@absolutejs/auth 0.54.4 → 0.54.6

package/dist/agents/oidcAdapter.d.ts

@@ -0,0 +1,9 @@
+import type { AgentCredentialVerifier } from './types';
+/** Adapter for Absolute Auth's RFC 9068-style JWT access tokens. It validates
+ * signature, issuer, audience, expiry, and extracts the OAuth client as the
+ * agent identity while retaining `sub` as the authorizing user. */
+export declare const createOidcAgentCredentialVerifier: ({ issuer, publicJwk, resource }: {
+    issuer: string;
+    publicJwk: JsonWebKey;
+    resource: string;
+}) => AgentCredentialVerifier;

package/dist/agents/postgresStores.d.ts

@@ -0,0 +1,290 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { AgentDelegationStatus, AgentDelegationStore, AgentRegistrationStatus, AgentRegistrationStore } from './types';
+export declare const agentDelegationsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_agent_delegations";
+    schema: undefined;
+    columns: {
+        agent_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_delegations", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_agent_delegations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        authorization_details: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_delegations", import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, Record<string, unknown>[]>, {
+            name: string;
+            tableName: "auth_agent_delegations";
+            dataType: "object json";
+            data: Record<string, unknown>[];
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_delegations", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_agent_delegations";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        delegation_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_delegations", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_agent_delegations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_delegations", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_agent_delegations";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        organization_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_delegations", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_agent_delegations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        scopes: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_delegations", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, string[]>>>, {
+            name: string;
+            tableName: "auth_agent_delegations";
+            dataType: "object json";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        status: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_delegations", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, AgentDelegationStatus>>, {
+            name: string;
+            tableName: "auth_agent_delegations";
+            dataType: "string";
+            data: AgentDelegationStatus;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updated_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_delegations", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_agent_delegations";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_delegations", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_agent_delegations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const agentRegistrationsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_agent_registrations";
+    schema: undefined;
+    columns: {
+        agent_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_registrations", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_agent_registrations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        allowed_scopes: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_registrations", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, string[]>>>, {
+            name: string;
+            tableName: "auth_agent_registrations";
+            dataType: "object json";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        client_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_registrations", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_agent_registrations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_registrations", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_agent_registrations";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        metadata: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_registrations", import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, Record<string, unknown>>, {
+            name: string;
+            tableName: "auth_agent_registrations";
+            dataType: "object json";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        name: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_registrations", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_agent_registrations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        status: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_registrations", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, AgentRegistrationStatus>>, {
+            name: string;
+            tableName: "auth_agent_registrations";
+            dataType: "string";
+            data: AgentRegistrationStatus;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updated_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_agent_registrations", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_agent_registrations";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonAgentDelegationStore: (databaseUrl: string) => AgentDelegationStore;
+export declare const createNeonAgentRegistrationStore: (databaseUrl: string) => AgentRegistrationStore;
+export declare const createPostgresAgentDelegationStore: <DB extends AnyPgDatabase>(db: DB) => AgentDelegationStore;
+export declare const createPostgresAgentRegistrationStore: <DB extends AnyPgDatabase>(db: DB) => AgentRegistrationStore;

package/dist/agents/principal.d.ts

@@ -0,0 +1,4 @@
+import type { AgentAuthConfig } from './config';
+import type { AgentPrincipal } from './types';
+export declare const agentHasScopes: (principal: AgentPrincipal | undefined, requiredScopes: string[]) => boolean;
+export declare const resolveAgentPrincipal: (request: Request, config: AgentAuthConfig) => Promise<AgentPrincipal | undefined>;

package/dist/agents/routes.d.ts

@@ -0,0 +1,96 @@
+import { Elysia } from 'elysia';
+import { type AgentAuthConfig } from './config';
+import type { AgentPrincipal } from './types';
+type AgentAuthFailure = {
+    code: 'Forbidden' | 'Unauthorized';
+    message: 'Agent is not authenticated' | 'Insufficient agent scopes';
+};
+export declare const agentAuthChallenge: ({ config, error, requiredScopes }: {
+    config: AgentAuthConfig;
+    error?: "invalid_token" | "insufficient_scope";
+    requiredScopes?: string[];
+}) => string;
+export declare const agentResourceMetadataUrl: (config: AgentAuthConfig) => string;
+export declare const agentAuthPlugin: (config?: AgentAuthConfig) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {
+        readonly protectAgent: <AuthReturn, AuthFailReturn>(requiredScopes: string[], handleAuth: (principal: AgentPrincipal) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AgentAuthFailure) => AuthFailReturn | Promise<AuthFailReturn>) => Promise<Response | AuthReturn | NonNullable<Awaited<AuthFailReturn>>>;
+    };
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: import("elysia").ExtractErrorFromHandle<{
+        readonly protectAgent: <AuthReturn, AuthFailReturn>(requiredScopes: string[], handleAuth: (principal: AgentPrincipal) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AgentAuthFailure) => AuthFailReturn | Promise<AuthFailReturn>) => Promise<Response | AuthReturn | NonNullable<Awaited<AuthFailReturn>>>;
+    }>;
+}, {}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}> | Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {
+        readonly protectAgent: <AuthReturn, AuthFailReturn>(requiredScopes: string[], handleAuth: (principal: AgentPrincipal) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AgentAuthFailure) => AuthFailReturn | Promise<AuthFailReturn>) => Promise<Response | AuthReturn | NonNullable<Awaited<AuthFailReturn>>>;
+    };
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: import("elysia").ExtractErrorFromHandle<{
+        readonly protectAgent: <AuthReturn, AuthFailReturn>(requiredScopes: string[], handleAuth: (principal: AgentPrincipal) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AgentAuthFailure) => AuthFailReturn | Promise<AuthFailReturn>) => Promise<Response | AuthReturn | NonNullable<Awaited<AuthFailReturn>>>;
+    }>;
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: {
+                    resource: string;
+                    scopes_supported: string[];
+                    resource_name?: string | undefined;
+                    resource_logo_uri?: string | undefined;
+                    authorization_servers: string[];
+                    bearer_methods_supported: string[];
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};

