@absolutejs/auth 0.25.1 → 0.26.0-beta.0

package/dist/audit/config.d.ts

@@ -0,0 +1,8 @@
+import type { AuditEvent, AuditSink } from './types';
+export type AuditConfig<UserType> = {
+    auditStore?: AuditSink;
+    getUserId?: (user: UserType) => string;
+    onAuditEvent?: (event: AuditEvent) => void | Promise<void>;
+};
+export type AuditEmitter = (event: AuditEvent) => Promise<void>;
+export declare const createAuditEmitter: <UserType>({ auditStore, onAuditEvent }: AuditConfig<UserType>) => (event: AuditEvent) => Promise<void>;

package/dist/audit/inMemoryAuditStore.d.ts

@@ -0,0 +1,2 @@
+import type { AuditSink } from './types';
+export declare const createInMemoryAuditSink: () => AuditSink;

package/dist/audit/postgresAuditStore.d.ts

@@ -0,0 +1,142 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { AuditSink } from './types';
+export declare const auditEventsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_audit_events";
+    schema: undefined;
+    columns: {
+        at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "at_ms";
+            tableName: "auth_audit_events";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "auth_audit_events";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        ip: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ip";
+            tableName: "auth_audit_events";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 64;
+        }>;
+        metadata_json: import("drizzle-orm/pg-core").PgColumn<{
+            name: "metadata_json";
+            tableName: "auth_audit_events";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        organization_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "organization_id";
+            tableName: "auth_audit_events";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        type: import("drizzle-orm/pg-core").PgColumn<{
+            name: "type";
+            tableName: "auth_audit_events";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 64;
+        }>;
+        user_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "auth_audit_events";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonAuditSink: (databaseUrl: string) => AuditSink;
+export declare const createPostgresAuditSink: (db: AnyPgDatabase) => AuditSink;

package/dist/audit/types.d.ts

@@ -0,0 +1,18 @@
+import type { OrganizationId } from '../tenancy';
+export type AuditEventType = 'credentials_login' | 'credentials_login_failed' | 'email_verified' | 'identity_conflict' | 'logout' | 'mfa_challenge' | 'mfa_challenge_failed' | 'mfa_enrolled' | 'oauth_login' | 'password_reset' | 'register' | 'scim_provision' | 'session_revoked' | 'sso_login' | 'token_refreshed' | 'token_revoked';
+export type AuditEvent = {
+    at: number;
+    ip?: string;
+    metadata?: Record<string, unknown>;
+    organizationId?: OrganizationId;
+    type: AuditEventType;
+    userId?: string;
+};
+export type AuditEventFilter = {
+    limit?: number;
+    userId?: string;
+};
+export type AuditSink = {
+    append: (event: AuditEvent) => Promise<void>;
+    list?: (filter?: AuditEventFilter) => Promise<AuditEvent[]>;
+};

package/dist/audit/wrap.d.ts

@@ -0,0 +1,9 @@
+import type { CredentialsConfig } from '../credentials/config';
+import type { MfaConfig } from '../mfa/config';
+import type { OnCallbackSuccess, OnRevocationSuccess, OnSignOut } from '../types';
+import type { AuditEmitter } from './config';
+export declare const composeCallbackAudit: <UserType>(onCallbackSuccess: OnCallbackSuccess<UserType>, emit: AuditEmitter) => (context: Parameters<NonNullable<OnCallbackSuccess<UserType>>>[0]) => Promise<void | Response | import("..").StatusReturn | undefined>;
+export declare const composeCredentialsAudit: <UserType>(credentials: CredentialsConfig<UserType>, emit: AuditEmitter, getUserId?: (user: UserType) => string) => CredentialsConfig<UserType>;
+export declare const composeMfaAudit: <UserType>(mfa: MfaConfig<UserType>, emit: AuditEmitter) => MfaConfig<UserType>;
+export declare const composeRevocationAudit: (onRevocationSuccess: OnRevocationSuccess, emit: AuditEmitter) => (context: Parameters<NonNullable<OnRevocationSuccess>>[0]) => Promise<void | undefined>;
+export declare const composeSignOutAudit: <UserType>(onSignOut: OnSignOut<UserType>, emit: AuditEmitter) => (context: Parameters<NonNullable<OnSignOut<UserType>>>[0]) => Promise<void | undefined>;

