nextly 0.0.1 → 0.0.2-alpha.0

package/dist/chunk-A3WPLSDT.mjs

@@ -0,0 +1,1364 @@
+import {
+  rateLimiter
+} from "./chunk-DXGGXIUZ.mjs";
+import {
+  getTrustedClientIp
+} from "./chunk-APKKRD2G.mjs";
+import {
+  generateRefreshToken,
+  generateRefreshTokenId,
+  getSession,
+  hashRefreshToken
+} from "./chunk-UUOFWCM6.mjs";
+import {
+  COOKIE_NAMES,
+  clearAccessTokenCookie,
+  getCookieOptions,
+  parseCookie,
+  readAccessTokenCookie,
+  serializeClearCookie,
+  serializeCookie,
+  setAccessTokenCookie
+} from "./chunk-2ZFKXPQM.mjs";
+import {
+  buildClaims,
+  signAccessToken
+} from "./chunk-X23WKS3Z.mjs";
+import {
+  readOrGenerateRequestId
+} from "./chunk-67GXH6PR.mjs";
+import {
+  getNextlyLogger
+} from "./chunk-W4MGXIRR.mjs";
+import {
+  EmailSchema,
+  PasswordSchema,
+  validatePasswordStrength,
+  verifyPassword
+} from "./chunk-W5KKPZT5.mjs";
+import {
+  respondAction,
+  respondData
+} from "./chunk-IUDOC7N7.mjs";
+import {
+  NextlyError
+} from "./chunk-NRUWQ5Z7.mjs";
+
+// src/auth/cookies/refresh-token-cookie.ts
+function setRefreshTokenCookie(token, ttlSeconds, isProduction) {
+  const options = getCookieOptions("refreshToken", isProduction, ttlSeconds);
+  return serializeCookie(COOKIE_NAMES.refreshToken, token, options);
+}
+function clearRefreshTokenCookie() {
+  return serializeClearCookie(
+    COOKIE_NAMES.refreshToken,
+    "/admin/api/auth/refresh"
+  );
+}
+function readRefreshTokenCookie(request) {
+  return parseCookie(request.headers.get("cookie"), COOKIE_NAMES.refreshToken);
+}
+
+// src/auth/csrf/csrf-cookie.ts
+function setCsrfCookie(token, isProduction) {
+  const options = getCookieOptions("csrf", isProduction);
+  return serializeCookie(COOKIE_NAMES.csrf, token, options);
+}
+function clearCsrfCookie() {
+  return serializeClearCookie(COOKIE_NAMES.csrf, "/admin");
+}
+function readCsrfCookie(request) {
+  return parseCookie(request.headers.get("cookie"), COOKIE_NAMES.csrf);
+}
+function readCsrfFromRequest(body, request) {
+  const headerToken = request.headers.get("x-csrf-token");
+  if (headerToken) return headerToken;
+  if (body && typeof body.csrfToken === "string") {
+    return body.csrfToken;
+  }
+  return null;
+}
+
+// src/auth/csrf/validate.ts
+import { timingSafeEqual } from "crypto";
+function csrfTokensMatch(cookieToken, requestToken) {
+  if (!cookieToken || !requestToken) return false;
+  if (cookieToken.length !== requestToken.length) return false;
+  try {
+    const a = Buffer.from(cookieToken, "utf-8");
+    const b = Buffer.from(requestToken, "utf-8");
+    return timingSafeEqual(a, b);
+  } catch {
+    return false;
+  }
+}
+function validateOrigin(request, allowedOrigins) {
+  const origin = request.headers.get("origin");
+  const referer = request.headers.get("referer");
+  const requestOrigin = origin || (referer ? new URL(referer).origin : null);
+  if (!requestOrigin) {
+    return false;
+  }
+  const requestUrl = new URL(request.url);
+  const selfOrigin = requestUrl.origin;
+  const allAllowed = [selfOrigin, ...allowedOrigins];
+  return allAllowed.some(
+    (allowed) => requestOrigin.toLowerCase() === allowed.toLowerCase()
+  );
+}
+function validateCsrf(request, cookieToken, requestToken, allowedOrigins = []) {
+  if (!cookieToken || !requestToken) {
+    return { valid: false, error: "Missing CSRF token" };
+  }
+  if (!csrfTokensMatch(cookieToken, requestToken)) {
+    return { valid: false, error: "Invalid CSRF token" };
+  }
+  if (!validateOrigin(request, allowedOrigins)) {
+    return { valid: false, error: "Invalid request origin" };
+  }
+  return { valid: true };
+}
+
+// src/auth/handlers/handler-utils.ts
+function jsonResponse(status, body, headers) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "Content-Type": "application/json",
+      ...headers
+    }
+  });
+}
+async function stallResponse(startTime, stallMs) {
+  const elapsed = Date.now() - startTime;
+  if (elapsed < stallMs) {
+    await new Promise((resolve) => setTimeout(resolve, stallMs - elapsed));
+  }
+}
+function buildCookieHeaders(cookies, extra) {
+  const headers = new Headers({
+    "Content-Type": "application/json",
+    ...extra
+  });
+  for (const cookie of cookies) {
+    headers.append("Set-Cookie", cookie);
+  }
+  return headers;
+}
+async function parseJsonBody(request) {
+  try {
+    return await request.json();
+  } catch {
+    return null;
+  }
+}
+
+// src/auth/handlers/change-password.ts
+async function handleChangePassword(request, deps) {
+  const sessionResult = await getSession(request, deps.secret);
+  if (!sessionResult.authenticated) {
+    return jsonResponse(401, {
+      error: { code: "AUTH_REQUIRED", message: "Authentication required" }
+    });
+  }
+  const body = await request.json();
+  const csrfCookie = readCsrfCookie(request);
+  const csrfToken = readCsrfFromRequest(body, request);
+  const csrfResult = validateCsrf(
+    request,
+    csrfCookie,
+    csrfToken,
+    deps.allowedOrigins
+  );
+  if (!csrfResult.valid) {
+    return jsonResponse(403, {
+      error: { code: "CSRF_FAILED", message: csrfResult.error }
+    });
+  }
