self-bench 0.3.6 → 0.3.8

package/dist/auth/config.d.ts

@@ -0,0 +1,17 @@
+export interface AuthConfig {
+    readonly clientId: string;
+    readonly clientSecret: string;
+    /** At least 32 characters; derives the cookie-signing and token-sealing keys. */
+    readonly sessionSecret: string;
+    /** Public origin of the site (no trailing slash); drives the callback URL and Secure cookies. */
+    readonly publicUrl: string;
+    readonly databaseUrl: string;
+    readonly githubUrl: string;
+    readonly githubApiUrl: string;
+}
+/**
+ * GitHub sign-in is opt-in: without GITHUB_OAUTH_CLIENT_ID the API keeps its bearer-token
+ * behavior and serves the Ledger as before. Setting it requires the rest to be complete.
+ */
+export declare function loadAuthConfig(environment?: NodeJS.ProcessEnv): AuthConfig | undefined;
+//# sourceMappingURL=config.d.ts.map

package/dist/auth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,WAAW,GAAE,MAAM,CAAC,UAAwB,GAC3C,UAAU,GAAG,SAAS,CAqBxB"}

package/dist/auth/config.js

@@ -0,0 +1,38 @@
+import { z } from "zod";
+const emptyStringAsUndefined = (value) => typeof value === "string" && value.trim() === "" ? undefined : value;
+const environmentSchema = z.object({
+    GITHUB_OAUTH_CLIENT_ID: z.preprocess(emptyStringAsUndefined, z.string().min(1).optional()),
+    GITHUB_OAUTH_CLIENT_SECRET: z.preprocess(emptyStringAsUndefined, z.string().min(1).optional()),
+    SELFBENCH_SESSION_SECRET: z.preprocess(emptyStringAsUndefined, z.string().optional()),
+    SELFBENCH_PUBLIC_URL: z.preprocess(emptyStringAsUndefined, z.string().url().optional()),
+    SELFBENCH_DATABASE_URL: z.preprocess(emptyStringAsUndefined, z.string().min(1).optional()),
+    GITHUB_URL: z.string().url().default("https://github.com"),
+    GITHUB_API_URL: z.string().url().default("https://api.github.com"),
+});
+/**
+ * GitHub sign-in is opt-in: without GITHUB_OAUTH_CLIENT_ID the API keeps its bearer-token
+ * behavior and serves the Ledger as before. Setting it requires the rest to be complete.
+ */
+export function loadAuthConfig(environment = process.env) {
+    const value = environmentSchema.parse(environment);
+    if (!value.GITHUB_OAUTH_CLIENT_ID)
+        return undefined;
+    const sessionSecret = value.SELFBENCH_SESSION_SECRET ?? "";
+    if (sessionSecret.length < 32) {
+        throw new Error("SELFBENCH_SESSION_SECRET must be at least 32 characters for GitHub sign-in");
+    }
+    return {
+        clientId: value.GITHUB_OAUTH_CLIENT_ID,
+        clientSecret: value.GITHUB_OAUTH_CLIENT_SECRET ??
+            fail("GITHUB_OAUTH_CLIENT_SECRET is required for GitHub sign-in"),
+        sessionSecret,
+        publicUrl: (value.SELFBENCH_PUBLIC_URL ?? fail("SELFBENCH_PUBLIC_URL is required for GitHub sign-in")).replace(/\/+$/, ""),
+        databaseUrl: value.SELFBENCH_DATABASE_URL ?? fail("SELFBENCH_DATABASE_URL is required for GitHub sign-in"),
+        githubUrl: value.GITHUB_URL.replace(/\/+$/, ""),
+        githubApiUrl: value.GITHUB_API_URL.replace(/\/+$/, ""),
+    };
+}
+function fail(message) {
+    throw new Error(message);
+}
+//# sourceMappingURL=config.js.map

