sentri 4.1.1 → 5.0.1

package/dist/adapters/fastify/index.d.cts

@@ -0,0 +1,113 @@
+import * as kysely from 'kysely';
+import { FastifyRequest, FastifyReply, FastifyPluginAsync, FastifyError } from 'fastify';
+import { AuthUser, AuthConfig, SentriLogger, ServerAuthConfig, CookieConfig, AccessCookieConfig, AuthHooks, RouterHandlers, RegisterInput, RegisterResult, LoginInput, AuthResult, RefreshResult, GetUserResult, ChangePasswordResult, AssignRolesResult, IdentifierInput, BulkIdentifiersResult } from '../../core/index.cjs';
+export { SENTRI_ERROR_STATUS, SentriError } from '../../core/index.cjs';
+
+type SentriFastifyHook = (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+declare module 'fastify' {
+    interface FastifyRequest {
+        user?: AuthUser;
+    }
+}
+declare function protect(config: AuthConfig): SentriFastifyHook;
+
+declare function createAuthorize(logger: SentriLogger, service: string): <TRole extends string>(...allowedRoles: TRole[]) => SentriFastifyHook;
+declare function authorize<TRole extends string>(...allowedRoles: TRole[]): SentriFastifyHook;
+
+type FastifyPermitCheck = (request: FastifyRequest) => boolean | Promise<boolean>;
+interface FastifyPermitOptions<TRole extends string> {
+    roles?: TRole[];
+    check: FastifyPermitCheck;
+}
+declare function createPermit(logger: SentriLogger, service: string): <TRole extends string>(optionsOrCheck: FastifyPermitOptions<TRole> | FastifyPermitCheck) => SentriFastifyHook;
+declare function permit<TRole extends string>(optionsOrCheck: FastifyPermitOptions<TRole> | FastifyPermitCheck): SentriFastifyHook;
+
+declare function createAuthPlugin<TRole extends string>(config: ServerAuthConfig<TRole>): FastifyPluginAsync;
+
+interface FastifyErrorHandlerOptions {
+    onUnhandled?: (error: unknown) => void;
+}
+type FastifyErrorHandler = (error: FastifyError | Error, request: FastifyRequest, reply: FastifyReply) => void;
+declare function createErrorHandler(options?: FastifyErrorHandlerOptions): FastifyErrorHandler;
+
+declare function getCurrentAccessToken(request: FastifyRequest, config: ServerAuthConfig): string | undefined;
+
+interface CreateFastifyServerOptions<TRole extends string = string> {
+    mode: 'server';
+    validRoles: readonly TRole[];
+    validIdentifiers?: readonly string[];
+    dialect: kysely.Dialect;
+    accessExpiresIn?: string | number;
+    refreshExpiresIn?: string | number;
+    saltRounds?: number;
+    apiKey?: string;
+    cookie?: CookieConfig;
+    accessCookie?: AccessCookieConfig;
+    hooks?: AuthHooks;
+    router?: RouterHandlers;
+    isTokenRevoked?: (sessionId: string) => boolean | Promise<boolean>;
+    redisUrl?: string;
+    logger?: SentriLogger;
+    loggerService?: string;
+}
+interface CreateFastifyClientOptions<TRole extends string = string> {
+    mode: 'client';
+    keyUri: string;
+    validRoles?: readonly TRole[];
+    logger?: SentriLogger;
+    loggerService?: string;
+}
+interface FastifyAuthClient<TRole extends string = string> {
+    /** Hook that ensures the request has a valid access token. Attaches `request.user`. */
+    protect(): SentriFastifyHook;
+    /** Hook that ensures the user has AT LEAST ONE of the required roles. */
+    authorize(...roles: TRole[]): SentriFastifyHook;
+    /** Hook that evaluates a custom authorization condition or ABAC rules. */
+    permit(check: FastifyPermitCheck): SentriFastifyHook;
+    permit(options: FastifyPermitOptions<TRole>): SentriFastifyHook;
+    /** Fastify error handler that converts Sentri errors to standardized JSON responses. */
+    errorHandler(options?: FastifyErrorHandlerOptions): FastifyErrorHandler;
+}
+interface FastifyServerAuthClient<TRole extends string = string> extends FastifyAuthClient<TRole> {
+    /** Returns a Fastify plugin containing all auth endpoints (e.g. POST /register). */
+    plugin(): FastifyPluginAsync;
+    /** Runs Kysely database migrations for Sentri tables. */
+    migrate(): Promise<void>;
+    getCurrentAccessToken(request: FastifyRequest): string | undefined;
+    hashPassword(plain: string): Promise<string>;
+    verifyPassword(plain: string, hash: string): Promise<boolean>;
+    signAccessToken(payload: AuthUser<TRole>): string;
+    signRefreshToken(sessionId: string): string;
+    verifyAccessToken(token: string): AuthUser<TRole>;
+    verifyRefreshToken(token: string): {
+        sessionId: string;
+    };
+    register(input: RegisterInput<TRole>): Promise<RegisterResult<TRole>>;
+    login(input: LoginInput): Promise<AuthResult<TRole>>;
+    refresh(refreshToken: string): Promise<RefreshResult<TRole>>;
+    logout(refreshToken: string): Promise<void>;
+    logoutAll(userId: string): Promise<void>;
+    getUser(userId: string): Promise<GetUserResult<TRole>>;
+    changePassword(userId: string, currentPassword: string, newPassword: string): Promise<ChangePasswordResult>;
+    assignRoles(userId: string, roles: TRole[]): Promise<AssignRolesResult<TRole>>;
+    bulkCreateIdentifiers(userId: string, identifiers: IdentifierInput[]): Promise<BulkIdentifiersResult>;
+    bulkUpdateIdentifiers(userId: string, updates: Array<{
+        id: string;
+        type: string;
+        value: string;
+    }>): Promise<BulkIdentifiersResult>;
+    bulkDeleteIdentifiers(userId: string, ids: string[]): Promise<BulkIdentifiersResult>;
+}
+type FastifyClientAuthClient<TRole extends string = string> = FastifyAuthClient<TRole>;
+/**
+ * Creates a Fastify authentication client (Server Mode).
+ * Configures database connections, handles registration, issues tokens, and mounts endpoints.
+ */
+declare function createAuthFastify<TRole extends string = string>(options: CreateFastifyServerOptions<TRole>): FastifyServerAuthClient<TRole>;
+/**
+ * Creates a Fastify authentication client (Client Mode).
+ * Used for microservices that only verify tokens issued by a separate auth server.
+ */
+declare function createAuthFastify<TRole extends string = string>(options: CreateFastifyClientOptions<TRole>): FastifyClientAuthClient<TRole>;
+
+export { type CreateFastifyClientOptions, type CreateFastifyServerOptions, type FastifyAuthClient, type FastifyClientAuthClient, type FastifyErrorHandler, type FastifyErrorHandlerOptions, type FastifyPermitCheck, type FastifyPermitOptions, type FastifyServerAuthClient, type SentriFastifyHook, SentriLogger, authorize, createAuthFastify, createAuthPlugin, createAuthorize, createErrorHandler, createPermit, getCurrentAccessToken, permit, protect };

package/dist/adapters/fastify/index.d.ts

@@ -0,0 +1,113 @@
+import * as kysely from 'kysely';
+import { FastifyRequest, FastifyReply, FastifyPluginAsync, FastifyError } from 'fastify';
+import { AuthUser, AuthConfig, SentriLogger, ServerAuthConfig, CookieConfig, AccessCookieConfig, AuthHooks, RouterHandlers, RegisterInput, RegisterResult, LoginInput, AuthResult, RefreshResult, GetUserResult, ChangePasswordResult, AssignRolesResult, IdentifierInput, BulkIdentifiersResult } from '../../core/index.js';
+export { SENTRI_ERROR_STATUS, SentriError } from '../../core/index.js';
+
+type SentriFastifyHook = (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+declare module 'fastify' {
+    interface FastifyRequest {
+        user?: AuthUser;
+    }
+}
+declare function protect(config: AuthConfig): SentriFastifyHook;
+
+declare function createAuthorize(logger: SentriLogger, service: string): <TRole extends string>(...allowedRoles: TRole[]) => SentriFastifyHook;
+declare function authorize<TRole extends string>(...allowedRoles: TRole[]): SentriFastifyHook;
+
+type FastifyPermitCheck = (request: FastifyRequest) => boolean | Promise<boolean>;
+interface FastifyPermitOptions<TRole extends string> {
+    roles?: TRole[];
+    check: FastifyPermitCheck;
+}
+declare function createPermit(logger: SentriLogger, service: string): <TRole extends string>(optionsOrCheck: FastifyPermitOptions<TRole> | FastifyPermitCheck) => SentriFastifyHook;
+declare function permit<TRole extends string>(optionsOrCheck: FastifyPermitOptions<TRole> | FastifyPermitCheck): SentriFastifyHook;
+
+declare function createAuthPlugin<TRole extends string>(config: ServerAuthConfig<TRole>): FastifyPluginAsync;
+
+interface FastifyErrorHandlerOptions {
+    onUnhandled?: (error: unknown) => void;
+}
+type FastifyErrorHandler = (error: FastifyError | Error, request: FastifyRequest, reply: FastifyReply) => void;
+declare function createErrorHandler(options?: FastifyErrorHandlerOptions): FastifyErrorHandler;
+
+declare function getCurrentAccessToken(request: FastifyRequest, config: ServerAuthConfig): string | undefined;
+
+interface CreateFastifyServerOptions<TRole extends string = string> {
+    mode: 'server';
+    validRoles: readonly TRole[];
+    validIdentifiers?: readonly string[];
+    dialect: kysely.Dialect;
+    accessExpiresIn?: string | number;
+    refreshExpiresIn?: string | number;
+    saltRounds?: number;
+    apiKey?: string;
+    cookie?: CookieConfig;
+    accessCookie?: AccessCookieConfig;
+    hooks?: AuthHooks;
+    router?: RouterHandlers;
+    isTokenRevoked?: (sessionId: string) => boolean | Promise<boolean>;
+    redisUrl?: string;
+    logger?: SentriLogger;
+    loggerService?: string;
+}
+interface CreateFastifyClientOptions<TRole extends string = string> {
+    mode: 'client';
+    keyUri: string;
+    validRoles?: readonly TRole[];
+    logger?: SentriLogger;
+    loggerService?: string;
+}
+interface FastifyAuthClient<TRole extends string = string> {
+    /** Hook that ensures the request has a valid access token. Attaches `request.user`. */
+    protect(): SentriFastifyHook;
+    /** Hook that ensures the user has AT LEAST ONE of the required roles. */
+    authorize(...roles: TRole[]): SentriFastifyHook;
+    /** Hook that evaluates a custom authorization condition or ABAC rules. */
+    permit(check: FastifyPermitCheck): SentriFastifyHook;
+    permit(options: FastifyPermitOptions<TRole>): SentriFastifyHook;
+    /** Fastify error handler that converts Sentri errors to standardized JSON responses. */
+    errorHandler(options?: FastifyErrorHandlerOptions): FastifyErrorHandler;
+}
+interface FastifyServerAuthClient<TRole extends string = string> extends FastifyAuthClient<TRole> {
+    /** Returns a Fastify plugin containing all auth endpoints (e.g. POST /register). */
+    plugin(): FastifyPluginAsync;
+    /** Runs Kysely database migrations for Sentri tables. */
+    migrate(): Promise<void>;
+    getCurrentAccessToken(request: FastifyRequest): string | undefined;
+    hashPassword(plain: string): Promise<string>;
+    verifyPassword(plain: string, hash: string): Promise<boolean>;
+    signAccessToken(payload: AuthUser<TRole>): string;
+    signRefreshToken(sessionId: string): string;
+    verifyAccessToken(token: string): AuthUser<TRole>;
+    verifyRefreshToken(token: string): {
+        sessionId: string;
+    };
+    register(input: RegisterInput<TRole>): Promise<RegisterResult<TRole>>;
+    login(input: LoginInput): Promise<AuthResult<TRole>>;
+    refresh(refreshToken: string): Promise<RefreshResult<TRole>>;
+    logout(refreshToken: string): Promise<void>;
+    logoutAll(userId: string): Promise<void>;
+    getUser(userId: string): Promise<GetUserResult<TRole>>;
+    changePassword(userId: string, currentPassword: string, newPassword: string): Promise<ChangePasswordResult>;
+    assignRoles(userId: string, roles: TRole[]): Promise<AssignRolesResult<TRole>>;
+    bulkCreateIdentifiers(userId: string, identifiers: IdentifierInput[]): Promise<BulkIdentifiersResult>;
+    bulkUpdateIdentifiers(userId: string, updates: Array<{
+        id: string;
+        type: string;
+        value: string;
+    }>): Promise<BulkIdentifiersResult>;
+    bulkDeleteIdentifiers(userId: string, ids: string[]): Promise<BulkIdentifiersResult>;
+}
+type FastifyClientAuthClient<TRole extends string = string> = FastifyAuthClient<TRole>;
+/**
+ * Creates a Fastify authentication client (Server Mode).
+ * Configures database connections, handles registration, issues tokens, and mounts endpoints.
+ */
+declare function createAuthFastify<TRole extends string = string>(options: CreateFastifyServerOptions<TRole>): FastifyServerAuthClient<TRole>;
+/**
+ * Creates a Fastify authentication client (Client Mode).
+ * Used for microservices that only verify tokens issued by a separate auth server.
