slauthjs 0.0.0-stage → 2.0.0

package/src/passkey/webauthn.js

@@ -0,0 +1,183 @@
+import { decodeCbor } from './cbor.js'
+import { base64Url, concat, fromBase64Url, sha256 } from '../util.js'
+
+/**
+ * WebAuthn (passkeys), the parts a server needs, with Web Crypto only:
+ *
+ * - registration: check the browser's answer to navigator.credentials.create() and pull
+ *   out the new public key;
+ * - sign-in: check a signature from navigator.credentials.get() with that key.
+ *
+ * Attestation is not checked ("none"): for a personal project what matters is that the
+ * same passkey signs in later, not which company made the authenticator.
+ *
+ * Supports ES256 (every platform passkey) and RS256 (some Windows Hello keys).
+ */
+
+export const ES256 = -7
+export const RS256 = -257
+
+const FLAG_UP = 0x01
+const FLAG_UV = 0x04
+const FLAG_AT = 0x40
+
+/**
+ * @typedef {{ origin: string | string[], rpId: string, challenge: string, requireUserVerification?: boolean }} Expect
+ * @typedef {{ id: string, publicKey: JsonWebKey, alg: number, counter: number, transports?: string[] }} Credential
+ */
+
+/**
+ * Checks a registration response.
+ * @param {{ id: string, rawId?: string, type: string, response: { clientDataJSON: string, attestationObject: string, transports?: string[] } }} credential
+ * @param {Expect} expect
+ * @returns {Promise<Credential>}
+ */
+export async function verifyRegistration(credential, expect) {
+  if (credential?.type !== 'public-key' || typeof credential.id !== 'string') throw new PasskeyError('Not a passkey.')
+  await checkClientData(credential.response?.clientDataJSON, 'webauthn.create', expect)
+
+  const attestation = decodeCbor(fromBase64Url(credential.response.attestationObject)).value
+  if (!(attestation instanceof Map) || !(attestation.get('authData') instanceof Uint8Array)) {
+    throw new PasskeyError('The attestation is malformed.')
+  }
+  const auth = await parseAuthData(attestation.get('authData'), expect)
+  if (!auth.credentialId || !auth.coseKey) throw new PasskeyError('No new credential in the response.')
+  if (base64Url(auth.credentialId) !== credential.id) throw new PasskeyError('Credential id mismatch.')
+
+  const { jwk, alg } = coseToJwk(auth.coseKey)
+  // Make sure Web Crypto accepts the key now, rather than at the first sign-in.
+  await importKey(jwk, alg)
+  const transports = Array.isArray(credential.response.transports) ? credential.response.transports.filter((t) => typeof t === 'string') : undefined
+  return { id: credential.id, publicKey: jwk, alg, counter: auth.signCount, transports }
+}
+
+/**
+ * Checks a sign-in (assertion) response against a stored credential.
+ * @param {{ id: string, type: string, response: { clientDataJSON: string, authenticatorData: string, signature: string, userHandle?: string | null } }} assertion
+ * @param {Credential} stored
+ * @param {Expect} expect
+ * @returns {Promise<{ counter: number }>}  the new signature counter to store
+ */
+export async function verifyAuthentication(assertion, stored, expect) {
+  if (assertion?.type !== 'public-key' || assertion.id !== stored.id) throw new PasskeyError('Not the expected passkey.')
+  const clientDataBytes = fromBase64Url(assertion.response?.clientDataJSON ?? '')
+  await checkClientData(assertion.response.clientDataJSON, 'webauthn.get', expect)
+
+  const authData = fromBase64Url(assertion.response.authenticatorData)
+  const auth = await parseAuthData(authData, expect)
+
+  const signed = concat(authData, await sha256(clientDataBytes))
+  let signature = fromBase64Url(assertion.response.signature)
+  const key = await importKey(stored.publicKey, stored.alg)
+  if (stored.alg === ES256) signature = derToRaw(signature)
+  const algorithm = stored.alg === ES256 ? { name: 'ECDSA', hash: 'SHA-256' } : { name: 'RSASSA-PKCS1-v1_5' }
+  if (!(await crypto.subtle.verify(algorithm, key, signature, signed))) throw new PasskeyError('The signature is wrong.')
+
+  // A counter that goes backwards means the passkey was copied. Many passkeys always
+  // send 0, which means "no counter" and is fine.
+  if ((auth.signCount !== 0 || stored.counter !== 0) && auth.signCount <= stored.counter) {
+    throw new PasskeyError('This passkey may have been cloned (its counter went backwards).')
