sentri 1.0.4 → 1.0.6

package/dist/middleware/router.js

@@ -1,8 +1,10 @@
 import { Router } from 'express';
 import { AuthError } from '../errors/AuthError.js';
-import { signup, login, refresh, logout, logoutAll } from '../services/auth.js';
+import { authErrorStatus } from '../types/auth.js';
+import { signup, login, refresh, logout, logoutAll, assignRoles } from '../services/auth.js';
 import { resolveConfig, parseExpiry } from '../libs/config.js';
 import { protect } from './protect.js';
+import { authorize } from './authorize.js';
 const MIN_PASSWORD_LENGTH = 8;
 // bcrypt silently truncates input beyond 72 bytes. Enforcing a cap makes the
 // truncation boundary explicit so two passwords that share the same first 72
@@ -12,6 +14,13 @@ const MAX_IDENTIFIER_LENGTH = 255;
 function badRequest(message) {
     return new AuthError('VALIDATION_ERROR', message);
 }
+function ok(response, statusCode, message, data) {
+    response.status(statusCode).json({ error: false, statusCode, message, data });
+}
+function fail(response, error) {
+    const statusCode = authErrorStatus(error.code);
+    response.status(statusCode).json({ error: true, statusCode, message: error.message, data: null });
+}
 function parseBody(body) {
     if (body === null || body === undefined || typeof body !== 'object' || Array.isArray(body)) {
         throw new AuthError('VALIDATION_ERROR', 'Request body is missing or not a JSON object. Did you apply express.json()?');
@@ -24,25 +33,28 @@ function readCookie(cookieHeader, name) {
         return undefined;
     const pair = cookieHeader
         .split(';')
-        .map((s) => s.trim())
-        .find((s) => s.startsWith(`${name}=`));
+        .map((segment) => segment.trim())
+        .find((segment) => segment.startsWith(`${name}=`));
     return pair !== undefined ? pair.slice(name.length + 1) : undefined;
 }
-function setCookie(res, token, config) {
-    const cfg = config.cookie;
+function getCookieName(config) {
+    return config.cookie?.name ?? 'refresh_token';
+}
+function setCookie(response, token, config) {
+    const cookieConfig = config.cookie ?? {};
     const resolved = resolveConfig(config);
     const maxAge = parseExpiry(resolved.refreshExpiresIn);
-    res.cookie(cfg.name ?? 'refresh_token', token, {
-        httpOnly: cfg.httpOnly ?? true,
-        secure: cfg.secure ?? false,
-        sameSite: cfg.sameSite ?? 'strict',
-        path: cfg.path ?? '/',
+    response.cookie(getCookieName(config), token, {
+        httpOnly: cookieConfig.httpOnly ?? true,
+        secure: cookieConfig.secure ?? false,
+        sameSite: cookieConfig.sameSite ?? 'strict',
+        path: cookieConfig.path ?? '/',
         maxAge,
     });
 }
-function clearCookie(res, config) {
-    const cfg = config.cookie;
-    res.clearCookie(cfg.name ?? 'refresh_token', { path: cfg.path ?? '/' });
+function clearCookie(response, config) {
+    const cookieConfig = config.cookie ?? {};
+    response.clearCookie(getCookieName(config), { path: cookieConfig.path ?? '/' });
 }
 /**
  * Creates a pre-built Express Router with all standard auth endpoints.
@@ -50,12 +62,13 @@ function clearCookie(res, config) {
  * Mount it once and all routes are ready:
  *
  * ```
- * POST /signup       — register a new user
- * POST /login        — authenticate and get tokens
- * POST /refresh      — rotate refresh token
- * POST /logout       — invalidate current session
- * POST /logout-all   — invalidate all sessions for the authenticated user
- * GET  /me           — return the currently authenticated user
+ * POST /signup              — register a new user
+ * POST /login               — authenticate and get tokens
+ * POST /refresh             — rotate refresh token
+ * POST /logout              — invalidate current session
+ * POST /logout-all          — invalidate all sessions for the authenticated user
+ * GET  /me                  — return the currently authenticated user
+ * POST /users/:userId/roles — assign roles (admin only)
  * ```
  *
  * Requires `express.json()` to be applied before the router.
