@absolutejs/auth 0.26.0-beta.3 → 0.26.0-beta.5

package/dist/organizations/routes.d.ts

@@ -0,0 +1,299 @@
+import { Elysia } from 'elysia';
+import type { SessionRecord } from '../types';
+import { type OrganizationsRouteProps } from './config';
+export declare const organizationRoutes: <UserType>({ authSessionStore, canCreateOrganization, canManageMembers, emit, getUserId, invitationDurationMs, onMembershipAdded, onMembershipRemoved, onOrganizationCreated, onSendInvitation, organizationsRoute, organizationStore, ownerRoles }: OrganizationsRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: {
+                    readonly organizations: {
+                        membership: import("./types").OrganizationMembership;
+                        organization: import("./types").Organization | undefined;
+                    }[];
+                };
+                401: "Authentication required";
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                metadata?: {} | undefined;
+                name: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: {
+                    readonly organization: import("./types").Organization;
+                };
+                401: "Authentication required";
+                403: "Cannot create organizations";
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":organizationId": {
+            invitations: {
+                post: {
+                    body: {
+                        roles?: string[] | undefined;
+                        email: string;
+                    };
+                    params: {
+                        organizationId: string;
+                    };
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: {
+                            readonly invitationId: string;
+                            readonly token: string;
+                        };
+                        401: "Authentication required";
+                        403: "Cannot manage members";
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":organizationId": {
+            invitations: {
+                get: {
+                    body: unknown;
+                    params: {
+                        organizationId: string;
+                    };
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: {
+                            readonly invitations: {
+                                email: string;
+                                expiresAt: number;
+                                invitationId: string;
+                                roles: string[];
+                                state: import("./types").InvitationState;
+                            }[];
+                        };
+                        401: "Authentication required";
+                        403: "Cannot manage members";
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":organizationId": {
+            invitations: {
+                ":invitationId": {
+                    delete: {
+                        body: unknown;
+                        params: {
+                            organizationId: string;
+                            invitationId: string;
+                        };
+                        query: unknown;
+                        headers: unknown;
+                        response: {
+                            200: {
+                                readonly revoked: string;
+                            };
+                            401: "Authentication required";
+                            403: "Cannot manage members";
+                            404: "Invitation not found";
+                            422: {
+                                type: "validation";
+                                on: string;
+                                summary?: string;
+                                message?: string;
+                                found?: unknown;
+                                property?: string;
+                                expected?: string;
+                            };
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        invitations: {
+            accept: {
+                post: {
+                    body: {
+                        token: string;
+                    };
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: {
+                            readonly organizationId: string;
+                            readonly roles: string[];
+                        };
+                        400: "Invalid or expired invitation";
+                        401: "Authentication required";
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":organizationId": {
+            members: {
+                get: {
+                    body: unknown;
+                    params: {
+                        organizationId: string;
+                    };
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: {
+                            readonly members: import("./types").OrganizationMembership[];
+                        };
+                        401: "Authentication required";
+                        403: "Not a member";
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":organizationId": {
+            members: {
+                ":userId": {
+                    delete: {
+                        body: unknown;
+                        params: {
+                            userId: string;
+                            organizationId: string;
+                        };
+                        query: unknown;
+                        headers: unknown;
+                        response: {
+                            200: {
+                                readonly removed: string;
+                            };
+                            401: "Authentication required";
+                            403: "Cannot manage members";
+                            422: {
+                                type: "validation";
+                                on: string;
+                                summary?: string;
+                                message?: string;
+                                found?: unknown;
+                                property?: string;
+                                expected?: string;
+                            };
+                        };
+                    };
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/organizations/types.d.ts

