@1auth/authn 0.0.0-beta.1 → 0.0.0-beta.3

package/README.md

@@ -0,0 +1,44 @@
+<div align="center">
+  <h1>@1auth/authn</h1>
+  <!--<img alt="1auth logo" src="https://raw.githubusercontent.com/willfarrell/1auth/main/docs/img/logo.svg"/>-->
+  <p><strong>Core authentication module with multi-factor authentication support</strong></p>
+<p>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-unit.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-unit.yml/badge.svg" alt="GitHub Actions unit test status"></a>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-dast.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-dast.yml/badge.svg" alt="GitHub Actions dast test status"></a>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-perf.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-perf.yml/badge.svg" alt="GitHub Actions perf test status"></a>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-sast.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-sast.yml/badge.svg" alt="GitHub Actions SAST test status"></a>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-lint.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-lint.yml/badge.svg" alt="GitHub Actions lint test status"></a>
+  <br/>
+  <a href="https://www.npmjs.com/package/@1auth/authn"><img alt="npm version" src="https://img.shields.io/npm/v/@1auth/authn.svg"></a>
+  <a href="https://packagephobia.com/result?p=@1auth/authn"><img src="https://packagephobia.com/badge?p=@1auth/authn" alt="npm install size"></a>
+  <a href="https://www.npmjs.com/package/@1auth/authn">
+  <img alt="npm weekly downloads" src="https://img.shields.io/npm/dw/@1auth/authn.svg"></a>
+  <a href="https://www.npmjs.com/package/@1auth/authn#provenance">
+  <img alt="npm provenance" src="https://img.shields.io/badge/provenance-Yes-brightgreen"></a>
+  <br/>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/willfarrell/1auth"><img src="https://api.scorecard.dev/projects/github.com/willfarrell/1auth/badge" alt="Open Source Security Foundation (OpenSSF) Scorecard"></a>
+  <a href="https://slsa.dev"><img src="https://slsa.dev/images/gh-badge-level3.svg" alt="SLSA 3"></a>
+  <a href="https://github.com/willfarrell/1auth/blob/main/docs/CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg"></a>
+  <a href="https://biomejs.dev"><img alt="Checked with Biome" src="https://img.shields.io/badge/Checked_with-Biome-60a5fa?style=flat&logo=biome"></a>
+  <a href="https://conventionalcommits.org"><img alt="Conventional Commits" src="https://img.shields.io/badge/Conventional%20Commits-1.0.0-%23FE5196?logo=conventionalcommits&logoColor=white"></a>
+</p>
+<p>You can read the documentation at: <a href="https://1auth.js.org">https://1auth.js.org</a></p>
+</div>
+
+## Install
+
+```bash
+npm install @1auth/authn
+```
+
+## Documentation and examples
+
+For documentation and examples, refer to the main [1auth monorepo on GitHub](https://github.com/willfarrell/1auth) or the [1auth website](https://1auth.js.org).
+
+## Contributing
+
+Everyone is very welcome to contribute to this repository. Feel free to [raise issues](https://github.com/willfarrell/1auth/issues) or to [submit Pull Requests](https://github.com/willfarrell/1auth/pulls).
+
+## License
+
+Licensed under [MIT License](LICENSE). Copyright (c) 2020-2026 [will Farrell](https://github.com/willfarrell) and [contributors](https://github.com/willfarrell/1auth/graphs/contributors).

package/index.js

@@ -3,6 +3,7 @@
 import { setTimeout } from "node:timers/promises";
 import {
 	makeRandomConfigObject,
+	nowInSeconds,
 	symmetricDecryptFields,
 	symmetricEncryptFields,
 	symmetricGenerateEncryptionKey,
@@ -35,19 +36,9 @@ export default (opt = {}) => {
 };
 export const getOptions = () => options;
 
