+20

packages/oauth/LICENSE

··· 1 1 + MIT License 2 2 + 3 3 + Copyright (c) 2025 Slices Network 4 4 + 5 5 + Permission is hereby granted, free of charge, to any person obtaining a copy of 6 6 + this software and associated documentation files (the "Software"), to deal in 7 7 + the Software without restriction, including without limitation the rights to 8 8 + use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of 9 9 + the Software, and to permit persons to whom the Software is furnished to do so, 10 10 + subject to the following conditions: 11 11 + 12 12 + The above copyright notice and this permission notice shall be included in all 13 13 + copies or substantial portions of the Software. 14 14 + 15 15 + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 16 + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS 17 17 + FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 18 18 + COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 19 19 + IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 20 20 + CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

+57

packages/oauth/README.md

··· 1 1 + # @slices/oauth 2 2 + 3 3 + [AIP](https://github.com/graze-social/aip) OAuth 2.1 client with PKCE support 4 4 + for Typescript. 5 5 + 6 6 + ## Features 7 7 + 8 8 + - OAuth 2.1 with PKCE flow 9 9 + - Token refresh handling 10 10 + - Pluggable storage backends (SQLite, Deno KV, others can be added) 11 11 + 12 12 + ## Installation 13 13 + 14 14 + ### Deno 15 15 + 16 16 + ```bash 17 17 + deno add jsr:@slices/oauth 18 18 + ``` 19 19 + 20 20 + ```typescript 21 21 + import { OAuthClient, SQLiteOAuthStorage } from "@slices/oauth"; 22 22 + ``` 23 23 + 24 24 + For node based package managers: 25 25 + 26 26 + ```bash 27 27 + # pnpm (10.9+) 28 28 + pnpm install jsr:@slices/oauth 29 29 + 30 30 + # Yarn (4.9+) 31 31 + yarn add jsr:@slices/oauth 32 32 + ``` 33 33 + 34 34 + ## Usage 35 35 + 36 36 + ```typescript 37 37 + import { OAuthClient, SQLiteOAuthStorage } from "@slices/oauth"; 38 38 + 39 39 + // Set up storage 40 40 + const storage = new SQLiteOAuthStorage("oauth.db"); 41 41 + 42 42 + // Create OAuth client 43 43 + const client = new OAuthClient({ 44 44 + clientId: "your-client-id", 45 45 + clientSecret: "your-client-secret", 46 46 + authBaseUrl: "https://auth.example.com", 47 47 + redirectUri: "http://localhost:8000/oauth/callback", 48 48 + scopes: ["atproto:atproto"], 49 49 + }, storage); 50 50 + 51 51 + // Start authorization flow 52 52 + const result = await client.authorize({ loginHint: "user.bsky.social" }); 53 53 + // Redirect user to result.authorizationUrl 54 54 + 55 55 + // Handle callback 56 56 + const tokens = await client.handleCallback({ code, state }); 57 57 + ```

+8

packages/oauth/deno.json

··· 1 1 + { 2 2 + "name": "@slices/oauth", 3 3 + "version": "0.4.1", 4 4 + "exports": "./mod.ts", 5 5 + "tasks": { 6 6 + "test": "deno test" 7 7 + } 8 8 + }

+16

packages/oauth/mod.ts

··· 1 1 + export { OAuthClient } from "./src/client.ts"; 2 2 + export { PKCEUtils } from "./src/pkce.ts"; 3 3 + export { DenoKVOAuthStorage } from "./src/storage/deno-kv.ts"; 4 4 + export { SQLiteOAuthStorage } from "./src/storage/sqlite.ts"; 5 5 + export type { 6 6 + OAuthConfig, 7 7 + OAuthTokens, 8 8 + OAuthAuthorizeParams, 9 9 + OAuthAuthorizeResult, 10 10 + OAuthCallbackParams, 11 11 + OAuthCallbackRequest, 12 12 + OAuthTokenResponse, 13 13 + OAuthStorage, 14 14 + OAuthUserInfo, 15 15 + PKCEChallenge, 16 16 + } from "./src/types.ts";

+308

packages/oauth/src/client.ts

··· 1 1 + import type { 2 2 + OAuthConfig, 3 3 + OAuthTokens, 4 4 + OAuthAuthorizeResult, 5 5 + OAuthTokenResponse, 6 6 + OAuthStorage, 7 7 + OAuthUserInfo, 8 8 + } from "./types.ts"; 9 9 + import { PKCEUtils } from "./pkce.ts"; 10 10 + 11 11 + export class OAuthClient { 12 12 + private config: OAuthConfig; 13 13 + private storage: OAuthStorage; 14 14 + private refreshPromise?: Promise<void>; 15 15 + private forceRefresh = false; // Flag to force refresh regardless of expiry 16 16 + 17 17 + constructor(config: OAuthConfig, storage: OAuthStorage) { 18 18 + this.config = config; 19 19 + this.storage = storage; 20 20 + } 21 21 + 22 22 + async authorize(params: { 23 23 + loginHint: string; 24 24 + state?: string; 25 25 + scope?: string; 26 26 + }): Promise<OAuthAuthorizeResult> { 27 27 + const pkce = await PKCEUtils.generatePKCEChallenge(); 28 28 + const state = params.state || PKCEUtils.generateState(); 29 29 + 30 30 + const parParams = { 31 31 + client_id: this.config.clientId, 32 32 + response_type: "code", 33 33 + redirect_uri: this.config.redirectUri, 34 34 + state, 35 35 + code_challenge: pkce.codeChallenge, 36 36 + code_challenge_method: pkce.codeChallengeMethod, 37 37 + scope: 38 38 + params.scope || 39 39 + this.config.scopes?.join(" ") || 40 40 + "atproto:atproto atproto:transition:generic", 41 41 + login_hint: params.loginHint, 42 42 + }; 43 43 + 44 44 + const parResponse = await this.makeRequest<{ request_uri: string }>( 45 45 + "oauth/par", 46 46 + "POST", 47 47 + parParams, 48 48 + false 49 49 + ); 50 50 + 51 51 + await this.storage.setState(state, pkce.codeVerifier); 52 52 + 53 53 + const authParams = new URLSearchParams({ 54 54 + client_id: this.config.clientId, 55 55 + request_uri: parResponse.request_uri, 56 56 + }); 57 57 + 58 58 + const authorizationUrl = `${ 59 59 + this.config.authBaseUrl 60 60 + }/oauth/authorize?${authParams.toString()}`; 61 61 + 62 62 + return { 63 63 + authorizationUrl, 64 64 + codeVerifier: pkce.codeVerifier, 65 65 + state, 66 66 + }; 67 67 + } 68 68 + 69 69 + async handleCallback(params: { 70 70 + code: string; 71 71 + state: string; 72 72 + }): Promise<OAuthTokens> { 73 73 + // Retrieve the code verifier from storage using the state 74 74 + const codeVerifier = await this.storage.getState(params.state); 75 75 + if (!codeVerifier) { 76 76 + throw new Error("Invalid or expired OAuth state"); 77 77 + } 78 78 + 79 79 + const tokenResponse = await this.makeRequest<OAuthTokenResponse>( 80 80 + "oauth/token", 81 81 + "POST", 82 82 + { 83 83 + grant_type: "authorization_code", 84 84 + code: params.code, 85 85 + redirect_uri: this.config.redirectUri, 86 86 + client_id: this.config.clientId, 87 87 + client_secret: this.config.clientSecret, 88 88 + code_verifier: codeVerifier, 89 89 + }, 90 90 + false 91 91 + ); 92 92 + 93 93 + const tokens = this.transformTokenResponse(tokenResponse); 94 94 + await this.storage.setTokens(tokens); 95 95 + await this.storage.clearState(params.state); 96 96 + 97 97 + return tokens; 98 98 + } 99 99 + 100 100 + async refreshAccessToken(): Promise<OAuthTokens> { 101 101 + const tokens = await this.storage.getTokens(); 102 102 + if (!tokens?.refreshToken) { 103 103 + throw new Error("No refresh token available"); 104 104 + } 105 105 + 106 106 + try { 107 107 + const tokenResponse = await this.makeRequest<OAuthTokenResponse>( 108 108 + "oauth/token", 109 109 + "POST", 110 110 + { 111 111 + grant_type: "refresh_token", 112 112 + refresh_token: tokens.refreshToken, 113 113 + client_id: this.config.clientId, 114 114 + client_secret: this.config.clientSecret, 115 115 + }, 116 116 + false 117 117 + ); 118 118 + 119 119 + const newTokens = this.transformTokenResponse(tokenResponse); 120 120 + await this.storage.setTokens(newTokens); 121 121 + return newTokens; 122 122 + } catch (error) { 123 123 + await this.storage.clearTokens(); 124 124 + throw new Error(`Failed to refresh token: ${error}`); 125 125 + } 126 126 + } 127 127 + 128 128 + async ensureValidToken(): Promise<OAuthTokens> { 129 129 + const tokens = await this.storage.getTokens(); 130 130 + 131 131 + if (!tokens) { 132 132 + throw new Error("No access token available. Please authenticate first."); 133 133 + } 134 134 + 135 135 + // Check if we need to refresh (either expired or force refresh flag is set) 136 136 + if (!this.forceRefresh && !this.isTokenExpired(tokens)) { 137 137 + return tokens; 138 138 + } 139 139 + 140 140 + if (!tokens.refreshToken) { 141 141 + throw new Error( 142 142 + "Access token expired and no refresh token available. Please re-authenticate." 143 143 + ); 144 144 + } 145 145 + 146 146 + if (this.refreshPromise) { 147 147 + await this.refreshPromise; 148 148 + const refreshedTokens = await this.storage.getTokens(); 149 149 + if (!refreshedTokens) { 150 150 + throw new Error("Failed to refresh tokens"); 151 151 + } 152 152 + this.forceRefresh = false; // Reset flag after successful refresh 153 153 + return refreshedTokens; 154 154 + } 155 155 + 156 156 + this.refreshPromise = this.refreshAccessToken().then(() => undefined); 157 157 + try { 158 158 + await this.refreshPromise; 159 159 + const refreshedTokens = await this.storage.getTokens(); 160 160 + if (!refreshedTokens) { 161 161 + throw new Error("Failed to refresh tokens"); 162 162 + } 163 163 + this.forceRefresh = false; // Reset flag after successful refresh 164 164 + return refreshedTokens; 165 165 + } finally { 166 166 + this.refreshPromise = undefined; 167 167 + } 168 168 + } 169 169 + 170 170 + async getUserInfo(): Promise<OAuthUserInfo | null> { 171 171 + const isAuthenticated = await this.isAuthenticated(); 172 172 + if (!isAuthenticated) { 173 173 + return null; 174 174 + } 175 175 + 176 176 + try { 177 177 + const userInfo = await this.makeRequest<OAuthUserInfo>( 178 178 + "oauth/userinfo", 179 179 + "GET", 180 180 + undefined, 181 181 + true 182 182 + ); 183 183 + return userInfo; 184 184 + } catch (error) { 185 185 + console.error("Failed to fetch user info:", error); 186 186 + return null; 187 187 + } 188 188 + } 189 189 + 190 190 + async isAuthenticated(): Promise<boolean> { 191 191 + const tokens = await this.storage.getTokens(); 192 192 + return !!tokens?.accessToken; 193 193 + } 194 194 + 195 195 + async logout(): Promise<void> { 196 196 + await this.storage.clearTokens(); 197 197 + } 198 198 + 199 199 + /** 200 200 + * Marks the current token as invalid, forcing the next ensureValidToken() 201 201 + * call to refresh regardless of expiry time. Use this when the server 202 202 + * rejects a token with 401 Unauthorized. 203 203 + */ 204 204 + invalidateCurrentToken(): void { 205 205 + this.forceRefresh = true; 206 206 + } 207 207 + 208 208 + async getAuthenticationInfo(): Promise<{ 209 209 + isAuthenticated: boolean; 210 210 + expiresAt?: number; 211 211 + scope?: string; 212 212 + }> { 213 213 + const tokens = await this.storage.getTokens(); 214 214 + return { 215 215 + isAuthenticated: !!tokens?.accessToken, 216 216 + expiresAt: tokens?.expiresAt, 217 217 + scope: tokens?.scope, 218 218 + }; 219 219 + } 220 220 + 221 221 + private isTokenExpired(tokens: OAuthTokens): boolean { 222 222 + if (!tokens.expiresAt) return false; 223 223 + return Date.now() >= tokens.expiresAt - 60000; // 60 second buffer 224 224 + } 225 225 + 226 226 + private transformTokenResponse(response: OAuthTokenResponse): OAuthTokens { 227 227 + const tokenType = response.token_type 228 228 + ? response.token_type.charAt(0).toUpperCase() + 229 229 + response.token_type.slice(1).toLowerCase() 230 230 + : "Bearer"; 231 231 + 232 232 + return { 233 233 + accessToken: response.access_token, 234 234 + refreshToken: response.refresh_token, 235 235 + tokenType, 236 236 + scope: response.scope, 237 237 + expiresAt: response.expires_in 238 238 + ? Date.now() + response.expires_in * 1000 239 239 + : undefined, 240 240 + expiresIn: response.expires_in, 241 241 + }; 242 242 + } 243 243 + 244 244 + private async makeRequest<T = unknown>( 245 245 + endpoint: string, 246 246 + method: "GET" | "POST", 247 247 + params?: Record<string, string | undefined>, 248 248 + requiresAuth: boolean = false 249 249 + ): Promise<T> { 250 250 + const url = `${this.config.authBaseUrl}/${endpoint}`; 251 251 + 252 252 + const requestInit: RequestInit = { 253 253 + method, 254 254 + headers: {}, 255 255 + }; 256 256 + 257 257 + if (requiresAuth) { 258 258 + const tokens = await this.ensureValidToken(); 259 259 + (requestInit.headers as Record<string, string>)[ 260 260 + "Authorization" 261 261 + ] = `${tokens.tokenType} ${tokens.accessToken}`; 262 262 + } else if (endpoint === "oauth/par" || endpoint === "oauth/token") { 263 263 + const credentials = btoa( 264 264 + `${this.config.clientId}:${this.config.clientSecret}` 265 265 + ); 266 266 + (requestInit.headers as Record<string, string>)[ 267 267 + "Authorization" 268 268 + ] = `Basic ${credentials}`; 269 269 + } 270 270 + 271 271 + if (method === "GET" && params) { 272 272 + const searchParams = new URLSearchParams(); 273 273 + Object.entries(params).forEach(([key, value]) => { 274 274 + if (value !== undefined && value !== null) { 275 275 + searchParams.append(key, String(value)); 276 276 + } 277 277 + }); 278 278 + const queryString = searchParams.toString(); 279 279 + if (queryString) { 280 280 + const urlWithParams = `${url}?${queryString}`; 281 281 + const response = await fetch(urlWithParams, requestInit); 282 282 + if (!response.ok) { 283 283 + throw new Error( 284 284 + `Request failed: ${response.status} ${response.statusText}` 285 285 + ); 286 286 + } 287 287 + return (await response.json()) as T; 288 288 + } 289 289 + } else if (method === "POST" && params) { 290 290 + (requestInit.headers as Record<string, string>)["Content-Type"] = 291 291 + "application/x-www-form-urlencoded"; 292 292 + requestInit.body = new URLSearchParams(params as Record<string, string>); 293 293 + } 294 294 + 295 295 + const response = await fetch(url, requestInit); 296 296 + if (!response.ok) { 297 297 + throw new Error( 298 298 + `Request failed: ${response.status} ${response.statusText}` 299 299 + ); 300 300 + } 301 301 + 302 302 + return (await response.json()) as T; 303 303 + } 304 304 + 305 305 + async getTokens(): Promise<OAuthTokens | null> { 306 306 + return await this.storage.getTokens(); 307 307 + } 308 308 + }