@@ -0,0 +1,44 @@
+import type { OrganizationId } from '../tenancy';
+export type Organization = {
+    createdAt: number;
+    metadata?: Record<string, unknown>;
+    name: string;
+    organizationId: OrganizationId;
+    updatedAt: number;
+};
+export type MembershipStatus = 'active' | 'suspended';
+export type OrganizationMembership = {
+    createdAt: number;
+    organizationId: OrganizationId;
+    roles: string[];
+    status: MembershipStatus;
+    updatedAt: number;
+    userId: string;
+};
+export type InvitationState = 'accepted' | 'pending' | 'revoked';
+export type OrganizationInvitation = {
+    acceptedAt?: number;
+    createdAt: number;
+    email: string;
+    expiresAt: number;
+    invitationId: string;
+    inviterUserId?: string;
+    organizationId: OrganizationId;
+    roles: string[];
+    state: InvitationState;
+    tokenHash: string;
+};
+export type OrganizationStore = {
+    deleteOrganization: (organizationId: OrganizationId) => Promise<void>;
+    getInvitation: (invitationId: string) => Promise<OrganizationInvitation | undefined>;
+    getInvitationByTokenHash: (tokenHash: string) => Promise<OrganizationInvitation | undefined>;
+    getMembership: (organizationId: OrganizationId, userId: string) => Promise<OrganizationMembership | undefined>;
+    getOrganization: (organizationId: OrganizationId) => Promise<Organization | undefined>;
+    listInvitationsByOrganization: (organizationId: OrganizationId) => Promise<OrganizationInvitation[]>;
+    listMembershipsByOrganization: (organizationId: OrganizationId) => Promise<OrganizationMembership[]>;
+    listMembershipsByUser: (userId: string) => Promise<OrganizationMembership[]>;
+    removeMembership: (organizationId: OrganizationId, userId: string) => Promise<void>;
+    saveInvitation: (invitation: OrganizationInvitation) => Promise<void>;
+    saveMembership: (membership: OrganizationMembership) => Promise<void>;
+    saveOrganization: (organization: Organization) => Promise<void>;
+};

package/dist/passwordless/config.d.ts

@@ -0,0 +1,42 @@
+import type { AuditEmitter } from '../audit/config';
+import type { AuthSessionStore } from '../session/types';
+import type { RouteString, UserSessionId } from '../types';
+import type { PasswordlessTokenStore } from './types';
+export declare const DEFAULT_MAGIC_LINK_TTL_MS: number;
+export declare const DEFAULT_OTP_LENGTH = 6;
+export declare const DEFAULT_OTP_TTL_MS: number;
+export declare const DEFAULT_PASSWORDLESS_ROUTE: RouteString;
+export declare const DEFAULT_PASSWORDLESS_SESSION_TTL_MS: number;
+export type MagicLinkMessage = {
+    email: string;
+    expiresAt: number;
+    token: string;
+};
+export type PasswordlessOtpMessage = {
+    code: string;
+    email: string;
+    expiresAt: number;
+};
+export type PasswordlessConfig<UserType> = {
+    getUserByEmail: (email: string) => Promise<UserType | null | undefined> | UserType | null | undefined;
+    passwordlessTokenStore: PasswordlessTokenStore;
+    getUserId?: (user: UserType) => string;
+    magicLinkTokenDurationMs?: number;
+    onCreateUser?: (context: {
+        email: string;
+    }) => Promise<UserType> | UserType;
+    onPasswordlessLogin?: (context: {
+        user: UserType;
+        userSessionId: UserSessionId;
+    }) => void | Promise<void>;
+    onSendMagicLink?: (message: MagicLinkMessage) => void | Promise<void>;
+    onSendOtp?: (message: PasswordlessOtpMessage) => void | Promise<void>;
+    otpDurationMs?: number;
+    otpLength?: number;
+    passwordlessRoute?: RouteString;
+    sessionDurationMs?: number;
+};
+export type PasswordlessRouteProps<UserType> = PasswordlessConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+    emit?: AuditEmitter;
+};

package/dist/passwordless/inMemoryPasswordlessTokenStore.d.ts

@@ -0,0 +1,2 @@
+import type { PasswordlessTokenStore } from './types';
+export declare const createInMemoryPasswordlessTokenStore: () => PasswordlessTokenStore;

package/dist/passwordless/postgresPasswordlessTokenStore.d.ts

@@ -0,0 +1,66 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { PasswordlessTokenStore } from './types';
+export declare const passwordlessTokensTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_passwordless_tokens";
+    schema: undefined;
+    columns: {
+        email: import("drizzle-orm/pg-core").PgColumn<{
+            name: "email";
+            tableName: "auth_passwordless_tokens";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at_ms";
+            tableName: "auth_passwordless_tokens";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        token_hash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token_hash";
+            tableName: "auth_passwordless_tokens";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonPasswordlessTokenStore: (databaseUrl: string) => PasswordlessTokenStore;
+export declare const createPostgresPasswordlessTokenStore: (db: AnyPgDatabase) => PasswordlessTokenStore;