+  const { currentPassword, newPassword } = body;
+  if (!currentPassword || !newPassword) {
+    return jsonResponse(400, {
+      error: {
+        code: "VALIDATION_ERROR",
+        message: "Current password and new password are required"
+      }
+    });
+  }
+  const result = await deps.changePassword(
+    sessionResult.user.id,
+    currentPassword,
+    newPassword
+  );
+  if (!result.success) {
+    return jsonResponse(400, {
+      error: { code: "PASSWORD_CHANGE_FAILED", message: result.error }
+    });
+  }
+  await deps.deleteAllRefreshTokensForUser(sessionResult.user.id);
+  await deps.auditLog.write({
+    kind: "password-changed",
+    actorUserId: sessionResult.user.id,
+    targetUserId: sessionResult.user.id,
+    ipAddress: getTrustedClientIp(request, {
+      trustProxy: deps.trustProxy,
+      trustedProxyIps: deps.trustedProxyIps
+    }),
+    userAgent: request.headers.get("user-agent")
+  });
+  const clearCookies = [clearAccessTokenCookie(), clearRefreshTokenCookie()];
+  return respondAction(
+    "Password changed.",
+    {},
+    { status: 200, headers: buildCookieHeaders(clearCookies) }
+  );
+}
+
+// src/auth/csrf/generate.ts
+import { randomBytes } from "crypto";
+function generateCsrfToken() {
+  return randomBytes(32).toString("hex");
+}
+
+// src/auth/handlers/csrf.ts
+async function handleCsrf(_request, deps) {
+  const token = generateCsrfToken();
+  const cookie = setCsrfCookie(token, deps.isProduction);
+  const headers = new Headers();
+  headers.append("Set-Cookie", cookie);
+  return respondData({ token }, { status: 200, headers });
+}
+
+// src/auth/handlers/forgot-password.ts
+var SILENT_MESSAGE = "If an account exists for this email, a password reset link has been sent.";
+function sanitizeRedirectPath(raw) {
+  if (typeof raw !== "string" || raw.length === 0) return void 0;
+  if (raw.length > 2048 || raw.includes("\0")) {
+    console.warn(
+      `[nextly/auth] Rejected forgot-password redirectPath: oversized or contained null byte`
+    );
+    return void 0;
+  }
+  if (raw.startsWith("/") && !raw.startsWith("//")) {
+    if (raw === "/admin" || raw.startsWith("/admin/") || raw.startsWith("/admin?")) {
+      return raw;
+    }
+    console.warn(
+      `[nextly/auth] Rejected forgot-password redirectPath outside /admin: ${raw}`
+    );
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    console.warn(
+      `[nextly/auth] Rejected forgot-password redirectPath: unparseable URL: ${raw}`
+    );
+    return void 0;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    console.warn(
+      `[nextly/auth] Rejected forgot-password redirectPath: bad protocol ${parsed.protocol}`
+    );
+    return void 0;
+  }
+  const allowed = (process.env.ALLOWED_REDIRECT_HOSTS ?? "").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+  const host = parsed.host.toLowerCase();
+  if (allowed.includes(host)) {
+    return raw;
+  }
+  console.warn(
+    `[nextly/auth] Rejected forgot-password redirectPath: host ${host} not in ALLOWED_REDIRECT_HOSTS`
+  );
+  return void 0;
+}
+function buildForgotErrorResponse(err, requestId) {
+  return new Response(
+    JSON.stringify({ error: err.toResponseJSON(requestId) }),
+    {
+      status: err.statusCode,
+      headers: {
+        "content-type": "application/problem+json",
+        "x-request-id": requestId
+      }
+    }
+  );
+}
+async function handleForgotPassword(request, deps) {
+  const startTime = Date.now();
+  const requestId = readOrGenerateRequestId(request);
+  try {
+    const body = await request.json();
+    const csrfCookie = readCsrfCookie(request);
+    const csrfToken = readCsrfFromRequest(body, request);
+    const csrfResult = validateCsrf(
+      request,
+      csrfCookie,
+      csrfToken,
+      deps.allowedOrigins
+    );
+    if (!csrfResult.valid) {
+      await stallResponse(startTime, deps.loginStallTimeMs);
+      return jsonResponse(
+        403,
+        { error: { code: "CSRF_FAILED", message: csrfResult.error } },
+        { "x-request-id": requestId }
+      );
+    }
+    const { email, redirectPath } = body;
+    if (!email) {
+      throw NextlyError.validation({
+        errors: [{ path: "email", code: "REQUIRED", message: "Required." }]
+      });
+    }
+    const safeRedirectPath = sanitizeRedirectPath(redirectPath);
+    try {
+      await deps.generatePasswordResetToken(email, safeRedirectPath);
+    } catch (err) {
+      if (NextlyError.is(err) && (err.code === "NOT_FOUND" || err.code === "AUTH_INVALID_CREDENTIALS" || err.code === "VALIDATION_ERROR")) {
+      } else {
+        throw err;
+      }
+    }
+    await stallResponse(startTime, deps.loginStallTimeMs);
+    return respondAction(
+      SILENT_MESSAGE,
+      {},
+      { status: 200, headers: { "x-request-id": requestId } }
+    );
+  } catch (err) {
+    await stallResponse(startTime, deps.loginStallTimeMs);
+    if (NextlyError.is(err)) {
+      return buildForgotErrorResponse(err, requestId);
+    }
+    return buildForgotErrorResponse(
+      NextlyError.internal({ cause: err }),
+      requestId
+    );
+  }
+}
+
+// src/auth/credentials/verify-credentials.ts