-// export const exists = async (credentialOptions, sub, params) => {
-//   const type = makeType(credentialOptions);
-//   const list = await options.store.selectList(options.table, {
-//     ...params,
-//     sub,
-//     type,
-//   });
-//   return list.length > 1;
-// };
-
 export const count = async (credentialOptions, sub) => {
 	if (!sub || typeof sub !== "string") {
-		throw new Error("401 Unauthorized", { cause: { sub, id } });
+		throw new Error("401 Unauthorized", { cause: { sub } });
 	}
 	const type = makeType(credentialOptions);
 	const credentials = await options.store.selectList(
@@ -72,7 +63,7 @@ export const count = async (credentialOptions, sub) => {
 
 export const list = async (credentialOptions, sub, params, fields) => {
 	if (!sub || typeof sub !== "string") {
-		throw new Error("401 Unauthorized", { cause: { sub, id } });
+		throw new Error("401 Unauthorized", { cause: { sub } });
 	}
 	const type = makeType(credentialOptions);
 	const items = await options.store.selectList(
@@ -84,14 +75,13 @@ export const list = async (credentialOptions, sub, params, fields) => {
 		},
 		fields,
 	);
-	// const now = nowInSeconds();
+	const now = nowInSeconds();
 	const list = [];
 	for (let i = items.length; i--; ) {
 		const item = items[i];
-		// TODO need filter for expire
-		// if (credential.expire < now) {
-		//   continue;
-		// }
+		if (item.expire && item.expire < now) {
+			continue;
+		}
 		const { encryptionKey: encryptedKey } = item;
 		item.encryptionKey = undefined;
 		const decryptedItem = symmetricDecryptFields(
@@ -167,11 +157,7 @@ export const update = async (
 	credentialOptions,
 	{ id, sub, encryptionKey, encryptedKey, value, ...values },
 ) => {
-	// if (!sub || typeof sub !== "string") {
-	// 	throw new Error("401 Unauthorized", { cause: { sub } });
-	// }
 	const now = nowInSeconds();
-	// const type = makeType(credentialOptions);
 
 	const encodedValue = await credentialOptions.encode(value);
 
@@ -181,7 +167,7 @@ export const update = async (
 		options.encryptedFields,
 	);
 
-	return options.store.update(
+	return await options.store.update(
 		options.table,
 		{ sub, id },
 		{
@@ -192,7 +178,7 @@ export const update = async (
 };
 
 export const subject = async (username) => {
-	return Promise.all(
+	return await Promise.all(
 		options.usernameExists.map((exists) => {
 			return exists(username);
 		}),
@@ -256,7 +242,6 @@ export const authenticate = async (credentialOptions, username, secret) => {
 			if (otp) {
 				await expire(credentialOptions, sub, id, { lastused: now });
 			} else {
-				const now = nowInSeconds();
 				await options.store.update(
 					options.table,
 					{ id, sub },
@@ -292,7 +277,6 @@ export const verifySecret = async (_credentialOptions, sub, id) => {
 	if (!id || typeof id !== "string") {
 		throw new Error("404 Not Found", { cause: { sub, id } });
 	}
-	// const type = makeType(credentialOptions);
 	const now = nowInSeconds();
 	await options.store.update(
 		options.table,
@@ -301,7 +285,6 @@ export const verifySecret = async (_credentialOptions, sub, id) => {
 	);
 };
 
-// TODO add in sourceId as filter for messengers
 export const verify = async (credentialOptions, sub, input) => {
 	const timeout = setTimeout(options.authenticationDuration);
 	if (!sub || typeof sub !== "string") {
@@ -315,11 +298,12 @@ export const verify = async (credentialOptions, sub, input) => {
 	}
 
 	const type = makeType(credentialOptions);
+	const filters = { sub, type };
+	if (credentialOptions.sourceId) {
+		filters.sourceId = credentialOptions.sourceId;
+	}
 