package/dist/auth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAW,EAAE,CACzD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAEvE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,sBAAsB,EAAE,CAAC,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1F,0BAA0B,EAAE,CAAC,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9F,wBAAwB,EAAE,CAAC,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;IACrF,oBAAoB,EAAE,CAAC,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IACvF,sBAAsB,EAAE,CAAC,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;CACnE,CAAC,CAAC;AAcH;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,cAAiC,OAAO,CAAC,GAAG;IAE5C,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,aAAa,GAAG,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC;IAC3D,IAAI,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,sBAAsB;QACtC,YAAY,EACV,KAAK,CAAC,0BAA0B;YAChC,IAAI,CAAC,2DAA2D,CAAC;QACnE,aAAa;QACb,SAAS,EAAE,CACT,KAAK,CAAC,oBAAoB,IAAI,IAAI,CAAC,qDAAqD,CAAC,CAC1F,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACrB,WAAW,EACT,KAAK,CAAC,sBAAsB,IAAI,IAAI,CAAC,uDAAuD,CAAC;QAC/F,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC"}

package/dist/auth/cookies.d.ts

@@ -0,0 +1,12 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+export interface CookieOptions {
+    readonly maxAgeSeconds: number;
+    readonly secure: boolean;
+    readonly path?: string;
+}
+export declare function parseCookies(request: IncomingMessage): Record<string, string>;
+/** Appends a Set-Cookie header; HttpOnly and SameSite=Lax always, Secure per the public URL. */
+export declare function setCookie(response: ServerResponse, name: string, value: string, options: CookieOptions): void;
+export declare function clearCookie(response: ServerResponse, name: string, options: Omit<CookieOptions, "maxAgeSeconds">): void;
+export declare function sendRedirect(response: ServerResponse, location: string): void;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/auth/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiB7E;AAED,gGAAgG;AAChG,wBAAgB,SAAS,CACvB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,IAAI,CAYN;AAED,wBAAgB,WAAW,CACzB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,GAC5C,IAAI,CAEN;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAG7E"}

package/dist/auth/cookies.js

@@ -0,0 +1,45 @@
+export function parseCookies(request) {
+    const header = request.headers.cookie;
+    const cookies = {};
+    if (!header)
+        return cookies;
+    for (const part of header.split(";")) {
+        const separator = part.indexOf("=");
+        if (separator === -1)
+            continue;
+        const name = part.slice(0, separator).trim();
+        const value = part.slice(separator + 1).trim();
+        if (!name)
+            continue;
+        try {
+            cookies[name] = decodeURIComponent(value);
+        }
+        catch {
+            // a malformed cookie is treated as absent
+        }
+    }
+    return cookies;
+}
+/** Appends a Set-Cookie header; HttpOnly and SameSite=Lax always, Secure per the public URL. */
+export function setCookie(response, name, value, options) {
+    const parts = [
+        `${name}=${encodeURIComponent(value)}`,
+        `Path=${options.path ?? "/"}`,
+        `Max-Age=${options.maxAgeSeconds}`,
+        "HttpOnly",
+        "SameSite=Lax",
+    ];
+    if (options.secure)
+        parts.push("Secure");
+    const existing = response.getHeader("set-cookie");
+    const list = Array.isArray(existing) ? existing : typeof existing === "string" ? [existing] : [];
+    response.setHeader("set-cookie", [...list, parts.join("; ")]);
+}
+export function clearCookie(response, name, options) {
+    setCookie(response, name, "", { ...options, maxAgeSeconds: 0 });
+}
+export function sendRedirect(response, location) {
+    response.writeHead(302, { location, "cache-control": "no-store" });
+    response.end();
+}
+//# sourceMappingURL=cookies.js.map

package/dist/auth/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,YAAY,CAAC,OAAwB;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,SAAS;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,SAAS,CACvB,QAAwB,EACxB,IAAY,EACZ,KAAa,EACb,OAAsB;IAEtB,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtC,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE;QAC7B,WAAW,OAAO,CAAC,aAAa,EAAE;QAClC,UAAU;QACV,cAAc;KACf,CAAC;IACF,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,QAAwB,EACxB,IAAY,EACZ,OAA6C;IAE7C,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAwB,EAAE,QAAgB;IACrE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACnE,QAAQ,CAAC,GAAG,EAAE,CAAC;AACjB,CAAC"}