+43

packages/oauth/src/pkce.ts

··· 1 1 + import type { PKCEChallenge } from "./types.ts"; 2 2 + 3 3 + export class PKCEUtils { 4 4 + static generateCodeVerifier(): string { 5 5 + const array = new Uint8Array(32); 6 6 + crypto.getRandomValues(array); 7 7 + return btoa(String.fromCharCode.apply(null, Array.from(array))) 8 8 + .replace(/\+/g, "-") 9 9 + .replace(/\//g, "_") 10 10 + .replace(/=/g, ""); 11 11 + } 12 12 + 13 13 + static async generateCodeChallenge(verifier: string): Promise<string> { 14 14 + const encoder = new TextEncoder(); 15 15 + const data = encoder.encode(verifier); 16 16 + const digest = await crypto.subtle.digest("SHA-256", data); 17 17 + return btoa( 18 18 + String.fromCharCode.apply(null, Array.from(new Uint8Array(digest))) 19 19 + ) 20 20 + .replace(/\+/g, "-") 21 21 + .replace(/\//g, "_") 22 22 + .replace(/=/g, ""); 23 23 + } 24 24 + 25 25 + static async generatePKCEChallenge(): Promise<PKCEChallenge> { 26 26 + const codeVerifier = this.generateCodeVerifier(); 27 27 + const codeChallenge = await this.generateCodeChallenge(codeVerifier); 28 28 + return { 29 29 + codeVerifier, 30 30 + codeChallenge, 31 31 + codeChallengeMethod: "S256", 32 32 + }; 33 33 + } 34 34 + 35 35 + static generateState(): string { 36 36 + const array = new Uint8Array(16); 37 37 + crypto.getRandomValues(array); 38 38 + return btoa(String.fromCharCode.apply(null, Array.from(array))) 39 39 + .replace(/\+/g, "-") 40 40 + .replace(/\//g, "_") 41 41 + .replace(/=/g, ""); 42 42 + } 43 43 + }

+66

packages/oauth/src/storage/deno-kv.ts

··· 1 1 + import type { OAuthStorage, OAuthTokens } from "../types.ts"; 2 2 + 3 3 + interface OAuthState { 4 4 + codeVerifier: string; 5 5 + timestamp: number; 6 6 + } 7 7 + 8 8 + export class DenoKVOAuthStorage implements OAuthStorage { 9 9 + constructor(private kv: Deno.Kv) {} 10 10 + 11 11 + async getTokens(): Promise<OAuthTokens | null> { 12 12 + const result = await this.kv.get<OAuthTokens>(["oauth_tokens"]); 13 13 + return result.value; 14 14 + } 15 15 + 16 16 + async setTokens(tokens: OAuthTokens): Promise<void> { 17 17 + const expirationMs = 30 * 24 * 60 * 60 * 1000; // 30 days 18 18 + await this.kv.set(["oauth_tokens"], tokens, { expireIn: expirationMs }); 19 19 + } 20 20 + 21 21 + async clearTokens(): Promise<void> { 22 22 + await this.kv.delete(["oauth_tokens"]); 23 23 + } 24 24 + 25 25 + async getState(state: string): Promise<string | null> { 26 26 + const result = await this.kv.get<OAuthState>(["oauth_states", state]); 27 27 + 28 28 + if (!result.value) return null; 29 29 + 30 30 + // Delete after use (one-time use) 31 31 + await this.kv.delete(["oauth_states", state]); 32 32 + 33 33 + return result.value.codeVerifier; 34 34 + } 35 35 + 36 36 + async setState(state: string, codeVerifier: string): Promise<void> { 37 37 + const stateData: OAuthState = { 38 38 + codeVerifier, 39 39 + timestamp: Date.now(), 40 40 + }; 41 41 + 42 42 + // Store with 10 minute expiration 43 43 + await this.kv.set( 44 44 + ["oauth_states", state], 45 45 + stateData, 46 46 + { expireIn: 10 * 60 * 1000 } 47 47 + ); 48 48 + 49 49 + // Auto-cleanup expired states 50 50 + await this.cleanup(); 51 51 + } 52 52 + 53 53 + async clearState(state: string): Promise<void> { 54 54 + await this.kv.delete(["oauth_states", state]); 55 55 + } 56 56 + 57 57 + private async cleanup(): Promise<void> { 58 58 + const cutoff = Date.now() - (10 * 60 * 1000); // 10 minutes ago 59 59 + 60 60 + for await (const entry of this.kv.list<OAuthState>({ prefix: ["oauth_states"] })) { 61 61 + if (entry.value.timestamp < cutoff) { 62 62 + await this.kv.delete(entry.key); 63 63 + } 64 64 + } 65 65 + } 66 66 + }