+  }
+  return { counter: auth.signCount }
+}
+
+export class PasskeyError extends Error {}
+
+/** The challenge a response answers, so the server can look up what it sent. */
+export function readChallenge(clientDataJSON) {
+  try {
+    const challenge = JSON.parse(new TextDecoder().decode(fromBase64Url(clientDataJSON))).challenge
+    return typeof challenge === 'string' ? challenge : null
+  } catch {
+    return null
+  }
+}
+
+async function checkClientData(encoded, type, expect) {
+  let data
+  try {
+    data = JSON.parse(new TextDecoder().decode(fromBase64Url(encoded)))
+  } catch {
+    throw new PasskeyError('clientDataJSON is malformed.')
+  }
+  if (data.type !== type) throw new PasskeyError(`Expected a ${type} response.`)
+  if (data.challenge !== expect.challenge) throw new PasskeyError('The challenge does not match.')
+  const origins = [expect.origin].flat()
+  if (!origins.includes(data.origin)) throw new PasskeyError(`Unexpected origin ${data.origin}.`)
+  if (data.crossOrigin === true) throw new PasskeyError('Cross-origin passkey requests are not allowed.')
+  return data
+}
+
+async function parseAuthData(bytes, expect) {
+  if (bytes.length < 37) throw new PasskeyError('authenticatorData is too short.')
+  const rpIdHash = bytes.subarray(0, 32)
+  const flags = bytes[32]
+  const signCount = new DataView(bytes.buffer, bytes.byteOffset + 33, 4).getUint32(0)
+
+  const expected = await sha256(expect.rpId)
+  if (base64Url(rpIdHash) !== base64Url(expected)) throw new PasskeyError('The passkey is for a different site (rpId).')
+  if (!(flags & FLAG_UP)) throw new PasskeyError('The user was not present.')
+  if (expect.requireUserVerification && !(flags & FLAG_UV)) throw new PasskeyError('The user was not verified.')
+
+  const out = { flags, signCount, credentialId: null, coseKey: null }
+  if (flags & FLAG_AT) {
+    let at = 37 + 16 // skip the AAGUID
+    if (bytes.length < at + 2) throw new PasskeyError('authenticatorData is truncated.')
+    const idLength = (bytes[at] << 8) | bytes[at + 1]
+    at += 2
+    if (bytes.length < at + idLength) throw new PasskeyError('authenticatorData is truncated.')
+    out.credentialId = bytes.slice(at, at + idLength)
+    at += idLength
+    out.coseKey = decodeCbor(bytes, at).value
+  }
+  return out
+}
+
+/** COSE_Key (RFC 9053) -> JWK. */
+function coseToJwk(cose) {
+  if (!(cose instanceof Map)) throw new PasskeyError('The public key is malformed.')
+  const kty = cose.get(1)
+  const alg = cose.get(3)
+  if (kty === 2 && alg === ES256 && cose.get(-1) === 1) {
+    const x = cose.get(-2)
+    const y = cose.get(-3)
+    if (!(x instanceof Uint8Array) || !(y instanceof Uint8Array) || x.length !== 32 || y.length !== 32) {
+      throw new PasskeyError('The P-256 key is malformed.')
+    }
+    return { alg, jwk: { kty: 'EC', crv: 'P-256', x: base64Url(x), y: base64Url(y) } }
+  }
+  if (kty === 3 && alg === RS256) {
+    const n = cose.get(-1)
+    const e = cose.get(-2)
+    if (!(n instanceof Uint8Array) || !(e instanceof Uint8Array)) throw new PasskeyError('The RSA key is malformed.')
+    return { alg, jwk: { kty: 'RSA', n: base64Url(n), e: base64Url(e), alg: 'RS256' } }
+  }
+  throw new PasskeyError(`Unsupported passkey algorithm (${alg}).`)
+}
+
+function importKey(jwk, alg) {
+  const algorithm = alg === ES256 ? { name: 'ECDSA', namedCurve: 'P-256' } : { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }
+  return crypto.subtle.importKey('jwk', jwk, algorithm, false, ['verify'])
+}
+
+/** ECDSA signatures arrive DER-encoded; Web Crypto wants r || s, 32 bytes each. */
+function derToRaw(der) {
+  const fail = () => {
+    throw new PasskeyError('The signature is malformed.')
+  }
+  if (der[0] !== 0x30) fail()
+  let at = 2
+  if (der[1] & 0x80) at = 2 + (der[1] & 0x7f)
+  const int = () => {
+    if (der[at] !== 0x02) fail()
+    const len = der[at + 1]
+    let value = der.subarray(at + 2, at + 2 + len)
+    at += 2 + len
+    while (value.length > 32 && value[0] === 0) value = value.subarray(1)
+    if (value.length > 32) fail()
+    const out = new Uint8Array(32)
+    out.set(value, 32 - value.length)
+    return out
+  }
+  return concat(int(), int())
+}