package/dist/auth/crypto.d.ts

@@ -0,0 +1,19 @@
+/** Opaque, unguessable identifier for OAuth state (256 bits, URL safe). */
+export declare function randomToken(): string;
+export declare function constantTimeEqual(left: string, right: string): boolean;
+/**
+ * One configured secret, two independent keys: signing session cookies and sealing GitHub
+ * tokens must not share key material, so each purpose gets its own HKDF derivation.
+ */
+export declare function deriveKey(secret: string, purpose: "session-signing" | "token-sealing"): Buffer;
+export declare function hmacSign(key: Buffer, message: string): string;
+export interface SecretBox {
+    seal(plaintext: string): Uint8Array;
+    open(sealed: Uint8Array): string;
+}
+/**
+ * AES-256-GCM sealed box. The GitHub access token is the only thing stored this way: a
+ * database read alone must not yield a usable credential.
+ */
+export declare function createSecretBox(key: Buffer): SecretBox;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/auth/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAYA,2EAA2E;AAC3E,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAItE;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,eAAe,GAAG,MAAM,CAE9F;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAmBtD"}

package/dist/auth/crypto.js

@@ -0,0 +1,48 @@
+import { createCipheriv, createDecipheriv, createHmac, hkdfSync, randomBytes, timingSafeEqual, } from "node:crypto";
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+/** Opaque, unguessable identifier for OAuth state (256 bits, URL safe). */
+export function randomToken() {
+    return randomBytes(32).toString("base64url");
+}
+export function constantTimeEqual(left, right) {
+    const leftBytes = Buffer.from(left);
+    const rightBytes = Buffer.from(right);
+    return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+/**
+ * One configured secret, two independent keys: signing session cookies and sealing GitHub
+ * tokens must not share key material, so each purpose gets its own HKDF derivation.
+ */
+export function deriveKey(secret, purpose) {
+    return Buffer.from(hkdfSync("sha256", secret, "", `selfbench:${purpose}`, 32));
+}
+export function hmacSign(key, message) {
+    return createHmac("sha256", key).update(message).digest("base64url");
+}
+/**
+ * AES-256-GCM sealed box. The GitHub access token is the only thing stored this way: a
+ * database read alone must not yield a usable credential.
+ */
+export function createSecretBox(key) {
+    return {
+        seal(plaintext) {
+            const iv = randomBytes(IV_BYTES);
+            const cipher = createCipheriv("aes-256-gcm", key, iv);
+            const body = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+            return Buffer.concat([iv, cipher.getAuthTag(), body]);
+        },
+        open(sealed) {
+            const bytes = Buffer.from(sealed);
+            if (bytes.length < IV_BYTES + TAG_BYTES)
+                throw new Error("sealed value is too short");
+            const decipher = createDecipheriv("aes-256-gcm", key, bytes.subarray(0, IV_BYTES));
+            decipher.setAuthTag(bytes.subarray(IV_BYTES, IV_BYTES + TAG_BYTES));
+            return Buffer.concat([
+                decipher.update(bytes.subarray(IV_BYTES + TAG_BYTES)),
+                decipher.final(),
+            ]).toString("utf8");
+        },
+    };
+}
+//# sourceMappingURL=crypto.js.map

package/dist/auth/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,QAAQ,EACR,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,2EAA2E;AAC3E,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAa;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,OAA4C;IACpF,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,OAAe;IACnD,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACvE,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO;QACL,IAAI,CAAC,SAAS;YACZ,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC/E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,MAAM;YACT,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,GAAG,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACtF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;YACnF,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC;YACpE,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;gBACrD,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/github.d.ts

