;AAAA,UACJ,QAAQ;AAAA,UACR,SAAS;AAAA,QACX,CAAC;AAAA,MACL;AACA,cAAQ,IAAI,QAAQ,cAAc,QAAQ,UAAU,EAAE;AAAA,IACxD;AAEA,QAAI;AACF,0BAAAC,QAAI,OAAO,OAAO,GAAG;AAAA,IACvB,SAAS,OAAO;AACd,YAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;AAE3C,UAAI,YAAY,eAAe;AAC7B,eAAO,IACJ,OAAO,GAAG,EACV,KAAK,EAAE,QAAQ,iBAAiB,SAAS,cAAc,CAAC;AAAA,MAC7D;AACA,UAAI,YAAY,qBAAqB;AACnC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,QAAQ;AAAA,UACR,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AACA,aAAO,IACJ,OAAO,GAAG,EACV,KAAK,EAAE,QAAQ,iBAAiB,QAAQ,CAAC;AAAA,IAC9C;AAEA,QAAI,WAAW;AACb,YAAM,aAAa,UAAU,IAAI,KAAK;AACtC,UAAI,YAAY;AACd,YAAI,OAAO;AACX,eAAO,KAAK;AAAA,MACd;AAAA,IACF;AAEA,QAAI;AACF,YAAM,eAAe,MAAM,QAAQ,OAAO,UAAU;AAEpD,UAAI,aAAa,SAAS,WAAW,KAAK;AACxC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,QAAQ;AAAA,UACR,SACE,aAAa,KAAK,WAAW;AAAA,QACjC,CAAC;AAAA,MACH;AACA,UAAI,aAAa,SAAS,WAAW,KAAK;AACxC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,QAAQ;AAAA,UACR,SACE,aAAa,KAAK,WAAW;AAAA,QACjC,CAAC;AAAA,MACH;AACA,UAAI,aAAa,SAAS,WAAW,KAAK;AACxC,YAAI,OAAO,aAAa,KAAK;AAC7B,YAAI,WAAW;AACb,oBAAU,IAAI,OAAO,IAAI,IAAI;AAAA,QAC/B;AACA,eAAO,KAAK;AAAA,MACd;AACA,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QAC1B,QAAQ;AAAA,QACR,SACE,aAAa,KAAK,WAAW;AAAA,MACjC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,UACJ,iBAAiB,QACb,MAAM,UACN;AACN,aAAO,IACJ,OAAO,GAAG,EACV,KAAK,EAAE,QAAQ,gBAAgB,QAAQ,CAAC;AAAA,IAC7C;AAAA,EACF;AACF;","names":["crypto","crypto","jwt"]}

package/dist/index.mjs

@@ -1,21 +1,12 @@
+import {
+  decryptSessionWithKeys,
+  deriveEncryptionKey,
+  getServerBasePath
+} from "./chunk-4A7BR4EM.mjs";
+
 // src/index.ts
 import jwt from "jsonwebtoken";
 
-// src/api/utils/config.ts
-var apiVersion = "v1";
-var serverDomain = "dauth.ovh";
-function getServerBasePath() {
-  if (process.env.DAUTH_URL) {
-    const base = process.env.DAUTH_URL.replace(/\/+$/, "");
-    return `${base}/api/${apiVersion}`;
-  }
-  const isLocalhost = process.env.NODE_ENV === "development";
-  const serverPort = 4012;
-  const serverLocalUrl = `http://localhost:${serverPort}/api/${apiVersion}`;
-  const serverProdUrl = `https://${serverDomain}/api/${apiVersion}`;
-  return isLocalhost ? serverLocalUrl : serverProdUrl;
-}
-
 // src/api/dauth.api.ts
 async function getUser(token, domainName) {
   const response = await fetch(
@@ -68,13 +59,68 @@ var UserCache = class {
 };
 
 // src/index.ts
-var dauth = ({ domainName, tsk, cache }) => {
+var dauth = ({
+  domainName,
+  tsk,
+  cache,
+  session
+}) => {
   const userCache = cache ? new UserCache(cache) : null;
+  let keysPromise = null;
+  async function getEncKeys() {
+    if (!keysPromise) {
+      keysPromise = (async () => {
+        const keys = [];
+        keys.push(
+          await deriveEncryptionKey(tsk, session?.sessionSalt)
+        );
+        if (session?.previousTsk) {
+          keys.push(
+            await deriveEncryptionKey(
+              session.previousTsk,
+              session.sessionSalt
+            )
+          );
+        }
+        return keys;
+      })();
+    }
+    return keysPromise;
+  }
+  function getSessionCookieName() {