package/src/password.js

@@ -0,0 +1,81 @@
+import { base64Url, fromBase64Url, safeEqual } from './util.js'
+
+const MAX_FAILURES = 10
+const FAILURE_WINDOW_SECONDS = 15 * 60
+
+/**
+ * Optional passwords, hashed with PBKDF2-SHA256 from Web Crypto. 100,000 rounds by
+ * default: the most Cloudflare Workers allows. Raise `iterations` elsewhere if you like;
+ * old hashes keep working because each one records its own count.
+ *
+ *   password:<userId>   { hash: "pbkdf2-sha256$<iterations>$<salt>$<hash>", updatedAt }
+ *   pwfail:<email>      { count }   (10 wrong guesses → wait 15 minutes)
+ *
+ * People only get a password after proving their email (a code, a link or a provider),
+ * so "forgot password" is just "sign in with a code, then set a new one".
+ *
+ * @param {{ store: import('./index.js').Store, iterations?: number, minLength?: number, validate?: (password: string) => string | null | Promise<string | null> }} options
+ */
+export function createPasswords({ store, iterations = 100_000, minLength = 8, validate }) {
+  // Run a real hash even for unknown emails, so timing doesn't reveal who has an account.
+  let decoy = null
+
+  return {
+    /** An error message when the password won't do, else null. */
+    async problem(password) {
+      if (typeof password !== 'string' || password.length < minLength) return `Passwords need at least ${minLength} characters.`
+      if (password.length > 256) return 'That password is too long.'
+      return validate ? ((await validate(password)) ?? null) : null
+    },
+
+    hash: (password) => hashPassword(password, iterations),
+
+    async set(userId, password) {
+      await store.put(`password:${userId}`, { hash: await hashPassword(password, iterations), updatedAt: Date.now() })
+    },
+
+    async has(userId) {
+      return Boolean(await store.get(`password:${userId}`))
+    },
+
+    async remove(userId) {
+      await store.delete(`password:${userId}`)
+    },
+
+    /** Checks a guess for a user (or null for "no such user"), counting failures per email. */
+    async check(email, userId, password) {
+      const failures = (await store.get(`pwfail:${email}`)) ?? { count: 0 }
+      if (failures.count >= MAX_FAILURES) return { ok: false, code: 'too-many-tries' }
+      const stored = userId ? await store.get(`password:${userId}`) : null
+      decoy ??= await hashPassword('decoy-password', iterations)
+      const ok = await verifyPassword(String(password ?? ''), stored?.hash ?? decoy)
+      if (ok && stored) {
+        await store.delete(`pwfail:${email}`)
+        return { ok: true }
+      }
+      await store.put(`pwfail:${email}`, { count: failures.count + 1 }, { ttl: FAILURE_WINDOW_SECONDS })
+      return { ok: false, code: 'bad-password' }
+    },
+
+    async verify(userId, password) {
+      const stored = await store.get(`password:${userId}`)
+      return Boolean(stored) && verifyPassword(String(password ?? ''), stored.hash)
+    },
+  }
+}
+
+export async function hashPassword(password, iterations = 100_000) {
+  const salt = crypto.getRandomValues(new Uint8Array(16))
+  return `pbkdf2-sha256$${iterations}$${base64Url(salt)}$${base64Url(await derive(password, salt, iterations))}`
+}
+
+export async function verifyPassword(password, stored) {
+  const [scheme, rounds, salt, hash] = String(stored).split('$')
+  if (scheme !== 'pbkdf2-sha256') return false
+  return safeEqual(base64Url(await derive(password, fromBase64Url(salt), Number(rounds))), hash)
+}
+
+async function derive(password, salt, iterations) {
+  const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(password.normalize('NFKC')), 'PBKDF2', false, ['deriveBits'])
+  return crypto.subtle.deriveBits({ name: 'PBKDF2', hash: 'SHA-256', salt, iterations }, key, 256)
+}