+var DUMMY_HASH = "$2b$12$ML1pr5W9k0ODLs2GFo9gruB/VcQfuby0nAeFo959eFXl0u1ZUmbb6";
+async function verifyCredentials(input, deps) {
+  const user = await deps.findUserByEmail(input.email);
+  const passwordOk = user ? await verifyPassword(input.password, user.passwordHash) : await verifyPassword(input.password, DUMMY_HASH);
+  if (!user || !passwordOk) {
+    if (user) {
+      const newAttempts = user.failedLoginAttempts + 1;
+      if (newAttempts >= deps.maxLoginAttempts) {
+        const lockedUntil = new Date(
+          Date.now() + deps.lockoutDurationSeconds * 1e3
+        );
+        await deps.lockAccount(user.id, lockedUntil);
+      } else {
+        await deps.incrementFailedAttempts(user.id);
+      }
+    }
+    throw NextlyError.invalidCredentials({
+      logContext: {
+        email: input.email,
+        reason: !user ? "user-not-found" : "password-mismatch"
+      }
+    });
+  }
+  if (user.lockedUntil && user.lockedUntil > /* @__PURE__ */ new Date()) {
+    throw NextlyError.invalidCredentials({
+      logContext: {
+        userId: user.id,
+        reason: "locked",
+        lockedUntil: user.lockedUntil
+      }
+    });
+  }
+  if (deps.requireEmailVerification && !user.emailVerified) {
+    throw NextlyError.invalidCredentials({
+      logContext: { userId: user.id, reason: "unverified" }
+    });
+  }
+  if (!user.isActive) {
+    throw NextlyError.invalidCredentials({
+      logContext: { userId: user.id, reason: "inactive" }
+    });
+  }
+  if (user.failedLoginAttempts > 0) {
+    await deps.resetFailedAttempts(user.id);
+  }
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    image: user.image,
+    emailVerified: user.emailVerified,
+    isActive: user.isActive
+  };
+}
+
+// src/auth/handlers/login.ts
+function buildLoginErrorResponse(err, requestId) {
+  return new Response(
+    JSON.stringify({ error: err.toResponseJSON(requestId) }),
+    {
+      status: err.statusCode,
+      headers: {
+        "content-type": "application/problem+json",
+        "x-request-id": requestId
+      }
+    }
+  );
+}
+async function handleLogin(request, deps) {
+  const startTime = Date.now();
+  const requestId = readOrGenerateRequestId(request);
+  try {
+    const body = await request.json();
+    const csrfCookie = readCsrfCookie(request);
+    const csrfToken = readCsrfFromRequest(body, request);
+    const csrfResult = validateCsrf(
+      request,
+      csrfCookie,
+      csrfToken,
+      deps.allowedOrigins
+    );
+    if (!csrfResult.valid) {
+      await stallResponse(startTime, deps.loginStallTimeMs);
+      return jsonResponse(
+        403,
+        {
+          error: { code: "CSRF_FAILED", message: csrfResult.error }
+        },
+        { "x-request-id": requestId }
+      );
+    }
+    const verifiedUser = await verifyCredentials(
+      { email: body.email, password: body.password },
+      {
+        findUserByEmail: deps.findUserByEmail,
+        incrementFailedAttempts: deps.incrementFailedAttempts,
+        lockAccount: deps.lockAccount,
+        resetFailedAttempts: deps.resetFailedAttempts,
+        maxLoginAttempts: deps.maxLoginAttempts,
+        lockoutDurationSeconds: deps.lockoutDurationSeconds,
+        requireEmailVerification: deps.requireEmailVerification
+      }
+    );
+    const [roleIds, customFields] = await Promise.all([
+      deps.fetchRoleIds(verifiedUser.id),
+      deps.fetchCustomFields(verifiedUser.id)
+    ]);
+    const claims = buildClaims({
+      userId: verifiedUser.id,
+      email: verifiedUser.email,
+      name: verifiedUser.name,
+      image: verifiedUser.image,
+      roleIds,
+      customFields
+    });
+    const accessToken = await signAccessToken(
+      claims,
+      deps.secret,
+      deps.accessTokenTTL
+    );
+    const rawRefreshToken = generateRefreshToken();
+    const refreshTokenHash = hashRefreshToken(rawRefreshToken);
+    await deps.storeRefreshToken({
+      id: generateRefreshTokenId(),
+      userId: verifiedUser.id,
+      tokenHash: refreshTokenHash,
+      userAgent: request.headers.get("user-agent"),
+      ipAddress: getTrustedClientIp(request, {
+        trustProxy: deps.trustProxy,
+        trustedProxyIps: deps.trustedProxyIps
+      }),
+      expiresAt: new Date(Date.now() + deps.refreshTokenTTL * 1e3)
+    });
+    const cookies = [
+      setAccessTokenCookie(
+        accessToken,
+        deps.refreshTokenTTL,
+        deps.isProduction
+      ),
+      setRefreshTokenCookie(
+        rawRefreshToken,
+        deps.refreshTokenTTL,
+        deps.isProduction
+      )
+    ];
+    await stallResponse(startTime, deps.loginStallTimeMs);
+    return respondAction(
+      "Logged in.",
+      {
+        user: {
+          id: verifiedUser.id,
+          email: verifiedUser.email,
+          name: verifiedUser.name,
+          image: verifiedUser.image,
+          roleIds
+        },
+        accessToken,
+        refreshToken: rawRefreshToken,
+        // `expiresAt` reflects the access-token JWT exp claim (the
+        // authoritative expiration server-side), not the cookie max-age.
+        // signAccessToken uses deps.accessTokenTTL for that.
