@absolutejs/auth 0.25.1 → 0.26.0-beta.0

package/dist/session/userSessions.d.ts

@@ -0,0 +1,16 @@
+import type { SessionData, UserSessionId } from '../types';
+import type { AuthSessionStore } from './types';
+export type UserSession<UserType> = {
+    id: UserSessionId;
+    session: SessionData<UserType>;
+};
+type ListUserSessionsProps<UserType> = {
+    authSessionStore: AuthSessionStore<UserType>;
+    getUserId: (user: UserType) => string;
+    userId: string;
+};
+export declare const listUserSessions: <UserType>({ authSessionStore, getUserId, userId }: ListUserSessionsProps<UserType>) => Promise<UserSession<UserType>[]>;
+export declare const revokeUserSessions: <UserType>({ authSessionStore, exceptSessionId, getUserId, userId }: ListUserSessionsProps<UserType> & {
+    exceptSessionId?: UserSessionId;
+}) => Promise<number>;
+export {};

package/dist/stores/postgres.d.ts

@@ -0,0 +1,5 @@
+import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
+export type AnyPgDatabase = PgDatabase<PgQueryResultHKT>;
+export declare const createNeonDatabase: (databaseUrl: string) => import("drizzle-orm/neon-http").NeonHttpDatabase<Record<string, never>> & {
+    $client: import("@neondatabase/serverless").NeonQueryFunction<false, false>;
+};

package/dist/tenancy.d.ts

@@ -0,0 +1,9 @@
+export type OrganizationId = string;
+export type WithOrganization<Resource> = Resource & {
+    organizationId?: OrganizationId;
+};
+export declare const hasOrganizationScope: (value: {
+    organizationId?: OrganizationId;
+}) => value is {
+    organizationId: OrganizationId;
+};

package/dist/typeGuards.d.ts

@@ -1,6 +1,6 @@
 import { AuthIntent, StatusReturn, UserSessionId } from './types';
 export declare const isValidUser: <UserType>(user: unknown) => user is UserType;
-export declare const isUserSessionId: (key: string) => key is UserSessionId;
+export declare const isAuthIntent: (value: unknown) => value is AuthIntent;
 export declare const isNonEmptyString: (str: string | null | undefined) => str is string;
 export declare const isStatusResponse: (value: unknown) => value is StatusReturn;
-export declare const isAuthIntent: (value: unknown) => value is AuthIntent;
+export declare const isUserSessionId: (key: string) => key is UserSessionId;

package/dist/typebox.d.ts

@@ -1,6 +1,6 @@
-export declare const userSessionIdTypebox: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TTemplateLiteralSyntax<"${string}-${string}-${string}-${string}-${string}">>;
+export declare const authClientOption: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+export declare const authIntentOption: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"login">, import("@sinclair/typebox").TLiteral<"link_identity">, import("@sinclair/typebox").TLiteral<"link_connector">]>>;
 export declare const authProviderOption: import("@sinclair/typebox").TEnum<{
     [k: string]: "42" | "amazoncognito" | "anilist" | "apple" | "atlassian" | "auth0" | "authentik" | "autodesk" | "battlenet" | "bitbucket" | "box" | "bungie" | "coinbase" | "discord" | "donationalerts" | "dribbble" | "dropbox" | "epicgames" | "etsy" | "facebook" | "figma" | "gitea" | "github" | "gitlab" | "google" | "intuit" | "kakao" | "keycloak" | "kick" | "lichess" | "line" | "linear" | "linkedin" | "mastodon" | "mercadolibre" | "mercadopago" | "microsoftentraid" | "myanimelist" | "naver" | "notion" | "okta" | "osu" | "patreon" | "polar" | "polaraccesslink" | "polarteampro" | "reddit" | "roblox" | "salesforce" | "shikimori" | "slack" | "spotify" | "startgg" | "strava" | "synology" | "tiktok" | "tiltify" | "tumblr" | "twitch" | "twitter" | "vk" | "withings" | "workos" | "yahoo" | "yandex" | "zoom";
 }>;
-export declare const authClientOption: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
-export declare const authIntentOption: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"login">, import("@sinclair/typebox").TLiteral<"link_identity">, import("@sinclair/typebox").TLiteral<"link_connector">]>>;
+export declare const userSessionIdTypebox: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TTemplateLiteralSyntax<"${string}-${string}-${string}-${string}-${string}">>;

package/dist/types.d.ts

@@ -1,9 +1,14 @@
 import { CredentialsFor, NonEmptyArray, OAuth2Client, OAuth2TokenResponse, ProviderOption, ProvidersMap } from 'citra';
 import { Cookie, status as statusType, redirect as redirectType } from 'elysia';
 import { ElysiaCustomStatusResponse } from 'elysia/error';
+import type { AuditConfig } from './audit/config';
+import type { CredentialsConfig } from './credentials/config';
 import type { AuthIdentityConflict } from './errors';
-import type { AuthSessionStore } from './sessionTypes';
-import type { AuthHtmxConfig, AuthHtmxUser } from './ui/types';
+import type { AuthHtmxConfig, AuthHtmxUser } from './htmx/types';
+import type { LockoutConfig } from './lockout/config';
+import type { MfaConfig } from './mfa/config';
+import type { SessionsConfig } from './session/sessionsConfig';
+import type { AuthSessionStore } from './session/types';
 export type AuthIntent = 'login' | 'link_identity' | 'link_connector';
 export type OAuth2ProviderClientConfiguration<Provider extends ProviderOption> = {
     credentials: CredentialsFor<Provider>;
@@ -20,9 +25,15 @@ export type OAuth2ConfigurationOptions = {
 export type UserSessionId = `${string}-${string}-${string}-${string}-${string}`;
 export type SessionData<UserType> = {
     user: UserType;
-    accessToken: string;
+    /** OAuth provider access token. Optional: credential / SSO sessions are not backed
+     *  by a provider token, so they omit it. Only the OAuth routes (profile, refresh,
+     *  revoke) read it, and they are all gated on an `auth_provider`. */
+    accessToken?: string;
     refreshToken?: string;
     expiresAt: number;
+    /** When the session was last established by an actual authentication (login, OAuth
+     *  callback, or MFA challenge — NOT a token refresh). Drives step-up `requireRecentAuth`. */
+    authenticatedAt?: number;
 };
 export type SessionRecord<UserType> = Record<UserSessionId, SessionData<UserType>>;
 export type UnregisteredSessionData = {
@@ -151,6 +162,25 @@ export type AuthConfig<UserType> = {
     maxSessions?: number;
     sessionDurationMs?: number;
     authSessionStore?: AuthSessionStore<UserType>;
+    /** Append-only audit logging. When present, `auth()` emits structured events
+     *  (register, login, mfa_*, password_reset, logout, …) from every flow into the
+     *  `auditStore` and/or `onAuditEvent` hook. SOC 2 prerequisite. */
+    audit?: AuditConfig<UserType>;
+    /** Local email/password (credentials) block. Additive and optional — when present,
+     *  mounts register / verify-email / login / reset-password routes that produce the
+     *  same `SessionData<UserType>` as OAuth, transparent to `protectRoute`. */
+    credentials?: CredentialsConfig<UserType>;
+    /** Multi-factor auth (TOTP + backup codes). When present alongside `credentials`,
+     *  `auth()` auto-wires the login MFA gate, mounts the enroll/challenge routes, and
+     *  promotes the parked session once a factor is verified. */
+    mfa?: MfaConfig<UserType>;
+    /** Per-identity attempt throttling + account lockout on the credential login route
+     *  (progressive: locks after `maxAttempts` failures within `windowMs`). */
+    lockout?: LockoutConfig;
+    /** Self-service session management: `GET /auth/sessions` (list the caller's active
+     *  sessions) and `DELETE /auth/sessions/:id` (remote revoke). Requires an
+     *  `authSessionStore` that can enumerate sessions. */
+    sessions?: SessionsConfig<UserType>;
     /** Enable the built-in HTMX fragment routes (login, identities, connectors,
      *  account, signout, delete-account). Supply provider display data + the
      *  identity/connector data actions; the package owns the route wiring and

