@absolutejs/auth 0.55.5 → 0.55.7

package/dist/mfa/routes.d.ts

@@ -1,234 +0,0 @@
-import { Elysia } from 'elysia';
-import type { MfaRouteProps } from './config';
-export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => Elysia<"", {
-    decorator: {};
-    store: {
-        session: import("../session/internalData").InternalSessionRecord<UserType>;
-        unregisteredSession: import("../session/internalData").InternalUnregisteredSessionRecord;
-    };
-    derive: {};
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: {};
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: {};
-}, {
-    [x: string]: {
-        get: {
-            body: unknown;
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                401: "Authentication required";
-                200: {
-                    backupCodesRemaining: number;
-                    enabled: boolean;
-                    smsBackup: {
-                        enabled: boolean;
-                        phone: string | null;
-                    };
-                    totp: {
-                        enabled: boolean;
-                    };
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        delete: {
-            body: unknown;
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                401: "Authentication required";
-                200: {
-                    readonly status: "disabled";
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        post: {
-            body: unknown;
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                401: "Authentication required";
-                200: {
-                    readonly secret: string;
-                    readonly uri: string;
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        post: {
-            body: {
-                code: string;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
-                401: "Authentication required";
-                200: {
-                    readonly backupCodes: string[];
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        post: {
-            body: {
-                phone: string;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                400: "Phone must be in E.164 format";
-                401: "Authentication required";
-                200: {
-                    readonly phone: string;
-                };
-                501: "SMS MFA is not configured";
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        post: {
-            body: {
-                code: string;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                400: "No SMS enrollment in progress" | "SMS code expired" | "Invalid SMS code";
-                401: "Authentication required";
-                200: {
-                    readonly status: "enrolled";
-                };
-                429: "Too many attempts";
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        post: {
-            body: {
-                code?: string | undefined;
-                action?: "verify" | "send" | undefined;
-                factor?: "sms" | undefined;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                400: "SMS code required" | "No SMS code in progress";
-                401: "SMS code expired" | "Too many attempts" | "No MFA challenge in progress" | "Invalid MFA code";
-                200: {
-                    readonly status: "sent";
-                } | {
-                    readonly status: "authenticated";
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-} & {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}>;

package/dist/mfa/secret.d.ts

@@ -1,2 +0,0 @@
-export declare const decryptTotpSecret: (ciphertext: string, encryptionKey?: string) => Promise<string>;
-export declare const encryptTotpSecret: (secret: string, encryptionKey?: string) => Promise<string>;

package/dist/mfa/sms.d.ts

@@ -1,105 +0,0 @@
-import { Elysia } from 'elysia';
-import { type MfaRouteProps, type SmsCodeMessage } from './config';
-import type { MfaEnrollment, MFAStore } from './types';
-export declare const isE164Phone: (phone: string) => boolean;
-export declare const issueAndStoreSmsCode: ({ codeLength, enrollment, mfaStore, onSendSmsCode, ttlMs }: {
-    codeLength: number;
-    enrollment: MfaEnrollment;
-    mfaStore: MFAStore;
-    onSendSmsCode?: (message: SmsCodeMessage) => void | Promise<void>;
-    ttlMs: number;
-}) => Promise<number | undefined>;
-export declare const maskPhone: (phone: string) => string;
-export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfaStore, onMfaEnrolled, onSendSmsCode, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsSetupRoute, smsVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
-    decorator: {};
-    store: {
-        session: import("../session/internalData").InternalSessionRecord<UserType>;
-        unregisteredSession: import("../session/internalData").InternalUnregisteredSessionRecord;
-    };
-    derive: {};
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: {};
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: {};
-}, {
-    [x: string]: {
-        post: {
-            body: {
-                phone: string;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                400: "Phone must be in E.164 format";
-                401: "Authentication required";
-                200: {
-                    readonly phone: string;
-                };
-                501: "SMS MFA is not configured";
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        post: {
-            body: {
-                code: string;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                400: "No SMS enrollment in progress" | "SMS code expired" | "Invalid SMS code";
-                401: "Authentication required";
-                200: {
-                    readonly status: "enrolled";
-                };
-                429: "Too many attempts";
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-} & {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}>;