+        expiresAt: new Date(
+          Date.now() + deps.accessTokenTTL * 1e3
+        ).toISOString()
+      },
+      {
+        status: 200,
+        headers: buildCookieHeaders(cookies, { "x-request-id": requestId })
+      }
+    );
+  } catch (err) {
+    await stallResponse(startTime, deps.loginStallTimeMs);
+    await deps.auditLog.write({
+      kind: "login-failed",
+      ipAddress: getTrustedClientIp(request, {
+        trustProxy: deps.trustProxy,
+        trustedProxyIps: deps.trustedProxyIps
+      }),
+      userAgent: request.headers.get("user-agent"),
+      metadata: NextlyError.is(err) ? { code: err.code, ...err.logContext ?? {} } : { code: "INTERNAL_ERROR" }
+    });
+    if (NextlyError.is(err)) {
+      return buildLoginErrorResponse(err, requestId);
+    }
+    return buildLoginErrorResponse(
+      NextlyError.internal({ cause: err }),
+      requestId
+    );
+  }
+}
+
+// src/auth/handlers/logout.ts
+async function handleLogout(request, deps) {
+  const body = await parseJsonBody(request);
+  const csrfCookie = readCsrfCookie(request);
+  const csrfToken = readCsrfFromRequest(body, request);
+  const csrfResult = validateCsrf(
+    request,
+    csrfCookie,
+    csrfToken,
+    deps.allowedOrigins
+  );
+  if (!csrfResult.valid) {
+    return jsonResponse(403, {
+      error: { code: "CSRF_FAILED", message: csrfResult.error }
+    });
+  }
+  const refreshToken = readRefreshTokenCookie(request);
+  if (refreshToken) {
+    const tokenHash = hashRefreshToken(refreshToken);
+    await deps.deleteRefreshTokenByHash(tokenHash);
+  }
+  const clearCookies = [
+    clearAccessTokenCookie(),
+    clearRefreshTokenCookie(),
+    clearCsrfCookie()
+  ];
+  return respondAction(
+    "Logged out.",
+    {},
+    { status: 200, headers: buildCookieHeaders(clearCookies) }
+  );
+}
+
+// src/auth/session/refresh-binding.ts
+var IPV4_RE = /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/;
+var IPV6_CHAR_RE = /^[0-9a-fA-F:.]+$/;
+function classifyIp(addr) {
+  if (IPV4_RE.test(addr)) return 4;
+  if (addr.includes(":") && IPV6_CHAR_RE.test(addr) && addr.length <= 45) {
+    return 6;
+  }
+  return 0;
+}
+function ipv4ToInt(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  let acc = 0;
+  for (const p of parts) {
+    const n = Number(p);
+    if (!Number.isInteger(n) || n < 0 || n > 255) return null;
+    acc = acc << 8 | n;
+  }
+  return acc >>> 0;
+}
+function sameIpv4Prefix(a, b, prefix) {
+  const ai = ipv4ToInt(a);
+  const bi = ipv4ToInt(b);
+  if (ai === null || bi === null) return false;
+  const mask = prefix === 0 ? 0 : -1 >>> 32 - prefix << 32 - prefix;
+  return (ai & mask) >>> 0 === (bi & mask) >>> 0;
+}
+function ipv6PrefixHex(addr, prefixBits) {
+  if (prefixBits % 4 !== 0) return null;
+  const hexCount = prefixBits / 4;
+  let work = addr.toLowerCase();
+  const dottedMatch = work.match(/^(.*:)(\d+\.\d+\.\d+\.\d+)$/);
+  if (dottedMatch) {
+    const v4 = ipv4ToInt(dottedMatch[2]);
+    if (v4 === null) return null;
+    const high = (v4 >>> 16 & 65535).toString(16);
+    const low = (v4 & 65535).toString(16);
+    work = `${dottedMatch[1]}${high}:${low}`;
+  }
+  const doubleColon = work.split("::");
+  if (doubleColon.length > 2) return null;
+  let groups;
+  if (doubleColon.length === 2) {
+    const left = doubleColon[0] === "" ? [] : doubleColon[0].split(":");
+    const right = doubleColon[1] === "" ? [] : doubleColon[1].split(":");
+    if (left.length + right.length > 8) return null;
+    const fill = new Array(8 - left.length - right.length).fill("0");
+    groups = [...left, ...fill, ...right];
+  } else {
+    groups = work.split(":");
+    if (groups.length !== 8) return null;
+  }
+  let out = "";
+  for (const g of groups) {
+    if (!/^[0-9a-f]{0,4}$/.test(g)) return null;
+    out += g.padStart(4, "0");
+    if (out.length >= hexCount) break;
+  }
+  return out.slice(0, hexCount);
+}
+function sameIpv6Prefix(a, b, prefix) {
+  const ah = ipv6PrefixHex(a, prefix);
+  const bh = ipv6PrefixHex(b, prefix);
+  if (ah === null || bh === null) return false;
+  return ah === bh;
+}
+function evaluateRefreshBinding(input) {
+  const ipResult = compareIps(input.storedIp, input.currentIp);
+  if (ipResult !== null) {
+    return { kind: "hard", reason: ipResult };
+  }
+  if (input.storedUserAgent !== null && input.currentUserAgent !== null && input.storedUserAgent !== input.currentUserAgent) {