package/dist/utils.d.ts

@@ -1,15 +1,7 @@
 import { OAuth2Client, OAuth2TokenResponse, ProviderOption } from 'citra';
 import { Cookie } from 'elysia';
+import { AuthHtmxConfig } from './htmx/types';
 import { AuthConfig, InsantiateUserSessionProps, OAuth2ConfigurationOptions, ResolvedOAuthAuthorization, SessionRecord, UnregisteredSessionRecord, UserSessionId } from './types';
-import { AuthHtmxConfig } from './ui/types';
-export declare const resolveOAuthTokenExpiresAt: (tokenResponse: OAuth2TokenResponse, now?: number) => number | undefined;
-export declare const resolveOAuthAuthorization: ({ authProvider, providerInstance, tokenResponse, now }: {
-    authProvider: ProviderOption;
-    providerInstance: OAuth2Client<ProviderOption>;
-    tokenResponse: OAuth2TokenResponse;
-    now?: number;
-}) => Promise<ResolvedOAuthAuthorization>;
-export declare const instantiateUserSession: <UserType>({ authProvider, session, user_session_id, unregisteredSession, tokenResponse, providerInstance, getUser, onNewUser, resolvedAuthorization, sessionDurationMs, unregisteredSessionDurationMs }: InsantiateUserSessionProps<UserType>) => Promise<import("./types").StatusReturn | Response | undefined>;
 export declare const defineAuthConfig: <UserType>(configuration: AuthConfig<UserType>) => AuthConfig<UserType>;
 export declare const defineAuthHtmxConfig: (htmxConfig: AuthHtmxConfig) => AuthHtmxConfig;
 export declare const defineProvidersConfiguration: (providersConfiguration: OAuth2ConfigurationOptions) => OAuth2ConfigurationOptions;
@@ -23,6 +15,14 @@ export declare const getStatus: <UserType>(session: SessionRecord<UserType>, use
     error: null;
     user: NonNullable<UserType> | null;
 }>;
+export declare const instantiateUserSession: <UserType>({ authProvider, session, user_session_id, unregisteredSession, tokenResponse, providerInstance, getUser, onNewUser, resolvedAuthorization, sessionDurationMs, unregisteredSessionDurationMs }: InsantiateUserSessionProps<UserType>) => Promise<Response | import("./types").StatusReturn | undefined>;
+export declare const resolveOAuthAuthorization: ({ authProvider, providerInstance, tokenResponse, now }: {
+    authProvider: ProviderOption;
+    providerInstance: OAuth2Client<ProviderOption>;
+    tokenResponse: OAuth2TokenResponse;
+    now?: number;
+}) => Promise<ResolvedOAuthAuthorization>;
+export declare const resolveOAuthTokenExpiresAt: (tokenResponse: OAuth2TokenResponse, now?: number) => number | undefined;
 type ValidateSessionProps<SessionType extends Record<string, unknown> & {
     expiresAt: number;
 }> = {

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.25.1",
+	"version": "0.26.0-beta.0",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {
@@ -10,11 +10,11 @@
 	"license": "CC BY-NC 4.0",
 	"author": "Alex Kahn",
 	"scripts": {
-		"build": "rm -rf dist && bun build src/index.ts src/ui/index.ts --outdir dist --sourcemap --target=bun --external elysia && tsc --emitDeclarationOnly --project tsconfig.json",
-		"test": "echo \"Error: no test specified\" && exit 1",
-		"format": "prettier --write \"./**/*.{js,jsx,ts,tsx,css,json}\"",
-		"lint": "eslint ./src ./eslint.config.mjs",
-		"typecheck": "bun run tsc --noEmit",
+		"build": "rm -rf dist && bun build src/index.ts src/htmx/index.ts --outdir dist --sourcemap --target=bun --external elysia && tsc --emitDeclarationOnly --project tsconfig.json",
+		"test": "bun test",
+		"format": "absolute prettier --write",
+		"lint": "absolute eslint",
+		"typecheck": "absolute typecheck",
 		"release": "bun run format && bun run build && bun publish"
 	},
 	"keywords": [
@@ -35,17 +35,20 @@
 		"drizzle-orm": "0.41.0"
 	},
 	"devDependencies": {
-		"@stylistic/eslint-plugin-ts": "4.2.0",
+		"@absolutejs/absolute": "^0.19.0-beta.1023",
+		"@eslint/js": "^10.0.1",
+		"@stylistic/eslint-plugin": "^5.10.0",
 		"@types/bun": "1.2.9",
+		"@typescript-eslint/parser": "^8.57.2",
 		"elysia": "1.4.26",
-		"eslint": "9.26.0",
-		"eslint-plugin-absolute": "0.0.3",
-		"eslint-plugin-import": "2.31.0",
-		"eslint-plugin-promise": "7.2.1",
-		"eslint-plugin-security": "3.0.1",
+		"eslint": "^10.1.0",
+		"eslint-plugin-absolute": "^0.11.0",
+		"eslint-plugin-promise": "^7.2.1",
+		"eslint-plugin-security": "^4.0.0",
+		"globals": "^17.4.0",
 		"prettier": "3.5.3",
 		"typescript": "5.8.3",
-		"typescript-eslint": "8.32.0"
+		"typescript-eslint": "^8.57.2"
 	},
 	"module": "./dist/index.js",
 	"exports": {
@@ -53,9 +56,9 @@
 			"import": "./dist/index.js",
 			"types": "./dist/index.d.ts"
 		},
-		"./ui": {
-			"import": "./dist/ui/index.js",
-			"types": "./dist/ui/index.d.ts"
+		"./htmx": {
+			"import": "./dist/htmx/index.js",
+			"types": "./dist/htmx/index.d.ts"
 		}
 	},
 	"type": "module",