sentri 5.0.0 → 5.0.2

package/README.md

@@ -350,6 +350,7 @@ const auth = createAuthServer({
   saltRounds: 12,
   apiKey: process.env.REGISTER_API_KEY,
   redisUrl: process.env.REDIS_URL, // enables Redis-backed idempotency cache
+  rateLimit: { maxLoginAttempts: 5, maxRegisterAttempts: 5 }, // default 5 attempts per 15 min
 });
 ```
 
@@ -369,7 +370,8 @@ createAuth({
   refreshExpiresIn: "7d", // default: '7d'
   saltRounds: 12, // default: 12 (bcrypt rounds, 10–31)
   apiKey: process.env.REGISTER_API_KEY, // restricts POST /register
-  redisUrl: process.env.REDIS_URL, // Redis URL for idempotency cache
+  redisUrl: process.env.REDIS_URL, // Redis URL for idempotency cache & rate limiter
+  rateLimit: { maxLoginAttempts: 5, maxRegisterAttempts: 5 }, // optional rate limiting config
   cookie: { secure: true }, // httpOnly refresh token cookie
   accessCookie: { secure: true }, // non-httpOnly access token cookie (SPA)
   hooks: { onLogin, onFailedLogin, onLogout },
@@ -751,6 +753,7 @@ app.onError(auth.errorHandler());
 | `FORBIDDEN`                 | 403  | Authenticated but missing required role                            |
 | `INVALID_ROLE`              | 400  | Role not in `validRoles`                                           |
 | `VALIDATION_ERROR`          | 400  | Missing or invalid input                                           |
+| `RATE_LIMIT_EXCEEDED`       | 429  | Too many requests to an endpoint                                   |
 | `CONFIGURATION_ERROR`       | 500  | Invalid `createAuth` config                                        |
 
 ### Extending `SentriError`

package/dist/adapters/elysia/index.cjs

@@ -1 +1 @@
-'use strict';var crypto=require('crypto'),kysely=require('kysely'),Ge=require('bcrypt'),Y=require('jsonwebtoken'),elysia=require('elysia');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var Ge__default=/*#__PURE__*/_interopDefault(Ge);var Y__default=/*#__PURE__*/_interopDefault(Y);var Nr=Object.defineProperty;var o=(e,r)=>Nr(e,"name",{value:r,configurable:true});var $e=Object.assign(Object.create(null),{UNAUTHORIZED:401,TOKEN_EXPIRED:401,TOKEN_INVALID:401,INVALID_CREDENTIALS:401,FORBIDDEN:403,USER_NOT_FOUND:404,IDENTIFIER_NOT_FOUND:404,USER_ALREADY_EXISTS:409,IDENTIFIER_ALREADY_EXISTS:409,INVALID_ROLE:400,VALIDATION_ERROR:400,CONFIGURATION_ERROR:500,TOKEN_REUSE:401}),a=class extends Error{static{o(this,"SentriError");}code;statusCode;constructor(r,t,s){super(t),this.name="SentriError",this.code=r,this.statusCode=s??$e[r]??500;}};var Ve=new WeakMap,Me=32,qe=10,Be=31;function ze(e){if(e.mode==="client"){if(!e.keyUri||e.keyUri.trim().length===0)throw new a("CONFIGURATION_ERROR","keyUri must not be empty");return}if(!e.secret||e.secret.trim().length===0)throw new a("CONFIGURATION_ERROR","secret must not be empty");if((e.algorithm??"HS256").startsWith("HS")&&e.secret.length<Me)throw new a("CONFIGURATION_ERROR",`secret must be at least ${Me} characters for HMAC algorithms`);let s=e.saltRounds??12;if(!Number.isInteger(s)||s<qe||s>Be)throw new a("CONFIGURATION_ERROR",`saltRounds must be an integer between ${qe} and ${Be}`);if(!e.validRoles||e.validRoles.length===0)throw new a("CONFIGURATION_ERROR","validRoles must contain at least one role");if(!e.dialect)throw new a("CONFIGURATION_ERROR","dialect is required in server mode")}o(ze,"validateConfig");function A(e){let r=Ve.get(e);if(r)return r;let t={algorithm:e.algorithm??"HS256",accessExpiresIn:e.accessExpiresIn??"15m",refreshExpiresIn:e.refreshExpiresIn??"7d",saltRounds:e.saltRounds??12,validRoles:e.validRoles,validRolesSet:new Set(e.validRoles),cookieName:e.cookie?.name??"refresh_token",accessCookieName:e.accessCookie?.name??"access_token"};return Ve.set(e,t),t}o(A,"resolveServerConfig");var Dr=/^(\d+)([smhdw])$/,Sr={s:1e3,m:6e4,h:36e5,d:864e5,w:6048e5},je=new Map;function $(e){if(typeof e=="number")return e*1e3;let r=je.get(e);if(r!==void 0)return r;let t=Dr.exec(e);if(!t?.[1]||!t?.[2])throw new Error(`Invalid expiresIn: "${e}". Use e.g. "15m", "7d", "1h".`);let s=Sr[t[2]];if(s===void 0)throw new Error(`Invalid expiresIn: "${e}". Use e.g. "15m", "7d", "1h".`);let n=parseInt(t[1],10)*s;return je.set(e,n),n}o($,"parseExpiry");var S={info:o(()=>{},"info"),warn:o(()=>{},"warn"),error:o(()=>{},"error")};function h(e,r,t){return {service:e,event:r,...t}}o(h,"buildLogData");async function Xe(e){await e.schema.createTable("sentri_users").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("password_hash","varchar(255)",r=>r.notNull()).addColumn("roles","text",r=>r.notNull().defaultTo("[]")).addColumn("created_at","timestamp",r=>r.notNull().defaultTo(kysely.sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createTable("sentri_sessions").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("user_id","varchar(36)",r=>r.notNull().references("sentri_users.id").onDelete("cascade")).addColumn("expires_at","timestamp",r=>r.notNull()).addColumn("ip_address","varchar(45)").addColumn("user_agent","text").addColumn("replaced_by","varchar(36)").addColumn("created_at","timestamp",r=>r.notNull().defaultTo(kysely.sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createTable("sentri_identifiers").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("user_id","varchar(36)",r=>r.notNull().references("sentri_users.id").onDelete("cascade")).addColumn("type","varchar(100)",r=>r.notNull()).addColumn("value","varchar(255)",r=>r.notNull().unique()).addColumn("created_at","timestamp",r=>r.notNull().defaultTo(kysely.sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createIndex("idx_sentri_sessions_user_id").ifNotExists().on("sentri_sessions").column("user_id").execute(),await e.schema.createIndex("idx_sentri_identifiers_user_id").ifNotExists().on("sentri_identifiers").column("user_id").execute();}o(Xe,"runMigrations");var Ze=new Map;function D(e){let r=Ze.get(e);return r||(r=new kysely.Kysely({dialect:e}),Ze.set(e,r)),r}o(D,"getDatabase");async function W(e,r=12){return Ge__default.default.hash(e,r)}o(W,"hashPassword");async function J(e,r){return Ge__default.default.compare(e,r)}o(J,"verifyPassword");var We=new Map,Je=new Map,Lr=3600*1e3;function Qe(e){let r=We.get(e);if(!r){let t=crypto.createPrivateKey(e),s=crypto.createPublicKey(t),n=s.export({format:"jwk"}),d=crypto.createHash("sha256").update(JSON.stringify({e:n.e,kty:n.kty,n:n.n})).digest("base64url"),c={...n,use:"sig",kid:d};r={kid:d,publicKey:s,jwk:c},We.set(e,r);}return r}o(Qe,"getOrBuildKey");function er(e){let{jwk:r}=Qe(e);return {keys:[r]}}o(er,"buildJwks");function rr(e){return Qe(e).publicKey}o(rr,"getPublicKeyFromPrivate");async function tr(e){let r=Date.now(),t=Je.get(e);if(t&&r-t.fetchedAt<Lr)return t.publicKey;let s=await fetch(e);if(!s.ok)throw new a("CONFIGURATION_ERROR",`Failed to fetch public key from ${e}: HTTP ${s.status}`);let n=await s.json();if(!n.keys||n.keys.length===0)throw new a("CONFIGURATION_ERROR",`No keys found in JWKS response from ${e}`);let u=n.keys[0],d=crypto.createPublicKey({key:u,format:"jwk"});return Je.set(e,{publicKey:d,fetchedAt:r}),d}o(tr,"fetchPublicKey");var sr=new Map,or=new Map,nr=new Map;function ir(e){return e.startsWith("RS")||e.startsWith("PS")}o(ir,"isRSA");function ar(e){let r=sr.get(e);return r||(r={access:`${e}:access`,refresh:`${e}:refresh`},sr.set(e,r)),r}o(ar,"getHsSecrets");function Pr(e){let r=or.get(e);return r||(r=crypto.createPrivateKey(e),or.set(e,r)),r}o(Pr,"getRsPrivateKey");function ur(e){let r=A(e);if(ir(r.algorithm)){let n=Pr(e.secret);return {accessKey:n,refreshKey:n}}let{access:t,refresh:s}=ar(e.secret);return {accessKey:t,refreshKey:s}}o(ur,"getSigningKeys");function cr(e,r){let t=A(e);if(ir(t.algorithm))return rr(e.secret);let{access:s,refresh:n}=ar(e.secret);return r==="access"?s:n}o(cr,"getVerifyKey");function dr(e,r,t,s){let n=`${t}:${s}`,u=nr.get(n);return u||(u={expiresIn:t,algorithm:s},nr.set(n,u)),Y__default.default.sign(e,r,u)}o(dr,"sign");function lr(e,r,t){try{let s=Y__default.default.verify(e,r,{algorithms:[t]});if(typeof s=="string"||s===null)throw new a("TOKEN_INVALID","Token payload is not an object");return s}catch(s){throw s instanceof a?s:s instanceof Y__default.default.TokenExpiredError?new a("TOKEN_EXPIRED","Token has expired"):new a("TOKEN_INVALID","Token is invalid or malformed")}}o(lr,"verify");function Q(e,r){let t=A(r),{accessKey:s}=ur(r);return dr(e,s,t.accessExpiresIn,t.algorithm)}o(Q,"signAccessToken");function ee(e,r){let t=A(r),{refreshKey:s}=ur(r);return dr({sessionId:e},s,t.refreshExpiresIn,t.algorithm)}o(ee,"signRefreshToken");function V(e,r){let t=A(r),s=cr(r,"access");return lr(e,s,t.algorithm)}o(V,"verifyAccessToken");function re(e,r){let t=A(r),s=cr(r,"refresh");return lr(e,s,t.algorithm)}o(re,"verifyRefreshToken");function fr(e,r){try{let t=Y__default.default.verify(e,r,{algorithms:["RS256","RS384","RS512","PS256","PS384","PS512"]});if(typeof t=="string"||t===null)throw new a("TOKEN_INVALID","Token payload is not an object");return t}catch(t){throw t instanceof a?t:t instanceof Y__default.default.TokenExpiredError?new a("TOKEN_EXPIRED","Token has expired"):new a("TOKEN_INVALID","Token is invalid or malformed")}}o(fr,"verifyTokenWithPublicKey");function xe(e){try{return JSON.parse(e)}catch{return []}}o(xe,"parseRoles");function Kr(e){return JSON.stringify(e)}o(Kr,"serializeRoles");function mr(e){return {id:e.id,userId:e.user_id,type:e.type,value:e.value,createdAt:new Date(e.created_at)}}o(mr,"mapIdentifier");async function te(e,r){let t=await e.selectFrom("sentri_identifiers as i").innerJoin("sentri_users as u","u.id","i.user_id").select(["u.id","u.password_hash","u.roles"]).where("i.value","=",r).executeTakeFirst();return t?{id:t.id,passwordHash:t.password_hash,roles:xe(t.roles)}:null}o(te,"findUserByIdentifierValue");async function ue(e,r){let t=await e.selectFrom("sentri_users").select(["id","password_hash","roles"]).where("id","=",r).executeTakeFirst();return t?{id:t.id,passwordHash:t.password_hash,roles:xe(t.roles)}:null}o(ue,"findUserById");async function pr(e,r,t){let s=t.map(n=>({id:crypto.randomUUID(),user_id:r,type:n.type,value:n.value}));return await e.insertInto("sentri_identifiers").values(s).execute(),s.map(n=>({id:n.id,userId:n.user_id,type:n.type,value:n.value,createdAt:new Date}))}o(pr,"createIdentifiers");async function se(e,r){return (await e.selectFrom("sentri_identifiers").selectAll().where("user_id","=",r).orderBy("created_at","asc").execute()).map(mr)}o(se,"findIdentifiersByUserId");async function Ce(e,r,t){let s=await e.selectFrom("sentri_identifiers").selectAll().where("id","=",r).where("user_id","=",t).executeTakeFirst();return s?mr(s):null}o(Ce,"findIdentifierById");async function wr(e,r){let t=await e.selectFrom("sentri_identifiers").select(s=>s.fn.countAll().as("count")).where("user_id","=",r).executeTakeFirst();return Number(t?.count??0)}o(wr,"countIdentifiersByUserId");async function gr(e,r,t,s){await e.updateTable("sentri_identifiers").set({type:s.type,value:s.value}).where("id","=",r).where("user_id","=",t).execute();}o(gr,"updateIdentifier");async function yr(e,r,t){await e.deleteFrom("sentri_identifiers").where("user_id","=",r).where("id","in",t).execute();}o(yr,"deleteIdentifiers");async function Ir(e,r,t){await e.updateTable("sentri_users").set({password_hash:t}).where("id","=",r).execute();}o(Ir,"updateUserPassword");async function Rr(e,r,t){await e.updateTable("sentri_users").set({roles:Kr(t)}).where("id","=",r).execute();}o(Rr,"updateUserRoles");async function Ne(e,r){let t=crypto.randomUUID();return await e.insertInto("sentri_sessions").values({id:t,user_id:r.userId,expires_at:r.expiresAt.toISOString(),ip_address:r.ipAddress??null,user_agent:r.userAgent??null}).execute(),{id:t}}o(Ne,"createSession");async function De(e,r){let t=await e.selectFrom("sentri_sessions as s").innerJoin("sentri_users as u","u.id","s.user_id").select(["s.id as session_id","s.user_id","s.expires_at","s.ip_address","s.user_agent","s.replaced_by","s.created_at as session_created_at","u.id as user_id_col","u.password_hash","u.roles"]).where("s.id","=",r).executeTakeFirst();return t?{id:t.session_id,userId:t.user_id,expiresAt:new Date(t.expires_at),ipAddress:t.ip_address,userAgent:t.user_agent,replacedBy:t.replaced_by,createdAt:new Date(t.session_created_at),user:{id:t.user_id_col,passwordHash:t.password_hash,roles:xe(t.roles)}}:null}o(De,"findSessionById");async function Se(e,r){await e.deleteFrom("sentri_sessions").where("id","=",r).execute();}o(Se,"deleteSession");async function _r(e,r,t){await e.updateTable("sentri_sessions").set({replaced_by:t}).where("id","=",r).execute();}o(_r,"markSessionReplaced");async function ce(e,r){await e.deleteFrom("sentri_sessions").where("user_id","=",r).execute();}o(ce,"deleteAllSessionsForUser");async function de(e,r,t){let s=A(r),n=D(r.dialect),u=e.roles??[],d=u.filter(k=>!s.validRolesSet.has(k));if(d.length>0)return {success:false,error:new a("INVALID_ROLE",`Invalid roles: ${d.join(", ")}`)};if(!e.identifiers||e.identifiers.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one identifier is required")};let c=e.identifiers.map(k=>({type:k.type.trim(),value:k.value.trim()}));if(new Set(c.map(k=>k.value)).size!==c.length)return {success:false,error:new a("VALIDATION_ERROR","Duplicate identifier values in request")};for(let k of c)if(await te(n,k.value))return {success:false,error:new a("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${k.value}`)};let g=await W(e.password,s.saltRounds),{userId:x,identifierRows:C}=await n.transaction().execute(async k=>{let H=crypto.randomUUID();await k.insertInto("sentri_users").values({id:H,password_hash:g,roles:JSON.stringify(u)}).execute();let ae=c.map(X=>({id:crypto.randomUUID(),user_id:H,type:X.type,value:X.value}));return await k.insertInto("sentri_identifiers").values(ae).execute(),{userId:H,identifierRows:ae}}),N={success:true,user:{id:x,roles:u,identifiers:C.map(k=>({id:k.id,type:k.type,value:k.value}))}};return r.hooks?.onRegister&&await r.hooks.onRegister(N.user),N}o(de,"register");async function le(e,r,t){let s=A(r),n=D(r.dialect),u=await te(n,e.identifier.trim());if(!u){let N=new a("INVALID_CREDENTIALS","Invalid credentials");return r.hooks?.onLoginFailed&&await r.hooks.onLoginFailed(e.identifier,N,{ip:t?.ip??""}),{success:false,error:N}}if(!await J(e.password,u.passwordHash)){let N=new a("INVALID_CREDENTIALS","Invalid credentials");return r.hooks?.onLoginFailed&&await r.hooks.onLoginFailed(e.identifier,N,{ip:t?.ip??""}),{success:false,error:N}}let c=new Date(Date.now()+$(s.refreshExpiresIn)),i=await Ne(n,{userId:u.id,expiresAt:c,ipAddress:t?.ip??null,userAgent:t?.userAgent??null}),g={id:u.id,roles:u.roles},x=Q({id:u.id,roles:u.roles,sessionId:i.id},r),C=ee(i.id,r);return r.hooks?.onLoginSuccess&&await r.hooks.onLoginSuccess(g,{ip:t?.ip??"",userAgent:t?.userAgent??""}),{success:true,accessToken:x,refreshToken:C,user:g}}o(le,"login");async function M(e,r,t){let s=A(r),n=D(r.dialect),u;try{({sessionId:u}=re(e,r));}catch(N){return N instanceof a?{success:false,error:N}:{success:false,error:new a("TOKEN_INVALID","Invalid refresh token")}}let d=await De(n,u);if(!d)return {success:false,error:new a("UNAUTHORIZED","Session not found or revoked")};if(d.replacedBy)return await ce(n,d.userId),{success:false,error:new a("TOKEN_REUSE","Token reuse detected. All sessions revoked.")};if(d.expiresAt.getTime()<Date.now())return await Se(n,u),{success:false,error:new a("TOKEN_EXPIRED","Session has expired")};let c=new Date(Date.now()+$(s.refreshExpiresIn)),i=await Ne(n,{userId:d.userId,expiresAt:c,ipAddress:t?.ip??null,userAgent:t?.userAgent??null});await _r(n,u,i.id);let g={id:d.user.id,roles:d.user.roles},x=Q({...g,sessionId:i.id},r),C=ee(i.id,r);return {success:true,accessToken:x,refreshToken:C,user:g}}o(M,"refresh");async function fe(e,r){let t=D(r.dialect),s;try{({sessionId:s}=re(e,r));}catch{return}let n=await De(t,s);n&&(await Se(t,s),r.hooks?.onLogout&&await r.hooks.onLogout(n.userId));}o(fe,"logout");async function he(e,r){let t=D(r.dialect);await ce(t,e),r.hooks?.onLogout&&await r.hooks.onLogout(e);}o(he,"logoutAll");async function me(e,r){let t=D(r.dialect),s=await ue(t,e);if(!s)return {success:false,error:new a("USER_NOT_FOUND","User not found")};let n=await se(t,e);return {success:true,user:{id:s.id,roles:s.roles,identifiers:n.map(u=>({id:u.id,type:u.type,value:u.value}))}}}o(me,"getUser");async function pe(e,r,t,s){let n=A(s),u=D(s.dialect),d=await ue(u,e);if(!d)return {success:false,error:new a("USER_NOT_FOUND","User not found")};if(!await J(r,d.passwordHash))return {success:false,error:new a("INVALID_CREDENTIALS","Invalid credentials")};let i=await W(t,n.saltRounds);return await Ir(u,e,i),await ce(u,e),s.hooks?.onPasswordChanged&&await s.hooks.onPasswordChanged(e),{success:true}}o(pe,"changePassword");async function we(e,r,t){let s=A(t),n=D(t.dialect),u=r.filter(g=>!s.validRolesSet.has(g));if(u.length>0)return {success:false,error:new a("INVALID_ROLE",`Invalid roles: ${u.join(", ")}`)};let d=await ue(n,e);if(!d)return {success:false,error:new a("USER_NOT_FOUND","User not found")};let c=new Set(d.roles);for(let g of r)c.add(g);let i=Array.from(c);return await Rr(n,e,i),{success:true,user:{id:d.id,roles:i}}}o(we,"assignRoles");async function ge(e,r,t){let s=D(t.dialect);if(r.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one identifier is required")};let n=r.map(c=>({type:c.type.trim(),value:c.value.trim()}));if(new Set(n.map(c=>c.value)).size!==n.length)return {success:false,error:new a("VALIDATION_ERROR","Duplicate identifier values in request")};for(let c of n)if(await te(s,c.value))return {success:false,error:new a("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${c.value}`)};return await pr(s,e,n),{success:true,identifiers:(await se(s,e)).map(c=>({id:c.id,type:c.type,value:c.value}))}}o(ge,"bulkCreateIdentifiers");async function ye(e,r,t){let s=D(t.dialect);if(r.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one update is required")};let n=r.map(c=>({id:c.id,type:c.type.trim(),value:c.value.trim()}));if(new Set(n.map(c=>c.value)).size!==n.length)return {success:false,error:new a("VALIDATION_ERROR","Duplicate identifier values in request")};for(let c of n){let i=await Ce(s,c.id,e);if(!i)return {success:false,error:new a("IDENTIFIER_NOT_FOUND",`Identifier not found: ${c.id}`)};if(i.value!==c.value&&await te(s,c.value))return {success:false,error:new a("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${c.value}`)}}return await s.transaction().execute(async c=>{for(let i of n)await gr(c,i.id,e,{type:i.type,value:i.value});}),{success:true,identifiers:(await se(s,e)).map(c=>({id:c.id,type:c.type,value:c.value}))}}o(ye,"bulkUpdateIdentifiers");async function Ie(e,r,t){let s=D(t.dialect);if(r.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one ID is required")};let n=Array.from(new Set(r));for(let c of n)if(!await Ce(s,c,e))return {success:false,error:new a("IDENTIFIER_NOT_FOUND",`Identifier not found: ${c}`)};return await wr(s,e)-n.length<1?{success:false,error:new a("VALIDATION_ERROR","Cannot delete all identifiers \u2014 at least one must remain")}:(await yr(s,e,n),{success:true,identifiers:(await se(s,e)).map(c=>({id:c.id,type:c.type,value:c.value}))})}o(Ie,"bulkDeleteIdentifiers");function L(e){return A(e).cookieName}o(L,"getCookieName");function Re(e){return A(e).accessCookieName}o(Re,"getAccessCookieName");function P(e,r){if(!e)return;let t=`${r}=`,s=0;for(;s<e.length;){for(;s<e.length&&e[s]===" ";)s++;let n=e.indexOf(";",s),u=n===-1?e.length:n;if(e.startsWith(t,s))return e.slice(s+t.length,u);s=u+1;}}o(P,"readCookie");function oe(e,r,t){let s=t.cookie??{},n=$(A(t).refreshExpiresIn)/1e3;e.cookie??={},e.cookie[L(t)]={value:r,httpOnly:s.httpOnly??true,secure:s.secure??false,sameSite:s.sameSite??"strict",path:s.path??"/",maxAge:n};}o(oe,"setCookieFromConfig");function _e(e,r){let t=r.cookie??{};e.cookie??={},e.cookie[L(r)]={value:"",httpOnly:t.httpOnly??true,path:t.path??"/",maxAge:0};}o(_e,"clearCookieFromConfig");function ne(e,r,t){if(!t.accessCookie)return;let s=t.accessCookie,n=$(A(t).accessExpiresIn)/1e3;e.cookie??={},e.cookie[Re(t)]={value:r,httpOnly:false,secure:s.secure??false,sameSite:s.sameSite??"strict",path:s.path??"/",maxAge:n};}o(ne,"setAccessCookieFromConfig");function Oe(e,r){if(!r.accessCookie)return;let t=r.accessCookie;e.cookie??={},e.cookie[Re(r)]={value:"",httpOnly:false,path:t.path??"