@@ -0,0 +1,37 @@
+import type { AuthConfig } from "./config.js";
+/** read:user for the profile, read:org for org memberships, repo so discovery can read private PRs. */
+export declare const OAUTH_SCOPES: readonly ["read:user", "read:org", "repo"];
+export interface GitHubProfile {
+    readonly githubId: number;
+    readonly login: string;
+    readonly name?: string;
+    readonly avatarUrl?: string;
+}
+export declare class GitHubOAuthError extends Error {
+    readonly status?: number | undefined;
+    constructor(message: string, status?: number | undefined);
+}
+export declare class GitHubIdentityError extends Error {
+    readonly status: 401 | 403 | 429 | 503;
+    constructor(status: 401 | 403 | 429 | 503);
+}
+export declare function validateGitHubIdentity(config: Pick<AuthConfig, "githubApiUrl">, token: string, subject: number, fetchImpl: typeof fetch): Promise<void>;
+type FetchLike = typeof fetch;
+export declare function callbackUrl(config: Pick<AuthConfig, "publicUrl">): string;
+export declare function authorizeUrl(config: Pick<AuthConfig, "githubUrl" | "clientId" | "publicUrl">, state: string): string;
+export declare function exchangeCode(config: AuthConfig, code: string, fetchImpl: FetchLike): Promise<{
+    token: string;
+    scopes: string;
+}>;
+export declare function fetchProfile(config: Pick<AuthConfig, "githubApiUrl">, token: string, fetchImpl: FetchLike): Promise<GitHubProfile>;
+export interface OrgMembership {
+    readonly githubId: number;
+    readonly login: string;
+    readonly avatarUrl?: string;
+    readonly role: "admin" | "member";
+}
+/** Every org the user is an active member of, private memberships included (read:org). */
+export declare function fetchOrgMemberships(config: Pick<AuthConfig, "githubApiUrl">, token: string, fetchImpl: FetchLike): Promise<OrgMembership[]>;
+export declare function apiHeaders(token: string): Record<string, string>;
+export {};
+//# sourceMappingURL=github.d.ts.map

package/dist/auth/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/auth/github.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,uGAAuG;AACvG,eAAO,MAAM,YAAY,4CAA6C,CAAC;AAEvE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAGvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;gBADxB,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM,YAAA;CAI3B;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAChC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;gBAA7B,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;CAWnD;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EACxC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,OAAO,KAAK,GACtB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,KAAK,SAAS,GAAG,OAAO,KAAK,CAAC;AAE9B,wBAAgB,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,MAAM,CAEzE;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC,EAChE,KAAK,EAAE,MAAM,GACZ,MAAM,CAOR;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAuB5C;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EACxC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,aAAa,CAAC,CAmBxB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;CACnC;AAED,0FAA0F;AAC1F,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EACxC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,aAAa,EAAE,CAAC,CA8B1B;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOhE"}

