@absolutejs/auth 0.27.0-beta.2 → 0.27.0-beta.4

package/dist/abuse/config.d.ts

@@ -0,0 +1,29 @@
+export type AbuseAction = 'allow' | 'challenge' | 'deny';
+export type AbuseSignal = 'blocked_ip' | 'bot' | 'captcha_failed' | 'not_allowlisted';
+export type BotClass = 'agent' | 'bot' | 'crawler' | 'human';
+export type AbuseContext = {
+    captchaToken?: string;
+    ip?: string;
+    userAgent?: string;
+};
+export type AbuseReason = {
+    action: AbuseAction;
+    signal: AbuseSignal;
+};
+export type AbuseAssessment = {
+    action: AbuseAction;
+    reasons: AbuseReason[];
+};
+export type AbuseConfig = {
+    botAction?: AbuseAction;
+    captchaAction?: AbuseAction;
+    classifyBot?: (context: AbuseContext) => BotClass | Promise<BotClass>;
+    ipAllow?: string[];
+    ipDeny?: string[];
+    verifyCaptcha?: (token: string | undefined, context: AbuseContext) => boolean | Promise<boolean>;
+};
+export declare const assessAbuse: (config: AbuseConfig, context: AbuseContext) => Promise<AbuseAssessment>;
+export declare const createAbuseGuard: (config: AbuseConfig) => {
+    assess: (context: AbuseContext) => Promise<AbuseAssessment>;
+};
+export declare const defaultBotClassifier: (context: AbuseContext) => "bot" | "crawler" | "human";

package/dist/apikeys/routes.d.ts

@@ -47,9 +47,9 @@ export declare const apiKeysRoutes: ({ accessTokenStore, accessTokenTtlMs, apiCl
         post: {
             body: {
                 client_id?: string | undefined;
+                scope?: string | undefined;
                 client_secret?: string | undefined;
                 grant_type?: string | undefined;
-                scope?: string | undefined;
             };
             params: {};
             query: unknown;

package/dist/audit/integrity.d.ts

@@ -0,0 +1,15 @@
+import type { AuditEvent, AuditSink } from './types';
+export type AuditIntegrity = {
+    hash: string;
+    previousHash: string;
+};
+export type AuditChainResult = {
+    brokenAt?: number;
+    ok: boolean;
+};
+export declare const createTamperEvidentSink: ({ secret, sink }: {
+    secret?: string;
+    sink: AuditSink;
+}) => AuditSink;
+export declare const hashAuditEvent: (event: AuditEvent, previousHash: string, secret?: string) => Promise<string>;
+export declare const verifyAuditChain: (events: AuditEvent[], secret?: string) => Promise<AuditChainResult>;

package/dist/audit/siem.d.ts

@@ -0,0 +1,11 @@
+import type { AuditSink } from './types';
+export type SiemFormat = 'datadog' | 'generic' | 'splunk';
+export type SiemEndpoint = {
+    format?: SiemFormat;
+    headers?: Record<string, string>;
+    token?: string;
+    url: string;
+};
+export declare const createSiemLogStream: ({ endpoints }: {
+    endpoints: SiemEndpoint[];
+}) => AuditSink;

package/dist/audit/types.d.ts

@@ -1,5 +1,5 @@
 import type { OrganizationId } from '../tenancy';
-export type AuditEventType = 'account_deleted' | 'authorization_denied' | 'credentials_login' | 'credentials_login_failed' | 'data_exported' | 'email_verified' | 'identity_conflict' | 'invitation_accepted' | 'invitation_created' | 'logout' | 'membership_removed' | 'mfa_challenge' | 'mfa_challenge_failed' | 'mfa_enrolled' | 'oauth_login' | 'organization_created' | 'password_reset' | 'passwordless_login' | 'register' | 'role_assigned' | 'scim_provision' | 'scim_token_created' | 'session_revoked' | 'setup_session_created' | 'sso_connection_configured' | 'sso_login' | 'token_refreshed' | 'token_revoked' | 'webauthn_authenticated' | 'webauthn_registered';
+export type AuditEventType = 'account_deleted' | 'authorization_denied' | 'credentials_login' | 'credentials_login_failed' | 'data_exported' | 'email_verified' | 'identity_conflict' | 'impersonation_ended' | 'impersonation_started' | 'invitation_accepted' | 'invitation_created' | 'logout' | 'membership_removed' | 'mfa_challenge' | 'mfa_challenge_failed' | 'mfa_enrolled' | 'oauth_login' | 'organization_created' | 'password_reset' | 'passwordless_login' | 'register' | 'role_assigned' | 'scim_provision' | 'scim_token_created' | 'session_revoked' | 'setup_session_created' | 'sso_connection_configured' | 'sso_login' | 'token_refreshed' | 'token_revoked' | 'webauthn_authenticated' | 'webauthn_registered';
 export type AuditEvent = {
     at: number;
     ip?: string;