@@ -63,16 +76,26 @@ function clearCookie(res, config) {
  * When `cookie` is set in config, the refresh token is stored in an httpOnly
  * cookie automatically — no `cookie-parser` needed.
  *
+ * When `router` is set in config, individual service functions can be replaced
+ * while the router still handles validation and response formatting.
+ *
  * @example
  * app.use(express.json());
  * app.use('/auth', auth.router());
  */
 export function createAuthRouter(config) {
     const router = Router();
-    const cookieMode = config.cookie !== undefined;
-    router.post('/signup', async (req, res, next) => {
+    // Resolve service functions — use custom override from config.router when provided, else fall back to the built-in service.
+    const baseConfig = config;
+    const signupFn = config.router?.signup ?? ((input) => signup(input, baseConfig));
+    const loginFn = config.router?.login ?? ((input) => login(input, baseConfig));
+    const refreshFn = config.router?.refresh ?? ((token) => refresh(token, baseConfig));
+    const logoutFn = config.router?.logout ?? ((token) => token !== undefined ? logout(token, baseConfig) : Promise.resolve());
+    const logoutAllFn = config.router?.logoutAll ?? ((userId) => logoutAll(userId, baseConfig));
+    const assignRolesFn = config.router?.assignRoles ?? ((userId, roles) => assignRoles(userId, roles, baseConfig));
+    router.post('/signup', async (request, response, next) => {
         try {
-            const body = parseBody(req.body);
+            const body = parseBody(request.body);
             const { identifier, password, roles } = body;
             if (typeof identifier !== 'string' || identifier.trim().length === 0) {
                 throw badRequest('identifier is required and must be a non-empty string');
@@ -89,38 +112,27 @@ export function createAuthRouter(config) {
             if (roles !== undefined && !Array.isArray(roles)) {
                 throw badRequest('roles must be an array of strings when provided');
             }
-            if (Array.isArray(roles) && !roles.every((r) => typeof r === 'string')) {
+            if (Array.isArray(roles) && !roles.every((role) => typeof role === 'string')) {
                 throw badRequest('each role must be a string');
             }
             const rolesInput = Array.isArray(roles) ? roles : undefined;
             const input = rolesInput !== undefined
                 ? { identifier: identifier.trim(), password, roles: rolesInput }
                 : { identifier: identifier.trim(), password };
-            const result = await signup(input, config);
+            const result = await signupFn(input);
             if (!result.success) {
-                const status = result.error.code === 'USER_ALREADY_EXISTS' ? 409 : 400;
-                res.status(status).json({ code: result.error.code, message: result.error.message });
+                fail(response, result.error);
                 return;
             }
-            if (cookieMode) {
-                setCookie(res, result.refreshToken, config);
-                res.status(201).json({ accessToken: result.accessToken, user: result.user });
-            }
-            else {
-                res.status(201).json({
-                    accessToken: result.accessToken,
-                    refreshToken: result.refreshToken,
-                    user: result.user,
-                });
-            }
+            ok(response, 201, 'User registered successfully', { user: result.user });
         }
-        catch (err) {
-            next(err);
+        catch (error) {
+            next(error);
         }
     });
-    router.post('/login', async (req, res, next) => {
+    router.post('/login', async (request, response, next) => {
         try {
-            const body = parseBody(req.body);
+            const body = parseBody(request.body);
             const { identifier, password } = body;
             if (typeof identifier !== 'string' || identifier.trim().length === 0) {
                 throw badRequest('identifier is required and must be a non-empty string');
@@ -134,110 +146,96 @@ export function createAuthRouter(config) {
             if (password.length > MAX_PASSWORD_LENGTH) {
                 throw badRequest(`password must not exceed ${MAX_PASSWORD_LENGTH} characters`);
             }
-            const result = await login({ identifier: identifier.trim(), password }, config);
+            const result = await loginFn({ identifier: identifier.trim(), password });
             if (!result.success) {
-                res.status(401).json({ code: result.error.code, message: result.error.message });
+                fail(response, result.error);
                 return;
             }
-            if (cookieMode) {
-                setCookie(res, result.refreshToken, config);
-                res.json({ accessToken: result.accessToken, user: result.user });
-            }
-            else {
-                res.json({
-                    accessToken: result.accessToken,
-                    refreshToken: result.refreshToken,
-                    user: result.user,
-                });
-            }
+            setCookie(response, result.refreshToken, config);
+            ok(response, 200, 'Login successful', { accessToken: result.accessToken, user: result.user });
         }
