@absolutejs/auth 0.26.0-beta.2 → 0.26.0-beta.4

package/dist/scim/routes.d.ts

@@ -0,0 +1,296 @@
+import { Elysia } from 'elysia';
+import { type ScimConfig } from './config';
+export declare const scimRoutes: ({ getScimGroup, getScimUser, listScimGroups, listScimUsers, onScimGroupCreate, onScimGroupDelete, onScimGroupReplace, onScimUserCreate, onScimUserDeactivate, onScimUserReplace, scimRoute, scimTokenStore }: ScimConfig) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: {
+                filter?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        put: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        patch: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        delete: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: {
+                filter?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        put: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        patch: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        delete: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/scim/serialize.d.ts

@@ -0,0 +1,45 @@
+import type { ScimFilter, ScimGroup, ScimGroupInput, ScimUser, ScimUserInput } from './types';
+export declare const toUserResource: (user: ScimUser, location: string) => Record<string, unknown>;
+export declare const parseUserInput: (body: unknown) => ScimUserInput | undefined;
+export declare const applyPatch: (user: ScimUser, body: unknown) => ScimUserInput;
+export declare const listResponse: (resources: Record<string, unknown>[]) => {
+    itemsPerPage: number;
+    Resources: Record<string, unknown>[];
+    schemas: string[];
+    startIndex: number;
+    totalResults: number;
+};
+export declare const parseFilter: (filter: string | undefined) => ScimFilter | undefined;
+export declare const scimError: (httpStatus: number, detail: string, scimType?: string) => Response;
+export declare const scimJson: (resource: unknown, httpStatus: number) => Response;
+export declare const serviceProviderConfig: (location: string) => {
+    bulk: {
+        maxOperations: number;
+        maxPayloadSize: number;
+        supported: boolean;
+    };
+    changePassword: {
+        supported: boolean;
+    };
+    etag: {
+        supported: boolean;
+    };
+    filter: {
+        maxResults: number;
+        supported: boolean;
+    };
+    meta: {
+        location: string;
+        resourceType: string;
+    };
+    patch: {
+        supported: boolean;
+    };
+    schemas: string[];
+    sort: {
+        supported: boolean;
+    };
+};
+export declare const applyGroupPatch: (group: ScimGroup, body: unknown) => ScimGroupInput;
+export declare const parseGroupInput: (body: unknown) => ScimGroupInput | undefined;
+export declare const toGroupResource: (group: ScimGroup, location: string) => Record<string, unknown>;

package/dist/scim/types.d.ts

@@ -0,0 +1,52 @@
+import type { OrganizationId } from '../tenancy';
+export type ScimToken = {
+    createdAt: number;
+    hashedToken: string;
+    lastUsedAt?: number;
+    organizationId: OrganizationId;
+    tokenId: string;
+};
+export type ScimTokenStore = {
+    deleteToken: (tokenId: string) => Promise<void>;
+    findByHashedToken: (hashedToken: string) => Promise<ScimToken | undefined>;
+    listTokens: (organizationId: OrganizationId) => Promise<ScimToken[]>;
+    saveToken: (token: ScimToken) => Promise<void>;
+};
+export type ScimUser = {
+    active: boolean;
+    displayName?: string;
+    email?: string;
+    externalId?: string;
+    familyName?: string;
+    givenName?: string;
+    id: string;
+    userName: string;
+};
+export type ScimUserInput = {
+    active: boolean;
+    displayName?: string;
+    email?: string;
+    externalId?: string;
+    familyName?: string;
+    givenName?: string;
+    userName: string;
+};
+export type ScimGroupMember = {
+    display?: string;
+    value: string;
+};
+export type ScimGroup = {
+    displayName: string;
+    externalId?: string;
+    id: string;
+    members: ScimGroupMember[];
+};
+export type ScimGroupInput = {
+    displayName: string;
+    externalId?: string;
+    members: ScimGroupMember[];
+};
+export type ScimFilter = {
+    attribute: string;
+    value: string;
+};