package/dist/fga/config.d.ts

@@ -0,0 +1,35 @@
+import type { FgaSchema, Warrant, WarrantStore } from './types';
+export type FgaConfig = {
+    maxDepth?: number;
+    schema: FgaSchema;
+    warrantStore: WarrantStore;
+};
+export type CheckQuery = {
+    relation: string;
+    resourceId: string;
+    resourceType: string;
+    subjectId: string;
+    subjectType: string;
+};
+export type Subject = {
+    subjectId: string;
+    subjectType: string;
+};
+export declare const check: (config: FgaConfig, query: CheckQuery) => Promise<boolean>;
+export declare const createFgaEngine: (config: FgaConfig) => {
+    check: (query: CheckQuery) => Promise<boolean>;
+    deleteWarrant: (warrant: Warrant) => Promise<void>;
+    listSubjects: (query: {
+        relation: string;
+        resourceId: string;
+        resourceType: string;
+    }) => Promise<Subject[]>;
+    writeWarrant: (warrant: Warrant) => Promise<void>;
+};
+export declare const deleteWarrant: (config: FgaConfig, warrant: Warrant) => Promise<void>;
+export declare const listSubjects: (config: FgaConfig, query: {
+    relation: string;
+    resourceId: string;
+    resourceType: string;
+}) => Promise<Subject[]>;
+export declare const writeWarrant: (config: FgaConfig, warrant: Warrant) => Promise<void>;

package/dist/fga/inMemoryStores.d.ts

@@ -0,0 +1,3 @@
+import type { Warrant, WarrantStore } from './types';
+export declare const createInMemoryWarrantStore: () => WarrantStore;
+export declare const warrantKey: (warrant: Warrant) => string;

package/dist/fga/postgresStores.d.ts

@@ -0,0 +1,144 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { WarrantStore } from './types';
+export declare const warrantsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_fga_warrants";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "auth_fga_warrants";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        relation: import("drizzle-orm/pg-core").PgColumn<{
+            name: "relation";
+            tableName: "auth_fga_warrants";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        resource_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "resource_id";
+            tableName: "auth_fga_warrants";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        resource_type: import("drizzle-orm/pg-core").PgColumn<{
+            name: "resource_type";
+            tableName: "auth_fga_warrants";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        subject_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "subject_id";
+            tableName: "auth_fga_warrants";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        subject_relation: import("drizzle-orm/pg-core").PgColumn<{
+            name: "subject_relation";
+            tableName: "auth_fga_warrants";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        subject_type: import("drizzle-orm/pg-core").PgColumn<{
+            name: "subject_type";
+            tableName: "auth_fga_warrants";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonWarrantStore: (databaseUrl: string) => WarrantStore;
+export declare const createPostgresWarrantStore: (db: AnyPgDatabase) => WarrantStore;

package/dist/fga/types.d.ts

@@ -0,0 +1,27 @@
+export type Warrant = {
+    relation: string;
+    resourceId: string;
+    resourceType: string;
+    subjectId: string;
+    subjectRelation?: string;
+    subjectType: string;
+};
+export type WarrantStore = {
+    deleteWarrant: (warrant: Warrant) => Promise<void>;
+    listForResource: (resourceType: string, resourceId: string, relation: string) => Promise<Warrant[]>;
+    saveWarrant: (warrant: Warrant) => Promise<void>;
+};
+export type RelationRule = {
+    kind: 'computedUserset';
+    relation: string;
+} | {
+    kind: 'self';
+} | {
+    kind: 'tupleToUserset';
+    relation: string;
+    viaRelation: string;
+} | {
+    kind: 'union';
+    rules: RelationRule[];
+};
+export type FgaSchema = Record<string, Record<string, RelationRule>>;