/",maxAge:0};}o(Oe,"clearAccessCookieFromConfig");function q(e,r){let t=e.headers.get("authorization");if(t?.startsWith("Bearer "))return t.slice(7);let s=e.headers.get("cookie");return s?P(s,Re(r)):void 0}o(q,"getCurrentAccessToken");function be(e){let r=e.logger??S,t=e.loggerService??"sentri";if(e.mode==="client"){let n=e;return new elysia.Elysia().derive({as:"global"},async({request:u})=>{let d=u.headers.get("authorization"),c=d?.startsWith("Bearer ")?d.slice(7):void 0;if(!c)throw r.warn(h(t,"auth.protect.failure",{mode:"client",errorCode:"UNAUTHORIZED"})),new a("UNAUTHORIZED","Missing or malformed Authorization header");try{let i=await tr(n.keyUri),g=fr(c,i),x={id:g.id,roles:g.roles};return r.info(h(t,"auth.protect.success",{mode:"client",userId:g.id})),{user:x}}catch(i){let g=i instanceof a?i.code:"TOKEN_INVALID";throw r.warn(h(t,"auth.protect.failure",{mode:"client",errorCode:g})),i}})}let s=e;return new elysia.Elysia().derive({as:"global"},async({request:n,set:u})=>{let d=q(n,s);if(!d)throw r.warn(h(t,"auth.protect.failure",{mode:"server",errorCode:"UNAUTHORIZED"})),new a("UNAUTHORIZED","Missing or malformed Authorization header");try{let c=V(d,s);if(s.isTokenRevoked&&await s.isTokenRevoked(c.sessionId))throw r.warn(h(t,"auth.protect.token_revoked",{mode:"server",userId:c.id})),new a("UNAUTHORIZED","Token has been revoked");let i={id:c.id,roles:c.roles};return r.info(h(t,"auth.protect.success",{mode:"server",userId:c.id})),{user:i}}catch(c){if(c instanceof a&&c.code==="TOKEN_EXPIRED"){let g=n.headers.get("cookie"),x=g?P(g,L(s)):void 0;if(!x)throw r.warn(h(t,"auth.protect.failure",{mode:"server",errorCode:"TOKEN_EXPIRED"})),new a("UNAUTHORIZED","Token expired. Please login again.");let C;try{C=await M(x,s);}catch{throw r.warn(h(t,"auth.protect.failure",{mode:"server",errorCode:"TOKEN_EXPIRED"})),new a("UNAUTHORIZED","Session expired. Please login again.")}if(!C.success)throw r.warn(h(t,"auth.protect.failure",{mode:"server",errorCode:C.error.code})),new a("UNAUTHORIZED","Session expired. Please login again.");return oe(u,C.refreshToken,s),ne(u,C.accessToken,s),u.headers["X-New-Access-Token"]=C.accessToken,r.info(h(t,"auth.protect.auto_refresh",{mode:"server",userId:C.user.id})),{user:C.user}}let i=c instanceof a?c.code:"TOKEN_INVALID";throw r.warn(h(t,"auth.protect.failure",{mode:"server",errorCode:i})),c}})}o(be,"protect");function Ar(e,r,t){let s=`Requires one of roles: ${e.join(", ")}`;return ({user:n})=>{if(!n)throw r.warn(h(t,"auth.authorize.unauthenticated",{requiredRoles:e})),new a("UNAUTHORIZED","Not authenticated");let u=n.roles;if(!e.some(d=>u.includes(d)))throw r.warn(h(t,"auth.authorize.denied",{userId:n.id,userRoles:[...u],requiredRoles:e})),new a("FORBIDDEN",s);r.info(h(t,"auth.authorize.passed",{userId:n.id,userRoles:[...u],requiredRoles:e}));}}o(Ar,"createAuthorizeHandler");function Ue(e,r){return o(function(...s){return Ar(s,e,r)},"authorize")}o(Ue,"createAuthorize");function Hr(...e){return Ar(e,S,"sentri")}o(Hr,"authorize");var $r=new a("FORBIDDEN","You do not have permission to perform this action");function Er(e,r,t){return async s=>{let n=s.user;if(!n)throw r.warn(h(t,"auth.permit.unauthenticated",{})),new a("UNAUTHORIZED","Not authenticated");if(e.roles&&e.roles.length>0){let u=n.roles;if(e.roles.some(d=>u.includes(d))){r.info(h(t,"auth.permit.role_bypass",{userId:n.id,bypassedByRole:true}));return}}try{let u=e.check(s);if(u instanceof Promise?await u:u)r.info(h(t,"auth.permit.passed",{userId:n.id}));else throw r.warn(h(t,"auth.permit.denied",{userId:n.id})),$r}catch(u){throw u}}}o(Er,"createPermitHandler");function Le(e,r){return o(function(s){return Er(typeof s=="function"?{check:s}:s,e,r)},"permit")}o(Le,"createPermit");function Vr(e){return Er(typeof e=="function"?{check:e}:e,S,"sentri")}o(Vr,"permit");function ie(e){return ({error:r,set:t})=>r instanceof a?(t.status=r.statusCode,{error:true,statusCode:r.statusCode,code:r.code,message:r.message,data:null}):(e?.onUnhandled?.(r),t.status=500,{error:true,statusCode:500,code:"INTERNAL_SERVER_ERROR",message:"Internal server error",data:null})}o(ie,"createErrorHandler");var Fe=class{static{o(this,"InMemoryRateLimiter");}store=new Map;constructor(){setInterval(()=>{let r=Date.now();for(let[t,s]of this.store.entries())s.expiresAt<r&&this.store.delete(t);},6e4).unref();}async consume(r,t,s){let n=Date.now(),u=this.store.get(r);if((!u||u.expiresAt<n)&&(u={count:0,expiresAt:n+s},this.store.set(r,u)),u.count>t){let d=Math.ceil((u.expiresAt-n)/1e3);throw new Error(`Rate limit exceeded. Try again in ${d} seconds.`)}u.count++;}},Pe=class{static{o(this,"RedisRateLimiter");}redis;logger;constructor(r,t){this.redis=r,this.logger=t;}async consume(r,t,s){let n=`sentri:rl:${r}`,u=Math.ceil(s/1e3);try{let d=await this.redis.multi().incr(n).expire(n,u,"NX").exec();if(!d||d.length===0)return;if(d[0][1]>t)throw new Error("Rate limit exceeded. Try again later.")}catch(d){if(d instanceof Error&&d.message.includes("Rate limit exceeded"))throw d;this.logger.error({msg:"Redis RateLimiter failed, bypassing limit",error:d});}}},B=null;async function Tr(e,r){if(B)return B;if(e)try{let{Redis:t}=await import('ioredis'),s=new t(e,{lazyConnect:!0,maxRetriesPerRequest:1});return await s.connect(),r?.info({msg:"Connected to Redis for Rate Limiting"}),B=new Pe(s,r??S),B}catch(t){r?.warn({msg:"Failed to connect to Redis for Rate Limiting, falling back to InMemoryRateLimiter",error:t});}return B=new Fe,B}o(Tr,"getRateLimiter");var ke=8,j=72,ve=255,xr=100,z=50;function _(e){return new a("VALIDATION_ERROR",e)}o(_,"badRequest");function O(e,r,t,s){return e.status=r,{error:false,statusCode:r,message:t,data:s}}o(O,"ok");function K(e){if(e==null||typeof e!="object"||Array.isArray(e))throw new a("VALIDATION_ERROR","Request body is missing or not a JSON object. Did you set Content-Type: application/json?");return e}o(K,"parseBody");function qr(e,r){if(!r.apiKey)return;let t=e.headers.get("x-api-key");if(typeof t!="string"||t!==r.apiKey)throw new a("UNAUTHORIZED","Invalid or missing API key")}o(qr,"validateApiKey");function Ke(e){if(e)try{let r=e();r instanceof Promise&&r.catch(()=>{});}catch{}}o(Ke,"fireHook");function Br(e){return e.startsWith("RS")||e.startsWith("PS")}o(Br,"isRSA");function He(e,r){if(typeof e!="object"||e===null||Array.isArray(e))throw _(`identifiers[${r}] must be an object`);let t=e;if(typeof t.type!="string"||t.type.trim().length===0)throw _(`identifiers[${r}].type is required and must be a non-empty string`);if(t.type.length>xr)throw _(`identifiers[${r}].type must not exceed ${xr} characters`);if(typeof t.value!="string"||t.value.trim().length===0)throw _(`identifiers[${r}].value is required and must be a non-empty string`);if(t.value.length>ve)throw _(`identifiers[${r}].value must not exceed ${ve} characters`);return {type:t.type,value:t.value}}o(He,"validateIdentifierInput");async function F(e,r,t){let s=q(e,t);if(!s)throw new a("UNAUTHORIZED","Missing or malformed Authorization header");let n=V(s,t);if(t.isTokenRevoked&&await t.isTokenRevoked(n.sessionId))throw new a("UNAUTHORIZED","Token has been revoked");return {id:n.id,roles:n.roles}}o(F,"requireAuth");function Cr(e){let r=e,t=A(r),s=e.logger??S,n=e.loggerService??"sentri",u=e.router?.register??(l=>de(l,r)),d=e.router?.login??(l=>le(l,r)),c=e.router?.refresh??(l=>M(l,r)),i=e.router?.logout??(l=>l!==void 0?fe(l,r):Promise.resolve()),g=e.router?.logoutAll??(l=>he(l,r)),x=e.router?.getUser??(l=>me(l,r)),C=e.router?.assignRoles??((l,f)=>we(l,f,r)),N=e.router?.changePassword??((l,f,w)=>pe(l,f,w,r)),k=e.router?.bulkCreateIdentifiers??((l,f)=>ge(l,f,r)),H=e.router?.bulkUpdateIdentifiers??((l,f)=>ye(l,f,r)),ae=e.router?.bulkDeleteIdentifiers??((l,f)=>Ie(l,f,r)),X=Tr(e.redisUrl,s),Ae=new elysia.Elysia().onError(ie());return Br(t.algorithm)&&Ae.get("/keys",({set:l})=>(l.headers["Cache-Control"]="public, max-age=3600",er(e.secret))),Ae.post("/register",async({body:l,request:f,set:w})=>{let I=Date.now();qr(f,r);let m=K(l),{identifiers:T,password:p,roles:R}=m;if(!Array.isArray(T)||T.length===0)throw _("identifiers is required and must be a non-empty array");if(T.length>z)throw _(`identifiers must not exceed ${z} entries`);let y=T.map((G,Ee)=>He(G,Ee));if(typeof p!="string"||p.length<ke)throw _(`password is required and must be at least ${ke} characters`);if(p.length>j)throw _(`password must not exceed ${j} characters`);if(R!==void 0&&!Array.isArray(R))throw _("roles must be an array of strings when provided");if(Array.isArray(R)&&!R.every(G=>typeof G=="string"))throw _("each role must be a string");let E=Array.isArray(R)?R:void 0,v=E!==void 0?{identifiers:y,password:p,roles:E}:{identifiers:y,password:p},U=f.headers.get("x-forwarded-for")||"127.0.0.1",Z=f.headers.get("user-agent")||"Unknown";if(e.rateLimit!==false){let G=await X,Ee=typeof e.rateLimit=="object"?e.rateLimit.maxRegisterAttempts??5:5;await G.consume(`register:${U}`,Ee,900*1e3);}let b=await u(v,{ip:U,userAgent:Z});return b.success?(s.info(h(n,"auth.register.success",{userId:b.user.id,duration_ms:Date.now()-I})),O(w,201,"User registered successfully",{user:b.user})):(s.warn(h(n,"auth.register.failure",{errorCode:b.error.code,duration_ms:Date.now()-I})),w.status=b.error.statusCode,{error:true,statusCode:b.error.statusCode,code:b.error.code,message:b.error.message,data:null})}).post("/login",async({body:l,request:f,set:w})=>{let I=Date.now(),m=K(l),{identifier:T,password:p}=m;if(typeof T!="string"||T.trim().length===0)throw _("identifier is required and must be a non-empty string");if(T.length>ve)throw _(`identifier must not exceed ${ve} characters`);if(typeof p!="string"||p.length===0)throw _("password is required");if(p.length>j)throw _(`password must not exceed ${j} characters`);let R=T.trim(),y=f.headers.get("x-forwarded-for")||"127.0.0.1",E=f.headers.get("user-agent")||"Unknown";if(e.rateLimit!==false){let U=await X,Z=typeof e.rateLimit=="object"?e.rateLimit.maxLoginAttempts??5:5;await U.consume(`login:${y}`,Z,900*1e3);}let v=await d({identifier:R,password:p},{ip:y,userAgent:E});return v.success?(Ke(()=>r.hooks?.onLoginSuccess?.(v.user,{ip:y,userAgent:E})),oe(w,v.refreshToken,r),ne(w,v.accessToken,r),s.info(h(n,"auth.login.success",{userId:v.user.id,duration_ms:Date.now()-I})),O(w,200,"Login successful",{accessToken:v.accessToken,user:v.user})):(Ke(()=>r.hooks?.onLoginFailed?.(R,v.error,{ip:y})),s.warn(h(n,"auth.login.failure",{errorCode:v.error.code,duration_ms:Date.now()-I})),w.status=v.error.statusCode,{error:true,statusCode:v.error.statusCode,code:v.error.code,message:v.error.message,data:null})}).post("/refresh",async({request:l,set:f})=>{let w=Date.now(),I=P(l.headers.get("cookie")??void 0,L(r));if(!I)throw new a("UNAUTHORIZED","Refresh token cookie is missing");let m=l.headers.get("x-forwarded-for")||"127.0.0.1",T=l.headers.get("user-agent")||"Unknown",p=await c(I,{ip:m,userAgent:T});return p.success?(oe(f,p.refreshToken,r),ne(f,p.accessToken,r),s.info(h(n,"auth.refresh.success",{userId:p.user.id,duration_ms:Date.now()-w})),O(f,200,"Token refreshed",{accessToken:p.accessToken})):(_e(f,r),s.warn(h(n,"auth.refresh.failure",{errorCode:p.error.code,duration_ms:Date.now()-w})),f.status=p.error.statusCode,{error:true,statusCode:p.error.statusCode,code:p.error.code,message:p.error.message,data:null})}).post("/logout",async({request:l,set:f})=>{let w=Date.now(),I=P(l.headers.get("cookie")??void 0,L(r));return await i(I),_e(f,r),Oe(f,r),s.info(h(n,"auth.logout",{duration_ms:Date.now()-w})),O(f,200,"Logged out",null)}).post("/logout-all",async({request:l,set:f})=>{let w=Date.now(),I=await F(l,f,r);return await g(I.id),Ke(()=>r.hooks?.onLogout?.(I.id)),_e(f,r),Oe(f,r),s.info(h(n,"auth.logout_all",{userId:I.id,duration_ms:Date.now()-w})),O(f,200,"All sessions revoked",null)}).get("/me",async({request:l,set:f})=>{let w=Date.now(),I=await F(l,f,r),m=await x(I.id);return m.success?(s.info(h(n,"auth.me.success",{userId:m.user.id,duration_ms:Date.now()-w})),O(f,200,"OK",m.user)):(s.warn(h(n,"auth.me.failure",{userId:I.id,errorCode:m.error.code,duration_ms:Date.now()-w})),f.status=m.error.statusCode,{error:true,statusCode:m.error.statusCode,code:m.error.code,message:m.error.message,data:null})}).get("/me/identifiers",async({request:l,set:f})=>{let w=Date.now(),I=await F(l,f,r),m=await x(I.id);return m.success?(s.info(h(n,"auth.me.identifiers.success",{userId:m.user.id,count:m.user.identifiers?.length??0,duration_ms:Date.now()-w})),O(f,200,"OK",{identifiers:m.user.identifiers??[]})):(s.warn(h(n,"auth.me.identifiers.failure",{userId:I.id,errorCode:m.error.code,duration_ms:Date.now()-w})),f.status=m.error.statusCode,{error:true,statusCode:m.error.statusCode,code:m.error.code,message:m.error.message,data:null})}).post("/me/identifiers",async({body:l,request:f,set:w})=>{let I=Date.now(),m=await F(f,w,r),T=K(l),{identifiers:p}=T;if(!Array.isArray(p)||p.length===0)throw _("identifiers is required and must be a non-empty array");if(p.length>z)throw _(`identifiers must not exceed ${z} entries`);let R=p.map((E,v)=>He(E,v)),y=await k(m.id,R);return y.success?(s.info(h(n,"auth.identifiers.created",{userId:m.id,count:y.identifiers.length,duration_ms:Date.now()-I})),O(w,201,"Identifiers added successfully",{identifiers:y.identifiers})):(s.warn(h(n,"auth.identifiers.create_failure",{userId:m.id,errorCode:y.error.code,duration_ms:Date.now()-I})),w.status=y.error.statusCode,{error:true,statusCode:y.error.statusCode,code:y.error.code,message:y.error.message,data:null})}).put("/me/identifiers",async({body:l,request:f,set:w})=>{let I=Date.now(),m=await F(f,w,r),T=K(l),{identifiers:p}=T;if(!Array.isArray(p)||p.length===0)throw _("identifiers is required and must be a non-empty array");if(p.length>z)throw _(`identifiers must not exceed ${z} entries`);let R=p.map((E,v)=>{if(typeof E!="object"||E===null||Array.isArray(E))throw _(`identifiers[${v}] must be an object`);let U=E;if(typeof U.id!="string"||U.id.trim().length===0)throw _(`identifiers[${v}].id is required and must be a non-empty string`);let{type:Z,value:b}=He(E,v);return {id:U.id,type:Z,value:b}}),y=await H(m.id,R);return y.success?(s.info(h(n,"auth.identifiers.updated",{userId:m.id,count:y.identifiers.length,duration_ms:Date.now()-I})),O(w,200,"Identifiers updated successfully",{identifiers:y.identifiers})):(s.warn(h(n,"auth.identifiers.update_failure",{userId:m.id,errorCode:y.error.code,duration_ms:Date.now()-I})),w.status=y.error.statusCode,{error:true,statusCode:y.error.statusCode,code:y.error.code,message:y.error.message,data:null})}).delete("/me/identifiers",async({body:l,request:f,set:w})=>{let I=Date.now(),m=await F(f,w,r),T=K(l),{ids:p}=T;if(!Array.isArray(p)||p.length===0)throw _("ids is required and must be a non-empty array of strings");if(!p.every(y=>typeof y=="string"))throw _("each id must be a string");let R=await ae(m.id,p);return R.success?(s.info(h(n,"auth.identifiers.deleted",{userId:m.id,duration_ms:Date.now()-I})),O(w,200,"Identifiers deleted successfully",{identifiers:R.identifiers})):(s.warn(h(n,"auth.identifiers.delete_failure",{userId:m.id,errorCode:R.error.code,duration_ms:Date.now()-I})),w.status=R.error.statusCode,{error:true,statusCode:R.error.statusCode,code:R.error.code,message:R.error.message,data:null})}).patch("/me/password",async({body:l,request:f,set:w})=>{let I=Date.now(),m=await F(f,w,r),T=K(l),{currentPassword:p,newPassword:R}=T;if(typeof p!="string"||p.length===0)throw _("currentPassword is required");if(typeof R!="string"||R.length<ke)throw _(`newPassword must be at least ${ke} characters`);if(R.length>j)throw _(`newPassword must not exceed ${j} characters`);if(p===R)throw _("newPassword must be different from currentPassword");let y=await N(m.id,p,R);return y.success?(s.info(h(n,"auth.password.changed",{userId:m.id,duration_ms:Date.now()-I})),O(w,200,"Password updated successfully. All sessions have been revoked.",null)):(s.warn(h(n,"auth.password.change_failure",{userId:m.id,errorCode:y.error.code,duration_ms:Date.now()-I})),w.status=y.error.statusCode,{error:true,statusCode:y.error.statusCode,code:y.error.code,message:y.error.message,data:null})}).post("/users/:userId/roles",async({body:l,request:f,set:w,params:I})=>{let m=Date.now();if(!(await F(f,w,r)).roles.includes("admin"))throw new a("FORBIDDEN","Requires one of roles: admin");let p=K(l),{roles:R}=p,{userId:y}=I;if(!y)throw _("userId is required");if(!Array.isArray(R)||R.length===0)throw _("roles must be a non-empty array of strings");if(!R.every(v=>typeof v=="string"))throw _("each role must be a string");let E=await C(y,R);return E.success?(s.info(h(n,"auth.roles.assigned",{targetUserId:y,roles:R,duration_ms:Date.now()-m})),O(w,200,"Roles assigned successfully",{user:E.user})):(s.warn(h(n,"auth.roles.assign_failure",{targetUserId:y,errorCode:E.error.code,duration_ms:Date.now()-m})),w.status=E.error.statusCode,{error:true,statusCode:E.error.statusCode,code:E.error.code,message:E.error.message,data:null})}),Ae}o(Cr,"createAuthRouter");function Ls(e){if(e.mode==="client"){let i={mode:"client",keyUri:e.keyUri,...e.validRoles!==void 0&&{validRoles:e.validRoles},...e.logger!==void 0&&{logger:e.logger},...e.loggerService!==void 0&&{loggerService:e.loggerService}};ze(i);let g=i.logger??S,x=i.loggerService??"sentri",C=Ue(g,x),N=Le(g,x);return {protect:o(()=>be(i),"protect"),authorize:o((...k)=>C(...k),"authorize"),permit:o(k=>N(k),"permit"),errorHandler:o(k=>ie(k),"errorHandler")}}let{privateKey:r}=crypto.generateKeyPairSync("rsa",{modulusLength:2048,privateKeyEncoding:{type:"pkcs8",format:"pem"},publicKeyEncoding:{type:"spki",format:"pem"}}),t={mode:"server",dialect:e.dialect,secret:r,algorithm:"RS256",validRoles:e.validRoles,...e.accessExpiresIn!==void 0&&{accessExpiresIn:e.accessExpiresIn},...e.refreshExpiresIn!==void 0&&{refreshExpiresIn:e.refreshExpiresIn},...e.saltRounds!==void 0&&{saltRounds:e.saltRounds},...e.apiKey!==void 0&&{apiKey:e.apiKey},...e.cookie!==void 0&&{cookie:e.cookie},...e.accessCookie!==void 0&&{accessCookie:e.accessCookie},...e.hooks!==void 0&&{hooks:e.hooks},...e.router!==void 0&&{router:e.router},...e.isTokenRevoked!==void 0&&{isTokenRevoked:e.isTokenRevoked},...e.redisUrl!==void 0&&{redisUrl:e.redisUrl},...e.logger!==void 0&&{logger:e.logger},...e.loggerService!==void 0&&{loggerService:e.loggerService}},s=t.logger??S,n=t.loggerService??"sentri",u=A(t),d=Ue(s,n),c=Le(s,n);return {protect:o(()=>be(t),"protect"),authorize:o((...i)=>d(...i),"authorize"),permit:o(i=>c(i),"permit"),errorHandler:o(i=>ie(i),"errorHandler"),router:o(()=>Cr(t),"router"),migrate:o(()=>Xe(D(t.dialect)),"migrate"),getCurrentAccessToken:o(i=>q(i,t),"getCurrentAccessToken"),hashPassword:o(i=>W(i,u.saltRounds),"hashPassword"),verifyPassword:o((i,g)=>J(i,g),"verifyPassword"),signAccessToken:o(i=>Q(i,t),"signAccessToken"),signRefreshToken:o(i=>ee(i,t),"signRefreshToken"),verifyAccessToken:o(i=>V(i,t),"verifyAccessToken"),verifyRefreshToken:o(i=>re(i,t),"verifyRefreshToken"),register:o(i=>de(i,t),"register"),login:o(i=>le(i,t),"login"),refresh:o(i=>M(i,t),"refresh"),logout:o(i=>fe(i,t),"logout"),logoutAll:o(i=>he(i,t),"logoutAll"),getUser:o(i=>me(i,t),"getUser"),changePassword:o((i,g,x)=>pe(i,g,x,t),"changePassword"),assignRoles:o((i,g)=>we(i,g,t),"assignRoles"),bulkCreateIdentifiers:o((i,g)=>ge(i,g,t),"bulkCreateIdentifiers"),bulkUpdateIdentifiers:o((i,g)=>ye(i,g,t),"bulkUpdateIdentifiers"),bulkDeleteIdentifiers:o((i,g)=>Ie(i,g,t),"bulkDeleteIdentifiers")}}o(Ls,"createAuthElysia");exports.SENTRI_ERROR_STATUS=$e;exports.SentriError=a;exports.authorize=Hr;exports.createAuthElysia=Ls;exports.createAuthRouter=Cr;exports.createAuthorize=Ue;exports.createErrorHandler=ie;exports.createPermit=Le;exports.getCurrentAccessToken=q;exports.permit=Vr;exports.protect=be;
