@absolutejs/auth 0.52.1 → 0.53.1

package/dist/manifest.json

@@ -0,0 +1,329 @@
+{
+	"contract": 1,
+	"identity": {
+		"accent": "#6366f1",
+		"category": "auth",
+		"description": "OAuth/OIDC sign-in for 60+ providers, email/password, magic links, passkeys, MFA, enterprise SSO/SCIM, organizations, roles, and API keys — one Elysia plugin backed by your Postgres database.",
+		"docsUrl": "https://github.com/absolutejs/auth",
+		"name": "@absolutejs/auth",
+		"tagline": "Let people create accounts and sign in."
+	},
+	"implements": [
+		{
+			"contract": "auth/session-store",
+			"factory": "createNeonAuthSessionStore",
+			"from": "@absolutejs/auth",
+			"requires": {
+				"env": [
+					{
+						"description": "Postgres connection string",
+						"example": "postgres://user:pass@host/db",
+						"key": "DATABASE_URL",
+						"secret": true
+					}
+				]
+			},
+			"title": "Your Postgres database (recommended)",
+			"wiring": {
+				"code": "createNeonAuthSessionStore(${env.DATABASE_URL} ?? \"\")",
+				"imports": [
+					{
+						"from": "@absolutejs/auth",
+						"names": [
+							"createNeonAuthSessionStore"
+						]
+					}
+				]
+			}
+		},
+		{
+			"contract": "auth/session-store",
+			"factory": "createInMemoryAuthSessionStore",
+			"from": "@absolutejs/auth",
+			"title": "In memory (development only — sign-ins reset on restart)",
+			"wiring": {
+				"code": "createInMemoryAuthSessionStore()",
+				"imports": [
+					{
+						"from": "@absolutejs/auth",
+						"names": [
+							"createInMemoryAuthSessionStore"
+						]
+					}
+				]
+			}
+		}
+	],
+	"lifecycle": [
+		{
+			"command": "bunx absolute-auth migrate",
+			"id": "migrate",
+			"idempotent": true,
+			"kind": "migration",
+			"title": "Set up the sign-in tables in your database",
+			"when": "after-install"
+		},
+		{
+			"command": "bunx absolute-auth migrate",
+			"id": "migrate-upgrade",
+			"idempotent": true,
+			"kind": "migration",
+			"title": "Apply new sign-in tables after upgrading",
+			"when": "after-upgrade"
+		}
+	],
+	"presets": [
+		{
+			"id": "social-login",
+			"title": "Social login (Google + GitHub)",
+			"values": {
+				"providersConfiguration": {
+					"github": {},
+					"google": {}
+				}
+			}
+		}
+	],
+	"requires": {
+		"env": [
+			{
+				"description": "Postgres connection string (sign-in tables live here)",
+				"example": "postgres://user:pass@host/db",
+				"key": "DATABASE_URL",
+				"secret": true
+			},
+			{
+				"description": "Discord OAuth client id",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "DISCORD_CLIENT_ID",
+				"when": "providersConfiguration.discord"
+			},
+			{
+				"description": "Discord OAuth client secret",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "DISCORD_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.discord"
+			},
+			{
+				"description": "Facebook OAuth client id",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "FACEBOOK_CLIENT_ID",
+				"when": "providersConfiguration.facebook"
+			},
+			{
+				"description": "Facebook OAuth client secret",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "FACEBOOK_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.facebook"
+			},
+			{
+				"description": "Github OAuth client id",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "GITHUB_CLIENT_ID",
+				"when": "providersConfiguration.github"
+			},
+			{
+				"description": "Github OAuth client secret",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "GITHUB_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.github"
+			},
+			{
+				"description": "Google OAuth client id",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "GOOGLE_CLIENT_ID",
+				"when": "providersConfiguration.google"
+			},
+			{
+				"description": "Google OAuth client secret",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "GOOGLE_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.google"
+			},
+			{
+				"description": "Linkedin OAuth client id",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "LINKEDIN_CLIENT_ID",
+				"when": "providersConfiguration.linkedin"
+			},
+			{
+				"description": "Linkedin OAuth client secret",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "LINKEDIN_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.linkedin"
+			},
+			{
+				"description": "Microsoft OAuth client id",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "MICROSOFT_CLIENT_ID",
+				"when": "providersConfiguration.microsoft"
+			},
+			{