package/dist/auth/github.js

@@ -0,0 +1,127 @@
+/** read:user for the profile, read:org for org memberships, repo so discovery can read private PRs. */
+export const OAUTH_SCOPES = ["read:user", "read:org", "repo"];
+export class GitHubOAuthError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+export class GitHubIdentityError extends Error {
+    status;
+    constructor(status) {
+        super(status === 401
+            ? "GitHub authorization expired. Sign in again."
+            : status === 403
+                ? "GitHub denied the identity check. Try again later."
+                : status === 429
+                    ? "GitHub rate limited the identity check. Try again later."
+                    : "GitHub identity could not be verified. Try again later.");
+        this.status = status;
+    }
+}
+export async function validateGitHubIdentity(config, token, subject, fetchImpl) {
+    try {
+        const response = await fetchImpl(`${config.githubApiUrl}/user`, {
+            headers: apiHeaders(token),
+            signal: AbortSignal.timeout(5_000),
+            redirect: "error",
+            cache: "no-store",
+        });
+        if (!response.ok) {
+            throw new GitHubIdentityError(response.status === 401 || response.status === 403 || response.status === 429
+                ? response.status
+                : 503);
+        }
+        const profile = await response.json();
+        if (!profile ||
+            typeof profile !== "object" ||
+            !("id" in profile) ||
+            !Number.isSafeInteger(profile.id))
+            throw new GitHubIdentityError(503);
+        if (profile.id !== subject)
+            throw new GitHubIdentityError(401);
+    }
+    catch (error) {
+        if (error instanceof GitHubIdentityError)
+            throw error;
+        throw new GitHubIdentityError(503);
+    }
+}
+export function callbackUrl(config) {
+    return `${config.publicUrl}/auth/github/callback`;
+}
+export function authorizeUrl(config, state) {
+    const url = new URL("/login/oauth/authorize", `${config.githubUrl}/`);
+    url.searchParams.set("client_id", config.clientId);
+    url.searchParams.set("redirect_uri", callbackUrl(config));
+    url.searchParams.set("scope", OAUTH_SCOPES.join(" "));
+    url.searchParams.set("state", state);
+    return url.toString();
+}
+export async function exchangeCode(config, code, fetchImpl) {
+    const response = await fetchImpl(`${config.githubUrl}/login/oauth/access_token`, {
+        method: "POST",
+        headers: { accept: "application/json", "content-type": "application/json" },
+        body: JSON.stringify({
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            code,
+            redirect_uri: callbackUrl(config),
+        }),
+    });
+    const body = (await response.json().catch(() => ({})));
+    if (!response.ok || !body.access_token) {
+        throw new GitHubOAuthError(`GitHub rejected the OAuth code: ${body.error_description ?? body.error ?? response.status}`);
+    }
+    return { token: body.access_token, scopes: body.scope ?? "" };
+}
+export async function fetchProfile(config, token, fetchImpl) {
+    const response = await fetchImpl(`${config.githubApiUrl}/user`, { headers: apiHeaders(token) });
+    if (!response.ok)
+        throw new GitHubOAuthError(`GitHub /user failed (${response.status})`, response.status);
+    const user = (await response.json());
+    if (typeof user.id !== "number" || typeof user.login !== "string") {
+        throw new GitHubOAuthError("GitHub /user returned no id or login");
+    }
+    return {
+        githubId: user.id,
+        login: user.login,
+        ...(user.name ? { name: user.name } : {}),
+        ...(user.avatar_url ? { avatarUrl: user.avatar_url } : {}),
+    };
+}
+/** Every org the user is an active member of, private memberships included (read:org). */
+export async function fetchOrgMemberships(config, token, fetchImpl) {
+    const memberships = [];
+    for (let page = 1; page <= 10; page += 1) {
+        const response = await fetchImpl(`${config.githubApiUrl}/user/memberships/orgs?state=active&per_page=100&page=${page}`, { headers: apiHeaders(token) });
+        if (!response.ok) {
+            throw new GitHubOAuthError(`GitHub /user/memberships/orgs failed (${response.status})`, response.status);
+        }
+        const rows = (await response.json());
+        for (const row of rows) {
+            const org = row.organization;
+            if (typeof org?.id !== "number" || typeof org.login !== "string")
+                continue;
+            memberships.push({
+                githubId: org.id,
+                login: org.login,
+                ...(org.avatar_url ? { avatarUrl: org.avatar_url } : {}),
+                role: row.role === "admin" ? "admin" : "member",
+            });
+        }
+        if (rows.length < 100)
+            break;
+    }
+    return memberships;
+}
+export function apiHeaders(token) {
+    return {
+        accept: "application/vnd.github+json",
+        authorization: `Bearer ${token}`,
+        "user-agent": "self-bench-site",
+        "x-github-api-version": "2022-11-28",
+    };
+}
+//# sourceMappingURL=github.js.map

