@absolutejs/auth 0.26.0-beta.4 → 0.26.0-beta.6

package/dist/portal/config.d.ts

@@ -0,0 +1,34 @@
+import type { AuditEmitter } from '../audit/config';
+import type { ScimTokenStore } from '../scim/types';
+import type { SSOConnectionStore, SSOConnectionType } from '../sso/types';
+import type { OrganizationId } from '../tenancy';
+import type { RouteString } from '../types';
+import type { SetupCapability, SetupSessionStore } from './types';
+export declare const DEFAULT_PORTAL_ROUTE: RouteString;
+export declare const DEFAULT_SETUP_SESSION_TTL_MS: number;
+export type PortalConfig = {
+    setupSessionStore: SetupSessionStore;
+    onScimTokenCreated?: (context: {
+        organizationId: OrganizationId;
+        tokenId: string;
+    }) => void | Promise<void>;
+    onSsoConnectionConfigured?: (context: {
+        organizationId: OrganizationId;
+        type: SSOConnectionType;
+    }) => void | Promise<void>;
+    portalRoute?: RouteString;
+    scimRoute?: RouteString;
+    scimTokenStore?: ScimTokenStore;
+    ssoConnectionStore?: SSOConnectionStore;
+    ssoRoute?: RouteString;
+};
+export type PortalRouteProps = PortalConfig & {
+    emit?: AuditEmitter;
+};
+export type SetupSessionRequest = {
+    capabilities: SetupCapability[];
+    createdBy?: string;
+    organizationId: OrganizationId;
+    setupSessionDurationMs?: number;
+    setupSessionStore: SetupSessionStore;
+};

package/dist/portal/inMemorySetupSessionStore.d.ts

@@ -0,0 +1,2 @@
+import type { SetupSessionStore } from './types';
+export declare const createInMemorySetupSessionStore: () => SetupSessionStore;

package/dist/portal/operations.d.ts

@@ -0,0 +1,10 @@
+import { type SetupSessionRequest } from './config';
+import type { SetupSession, SetupSessionStore } from './types';
+export declare const createSetupSession: ({ capabilities, createdBy, organizationId, setupSessionDurationMs, setupSessionStore }: SetupSessionRequest) => Promise<{
+    setupSession: SetupSession;
+    token: string;
+}>;
+export declare const resolveSetupSession: ({ authorization, setupSessionStore }: {
+    authorization: string | undefined;
+    setupSessionStore: SetupSessionStore;
+}) => Promise<SetupSession | undefined>;

package/dist/portal/postgresSetupSessionStore.d.ts

@@ -0,0 +1,140 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { SetupCapability, SetupSessionStore } from './types';
+export declare const setupSessionsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_setup_sessions";
+    schema: undefined;
+    columns: {
+        capabilities: import("drizzle-orm/pg-core").PgColumn<{
+            name: "capabilities";
+            tableName: "auth_setup_sessions";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: SetupCapability[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: SetupCapability[];
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at_ms";
+            tableName: "auth_setup_sessions";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        created_by: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_by";
+            tableName: "auth_setup_sessions";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at_ms";
+            tableName: "auth_setup_sessions";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        organization_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "organization_id";
+            tableName: "auth_setup_sessions";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        setup_session_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "setup_session_id";
+            tableName: "auth_setup_sessions";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        token_hash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token_hash";
+            tableName: "auth_setup_sessions";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonSetupSessionStore: (databaseUrl: string) => SetupSessionStore;
+export declare const createPostgresSetupSessionStore: (db: AnyPgDatabase) => SetupSessionStore;

package/dist/portal/routes.d.ts

@@ -0,0 +1,160 @@
+import { Elysia } from 'elysia';
+import { type PortalRouteProps } from './config';
+export declare const portalRoutes: ({ emit, onScimTokenCreated, onSsoConnectionConfigured, portalRoute, scimRoute, scimTokenStore, setupSessionStore, ssoConnectionStore, ssoRoute }: PortalRouteProps) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        session: {
+            get: {
+                body: unknown;
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        readonly capabilities: import("./types").SetupCapability[];
+                        readonly configured: {
+                            readonly oidc: boolean;
+                            readonly saml: boolean;
+                        };
+                        readonly expiresAt: number;
+                        readonly oidc: {
+                            redirectUri: string;
+                        } | undefined;
+                        readonly organizationId: string;
+                        readonly saml: {
+                            acsUrl: string;
+                            entityId: string;
+                            metadataUrl: string;
+                        } | undefined;
+                        readonly scim: {
+                            baseUrl: string;
+                        } | undefined;
+                    };
+                    401: "Invalid or expired setup link";
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        connection: {
+            saml: {
+                put: {
+                    body: {
+                        idpSloUrl?: string | undefined;
+                        idpEntityId: string;
+                        idpSsoUrl: string;
+                        idpX509Cert: string;
+                    };
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: {
+                            readonly configured: true;
+                            readonly type: "saml";
+                        };
+                        401: "Invalid or expired setup link";
+                        403: "This setup link cannot configure SAML";
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                        501: "SSO is not configured";
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        connection: {
+            oidc: {
+                put: {
+                    body: {
+                        redirectUri?: string | undefined;
+                        scopes?: string[] | undefined;
+                        issuer: string;
+                        clientId: string;
+                        clientSecret: string;
+                    };
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: {
+                            readonly configured: true;
+                            readonly type: "oidc";
+                        };
+                        401: "Invalid or expired setup link";
+                        403: "This setup link cannot configure OIDC";
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                        501: "SSO is not configured";
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        scim: {
+            token: {
+                post: {
+                    body: unknown;
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: {
+                            readonly baseUrl: `${string}/${string}`;
+                            readonly token: string;
+                            readonly tokenId: string;
+                        };
+                        401: "Invalid or expired setup link";
+                        403: "This setup link cannot configure SCIM";
+                        501: "SCIM is not configured";
+                    };
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/portal/types.d.ts