+ */
+declare function createAuthFastify<TRole extends string = string>(options: CreateFastifyClientOptions<TRole>): FastifyClientAuthClient<TRole>;
+
+export { type CreateFastifyClientOptions, type CreateFastifyServerOptions, type FastifyAuthClient, type FastifyClientAuthClient, type FastifyErrorHandler, type FastifyErrorHandlerOptions, type FastifyPermitCheck, type FastifyPermitOptions, type FastifyServerAuthClient, type SentriFastifyHook, SentriLogger, authorize, createAuthFastify, createAuthPlugin, createAuthorize, createErrorHandler, createPermit, getCurrentAccessToken, permit, protect };

package/dist/adapters/fastify/index.js

@@ -0,0 +1 @@
+import {generateKeyPairSync,createPrivateKey,createPublicKey,createHash,randomUUID}from'crypto';import {sql,Kysely}from'kysely';import Ze from'bcrypt';import J from'jsonwebtoken';import'@fastify/cookie';import {Readable}from'stream';var Lr=Object.defineProperty;var n=(e,r)=>Lr(e,"name",{value:r,configurable:true});var $e=Object.assign(Object.create(null),{UNAUTHORIZED:401,TOKEN_EXPIRED:401,TOKEN_INVALID:401,INVALID_CREDENTIALS:401,FORBIDDEN:403,USER_NOT_FOUND:404,IDENTIFIER_NOT_FOUND:404,USER_ALREADY_EXISTS:409,IDENTIFIER_ALREADY_EXISTS:409,INVALID_ROLE:400,VALIDATION_ERROR:400,CONFIGURATION_ERROR:500,TOKEN_REUSE:401}),u=class extends Error{static{n(this,"SentriError");}code;statusCode;constructor(r,t,s){super(t),this.name="SentriError",this.code=r,this.statusCode=s??$e[r]??500;}};var Ve=new WeakMap,Me=32,Be=10,je=31;function Xe(e){if(e.mode==="client"){if(!e.keyUri||e.keyUri.trim().length===0)throw new u("CONFIGURATION_ERROR","keyUri must not be empty");return}if(!e.secret||e.secret.trim().length===0)throw new u("CONFIGURATION_ERROR","secret must not be empty");if((e.algorithm??"HS256").startsWith("HS")&&e.secret.length<Me)throw new u("CONFIGURATION_ERROR",`secret must be at least ${Me} characters for HMAC algorithms`);let s=e.saltRounds??12;if(!Number.isInteger(s)||s<Be||s>je)throw new u("CONFIGURATION_ERROR",`saltRounds must be an integer between ${Be} and ${je}`);if(!e.validRoles||e.validRoles.length===0)throw new u("CONFIGURATION_ERROR","validRoles must contain at least one role");if(e.validIdentifiers!==void 0&&e.validIdentifiers.length===0)throw new u("CONFIGURATION_ERROR","validIdentifiers must contain at least one identifier type");if(!e.dialect)throw new u("CONFIGURATION_ERROR","dialect is required in server mode")}n(Xe,"validateConfig");function g(e){let r=Ve.get(e);if(r)return r;let t={algorithm:e.algorithm??"HS256",accessExpiresIn:e.accessExpiresIn??"15m",refreshExpiresIn:e.refreshExpiresIn??"7d",saltRounds:e.saltRounds??12,validRoles:e.validRoles,validRolesSet:new Set(e.validRoles),validIdentifiers:e.validIdentifiers??["email","username"],validIdentifiersSet:new Set(e.validIdentifiers??["email","username"]),cookieName:e.cookie?.name??"refresh_token",accessCookieName:e.accessCookie?.name??"access_token"};return Ve.set(e,t),t}n(g,"resolveServerConfig");var Fr=/^(\d+)([smhdw])$/,Pr={s:1e3,m:6e4,h:36e5,d:864e5,w:6048e5},ze=new Map;function H(e){if(typeof e=="number")return e*1e3;let r=ze.get(e);if(r!==void 0)return r;let t=Fr.exec(e);if(!t?.[1]||!t?.[2])throw new Error(`Invalid expiresIn: "${e}". Use e.g. "15m", "7d", "1h".`);let s=Pr[t[2]];if(s===void 0)throw new Error(`Invalid expiresIn: "${e}". Use e.g. "15m", "7d", "1h".`);let i=parseInt(t[1],10)*s;return ze.set(e,i),i}n(H,"parseExpiry");var D={info:n(()=>{},"info"),warn:n(()=>{},"warn"),error:n(()=>{},"error")};function m(e,r,t){return {service:e,event:r,...t}}n(m,"buildLogData");async function Ge(e){await e.schema.createTable("sentri_users").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("password_hash","varchar(255)",r=>r.notNull()).addColumn("roles","text",r=>r.notNull().defaultTo("[]")).addColumn("created_at","timestamp",r=>r.notNull().defaultTo(sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createTable("sentri_sessions").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("user_id","varchar(36)",r=>r.notNull().references("sentri_users.id").onDelete("cascade")).addColumn("expires_at","timestamp",r=>r.notNull()).addColumn("ip_address","varchar(45)").addColumn("user_agent","text").addColumn("replaced_by","varchar(36)").addColumn("created_at","timestamp",r=>r.notNull().defaultTo(sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createTable("sentri_identifiers").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("user_id","varchar(36)",r=>r.notNull().references("sentri_users.id").onDelete("cascade")).addColumn("type","varchar(100)",r=>r.notNull()).addColumn("value","varchar(255)",r=>r.notNull().unique()).addColumn("created_at","timestamp",r=>r.notNull().defaultTo(sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createIndex("idx_sentri_sessions_user_id").ifNotExists().on("sentri_sessions").column("user_id").execute(),await e.schema.createIndex("idx_sentri_identifiers_user_id").ifNotExists().on("sentri_identifiers").column("user_id").execute();}n(Ge,"runMigrations");var We=new Map;function T(e){let r=We.get(e);return r||(r=new Kysely({dialect:e}),We.set(e,r)),r}n(T,"getDatabase");async function W(e,r=12){return Ze.hash(e,r)}n(W,"hashPassword");async function Z(e,r){return Ze.compare(e,r)}n(Z,"verifyPassword");var Je=new Map,Ye=new Map,Vr=3600*1e3;function Qe(e){let r=Je.get(e);if(!r){let t=createPrivateKey(e),s=createPublicKey(t),i=s.export({format:"jwk"}),c=createHash("sha256").update(JSON.stringify({e:i.e,kty:i.kty,n:i.n})).digest("base64url"),y={...i,use:"sig",kid:c};r={kid:c,publicKey:s,jwk:y},Je.set(e,r);}return r}n(Qe,"getOrBuildKey");function er(e){let{jwk:r}=Qe(e);return {keys:[r]}}n(er,"buildJwks");function rr(e){return Qe(e).publicKey}n(rr,"getPublicKeyFromPrivate");async function tr(e){let r=Date.now(),t=Ye.get(e);if(t&&r-t.fetchedAt<Vr)return t.publicKey;let s=await fetch(e);if(!s.ok)throw new u("CONFIGURATION_ERROR",`Failed to fetch public key from ${e}: HTTP ${s.status}`);let i=await s.json();if(!i.keys||i.keys.length===0)throw new u("CONFIGURATION_ERROR",`No keys found in JWKS response from ${e}`);let o=i.keys[0],c=createPublicKey({key:o,format:"jwk"});return Ye.set(e,{publicKey:c,fetchedAt:r}),c}n(tr,"fetchPublicKey");var sr=new Map,nr=new Map,ir=new Map;function or(e){return e.startsWith("RS")||e.startsWith("PS")}n(or,"isRSA");function ar(e){let r=sr.get(e);return r||(r={access:`${e}:access`,refresh:`${e}:refresh`},sr.set(e,r)),r}n(ar,"getHsSecrets");function Br(e){let r=nr.get(e);return r||(r=createPrivateKey(e),nr.set(e,r)),r}n(Br,"getRsPrivateKey");function dr(e){let r=g(e);if(or(r.algorithm)){let i=Br(e.secret);return {accessKey:i,refreshKey:i}}let{access:t,refresh:s}=ar(e.secret);return {accessKey:t,refreshKey:s}}n(dr,"getSigningKeys");function cr(e,r){let t=g(e);if(or(t.algorithm))return rr(e.secret);let{access:s,refresh:i}=ar(e.secret);return r==="access"?s:i}n(cr,"getVerifyKey");function ur(e,r,t,s){let i=`${t}:${s}`,o=ir.get(i);return o||(o={expiresIn:t,algorithm:s},ir.set(i,o)),J.sign(e,r,o)}n(ur,"sign");function lr(e,r,t){try{let s=J.verify(e,r,{algorithms:[t]});if(typeof s=="string"||s===null)throw new u("TOKEN_INVALID","Token payload is not an object");return s}catch(s){throw s instanceof u?s:s instanceof J.TokenExpiredError?new u("TOKEN_EXPIRED","Token has expired"):new u("TOKEN_INVALID","Token is invalid or malformed")}}n(lr,"verify");function Y(e,r){let t=g(r),{accessKey:s}=dr(r);return ur(e,s,t.accessExpiresIn,t.algorithm)}n(Y,"signAccessToken");function q(e,r){let t=g(r),{refreshKey:s}=dr(r);return ur({sessionId:e},s,t.refreshExpiresIn,t.algorithm)}n(q,"signRefreshToken");function ce(e,r){let t=g(r),s=cr(r,"access");return lr(e,s,t.algorithm)}n(ce,"verifyAccessToken");function Q(e,r){let t=g(r),s=cr(r,"refresh");return lr(e,s,t.algorithm)}n(Q,"verifyRefreshToken");function fr(e,r){try{let t=J.verify(e,r,{algorithms:["RS256","RS384","RS512","PS256","PS384","PS512"]});if(typeof t=="string"||t===null)throw new u("TOKEN_INVALID","Token payload is not an object");return t}catch(t){throw t instanceof u?t:t instanceof J.TokenExpiredError?new u("TOKEN_EXPIRED","Token has expired"):new u("TOKEN_INVALID","Token is invalid or malformed")}}n(fr,"verifyTokenWithPublicKey");function Ce(e){try{return JSON.parse(e)}catch{return []}}n(Ce,"parseRoles");function jr(e){return JSON.stringify(e)}n(jr,"serializeRoles");function mr(e){return {id:e.id,userId:e.user_id,type:e.type,value:e.value,createdAt:new Date(e.created_at)}}n(mr,"mapIdentifier");async function ee(e,r){let t=await e.selectFrom("sentri_identifiers as i").innerJoin("sentri_users as u","u.id","i.user_id").select(["u.id","u.password_hash","u.roles"]).where("i.value","=",r).executeTakeFirst();return t?{id:t.id,passwordHash:t.password_hash,roles:Ce(t.roles)}:null}n(ee,"findUserByIdentifierValue");async function ue(e,r){let t=await e.selectFrom("sentri_users").select(["id","password_hash","roles"]).where("id","=",r).executeTakeFirst();return t?{id:t.id,passwordHash:t.password_hash,roles:Ce(t.roles)}:null}n(ue,"findUserById");async function pr(e,r,t){let s=t.map(i=>({id:randomUUID(),user_id:r,type:i.type,value:i.value}));return await e.insertInto("sentri_identifiers").values(s).execute(),s.map(i=>({id:i.id,userId:i.user_id,type:i.type,value:i.value,createdAt:new Date}))}n(pr,"createIdentifiers");async function re(e,r){return (await e.selectFrom("sentri_identifiers").selectAll().where("user_id","=",r).orderBy("created_at","asc").execute()).map(mr)}n(re,"findIdentifiersByUserId");async function Oe(e,r,t){let s=await e.selectFrom("sentri_identifiers").selectAll().where("id","=",r).where("user_id","=",t).executeTakeFirst();return s?mr(s):null}n(Oe,"findIdentifierById");async function wr(e,r){let t=await e.selectFrom("sentri_identifiers").select(s=>s.fn.countAll().as("count")).where("user_id","=",r).executeTakeFirst();return Number(t?.count??0)}n(wr,"countIdentifiersByUserId");async function Ir(e,r,t,s){await e.updateTable("sentri_identifiers").set({type:s.type,value:s.value}).where("id","=",r).where("user_id","=",t).execute();}n(Ir,"updateIdentifier");async function yr(e,r,t){await e.deleteFrom("sentri_identifiers").where("user_id","=",r).where("id","in",t).execute();}n(yr,"deleteIdentifiers");async function Rr(e,r,t){await e.updateTable("sentri_users").set({password_hash:t}).where("id","=",r).execute();}n(Rr,"updateUserPassword");async function _r(e,r,t){await e.updateTable("sentri_users").set({roles:jr(t)}).where("id","=",r).execute();}n(_r,"updateUserRoles");async function be(e,r){let t=randomUUID();return await e.insertInto("sentri_sessions").values({id:t,user_id:r.userId,expires_at:r.expiresAt.toISOString(),ip_address:r.ipAddress??null,user_agent:r.userAgent??null}).execute(),{id:t}}n(be,"createSession");async function le(e,r){let t=await e.selectFrom("sentri_sessions as s").innerJoin("sentri_users as u","u.id","s.user_id").select(["s.id as session_id","s.user_id","s.expires_at","s.ip_address","s.user_agent","s.replaced_by","s.created_at as session_created_at","u.id as user_id_col","u.password_hash","u.roles"]).where("s.id","=",r).executeTakeFirst();return t?{id:t.session_id,userId:t.user_id,expiresAt:new Date(t.expires_at),ipAddress:t.ip_address,userAgent:t.user_agent,replacedBy:t.replaced_by,createdAt:new Date(t.session_created_at),user:{id:t.user_id_col,passwordHash:t.password_hash,roles:Ce(t.roles)}}:null}n(le,"findSessionById");async function fe(e,r){await e.deleteFrom("sentri_sessions").where("id","=",r).execute();}n(fe,"deleteSession");async function gr(e,r,t){await e.updateTable("sentri_sessions").set({replaced_by:t}).where("id","=",r).execute();}n(gr,"markSessionReplaced");async function he(e,r){await e.deleteFrom("sentri_sessions").where("user_id","=",r).execute();}n(he,"deleteAllSessionsForUser");async function vr(e,r){return (await e.selectFrom("sentri_sessions").selectAll().where("user_id","=",r).where("replaced_by","is",null).where("expires_at",">",new Date).execute()).map(s=>({id:s.id,userId:s.user_id,expiresAt:new Date(s.expires_at),ipAddress:s.ip_address,userAgent:s.user_agent,replacedBy:s.replaced_by,createdAt:new Date(s.created_at)}))}n(vr,"findSessionsByUserId");async function me(e,r,t){let s=g(r),i=T(r.dialect),o=e.roles??[],c=o.filter(A=>!s.validRolesSet.has(A));if(c.length>0)return {success:false,error:new u("INVALID_ROLE",`Invalid roles: ${c.join(", ")}`)};if(!e.identifiers||e.identifiers.length===0)return {success:false,error:new u("VALIDATION_ERROR","At least one identifier is required")};let y=e.identifiers.map(A=>({type:A.type.trim(),value:A.value.trim()})),d=y.filter(A=>!s.validIdentifiersSet.has(A.type));if(d.length>0)return {success:false,error:new u("VALIDATION_ERROR",`Invalid identifier types: ${d.map(A=>A.type).join(", ")}`)};if(new Set(y.map(A=>A.value)).size!