-        catch (err) {
-            next(err);
+        catch (error) {
+            next(error);
         }
     });
-    router.post('/refresh', async (req, res, next) => {
+    router.post('/refresh', async (request, response, next) => {
         try {
-            let refreshToken;
-            if (cookieMode) {
-                const fromCookie = readCookie(req.headers['cookie'], config.cookie?.name ?? 'refresh_token');
-                if (!fromCookie) {
-                    throw new AuthError('UNAUTHORIZED', 'Refresh token cookie is missing');
-                }
-                refreshToken = fromCookie;
-            }
-            else {
-                const body = parseBody(req.body);
-                const { refreshToken: fromBody } = body;
-                if (typeof fromBody !== 'string' || fromBody.trim().length === 0) {
-                    throw badRequest('refreshToken is required');
-                }
-                refreshToken = fromBody;
-            }
-            const result = await refresh(refreshToken, config);
+            const fromCookie = readCookie(request.headers['cookie'], getCookieName(config));
+            if (!fromCookie) {
+                throw new AuthError('UNAUTHORIZED', 'Refresh token cookie is missing');
+            }
+            const result = await refreshFn(fromCookie);
             if (!result.success) {
-                if (cookieMode)
-                    clearCookie(res, config);
-                res.status(401).json({ code: result.error.code, message: result.error.message });
+                clearCookie(response, config);
+                fail(response, result.error);
                 return;
             }
-            if (cookieMode) {
-                setCookie(res, result.refreshToken, config);
-                res.json({ accessToken: result.accessToken });
-            }
-            else {
-                res.json({
-                    accessToken: result.accessToken,
-                    refreshToken: result.refreshToken,
-                });
-            }
+            setCookie(response, result.refreshToken, config);
+            ok(response, 200, 'Token refreshed', { accessToken: result.accessToken });
         }
-        catch (err) {
-            next(err);
+        catch (error) {
+            next(error);
         }
     });
-    router.post('/logout', async (req, res, next) => {
+    router.post('/logout', async (request, response, next) => {
         try {
-            let refreshToken;
-            if (cookieMode) {
-                const fromCookie = readCookie(req.headers['cookie'], config.cookie?.name ?? 'refresh_token');
-                if (!fromCookie) {
-                    // Nothing to revoke, just clear the cookie and return success
-                    clearCookie(res, config);
-                    res.json({ message: 'logged out' });
-                    return;
-                }
-                refreshToken = fromCookie;
-            }
-            else {
-                const body = parseBody(req.body);
-                const { refreshToken: fromBody } = body;
-                if (typeof fromBody !== 'string' || fromBody.trim().length === 0) {
-                    throw badRequest('refreshToken is required');
-                }
-                refreshToken = fromBody;
-            }
-            await logout(refreshToken, config);
-            if (cookieMode)
-                clearCookie(res, config);
-            res.json({ message: 'logged out' });
+            const fromCookie = readCookie(request.headers['cookie'], getCookieName(config));
+            await logoutFn(fromCookie);
+            clearCookie(response, config);
+            ok(response, 200, 'Logged out', null);
         }
-        catch (err) {
-            next(err);
+        catch (error) {
+            next(error);
         }
     });
-    router.post('/logout-all', protect(config), async (req, res, next) => {
+    router.post('/logout-all', protect(config), async (request, response, next) => {
         try {
-            await logoutAll(req.user.id, config);
-            if (cookieMode)
-                clearCookie(res, config);
-            res.json({ message: 'all sessions revoked' });
+            await logoutAllFn(request.user.id);
+            clearCookie(response, config);
+            ok(response, 200, 'All sessions revoked', null);
         }
-        catch (err) {
-            next(err);
+        catch (error) {
+            next(error);
         }
     });
-    router.get('/me', protect(config), (req, res) => {
-        res.json(req.user);
+    router.get('/me', protect(config), (request, response) => {
+        ok(response, 200, 'OK', request.user);
+    });
+    router.post('/users/:userId/roles', protect(config), authorize('admin'), async (request, response, next) => {
+        try {
+            const body = parseBody(request.body);
+            const { roles } = body;
+            const rawUserId = request.params['userId'];
+            const userId = typeof rawUserId === 'string' ? rawUserId : undefined;
+            if (!userId) {
+                throw badRequest('userId is required');
+            }
+            if (!Array.isArray(roles) || roles.length === 0) {
+                throw badRequest('roles must be a non-empty array of strings');
+            }