+'use strict';var crypto=require('crypto'),kysely=require('kysely'),Ze=require('bcrypt'),ee=require('jsonwebtoken'),elysia=require('elysia');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var Ze__default=/*#__PURE__*/_interopDefault(Ze);var ee__default=/*#__PURE__*/_interopDefault(ee);var Cr=Object.defineProperty;var o=(e,r)=>Cr(e,"name",{value:r,configurable:true});var He=Object.assign(Object.create(null),{UNAUTHORIZED:401,TOKEN_EXPIRED:401,TOKEN_INVALID:401,INVALID_CREDENTIALS:401,FORBIDDEN:403,USER_NOT_FOUND:404,IDENTIFIER_NOT_FOUND:404,USER_ALREADY_EXISTS:409,IDENTIFIER_ALREADY_EXISTS:409,INVALID_ROLE:400,VALIDATION_ERROR:400,CONFIGURATION_ERROR:500,TOKEN_REUSE:401,RATE_LIMIT_EXCEEDED:429}),a=class extends Error{static{o(this,"SentriError");}code;statusCode;constructor(r,t,s){super(t),this.name="SentriError",this.code=r,this.statusCode=s??He[r]??500;}};var Me=new WeakMap,Ve=32,qe=10,Be=31;function Xe(e){if(e.mode==="client"){if(!e.keyUri||e.keyUri.trim().length===0)throw new a("CONFIGURATION_ERROR","keyUri must not be empty");return}if(!e.secret||e.secret.trim().length===0)throw new a("CONFIGURATION_ERROR","secret must not be empty");if((e.algorithm??"HS256").startsWith("HS")&&e.secret.length<Ve)throw new a("CONFIGURATION_ERROR",`secret must be at least ${Ve} characters for HMAC algorithms`);let s=e.saltRounds??12;if(!Number.isInteger(s)||s<qe||s>Be)throw new a("CONFIGURATION_ERROR",`saltRounds must be an integer between ${qe} and ${Be}`);if(!e.validRoles||e.validRoles.length===0)throw new a("CONFIGURATION_ERROR","validRoles must contain at least one role");if(e.validIdentifiers!==void 0&&e.validIdentifiers.length===0)throw new a("CONFIGURATION_ERROR","validIdentifiers must contain at least one identifier type");if(!e.dialect)throw new a("CONFIGURATION_ERROR","dialect is required in server mode")}o(Xe,"validateConfig");function A(e){let r=Me.get(e);if(r)return r;let t={algorithm:e.algorithm??"HS256",accessExpiresIn:e.accessExpiresIn??"15m",refreshExpiresIn:e.refreshExpiresIn??"7d",saltRounds:e.saltRounds??12,validRoles:e.validRoles,validRolesSet:new Set(e.validRoles),validIdentifiers:e.validIdentifiers??["email","username"],validIdentifiersSet:new Set(e.validIdentifiers??["email","username"]),cookieName:e.cookie?.name??"refresh_token",accessCookieName:e.accessCookie?.name??"access_token"};return Me.set(e,t),t}o(A,"resolveServerConfig");var Nr=/^(\d+)([smhdw])$/,Sr={s:1e3,m:6e4,h:36e5,d:864e5,w:6048e5},je=new Map;function V(e){if(typeof e=="number")return e*1e3;let r=je.get(e);if(r!==void 0)return r;let t=Nr.exec(e);if(!t?.[1]||!t?.[2])throw new Error(`Invalid expiresIn: "${e}". Use e.g. "15m", "7d", "1h".`);let s=Sr[t[2]];if(s===void 0)throw new Error(`Invalid expiresIn: "${e}". Use e.g. "15m", "7d", "1h".`);let n=parseInt(t[1],10)*s;return je.set(e,n),n}o(V,"parseExpiry");var S={info:o(()=>{},"info"),warn:o(()=>{},"warn"),error:o(()=>{},"error")};function m(e,r,t){return {service:e,event:r,...t}}o(m,"buildLogData");async function ze(e){await e.schema.createTable("sentri_users").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("password_hash","varchar(255)",r=>r.notNull()).addColumn("roles","text",r=>r.notNull().defaultTo("[]")).addColumn("created_at","timestamp",r=>r.notNull().defaultTo(kysely.sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createTable("sentri_sessions").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("user_id","varchar(36)",r=>r.notNull().references("sentri_users.id").onDelete("cascade")).addColumn("expires_at","timestamp",r=>r.notNull()).addColumn("ip_address","varchar(45)").addColumn("user_agent","text").addColumn("replaced_by","varchar(36)").addColumn("created_at","timestamp",r=>r.notNull().defaultTo(kysely.sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createTable("sentri_identifiers").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("user_id","varchar(36)",r=>r.notNull().references("sentri_users.id").onDelete("cascade")).addColumn("type","varchar(100)",r=>r.notNull()).addColumn("value","varchar(255)",r=>r.notNull().unique()).addColumn("created_at","timestamp",r=>r.notNull().defaultTo(kysely.sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createIndex("idx_sentri_sessions_user_id").ifNotExists().on("sentri_sessions").column("user_id").execute(),await e.schema.createIndex("idx_sentri_identifiers_user_id").ifNotExists().on("sentri_identifiers").column("user_id").execute();}o(ze,"runMigrations");var Ge=new Map;function N(e){let r=Ge.get(e);return r||(r=new kysely.Kysely({dialect:e}),Ge.set(e,r)),r}o(N,"getDatabase");async function Y(e,r=12){return Ze__default.default.hash(e,r)}o(Y,"hashPassword");async function Q(e,r){return Ze__default.default.compare(e,r)}o(Q,"verifyPassword");var We=new Map,Je=new Map,Lr=3600*1e3;function Qe(e){let r=We.get(e);if(!r){let t=crypto.createPrivateKey(e),s=crypto.createPublicKey(t),n=s.export({format:"jwk"}),c=crypto.createHash("sha256").update(JSON.stringify({e:n.e,kty:n.kty,n:n.n})).digest("base64url"),h={...n,use:"sig",kid:c};r={kid:c,publicKey:s,jwk:h},We.set(e,r);}return r}o(Qe,"getOrBuildKey");function er(e){let{jwk:r}=Qe(e);return {keys:[r]}}o(er,"buildJwks");function rr(e){return Qe(e).publicKey}o(rr,"getPublicKeyFromPrivate");async function tr(e){let r=Date.now(),t=Je.get(e);if(t&&r-t.fetchedAt<Lr)return t.publicKey;let s=await fetch(e);if(!s.ok)throw new a("CONFIGURATION_ERROR",`Failed to fetch public key from ${e}: HTTP ${s.status}`);let n=await s.json();if(!n.keys||n.keys.length===0)throw new a("CONFIGURATION_ERROR",`No keys found in JWKS response from ${e}`);let i=n.keys[0],c=crypto.createPublicKey({key:i,format:"jwk"});return Je.set(e,{publicKey:c,fetchedAt:r}),c}o(tr,"fetchPublicKey");var sr=new Map,or=new Map,nr=new Map;function ir(e){return e.startsWith("RS")||e.startsWith("PS")}o(ir,"isRSA");function ar(e){let r=sr.get(e);return r||(r={access:`${e}:access`,refresh:`${e}:refresh`},sr.set(e,r)),r}o(ar,"getHsSecrets");function Pr(e){let r=or.get(e);return r||(r=crypto.createPrivateKey(e),or.set(e,r)),r}o(Pr,"getRsPrivateKey");function ur(e){let r=A(e);if(ir(r.algorithm)){let n=Pr(e.secret);return {accessKey:n,refreshKey:n}}let{access:t,refresh:s}=ar(e.secret);return {accessKey:t,refreshKey:s}}o(ur,"getSigningKeys");function dr(e,r){let t=A(e);if(ir(t.algorithm))return rr(e.secret);let{access:s,refresh:n}=ar(e.secret);return r==="access"?s:n}o(dr,"getVerifyKey");function cr(e,r,t,s){let n=`${t}:${s}`,i=nr.get(n);return i||(i={expiresIn:t,algorithm:s},nr.set(n,i)),ee__default.default.sign(e,r,i)}o(cr,"sign");function lr(e,r,t){try{let s=ee__default.default.verify(e,r,{algorithms:[t]});if(typeof s=="string"||s===null)throw new a("TOKEN_INVALID","Token payload is not an object");return s}catch(s){throw s instanceof a?s:s instanceof ee__default.default.TokenExpiredError?new a("TOKEN_EXPIRED","Token has expired"):new a("TOKEN_INVALID","Token is invalid or malformed")}}o(lr,"verify");function re(e,r){let t=A(r),{accessKey:s}=ur(r);return cr(e,s,t.accessExpiresIn,t.algorithm)}o(re,"signAccessToken");function te(e,r){let t=A(r),{refreshKey:s}=ur(r);return cr({sessionId:e},s,t.refreshExpiresIn,t.algorithm)}o(te,"signRefreshToken");function q(e,r){let t=A(r),s=dr(r,"access");return lr(e,s,t.algorithm)}o(q,"verifyAccessToken");function se(e,r){let t=A(r),s=dr(r,"refresh");return lr(e,s,t.algorithm)}o(se,"verifyRefreshToken");function fr(e,r){try{let t=ee__default.default.verify(e,r,{algorithms:["RS256","RS384","RS512","PS256","PS384","PS512"]});if(typeof t=="string"||t===null)throw new a("TOKEN_INVALID","Token payload is not an object");return t}catch(t){throw t instanceof a?t:t instanceof ee__default.default.TokenExpiredError?new a("TOKEN_EXPIRED","Token has expired"):new a("TOKEN_INVALID","Token is invalid or malformed")}}o(fr,"verifyTokenWithPublicKey");function xe(e){try{return JSON.parse(e)}catch{return []}}o(xe,"parseRoles");function Kr(e){return JSON.stringify(e)}o(Kr,"serializeRoles");function mr(e){return {id:e.id,userId:e.user_id,type:e.type,value:e.value,createdAt:new Date(e.created_at)}}o(mr,"mapIdentifier");async function oe(e,r){let t=await e.selectFrom("sentri_identifiers as i").innerJoin("sentri_users as u","u.id","i.user_id").select(["u.id","u.password_hash","u.roles"]).where("i.value","=",r).executeTakeFirst();return t?{id:t.id,passwordHash:t.password_hash,roles:xe(t.roles)}:null}o(oe,"findUserByIdentifierValue");async function de(e,r){let t=await e.selectFrom("sentri_users").select(["id","password_hash","roles"]).where("id","=",r).executeTakeFirst();return t?{id:t.id,passwordHash:t.password_hash,roles:xe(t.roles)}:null}o(de,"findUserById");async function pr(e,r,t){let s=t.map(n=>({id:crypto.randomUUID(),user_id:r,type:n.type,value:n.value}));return await e.insertInto("sentri_identifiers").values(s).execute(),s.map(n=>({id:n.id,userId:n.user_id,type:n.type,value:n.value,createdAt:new Date}))}o(pr,"createIdentifiers");async function ne(e,r){return (await e.selectFrom("sentri_identifiers").selectAll().where("user_id","=",r).orderBy("created_at","asc").execute()).map(mr)}o(ne,"findIdentifiersByUserId");async function De(e,r,t){let s=await e.selectFrom("sentri_identifiers").selectAll().where("id","=",r).where("user_id","=",t).executeTakeFirst();return s?mr(s):null}o(De,"findIdentifierById");async function wr(e,r){let t=await e.selectFrom("sentri_identifiers").select(s=>s.fn.countAll().as("count")).where("user_id","=",r).executeTakeFirst();return Number(t?.count??0)}o(wr,"countIdentifiersByUserId");async function gr(e,r,t,s){await e.updateTable("sentri_identifiers").set({type:s.type,value:s.value}).where("id","=",r).where("user_id","=",t).execute();}o(gr,"updateIdentifier");async function yr(e,r,t){await e.deleteFrom("sentri_identifiers").where("user_id","=",r).where("id","in",t).execute();}o(yr,"deleteIdentifiers");async function Ir(e,r,t){await e.updateTable("sentri_users").set({password_hash:t}).where("id","=",r).execute();}o(Ir,"updateUserPassword");async function Rr(e,r,t){await e.updateTable("sentri_users").set({roles:Kr(t)}).where("id","=",r).execute();}o(Rr,"updateUserRoles");async function Ce(e,r){let t=crypto.randomUUID();return await e.insertInto("sentri_sessions").values({id:t,user_id:r.userId,expires_at:r.expiresAt.toISOString(),ip_address:r.ipAddress??null,user_agent:r.userAgent??null}).execute(),{id:t}}o(Ce,"createSession");async function Ne(e,r){let t=await e.selectFrom("sentri_sessions as s").innerJoin("sentri_users as u","u.id","s.user_id").select(["s.id as session_id","s.user_id","s.expires_at","s.ip_address","s.user_agent","s.replaced_by","s.created_at as session_created_at","u.id as user_id_col","u.password_hash","u.roles"]).where("s.id","=",r).executeTakeFirst();return t?{id:t.session_id,userId:t.user_id,expiresAt:new Date(t.expires_at),ipAddress:t.ip_address,userAgent:t.user_agent,replacedBy:t.replaced_by,createdAt:new Date(t.session_created_at),user:{id:t.user_id_col,passwordHash:t.password_hash,roles:xe(t.roles)}}:null}o(Ne,"findSessionById");async function Se(e,r){await e.deleteFrom("sentri_sessions").where("id","=",r).execute();}o(Se,"deleteSession");async function _r(e,r,t){await e.updateTable("sentri_sessions").set({replaced_by:t}).where("id","=",r).execute();}o(_r,"markSessionReplaced");async function ce(e,r){await e.deleteFrom("sentri_sessions").where("user_id","=",r).execute();}o(ce,"deleteAllSessionsForUser");async function le(e,r,t){let s=A(r),n=N(r.dialect),i=e.roles??[],c=i.filter(k=>!s.validRolesSet.has(k));if(c.length>0)return {success:false,error:new a("INVALID_ROLE",`Invalid roles: ${c.join(", ")}`)};if(!e.identifiers||e.identifiers.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one identifier is required")};let h=e.identifiers.map(k=>({type:k.type.trim(),value:k.value.trim()})),u=h.filter(k=>!s.validIdentifiersSet.has(k.type));if(u.length>0)return {success:false,error:new a("VALIDATION_ERROR",`Invalid identifier types: ${u.map(k=>k.type).join(", ")}`)};if(new Set(h.map(k=>k.value)).size!==h.length)return {success:false,error:new a("VALIDATION_ERROR","Duplicate identifier values in request")};for(let k of h)if(await oe(n,k.value))return {success:false,error:new a("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${k.value}`)};let v=await Y(e.password,s.saltRounds),{userId:D,identifierRows:C}=await n.transaction().execute(async k=>{let H=crypto.randomUUID();await k.insertInto("sentri_users").values({id:H,password_hash:v,roles:JSON.stringify(i)}).execute();let Z=h.map(M=>({id:crypto.randomUUID(),user_id:H,type:M.type,value:M.value}));return await k.insertInto("sentri_identifiers").values(Z).execute(),{userId:H,identifierRows:Z}}),b={success:true,user:{id:D,roles:i,identifiers:C.map(k=>({id:k.id,type:k.type,value:k.value}))}};return r.hooks?.onRegister&&await r.hooks.onRegister(b.user),b}o(le,"register");async function fe(e,r,t){let s=A(r),n=N(r.dialect),i=await oe(n,e.identifier.trim());if(!i){let C=new a("INVALID_CREDENTIALS","Invalid credentials");return r.hooks?.onLoginFailed&&await r.hooks.onLoginFailed(e.identifier,C,{ip:t?.ip??""}),{success:false,error:C}}if(!await Q(e.password,i.passwordHash)){let C=new a("INVALID_CREDENTIALS","Invalid credentials");return r.hooks?.onLoginFailed&&await r.hooks.onLoginFailed(e.identifier,C,{ip:t?.ip??""}),{success:false,error:C}}let h=new Date(Date.now()+V(s.refreshExpiresIn)),u=await Ce(n,{userId:i.id,expiresAt:h,ipAddress:t?.ip??null,userAgent:t?.userAgent??null}),d={id:i.id,roles:i.roles},v=re({id:i.id,roles:i.roles,sessionId:u.id},r),D=te(u.id,r);return r.hooks?.onLoginSuccess&&await r.hooks.onLoginSuccess(d,{ip:t?.ip??"",userAgent:t?.userAgent??""}),{success:true,accessToken:v,refreshToken:D,user:d}}o(fe,"login");async function B(e,r,t){let s=A(r),n=N(r.dialect),i;try{({sessionId:i}=se(e,r));}catch(C){return C instanceof a?{success:false,error:C}:{success:false,error:new a("TOKEN_INVALID","Invalid refresh token")}}let c=await Ne(n,i);if(!c)return {success:false,error:new a("UNAUTHORIZED","Session not found or revoked")};if(c.replacedBy)return await ce(n,c.userId),{success:false,error:new a("TOKEN_REUSE","Token reuse detected. All sessions revoked.")};if(c.expiresAt.getTime()<Date.now())return await Se(n,i),{success:false,error:new a("TOKEN_EXPIRED","Session has expired")};let h=new Date(Date.now()+V(s.refreshExpiresIn)),u=await Ce(n,{userId:c.userId,expiresAt:h,ipAddress:t?.ip??null,userAgent:t?.userAgent??null});await _r(n,i,u.id);let d={id:c.user.id,roles:c.user.roles},v=re({...d,sessionId:u.id},r),D=te(u.id,r);return {success:true,accessToken:v,refreshToken:D,user:d}}o(B,"refresh");async function he(e,r){let t=N(r.dialect),s;try{({sessionId:s}=se(e,r));}catch{return}let n=await Ne(t,s);n&&(await Se(t,s),r.hooks?.onLogout&&await r.hooks.onLogout(n.userId));}o(he,"logout");async function me(e,r){let t=N(r.dialect);await ce(t,e),r.hooks?.onLogout&&await r.hooks.onLogout(e);}o(me,"logoutAll");async function pe(e,r){let t=N(r.dialect),s=await de(t,e);if(!s)return {success:false,error:new a("USER_NOT_FOUND","User not found")};let n=await ne(t,e);return {success:true,user:{id:s.id,roles:s.roles,identifiers:n.map(i=>({id:i.id,type:i.type,value:i.value}))}}}o(pe,"getUser");async function we(e,r,t,s){let n=A(s),i=N(s.dialect),c=await de(i,e);if(!c)return {success:false,error:new a("USER_NOT_FOUND","User not found")};if(!await Q(r,c.passwordHash))return {success:false,error:new a("INVALID_CREDENTIALS","Invalid credentials")};let u=await Y(t,n.saltRounds);return await Ir(i,e,u),await ce(i,e),s.hooks?.onPasswordChanged&&await s.hooks.onPasswordChanged(e),{success:true}}o(we,"changePassword");async function ge(e,r,t){let s=A(t),n=N(t.dialect),i=r.filter(d=>!s.validRolesSet.has(d));if(i.length>0)return {success:false,error:new a("INVALID_ROLE",`Invalid roles: ${i.join(", ")}`)};let c=await de(n,e);if(!c)return {success:false,error:new a("USER_NOT_FOUND","User not found")};let h=new Set(c.roles);for(let d of r)h.add(d);let u=Array.from(h);return await Rr(n,e,u),{success:true,user:{id:c.id,roles:u}}}o(ge,"assignRoles");async function ye(e,r,t){let s=A(t),n=N(t.dialect);if(r.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one identifier is required")};let i=r.map(d=>({type:d.type.trim(),value:d.value.trim()})),c=i.filter(d=>!s.validIdentifiersSet.has(d.type));if(c.length>0)return {success:false,error:new a("VALIDATION_ERROR",`Invalid identifier types: ${c.map(d=>d.type).join(", ")}`)};if(new Set(i.map(d=>d.value)).size!==i.length)return {success:false,error:new a("VALIDATION_ERROR","Duplicate identifier values in request")};for(let d of i)if(await oe(n,d.value))return {success:false,error:new a("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${d.value}`)};return await pr(n,e,i),{success:true,identifiers:(await ne(n,e)).map(d=>({id:d.id,type:d.type,value:d.value}))}}o(ye,"bulkCreateIdentifiers");async function Ie(e,r,t){let s=A(t),n=N(t.dialect);if(r.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one update is required")};let i=r.map(d=>({id:d.id,type:d.type.trim(),value:d.value.trim()})),c=i.filter(d=>!s.validIdentifiersSet.has(d.type));if(c.length>0)return {success:false,error:new a("VALIDATION_ERROR",`Invalid identifier types: ${c.map(d=>d.type).join(", ")}`)};if(new Set(i.map(d=>d.value)).size!==i.length)return {success:false,error:new a("VALIDATION_ERROR","Duplicate identifier values in request")};for(let d of i){let v=await De(n,d.id,e);if(!v)return {success:false,error:new a("IDENTIFIER_NOT_FOUND",`Identifier not found: ${d.id}`)};if(v.value!==d.value&&await oe(n,d.value))return {success:false,error:new a("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${d.value}`)}}return await n.transaction().execute(async d=>{for(let v of i)await gr(d,v.id,e,{type:v.type,value:v.value});}),{success:true,identifiers:(await ne(n,e)).map(d=>({id:d.id,type:d.type,value:d.value}))}}o(Ie,"bulkUpdateIdentifiers");async function Re(e,r,t){let s=N(t.dialect);if(r.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one ID is required")};let n=Array.from(new Set(r));for(let h of n)if(!await De(s,h,e))return {success:false,error:new a("IDENTIFIER_NOT_FOUND",`Identifier not found: ${h}`)};return await wr(s,e)-n.length<1?{success:false,error:new a("VALIDATION_ERROR","Cannot delete all identifiers \u2014 at least one must remain")}:(await yr(s,e,n),{success:true,identifiers:(await ne(s,e)).map(h=>({id:h.id,type:h.type,value:h.value}))})}o(Re,"bulkDeleteIdentifiers");function F(e){return A(e).cookieName}o(F,"getCookieName");function _e(e){return A(e).accessCookieName}o(_e,"getAccessCookieName");function K(e,r){if(!e)return;let t=`${r}=`,s=0;for(;s<e.length;){for(;s<e.length&&e[s]===" ";)s++;let n=e.indexOf(";",s),i=n===-1?e.length:n;if(e.startsWith(t,s))return e.slice(s+t.length,i);s=i+1;}}o(K,"readCookie");function ie(e,r,t){let s=t.cookie??{},n=V(A(t).refreshExpiresIn)/1e3;e.cookie??={},e.cookie[F(t)]={value:r,httpOnly:s.httpOnly??true,secure:s.secure??false,sameSite:s.sameSite??"strict",path:s.path??"/",maxAge:n};}o(ie,"setCookieFromConfig");function ve(e,r){let t=r.cookie??{};e.cookie??={},e.cookie[F(r)]={value:"",httpOnly:t.httpOnly??true,path:t.path??"/",maxAge:0};}o(ve,"clearCookieFromConfig");function ae(e,r,t){if(!t.accessCookie)return;let s=t.accessCookie,n=V(A(t).accessExpiresIn)/1e3;e.cookie??={},e.cookie[_e(t)]={value:r,httpOnly:false,secure:s.secure??false,sameSite:s.sameSite??"strict",path:s.path??"/",maxAge:n};}o(ae,"setAccessCookieFromConfig");function Oe(e,r){if(!r.accessCookie)return;let t=r.accessCookie;e.cookie??={},e.cookie[_e(r)]={value:"",httpOnly:false,path:t.path??"/",maxAge:0};}o(Oe,"clearAccessCookieFromConfig");function j(e,r){let t=e.headers.get("authorization");if(t?.startsWith("Bearer "))return t.slice(7);let s=e.headers.get("cookie");return s?K(s,_e(r)):void 0}o(j,"getCurrentAccessToken");function be(e){let r=e.logger??S,t=e.loggerService??"sentri";if(e.mode==="client"){let n=e;return new elysia.Elysia().derive({as:"global"},async({request:i})=>{let c=i.headers.get("authorization"),h=c?.startsWith("Bearer ")?c.slice(7):void 0;if(!h)throw r.warn(m(t,"auth.protect.failure",{mode:"client",errorCode:"UNAUTHORIZED"})),new a("UNAUTHORIZED","Missing or malformed Authorization header");try{let u=await tr(n.keyUri),d=fr(h,u),v={id:d.id,roles:d.roles};return r.info(m(t,"auth.protect.success",{mode:"client",userId:d.id})),{user:v}}catch(u){let d=u instanceof a?u.code:"TOKEN_INVALID";throw r.warn(m(t,"auth.protect.failure",{mode:"client",errorCode:d})),u}})}let s=e;return new elysia.Elysia().derive({as:"global"},async({request:n,set:i})=>{let c=j(n,s);if(!c)throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:"UNAUTHORIZED"})),new a("UNAUTHORIZED","Missing or malformed Authorization header");try{let h=q(c,s);if(s.isTokenRevoked&&await s.isTokenRevoked(h.sessionId))throw r.warn(m(t,"auth.protect.token_revoked",{mode:"server",userId:h.id})),new a("UNAUTHORIZED","Token has been revoked");let u={id:h.id,roles:h.roles};return r.info(m(t,"auth.protect.success",{mode:"server",userId:h.id})),{user:u}}catch(h){if(h instanceof a&&h.code==="TOKEN_EXPIRED"){let d=n.headers.get("cookie"),v=d?K(d,F(s)):void 0;if(!v)throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:"TOKEN_EXPIRED"})),new a("UNAUTHORIZED","Token expired. Please login again.");let D;try{D=await B(v,s);}catch{throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:"TOKEN_EXPIRED"})),new a("UNAUTHORIZED","Session expired. Please login again.")}if(!D.success)throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:D.error.code})),new a("UNAUTHORIZED","Session expired. Please login again.");return ie(i,D.refreshToken,s),ae(i,D.accessToken,s),i.headers["X-New-Access-Token"]=D.accessToken,r.info(m(t,"auth.protect.auto_refresh",{mode:"server",userId:D.user.id})),{user:D.user}}let u=h instanceof a?h.code:"TOKEN_INVALID";throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:u})),h}})}o(be,"protect");function Er(e,r,t){let s=`Requires one of roles: ${e.join(", ")}`;return ({user:n})=>{if(!n)throw r.warn(m(t,"auth.authorize.unauthenticated",{requiredRoles:e})),new a("UNAUTHORIZED","Not authenticated");let i=n.roles;if(!e.some(c=>i.includes(c)))throw r.warn(m(t,"auth.authorize.denied",{userId:n.id,userRoles:[...i],requiredRoles:e})),new a("FORBIDDEN",s);r.info(m(t,"auth.authorize.passed",{userId:n.id,userRoles:[...i],requiredRoles:e}));}}o(Er,"createAuthorizeHandler");function Ue(e,r){return o(function(...s){return Er(s,e,r)},"authorize")}o(Ue,"createAuthorize");function $r(...e){return Er(e,S,"sentri")}o($r,"authorize");var Hr=new a("FORBIDDEN","You do not have permission to perform this action");function kr(e,r,t){return async s=>{let n=s.user;if(!n)throw r.warn(m(t,"auth.permit.unauthenticated",{})),new a("UNAUTHORIZED","Not authenticated");if(e.roles&&e.roles.length>0){let i=n.roles;if(e.roles.some(c=>i.includes(c))){r.info(m(t,"auth.permit.role_bypass",{userId:n.id,bypassedByRole:true}));return}}try{let i=e.check(s);if(i instanceof Promise?await i:i)r.info(m(t,"auth.permit.passed",{userId:n.id}));else throw r.warn(m(t,"auth.permit.denied",{userId:n.id})),Hr}catch(i){throw i}}}o(kr,"createPermitHandler");function Le(e,r){return o(function(s){return kr(typeof s=="function"?