+134

packages/oauth/src/storage/sqlite.ts

··· 1 1 + import { DatabaseSync } from "node:sqlite"; 2 2 + import type { OAuthStorage, OAuthTokens } from "../types.ts"; 3 3 + 4 4 + export class SQLiteOAuthStorage implements OAuthStorage { 5 5 + private db: DatabaseSync; 6 6 + 7 7 + constructor(dbPath: string = ":memory:") { 8 8 + this.db = new DatabaseSync(dbPath); 9 9 + this.initTables(); 10 10 + } 11 11 + 12 12 + private initTables(): void { 13 13 + // Create tokens table 14 14 + this.db.exec(` 15 15 + CREATE TABLE IF NOT EXISTS oauth_tokens ( 16 16 + id INTEGER PRIMARY KEY, 17 17 + access_token TEXT NOT NULL, 18 18 + token_type TEXT NOT NULL, 19 19 + expires_at INTEGER, 20 20 + refresh_token TEXT, 21 21 + scope TEXT, 22 22 + created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000) 23 23 + ) 24 24 + `); 25 25 + 26 26 + // Create states table with automatic cleanup 27 27 + this.db.exec(` 28 28 + CREATE TABLE IF NOT EXISTS oauth_states ( 29 29 + state TEXT PRIMARY KEY, 30 30 + code_verifier TEXT NOT NULL, 31 31 + timestamp INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000) 32 32 + ) 33 33 + `); 34 34 + 35 35 + // Create index for cleanup efficiency 36 36 + this.db.exec(` 37 37 + CREATE INDEX IF NOT EXISTS idx_oauth_states_timestamp ON oauth_states(timestamp) 38 38 + `); 39 39 + } 40 40 + 41 41 + getTokens(): Promise<OAuthTokens | null> { 42 42 + const stmt = this.db.prepare(` 43 43 + SELECT access_token, token_type, expires_at, refresh_token, scope 44 44 + FROM oauth_tokens 45 45 + ORDER BY created_at DESC 46 46 + LIMIT 1 47 47 + `); 48 48 + 49 49 + const row = stmt.get() as { 50 50 + access_token: string; 51 51 + token_type: string; 52 52 + expires_at?: number; 53 53 + refresh_token?: string; 54 54 + scope?: string; 55 55 + } | undefined; 56 56 + if (!row) return Promise.resolve(null); 57 57 + 58 58 + return Promise.resolve({ 59 59 + accessToken: row.access_token, 60 60 + tokenType: row.token_type, 61 61 + expiresAt: row.expires_at, 62 62 + refreshToken: row.refresh_token, 63 63 + scope: row.scope, 64 64 + }); 65 65 + } 66 66 + 67 67 + async setTokens(tokens: OAuthTokens): Promise<void> { 68 68 + // Clear existing tokens first 69 69 + await this.clearTokens(); 70 70 + 71 71 + const stmt = this.db.prepare(` 72 72 + INSERT INTO oauth_tokens (access_token, token_type, expires_at, refresh_token, scope) 73 73 + VALUES (?, ?, ?, ?, ?) 74 74 + `); 75 75 + 76 76 + stmt.run( 77 77 + tokens.accessToken, 78 78 + tokens.tokenType, 79 79 + tokens.expiresAt || null, 80 80 + tokens.refreshToken || null, 81 81 + tokens.scope || null 82 82 + ); 83 83 + } 84 84 + 85 85 + clearTokens(): Promise<void> { 86 86 + const stmt = this.db.prepare("DELETE FROM oauth_tokens"); 87 87 + stmt.run(); 88 88 + return Promise.resolve(); 89 89 + } 90 90 + 91 91 + async getState(state: string): Promise<string | null> { 92 92 + const stmt = this.db.prepare(` 93 93 + SELECT code_verifier FROM oauth_states WHERE state = ? 94 94 + `); 95 95 + 96 96 + const row = stmt.get(state) as { code_verifier: string } | undefined; 97 97 + if (!row) return null; 98 98 + 99 99 + // Delete after use (one-time use) 100 100 + await this.clearState(state); 101 101 + 102 102 + return row.code_verifier; 103 103 + } 104 104 + 105 105 + setState(state: string, codeVerifier: string): Promise<void> { 106 106 + const stmt = this.db.prepare(` 107 107 + INSERT OR REPLACE INTO oauth_states (state, code_verifier, timestamp) 108 108 + VALUES (?, ?, ?) 109 109 + `); 110 110 + 111 111 + stmt.run(state, codeVerifier, Date.now()); 112 112 + 113 113 + // Auto-cleanup expired states 114 114 + this.cleanup(); 115 115 + 116 116 + return Promise.resolve(); 117 117 + } 118 118 + 119 119 + clearState(state: string): Promise<void> { 120 120 + const stmt = this.db.prepare("DELETE FROM oauth_states WHERE state = ?"); 121 121 + stmt.run(state); 122 122 + return Promise.resolve(); 123 123 + } 124 124 + 125 125 + private cleanup(): void { 126 126 + const cutoff = Date.now() - (10 * 60 * 1000); // 10 minutes ago 127 127 + const stmt = this.db.prepare("DELETE FROM oauth_states WHERE timestamp < ?"); 128 128 + stmt.run(cutoff); 129 129 + } 130 130 + 131 131 + close(): void { 132 132 + this.db.close(); 133 133 + } 134 134 + }

+74

packages/oauth/src/types.ts

··· 1 1 + export interface OAuthConfig { 2 2 + clientId: string; 3 3 + clientSecret: string; 4 4 + authBaseUrl: string; 5 5 + redirectUri: string; 6 6 + scopes?: string[]; 7 7 + } 8 8 + 9 9 + export interface OAuthTokens { 10 10 + accessToken: string; 11 11 + refreshToken?: string; 12 12 + tokenType: string; 13 13 + expiresIn?: number; 14 14 + expiresAt?: number; 15 15 + scope?: string; 16 16 + } 17 17 + 18 18 + export interface OAuthAuthorizeParams { 19 19 + loginHint: string; 20 20 + redirectUri: string; 21 21 + scope?: string; 22 22 + state?: string; 23 23 + } 24 24 + 25 25 + export interface OAuthAuthorizeResult { 26 26 + authorizationUrl: string; 27 27 + codeVerifier: string; 28 28 + state: string; 29 29 + } 30 30 + 31 31 + export interface OAuthCallbackParams { 32 32 + code: string; 33 33 + state: string; 34 34 + codeVerifier: string; 35 35 + redirectUri: string; 36 36 + } 37 37 + 38 38 + export interface OAuthCallbackRequest { 39 39 + code: string; 40 40 + state: string; 41 41 + redirectUri: string; 42 42 + } 43 43 + 44 44 + export interface OAuthTokenResponse { 45 45 + access_token: string; 46 46 + token_type: string; 47 47 + expires_in?: number; 48 48 + refresh_token?: string; 49 49 + scope?: string; 50 50 + } 51 51 + 52 52 + export interface PKCEChallenge { 53 53 + codeVerifier: string; 54 54 + codeChallenge: string; 55 55 + codeChallengeMethod: "S256"; 56 56 + } 57 57 + 58 58 + export interface OAuthStorage { 59 59 + getTokens(): Promise<OAuthTokens | null>; 60 60 + setTokens(tokens: OAuthTokens): Promise<void>; 61 61 + clearTokens(): Promise<void>; 62 62 + 63 63 + getState(state: string): Promise<string | null>; 64 64 + setState(state: string, codeVerifier: string): Promise<void>; 65 65 + clearState(state: string): Promise<void>; 66 66 + } 67 67 + 68 68 + export interface OAuthUserInfo { 69 69 + sub: string; 70 70 + did: string; 71 71 + name?: string; 72 72 + profile?: string; 73 73 + pds_endpoint?: string; 74 74 + }

+1

packages/session/.gitignore

··· 1 1 + node_modules

+20

packages/session/LICENSE

··· 1 1 + MIT License 2 2 + 3 3 + Copyright (c) 2025 Slices Network 4 4 + 5 5 + Permission is hereby granted, free of charge, to any person obtaining a copy of 6 6 + this software and associated documentation files (the "Software"), to deal in 7 7 + the Software without restriction, including without limitation the rights to 8 8 + use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of 9 9 + the Software, and to permit persons to whom the Software is furnished to do so, 10 10 + subject to the following conditions: 11 11 + 12 12 + The above copyright notice and this permission notice shall be included in all 13 13 + copies or substantial portions of the Software. 14 14 + 15 15 + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 16 + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS 17 17 + FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 18 18 + COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 19 19 + IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 20 20 + CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