+            if (!roles.every((role) => typeof role === 'string')) {
+                throw badRequest('each role must be a string');
+            }
+            const result = await assignRolesFn(userId, roles);
+            if (!result.success) {
+                fail(response, result.error);
+                return;
+            }
+            ok(response, 200, 'Roles assigned successfully', { user: result.user });
+        }
+        catch (error) {
+            next(error);
+        }
+    });
+    // Centralized error handler — converts AuthError (and unexpected errors) to the
+    // standard envelope so every endpoint produces a consistent shape on failure.
+    router.use((error, _request, response, _next) => {
+        if (error instanceof AuthError) {
+            fail(response, error);
+        }
+        else {
+            response.status(500).json({ error: true, statusCode: 500, message: 'Internal server error', data: null });
+        }
     });
     return router;
 }

package/dist/middleware/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/middleware/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAiB,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,6EAA6E;AAC7E,6EAA6E;AAC7E,wCAAwC;AACxC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,IAAI,SAAS,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,6EAA6E,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,YAAgC,EAAE,IAAY;IAChE,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,IAAI,GAAG,YAAY;SACtB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,SAAS,SAAS,CAAC,GAAa,EAAE,KAAa,EAAE,MAAkB;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAO,CAAC;IAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,eAAe,EAAE,KAAK,EAAE;QAC7C,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;QAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,QAAQ;QAClC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG;QACrB,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAa,EAAE,MAAkB;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAO,CAAC;IAC3B,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,eAAe,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,gBAAgB,CAAuB,MAAyB;IAC9E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;IAE/C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;YAE7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrE,MAAM,UAAU,CAAC,uDAAuD,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;gBAC9C,MAAM,UAAU,CAAC,8BAA8B,qBAAqB,aAAa,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBAC1E,MAAM,UAAU,CAAC,6CAA6C,mBAAmB,aAAa,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,UAAU,CAAC,4BAA4B,mBAAmB,aAAa,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,MAAM,UAAU,CAAC,iDAAiD,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACvE,MAAM,UAAU,CAAC,4BAA4B,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;gBAChE,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAE3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACvE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;YAEtC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrE,MAAM,UAAU,CAAC,uDAAuD,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;gBAC9C,MAAM,UAAU,CAAC,8BAA8B,qBAAqB,aAAa,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1D,MAAM,UAAU,CAAC,sBAAsB,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,UAAU,CAAC,4BAA4B,mBAAmB,aAAa,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;YAEhF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC;oBACP,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/C,IAAI,CAAC;YACH,IAAI,YAAoB,CAAC;YAEzB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,UAAU,CAC3B,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EACrB,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,eAAe,CACvC,CAAC;gBACF,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;gBACzE,CAAC;gBACD,YAAY,GAAG,UAAU,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;gBACxC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACjE,MAAM,UAAU,CAAC,0BAA0B,CAAC,CAAC;gBAC/C,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAEnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,UAAU;oBAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC;oBACP,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,IAAI,YAAoB,CAAC;YAEzB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,UAAU,CAC3B,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EACrB,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,eAAe,CACvC,CAAC;gBACF,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,8DAA8D;oBAC9D,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBACzB,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;oBACpC,OAAO;gBACT,CAAC;gBACD,YAAY,GAAG,UAAU,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;gBACxC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACjE,MAAM,UAAU,CAAC,0BAA0B,CAAC,CAAC;gBAC/C,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;YAED,MAAM,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACnC,IAAI,UAAU;gBAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACnE,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,GAAG,CAAC,IAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,UAAU;gBAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/middleware/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkD,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