@absolutejs/auth 0.30.0-beta.0 → 0.30.0-beta.1

package/dist/credentials/config.d.ts

@@ -26,6 +26,8 @@ export type CredentialsConfig<UserType> = {
         headers: Record<string, string | undefined>;
         ip?: string;
     }) => boolean | Promise<boolean>;
+    passwordVerifier?: (plainPassword: string, storedHash: string) => Promise<boolean>;
+    rehashOnLogin?: boolean;
     loginRoute?: RouteString;
     onCreateCredentialUser: (identity: CredentialIdentity & Record<string, unknown>) => Promise<Response | StatusReturn | UserType> | Response | StatusReturn | UserType;
     onCredentialsLoginError?: (context: {

package/dist/credentials/import.d.ts

@@ -0,0 +1,34 @@
+import type { CredentialRecord, CredentialStore } from './types';
+export type ImportableUser<UserType> = {
+    passwordHash?: string;
+    user: UserType;
+};
+export type ImportUserResult<UserType> = {
+    error: string;
+    ok: false;
+    user: UserType;
+} | {
+    credential?: CredentialRecord;
+    ok: true;
+    user: UserType;
+};
+export type ImportUsersOptions<UserType> = {
+    onCreateUser: (input: ImportableUser<UserType>) => Promise<{
+        email: string;
+        emailVerified?: boolean;
+        userId?: string;
+    } | null>;
+    concurrency?: number;
+    credentialStore: CredentialStore;
+};
+export declare const importUser: <UserType>(input: ImportableUser<UserType>, options: ImportUsersOptions<UserType>) => Promise<ImportUserResult<UserType>>;
+export declare const importUsers: <UserType>(inputs: readonly ImportableUser<UserType>[], options: ImportUsersOptions<UserType>) => Promise<{
+    failed: number;
+    results: ImportUserResult<UserType>[];
+    succeeded: number;
+}>;
+export declare const rehashCredentialPassword: ({ credentialStore, current, plainPassword }: {
+    credentialStore: CredentialStore;
+    current: CredentialRecord;
+    plainPassword: string;
+}) => Promise<void>;

package/dist/credentials/legacyHashers.d.ts

@@ -0,0 +1,3 @@
+export declare const isLegacyHash: (storedHash: string) => boolean;
+export declare const verifyAuth0Pbkdf2: (plainPassword: string, wrappedHash: string) => Promise<boolean>;
+export declare const verifyCognitoSha256: (plainPassword: string, wrappedHash: string) => Promise<boolean>;

package/dist/credentials/login.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type CredentialRouteProps } from './config';
-export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, credentialStore, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, requireEmailVerification, sessionDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
+export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, credentialStore, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, passwordVerifier, rehashOnLogin, requireEmailVerification, sessionDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;

package/dist/index.d.ts

@@ -15050,6 +15050,9 @@ export * from './tenancy';
 export * from './credentials/config';
 export * from './credentials/passwordPolicy';
 export * from './credentials/emailValidation';
+export { importUser, importUsers, rehashCredentialPassword } from './credentials/import';
+export type { ImportUserResult, ImportUsersOptions, ImportableUser } from './credentials/import';
+export { isLegacyHash, verifyAuth0Pbkdf2, verifyCognitoSha256 } from './credentials/legacyHashers';
 export * from './credentials/types';
 export { credentialRoutes } from './credentials/routes';
 export { credentialsEmailVerification } from './credentials/emailVerification';

package/dist/index.js

@@ -3392,6 +3392,110 @@ var credentialsEmailVerification = ({
 // src/credentials/login.ts
 import { Elysia as Elysia6, t as t6 } from "elysia";
 