==y.length)return {success:false,error:new u("VALIDATION_ERROR","Duplicate identifier values in request")};for(let A of y)if(await ee(i,A.value))return {success:false,error:new u("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${A.value}`)};let v=await W(e.password,s.saltRounds),{userId:C,identifierRows:x}=await i.transaction().execute(async A=>{let P=randomUUID();await A.insertInto("sentri_users").values({id:P,password_hash:v,roles:JSON.stringify(o)}).execute();let j=y.map(de=>({id:randomUUID(),user_id:P,type:de.type,value:de.value}));return await A.insertInto("sentri_identifiers").values(j).execute(),{userId:P,identifierRows:j}}),O={success:true,user:{id:C,roles:o,identifiers:x.map(A=>({id:A.id,type:A.type,value:A.value}))}};return r.hooks?.onRegister&&await r.hooks.onRegister(O.user),O}n(me,"register");async function pe(e,r,t){let s=g(r),i=T(r.dialect),o=await ee(i,e.identifier.trim());if(!o){let x=new u("INVALID_CREDENTIALS","Invalid credentials");return r.hooks?.onLoginFailed&&await r.hooks.onLoginFailed(e.identifier,x,{ip:t?.ip??""}),{success:false,error:x}}if(!await Z(e.password,o.passwordHash)){let x=new u("INVALID_CREDENTIALS","Invalid credentials");return r.hooks?.onLoginFailed&&await r.hooks.onLoginFailed(e.identifier,x,{ip:t?.ip??""}),{success:false,error:x}}let y=new Date(Date.now()+H(s.refreshExpiresIn)),d=await be(i,{userId:o.id,expiresAt:y,ipAddress:t?.ip??null,userAgent:t?.userAgent??null}),l={id:o.id,roles:o.roles},v=Y({id:o.id,roles:o.roles,sessionId:d.id},r),C=q(d.id,r);return r.hooks?.onLoginSuccess&&await r.hooks.onLoginSuccess(l,{ip:t?.ip??"",userAgent:t?.userAgent??""}),{success:true,accessToken:v,refreshToken:C,user:l}}n(pe,"login");async function $(e,r,t){let s=g(r),i=T(r.dialect),o;try{({sessionId:o}=Q(e,r));}catch(x){return x instanceof u?{success:false,error:x}:{success:false,error:new u("TOKEN_INVALID","Invalid refresh token")}}let c=await le(i,o);if(!c)return {success:false,error:new u("UNAUTHORIZED","Session not found or revoked")};if(c.replacedBy)return await he(i,c.userId),{success:false,error:new u("TOKEN_REUSE","Token reuse detected. All sessions revoked.")};if(c.expiresAt.getTime()<Date.now())return await fe(i,o),{success:false,error:new u("TOKEN_EXPIRED","Session has expired")};let y=new Date(Date.now()+H(s.refreshExpiresIn)),d=await be(i,{userId:c.userId,expiresAt:y,ipAddress:t?.ip??null,userAgent:t?.userAgent??null});await gr(i,o,d.id);let l={id:c.user.id,roles:c.user.roles},v=Y({...l,sessionId:d.id},r),C=q(d.id,r);return {success:true,accessToken:v,refreshToken:C,user:l}}n($,"refresh");async function we(e,r){let t=T(r.dialect),s;try{({sessionId:s}=Q(e,r));}catch{return}let i=await le(t,s);i&&(await fe(t,s),r.hooks?.onLogout&&await r.hooks.onLogout(i.userId));}n(we,"logout");async function Ie(e,r){let t=T(r.dialect);await he(t,e),r.hooks?.onLogout&&await r.hooks.onLogout(e);}n(Ie,"logoutAll");async function ye(e,r){let t=T(r.dialect),s=await ue(t,e);if(!s)return {success:false,error:new u("USER_NOT_FOUND","User not found")};let i=await re(t,e);return {success:true,user:{id:s.id,roles:s.roles,identifiers:i.map(o=>({id:o.id,type:o.type,value:o.value}))}}}n(ye,"getUser");async function Re(e,r,t,s){let i=g(s),o=T(s.dialect),c=await ue(o,e);if(!c)return {success:false,error:new u("USER_NOT_FOUND","User not found")};if(!await Z(r,c.passwordHash))return {success:false,error:new u("INVALID_CREDENTIALS","Invalid credentials")};let d=await W(t,i.saltRounds);return await Rr(o,e,d),await he(o,e),s.hooks?.onPasswordChanged&&await s.hooks.onPasswordChanged(e),{success:true}}n(Re,"changePassword");async function _e(e,r,t){let s=g(t),i=T(t.dialect),o=r.filter(l=>!s.validRolesSet.has(l));if(o.length>0)return {success:false,error:new u("INVALID_ROLE",`Invalid roles: ${o.join(", ")}`)};let c=await ue(i,e);if(!c)return {success:false,error:new u("USER_NOT_FOUND","User not found")};let y=new Set(c.roles);for(let l of r)y.add(l);let d=Array.from(y);return await _r(i,e,d),{success:true,user:{id:c.id,roles:d}}}n(_e,"assignRoles");async function ge(e,r,t){let s=g(t),i=T(t.dialect);if(r.length===0)return {success:false,error:new u("VALIDATION_ERROR","At least one identifier is required")};let o=r.map(l=>({type:l.type.trim(),value:l.value.trim()})),c=o.filter(l=>!s.validIdentifiersSet.has(l.type));if(c.length>0)return {success:false,error:new u("VALIDATION_ERROR",`Invalid identifier types: ${c.map(l=>l.type).join(", ")}`)};if(new Set(o.map(l=>l.value)).size!==o.length)return {success:false,error:new u("VALIDATION_ERROR","Duplicate identifier values in request")};for(let l of o)if(await ee(i,l.value))return {success:false,error:new u("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${l.value}`)};return await pr(i,e,o),{success:true,identifiers:(await re(i,e)).map(l=>({id:l.id,type:l.type,value:l.value}))}}n(ge,"bulkCreateIdentifiers");async function ve(e,r,t){let s=g(t),i=T(t.dialect);if(r.length===0)return {success:false,error:new u("VALIDATION_ERROR","At least one update is required")};let o=r.map(l=>({id:l.id,type:l.type.trim(),value:l.value.trim()})),c=o.filter(l=>!s.validIdentifiersSet.has(l.type));if(c.length>0)return {success:false,error:new u("VALIDATION_ERROR",`Invalid identifier types: ${c.map(l=>l.type).join(", ")}`)};if(new Set(o.map(l=>l.value)).size!==o.length)return {success:false,error:new u("VALIDATION_ERROR","Duplicate identifier values in request")};for(let l of o){let v=await Oe(i,l.id,e);if(!v)return {success:false,error:new u("IDENTIFIER_NOT_FOUND",`Identifier not found: ${l.id}`)};if(v.value!==l.value&&await ee(i,l.value))return {success:false,error:new u("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${l.value}`)}}return await i.transaction().execute(async l=>{for(let v of o)await Ir(l,v.id,e,{type:v.type,value:v.value});}),{success:true,identifiers:(await re(i,e)).map(l=>({id:l.id,type:l.type,value:l.value}))}}n(ve,"bulkUpdateIdentifiers");async function Ae(e,r,t){let s=T(t.dialect);if(r.length===0)return {success:false,error:new u("VALIDATION_ERROR","At least one ID is required")};let i=Array.from(new Set(r));for(let y of i)if(!await Oe(s,y,e))return {success:false,error:new u("IDENTIFIER_NOT_FOUND",`Identifier not found: ${y}`)};return await wr(s,e)-i.length<1?{success:false,error:new u("VALIDATION_ERROR","Cannot delete all identifiers \u2014 at least one must remain")}:(await yr(s,e,i),{success:true,identifiers:(await re(s,e)).map(y=>({id:y.id,type:y.type,value:y.value}))})}n(Ae,"bulkDeleteIdentifiers");async function kr(e,r){let t=T(r.dialect);return (await vr(t,e)).map(i=>({id:i.id,ipAddress:i.ipAddress,userAgent:i.userAgent,createdAt:i.createdAt,expiresAt:i.expiresAt}))}n(kr,"getSessions");async function Er(e,r,t){let s=T(t.dialect),i=await le(s,r);i&&i.userId===e&&await fe(s,r);}n(Er,"revokeSession");function U(e){return g(e).cookieName}n(U,"getCookieName");function ke(e){return g(e).accessCookieName}n(ke,"getAccessCookieName");function L(e,r){if(!e)return;let t=`${r}=`,s=0;for(;s<e.length;){for(;s<e.length&&e[s]===" ";)s++;let i=e.indexOf(";",s),o=i===-1?e.length:i;if(e.startsWith(t,s))return e.slice(s+t.length,o);s=o+1;}}n(L,"readCookie");function te(e,r,t){let s=t.cookie??{},i=H(g(t).refreshExpiresIn)/1e3;e.setCookie(U(t),r,{httpOnly:s.httpOnly??true,secure:s.secure??false,sameSite:s.sameSite??"strict",path:s.path??"/",maxAge:i});}n(te,"setCookieFromConfig");function Ee(e,r){let t=r.cookie??{};e.clearCookie(U(r),{path:t.path??"/"});}n(Ee,"clearCookieFromConfig");function se(e,r,t){if(!t.accessCookie)return;let s=t.accessCookie,i=H(g(t).accessExpiresIn)/1e3;e.setCookie(ke(t),r,{httpOnly:false,secure:s.secure??false,sameSite:s.sameSite??"strict",path:s.path??"/",maxAge:i});}n(se,"setAccessCookieFromConfig");function Ue(e,r){if(!r.accessCookie)return;let t=r.accessCookie;e.clearCookie(ke(r),{path:t.path??"/"});}n(Ue,"clearAccessCookieFromConfig");function Te(e,r){let t=e.headers.authorization;return t?.startsWith("Bearer ")?t.slice(7):L(e.headers.cookie,ke(r))}n(Te,"getCurrentAccessToken");function ne(e){let r=e.logger??D,t=e.loggerService??"sentri";return e.mode==="client"?zr(e.keyUri,r,t):Xr(e,r,t)}n(ne,"protect");function zr(e,r,t){return async s=>{let i=s.headers.authorization,o=i?.startsWith("Bearer ")?i.slice(7):void 0;if(!o)throw r.warn(m(t,"auth.protect.failure",{mode:"client",errorCode:"UNAUTHORIZED",requestId:s.id})),new u("UNAUTHORIZED","Missing or malformed Authorization header");try{let c=await tr(e),y=fr(o,c);s.user={id:y.id,roles:y.roles},r.info(m(t,"auth.protect.success",{mode:"client",userId:y.id,requestId:s.id}));}catch(c){let y=c instanceof u?c.code:"TOKEN_INVALID";throw r.warn(m(t,"auth.protect.failure",{mode:"client",errorCode:y,requestId:s.id})),c}}}n(zr,"protectClient");function Xr(e,r,t){return async(s,i)=>{let o=Te(s,e);if(!o)throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:"UNAUTHORIZED",requestId:s.id})),new u("UNAUTHORIZED","Missing or malformed Authorization header");try{let c=ce(o,e);if(e.isTokenRevoked&&await e.isTokenRevoked(c.sessionId))throw r.warn(m(t,"auth.protect.token_revoked",{mode:"server",userId:c.id,requestId:s.id})),new u("UNAUTHORIZED","Token has been revoked");s.user={id:c.id,roles:c.roles},r.info(m(t,"auth.protect.success",{mode:"server",userId:c.id,requestId:s.id}));}catch(c){if(c instanceof u&&c.code==="TOKEN_EXPIRED"){let y=L(s.headers.cookie,U(e));if(!y)throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:"TOKEN_EXPIRED",requestId:s.id})),new u("UNAUTHORIZED","Token expired. Please login again.");let d;try{d=await $(y,e);}catch{throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:"TOKEN_EXPIRED",requestId:s.id})),new u("UNAUTHORIZED","Session expired. Please login again.")}if(!d.success)throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:d.error.code,requestId:s.id})),new u("UNAUTHORIZED","Session expired. Please login again.");te(i,d.refreshToken,e),se(i,d.accessToken,e),i.header("X-New-Access-Token",d.accessToken),s.user=d.user,r.info(m(t,"auth.protect.auto_refresh",{mode:"server",userId:d.user.id,requestId:s.id}));}else {let y=c instanceof u?c.code:"TOKEN_INVALID";throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:y,requestId:s.id})),c}}}}n(Xr,"protectServer");function Tr(e,r,t){let s=`Requires one of roles: ${e.join(", ")}`;return async i=>{if(!i.user)throw r.warn(m(t,"auth.authorize.unauthenticated",{requiredRoles:e,requestId:i.id})),new u("UNAUTHORIZED","Not authenticated");let o=i.user.roles;if(!e.some(c=>o.includes(c)))throw r.warn(m(t,"auth.authorize.denied",{userId:i.user.id,userRoles:[...o],requiredRoles:e,requestId:i.id})),new u("FORBIDDEN",s);r.info(m(t,"auth.authorize.passed",{userId:i.user.id,userRoles:[...o],requiredRoles:e,requestId:i.id}));}}n(Tr,"createAuthorizeHandler");function ie(e,r){return n(function(...s){return Tr(s,e,r)},"authorize")}n(ie,"createAuthorize");function Gr(...e){return Tr(e,D,"sentri")}n(Gr,"authorize");var Wr=new u("FORBIDDEN","You do not have permission to perform this action");function xr(e,r,t){return async s=>{if(!s.user)throw r.warn(m(t,"auth.permit.unauthenticated",{requestId:s.id})),new u("UNAUTHORIZED","Not authenticated");let i=s.user.id;if(e.roles&&e.roles.length>0){let y=s.user.roles;if(e.roles.some(d=>y.includes(d))){r.info(m(t,"auth.permit.role_bypass",{userId:i,bypassedByRole:true,requestId:s.id}));return}}let o=e.check(s);if(o instanceof Promise?await o:o)r.info(m(t,"auth.permit.passed",{userId:i,requestId:s.id}));else throw r.warn(m(t,"auth.permit.denied",{userId:i,requestId:s.id})),Wr}}n(xr,"createPermitHandler");function oe(e,r){return n(function(s){return xr(typeof s=="function"?{check:s}:s,e,r)},"permit")}n(oe,"createPermit");function Zr(e){return xr(typeof e=="function"?{check:e}:e,D,"sentri")}n(Zr,"permit");var Le=class{static{n(this,"InMemoryRateLimiter");}store=new Map;constructor(){setInterval(()=>{let r=Date.now();for(let[t,s]of this.store.entries())s.expiresAt<r&&this.store.delete(t);},6e4).unref();}async consume(r,t,s){let i=Date.now(),o=this.store.get(r);if((!o||o.expiresAt<i)&&(o={count:0,expiresAt:i+s},this.store.set(r,o)),o.count>t){let c=Math.ceil((o.expiresAt-i)/1e3);throw new Error(`Rate limit exceeded. Try again in ${c} seconds.`)}o.count++;}},Fe=class{static{n(this,"RedisRateLimiter");}redis;logger;constructor(r,t){this.redis=r,this.logger=t;}async consume(r,t,s){let i=`sentri:rl:${r}`,o=Math.ceil(s/1e3);try{let c=await this.redis.multi().incr(i).expire(i,o,"NX").exec();if(!c||c.length===0)return;if(c[0][1]>t)throw new Error("Rate limit exceeded. Try again later.")