+217

packages/session/README.md

··· 1 1 + # @slices/session 2 2 + 3 3 + Session management for Slice applications with OAuth integration. 4 4 + 5 5 + ## Features 6 6 + 7 7 + - **Multiple Storage Adapters**: Memory, SQLite, PostgreSQL 8 8 + - **OAuth Integration**: Works seamlessly with `@slices/oauth` 9 9 + - **Automatic Token Refresh**: Keeps OAuth tokens valid 10 10 + - **Secure Cookie Handling**: HttpOnly, Secure, SameSite defaults 11 11 + - **Automatic Cleanup**: Expired session cleanup 12 12 + - **Framework Agnostic**: Works with any Deno web framework 13 13 + 14 14 + ## Installation 15 15 + 16 16 + ```bash 17 17 + deno add @slices/session 18 18 + ``` 19 19 + 20 20 + ## Quick Start 21 21 + 22 22 + ### Basic Usage 23 23 + 24 24 + ```typescript 25 25 + import { SessionStore, SQLiteAdapter } from "@slices/session"; 26 26 + 27 27 + const sessionStore = new SessionStore({ 28 28 + adapter: new SQLiteAdapter("./sessions.db"), 29 29 + cookieOptions: { 30 30 + httpOnly: true, 31 31 + secure: true, 32 32 + sameSite: "lax" 33 33 + } 34 34 + }); 35 35 + 36 36 + // Create a session 37 37 + const sessionId = await sessionStore.createSession("user123", "alice.bsky.social"); 38 38 + 39 39 + // Get session from request 40 40 + const session = await sessionStore.getSessionFromRequest(request); 41 41 + if (session) { 42 42 + console.log("User:", session.handle); 43 43 + } 44 44 + ``` 45 45 + 46 46 + ### With OAuth Integration 47 47 + 48 48 + ```typescript 49 49 + import { SessionStore, SQLiteAdapter, withOAuthSession } from "@slices/session"; 50 50 + import { OAuthClient } from "@slices/oauth"; 51 51 + 52 52 + const sessionStore = new SessionStore({ 53 53 + adapter: new SQLiteAdapter("./sessions.db") 54 54 + }); 55 55 + 56 56 + const oauthClient = new OAuthClient({ 57 57 + clientId: "your-client-id", 58 58 + clientSecret: "your-client-secret", 59 59 + authBaseUrl: "https://auth.example.com" 60 60 + }); 61 61 + 62 62 + const oauthSessions = withOAuthSession(sessionStore, oauthClient); 63 63 + 64 64 + // Create OAuth session 65 65 + const sessionId = await oauthSessions.createOAuthSession(request); 66 66 + 67 67 + // Get session with auto token refresh 68 68 + const session = await oauthSessions.getOAuthSession(sessionId); 69 69 + ``` 70 70 + 71 71 + ### Storage Adapters 72 72 + 73 73 + #### Memory Adapter (Development) 74 74 + 75 75 + ```typescript 76 76 + import { MemoryAdapter } from "@slices/session"; 77 77 + 78 78 + const adapter = new MemoryAdapter(); 79 79 + ``` 80 80 + 81 81 + #### SQLite Adapter (Production Single Instance) 82 82 + 83 83 + ```typescript 84 84 + import { SQLiteAdapter } from "@slices/session"; 85 85 + 86 86 + const adapter = new SQLiteAdapter("./sessions.db"); 87 87 + // or with URL 88 88 + const adapter = new SQLiteAdapter("sqlite://./sessions.db"); 89 89 + ``` 90 90 + 91 91 + #### PostgreSQL Adapter (Production Distributed) 92 92 + 93 93 + ```typescript 94 94 + import { PostgresAdapter } from "@slices/session"; 95 95 + 96 96 + const adapter = new PostgresAdapter("postgresql://user:pass@localhost/db"); 97 97 + 98 98 + // Initialize the database table 99 99 + await adapter.initialize(); 100 100 + ``` 101 101 + 102 102 + ## API Reference 103 103 + 104 104 + ### SessionStore 105 105 + 106 106 + Main session management class. 107 107 + 108 108 + ```typescript 109 109 + const store = new SessionStore({ 110 110 + adapter: SessionAdapter, 111 111 + cookieName?: string, // Default: "slice-session" 112 112 + cookieOptions?: CookieOptions, 113 113 + sessionTTL?: number, // Default: 30 days (ms) 114 114 + cleanupInterval?: number, // Default: 1 hour (ms) 115 115 + generateId?: () => string // Default: crypto.randomUUID() 116 116 + }); 117 117 + ``` 118 118 + 119 119 + #### Methods 120 120 + 121 121 + - `createSession(userId, handle?, data?)` - Create new session 122 122 + - `getSession(sessionId)` - Get session by ID 123 123 + - `updateSession(sessionId, updates)` - Update session data 124 124 + - `deleteSession(sessionId)` - Delete session 125 125 + - `getSessionFromRequest(request)` - Extract session from HTTP request 126 126 + - `getCurrentUser(request)` - Get user info from request 127 127 + - `createSessionCookie(sessionId)` - Create Set-Cookie header 128 128 + - `createLogoutCookie()` - Create logout cookie header 129 129 + - `cleanup()` - Remove expired sessions 130 130 + 131 131 + ### OAuthSessionManager 132 132 + 133 133 + OAuth-enabled session management. 134 134 + 135 135 + ```typescript 136 136 + const manager = withOAuthSession(sessionStore, oauthClient, { 137 137 + autoRefresh: true, // Auto-refresh expired tokens 138 138 + onTokenRefresh: async (sessionId, tokens) => { 139 139 + // Handle token refresh 140 140 + }, 141 141 + onLogout: async (sessionId) => { 142 142 + // Handle logout 143 143 + } 144 144 + }); 145 145 + ``` 146 146 + 147 147 + #### Methods 148 148 + 149 149 + - `createOAuthSession(request)` - Create session with OAuth tokens 150 150 + - `getOAuthSession(sessionId)` - Get session with token refresh 151 151 + - `logout(sessionId)` - OAuth logout and session cleanup 152 152 + - `hasValidOAuthTokens(sessionId)` - Check token validity 153 153 + - `getAccessToken(sessionId)` - Get access token for API calls 154 154 + 155 155 + ### Session Data Structure 156 156 + 157 157 + ```typescript 158 158 + interface SessionData { 159 159 + sessionId: string; 160 160 + userId: string; // User's DID or ID 161 161 + handle?: string; // User's handle (e.g., alice.bsky.social) 162 162 + isAuthenticated: boolean; 163 163 + data?: Record<string, unknown>; // Custom session data 164 164 + createdAt: number; // Timestamp 165 165 + expiresAt: number; // Timestamp 166 166 + lastAccessedAt: number; // Timestamp 167 167 + } 168 168 + ``` 169 169 + 170 170 + ## Framework Integration 171 171 + 172 172 + ### Deno Fresh 173 173 + 174 174 + ```typescript 175 175 + // routes/_middleware.ts 176 176 + import { SessionStore, SQLiteAdapter } from "@slices/session"; 177 177 + 178 178 + const sessionStore = new SessionStore({ 179 179 + adapter: new SQLiteAdapter("./sessions.db") 180 180 + }); 181 181 + 182 182 + export async function handler(req: Request, ctx: FreshContext) { 183 183 + const user = await sessionStore.getCurrentUser(req); 184 184 + ctx.state.user = user; 185 185 + return ctx.next(); 186 186 + } 187 187 + ``` 188 188 + 189 189 + ### Hono 190 190 + 191 191 + ```typescript 192 192 + import { Hono } from "hono"; 193 193 + import { SessionStore, SQLiteAdapter } from "@slices/session"; 194 194 + 195 195 + const app = new Hono(); 196 196 + const sessionStore = new SessionStore({ 197 197 + adapter: new SQLiteAdapter("./sessions.db") 198 198 + }); 199 199 + 200 200 + app.use("*", async (c, next) => { 201 201 + const user = await sessionStore.getCurrentUser(c.req.raw); 202 202 + c.set("user", user); 203 203 + await next(); 204 204 + }); 205 205 + ``` 206 206 + 207 207 + ## Security 208 208 + 209 209 + - Sessions are stored with secure, httpOnly cookies by default 210 210 + - Automatic cleanup of expired sessions 211 211 + - CSRF protection through SameSite cookies 212 212 + - Secure session ID generation using crypto.randomUUID() 213 213 + - Optional token refresh to keep OAuth sessions valid 214 214 + 215 215 + ## License 216 216 + 217 217 + MIT

+14

packages/session/deno.json

··· 1 1 + { 2 2 + "name": "@slices/session", 3 3 + "version": "0.2.1", 4 4 + "exports": "./mod.ts", 5 5 + "tasks": { 6 6 + "test": "deno test", 7 7 + "check": "deno check mod.ts" 8 8 + }, 9 9 + "imports": { 10 10 + "@slices/oauth": "jsr:@slices/oauth@^0.4.1", 11 11 + "pg": "npm:pg@^8.16.3" 12 12 + }, 13 13 + "nodeModulesDir": "auto" 14 14 + }

+99

packages/session/deno.lock

··· 1 1 + { 2 2 + "version": "5", 3 3 + "specifiers": { 4 4 + "jsr:@slices/oauth@~0.3.2": "0.3.2", 5 5 + "npm:@types/node@*": "22.15.15", 6 6 + "npm:pg@^8.11.0": "8.16.3", 7 7 + "npm:pg@^8.16.3": "8.16.3" 8 8 + }, 9 9 + "jsr": { 10 10 + "@slices/oauth@0.3.2": { 11 11 + "integrity": "51feaa6be538a61a3278ee7f1d264ed937187d09da2be1f0a2a837128df82526" 12 12 + } 13 13 + }, 14 14 + "npm": { 15 15 + "@types/node@22.15.15": { 16 16 + "integrity": "sha512-R5muMcZob3/Jjchn5LcO8jdKwSCbzqmPB6ruBxMcf9kbxtniZHP327s6C37iOfuw8mbKK3cAQa7sEl7afLrQ8A==", 17 17 + "dependencies": [ 18 18 + "undici-types" 19 19 + ] 20 20 + }, 21 21 + "pg-cloudflare@1.2.7": { 22 22 + "integrity": "sha512-YgCtzMH0ptvZJslLM1ffsY4EuGaU0cx4XSdXLRFae8bPP4dS5xL1tNB3k2o/N64cHJpwU7dxKli/nZ2lUa5fLg==" 23 23 + }, 24 24 + "pg-connection-string@2.9.1": { 25 25 + "integrity": "sha512-nkc6NpDcvPVpZXxrreI/FOtX3XemeLl8E0qFr6F2Lrm/I8WOnaWNhIPK2Z7OHpw7gh5XJThi6j6ppgNoaT1w4w==" 26 26 + }, 27 27 + "pg-int8@1.0.1": { 28 28 + "integrity": "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==" 29 29 + }, 30 30 + "pg-pool@3.10.1_pg@8.16.3": { 31 31 + "integrity": "sha512-Tu8jMlcX+9d8+QVzKIvM/uJtp07PKr82IUOYEphaWcoBhIYkoHpLXN3qO59nAI11ripznDsEzEv8nUxBVWajGg==", 32 32 + "dependencies": [ 33 33 + "pg" 34 34 + ] 35 35 + }, 36 36 + "pg-protocol@1.10.3": { 37 37 + "integrity": "sha512-6DIBgBQaTKDJyxnXaLiLR8wBpQQcGWuAESkRBX/t6OwA8YsqP+iVSiond2EDy6Y/dsGk8rh/jtax3js5NeV7JQ==" 38 38 + }, 39 39 + "pg-types@2.2.0": { 40 40 + "integrity": "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==", 41 41 + "dependencies": [ 42 42 + "pg-int8", 43 43 + "postgres-array", 44 44 + "postgres-bytea", 45 45 + "postgres-date", 46 46 + "postgres-interval" 47 47 + ] 48 48 + }, 49 49 + "pg@8.16.3": { 50 50 + "integrity": "sha512-enxc1h0jA/aq5oSDMvqyW3q89ra6XIIDZgCX9vkMrnz5DFTw/Ny3Li2lFQ+pt3L6MCgm/5o2o8HW9hiJji+xvw==", 51 51 + "dependencies": [ 52 52 + "pg-connection-string", 53 53 + "pg-pool", 54 54 + "pg-protocol", 55 55 + "pg-types", 56 56 + "pgpass" 57 57 + ], 58 58 + "optionalDependencies": [ 59 59 + "pg-cloudflare" 60 60 + ] 61 61 + }, 62 62 + "pgpass@1.0.5": { 63 63 + "integrity": "sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug==", 64 64 + "dependencies": [ 65 65 + "split2" 66 66 + ] 67 67 + }, 68 68 + "postgres-array@2.0.0": { 69 69 + "integrity": "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==" 70 70 + }, 71 71 + "postgres-bytea@1.0.0": { 72 72 + "integrity": "sha512-xy3pmLuQqRBZBXDULy7KbaitYqLcmxigw14Q5sj8QBVLqEwXfeybIKVWiqAXTlcvdvb0+xkOtDbfQMOf4lST1w==" 73 73 + }, 74 74 + "postgres-date@1.0.7": { 75 75 + "integrity": "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==" 76 76 + }, 77 77 + "postgres-interval@1.2.0": { 78 78 + "integrity": "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==", 79 79 + "dependencies": [ 80 80 + "xtend" 81 81 + ] 82 82 + }, 83 83 + "split2@4.2.0": { 84 84 + "integrity": "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==" 85 85 + }, 86 86 + "undici-types@6.21.0": { 87 87 + "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==" 88 88 + }, 89 89 + "xtend@4.0.2": { 90 90 + "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==" 91 91 + } 92 92 + }, 93 93 + "workspace": { 94 94 + "dependencies": [ 95 95 + "jsr:@slices/oauth@~0.3.2", 96 96 + "npm:pg@^8.16.3" 97 97 + ] 98 98 + } 99 99 + }

