@absolutejs/auth 0.26.0-beta.1 → 0.26.0-beta.3

package/dist/sso/config.d.ts

@@ -0,0 +1,104 @@
+import type { OAuth2TokenResponse, OIDCIdTokenClaims } from 'citra';
+import type { OrganizationId } from '../tenancy';
+import type { RouteString, UserSessionId } from '../types';
+import type { OidcConnection, SamlConnection, SSOConnectionStore } from './types';
+export declare const DEFAULT_SSO_ROUTE = "/sso";
+export declare const DEFAULT_SSO_SESSION_TTL_MS: number;
+export type SamlProfile = {
+    attributes: Record<string, unknown>;
+    email?: string;
+    nameId: string;
+    sessionIndex?: string;
+};
+type SamlAuthorizeRequest = {
+    acsUrl: string;
+    connection: SamlConnection;
+    relayState?: string;
+};
+type SamlAssertionRequest = {
+    acsUrl: string;
+    connection: SamlConnection;
+    relayState?: string;
+    samlResponse: string;
+};
+type SamlMetadataRequest = {
+    acsUrl: string;
+    connection: SamlConnection;
+};
+type SamlLogoutRequest = {
+    connection: SamlConnection;
+    nameId: string;
+    relayState?: string;
+    sessionIndex?: string;
+    sloUrl: string;
+};
+type SamlLogoutResponseRequest = {
+    connection: SamlConnection;
+    relayState?: string;
+    samlResponse: string;
+    sloUrl: string;
+};
+type SamlIdpLogoutRequest = {
+    connection: SamlConnection;
+    relayState?: string;
+    samlRequest: string;
+    sloUrl: string;
+};
+type SamlLogoutResponseAck = {
+    connection: SamlConnection;
+    inResponseTo?: string;
+    nameId?: string;
+    relayState?: string;
+    sloUrl: string;
+};
+export type SamlLogoutInfo = {
+    nameId?: string;
+    relayState?: string;
+    requestId?: string;
+    sessionIndex?: string;
+};
+export type SamlAdapter = {
+    createAuthorizationUrl: (request: SamlAuthorizeRequest) => Promise<string> | string;
+    createLogoutRequestUrl?: (request: SamlLogoutRequest) => Promise<string> | string;
+    createLogoutResponseUrl?: (request: SamlLogoutResponseAck) => Promise<string> | string;
+    getServiceProviderMetadata: (request: SamlMetadataRequest) => Promise<string> | string;
+    validateAssertion: (request: SamlAssertionRequest) => Promise<SamlProfile>;
+    validateLogoutRequest?: (request: SamlIdpLogoutRequest) => Promise<SamlLogoutInfo> | SamlLogoutInfo;
+    validateLogoutResponse?: (request: SamlLogoutResponseRequest) => Promise<void> | void;
+};
+type SsoIdentityBase = {
+    email?: string;
+    organizationId: OrganizationId;
+    sub: string;
+};
+export type OidcSsoIdentity = SsoIdentityBase & {
+    claims: OIDCIdTokenClaims;
+    connection: OidcConnection;
+    protocol: 'oidc';
+    tokenResponse: OAuth2TokenResponse;
+};
+export type SamlSsoIdentity = SsoIdentityBase & {
+    attributes: Record<string, unknown>;
+    connection: SamlConnection;
+    protocol: 'saml';
+    sessionIndex?: string;
+};
+export type SsoIdentity = OidcSsoIdentity | SamlSsoIdentity;
+export type SSOConfig<UserType> = {
+    getOrganizationByEmailDomain?: (domain: string) => OrganizationId | undefined | Promise<OrganizationId | undefined>;
+    getSsoUser: (identity: SsoIdentity) => Promise<UserType> | UserType;
+    onSsoCallbackError?: (context: {
+        error: unknown;
+        organizationId: string;
+    }) => void | Promise<void>;
+    onSsoCallbackSuccess?: (context: {
+        identity: SsoIdentity;
+        user: UserType;
+        userSessionId: UserSessionId;
+    }) => void | Promise<void>;
+    samlAdapter?: SamlAdapter;
+    sessionDurationMs?: number;
+    ssoConnectionStore: SSOConnectionStore;
+    ssoRoute?: RouteString;
+};
+export {};

