@9in-io/sdk 0.1.0 → 0.1.1

package/README.md

@@ -90,10 +90,18 @@ import { ManagementClient } from "@9in-io/sdk/server";
 const nine = new ManagementClient({ issuer, clientId, clientSecret }); // app with management scopes
 await nine.createUser({ email: "jane@acme.com", password: "…", emailVerified: true });
 await nine.blockUser(userId);
+const { user } = await nine.findUser("phone", "+447700900000"); // or "email", "username"
+
+// Sessions: list them, end one (its sid), or sign the user out everywhere
+const { sessions } = await nine.listUserSessions(userId);
+await nine.revokeSession(sessions[0].sid);
 await nine.revokeUserSessions(userId);
 
 // Single-use sign-in link (magic links, moving a signed-in user from your app to 9in)
 const { url } = await nine.createLoginLink(userId, { returnTo: "https://app.acme.com/callback", ttlSeconds: 600 });
+
+// Bulk import (500 per call): old ids, password hashes (bcrypt, argon2, PBKDF2, Firebase scrypt), social identities
+const { results } = await nine.importUsers([{ id: "auth0|42", email: "jane@acme.com", passwordHash: "$2b$10$…" }], { onConflict: "skip", source: "auth0" });
 ```
 
 ## Keep users in your own database (adapter)

package/dist/index.js

@@ -107,17 +107,24 @@ export class NineAuth {
             throw new NineError("invalid_issuer", `unexpected issuer ${iss}`);
         const config = await discover(this.issuer, this.fetcher);
         const tokens = await postForm(config.token_endpoint, { grant_type: "authorization_code", code, redirect_uri: this.options.redirectUri, client_id: this.options.clientId, code_verifier: pending.verifier }, {}, this.fetcher);
-        const set = this.store(tokens);
-        if (set.idToken) {
+        if (typeof tokens.id_token === "string") {
             // The ID token came straight from the token endpoint over TLS (OIDC Core 3.1.3.7):
             // its claims are checked; the signature check is for servers (verifyAccessToken).
-            const { payload } = decodeJwt(set.idToken);
+            // Checked before anything is stored, so a refused sign-in leaves no tokens behind.
+            let payload;
+            try {
+                payload = decodeJwt(tokens.id_token).payload;
+            }
+            catch {
+                throw new NineError("invalid_id_token", "malformed ID token");
+            }
             const aud = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
             if (!aud.includes(this.options.clientId))
                 throw new NineError("invalid_id_token", "audience mismatch");
             if (payload.nonce !== pending.nonce)
                 throw new NineError("invalid_id_token", "nonce mismatch");
         }
+        this.store(tokens);
         if (typeof window !== "undefined" && window.history && url === window.location.href) {
             for (const p of ["code", "state", "iss", "session_state"])
                 current.searchParams.delete(p);

package/dist/server.d.ts

@@ -108,6 +108,68 @@ export interface ManagedUser {
     lastLoginAt: number | null;
     [field: string]: unknown;
 }
+/** An active sign-in session (`sid` is the `sid` claim of its tokens). Times are ms since epoch. */
+export interface ManagedSession {
+    sid: string;
+    userId: string;
+    authTime: number;
+    amr: string[];
+    ip: string;
+    userAgent: string;
+    createdAt: number;
+    lastSeenAt: number;
+    expiresAt: number;
+    revokedAt: number | null;
+}
+/** One record for `importUsers`: the fields of `createUser` plus what an import may carry over. */
+export interface ImportUser {
+    /** Keep the id from your old system (letters, digits and | _ . : @ + -, max 128). */
+    id?: string;
+    email?: string | null;
+    emailVerified?: boolean;
+    /** E.164, e.g. +447700900000. */
+    phone?: string | null;
+    phoneVerified?: boolean;
+    username?: string | null;
+    name?: string | null;
+    given_name?: string | null;
+    family_name?: string | null;
+    picture?: string | null;
+    locale?: string | null;
+    zoneinfo?: string | null;
+    birthdate?: string | null;
+    metadata?: Record<string, unknown>;
+    blocked?: boolean;
+    /** A plain password (at most 50 such records per call), or `passwordHash` from your old system. */
+    password?: string;
+    /** bcrypt, argon2, PBKDF2 or Firebase scrypt hash: users keep their password. */
+    passwordHash?: string;
+    /** Linked sign-ins, e.g. { connection: "social:google", subject: "1069…" }. */
+    identities?: {
+        connection: string;
+        subject: string;
+    }[];
+    /** ms since epoch */
+    createdAt?: number;
+    lastLoginAt?: number;
+}
+/** Fields of a new user (`createUser`, `updateUser`). */
+export type NewUser = Omit<ImportUser, "id" | "identities" | "createdAt" | "lastLoginAt">;
+export type ImportResult = {
