@absolutejs/auth 0.55.5 → 0.55.7

package/dist/audit/wrap.d.ts

@@ -1,9 +0,0 @@
-import type { CredentialsConfig } from '../credentials/config';
-import type { MfaConfig } from '../mfa/config';
-import type { OnCallbackSuccess, OnRevocationSuccess, OnSignOut } from '../types';
-import type { AuditEmitter } from './config';
-export declare const composeCallbackAudit: <UserType>(onCallbackSuccess: OnCallbackSuccess<UserType>, emit: AuditEmitter) => (context: Parameters<NonNullable<OnCallbackSuccess<UserType>>>[0]) => Promise<void | Response | import("..").StatusReturn>;
-export declare const composeCredentialsAudit: <UserType>(credentials: CredentialsConfig<UserType>, emit: AuditEmitter, getUserId?: (user: UserType) => string) => CredentialsConfig<UserType>;
-export declare const composeMfaAudit: <UserType>(mfa: MfaConfig<UserType>, emit: AuditEmitter) => MfaConfig<UserType>;
-export declare const composeRevocationAudit: (onRevocationSuccess: OnRevocationSuccess, emit: AuditEmitter) => (context: Parameters<NonNullable<OnRevocationSuccess>>[0]) => Promise<void | undefined>;
-export declare const composeSignOutAudit: <UserType>(onSignOut: OnSignOut<UserType>, emit: AuditEmitter) => (context: Parameters<NonNullable<OnSignOut<UserType>>>[0]) => Promise<void | undefined>;

package/dist/authInstance.d.ts

@@ -1,7 +0,0 @@
-import type { protectRoutePlugin } from './routes/protectRoute';
-/** The consumer-facing context contributed by `auth()`. Configurable auth
- * routes are available at runtime but intentionally omitted from this type:
- * their user-defined paths cannot form useful literal route declarations.
- * Optional step-up and agent contexts remain available through their explicit
- * plugins without multiplying the default application's Elysia type graph. */
-export type AuthInstance<UserType> = ReturnType<typeof protectRoutePlugin<UserType>>;

package/dist/authorization/config.d.ts

@@ -1,19 +0,0 @@
-import type { AuditEmitter } from '../audit/config';
-import type { AuthSessionStore } from '../session/types';
-import type { OrganizationId } from '../tenancy';
-export type PermissionContext<UserType> = {
-    organizationId?: OrganizationId;
-    permission: string;
-    user: UserType;
-};
-export type AuthorizationConfig<UserType> = {
-    hasPermission: (context: PermissionContext<UserType>) => boolean | Promise<boolean>;
-};
-export type PermissionCheck = {
-    organizationId?: OrganizationId;
-    permission: string;
-};
-export type AuthorizationPluginProps<UserType> = AuthorizationConfig<UserType> & {
-    authSessionStore?: AuthSessionStore<UserType>;
-    emit?: AuditEmitter;
-};

package/dist/authorization/protectPermission.d.ts

@@ -1,52 +0,0 @@
-import { Elysia } from 'elysia';
-import type { AuthorizationPluginProps, PermissionCheck } from './config';
-type PermissionFailError = {
-    readonly code: 'Bad Request';
-    readonly message: 'Cookies are missing';
-} | {
-    readonly code: 'Forbidden';
-    readonly message: 'Insufficient permissions';
-} | {
-    readonly code: 'Unauthorized';
-    readonly message: 'User is not authenticated';
-};
-export declare const protectPermissionPlugin: <UserType>({ authSessionStore, emit, hasPermission }: AuthorizationPluginProps<UserType>) => Elysia<"", {
-    decorator: {};
-    store: {
-        session: import("../session/internalData").InternalSessionRecord<UserType>;
-        unregisteredSession: import("../session/internalData").InternalUnregisteredSessionRecord;
-    };
-    derive: {
-        readonly protectPermission: <AuthReturn, AuthFailReturn>(check: PermissionCheck, handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: PermissionFailError) => AuthFailReturn) => Promise<import("elysia").ElysiaCustomStatusResponse<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaCustomStatusResponse<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn> | import("elysia").ElysiaCustomStatusResponse<"Forbidden", "Insufficient permissions", 403>>;
-    };
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: import("elysia").UnwrapRoute<{
-        cookie: import("@sinclair/typebox").TObject<{
-            user_session_id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TTemplateLiteralSyntax<"${string}-${string}-${string}-${string}-${string}">>;
-        }>;
-    }, {}, "">;
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: import("elysia").ExtractErrorFromHandle<{
-        readonly protectPermission: <AuthReturn, AuthFailReturn>(check: PermissionCheck, handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: PermissionFailError) => AuthFailReturn) => Promise<import("elysia").ElysiaCustomStatusResponse<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaCustomStatusResponse<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn> | import("elysia").ElysiaCustomStatusResponse<"Forbidden", "Insufficient permissions", 403>>;
-    }>;
-}, {}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}>;
-export {};