+    return { kind: "soft", reason: "ua-mismatch" };
+  }
+  return { kind: "ok" };
+}
+function compareIps(stored, current) {
+  if (stored === null || current === null) return null;
+  if (stored === current) return null;
+  const sf = classifyIp(stored);
+  const cf = classifyIp(current);
+  if (sf === 0 || cf === 0) return null;
+  if (sf !== cf) return "ip-family-mismatch";
+  if (sf === 4) {
+    return sameIpv4Prefix(stored, current, 24) ? null : "ipv4-prefix-mismatch";
+  }
+  return sameIpv6Prefix(stored, current, 48) ? null : "ipv6-prefix-mismatch";
+}
+
+// src/auth/handlers/refresh.ts
+async function handleRefresh(request, deps) {
+  const rawToken = readRefreshTokenCookie(request);
+  if (!rawToken) {
+    return clearAndDeny("No refresh token");
+  }
+  const tokenHash = hashRefreshToken(rawToken);
+  const tokenRecord = await deps.findRefreshTokenByHash(tokenHash);
+  if (!tokenRecord) {
+    return clearAndDeny("Invalid refresh token");
+  }
+  if (tokenRecord.expiresAt < /* @__PURE__ */ new Date()) {
+    await deps.deleteRefreshToken(tokenRecord.id);
+    return clearAndDeny("Refresh token expired");
+  }
+  const currentUserAgent = request.headers.get("user-agent");
+  const currentIp = getTrustedClientIp(request, {
+    trustProxy: deps.trustProxy,
+    trustedProxyIps: deps.trustedProxyIps
+  });
+  const binding = evaluateRefreshBinding({
+    storedUserAgent: tokenRecord.userAgent,
+    currentUserAgent,
+    storedIp: tokenRecord.ipAddress,
+    currentIp
+  });
+  if (binding.kind === "hard") {
+    await deps.deleteRefreshToken(tokenRecord.id);
+    await deps.deleteAllRefreshTokensForUser(tokenRecord.userId);
+    getNextlyLogger().warn({
+      kind: "refresh-binding-hard-fail",
+      reason: binding.reason,
+      tokenId: tokenRecord.id,
+      userId: tokenRecord.userId
+    });
+    return clearAndDeny("Session binding mismatch");
+  }
+  if (binding.kind === "soft") {
+    getNextlyLogger().warn({
+      kind: "refresh-binding-soft-warn",
+      reason: binding.reason,
+      tokenId: tokenRecord.id,
+      userId: tokenRecord.userId
+    });
+  }
+  await deps.deleteRefreshToken(tokenRecord.id);
+  const user = await deps.findUserById(tokenRecord.userId);
+  if (!user || !user.isActive) {
+    return clearAndDeny("User not found or inactive");
+  }
+  const [roleIds, customFields] = await Promise.all([
+    deps.fetchRoleIds(user.id),
+    deps.fetchCustomFields(user.id)
+  ]);
+  const claims = buildClaims({
+    userId: user.id,
+    email: user.email,
+    name: user.name,
+    image: user.image,
+    roleIds,
+    customFields
+  });
+  const accessToken = await signAccessToken(
+    claims,
+    deps.secret,
+    deps.accessTokenTTL
+  );
+  const newRawToken = generateRefreshToken();
+  const newTokenHash = hashRefreshToken(newRawToken);
+  await deps.storeRefreshToken({
+    id: generateRefreshTokenId(),
+    userId: user.id,
+    tokenHash: newTokenHash,
+    userAgent: request.headers.get("user-agent"),
+    ipAddress: getTrustedClientIp(request, {
+      trustProxy: deps.trustProxy,
+      trustedProxyIps: deps.trustedProxyIps
+    }),
+    expiresAt: new Date(Date.now() + deps.refreshTokenTTL * 1e3)
+  });
+  const cookies = [
+    setAccessTokenCookie(accessToken, deps.refreshTokenTTL, deps.isProduction),
+    setRefreshTokenCookie(newRawToken, deps.refreshTokenTTL, deps.isProduction)
+  ];
+  return respondData(
+    {
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        image: user.image,
+        roleIds
+      },
+      accessToken,
+      refreshToken: newRawToken,
+      // Authoritative server-side exp lives on the JWT itself (accessTokenTTL).
+      expiresAt: new Date(
+        Date.now() + deps.accessTokenTTL * 1e3
+      ).toISOString()
+    },
+    { status: 200, headers: buildCookieHeaders(cookies) }
+  );
+}
+function clearAndDeny(message) {
+  const clearCookies = [
+    clearAccessTokenCookie(),
+    clearRefreshTokenCookie(),
+    clearCsrfCookie()
+  ];
+  return new Response(
+    JSON.stringify({
+      error: { code: "REFRESH_FAILED", message }
+    }),
+    { status: 401, headers: buildCookieHeaders(clearCookies) }
+  );
+}
+
+// src/auth/handlers/register.ts
+import { z } from "zod";
+var RegisterPayloadSchema = z.object({
+  email: EmailSchema,
+  password: PasswordSchema,
+  name: z.string().trim().min(1, "Name is required.").max(100, "Name must be 100 characters or less.")