package/dist/session/promote.d.ts

@@ -1,13 +1,20 @@
 import type { Cookie } from 'elysia';
-import type { SessionRecord, UserSessionId } from '../types';
+import type { SessionData, SessionRecord, UserSessionId } from '../types';
 import type { AuthSessionStore } from './types';
+type ClearSessionProps<UserType> = {
+    authSessionStore?: AuthSessionStore<UserType>;
+    cookie: Cookie<UserSessionId | undefined>;
+    inMemorySession: SessionRecord<UserType>;
+};
+export declare const clearSession: <UserType>({ authSessionStore, cookie, inMemorySession }: ClearSessionProps<UserType>) => Promise<void>;
 export declare const persistWhen: (shouldPersist: boolean, persist: () => Promise<void>) => Promise<void>;
 type PromoteToSessionProps<UserType> = {
     authSessionStore?: AuthSessionStore<UserType>;
     cookie: Cookie<UserSessionId | undefined>;
     inMemorySession: SessionRecord<UserType>;
+    samlLogout?: SessionData<UserType>['samlLogout'];
     sessionDurationMs: number;
     user: UserType;
 };
-export declare const promoteToSession: <UserType>({ authSessionStore, cookie, inMemorySession, sessionDurationMs, user }: PromoteToSessionProps<UserType>) => Promise<`${string}-${string}-${string}-${string}-${string}`>;
+export declare const promoteToSession: <UserType>({ authSessionStore, cookie, inMemorySession, samlLogout, sessionDurationMs, user }: PromoteToSessionProps<UserType>) => Promise<`${string}-${string}-${string}-${string}-${string}`>;
 export {};

package/dist/sso/config.d.ts

@@ -0,0 +1,104 @@
+import type { OAuth2TokenResponse, OIDCIdTokenClaims } from 'citra';
+import type { OrganizationId } from '../tenancy';
+import type { RouteString, UserSessionId } from '../types';
+import type { OidcConnection, SamlConnection, SSOConnectionStore } from './types';
+export declare const DEFAULT_SSO_ROUTE = "/sso";
+export declare const DEFAULT_SSO_SESSION_TTL_MS: number;
+export type SamlProfile = {
+    attributes: Record<string, unknown>;
+    email?: string;
+    nameId: string;
+    sessionIndex?: string;
+};
+type SamlAuthorizeRequest = {
+    acsUrl: string;
+    connection: SamlConnection;
+    relayState?: string;
+};
+type SamlAssertionRequest = {
+    acsUrl: string;
+    connection: SamlConnection;
+    relayState?: string;
+    samlResponse: string;
+};
+type SamlMetadataRequest = {
+    acsUrl: string;
+    connection: SamlConnection;
+};
+type SamlLogoutRequest = {
+    connection: SamlConnection;
+    nameId: string;
+    relayState?: string;
+    sessionIndex?: string;
+    sloUrl: string;
+};
+type SamlLogoutResponseRequest = {
+    connection: SamlConnection;
+    relayState?: string;
+    samlResponse: string;
+    sloUrl: string;
+};
+type SamlIdpLogoutRequest = {
+    connection: SamlConnection;
+    relayState?: string;
+    samlRequest: string;
+    sloUrl: string;
+};
+type SamlLogoutResponseAck = {
+    connection: SamlConnection;
+    inResponseTo?: string;
+    nameId?: string;
+    relayState?: string;
+    sloUrl: string;
+};
+export type SamlLogoutInfo = {
+    nameId?: string;
+    relayState?: string;
+    requestId?: string;
+    sessionIndex?: string;
+};
+export type SamlAdapter = {
+    createAuthorizationUrl: (request: SamlAuthorizeRequest) => Promise<string> | string;
+    createLogoutRequestUrl?: (request: SamlLogoutRequest) => Promise<string> | string;
+    createLogoutResponseUrl?: (request: SamlLogoutResponseAck) => Promise<string> | string;
+    getServiceProviderMetadata: (request: SamlMetadataRequest) => Promise<string> | string;
+    validateAssertion: (request: SamlAssertionRequest) => Promise<SamlProfile>;
+    validateLogoutRequest?: (request: SamlIdpLogoutRequest) => Promise<SamlLogoutInfo> | SamlLogoutInfo;
+    validateLogoutResponse?: (request: SamlLogoutResponseRequest) => Promise<void> | void;
+};
+type SsoIdentityBase = {
+    email?: string;
+    organizationId: OrganizationId;
+    sub: string;
+};
+export type OidcSsoIdentity = SsoIdentityBase & {
+    claims: OIDCIdTokenClaims;
+    connection: OidcConnection;
+    protocol: 'oidc';
+    tokenResponse: OAuth2TokenResponse;
+};
+export type SamlSsoIdentity = SsoIdentityBase & {
+    attributes: Record<string, unknown>;
+    connection: SamlConnection;
+    protocol: 'saml';
+    sessionIndex?: string;
+};
+export type SsoIdentity = OidcSsoIdentity | SamlSsoIdentity;
+export type SSOConfig<UserType> = {
+    getOrganizationByEmailDomain?: (domain: string) => OrganizationId | undefined | Promise<OrganizationId | undefined>;
+    getSsoUser: (identity: SsoIdentity) => Promise<UserType> | UserType;
+    onSsoCallbackError?: (context: {
+        error: unknown;
+        organizationId: string;
+    }) => void | Promise<void>;
+    onSsoCallbackSuccess?: (context: {
+        identity: SsoIdentity;
+        user: UserType;
+        userSessionId: UserSessionId;
+    }) => void | Promise<void>;
+    samlAdapter?: SamlAdapter;
+    sessionDurationMs?: number;
+    ssoConnectionStore: SSOConnectionStore;
+    ssoRoute?: RouteString;
+};
+export {};