+14

packages/session/mod.ts

··· 1 1 + export { SessionStore } from "./src/store.ts"; 2 2 + export { MemoryAdapter } from "./src/adapters/memory.ts"; 3 3 + export { SQLiteAdapter } from "./src/adapters/sqlite.ts"; 4 4 + export { PostgresAdapter } from "./src/adapters/postgres.ts"; 5 5 + export { DenoKVAdapter } from "./src/adapters/deno-kv.ts"; 6 6 + export { withOAuthSession } from "./src/oauth-integration.ts"; 7 7 + export { parseCookie, serializeCookie } from "./src/cookie.ts"; 8 8 + export type { 9 9 + SessionData, 10 10 + SessionOptions, 11 11 + SessionAdapter, 12 12 + CookieOptions, 13 13 + SessionUser, 14 14 + } from "./src/types.ts";

+98

packages/session/src/adapters/deno-kv.ts

··· 1 1 + import type { SessionAdapter, SessionData } from "../types.ts"; 2 2 + 3 3 + export class DenoKVAdapter implements SessionAdapter { 4 4 + private kv: Deno.Kv; 5 5 + private keyPrefix: string; 6 6 + 7 7 + constructor(kv: Deno.Kv, keyPrefix = "sessions") { 8 8 + this.kv = kv; 9 9 + this.keyPrefix = keyPrefix; 10 10 + } 11 11 + 12 12 + static async create(path?: string, keyPrefix = "sessions"): Promise<DenoKVAdapter> { 13 13 + const kv = await Deno.openKv(path); 14 14 + return new DenoKVAdapter(kv, keyPrefix); 15 15 + } 16 16 + 17 17 + private getKey(sessionId: string): string[] { 18 18 + return [this.keyPrefix, sessionId]; 19 19 + } 20 20 + 21 21 + async get(sessionId: string): Promise<SessionData | null> { 22 22 + const result = await this.kv.get<SessionData>(this.getKey(sessionId)); 23 23 + return result.value; 24 24 + } 25 25 + 26 26 + async set(sessionId: string, data: SessionData): Promise<void> { 27 27 + await this.kv.set(this.getKey(sessionId), data); 28 28 + } 29 29 + 30 30 + async update(sessionId: string, updates: Partial<SessionData>): Promise<boolean> { 31 31 + const existing = await this.get(sessionId); 32 32 + if (!existing) return false; 33 33 + 34 34 + const updated = { ...existing, ...updates }; 35 35 + await this.set(sessionId, updated); 36 36 + return true; 37 37 + } 38 38 + 39 39 + async delete(sessionId: string): Promise<void> { 40 40 + await this.kv.delete(this.getKey(sessionId)); 41 41 + } 42 42 + 43 43 + async cleanup(expiresBeforeMs: number): Promise<number> { 44 44 + let cleanedCount = 0; 45 45 + 46 46 + const iter = this.kv.list<SessionData>({ prefix: [this.keyPrefix] }); 47 47 + 48 48 + for await (const entry of iter) { 49 49 + if (entry.value && entry.value.expiresAt < expiresBeforeMs) { 50 50 + await this.kv.delete(entry.key); 51 51 + cleanedCount++; 52 52 + } 53 53 + } 54 54 + 55 55 + return cleanedCount; 56 56 + } 57 57 + 58 58 + async exists(sessionId: string): Promise<boolean> { 59 59 + const result = await this.kv.get(this.getKey(sessionId)); 60 60 + return result.value !== null; 61 61 + } 62 62 + 63 63 + close(): void { 64 64 + this.kv.close(); 65 65 + } 66 66 + 67 67 + async getSessionsByUser(userId: string): Promise<SessionData[]> { 68 68 + const sessions: SessionData[] = []; 69 69 + const iter = this.kv.list<SessionData>({ prefix: [this.keyPrefix] }); 70 70 + 71 71 + for await (const entry of iter) { 72 72 + if (entry.value && entry.value.userId === userId) { 73 73 + sessions.push(entry.value); 74 74 + } 75 75 + } 76 76 + 77 77 + return sessions; 78 78 + } 79 79 + 80 80 + async clear(): Promise<void> { 81 81 + const iter = this.kv.list({ prefix: [this.keyPrefix] }); 82 82 + 83 83 + for await (const entry of iter) { 84 84 + await this.kv.delete(entry.key); 85 85 + } 86 86 + } 87 87 + 88 88 + async count(): Promise<number> { 89 89 + let count = 0; 90 90 + const iter = this.kv.list({ prefix: [this.keyPrefix] }); 91 91 + 92 92 + for await (const _entry of iter) { 93 93 + count++; 94 94 + } 95 95 + 96 96 + return count; 97 97 + } 98 98 + }

+57

packages/session/src/adapters/memory.ts

··· 1 1 + import type { SessionAdapter, SessionData } from "../types.ts"; 2 2 + 3 3 + export class MemoryAdapter implements SessionAdapter { 4 4 + private sessions = new Map<string, SessionData>(); 5 5 + 6 6 + get(sessionId: string): Promise<SessionData | null> { 7 7 + return Promise.resolve(this.sessions.get(sessionId) ?? null); 8 8 + } 9 9 + 10 10 + set(sessionId: string, data: SessionData): Promise<void> { 11 11 + this.sessions.set(sessionId, data); 12 12 + return Promise.resolve(); 13 13 + } 14 14 + 15 15 + update(sessionId: string, updates: Partial<SessionData>): Promise<boolean> { 16 16 + const existing = this.sessions.get(sessionId); 17 17 + if (!existing) return Promise.resolve(false); 18 18 + 19 19 + this.sessions.set(sessionId, { ...existing, ...updates }); 20 20 + return Promise.resolve(true); 21 21 + } 22 22 + 23 23 + delete(sessionId: string): Promise<void> { 24 24 + this.sessions.delete(sessionId); 25 25 + return Promise.resolve(); 26 26 + } 27 27 + 28 28 + cleanup(expiresBeforeMs: number): Promise<number> { 29 29 + let cleanedCount = 0; 30 30 + 31 31 + for (const [sessionId, data] of this.sessions.entries()) { 32 32 + if (data.expiresAt < expiresBeforeMs) { 33 33 + this.sessions.delete(sessionId); 34 34 + cleanedCount++; 35 35 + } 36 36 + } 37 37 + 38 38 + return Promise.resolve(cleanedCount); 39 39 + } 40 40 + 41 41 + exists(sessionId: string): Promise<boolean> { 42 42 + return Promise.resolve(this.sessions.has(sessionId)); 43 43 + } 44 44 + 45 45 + // Memory-specific methods 46 46 + clear(): void { 47 47 + this.sessions.clear(); 48 48 + } 49 49 + 50 50 + size(): number { 51 51 + return this.sessions.size; 52 52 + } 53 53 + 54 54 + keys(): string[] { 55 55 + return Array.from(this.sessions.keys()); 56 56 + } 57 57 + }