package/src/providers.d.ts

@@ -0,0 +1,28 @@
+import type { Profile, Provider } from './index.js'
+
+interface Common {
+  clientId: string
+  clientSecret?: string
+  /** Count the provider's email as verified even when it doesn't say so. */
+  trustEmail?: boolean
+  /** Save access and refresh tokens, for auth.accounts.list(). */
+  keepTokens?: boolean
+  scope?: string
+  params?: Record<string, string>
+}
+
+export function oauth2(options: Common & {
+  id: string
+  name: string
+  authorization: string
+  token: string
+  pkce?: boolean
+  tokenAuth?: 'post' | 'basic'
+  profile(tokens: Record<string, any>, fetch: typeof globalThis.fetch): Promise<Profile>
+}): Provider
+export function oidc(options: Common & { id: string; name: string; issuer: string; tokenAuth?: 'post' | 'basic' }): Provider
+export function github(options: Common): Provider
+export function google(options: Common): Provider
+export function discord(options: Common): Provider
+export function gitlab(options: Common & { baseUrl?: string }): Provider
+export function microsoft(options: Common & { tenant?: string }): Provider

package/src/providers.js

@@ -0,0 +1 @@
+export { oauth2, oidc, github, google, discord, gitlab, microsoft } from './oauth/providers.js'

package/src/rate-limit.js

@@ -0,0 +1,41 @@
+import { clientIp } from './util.js'
+
+/** Per-IP limits on the routes that send email or check a guess: [requests, per seconds]. */
+export const DEFAULT_LIMITS = {
+  'email/start': [10, 600],
+  'password/signin': [20, 600],
+  'password/signup': [10, 600],
+  'two-factor/verify': [20, 600],
+}
+
+/**
+ * A fixed-window counter per IP and route, kept in the store.
+ *
+ *   rate:<route>:<ip>:<window>  count
+ *
+ * Off when no IP can be trusted (see `ip` in the config): the per-email and per-code
+ * limits still apply then.
+ *
+ * @param {import('./index.js').Store} store
+ * @param {false | { limits?: Record<string, [number, number]>, ip?: (request: Request) => string | null }} [options]
+ */
+export function createRateLimit(store, options = {}) {
+  if (options === false) return { check: async () => null }
+  const limits = { ...DEFAULT_LIMITS, ...options.limits }
+  const ipOf = options.ip ?? clientIp
+
+  return {
+    /** Null when it's fine, or how many seconds to wait. */
+    async check(route, request) {
+      const limit = limits[route]
+      const ip = limit && ipOf(request)
+      if (!ip) return null
+      const [max, seconds] = limit
+      const window = Math.floor(Date.now() / 1000 / seconds)
+      const key = `rate:${route}:${ip}:${window}`
+      const count = ((await store.get(key)) ?? 0) + 1
+      await store.put(key, count, { ttl: seconds })
+      return count > max ? (window + 1) * seconds - Math.floor(Date.now() / 1000) : null
+    },
+  }
+}