+    index: number;
+    ok: boolean;
+} & ({
+    status: "created" | "updated";
+    id: string;
+} | {
+    status: "skipped";
+    id: string;
+    reason: string;
+} | {
+    status: "failed";
+    error: string;
+    details?: unknown;
+});
 export declare class ManagementClient {
     private readonly options;
     /** One token per scope: each call asks only for what it needs, so an app granted some scopes works. */
@@ -131,17 +193,24 @@ export declare class ManagementClient {
     findUserByEmail(email: string): Promise<{
         user: ManagedUser;
     }>;
-    createUser(input: {
-        email?: string;
-        phone?: string;
-        username?: string;
-        password?: string;
-        name?: string;
-        emailVerified?: boolean;
-        metadata?: Record<string, unknown>;
-    }): Promise<{
+    /** Looks a user up by email, phone (E.164) or username; throws `not_found` (404) when unknown. */
+    findUser(type: "email" | "phone" | "username", value: string): Promise<{
+        user: ManagedUser;
+    }>;
+    createUser(input: NewUser): Promise<{
         user: ManagedUser;
     }>;
+    /**
+     * Bulk import, up to 500 users per call. Records may keep their old id and carry password
+     * hashes (bcrypt, argon2, PBKDF2, Firebase scrypt), social identities and original dates.
+     * Results are per record, in order; one bad record does not stop the others.
+     */
+    importUsers(users: ImportUser[], options?: {
+        onConflict?: "skip" | "update";
+        source?: string;
+    }): Promise<{
+        results: ImportResult[];
+    }>;
     updateUser(id: string, input: Record<string, unknown>): Promise<{
         user: ManagedUser;
     }>;
@@ -161,9 +230,16 @@ export declare class ManagementClient {
         url: string;
         expires_at: number;
     }>;
+    /** The user's active sessions, most recently used first. */
+    listUserSessions(id: string): Promise<{
+        sessions: ManagedSession[];
+    }>;
+    /** Signs the user out everywhere; returns how many sessions ended. */
     revokeUserSessions(id: string): Promise<{
         revoked: number;
     }>;
+    /** Ends one session (its `sid`) and every token issued under it. */
+    revokeSession(sid: string): Promise<void>;
 }
 export interface AdapterIdentifier {
     type: "email" | "username" | "phone";

package/dist/server.js

@@ -293,11 +293,27 @@ export class ManagementClient {
         return this.request("GET", `/users/${encodeURIComponent(id)}`);
     }
     findUserByEmail(email) {
-        return this.request("GET", `/users/lookup?email=${encodeURIComponent(email)}`);
+        return this.findUser("email", email);
+    }
+    /** Looks a user up by email, phone (E.164) or username; throws `not_found` (404) when unknown. */
+    findUser(type, value) {
+        return this.request("GET", `/users/lookup?${type}=${encodeURIComponent(value)}`);
     }
     createUser(input) {
         return this.request("POST", "/users", input);
     }
+    /**
+     * Bulk import, up to 500 users per call. Records may keep their old id and carry password
+     * hashes (bcrypt, argon2, PBKDF2, Firebase scrypt), social identities and original dates.
+     * Results are per record, in order; one bad record does not stop the others.
+     */
+    importUsers(users, options = {}) {
+        return this.request("POST", "/users/import", {
+            users,
+            ...(options.onConflict ? { on_conflict: options.onConflict } : {}),
+            ...(options.source ? { source: options.source } : {}),
+        });
+    }
     updateUser(id, input) {
         return this.request("PATCH", `/users/${encodeURIComponent(id)}`, input);
     }
@@ -318,9 +334,18 @@ export class ManagementClient {
             ...(options.ttlSeconds ? { ttl_seconds: options.ttlSeconds } : {}),
         });
     }
+    /** The user's active sessions, most recently used first. */
+    listUserSessions(id) {
+        return this.request("GET", `/users/${encodeURIComponent(id)}/sessions`);
+    }
+    /** Signs the user out everywhere; returns how many sessions ended. */
     revokeUserSessions(id) {
         return this.request("DELETE", `/users/${encodeURIComponent(id)}/sessions`);
     }
+    /** Ends one session (its `sid`) and every token issued under it. */
+    revokeSession(sid) {
+        return this.request("DELETE", `/sessions/${encodeURIComponent(sid)}`);
+    }
 }
 const SIGNATURE_HEADER = "9in-signature";
 async function hmac(secret, payload) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@9in-io/sdk",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Official 9in SDK: browser sign-in with PKCE, token verification, Management API client and adapter handler. Zero dependencies; runs in browsers, Node 18+, Cloudflare Workers, Deno and Bun.",
   "license": "MIT",
   "type": "module",