@absolutejs/auth 0.41.0 → 0.43.0

package/dist/cli/import/auth0.d.ts

@@ -0,0 +1,2 @@
+import type { Importer } from './types';
+export declare const auth0Importer: Importer;

package/dist/cli/import/clerk.d.ts

@@ -0,0 +1,2 @@
+import type { Importer } from './types';
+export declare const clerkImporter: Importer;

package/dist/cli/import/index.d.ts

@@ -0,0 +1,10 @@
+import type { ImportResult, Importer } from './types';
+export declare const importers: Record<string, Importer>;
+export type ImportOptions = {
+    commit: boolean;
+    databaseUrl: string;
+};
+export declare const runImport: (result: ImportResult, options: ImportOptions) => Promise<{
+    identityCount: number;
+    userCount: number;
+}>;

package/dist/cli/import/lucia.d.ts

@@ -0,0 +1,2 @@
+import type { Importer } from './types';
+export declare const luciaImporter: Importer;

package/dist/cli/import/nextauth.d.ts

@@ -0,0 +1,2 @@
+import type { Importer } from './types';
+export declare const nextauthImporter: Importer;

package/dist/cli/import/supabase.d.ts

@@ -0,0 +1,2 @@
+import type { Importer } from './types';
+export declare const supabaseImporter: Importer;

package/dist/cli/import/types.d.ts

@@ -0,0 +1,26 @@
+export type ImportedUser = {
+    createdAtMs: number;
+    email: string;
+    emailVerified: boolean;
+    externalId: string;
+    familyName?: string;
+    givenName?: string;
+    passwordHash?: string;
+    passwordHashAlgo?: 'argon2id' | 'bcrypt' | 'scrypt' | 'pbkdf2';
+};
+export type ImportedIdentity = {
+    authProvider: string;
+    createdAtMs: number;
+    metadata?: Record<string, unknown>;
+    providerSubject: string;
+    userExternalId: string;
+};
+export type ImportResult = {
+    identities: ImportedIdentity[];
+    source: string;
+    users: ImportedUser[];
+};
+export type Importer = {
+    parse: (path: string) => Promise<ImportResult>;
+    source: string;
+};