+});
+var SILENT_SUCCESS_MESSAGE = "If this email is available, we've sent a confirmation link.";
+function zodIssueToCode(issue) {
+  switch (issue.code) {
+    case "invalid_type":
+      return "REQUIRED";
+    case "too_small":
+      return issue.minimum === 1 ? "REQUIRED" : "TOO_SHORT";
+    case "too_big":
+      return "TOO_LONG";
+    case "invalid_format":
+      return "INVALID_FORMAT";
+    default:
+      return "INVALID";
+  }
+}
+function buildRegisterErrorResponse(err, requestId) {
+  return new Response(
+    JSON.stringify({ error: err.toResponseJSON(requestId) }),
+    {
+      status: err.statusCode,
+      headers: {
+        "content-type": "application/problem+json",
+        "x-request-id": requestId
+      }
+    }
+  );
+}
+async function handleRegister(request, deps) {
+  const startTime = Date.now();
+  const requestId = readOrGenerateRequestId(request);
+  try {
+    const body = await request.json();
+    const csrfCookie = readCsrfCookie(request);
+    const csrfToken = readCsrfFromRequest(body, request);
+    const csrfResult = validateCsrf(
+      request,
+      csrfCookie,
+      csrfToken,
+      deps.allowedOrigins
+    );
+    if (!csrfResult.valid) {
+      await stallResponse(startTime, deps.loginStallTimeMs);
+      return jsonResponse(
+        403,
+        { error: { code: "CSRF_FAILED", message: csrfResult.error } },
+        { "x-request-id": requestId }
+      );
+    }
+    const parsed = RegisterPayloadSchema.safeParse(body);
+    if (!parsed.success) {
+      throw NextlyError.validation({
+        errors: parsed.error.issues.map((issue) => ({
+          path: issue.path.join(".") || "root",
+          code: zodIssueToCode(issue),
+          message: issue.message.endsWith(".") ? issue.message : `${issue.message}.`
+        }))
+      });
+    }
+    const { email, password, name } = parsed.data;
+    try {
+      const user = await deps.registerUser({ email, password, name });
+      if (deps.revealRegistrationConflict) {
+        await stallResponse(startTime, deps.loginStallTimeMs);
+        return respondAction(
+          "Account created.",
+          { user: { id: user.id, email: user.email, name: user.name } },
+          {
+            status: 201,
+            headers: { "x-request-id": requestId }
+          }
+        );
+      }
+      await stallResponse(startTime, deps.loginStallTimeMs);
+      return respondAction(
+        SILENT_SUCCESS_MESSAGE,
+        {},
+        {
+          status: 200,
+          headers: { "x-request-id": requestId }
+        }
+      );
+    } catch (err) {
+      if (NextlyError.isCode(err, "DUPLICATE") && !deps.revealRegistrationConflict) {
+        getNextlyLogger().info({
+          kind: "register-duplicate-swallowed",
+          requestId,
+          logContext: err.logContext
+        });
+        await stallResponse(startTime, deps.loginStallTimeMs);
+        return respondAction(
+          SILENT_SUCCESS_MESSAGE,
+          {},
+          {
+            status: 200,
+            headers: { "x-request-id": requestId }
+          }
+        );
+      }
+      throw err;
+    }
+  } catch (err) {
+    await stallResponse(startTime, deps.loginStallTimeMs);
+    if (NextlyError.is(err)) {
+      return buildRegisterErrorResponse(err, requestId);
+    }
+    return buildRegisterErrorResponse(
+      NextlyError.internal({ cause: err }),
+      requestId
+    );
+  }
+}
+
+// src/auth/handlers/reset-password.ts
+function buildResetErrorResponse(err, requestId) {
+  return new Response(
+    JSON.stringify({ error: err.toResponseJSON(requestId) }),
+    {
+      status: err.statusCode,
+      headers: {
+        "content-type": "application/problem+json",
+        "x-request-id": requestId
+      }
+    }
+  );
+}
+function normaliseTokenFailure(err) {
+  if (NextlyError.is(err)) {
+    if (err.code === "NOT_FOUND" || err.code === "INVALID_INPUT" || err.code === "TOKEN_EXPIRED" || err.code === "VALIDATION_ERROR") {
+      return new NextlyError({
+        code: "INVALID_INPUT",
+        publicMessage: "This reset link is invalid or has expired.",
+        logContext: {
+          ...err.logContext ?? {},
+          originalCode: err.code
+        }
+      });
+    }
+  }
+  throw err;
+}
+async function handleResetPassword(request, deps) {
+  const requestId = readOrGenerateRequestId(request);
+  try {
+    const body = await request.json();
+    const csrfCookie = readCsrfCookie(request);
+    const csrfToken = readCsrfFromRequest(body, request);
+    const csrfResult = validateCsrf(
+      request,
+      csrfCookie,
+      csrfToken,
+      deps.allowedOrigins
+    );
+    if (!csrfResult.valid) {
+      return jsonResponse(
+        403,
+        { error: { code: "CSRF_FAILED", message: csrfResult.error } },
+        { "x-request-id": requestId }
+      );
+    }
+    const { token, newPassword } = body;
+    if (!token || !newPassword) {
+      throw NextlyError.validation({
+        errors: [
+          ...!token ? [{ path: "token", code: "REQUIRED", message: "Required." }] : [],
+          ...!newPassword ? [{ path: "newPassword", code: "REQUIRED", message: "Required." }] : []
+        ]
+      });
+    }
+    let result;
+    try {
+      result = await deps.resetPasswordWithToken(token, newPassword);
+    } catch (err) {
+      throw normaliseTokenFailure(err);
+    }
+    if (result.email) {
+      const user = await deps.findUserByEmail(result.email);
+      if (user) {
+        await deps.deleteAllRefreshTokensForUser(user.id);
+      }
+    }
+    return respondAction(
+      "Password reset.",
+      {},
+      { status: 200, headers: { "x-request-id": requestId } }
+    );
+  } catch (err) {
+    if (NextlyError.is(err)) {
+      return buildResetErrorResponse(err, requestId);
+    }
+    return buildResetErrorResponse(
+      NextlyError.internal({ cause: err }),
+      requestId
+    );
+  }
+}
+
+// src/auth/handlers/session.ts
+var devAutoLoginWarned = /* @__PURE__ */ new Set();
+async function handleSession(request, deps) {
+  const result = await getSession(request, deps.secret);
+  let failureReason = null;
+  if (!result.authenticated) {
+    failureReason = result.reason;