package/dist/compliance/cipher.d.ts

@@ -1,5 +0,0 @@
-export type SecretCipher = {
-    decrypt: (ciphertext: string) => Promise<string>;
-    encrypt: (plaintext: string) => Promise<string>;
-};
-export declare const createSecretCipher: (keyMaterial: string) => SecretCipher;

package/dist/compliance/config.d.ts

@@ -1,18 +0,0 @@
-import type { AuditEmitter } from '../audit/config';
-import type { AuthSessionStore } from '../session/types';
-import type { RouteString } from '../types';
-export type ComplianceConfig<UserType> = {
-    complianceRoute?: RouteString;
-    deleteUserData: (context: {
-        user: UserType;
-        userId?: string;
-    }) => void | Promise<void>;
-    exportUserData: (context: {
-        user: UserType;
-    }) => Record<string, unknown> | Promise<Record<string, unknown>>;
-    getUserId?: (user: UserType) => string;
-};
-export type CompliancePluginProps<UserType> = ComplianceConfig<UserType> & {
-    authSessionStore?: AuthSessionStore<UserType>;
-    emit?: AuditEmitter;
-};

package/dist/compliance/redaction.d.ts

@@ -1,8 +0,0 @@
-import type { AuditEvent } from '../audit/types';
-type AuditRedactorOptions = {
-    dropFields?: string[];
-    hashFields?: string[];
-    redactIp?: boolean;
-};
-export declare const createAuditRedactor: ({ dropFields, hashFields, redactIp }: AuditRedactorOptions) => (event: AuditEvent) => Promise<AuditEvent>;
-export {};

package/dist/compliance/routes.d.ts

@@ -1,89 +0,0 @@
-import { Elysia } from 'elysia';
-import type { CompliancePluginProps } from './config';
-export declare const complianceRoutes: <UserType>({ authSessionStore, complianceRoute, deleteUserData, emit, exportUserData, getUserId }: CompliancePluginProps<UserType>) => Elysia<"", {
-    decorator: {};
-    store: {
-        session: import("../session/internalData").InternalSessionRecord<UserType>;
-        unregisteredSession: import("../session/internalData").InternalUnregisteredSessionRecord;
-    };
-    derive: {};
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: {};
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: {};
-}, {
-    [x: string]: {
-        export: {
-            get: {
-                body: unknown;
-                params: {};
-                query: unknown;
-                headers: unknown;
-                response: {
-                    401: "Authentication required";
-                    200: {
-                        [x: string]: unknown;
-                    };
-                    422: {
-                        type: "validation";
-                        on: string;
-                        summary?: string;
-                        message?: string;
-                        found?: unknown;
-                        property?: string;
-                        expected?: string;
-                    };
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        delete: {
-            body: unknown;
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                401: "Authentication required";
-                200: {
-                    readonly deleted: true;
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-} & {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}>;