package/dist/cli/migrate.js

@@ -1,6 +1,270 @@
 #!/usr/bin/env bun
 // @bun
 
+// src/cli/import/index.ts
+import { neon } from "@neondatabase/serverless";
+
+// src/cli/import/auth0.ts
+import { readFile } from "fs/promises";
+var parseUsersFromText = (text) => {
+  const trimmed = text.trim();
+  if (trimmed.startsWith("[")) {
+    return JSON.parse(trimmed);
+  }
+  return trimmed.split(`
+`).filter((line) => line.length > 0).map((line) => JSON.parse(line));
+};
+var auth0Importer = {
+  source: "auth0",
+  parse: async (path) => {
+    const text = await readFile(path, "utf-8");
+    const auth0Users = parseUsersFromText(text);
+    const users = auth0Users.map((raw) => ({
+      createdAtMs: raw.created_at === undefined ? Date.now() : Date.parse(raw.created_at),
+      email: raw.email,
+      emailVerified: raw.email_verified ?? false,
+      externalId: raw.user_id,
+      familyName: raw.family_name,
+      givenName: raw.given_name,
+      passwordHash: raw.password_hash,
+      passwordHashAlgo: raw.password_hash?.startsWith("$2b$") || raw.password_hash?.startsWith("$2a$") || raw.password_hash?.startsWith("$2y$") ? "bcrypt" : undefined
+    }));
+    const identities = auth0Users.flatMap((raw) => (raw.identities ?? []).filter((identity) => identity.provider !== "auth0").map((identity) => ({
+      authProvider: identity.provider.replace("-oauth2", ""),
+      createdAtMs: raw.created_at === undefined ? Date.now() : Date.parse(raw.created_at),
+      metadata: identity.connection === undefined ? undefined : { connection: identity.connection },
+      providerSubject: identity.user_id,
+      userExternalId: raw.user_id
+    })));
+    return { identities, source: "auth0", users };
+  }
+};
+
+// src/cli/import/clerk.ts
+import { readFile as readFile2 } from "fs/promises";
+var stripOauthPrefix = (provider) => provider.startsWith("oauth_") ? provider.slice("oauth_".length) : provider;
+var clerkImporter = {
+  source: "clerk",
+  parse: async (path) => {
+    const text = await readFile2(path, "utf-8");
+    const clerkUsers = JSON.parse(text);
+    const users = clerkUsers.filter((raw) => raw.email_addresses !== undefined && raw.email_addresses.length > 0).map((raw) => {
+      const primary = raw.email_addresses?.find((e) => raw.primary_email_address_id === undefined || e.email_address.length > 0) ?? raw.email_addresses?.[0];
+      return {
+        createdAtMs: raw.created_at ?? Date.now(),
+        email: primary?.email_address ?? "",
+        emailVerified: primary?.verification?.status === "verified",
+        externalId: raw.id,
+        familyName: raw.last_name,
+        givenName: raw.first_name,
+        passwordHash: raw.password_digest,
+        passwordHashAlgo: raw.password_digest?.startsWith("$argon2id") ? "argon2id" : raw.password_digest?.startsWith("$2") ? "bcrypt" : undefined
+      };
+    });
+    const identities = clerkUsers.flatMap((raw) => (raw.external_accounts ?? []).map((account) => ({
+      authProvider: stripOauthPrefix(account.provider),
+      createdAtMs: raw.created_at ?? Date.now(),
+      providerSubject: account.provider_user_id ?? account.external_id ?? "",
+      userExternalId: raw.id
+    })));
+    return { identities, source: "clerk", users };
+  }
+};
+
+// src/cli/import/lucia.ts
+import { readFile as readFile3 } from "fs/promises";
+var toMs = (value) => {
+  if (value === undefined)
+    return Date.now();
+  if (typeof value === "number")
+    return value < 1000000000000 ? value * 1000 : value;
+  return Date.parse(value);
+};
+var luciaImporter = {
+  source: "lucia",
+  parse: async (path) => {
+    const text = await readFile3(path, "utf-8");
+    const parsed = JSON.parse(text);
+    const passwordByUserId = new Map;
+    const oauthKeys = [];
+    for (const key of parsed.keys ?? []) {
+      const separator = key.id.indexOf(":");
+      if (separator < 0)
+        continue;
+      const provider = key.id.slice(0, separator);
+      if (provider === "email" || provider === "username") {
+        passwordByUserId.set(key.user_id, key.hashed_password);
+      } else {
+        oauthKeys.push(key);
+      }
+    }
+    const users = parsed.users.map((raw) => ({
+      createdAtMs: toMs(raw.created_at),
+      email: raw.email ?? "",
+      emailVerified: true,
+      externalId: raw.id,
+      passwordHash: passwordByUserId.get(raw.id),
+      passwordHashAlgo: passwordByUserId.get(raw.id)?.startsWith("$argon2id") ? "argon2id" : passwordByUserId.get(raw.id)?.startsWith("$2") ? "bcrypt" : undefined
+    }));
+    const identities = oauthKeys.map((key) => {
+      const separator = key.id.indexOf(":");
+      return {
+        authProvider: key.id.slice(0, separator),
+        createdAtMs: Date.now(),
+        providerSubject: key.id.slice(separator + 1),
+        userExternalId: key.user_id
+      };
+    });
+    return { identities, source: "lucia", users };
+  }
+};
+
+// src/cli/import/nextauth.ts
+import { readFile as readFile4 } from "fs/promises";
+var splitName = (full) => {