package/dist/auth/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/auth/github.ts"],"names":[],"mappings":"AAEA,uGAAuG;AACvG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAU,CAAC;AASvE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAG9B;IAFX,YACE,OAAe,EACN,MAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAS;IAG1B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACvB;IAArB,YAAqB,MAA6B;QAChD,KAAK,CACH,MAAM,KAAK,GAAG;YACZ,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,MAAM,KAAK,GAAG;gBACd,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,MAAM,KAAK,GAAG;oBACd,CAAC,CAAC,0DAA0D;oBAC5D,CAAC,CAAC,yDAAyD,CAClE,CAAC;QATiB,WAAM,GAAN,MAAM,CAAuB;IAUlD,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAwC,EACxC,KAAa,EACb,OAAe,EACf,SAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,CAAC,YAAY,OAAO,EAAE;YAC9D,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;YAClC,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,mBAAmB,CAC3B,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAC3E,CAAC,CAAC,QAAQ,CAAC,MAAM;gBACjB,CAAC,CAAC,GAAG,CACR,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/C,IACE,CAAC,OAAO;YACR,OAAO,OAAO,KAAK,QAAQ;YAC3B,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC;YAClB,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAEjC,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAC;QACtD,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAID,MAAM,UAAU,WAAW,CAAC,MAAqC;IAC/D,OAAO,GAAG,MAAM,CAAC,SAAS,uBAAuB,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAgE,EAChE,KAAa;IAEb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;IACtE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,IAAY,EACZ,SAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,CAAC,SAAS,2BAA2B,EAAE;QAC/E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,IAAI;YACJ,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC;SAClC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAKpD,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,gBAAgB,CACxB,mCAAmC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAwC,EACxC,KAAa,EACb,SAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,CAAC,YAAY,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChG,IAAI,CAAC,QAAQ,CAAC,EAAE;QACd,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,QAAQ,CAAC,MAAM,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IACF,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAClE,MAAM,IAAI,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,EAAE;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;AACJ,CAAC;AASD,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAwC,EACxC,KAAa,EACb,SAAoB;IAEpB,MAAM,WAAW,GAAoB,EAAE,CAAC;IACxC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,GAAG,MAAM,CAAC,YAAY,yDAAyD,IAAI,EAAE,EACrF,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAC/B,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,QAAQ,CAAC,MAAM,GAAG,EAC3D,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGhC,CAAC;QACJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC;YAC7B,IAAI,OAAO,GAAG,EAAE,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAAE,SAAS;YAC3E,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAChB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;aAChD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM;IAC/B,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO;QACL,MAAM,EAAE,6BAA6B;QACrC,aAAa,EAAE,UAAU,KAAK,EAAE;QAChC,YAAY,EAAE,iBAAiB;QAC/B,sBAAsB,EAAE,YAAY;KACrC,CAAC;AACJ,CAAC"}

package/dist/auth/routes.d.ts

@@ -0,0 +1,41 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type ApiKeyStore } from "./api-keys.js";
+import type { AuthConfig } from "./config.js";
+import type { Org, User, UserStore } from "./users.js";
+export declare const OAUTH_STATE_COOKIE = "selfbench_oauth_state";
+/** Why a sign-in attempt bounced back to /login; the page renders one line per code. */
+export type LoginError = "state" | "denied" | "github";
+export interface SiteAuthOptions {
+    readonly config: AuthConfig;
+    readonly users: UserStore;
+    /** When present, `Authorization: Bearer sbk_…` and `X-API-Key` resolve to their owner. */
+    readonly apiKeys?: ApiKeyStore;
+    readonly fetchImpl?: typeof fetch;
+    readonly now?: () => Date;
+}
+export interface SiteAuth {
+    /** Answers /auth/* and /api/me. True when the response has been sent. */
+    handle(request: IncomingMessage, url: URL, response: ServerResponse): Promise<boolean>;
+    /**
+     * Resolves the caller: an API key first, else the session cookie (validated against GitHub).
+     * A matching CLI bearer is authorized separately. Throws ApiKeyError for an unknown key.
+     */
+    authenticate(request: IncomingMessage, apiToken?: string): Promise<User | undefined>;
+}
+export declare function createSiteAuth(options: SiteAuthOptions): SiteAuth;
+/** The browser-facing shape of a user: display fields only. */
+export declare function publicUser(user: User): {
+    login: string;
+    name?: string;
+    avatarUrl?: string;
+};
+/** The browser-facing shape of a tenant. */
+export declare function publicOrg(org: Org): {
+    login: string;
+    kind: "org" | "user";
+    role: "admin" | "member";
+    name?: string;
+    avatarUrl?: string;
+};
+export declare function sendIdentityError(response: ServerResponse, error: unknown, publicUrl: string): boolean;
+//# sourceMappingURL=routes.d.ts.map

package/dist/auth/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,EAAe,KAAK,WAAW,EAAmB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAa9C,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvD,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAG1D,wFAAwF;AACxF,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEvD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,0FAA0F;IAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,QAAQ;IACvB,yEAAyE;IACzE,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;CACtF;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CA8GjE;AAED,+DAA+D;AAC/D,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAMA;AAED,4CAA4C;AAC5C,wBAAgB,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IACrB,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAQA;AAMD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAeT"}