package/dist/passwordless/routes.d.ts

@@ -0,0 +1,163 @@
+import { Elysia } from 'elysia';
+import type { SessionRecord } from '../types';
+import { type PasswordlessRouteProps } from './config';
+export declare const passwordlessRoutes: <UserType>({ authSessionStore, emit, getUserByEmail, getUserId, magicLinkTokenDurationMs, onCreateUser, onPasswordlessLogin, onSendMagicLink, onSendOtp, otpDurationMs, otpLength, passwordlessRoute, passwordlessTokenStore, sessionDurationMs }: PasswordlessRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {} | {
+        session: SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    } | {
+        session: SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    } | {
+        session: SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, ({} | ({
+    [x: string]: {
+        "magic-link": {
+            post: {
+                body: {
+                    email: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        readonly status: "magic_link_sent";
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        "magic-link": {
+            verify: {
+                post: {
+                    body: {
+                        token: string;
+                    };
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: {
+                            readonly status: "authenticated";
+                        };
+                        400: "Invalid or expired link";
+                        401: "No account for this email";
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+})) & ({} | ({
+    [x: string]: {
+        otp: {
+            post: {
+                body: {
+                    email: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        readonly status: "otp_sent";
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        otp: {
+            verify: {
+                post: {
+                    body: {
+                        email: string;
+                        code: string;
+                    };
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: {
+                            readonly status: "authenticated";
+                        };
+                        400: "Invalid or expired code";
+                        401: "No account for this email";
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+})), {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/passwordless/types.d.ts

@@ -0,0 +1,9 @@
+export type PasswordlessToken = {
+    email: string;
+    expiresAt: number;
+    tokenHash: string;
+};
+export type PasswordlessTokenStore = {
+    consumeToken: (tokenHash: string) => Promise<PasswordlessToken | undefined>;
+    saveToken: (token: PasswordlessToken) => Promise<void>;
+};

package/dist/portal/config.d.ts

@@ -0,0 +1,34 @@
+import type { AuditEmitter } from '../audit/config';
+import type { ScimTokenStore } from '../scim/types';
+import type { SSOConnectionStore, SSOConnectionType } from '../sso/types';
+import type { OrganizationId } from '../tenancy';
+import type { RouteString } from '../types';
+import type { SetupCapability, SetupSessionStore } from './types';
+export declare const DEFAULT_PORTAL_ROUTE: RouteString;
+export declare const DEFAULT_SETUP_SESSION_TTL_MS: number;
+export type PortalConfig = {
+    setupSessionStore: SetupSessionStore;
+    onScimTokenCreated?: (context: {
+        organizationId: OrganizationId;
+        tokenId: string;
+    }) => void | Promise<void>;
+    onSsoConnectionConfigured?: (context: {
+        organizationId: OrganizationId;
+        type: SSOConnectionType;
+    }) => void | Promise<void>;
+    portalRoute?: RouteString;
+    scimRoute?: RouteString;
+    scimTokenStore?: ScimTokenStore;
+    ssoConnectionStore?: SSOConnectionStore;
+    ssoRoute?: RouteString;
+};
+export type PortalRouteProps = PortalConfig & {
+    emit?: AuditEmitter;
+};
+export type SetupSessionRequest = {
+    capabilities: SetupCapability[];
+    createdBy?: string;
+    organizationId: OrganizationId;
+    setupSessionDurationMs?: number;
+    setupSessionStore: SetupSessionStore;
+};

package/dist/portal/inMemorySetupSessionStore.d.ts

@@ -0,0 +1,2 @@
+import type { SetupSessionStore } from './types';
+export declare const createInMemorySetupSessionStore: () => SetupSessionStore;

package/dist/portal/operations.d.ts

@@ -0,0 +1,10 @@
+import { type SetupSessionRequest } from './config';
+import type { SetupSession, SetupSessionStore } from './types';
+export declare const createSetupSession: ({ capabilities, createdBy, organizationId, setupSessionDurationMs, setupSessionStore }: SetupSessionRequest) => Promise<{
+    setupSession: SetupSession;
+    token: string;
+}>;
+export declare const resolveSetupSession: ({ authorization, setupSessionStore }: {
+    authorization: string | undefined;
+    setupSessionStore: SetupSessionStore;
+}) => Promise<SetupSession | undefined>;