+  } else if (!deps.isProduction && deps.devAutoLogin) {
+    const live = await deps.findUserByEmail(result.user.email);
+    if (!live || live.id !== result.user.id) failureReason = "user_gone";
+  }
+  if (failureReason === null && result.authenticated) {
+    const accessToken = readAccessTokenCookie(request);
+    return respondData({ user: result.user, accessToken });
+  }
+  if (!deps.isProduction && deps.devAutoLogin) {
+    const autoLoginResponse = await attemptDevAutoLogin(deps);
+    if (autoLoginResponse) return autoLoginResponse;
+  } else if (deps.isProduction && deps.devAutoLogin) {
+    const key = deps.devAutoLogin.email;
+    if (!devAutoLoginWarned.has(`prod:${key}`)) {
+      devAutoLoginWarned.add(`prod:${key}`);
+      console.warn(
+        `[nextly] devAutoLogin ignored: NODE_ENV=production. Set this only for development. (configured email: ${key})`
+      );
+    }
+  }
+  const clearCookies = [];
+  if (failureReason === "invalid" || failureReason === "user_gone") {
+    clearCookies.push(clearAccessTokenCookie());
+  }
+  const code = failureReason === "expired" ? "TOKEN_EXPIRED" : "AUTH_REQUIRED";
+  const message = code === "TOKEN_EXPIRED" ? "Session expired" : "Not authenticated";
+  if (clearCookies.length > 0) {
+    return new Response(JSON.stringify({ error: { code, message } }), {
+      status: 401,
+      headers: buildCookieHeaders(clearCookies)
+    });
+  }
+  return jsonResponse(401, { error: { code, message } });
+}
+async function attemptDevAutoLogin(deps) {
+  if (!deps.devAutoLogin) return null;
+  const { email } = deps.devAutoLogin;
+  if (!email) return null;
+  const user = await deps.findUserByEmail(email);
+  if (!user || !user.isActive) {
+    if (!devAutoLoginWarned.has(`miss:${email}`)) {
+      devAutoLoginWarned.add(`miss:${email}`);
+      console.warn(
+        `[nextly] devAutoLogin: user "${email}" not found. Auto-login skipped. Either register the user or update admin.devAutoLogin.email in your nextly.config.ts.`
+      );
+    }
+    return null;
+  }
+  if (!devAutoLoginWarned.has(`active:${email}`)) {
+    devAutoLoginWarned.add(`active:${email}`);
+    console.warn(
+      `[nextly] devAutoLogin enabled for ${email}. DO NOT use this in production deployments.`
+    );
+  }
+  const [roleIds, customFields] = await Promise.all([
+    deps.fetchRoleIds(user.id),
+    deps.fetchCustomFields(user.id)
+  ]);
+  const claims = buildClaims({
+    userId: user.id,
+    email: user.email,
+    name: user.name,
+    image: user.image,
+    roleIds,
+    customFields
+  });
+  const accessToken = await signAccessToken(
+    claims,
+    deps.secret,
+    deps.accessTokenTTL
+  );
+  const rawRefreshToken = generateRefreshToken();
+  const refreshTokenHash = hashRefreshToken(rawRefreshToken);
+  await deps.storeRefreshToken({
+    id: generateRefreshTokenId(),
+    userId: user.id,
+    tokenHash: refreshTokenHash,
+    userAgent: null,
+    ipAddress: null,
+    expiresAt: new Date(Date.now() + deps.refreshTokenTTL * 1e3)
+  });
+  const cookies = [
+    setAccessTokenCookie(accessToken, deps.refreshTokenTTL, deps.isProduction),
+    setRefreshTokenCookie(
+      rawRefreshToken,
+      deps.refreshTokenTTL,
+      deps.isProduction
+    )
+  ];
+  return new Response(
+    JSON.stringify({
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        image: user.image
+      },
+      accessToken
+    }),
+    {
+      status: 200,
+      headers: buildCookieHeaders(cookies)
+    }
+  );
+}
+
+// src/auth/handlers/setup.ts
+async function handleSetupStatus(_request, deps) {
+  const count = await deps.getUserCount();
+  const isSetup = count > 0;
+  return respondData({ isSetup, requiresInitialUser: !isSetup });
+}
+async function handleSetup(request, deps) {
+  const userCount = await deps.getUserCount();
+  if (userCount > 0) {
+    return jsonResponse(403, {
+      error: {
+        code: "SETUP_COMPLETE",
+        message: "Setup already completed"
+      }
+    });
+  }
+  const body = await request.json();
+  const csrfCookie = readCsrfCookie(request);
+  const csrfToken = readCsrfFromRequest(body, request);
+  const csrfResult = validateCsrf(
+    request,
+    csrfCookie,
+    csrfToken,
+    deps.allowedOrigins
+  );
+  if (!csrfResult.valid) {
+    return jsonResponse(403, {
+      error: { code: "CSRF_FAILED", message: csrfResult.error }
+    });
+  }
+  const { email, name, password } = body;
+  if (!email || !name || !password) {
+    return jsonResponse(400, {
+      error: {
+        code: "VALIDATION_ERROR",
+        message: "Email, name, and password are required"
+      }
+    });
+  }
+  const strengthResult = validatePasswordStrength(password);
+  if (!strengthResult.ok) {
+    return jsonResponse(400, {
+      error: {
+        code: "WEAK_PASSWORD",
+        message: "Password does not meet requirements",
+        details: strengthResult.errors
+      }
+    });
+  }
+  const user = await deps.createSuperAdmin({ email, name, password });
+  const roleIds = await deps.fetchRoleIds(user.id);
+  const claims = buildClaims({
+    userId: user.id,
+    email: user.email,
+    name: user.name,
+    image: null,
+    roleIds
+  });
+  const accessToken = await signAccessToken(
+    claims,
+    deps.secret,
+    deps.accessTokenTTL
+  );
+  const rawRefreshToken = generateRefreshToken();
+  await deps.storeRefreshToken({
+    id: generateRefreshTokenId(),
+    userId: user.id,
+    tokenHash: hashRefreshToken(rawRefreshToken),
+    userAgent: request.headers.get("user-agent"),
+    ipAddress: getTrustedClientIp(request, {
+      trustProxy: deps.trustProxy,
+      trustedProxyIps: deps.trustedProxyIps
+    }),
+    expiresAt: new Date(Date.now() + deps.refreshTokenTTL * 1e3)
+  });
+  const cookies = [
+    setAccessTokenCookie(accessToken, deps.refreshTokenTTL, deps.isProduction),
+    setRefreshTokenCookie(
+      rawRefreshToken,
+      deps.refreshTokenTTL,
+      deps.isProduction
+    )
+  ];
+  return respondAction(
+    "Setup complete.",
+    {
+      user: { id: user.id, email: user.email, name: user.name, roleIds },
+      accessToken,
+      refreshToken: rawRefreshToken,
+      // Authoritative server-side exp = accessToken JWT exp claim, not cookie max-age.