+    if (session?.cookieName) return session.cookieName;
+    const secure = session?.secure ?? process.env.NODE_ENV !== "development";
+    return secure ? "__Host-dauth-session" : "dauth-session";
+  }
   return async (req, res, next) => {
-    if (!req.headers.authorization) {
-      return res.status(403).send({ status: "token-not-found", message: "Token not found" });
+    let token;
+    if (session) {
+      const cookieName = getSessionCookieName();
+      const cookie = req.cookies?.[cookieName];
+      if (!cookie) {
+        return res.status(401).send({
+          status: "no-session",
+          message: "Not authenticated"
+        });
+      }
+      const keys = await getEncKeys();
+      const payload = decryptSessionWithKeys(cookie, keys);
+      if (!payload) {
+        return res.status(401).send({
+          status: "session-invalid",
+          message: "Invalid session"
+        });
+      }
+      token = payload.accessToken;
+    } else {
+      if (!req.headers.authorization) {
+        return res.status(403).send({
+          status: "token-not-found",
+          message: "Token not found"
+        });
+      }
+      token = req.headers.authorization.replace(/['"]+/g, "");
     }
-    const token = req.headers.authorization.replace(/['"]+/g, "");
     try {
       jwt.verify(token, tsk);
     } catch (error) {

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/api/utils/config.ts","../src/api/dauth.api.ts","../src/cache.ts"],"sourcesContent":["import { Request, NextFunction, Response as ExpressResponse } from 'express';\nimport jwt from 'jsonwebtoken';\nimport { getUser } from './api/dauth.api';\nimport { UserCache } from './cache';\nimport type { CacheOptions } from './cache';\n\nexport type AuthMethodType = 'magic-link' | 'passkey';\n\nexport interface IDauthUser {\n  _id: string;\n  name: string;\n  lastname: string;\n  nickname: string;\n  email: string;\n  isVerified: boolean;\n  language: string;\n  avatar: {\n    id: string;\n    url: string;\n  };\n  role: string;\n  telPrefix: string;\n  telSuffix: string;\n  birthDate?: string;\n  country?: string;\n  metadata?: Record<string, unknown>;\n  authMethods?: AuthMethodType[];\n  createdAt: Date;\n  updatedAt: Date;\n  lastLogin: Date;\n}\n\nexport interface IRequestDauth extends Request {\n  user: IDauthUser;\n  files: {\n    image: { path: string };\n    avatar: { path: string };\n  };\n  headers: {\n    authorization: string;\n  };\n}\n\nexport interface DauthOptions {\n  domainName: string;\n  tsk: string;\n  cache?: CacheOptions;\n}\n\ninterface TCustomResponse extends ExpressResponse {\n  status(code: number): this;\n  send(body?: unknown): this;\n}\n\nexport { UserCache };\nexport type { CacheOptions };\n\nexport const dauth = ({ domainName, tsk, cache }: DauthOptions) => {\n  const userCache = cache ? new UserCache(cache) : null;\n\n  return async (\n    req: IRequestDauth,\n    res: TCustomResponse,\n    next: NextFunction\n  ) => {\n    if (!req.headers.authorization) {\n      return res\n        .status(403)\n        .send({ status: 'token-not-found', message: 'Token not found' });\n    }\n\n    const token = req.headers.authorization.replace(/['\"]+/g, '');\n\n    try {\n      jwt.verify(token, tsk);\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Token invalid';\n\n      if (message === 'jwt expired') {\n        return res\n          .status(401)\n          .send({ status: 'token-expired', message: 'jwt expired' });\n      }\n      if (message === 'invalid signature') {\n        return res.status(401).send({\n          status: 'tsk-not-invalid',\n          message: 'The TSK variable in the backend middleware is not valid',\n        });\n      }\n      return res.status(401).send({ status: 'token-invalid', message });\n    }\n\n    if (userCache) {\n      const cachedUser = userCache.get(token);\n      if (cachedUser) {\n        req.user = cachedUser;\n        return next();\n      }\n    }\n\n    try {\n      const getUserFetch = await getUser(token, domainName);\n\n      if (getUserFetch.response.status === 404) {\n        return res.status(404).send({\n          status: 'user-not-found',\n          message: getUserFetch.data.message ?? 'User does not exist',\n        });\n      }\n      if (getUserFetch.response.status === 500) {\n        return res.status(500).send({\n          status: 'error',\n          message: getUserFetch.data.message ?? 'Dauth server error',\n        });\n      }\n      if (getUserFetch.response.status === 200) {\n        req.user = getUserFetch.data.user;\n        if (userCache) {\n          userCache.set(token, req.user);\n        }\n        return next();\n      }\n      return res.status(501).send({\n        status: 'request-error',\n        message: getUserFetch.data.message ?? 'Dauth server error',\n      });\n    } catch (error) {\n      const message =\n        error instanceof Error ? error.message : 'Dauth server error';\n      return res.status(500).send({ status: 'server-error', message });\n    }\n  };\n};\n","export const apiVersion = 'v1';\nexport const serverDomain = 'dauth.ovh';\n\nexport function getServerBasePath(): string {\n  if (process.env.DAUTH_URL) {\n    const base = process.env.DAUTH_URL.replace(/\\/+$/, '');\n    return `${base}/api/${apiVersion}`;\n  }\n\n  const isLocalhost = process.env.NODE_ENV === 'development';\n  const serverPort = 4012;\n  const serverLocalUrl = `http://localhost:${serverPort}/api/${apiVersion}`;\n  const serverProdUrl = `https://${serverDomain}/api/${apiVersion}`;\n  return isLocalhost ? serverLocalUrl : serverProdUrl;\n}\n","import { getServerBasePath } from './utils/config';\n\ninterface GetUserResponse {\n  response: { status: number };\n  data: { user?: any; message?: string };\n}\n\nexport async function getUser(\n  token: string,\n  domainName: string\n): Promise<GetUserResponse> {\n  const response = await fetch(\n    `${getServerBasePath()}/app/${domainName}/user`,\n    {\n      method: 'GET',\n      headers: {\n        Authorization: token,\n        'Content-Type': 'application/json',\n      },\n    }\n  );\n  const data = (await response.json()) as GetUserResponse['data'];\n  return { response: { status: response.status }, data };\n}\n","import { IDauthUser } from './index';\n\ninterface CacheEntry {\n  user: IDauthUser;\n  expiresAt: number;\n}\n\nexport interface CacheOptions {\n  ttlMs: number;\n}\n\nexport class UserCache {\n  private store = new Map<string, CacheEntry>();\n  private ttlMs: number;\n\n  constructor(options: CacheOptions) {\n    this.ttlMs = options.ttlMs;\n  }\n\n  get(token: string): IDauthUser | undefined {\n    const entry = this.store.get(token);\n    if (!entry) return undefined;\n\n    if (Date.now() > entry.expiresAt) {\n      this.store.delete(token);\n      return undefined;\n    }\n\n    return entry.user;\n  }\n\n  set(token: string, user: IDauthUser): void {\n    if (this.store.size > 1000) {\n      this.sweep();\n    }\n    this.store.set(token, { user, expiresAt: Date.now() + this.ttlMs });\n  }\n\n  clear(): void {\n    this.store.clear();\n  }\n\n  private sweep(): void {\n    const now = Date.now();\n    for (const [key, entry] of this.store) {\n      if (now > entry.expiresAt) {\n        this.store.delete(key);\n      }\n    }\n  }\n}\n"],"mappings":";AACA,OAAO,SAAS;;;ACDT,IAAM,aAAa;AACnB,IAAM,eAAe;AAErB,SAAS,oBAA4B;AAC1C,MAAI,QAAQ,IAAI,WAAW;AACzB,UAAM,OAAO,QAAQ,IAAI,UAAU,QAAQ,QAAQ,EAAE;AACrD,WAAO,GAAG,IAAI,QAAQ,UAAU;AAAA,EAClC;AAEA,QAAM,cAAc,QAAQ,IAAI,aAAa;AAC7C,QAAM,aAAa;AACnB,QAAM,iBAAiB,oBAAoB,UAAU,QAAQ,UAAU;AACvE,QAAM,gBAAgB,WAAW,YAAY,QAAQ,UAAU;AAC/D,SAAO,cAAc,iBAAiB;AACxC;;;ACPA,eAAsB,QACpB,OACA,YAC0B;AAC1B,QAAM,WAAW,MAAM;AAAA,IACrB,GAAG,kBAAkB,CAAC,QAAQ,UAAU;AAAA,IACxC;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe;AAAA,QACf,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,SAAO,EAAE,UAAU,EAAE,QAAQ,SAAS,OAAO,GAAG,KAAK;AACvD;;;ACZO,IAAM,YAAN,MAAgB;AAAA,EACb,QAAQ,oBAAI,IAAwB;AAAA,EACpC;AAAA,EAER,YAAY,SAAuB;AACjC,SAAK,QAAQ,QAAQ;AAAA,EACvB;AAAA,EAEA,IAAI,OAAuC;AACzC,UAAM,QAAQ,KAAK,MAAM,IAAI,KAAK;AAClC,QAAI,CAAC,MAAO,QAAO;AAEnB,QAAI,KAAK,IAAI,IAAI,MAAM,WAAW;AAChC,WAAK,MAAM,OAAO,KAAK;AACvB,aAAO;AAAA,IACT;AAEA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,OAAe,MAAwB;AACzC,QAAI,KAAK,MAAM,OAAO,KAAM;AAC1B,WAAK,MAAM;AAAA,IACb;AACA,SAAK,MAAM,IAAI,OAAO,EAAE,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK,MAAM,CAAC;AAAA,EACpE;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEQ,QAAc;AACpB,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,OAAO;AACrC,UAAI,MAAM,MAAM,WAAW;AACzB,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;;;AHOO,IAAM,QAAQ,CAAC,EAAE,YAAY,KAAK,MAAM,MAAoB;AACjE,QAAM,YAAY,QAAQ,IAAI,UAAU,KAAK,IAAI;AAEjD,SAAO,OACL,KACA,KACA,SACG;AACH,QAAI,CAAC,IAAI,QAAQ,eAAe;AAC9B,aAAO,IACJ,OAAO,GAAG,EACV,KAAK,EAAE,QAAQ,mBAAmB,SAAS,kBAAkB,CAAC;AAAA,IACnE;AAEA,UAAM,QAAQ,IAAI,QAAQ,cAAc,QAAQ,UAAU,EAAE;AAE5D,QAAI;AACF,UAAI,OAAO,OAAO,GAAG;AAAA,IACvB,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AAEzD,UAAI,YAAY,eAAe;AAC7B,eAAO,IACJ,OAAO,GAAG,EACV,KAAK,EAAE,QAAQ,iBAAiB,SAAS,cAAc,CAAC;AAAA,MAC7D;AACA,UAAI,YAAY,qBAAqB;AACnC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,QAAQ;AAAA,UACR,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,QAAQ,iBAAiB,QAAQ,CAAC;AAAA,IAClE;AAEA,QAAI,WAAW;AACb,YAAM,aAAa,UAAU,IAAI,KAAK;AACtC,UAAI,YAAY;AACd,YAAI,OAAO;AACX,eAAO,KAAK;AAAA,MACd;AAAA,IACF;AAEA,QAAI;AACF,YAAM,eAAe,MAAM,QAAQ,OAAO,UAAU;AAEpD,UAAI,aAAa,SAAS,WAAW,KAAK;AACxC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,QAAQ;AAAA,UACR,SAAS,aAAa,KAAK,WAAW;AAAA,QACxC,CAAC;AAAA,MACH;AACA,UAAI,aAAa,SAAS,WAAW,KAAK;AACxC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,QAAQ;AAAA,UACR,SAAS,aAAa,KAAK,WAAW;AAAA,QACxC,CAAC;AAAA,MACH;AACA,UAAI,aAAa,SAAS,WAAW,KAAK;AACxC,YAAI,OAAO,aAAa,KAAK;AAC7B,YAAI,WAAW;AACb,oBAAU,IAAI,OAAO,IAAI,IAAI;AAAA,QAC/B;AACA,eAAO,KAAK;AAAA,MACd;AACA,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QAC1B,QAAQ;AAAA,QACR,SAAS,aAAa,KAAK,WAAW;AAAA,MACxC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;AAC3C,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,QAAQ,gBAAgB,QAAQ,CAAC;AAAA,IACjE;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/api/dauth.api.ts","../src/cache.ts"],"sourcesContent":["import { Request, NextFunction, Response as ExpressResponse } from 'express';\nimport jwt from 'jsonwebtoken';\nimport { getUser } from './api/dauth.api';\nimport { UserCache } from './cache';\nimport type { CacheOptions } from './cache';\nimport { deriveEncryptionKey, decryptSessionWithKeys } from './session';\n\nexport type AuthMethodType = 'magic-link' | 'passkey';\n\nexport interface IDauthUser {\n  _id: string;\n  name: string;\n  lastname: string;\n  nickname: string;\n  email: string;\n  isVerified: boolean;\n  language: string;\n  avatar: {\n    id: string;\n    url: string;\n  };\n  role: string;\n  telPrefix: string;\n  telSuffix: string;\n  birthDate?: string;\n  country?: string;\n  metadata?: Record<string, unknown>;\n  authMethods?: AuthMethodType[];\n  createdAt: Date;\n  updatedAt: Date;\n  lastLogin: Date;\n}\n\nexport interface IRequestDauth extends Request {\n  user: IDauthUser;\n  files: {\n    image: { path: string };\n    avatar: { path: string };\n  };\n  headers: {\n    authorization: string;\n  };\n}\n\nexport interface SessionOptions {\n  cookieName?: string;\n  secure?: boolean;\n  previousTsk?: string;\n  sessionSalt?: string;\n}\n\nexport interface DauthOptions {\n  domainName: string;\n  tsk: string;\n  cache?: CacheOptions;\n  session?: SessionOptions;\n}\n\ninterface TCustomResponse extends ExpressResponse {\n  status(code: number): this;\n  send(body?: unknown): this;\n}\n\nexport { UserCache };\nexport type { CacheOptions };\n\nexport const dauth = ({\n  domainName,\n  tsk,\n  cache,\n  session,\n}: DauthOptions) => {\n  const userCache = cache ? new UserCache(cache) : null;\n\n  // Lazy-init encryption keys for session cookie mode\n  let keysPromise: Promise<Buffer[]> | null = null;\n  async function getEncKeys(): Promise<Buffer[]> {\n    if (!keysPromise) {\n      keysPromise = (async () => {\n        const keys: Buffer[] = [];\n        keys.push(\n          await deriveEncryptionKey(tsk, session?.sessionSalt)\n        );\n        if (session?.previousTsk) {\n          keys.push(\n            await deriveEncryptionKey(\n              session.previousTsk,\n              session.sessionSalt\n            )\n          );\n        }\n        return keys;\n      })();\n    }\n    return keysPromise;\n  }\n\n  function getSessionCookieName(): string {\n    if (session?.cookieName) return session.cookieName;\n    const secure =\n      session?.secure ?? process.env.NODE_ENV !