package/dist/credentials/config.d.ts

@@ -0,0 +1,61 @@
+import type { LockoutGuard } from '../lockout/config';
+import type { AuthSessionStore } from '../session/types';
+import type { OrganizationId } from '../tenancy';
+import type { RouteString, StatusReturn, UserSessionId } from '../types';
+import type { PasswordPolicy } from './passwordPolicy';
+import type { CredentialStore } from './types';
+export declare const DEFAULT_CREDENTIAL_SESSION_TTL_MS: number;
+export declare const DEFAULT_RESET_TOKEN_TTL_MS: number;
+export declare const DEFAULT_VERIFICATION_TOKEN_TTL_MS: number;
+export type CredentialIdentity = {
+    email: string;
+    organizationId?: OrganizationId;
+};
+export type CredentialEmailType = 'reset_password' | 'verify_email';
+export type CredentialEmailMessage = {
+    email: string;
+    expiresAt: number;
+    token: string;
+    type: CredentialEmailType;
+};
+export type CredentialsConfig<UserType> = {
+    credentialStore: CredentialStore;
+    getUserByEmail: (email: string) => Promise<UserType | null | undefined> | UserType | null | undefined;
+    isMfaRequired?: (user: UserType) => boolean | Promise<boolean>;
+    loginRoute?: RouteString;
+    onCreateCredentialUser: (identity: CredentialIdentity) => Promise<Response | StatusReturn | UserType> | Response | StatusReturn | UserType;
+    onCredentialsLoginError?: (context: {
+        email: string;
+        error: unknown;
+    }) => void | Promise<void>;
+    onCredentialsLoginSuccess?: (context: {
+        user: UserType;
+        userSessionId: UserSessionId;
+    }) => void | Promise<void>;
+    onEmailVerified?: (context: {
+        email: string;
+    }) => void | Promise<void>;
+    onPasswordReset?: (context: {
+        email: string;
+    }) => void | Promise<void>;
+    onRegistrationSuccess?: (context: {
+        email: string;
+        user: UserType;
+    }) => void | Promise<void>;
+    onSendEmail: (message: CredentialEmailMessage) => void | Promise<void>;
+    passwordPolicy?: PasswordPolicy;
+    registerRoute?: RouteString;
+    /** When true, registration creates the account but NOT a session, and login is
+     *  rejected until the email is verified. Default false = auto-login on register and
+     *  verification acts as a soft, later gate. */
+    requireEmailVerification?: boolean;
+    resetPasswordRoute?: RouteString;
+    resetTokenDurationMs?: number;
+    sessionDurationMs?: number;
+    verificationTokenDurationMs?: number;
+    verifyEmailRoute?: RouteString;
+};
+export type CredentialRouteProps<UserType> = CredentialsConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+    lockoutGuard?: LockoutGuard;
+};

package/dist/credentials/emailVerification.d.ts

@@ -0,0 +1,83 @@
+import { Elysia } from 'elysia';
+import { type CredentialsConfig } from './config';
+export declare const credentialsEmailVerification: <UserType>({ credentialStore, onEmailVerified, onSendEmail, verificationTokenDurationMs, verifyEmailRoute }: CredentialsConfig<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: {
+                token: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: {
+                    readonly status: "email_verified";
+                };
+                400: "Invalid or expired verification token";
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        request: {
+            post: {
+                body: {
+                    email: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        readonly status: "verification_requested";
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/credentials/inMemoryCredentialStore.d.ts

@@ -0,0 +1,2 @@
+import type { CredentialStore } from './types';
+export declare const createInMemoryCredentialStore: () => CredentialStore;

package/dist/credentials/login.d.ts

@@ -0,0 +1,75 @@
+import { Elysia } from 'elysia';
+import { type CredentialRouteProps } from './config';
+export declare const credentialsLogin: <UserType>({ authSessionStore, credentialStore, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, requireEmailVerification, sessionDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: {
+                email: string;
+                password: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: {
+                    readonly status: "mfa_required";
+                } | {
+                    readonly status: "authenticated";
+                };
+                401: "Invalid email or password";
+                403: {
+                    readonly status: "email_not_verified";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                429: {
+                    readonly retryAfterMs: number | undefined;
+                    readonly status: "account_locked";
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/credentials/passwordPolicy.d.ts

@@ -0,0 +1,14 @@
+export type PasswordPolicy = {
+    checkBreaches?: boolean;
+    minLength?: number;
+    requireDigit?: boolean;
+    requireLowercase?: boolean;
+    requireSymbol?: boolean;
+    requireUppercase?: boolean;
+};
+export type PasswordPolicyViolation = 'breached' | 'missing_digit' | 'missing_lowercase' | 'missing_symbol' | 'missing_uppercase' | 'too_short';
+export type PasswordPolicyResult = {
+    ok: boolean;
+    violations: PasswordPolicyViolation[];
+};
+export declare const evaluatePassword: (password: string, policy?: PasswordPolicy) => Promise<PasswordPolicyResult>;

package/dist/credentials/passwordReset.d.ts

@@ -0,0 +1,87 @@
+import { Elysia } from 'elysia';
+import { type CredentialsConfig } from './config';
+export declare const credentialsPasswordReset: <UserType>({ credentialStore, onPasswordReset, onSendEmail, passwordPolicy, resetPasswordRoute, resetTokenDurationMs }: CredentialsConfig<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        request: {
+            post: {
+                body: {
+                    email: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        readonly status: "reset_requested";
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                token: string;
+                password: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: {
+                    readonly status: "password_reset";
+                };
+                400: "Invalid or expired reset token" | {
+                    readonly message: "Password does not meet the policy";
+                    readonly violations: import("./passwordPolicy").PasswordPolicyViolation[];
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;