+      expiresAt: new Date(
+        Date.now() + deps.accessTokenTTL * 1e3
+      ).toISOString()
+    },
+    { status: 201, headers: buildCookieHeaders(cookies) }
+  );
+}
+
+// src/auth/handlers/verify-email.ts
+async function handleVerifyEmail(request, deps) {
+  const body = await request.json();
+  const { token } = body;
+  if (!token) {
+    return jsonResponse(400, {
+      error: { code: "VALIDATION_ERROR", message: "Token is required" }
+    });
+  }
+  const result = await deps.verifyEmail(token);
+  if (!result.success) {
+    return jsonResponse(400, {
+      error: {
+        code: "VERIFICATION_FAILED",
+        message: result.error || "Invalid or expired token"
+      }
+    });
+  }
+  return respondAction("Email verified.", { email: result.email });
+}
+async function handleResendVerification(request, deps) {
+  const body = await request.json();
+  const csrfCookie = readCsrfCookie(request);
+  const csrfToken = readCsrfFromRequest(body, request);
+  const csrfResult = validateCsrf(
+    request,
+    csrfCookie,
+    csrfToken,
+    deps.allowedOrigins
+  );
+  if (!csrfResult.valid) {
+    return jsonResponse(403, {
+      error: { code: "CSRF_FAILED", message: csrfResult.error }
+    });
+  }
+  const { email } = body;
+  if (!email) {
+    return jsonResponse(400, {
+      error: { code: "VALIDATION_ERROR", message: "Email is required" }
+    });
+  }
+  await deps.resendVerificationEmail(email);
+  return respondAction("Verification email sent.");
+}
+
+// src/auth/handlers/router.ts
+var RATE_LIMITED_AUTH_PATHS = /* @__PURE__ */ new Set([
+  "login",
+  "register",
+  "forgot-password",
+  "reset-password"
+]);
+async function routeAuthRequest(request, authPath, deps) {
+  const response = await dispatchAuthRequest(request, authPath, deps);
+  return applyNoStoreCache(response);
+}
+async function dispatchAuthRequest(request, authPath, deps) {
+  const method = request.method.toUpperCase();
+  if (method === "GET") {
+    switch (authPath) {
+      case "setup-status":
+        return handleSetupStatus(request, deps);
+      case "session":
+        return handleSession(request, deps);
+      case "csrf":
+        return handleCsrf(request, deps);
+      default:
+        return null;
+    }
+  }
+  if (method === "POST") {
+    if (RATE_LIMITED_AUTH_PATHS.has(authPath)) {
+      const limited = checkAuthIpRateLimit(request, deps);
+      if (limited) return limited;
+    }
+    return auditCsrfFailure(request, authPath, deps, () => {
+      switch (authPath) {
+        case "login":
+          return handleLogin(request, deps);
+        case "logout":
+          return handleLogout(request, deps);
+        case "refresh":
+          return handleRefresh(request, deps);
+        case "setup":
+          return handleSetup(request, deps);
+        case "register":
+          return handleRegister(request, deps);
+        case "forgot-password":
+          return handleForgotPassword(request, deps);
+        case "reset-password":
+          return handleResetPassword(request, deps);
+        case "verify-email":
+          return handleVerifyEmail(request, deps);
+        case "verify-email/resend":
+          return handleResendVerification(request, deps);
+        default:
+          return Promise.resolve(null);
+      }
+    });
+  }
+  if (method === "PATCH") {
+    return auditCsrfFailure(request, authPath, deps, () => {
+      switch (authPath) {
+        case "change-password":
+          return handleChangePassword(request, deps);
+        default:
+          return Promise.resolve(null);
+      }
+    });
+  }
+  return null;
+}
+function applyNoStoreCache(response) {
+  if (!response) return response;
+  response.headers.set("Cache-Control", "no-store");
+  response.headers.set("Pragma", "no-cache");
+  return response;
+}
+async function auditCsrfFailure(request, authPath, deps, dispatch) {
+  const response = await dispatch();
+  if (!response || response.status !== 403) return response;
+  try {
+    const body = await response.clone().json();
+    if (body?.error?.code !== "CSRF_FAILED") return response;
+    await deps.auditLog.write({
+      kind: "csrf-failed",
+      ipAddress: getTrustedClientIp(request, {
+        trustProxy: deps.trustProxy,
+        trustedProxyIps: deps.trustedProxyIps
+      }),
+      userAgent: request.headers.get("user-agent"),
+      metadata: { path: authPath, method: request.method.toUpperCase() }
+    });
+  } catch {
+  }
+  return response;
+}
+function checkAuthIpRateLimit(request, deps) {
+  const limit = deps.authRateLimit.requestsPerHour;
+  if (limit <= 0) return null;
+  const ip = getTrustedClientIp(request, {
+    trustProxy: deps.trustProxy,
+    trustedProxyIps: deps.trustedProxyIps
+  }) ?? "unknown";
+  const result = rateLimiter.check(
+    `auth-ip:${ip}`,
+    limit,
+    deps.authRateLimit.windowMs
+  );
+  if (result.allowed) return null;
+  const retryAfter = Math.max(
+    1,
+    Math.ceil((result.resetAt.getTime() - Date.now()) / 1e3)
+  );
+  return new Response(
+    JSON.stringify({
+      error: {
+        code: "RATE_LIMIT_EXCEEDED",
+        message: "Too many auth requests from this IP. Please try again later.",
+        retryAfter
+      }
+    }),
+    {
+      status: 429,
+      headers: {
+        "content-type": "application/json",
+        "retry-after": String(retryAfter),
+        "x-ratelimit-limit": String(limit),
+        "x-ratelimit-remaining": "0",
+        "x-ratelimit-reset": String(result.resetAt.getTime())
+      }
+    }
+  );
+}
+
+export {
+  routeAuthRequest
+};