}catch(c){if(c instanceof Error&&c.message.includes("Rate limit exceeded"))throw c;this.logger.error({msg:"Redis RateLimiter failed, bypassing limit",error:c});}}},V=null;async function Nr(e,r){if(V)return V;if(e)try{let{Redis:t}=await import('ioredis'),s=new t(e,{lazyConnect:!0,maxRetriesPerRequest:1});return await s.connect(),r?.info({msg:"Connected to Redis for Rate Limiting"}),V=new Fe(s,r??D),V}catch(t){r?.warn({msg:"Failed to connect to Redis for Rate Limiting, falling back to InMemoryRateLimiter",error:t});}return V=new Le,V}n(Nr,"getRateLimiter");function ae(e){return (r,t,s)=>{if(r instanceof u){s.code(r.statusCode).send({error:true,statusCode:r.statusCode,code:r.code,message:r.message,data:null});return}e?.onUnhandled?.(r),s.code(500).send({error:true,statusCode:500,code:"INTERNAL_SERVER_ERROR",message:"Internal server error",data:null});}}n(ae,"createErrorHandler");var xe=8,M=72,Ne=255,Dr=100,B=50;function _(e){return new u("VALIDATION_ERROR",e)}n(_,"badRequest");function N(e,r,t,s){e.code(r).send({error:false,statusCode:r,message:t,data:s});}n(N,"ok");function b(e,r){e.code(r.statusCode).send({error:true,statusCode:r.statusCode,code:r.code,message:r.message,data:null});}n(b,"fail");function F(e){let r=e.body;if(r==null||typeof r!="object"||Array.isArray(r))throw new u("VALIDATION_ERROR","Request body is missing or not a JSON object.");return r}n(F,"parseBody");function Jr(e,r){if(!r.apiKey)return;let t=e.headers["x-api-key"];if(typeof t!="string"||t!==r.apiKey)throw new u("UNAUTHORIZED","Invalid or missing API key")}n(Jr,"validateApiKey");function Ke(e){if(e)try{let r=e();r instanceof Promise&&r.catch(()=>{});}catch{}}n(Ke,"fireHook");function Yr(e){return e.startsWith("RS")||e.startsWith("PS")}n(Yr,"isRSA");function He(e,r){if(typeof e!="object"||e===null||Array.isArray(e))throw _(`identifiers[${r}] must be an object`);let t=e;if(typeof t.type!="string"||t.type.trim().length===0)throw _(`identifiers[${r}].type is required and must be a non-empty string`);if(t.type.length>Dr)throw _(`identifiers[${r}].type must not exceed ${Dr} characters`);if(typeof t.value!="string"||t.value.trim().length===0)throw _(`identifiers[${r}].value is required and must be a non-empty string`);if(t.value.length>Ne)throw _(`identifiers[${r}].value must not exceed ${Ne} characters`);return {type:t.type,value:t.value}}n(He,"validateIdentifierInput");function Sr(e){return async r=>{let t=e,s=g(t),i=e.logger??D,o=e.loggerService??"sentri",c=ne(e),y=ie(i,o),d=oe(i,o),l=Nr(e.redisUrl,i),v=d(a=>!!a.user);r.setErrorHandler(ae()),r.addHook("preParsing",function(a,f,p,h){if(!a.headers["content-type"]?.includes("application/json")){h(null,p);return}if(p==null){h(null,Readable.from("{}"));return}let w=[];p.on("data",R=>w.push(R)),p.on("end",()=>{let R=Buffer.concat(w);h(null,R.length===0?Readable.from("{}"):Readable.from(R));}),p.on("error",R=>h(R));});let C=e.router?.register??(a=>me(a,t)),x=e.router?.login??(a=>pe(a,t)),O=e.router?.refresh??(a=>$(a,t)),A=e.router?.logout??(a=>a!==void 0?we(a,t):Promise.resolve()),P=e.router?.logoutAll??(a=>Ie(a,t)),j=e.router?.getUser??(a=>ye(a,t)),de=e.router?.assignRoles??((a,f)=>_e(a,f,t)),Cr=e.router?.changePassword??((a,f,p)=>Re(a,f,p,t)),Or=e.router?.bulkCreateIdentifiers??((a,f)=>ge(a,f,t)),br=e.router?.bulkUpdateIdentifiers??((a,f)=>ve(a,f,t)),Ur=e.router?.bulkDeleteIdentifiers??((a,f)=>Ae(a,f,t));Yr(s.algorithm)&&r.get("/keys",async(a,f)=>{f.header("Cache-Control","public, max-age=3600").send(er(e.secret));}),r.post("/register",async(a,f)=>{let p=Date.now();Jr(a,e);let h=F(a),{identifiers:w,password:R,roles:I}=h;if(!Array.isArray(w)||w.length===0)throw _("identifiers is required and must be a non-empty array");if(w.length>B)throw _(`identifiers must not exceed ${B} entries`);let k=w.map((G,De)=>He(G,De));if(typeof R!="string"||R.length<xe)throw _(`password is required and must be at least ${xe} characters`);if(R.length>M)throw _(`password must not exceed ${M} characters`);if(I!==void 0&&!Array.isArray(I))throw _("roles must be an array of strings when provided");if(Array.isArray(I)&&!I.every(G=>typeof G=="string"))throw _("each role must be a string");let S=Array.isArray(I)?I:void 0,E=S!==void 0?{identifiers:k,password:R,roles:S}:{identifiers:k,password:R},K=a.ip||"127.0.0.1",z=a.headers["user-agent"]||"Unknown";if(e.rateLimit!==false){let G=await l,De=typeof e.rateLimit=="object"?e.rateLimit.maxRegisterAttempts??5:5;await G.consume(`register:${K}`,De,900*1e3);}let X=await C(E,{ip:K,userAgent:z});if(!X.success){i.warn(m(o,"auth.register.failure",{errorCode:X.error.code,duration_ms:Date.now()-p,requestId:a.id})),b(f,X.error);return}i.info(m(o,"auth.register.success",{userId:X.user.id,duration_ms:Date.now()-p,requestId:a.id})),N(f,201,"User registered successfully",{user:X.user});}),r.post("/login",async(a,f)=>{let p=Date.now(),h=F(a),{identifier:w,password:R}=h;if(typeof w!="string"||w.trim().length===0)throw _("identifier is required and must be a non-empty string");if(w.length>Ne)throw _(`identifier must not exceed ${Ne} characters`);if(typeof R!="string"||R.length===0)throw _("password is required");if(R.length>M)throw _(`password must not exceed ${M} characters`);let I=w.trim(),k=a.ip||"127.0.0.1",S=a.headers["user-agent"]||"Unknown";if(e.rateLimit!==false){let K=await l,z=typeof e.rateLimit=="object"?e.rateLimit.maxLoginAttempts??5:5;await K.consume(`login:${k}`,z,900*1e3);}let E=await x({identifier:I,password:R},{ip:k,userAgent:S});if(!E.success){Ke(()=>e.hooks?.onLoginFailed?.(I,E.error,{ip:k})),i.warn(m(o,"auth.login.failure",{errorCode:E.error.code,duration_ms:Date.now()-p,requestId:a.id})),b(f,E.error);return}Ke(()=>e.hooks?.onLoginSuccess?.(E.user,{ip:k,userAgent:S})),te(f,E.refreshToken,e),se(f,E.accessToken,e),i.info(m(o,"auth.login.success",{userId:E.user.id,duration_ms:Date.now()-p,requestId:a.id})),N(f,200,"Login successful",{accessToken:E.accessToken,user:E.user});}),r.post("/refresh",async(a,f)=>{let p=Date.now(),h=L(a.headers.cookie,U(e));if(!h)throw new u("UNAUTHORIZED","Refresh token cookie is missing");let w=a.ip||"127.0.0.1",R=a.headers["user-agent"]||"Unknown",I=await O(h,{ip:w,userAgent:R});if(!I.success){Ee(f,e),i.warn(m(o,"auth.refresh.failure",{errorCode:I.error.code,duration_ms:Date.now()-p,requestId:a.id})),b(f,I.error);return}te(f,I.refreshToken,e),se(f,I.accessToken,e),i.info(m(o,"auth.refresh.success",{userId:I.user.id,duration_ms:Date.now()-p,requestId:a.id})),N(f,200,"Token refreshed",{accessToken:I.accessToken});}),r.post("/logout",async(a,f)=>{let p=Date.now(),h=L(a.headers.cookie,U(e));await A(h),Ee(f,e),Ue(f,e),i.info(m(o,"auth.logout",{duration_ms:Date.now()-p,requestId:a.id})),N(f,200,"Logged out",null);}),r.post("/logout-all",{preHandler:c},async(a,f)=>{let p=Date.now(),h=a.user.id;await P(h),Ke(()=>e.hooks?.onLogout?.(h)),Ee(f,e),Ue(f,e),i.info(m(o,"auth.logout_all",{userId:h,duration_ms:Date.now()-p,requestId:a.id})),N(f,200,"All sessions revoked",null);}),r.get("/me",{preHandler:c},async(a,f)=>{let p=Date.now(),h=await j(a.user.id);if(!h.success){i.warn(m(o,"auth.me.failure",{userId:a.user.id,errorCode:h.error.code,duration_ms:Date.now()-p,requestId:a.id})),b(f,h.error);return}i.info(m(o,"auth.me.success",{userId:h.user.id,duration_ms:Date.now()-p,requestId:a.id})),N(f,200,"OK",h.user);}),r.get("/me/identifiers",{preHandler:c},async(a,f)=>{let p=Date.now(),h=await j(a.user.id);if(!h.success){i.warn(m(o,"auth.me.identifiers.failure",{userId:a.user.id,errorCode:h.error.code,duration_ms:Date.now()-p,requestId:a.id})),b(f,h.error);return}i.info(m(o,"auth.me.identifiers.success",{userId:h.user.id,count:h.user.identifiers?.length??0,duration_ms:Date.now()-p,requestId:a.id})),N(f,200,"OK",{identifiers:h.user.identifiers??[]});}),r.post("/me/identifiers",{preHandler:[c,v]},async(a,f)=>{let p=Date.now(),h=F(a),{identifiers:w}=h;if(!Array.isArray(w)||w.length===0)throw _("identifiers is required and must be a non-empty array");if(w.length>B)throw _(`identifiers must not exceed ${B} entries`);let R=w.map((k,S)=>He(k,S)),I=await Or(a.user.id,R);if(!I.success){i.warn(m(o,"auth.identifiers.create_failure",{userId:a.user.id,errorCode:I.error.code,duration_ms:Date.now()-p,requestId:a.id})),b(f,I.error);return}i.info(m(o,"auth.identifiers.created",{userId:a.user.id,count:I.identifiers.length,duration_ms:Date.now()-p,requestId:a.id})),N(f,201,"Identifiers added successfully",{identifiers:I.identifiers});}),r.put("/me/identifiers",{preHandler:[c,v]},async(a,f)=>{let p=Date.now(),h=F(a),{identifiers:w}=h;if(!Array.isArray(w)||w.length===0)throw _("identifiers is required and must be a non-empty array");if(w.length>B)throw _(`identifiers must not exceed ${B} entries`);let R=w.map((k,S)=>{if(typeof k!="object"||k===null||Array.isArray(k))throw _(`identifiers[${S}] must be an object`);let E=k;if(typeof E.id!="string"||E.id.trim().length===0)throw _(`identifiers[${S}].id is required and must be a non-empty string`);let{type:K,value:z}=He(k,S);return {id:E.id,type:K,value:z}}),I=await br(a.user.id,R);if(!I.success){i.warn(m(o,"auth.identifiers.update_failure",{userId:a.user.id,errorCode:I.error.code,duration_ms:Date.now()-p,requestId:a.id})),b(f,I.error);return}i.info(m(o,"auth.identifiers.updated",{userId:a.user.id,count:I.identifiers.length,duration_ms:Date.now()-p,requestId:a.id})),N(f,200,"Identifiers updated successfully",{identifiers:I.identifiers});}),r.delete("/me/identifiers",{preHandler:[c,v]},async(a,f)=>{let p=Date.now(),h=F(a),{ids:w}=h;if(!Array.isArray(w)||w.length===0)throw _("ids is required and must be a non-empty array of strings");if(!w.every(I=>typeof I=="string"))throw _("each id must be a string");let R=await Ur(a.user.id,w);if(!R.success){i.warn(m(o,"auth.identifiers.delete_failure",{userId:a.user.id,errorCode:R.error.code,duration_ms:Date.now()-p,requestId:a.id})),b(f,R.error);return}i.info(m(o,"auth.identifiers.deleted",{userId:a.user.id,duration_ms:Date.now()-p,requestId:a.id})),N(f,200,"Identifiers deleted successfully",{identifiers:R.identifiers});}),r.patch("/me/password",{preHandler:[c,v]},async(a,f)=>{let p=Date.now(),h=F(a),{currentPassword:w,newPassword:R}=h;if(typeof w!="string"||w.length===0)throw _("currentPassword is required");if(typeof R!="string"||R.length<xe)throw _(`newPassword must be at least ${xe} characters`);if(R.length>M)throw _(`newPassword must not exceed ${M} characters`);if(w===R)throw _("newPassword must be different from currentPassword");let I=await Cr(a.user.id,w,R);if(!I.success){i.warn(m(o,"auth.password.change_failure",{userId:a.user.id,errorCode:I.error.code,duration_ms:Date.now()-p,requestId:a.id})),b(f,I.error);return}i.info(m(o,"auth.password.changed",{userId:a.user.id,duration_ms:Date.now()-p,requestId:a.id})),N(f,200,"Password updated successfully. All sessions have been revoked.",null);}),r.post("/users/:userId/roles",{preHandler:[c,y("admin")]},async(a,f)=>{let p=Date.now(),h=F(a),{roles:w}=h,R=a.params.userId;if(!R)throw _("userId is required");if(!Array.isArray(w)||w.length===0)throw _("roles must be a non-empty array of strings");if(!w.every(k=>typeof k=="string"))throw _("each role must be a string");let I=await de(R,w);if(!I.success){i.warn(m(o,"auth.roles.assign_failure",{targetUserId:R,errorCode:I.error.code,duration_ms:Date.now()-p,requestId:a.id})),b(f,I.error);return}i.info(m(o,"auth.roles.assigned",{targetUserId:R,roles:w,duration_ms:Date.now()-p,requestId:a.id})),N(f,200,"Roles assigned successfully",{user:I.user});}),r.get("/sessions",{preHandler:c},async(a,f)=>{let p=Date.now(),h=a.user.id,R=await(e.router?.getSessions??(I=>kr(I,t)))(h);i.info(m(o,"auth.sessions.get",{userId:h,duration_ms:Date.now()-p,requestId:a.id})),N(f,200,"OK",{sessions:R});}),r.delete("/sessions/:id",{preHandler:c},async(a,f)=>{let p=Date.now(),h=a.user.id,w=a.params.id;await(e.router?.revokeSession??((I,k)=>Er(I,k,t)))(h,w),i.info(m(o,"auth.sessions.revoke",{userId:h,sessionId:w,duration_ms:Date.now()-p,requestId:a.id})),N(f,200,"Session revoked",null);});}}n(Sr,"createAuthPlugin");function Bs(e){if(e.mode==="client"){let d={mode:"client",keyUri:e.keyUri,...e.validRoles!==void 0&&{validRoles:e.validRoles},...e.logger!==void 0&&{logger:e.logger},...e.loggerService!==void 0&&{loggerService:e.loggerService}};Xe(d);let l=d.logger??D,v=d.loggerService??"sentri",C=ie(l,v),x=oe(l,v);return {protect:n(()=>ne(d),"protect"),authorize:n((...O)=>C(...O),"authorize"),permit:n(O=>x(O),"permit"),errorHandler:n(O=>ae(O),"errorHandler")}}let{privateKey:r}=generateKeyPairSync("rsa",{modulusLength:2048,privateKeyEncoding:{type:"pkcs8",format:"pem"},publicKeyEncoding:{type:"spki",format:"pem"}}),t={mode:"server",dialect:e.dialect,secret:r,algorithm:"RS256",validRoles:e.validRoles,...e.validIdentifiers!==void 0&&{validIdentifiers:e.validIdentifiers},...e.accessExpiresIn!==void 0&&{accessExpiresIn:e.accessExpiresIn},...e.refreshExpiresIn!==void 0&&{refreshExpiresIn:e.refreshExpiresIn},...e.saltRounds!==void 0&&{saltRounds:e.saltRounds},...e.apiKey!==void 0&&{apiKey:e.apiKey},...e.cookie!==void 0&&{cookie:e.cookie},...e.accessCookie!==void 0&&{accessCookie:e.accessCookie},...e.hooks!==void 0&&{hooks:e.hooks},...e.router!==void 0&&{router:e.router},...e.isTokenRevoked!==void 0&&{isTokenRevoked:e.isTokenRevoked},...e.redisUrl!==void 0&&{redisUrl:e.redisUrl},...e.logger!==void 0&&{logger:e.logger},...e.loggerService!==void 0&&{loggerService:e.loggerService}},s=t.logger??D,i=t.loggerService??"sentri",o=g(t),c=ie(s,i),y=oe(s,i);return {protect:n(()=>ne(t),"protect"),authorize:n((...d)=>c(...d),"authorize"),permit:n(d=>y(d),"permit"),plugin:n(()=>Sr(t),"plugin"),errorHandler:n(d=>ae(d),"errorHandler"),migrate:n(()=>Ge(T(t.dialect)),"migrate"),getCurrentAccessToken:n(d=>Te(d,t),"getCurrentAccessToken"),hashPassword:n(d=>W(d,o.saltRounds),"hashPassword"),verifyPassword:n((d,l)=>Z(d,l),"verifyPassword"),signAccessToken:n(d=>Y(d,t),"signAccessToken"),signRefreshToken:n(d=>q(d,t),"signRefreshToken"),verifyAccessToken:n(d=>ce(d,t),"verifyAccessToken"),verifyRefreshToken:n(d=>Q(d,t),"verifyRefreshToken"),register:n(d=>me(d,t),"register"),login:n(d=>pe(d,t),"login"),refresh:n(d=>$(d,t),"refresh"),logout:n(d=>we(d,t),"logout"),logoutAll:n(d=>Ie(d,t),"logoutAll"),getUser:n(d=>ye(d,t),"getUser"),changePassword:n((d,l,v)=>Re(d,l,v,t),"changePassword"),assignRoles:n((d,l)=>_e(d,l,t),"assignRoles"),bulkCreateIdentifiers:n((d,l)=>ge(d,l,t),"bulkCreateIdentifiers"),bulkUpdateIdentifiers:n((d,l)=>ve(d,l,t),"bulkUpdateIdentifiers"),bulkDeleteIdentifiers:n((d,l)=>Ae(d,l,t),"bulkDeleteIdentifiers")}}n(Bs,"createAuthFastify");export{$e as SENTRI_ERROR_STATUS,u as SentriError,Gr as authorize,Bs as createAuthFastify,Sr as createAuthPlugin,ie as createAuthorize,ae as createErrorHandler,oe as createPermit,Te as getCurrentAccessToken,Zr as permit,ne as protect};

package/dist/adapters/hono/index.cjs

@@ -0,0 +1 @@
+'use strict';var crypto=require('crypto'),kysely=require('kysely'),We=require('bcrypt'),Z=require('jsonwebtoken'),cookie=require('hono/cookie'),hono=require('hono');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var We__default=/*#__PURE__*/_interopDefault(We);var Z__default=/*#__PURE__*/_interopDefault(Z);var Fr=Object.defineProperty;var n=(e,r)=>Fr(e,"name",{value:r,configurable:true});var $e=Object.assign(Object.create(null),{UNAUTHORIZED:401,TOKEN_EXPIRED:401,TOKEN_INVALID:401,INVALID_CREDENTIALS:401,FORBIDDEN:403,USER_NOT_FOUND:404,IDENTIFIER_NOT_FOUND:404,USER_ALREADY_EXISTS:409,IDENTIFIER_ALREADY_EXISTS:409,INVALID_ROLE:400,VALIDATION_ERROR:400,CONFIGURATION_ERROR:500,TOKEN_REUSE:401}),l=class extends Error{static{n(this,"SentriError");}code;statusCode;constructor(r,t,s){super(t),this.name="SentriError",this.code=r,this.statusCode=s??$e[r]??500;}};var He=new WeakMap,Ve=32,je=10,Me=31;function ze(e){if(e.mode==="client"){if(!e.keyUri||e.keyUri.trim().length===0)throw new l("CONFIGURATION_ERROR","keyUri must not be empty");return}if(!e.secret||e.secret.trim().length===0)throw new l("CONFIGURATION_ERROR","secret must not be empty");if((e.algorithm??"HS256").startsWith("HS")&&e.secret.length<Ve)throw new l("CONFIGURATION_ERROR",`secret must be at least ${Ve} characters for HMAC algorithms`);let s=e.saltRounds??12;if(!Number.isInteger(s)||s<je||s>Me)throw new l("CONFIGURATION_ERROR",`saltRounds must be an integer between ${je} and ${Me}`);if(!e.validRoles||e.validRoles.length===0)throw new l("CONFIGURATION_ERROR","validRoles must contain at least one role");if(e.validIdentifiers!==void 0&&e.validIdentifiers.length===0)throw new l("CONFIGURATION_ERROR","validIdentifiers must contain at least one identifier type");if(!e.dialect)throw new l("CONFIGURATION_ERROR","dialect is required in server mode")}n(ze,"validateConfig");function R(e){let r=He.get(e);if(r)return r;let t={algorithm:e.algorithm??"HS256",accessExpiresIn:e.accessExpiresIn??"15m",refreshExpiresIn:e.refreshExpiresIn??"7d",saltRounds:e.saltRounds??12,validRoles:e.validRoles,validRolesSet:new Set(e.validRoles),validIdentifiers:e.validIdentifiers??["email","username"],validIdentifiersSet:new Set(e.validIdentifiers??["email","username"]),cookieName:e.cookie?.name??"refresh_token",accessCookieName:e.accessCookie?.name??"access_token"};return He.set(e,t),t}n(R,"resolveServerConfig");var Pr=/^(\d+)([smhdw])$/,Kr={s:1e3,m:6e4,h:36e5,d:864e5,w:6048e5},Be=new Map;function $(e){if(typeof e=="number")return e*1e3;let r=Be.get(e);if(r!==void 0)return r;let t=Pr.exec(e);if(!t?.[1]||!t?.[2])throw new Error(`Invalid expiresIn: "${e}". Use e.g. "15m", "7d", "1h".`);let s=Kr[t[2]];if(s===void 0)throw new Error(`Invalid expiresIn: "${e}". Use e.g. "15m", "7d", "1h".`);let i=parseInt(t[1],10)*s;return Be.set(e,i),i}n($,"parseExpiry");var D={info:n(()=>{},"info"),warn:n(()=>{},"warn"),error:n(()=>{},"error")};function p(e,r,t){return {service:e,event:r,...t}}n(p,"buildLogData");async function Xe(e){await e.schema.createTable("sentri_users").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("password_hash","varchar(255)",r=>r.notNull()).addColumn("roles","text",r=>r.notNull().defaultTo("[]")).addColumn("created_at","timestamp",r=>r.notNull().defaultTo(kysely.sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createTable("sentri_sessions").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("user_id","varchar(36)",r=>r.notNull().references("sentri_users.id").onDelete("cascade")).addColumn("expires_at","timestamp",r=>r.notNull()).addColumn("ip_address","varchar(45)").addColumn("user_agent","text").addColumn("replaced_by","varchar(36)").addColumn("created_at","timestamp",r=>r.notNull().defaultTo(kysely.sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createTable("sentri_identifiers").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("user_id","varchar(36)",r=>r.notNull().references("sentri_users.id").onDelete("cascade")).addColumn("type","varchar(100)",r=>r.notNull()).addColumn("value","varchar(255)",r=>r.notNull().unique()).addColumn("created_at","timestamp",r=>r.notNull().defaultTo(kysely.sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createIndex("idx_sentri_sessions_user_id").ifNotExists().on("sentri_sessions").column("user_id").execute(),await e.schema.createIndex("idx_sentri_identifiers_user_id").ifNotExists().on("sentri_identifiers").column("user_id").execute();}n(Xe,"runMigrations");var Ge=new Map;function T(e){let r=Ge.get(e);return r||(r=new kysely.Kysely({dialect:e}),Ge.set(e,r)),r}n(T,"getDatabase");async function G(e,r=12){return We__default.default.hash(e,r)}n(G,"hashPassword");async function W(e,r){return We__default.default.compare(e,r)}n(W,"verifyPassword");var Ze=new Map,Je=new Map,jr=3600*1e3;function Qe(e){let r=Ze.get(e);if(!r){let t=crypto.createPrivateKey(e),s=crypto.createPublicKey(t),i=s.export({format:"jwk"}),d=crypto.createHash("sha256").update(JSON.stringify({e:i.e,kty:i.kty,n:i.n})).digest("base64url"),h={...i,use:"sig",kid:d};r={kid:d,publicKey:s,jwk:h},Ze.set(e,r);}return r}n(Qe,"getOrBuildKey");function er(e){let{jwk:r}=Qe(e);return {keys:[r]}}n(er,"buildJwks");function rr(e){return Qe(e).publicKey}n(rr,"getPublicKeyFromPrivate");async function tr(e){let r=Date.now(),t=Je.get(e);if(t&&r-t.fetchedAt<jr)return t.publicKey;let s=await fetch(e);if(!s.ok)throw new l("CONFIGURATION_ERROR",`Failed to fetch public key from ${e}: HTTP ${s.status}`);let i=await s.json();if(!i.keys||i.keys.length===0)throw new l("CONFIGURATION_ERROR",`No keys found in JWKS response from ${e}`);let a=i.keys[0],d=crypto.createPublicKey({key:a,format:"jwk"});return Je.set(e,{publicKey:d,fetchedAt:r}),d}n(tr,"fetchPublicKey");var sr=new Map,nr=new Map,or=new Map;function ir(e){return e.startsWith("RS")||e.startsWith("PS")}n(ir,"isRSA");function ar(e){let r=sr.get(e);return r||(r={access:`${e}:access`,refresh:`${e}:refresh`},sr.set(e,r)),r}n(ar,"getHsSecrets");function Br(e){let r=nr.get(e);return r||(r=crypto.createPrivateKey(e),nr.set(e,r)),r}n(Br,"getRsPrivateKey");function ur(e){let r=R(e);if(ir(r.algorithm)){let i=Br(e.secret);return {accessKey:i,refreshKey:i}}let{access:t,refresh:s}=ar(e.secret);return {accessKey:t,refreshKey:s}}n(ur,"getSigningKeys");function dr(e,r){let t=R(e);if(ir(t.algorithm))return rr(e.secret);let{access:s,refresh:i}=ar(e.secret);return r==="access"?s:i}n(dr,"getVerifyKey");function cr(e,r,t,s){let i=`${t}:${s}`,a=or.get(i);return a||(a={expiresIn:t,algorithm:s},or.set(i,a)),Z__default.default.sign(e,r,a)}n(cr,"sign");function lr(e,r,t){try{let s=Z__default.default.verify(e,r,{algorithms:[t]});if(typeof s=="string"||s===null)throw new l("TOKEN_INVALID","Token payload is not an object");return s}catch(s){throw s instanceof l?s:s instanceof Z__default.default.TokenExpiredError?new l("TOKEN_EXPIRED","Token has expired"):new l("TOKEN_INVALID","Token is invalid or malformed")}}n(lr,"verify");function J(e,r){let t=R(r),{accessKey:s}=ur(r);return cr(e,s,t.accessExpiresIn,t.algorithm)}n(J,"signAccessToken");function Y(e,r){let t=R(r),{refreshKey:s}=ur(r);return cr({sessionId:e},s,t.refreshExpiresIn,t.algorithm)}n(Y,"signRefreshToken");function ce(e,r){let t=R(r),s=dr(r,"access");return lr(e,s,t.algorithm)}n(ce,"verifyAccessToken");function Q(e,r){let t=R(r),s=dr(r,"refresh");return lr(e,s,t.algorithm)}n(Q,"verifyRefreshToken");function fr(e,r){try{let t=Z__default.default.verify(e,r,{algorithms:["RS256","RS384","RS512","PS256","PS384","PS512"]});if(typeof t=="string"||t===null)throw new l("TOKEN_INVALID","Token payload is not an object");return t}catch(t){throw t instanceof l?t:t instanceof Z__default.default.TokenExpiredError?new l("TOKEN_EXPIRED","Token has expired"):new l("TOKEN_INVALID","Token is invalid or malformed")}}n(fr,"verifyTokenWithPublicKey");function Oe(e){try{return JSON.parse(e)}catch{return []}}n(Oe,"parseRoles");function zr(e){return JSON.stringify(e)}n(zr,"serializeRoles");function wr(e){return {id:e.id,userId:e.user_id,type:e.type,value:e.value,createdAt:new Date(e.created_at)}}n(wr,"mapIdentifier");async function ee(e,r){let t=await e.selectFrom("sentri_identifiers as i").innerJoin("sentri_users as u","u.id","i.user_id").select(["u.id","u.password_hash","u.roles"]).where("i.value","=",r).executeTakeFirst();return t?{id:t.id,passwordHash:t.password_hash,roles:Oe(t.roles)}:null}n(ee,"findUserByIdentifierValue");async function le(e,r){let t=await e.selectFrom("sentri_users").select(["id","password_hash","roles"]).where("id","=",r).executeTakeFirst();return t?{id:t.id,passwordHash:t.password_hash,roles:Oe(t.roles)}:null}n(le,"findUserById");async function pr(e,r,t){let s=t.map(i=>({id:crypto.randomUUID(),user_id:r,type:i.type,value:i.value}));return await e.insertInto("sentri_identifiers").values(s).execute(),s.map(i=>({id:i.id,userId:i.user_id,type:i.type,value:i.value,createdAt:new Date}))}n(pr,"createIdentifiers");async function re(e,r){return (await e.selectFrom("sentri_identifiers").selectAll().where("user_id","=",r).orderBy("created_at","asc").execute()).map(wr)}n(re,"findIdentifiersByUserId");async function be(e,r,t){let s=await e.selectFrom("sentri_identifiers").selectAll().where("id","=",r).where("user_id","=",t).executeTakeFirst();return s?wr(s):null}n(be,"findIdentifierById");async function mr(e,r){let t=await e.selectFrom("sentri_identifiers").select(s=>s.fn.countAll().as("count")).where("user_id","=",r).executeTakeFirst();return Number(t?.count??0)}n(mr,"countIdentifiersByUserId");async function yr(e,r,t,s){await e.updateTable("sentri_identifiers").set({type:s.type,value:s.value}).where("id","=",r).where("user_id","=",t).execute();}n(yr,"updateIdentifier");async function Ir(e,r,t){await e.deleteFrom("sentri_identifiers").where("user_id","=",r).where("id","in",t).execute();}n(Ir,"deleteIdentifiers");async function gr(e,r,t){await e.updateTable("sentri_users").set({password_hash:t}).where("id","=",r).execute();}n(gr,"updateUserPassword");async function Rr(e,r,t){await e.updateTable("sentri_users").set({roles:zr(t)}).where("id","=",r).execute();}n(Rr,"updateUserRoles");async function Ue(e,r){let t=crypto.randomUUID();return await e.insertInto("sentri_sessions").values({id:t,user_id:r.userId,expires_at:r.expiresAt.toISOString(),ip_address:r.ipAddress??null,user_agent:r.userAgent??null}).execute(),{id:t}}n(Ue,"createSession");async function fe(e,r){let t=await e.selectFrom("sentri_sessions as s").innerJoin("sentri_users as u","u.id","s.user_id").select(["s.id as session_id","s.user_id","s.expires_at","s.ip_address","s.user_agent","s.replaced_by","s.created_at as session_created_at","u.id as user_id_col","u.password_hash","u.roles"]).where("s.id","=",r).executeTakeFirst();return t?