,6EAA6E;AAC7E,6EAA6E;AAC7E,wCAAwC;AACxC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,IAAI,SAAS,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,EAAE,CAAI,QAAkB,EAAE,UAAkB,EAAE,OAAe,EAAE,IAAO;IAC7E,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,IAAI,CAAC,QAAkB,EAAE,KAAgB;IAChD,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,6EAA6E,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,YAAgC,EAAE,IAAY;IAChE,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,IAAI,GAAG,YAAY;SACtB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;SAChC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,MAAkB;IACvC,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,eAAe,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,QAAkB,EAAE,KAAa,EAAE,MAAkB;IACtE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACtD,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE;QAC5C,QAAQ,EAAE,YAAY,CAAC,QAAQ,IAAI,IAAI;QACvC,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,KAAK;QACpC,QAAQ,EAAE,YAAY,CAAC,QAAQ,IAAI,QAAQ;QAC3C,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,GAAG;QAC9B,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,QAAkB,EAAE,MAAkB;IACzD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,gBAAgB,CAAuB,MAAyB;IAC9E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,4HAA4H;IAC5H,MAAM,UAAU,GAAG,MAAoB,CAAC;IACxC,MAAM,QAAQ,GAAK,MAAM,CAAC,MAAM,EAAE,MAAM,IAAS,CAAC,CAAC,KAAkB,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACrG,MAAM,OAAO,GAAM,MAAM,CAAC,MAAM,EAAE,KAAK,IAAU,CAAC,CAAC,KAAiB,EAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACpG,MAAM,SAAS,GAAI,MAAM,CAAC,MAAM,EAAE,OAAO,IAAQ,CAAC,CAAC,KAAa,EAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAK,MAAM,CAAC,MAAM,EAAE,MAAM,IAAS,CAAC,CAAC,KAAyB,EAAE,EAAE,CAC9E,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,MAAM,WAAW,GAAK,MAAM,CAAC,MAAM,EAAE,SAAS,IAAM,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACxG,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,CAAC,MAAc,EAAE,KAAe,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IAElI,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACvD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;YAE7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrE,MAAM,UAAU,CAAC,uDAAuD,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;gBAC9C,MAAM,UAAU,CAAC,8BAA8B,qBAAqB,aAAa,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBAC1E,MAAM,UAAU,CAAC,6CAA6C,mBAAmB,aAAa,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,UAAU,CAAC,4BAA4B,mBAAmB,aAAa,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,MAAM,UAAU,CAAC,iDAAiD,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC7E,MAAM,UAAU,CAAC,4BAA4B,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;gBAChE,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YAErC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,8BAA8B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;YAEtC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrE,MAAM,UAAU,CAAC,uDAAuD,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;gBAC9C,MAAM,UAAU,CAAC,8BAA8B,qBAAqB,aAAa,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1D,MAAM,UAAU,CAAC,sBAAsB,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,UAAU,CAAC,4BAA4B,mBAAmB,aAAa,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAE1E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACjD,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,kBAAkB,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YAChF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;YAE3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC9B,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACjD,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACvD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YAChF,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3B,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9B,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QAC5E,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC;YACpC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9B,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACvD,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAK,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACzG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;YACvB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAErE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,UAAU,CAAC,oBAAoB,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,MAAM,UAAU,CAAC,4CAA4C,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACrD,MAAM,UAAU,CAAC,4BAA4B,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,KAAiB,CAAC,CAAC;YAE9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,6BAA6B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,8EAA8E;IAC9E,MAAM,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,QAAiB,EAAE,QAAkB,EAAE,KAAmB,EAAE,EAAE;QACxF,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/services/auth.d.ts

@@ -1,7 +1,83 @@
-import type { AuthConfig, AuthResult, LoginInput, RefreshResult, SignupInput } from '../types/auth.js';
-export declare function signup(input: SignupInput, config: AuthConfig): Promise<AuthResult>;
+import type { AssignRolesResult, AuthConfig, AuthResult, LoginInput, RefreshResult, SignupInput, SignupResult } from '../types/auth.js';
+/**
+ * Register a new user.