+266

packages/session/src/adapters/postgres.ts

··· 1 1 + import type { SessionAdapter, SessionData } from "../types.ts"; 2 2 + import { Client } from "pg"; 3 3 + 4 4 + interface SessionTable { 5 5 + session_id: string; 6 6 + user_id: string; 7 7 + handle: string | null; 8 8 + is_authenticated: boolean; 9 9 + data: string | null; 10 10 + created_at: Date; 11 11 + expires_at: Date; 12 12 + last_accessed_at: Date; 13 13 + } 14 14 + 15 15 + export class PostgresAdapter implements SessionAdapter { 16 16 + private connectionString: string; 17 17 + 18 18 + constructor(connectionString: string) { 19 19 + this.connectionString = connectionString; 20 20 + } 21 21 + 22 22 + // Initialize the sessions table 23 23 + async initialize(): Promise<void> { 24 24 + const client = new Client({ connectionString: this.connectionString }); 25 25 + 26 26 + try { 27 27 + await client.connect(); 28 28 + 29 29 + await client.query(` 30 30 + CREATE TABLE IF NOT EXISTS sessions ( 31 31 + session_id TEXT PRIMARY KEY, 32 32 + user_id TEXT NOT NULL, 33 33 + handle TEXT, 34 34 + is_authenticated BOOLEAN NOT NULL DEFAULT true, 35 35 + data JSONB, 36 36 + created_at BIGINT NOT NULL, 37 37 + expires_at BIGINT NOT NULL, 38 38 + last_accessed_at BIGINT NOT NULL 39 39 + ) 40 40 + `); 41 41 + 42 42 + // Index for cleanup operations 43 43 + await client.query(` 44 44 + CREATE INDEX IF NOT EXISTS idx_sessions_expires_at 45 45 + ON sessions(expires_at) 46 46 + `); 47 47 + 48 48 + // Index for user lookups 49 49 + await client.query(` 50 50 + CREATE INDEX IF NOT EXISTS idx_sessions_user_id 51 51 + ON sessions(user_id) 52 52 + `); 53 53 + } finally { 54 54 + await client.end(); 55 55 + } 56 56 + } 57 57 + 58 58 + async get(sessionId: string): Promise<SessionData | null> { 59 59 + const client = new Client({ connectionString: this.connectionString }); 60 60 + 61 61 + try { 62 62 + await client.connect(); 63 63 + 64 64 + const result = await client.query( 65 65 + "SELECT * FROM sessions WHERE session_id = $1", 66 66 + [sessionId] 67 67 + ); 68 68 + 69 69 + if (result.rows.length === 0) return null; 70 70 + 71 71 + return this.rowToSessionData(result.rows[0]); 72 72 + } finally { 73 73 + await client.end(); 74 74 + } 75 75 + } 76 76 + 77 77 + async set(sessionId: string, data: SessionData): Promise<void> { 78 78 + const client = new Client({ connectionString: this.connectionString }); 79 79 + 80 80 + try { 81 81 + await client.connect(); 82 82 + 83 83 + await client.query( 84 84 + ` 85 85 + INSERT INTO sessions 86 86 + (session_id, user_id, handle, is_authenticated, data, created_at, expires_at, last_accessed_at) 87 87 + VALUES ($1, $2, $3, $4, $5, $6, $7, $8) 88 88 + ON CONFLICT (session_id) 89 89 + DO UPDATE SET 90 90 + user_id = $2, 91 91 + handle = $3, 92 92 + is_authenticated = $4, 93 93 + data = $5, 94 94 + created_at = $6, 95 95 + expires_at = $7, 96 96 + last_accessed_at = $8 97 97 + `, 98 98 + [ 99 99 + sessionId, 100 100 + data.userId, 101 101 + data.handle || null, 102 102 + data.isAuthenticated, 103 103 + data.data ? JSON.stringify(data.data) : null, 104 104 + data.createdAt, 105 105 + data.expiresAt, 106 106 + data.lastAccessedAt, 107 107 + ] 108 108 + ); 109 109 + } finally { 110 110 + await client.end(); 111 111 + } 112 112 + } 113 113 + 114 114 + async update( 115 115 + sessionId: string, 116 116 + updates: Partial<SessionData> 117 117 + ): Promise<boolean> { 118 118 + const setParts: string[] = []; 119 119 + const values: (string | number | boolean | null)[] = []; 120 120 + let paramIndex = 1; 121 121 + 122 122 + if (updates.userId !== undefined) { 123 123 + setParts.push(`user_id = $${paramIndex++}`); 124 124 + values.push(updates.userId); 125 125 + } 126 126 + 127 127 + if (updates.handle !== undefined) { 128 128 + setParts.push(`handle = $${paramIndex++}`); 129 129 + values.push(updates.handle); 130 130 + } 131 131 + 132 132 + if (updates.isAuthenticated !== undefined) { 133 133 + setParts.push(`is_authenticated = $${paramIndex++}`); 134 134 + values.push(updates.isAuthenticated); 135 135 + } 136 136 + 137 137 + if (updates.data !== undefined) { 138 138 + setParts.push(`data = $${paramIndex++}`); 139 139 + values.push(updates.data ? JSON.stringify(updates.data) : null); 140 140 + } 141 141 + 142 142 + if (updates.expiresAt !== undefined) { 143 143 + setParts.push(`expires_at = $${paramIndex++}`); 144 144 + values.push(updates.expiresAt); 145 145 + } 146 146 + 147 147 + if (updates.lastAccessedAt !== undefined) { 148 148 + setParts.push(`last_accessed_at = $${paramIndex++}`); 149 149 + values.push(updates.lastAccessedAt); 150 150 + } 151 151 + 152 152 + if (setParts.length === 0) return false; 153 153 + 154 154 + values.push(sessionId); 155 155 + 156 156 + const client = new Client({ connectionString: this.connectionString }); 157 157 + 158 158 + try { 159 159 + await client.connect(); 160 160 + 161 161 + const result = await client.query( 162 162 + ` 163 163 + UPDATE sessions 164 164 + SET ${setParts.join(", ")} 165 165 + WHERE session_id = $${paramIndex} 166 166 + `, 167 167 + values 168 168 + ); 169 169 + 170 170 + return result.rowCount !== null && result.rowCount > 0; 171 171 + } finally { 172 172 + await client.end(); 173 173 + } 174 174 + } 175 175 + 176 176 + async delete(sessionId: string): Promise<void> { 177 177 + const client = new Client({ connectionString: this.connectionString }); 178 178 + 179 179 + try { 180 180 + await client.connect(); 181 181 + await client.query("DELETE FROM sessions WHERE session_id = $1", [ 182 182 + sessionId, 183 183 + ]); 184 184 + } finally { 185 185 + await client.end(); 186 186 + } 187 187 + } 188 188 + 189 189 + async cleanup(expiresBeforeMs: number): Promise<number> { 190 190 + const client = new Client({ connectionString: this.connectionString }); 191 191 + 192 192 + try { 193 193 + await client.connect(); 194 194 + 195 195 + const result = await client.query( 196 196 + "DELETE FROM sessions WHERE expires_at < $1", 197 197 + [expiresBeforeMs] 198 198 + ); 199 199 + 200 200 + return result.rowCount || 0; 201 201 + } finally { 202 202 + await client.end(); 203 203 + } 204 204 + } 205 205 + 206 206 + async exists(sessionId: string): Promise<boolean> { 207 207 + const client = new Client({ connectionString: this.connectionString }); 208 208 + 209 209 + try { 210 210 + await client.connect(); 211 211 + 212 212 + const result = await client.query( 213 213 + "SELECT 1 FROM sessions WHERE session_id = $1 LIMIT 1", 214 214 + [sessionId] 215 215 + ); 216 216 + 217 217 + return result.rows.length > 0; 218 218 + } finally { 219 219 + await client.end(); 220 220 + } 221 221 + } 222 222 + 223 223 + private rowToSessionData(row: SessionTable): SessionData { 224 224 + return { 225 225 + sessionId: row.session_id, 226 226 + userId: row.user_id, 227 227 + handle: row.handle || undefined, 228 228 + isAuthenticated: row.is_authenticated, 229 229 + data: row.data ? JSON.parse(row.data) : undefined, 230 230 + createdAt: row.created_at.getTime(), 231 231 + expiresAt: row.expires_at.getTime(), 232 232 + lastAccessedAt: row.last_accessed_at.getTime(), 233 233 + }; 234 234 + } 235 235 + 236 236 + // PostgreSQL-specific methods 237 237 + async getSessionsByUser(userId: string): Promise<SessionData[]> { 238 238 + const client = new Client({ connectionString: this.connectionString }); 239 239 + 240 240 + try { 241 241 + await client.connect(); 242 242 + 243 243 + const result = await client.query( 244 244 + "SELECT * FROM sessions WHERE user_id = $1", 245 245 + [userId] 246 246 + ); 247 247 + 248 248 + return result.rows.map((row: Record<string, unknown>) => 249 249 + this.rowToSessionData(row as unknown as SessionTable) 250 250 + ); 251 251 + } finally { 252 252 + await client.end(); 253 253 + } 254 254 + } 255 255 + 256 256 + async vacuum(): Promise<void> { 257 257 + const client = new Client({ connectionString: this.connectionString }); 258 258 + 259 259 + try { 260 260 + await client.connect(); 261 261 + await client.query("VACUUM ANALYZE sessions"); 262 262 + } finally { 263 263 + await client.end(); 264 264 + } 265 265 + } 266 266 + }

+181

packages/session/src/adapters/sqlite.ts

··· 1 1 + import type { SessionAdapter, SessionData } from "../types.ts"; 2 2 + import { DatabaseSync } from "node:sqlite"; 3 3 + 4 4 + interface SessionTable { 5 5 + session_id: string; 6 6 + user_id: string; 7 7 + handle: string | null; 8 8 + is_authenticated: number; 9 9 + data: string | null; 10 10 + created_at: number; 11 11 + expires_at: number; 12 12 + last_accessed_at: number; 13 13 + } 14 14 + 15 15 + export class SQLiteAdapter implements SessionAdapter { 16 16 + private db: DatabaseSync; 17 17 + 18 18 + constructor(databasePath: string) { 19 19 + // Handle sqlite:// URLs or direct paths 20 20 + const dbPath = databasePath.startsWith("sqlite://") 21 21 + ? databasePath.slice(9) 22 22 + : databasePath; 23 23 + 24 24 + this.db = new DatabaseSync(dbPath); 25 25 + this.initializeDatabase(); 26 26 + } 27 27 + 28 28 + private initializeDatabase() { 29 29 + this.db.exec(` 30 30 + CREATE TABLE IF NOT EXISTS sessions ( 31 31 + session_id TEXT PRIMARY KEY, 32 32 + user_id TEXT NOT NULL, 33 33 + handle TEXT, 34 34 + is_authenticated INTEGER NOT NULL DEFAULT 1, 35 35 + data TEXT, -- JSON string 36 36 + created_at INTEGER NOT NULL, 37 37 + expires_at INTEGER NOT NULL, 38 38 + last_accessed_at INTEGER NOT NULL 39 39 + ) 40 40 + `); 41 41 + 42 42 + // Index for cleanup operations 43 43 + this.db.exec(` 44 44 + CREATE INDEX IF NOT EXISTS idx_sessions_expires_at 45 45 + ON sessions(expires_at) 46 46 + `); 47 47 + 48 48 + // Index for user lookups 49 49 + this.db.exec(` 50 50 + CREATE INDEX IF NOT EXISTS idx_sessions_user_id 51 51 + ON sessions(user_id) 52 52 + `); 53 53 + } 54 54 + 55 55 + get(sessionId: string): Promise<SessionData | null> { 56 56 + const stmt = this.db.prepare(` 57 57 + SELECT * FROM sessions 58 58 + WHERE session_id = ? 59 59 + `); 60 60 + 61 61 + const row = stmt.get(sessionId) as SessionTable | undefined; 62 62 + if (!row) return Promise.resolve(null); 63 63 + 64 64 + return Promise.resolve(this.rowToSessionData(row)); 65 65 + } 66 66 + 67 67 + set(sessionId: string, data: SessionData): Promise<void> { 68 68 + const stmt = this.db.prepare(` 69 69 + INSERT OR REPLACE INTO sessions 70 70 + (session_id, user_id, handle, is_authenticated, data, created_at, expires_at, last_accessed_at) 71 71 + VALUES (?, ?, ?, ?, ?, ?, ?, ?) 72 72 + `); 73 73 + 74 74 + stmt.run( 75 75 + sessionId, 76 76 + data.userId, 77 77 + data.handle || null, 78 78 + data.isAuthenticated ? 1 : 0, 79 79 + data.data ? JSON.stringify(data.data) : null, 80 80 + data.createdAt, 81 81 + data.expiresAt, 82 82 + data.lastAccessedAt 83 83 + ); 84 84 + return Promise.resolve(); 85 85 + } 86 86 + 87 87 + update(sessionId: string, updates: Partial<SessionData>): Promise<boolean> { 88 88 + const setParts: string[] = []; 89 89 + const values: (string | number | null)[] = []; 90 90 + 91 91 + if (updates.userId !== undefined) { 92 92 + setParts.push("user_id = ?"); 93 93 + values.push(updates.userId); 94 94 + } 95 95 + 96 96 + if (updates.handle !== undefined) { 97 97 + setParts.push("handle = ?"); 98 98 + values.push(updates.handle); 99 99 + } 100 100 + 101 101 + if (updates.isAuthenticated !== undefined) { 102 102 + setParts.push("is_authenticated = ?"); 103 103 + values.push(updates.isAuthenticated ? 1 : 0); 104 104 + } 105 105 + 106 106 + if (updates.data !== undefined) { 107 107 + setParts.push("data = ?"); 108 108 + values.push(updates.data ? JSON.stringify(updates.data) : null); 109 109 + } 110 110 + 111 111 + if (updates.expiresAt !== undefined) { 112 112 + setParts.push("expires_at = ?"); 113 113 + values.push(updates.expiresAt); 114 114 + } 115 115 + 116 116 + if (updates.lastAccessedAt !== undefined) { 117 117 + setParts.push("last_accessed_at = ?"); 118 118 + values.push(updates.lastAccessedAt); 119 119 + } 120 120 + 121 121 + if (setParts.length === 0) return Promise.resolve(false); 122 122 + 123 123 + values.push(sessionId); 124 124 + 125 125 + const stmt = this.db.prepare(` 126 126 + UPDATE sessions 127 127 + SET ${setParts.join(", ")} 128 128 + WHERE session_id = ? 129 129 + `); 130 130 + 131 131 + const result = stmt.run(...values); 132 132 + return Promise.resolve(Number(result.changes) > 0); 133 133 + } 134 134 + 135 135 + delete(sessionId: string): Promise<void> { 136 136 + const stmt = this.db.prepare("DELETE FROM sessions WHERE session_id = ?"); 137 137 + stmt.run(sessionId); 138 138 + return Promise.resolve(); 139 139 + } 140 140 + 141 141 + cleanup(expiresBeforeMs: number): Promise<number> { 142 142 + const stmt = this.db.prepare("DELETE FROM sessions WHERE expires_at < ?"); 143 143 + const result = stmt.run(expiresBeforeMs); 144 144 + return Promise.resolve(Number(result.changes)); 145 145 + } 146 146 + 147 147 + exists(sessionId: string): Promise<boolean> { 148 148 + const stmt = this.db.prepare( 149 149 + "SELECT 1 FROM sessions WHERE session_id = ? LIMIT 1" 150 150 + ); 151 151 + return Promise.resolve(stmt.get(sessionId) !== undefined); 152 152 + } 153 153 + 154 154 + private rowToSessionData(row: SessionTable): SessionData { 155 155 + return { 156 156 + sessionId: row.session_id, 157 157 + userId: row.user_id, 158 158 + handle: row.handle || undefined, 159 159 + isAuthenticated: Boolean(row.is_authenticated), 160 160 + data: row.data ? JSON.parse(row.data) : undefined, 161 161 + createdAt: row.created_at, 162 162 + expiresAt: row.expires_at, 163 163 + lastAccessedAt: row.last_accessed_at, 164 164 + }; 165 165 + } 166 166 + 167 167 + // SQLite-specific methods 168 168 + close(): void { 169 169 + this.db.close(); 170 170 + } 171 171 + 172 172 + vacuum(): void { 173 173 + this.db.exec("VACUUM"); 174 174 + } 175 175 + 176 176 + getSessionsByUser(userId: string): SessionData[] { 177 177 + const stmt = this.db.prepare("SELECT * FROM sessions WHERE user_id = ?"); 178 178 + const rows = stmt.all(userId) as unknown as SessionTable[]; 179 179 + return rows.map(row => this.rowToSessionData(row)); 180 180 + } 181 181 + }

