@absolutejs/auth 0.27.0-beta.9 → 0.28.0

package/dist/oidc/config.d.ts

@@ -1,11 +1,20 @@
 import type { RouteString } from '../types';
 import { type SigningKey } from './keys';
-import type { AuthorizationCodeStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { AuthorizationCodeStore, DeviceAuthorizationStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
 export declare const DEFAULT_OIDC_ROUTE: RouteString;
 export type OidcProviderConfig<UserType> = {
     accessTokenTtlMs?: number;
     authorizationCodeStore: AuthorizationCodeStore;
     clientStore: OAuthClientStore;
+    deviceAuthorizationStore?: DeviceAuthorizationStore;
+    deviceCodeTtlMs?: number;
+    devicePollIntervalSeconds?: number;
+    getAccessTokenClaims?: (context: {
+        audience?: string;
+        clientId: string;
+        scopes: string[];
+        sub: string;
+    }) => Record<string, unknown> | Promise<Record<string, unknown>>;
     getClaims?: (user: UserType) => Record<string, unknown>;
     getGrantedScopes?: (context: {
         client: {
@@ -57,7 +66,7 @@ export declare const issueTokenSet: <UserType>({ claims, clientId, config, dpopJ
     id_token: string;
     refresh_token: string;
     scope: string;
-    token_type: string;
+    token_type: "Bearer" | "DPoP";
 }>;
 export declare const mcpProtectedResourceMetadata: ({ issuer, resource, scopes }: {
     issuer: string;
@@ -69,3 +78,89 @@ export declare const mcpProtectedResourceMetadata: ({ issuer, resource, scopes }
     scopes_supported: string[];
 };
 export declare const verifyPkce: (codeVerifier: string, codeChallenge: string) => Promise<boolean>;
+export type TokenIntrospection = {
+    active: false;
+} | {
+    active: true;
+    client_id: string;
+    exp: number;
+    iat: number;
+    scope: string;
+    sub: string;
+    token_type: 'access_token' | 'refresh_token';
+};
+export type TokenTypeHint = 'access_token' | 'refresh_token';
+export declare const introspectToken: <UserType>({ config, hint, now, token }: {
+    config: OidcProviderConfig<UserType>;
+    hint?: TokenTypeHint;
+    now?: number;
+    token: string;
+}) => Promise<{
+    active: false;
+} | {
+    active: true;
+    client_id: any;
+    exp: any;
+    iat: any;
+    scope: any;
+    sub: any;
+    token_type: "access_token";
+} | {
+    active: true;
+    client_id: string;
+    exp: number;
+    iat: number;
+    scope: string;
+    sub: string;
+    token_type: "refresh_token";
+}>;
+export declare const revokeRefreshToken: <UserType>(config: OidcProviderConfig<UserType>, token: string) => Promise<boolean>;
+export type DeviceAuthorizationResponse = {
+    device_code: string;
+    expires_in: number;
+    interval: number;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+};
+export declare const issueDeviceAuthorization: <UserType>({ clientId, config, now, requestedScopes }: {
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    now?: number;
+    requestedScopes: string[];
+}) => Promise<DeviceAuthorizationResponse>;
+export type DeviceDecisionResult = {
+    error: 'already_decided' | 'expired_token' | 'invalid_user_code' | 'not_configured';
+    ok: false;
+} | {
+    ok: true;
+};
+export declare const approveDeviceAuthorization: <UserType>({ config, userCode, userSub }: {
+    config: OidcProviderConfig<UserType>;
+    userCode: string;
+    userSub: string;
+}) => Promise<DeviceDecisionResult>;
+export declare const denyDeviceAuthorization: <UserType>({ config, userCode }: {
+    config: OidcProviderConfig<UserType>;
+    userCode: string;
+}) => Promise<DeviceDecisionResult>;
+export type DeviceCodeExchangeError = 'access_denied' | 'authorization_pending' | 'expired_token' | 'invalid_grant' | 'slow_down';
+export type DeviceCodeExchangeResult = {
+    access_token: string;
+    expires_in: number;
+    id_token: string;
+    ok: true;
+    refresh_token: string;
+    scope: string;
+    token_type: 'Bearer' | 'DPoP';
+} | {
+    error: DeviceCodeExchangeError;
+    ok: false;
+};
+export declare const exchangeDeviceCode: <UserType>({ clientId, config, deviceCode, dpopJkt, now }: {
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    deviceCode: string;
+    dpopJkt?: string;
+    now?: number;
+}) => Promise<DeviceCodeExchangeResult>;

package/dist/oidc/inMemoryStores.d.ts

@@ -1,4 +1,5 @@
-import type { AuthorizationCodeStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { AuthorizationCodeStore, DeviceAuthorizationStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore } from './types';
 export declare const createInMemoryAuthorizationCodeStore: () => AuthorizationCodeStore;
+export declare const createInMemoryDeviceAuthorizationStore: () => DeviceAuthorizationStore;
 export declare const createInMemoryOAuthClientStore: (clients: OAuthClient[]) => OAuthClientStore;
 export declare const createInMemoryOidcRefreshTokenStore: () => OidcRefreshTokenStore;