{id:t.session_id,userId:t.user_id,expiresAt:new Date(t.expires_at),ipAddress:t.ip_address,userAgent:t.user_agent,replacedBy:t.replaced_by,createdAt:new Date(t.session_created_at),user:{id:t.user_id_col,passwordHash:t.password_hash,roles:Oe(t.roles)}}:null}n(fe,"findSessionById");async function he(e,r){await e.deleteFrom("sentri_sessions").where("id","=",r).execute();}n(he,"deleteSession");async function _r(e,r,t){await e.updateTable("sentri_sessions").set({replaced_by:t}).where("id","=",r).execute();}n(_r,"markSessionReplaced");async function we(e,r){await e.deleteFrom("sentri_sessions").where("user_id","=",r).execute();}n(we,"deleteAllSessionsForUser");async function vr(e,r){return (await e.selectFrom("sentri_sessions").selectAll().where("user_id","=",r).where("replaced_by","is",null).where("expires_at",">",new Date).execute()).map(s=>({id:s.id,userId:s.user_id,expiresAt:new Date(s.expires_at),ipAddress:s.ip_address,userAgent:s.user_agent,replacedBy:s.replaced_by,createdAt:new Date(s.created_at)}))}n(vr,"findSessionsByUserId");async function pe(e,r,t){let s=R(r),i=T(r.dialect),a=e.roles??[],d=a.filter(v=>!s.validRolesSet.has(v));if(d.length>0)return {success:false,error:new l("INVALID_ROLE",`Invalid roles: ${d.join(", ")}`)};if(!e.identifiers||e.identifiers.length===0)return {success:false,error:new l("VALIDATION_ERROR","At least one identifier is required")};let h=e.identifiers.map(v=>({type:v.type.trim(),value:v.value.trim()})),u=h.filter(v=>!s.validIdentifiersSet.has(v.type));if(u.length>0)return {success:false,error:new l("VALIDATION_ERROR",`Invalid identifier types: ${u.map(v=>v.type).join(", ")}`)};if(new Set(h.map(v=>v.value)).size!==h.length)return {success:false,error:new l("VALIDATION_ERROR","Duplicate identifier values in request")};for(let v of h)if(await ee(i,v.value))return {success:false,error:new l("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${v.value}`)};let A=await G(e.password,s.saltRounds),{userId:C,identifierRows:x}=await i.transaction().execute(async v=>{let L=crypto.randomUUID();await v.insertInto("sentri_users").values({id:L,password_hash:A,roles:JSON.stringify(a)}).execute();let ae=h.map(ue=>({id:crypto.randomUUID(),user_id:L,type:ue.type,value:ue.value}));return await v.insertInto("sentri_identifiers").values(ae).execute(),{userId:L,identifierRows:ae}}),O={success:true,user:{id:C,roles:a,identifiers:x.map(v=>({id:v.id,type:v.type,value:v.value}))}};return r.hooks?.onRegister&&await r.hooks.onRegister(O.user),O}n(pe,"register");async function me(e,r,t){let s=R(r),i=T(r.dialect),a=await ee(i,e.identifier.trim());if(!a){let x=new l("INVALID_CREDENTIALS","Invalid credentials");return r.hooks?.onLoginFailed&&await r.hooks.onLoginFailed(e.identifier,x,{ip:t?.ip??""}),{success:false,error:x}}if(!await W(e.password,a.passwordHash)){let x=new l("INVALID_CREDENTIALS","Invalid credentials");return r.hooks?.onLoginFailed&&await r.hooks.onLoginFailed(e.identifier,x,{ip:t?.ip??""}),{success:false,error:x}}let h=new Date(Date.now()+$(s.refreshExpiresIn)),u=await Ue(i,{userId:a.id,expiresAt:h,ipAddress:t?.ip??null,userAgent:t?.userAgent??null}),c={id:a.id,roles:a.roles},A=J({id:a.id,roles:a.roles,sessionId:u.id},r),C=Y(u.id,r);return r.hooks?.onLoginSuccess&&await r.hooks.onLoginSuccess(c,{ip:t?.ip??"",userAgent:t?.userAgent??""}),{success:true,accessToken:A,refreshToken:C,user:c}}n(me,"login");async function H(e,r,t){let s=R(r),i=T(r.dialect),a;try{({sessionId:a}=Q(e,r));}catch(x){return x instanceof l?{success:false,error:x}:{success:false,error:new l("TOKEN_INVALID","Invalid refresh token")}}let d=await fe(i,a);if(!d)return {success:false,error:new l("UNAUTHORIZED","Session not found or revoked")};if(d.replacedBy)return await we(i,d.userId),{success:false,error:new l("TOKEN_REUSE","Token reuse detected. All sessions revoked.")};if(d.expiresAt.getTime()<Date.now())return await he(i,a),{success:false,error:new l("TOKEN_EXPIRED","Session has expired")};let h=new Date(Date.now()+$(s.refreshExpiresIn)),u=await Ue(i,{userId:d.userId,expiresAt:h,ipAddress:t?.ip??null,userAgent:t?.userAgent??null});await _r(i,a,u.id);let c={id:d.user.id,roles:d.user.roles},A=J({...c,sessionId:u.id},r),C=Y(u.id,r);return {success:true,accessToken:A,refreshToken:C,user:c}}n(H,"refresh");async function ye(e,r){let t=T(r.dialect),s;try{({sessionId:s}=Q(e,r));}catch{return}let i=await fe(t,s);i&&(await he(t,s),r.hooks?.onLogout&&await r.hooks.onLogout(i.userId));}n(ye,"logout");async function Ie(e,r){let t=T(r.dialect);await we(t,e),r.hooks?.onLogout&&await r.hooks.onLogout(e);}n(Ie,"logoutAll");async function ge(e,r){let t=T(r.dialect),s=await le(t,e);if(!s)return {success:false,error:new l("USER_NOT_FOUND","User not found")};let i=await re(t,e);return {success:true,user:{id:s.id,roles:s.roles,identifiers:i.map(a=>({id:a.id,type:a.type,value:a.value}))}}}n(ge,"getUser");async function Re(e,r,t,s){let i=R(s),a=T(s.dialect),d=await le(a,e);if(!d)return {success:false,error:new l("USER_NOT_FOUND","User not found")};if(!await W(r,d.passwordHash))return {success:false,error:new l("INVALID_CREDENTIALS","Invalid credentials")};let u=await G(t,i.saltRounds);return await gr(a,e,u),await we(a,e),s.hooks?.onPasswordChanged&&await s.hooks.onPasswordChanged(e),{success:true}}n(Re,"changePassword");async function _e(e,r,t){let s=R(t),i=T(t.dialect),a=r.filter(c=>!s.validRolesSet.has(c));if(a.length>0)return {success:false,error:new l("INVALID_ROLE",`Invalid roles: ${a.join(", ")}`)};let d=await le(i,e);if(!d)return {success:false,error:new l("USER_NOT_FOUND","User not found")};let h=new Set(d.roles);for(let c of r)h.add(c);let u=Array.from(h);return await Rr(i,e,u),{success:true,user:{id:d.id,roles:u}}}n(_e,"assignRoles");async function ve(e,r,t){let s=R(t),i=T(t.dialect);if(r.length===0)return {success:false,error:new l("VALIDATION_ERROR","At least one identifier is required")};let a=r.map(c=>({type:c.type.trim(),value:c.value.trim()})),d=a.filter(c=>!s.validIdentifiersSet.has(c.type));if(d.length>0)return {success:false,error:new l("VALIDATION_ERROR",`Invalid identifier types: ${d.map(c=>c.type).join(", ")}`)};if(new Set(a.map(c=>c.value)).size!==a.length)return {success:false,error:new l("VALIDATION_ERROR","Duplicate identifier values in request")};for(let c of a)if(await ee(i,c.value))return {success:false,error:new l("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${c.value}`)};return await pr(i,e,a),{success:true,identifiers:(await re(i,e)).map(c=>({id:c.id,type:c.type,value:c.value}))}}n(ve,"bulkCreateIdentifiers");async function Ae(e,r,t){let s=R(t),i=T(t.dialect);if(r.length===0)return {success:false,error:new l("VALIDATION_ERROR","At least one update is required")};let a=r.map(c=>({id:c.id,type:c.type.trim(),value:c.value.trim()})),d=a.filter(c=>!s.validIdentifiersSet.has(c.type));if(d.length>0)return {success:false,error:new l("VALIDATION_ERROR",`Invalid identifier types: ${d.map(c=>c.type).join(", ")}`)};if(new Set(a.map(c=>c.value)).size!==a.length)return {success:false,error:new l("VALIDATION_ERROR","Duplicate identifier values in request")};for(let c of a){let A=await be(i,c.id,e);if(!A)return {success:false,error:new l("IDENTIFIER_NOT_FOUND",`Identifier not found: ${c.id}`)};if(A.value!==c.value&&await ee(i,c.value))return {success:false,error:new l("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${c.value}`)}}return await i.transaction().execute(async c=>{for(let A of a)await yr(c,A.id,e,{type:A.type,value:A.value});}),{success:true,identifiers:(await re(i,e)).map(c=>({id:c.id,type:c.type,value:c.value}))}}n(Ae,"bulkUpdateIdentifiers");async function ke(e,r,t){let s=T(t.dialect);if(r.length===0)return {success:false,error:new l("VALIDATION_ERROR","At least one ID is required")};let i=Array.from(new Set(r));for(let h of i)if(!await be(s,h,e))return {success:false,error:new l("IDENTIFIER_NOT_FOUND",`Identifier not found: ${h}`)};return await mr(s,e)-i.length<1?{success:false,error:new l("VALIDATION_ERROR","Cannot delete all identifiers \u2014 at least one must remain")}:(await Ir(s,e,i),{success:true,identifiers:(await re(s,e)).map(h=>({id:h.id,type:h.type,value:h.value}))})}n(ke,"bulkDeleteIdentifiers");async function kr(e,r){let t=T(r.dialect);return (await vr(t,e)).map(i=>({id:i.id,ipAddress:i.ipAddress,userAgent:i.userAgent,createdAt:i.createdAt,expiresAt:i.expiresAt}))}n(kr,"getSessions");async function Er(e,r,t){let s=T(t.dialect),i=await fe(s,r);i&&i.userId===e&&await he(s,r);}n(Er,"revokeSession");function U(e){return R(e).cookieName}n(U,"getCookieName");function Ee(e){return R(e).accessCookieName}n(Ee,"getAccessCookieName");function q(e,r){if(!e)return;let t=`${r}=`,s=0;for(;s<e.length;){for(;s<e.length&&e[s]===" ";)s++;let i=e.indexOf(";",s),a=i===-1?e.length:i;if(e.startsWith(t,s))return e.slice(s+t.length,a);s=a+1;}}n(q,"readCookie");function Nr(e){let r=(e??"strict").toLowerCase();return r==="lax"?"Lax":r==="none"?"None":"Strict"}n(Nr,"normalizeSameSite");function te(e,r,t){let s=t.cookie??{},i=$(R(t).refreshExpiresIn)/1e3;cookie.setCookie(e,U(t),r,{httpOnly:s.httpOnly??true,secure:s.secure??false,sameSite:Nr(s.sameSite),path:s.path??"/",maxAge:i});}n(te,"setCookieFromConfig");function Te(e,r){let t=r.cookie??{};cookie.deleteCookie(e,U(r),{path:t.path??"/"});}n(Te,"clearCookieFromConfig");function se(e,r,t){if(!t.accessCookie)return;let s=t.accessCookie,i=$(R(t).accessExpiresIn)/1e3;cookie.setCookie(e,Ee(t),r,{httpOnly:false,secure:s.secure??false,sameSite:Nr(s.sameSite),path:s.path??"/",maxAge:i});}n(se,"setAccessCookieFromConfig");function Le(e,r){if(!r.accessCookie)return;let t=r.accessCookie;cookie.deleteCookie(e,Ee(r),{path:t.path??"/"});}n(Le,"clearAccessCookieFromConfig");function xe(e,r){let t=e.req.header("authorization");return t?.startsWith("Bearer ")?t.slice(7):q(e.req.header("cookie"),Ee(r))}n(xe,"getCurrentAccessToken");function F(e){let r=e.logger??D,t=e.loggerService??"sentri";return e.mode==="client"?Xr(e.keyUri,r,t):Gr(e,r,t)}n(F,"protect");function Xr(e,r,t){return async(s,i)=>{let a=s.req.header("authorization"),d=a?.startsWith("Bearer ")?a.slice(7):void 0,h=s.get("requestId");if(!d)throw r.warn(p(t,"auth.protect.failure",{mode:"client",errorCode:"UNAUTHORIZED",...h!==void 0&&{requestId:h}})),new l("UNAUTHORIZED","Missing or malformed Authorization header");try{let u=await tr(e),c=fr(d,u);s.set("user",{id:c.id,roles:c.roles}),r.info(p(t,"auth.protect.success",{mode:"client",userId:c.id,...h!==void 0&&{requestId:h}})),await i();}catch(u){let c=u instanceof l?u.code:"TOKEN_INVALID";throw r.warn(p(t,"auth.protect.failure",{mode:"client",errorCode:c,...h!==void 0&&{requestId:h}})),u}}}n(Xr,"protectClient");function Gr(e,r,t){return async(s,i)=>{let a=xe(s,e),d=s.get("requestId");if(!a)throw r.warn(p(t,"auth.protect.failure",{mode:"server",errorCode:"UNAUTHORIZED",...d!==void 0&&{requestId:d}})),new l("UNAUTHORIZED","Missing or malformed Authorization header");try{let h=ce(a,e);if(e.isTokenRevoked&&await e.isTokenRevoked(h.sessionId))throw r.warn(p(t,"auth.protect.token_revoked",{mode:"server",userId:h.id,...d!==void 0&&{requestId:d}})),new l("UNAUTHORIZED","Token has been revoked");s.set("user",{id:h.id,roles:h.roles}),r.info(p(t,"auth.protect.success",{mode:"server",userId:h.id,...d!==void 0&&{requestId:d}})),await i();}catch(h){if(h instanceof l&&h.code==="TOKEN_EXPIRED"){let u=q(s.req.header("cookie"),U(e));if(!u)throw r.warn(p(t,"auth.protect.failure",{mode:"server",errorCode:"TOKEN_EXPIRED",...d!==void 0&&{requestId:d}})),new l("UNAUTHORIZED","Token expired. Please login again.");let c;try{c=await H(u,e);}catch{throw r.warn(p(t,"auth.protect.failure",{mode:"server",errorCode:"TOKEN_EXPIRED",...d!==void 0&&{requestId:d}})),new l("UNAUTHORIZED","Session expired. Please login again.")}if(!c.success)throw r.warn(p(t,"auth.protect.failure",{mode:"server",errorCode:c.error.code,...d!==void 0&&{requestId:d}})),new l("UNAUTHORIZED","Session expired. Please login again.");te(s,c.refreshToken,e),se(s,c.accessToken,e),s.header("X-New-Access-Token",c.accessToken),s.set("user",c.user),r.info(p(t,"auth.protect.auto_refresh",{mode:"server",userId:c.user.id,...d!