+  if (full === undefined)
+    return { familyName: undefined, givenName: undefined };
+  const parts = full.split(/\s+/);
+  if (parts.length === 1)
+    return { familyName: undefined, givenName: parts[0] };
+  return {
+    familyName: parts.slice(1).join(" "),
+    givenName: parts[0]
+  };
+};
+var nextauthImporter = {
+  source: "nextauth",
+  parse: async (path) => {
+    const text = await readFile4(path, "utf-8");
+    const parsed = JSON.parse(text);
+    const users = parsed.users.map((raw) => {
+      const split = splitName(raw.name);
+      const passwordHash = parsed.passwordsByUserId?.[raw.id];
+      return {
+        createdAtMs: Date.now(),
+        email: raw.email,
+        emailVerified: raw.emailVerified !== null && raw.emailVerified !== undefined,
+        externalId: raw.id,
+        familyName: split.familyName,
+        givenName: split.givenName,
+        passwordHash,
+        passwordHashAlgo: passwordHash?.startsWith("$argon2id") ? "argon2id" : passwordHash?.startsWith("$2") ? "bcrypt" : undefined
+      };
+    });
+    const identities = (parsed.accounts ?? []).filter((account) => account.type === undefined || account.type === "oauth").map((account) => ({
+      authProvider: account.provider,
+      createdAtMs: Date.now(),
+      providerSubject: account.providerAccountId,
+      userExternalId: account.userId
+    }));
+    return { identities, source: "nextauth", users };
+  }
+};
+
+// src/cli/import/supabase.ts
+import { readFile as readFile5 } from "fs/promises";
+var splitFullName = (full) => {
+  if (full === undefined)
+    return { familyName: undefined, givenName: undefined };
+  const parts = full.split(/\s+/);
+  if (parts.length === 1)
+    return { familyName: undefined, givenName: parts[0] };
+  return {
+    familyName: parts.slice(1).join(" "),
+    givenName: parts[0]
+  };
+};
+var supabaseImporter = {
+  source: "supabase",
+  parse: async (path) => {
+    const text = await readFile5(path, "utf-8");
+    const parsed = JSON.parse(text);
+    const users = parsed.users.map((raw) => {
+      const meta = raw.raw_user_meta_data ?? {};
+      const split = splitFullName(meta.full_name);
+      return {
+        createdAtMs: raw.created_at === undefined ? Date.now() : Date.parse(raw.created_at),
+        email: raw.email,
+        emailVerified: raw.email_confirmed_at !== undefined,
+        externalId: raw.id,
+        familyName: meta.family_name ?? split.familyName,
+        givenName: meta.given_name ?? split.givenName,
+        passwordHash: raw.encrypted_password,
+        passwordHashAlgo: raw.encrypted_password?.startsWith("$2") ? "bcrypt" : undefined
+      };
+    });
+    const identities = (parsed.identities ?? []).map((identity) => ({
+      authProvider: identity.provider,
+      createdAtMs: identity.created_at === undefined ? Date.now() : Date.parse(identity.created_at),
+      providerSubject: identity.provider_id,
+      userExternalId: identity.user_id
+    }));
+    return { identities, source: "supabase", users };
+  }
+};
+
+// src/cli/import/index.ts
+var importers = {
+  auth0: auth0Importer,
+  clerk: clerkImporter,
+  lucia: luciaImporter,
+  nextauth: nextauthImporter,
+  supabase: supabaseImporter
+};
+var runImport = async (result, options) => {
+  const sql = neon(options.databaseUrl);
+  const subByExternalId = new Map;
+  for (const user of result.users) {
+    subByExternalId.set(user.externalId, crypto.randomUUID());
+  }
+  if (!options.commit) {
+    return {
+      identityCount: result.identities.length,
+      userCount: result.users.length
+    };
+  }
+  for (const user of result.users) {
+    const sub = subByExternalId.get(user.externalId);
+    await sql`
+			INSERT INTO users (sub, email, password, family_name, given_name, email_verified, created_at)
+			VALUES (
+				${sub},
+				${user.email.toLowerCase().trim()},
+				${user.passwordHash ?? null},
+				${user.familyName ?? null},
+				${user.givenName ?? null},
+				${user.emailVerified},
+				to_timestamp(${user.createdAtMs} / 1000.0)
+			)
+			ON CONFLICT (email) DO NOTHING
+		`;
+  }
+  let insertedIdentities = 0;
+  for (const identity of result.identities) {
+    const sub = subByExternalId.get(identity.userExternalId);
+    if (sub === undefined)
+      continue;
+    const inserted = await sql`
+			INSERT INTO auth_identities (id, auth_provider, provider_subject, user_sub, metadata)
+			VALUES (
+				${`${identity.authProvider}:${identity.providerSubject}`},
+				${identity.authProvider},
+				${identity.providerSubject},
+				${sub},
+				${identity.metadata ?? {}}
+			)
+			ON CONFLICT (auth_provider, provider_subject) DO NOTHING
+			RETURNING id
+		`;
+    if (Array.isArray(inserted) && inserted.length > 0)
+      insertedIdentities++;
+  }
+  return {
+    identityCount: insertedIdentities,
+    userCount: result.users.length
+  };
+};
+
 // src/adaptive/postgresStores.ts
 import { and, desc, eq } from "drizzle-orm";
 import {
@@ -13,7 +277,7 @@ import {
 } from "drizzle-orm/pg-core";
 