package/dist/constants.d.ts

@@ -1,10 +0,0 @@
-export declare const SECONDS_IN_A_MINUTE = 60;
-export declare const MILLISECONDS_IN_A_SECOND = 1000;
-export declare const MILLISECONDS_IN_A_MINUTE: number;
-export declare const MINUTES_IN_AN_HOUR = 60;
-export declare const HOURS_IN_A_DAY = 24;
-export declare const MILLISECONDS_IN_A_DAY: number;
-export declare const MILLISECONDS_IN_AN_HOUR: number;
-export declare const COOKIE_MINUTES = 30;
-export declare const COOKIE_DURATION: number;
-export declare const DEFAULT_MAX_SESSIONS = 10000;

package/dist/credentials/backgroundOps.d.ts

@@ -1,45 +0,0 @@
-export type BreachRecord = {
-    addedDate: string;
-    dataClasses?: string[];
-    name: string;
-};
-export type EmailBreachEvent = {
-    breaches: BreachRecord[];
-    email: string;
-};
-export type EmailBreachScanInput = {
-    hibpApiKey: string;
-    iterateEmails: (cursor: string | undefined) => Promise<{
-        emails: string[];
-        nextCursor: string | undefined;
-    }>;
-    onBreachFound: (event: EmailBreachEvent) => Promise<void> | void;
-    pauseMs?: number;
-    truncateResponse?: boolean;
-};
-export type EmailBreachScanResult = {
-    breached: number;
-    scanned: number;
-};
-export declare const runEmailBreachScan: (input: EmailBreachScanInput) => Promise<EmailBreachScanResult>;
-export type InactiveUserCandidate = {
-    createdAt?: number;
-    lastLoginAt: number | null;
-    userId: string;
-};
-export type PruneInactiveUsersInput = {
-    dryRun?: boolean;
-    iterateUsers: (cursor: string | undefined) => Promise<{
-        nextCursor: string | undefined;
-        users: InactiveUserCandidate[];
-    }>;
-    now?: () => number;
-    olderThanDays: number;
-    onDelete: (userId: string) => Promise<void> | void;
-};
-export type PruneInactiveUsersResult = {
-    dryRun: boolean;
-    prunedUserIds: string[];
-    scanned: number;
-};
-export declare const pruneInactiveUsers: (input: PruneInactiveUsersInput) => Promise<PruneInactiveUsersResult>;

package/dist/credentials/config.d.ts

@@ -1,68 +0,0 @@
-import type { LockoutGuard } from '../lockout/config';
-import type { AuthSessionStore } from '../session/types';
-import type { OrganizationId } from '../tenancy';
-import type { RouteString, StatusReturn, UserSessionId } from '../types';
-import type { PasswordPolicy } from './passwordPolicy';
-import type { CredentialStore } from './types';
-export declare const DEFAULT_CREDENTIAL_SESSION_TTL_MS: number;
-export declare const DEFAULT_RESET_TOKEN_TTL_MS: number;
-export declare const DEFAULT_VERIFICATION_TOKEN_TTL_MS: number;
-export type CredentialIdentity = {
-    email: string;
-    organizationId?: OrganizationId;
-};
-export type CredentialEmailType = 'reset_password' | 'verify_email';
-export type CredentialEmailMessage = {
-    email: string;
-    expiresAt: number;
-    token: string;
-    type: CredentialEmailType;
-};
-export type CredentialsConfig<UserType> = {
-    checkBreachesOnLogin?: boolean;
-    credentialStore: CredentialStore;
-    getUserByEmail: (email: string) => Promise<UserType | null | undefined> | UserType | null | undefined;
-    isMfaRequired?: (user: UserType, context?: {
-        headers: Record<string, string | undefined>;
-        ip?: string;
-    }) => boolean | Promise<boolean>;
-    passwordVerifier?: (plainPassword: string, storedHash: string) => Promise<boolean>;
-    rehashOnLogin?: boolean;
-    loginRoute?: RouteString;
-    onCreateCredentialUser: (identity: CredentialIdentity & Record<string, unknown>) => Promise<Response | StatusReturn | UserType> | Response | StatusReturn | UserType;
-    onCredentialsLoginError?: (context: {
-        email: string;
-        error: unknown;
-    }) => void | Promise<void>;
-    onCredentialsLoginSuccess?: (context: {
-        user: UserType;
-        userSessionId: UserSessionId;
-    }) => void | Promise<void>;
-    onEmailVerified?: (context: {
-        email: string;
-    }) => void | Promise<void>;
-    onPasswordReset?: (context: {
-        email: string;
-    }) => void | Promise<void>;
-    onRegistrationSuccess?: (context: {
-        email: string;
-        user: UserType;
-    }) => void | Promise<void>;
-    onSendEmail: (message: CredentialEmailMessage) => void | Promise<void>;
-    passwordPolicy?: PasswordPolicy;
-    registerRoute?: RouteString;
-    /** When true, registration creates the account but NOT a session, and login is
-     *  rejected until the email is verified. Default false = auto-login on register and
-     *  verification acts as a soft, later gate. */
-    requireEmailVerification?: boolean;
-    resetPasswordRoute?: RouteString;
-    resetTokenDurationMs?: number;
-    sessionDurationMs?: number;
-    verificationTokenDurationMs?: number;
-    verifyEmailRoute?: RouteString;
-};
-export type CredentialRouteProps<UserType> = CredentialsConfig<UserType> & {
-    authSessionStore?: AuthSessionStore<UserType>;
-    cookieSecure?: boolean;
-    lockoutGuard?: LockoutGuard;
-};

package/dist/credentials/emailValidation.d.ts

@@ -1,9 +0,0 @@
-export type EmailValidationResult = {
-    ok: boolean;
-    reason?: 'disposable' | 'invalid_format' | 'no_mx';
-};
-export declare const isDisposableEmail: (email: string, extraDomains?: Iterable<string>) => boolean;
-export declare const validateEmailDeliverability: (email: string, options?: {
-    checkMx?: boolean;
-    disposableDomains?: Iterable<string>;
-}) => Promise<EmailValidationResult>;

package/dist/credentials/emailVerification.d.ts

@@ -1,83 +0,0 @@
-import { Elysia } from 'elysia';
-import { type CredentialsConfig } from './config';
-export declare const credentialsEmailVerification: <UserType>({ credentialStore, onEmailVerified, onSendEmail, verificationTokenDurationMs, verifyEmailRoute }: CredentialsConfig<UserType>) => Elysia<"", {
-    decorator: {};
-    store: {};
-    derive: {};
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: {};
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: {};
-}, {
-    [x: string]: {
-        post: {
-            body: {
-                token: string;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                400: "Invalid or expired verification token";
-                200: {
-                    readonly status: "email_verified";
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        request: {
-            post: {
-                body: {
-                    email: string;
-                };
-                params: {};
-                query: unknown;
-                headers: unknown;
-                response: {
-                    200: {
-                        readonly status: "verification_requested";
-                    };
-                    422: {
-                        type: "validation";
-                        on: string;
-                        summary?: string;
-                        message?: string;
-                        found?: unknown;
-                        property?: string;
-                        expected?: string;
-                    };
-                };
-            };
-        };
-    };
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}>;

package/dist/credentials/import.d.ts

@@ -1,34 +0,0 @@
-import type { CredentialRecord, CredentialStore } from './types';
-export type ImportableUser<UserType> = {
-    passwordHash?: string;
-    user: UserType;
-};
-export type ImportUserResult<UserType> = {
-    error: string;
-    ok: false;
-    user: UserType;
-} | {
-    credential?: CredentialRecord;
-    ok: true;
-    user: UserType;
-};
-export type ImportUsersOptions<UserType> = {
-    onCreateUser: (input: ImportableUser<UserType>) => Promise<{
-        email: string;
-        emailVerified?: boolean;
-        userId?: string;
-    } | null>;
-    concurrency?: number;
-    credentialStore: CredentialStore;
-};
-export declare const importUser: <UserType>(input: ImportableUser<UserType>, options: ImportUsersOptions<UserType>) => Promise<ImportUserResult<UserType>>;
-export declare const importUsers: <UserType>(inputs: readonly ImportableUser<UserType>[], options: ImportUsersOptions<UserType>) => Promise<{
-    failed: number;
-    results: ImportUserResult<UserType>[];
-    succeeded: number;
-}>;
-export declare const rehashCredentialPassword: ({ credentialStore, current, plainPassword }: {
-    credentialStore: CredentialStore;
-    current: CredentialRecord;
-    plainPassword: string;
-}) => Promise<void>;

package/dist/credentials/inMemoryCredentialStore.d.ts

@@ -1,2 +0,0 @@
-import type { CredentialStore } from './types';
-export declare const createInMemoryCredentialStore: () => CredentialStore;

package/dist/credentials/legacyHashers.d.ts

@@ -1,3 +0,0 @@
-export declare const isLegacyHash: (storedHash: string) => boolean;
-export declare const verifyAuth0Pbkdf2: (plainPassword: string, wrappedHash: string) => Promise<boolean>;
-export declare const verifyCognitoSha256: (plainPassword: string, wrappedHash: string) => Promise<boolean>;

package/dist/credentials/login.d.ts

@@ -1,76 +0,0 @@
-import { Elysia } from 'elysia';
-import { type CredentialRouteProps } from './config';
-export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, cookieSecure, credentialStore, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, passwordVerifier, rehashOnLogin, requireEmailVerification, sessionDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
-    decorator: {};
-    store: {
-        session: import("../session/internalData").InternalSessionRecord<UserType>;
-        unregisteredSession: import("../session/internalData").InternalUnregisteredSessionRecord;
-    };
-    derive: {};
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: {};
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: {};
-}, {
-    [x: string]: {
-        post: {
-            body: {
-                email: string;
-                password: string;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                401: "Invalid email or password";
-                403: {
-                    readonly status: "email_not_verified";
-                };
-                200: {
-                    readonly status: "mfa_required";
-                } | {
-                    readonly passwordCompromised: boolean;
-                    readonly status: "authenticated";
-                };
-                429: {
-                    readonly retryAfterMs: number | undefined;
-                    readonly status: "account_locked";
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-} & {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}>;

package/dist/credentials/passwordPolicy.d.ts

@@ -1,15 +0,0 @@
-export type PasswordPolicy = {
-    checkBreaches?: boolean;
-    minLength?: number;
-    requireDigit?: boolean;
-    requireLowercase?: boolean;
-    requireSymbol?: boolean;
-    requireUppercase?: boolean;
-};
-export type PasswordPolicyViolation = 'breached' | 'missing_digit' | 'missing_lowercase' | 'missing_symbol' | 'missing_uppercase' | 'too_short';
-export type PasswordPolicyResult = {
-    ok: boolean;
-    violations: PasswordPolicyViolation[];
-};
-export declare const evaluatePassword: (password: string, policy?: PasswordPolicy) => Promise<PasswordPolicyResult>;
-export declare const isPasswordCompromised: (password: string) => Promise<boolean>;

package/dist/credentials/passwordReset.d.ts

@@ -1,87 +0,0 @@
-import { Elysia } from 'elysia';
-import { type CredentialsConfig } from './config';
-export declare const credentialsPasswordReset: <UserType>({ credentialStore, onPasswordReset, onSendEmail, passwordPolicy, resetPasswordRoute, resetTokenDurationMs }: CredentialsConfig<UserType>) => Elysia<"", {
-    decorator: {};
-    store: {};
-    derive: {};
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: {};
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: {};
-}, {
-    [x: string]: {
-        request: {
-            post: {
-                body: {
-                    email: string;
-                };
-                params: {};
-                query: unknown;
-                headers: unknown;
-                response: {
-                    200: {
-                        readonly status: "reset_requested";
-                    };
-                    422: {
-                        type: "validation";
-                        on: string;
-                        summary?: string;
-                        message?: string;
-                        found?: unknown;
-                        property?: string;
-                        expected?: string;
-                    };
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        post: {
-            body: {
-                token: string;
-                password: string;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                400: "Invalid or expired reset token" | {
-                    readonly message: "Password does not meet the policy";
-                    readonly violations: import("./passwordPolicy").PasswordPolicyViolation[];
-                };
-                200: {
-                    readonly status: "password_reset";
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}>;