==void 0&&{requestId:d}})),await i();}else {let u=h instanceof l?h.code:"TOKEN_INVALID";throw r.warn(p(t,"auth.protect.failure",{mode:"server",errorCode:u,...d!==void 0&&{requestId:d}})),h}}}}n(Gr,"protectServer");function Dr(e,r,t){let s=`Requires one of roles: ${e.join(", ")}`;return async(i,a)=>{let d=i.get("user"),h=i.get("requestId");if(!d)throw r.warn(p(t,"auth.authorize.unauthenticated",{requiredRoles:e,...h!==void 0&&{requestId:h}})),new l("UNAUTHORIZED","Not authenticated");let u=d.roles;if(!e.some(c=>u.includes(c)))throw r.warn(p(t,"auth.authorize.denied",{userId:d.id,userRoles:[...u],requiredRoles:e,...h!==void 0&&{requestId:h}})),new l("FORBIDDEN",s);r.info(p(t,"auth.authorize.passed",{userId:d.id,userRoles:[...u],requiredRoles:e,...h!==void 0&&{requestId:h}})),await a();}}n(Dr,"createAuthorizeHandler");function ne(e,r){return n(function(...s){return Dr(s,e,r)},"authorize")}n(ne,"createAuthorize");function Wr(...e){return Dr(e,D,"sentri")}n(Wr,"authorize");var Zr=new l("FORBIDDEN","You do not have permission to perform this action");function Sr(e,r,t){return async(s,i)=>{let a=s.get("user"),d=s.get("requestId");if(!a)throw r.warn(p(t,"auth.permit.unauthenticated",{...d!==void 0&&{requestId:d}})),new l("UNAUTHORIZED","Not authenticated");let h=a.id;if(e.roles&&e.roles.length>0){let u=a.roles;if(e.roles.some(c=>u.includes(c))){r.info(p(t,"auth.permit.role_bypass",{userId:h,bypassedByRole:true,...d!==void 0&&{requestId:d}})),await i();return}}try{let u=e.check(s);if(u instanceof Promise?await u:u)r.info(p(t,"auth.permit.passed",{userId:h,...d!==void 0&&{requestId:d}})),await i();else throw r.warn(p(t,"auth.permit.denied",{userId:h,...d!==void 0&&{requestId:d}})),Zr}catch(u){throw u}}}n(Sr,"createPermitHandler");function oe(e,r){return n(function(s){return Sr(typeof s=="function"?{check:s}:s,e,r)},"permit")}n(oe,"createPermit");function Jr(e){return Sr(typeof e=="function"?{check:e}:e,D,"sentri")}n(Jr,"permit");function ie(e){return (r,t)=>r instanceof l?t.json({error:true,statusCode:r.statusCode,code:r.code,message:r.message,data:null},r.statusCode):(e?.onUnhandled?.(r),t.json({error:true,statusCode:500,code:"INTERNAL_SERVER_ERROR",message:"Internal server error",data:null},500))}n(ie,"createErrorHandler");var qe=class{static{n(this,"InMemoryRateLimiter");}store=new Map;constructor(){setInterval(()=>{let r=Date.now();for(let[t,s]of this.store.entries())s.expiresAt<r&&this.store.delete(t);},6e4).unref();}async consume(r,t,s){let i=Date.now(),a=this.store.get(r);if((!a||a.expiresAt<i)&&(a={count:0,expiresAt:i+s},this.store.set(r,a)),a.count>t){let d=Math.ceil((a.expiresAt-i)/1e3);throw new Error(`Rate limit exceeded. Try again in ${d} seconds.`)}a.count++;}},Fe=class{static{n(this,"RedisRateLimiter");}redis;logger;constructor(r,t){this.redis=r,this.logger=t;}async consume(r,t,s){let i=`sentri:rl:${r}`,a=Math.ceil(s/1e3);try{let d=await this.redis.multi().incr(i).expire(i,a,"NX").exec();if(!d||d.length===0)return;if(d[0][1]>t)throw new Error("Rate limit exceeded. Try again later.")}catch(d){if(d instanceof Error&&d.message.includes("Rate limit exceeded"))throw d;this.logger.error({msg:"Redis RateLimiter failed, bypassing limit",error:d});}}},V=null;async function Cr(e,r){if(V)return V;if(e)try{let{Redis:t}=await import('ioredis'),s=new t(e,{lazyConnect:!0,maxRetriesPerRequest:1});return await s.connect(),r?.info({msg:"Connected to Redis for Rate Limiting"}),V=new Fe(s,r??D),V}catch(t){r?.warn({msg:"Failed to connect to Redis for Rate Limiting, falling back to InMemoryRateLimiter",error:t});}return V=new qe,V}n(Cr,"getRateLimiter");var Ne=8,j=72,De=255,Or=100,M=50;function g(e){return new l("VALIDATION_ERROR",e)}n(g,"badRequest");function N(e,r,t,s){return e.json({error:false,statusCode:r,message:t,data:s},r)}n(N,"ok");function b(e,r){return e.json({error:true,statusCode:r.statusCode,code:r.code,message:r.message,data:null},r.statusCode)}n(b,"fail");async function P(e){try{let r=await e.req.json();if(r==null||typeof r!="object"||Array.isArray(r))throw new l("VALIDATION_ERROR","Request body is missing or not a JSON object. Did you set Content-Type: application/json?");return r}catch(r){throw r instanceof l?r:new l("VALIDATION_ERROR","Invalid JSON body. Did you set Content-Type: application/json?")}}n(P,"parseBody");function Qr(e,r){if(!r.apiKey)return;let t=e.req.header("x-api-key");if(typeof t!="string"||t!==r.apiKey)throw new l("UNAUTHORIZED","Invalid or missing API key")}n(Qr,"validateApiKey");function Pe(e){if(e)try{let r=e();r instanceof Promise&&r.catch(()=>{});}catch{}}n(Pe,"fireHook");function et(e){return e.startsWith("RS")||e.startsWith("PS")}n(et,"isRSA");function Ke(e,r){if(typeof e!="object"||e===null||Array.isArray(e))throw g(`identifiers[${r}] must be an object`);let t=e;if(typeof t.type!="string"||t.type.trim().length===0)throw g(`identifiers[${r}].type is required and must be a non-empty string`);if(t.type.length>Or)throw g(`identifiers[${r}].type must not exceed ${Or} characters`);if(typeof t.value!="string"||t.value.trim().length===0)throw g(`identifiers[${r}].value is required and must be a non-empty string`);if(t.value.length>De)throw g(`identifiers[${r}].value must not exceed ${De} characters`);return {type:t.type,value:t.value}}n(Ke,"validateIdentifierInput");function _(e){let r=e.get("requestId");return r!==void 0?{requestId:r}:{}}n(_,"reqId");function br(e){let r=new hono.Hono,t=e,s=R(t),i=e.logger??D,a=e.loggerService??"sentri",d=F(e),h=ne(i,a),u=oe(i,a),c=Cr(e.redisUrl,i),A=e.router?.register??(o=>pe(o,t)),C=e.router?.login??(o=>me(o,t)),x=e.router?.refresh??(o=>H(o,t)),O=e.router?.logout??(o=>o!==void 0?ye(o,t):Promise.resolve()),v=e.router?.logoutAll??(o=>Ie(o,t)),L=e.router?.getUser??(o=>ge(o,t)),ae=e.router?.assignRoles??((o,w)=>_e(o,w,t)),ue=e.router?.changePassword??((o,w,f)=>Re(o,w,f,t)),Ur=e.router?.bulkCreateIdentifiers??((o,w)=>ve(o,w,t)),Lr=e.router?.bulkUpdateIdentifiers??((o,w)=>Ae(o,w,t)),qr=e.router?.bulkDeleteIdentifiers??((o,w)=>ke(o,w,t)),de=u(o=>!!o.get("user"));return r.onError(ie()),et(s.algorithm)&&r.get("/keys",o=>(o.header("Cache-Control","public, max-age=3600"),o.json(er(e.secret)))),r.post("/register",async o=>{let w=Date.now();try{Qr(o,e);let f=await P(o),{identifiers:y,password:I,roles:m}=f;if(!Array.isArray(y)||y.length===0)throw g("identifiers is required and must be a non-empty array");if(y.length>M)throw g(`identifiers must not exceed ${M} entries`);let k=y.map((X,Se)=>Ke(X,Se));if(typeof I!="string"||I.length<Ne)throw g(`password is required and must be at least ${Ne} characters`);if(I.length>j)throw g(`password must not exceed ${j} characters`);if(m!==void 0&&!Array.isArray(m))throw g("roles must be an array of strings when provided");if(Array.isArray(m)&&!m.every(X=>typeof X=="string"))throw g("each role must be a string");let S=Array.isArray(m)?m:void 0,E=S!==void 0?{identifiers:k,password:I,roles:S}:{identifiers:k,password:I},K=o.req.header("x-forwarded-for")||o.env?.incoming?.ip||"127.0.0.1",B=o.req.header("user-agent")||"Unknown";if(e.rateLimit!==!1){let X=await c,Se=typeof e.rateLimit=="object"?e.rateLimit.maxRegisterAttempts??5:5;await X.consume(`register:${K}`,Se,900*1e3);}let z=await A(E,{ip:K,userAgent:B});return z.success?(i.info(p(a,"auth.register.success",{userId:z.user.id,duration_ms:Date.now()-w,..._(o)})),N(o,201,"User registered successfully",{user:z.user})):(i.warn(p(a,"auth.register.failure",{errorCode:z.error.code,duration_ms:Date.now()-w,..._(o)})),b(o,z.error))}catch(f){throw f}}),r.post("/login",async o=>{let w=Date.now();try{let f=await P(o),{identifier:y,password:I}=f;if(typeof y!="string"||y.trim().length===0)throw g("identifier is required and must be a non-empty string");if(y.length>De)throw g(`identifier must not exceed ${De} characters`);if(typeof I!="string"||I.length===0)throw g("password is required");if(I.length>j)throw g(`password must not exceed ${j} characters`);let m=y.trim(),k=o.req.header("x-forwarded-for")||o.env?.incoming?.ip||"127.0.0.1",S=o.req.header("user-agent")||"Unknown";if(e.rateLimit!==!1){let K=await c,B=typeof e.rateLimit=="object"?e.rateLimit.maxLoginAttempts??5:5;await K.consume(`login:${k}`,B,900*1e3);}let E=await C({identifier:m,password:I},{ip:k,userAgent:S});return E.success?(Pe(()=>e.hooks?.onLoginSuccess?.(E.user,{ip:k,userAgent:S})),te(o,E.refreshToken,e),se(o,E.accessToken,e),i.info(p(a,"auth.login.success",{userId:E.user.id,duration_ms:Date.now()-w,..._(o)})),N(o,200,"Login successful",{accessToken:E.accessToken,user:E.user})):(Pe(()=>e.hooks?.onLoginFailed?.(m,E.error,{ip:k})),i.warn(p(a,"auth.login.failure",{errorCode:E.error.code,duration_ms:Date.now()-w,..._(o)})),b(o,E.error))}catch(f){throw f}}),r.post("/refresh",async o=>{let w=Date.now();try{let f=q(o.req.header("cookie"),U(e));if(!f)throw new l("UNAUTHORIZED","Refresh token cookie is missing");let y=o.req.header("x-forwarded-for")||o.env?.incoming?.ip||"127.0.0.1",I=o.req.header("user-agent")||"Unknown",m=await x(f,{ip:y,userAgent:I});return m.success?(te(o,m.refreshToken,e),se(o,m.accessToken,e),i.info(p(a,"auth.refresh.success",{userId:m.user.id,duration_ms:Date.now()-w,..._(o)})),N(o,200,"Token refreshed",{accessToken:m.accessToken})):(Te(o,e),i.warn(p(a,"auth.refresh.failure",{errorCode:m.error.code,duration_ms:Date.now()-w,..._(o)})),b(o,m.error))}catch(f){throw f}}),r.post("/logout",async o=>{let w=Date.now();try{let f=q(o.req.header("cookie"),U(e));return await O(f),Te(o,e),Le(o,e),i.info(p(a,"auth.logout",{duration_ms:Date.now()-w,..._(o)})),N(o,200,"Logged out",null)}catch(f){throw f}}),r.post("/logout-all",d,async o=>{let w=Date.now();try{let f=o.get("user").id;return await v(f),Pe(()=>e.hooks?.onLogout?.(f)),Te(o,e),Le(o,e),i.info(p(a,"auth.logout_all",{userId:f,duration_ms:Date.now()-w,..._(o)})),N(o,200,"All sessions revoked",null)}catch(f){throw f}}),r.get("/me",d,async o=>{let w=Date.now();try{let f=await L(o.get("user").id);return f.success?(i.info(p(a,"auth.me.success",{userId:f.user.id,duration_ms:Date.now()-w,..._(o)})),N(o,200,"OK",f.user)):(i.warn(p(a,"auth.me.failure",{userId:o.get("user").id,errorCode:f.error.code,duration_ms:Date.now()-w,..._(o)})),b(o,f.error))}catch(f){throw f}}),r.get("/me/identifiers",d,async o=>{let w=Date.now();try{let f=await L(o.get("user").id);return f.success?(i.info(p(a,"auth.me.identifiers.success",{userId:f.user.id,count:f.user.identifiers?.length??0,duration_ms:Date.now()-w,..._(o)})),N(o,200,"OK",{identifiers:f.user.identifiers??[]})):(i.warn(p(a,"auth.me.identifiers.failure",{userId:o.get("user").id,errorCode:f.error.code,duration_ms:Date.now()-w,..._(o)})),b(o,f.error))}catch(f){throw f}}),r.post("/me/identifiers",d,de,async o=>{let w=Date.now();try{let f=await P(o),{identifiers:y}=f;if(!Array.isArray(y)||y.length===0)throw g("identifiers is required and must be a non-empty array");if(y.length>M)throw g(`identifiers must not exceed ${M} entries`);let I=y.map((k,S)=>Ke(k,S)),m=await Ur(o.get("user").id,I);return m.success?(i.info(p(a,"auth.identifiers.created",{userId:o.get("user").id,count:m.identifiers.length,duration_ms:Date.now()-w,..._(o)})),N(o,201,"Identifiers added successfully",{identifiers:m.identifiers})):(i.warn(p(a,"auth.identifiers.create_failure",{userId:o.get("user").id,errorCode:m.error.code,duration_ms:Date.now()-w,..._(o)})),b(o,m.error))}catch(f){throw f}}),r.put("/me/identifiers",d,de,async o=>{let w=Date.now();try{let f=await P(o),{identifiers:y}=f;if(!Array.isArray(y)||y.length===0)throw g("identifiers is required and must be a non-empty array");if(y.length>M)throw g(`identifiers must not exceed ${M} entries`);let I=y.map((k,S)=>{if(typeof k!="object"||k===null||Array.isArray(k))throw g(`identifiers[${S}] must be an object`);let E=k;if(typeof E.id!="string"||E.id.trim().length===0)throw g(`identifiers[${S}].id is required and must be a non-empty string`);let{type:K,value:B}=Ke(k,S);return {id:E.id,type:K,value:B}}),m=await Lr(o.get("user").id,I);return m.success?(i.info(p(a,"auth.identifiers.updated",{userId:o.get("user").id,count:m.identifiers.length,duration_ms:Date.now()-w,..._(o)})),N(o,200,"Identifiers updated successfully",{identifiers:m.identifiers})):(i.warn(p(a,"auth.identifiers.update_failure",{userId:o.get("user").id,errorCode:m.error.code,duration_ms:Date.now()-w,..._(o)})),b(o,m.error))}catch(f){throw f}}),r.delete("/me/identifiers",d,de,async o=>{let w=Date.now();try{let f=await P(o),{ids:y}=f;if(!Array.isArray(y)||y.length===0)throw g("ids is required and must be a non-empty array of strings");if(!y.every(m=>typeof m=="string"))throw g("each id must be a string");let I=await qr(o.get("user").id,y);return I.success?