+				"description": "Microsoft OAuth client secret",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "MICROSOFT_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.microsoft"
+			},
+			{
+				"description": "Slack OAuth client id",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "SLACK_CLIENT_ID",
+				"when": "providersConfiguration.slack"
+			},
+			{
+				"description": "Slack OAuth client secret",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "SLACK_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.slack"
+			},
+			{
+				"description": "Spotify OAuth client id",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "SPOTIFY_CLIENT_ID",
+				"when": "providersConfiguration.spotify"
+			},
+			{
+				"description": "Spotify OAuth client secret",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "SPOTIFY_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.spotify"
+			},
+			{
+				"description": "Twitch OAuth client id",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "TWITCH_CLIENT_ID",
+				"when": "providersConfiguration.twitch"
+			},
+			{
+				"description": "Twitch OAuth client secret",
+				"docsUrl": "https://github.com/absolutejs/auth#providers",
+				"key": "TWITCH_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.twitch"
+			}
+		],
+		"peers": [
+			{
+				"name": "elysia",
+				"range": ">=1.0",
+				"reason": "plugin host"
+			}
+		],
+		"services": [
+			{
+				"description": "Stores accounts, sessions, and audit events",
+				"id": "postgres"
+			}
+		]
+	},
+	"settings": {
+		"type": "object",
+		"properties": {
+			"cleanupIntervalMs": {
+				"description": "How often expired sessions are swept, in milliseconds.",
+				"minimum": 1000,
+				"title": "Session cleanup interval",
+				"x-group": "advanced",
+				"type": "number"
+			},
+			"cookieSecure": {
+				"description": "Only send the sign-in cookie over HTTPS. Leave off in local development.",
+				"title": "HTTPS-only cookies",
+				"x-group": "advanced",
+				"type": "boolean"
+			},
+			"maxSessions": {
+				"description": "How many devices someone can stay signed in on at once.",
+				"minimum": 1,
+				"title": "Signed-in devices per person",
+				"x-group": "sessions",
+				"type": "integer"
+			},
+			"providersConfiguration": {
+				"description": "Which services people can sign in with. Each needs a client id and secret from that provider.",
+				"title": "Sign-in providers",
+				"x-group": "providers",
+				"type": "object",
+				"patternProperties": {
+					"^(.*)$": {
+						"type": "object",
+						"properties": {
+							"scope": {
+								"description": "Extra permissions to request from the provider.",
+								"title": "Permissions",
+								"type": "array",
+								"items": {
+									"type": "string"
+								}
+							}
+						}
+					}
+				}
+			},
+			"sessionDurationMs": {
+				"description": "How long someone stays signed in, in milliseconds. Default is 7 days.",
+				"minimum": 60000,
+				"title": "Stay signed in for",
+				"x-group": "sessions",
+				"type": "number"
+			}
+		}
+	},
+	"slots": {
+		"sessionStore": {
+			"configPath": "authSessionStore",
+			"contract": "auth/session-store",
+			"description": "Where live sign-in sessions are kept",
+			"known": [
+				"@absolutejs/auth#postgres",
+				"@absolutejs/auth#memory"
+			],
+			"required": true
+		}
+	},
+	"wiring": [
+		{
+			"description": "Sign in with Google, GitHub, and 60+ other services. Add email/password later from settings.",
+			"id": "default",
+			"server": {
+				"code": ".use(\n\tawait auth({\n\t\t// TODO: return your application user for a session subject.\n\t\tgetUser: (sub) => ({ sub }),\n\t\tauthSessionStore: ${slot.sessionStore},\n\t\tcookieSecure: ${settings.cookieSecure},\n\t\tmaxSessions: ${settings.maxSessions},\n\t\tprovidersConfiguration: providersFromEnv(${settings.providersConfiguration} ?? {}),\n\t\tsessionDurationMs: ${settings.sessionDurationMs}\n\t})\n)",
+				"imports": [
+					{
+						"from": "@absolutejs/auth",
+						"names": [
+							"auth",
+							"providersFromEnv"
+						]
+					}
+				],
+				"placement": "server-plugin"
+			},
+			"title": "Social sign-in (OAuth)"
+		}
+	],
+	"tools": {
+		"list_sign_in_providers": {
+			"annotations": {
+				"readOnlyHint": true
+			},
+			"capabilities": [
+				"read",
+				"glob"
+			],
+			"description": "List which sign-in providers this project has configured, and which are missing credentials.",
+			"input": {
+				"type": "object",
+				"properties": {}
+			},
+			"kind": "workspace"
+		}
+	}
+}