 // src/stores/postgres.ts
-import { neon } from "@neondatabase/serverless";
+import { neon as neon2 } from "@neondatabase/serverless";
 import { drizzle } from "drizzle-orm/neon-http";
 
 // src/adaptive/postgresStores.ts
@@ -133,7 +397,7 @@ var warrantsTable = pgTable5("auth_fga_warrants", {
 });
 
 // src/linkedProviders/neonStores.ts
-import { neon as neon2 } from "@neondatabase/serverless";
+import { neon as neon3 } from "@neondatabase/serverless";
 import { desc as desc4, eq as eq6 } from "drizzle-orm";
 import { drizzle as drizzle2 } from "drizzle-orm/neon-http";
 import {
@@ -2386,7 +2650,7 @@ var scimTokensTable = pgTable14("auth_scim_tokens", {
 });
 
 // src/session/neonStore.ts
-import { neon as neon3 } from "@neondatabase/serverless";
+import { neon as neon4 } from "@neondatabase/serverless";
 import { eq as eq15 } from "drizzle-orm";
 import { drizzle as drizzle3 } from "drizzle-orm/neon-http";
 import {
@@ -2703,7 +2967,18 @@ var blockMigrations = {
 };
 
 // src/cli/migrate.ts
-var USAGE = `Usage:
+var TOP_USAGE = `Usage:
+  bunx absolute-auth <command> [options]
+
+Commands:
+  migrate                Apply the package's Drizzle migrations
+  import <source> <file> Import a user export from another auth library
+                         <source> is one of: ${Object.keys(importers).sort().join(", ")}
+  help                   Print this message
+
+Run 'bunx absolute-auth <command> --help' for command-specific options.
+`;
+var MIGRATE_USAGE = `Usage:
   bunx absolute-auth migrate --db <url> [--blocks block1,block2,...]
 
 Options:
@@ -2713,17 +2988,19 @@ Options:
 
 Available blocks: ${Object.keys(blockMigrations).sort().join(", ")}
 `;
-var consumeFlag = (parsed, flag, args) => {
-  if (flag === "--help" || flag === "-h") {
-    parsed.help = true;
-  } else if (flag === "--db" || flag === "--database-url") {
-    parsed.databaseUrl = args.shift();
-  } else if (flag === "--blocks") {
-    const list = args.shift() ?? "";
-    parsed.blocks = list.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0).map((entry) => entry);
-  }
-};
-var parseArgs = (argv) => {
+var IMPORT_USAGE = `Usage:
+  bunx absolute-auth import <source> <file> --db <url> [--commit]
+
+Arguments:
+  source    one of: ${Object.keys(importers).sort().join(", ")}
+  file      path to the export JSON (see docs/MIGRATE-FROM-*.md per source)
+
+Options:
+  --db, --database-url    Postgres connection string (falls back to DATABASE_URL env)
+  --commit                Without this, the run is a dry-run (counts only, no inserts)
+  --help                  Print this message
+`;
+var parseMigrateArgs = (argv) => {
   const parsed = {
     blocks: undefined,
     databaseUrl: undefined,
@@ -2731,34 +3008,67 @@ var parseArgs = (argv) => {
   };
   const args = [...argv];
   while (args.length > 0) {
-    consumeFlag(parsed, args.shift(), args);
+    const flag = args.shift();
+    if (flag === "--help" || flag === "-h") {
+      parsed.help = true;
+    } else if (flag === "--db" || flag === "--database-url") {
+      parsed.databaseUrl = args.shift();
+    } else if (flag === "--blocks") {
+      const list = args.shift() ?? "";
+      parsed.blocks = list.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0).map((entry) => entry);
+    }
+  }
+  return parsed;
+};
+var parseImportArgs = (argv) => {
+  const parsed = {
+    commit: false,
+    databaseUrl: undefined,
+    file: undefined,
+    help: false,
+    source: undefined
+  };
+  const args = [...argv];
+  const positionals = [];
+  while (args.length > 0) {
+    const next = args.shift();
+    if (next === undefined)
+      break;
+    if (next === "--help" || next === "-h") {
+      parsed.help = true;
+    } else if (next === "--db" || next === "--database-url") {
+      parsed.databaseUrl = args.shift();
+    } else if (next === "--commit") {
+      parsed.commit = true;
+    } else if (!next.startsWith("--")) {
+      positionals.push(next);
+    }
   }
+  parsed.source = positionals[0];
+  parsed.file = positionals[1];
   return parsed;
 };
-var die = (message) => {
+var die = (message, usage) => {
   process.stderr.write(`error: ${message}
 