package/src/routes/account.js

@@ -0,0 +1,130 @@
+import { publicUser } from '../users.js'
+import { json } from '../util.js'
+
+/**
+ * The signed-in person's own account: the session, their profile, their other
+ * sessions, linked providers, and tokens for your APIs.
+ *
+ * @param {object} app  the shared context from core.js
+ */
+export function accountRoutes(app) {
+  const { store, sessions, users, lock, tokens } = app
+
+  return async function route({ route, method, request, url, body }) {
+    if (route === 'session' && method === 'GET') {
+      const me = await app.current(request)
+      const headers = {}
+      if (me?.session) {
+        const refreshed = await sessions.refresh(me.session, request)
+        if (refreshed) headers['Set-Cookie'] = refreshed
+      }
+      const out = { user: me ? publicUser(me.user) : null }
+      if (me?.session?.impersonatorId) out.impersonatorId = me.session.impersonatorId
+      if (!me && app.twoFactor && (await app.pending(request))) out.twoFactor = 'pending'
+      if (lock && me) out.lock = (await lock.handle('session', 'GET', body, { email: me.user.email, userId: me.user.id }, request.headers.get('cookie'), url.protocol === 'https:')).body
+      return json(out, 200, headers)
+    }
+
+    // What the sign-in box should offer.
+    if (route === 'config' && method === 'GET') {
+      return json({
+        appName: app.appName,
+        emailCodes: true,
+        magicLinks: Boolean(app.magicLinks),
+        passkeys: app.passkeys !== false,
+        passwords: Boolean(app.passwords),
+        twoFactor: Boolean(app.twoFactor),
+        organizations: Boolean(app.orgs),
+        providers: app.providers.map((p) => ({ id: p.id, name: p.name })),
+      })
+    }
+
+    if (route === 'signout' && method === 'POST') {
+      const me = await app.current(request)
+      const cookie = await sessions.destroy(request)
+      if (me) await app.emit('signOut', { user: publicUser(me.user), request })
+      return json({ ok: true }, 200, { 'Set-Cookie': cookie })
+    }
+
+    if (route === 'jwks.json' && method === 'GET' && tokens) {
+      return new Response(JSON.stringify(await tokens.jwks()), { headers: { 'Content-Type': 'application/json', 'Cache-Control': 'public, max-age=300', 'Access-Control-Allow-Origin': '*' } })
+    }
+
+    const mine = new Set(['sessions', 'sessions/revoke', 'sessions/revoke-others', 'user', 'user/delete', 'accounts', 'accounts/unlink', 'token'])
+    if (!mine.has(route)) return
+
+    const me = await app.signedIn(request)
+    if (me instanceof Response) return me
+    const { user, session } = me
+
+    if (route === 'token' && method === 'GET' && tokens) {
+      return json(await tokens.create(publicUser(user)))
+    }
+
+    if (route === 'sessions' && method === 'GET') {
+      const list = await sessions.list(user.id)
+      return json({ sessions: list.map((s) => ({ ...s, current: s.id === session?.id })) })
+    }
+
+    if (route === 'sessions/revoke' && method === 'POST') {
+      const { id } = await body()
+      if (!(await sessions.revoke(user.id, id))) return json({ error: 'No such session.', code: 'not-found' }, 404)
+      return json({ ok: true })
+    }
+
+    if (route === 'sessions/revoke-others' && method === 'POST') {
+      await sessions.revokeAll(user.id, session?.id)
+      return json({ ok: true })
+    }
+
+    if (route === 'user' && method === 'POST') {
+      const input = await body()
+      const patch = {}
+      if (input.name !== undefined) {
+        if (input.name !== null && typeof input.name !== 'string') return json({ error: 'A name is text.', code: 'bad-request' }, 400)
+        patch.name = input.name?.trim().slice(0, 100) || null
+      }
+      if (input.image !== undefined) {
+        if (input.image !== null && !(typeof input.image === 'string' && /^https:\/\/\S+$/.test(input.image) && input.image.length <= 2000)) {
+          return json({ error: 'A picture is an https:// link.', code: 'bad-request' }, 400)
+        }
+        patch.image = input.image
+      }
+      const updated = await users.update(user.id, patch)
+      await app.emit('userUpdated', { user: publicUser(updated) })
+      return json({ user: publicUser(updated) })
+    }
+
+    if (route === 'user/delete' && method === 'POST') {
+      if (app.config.allowDeletion === false) return json({ error: "Accounts can't be deleted here.", code: 'not-found' }, 404)
+      if (!app.fresh(session)) return app.reauth()
+      await app.deleteUser(user.id)
+      return json({ ok: true }, 200, { 'Set-Cookie': sessions.clear(request) })
+    }
+
+    if (route === 'accounts' && method === 'GET') {
+      const out = []
+      for (const key of (await store.get(`accounts:${user.id}`)) ?? []) {
+        const doc = await store.get(`account:${key}`)
+        if (doc) out.push({ provider: doc.provider, name: app.providers.find((p) => p.id === doc.provider)?.name ?? doc.provider, email: doc.email ?? null, username: doc.name ?? null, createdAt: doc.createdAt })
+      }
+      return json({
+        accounts: out,
+        password: app.passwords ? await app.passwords.has(user.id) : false,
+        twoFactor: app.twoFactor ? await app.twoFactor.enabled(user.id) : false,
+      })
+    }
+
+    if (route === 'accounts/unlink' && method === 'POST') {
+      const { provider } = await body()
+      const keys = (await store.get(`accounts:${user.id}`)) ?? []
+      const key = keys.find((k) => k.split(':')[0] === provider)
+      if (!key) return json({ error: "That account isn't linked.", code: 'not-found' }, 404)
+      await store.delete(`account:${key}`)
+      const rest = keys.filter((k) => k !== key)
+      if (rest.length) await store.put(`accounts:${user.id}`, rest)
+      else await store.delete(`accounts:${user.id}`)
+      return json({ ok: true })
+    }
+  }
+}