+55

packages/session/src/cookie.ts

··· 1 1 + import type { CookieOptions } from "./types.ts"; 2 2 + 3 3 + export function parseCookie(cookieString: string): Record<string, string> { 4 4 + const cookies: Record<string, string> = {}; 5 5 + 6 6 + if (!cookieString) return cookies; 7 7 + 8 8 + const pairs = cookieString.split(";"); 9 9 + 10 10 + for (const pair of pairs) { 11 11 + const [key, ...valueParts] = pair.split("="); 12 12 + const trimmedKey = key?.trim(); 13 13 + const value = valueParts.join("=")?.trim(); 14 14 + 15 15 + if (trimmedKey) { 16 16 + cookies[trimmedKey] = decodeURIComponent(value || ""); 17 17 + } 18 18 + } 19 19 + 20 20 + return cookies; 21 21 + } 22 22 + 23 23 + export function serializeCookie( 24 24 + name: string, 25 25 + value: string, 26 26 + options: CookieOptions = {} 27 27 + ): string { 28 28 + const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`]; 29 29 + 30 30 + if (options.maxAge !== undefined) { 31 31 + parts.push(`Max-Age=${options.maxAge}`); 32 32 + } 33 33 + 34 34 + if (options.domain) { 35 35 + parts.push(`Domain=${options.domain}`); 36 36 + } 37 37 + 38 38 + if (options.path) { 39 39 + parts.push(`Path=${options.path}`); 40 40 + } 41 41 + 42 42 + if (options.httpOnly) { 43 43 + parts.push("HttpOnly"); 44 44 + } 45 45 + 46 46 + if (options.secure) { 47 47 + parts.push("Secure"); 48 48 + } 49 49 + 50 50 + if (options.sameSite) { 51 51 + parts.push(`SameSite=${options.sameSite}`); 52 52 + } 53 53 + 54 54 + return parts.join("; "); 55 55 + }

+247

packages/session/src/oauth-integration.ts

··· 1 1 + import type { SessionStore } from "./store.ts"; 2 2 + import type { SessionData } from "./types.ts"; 3 3 + import type { OAuthClient, OAuthTokens } from "@slices/oauth"; 4 4 + 5 5 + export interface OAuthSessionOptions { 6 6 + sessionStore: SessionStore; 7 7 + oauthClient: OAuthClient; 8 8 + autoRefresh?: boolean; 9 9 + onTokenRefresh?: (sessionId: string, tokens: OAuthTokens) => Promise<void>; 10 10 + onLogout?: (sessionId: string) => Promise<void>; 11 11 + } 12 12 + 13 13 + export class OAuthSessionManager { 14 14 + private options: OAuthSessionOptions; 15 15 + 16 16 + constructor(options: OAuthSessionOptions) { 17 17 + this.options = options; 18 18 + } 19 19 + 20 20 + // Create a session linked to OAuth (no token duplication) 21 21 + async createOAuthSession(): Promise<string | null> { 22 22 + try { 23 23 + // Verify OAuth tokens exist (but don't store them) 24 24 + const tokens = await this.options.oauthClient.ensureValidToken(); 25 25 + if (!tokens.accessToken) { 26 26 + return null; 27 27 + } 28 28 + 29 29 + // Get user info from OAuth 30 30 + const userInfo = await this.options.oauthClient.getUserInfo(); 31 31 + if (!userInfo) { 32 32 + return null; 33 33 + } 34 34 + 35 35 + // Create session with user data only (no token storage) 36 36 + const sessionId = await this.options.sessionStore.createSession( 37 37 + userInfo.sub, 38 38 + userInfo.name, 39 39 + { 40 40 + userInfo: { 41 41 + ...userInfo, 42 42 + handle: userInfo.name, 43 43 + }, 44 44 + // OAuth tokens are managed separately by @slices/oauth 45 45 + // No token duplication here 46 46 + } 47 47 + ); 48 48 + 49 49 + return sessionId; 50 50 + } catch (error) { 51 51 + console.error("Failed to create OAuth session:", error); 52 52 + return null; 53 53 + } 54 54 + } 55 55 + 56 56 + // Get session (tokens managed separately by OAuth client) 57 57 + async getOAuthSession(sessionId: string): Promise<SessionData | null> { 58 58 + const session = await this.options.sessionStore.getSession(sessionId); 59 59 + if (!session) { 60 60 + return null; 61 61 + } 62 62 + 63 63 + // Auto-refresh is handled by OAuth client, not session storage 64 64 + if (this.options.autoRefresh) { 65 65 + try { 66 66 + // This ensures tokens are fresh in OAuth storage 67 67 + await this.options.oauthClient.ensureValidToken(); 68 68 + 69 69 + // Call refresh callback if provided 70 70 + if (this.options.onTokenRefresh) { 71 71 + const tokens = await this.options.oauthClient.ensureValidToken(); 72 72 + await this.options.onTokenRefresh(sessionId, tokens); 73 73 + } 74 74 + } catch (error) { 75 75 + console.error("Failed to refresh OAuth tokens:", error); 76 76 + // Session is still valid even if token refresh fails 77 77 + } 78 78 + } 79 79 + 80 80 + return session; 81 81 + } 82 82 + 83 83 + // Logout and cleanup OAuth session 84 84 + async logout(sessionId: string): Promise<void> { 85 85 + try { 86 86 + // Call OAuth logout 87 87 + await this.options.oauthClient.logout(); 88 88 + 89 89 + // Delete session 90 90 + await this.options.sessionStore.deleteSession(sessionId); 91 91 + 92 92 + // Call logout callback if provided 93 93 + if (this.options.onLogout) { 94 94 + await this.options.onLogout(sessionId); 95 95 + } 96 96 + } catch (error) { 97 97 + console.error("Failed to logout OAuth session:", error); 98 98 + // Still delete the session even if OAuth logout fails 99 99 + await this.options.sessionStore.deleteSession(sessionId); 100 100 + } 101 101 + } 102 102 + 103 103 + // Check if session has valid OAuth tokens (via OAuth client) 104 104 + async hasValidOAuthTokens(sessionId: string): Promise<boolean> { 105 105 + const session = await this.getOAuthSession(sessionId); 106 106 + if (!session) return false; 107 107 + 108 108 + try { 109 109 + // Let OAuth client determine token validity 110 110 + const tokens = await this.options.oauthClient.ensureValidToken(); 111 111 + return !!tokens.accessToken; 112 112 + } catch (_error) { 113 113 + return false; 114 114 + } 115 115 + } 116 116 + 117 117 + // Get OAuth access token for API calls (from OAuth client, not session) 118 118 + async getAccessToken(sessionId: string): Promise<string | null> { 119 119 + const session = await this.getOAuthSession(sessionId); 120 120 + if (!session) return null; 121 121 + 122 122 + try { 123 123 + // Get fresh tokens from OAuth client 124 124 + const tokens = await this.options.oauthClient.ensureValidToken(); 125 125 + return tokens.accessToken || null; 126 126 + } catch (_error) { 127 127 + return null; 128 128 + } 129 129 + } 130 130 + } 131 131 + 132 132 + // Convenience function to create an OAuth-enabled session store 133 133 + export function withOAuthSession( 134 134 + sessionStore: SessionStore, 135 135 + oauthClient: OAuthClient, 136 136 + options: Partial<OAuthSessionOptions> = {} 137 137 + ): OAuthSessionManager { 138 138 + return new OAuthSessionManager({ 139 139 + sessionStore, 140 140 + oauthClient, 141 141 + autoRefresh: true, 142 142 + ...options, 143 143 + }); 144 144 + } 145 145 + 146 146 + // Helper middleware for frameworks 147 147 + export interface OAuthSessionMiddlewareOptions extends OAuthSessionOptions { 148 148 + cookieName?: string; 149 149 + loginRedirect?: string; 150 150 + logoutRedirect?: string; 151 151 + } 152 152 + 153 153 + export function createOAuthSessionMiddleware( 154 154 + options: OAuthSessionMiddlewareOptions 155 155 + ) { 156 156 + const manager = new OAuthSessionManager(options); 157 157 + const cookieName = options.cookieName || "slice-session"; 158 158 + 159 159 + return { 160 160 + // Get current user from session 161 161 + async getCurrentUser(request: Request) { 162 162 + const sessionId = getSessionIdFromRequest(request, cookieName); 163 163 + if (!sessionId) { 164 164 + return { isAuthenticated: false }; 165 165 + } 166 166 + 167 167 + const session = await manager.getOAuthSession(sessionId); 168 168 + if (!session) { 169 169 + return { isAuthenticated: false }; 170 170 + } 171 171 + 172 172 + return { 173 173 + isAuthenticated: true, 174 174 + sub: session.userId, 175 175 + handle: session.handle, 176 176 + // User info from session data (no OAuth tokens) 177 177 + ...(session.data?.userInfo || {}), 178 178 + }; 179 179 + }, 180 180 + 181 181 + // Login handler 182 182 + async login(): Promise<Response> { 183 183 + const sessionId = await manager.createOAuthSession(); 184 184 + if (!sessionId) { 185 185 + return new Response("Authentication failed", { status: 401 }); 186 186 + } 187 187 + 188 188 + const cookie = options.sessionStore.createSessionCookie(sessionId); 189 189 + const redirectUrl = options.loginRedirect || "/"; 190 190 + 191 191 + return new Response("", { 192 192 + status: 302, 193 193 + headers: { 194 194 + Location: redirectUrl, 195 195 + "Set-Cookie": cookie, 196 196 + }, 197 197 + }); 198 198 + }, 199 199 + 200 200 + // Logout handler 201 201 + async logout(request: Request): Promise<Response> { 202 202 + const sessionId = getSessionIdFromRequest(request, cookieName); 203 203 + if (sessionId) { 204 204 + await manager.logout(sessionId); 205 205 + } 206 206 + 207 207 + const cookie = options.sessionStore.createLogoutCookie(); 208 208 + const redirectUrl = options.logoutRedirect || "/"; 209 209 + 210 210 + return new Response("", { 211 211 + status: 302, 212 212 + headers: { 213 213 + Location: redirectUrl, 214 214 + "Set-Cookie": cookie, 215 215 + }, 216 216 + }); 217 217 + }, 218 218 + 219 219 + manager, 220 220 + }; 221 221 + } 222 222 + 223 223 + // Helper to extract session ID from request 224 224 + function getSessionIdFromRequest( 225 225 + request: Request, 226 226 + cookieName: string 227 227 + ): string | null { 228 228 + const cookieHeader = request.headers.get("cookie"); 229 229 + if (!cookieHeader) return null; 230 230 + 231 231 + const cookies = parseCookies(cookieHeader); 232 232 + return cookies[cookieName] || null; 233 233 + } 234 234 + 235 235 + // Simple cookie parser 236 236 + function parseCookies(cookieString: string): Record<string, string> { 237 237 + const cookies: Record<string, string> = {}; 238 238 + 239 239 + cookieString.split(";").forEach((cookie) => { 240 240 + const [key, value] = cookie.split("=").map((s) => s.trim()); 241 241 + if (key && value) { 242 242 + cookies[decodeURIComponent(key)] = decodeURIComponent(value); 243 243 + } 244 244 + }); 245 245 + 246 246 + return cookies; 247 247 + }