package/dist/oidc/postgresStores.d.ts

@@ -1,5 +1,5 @@
 import { type AnyPgDatabase } from '../stores/postgres';
-import type { AuthorizationCodeStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { AuthorizationCodeStore, DeviceAuthorizationStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
 export declare const oauthClientsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_oauth_clients";
     schema: undefined;
@@ -386,6 +386,202 @@ export declare const oauthCodesTable: import("drizzle-orm/pg-core").PgTableWithC
     };
     dialect: "pg";
 }>;
+export declare const oauthDeviceAuthorizationsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_oauth_device_authorizations";
+    schema: undefined;
+    columns: {
+        client_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "client_id";
+            tableName: "auth_oauth_device_authorizations";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at_ms";
+            tableName: "auth_oauth_device_authorizations";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        device_code_hash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "device_code_hash";
+            tableName: "auth_oauth_device_authorizations";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at_ms";
+            tableName: "auth_oauth_device_authorizations";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        interval_seconds: import("drizzle-orm/pg-core").PgColumn<{
+            name: "interval_seconds";
+            tableName: "auth_oauth_device_authorizations";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        scopes: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scopes";
+            tableName: "auth_oauth_device_authorizations";
+            dataType: "array";
+            columnType: "PgArray";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: import("drizzle-orm").Column<{
+                name: "scopes";
+                tableName: "auth_oauth_device_authorizations";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            baseBuilder: import("drizzle-orm/pg-core").PgColumnBuilder<{
+                name: "scopes";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                enumValues: [string, ...string[]];
+                driverParam: string;
+            }, {}, {}, import("drizzle-orm").ColumnBuilderExtraConfig>;
+            size: undefined;
+        }>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "auth_oauth_device_authorizations";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 16;
+        }>;
+        user_code: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_code";
+            tableName: "auth_oauth_device_authorizations";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 16;
+        }>;
+        user_sub: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_sub";
+            tableName: "auth_oauth_device_authorizations";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+    };
+    dialect: "pg";
+}>;
 export declare const oauthRefreshTokensTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_oauth_refresh_tokens";
     schema: undefined;
@@ -566,8 +762,10 @@ export declare const oauthRefreshTokensTable: import("drizzle-orm/pg-core").PgTa
     dialect: "pg";
 }>;
 export declare const createNeonAuthorizationCodeStore: (databaseUrl: string) => AuthorizationCodeStore;
+export declare const createNeonDeviceAuthorizationStore: (databaseUrl: string) => DeviceAuthorizationStore;
 export declare const createNeonOAuthClientStore: (databaseUrl: string) => OAuthClientStore;
 export declare const createNeonOidcRefreshTokenStore: (databaseUrl: string) => OidcRefreshTokenStore;
 export declare const createPostgresAuthorizationCodeStore: (db: AnyPgDatabase) => AuthorizationCodeStore;
+export declare const createPostgresDeviceAuthorizationStore: (db: AnyPgDatabase) => DeviceAuthorizationStore;
 export declare const createPostgresOAuthClientStore: (db: AnyPgDatabase) => OAuthClientStore;
 export declare const createPostgresOidcRefreshTokenStore: (db: AnyPgDatabase) => OidcRefreshTokenStore;

package/dist/oidc/routes.d.ts

@@ -27,9 +27,9 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
             body: unknown;
             params: {};
             query: {
-                nonce?: string | undefined;
                 client_id?: string | undefined;
                 scope?: string | undefined;
+                nonce?: string | undefined;
                 code_challenge?: string | undefined;
                 code_challenge_method?: string | undefined;
                 redirect_uri?: string | undefined;
@@ -55,11 +55,12 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
-                audience?: string | undefined;
-                resource?: string | undefined;
                 client_id?: string | undefined;
                 scope?: string | undefined;
+                audience?: string | undefined;
+                resource?: string | undefined;
                 refresh_token?: string | undefined;
+                device_code?: string | undefined;
                 client_secret?: string | undefined;
                 grant_type?: string | undefined;
                 code?: string | undefined;
@@ -85,6 +86,113 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
             };
         };
     };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                client_id?: string | undefined;
+                client_secret?: string | undefined;
+                token_type_hint?: string | undefined;
+                token: string;
+            };
+            params: {};
+            query: unknown;
+            headers: {
+                authorization?: string | undefined;
+            };
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                client_id?: string | undefined;
+                client_secret?: string | undefined;
+                token_type_hint?: string | undefined;
+                token: string;
+            };
+            params: {};
+            query: unknown;
+            headers: {
+                authorization?: string | undefined;
+            };
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                client_id?: string | undefined;
+                scope?: string | undefined;
+                client_secret?: string | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: {
+                authorization?: string | undefined;
+            };
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                action?: "deny" | "approve" | undefined;
+                user_code: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
 } & {
     [x: string]: {
         get: {