package/src/routes/email.js

@@ -0,0 +1,147 @@
+import { CODE_MINUTES } from '../email-code.js'
+import { normalizeEmail, publicUser, validEmail } from '../users.js'
+import { base64Url, escapeHtml, json, randomToken, safeRedirect, sha256 } from '../util.js'
+
+const MESSAGES = { expired: 'That code has expired. Ask for a new one.', 'too-many-tries': 'Too many tries. Ask for a new code.', 'bad-code': 'That code is wrong.' }
+
+/**
+ * Email codes (and, with magicLinks on, a link in the same email), and changing the
+ * address on an account.
+ *
+ *   link:<sha256 of token>  { email, redirect }   (lives as long as the code)
+ *   signup:<email>          { hash }              (a password to set once the code is used)
+ *
+ * @param {object} app  the shared context from core.js
+ */
+export function emailRoutes(app) {
+  const { store, users, codes, limits } = app
+  const notAllowed = () => json({ error: "That email isn't on the list for this app.", code: 'not-allowed' }, 403)
+  const badEmail = () => json({ error: "That doesn't look like an email address.", code: 'bad-email' }, 400)
+  const slowDown = (retryAfter) => json({ error: `Please wait ${retryAfter}s before trying again.`, code: 'slow-down', retryAfter }, 429)
+  const failed = (result) => json({ error: MESSAGES[result.code], code: result.code, triesLeft: result.triesLeft }, result.code === 'bad-code' ? 400 : 410)
+
+  /** Sends a sign-in code (and link) to an address that's allowed in. Shared with password sign-up. */
+  async function sendSignInCode(email, url, redirect) {
+    let link
+    let data = {}
+    if (app.magicLinks) {
+      const token = randomToken()
+      const linkId = base64Url(await sha256(token))
+      link = `${app.origin(url)}${app.prefix}/email/link?token=${token}`
+      data = { linkId }
+      const sent = await codes.start(email, { link, data })
+      if (sent.ok) await store.put(`link:${linkId}`, { email, redirect: safeRedirect(redirect, null) }, { ttl: CODE_MINUTES * 60 })
+      return sent
+    }
+    return codes.start(email, { data })
+  }
+  app.sendSignInCode = sendSignInCode
+
+  return async function route({ route, method, request, url, body }) {
+    if (route === 'email/start' && method === 'POST') {
+      const input = await body()
+      const email = normalizeEmail(input.email)
+      if (!validEmail(email)) return badEmail()
+      const wait = await limits.check('email/start', request)
+      if (wait) return slowDown(wait)
+      if (!(await users.allowed(email, { method: 'email' }))) return notAllowed()
+      const sent = await sendSignInCode(email, url, input.redirect)
+      if (!sent.ok) return slowDown(sent.retryAfter)
+      return json({ ok: true })
+    }
+
+    if (route === 'email/verify' && method === 'POST') {
+      const input = await body()
+      const email = normalizeEmail(input.email)
+      if (!validEmail(email)) return badEmail()
+      const result = await codes.verify(email, input.code)
+      if (!result.ok) return failed(result)
+      if (result.entry.linkId) await store.delete(`link:${result.entry.linkId}`)
+      const found = await users.signIn(email, { method: 'email' })
+      if (!found) return notAllowed()
+      await finishSignup(found)
+      return app.reply(await app.complete(found, request, { method: 'email' }), {}, request)
+    }
+
+    // The link in the email opens a page with a button, rather than signing in on GET:
+    // mail scanners open links to check them, and would use the link up.
+    if (route === 'email/link' && method === 'GET') {
+      return new Response(linkPage(app.appName, `${app.prefix}/email/link`), {
+        headers: { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Referrer-Policy': 'no-referrer', 'Content-Security-Policy': "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'" },
+      })
+    }
+
+    if (route === 'email/link' && method === 'POST') {
+      const { token } = await body()
+      const linkId = typeof token === 'string' && token.length <= 128 ? base64Url(await sha256(token)) : null
+      const link = linkId ? await store.get(`link:${linkId}`) : null
+      if (!link) return json({ error: 'That link has expired or was already used. Ask for a new one.', code: 'expired' }, 410)