+// src/credentials/import.ts
+var normalizeEmail = (email) => email.trim().toLowerCase();
+var buildCredential = (email, emailVerified, passwordHash, userId) => ({
+  createdAt: Date.now(),
+  email,
+  emailVerified,
+  passwordHash,
+  status: "active",
+  updatedAt: Date.now(),
+  userId
+});
+var importUser = async (input, options) => {
+  try {
+    const created = await options.onCreateUser(input);
+    if (created === null)
+      return {
+        error: "onCreateUser returned null",
+        ok: false,
+        user: input.user
+      };
+    const email = normalizeEmail(created.email);
+    const emailVerified = created.emailVerified ?? true;
+    if (input.passwordHash === undefined) {
+      return { ok: true, user: input.user };
+    }
+    const credential = buildCredential(email, emailVerified, input.passwordHash, created.userId);
+    await options.credentialStore.saveCredential(credential);
+    return { credential, ok: true, user: input.user };
+  } catch (err) {
+    return {
+      error: err instanceof Error ? err.message : String(err),
+      ok: false,
+      user: input.user
+    };
+  }
+};
+var importUsers = async (inputs, options) => {
+  const concurrency = Math.max(1, options.concurrency ?? 1);
+  const results = [];
+  for (let cursor = 0;cursor < inputs.length; cursor += concurrency) {
+    const slice = inputs.slice(cursor, cursor + concurrency);
+    const batch = await Promise.all(slice.map((input) => importUser(input, options)));
+    results.push(...batch);
+  }
+  return {
+    failed: results.filter((result) => !result.ok).length,
+    results,
+    succeeded: results.filter((result) => result.ok).length
+  };
+};
+var rehashCredentialPassword = async ({
+  credentialStore,
+  current,
+  plainPassword
+}) => {
+  const passwordHash = await hashPassword(plainPassword);
+  await credentialStore.saveCredential({
+    ...current,
+    passwordHash,
+    updatedAt: Date.now()
+  });
+};
+
+// src/credentials/legacyHashers.ts
+var PBKDF2_DEFAULT_ITERATIONS = 1e5;
+var PBKDF2_KEY_LENGTH_BYTES = 32;
+var constantTimeEqualBytes = (left, right) => {
+  if (left.byteLength !== right.byteLength)
+    return false;
+  let diff = 0;
+  for (let index = 0;index < left.byteLength; index++) {
+    diff |= (left[index] ?? 0) ^ (right[index] ?? 0);
+  }
+  return diff === 0;
+};
+var base64Decode = (encoded) => new Uint8Array(Buffer.from(encoded, "base64"));
+var sha256Bytes = async (input) => new Uint8Array(await crypto.subtle.digest("SHA-256", input));
+var isLegacyHash = (storedHash) => !storedHash.startsWith("$argon2id$") && !storedHash.startsWith("$2");
+var verifyAuth0Pbkdf2 = async (plainPassword, wrappedHash) => {
+  const parts = wrappedHash.split(":");
+  if (parts.length !== 4 || parts[0] !== "auth0_pbkdf2")
+    return false;
+  const salt = base64Decode(parts[1] ?? "");
+  const expected = base64Decode(parts[2] ?? "");
+  const iterations = Number(parts[3] ?? PBKDF2_DEFAULT_ITERATIONS);
+  if (Number.isNaN(iterations) || iterations <= 0)
+    return false;
+  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(plainPassword), { name: "PBKDF2" }, false, ["deriveBits"]);
+  const derivedBits = await crypto.subtle.deriveBits({ hash: "SHA-256", iterations, name: "PBKDF2", salt }, key, PBKDF2_KEY_LENGTH_BYTES * 8);
+  return constantTimeEqualBytes(new Uint8Array(derivedBits), expected);
+};
+var verifyCognitoSha256 = async (plainPassword, wrappedHash) => {
+  const parts = wrappedHash.split(":");
+  if (parts.length !== 3 || parts[0] !== "cognito_sha256")
+    return false;
+  const salt = base64Decode(parts[1] ?? "");
+  const expected = base64Decode(parts[2] ?? "");
+  const payload = new Uint8Array(salt.byteLength + plainPassword.length);
+  payload.set(salt, 0);
+  payload.set(new TextEncoder().encode(plainPassword), salt.byteLength);
+  const derived = await sha256Bytes(payload);
+  return constantTimeEqualBytes(derived, expected);
+};
+
 // src/credentials/passwordPolicy.ts
 var DEFAULT_MIN_LENGTH = 12;
 var HEX_RADIX = 16;
@@ -3452,6 +3556,8 @@ var credentialsLogin = ({
   loginRoute = "/auth/login",
   onCredentialsLoginError,
   onCredentialsLoginSuccess,
+  passwordVerifier,
+  rehashOnLogin = false,
   requireEmailVerification = false,
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS
 }) => new Elysia6().use(sessionStore()).post(loginRoute, async ({
@@ -3479,7 +3585,8 @@ var credentialsLogin = ({
   }
   const credential = await credentialStore.getCredentialByEmail(normalizedEmail);
   const user = await getUserByEmail(normalizedEmail);
-  const passwordValid = credential ? await verifyPassword(password, credential.passwordHash) : false;
+  const verifyHash = passwordVerifier ?? verifyPassword;
+  const passwordValid = credential === undefined ? false : await verifyHash(password, credential.passwordHash);
   if (!credential || !user || credential.status !== "active" || !passwordValid) {
     await lockoutGuard?.recordFailure(normalizedEmail);
     await onCredentialsLoginError?.({
@@ -3489,6 +3596,13 @@ var credentialsLogin = ({
     return status("Unauthorized", "Invalid email or password");
   }
   await lockoutGuard?.recordSuccess(normalizedEmail);
+  if (rehashOnLogin && isLegacyHash(credential.passwordHash)) {
+    await rehashCredentialPassword({
+      credentialStore,
+      current: credential,
+      plainPassword: password
+    });
+  }
   if (requireEmailVerification && !credential.emailVerified) {
     return status("Forbidden", { status: "email_not_verified" });
   }
@@ -22997,7 +23111,9 @@ export {
   verifyHcaptcha,
   verifyDpopProof,
   verifyDpopNonce,
+  verifyCognitoSha256,
   verifyClientAssertion,
+  verifyAuth0Pbkdf2,
   verifyAuditChain,
   verifyApiKey,
   verifyAccessToken,
@@ -23044,6 +23160,7 @@ export {
   resolveAuthHtmxRenderers,
   resolveApiPrincipal,
   removeFromSessionRing,
+  rehashCredentialPassword,
   registerClient,
   refreshableProviderOptions,
   recordLoginAttempt,
@@ -23104,6 +23221,7 @@ export {
   isPKCEProviderOption,
   isOIDCProviderOption,
   isMfaEnrolled,
+  isLegacyHash,
   isImpersonating,
   isDisposableEmail,
   isAuthIntent,
@@ -23111,6 +23229,8 @@ export {
   inviteToOrganization,
   introspectToken,
   instantiateUserSession,
+  importUsers,
+  importUser,
   hashToken,
   hashPassword,
   hashAuditEvent,
@@ -23330,5 +23450,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=BAAEA91F75FEB49E64756E2164756E21
+//# debugId=658AE7172110F24564756E2164756E21
 //# sourceMappingURL=index.js.map