== 'development';\n    return secure ? '__Host-dauth-session' : 'dauth-session';\n  }\n\n  return async (\n    req: IRequestDauth,\n    res: TCustomResponse,\n    next: NextFunction\n  ) => {\n    let token: string;\n\n    if (session) {\n      // Session cookie mode: read encrypted cookie\n      const cookieName = getSessionCookieName();\n      const cookie = req.cookies?.[cookieName];\n      if (!cookie) {\n        return res\n          .status(401)\n          .send({\n            status: 'no-session',\n            message: 'Not authenticated',\n          });\n      }\n      const keys = await getEncKeys();\n      const payload = decryptSessionWithKeys(cookie, keys);\n      if (!payload) {\n        return res\n          .status(401)\n          .send({\n            status: 'session-invalid',\n            message: 'Invalid session',\n          });\n      }\n      token = payload.accessToken;\n    } else {\n      // Authorization header mode\n      if (!req.headers.authorization) {\n        return res\n          .status(403)\n          .send({\n            status: 'token-not-found',\n            message: 'Token not found',\n          });\n      }\n      token = req.headers.authorization.replace(/['\"]+/g, '');\n    }\n\n    try {\n      jwt.verify(token, tsk);\n    } catch (error) {\n      const message =\n        error instanceof Error ? error.message : 'Token invalid';\n\n      if (message === 'jwt expired') {\n        return res\n          .status(401)\n          .send({ status: 'token-expired', message: 'jwt expired' });\n      }\n      if (message === 'invalid signature') {\n        return res.status(401).send({\n          status: 'tsk-not-invalid',\n          message:\n            'The TSK variable in the backend middleware is not valid',\n        });\n      }\n      return res\n        .status(401)\n        .send({ status: 'token-invalid', message });\n    }\n\n    if (userCache) {\n      const cachedUser = userCache.get(token);\n      if (cachedUser) {\n        req.user = cachedUser;\n        return next();\n      }\n    }\n\n    try {\n      const getUserFetch = await getUser(token, domainName);\n\n      if (getUserFetch.response.status === 404) {\n        return res.status(404).send({\n          status: 'user-not-found',\n          message:\n            getUserFetch.data.message ?? 'User does not exist',\n        });\n      }\n      if (getUserFetch.response.status === 500) {\n        return res.status(500).send({\n          status: 'error',\n          message:\n            getUserFetch.data.message ?? 'Dauth server error',\n        });\n      }\n      if (getUserFetch.response.status === 200) {\n        req.user = getUserFetch.data.user;\n        if (userCache) {\n          userCache.set(token, req.user);\n        }\n        return next();\n      }\n      return res.status(501).send({\n        status: 'request-error',\n        message:\n          getUserFetch.data.message ?? 