+      await store.delete(`link:${linkId}`)
+      const code = await store.get(`code:${link.email}`)
+      if (code?.linkId === linkId) await store.delete(`code:${link.email}`)
+      const found = await users.signIn(link.email, { method: 'link' })
+      if (!found) return notAllowed()
+      await finishSignup(found)
+      const result = await app.complete(found, request, { method: 'link' })
+      const to = result.kind === 'two-factor' ? (app.signInPage ?? link.redirect ?? '/') : (link.redirect ?? '/')
+      return app.reply(result, { redirect: to }, request)
+    }
+
+    if (route === 'email/change/start' && method === 'POST') {
+      const me = await app.signedIn(request)
+      if (me instanceof Response) return me
+      if (!app.fresh(me.session)) return app.reauth()
+      const email = normalizeEmail((await body()).email)
+      if (!validEmail(email)) return badEmail()
+      if (email === me.user.email) return json({ error: "That's already your email.", code: 'same-email' }, 400)
+      if (!(await users.allowed(email, { method: 'email-change', user: publicUser(me.user) }))) return notAllowed()
+      if (await users.byEmail(email)) return json({ error: 'Another account uses that email.', code: 'email-taken' }, 409)
+      const sent = await codes.start(email, { key: `code-change:${me.user.id}`, kind: 'email-change' })
+      if (!sent.ok) return slowDown(sent.retryAfter)
+      return json({ ok: true })
+    }
+
+    if (route === 'email/change/verify' && method === 'POST') {
+      const me = await app.signedIn(request)
+      if (me instanceof Response) return me
+      const input = await body()
+      const email = normalizeEmail(input.email)
+      if (!validEmail(email)) return badEmail()
+      const result = await codes.verify(email, input.code, { key: `code-change:${me.user.id}` })
+      if (!result.ok) return failed(result)
+      if (await users.byEmail(email)) return json({ error: 'Another account uses that email.', code: 'email-taken' }, 409)
+      const updated = await users.update(me.user.id, { email })
+      await app.emit('userUpdated', { user: publicUser(updated) })
+      return json({ user: publicUser(updated) })
+    }
+  }
+
+  /** Someone who signed up with a password has now proved their email: save the password. */
+  async function finishSignup(found) {
+    const pending = await store.get(`signup:${found.email}`)
+    if (!pending) return
+    await store.delete(`signup:${found.email}`)
+    await store.put(`password:${found.id}`, { hash: pending.hash, updatedAt: Date.now() })
+  }
+}
+
+function linkPage(appName, endpoint) {
+  const name = escapeHtml(appName)
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign in to ${name}</title>
+<style>body{margin:0;min-height:100vh;display:grid;place-items:center;background:#fdf6ec;color:#2b2118;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif}
+main{max-width:360px;margin:16px;background:#fff;border:2px solid #2b2118;border-radius:16px;padding:28px;box-shadow:4px 4px 0 #2b2118;text-align:center}
+button{font:inherit;font-weight:700;font-size:16px;background:#f59e0b;color:#2b2118;border:2px solid #2b2118;border-radius:10px;padding:12px 18px;width:100%;cursor:pointer}
+p{opacity:.8}.error{color:#c2410c;font-weight:600;opacity:1}</style></head>
+<body><main><h1 style="font-size:22px;margin:0 0 8px">Sign in to ${name}</h1><p>You're one tap away.</p>
+<button id="go">Continue</button><p id="msg" class="error" role="alert"></p></main>
+<script>
+const token = new URLSearchParams(location.search).get('token')
+document.getElementById('go').addEventListener('click', async (e) => {
+  e.target.disabled = true
+  const res = await fetch(${JSON.stringify(endpoint)}, { method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ token }) }).catch(() => null)
+  const data = res ? await res.json().catch(() => ({})) : { error: "Couldn't reach the server." }
+  if (res && res.ok) location.replace(data.redirect || '/')
+  else { document.getElementById('msg').textContent = data.error || 'Something went wrong.'; e.target.disabled = false }
+})
+</script></body></html>`
+}