Add optional 30-day remembered sessions

src/routes/api/auth/password/+server.ts

@@ -7,7 +7,12 @@ export const POST: RequestHandler = async ({ request, cookies, locals, url, getC
         consumeAuthAttempt(getClientAddress(), user.id, 'password');
         const body = await authBody(request);
         return sessionResponse(
-            await changePassword(user.id, body.currentPassword, body.newPassword),
+            await changePassword(
+                user.id,
+                body.currentPassword,
+                body.newPassword,
+                locals.sessionHash ?? ''
+            ),
             cookies,
             url
         );

src/routes/api/users/+server.ts

@@ -2,10 +2,15 @@ import { json, type RequestHandler } from '@sveltejs/kit';
 import { createUser, listUsers } from '$lib/server/auth/index.js';
 import { authBody, authError, requireUser } from '$lib/server/auth/http.js';
 export const GET: RequestHandler = () => json({ users: listUsers() });
-export const POST: RequestHandler = async ({ request, locals }) => {
+export const POST: RequestHandler = async ({ request, locals, getClientAddress }) => {
     try {
         return json(
-            { user: await createUser(requireUser(locals.user).id, await authBody(request)) },
+            {
+                user: await createUser(requireUser(locals.user).id, await authBody(request), {
+                    tokenHash: locals.sessionHash ?? '',
+                    clientAddress: getClientAddress()
+                })
+            },
             { status: 201 }
         );
     } catch (cause) {

src/routes/api/users/[id]/+server.ts

@@ -2,10 +2,18 @@ import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { updateUser } from '$lib/server/auth/index.js';
 import { authBody, authError, requireUser } from '$lib/server/auth/http.js';
-export const PATCH: RequestHandler = async ({ request, params, locals }) => {
+export const PATCH: RequestHandler = async ({ request, params, locals, getClientAddress }) => {
     try {
         return json({
-            user: await updateUser(requireUser(locals.user).id, params.id, await authBody(request))
+            user: await updateUser(
+                requireUser(locals.user).id,
+                params.id,
+                await authBody(request),
+                {
+                    tokenHash: locals.sessionHash ?? '',
+                    clientAddress: getClientAddress()
+                }
+            )
         });
     } catch (cause) {
         return authError(cause);