package/dist/oidc/config.d.ts

@@ -5,7 +5,9 @@ import type { VciConfig } from './vci';
 import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
 export declare const DEFAULT_OIDC_ROUTE: RouteString;
 export type OidcProviderConfig<UserType> = {
-    accessTokenTtlMs?: number;
+    accessTokenTtlMs?: number | ((context: {
+        scopes: string[];
+    }) => number);
     acrValuesSupported?: string[];
     authorizationCodeStore: AuthorizationCodeStore;
     clientAssertionJtiStore?: ClientAssertionJtiStore;

package/dist/providersFromEnv.d.ts

@@ -0,0 +1,19 @@
+import type { OAuth2ConfigurationOptions } from './types';
+export type ProviderSelection = Record<string, {
+    scope?: string[];
+    searchParams?: [string, string][];
+}>;
+/**
+ * Build `providersConfiguration` from a serializable provider selection plus
+ * environment credentials, by convention: `<PROVIDER>_CLIENT_ID` and
+ * `<PROVIDER>_CLIENT_SECRET` (e.g. `GOOGLE_CLIENT_ID`). This is the bridge
+ * between no-code/manifest-driven configuration (which must never contain
+ * secrets) and `auth()`'s credential-bearing provider entries — the host app
+ * wires env → config, the selection stays serializable.
+ *
+ * Covers providers whose citra credentials are the standard
+ * clientId/clientSecret pair. Providers with richer credential shapes
+ * (e.g. Apple's team/key ids) should be configured directly in
+ * `providersConfiguration`.
+ */
+export declare const providersFromEnv: (selection: ProviderSelection, env?: Record<string, string | undefined>) => OAuth2ConfigurationOptions;

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.52.1",
+	"version": "0.53.1",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {
@@ -17,7 +17,7 @@
 	"license": "BSL-1.1",
 	"author": "Alex Kahn",
 	"scripts": {
-		"build": "rm -rf dist && bun build src/index.ts src/htmx/index.ts src/client/index.ts src/client/react.ts src/client/vue.ts src/client/solid.ts src/client/svelte.ts src/plugins/index.ts src/providers/index.ts --root src --outdir dist --sourcemap --target=bun --external elysia --external react --external vue --external solid-js --external svelte --external @opentelemetry/api --external @simplewebauthn/server --external @node-saml/node-saml && bun build src/cli/migrate.ts --outdir dist/cli --sourcemap --target=bun --external @neondatabase/serverless --external drizzle-orm && bun build src/fingerprint-client/index.ts --outdir dist/fingerprint-client --sourcemap --target=browser && tsc --emitDeclarationOnly --project tsconfig.json && chmod +x dist/cli/migrate.js",
+		"build": "rm -rf dist && bun build src/index.ts src/htmx/index.ts src/client/index.ts src/client/react.ts src/client/vue.ts src/client/solid.ts src/client/svelte.ts src/plugins/index.ts src/providers/index.ts src/manifest.ts --root src --outdir dist --sourcemap --target=bun --external elysia --external react --external vue --external solid-js --external svelte --external @opentelemetry/api --external @simplewebauthn/server --external @node-saml/node-saml && bun build src/cli/migrate.ts --outdir dist/cli --sourcemap --target=bun --external @neondatabase/serverless --external drizzle-orm && bun build src/fingerprint-client/index.ts --outdir dist/fingerprint-client --sourcemap --target=browser && tsc --emitDeclarationOnly --project tsconfig.json && chmod +x dist/cli/migrate.js && absolute-manifest emit",
 		"config": "absolute config",
 		"test": "bun test",
 		"format": "absolute prettier --write",
@@ -75,7 +75,9 @@
 	"dependencies": {
 		"@absolutejs/linked-providers": "0.0.2",
 		"@neondatabase/serverless": "1.0.0",
-		"citra": "0.29.1"
+		"citra": "0.29.1",
+		"@absolutejs/manifest": "^0.1.0",
+		"@sinclair/typebox": "^0.34.0"
 	},
 	"devDependencies": {
 		"@absolutejs/absolute": "^0.19.0-beta.1023",
@@ -154,7 +156,13 @@
 			"import": "./dist/client/vue.js",
 			"types": "./dist/client/vue.d.ts",
 			"require": "./dist/client/vue.js"
-		}
+		},
+		"./manifest": {
+			"types": "./dist/manifest.d.ts",
+			"import": "./dist/manifest.js",
+			"default": "./dist/manifest.js"
+		},
+		"./manifest.json": "./dist/manifest.json"
 	},
 	"type": "module",
 	"files": [
@@ -168,5 +176,8 @@
 			]
 		}
 	},
-	"build": null
+	"build": null,
+	"absolutejs": {
+		"manifestContract": 1
+	}
 }