package/dist/sso/discoveryRoute.d.ts

@@ -0,0 +1,63 @@
+import { Elysia } from 'elysia';
+import type { OrganizationId } from '../tenancy';
+import type { RouteString } from '../types';
+import type { SSOConnectionStore } from './types';
+type SsoDiscoveryProps = {
+    getOrganizationByEmailDomain: (domain: string) => OrganizationId | undefined | Promise<OrganizationId | undefined>;
+    ssoConnectionStore: SSOConnectionStore;
+    ssoRoute?: RouteString;
+};
+export declare const ssoDiscoveryRoute: ({ getOrganizationByEmailDomain, ssoConnectionStore, ssoRoute }: SsoDiscoveryProps) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: {
+                email?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                200: Response;
+                400: "An \"email\" query parameter is required" | "A valid email address is required";
+                404: "No SSO organization is configured for this email domain" | "No SSO connection is configured for this organization";
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};

package/dist/sso/inMemorySsoConnectionStore.d.ts

@@ -0,0 +1,2 @@
+import type { SSOConnectionStore } from './types';
+export declare const createInMemorySsoConnectionStore: () => SSOConnectionStore;

package/dist/sso/oidcRoutes.d.ts

@@ -0,0 +1,97 @@
+import { Elysia } from 'elysia';
+import type { AuthSessionStore } from '../session/types';
+import { type SSOConfig } from './config';
+type OidcRoutesProps<UserType> = SSOConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+};
+export declare const oidcSsoRoutes: <UserType>({ authSessionStore, getSsoUser, onSsoCallbackError, onSsoCallbackSuccess, sessionDurationMs, ssoConnectionStore, ssoRoute }: OidcRoutesProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                organizationId: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                404: "No OIDC connection is configured for this organization";
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                organizationId: string;
+            };
+            query: {
+                code?: string | undefined;
+                state?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                200: Response;
+                400: "SSO session cookies are missing" | "Invalid SSO callback request" | "SSO organization mismatch" | "OIDC token response is missing an id_token";
+                404: "No OIDC connection is configured for this organization";
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                500: "OIDC sign-in failed";
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};

package/dist/sso/postgresSsoConnectionStore.d.ts

@@ -0,0 +1,139 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { OidcConnectionConfig, SamlConnectionConfig, SSOConnectionStore, SSOConnectionType } from './types';
+export declare const ssoConnectionsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_sso_connections";
+    schema: undefined;
+    columns: {
+        config: import("drizzle-orm/pg-core").PgColumn<{
+            name: "config";
+            tableName: "auth_sso_connections";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: OidcConnectionConfig | SamlConnectionConfig;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: OidcConnectionConfig | SamlConnectionConfig;
+        }>;
+        connection_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "connection_id";
+            tableName: "auth_sso_connections";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at_ms";
+            tableName: "auth_sso_connections";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        enabled: import("drizzle-orm/pg-core").PgColumn<{
+            name: "enabled";
+            tableName: "auth_sso_connections";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        organization_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "organization_id";
+            tableName: "auth_sso_connections";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        type: import("drizzle-orm/pg-core").PgColumn<{
+            name: "type";
+            tableName: "auth_sso_connections";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: SSOConnectionType;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 16;
+            $type: SSOConnectionType;
+        }>;
+        updated_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at_ms";
+            tableName: "auth_sso_connections";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonSsoConnectionStore: (databaseUrl: string) => SSOConnectionStore;
+export declare const createPostgresSsoConnectionStore: (db: AnyPgDatabase) => SSOConnectionStore;

package/dist/sso/samlRoutes.d.ts

@@ -0,0 +1,176 @@
+import { Elysia } from 'elysia';
+import type { AuthSessionStore } from '../session/types';
+import type { SessionRecord } from '../types';
+import { type SamlAdapter, type SSOConfig } from './config';
+type SamlRoutesProps<UserType> = SSOConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+    samlAdapter: SamlAdapter;
+};
+export declare const samlSsoRoutes: <UserType>({ authSessionStore, getSsoUser, onSsoCallbackError, onSsoCallbackSuccess, samlAdapter, sessionDurationMs, ssoConnectionStore, ssoRoute }: SamlRoutesProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                organizationId: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                404: "No SAML connection is configured for this organization";
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                RelayState?: string | undefined;
+                SAMLResponse: string;
+            };
+            params: {
+                organizationId: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                404: "No SAML connection is configured for this organization";
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                500: "SAML sign-in failed";
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                organizationId: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                404: "No SAML connection is configured for this organization";
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                organizationId: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                organizationId: string;
+            };
+            query: {
+                RelayState?: string | undefined;
+                SAMLResponse?: string | undefined;
+                SAMLRequest?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                200: Response;
+                400: "Missing SAMLRequest or SAMLResponse" | "Invalid SAML LogoutRequest";
+                404: "No SAML connection is configured for this organization";
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                500: "SAML logout failed";
+                501: "SAML Single Logout is not configured";
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};