+ *
+ * Validates that every requested role is in `validRoles`, rejects duplicate
+ * identifiers, hashes the password with bcrypt, creates the user record via
+ * the adapter, and returns the created user.
+ *
+ * No tokens are issued — the caller should invoke `login` after signup if
+ * immediate authentication is desired.
+ *
+ * @param input - Signup data: identifier, plain-text password, and optional roles.
+ * @param config - Auth configuration containing the adapter and role definitions.
+ * @returns `{ success: true, user }` on success, or `{ success: false, error }` with
+ *   code `INVALID_ROLE` or `USER_ALREADY_EXISTS` on failure.
+ */
+export declare function signup(input: SignupInput, config: AuthConfig): Promise<SignupResult>;
+/**
+ * Authenticate an existing user by identifier and plain-text password.
+ *
+ * Looks up the user, verifies the password with bcrypt, creates a new session,
+ * and issues a JWT access token + refresh token pair.
+ *
+ * The failure response always uses code `INVALID_CREDENTIALS` regardless of
+ * whether the identifier or the password was wrong, preventing user enumeration.
+ *
+ * @param input - Login data: identifier and plain-text password.
+ * @param config - Auth configuration containing the adapter and JWT settings.
+ * @returns `{ success: true, accessToken, refreshToken, user }` on success, or
+ *   `{ success: false, error }` with code `INVALID_CREDENTIALS` on failure.
+ */
 export declare function login(input: LoginInput, config: AuthConfig): Promise<AuthResult>;
+/**
+ * Exchange a valid refresh token for a new access + refresh token pair.
+ *
+ * Implements **session rotation**: the old session is deleted and a fresh
+ * session is created, so each refresh token is single-use. An attacker
+ * replaying a stolen refresh token after it has already been rotated will
+ * find the session gone.
+ *
+ * @param refreshToken - The JWT refresh token (typically from an httpOnly cookie).
+ * @param config - Auth configuration containing the adapter and JWT settings.
+ * @returns `{ success: true, accessToken, refreshToken, user }` on success, or
+ *   `{ success: false, error }` with code `UNAUTHORIZED`, `TOKEN_EXPIRED`, or
+ *   `TOKEN_INVALID` on failure.
+ */
 export declare function refresh(refreshToken: string, config: AuthConfig): Promise<RefreshResult>;
+/**
+ * Invalidate a single session identified by a refresh token.
+ *
+ * Safe to call even when the token is already expired or invalid — the JWT
+ * parse failure is silently swallowed and the function resolves normally.
+ * This makes logout idempotent from the client's perspective.
+ *
+ * @param refreshToken - The JWT refresh token bound to the session to revoke.
+ * @param config - Auth configuration containing the adapter and JWT settings.
+ */
 export declare function logout(refreshToken: string, config: AuthConfig): Promise<void>;
+/**
+ * Delete all sessions for a user, effectively logging them out of every device.
+ *
+ * Delegates to `adapter.session.deleteAllForUser`. No token is required — the
+ * router route that calls this function is already guarded by `protect()`.
+ *
+ * @param userId - The user's primary key as stored in the database.
+ * @param config - Auth configuration containing the adapter.