-	const credentials = await options.store.selectList(options.table, {
-		sub,
-		type,
-	});
+	const credentials = await options.store.selectList(options.table, filters);
 
 	const now = nowInSeconds();
 	let valid;
@@ -327,7 +311,7 @@ export const verify = async (credentialOptions, sub, input) => {
 	let skipExpiredCount = 0;
 	for (credential of credentials) {
 		// skip expired
-		if (credential.expire < now) {
+		if (credential.expire && credential.expire < now) {
 			skipExpiredCount += 1;
 			continue;
 		}
@@ -378,7 +362,6 @@ export const expire = async (_credentialOptions, sub, id, values = {}) => {
 	if (!id || typeof id !== "string") {
 		throw new Error("404 Not Found", { cause: { sub, id } });
 	}
-	// const type = makeType(credentialOptions);
 	await options.store.update(
 		options.table,
 		{ sub, id },
@@ -428,12 +411,5 @@ export const select = async (credentialOptions, sub, id) => {
 	return decryptedItem;
 };
 
-// TODO manage onboard state
-
-// TODO save notification settings
-
-// TODO authorize management?
-
-const makeType = (credentialOptions) =>
+export const makeType = (credentialOptions) =>
 	`${credentialOptions.id}-${credentialOptions.type}`;
-const nowInSeconds = () => Math.floor(Date.now() / 1000);

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@1auth/authn",
-	"version": "0.0.0-beta.1",
-	"description": "",
+	"version": "0.0.0-beta.3",
+	"description": "Core authentication module with multi-factor authentication support",
 	"type": "module",
 	"engines": {
 		"node": ">=24"
@@ -12,18 +12,18 @@
 	},
 	"main": "./index.js",
 	"module": "./index.js",
+	"sideEffects": false,
 	"exports": {
 		".": {
-			"import": {
-				"types": "./index.d.ts",
-				"default": "./index.js"
-			}
+			"import": "./index.js"
+		},
+		"./table/*": {
+			"import": "./table/*"
 		}
 	},
-	"types": "index.d.ts",
 	"files": [
 		"index.js",
-		"index.d.ts"
+		"table"
 	],
 	"scripts": {
 		"test": "npm run test:unit",
@@ -34,7 +34,13 @@
 		"type": "github",
 		"url": "https://github.com/sponsors/willfarrell"
 	},
-	"keywords": [],
+	"keywords": [
+		"1auth",
+		"OWASP",
+		"ASVS",
+		"authentication",
+		"credentials"
+	],
 	"author": {
 		"name": "1auth contributors",
 		"url": "https://github.com/willfarrell/1auth/graphs/contributors"
@@ -50,6 +56,6 @@
 	"homepage": "https://github.com/willfarrell/1auth",
 	"gitHead": "7a6c0fbb8ab71d6a2171e678697de9f237568431",
 	"dependencies": {
-		"@1auth/crypto": "0.0.0-beta.1"
+		"@1auth/crypto": "0.0.0-beta.3"
 	}
 }