package/dist/sso/types.d.ts

@@ -0,0 +1,39 @@
+import type { OrganizationId } from '../tenancy';
+export type SSOConnectionType = 'oidc' | 'saml';
+export type OidcConnectionConfig = {
+    clientId: string;
+    clientSecret: string;
+    issuer: string;
+    redirectUri: string;
+    scopes: string[];
+};
+export type SamlConnectionConfig = {
+    idpEntityId: string;
+    idpSloUrl?: string;
+    idpSsoUrl: string;
+    idpX509Cert: string;
+};
+type SSOConnectionBase = {
+    connectionId: string;
+    createdAt: number;
+    enabled: boolean;
+    organizationId: OrganizationId;
+    updatedAt: number;
+};
+export type OidcConnection = SSOConnectionBase & {
+    config: OidcConnectionConfig;
+    type: 'oidc';
+};
+export type SamlConnection = SSOConnectionBase & {
+    config: SamlConnectionConfig;
+    type: 'saml';
+};
+export type SSOConnection = OidcConnection | SamlConnection;
+export type SSOConnectionStore = {
+    deleteConnection: (connectionId: string) => Promise<void>;
+    getConnection: (connectionId: string) => Promise<SSOConnection | undefined>;
+    getConnectionByOrganization: (organizationId: OrganizationId, type?: SSOConnectionType) => Promise<SSOConnection | undefined>;
+    listConnectionsByOrganization: (organizationId: OrganizationId) => Promise<SSOConnection[]>;
+    saveConnection: (connection: SSOConnection) => Promise<void>;
+};
+export {};

package/dist/stores/redis.d.ts

@@ -0,0 +1,5 @@
+export type RedisLike = {
+    del: (key: string) => Promise<unknown>;
+    get: (key: string) => Promise<string | null>;
+    set: (key: string, value: string, ttlMs: number) => Promise<unknown>;
+};

package/dist/typebox.d.ts

@@ -1,6 +1,6 @@
 export declare const authClientOption: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
 export declare const authIntentOption: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"login">, import("@sinclair/typebox").TLiteral<"link_identity">, import("@sinclair/typebox").TLiteral<"link_connector">]>>;
 export declare const authProviderOption: import("@sinclair/typebox").TEnum<{
-    [k: string]: "42" | "amazoncognito" | "anilist" | "apple" | "atlassian" | "auth0" | "authentik" | "autodesk" | "battlenet" | "bitbucket" | "box" | "bungie" | "coinbase" | "discord" | "donationalerts" | "dribbble" | "dropbox" | "epicgames" | "etsy" | "facebook" | "figma" | "gitea" | "github" | "gitlab" | "google" | "intuit" | "kakao" | "keycloak" | "kick" | "lichess" | "line" | "linear" | "linkedin" | "mastodon" | "mercadolibre" | "mercadopago" | "microsoftentraid" | "myanimelist" | "naver" | "notion" | "okta" | "osu" | "patreon" | "polar" | "polaraccesslink" | "polarteampro" | "reddit" | "roblox" | "salesforce" | "shikimori" | "slack" | "spotify" | "startgg" | "strava" | "synology" | "tiktok" | "tiltify" | "tumblr" | "twitch" | "twitter" | "vk" | "withings" | "workos" | "yahoo" | "yandex" | "zoom";
+    [k: string]: "42" | "amazoncognito" | "anilist" | "apple" | "atlassian" | "attio" | "auth0" | "authentik" | "autodesk" | "battlenet" | "bitbucket" | "box" | "bungie" | "close" | "coinbase" | "discord" | "donationalerts" | "dribbble" | "dropbox" | "epicgames" | "etsy" | "facebook" | "figma" | "gitea" | "github" | "gitlab" | "gohighlevel" | "google" | "hubspot" | "intuit" | "kakao" | "keycloak" | "kick" | "lichess" | "line" | "linear" | "linkedin" | "mastodon" | "mercadolibre" | "mercadopago" | "microsoftentraid" | "monday" | "myanimelist" | "naver" | "notion" | "okta" | "osu" | "patreon" | "pipedrive" | "polar" | "polaraccesslink" | "polarteampro" | "reddit" | "roblox" | "salesforce" | "shikimori" | "slack" | "spotify" | "startgg" | "strava" | "synology" | "tiktok" | "tiltify" | "tumblr" | "twitch" | "twitter" | "vk" | "withings" | "workos" | "yahoo" | "yandex" | "zoho" | "zoom";
 }>;
 export declare const userSessionIdTypebox: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TTemplateLiteralSyntax<"${string}-${string}-${string}-${string}-${string}">>;