package/dist/oidc/types.d.ts

@@ -38,5 +38,25 @@ export type OidcRefreshToken = {
 export type OidcRefreshTokenStore = {
     consumeToken: (tokenHash: string) => Promise<OidcRefreshToken | undefined>;
     deleteForUser: (userId: string) => Promise<void>;
+    getToken: (tokenHash: string) => Promise<OidcRefreshToken | undefined>;
     saveToken: (token: OidcRefreshToken) => Promise<void>;
 };
+export type DeviceAuthorizationStatus = 'approved' | 'denied' | 'pending';
+export type DeviceAuthorization = {
+    clientId: string;
+    createdAt: number;
+    deviceCodeHash: string;
+    expiresAt: number;
+    intervalSeconds: number;
+    scopes: string[];
+    status: DeviceAuthorizationStatus;
+    userCode: string;
+    userSub?: string;
+};
+export type DeviceAuthorizationStore = {
+    deleteByDeviceCodeHash: (deviceCodeHash: string) => Promise<void>;
+    findByDeviceCodeHash: (deviceCodeHash: string) => Promise<DeviceAuthorization | undefined>;
+    findByUserCode: (userCode: string) => Promise<DeviceAuthorization | undefined>;
+    saveDeviceAuthorization: (deviceAuthorization: DeviceAuthorization) => Promise<void>;
+    updateStatus: (deviceCodeHash: string, status: DeviceAuthorizationStatus, userSub?: string) => Promise<void>;
+};

package/dist/organizations/operations.d.ts

@@ -5,6 +5,13 @@ export declare const acceptInvitation: ({ organizationStore, token, userId }: {
     token: string;
     userId: string;
 }) => Promise<OrganizationMembership | undefined>;
+export declare const autoAssignOrgsByEmail: ({ email, getOrgsForDomain, organizationStore, roles, userId }: {
+    email: string;
+    getOrgsForDomain: (domain: string) => Promise<OrganizationId[]> | OrganizationId[];
+    organizationStore: OrganizationStore;
+    roles?: string[];
+    userId: string;
+}) => Promise<string[]>;
 export declare const createOrganization: ({ metadata, name, organizationStore, ownerRoles, ownerUserId }: {
     metadata?: Record<string, unknown>;
     name: string;

package/dist/vault/config.d.ts

@@ -0,0 +1,20 @@
+import { type SecretCipher } from '../compliance/cipher';
+import type { VaultStore } from './types';
+export type Vault = {
+    delete: (ownerId: string, name: string) => Promise<void>;
+    get: (ownerId: string, name: string) => Promise<string | undefined>;
+    list: (ownerId: string) => Promise<string[]>;
+    put: (ownerId: string, name: string, value: string) => Promise<void>;
+};
+export declare const createVault: ({ cipher, store }: {
+    cipher: SecretCipher;
+    store: VaultStore;
+}) => Vault;
+export type VaultKeyRotationResult = {
+    rotated: number;
+};
+export declare const rotateVaultKey: ({ newKey, oldKey, store }: {
+    newKey: string;
+    oldKey: string;
+    store: VaultStore;
+}) => Promise<VaultKeyRotationResult>;

package/dist/vault/inMemoryVaultStore.d.ts

@@ -0,0 +1,2 @@
+import type { VaultStore } from './types';
+export declare const createInMemoryVaultStore: () => VaultStore;

package/dist/vault/postgresVaultStore.d.ts

@@ -0,0 +1,100 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { VaultStore } from './types';
+export declare const vaultEntriesTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_vault_entries";
+    schema: undefined;
+    columns: {
+        created_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at_ms";
+            tableName: "auth_vault_entries";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        encrypted_value: import("drizzle-orm/pg-core").PgColumn<{
+            name: "encrypted_value";
+            tableName: "auth_vault_entries";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "auth_vault_entries";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        owner_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "owner_id";
+            tableName: "auth_vault_entries";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        updated_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at_ms";
+            tableName: "auth_vault_entries";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonVaultStore: (databaseUrl: string) => VaultStore;
+export declare const createPostgresVaultStore: (db: AnyPgDatabase) => VaultStore;

package/dist/vault/types.d.ts

@@ -0,0 +1,14 @@
+export type VaultEntry = {
+    createdAt: number;
+    encryptedValue: string;
+    name: string;
+    ownerId: string;
+    updatedAt: number;
+};
+export type VaultStore = {
+    deleteEntry: (ownerId: string, name: string) => Promise<void>;
+    getEntry: (ownerId: string, name: string) => Promise<VaultEntry | undefined>;
+    listAllEntries: () => Promise<VaultEntry[]>;
+    listEntries: (ownerId: string) => Promise<VaultEntry[]>;
+    saveEntry: (entry: VaultEntry) => Promise<void>;
+};