(i.info(p(a,"auth.identifiers.deleted",{userId:o.get("user").id,duration_ms:Date.now()-w,..._(o)})),N(o,200,"Identifiers deleted successfully",{identifiers:I.identifiers})):(i.warn(p(a,"auth.identifiers.delete_failure",{userId:o.get("user").id,errorCode:I.error.code,duration_ms:Date.now()-w,..._(o)})),b(o,I.error))}catch(f){throw f}}),r.patch("/me/password",d,de,async o=>{let w=Date.now();try{let f=await P(o),{currentPassword:y,newPassword:I}=f;if(typeof y!="string"||y.length===0)throw g("currentPassword is required");if(typeof I!="string"||I.length<Ne)throw g(`newPassword must be at least ${Ne} characters`);if(I.length>j)throw g(`newPassword must not exceed ${j} characters`);if(y===I)throw g("newPassword must be different from currentPassword");let m=await ue(o.get("user").id,y,I);return m.success?(i.info(p(a,"auth.password.changed",{userId:o.get("user").id,duration_ms:Date.now()-w,..._(o)})),N(o,200,"Password updated successfully. All sessions have been revoked.",null)):(i.warn(p(a,"auth.password.change_failure",{userId:o.get("user").id,errorCode:m.error.code,duration_ms:Date.now()-w,..._(o)})),b(o,m.error))}catch(f){throw f}}),r.post("/users/:userId/roles",d,h("admin"),async o=>{let w=Date.now();try{let f=await P(o),{roles:y}=f,I=o.req.param("userId");if(!I)throw g("userId is required");if(!Array.isArray(y)||y.length===0)throw g("roles must be a non-empty array of strings");if(!y.every(k=>typeof k=="string"))throw g("each role must be a string");let m=await ae(I,y);return m.success?(i.info(p(a,"auth.roles.assigned",{targetUserId:I,roles:y,duration_ms:Date.now()-w,..._(o)})),N(o,200,"Roles assigned successfully",{user:m.user})):(i.warn(p(a,"auth.roles.assign_failure",{targetUserId:I,errorCode:m.error.code,duration_ms:Date.now()-w,..._(o)})),b(o,m.error))}catch(f){throw f}}),r.get("/sessions",F(e),async o=>{let w=Date.now(),f=o.get("user").id,I=await(e.router?.getSessions??(m=>kr(m,t)))(f);return i.info(p(a,"auth.sessions.get",{userId:f,duration_ms:Date.now()-w,..._(o)})),N(o,200,"OK",{sessions:I})}),r.delete("/sessions/:id",F(e),async o=>{let w=Date.now(),f=o.get("user").id,y=o.req.param("id");return await(e.router?.revokeSession??((m,k)=>Er(m,k,t)))(f,y),i.info(p(a,"auth.sessions.revoke",{userId:f,sessionId:y,duration_ms:Date.now()-w,..._(o)})),N(o,200,"Session revoked",null)}),r}n(br,"createAuthRouter");function zs(e){if(e.mode==="client"){let u={mode:"client",keyUri:e.keyUri,...e.validRoles!==void 0&&{validRoles:e.validRoles},...e.logger!==void 0&&{logger:e.logger},...e.loggerService!==void 0&&{loggerService:e.loggerService}};ze(u);let c=u.logger??D,A=u.loggerService??"sentri",C=ne(c,A),x=oe(c,A);return {protect:n(()=>F(u),"protect"),authorize:n((...O)=>C(...O),"authorize"),permit:n(O=>x(O),"permit"),errorHandler:n(O=>ie(O),"errorHandler")}}let{privateKey:r}=crypto.generateKeyPairSync("rsa",{modulusLength:2048,privateKeyEncoding:{type:"pkcs8",format:"pem"},publicKeyEncoding:{type:"spki",format:"pem"}}),t={mode:"server",dialect:e.dialect,secret:r,algorithm:"RS256",validRoles:e.validRoles,...e.validIdentifiers!==void 0&&{validIdentifiers:e.validIdentifiers},...e.accessExpiresIn!==void 0&&{accessExpiresIn:e.accessExpiresIn},...e.refreshExpiresIn!==void 0&&{refreshExpiresIn:e.refreshExpiresIn},...e.saltRounds!==void 0&&{saltRounds:e.saltRounds},...e.apiKey!==void 0&&{apiKey:e.apiKey},...e.cookie!==void 0&&{cookie:e.cookie},...e.accessCookie!==void 0&&{accessCookie:e.accessCookie},...e.hooks!==void 0&&{hooks:e.hooks},...e.router!==void 0&&{router:e.router},...e.isTokenRevoked!==void 0&&{isTokenRevoked:e.isTokenRevoked},...e.redisUrl!==void 0&&{redisUrl:e.redisUrl},...e.logger!==void 0&&{logger:e.logger},...e.loggerService!==void 0&&{loggerService:e.loggerService}},s=t.logger??D,i=t.loggerService??"sentri",a=R(t),d=ne(s,i),h=oe(s,i);return {protect:n(()=>F(t),"protect"),authorize:n((...u)=>d(...u),"authorize"),permit:n(u=>h(u),"permit"),errorHandler:n(u=>ie(u),"errorHandler"),router:n(()=>br(t),"router"),migrate:n(()=>Xe(T(t.dialect)),"migrate"),getCurrentAccessToken:n(u=>xe(u,t),"getCurrentAccessToken"),hashPassword:n(u=>G(u,a.saltRounds),"hashPassword"),verifyPassword:n((u,c)=>W(u,c),"verifyPassword"),signAccessToken:n(u=>J(u,t),"signAccessToken"),signRefreshToken:n(u=>Y(u,t),"signRefreshToken"),verifyAccessToken:n(u=>ce(u,t),"verifyAccessToken"),verifyRefreshToken:n(u=>Q(u,t),"verifyRefreshToken"),register:n(u=>pe(u,t),"register"),login:n(u=>me(u,t),"login"),refresh:n(u=>H(u,t),"refresh"),logout:n(u=>ye(u,t),"logout"),logoutAll:n(u=>Ie(u,t),"logoutAll"),getUser:n(u=>ge(u,t),"getUser"),changePassword:n((u,c,A)=>Re(u,c,A,t),"changePassword"),assignRoles:n((u,c)=>_e(u,c,t),"assignRoles"),bulkCreateIdentifiers:n((u,c)=>ve(u,c,t),"bulkCreateIdentifiers"),bulkUpdateIdentifiers:n((u,c)=>Ae(u,c,t),"bulkUpdateIdentifiers"),bulkDeleteIdentifiers:n((u,c)=>ke(u,c,t),"bulkDeleteIdentifiers")}}n(zs,"createAuthHono");exports.SENTRI_ERROR_STATUS=$e;exports.SentriError=l;exports.authorize=Wr;exports.createAuthHono=zs;exports.createAuthRouter=br;exports.createAuthorize=ne;exports.createErrorHandler=ie;exports.createPermit=oe;exports.getCurrentAccessToken=xe;exports.permit=Jr;exports.protect=F;

package/dist/adapters/hono/index.d.cts

@@ -0,0 +1,129 @@
+import * as kysely from 'kysely';
+import { MiddlewareHandler, Context, Next, Hono } from 'hono';
+import { AuthUser, AuthConfig, SentriLogger, ServerAuthConfig, CookieConfig, AccessCookieConfig, AuthHooks, RouterHandlers, RegisterInput, RegisterResult, LoginInput, AuthResult, RefreshResult, GetUserResult, ChangePasswordResult, AssignRolesResult, IdentifierInput, BulkIdentifiersResult } from '../../core/index.cjs';
+export { ApiResponse, ClientAuthConfig, IdentifierRecord, SENTRI_ERROR_STATUS, SentriError, SentriErrorCode } from '../../core/index.cjs';
+
+interface SentriHonoVariables {
+    user: AuthUser | undefined;
+    requestId: string | undefined;
+}
+type SentriHonoEnv = {
+    Variables: SentriHonoVariables;
+};
+type SentriHonoMiddleware = MiddlewareHandler<SentriHonoEnv>;
+
+declare function protect(config: AuthConfig): (c: Context<SentriHonoEnv>, next: Next) => Promise<Response | void>;
+
+declare function createAuthorize(logger: SentriLogger, service: string): <TRole extends string>(...allowedRoles: TRole[]) => SentriHonoMiddleware;
+declare function authorize<TRole extends string>(...allowedRoles: TRole[]): SentriHonoMiddleware;
+
+/** A function that determines whether the current request is permitted. */
+type HonoPermitCheck = (c: Context<SentriHonoEnv>) => boolean | Promise<boolean>;
+/**
+ * Options for {@link permit} when you need role-bypass alongside a resource check.
+ *
+ * @example
+ * auth.permit({
+ *   roles: ['admin'],
+ *   check: async (c) => {
+ *     const post = await db.findPost(c.req.param('id'));
+ *     return post?.authorId === c.get('user')!.id;
+ *   },
+ * })
+ */
+interface HonoPermitOptions<TRole extends string> {
+    roles?: TRole[];
+    check: HonoPermitCheck;
+}
+declare function createPermit(logger: SentriLogger, service: string): <TRole extends string>(optionsOrCheck: HonoPermitOptions<TRole> | HonoPermitCheck) => SentriHonoMiddleware;
+declare function permit<TRole extends string>(optionsOrCheck: HonoPermitOptions<TRole> | HonoPermitCheck): SentriHonoMiddleware;
+
+interface HonoErrorHandlerOptions {
+    onUnhandled?: (error: unknown) => void;
+}
+type HonoErrorHandler = (err: Error, c: Context) => Response | Promise<Response>;
+declare function createErrorHandler(options?: HonoErrorHandlerOptions): HonoErrorHandler;
+
+declare function getCurrentAccessToken(c: Context, config: ServerAuthConfig): string | undefined;
+
+declare function createAuthRouter<TRole extends string>(config: ServerAuthConfig<TRole>): Hono<SentriHonoEnv>;
+
+interface CreateHonoServerOptions<TRole extends string = string> {
+    mode: 'server';
+    validRoles: readonly TRole[];
+    validIdentifiers?: readonly string[];
+    dialect: kysely.Dialect;
+    accessExpiresIn?: string | number;
+    refreshExpiresIn?: string | number;
+    saltRounds?: number;
+    apiKey?: string;
+    cookie?: CookieConfig;
+    accessCookie?: AccessCookieConfig;
+    hooks?: AuthHooks;
+    router?: RouterHandlers;
+    isTokenRevoked?: (sessionId: string) => boolean | Promise<boolean>;
+    redisUrl?: string;
+    logger?: SentriLogger;
+    loggerService?: string;
+}
+interface CreateHonoClientOptions<TRole extends string = string> {
+    mode: 'client';
+    keyUri: string;
+    validRoles?: readonly TRole[];
+    logger?: SentriLogger;
+    loggerService?: string;
+}
+interface HonoAuthClient<TRole extends string = string> {
+    /** Middleware that ensures the request has a valid access token. Attaches `c.get('user')`. */
+    protect(): SentriHonoMiddleware;
+    /** Middleware that ensures the user has AT LEAST ONE of the required roles. */
+    authorize(...roles: TRole[]): SentriHonoMiddleware;
+    /** Middleware that evaluates a custom authorization condition or ABAC rules. */
+    permit(check: HonoPermitCheck): SentriHonoMiddleware;
+    permit(options: HonoPermitOptions<TRole>): SentriHonoMiddleware;
+    /** Hono error handler that converts Sentri errors to standardized JSON responses. */
+    errorHandler(options?: HonoErrorHandlerOptions): HonoErrorHandler;
+}
+interface HonoServerAuthClient<TRole extends string = string> extends HonoAuthClient<TRole> {
+    /** Returns a Hono router containing all auth endpoints (e.g. POST /register). */
+    router(): Hono<SentriHonoEnv>;
+    /** Runs Kysely database migrations for Sentri tables. */
+    migrate(): Promise<void>;
+    getCurrentAccessToken(c: Context): string | undefined;
+    hashPassword(plain: string): Promise<string>;
+    verifyPassword(plain: string, hash: string): Promise<boolean>;
+    signAccessToken(payload: AuthUser<TRole>): string;
+    signRefreshToken(sessionId: string): string;
+    verifyAccessToken(token: string): AuthUser<TRole>;
+    verifyRefreshToken(token: string): {
+        sessionId: string;
+    };
+    register(input: RegisterInput<TRole>): Promise<RegisterResult<TRole>>;
+    login(input: LoginInput): Promise<AuthResult<TRole>>;
+    refresh(refreshToken: string): Promise<RefreshResult<TRole>>;
+    logout(refreshToken: string): Promise<void>;
+    logoutAll(userId: string): Promise<void>;
+    getUser(userId: string): Promise<GetUserResult<TRole>>;
+    changePassword(userId: string, currentPassword: string, newPassword: string): Promise<ChangePasswordResult>;
+    assignRoles(userId: string, roles: TRole[]): Promise<AssignRolesResult<TRole>>;
+    bulkCreateIdentifiers(userId: string, identifiers: IdentifierInput[]): Promise<BulkIdentifiersResult>;
+    bulkUpdateIdentifiers(userId: string, updates: Array<{
+        id: string;
+        type: string;
+        value: string;
+    }>): Promise<BulkIdentifiersResult>;
+    bulkDeleteIdentifiers(userId: string, ids: string[]): Promise<BulkIdentifiersResult>;
+}
+type HonoClientAuthClient<TRole extends string = string> = HonoAuthClient<TRole>;
+/**
+ * Creates a Hono authentication client (Server Mode).
+ * Configures database connections, handles registration, issues tokens, and mounts endpoints.
+ */
+declare function createAuthHono<TRole extends string = string>(options: CreateHonoServerOptions<TRole>): HonoServerAuthClient<TRole>;
+/**
+ * Creates a Hono authentication client (Client Mode).
+ * Used for microservices that only verify tokens issued by a separate auth server.
+ */
+declare function createAuthHono<TRole extends string = string>(options: CreateHonoClientOptions<TRole>): HonoClientAuthClient<TRole>;
+
+export { AccessCookieConfig, AssignRolesResult, AuthConfig, AuthHooks, AuthResult, AuthUser, BulkIdentifiersResult, ChangePasswordResult, CookieConfig, type CreateHonoClientOptions, type CreateHonoServerOptions, GetUserResult, type HonoAuthClient, type HonoClientAuthClient, type HonoErrorHandler, type HonoErrorHandlerOptions, type HonoPermitCheck, type HonoPermitOptions, type HonoServerAuthClient, IdentifierInput, LoginInput, RefreshResult, RegisterInput, RegisterResult, RouterHandlers, type SentriHonoEnv, type SentriHonoMiddleware, type SentriHonoVariables, SentriLogger, ServerAuthConfig, authorize, createAuthHono, createAuthRouter, createAuthorize, createErrorHandler, createPermit, getCurrentAccessToken, permit, protect };