@@ -0,0 +1,16 @@
+import type { OrganizationId } from '../tenancy';
+export type SetupCapability = 'scim' | 'sso_oidc' | 'sso_saml';
+export type SetupSession = {
+    capabilities: SetupCapability[];
+    createdAt: number;
+    createdBy?: string;
+    expiresAt: number;
+    organizationId: OrganizationId;
+    setupSessionId: string;
+    tokenHash: string;
+};
+export type SetupSessionStore = {
+    deleteSetupSession: (setupSessionId: string) => Promise<void>;
+    getSetupSessionByTokenHash: (tokenHash: string) => Promise<SetupSession | undefined>;
+    saveSetupSession: (session: SetupSession) => Promise<void>;
+};

package/dist/types.d.ts

@@ -11,6 +11,7 @@ import type { LockoutConfig } from './lockout/config';
 import type { MfaConfig } from './mfa/config';
 import type { OrganizationsConfig } from './organizations/config';
 import type { PasswordlessConfig } from './passwordless/config';
+import type { PortalConfig } from './portal/config';
 import type { RolesConfig } from './roles/config';
 import type { ScimConfig } from './scim/config';
 import type { SessionsConfig } from './session/sessionsConfig';
@@ -217,6 +218,11 @@ export type AuthConfig<UserType> = {
      *  one (caller becomes owner), invite/accept/revoke by email, and list/remove members. Ties the
      *  bare `organizationId` used by SSO/SCIM/RBAC into a real tenant model with org-scoped roles. */
     organizations?: OrganizationsConfig<UserType>;
+    /** Admin portal — the WorkOS self-serve "setup link" model, headless. When present, mounts
+     *  `{portalRoute}` endpoints a customer's IT admin (holding a scoped setup token from
+     *  `createSetupSession`) calls to read the service-provider URLs and configure their own SSO
+     *  connection / SCIM token. JSON contract, so the portal UI can be built in any framework. */
+    portal?: PortalConfig;
     /** Org-scoped roles & permissions (builds on `organizations`). When present, mounts routes to
      *  list an org's role definitions and set a member's roles. Pair with
      *  `createMembershipPermissionResolver` to make `authorization.hasPermission` turnkey. */
@@ -268,6 +274,12 @@ export type AuthConfig<UserType> = {
     onProfileError?: OnProfileError;
     onSessionCleanup?: OnSessionCleanup<UserType>;
 };
+/** The serializable subset of `AuthConfig` — the route paths, session durations, and
+ *  limits that can live in a data file (`auth.config.ts` via `defineAuthSettings`) and
+ *  be edited from tooling, separate from the code wiring (stores, hooks, callbacks)
+ *  that stays in the `auth()` call. Spread alongside the rest:
+ *  `auth({ ...defineAuthSettings({...}), authSessionStore, providersConfiguration })`. */
+export type AuthSettings = Pick<AuthConfig<unknown>, 'authorizeRoute' | 'callbackRoute' | 'cleanupIntervalMs' | 'maxSessions' | 'profileRoute' | 'refreshRoute' | 'revokeRoute' | 'sessionDurationMs' | 'signoutRoute' | 'statusRoute' | 'unregisteredSessionDurationMs'>;
 export type ClientProviderEntry = {
     clientName?: string;
     providerInstance: OAuth2Client<ProviderOption>;

package/dist/utils.d.ts

@@ -1,9 +1,10 @@
 import { OAuth2Client, OAuth2TokenResponse, ProviderOption } from 'citra';
 import { Cookie } from 'elysia';
 import { AuthHtmxConfig } from './htmx/types';
-import { AuthConfig, InsantiateUserSessionProps, OAuth2ConfigurationOptions, ResolvedOAuthAuthorization, SessionRecord, UnregisteredSessionRecord, UserSessionId } from './types';
+import { AuthConfig, AuthSettings, InsantiateUserSessionProps, OAuth2ConfigurationOptions, ResolvedOAuthAuthorization, SessionRecord, UnregisteredSessionRecord, UserSessionId } from './types';
 export declare const defineAuthConfig: <UserType>(configuration: AuthConfig<UserType>) => AuthConfig<UserType>;
 export declare const defineAuthHtmxConfig: (htmxConfig: AuthHtmxConfig) => AuthHtmxConfig;
+export declare const defineAuthSettings: (settings: AuthSettings) => AuthSettings;
 export declare const defineProvidersConfiguration: (providersConfiguration: OAuth2ConfigurationOptions) => OAuth2ConfigurationOptions;
 export declare const getStatus: <UserType>(session: SessionRecord<UserType>, user_session_id: Cookie<UserSessionId | undefined>) => Promise<{
     error: {

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.26.0-beta.4",
+	"version": "0.26.0-beta.6",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {