@absolutejs/auth 0.54.9 → 0.55.1

package/dist/agents/types.d.ts

@@ -68,3 +68,62 @@ export type AgentPrincipal = {
     trust: 'delegated' | 'registered';
     userId?: string;
 };
+export type AgentIdentityRegistrationKind = 'anonymous' | 'identity_assertion' | 'service_auth';
+export type AgentIdentityRegistrationStatus = 'claimed' | 'pending' | 'revoked';
+export type AgentClaimAttempt = {
+    attempts: number;
+    email: string;
+    expiresAt: number;
+    tokenHash: string;
+    userCodeHash: string;
+};
+/** Durable state for the open auth.md registration profile. Secrets are
+ * represented only by hashes; plaintext claim and attempt tokens are returned
+ * once to the agent and never persisted. `version` is used for compare-and-swap
+ * updates so claim completion is safe across multiple application instances. */
+export type AgentIdentityRegistration = {
+    agentId: string;
+    claimAttempt?: AgentClaimAttempt;
+    claimExpiresAt: number;
+    claimTokenHash: string;
+    createdAt: number;
+    expiresAt: number;
+    kind: AgentIdentityRegistrationKind;
+    loginHint?: string;
+    lastPolledAt?: number;
+    registrationId: string;
+    status: AgentIdentityRegistrationStatus;
+    updatedAt: number;
+    upstream?: {
+        clientId: string;
+        issuer: string;
+        subject: string;
+    };
+    userId?: string;
+    version: number;
+};
+export type AgentIdentityRegistrationStore = {
+    create: (registration: AgentIdentityRegistration) => Promise<boolean>;
+    findByClaimTokenHash: (claimTokenHash: string) => Promise<AgentIdentityRegistration | undefined>;
+    findByAgentId: (agentId: string) => Promise<AgentIdentityRegistration | undefined>;
+    findByRegistrationId: (registrationId: string) => Promise<AgentIdentityRegistration | undefined>;
+    findByUpstreamIdentity: (query: {
+        clientId: string;
+        issuer: string;
+        subject: string;
+    }) => Promise<AgentIdentityRegistration | undefined>;
+    findByAttemptTokenHash: (attemptTokenHash: string) => Promise<AgentIdentityRegistration | undefined>;
+    /** Replaces a record only when its current version equals expectedVersion. */
+    replace: (registration: AgentIdentityRegistration, expectedVersion: number) => Promise<boolean>;
+};
+export type VerifiedAgentIdentityAssertion = {
+    authenticatedAt: number;
+    clientId: string;
+    email?: string;
+    emailVerified?: boolean;
+    issuer: string;
+    name?: string;
+    phoneNumber?: string;
+    phoneNumberVerified?: boolean;
+    subject: string;
+};

package/dist/apikeys/routes.d.ts

@@ -48,8 +48,8 @@ export declare const apiKeysRoutes: ({ accessTokenStore, accessTokenTtlMs, apiCl
             body: {
                 client_id?: string | undefined;
                 scope?: string | undefined;
-                client_secret?: string | undefined;
                 grant_type?: string | undefined;
+                client_secret?: string | undefined;
             };
             params: {};
             query: unknown;

package/dist/authInstance.d.ts

@@ -0,0 +1,12 @@
+import type { Elysia } from 'elysia';
+import type { agentAuthContextPlugin } from './agents/routes';
+import type { protectRoutePlugin } from './routes/protectRoute';
+import type { stepUpPlugin } from './routes/stepUp';
+/** Merge the stable context contributed by independent Auth plugins without
+ * exposing the configurable route graph in consumer declarations. */
+type MergeAuthContext<Base, Extra> = Base extends Elysia<infer Path, infer Singleton, infer Definitions, infer Metadata, infer Routes, infer Ephemeral, infer Volatile> ? Extra extends Elysia<infer ExtraPath, infer ExtraSingleton, infer ExtraDefinitions, infer ExtraMetadata, infer ExtraRoutes, infer ExtraEphemeral, infer ExtraVolatile> ? Elysia<Path & ExtraPath, Singleton & ExtraSingleton, Definitions & ExtraDefinitions, Metadata & ExtraMetadata, Routes & ExtraRoutes, Ephemeral & ExtraEphemeral, Volatile & ExtraVolatile> : never : never;
+/** The consumer-facing context contributed by `auth()`. Configurable auth
+ * routes are available at runtime but intentionally omitted from this type:
+ * their user-defined paths cannot form useful literal route declarations. */
+export type AuthInstance<UserType> = MergeAuthContext<MergeAuthContext<ReturnType<typeof protectRoutePlugin<UserType>>, ReturnType<typeof stepUpPlugin<UserType>>>, ReturnType<typeof agentAuthContextPlugin>>;
+export {};

package/dist/authorization/protectPermission.d.ts

@@ -17,7 +17,7 @@ export declare const protectPermissionPlugin: <UserType>({ authSessionStore, emi
         unregisteredSession: import("..").UnregisteredSessionRecord;
     };
     derive: {
-        readonly protectPermission: <AuthReturn, AuthFailReturn>(check: PermissionCheck, handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: PermissionFailError) => AuthFailReturn) => Promise<AuthReturn | import("elysia").ElysiaCustomStatusResponse<"Bad Request", "Cookies are missing", 400> | NonNullable<AuthFailReturn> | import("elysia").ElysiaCustomStatusResponse<"Unauthorized", "User is not authenticated", 401> | import("elysia").ElysiaCustomStatusResponse<"Forbidden", "Insufficient permissions", 403>>;
+        readonly protectPermission: <AuthReturn, AuthFailReturn>(check: PermissionCheck, handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: PermissionFailError) => AuthFailReturn) => Promise<import("elysia").ElysiaCustomStatusResponse<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaCustomStatusResponse<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn> | import("elysia").ElysiaCustomStatusResponse<"Forbidden", "Insufficient permissions", 403>>;
     };
     resolve: {};
 }, {
@@ -34,7 +34,7 @@ export declare const protectPermissionPlugin: <UserType>({ authSessionStore, emi
     macroFn: {};
     parser: {};
     response: import("elysia").ExtractErrorFromHandle<{
-        readonly protectPermission: <AuthReturn, AuthFailReturn>(check: PermissionCheck, handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: PermissionFailError) => AuthFailReturn) => Promise<AuthReturn | import("elysia").ElysiaCustomStatusResponse<"Bad Request", "Cookies are missing", 400> | NonNullable<AuthFailReturn> | import("elysia").ElysiaCustomStatusResponse<"Unauthorized", "User is not authenticated", 401> | import("elysia").ElysiaCustomStatusResponse<"Forbidden", "Insufficient permissions", 403>>;
+        readonly protectPermission: <AuthReturn, AuthFailReturn>(check: PermissionCheck, handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: PermissionFailError) => AuthFailReturn) => Promise<import("elysia").ElysiaCustomStatusResponse<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaCustomStatusResponse<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn> | import("elysia").ElysiaCustomStatusResponse<"Forbidden", "Insufficient permissions", 403>>;
     }>;
 }, {}, {
     derive: {};

package/dist/cli/migrate.js

@@ -341,7 +341,14 @@ var apiKeysTable = pgTable2("auth_api_keys", {
 
 // src/agents/postgresStores.ts
 import { and as and2, desc as desc3, eq as eq3, gt, isNull, or } from "drizzle-orm";
-import { bigint as bigint3, jsonb, pgTable as pgTable3, varchar as varchar3 } from "drizzle-orm/pg-core";
+import {
+  bigint as bigint3,
+  integer,
+  jsonb,
+  pgTable as pgTable3,
+  uniqueIndex,
+  varchar as varchar3
+} from "drizzle-orm/pg-core";
 var ID_LENGTH3 = 255;
 var NAME_LENGTH = 255;
 var STATUS_LENGTH = 16;
@@ -359,6 +366,38 @@ var agentDelegationsTable = pgTable3("auth_agent_delegations", {
   updated_at_ms: bigint3("updated_at_ms", { mode: "number" }).notNull(),
   user_id: varchar3("user_id", { length: ID_LENGTH3 }).notNull()
 });
+var agentIdentityRegistrationsTable = pgTable3("auth_agent_identity_registrations", {
+  agent_id: varchar3("agent_id", { length: ID_LENGTH3 }).notNull().unique(),
+  claim_attempt: jsonb("claim_attempt").$type(),
+  claim_attempt_token_hash: varchar3("claim_attempt_token_hash", {
+    length: ID_LENGTH3
+  }).unique(),
+  claim_expires_at_ms: bigint3("claim_expires_at_ms", {
+    mode: "number"
+  }).notNull(),
+  claim_token_hash: varchar3("claim_token_hash", {
+    length: ID_LENGTH3
+  }).notNull().unique(),
+  created_at_ms: bigint3("created_at_ms", { mode: "number" }).notNull(),
+  expires_at_ms: bigint3("expires_at_ms", { mode: "number" }).notNull(),
+  kind: varchar3("kind", { length: 32 }).$type().notNull(),
+  last_polled_at_ms: bigint3("last_polled_at_ms", { mode: "number" }),
+  login_hint: varchar3("login_hint", { length: ID_LENGTH3 }),
+  registration_id: varchar3("registration_id", {
+    length: ID_LENGTH3
+  }).primaryKey(),
+  status: varchar3("status", { length: STATUS_LENGTH }).$type().notNull(),
+  updated_at_ms: bigint3("updated_at_ms", { mode: "number" }).notNull(),
+  upstream_client_id: varchar3("upstream_client_id", {
+    length: ID_LENGTH3
+  }),
+  upstream_issuer: varchar3("upstream_issuer", { length: ID_LENGTH3 }),
+  upstream_subject: varchar3("upstream_subject", { length: ID_LENGTH3 }),
+  user_id: varchar3("user_id", { length: ID_LENGTH3 }),
+  version: integer("version").notNull()
+}, (table) => [
+  uniqueIndex("auth_agent_identity_upstream_unique").on(table.upstream_issuer, table.upstream_subject, table.upstream_client_id)
+]);
 var agentRegistrationsTable = pgTable3("auth_agent_registrations", {
   agent_id: varchar3("agent_id", { length: ID_LENGTH3 }).primaryKey(),
   allowed_scopes: jsonb("allowed_scopes").$type().notNull().default([]),
@@ -2524,10 +2563,10 @@ var linkedProviderGrantsTable = pgTable7("linked_provider_grants", {
 
 // src/lockout/postgresLockoutStore.ts
 import { eq as eq8 } from "drizzle-orm";
-import { bigint as bigint6, integer, pgTable as pgTable8, varchar as varchar8 } from "drizzle-orm/pg-core";
+import { bigint as bigint6, integer as integer2, pgTable as pgTable8, varchar as varchar8 } from "drizzle-orm/pg-core";
 var KEY_LENGTH = 320;
 var lockoutsTable = pgTable8("auth_lockouts", {
-  failed_attempts: integer("failed_attempts").notNull().default(0),
+  failed_attempts: integer2("failed_attempts").notNull().default(0),
   key: varchar8("key", { length: KEY_LENGTH }).primaryKey(),
   locked_until_ms: bigint6("locked_until_ms", { mode: "number" }),
   window_started_at_ms: bigint6("window_started_at_ms", {
@@ -3081,10 +3120,20 @@ var mfaTotpLockoutMigration = {
 };
 var blockMigrations = {
   adaptive: initMigration("adaptive", [knownDevicesTable, loginHistoryTable]),
-  agents: initMigration("agents", [
-    agentRegistrationsTable,
-    agentDelegationsTable
-  ]),
+  agents: {
+    block: "agents",
+    migrations: [
+      ...initMigration("agents", [
+        agentRegistrationsTable,
+        agentDelegationsTable,
+        agentIdentityRegistrationsTable
+      ]).migrations,
+      {
+        id: "0002_identity_registration",
+        sql: tablesToInitSql([agentIdentityRegistrationsTable])
+      }
+    ]
+  },
   apikeys: initMigration("apikeys", [
     accessTokensTable,
     apiClientsTable,
@@ -3313,5 +3362,5 @@ var main = async () => {
 };
 await main();
 
-//# debugId=0F50F54AA9959FD164756E2164756E21
+//# debugId=2CDEAF9E7315372064756E2164756E21
 //# sourceMappingURL=migrate.js.map