 `);
-  process.stderr.write(USAGE);
+  process.stderr.write(usage);
   process.exit(1);
 };
-var main = async () => {
-  const positional = process.argv.slice(2);
-  if (positional[0] === "migrate")
-    positional.shift();
-  const { blocks, databaseUrl, help } = parseArgs(positional);
+var runMigrate = async (argv) => {
+  const { blocks, databaseUrl, help } = parseMigrateArgs(argv);
   if (help) {
-    process.stdout.write(USAGE);
+    process.stdout.write(MIGRATE_USAGE);
     return;
   }
   const resolved = databaseUrl ?? process.env["DATABASE_URL"];
   if (resolved === undefined || resolved.length === 0) {
-    die("a Postgres URL is required (--db or DATABASE_URL)");
+    die("a Postgres URL is required (--db or DATABASE_URL)", MIGRATE_USAGE);
     return;
   }
   const unknown = blocks?.filter((block) => !(block in blockMigrations)) ?? [];
   if (unknown.length > 0) {
-    die(`unknown block(s): ${unknown.join(", ")}`);
+    die(`unknown block(s): ${unknown.join(", ")}`, MIGRATE_USAGE);
     return;
   }
   const result = await runMigrations({ blocks, databaseUrl: resolved });
@@ -2766,7 +3076,62 @@ var main = async () => {
 ${result.applied.length} migration(s) applied, ${result.skipped.length} skipped.
 `);
 };
+var runImportCommand = async (argv) => {
+  const { commit, databaseUrl, file, help, source } = parseImportArgs(argv);
+  if (help) {
+    process.stdout.write(IMPORT_USAGE);
+    return;
+  }
+  if (source === undefined) {
+    die("source is required", IMPORT_USAGE);
+    return;
+  }
+  const importer = importers[source];
+  if (importer === undefined) {
+    die(`unknown source "${source}"`, IMPORT_USAGE);
+    return;
+  }
+  if (file === undefined) {
+    die("file path is required", IMPORT_USAGE);
+    return;
+  }
+  const resolved = databaseUrl ?? process.env["DATABASE_URL"];
+  if (resolved === undefined || resolved.length === 0) {
+    die("a Postgres URL is required (--db or DATABASE_URL)", IMPORT_USAGE);
+    return;
+  }
+  process.stdout.write(`[${source}] parsing ${file}\u2026
+`);
+  const result = await importer.parse(file);
+  process.stdout.write(`[${source}] parsed ${result.users.length} user(s), ${result.identities.length} identity row(s).
+`);
+  const counts = await runImport(result, { commit, databaseUrl: resolved });
+  if (commit) {
+    process.stdout.write(`[${source}] inserted ${counts.userCount} user(s), ${counts.identityCount} new identity row(s). \u2713
+`);
+  } else {
+    process.stdout.write(`[${source}] dry-run \u2014 pass --commit to insert.
+`);
+  }
+};
+var main = async () => {
+  const argv = process.argv.slice(2);
+  const command = argv.shift();
+  if (command === undefined || command === "help" || command === "--help") {
+    process.stdout.write(TOP_USAGE);
+    return;
+  }
+  if (command === "migrate") {
+    await runMigrate(argv);
+    return;
+  }
+  if (command === "import") {
+    await runImportCommand(argv);
+    return;
+  }
+  die(`unknown command "${command}"`, TOP_USAGE);
+};
 await main();
 
-//# debugId=05E38D74A4CE167A64756E2164756E21
+//# debugId=6E4C57DBFBD5A3C964756E2164756E21
 //# sourceMappingURL=migrate.js.map