'Dauth server error',\n      });\n    } catch (error) {\n      const message =\n        error instanceof Error\n          ? error.message\n          : 'Dauth server error';\n      return res\n        .status(500)\n        .send({ status: 'server-error', message });\n    }\n  };\n};\n","import { getServerBasePath } from './utils/config';\n\ninterface GetUserResponse {\n  response: { status: number };\n  data: { user?: any; message?: string };\n}\n\nexport async function getUser(\n  token: string,\n  domainName: string\n): Promise<GetUserResponse> {\n  const response = await fetch(\n    `${getServerBasePath()}/app/${domainName}/user`,\n    {\n      method: 'GET',\n      headers: {\n        Authorization: token,\n        'Content-Type': 'application/json',\n      },\n    }\n  );\n  const data = (await response.json()) as GetUserResponse['data'];\n  return { response: { status: response.status }, data };\n}\n","import { IDauthUser } from './index';\n\ninterface CacheEntry {\n  user: IDauthUser;\n  expiresAt: number;\n}\n\nexport interface CacheOptions {\n  ttlMs: number;\n}\n\nexport class UserCache {\n  private store = new Map<string, CacheEntry>();\n  private ttlMs: number;\n\n  constructor(options: CacheOptions) {\n    this.ttlMs = options.ttlMs;\n  }\n\n  get(token: string): IDauthUser | undefined {\n    const entry = this.store.get(token);\n    if (!entry) return undefined;\n\n    if (Date.now() > entry.expiresAt) {\n      this.store.delete(token);\n      return undefined;\n    }\n\n    return entry.user;\n  }\n\n  set(token: string, user: IDauthUser): void {\n    if (this.store.size > 1000) {\n      this.sweep();\n    }\n    this.store.set(token, { user, expiresAt: Date.now() + this.ttlMs });\n  }\n\n  clear(): void {\n    this.store.clear();\n  }\n\n  private sweep(): void {\n    const now = Date.now();\n    for (const [key, entry] of this.store) {\n      if (now > entry.expiresAt) {\n        this.store.delete(key);\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;AACA,OAAO,SAAS;;;ACMhB,eAAsB,QACpB,OACA,YAC0B;AAC1B,QAAM,WAAW,MAAM;AAAA,IACrB,GAAG,kBAAkB,CAAC,QAAQ,UAAU;AAAA,IACxC;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe;AAAA,QACf,gBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,SAAO,EAAE,UAAU,EAAE,QAAQ,SAAS,OAAO,GAAG,KAAK;AACvD;;;ACZO,IAAM,YAAN,MAAgB;AAAA,EACb,QAAQ,oBAAI,IAAwB;AAAA,EACpC;AAAA,EAER,YAAY,SAAuB;AACjC,SAAK,QAAQ,QAAQ;AAAA,EACvB;AAAA,EAEA,IAAI,OAAuC;AACzC,UAAM,QAAQ,KAAK,MAAM,IAAI,KAAK;AAClC,QAAI,CAAC,MAAO,QAAO;AAEnB,QAAI,KAAK,IAAI,IAAI,MAAM,WAAW;AAChC,WAAK,MAAM,OAAO,KAAK;AACvB,aAAO;AAAA,IACT;AAEA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,OAAe,MAAwB;AACzC,QAAI,KAAK,MAAM,OAAO,KAAM;AAC1B,WAAK,MAAM;AAAA,IACb;AACA,SAAK,MAAM,IAAI,OAAO,EAAE,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK,MAAM,CAAC;AAAA,EACpE;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEQ,QAAc;AACpB,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,OAAO;AACrC,UAAI,MAAM,MAAM,WAAW;AACzB,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;;;AFgBO,IAAM,QAAQ,CAAC;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,MAAoB;AAClB,QAAM,YAAY,QAAQ,IAAI,UAAU,KAAK,IAAI;AAGjD,MAAI,cAAwC;AAC5C,iBAAe,aAAgC;AAC7C,QAAI,CAAC,aAAa;AAChB,qBAAe,YAAY;AACzB,cAAM,OAAiB,CAAC;AACxB,aAAK;AAAA,UACH,MAAM,oBAAoB,KAAK,SAAS,WAAW;AAAA,QACrD;AACA,YAAI,SAAS,aAAa;AACxB,eAAK;AAAA,YACH,MAAM;AAAA,cACJ,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV;AAAA,UACF;AAAA,QACF;AACA,eAAO;AAAA,MACT,GAAG;AAAA,IACL;AACA,WAAO;AAAA,EACT;AAEA,WAAS,uBAA+B;AACtC,QAAI,SAAS,WAAY,QAAO,QAAQ;AACxC,UAAM,SACJ,SAAS,UAAU,QAAQ,IAAI,aAAa;AAC9C,WAAO,SAAS,yBAAyB;AAAA,EAC3C;AAEA,SAAO,OACL,KACA,KACA,SACG;AACH,QAAI;AAEJ,QAAI,SAAS;AAEX,YAAM,aAAa,qBAAqB;AACxC,YAAM,SAAS,IAAI,UAAU,UAAU;AACvC,UAAI,CAAC,QAAQ;AACX,eAAO,IACJ,OAAO,GAAG,EACV,KAAK;AAAA,UACJ,QAAQ;AAAA,UACR,SAAS;AAAA,QACX,CAAC;AAAA,MACL;AACA,YAAM,OAAO,MAAM,WAAW;AAC9B,YAAM,UAAU,uBAAuB,QAAQ,IAAI;AACnD,UAAI,CAAC,SAAS;AACZ,eAAO,IACJ,OAAO,GAAG,EACV,KAAK;AAAA,UACJ,QAAQ;AAAA,UACR,SAAS;AAAA,QACX,CAAC;AAAA,MACL;AACA,cAAQ,QAAQ;AAAA,IAClB,OAAO;AAEL,UAAI,CAAC,IAAI,QAAQ,eAAe;AAC9B,eAAO,IACJ,OAAO,GAAG,EACV,KAAK;AAAA,UACJ,QAAQ;AAAA,UACR,SAAS;AAAA,QACX,CAAC;AAAA,MACL;AACA,cAAQ,IAAI,QAAQ,cAAc,QAAQ,UAAU,EAAE;AAAA,IACxD;AAEA,QAAI;AACF,UAAI,OAAO,OAAO,GAAG;AAAA,IACvB,SAAS,OAAO;AACd,YAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;AAE3C,UAAI,YAAY,eAAe;AAC7B,eAAO,IACJ,OAAO,GAAG,EACV,KAAK,EAAE,QAAQ,iBAAiB,SAAS,cAAc,CAAC;AAAA,MAC7D;AACA,UAAI,YAAY,qBAAqB;AACnC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,QAAQ;AAAA,UACR,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AACA,aAAO,IACJ,OAAO,GAAG,EACV,KAAK,EAAE,QAAQ,iBAAiB,QAAQ,CAAC;AAAA,IAC9C;AAEA,QAAI,WAAW;AACb,YAAM,aAAa,UAAU,IAAI,KAAK;AACtC,UAAI,YAAY;AACd,YAAI,OAAO;AACX,eAAO,KAAK;AAAA,MACd;AAAA,IACF;AAEA,QAAI;AACF,YAAM,eAAe,MAAM,QAAQ,OAAO,UAAU;AAEpD,UAAI,aAAa,SAAS,WAAW,KAAK;AACxC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,QAAQ;AAAA,UACR,SACE,aAAa,KAAK,WAAW;AAAA,QACjC,CAAC;AAAA,MACH;AACA,UAAI,aAAa,SAAS,WAAW,KAAK;AACxC,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,QAAQ;AAAA,UACR,SACE,aAAa,KAAK,WAAW;AAAA,QACjC,CAAC;AAAA,MACH;AACA,UAAI,aAAa,SAAS,WAAW,KAAK;AACxC,YAAI,OAAO,aAAa,KAAK;AAC7B,YAAI,WAAW;AACb,oBAAU,IAAI,OAAO,IAAI,IAAI;AAAA,QAC/B;AACA,eAAO,KAAK;AAAA,MACd;AACA,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QAC1B,QAAQ;AAAA,QACR,SACE,aAAa,KAAK,WAAW;AAAA,MACjC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,UACJ,iBAAiB,QACb,MAAM,UACN;AACN,aAAO,IACJ,OAAO,GAAG,EACV,KAAK,EAAE,QAAQ,gBAAgB,QAAQ,CAAC;AAAA,IAC7C;AAAA,EACF;AACF;","names":[]}

package/dist/router.d.mts

@@ -0,0 +1,16 @@
+import { Router } from 'express';
+
+interface DauthRouterOptions {
+    domainName: string;
+    tsk: string;
+    dauthUrl?: string;
+    cookieName?: string;
+    csrfCookieName?: string;
+    maxAge?: number;
+    secure?: boolean;
+    previousTsk?: string;
+    sessionSalt?: string;
+}
+declare function dauthRouter(opts: DauthRouterOptions): Router;
+
+export { type DauthRouterOptions, dauthRouter };

package/dist/router.d.ts

@@ -0,0 +1,16 @@
+import { Router } from 'express';
+
+interface DauthRouterOptions {
+    domainName: string;
+    tsk: string;
+    dauthUrl?: string;
+    cookieName?: string;
+    csrfCookieName?: string;
+    maxAge?: number;
+    secure?: boolean;
+    previousTsk?: string;
+    sessionSalt?: string;
+}
+declare function dauthRouter(opts: DauthRouterOptions): Router;
+
+export { type DauthRouterOptions, dauthRouter };