{check:s}:s,e,r)},"permit")}o(Le,"createPermit");function Mr(e){return kr(typeof e=="function"?{check:e}:e,S,"sentri")}o(Mr,"permit");function ue(e){return ({error:r,set:t})=>r instanceof a?(t.status=r.statusCode,{error:true,statusCode:r.statusCode,code:r.code,message:r.message,data:null}):(e?.onUnhandled?.(r),t.status=500,{error:true,statusCode:500,code:"INTERNAL_SERVER_ERROR",message:"Internal server error",data:null})}o(ue,"createErrorHandler");var Fe=class{static{o(this,"InMemoryRateLimiter");}store=new Map;constructor(){setInterval(()=>{let r=Date.now();for(let[t,s]of this.store.entries())s.expiresAt<r&&this.store.delete(t);},6e4).unref();}async consume(r,t,s){let n=Date.now(),i=this.store.get(r);if((!i||i.expiresAt<n)&&(i={count:0,expiresAt:n+s},this.store.set(r,i)),i.count>=t){let c=Math.ceil((i.expiresAt-n)/1e3);throw new a("RATE_LIMIT_EXCEEDED",`Rate limit exceeded. Try again in ${c} seconds.`)}i.count++;}},Pe=class{static{o(this,"RedisRateLimiter");}redis;logger;constructor(r,t){this.redis=r,this.logger=t;}async consume(r,t,s){let n=`sentri:rl:${r}`,i=Math.ceil(s/1e3);try{let c=await this.redis.multi().incr(n).expire(n,i,"NX").exec();if(!c||c.length===0)return;if(c[0][1]>t)throw new a("RATE_LIMIT_EXCEEDED","Rate limit exceeded. Try again later.")}catch(c){if(c instanceof a&&c.code==="RATE_LIMIT_EXCEEDED")throw c;this.logger.error({msg:"Redis RateLimiter failed, bypassing limit",error:c});}}},X=null;async function Tr(e,r){if(X)return X;if(e)try{let{Redis:t}=await import('ioredis'),s=new t(e,{lazyConnect:!0,maxRetriesPerRequest:1});return await s.connect(),r?.info({msg:"Connected to Redis for Rate Limiting"}),X=new Pe(s,r??S),X}catch(t){r?.warn({msg:"Failed to connect to Redis for Rate Limiting, falling back to InMemoryRateLimiter",error:t});}return X=new Fe,X}o(Tr,"getRateLimiter");var Ae=8,z=72,Ee=255,xr=100,G=50;function _(e){return new a("VALIDATION_ERROR",e)}o(_,"badRequest");function O(e,r,t,s){return e.status=r,{error:false,statusCode:r,message:t,data:s}}o(O,"ok");function $(e){if(e==null||typeof e!="object"||Array.isArray(e))throw new a("VALIDATION_ERROR","Request body is missing or not a JSON object. Did you set Content-Type: application/json?");return e}o($,"parseBody");function qr(e,r){if(!r.apiKey)return;let t=e.headers.get("x-api-key");if(typeof t!="string"||t!==r.apiKey)throw new a("UNAUTHORIZED","Invalid or missing API key")}o(qr,"validateApiKey");function Ke(e){if(e)try{let r=e();r instanceof Promise&&r.catch(()=>{});}catch{}}o(Ke,"fireHook");function Br(e){return e.startsWith("RS")||e.startsWith("PS")}o(Br,"isRSA");function $e(e,r){if(typeof e!="object"||e===null||Array.isArray(e))throw _(`identifiers[${r}] must be an object`);let t=e;if(typeof t.type!="string"||t.type.trim().length===0)throw _(`identifiers[${r}].type is required and must be a non-empty string`);if(t.type.length>xr)throw _(`identifiers[${r}].type must not exceed ${xr} characters`);if(typeof t.value!="string"||t.value.trim().length===0)throw _(`identifiers[${r}].value is required and must be a non-empty string`);if(t.value.length>Ee)throw _(`identifiers[${r}].value must not exceed ${Ee} characters`);return {type:t.type,value:t.value}}o($e,"validateIdentifierInput");async function P(e,r,t){let s=j(e,t);if(!s)throw new a("UNAUTHORIZED","Missing or malformed Authorization header");let n=q(s,t);if(t.isTokenRevoked&&await t.isTokenRevoked(n.sessionId))throw new a("UNAUTHORIZED","Token has been revoked");return {id:n.id,roles:n.roles}}o(P,"requireAuth");function Dr(e){let r=e,t=A(r),s=e.logger??S,n=e.loggerService??"sentri",i=e.router?.register??(l=>le(l,r)),c=e.router?.login??(l=>fe(l,r)),h=e.router?.refresh??(l=>B(l,r)),u=e.router?.logout??(l=>l!==void 0?he(l,r):Promise.resolve()),d=e.router?.logoutAll??(l=>me(l,r)),v=e.router?.getUser??(l=>pe(l,r)),D=e.router?.assignRoles??((l,f)=>ge(l,f,r)),C=e.router?.changePassword??((l,f,g)=>we(l,f,g,r)),b=e.router?.bulkCreateIdentifiers??((l,f)=>ye(l,f,r)),k=e.router?.bulkUpdateIdentifiers??((l,f)=>Ie(l,f,r)),H=e.router?.bulkDeleteIdentifiers??((l,f)=>Re(l,f,r)),Z=Tr(e.redisUrl,s),M=new elysia.Elysia().onError(ue());return Br(t.algorithm)&&M.get("/keys",({set:l})=>(l.headers["Cache-Control"]="public, max-age=3600",er(e.secret))),M.post("/register",async({body:l,request:f,set:g})=>{let I=Date.now();qr(f,r);let p=$(l),{identifiers:x,password:w,roles:R}=p;if(!Array.isArray(x)||x.length===0)throw _("identifiers is required and must be a non-empty array");if(x.length>G)throw _(`identifiers must not exceed ${G} entries`);let y=x.map((J,ke)=>$e(J,ke));if(typeof w!="string"||w.length<Ae)throw _(`password is required and must be at least ${Ae} characters`);if(w.length>z)throw _(`password must not exceed ${z} characters`);if(R!==void 0&&!Array.isArray(R))throw _("roles must be an array of strings when provided");if(Array.isArray(R)&&!R.every(J=>typeof J=="string"))throw _("each role must be a string");let T=Array.isArray(R)?R:void 0,E=T!==void 0?{identifiers:y,password:w,roles:T}:{identifiers:y,password:w},L=f.headers.get("x-forwarded-for")||"127.0.0.1",W=f.headers.get("user-agent")||"Unknown";if(e.rateLimit!==false){let J=await Z,ke=typeof e.rateLimit=="object"?e.rateLimit.maxRegisterAttempts??5:5;await J.consume(`register:${L}`,ke,900*1e3);}let U=await i(E,{ip:L,userAgent:W});return U.success?(s.info(m(n,"auth.register.success",{userId:U.user.id,duration_ms:Date.now()-I})),O(g,201,"User registered successfully",{user:U.user})):(s.warn(m(n,"auth.register.failure",{errorCode:U.error.code,duration_ms:Date.now()-I})),g.status=U.error.statusCode,{error:true,statusCode:U.error.statusCode,code:U.error.code,message:U.error.message,data:null})}).post("/login",async({body:l,request:f,set:g})=>{let I=Date.now(),p=$(l),{identifier:x,password:w}=p;if(typeof x!="string"||x.trim().length===0)throw _("identifier is required and must be a non-empty string");if(x.length>Ee)throw _(`identifier must not exceed ${Ee} characters`);if(typeof w!="string"||w.length===0)throw _("password is required");if(w.length>z)throw _(`password must not exceed ${z} characters`);let R=x.trim(),y=f.headers.get("x-forwarded-for")||"127.0.0.1",T=f.headers.get("user-agent")||"Unknown";if(e.rateLimit!==false){let L=await Z,W=typeof e.rateLimit=="object"?e.rateLimit.maxLoginAttempts??5:5;await L.consume(`login:${y}`,W,900*1e3);}let E=await c({identifier:R,password:w},{ip:y,userAgent:T});return E.success?(Ke(()=>r.hooks?.onLoginSuccess?.(E.user,{ip:y,userAgent:T})),ie(g,E.refreshToken,r),ae(g,E.accessToken,r),s.info(m(n,"auth.login.success",{userId:E.user.id,duration_ms:Date.now()-I})),O(g,200,"Login successful",{accessToken:E.accessToken,user:E.user})):(Ke(()=>r.hooks?.onLoginFailed?.(R,E.error,{ip:y})),s.warn(m(n,"auth.login.failure",{errorCode:E.error.code,duration_ms:Date.now()-I})),g.status=E.error.statusCode,{error:true,statusCode:E.error.statusCode,code:E.error.code,message:E.error.message,data:null})}).post("/refresh",async({request:l,set:f})=>{let g=Date.now(),I=K(l.headers.get("cookie")??void 0,F(r));if(!I)throw new a("UNAUTHORIZED","Refresh token cookie is missing");let p=l.headers.get("x-forwarded-for")||"127.0.0.1",x=l.headers.get("user-agent")||"Unknown",w=await h(I,{ip:p,userAgent:x});return w.success?(ie(f,w.refreshToken,r),ae(f,w.accessToken,r),s.info(m(n,"auth.refresh.success",{userId:w.user.id,duration_ms:Date.now()-g})),O(f,200,"Token refreshed",{accessToken:w.accessToken})):(ve(f,r),s.warn(m(n,"auth.refresh.failure",{errorCode:w.error.code,duration_ms:Date.now()-g})),f.status=w.error.statusCode,{error:true,statusCode:w.error.statusCode,code:w.error.code,message:w.error.message,data:null})}).post("/logout",async({request:l,set:f})=>{let g=Date.now(),I=K(l.headers.get("cookie")??void 0,F(r));return await u(I),ve(f,r),Oe(f,r),s.info(m(n,"auth.logout",{duration_ms:Date.now()-g})),O(f,200,"Logged out",null)}).post("/logout-all",async({request:l,set:f})=>{let g=Date.now(),I=await P(l,f,r);return await d(I.id),Ke(()=>r.hooks?.onLogout?.(I.id)),ve(f,r),Oe(f,r),s.info(m(n,"auth.logout_all",{userId:I.id,duration_ms:Date.now()-g})),O(f,200,"All sessions revoked",null)}).get("/me",async({request:l,set:f})=>{let g=Date.now(),I=await P(l,f,r),p=await v(I.id);return p.success?(s.info(m(n,"auth.me.success",{userId:p.user.id,duration_ms:Date.now()-g})),O(f,200,"OK",p.user)):(s.warn(m(n,"auth.me.failure",{userId:I.id,errorCode:p.error.code,duration_ms:Date.now()-g})),f.status=p.error.statusCode,{error:true,statusCode:p.error.statusCode,code:p.error.code,message:p.error.message,data:null})}).get("/me/identifiers",async({request:l,set:f})=>{let g=Date.now(),I=await P(l,f,r),p=await v(I.id);return p.success?(s.info(m(n,"auth.me.identifiers.success",{userId:p.user.id,count:p.user.identifiers?.length??0,duration_ms:Date.now()-g})),O(f,200,"OK",{identifiers:p.user.identifiers??[]})):(s.warn(m(n,"auth.me.identifiers.failure",{userId:I.id,errorCode:p.error.code,duration_ms:Date.now()-g})),f.status=p.error.statusCode,{error:true,statusCode:p.error.statusCode,code:p.error.code,message:p.error.message,data:null})}).post("/me/identifiers",async({body:l,request:f,set:g})=>{let I=Date.now(),p=await P(f,g,r),x=$(l),{identifiers:w}=x;if(!Array.isArray(w)||w.length===0)throw _("identifiers is required and must be a non-empty array");if(w.length>G)throw _(`identifiers must not exceed ${G} entries`);let R=w.map((T,E)=>$e(T,E)),y=await b(p.id,R);return y.success?(s.info(m(n,"auth.identifiers.created",{userId:p.id,count:y.identifiers.length,duration_ms:Date.now()-I})),O(g,201,"Identifiers added successfully",{identifiers:y.identifiers})):(s.warn(m(n,"auth.identifiers.create_failure",{userId:p.id,errorCode:y.error.code,duration_ms:Date.now()-I})),g.status=y.error.statusCode,{error:true,statusCode:y.error.statusCode,code:y.error.code,message:y.error.message,data:null})}).put("/me/identifiers",async({body:l,request:f,set:g})=>{let I=Date.now(),p=await P(f,g,r),x=$(l),{identifiers:w}=x;if(!Array.isArray(w)||w.length===0)throw _("identifiers is required and must be a non-empty array");if(w.length>G)throw _(`identifiers must not exceed ${G} entries`);let R=w.map((T,E)=>{if(typeof T!="object"||T===null||Array.isArray(T))throw _(`identifiers[${E}] must be an object`);let L=T;if(typeof L.id!="string"||L.id.trim().length===0)throw _(`identifiers[${E}].id is required and must be a non-empty string`);let{type:W,value:U}=$e(T,E);return {id:L.id,type:W,value:U}}),y=await k(p.id,R);return y.success?(s.info(m(n,"auth.identifiers.updated",{userId:p.id,count:y.identifiers.length,duration_ms:Date.now()-I})),O(g,200,"Identifiers updated successfully",{identifiers:y.identifiers})):(s.warn(m(n,"auth.identifiers.update_failure",{userId:p.id,errorCode:y.error.code,duration_ms:Date.now()-I})),g.status=y.error.statusCode,{error:true,statusCode:y.error.statusCode,code:y.error.code,message:y.error.message,data:null})}).delete("/me/identifiers",async({body:l,request:f,set:g})=>{let I=Date.now(),p=await P(f,g,r),x=$(l),{ids:w}=x;if(!Array.isArray(w)||w.length===0)throw _("ids is required and must be a non-empty array of strings");if(!w.every(y=>typeof y=="string"))throw _("each id must be a string");let R=await H(p.id,w);return R.success?(s.info(m(n,"auth.identifiers.deleted",{userId:p.id,duration_ms:Date.now()-I})),O(g,200,"Identifiers deleted successfully",{identifiers:R.identifiers})):(s.warn(m(n,"auth.identifiers.delete_failure",{userId:p.id,errorCode:R.error.code,duration_ms:Date.now()-I})),g.status=R.error.statusCode,{error:true,statusCode:R.error.statusCode,code:R.error.code,message:R.error.message,data:null})}).patch("/me/password",async({body:l,request:f,set:g})=>{let I=Date.now(),p=await P(f,g,r),x=$(l),{currentPassword:w,newPassword:R}=x;if(typeof w!="string"||w.length===0)throw _("currentPassword is required");if(typeof R!="string"||R.length<Ae)throw _(`newPassword must be at least ${Ae} characters`);if(R.length>z)throw _(`newPassword must not exceed ${z} characters`);if(w===R)throw _("newPassword must be different from currentPassword");let y=await C(p.id,w,R);return y.success?(s.info(m(n,"auth.password.changed",{userId:p.id,duration_ms:Date.now()-I})),O(g,200,"Password updated successfully. All sessions have been revoked.",null)):(s.warn(m(n,"auth.password.change_failure",{userId:p.id,errorCode:y.error.code,duration_ms:Date.now()-I})),g.status=y.error.statusCode,{error:true,statusCode:y.error.statusCode,code:y.error.code,message:y.error.message,data:null})}).post("/users/:userId/roles",async({body:l,request:f,set:g,params:I})=>{let p=Date.now();if(!(await P(f,g,r)).roles.includes("admin"))throw new a("FORBIDDEN","Requires one of roles: admin");let w=$(l),{roles:R}=w,{userId:y}=I;if(!y)throw _("userId is required");if(!Array.isArray(R)||R.length===0)throw _("roles must be a non-empty array of strings");if(!R.every(E=>typeof E=="string"))throw _("each role must be a string");let T=await D(y,R);return T.success?(s.info(m(n,"auth.roles.assigned",{targetUserId:y,roles:R,duration_ms:Date.now()-p})),O(g,200,"Roles assigned successfully",{user:T.user})):(s.warn(m(n,"auth.roles.assign_failure",{targetUserId:y,errorCode:T.error.code,duration_ms:Date.now()-p})),g.status=T.error.statusCode,{error:true,statusCode:T.error.statusCode,code:T.error.code,message:T.error.message,data:null})}),M}o(Dr,"createAuthRouter");function Fs(e){if(e.mode==="client"){let u={mode:"client",keyUri:e.keyUri,...e.validRoles!==void 0&&{validRoles:e.validRoles},...e.logger!==void 0&&{logger:e.logger},...e.loggerService!==void 0&&{loggerService:e.loggerService}};Xe(u);let d=u.logger??S,v=u.loggerService??"sentri",D=Ue(d,v),C=Le(d,v);return {protect:o(()=>be(u),"protect"),authorize:o((...b)=>D(...b),"authorize"),permit:o(b=>C(b),"permit"),errorHandler:o(b=>ue(b),"errorHandler")}}let{privateKey:r}=crypto.generateKeyPairSync("rsa",{modulusLength:2048,privateKeyEncoding:{type:"pkcs8",format:"pem"},publicKeyEncoding:{type:"spki",format:"pem"}}),t={mode:"server",dialect:e.dialect,secret:r,algorithm:"RS256",validRoles:e.validRoles,...e.validIdentifiers!==void 0&&{validIdentifiers:e.validIdentifiers},...e.accessExpiresIn!==void 0&&{accessExpiresIn:e.accessExpiresIn},...e.refreshExpiresIn!==void 0&&{refreshExpiresIn:e.refreshExpiresIn},...e.saltRounds!==void 0&&{saltRounds:e.saltRounds},...e.apiKey!==void 0&&{apiKey:e.apiKey},...e.cookie!==void 0&&{cookie:e.cookie},...e.accessCookie!==void 0&&{accessCookie:e.accessCookie},...e.hooks!==void 0&&{hooks:e.hooks},...e.router!==void 0&&{router:e.router},...e.isTokenRevoked!==void 0&&{isTokenRevoked:e.isTokenRevoked},...e.rateLimit!==void 0&&{rateLimit:e.rateLimit},...e.redisUrl!==void 0&&{redisUrl:e.redisUrl},...e.logger!==void 0&&{logger:e.logger},...e.loggerService!==void 0&&{loggerService:e.loggerService}},s=t.logger??S,n=t.loggerService??"sentri",i=A(t),c=Ue(s,n),h=Le(s,n);return {protect:o(()=>be(t),"protect"),authorize:o((...u)=>c(...u),"authorize"),permit:o(u=>h(u),"permit"),errorHandler:o(u=>ue(u),"errorHandler"),router:o(()=>Dr(t),"router"),migrate:o(()=>ze(N(t.dialect)),"migrate"),getCurrentAccessToken:o(u=>j(u,t),"getCurrentAccessToken"),hashPassword:o(u=>Y(u,i.saltRounds),"hashPassword"),verifyPassword:o((u,d)=>Q(u,d),"verifyPassword"),signAccessToken:o(u=>re(u,t),"signAccessToken"),signRefreshToken:o(u=>te(u,t),"signRefreshToken"),verifyAccessToken:o(u=>q(u,t),"verifyAccessToken"),verifyRefreshToken:o(u=>se(u,t),"verifyRefreshToken"),register:o(u=>le(u,t),"register"),login:o(u=>fe(u,t),"login"),refresh:o(u=>B(u,t),"refresh"),logout:o(u=>he(u,t),"logout"),logoutAll:o(u=>me(u,t),"logoutAll"),getUser:o(u=>pe(u,t),"getUser"),changePassword:o((u,d,v)=>we(u,d,v,t),"changePassword"),assignRoles:o((u,d)=>ge(u,d,t),"assignRoles"),bulkCreateIdentifiers:o((u,d)=>ye(u,d,t),"bulkCreateIdentifiers"),bulkUpdateIdentifiers:o((u,d)=>Ie(u,d,t),"bulkUpdateIdentifiers"),bulkDeleteIdentifiers:o((u,d)=>Re(u,d,t),"bulkDeleteIdentifiers")}}o(Fs,"createAuthElysia");exports.SENTRI_ERROR_STATUS=He;exports.SentriError=a;exports.authorize=$r;exports.createAuthElysia=Fs;exports.createAuthRouter=Dr;exports.createAuthorize=Ue;exports.createErrorHandler=ue;exports.createPermit=Le;exports.getCurrentAccessToken=j;exports.permit=Mr;exports.protect=be;

package/dist/adapters/elysia/index.d.cts

@@ -1,8 +1,8 @@
+import { a as AuthConfig, A as AuthUser, S as SentriLogger, b as ServerAuthConfig, C as CookieConfig, c as AccessCookieConfig, d as AuthHooks, R as RouterHandlers, e as RateLimitOptions, f as RegisterInput, g as RegisterResult, L as LoginInput, h as AuthResult, i as RefreshResult, G as GetUserResult, j as ChangePasswordResult, k as AssignRolesResult, I as IdentifierInput, B as BulkIdentifiersResult } from '../../index-CVb3-EnK.cjs';
+export { n as ApiResponse, o as ClientAuthConfig, p as IdentifierRecord, l as SENTRI_ERROR_STATUS, m as SentriError, q as SentriErrorCode } from '../../index-CVb3-EnK.cjs';
 import * as kysely from 'kysely';
 import * as elysia from 'elysia';
 import { Elysia } from 'elysia';
-import { AuthConfig, AuthUser, SentriLogger, ServerAuthConfig, CookieConfig, AccessCookieConfig, AuthHooks, RouterHandlers, RegisterInput, RegisterResult, LoginInput, AuthResult, RefreshResult, GetUserResult, ChangePasswordResult, AssignRolesResult, IdentifierInput, BulkIdentifiersResult } from '../../core/index.cjs';
-export { ApiResponse, ClientAuthConfig, IdentifierRecord, SENTRI_ERROR_STATUS, SentriError, SentriErrorCode } from '../../core/index.cjs';
 
 declare function protect(config: AuthConfig): Elysia<"", {
     decorator: {};
@@ -77,6 +77,7 @@ declare function createAuthRouter<TRole extends string>(config: ServerAuthConfig
 interface CreateElysiaServerOptions<TRole extends string = string> {
     mode: 'server';
     validRoles: readonly TRole[];
+    validIdentifiers?: readonly string[];
     dialect: kysely.Dialect;
     accessExpiresIn?: string | number;
     refreshExpiresIn?: string | number;
@@ -87,6 +88,7 @@ interface CreateElysiaServerOptions<TRole extends string = string> {
     hooks?: AuthHooks;
     router?: RouterHandlers;
     isTokenRevoked?: (sessionId: string) => boolean | Promise<boolean>;
+    rateLimit?: RateLimitOptions | boolean;
     redisUrl?: string;
     logger?: SentriLogger;
     loggerService?: string;
@@ -99,11 +101,14 @@ interface CreateElysiaClientOptions<TRole extends string = string> {
     loggerService?: string;
 }
 interface ElysiaAuthClient<TRole extends string = string> {
+    /** Elysia plugin that ensures the request has a valid access token. Attaches `ctx.user`. */
     protect(): any;
+    /** Middleware that ensures the user has AT LEAST ONE of the required roles. */
     authorize(...roles: TRole[]): (ctx: {
         user?: AuthUser;
         [key: string]: unknown;
     }) => void;
+    /** Middleware that evaluates a custom authorization condition or ABAC rules. */
     permit(check: ElysiaPermitCheck): (ctx: {
         user?: AuthUser;
         [key: string]: unknown;
@@ -112,10 +117,13 @@ interface ElysiaAuthClient<TRole extends string = string> {
         user?: AuthUser;
         [key: string]: unknown;
     }) => void | Promise<void>;
+    /** Elysia error handler that converts Sentri errors to standardized JSON responses. */
     errorHandler(options?: ElysiaErrorHandlerOptions): ElysiaErrorHandler;
 }
 interface ElysiaServerAuthClient<TRole extends string = string> extends ElysiaAuthClient<TRole> {
+    /** Returns an Elysia router containing all auth endpoints (e.g. POST /register). */
     router(): any;
+    /** Runs Kysely database migrations for Sentri tables. */
     migrate(): Promise<void>;
     getCurrentAccessToken(request: Request): string | undefined;
     hashPassword(plain: string): Promise<string>;
@@ -143,7 +151,15 @@ interface ElysiaServerAuthClient<TRole extends string = string> extends ElysiaAu
     bulkDeleteIdentifiers(userId: string, ids: string[]): Promise<BulkIdentifiersResult>;
 }
 type ElysiaClientAuthClient<TRole extends string = string> = ElysiaAuthClient<TRole>;
+/**
+ * Creates an Elysia authentication client (Server Mode).
+ * Configures database connections, handles registration, issues tokens, and mounts endpoints.
+ */
 declare function createAuthElysia<TRole extends string = string>(options: CreateElysiaServerOptions<TRole>): ElysiaServerAuthClient<TRole>;
+/**
+ * Creates an Elysia authentication client (Client Mode).