+ */
 export declare function logoutAll(userId: string, config: AuthConfig): Promise<void>;
+/**
+ * Add roles to a user account, merging them with any existing roles.
+ *
+ * Validates that every role in `rolesToAdd` is listed in `config.validRoles`.
+ * The resulting role set is deduplicated before being persisted via
+ * `adapter.user.updateRoles`.
+ *
+ * @param userId - The primary key of the user to update.
+ * @param rolesToAdd - Role names to assign. Must all be present in `validRoles`.
+ * @param config - Auth configuration containing the adapter and role definitions.
+ * @returns `{ success: true, user }` on success, or `{ success: false, error }` with
+ *   code `INVALID_ROLE` or `USER_NOT_FOUND` on failure.
+ */
+export declare function assignRoles(userId: string, rolesToAdd: string[], config: AuthConfig): Promise<AssignRolesResult>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/services/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/services/auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEvG,wBAAsB,MAAM,CAC1B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAyBrB;AAED,wBAAsB,KAAK,CACzB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAoBrB;AAED,wBAAsB,OAAO,CAC3B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,aAAa,CAAC,CA8BxB;AAED,wBAAsB,MAAM,CAC1B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/services/auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAExI;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,CAAC,CAoBvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,KAAK,CACzB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAoBrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,OAAO,CAC3B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,aAAa,CAAC,CA8BxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,MAAM,CAC1B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAAE,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAiB5B"}

package/dist/services/auth.js

@@ -2,6 +2,21 @@ import { AuthError } from '../errors/AuthError.js';
 import { hashPassword, verifyPassword } from '../libs/hash.js';
 import { signAccessToken, signRefreshToken, verifyRefreshToken } from '../libs/token.js';
 import { resolveConfig, parseExpiry } from '../libs/config.js';
+/**
+ * Register a new user.
+ *
+ * Validates that every requested role is in `validRoles`, rejects duplicate
+ * identifiers, hashes the password with bcrypt, creates the user record via
+ * the adapter, and returns the created user.
+ *
+ * No tokens are issued — the caller should invoke `login` after signup if
+ * immediate authentication is desired.
+ *
+ * @param input - Signup data: identifier, plain-text password, and optional roles.
+ * @param config - Auth configuration containing the adapter and role definitions.
+ * @returns `{ success: true, user }` on success, or `{ success: false, error }` with
+ *   code `INVALID_ROLE` or `USER_ALREADY_EXISTS` on failure.
+ */
 export async function signup(input, config) {
     const resolved = resolveConfig(config);
     const requestedRoles = input.roles ?? [];
@@ -16,13 +31,23 @@ export async function signup(input, config) {
     }
     const passwordHash = await hashPassword(input.password, resolved.saltRounds);
     const created = await resolved.adapter.user.create({ identifier, passwordHash, roles: requestedRoles });
-    const expiresAt = new Date(Date.now() + parseExpiry(resolved.refreshExpiresIn));
-    const session = await resolved.adapter.session.create({ userId: created.id, expiresAt });
     const user = { id: created.id, identifier, roles: requestedRoles };
-    const accessToken = signAccessToken(user, config);
-    const refreshToken = signRefreshToken(session.id, config);
-    return { success: true, accessToken, refreshToken, user };
+    return { success: true, user };
 }
+/**
+ * Authenticate an existing user by identifier and plain-text password.
+ *
+ * Looks up the user, verifies the password with bcrypt, creates a new session,
+ * and issues a JWT access token + refresh token pair.
+ *
+ * The failure response always uses code `INVALID_CREDENTIALS` regardless of
+ * whether the identifier or the password was wrong, preventing user enumeration.
+ *
+ * @param input - Login data: identifier and plain-text password.
+ * @param config - Auth configuration containing the adapter and JWT settings.
+ * @returns `{ success: true, accessToken, refreshToken, user }` on success, or
+ *   `{ success: false, error }` with code `INVALID_CREDENTIALS` on failure.