+158

packages/session/src/store.ts

··· 1 1 + import type { SessionAdapter, SessionData, SessionOptions, SessionUser } from "./types.ts"; 2 2 + import { parseCookie, serializeCookie } from "./cookie.ts"; 3 3 + 4 4 + const DEFAULT_SESSION_TTL = 30 * 24 * 60 * 60 * 1000; // 30 days 5 5 + const DEFAULT_CLEANUP_INTERVAL = 60 * 60 * 1000; // 1 hour 6 6 + const DEFAULT_COOKIE_NAME = "slice-session"; 7 7 + 8 8 + export class SessionStore { 9 9 + private adapter: SessionAdapter; 10 10 + private options: Required<SessionOptions>; 11 11 + private cleanupTimer?: number; 12 12 + 13 13 + constructor(options: SessionOptions) { 14 14 + this.adapter = options.adapter; 15 15 + this.options = { 16 16 + adapter: options.adapter, 17 17 + cookieName: options.cookieName ?? DEFAULT_COOKIE_NAME, 18 18 + cookieOptions: { 19 19 + httpOnly: true, 20 20 + secure: true, 21 21 + sameSite: "lax", 22 22 + path: "/", 23 23 + ...options.cookieOptions, 24 24 + }, 25 25 + sessionTTL: options.sessionTTL ?? DEFAULT_SESSION_TTL, 26 26 + cleanupInterval: options.cleanupInterval ?? DEFAULT_CLEANUP_INTERVAL, 27 27 + generateId: options.generateId ?? (() => crypto.randomUUID()), 28 28 + }; 29 29 + 30 30 + // Start cleanup timer 31 31 + this.startCleanupTimer(); 32 32 + } 33 33 + 34 34 + private startCleanupTimer() { 35 35 + if (this.cleanupTimer) { 36 36 + clearInterval(this.cleanupTimer); 37 37 + } 38 38 + 39 39 + this.cleanupTimer = setInterval(() => { 40 40 + this.cleanup().catch(console.error); 41 41 + }, this.options.cleanupInterval); 42 42 + } 43 43 + 44 44 + async createSession(userId: string, handle?: string, data?: Record<string, unknown>): Promise<string> { 45 45 + const sessionId = this.options.generateId(); 46 46 + const now = Date.now(); 47 47 + 48 48 + const sessionData: SessionData = { 49 49 + sessionId, 50 50 + userId, 51 51 + handle, 52 52 + isAuthenticated: true, 53 53 + data, 54 54 + createdAt: now, 55 55 + expiresAt: now + this.options.sessionTTL, 56 56 + lastAccessedAt: now, 57 57 + }; 58 58 + 59 59 + await this.adapter.set(sessionId, sessionData); 60 60 + return sessionId; 61 61 + } 62 62 + 63 63 + async getSession(sessionId: string): Promise<SessionData | null> { 64 64 + if (!sessionId) return null; 65 65 + 66 66 + const session = await this.adapter.get(sessionId); 67 67 + if (!session) return null; 68 68 + 69 69 + // Check if session is expired 70 70 + if (session.expiresAt < Date.now()) { 71 71 + await this.adapter.delete(sessionId); 72 72 + return null; 73 73 + } 74 74 + 75 75 + // Update last accessed time 76 76 + await this.adapter.update(sessionId, { 77 77 + lastAccessedAt: Date.now(), 78 78 + }); 79 79 + 80 80 + return session; 81 81 + } 82 82 + 83 83 + async updateSession(sessionId: string, updates: Partial<SessionData>): Promise<boolean> { 84 84 + const session = await this.getSession(sessionId); 85 85 + if (!session) return false; 86 86 + 87 87 + // Extend expiration on update 88 88 + const extendedExpiration = Date.now() + this.options.sessionTTL; 89 89 + 90 90 + return await this.adapter.update(sessionId, { 91 91 + ...updates, 92 92 + expiresAt: extendedExpiration, 93 93 + lastAccessedAt: Date.now(), 94 94 + }); 95 95 + } 96 96 + 97 97 + async deleteSession(sessionId: string): Promise<void> { 98 98 + await this.adapter.delete(sessionId); 99 99 + } 100 100 + 101 101 + async cleanup(): Promise<number> { 102 102 + return await this.adapter.cleanup(Date.now()); 103 103 + } 104 104 + 105 105 + // Get session from request cookies 106 106 + async getSessionFromRequest(request: Request): Promise<SessionData | null> { 107 107 + const cookieHeader = request.headers.get("cookie"); 108 108 + if (!cookieHeader) return null; 109 109 + 110 110 + const cookies = parseCookie(cookieHeader); 111 111 + const sessionId = cookies[this.options.cookieName]; 112 112 + if (!sessionId) return null; 113 113 + 114 114 + return await this.getSession(sessionId); 115 115 + } 116 116 + 117 117 + // Get user info from session 118 118 + async getCurrentUser(request: Request): Promise<SessionUser> { 119 119 + const session = await this.getSessionFromRequest(request); 120 120 + 121 121 + if (!session) { 122 122 + return { 123 123 + isAuthenticated: false, 124 124 + }; 125 125 + } 126 126 + 127 127 + return { 128 128 + sub: session.userId, 129 129 + handle: session.handle, 130 130 + isAuthenticated: session.isAuthenticated, 131 131 + ...session.data, 132 132 + }; 133 133 + } 134 134 + 135 135 + // Create session cookie header 136 136 + createSessionCookie(sessionId: string): string { 137 137 + return serializeCookie(this.options.cookieName, sessionId, { 138 138 + ...this.options.cookieOptions, 139 139 + maxAge: Math.floor(this.options.sessionTTL / 1000), // Convert to seconds 140 140 + }); 141 141 + } 142 142 + 143 143 + // Create logout cookie header (clears the session) 144 144 + createLogoutCookie(): string { 145 145 + return serializeCookie(this.options.cookieName, "", { 146 146 + ...this.options.cookieOptions, 147 147 + maxAge: 0, 148 148 + }); 149 149 + } 150 150 + 151 151 + // Cleanup on destroy 152 152 + destroy() { 153 153 + if (this.cleanupTimer) { 154 154 + clearInterval(this.cleanupTimer); 155 155 + this.cleanupTimer = undefined; 156 156 + } 157 157 + } 158 158 + }

+44

packages/session/src/types.ts

··· 1 1 + export interface SessionData { 2 2 + sessionId: string; 3 3 + userId: string; 4 4 + handle?: string; 5 5 + isAuthenticated: boolean; 6 6 + data?: Record<string, unknown>; 7 7 + createdAt: number; 8 8 + expiresAt: number; 9 9 + lastAccessedAt: number; 10 10 + } 11 11 + 12 12 + export interface SessionUser { 13 13 + sub?: string; 14 14 + handle?: string; 15 15 + isAuthenticated: boolean; 16 16 + [key: string]: unknown; 17 17 + } 18 18 + 19 19 + export interface SessionOptions { 20 20 + adapter: SessionAdapter; 21 21 + cookieName?: string; 22 22 + cookieOptions?: CookieOptions; 23 23 + sessionTTL?: number; // milliseconds, default 30 days 24 24 + cleanupInterval?: number; // milliseconds, default 1 hour 25 25 + generateId?: () => string; 26 26 + } 27 27 + 28 28 + export interface CookieOptions { 29 29 + httpOnly?: boolean; 30 30 + secure?: boolean; 31 31 + sameSite?: "strict" | "lax" | "none"; 32 32 + domain?: string; 33 33 + path?: string; 34 34 + maxAge?: number; // seconds 35 35 + } 36 36 + 37 37 + export interface SessionAdapter { 38 38 + get(sessionId: string): Promise<SessionData | null>; 39 39 + set(sessionId: string, data: SessionData): Promise<void>; 40 40 + update(sessionId: string, data: Partial<SessionData>): Promise<boolean>; 41 41 + delete(sessionId: string): Promise<void>; 42 42 + cleanup(expiresBeforeMs: number): Promise<number>; 43 43 + exists(sessionId: string): Promise<boolean>; 44 44 + }