package/dist/auth/routes.js

@@ -0,0 +1,153 @@
+import { bearerMatches, sendJson } from "../api/http.js";
+import { ApiKeyError, presentedApiKey } from "./api-keys.js";
+import { clearCookie, parseCookies, sendRedirect, setCookie } from "./cookies.js";
+import { constantTimeEqual, randomToken } from "./crypto.js";
+import { authorizeUrl, exchangeCode, fetchOrgMemberships, fetchProfile, GitHubIdentityError, GitHubOAuthError, validateGitHubIdentity, } from "./github.js";
+import { createSessionSigner, SESSION_COOKIE, SESSION_TTL_SECONDS } from "./session.js";
+export const OAUTH_STATE_COOKIE = "selfbench_oauth_state";
+const STATE_TTL_SECONDS = 10 * 60;
+export function createSiteAuth(options) {
+    const { config, users } = options;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const now = options.now ?? (() => new Date());
+    const signer = createSessionSigner(config.sessionSecret, { now });
+    const secure = config.publicUrl.startsWith("https://");
+    const authenticate = async (request, apiToken) => {
+        if (apiToken && bearerMatches(request, apiToken))
+            return undefined;
+        const secret = presentedApiKey(request.headers);
+        if (secret !== undefined) {
+            const owner = await options.apiKeys?.authenticate(secret);
+            if (!owner)
+                throw new ApiKeyError();
+            return owner;
+        }
+        const claims = signer.verify(parseCookies(request)[SESSION_COOKIE]);
+        if (!claims)
+            return undefined;
+        const token = await users.gitHubToken(claims.githubId);
+        if (!token)
+            throw new GitHubIdentityError(401);
+        await validateGitHubIdentity(config, token, claims.githubId, fetchImpl);
+        return users.findByGitHubId(claims.githubId);
+    };
+    const startSignIn = (response) => {
+        const state = randomToken();
+        setCookie(response, OAUTH_STATE_COOKIE, state, {
+            maxAgeSeconds: STATE_TTL_SECONDS,
+            secure,
+            path: "/auth",
+        });
+        sendRedirect(response, authorizeUrl(config, state));
+    };
+    const finishSignIn = async (request, url, response) => {
+        const expected = parseCookies(request)[OAUTH_STATE_COOKIE];
+        const state = url.searchParams.get("state") ?? "";
+        const code = url.searchParams.get("code") ?? "";
+        clearCookie(response, OAUTH_STATE_COOKIE, { secure, path: "/auth" });
+        if (!expected || !state || !constantTimeEqual(expected, state)) {
+            sendRedirect(response, loginPath("state"));
+            return;
+        }
+        if (!code) {
+            sendRedirect(response, loginPath("denied"));
+            return;
+        }
+        let signedIn;
+        try {
+            const { token, scopes } = await exchangeCode(config, code, fetchImpl);
+            const profile = await fetchProfile(config, token, fetchImpl);
+            const orgs = await fetchOrgMemberships(config, token, fetchImpl);
+            signedIn = { user: await users.upsert({ ...profile, token, scopes, orgs }) };
+        }
+        catch (error) {
+            if (!(error instanceof GitHubOAuthError))
+                throw error;
+            console.error(`GitHub sign-in failed: ${error.message}`);
+            signedIn = { error: "github" };
+        }
+        if ("error" in signedIn) {
+            sendRedirect(response, loginPath(signedIn.error));
+            return;
+        }
+        setCookie(response, SESSION_COOKIE, signer.issue(signedIn.user.githubId), {
+            maxAgeSeconds: SESSION_TTL_SECONDS,
+            secure,
+        });
+        sendRedirect(response, "/");
+    };
+    return {
+        authenticate,
+        async handle(request, url, response) {
+            const method = request.method ?? "GET";
+            if (method === "GET" && url.pathname === "/auth/github") {
+                startSignIn(response);
+                return true;
+            }
+            if (method === "GET" && url.pathname === "/auth/github/callback") {
+                await finishSignIn(request, url, response);
+                return true;
+            }
+            if (method === "POST" && url.pathname === "/auth/logout") {
+                clearCookie(response, SESSION_COOKIE, { secure });
+                sendJson(response, 200, { ok: true });
+                return true;
+            }
+            if (method === "GET" && url.pathname === "/api/me") {
+                const user = await authenticate(request);
+                if (!user) {
+                    sendJson(response, 401, { error: "sign in required" });
+                    return true;
+                }
+                const orgs = await users.orgsFor(user.id);
+                sendJson(response, 200, {
+                    user: publicUser(user),
+                    orgs: orgs.map(publicOrg),
+                    auth: user.apiKey ? "api-key" : "session",
+                    ...(user.apiKey ? { apiKey: { name: user.apiKey.name, scope: user.apiKey.scope } } : {}),
+                });
+                return true;
+            }
+            return false;
+        },
+    };
+}
+/** The browser-facing shape of a user: display fields only. */
+export function publicUser(user) {
+    return {
+        login: user.login,
+        ...(user.name ? { name: user.name } : {}),
+        ...(user.avatarUrl ? { avatarUrl: user.avatarUrl } : {}),
+    };
+}
+/** The browser-facing shape of a tenant. */
+export function publicOrg(org) {
+    return {
+        login: org.login,
+        kind: org.kind,
+        role: org.role,
+        ...(org.name ? { name: org.name } : {}),
+        ...(org.avatarUrl ? { avatarUrl: org.avatarUrl } : {}),
+    };
+}
+function loginPath(error) {
+    return `/login?error=${error}`;
+}
+export function sendIdentityError(response, error, publicUrl) {
+    if (error instanceof ApiKeyError) {
+        response.setHeader("cache-control", "no-store");
+        sendJson(response, error.status, { error: error.message, code: "invalid_api_key" });
+        return true;
+    }
+    if (!(error instanceof GitHubIdentityError))
+        return false;
+    if (error.status === 401)
+        clearCookie(response, SESSION_COOKIE, { secure: publicUrl.startsWith("https://") });
+    response.setHeader("cache-control", "no-store");
+    sendJson(response, error.status, {
+        error: error.message,
+        code: error.status === 401 ? "session_expired" : "github_identity_unavailable",
+    });
+    return true;
+}
+//# sourceMappingURL=routes.js.map