package/table/dynamodb.js

@@ -0,0 +1,151 @@
+// Copyright 2003 - 2026 will Farrell, and 1Auth contributors.
+// SPDX-License-Identifier: MIT
+import {
+	CreateTableCommand,
+	DeleteTableCommand,
+} from "@aws-sdk/client-dynamodb";
+
+export const name = "authentications";
+export const timeToLiveKey = "remove";
+
+export const create = async (client, table = name) => {
+	try {
+		await client.send(
+			new CreateTableCommand({
+				TableName: table,
+				AttributeDefinitions: [
+					{
+						AttributeName: "id",
+						AttributeType: "S",
+					},
+					{
+						AttributeName: "sub",
+						AttributeType: "S",
+					},
+					{
+						AttributeName: "type",
+						AttributeType: "S",
+					},
+					{
+						AttributeName: "digest",
+						AttributeType: "S",
+					},
+					{
+						AttributeName: "expire",
+						AttributeType: "N",
+					},
+				],
+				KeySchema: [
+					{
+						AttributeName: "sub",
+						KeyType: "HASH",
+					},
+					{
+						AttributeName: "id",
+						KeyType: "RANGE",
+					},
+				],
+				GlobalSecondaryIndexes: [
+					{
+						IndexName: "sub",
+						KeySchema: [
+							{
+								AttributeName: "sub",
+								KeyType: "HASH",
+							},
+							{
+								AttributeName: "type",
+								KeyType: "RANGE",
+							},
+						],
+						Projection: {
+							ProjectionType: "INCLUDE",
+							NonKeyAttributes: [
+								"id",
+								"encryptionKey",
+								"value",
+								"digest",
+								"name",
+								"otp",
+								"sourceId",
+								"create",
+								"update",
+								"verify",
+								"expire",
+								"lastused",
+							],
+						},
+					},
+					{
+						IndexName: "digest",
+						KeySchema: [
+							{
+								AttributeName: "digest",
+								KeyType: "HASH",
+							},
+						],
+						Projection: {
+							ProjectionType: "INCLUDE",
+							NonKeyAttributes: [
+								"id",
+								"sub",
+								"encryptionKey",
+								"value",
+								"name",
+								"otp",
+								"sourceId",
+								"create",
+								"update",
+								"verify",
+								"expire",
+								"lastused",
+							],
+						},
+					},
+					{
+						IndexName: "expire",
+						KeySchema: [
+							{
+								AttributeName: "type",
+								KeyType: "HASH",
+							},
+							{
+								AttributeName: "expire",
+								KeyType: "RANGE",
+							},
+						],
+						Projection: {
+							ProjectionType: "INCLUDE",
+							NonKeyAttributes: ["sub"],
+						},
+					},
+				],
+				TimeToLiveSpecification: {
+					Enabled: true,
+					AttributeName: timeToLiveKey,
+				},
+				BillingMode: "PAY_PER_REQUEST",
+			}),
+		);
+	} catch (e) {
+		if (e.message === "Cannot create preexisting table") {
+			await truncate(client, table);
+		} else {
+			console.error("ERROR create", e.message);
+			throw e;
+		}
+	}
+};
+
+export const truncate = async (client, table = name) => {
+	await drop(client, table);
+	await create(client, table);
+};
+
+export const drop = async (client, table = name) => {
+	await client.send(
+		new DeleteTableCommand({
+			TableName: table,
+		}),
+	);
+};

package/table/sql.js

@@ -0,0 +1,46 @@
+// Copyright 2003 - 2026 will Farrell, and 1Auth contributors.
+// SPDX-License-Identifier: MIT
+export const name = "authentications";
+export const timeToLiveKey = "remove";
+export const create = async (client, table = name) => {
+	const sql = `
+	CREATE TABLE IF NOT EXISTS ${table}
+   (
+     "id"                 VARCHAR(19)         NOT NULL, -- prefix (authn_) + entropy (11)
+     "sub"                VARCHAR(15)         NOT NULL, -- prefix (sub_) + entropy (11)
+     "type"               VARCHAR(32)         NOT NULL,
+
+     "encryptionKey"      VARCHAR(256)        NOT NULL,
+     "value"              VARCHAR(2048) DEFAULT NULL,
+     "digest"             VARCHAR(73)  DEFAULT NULL, -- of value
+
+     "name"               VARCHAR(128) DEFAULT NULL,
+     "otp"                BOOLEAN      DEFAULT FALSE,
+     "sourceId"           VARCHAR(32)  DEFAULT NULL,
+     "lastused"           TIMESTAMP WITH TIME ZONE DEFAULT NULL,
+
+     "create"             TIMESTAMP WITH TIME ZONE DEFAULT NULL, -- postges: DEFAULT NOW(), sqlite: DEFAULT CURRENT_TIME,
+     "update"             TIMESTAMP WITH TIME ZONE DEFAULT NULL, -- NOW()
+     "verify"             TIMESTAMP WITH TIME ZONE DEFAULT NULL,
+     "expire"             TIMESTAMP WITH TIME ZONE DEFAULT NULL,
+     "${timeToLiveKey}"   TIMESTAMP WITH TIME ZONE DEFAULT NULL,
+
+     CONSTRAINT ${table}_pkey PRIMARY KEY ("id")
+   );
+   `;
+	return await client.query(sql);
+};
+
+export const truncate = async (client, table = name) => {
+	const sql = `
+    DELETE FROM ${table};
+  `;
+	return await client.query(sql);
+};
+
+export const drop = async (client, table = name) => {
+	const sql = `
+    DROP TABLE ${table};
+  `;
+	return await client.query(sql);
+};