+ * Used for microservices that only verify tokens issued by a separate auth server.
+ */
 declare function createAuthElysia<TRole extends string = string>(options: CreateElysiaClientOptions<TRole>): ElysiaClientAuthClient<TRole>;
 
 export { AccessCookieConfig, AssignRolesResult, AuthConfig, AuthHooks, AuthResult, AuthUser, BulkIdentifiersResult, ChangePasswordResult, CookieConfig, type CreateElysiaClientOptions, type CreateElysiaServerOptions, type ElysiaAuthClient, type ElysiaClientAuthClient, type ElysiaErrorHandler, type ElysiaErrorHandlerOptions, type ElysiaPermitCheck, type ElysiaPermitOptions, type ElysiaServerAuthClient, GetUserResult, IdentifierInput, LoginInput, RefreshResult, RegisterInput, RegisterResult, RouterHandlers, type SentriElysiaVariables, SentriLogger, ServerAuthConfig, authorize, createAuthElysia, createAuthRouter, createAuthorize, createErrorHandler, createPermit, getCurrentAccessToken, permit, protect };

package/dist/adapters/elysia/index.d.ts

@@ -1,8 +1,8 @@
+import { a as AuthConfig, A as AuthUser, S as SentriLogger, b as ServerAuthConfig, C as CookieConfig, c as AccessCookieConfig, d as AuthHooks, R as RouterHandlers, e as RateLimitOptions, f as RegisterInput, g as RegisterResult, L as LoginInput, h as AuthResult, i as RefreshResult, G as GetUserResult, j as ChangePasswordResult, k as AssignRolesResult, I as IdentifierInput, B as BulkIdentifiersResult } from '../../index-CVb3-EnK.js';
+export { n as ApiResponse, o as ClientAuthConfig, p as IdentifierRecord, l as SENTRI_ERROR_STATUS, m as SentriError, q as SentriErrorCode } from '../../index-CVb3-EnK.js';
 import * as kysely from 'kysely';
 import * as elysia from 'elysia';
 import { Elysia } from 'elysia';
-import { AuthConfig, AuthUser, SentriLogger, ServerAuthConfig, CookieConfig, AccessCookieConfig, AuthHooks, RouterHandlers, RegisterInput, RegisterResult, LoginInput, AuthResult, RefreshResult, GetUserResult, ChangePasswordResult, AssignRolesResult, IdentifierInput, BulkIdentifiersResult } from '../../core/index.js';
-export { ApiResponse, ClientAuthConfig, IdentifierRecord, SENTRI_ERROR_STATUS, SentriError, SentriErrorCode } from '../../core/index.js';
 
 declare function protect(config: AuthConfig): Elysia<"", {
     decorator: {};
@@ -77,6 +77,7 @@ declare function createAuthRouter<TRole extends string>(config: ServerAuthConfig
 interface CreateElysiaServerOptions<TRole extends string = string> {
     mode: 'server';
     validRoles: readonly TRole[];
+    validIdentifiers?: readonly string[];
     dialect: kysely.Dialect;
     accessExpiresIn?: string | number;
     refreshExpiresIn?: string | number;
@@ -87,6 +88,7 @@ interface CreateElysiaServerOptions<TRole extends string = string> {
     hooks?: AuthHooks;
     router?: RouterHandlers;
     isTokenRevoked?: (sessionId: string) => boolean | Promise<boolean>;
+    rateLimit?: RateLimitOptions | boolean;
     redisUrl?: string;
     logger?: SentriLogger;
     loggerService?: string;
@@ -99,11 +101,14 @@ interface CreateElysiaClientOptions<TRole extends string = string> {
     loggerService?: string;
 }
 interface ElysiaAuthClient<TRole extends string = string> {
+    /** Elysia plugin that ensures the request has a valid access token. Attaches `ctx.user`. */
     protect(): any;
+    /** Middleware that ensures the user has AT LEAST ONE of the required roles. */
     authorize(...roles: TRole[]): (ctx: {
         user?: AuthUser;
         [key: string]: unknown;
     }) => void;
+    /** Middleware that evaluates a custom authorization condition or ABAC rules. */
     permit(check: ElysiaPermitCheck): (ctx: {
         user?: AuthUser;
         [key: string]: unknown;
@@ -112,10 +117,13 @@ interface ElysiaAuthClient<TRole extends string = string> {
         user?: AuthUser;
         [key: string]: unknown;
     }) => void | Promise<void>;
+    /** Elysia error handler that converts Sentri errors to standardized JSON responses. */
     errorHandler(options?: ElysiaErrorHandlerOptions): ElysiaErrorHandler;
 }
 interface ElysiaServerAuthClient<TRole extends string = string> extends ElysiaAuthClient<TRole> {
+    /** Returns an Elysia router containing all auth endpoints (e.g. POST /register). */
     router(): any;
+    /** Runs Kysely database migrations for Sentri tables. */
     migrate(): Promise<void>;
     getCurrentAccessToken(request: Request): string | undefined;
     hashPassword(plain: string): Promise<string>;
@@ -143,7 +151,15 @@ interface ElysiaServerAuthClient<TRole extends string = string> extends ElysiaAu
     bulkDeleteIdentifiers(userId: string, ids: string[]): Promise<BulkIdentifiersResult>;
 }
 type ElysiaClientAuthClient<TRole extends string = string> = ElysiaAuthClient<TRole>;
+/**
+ * Creates an Elysia authentication client (Server Mode).
+ * Configures database connections, handles registration, issues tokens, and mounts endpoints.
+ */
 declare function createAuthElysia<TRole extends string = string>(options: CreateElysiaServerOptions<TRole>): ElysiaServerAuthClient<TRole>;
+/**
+ * Creates an Elysia authentication client (Client Mode).
+ * Used for microservices that only verify tokens issued by a separate auth server.
+ */
 declare function createAuthElysia<TRole extends string = string>(options: CreateElysiaClientOptions<TRole>): ElysiaClientAuthClient<TRole>;
 
 export { AccessCookieConfig, AssignRolesResult, AuthConfig, AuthHooks, AuthResult, AuthUser, BulkIdentifiersResult, ChangePasswordResult, CookieConfig, type CreateElysiaClientOptions, type CreateElysiaServerOptions, type ElysiaAuthClient, type ElysiaClientAuthClient, type ElysiaErrorHandler, type ElysiaErrorHandlerOptions, type ElysiaPermitCheck, type ElysiaPermitOptions, type ElysiaServerAuthClient, GetUserResult, IdentifierInput, LoginInput, RefreshResult, RegisterInput, RegisterResult, RouterHandlers, type SentriElysiaVariables, SentriLogger, ServerAuthConfig, authorize, createAuthElysia, createAuthRouter, createAuthorize, createErrorHandler, createPermit, getCurrentAccessToken, permit, protect };

package/dist/adapters/elysia/index.js

@@ -1 +1 @@
-import {generateKeyPairSync,createPrivateKey,createPublicKey,createHash,randomUUID}from'crypto';import {sql,Kysely}from'kysely';import Ge from'bcrypt';import Y from'jsonwebtoken';import {Elysia}from'elysia';var Nr=Object.defineProperty;var o=(e,r)=>Nr(e,"name",{value:r,configurable:true});var $e=Object.assign(Object.create(null),{UNAUTHORIZED:401,TOKEN_EXPIRED:401,TOKEN_INVALID:401,INVALID_CREDENTIALS:401,FORBIDDEN:403,USER_NOT_FOUND:404,IDENTIFIER_NOT_FOUND:404,USER_ALREADY_EXISTS:409,IDENTIFIER_ALREADY_EXISTS:409,INVALID_ROLE:400,VALIDATION_ERROR:400,CONFIGURATION_ERROR:500,TOKEN_REUSE:401}),a=class extends Error{static{o(this,"SentriError");}code;statusCode;constructor(r,t,s){super(t),this.name="SentriError",this.code=r,this.statusCode=s??$e[r]??500;}};var Ve=new WeakMap,Me=32,qe=10,Be=31;function ze(e){if(e.mode==="client"){if(!e.keyUri||e.keyUri.trim().length===0)throw new a("CONFIGURATION_ERROR","keyUri must not be empty");return}if(!e.secret||e.secret.trim().length===0)throw new a("CONFIGURATION_ERROR","secret must not be empty");if((e.algorithm??"HS256").startsWith("HS")&&e.secret.length<Me)throw new a("CONFIGURATION_ERROR",`secret must be at least ${Me} characters for HMAC algorithms`);let s=e.saltRounds??12;if(!Number.isInteger(s)||s<qe||s>Be)throw new a("CONFIGURATION_ERROR",`saltRounds must be an integer between ${qe} and ${Be}`);if(!e.validRoles||e.validRoles.length===0)throw new a("CONFIGURATION_ERROR","validRoles must contain at least one role");if(!e.dialect)throw new a("CONFIGURATION_ERROR","dialect is required in server mode")}o(ze,"validateConfig");function A(e){let r=Ve.get(e);if(r)return r;let t={algorithm:e.algorithm??"HS256",accessExpiresIn:e.accessExpiresIn??"15m",refreshExpiresIn:e.refreshExpiresIn??"7d",saltRounds:e.saltRounds??12,validRoles:e.validRoles,validRolesSet:new Set(e.validRoles),cookieName:e.cookie?.name??"refresh_token",accessCookieName:e.accessCookie?.name??"access_token"};return Ve.set(e,t),t}o(A,"resolveServerConfig");var Dr=/^(\d+)([smhdw])$/,Sr={s:1e3,m:6e4,h:36e5,d:864e5,w:6048e5},je=new Map;function $(e){if(typeof e=="number")return e*1e3;let r=je.get(e);if(r!==void 0)return r;let t=Dr.exec(e);if(!t?.[1]||!t?.[2])throw new Error(`Invalid expiresIn: "${e}". Use e.g. "15m", "7d", "1h".`);let s=Sr[t[2]];if(s===void 0)throw new Error(`Invalid expiresIn: "${e}". Use e.g. "15m", "7d", "1h".`);let n=parseInt(t[1],10)*s;return je.set(e,n),n}o($,"parseExpiry");var S={info:o(()=>{},"info"),warn:o(()=>{},"warn"),error:o(()=>{},"error")};function h(e,r,t){return {service:e,event:r,...t}}o(h,"buildLogData");async function Xe(e){await e.schema.createTable("sentri_users").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("password_hash","varchar(255)",r=>r.notNull()).addColumn("roles","text",r=>r.notNull().defaultTo("[]")).addColumn("created_at","timestamp",r=>r.notNull().defaultTo(sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createTable("sentri_sessions").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("user_id","varchar(36)",r=>r.notNull().references("sentri_users.id").onDelete("cascade")).addColumn("expires_at","timestamp",r=>r.notNull()).addColumn("ip_address","varchar(45)").addColumn("user_agent","text").addColumn("replaced_by","varchar(36)").addColumn("created_at","timestamp",r=>r.notNull().defaultTo(sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createTable("sentri_identifiers").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("user_id","varchar(36)",r=>r.notNull().references("sentri_users.id").onDelete("cascade")).addColumn("type","varchar(100)",r=>r.notNull()).addColumn("value","varchar(255)",r=>r.notNull().unique()).addColumn("created_at","timestamp",r=>r.notNull().defaultTo(sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createIndex("idx_sentri_sessions_user_id").ifNotExists().on("sentri_sessions").column("user_id").execute(),await e.schema.createIndex("idx_sentri_identifiers_user_id").ifNotExists().on("sentri_identifiers").column("user_id").execute();}o(Xe,"runMigrations");var Ze=new Map;function D(e){let r=Ze.get(e);return r||(r=new Kysely({dialect:e}),Ze.set(e,r)),r}o(D,"getDatabase");async function W(e,r=12){return Ge.hash(e,r)}o(W,"hashPassword");async function J(e,r){return Ge.compare(e,r)}o(J,"verifyPassword");var We=new Map,Je=new Map,Lr=3600*1e3;function Qe(e){let r=We.get(e);if(!r){let t=createPrivateKey(e),s=createPublicKey(t),n=s.export({format:"jwk"}),d=createHash("sha256").update(JSON.stringify({e:n.e,kty:n.kty,n:n.n})).digest("base64url"),c={...n,use:"sig",kid:d};r={kid:d,publicKey:s,jwk:c},We.set(e,r);}return r}o(Qe,"getOrBuildKey");function er(e){let{jwk:r}=Qe(e);return {keys:[r]}}o(er,"buildJwks");function rr(e){return Qe(e).publicKey}o(rr,"getPublicKeyFromPrivate");async function tr(e){let r=Date.now(),t=Je.get(e);if(t&&r-t.fetchedAt<Lr)return t.publicKey;let s=await fetch(e);if(!s.ok)throw new a("CONFIGURATION_ERROR",`Failed to fetch public key from ${e}: HTTP ${s.status}`);let n=await s.json();if(!n.keys||n.keys.length===0)throw new a("CONFIGURATION_ERROR",`No keys found in JWKS response from ${e}`);let u=n.keys[0],d=createPublicKey({key:u,format:"jwk"});return Je.set(e,{publicKey:d,fetchedAt:r}),d}o(tr,"fetchPublicKey");var sr=new Map,or=new Map,nr=new Map;function ir(e){return e.startsWith("RS")||e.startsWith("PS")}o(ir,"isRSA");function ar(e){let r=sr.get(e);return r||(r={access:`${e}:access`,refresh:`${e}:refresh`},sr.set(e,r)),r}o(ar,"getHsSecrets");function Pr(e){let r=or.get(e);return r||(r=createPrivateKey(e),or.set(e,r)),r}o(Pr,"getRsPrivateKey");function ur(e){let r=A(e);if(ir(r.algorithm)){let n=Pr(e.secret);return {accessKey:n,refreshKey:n}}let{access:t,refresh:s}=ar(e.secret);return {accessKey:t,refreshKey:s}}o(ur,"getSigningKeys");function cr(e,r){let t=A(e);if(ir(t.algorithm))return rr(e.secret);let{access:s,refresh:n}=ar(e.secret);return r==="access"?s:n}o(cr,"getVerifyKey");function dr(e,r,t,s){let n=`${t}:${s}`,u=nr.get(n);return u||(u={expiresIn:t,algorithm:s},nr.set(n,u)),Y.sign(e,r,u)}o(dr,"sign");function lr(e,r,t){try{let s=Y.verify(e,r,{algorithms:[t]});if(typeof s=="string"||s===null)throw new a("TOKEN_INVALID","Token payload is not an object");return s}catch(s){throw s instanceof a?s:s instanceof Y.TokenExpiredError?new a("TOKEN_EXPIRED","Token has expired"):new a("TOKEN_INVALID","Token is invalid or malformed")}}o(lr,"verify");function Q(e,r){let t=A(r),{accessKey:s}=ur(r);return dr(e,s,t.accessExpiresIn,t.algorithm)}o(Q,"signAccessToken");function ee(e,r){let t=A(r),{refreshKey:s}=ur(r);return dr({sessionId:e},s,t.refreshExpiresIn,t.algorithm)}o(ee,"signRefreshToken");function V(e,r){let t=A(r),s=cr(r,"access");return lr(e,s,t.algorithm)}o(V,"verifyAccessToken");function re(e,r){let t=A(r),s=cr(r,"refresh");return lr(e,s,t.algorithm)}o(re,"verifyRefreshToken");function fr(e,r){try{let t=Y.verify(e,r,{algorithms:["RS256","RS384","RS512","PS256","PS384","PS512"]});if(typeof t=="string"||t===null)throw new a("TOKEN_INVALID","Token payload is not an object");return t}catch(t){throw t instanceof a?t:t instanceof Y.TokenExpiredError?new a("TOKEN_EXPIRED","Token has expired"):new a("TOKEN_INVALID","Token is invalid or malformed")}}o(fr,"verifyTokenWithPublicKey");function xe(e){try{return JSON.parse(e)}catch{return []}}o(xe,"parseRoles");function Kr(e){return JSON.stringify(e)}o(Kr,"serializeRoles");function mr(e){return {id:e.id,userId:e.user_id,type:e.type,value:e.value,createdAt:new Date(e.created_at)}}o(mr,"mapIdentifier");async function te(e,r){let t=await e.selectFrom("sentri_identifiers as i").innerJoin("sentri_users as u","u.id","i.user_id").select(["u.id","u.password_hash","u.roles"]).where("i.value","=",r).executeTakeFirst();return t?{id:t.id,passwordHash:t.password_hash,roles:xe(t.roles)}:null}o(te,"findUserByIdentifierValue");async function ue(e,r){let t=await e.selectFrom("sentri_users").select(["id","password_hash","roles"]).where("id","=",r).executeTakeFirst();return t?{id:t.id,passwordHash:t.password_hash,roles:xe(t.roles)}:null}o(ue,"findUserById");async function pr(e,r,t){let s=t.map(n=>({id:randomUUID(),user_id:r,type:n.type,value:n.value}));return await e.insertInto("sentri_identifiers").values(s).execute(),s.map(n=>({id:n.id,userId:n.user_id,type:n.type,value:n.value,createdAt:new Date}))}o(pr,"createIdentifiers");async function se(e,r){return (await e.selectFrom("sentri_identifiers").selectAll().where("user_id","=",r).orderBy("created_at","asc").execute()).map(mr)}o(se,"findIdentifiersByUserId");async function Ce(e,r,t){let s=await e.selectFrom("sentri_identifiers").selectAll().where("id","=",r).where("user_id","=",t).executeTakeFirst();return s?mr(s):null}o(Ce,"findIdentifierById");async function wr(e,r){let t=await e.selectFrom("sentri_identifiers").select(s=>s.fn.countAll().as("count")).where("user_id","=",r).executeTakeFirst();return Number(t?.count??0)}o(wr,"countIdentifiersByUserId");async function gr(e,r,t,s){await e.updateTable("sentri_identifiers").set({type:s.type,value:s.value}).where("id","=",r).where("user_id","=",t).execute();}o(gr,"updateIdentifier");async function yr(e,r,t){await e.deleteFrom("sentri_identifiers").where("user_id","=",r).where("id","in",t).execute();}o(yr,"deleteIdentifiers");async function Ir(e,r,t){await e.updateTable("sentri_users").set({password_hash:t}).where("id","=",r).execute();}o(Ir,"updateUserPassword");async function Rr(e,r,t){await e.updateTable("sentri_users").set({roles:Kr(t)}).where("id","=",r).execute();}o(Rr,"updateUserRoles");async function Ne(e,r){let t=randomUUID();return await e.insertInto("sentri_sessions").values({id:t,user_id:r.userId,expires_at:r.expiresAt.toISOString(),ip_address:r.ipAddress??null,user_agent:r.userAgent??null}).execute(),{id:t}}o(Ne,"createSession");async function De(e,r){let t=await e.selectFrom("sentri_sessions as s").innerJoin("sentri_users as u","u.id","s.user_id").select(["s.id as session_id","s.user_id","s.expires_at","s.ip_address","s.user_agent","s.replaced_by","s.created_at as session_created_at","u.id as user_id_col","u.password_hash","u.roles"]).where("s.id","=",r).executeTakeFirst();return t?{id:t.session_id,userId:t.user_id,expiresAt:new Date(t.expires_at),ipAddress:t.ip_address,userAgent:t.user_agent,replacedBy:t.replaced_by,createdAt:new Date(t.session_created_at),user:{id:t.user_id_col,passwordHash:t.password_hash,roles:xe(t.roles)}}:null}o(De,"findSessionById");async function Se(e,r){await e.deleteFrom("sentri_sessions").where("id","=",r).execute();}o(Se,"deleteSession");async function _r(e,r,t){await e.updateTable("sentri_sessions").set({replaced_by:t}).where("id","=",r).execute();}o(_r,"markSessionReplaced");async function ce(e,r){await e.deleteFrom("sentri_sessions").where("user_id","=",r).execute();}o(ce,"deleteAllSessionsForUser");async function de(e,r,t){let s=A(r),n=D(r.dialect),u=e.roles??[],d=u.filter(k=>!s.validRolesSet.has(k));if(d.length>0)return {success:false,error:new a("INVALID_ROLE",`Invalid roles: ${d.join(", ")}`)};if(!e.identifiers||e.identifiers.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one identifier is required")};let c=e.identifiers.map(k=>({type:k.type.trim(),value:k.value.trim()}));if(new Set(c.map(k=>k.value)).size!==c.length)return {success:false,error:new a("VALIDATION_ERROR","Duplicate identifier values in request")};for(let k of c)if(await te(n,k.value))return {success:false,error:new a("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${k.value}`)};let g=await W(e.password,s.saltRounds),{userId:x,identifierRows:C}=await n.transaction().execute(async k=>{let H=randomUUID();await k.insertInto("sentri_users").values({id:H,password_hash:g,roles:JSON.stringify(u)}).execute();let ae=c.map(X=>({id:randomUUID(),user_id:H,type:X.type,value:X.value}));return await k.insertInto("sentri_identifiers").values(ae).execute(),{userId:H,identifierRows:ae}}),N={success:true,user:{id:x,roles:u,identifiers:C.map(k=>({id:k.id,type:k.type,value:k.value}))}};return r.hooks?.onRegister&&await r.hooks.onRegister(N.user),N}o(de,"register");async function le(e,r,t){let s=A(r),n=D(r.dialect),u=await te(n,e.identifier.trim());if(!u){let N=new a("INVALID_CREDENTIALS","Invalid credentials");return r.hooks?.onLoginFailed&&await r.hooks.onLoginFailed(e.identifier,N,{ip:t?.ip??""}),{success:false,error:N}}if(!await J(e.password,u.passwordHash)){let N=new a("INVALID_CREDENTIALS","Invalid credentials");return r.hooks?.onLoginFailed&&await r.hooks.onLoginFailed(e.identifier,N,{ip:t?.ip??""}),{success:false,error:N}}let c=new Date(Date.now()+$(s.refreshExpiresIn)),i=await Ne(n,{userId:u.id,expiresAt:c,ipAddress:t?.ip??null,userAgent:t?.userAgent??null}),g={id:u.id,roles:u.roles},x=Q({id:u.id,roles:u.roles,sessionId:i.id},r),C=ee(i.id,r);return r.hooks?.onLoginSuccess&&await r.hooks.onLoginSuccess(g,{ip:t?.ip??"",userAgent:t?.userAgent??""}),{success:true,accessToken:x,refreshToken:C,user:g}}o(le,"login");async function M(e,r,t){let s=A(r),n=D(r.dialect),u;try{({sessionId:u}=re(e,r));}catch(N){return N instanceof a?{success:false,error:N}:{success:false,error:new a("TOKEN_INVALID","Invalid refresh token")}}let d=await De(n,u);if(!d)return {success:false,error:new a("UNAUTHORIZED","Session not found or revoked")};if(d.replacedBy)return await ce(n,d.userId),{success:false,error:new a("TOKEN_REUSE","Token reuse detected. All sessions revoked.")};if(d.expiresAt.getTime()<Date.now())return await Se(n,u),{success:false,error:new a("TOKEN_EXPIRED","Session has expired")};let c=new Date(Date.now()+$(s.refreshExpiresIn)),i=await Ne(n,{userId:d.userId,expiresAt:c,ipAddress:t?.ip??null,userAgent:t?.userAgent??null});await _r(n,u,i.id);let g={id:d.user.id,roles:d.user.roles},x=Q({...g,sessionId:i.id},r),C=ee(i.id,r);return {success:true,accessToken:x,refreshToken:C,user:g}}o(M,"refresh");async function fe(e,r){let t=D(r.dialect),s;try{({sessionId:s}=re(e,r));}catch{return}let n=await De(t,s);n&&(await Se(t,s),r.hooks?.onLogout&&await r.hooks.onLogout(n.userId));}o(fe,"logout");async function he(e,r){let t=D(r.dialect);await ce(t,e),r.hooks?.onLogout&&await r.hooks.onLogout(e);}o(he,"logoutAll");async function me(e,r){let t=D(r.dialect),s=await ue(t,e);if(!s)return {success:false,error:new a("USER_NOT_FOUND","User not found")};let n=await se(t,e);return {success:true,user:{id:s.id,roles:s.roles,identifiers:n.map(u=>({id:u.id,type:u.type,value:u.value}))}}}o(me,"getUser");async function pe(e,r,t,s){let n=A(s),u=D(s.dialect),d=await ue(u,e);if(!d)return {success:false,error:new a("USER_NOT_FOUND","User not found")};if(!await J(r,d.passwordHash))return {success:false,error:new a("INVALID_CREDENTIALS","Invalid credentials")};let i=await W(t,n.saltRounds);return await Ir(u,e,i),await ce(u,e),s.hooks?.onPasswordChanged&&await s.hooks.onPasswordChanged(e),{success:true}}o(pe,"changePassword");async function we(e,r,t){let s=A(t),n=D(t.dialect),u=r.filter(g=>!s.validRolesSet.has(g));if(u.length>0)return {success:false,error:new a("INVALID_ROLE",`Invalid roles: ${u.join(", ")}`)};let d=await ue(n,e);if(!d)return {success:false,error:new a("USER_NOT_FOUND","User not found")};let c=new Set(d.roles);for(let g of r)c.add(g);let i=Array.from(c);return await Rr(n,e,i),{success:true,user:{id:d.id,roles:i}}}o(we,"assignRoles");async function ge(e,r,t){let s=D(t.dialect);if(r.