package/dist/sso/discoveryRoute.d.ts

@@ -0,0 +1,63 @@
+import { Elysia } from 'elysia';
+import type { OrganizationId } from '../tenancy';
+import type { RouteString } from '../types';
+import type { SSOConnectionStore } from './types';
+type SsoDiscoveryProps = {
+    getOrganizationByEmailDomain: (domain: string) => OrganizationId | undefined | Promise<OrganizationId | undefined>;
+    ssoConnectionStore: SSOConnectionStore;
+    ssoRoute?: RouteString;
+};
+export declare const ssoDiscoveryRoute: ({ getOrganizationByEmailDomain, ssoConnectionStore, ssoRoute }: SsoDiscoveryProps) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: {
+                email?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                200: Response;
+                400: "An \"email\" query parameter is required" | "A valid email address is required";
+                404: "No SSO organization is configured for this email domain" | "No SSO connection is configured for this organization";
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};

package/dist/sso/inMemorySsoConnectionStore.d.ts

@@ -0,0 +1,2 @@
+import type { SSOConnectionStore } from './types';
+export declare const createInMemorySsoConnectionStore: () => SSOConnectionStore;

package/dist/sso/oidcRoutes.d.ts

@@ -0,0 +1,97 @@
+import { Elysia } from 'elysia';
+import type { AuthSessionStore } from '../session/types';
+import { type SSOConfig } from './config';
+type OidcRoutesProps<UserType> = SSOConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+};
+export declare const oidcSsoRoutes: <UserType>({ authSessionStore, getSsoUser, onSsoCallbackError, onSsoCallbackSuccess, sessionDurationMs, ssoConnectionStore, ssoRoute }: OidcRoutesProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                organizationId: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                404: "No OIDC connection is configured for this organization";
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                organizationId: string;
+            };
+            query: {
+                code?: string | undefined;
+                state?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                200: Response;
+                400: "SSO session cookies are missing" | "Invalid SSO callback request" | "SSO organization mismatch" | "OIDC token response is missing an id_token";
+                404: "No OIDC connection is configured for this organization";
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                500: "OIDC sign-in failed";
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};