+ */
 export async function login(input, config) {
     const resolved = resolveConfig(config);
     const found = await resolved.adapter.user.findByIdentifier(input.identifier.trim());
@@ -40,6 +65,20 @@ export async function login(input, config) {
     const refreshToken = signRefreshToken(session.id, config);
     return { success: true, accessToken, refreshToken, user };
 }
+/**
+ * Exchange a valid refresh token for a new access + refresh token pair.
+ *
+ * Implements **session rotation**: the old session is deleted and a fresh
+ * session is created, so each refresh token is single-use. An attacker
+ * replaying a stolen refresh token after it has already been rotated will
+ * find the session gone.
+ *
+ * @param refreshToken - The JWT refresh token (typically from an httpOnly cookie).
+ * @param config - Auth configuration containing the adapter and JWT settings.
+ * @returns `{ success: true, accessToken, refreshToken, user }` on success, or
+ *   `{ success: false, error }` with code `UNAUTHORIZED`, `TOKEN_EXPIRED`, or
+ *   `TOKEN_INVALID` on failure.
+ */
 export async function refresh(refreshToken, config) {
     const resolved = resolveConfig(config);
     let sessionId;
@@ -68,6 +107,16 @@ export async function refresh(refreshToken, config) {
     const newRefreshToken = signRefreshToken(newSession.id, config);
     return { success: true, accessToken: newAccessToken, refreshToken: newRefreshToken, user };
 }
+/**
+ * Invalidate a single session identified by a refresh token.
+ *
+ * Safe to call even when the token is already expired or invalid — the JWT
+ * parse failure is silently swallowed and the function resolves normally.
+ * This makes logout idempotent from the client's perspective.
+ *
+ * @param refreshToken - The JWT refresh token bound to the session to revoke.
+ * @param config - Auth configuration containing the adapter and JWT settings.
+ */
 export async function logout(refreshToken, config) {
     let sessionId;
     try {
@@ -78,7 +127,43 @@ export async function logout(refreshToken, config) {
     }
     await resolveConfig(config).adapter.session.delete(sessionId);
 }
+/**
+ * Delete all sessions for a user, effectively logging them out of every device.
+ *
+ * Delegates to `adapter.session.deleteAllForUser`. No token is required — the
+ * router route that calls this function is already guarded by `protect()`.
+ *
+ * @param userId - The user's primary key as stored in the database.
+ * @param config - Auth configuration containing the adapter.
+ */
 export async function logoutAll(userId, config) {
     await resolveConfig(config).adapter.session.deleteAllForUser(userId);
 }
+/**
+ * Add roles to a user account, merging them with any existing roles.
+ *
+ * Validates that every role in `rolesToAdd` is listed in `config.validRoles`.
+ * The resulting role set is deduplicated before being persisted via
+ * `adapter.user.updateRoles`.
+ *
+ * @param userId - The primary key of the user to update.
+ * @param rolesToAdd - Role names to assign. Must all be present in `validRoles`.
+ * @param config - Auth configuration containing the adapter and role definitions.
+ * @returns `{ success: true, user }` on success, or `{ success: false, error }` with
+ *   code `INVALID_ROLE` or `USER_NOT_FOUND` on failure.
+ */
+export async function assignRoles(userId, rolesToAdd, config) {
+    const resolved = resolveConfig(config);
+    const invalidRoles = rolesToAdd.filter((role) => !resolved.validRoles.includes(role));
+    if (invalidRoles.length > 0) {
+        return { success: false, error: new AuthError('INVALID_ROLE', `Invalid roles: ${invalidRoles.join(', ')}`) };
+    }
+    const found = await resolved.adapter.user.findById(userId);
+    if (!found) {
+        return { success: false, error: new AuthError('USER_NOT_FOUND', 'User not found') };
+    }
+    const mergedRoles = Array.from(new Set([...found.roles, ...rolesToAdd]));
+    await resolved.adapter.user.updateRoles(userId, mergedRoles);
+    return { success: true, user: { id: found.id, identifier: found.identifier, roles: mergedRoles } };
+}
 //# sourceMappingURL=auth.js.map