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one identifier is required")};let n=r.map(c=>({type:c.type.trim(),value:c.value.trim()}));if(new Set(n.map(c=>c.value)).size!==n.length)return {success:false,error:new a("VALIDATION_ERROR","Duplicate identifier values in request")};for(let c of n)if(await te(s,c.value))return {success:false,error:new a("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${c.value}`)};return await pr(s,e,n),{success:true,identifiers:(await se(s,e)).map(c=>({id:c.id,type:c.type,value:c.value}))}}o(ge,"bulkCreateIdentifiers");async function ye(e,r,t){let s=D(t.dialect);if(r.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one update is required")};let n=r.map(c=>({id:c.id,type:c.type.trim(),value:c.value.trim()}));if(new Set(n.map(c=>c.value)).size!==n.length)return {success:false,error:new a("VALIDATION_ERROR","Duplicate identifier values in request")};for(let c of n){let i=await Ce(s,c.id,e);if(!i)return {success:false,error:new a("IDENTIFIER_NOT_FOUND",`Identifier not found: ${c.id}`)};if(i.value!==c.value&&await te(s,c.value))return {success:false,error:new a("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${c.value}`)}}return await s.transaction().execute(async c=>{for(let i of n)await gr(c,i.id,e,{type:i.type,value:i.value});}),{success:true,identifiers:(await se(s,e)).map(c=>({id:c.id,type:c.type,value:c.value}))}}o(ye,"bulkUpdateIdentifiers");async function Ie(e,r,t){let s=D(t.dialect);if(r.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one ID is required")};let n=Array.from(new Set(r));for(let c of n)if(!await Ce(s,c,e))return {success:false,error:new a("IDENTIFIER_NOT_FOUND",`Identifier not found: ${c}`)};return await wr(s,e)-n.length<1?{success:false,error:new a("VALIDATION_ERROR","Cannot delete all identifiers \u2014 at least one must remain")}:(await yr(s,e,n),{success:true,identifiers:(await se(s,e)).map(c=>({id:c.id,type:c.type,value:c.value}))})}o(Ie,"bulkDeleteIdentifiers");function L(e){return A(e).cookieName}o(L,"getCookieName");function Re(e){return A(e).accessCookieName}o(Re,"getAccessCookieName");function P(e,r){if(!e)return;let t=`${r}=`,s=0;for(;s<e.length;){for(;s<e.length&&e[s]===" ";)s++;let n=e.indexOf(";",s),u=n===-1?e.length:n;if(e.startsWith(t,s))return e.slice(s+t.length,u);s=u+1;}}o(P,"readCookie");function oe(e,r,t){let s=t.cookie??{},n=$(A(t).refreshExpiresIn)/1e3;e.cookie??={},e.cookie[L(t)]={value:r,httpOnly:s.httpOnly??true,secure:s.secure??false,sameSite:s.sameSite??"strict",path:s.path??"/",maxAge:n};}o(oe,"setCookieFromConfig");function _e(e,r){let t=r.cookie??{};e.cookie??={},e.cookie[L(r)]={value:"",httpOnly:t.httpOnly??true,path:t.path??"/",maxAge:0};}o(_e,"clearCookieFromConfig");function ne(e,r,t){if(!t.accessCookie)return;let s=t.accessCookie,n=$(A(t).accessExpiresIn)/1e3;e.cookie??={},e.cookie[Re(t)]={value:r,httpOnly:false,secure:s.secure??false,sameSite:s.sameSite??"strict",path:s.path??"/",maxAge:n};}o(ne,"setAccessCookieFromConfig");function Oe(e,r){if(!r.accessCookie)return;let t=r.accessCookie;e.cookie??={},e.cookie[Re(r)]={value:"",httpOnly:false,path:t.path??"/",maxAge:0};}o(Oe,"clearAccessCookieFromConfig");function q(e,r){let t=e.headers.get("authorization");if(t?.startsWith("Bearer "))return t.slice(7);let s=e.headers.get("cookie");return s?P(s,Re(r)):void 0}o(q,"getCurrentAccessToken");function be(e){let r=e.logger??S,t=e.loggerService??"sentri";if(e.mode==="client"){let n=e;return new Elysia().derive({as:"global"},async({request:u})=>{let d=u.headers.get("authorization"),c=d?.startsWith("Bearer ")?d.slice(7):void 0;if(!c)throw r.warn(h(t,"auth.protect.failure",{mode:"client",errorCode:"UNAUTHORIZED"})),new a("UNAUTHORIZED","Missing or malformed Authorization header");try{let i=await tr(n.keyUri),g=fr(c,i),x={id:g.id,roles:g.roles};return r.info(h(t,"auth.protect.success",{mode:"client",userId:g.id})),{user:x}}catch(i){let g=i instanceof a?i.code:"TOKEN_INVALID";throw r.warn(h(t,"auth.protect.failure",{mode:"client",errorCode:g})),i}})}let s=e;return new Elysia().derive({as:"global"},async({request:n,set:u})=>{let d=q(n,s);if(!d)throw r.warn(h(t,"auth.protect.failure",{mode:"server",errorCode:"UNAUTHORIZED"})),new a("UNAUTHORIZED","Missing or malformed Authorization header");try{let c=V(d,s);if(s.isTokenRevoked&&await s.isTokenRevoked(c.sessionId))throw r.warn(h(t,"auth.protect.token_revoked",{mode:"server",userId:c.id})),new a("UNAUTHORIZED","Token has been revoked");let i={id:c.id,roles:c.roles};return r.info(h(t,"auth.protect.success",{mode:"server",userId:c.id})),{user:i}}catch(c){if(c instanceof a&&c.code==="TOKEN_EXPIRED"){let g=n.headers.get("cookie"),x=g?P(g,L(s)):void 0;if(!x)throw r.warn(h(t,"auth.protect.failure",{mode:"server",errorCode:"TOKEN_EXPIRED"})),new a("UNAUTHORIZED","Token expired. Please login again.");let C;try{C=await M(x,s);}catch{throw r.warn(h(t,"auth.protect.failure",{mode:"server",errorCode:"TOKEN_EXPIRED"})),new a("UNAUTHORIZED","Session expired. Please login again.")}if(!C.success)throw r.warn(h(t,"auth.protect.failure",{mode:"server",errorCode:C.error.code})),new a("UNAUTHORIZED","Session expired. Please login again.");return oe(u,C.refreshToken,s),ne(u,C.accessToken,s),u.headers["X-New-Access-Token"]=C.accessToken,r.info(h(t,"auth.protect.auto_refresh",{mode:"server",userId:C.user.id})),{user:C.user}}let i=c instanceof a?c.code:"TOKEN_INVALID";throw r.warn(h(t,"auth.protect.failure",{mode:"server",errorCode:i})),c}})}o(be,"protect");function Ar(e,r,t){let s=`Requires one of roles: ${e.join(", ")}`;return ({user:n})=>{if(!n)throw r.warn(h(t,"auth.authorize.unauthenticated",{requiredRoles:e})),new a("UNAUTHORIZED","Not authenticated");let u=n.roles;if(!e.some(d=>u.includes(d)))throw r.warn(h(t,"auth.authorize.denied",{userId:n.id,userRoles:[...u],requiredRoles:e})),new a("FORBIDDEN",s);r.info(h(t,"auth.authorize.passed",{userId:n.id,userRoles:[...u],requiredRoles:e}));}}o(Ar,"createAuthorizeHandler");function Ue(e,r){return o(function(...s){return Ar(s,e,r)},"authorize")}o(Ue,"createAuthorize");function Hr(...e){return Ar(e,S,"sentri")}o(Hr,"authorize");var $r=new a("FORBIDDEN","You do not have permission to perform this action");function Er(e,r,t){return async s=>{let n=s.user;if(!n)throw r.warn(h(t,"auth.permit.unauthenticated",{})),new a("UNAUTHORIZED","Not authenticated");if(e.roles&&e.roles.length>0){let u=n.roles;if(e.roles.some(d=>u.includes(d))){r.info(h(t,"auth.permit.role_bypass",{userId:n.id,bypassedByRole:true}));return}}try{let u=e.check(s);if(u instanceof Promise?await u:u)r.info(h(t,"auth.permit.passed",{userId:n.id}));else throw r.warn(h(t,"auth.permit.denied",{userId:n.id})),$r}catch(u){throw u}}}o(Er,"createPermitHandler");function Le(e,r){return o(function(s){return Er(typeof s=="function"?{check:s}:s,e,r)},"permit")}o(Le,"createPermit");function Vr(e){return Er(typeof e=="function"?{check:e}:e,S,"sentri")}o(Vr,"permit");function ie(e){return ({error:r,set:t})=>r instanceof a?(t.status=r.statusCode,{error:true,statusCode:r.statusCode,code:r.code,message:r.message,data:null}):(e?.onUnhandled?.(r),t.status=500,{error:true,statusCode:500,code:"INTERNAL_SERVER_ERROR",message:"Internal server error",data:null})}o(ie,"createErrorHandler");var Fe=class{static{o(this,"InMemoryRateLimiter");}store=new Map;constructor(){setInterval(()=>{let r=Date.now();for(let[t,s]of this.store.entries())s.expiresAt<r&&this.store.delete(t);},6e4).unref();}async consume(r,t,s){let n=Date.now(),u=this.store.get(r);if((!u||u.expiresAt<n)&&(u={count:0,expiresAt:n+s},this.store.set(r,u)),u.count>t){let d=Math.ceil((u.expiresAt-n)/1e3);throw new Error(`Rate limit exceeded. Try again in ${d} seconds.`)}u.count++;}},Pe=class{static{o(this,"RedisRateLimiter");}redis;logger;constructor(r,t){this.redis=r,this.logger=t;}async consume(r,t,s){let n=`sentri:rl:${r}`,u=Math.ceil(s/1e3);try{let d=await this.redis.multi().incr(n).expire(n,u,"NX").exec();if(!d||d.length===0)return;if(d[0][1]>t)throw new Error("Rate limit exceeded. Try again later.")}catch(d){if(d instanceof Error&&d.message.includes("Rate limit exceeded"))throw d;this.logger.error({msg:"Redis RateLimiter failed, bypassing limit",error:d});}}},B=null;async function Tr(e,r){if(B)return B;if(e)try{let{Redis:t}=await import('ioredis'),s=new t(e,{lazyConnect:!0,maxRetriesPerRequest:1});return await s.connect(),r?.info({msg:"Connected to Redis for Rate Limiting"}),B=new Pe(s,r??S),B}catch(t){r?.warn({msg:"Failed to connect to Redis for Rate Limiting, falling back to InMemoryRateLimiter",error:t});}return B=new Fe,B}o(Tr,"getRateLimiter");var ke=8,j=72,ve=255,xr=100,z=50;function _(e){return new a("VALIDATION_ERROR",e)}o(_,"badRequest");function O(e,r,t,s){return e.status=r,{error:false,statusCode:r,message:t,data:s}}o(O,"ok");function K(e){if(e==null||typeof e!="object"||Array.isArray(e))throw new a("VALIDATION_ERROR","Request body is missing or not a JSON object. Did you set Content-Type: application/json?");return e}o(K,"parseBody");function qr(e,r){if(!r.apiKey)return;let t=e.headers.get("x-api-key");if(typeof t!="string"||t!==r.apiKey)throw new a("UNAUTHORIZED","Invalid or missing API key")}o(qr,"validateApiKey");function Ke(e){if(e)try{let r=e();r instanceof Promise&&r.catch(()=>{});}catch{}}o(Ke,"fireHook");function Br(e){return e.startsWith("RS")||e.startsWith("PS")}o(Br,"isRSA");function He(e,r){if(typeof e!="object"||e===null||Array.isArray(e))throw _(`identifiers[${r}] must be an object`);let t=e;if(typeof t.type!="string"||t.type.trim().length===0)throw _(`identifiers[${r}].type is required and must be a non-empty string`);if(t.type.length>xr)throw _(`identifiers[${r}].type must not exceed ${xr} characters`);if(typeof t.value!="string"||t.value.trim().length===0)throw _(`identifiers[${r}].value is required and must be a non-empty string`);if(t.value.length>ve)throw _(`identifiers[${r}].value must not exceed ${ve} characters`);return {type:t.type,value:t.value}}o(He,"validateIdentifierInput");async function F(e,r,t){let s=q(e,t);if(!s)throw new a("UNAUTHORIZED","Missing or malformed Authorization header");let n=V(s,t);if(t.isTokenRevoked&&await t.isTokenRevoked(n.sessionId))throw new a("UNAUTHORIZED","Token has been revoked");return {id:n.id,roles:n.roles}}o(F,"requireAuth");function Cr(e){let r=e,t=A(r),s=e.logger??S,n=e.loggerService??"sentri",u=e.router?.register??(l=>de(l,r)),d=e.router?.login??(l=>le(l,r)),c=e.router?.refresh??(l=>M(l,r)),i=e.router?.logout??(l=>l!==void 0?fe(l,r):Promise.resolve()),g=e.router?.logoutAll??(l=>he(l,r)),x=e.router?.getUser??(l=>me(l,r)),C=e.router?.assignRoles??((l,f)=>we(l,f,r)),N=e.router?.changePassword??((l,f,w)=>pe(l,f,w,r)),k=e.router?.bulkCreateIdentifiers??((l,f)=>ge(l,f,r)),H=e.router?.bulkUpdateIdentifiers??((l,f)=>ye(l,f,r)),ae=e.router?.bulkDeleteIdentifiers??((l,f)=>Ie(l,f,r)),X=Tr(e.redisUrl,s),Ae=new Elysia().onError(ie());return Br(t.algorithm)&&Ae.get("/keys",({set:l})=>(l.headers["Cache-Control"]="public, max-age=3600",er(e.secret))),Ae.post("/register",async({body:l,request:f,set:w})=>{let I=Date.now();qr(f,r);let m=K(l),{identifiers:T,password:p,roles:R}=m;if(!Array.isArray(T)||T.length===0)throw _("identifiers is required and must be a non-empty array");if(T.length>z)throw _(`identifiers must not exceed ${z} entries`);let y=T.map((G,Ee)=>He(G,Ee));if(typeof p!="string"||p.length<ke)throw _(`password is required and must be at least ${ke} characters`);if(p.length>j)throw _(`password must not exceed ${j} characters`);if(R!==void 0&&!Array.isArray(R))throw _("roles must be an array of strings when provided");if(Array.isArray(R)&&!R.every(G=>typeof G=="string"))throw _("each role must be a string");let E=Array.isArray(R)?R:void 0,v=E!==void 0?{identifiers:y,password:p,roles:E}:{identifiers:y,password:p},U=f.headers.get("x-forwarded-for")||"127.0.0.1",Z=f.headers.get("user-agent")||"Unknown";if(e.rateLimit!==false){let G=await X,Ee=typeof e.rateLimit=="object"?e.rateLimit.maxRegisterAttempts??5:5;await G.consume(`register:${U}`,Ee,900*1e3);}let b=await u(v,{ip:U,userAgent:Z});return b.success?(s.info(h(n,"auth.register.success",{userId:b.user.id,duration_ms:Date.now()-I})),O(w,201,"User registered successfully",{user:b.user})):(s.warn(h(n,"auth.register.failure",{errorCode:b.error.code,duration_ms:Date.now()-I})),w.status=b.error.statusCode,{error:true,statusCode:b.error.statusCode,code:b.error.code,message:b.error.message,data:null})}).post("/login",async({body:l,request:f,set:w})=>{let I=Date.now(),m=K(l),{identifier:T,password:p}=m;if(typeof T!="string"||T.trim().length===0)throw _("identifier is required and must be a non-empty string");if(T.length>ve)throw _(`identifier must not exceed ${ve} characters`);if(typeof p!="string"||p.length===0)throw _("password is required");if(p.length>j)throw _(`password must not exceed ${j} characters`);let R=T.trim(),y=f.headers.get("x-forwarded-for")||"127.0.0.1",E=f.headers.get("user-agent")||"Unknown";if(e.rateLimit!==false){let U=await X,Z=typeof e.rateLimit=="object"?e.rateLimit.maxLoginAttempts??5:5;await U.consume(`login:${y}`,Z,900*1e3);}let v=await d({identifier:R,password:p},{ip:y,userAgent:E});return v.success?(Ke(()=>r.hooks?.onLoginSuccess?.(v.user,{ip:y,userAgent:E})),oe(w,v.refreshToken,r),ne(w,v.accessToken,r),s.info(h(n,"auth.login.success",{userId:v.user.id,duration_ms:Date.now()-I})),O(w,200,"Login successful",{accessToken:v.accessToken,user:v.user})):(Ke(()=>r.hooks?.onLoginFailed?.(R,v.error,{ip:y})),s.warn(h(n,"auth.login.failure",{errorCode:v.error.code,duration_ms:Date.now()-I})),w.status=v.error.statusCode,{error:true,statusCode:v.error.statusCode,code:v.error.code,message:v.error.message,data:null})}).post("/refresh",async({request:l,set:f})=>{let w=Date.now(),I=P(l.headers.get("cookie")??void 0,L(r));if(!I)throw new a("UNAUTHORIZED","Refresh token cookie is missing");let m=l.headers.get("x-forwarded-for")||"127.0.0.1",T=l.headers.get("user-agent")||"Unknown",p=await c(I,{ip:m,userAgent:T});return p.success?(oe(f,p.refreshToken,r),ne(f,p.accessToken,r),s.info(h(n,"auth.refresh.success",{userId:p.user.id,duration_ms:Date.now()-w})),O(f,200,"Token refreshed",{accessToken:p.accessToken})):(_e(f,r),s.warn(h(n,"auth.refresh.failure",{errorCode:p.error.code,duration_ms:Date.now()-w})),f.status=p.error.statusCode,{error:true,statusCode:p.error.statusCode,code:p.error.code,message:p.error.message,data:null})}).post("/logout",async({request:l,set:f})=>{let w=Date.now(),I=P(l.headers.get("cookie")??void 0,L(r));return await i(I),_e(f,r),Oe(f,r),s.info(h(n,"auth.logout",{duration_ms:Date.now()-w})),O(f,200,"Logged out",null)}).post("/logout-all",async({request:l,set:f})=>{let w=Date.now(),I=await F(l,f,r);return await g(I.id),Ke(()=>r.hooks?.onLogout?.(I.id)),_e(f,r),Oe(f,r),s.info(h(n,"auth.logout_all",{userId:I.id,duration_ms:Date.now()-w})),O(f,200,"All sessions revoked",null)}).get("/me",async({request:l,set:f})=>{let w=Date.now(),I=await F(l,f,r),m=await x(I.id);return m.success?(s.info(h(n,"auth.me.success",{userId:m.user.id,duration_ms:Date.now()-w})),O(f,200,"OK",m.user)):(s.warn(h(n,"auth.me.failure",{userId:I.id,errorCode:m.error.code,duration_ms:Date.now()-w})),f.status=m.error.statusCode,{error:true,statusCode:m.error.statusCode,code:m.error.code,message:m.error.message,data:null})}).get("/me/identifiers",async({request:l,set:f})=>{let w=Date.now(),I=await F(l,f,r),m=await x(I.id);return m.success?(s.info(h(n,"auth.me.identifiers.success",{userId:m.user.id,count:m.user.identifiers?.length??0,duration_ms:Date.now()-w})),O(f,200,"OK",{identifiers:m.user.identifiers??[]})):(s.warn(h(n,"auth.me.identifiers.failure",{userId:I.id,errorCode:m.error.code,duration_ms:Date.now()-w})),f.status=m.error.statusCode,{error:true,statusCode:m.error.statusCode,code:m.error.code,message:m.error.message,data:null})}).post("/me/identifiers",async({body:l,request:f,set:w})=>{let I=Date.now(),m=await F(f,w,r),T=K(l),{identifiers:p}=T;if(!Array.isArray(p)||p.length===0)throw _("identifiers is required and must be a non-empty array");if(p.length>z)throw _(`identifiers must not exceed ${z} entries`);let R=p.map((E,v)=>He(E,v)),y=await k(m.id,R);return y.success?(s.info(h(n,"auth.identifiers.created",{userId:m.id,count:y.identifiers.length,duration_ms:Date.now()-I})),O(w,201,"Identifiers added successfully",{identifiers:y.identifiers})):(s.warn(h(n,"auth.identifiers.create_failure",{userId:m.id,errorCode:y.error.code,duration_ms:Date.now()-I})),w.status=y.error.statusCode,{error:true,statusCode:y.error.statusCode,code:y.error.code,message:y.error.message,data:null})}).put("/me/identifiers",async({body:l,request:f,set:w})=>{let I=Date.now(),m=await F(f,w,r),T=K(l),{identifiers:p}=T;if(!Array.isArray(p)||p.length===0)throw _("identifiers is required and must be a non-empty array");if(p.length>z)throw _(`identifiers must not exceed ${z} entries`);let R=p.map((E,v)=>{if(typeof E!="object"||E===null||Array.isArray(E))throw _(`identifiers[${v}] must be an object`);let U=E;if(typeof U.id!="string"||U.id.trim().length===0)throw _(`identifiers[${v}].id is required and must be a non-empty string`);let{type:Z,value:b}=He(E,v);return {id:U.id,type:Z,value:b}}),y=await H(m.id,R);return y.success?(s.info(h(n,"auth.identifiers.updated",{userId:m.id,count:y.identifiers.length,duration_ms:Date.now()-I})),O(w,200,"Identifiers updated successfully",{identifiers:y.identifiers})):(s.warn(h(n,"auth.identifiers.update_failure",{userId:m.id,errorCode:y.error.code,duration_ms:Date.now()-I})),w.status=y.error.statusCode,{error:true,statusCode:y.error.statusCode,code:y.error.code,message:y.error.message,data:null})}).delete("/me/identifiers",async({body:l,request:f,set:w})=>{let I=Date.now(),m=await F(f,w,r),T=K(l),{ids:p}=T;if(!Array.isArray(p)||p.length===0)throw _("ids is required and must be a non-empty array of strings");if(!p.every(y=>typeof y=="string"))throw _("each id must be a string");let R=await ae(m.id,p);return R.success?(s.info(h(n,"auth.identifiers.deleted",{userId:m.id,duration_ms:Date.now()-I})),O(w,200,"Identifiers deleted successfully",{identifiers:R.identifiers})):(s.warn(h(n,"auth.identifiers.delete_failure",{userId:m.id,errorCode:R.error.code,duration_ms:Date.now()-I})),w.status=R.error.statusCode,{error:true,statusCode:R.error.statusCode,code:R.error.code,message:R.error.message,data:null})}).patch("/me/password",async({body:l,request:f,set:w})=>{let I=Date.now(),m=await F(f,w,r),T=K(l),{currentPassword:p,newPassword:R}=T;if(typeof p!="string"||p.length===0)throw _("currentPassword is required");if(typeof R!="string"||R.length<ke)throw _(`newPassword must be at least ${ke} characters`);if(R.length>j)throw _(`newPassword must not exceed ${j} characters`);if(p===R)throw _("newPassword must be different from currentPassword");let y=await N(m.id,p,R);return y.success?(s.info(h(n,"auth.password.changed",{userId:m.id,duration_ms:Date.now()-I})),O(w,200,"Password updated successfully. All sessions have been revoked.",null)):(s.warn(h(n,"auth.password.change_failure",{userId:m.id,errorCode:y.error.code,duration_ms:Date.now()-I})),w.status=y.error.statusCode,{error:true,statusCode:y.error.statusCode,code:y.error.code,message:y.error.message,data:null})}).post("/users/:userId/roles",async({body:l,request:f,set:w,params:I})=>{let m=Date.now();if(!(await F(f,w,r)).roles.includes("admin"))throw new a("FORBIDDEN","Requires one of roles: admin");let p=K(l),{roles:R}=p,{userId:y}=I;if(!y)throw _("userId is required");if(!Array.isArray(R)||R.length===0)throw _("roles must be a non-empty array of strings");if(!R.every(v=>typeof v=="string"))throw _("each role must be a string");let E=await C(y,R);return E.success?(s.info(h(n,"auth.roles.assigned",{targetUserId:y,roles:R,duration_ms:Date.now()-m})),O(w,200,"Roles assigned successfully",{user:E.user})):(s.warn(h(n,"auth.roles.assign_failure",{targetUserId:y,errorCode:E.error.code,duration_ms:Date.now()-m})),w.status=E.error.statusCode,{error:true,statusCode:E.error.statusCode,code:E.error.code,message:E.error.message,data:null})}),Ae}o(Cr,"createAuthRouter");function Ls(e){if(e.mode==="client"){let i={mode:"client",keyUri:e.keyUri,...e.validRoles!==void 0&&{validRoles:e.validRoles},...e.logger!==void 0&&{logger:e.logger},...e.loggerService!==void 0&&{loggerService:e.loggerService}};ze(i);let g=i.logger??S,x=i.loggerService??"sentri",C=Ue(g,x),N=Le(g,x);return {protect:o(()=>be(i),"protect"),authorize:o((...k)=>C(...k),"authorize"),permit:o(k=>N(k),"permit"),errorHandler:o(k=>ie(k),"errorHandler")}}let{privateKey:r}=generateKeyPairSync("rsa",{modulusLength:2048,privateKeyEncoding:{type:"pkcs8",format:"pem"},publicKeyEncoding:{type:"spki",format:"pem"}}),t={mode:"server",dialect:e.dialect,secret:r,algorithm:"RS256",validRoles:e.validRoles,...e.accessExpiresIn!==void 0&&{accessExpiresIn:e.accessExpiresIn},...e.refreshExpiresIn!==void 0&&{refreshExpiresIn:e.refreshExpiresIn},...e.saltRounds!==void 0&&{saltRounds:e.saltRounds},...e.apiKey!==void 0&&{apiKey:e.apiKey},...e.cookie!==void 0&&{cookie:e.cookie},...e.accessCookie!==void 0&&{accessCookie:e.accessCookie},...e.hooks!==void 0&&{hooks:e.hooks},...e.router!==void 0&&{router:e.router},...e.isTokenRevoked!==void 0&&{isTokenRevoked:e.isTokenRevoked},...e.redisUrl!==void 0&&{redisUrl:e.redisUrl},...e.logger!==void 0&&{logger:e.logger},...e.loggerService!==void 0&&{loggerService:e.loggerService}},s=t.logger??S,n=t.loggerService??"sentri",u=A(t),d=Ue(s,n),c=Le(s,n);return {protect:o(()=>be(t),"protect"),authorize:o((...i)=>d(...i),"authorize"),permit:o(i=>c(i),"permit"),errorHandler:o(i=>ie(i),"errorHandler"),router:o(()=>Cr(t),"router"),migrate:o(()=>Xe(D(t.dialect)),"migrate"),getCurrentAccessToken:o(i=>q(i,t),"getCurrentAccessToken"),hashPassword:o(i=>W(i,u.saltRounds),"hashPassword"),verifyPassword:o((i,g)=>J(i,g),"verifyPassword"),signAccessToken:o(i=>Q(i,t),"signAccessToken"),signRefreshToken:o(i=>ee(i,t),"signRefreshToken"),verifyAccessToken:o(i=>V(i,t),"verifyAccessToken"),verifyRefreshToken:o(i=>re(i,t),"verifyRefreshToken"),register:o(i=>de(i,t),"register"),login:o(i=>le(i,t),"login"),refresh:o(i=>M(i,t),"refresh"),logout:o(i=>fe(i,t),"logout"),logoutAll:o(i=>he(i,t),"logoutAll"),getUser:o(i=>me(i,t),"getUser"),changePassword:o((i,g,x)=>pe(i,g,x,t),"changePassword"),assignRoles:o((i,g)=>we(i,g,t),"assignRoles"),bulkCreateIdentifiers:o((i,g)=>ge(i,g,t),"bulkCreateIdentifiers"),bulkUpdateIdentifiers:o((i,g)=>ye(i,g,t),"bulkUpdateIdentifiers"),bulkDeleteIdentifiers:o((i,g)=>Ie(i,g,t),"bulkDeleteIdentifiers")}}o(Ls,"createAuthElysia");export{$e as SENTRI_ERROR_STATUS,a as SentriError,Hr as authorize,Ls as createAuthElysia,Cr as createAuthRouter,Ue as createAuthorize,ie as createErrorHandler,Le as createPermit,q as getCurrentAccessToken,Vr as permit,be as protect};