package/dist/agents/types.d.ts

@@ -0,0 +1,70 @@
+export type AgentRegistrationStatus = 'active' | 'revoked';
+export type AgentDelegationStatus = 'active' | 'revoked';
+/** A durable identity for an agent client. This is deliberately protocol-neutral:
+ * `clientId` can refer to an OAuth client, while adapters for other protocols can
+ * use `agentId` without manufacturing OAuth metadata. */
+export type AgentRegistration = {
+    agentId: string;
+    allowedScopes: string[];
+    clientId?: string;
+    createdAt: number;
+    metadata?: Record<string, unknown>;
+    name: string;
+    status: AgentRegistrationStatus;
+    updatedAt: number;
+};
+export type AgentRegistrationStore = {
+    findByAgentId: (agentId: string) => Promise<AgentRegistration | undefined>;
+    findByClientId: (clientId: string) => Promise<AgentRegistration | undefined>;
+    listRegistrations: () => Promise<AgentRegistration[]>;
+    saveRegistration: (registration: AgentRegistration) => Promise<void>;
+};
+/** A user's explicit grant to an agent. Authorization details use RFC 9396's
+ * open object shape so applications can express transaction constraints without
+ * forcing them into coarse OAuth scope strings. */
+export type AgentDelegation = {
+    agentId: string;
+    authorizationDetails?: Record<string, unknown>[];
+    createdAt: number;
+    delegationId: string;
+    expiresAt?: number;
+    organizationId?: string;
+    scopes: string[];
+    status: AgentDelegationStatus;
+    updatedAt: number;
+    userId: string;
+};
+export type AgentDelegationStore = {
+    findActiveDelegation: (query: {
+        agentId: string;
+        now?: number;
+        organizationId?: string;
+        userId: string;
+    }) => Promise<AgentDelegation | undefined>;
+    findByDelegationId: (delegationId: string) => Promise<AgentDelegation | undefined>;
+    listDelegations: (agentId?: string) => Promise<AgentDelegation[]>;
+    saveDelegation: (delegation: AgentDelegation) => Promise<void>;
+};
+/** The normalized result produced by a wire-protocol adapter. The core never
+ * handles raw provider assertions; it authorizes only this verified shape. */
+export type VerifiedAgentCredential = {
+    agentId: string;
+    claims?: Record<string, unknown>;
+    expiresAt?: number;
+    organizationId?: string;
+    resource?: string;
+    scopes: string[];
+    userId?: string;
+};
+export type AgentCredentialVerifier = (request: Request) => Promise<VerifiedAgentCredential | undefined>;
+export type AgentPrincipal = {
+    agentId: string;
+    authorizationDetails?: Record<string, unknown>[];
+    delegationId?: string;
+    kind: 'agent';
+    name: string;
+    organizationId?: string;
+    scopes: string[];
+    trust: 'delegated' | 'registered';
+    userId?: string;
+};

package/dist/audit/types.d.ts

@@ -1,5 +1,5 @@
 import type { OrganizationId } from '../tenancy';
-export type AuditEventType = 'account_deleted' | 'authorization_denied' | 'credentials_login' | 'credentials_login_failed' | 'data_exported' | 'email_verified' | 'identity_conflict' | 'impersonation_ended' | 'impersonation_started' | 'invitation_accepted' | 'invitation_created' | 'logout' | 'membership_removed' | 'mfa_challenge' | 'mfa_challenge_failed' | 'mfa_enrolled' | 'oauth_login' | 'organization_created' | 'password_reset' | 'passwordless_login' | 'register' | 'role_assigned' | 'scim_provision' | 'scim_token_created' | 'session_revoked' | 'setup_session_created' | 'sso_connection_configured' | 'sso_login' | 'token_refreshed' | 'token_revoked' | 'webauthn_authenticated' | 'webauthn_registered';
+export type AuditEventType = 'account_deleted' | 'agent_credential_issued' | 'agent_delegated' | 'agent_registered' | 'agent_revoked' | 'authorization_denied' | 'credentials_login' | 'credentials_login_failed' | 'data_exported' | 'email_verified' | 'identity_conflict' | 'impersonation_ended' | 'impersonation_started' | 'invitation_accepted' | 'invitation_created' | 'logout' | 'membership_removed' | 'mfa_challenge' | 'mfa_challenge_failed' | 'mfa_enrolled' | 'oauth_login' | 'organization_created' | 'password_reset' | 'passwordless_login' | 'register' | 'role_assigned' | 'scim_provision' | 'scim_token_created' | 'session_revoked' | 'setup_session_created' | 'sso_connection_configured' | 'sso_login' | 'token_refreshed' | 'token_revoked' | 'webauthn_authenticated' | 'webauthn_registered';
 export type AuditEvent = {
     at: number;
     ip?: string;