package/dist/auth/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAoB,eAAe,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGxF,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAC1D,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,CAAC;AAwBlC,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAEvD,MAAM,YAAY,GAAG,KAAK,EACxB,OAAwB,EACxB,QAAiB,EACU,EAAE;QAC7B,IAAI,QAAQ,IAAI,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QACnE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,WAAW,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,sBAAsB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,QAAwB,EAAQ,EAAE;QACrD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,SAAS,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE;YAC7C,aAAa,EAAE,iBAAiB;YAChC,MAAM;YACN,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EACxB,OAAwB,EACxB,GAAQ,EACR,QAAwB,EACT,EAAE;QACjB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,WAAW,CAAC,QAAQ,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YAC/D,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,IAAI,QAAgD,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACjE,QAAQ,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,gBAAgB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACtD,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACzD,QAAQ,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YACxE,aAAa,EAAE,mBAAmB;YAClC,MAAM;SACP,CAAC,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC;IAEF,OAAO;QACL,YAAY;QACZ,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ;YACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;YACvC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;gBACxD,WAAW,CAAC,QAAQ,CAAC,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,uBAAuB,EAAE,CAAC;gBACjE,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;gBACzD,WAAW,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACnD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;gBACzC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBACvD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC1C,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;oBACtB,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;oBACtB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;oBACzB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;oBACzC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzF,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CAAC,IAAU;IAKnC,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,SAAS,CAAC,GAAQ;IAOhC,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,gBAAgB,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAAwB,EACxB,KAAc,EACd,SAAiB;IAEjB,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QACtB,WAAW,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACtF,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE;QAC/B,KAAK,EAAE,KAAK,CAAC,OAAO;QACpB,IAAI,EAAE,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,6BAA6B;KAC/E,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/session-expired.d.ts

@@ -0,0 +1,4 @@
+import type { ServerResponse } from "node:http";
+/** Only an authentication failure logs out the browser; permission/rate-limit errors do not. */
+export declare function sendExpiredSession(response: ServerResponse, error: unknown, publicUrl: string): boolean;
+//# sourceMappingURL=session-expired.d.ts.map

package/dist/auth/session-expired.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-expired.d.ts","sourceRoot":"","sources":["../../src/auth/session-expired.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMhD,gGAAgG;AAChG,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAST"}