+import {generateKeyPairSync,createPrivateKey,createPublicKey,createHash,randomUUID}from'crypto';import {sql,Kysely}from'kysely';import Ze from'bcrypt';import ee from'jsonwebtoken';import {Elysia}from'elysia';var Cr=Object.defineProperty;var o=(e,r)=>Cr(e,"name",{value:r,configurable:true});var He=Object.assign(Object.create(null),{UNAUTHORIZED:401,TOKEN_EXPIRED:401,TOKEN_INVALID:401,INVALID_CREDENTIALS:401,FORBIDDEN:403,USER_NOT_FOUND:404,IDENTIFIER_NOT_FOUND:404,USER_ALREADY_EXISTS:409,IDENTIFIER_ALREADY_EXISTS:409,INVALID_ROLE:400,VALIDATION_ERROR:400,CONFIGURATION_ERROR:500,TOKEN_REUSE:401,RATE_LIMIT_EXCEEDED:429}),a=class extends Error{static{o(this,"SentriError");}code;statusCode;constructor(r,t,s){super(t),this.name="SentriError",this.code=r,this.statusCode=s??He[r]??500;}};var Me=new WeakMap,Ve=32,qe=10,Be=31;function Xe(e){if(e.mode==="client"){if(!e.keyUri||e.keyUri.trim().length===0)throw new a("CONFIGURATION_ERROR","keyUri must not be empty");return}if(!e.secret||e.secret.trim().length===0)throw new a("CONFIGURATION_ERROR","secret must not be empty");if((e.algorithm??"HS256").startsWith("HS")&&e.secret.length<Ve)throw new a("CONFIGURATION_ERROR",`secret must be at least ${Ve} characters for HMAC algorithms`);let s=e.saltRounds??12;if(!Number.isInteger(s)||s<qe||s>Be)throw new a("CONFIGURATION_ERROR",`saltRounds must be an integer between ${qe} and ${Be}`);if(!e.validRoles||e.validRoles.length===0)throw new a("CONFIGURATION_ERROR","validRoles must contain at least one role");if(e.validIdentifiers!==void 0&&e.validIdentifiers.length===0)throw new a("CONFIGURATION_ERROR","validIdentifiers must contain at least one identifier type");if(!e.dialect)throw new a("CONFIGURATION_ERROR","dialect is required in server mode")}o(Xe,"validateConfig");function A(e){let r=Me.get(e);if(r)return r;let t={algorithm:e.algorithm??"HS256",accessExpiresIn:e.accessExpiresIn??"15m",refreshExpiresIn:e.refreshExpiresIn??"7d",saltRounds:e.saltRounds??12,validRoles:e.validRoles,validRolesSet:new Set(e.validRoles),validIdentifiers:e.validIdentifiers??["email","username"],validIdentifiersSet:new Set(e.validIdentifiers??["email","username"]),cookieName:e.cookie?.name??"refresh_token",accessCookieName:e.accessCookie?.name??"access_token"};return Me.set(e,t),t}o(A,"resolveServerConfig");var Nr=/^(\d+)([smhdw])$/,Sr={s:1e3,m:6e4,h:36e5,d:864e5,w:6048e5},je=new Map;function V(e){if(typeof e=="number")return e*1e3;let r=je.get(e);if(r!==void 0)return r;let t=Nr.exec(e);if(!t?.[1]||!t?.[2])throw new Error(`Invalid expiresIn: "${e}". Use e.g. "15m", "7d", "1h".`);let s=Sr[t[2]];if(s===void 0)throw new Error(`Invalid expiresIn: "${e}". Use e.g. "15m", "7d", "1h".`);let n=parseInt(t[1],10)*s;return je.set(e,n),n}o(V,"parseExpiry");var S={info:o(()=>{},"info"),warn:o(()=>{},"warn"),error:o(()=>{},"error")};function m(e,r,t){return {service:e,event:r,...t}}o(m,"buildLogData");async function ze(e){await e.schema.createTable("sentri_users").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("password_hash","varchar(255)",r=>r.notNull()).addColumn("roles","text",r=>r.notNull().defaultTo("[]")).addColumn("created_at","timestamp",r=>r.notNull().defaultTo(sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createTable("sentri_sessions").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("user_id","varchar(36)",r=>r.notNull().references("sentri_users.id").onDelete("cascade")).addColumn("expires_at","timestamp",r=>r.notNull()).addColumn("ip_address","varchar(45)").addColumn("user_agent","text").addColumn("replaced_by","varchar(36)").addColumn("created_at","timestamp",r=>r.notNull().defaultTo(sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createTable("sentri_identifiers").ifNotExists().addColumn("id","varchar(36)",r=>r.primaryKey().notNull()).addColumn("user_id","varchar(36)",r=>r.notNull().references("sentri_users.id").onDelete("cascade")).addColumn("type","varchar(100)",r=>r.notNull()).addColumn("value","varchar(255)",r=>r.notNull().unique()).addColumn("created_at","timestamp",r=>r.notNull().defaultTo(sql`CURRENT_TIMESTAMP`)).execute(),await e.schema.createIndex("idx_sentri_sessions_user_id").ifNotExists().on("sentri_sessions").column("user_id").execute(),await e.schema.createIndex("idx_sentri_identifiers_user_id").ifNotExists().on("sentri_identifiers").column("user_id").execute();}o(ze,"runMigrations");var Ge=new Map;function N(e){let r=Ge.get(e);return r||(r=new Kysely({dialect:e}),Ge.set(e,r)),r}o(N,"getDatabase");async function Y(e,r=12){return Ze.hash(e,r)}o(Y,"hashPassword");async function Q(e,r){return Ze.compare(e,r)}o(Q,"verifyPassword");var We=new Map,Je=new Map,Lr=3600*1e3;function Qe(e){let r=We.get(e);if(!r){let t=createPrivateKey(e),s=createPublicKey(t),n=s.export({format:"jwk"}),c=createHash("sha256").update(JSON.stringify({e:n.e,kty:n.kty,n:n.n})).digest("base64url"),h={...n,use:"sig",kid:c};r={kid:c,publicKey:s,jwk:h},We.set(e,r);}return r}o(Qe,"getOrBuildKey");function er(e){let{jwk:r}=Qe(e);return {keys:[r]}}o(er,"buildJwks");function rr(e){return Qe(e).publicKey}o(rr,"getPublicKeyFromPrivate");async function tr(e){let r=Date.now(),t=Je.get(e);if(t&&r-t.fetchedAt<Lr)return t.publicKey;let s=await fetch(e);if(!s.ok)throw new a("CONFIGURATION_ERROR",`Failed to fetch public key from ${e}: HTTP ${s.status}`);let n=await s.json();if(!n.keys||n.keys.length===0)throw new a("CONFIGURATION_ERROR",`No keys found in JWKS response from ${e}`);let i=n.keys[0],c=createPublicKey({key:i,format:"jwk"});return Je.set(e,{publicKey:c,fetchedAt:r}),c}o(tr,"fetchPublicKey");var sr=new Map,or=new Map,nr=new Map;function ir(e){return e.startsWith("RS")||e.startsWith("PS")}o(ir,"isRSA");function ar(e){let r=sr.get(e);return r||(r={access:`${e}:access`,refresh:`${e}:refresh`},sr.set(e,r)),r}o(ar,"getHsSecrets");function Pr(e){let r=or.get(e);return r||(r=createPrivateKey(e),or.set(e,r)),r}o(Pr,"getRsPrivateKey");function ur(e){let r=A(e);if(ir(r.algorithm)){let n=Pr(e.secret);return {accessKey:n,refreshKey:n}}let{access:t,refresh:s}=ar(e.secret);return {accessKey:t,refreshKey:s}}o(ur,"getSigningKeys");function dr(e,r){let t=A(e);if(ir(t.algorithm))return rr(e.secret);let{access:s,refresh:n}=ar(e.secret);return r==="access"?s:n}o(dr,"getVerifyKey");function cr(e,r,t,s){let n=`${t}:${s}`,i=nr.get(n);return i||(i={expiresIn:t,algorithm:s},nr.set(n,i)),ee.sign(e,r,i)}o(cr,"sign");function lr(e,r,t){try{let s=ee.verify(e,r,{algorithms:[t]});if(typeof s=="string"||s===null)throw new a("TOKEN_INVALID","Token payload is not an object");return s}catch(s){throw s instanceof a?s:s instanceof ee.TokenExpiredError?new a("TOKEN_EXPIRED","Token has expired"):new a("TOKEN_INVALID","Token is invalid or malformed")}}o(lr,"verify");function re(e,r){let t=A(r),{accessKey:s}=ur(r);return cr(e,s,t.accessExpiresIn,t.algorithm)}o(re,"signAccessToken");function te(e,r){let t=A(r),{refreshKey:s}=ur(r);return cr({sessionId:e},s,t.refreshExpiresIn,t.algorithm)}o(te,"signRefreshToken");function q(e,r){let t=A(r),s=dr(r,"access");return lr(e,s,t.algorithm)}o(q,"verifyAccessToken");function se(e,r){let t=A(r),s=dr(r,"refresh");return lr(e,s,t.algorithm)}o(se,"verifyRefreshToken");function fr(e,r){try{let t=ee.verify(e,r,{algorithms:["RS256","RS384","RS512","PS256","PS384","PS512"]});if(typeof t=="string"||t===null)throw new a("TOKEN_INVALID","Token payload is not an object");return t}catch(t){throw t instanceof a?t:t instanceof ee.TokenExpiredError?new a("TOKEN_EXPIRED","Token has expired"):new a("TOKEN_INVALID","Token is invalid or malformed")}}o(fr,"verifyTokenWithPublicKey");function xe(e){try{return JSON.parse(e)}catch{return []}}o(xe,"parseRoles");function Kr(e){return JSON.stringify(e)}o(Kr,"serializeRoles");function mr(e){return {id:e.id,userId:e.user_id,type:e.type,value:e.value,createdAt:new Date(e.created_at)}}o(mr,"mapIdentifier");async function oe(e,r){let t=await e.selectFrom("sentri_identifiers as i").innerJoin("sentri_users as u","u.id","i.user_id").select(["u.id","u.password_hash","u.roles"]).where("i.value","=",r).executeTakeFirst();return t?{id:t.id,passwordHash:t.password_hash,roles:xe(t.roles)}:null}o(oe,"findUserByIdentifierValue");async function de(e,r){let t=await e.selectFrom("sentri_users").select(["id","password_hash","roles"]).where("id","=",r).executeTakeFirst();return t?{id:t.id,passwordHash:t.password_hash,roles:xe(t.roles)}:null}o(de,"findUserById");async function pr(e,r,t){let s=t.map(n=>({id:randomUUID(),user_id:r,type:n.type,value:n.value}));return await e.insertInto("sentri_identifiers").values(s).execute(),s.map(n=>({id:n.id,userId:n.user_id,type:n.type,value:n.value,createdAt:new Date}))}o(pr,"createIdentifiers");async function ne(e,r){return (await e.selectFrom("sentri_identifiers").selectAll().where("user_id","=",r).orderBy("created_at","asc").execute()).map(mr)}o(ne,"findIdentifiersByUserId");async function De(e,r,t){let s=await e.selectFrom("sentri_identifiers").selectAll().where("id","=",r).where("user_id","=",t).executeTakeFirst();return s?mr(s):null}o(De,"findIdentifierById");async function wr(e,r){let t=await e.selectFrom("sentri_identifiers").select(s=>s.fn.countAll().as("count")).where("user_id","=",r).executeTakeFirst();return Number(t?.count??0)}o(wr,"countIdentifiersByUserId");async function gr(e,r,t,s){await e.updateTable("sentri_identifiers").set({type:s.type,value:s.value}).where("id","=",r).where("user_id","=",t).execute();}o(gr,"updateIdentifier");async function yr(e,r,t){await e.deleteFrom("sentri_identifiers").where("user_id","=",r).where("id","in",t).execute();}o(yr,"deleteIdentifiers");async function Ir(e,r,t){await e.updateTable("sentri_users").set({password_hash:t}).where("id","=",r).execute();}o(Ir,"updateUserPassword");async function Rr(e,r,t){await e.updateTable("sentri_users").set({roles:Kr(t)}).where("id","=",r).execute();}o(Rr,"updateUserRoles");async function Ce(e,r){let t=randomUUID();return await e.insertInto("sentri_sessions").values({id:t,user_id:r.userId,expires_at:r.expiresAt.toISOString(),ip_address:r.ipAddress??null,user_agent:r.userAgent??null}).execute(),{id:t}}o(Ce,"createSession");async function Ne(e,r){let t=await e.selectFrom("sentri_sessions as s").innerJoin("sentri_users as u","u.id","s.user_id").select(["s.id as session_id","s.user_id","s.expires_at","s.ip_address","s.user_agent","s.replaced_by","s.created_at as session_created_at","u.id as user_id_col","u.password_hash","u.roles"]).where("s.id","=",r).executeTakeFirst();return t?{id:t.session_id,userId:t.user_id,expiresAt:new Date(t.expires_at),ipAddress:t.ip_address,userAgent:t.user_agent,replacedBy:t.replaced_by,createdAt:new Date(t.session_created_at),user:{id:t.user_id_col,passwordHash:t.password_hash,roles:xe(t.roles)}}:null}o(Ne,"findSessionById");async function Se(e,r){await e.deleteFrom("sentri_sessions").where("id","=",r).execute();}o(Se,"deleteSession");async function _r(e,r,t){await e.updateTable("sentri_sessions").set({replaced_by:t}).where("id","=",r).execute();}o(_r,"markSessionReplaced");async function ce(e,r){await e.deleteFrom("sentri_sessions").where("user_id","=",r).execute();}o(ce,"deleteAllSessionsForUser");async function le(e,r,t){let s=A(r),n=N(r.dialect),i=e.roles??[],c=i.filter(k=>!s.validRolesSet.has(k));if(c.length>0)return {success:false,error:new a("INVALID_ROLE",`Invalid roles: ${c.join(", ")}`)};if(!e.identifiers||e.identifiers.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one identifier is required")};let h=e.identifiers.map(k=>({type:k.type.trim(),value:k.value.trim()})),u=h.filter(k=>!s.validIdentifiersSet.has(k.type));if(u.length>0)return {success:false,error:new a("VALIDATION_ERROR",`Invalid identifier types: ${u.map(k=>k.type).join(", ")}`)};if(new Set(h.map(k=>k.value)).size!==h.length)return {success:false,error:new a("VALIDATION_ERROR","Duplicate identifier values in request")};for(let k of h)if(await oe(n,k.value))return {success:false,error:new a("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${k.value}`)};let v=await Y(e.password,s.saltRounds),{userId:D,identifierRows:C}=await n.transaction().execute(async k=>{let H=randomUUID();await k.insertInto("sentri_users").values({id:H,password_hash:v,roles:JSON.stringify(i)}).execute();let Z=h.map(M=>({id:randomUUID(),user_id:H,type:M.type,value:M.value}));return await k.insertInto("sentri_identifiers").values(Z).execute(),{userId:H,identifierRows:Z}}),b={success:true,user:{id:D,roles:i,identifiers:C.map(k=>({id:k.id,type:k.type,value:k.value}))}};return r.hooks?.onRegister&&await r.hooks.onRegister(b.user),b}o(le,"register");async function fe(e,r,t){let s=A(r),n=N(r.dialect),i=await oe(n,e.identifier.trim());if(!i){let C=new a("INVALID_CREDENTIALS","Invalid credentials");return r.hooks?.onLoginFailed&&await r.hooks.onLoginFailed(e.identifier,C,{ip:t?.ip??""}),{success:false,error:C}}if(!await Q(e.password,i.passwordHash)){let C=new a("INVALID_CREDENTIALS","Invalid credentials");return r.hooks?.onLoginFailed&&await r.hooks.onLoginFailed(e.identifier,C,{ip:t?.ip??""}),{success:false,error:C}}let h=new Date(Date.now()+V(s.refreshExpiresIn)),u=await Ce(n,{userId:i.id,expiresAt:h,ipAddress:t?.ip??null,userAgent:t?.userAgent??null}),d={id:i.id,roles:i.roles},v=re({id:i.id,roles:i.roles,sessionId:u.id},r),D=te(u.id,r);return r.hooks?.onLoginSuccess&&await r.hooks.onLoginSuccess(d,{ip:t?.ip??"",userAgent:t?.userAgent??""}),{success:true,accessToken:v,refreshToken:D,user:d}}o(fe,"login");async function B(e,r,t){let s=A(r),n=N(r.dialect),i;try{({sessionId:i}=se(e,r));}catch(C){return C instanceof a?{success:false,error:C}:{success:false,error:new a("TOKEN_INVALID","Invalid refresh token")}}let c=await Ne(n,i);if(!c)return {success:false,error:new a("UNAUTHORIZED","Session not found or revoked")};if(c.replacedBy)return await ce(n,c.userId),{success:false,error:new a("TOKEN_REUSE","Token reuse detected. All sessions revoked.")};if(c.expiresAt.getTime()<Date.now())return await Se(n,i),{success:false,error:new a("TOKEN_EXPIRED","Session has expired")};let h=new Date(Date.now()+V(s.refreshExpiresIn)),u=await Ce(n,{userId:c.userId,expiresAt:h,ipAddress:t?.ip??null,userAgent:t?.userAgent??null});await _r(n,i,u.id);let d={id:c.user.id,roles:c.user.roles},v=re({...d,sessionId:u.id},r),D=te(u.id,r);return {success:true,accessToken:v,refreshToken:D,user:d}}o(B,"refresh");async function he(e,r){let t=N(r.dialect),s;try{({sessionId:s}=se(e,r));}catch{return}let n=await Ne(t,s);n&&(await Se(t,s),r.hooks?.onLogout&&await r.hooks.onLogout(n.userId));}o(he,"logout");async function me(e,r){let t=N(r.dialect);await ce(t,e),r.hooks?.onLogout&&await r.hooks.onLogout(e);}o(me,"logoutAll");async function pe(e,r){let t=N(r.dialect),s=await de(t,e);if(!s)return {success:false,error:new a("USER_NOT_FOUND","User not found")};let n=await ne(t,e);return {success:true,user:{id:s.id,roles:s.roles,identifiers:n.map(i=>({id:i.id,type:i.type,value:i.value}))}}}o(pe,"getUser");async function we(e,r,t,s){let n=A(s),i=N(s.dialect),c=await de(i,e);if(!c)return {success:false,error:new a("USER_NOT_FOUND","User not found")};if(!await Q(r,c.passwordHash))return {success:false,error:new a("INVALID_CREDENTIALS","Invalid credentials")};let u=await Y(t,n.saltRounds);return await Ir(i,e,u),await ce(i,e),s.hooks?.onPasswordChanged&&await s.hooks.onPasswordChanged(e),{success:true}}o(we,"changePassword");async function ge(e,r,t){let s=A(t),n=N(t.dialect),i=r.filter(d=>!s.validRolesSet.has(d));if(i.length>0)return {success:false,error:new a("INVALID_ROLE",`Invalid roles: ${i.join(", ")}`)};let c=await de(n,e);if(!c)return {success:false,error:new a("USER_NOT_FOUND","User not found")};let h=new Set(c.roles);for(let d of r)h.add(d);let u=Array.from(h);return await Rr(n,e,u),{success:true,user:{id:c.id,roles:u}}}o(ge,"assignRoles");async function ye(e,r,t){let s=A(t),n=N(t.dialect);if(r.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one identifier is required")};let i=r.map(d=>({type:d.type.trim(),value:d.value.trim()})),c=i.filter(d=>!s.validIdentifiersSet.has(d.type));if(c.length>0)return {success:false,error:new a("VALIDATION_ERROR",`Invalid identifier types: ${c.map(d=>d.type).join(", ")}`)};if(new Set(i.map(d=>d.value)).size!==i.length)return {success:false,error:new a("VALIDATION_ERROR","Duplicate identifier values in request")};for(let d of i)if(await oe(n,d.value))return {success:false,error:new a("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${d.value}`)};return await pr(n,e,i),{success:true,identifiers:(await ne(n,e)).map(d=>({id:d.id,type:d.type,value:d.value}))}}o(ye,"bulkCreateIdentifiers");async function Ie(e,r,t){let s=A(t),n=N(t.dialect);if(r.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one update is required")};let i=r.map(d=>({id:d.id,type:d.type.trim(),value:d.value.trim()})),c=i.filter(d=>!s.validIdentifiersSet.has(d.type));if(c.length>0)return {success:false,error:new a("VALIDATION_ERROR",`Invalid identifier types: ${c.map(d=>d.type).join(", ")}`)};if(new Set(i.map(d=>d.value)).size!==i.length)return {success:false,error:new a("VALIDATION_ERROR","Duplicate identifier values in request")};for(let d of i){let v=await De(n,d.id,e);if(!v)return {success:false,error:new a("IDENTIFIER_NOT_FOUND",`Identifier not found: ${d.id}`)};if(v.value!==d.value&&await oe(n,d.value))return {success:false,error:new a("IDENTIFIER_ALREADY_EXISTS",`Identifier already taken: ${d.value}`)}}return await n.transaction().execute(async d=>{for(let v of i)await gr(d,v.id,e,{type:v.type,value:v.value});}),{success:true,identifiers:(await ne(n,e)).map(d=>({id:d.id,type:d.type,value:d.value}))}}o(Ie,"bulkUpdateIdentifiers");async function Re(e,r,t){let s=N(t.dialect);if(r.length===0)return {success:false,error:new a("VALIDATION_ERROR","At least one ID is required")};let n=Array.from(new Set(r));for(let h of n)if(!await De(s,h,e))return {success:false,error:new a("IDENTIFIER_NOT_FOUND",`Identifier not found: ${h}`)};return await wr(s,e)-n.length<1?{success:false,error:new a("VALIDATION_ERROR","Cannot delete all identifiers \u2014 at least one must remain")}:(await yr(s,e,n),{success:true,identifiers:(await ne(s,e)).map(h=>({id:h.id,type:h.type,value:h.value}))})}o(Re,"bulkDeleteIdentifiers");function F(e){return A(e).cookieName}o(F,"getCookieName");function _e(e){return A(e).accessCookieName}o(_e,"getAccessCookieName");function K(e,r){if(!e)return;let t=`${r}=`,s=0;for(;s<e.length;){for(;s<e.length&&e[s]===" ";)s++;let n=e.indexOf(";",s),i=n===-1?e.length:n;if(e.startsWith(t,s))return e.slice(s+t.length,i);s=i+1;}}o(K,"readCookie");function ie(e,r,t){let s=t.cookie??{},n=V(A(t).refreshExpiresIn)/1e3;e.cookie??={},e.cookie[F(t)]={value:r,httpOnly:s.httpOnly??true,secure:s.secure??false,sameSite:s.sameSite??"strict",path:s.path??"/",maxAge:n};}o(ie,"setCookieFromConfig");function ve(e,r){let t=r.cookie??{};e.cookie??={},e.cookie[F(r)]={value:"",httpOnly:t.httpOnly??true,path:t.path??"/",maxAge:0};}o(ve,"clearCookieFromConfig");function ae(e,r,t){if(!t.accessCookie)return;let s=t.accessCookie,n=V(A(t).accessExpiresIn)/1e3;e.cookie??={},e.cookie[_e(t)]={value:r,httpOnly:false,secure:s.secure??false,sameSite:s.sameSite??"strict",path:s.path??"/",maxAge:n};}o(ae,"setAccessCookieFromConfig");function Oe(e,r){if(!r.accessCookie)return;let t=r.accessCookie;e.cookie??={},e.cookie[_e(r)]={value:"",httpOnly:false,path:t.path??"/",maxAge:0};}o(Oe,"clearAccessCookieFromConfig");function j(e,r){let t=e.headers.get("authorization");if(t?.startsWith("Bearer "))return t.slice(7);let s=e.headers.get("cookie");return s?K(s,_e(r)):void 0}o(j,"getCurrentAccessToken");function be(e){let r=e.logger??S,t=e.loggerService??"sentri";if(e.mode==="client"){let n=e;return new Elysia().derive({as:"global"},async({request:i})=>{let c=i.headers.get("authorization"),h=c?.startsWith("Bearer ")?c.slice(7):void 0;if(!h)throw r.warn(m(t,"auth.protect.failure",{mode:"client",errorCode:"UNAUTHORIZED"})),new a("UNAUTHORIZED","Missing or malformed Authorization header");try{let u=await tr(n.keyUri),d=fr(h,u),v={id:d.id,roles:d.roles};return r.info(m(t,"auth.protect.success",{mode:"client",userId:d.id})),{user:v}}catch(u){let d=u instanceof a?u.code:"TOKEN_INVALID";throw r.warn(m(t,"auth.protect.failure",{mode:"client",errorCode:d})),u}})}let s=e;return new Elysia().derive({as:"global"},async({request:n,set:i})=>{let c=j(n,s);if(!c)throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:"UNAUTHORIZED"})),new a("UNAUTHORIZED","Missing or malformed Authorization header");try{let h=q(c,s);if(s.isTokenRevoked&&await s.isTokenRevoked(h.sessionId))throw r.warn(m(t,"auth.protect.token_revoked",{mode:"server",userId:h.id})),new a("UNAUTHORIZED","Token has been revoked");let u={id:h.id,roles:h.roles};return r.info(m(t,"auth.protect.success",{mode:"server",userId:h.id})),{user:u}}catch(h){if(h instanceof a&&h.code==="TOKEN_EXPIRED"){let d=n.headers.get("cookie"),v=d?K(d,F(s)):void 0;if(!v)throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:"TOKEN_EXPIRED"})),new a("UNAUTHORIZED","Token expired. Please login again.");let D;try{D=await B(v,s);}catch{throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:"TOKEN_EXPIRED"})),new a("UNAUTHORIZED","Session expired. Please login again.")}if(!D.success)throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:D.error.code})),new a("UNAUTHORIZED","Session expired. Please login again.");return ie(i,D.refreshToken,s),ae(i,D.accessToken,s),i.headers["X-New-Access-Token"]=D.accessToken,r.info(m(t,"auth.protect.auto_refresh",{mode:"server",userId:D.user.id})),{user:D.user}}let u=h instanceof a?h.code:"TOKEN_INVALID";throw r.warn(m(t,"auth.protect.failure",{mode:"server",errorCode:u})),h}})}o(be,"protect");function Er(e,r,t){let s=`Requires one of roles: ${e.join(", ")}`;return ({user:n})=>{if(!n)throw r.warn(m(t,"auth.authorize.unauthenticated",{requiredRoles:e})),new a("UNAUTHORIZED","Not authenticated");let i=n.roles;if(!e.some(c=>i.includes(c)))throw r.warn(m(t,"auth.authorize.denied",{userId:n.id,userRoles:[...i],requiredRoles:e})),new a("FORBIDDEN",s);r.info(m(t,"auth.authorize.passed",{userId:n.id,userRoles:[...i],requiredRoles:e}));}}o(Er,"createAuthorizeHandler");function Ue(e,r){return o(function(...s){return Er(s,e,r)},"authorize")}o(Ue,"createAuthorize");function $r(...e){return Er(e,S,"sentri")}o($r,"authorize");var Hr=new a("FORBIDDEN","You do not have permission to perform this action");function kr(e,r,t){return async s=>{let n=s.user;if(!n)throw r.warn(m(t,"auth.permit.unauthenticated",{})),new a("UNAUTHORIZED","Not authenticated");if(e.roles&&e.roles.length>0){let i=n.roles;if(e.roles.some(c=>i.includes(c))){r.info(m(t,"auth.permit.role_bypass",{userId:n.id,bypassedByRole:true}));return}}try{let i=e.check(s);if(i instanceof Promise?await i:i)r.info(m(t,"auth.permit.passed",{userId:n.id}));else throw r.warn(m(t,"auth.permit.denied",{userId:n.id})),Hr}catch(i){throw i}}}o(kr,"createPermitHandler");function Le(e,r){return o(function(s){return kr(typeof s=="function"?{check:s}:s,e,r)},"permit")}o(Le,"createPermit");function Mr(e){return kr(typeof e=="function"?{check:e}:e,S,"sentri")}o(Mr,"permit");function ue(e){return ({error:r,set:t})=>r instanceof a?(t.status=r.statusCode,{error:true,statusCode:r.statusCode,code:r.code,message:r.message,data:null}):(e?.onUnhandled?.(r),t.status=500,{error:true,statusCode:500,code:"INTERNAL_SERVER_ERROR",message:"Internal server error",data:null})}o(ue,"createErrorHandler");var Fe=class{static{o(this,"InMemoryRateLimiter");}store=new Map;constructor(){setInterval(()=>{let r=Date.now();for(let[t,s]of this.store.entries())s.expiresAt<r&&this.store.delete(t);},6e4).unref();}async consume(r,t,s){let n=Date.now(),i=this.store.get(r);if((!i||i.expiresAt<n)&&(i={count:0,expiresAt:n+s},this.store.set(r,i)),i.count>=t){let c=Math.ceil((i.expiresAt-n)/1e3);throw new a("RATE_LIMIT_EXCEEDED",`Rate limit exceeded. Try again in ${c} seconds.`)}i.count++;}},Pe=class{static{o(this,"RedisRateLimiter");}redis;logger;constructor(r,t){this.redis=r,this.logger=t;}async consume(r,t,s){let n=`sentri:rl:${r}`,i=Math.ceil(s/1e3);try{let c=await this.redis.multi().incr(n).expire(n,i,"NX").exec();if(!c||c.length===0)return;if(c[0][1]>t)throw new a("RATE_LIMIT_EXCEEDED","Rate limit exceeded. Try again later.")}catch(c){if(c instanceof a&&c.code==="RATE_LIMIT_EXCEEDED")throw c;this.logger.error({msg:"Redis RateLimiter failed, bypassing limit",error:c});}}},X=null;async function Tr(e,r){if(X)return X;if(e)try{let{Redis:t}=await import('ioredis'),s=new t(e,{lazyConnect:!0,maxRetriesPerRequest:1});return await s.connect(),r?.info({msg:"Connected to Redis for Rate Limiting"}),X=new Pe(s,r??S),X}catch(t){r?.warn({msg:"Failed to connect to Redis for Rate Limiting, falling back to InMemoryRateLimiter",error:t});}return X=new Fe,X}o(Tr,"getRateLimiter");var Ae=8,z=72,Ee=255,xr=100,G=50;function _(e){return new a("VALIDATION_ERROR",e)}o(_,"badRequest");function O(e,r,t,s){return e.status=r,{error:false,statusCode:r,message:t,data:s}}o(O,"ok");function $(e){if(e==null||typeof e!="object"||Array.isArray(e))throw new a("VALIDATION_ERROR","Request body is missing or not a JSON object. Did you set Content-Type: application/json?");return e}o($,"parseBody");function qr(e,r){if(!r.apiKey)return;let t=e.headers.get("x-api-key");if(typeof t!="string"||t!==r.apiKey)throw new a("UNAUTHORIZED","Invalid or missing API key")}o(qr,"validateApiKey");function Ke(e){if(e)try{let r=e();r instanceof Promise&&r.catch(()=>{});}catch{}}o(Ke,"fireHook");function Br(e){return e.startsWith("RS")||e.startsWith("PS")}o(Br,"isRSA");function $e(e,r){if(typeof e!="object"||e===null||Array.isArray(e))throw _(`identifiers[${r}] must be an object`);let t=e;if(typeof t.type!="string"||t.type.trim().length===0)throw _(`identifiers[${r}].type is required and must be a non-empty string`);if(t.type.length>xr)throw _(`identifiers[${r}].type must not exceed ${xr} characters`);if(typeof t.value!="string"||t.value.trim().length===0)throw _(`identifiers[${r}].value is required and must be a non-empty string`);if(t.value.length>Ee)throw _(`identifiers[${r}].value must not exceed ${Ee} characters`);return {type:t.type,value:t.value}}o($e,"validateIdentifierInput");async function P(e,r,t){let s=j(e,t);if(!s)throw new a("UNAUTHORIZED","Missing or malformed Authorization header");let n=q(s,t);if(t.isTokenRevoked&&await t.isTokenRevoked(n.sessionId))throw new a("UNAUTHORIZED","Token has been revoked");return {id:n.id,roles:n.roles}}o(P,"requireAuth");function Dr(e){let r=e,t=A(r),s=e.logger??S,n=e.loggerService??"sentri",i=e.router?.register??(l=>le(l,r)),c=e.router?.login??(l=>fe(l,r)),h=e.router?.refresh??(l=>B(l,r)),u=e.router?.logout??(l=>l!==void 0?he(l,r):Promise.resolve()),d=e.router?.logoutAll??(l=>me(l,r)),v=e.router?.getUser??(l=>pe(l,r)),D=e.router?.assignRoles??((l,f)=>ge(l,f,r)),C=e.router?.changePassword??((l,f,g)=>we(l,f,g,r)),b=e.router?.bulkCreateIdentifiers??((l,f)=>ye(l,f,r)),k=e.router?.bulkUpdateIdentifiers??((l,f)=>Ie(l,f,r)),H=e.router?.bulkDeleteIdentifiers??((l,f)=>Re(l,f,r)),Z=Tr(e.redisUrl,s),M=new Elysia().onError(ue());return Br(t.algorithm)&&M.get("/keys",({set:l})=>(l.headers["Cache-Control"]="public, max-age=3600",er(e.secret))),M.post("/register",async({body:l,request:f,set:g})=>{let I=Date.now();qr(f,r);let p=$(l),{identifiers:x,password:w,roles:R}=p;if(!Array.isArray(x)||x.length===0)throw _("identifiers is required and must be a non-empty array");if(x.length>G)throw _(`identifiers must not exceed ${G} entries`);let y=x.map((J,ke)=>$e(J,ke));if(typeof w!="string"||w.length<Ae)throw _(`password is required and must be at least ${Ae} characters`);if(w.length>z)throw _(`password must not exceed ${z} characters`);if(R!==void 0&&!Array.isArray(R))throw _("roles must be an array of strings when provided");if(Array.isArray(R)&&!R.every(J=>typeof J=="string"))throw _("each role must be a string");let T=Array.isArray(R)?R:void 0,E=T!==void 0?{identifiers:y,password:w,roles:T}:{identifiers:y,password:w},L=f.headers.get("x-forwarded-for")||"127.0.0.1",W=f.headers.get("user-agent")||"Unknown";if(e.rateLimit!==false){let J=await Z,ke=typeof e.rateLimit=="object"?e.rateLimit.maxRegisterAttempts??5:5;await J.consume(`register:${L}`,ke,900*1e3);}let U=await i(E,{ip:L,userAgent:W});return U.success?(s.info(m(n,"auth.register.success",{userId:U.user.id,duration_ms:Date.now()-I})),O(g,201,"User registered successfully",{user:U.user})):(s.warn(m(n,"auth.register.failure",{errorCode:U.error.code,duration_ms:Date.now()-I})),g.status=U.error.statusCode,{error:true,statusCode:U.error.statusCode,code:U.error.code,message:U.error.message,data:null})}).post("/login",async({body:l,request:f,set:g})=>{let I=Date.now(),p=$(l),{identifier:x,password:w}=p;if(typeof x!="string"||x.trim().length===0)throw _("identifier is required and must be a non-empty string");if(x.length>Ee)throw _(`identifier must not exceed ${Ee} characters`);if(typeof w!="string"||w.length===0)throw _("password is required");if(w.length>z)throw _(`password must not exceed ${z} characters`);let R=x.trim(),y=f.headers.get("x-forwarded-for")||"127.0.0.1",T=f.headers.get("user-agent")||"Unknown";if(e.rateLimit!==false){let L=await Z,W=typeof e.rateLimit=="object"?e.rateLimit.maxLoginAttempts??5:5;await L.consume(`login:${y}`,W,900*1e3);}let E=await c({identifier:R,password:w},{ip:y,userAgent:T});return E.success?(Ke(()=>r.hooks?.onLoginSuccess?.(E.user,{ip:y,userAgent:T})),ie(g,E.refreshToken,r),ae(g,E.accessToken,r),s.info(m(n,"auth.login.success",{userId:E.user.id,duration_ms:Date.now()-I})),O(g,200,"Login successful",{accessToken:E.accessToken,user:E.user})):(Ke(()=>r.hooks?.onLoginFailed?.(R,E.error,{ip:y})),s.warn(m(n,"auth.login.failure",{errorCode:E.error.code,duration_ms:Date.now()-I})),g.status=E.error.statusCode,{error:true,statusCode:E.error.statusCode,code:E.error.code,message:E.error.message,data:null})}).post("/refresh",async({request:l,set:f})=>{let g=Date.now(),I=K(l.headers.get("cookie")??void 0,F(r));if(!I)throw new a("UNAUTHORIZED","Refresh token cookie is missing");let p=l.headers.get("x-forwarded-for")||"127.0.0.1",x=l.headers.get("user-agent")||"Unknown",w=await h(I,{ip:p,userAgent:x});return w.success?(ie(f,w.refreshToken,r),ae(f,w.accessToken,r),s.info(m(n,"auth.refresh.success",{userId:w.user.id,duration_ms:Date.now()-g})),O(f,200,"Token refreshed",{accessToken:w.accessToken})):(ve(f,r),s.warn(m(n,"auth.refresh.failure",{errorCode:w.error.code,duration_ms:Date.now()-g})),f.status=w.error.statusCode,{error:true,statusCode:w.error.statusCode,code:w.error.code,message:w.error.message,data:null})}).post("/logout",async({request:l,set:f})=>{let g=Date.now(),I=K(l.headers.get("cookie")??void 0,F(r));return await u(I),ve(f,r),Oe(f,r),s.info(m(n,"auth.logout",{duration_ms:Date.now()-g})),O(f,200,"Logged out",null)}).post("/logout-all",async({request:l,set:f})=>{let g=Date.now(),I=await P(l,f,r);return await d(I.id),Ke(()=>r.hooks?.onLogout?.(I.id)),ve(f,r),Oe(f,r),s.info(m(n,"auth.logout_all",{userId:I.id,duration_ms:Date.now()-g})),O(f,200,"All sessions revoked",null)}).get("/me",async({request:l,set:f})=>{let g=Date.now(),I=await P(l,f,r),p=await v(I.id);return p.success?(s.info(m(n,"auth.me.success",{userId:p.user.id,duration_ms:Date.now()-g})),O(f,200,"OK",p.user)):(s.warn(m(n,"auth.me.failure",{userId:I.id,errorCode:p.error.code,duration_ms:Date.now()-g})),f.status=p.error.statusCode,{error:true,statusCode:p.error.statusCode,code:p.error.code,message:p.error.message,data:null})}).get("/me/identifiers",async({request:l,set:f})=>{let g=Date.now(),I=await P(l,f,r),p=await v(I.id);return p.success?(s.info(m(n,"auth.me.identifiers.success",{userId:p.user.id,count:p.user.identifiers?.length??0,duration_ms:Date.now()-g})),O(f,200,"OK",{identifiers:p.user.identifiers??[]})):(s.warn(m(n,"auth.me.identifiers.failure",{userId:I.id,errorCode:p.error.code,duration_ms:Date.now()-g})),f.status=p.error.statusCode,{error:true,statusCode:p.error.statusCode,code:p.error.code,message:p.error.message,data:null})}).post("/me/identifiers",async({body:l,request:f,set:g})=>{let I=Date.now(),p=await P(f,g,r),x=$(l),{identifiers:w}=x;if(!Array.isArray(w)||w.length===0)throw _("identifiers is required and must be a non-empty array");if(w.length>G)throw _(`identifiers must not exceed ${G} entries`);let R=w.map((T,E)=>$e(T,E)),y=await b(p.id,R);return y.success?(s.info(m(n,"auth.identifiers.created",{userId:p.id,count:y.identifiers.length,duration_ms:Date.now()-I})),O(g,201,"Identifiers added successfully",{identifiers:y.identifiers})):(s.warn(m(n,"auth.identifiers.create_failure",{userId:p.id,errorCode:y.error.code,duration_ms:Date.now()-I})),g.status=y.error.statusCode,{error:true,statusCode:y.error.statusCode,code:y.error.code,message:y.error.message,data:null})}).put("/me/identifiers",async({body:l,request:f,set:g})=>{let I=Date.now(),p=await P(f,g,r),x=$(l),{identifiers:w}=x;if(!Array.isArray(w)||w.length===0)throw _("identifiers is required and must be a non-empty array");if(w.length>G)throw _(`identifiers must not exceed ${G} entries`);let R=w.map((T,E)=>{if(typeof T!="object"||T===null||Array.isArray(T))throw _(`identifiers[${E}] must be an object`);let L=T;if(typeof L.id!="string"||L.id.trim().length===0)throw _(`identifiers[${E}].id is required and must be a non-empty string`);let{type:W,value:U}=$e(T,E);return {id:L.id,type:W,value:U}}),y=await k(p.id,R);return y.success?(s.info(m(n,"auth.identifiers.updated",{userId:p.id,count:y.identifiers.length,duration_ms:Date.now()-I})),O(g,200,"Identifiers updated successfully",{identifiers:y.identifiers})):(s.warn(m(n,"auth.identifiers.update_failure",{userId:p.id,errorCode:y.error.code,duration_ms:Date.now()-I})),g.status=y.error.statusCode,{error:true,statusCode:y.error.statusCode,code:y.error.code,message:y.error.message,data:null})}).delete("/me/identifiers",async({body:l,request:f,set:g})=>{let I=Date.now(),p=await P(f,g,r),x=$(l),{ids:w}=x;if(!Array.isArray(w)||w.length===0)throw _("ids is required and must be a non-empty array of strings");if(!w.every(y=>typeof y=="string"))throw _("each id must be a string");let R=await H(p.id,w);return R.success?(s.info(m(n,"auth.identifiers.deleted",{userId:p.id,duration_ms:Date.now()-I})),O(g,200,"Identifiers deleted successfully",{identifiers:R.identifiers})):(s.warn(m(n,"auth.identifiers.delete_failure",{userId:p.id,errorCode:R.error.code,duration_ms:Date.now()-I})),g.status=R.error.statusCode,{error:true,statusCode:R.error.statusCode,code:R.error.code,message:R.error.message,data:null})}).patch("/me/password",async({body:l,request:f,set:g})=>{let I=Date.now(),p=await P(f,g,r),x=$(l),{currentPassword:w,newPassword:R}=x;if(typeof w!="string"||w.length===0)throw _("currentPassword is required");if(typeof R!="string"||R.length<Ae)throw _(`newPassword must be at least ${Ae} characters`);if(R.length>z)throw _(`newPassword must not exceed ${z} characters`);if(w===R)throw _("newPassword must be different from currentPassword");let y=await C(p.id,w,R);return y.success?(s.info(m(n,"auth.password.changed",{userId:p.id,duration_ms:Date.now()-I})),O(g,200,"Password updated successfully. All sessions have been revoked.",null)):(s.warn(m(n,"auth.password.change_failure",{userId:p.id,errorCode:y.error.code,duration_ms:Date.now()-I})),g.status=y.error.statusCode,{error:true,statusCode:y.error.statusCode,code:y.error.code,message:y.error.message,data:null})}).post("/users/:userId/roles",async({body:l,request:f,set:g,params:I})=>{let p=Date.now();if(!(await P(f,g,r)).roles.includes("admin"))throw new a("FORBIDDEN","Requires one of roles: admin");let w=$(l),{roles:R}=w,{userId:y}=I;if(!y)throw _("userId is required");if(!Array.isArray(R)||R.length===0)throw _("roles must be a non-empty array of strings");if(!R.every(E=>typeof E=="string"))throw _("each role must be a string");let T=await D(y,R);return T.success?(s.info(m(n,"auth.roles.assigned",{targetUserId:y,roles:R,duration_ms:Date.now()-p})),O(g,200,"Roles assigned successfully",{user:T.user})):(s.warn(m(n,"auth.roles.assign_failure",{targetUserId:y,errorCode:T.error.code,duration_ms:Date.now()-p})),g.status=T.error.statusCode,{error:true,statusCode:T.error.statusCode,code:T.error.code,message:T.error.message,data:null})}),M}o(Dr,"createAuthRouter");function Fs(e){if(e.mode==="client"){let u={mode:"client",keyUri:e.keyUri,...e.validRoles!==void 0&&{validRoles:e.validRoles},...e.logger!==void 0&&{logger:e.logger},...e.loggerService!==void 0&&{loggerService:e.loggerService}};Xe(u);let d=u.logger??S,v=u.loggerService??"sentri",D=Ue(d,v),C=Le(d,v);return {protect:o(()=>be(u),"protect"),authorize:o((...b)=>D(...b),"authorize"),permit:o(b=>C(b),"permit"),errorHandler:o(b=>ue(b),"errorHandler")}}let{privateKey:r}=generateKeyPairSync("rsa",{modulusLength:2048,privateKeyEncoding:{type:"pkcs8",format:"pem"},publicKeyEncoding:{type:"spki",format:"pem"}}),t={mode:"server",dialect:e.dialect,secret:r,algorithm:"RS256",validRoles:e.validRoles,...e.validIdentifiers!==void 0&&{validIdentifiers:e.validIdentifiers},...e.accessExpiresIn!==void 0&&{accessExpiresIn:e.accessExpiresIn},...e.refreshExpiresIn!==void 0&&{refreshExpiresIn:e.refreshExpiresIn},...e.saltRounds!==void 0&&{saltRounds:e.saltRounds},...e.apiKey!==void 0&&{apiKey:e.apiKey},...e.cookie!==void 0&&{cookie:e.cookie},...e.accessCookie!==void 0&&{accessCookie:e.accessCookie},...e.hooks!==void 0&&{hooks:e.hooks},...e.router!==void 0&&{router:e.router},...e.isTokenRevoked!==void 0&&{isTokenRevoked:e.isTokenRevoked},...e.rateLimit!==void 0&&{rateLimit:e.rateLimit},...e.redisUrl!==void 0&&{redisUrl:e.redisUrl},...e.logger!==void 0&&{logger:e.logger},...e.loggerService!==void 0&&{loggerService:e.loggerService}},s=t.logger??S,n=t.loggerService??"sentri",i=A(t),c=Ue(s,n),h=Le(s,n);return {protect:o(()=>be(t),"protect"),authorize:o((...u)=>c(...u),"authorize"),permit:o(u=>h(u),"permit"),errorHandler:o(u=>ue(u),"errorHandler"),router:o(()=>Dr(t),"router"),migrate:o(()=>ze(N(t.dialect)),"migrate"),getCurrentAccessToken:o(u=>j(u,t),"getCurrentAccessToken"),hashPassword:o(u=>Y(u,i.saltRounds),"hashPassword"),verifyPassword:o((u,d)=>Q(u,d),"verifyPassword"),signAccessToken:o(u=>re(u,t),"signAccessToken"),signRefreshToken:o(u=>te(u,t),"signRefreshToken"),verifyAccessToken:o(u=>q(u,t),"verifyAccessToken"),verifyRefreshToken:o(u=>se(u,t),"verifyRefreshToken"),register:o(u=>le(u,t),"register"),login:o(u=>fe(u,t),"login"),refresh:o(u=>B(u,t),"refresh"),logout:o(u=>he(u,t),"logout"),logoutAll:o(u=>me(u,t),"logoutAll"),getUser:o(u=>pe(u,t),"getUser"),changePassword:o((u,d,v)=>we(u,d,v,t),"changePassword"),assignRoles:o((u,d)=>ge(u,d,t),"assignRoles"),bulkCreateIdentifiers:o((u,d)=>ye(u,d,t),"bulkCreateIdentifiers"),bulkUpdateIdentifiers:o((u,d)=>Ie(u,d,t),"bulkUpdateIdentifiers"),bulkDeleteIdentifiers:o((u,d)=>Re(u,d,t),"bulkDeleteIdentifiers")}}o(Fs,"createAuthElysia");export{He as SENTRI_ERROR_STATUS,a as SentriError,$r as authorize,Fs as createAuthElysia,Dr as createAuthRouter,Ue as createAuthorize,ue as createErrorHandler,Le as createPermit,j as getCurrentAccessToken,Mr as permit,be as protect};