package/dist/mfa/totp.d.ts

@@ -1,91 +0,0 @@
-import { Elysia } from 'elysia';
-import { type MfaRouteProps } from './config';
-export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCount, encryptionKey, getUserId, issuer, mfaStore, onMfaEnrolled, totpSetupRoute, totpVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
-    decorator: {};
-    store: {
-        session: import("../session/internalData").InternalSessionRecord<UserType>;
-        unregisteredSession: import("../session/internalData").InternalUnregisteredSessionRecord;
-    };
-    derive: {};
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: {};
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: {};
-}, {
-    [x: string]: {
-        post: {
-            body: unknown;
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                401: "Authentication required";
-                200: {
-                    readonly secret: string;
-                    readonly uri: string;
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        post: {
-            body: {
-                code: string;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
-                401: "Authentication required";
-                200: {
-                    readonly backupCodes: string[];
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-} & {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}>;

package/dist/mfa/types.d.ts

@@ -1,23 +0,0 @@
-export type MfaFactorType = 'backup_codes' | 'sms' | 'totp';
-export type MfaEnrollment = {
-    backupCodeHashes: string[];
-    createdAt: number;
-    lastUsedAt?: number;
-    smsFailedAttempts?: number;
-    smsPendingCodeHash?: string;
-    smsPendingCodeExpiresAt?: number;
-    smsPhone?: string;
-    smsVerified: boolean;
-    totpFailedAttempts?: number;
-    totpSecretCiphertext?: string;
-    totpVerified: boolean;
-    updatedAt: number;
-    userId: string;
-};
-export type MFAStore = {
-    getEnrollment: (userId: string) => Promise<MfaEnrollment | undefined>;
-    listEnrollments: () => Promise<MfaEnrollment[]>;
-    removeEnrollment: (userId: string) => Promise<void>;
-    saveEnrollment: (enrollment: MfaEnrollment) => Promise<void>;
-};
-export declare const isMfaEnrolled: (enrollment: MfaEnrollment | undefined) => boolean;

package/dist/migrations/generate.d.ts

@@ -1,2 +0,0 @@
-import { type PgTable } from 'drizzle-orm/pg-core';
-export declare const tablesToInitSql: (tables: PgTable[]) => string;

package/dist/migrations/index.d.ts

@@ -1,5 +0,0 @@
-import type { BlockMigrations } from './types';
-export type BlockName = 'adaptive' | 'agents' | 'apikeys' | 'audit' | 'credentials' | 'fga' | 'linkedProviders' | 'lockout' | 'mfa' | 'oidc' | 'organizations' | 'passwordless' | 'portal' | 'roles' | 'scim' | 'sessions' | 'sso' | 'vault' | 'vc' | 'webauthn' | 'webhooks';
-export declare const blockMigrations: Record<BlockName, BlockMigrations>;
-export { runMigrations } from './runner';
-export type { Migration, BlockMigrations } from './types';

package/dist/migrations/runner.d.ts

@@ -1,13 +0,0 @@
-import { type BlockName } from './index';
-export type RunMigrationsOptions = {
-    databaseUrl: string;
-    /** Subset of blocks to apply. Omit to apply every block the package ships. */
-    blocks?: BlockName[];
-    /** Optional logger; defaults to console.log. Pass `() => undefined` for silent mode. */
-    log?: (message: string) => void;
-};
-export type MigrationRunResult = {
-    applied: string[];
-    skipped: string[];
-};
-export declare const runMigrations: ({ blocks, databaseUrl, log }: RunMigrationsOptions) => Promise<MigrationRunResult>;

package/dist/migrations/types.d.ts

@@ -1,14 +0,0 @@
-export type Migration = {
-    /** Stable identifier — stored in `auth_migrations` to track applied state. Must be
-     *  monotonically ordered within a block (e.g. `0001_init`, `0002_add_foo_column`). */
-    id: string;
-    /** Idempotent SQL. Use `CREATE TABLE IF NOT EXISTS` so re-running is a no-op even if
-     *  the consumer wired the tables by hand before adopting the migration runner. */
-    sql: string;
-};
-export type BlockMigrations = {
-    /** Block name as used in the CLI's `--blocks` flag and in `runMigrations({ blocks })`.
-     *  Convention: same string as the `src/<block>/` directory. */
-    block: string;
-    migrations: Migration[];
-};

package/dist/oidc/clientAuth.d.ts

@@ -1,19 +0,0 @@
-import type { ClientAssertionJtiStore, OAuthClient } from './types';
-export declare const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
-export declare const verifyClientAssertion: ({ assertion, expectedAudience, jtiStore, resolveClient }: {
-    assertion: string;
-    expectedAudience: string;
-    jtiStore?: ClientAssertionJtiStore;
-    resolveClient: (clientId: string) => Promise<OAuthClient | undefined>;
-}) => Promise<OAuthClient | undefined>;
-export declare const verifyJwtSignedByClient: ({ jwt, client }: {
-    client: OAuthClient;
-    jwt: string;
-}) => Promise<{
-    header: {
-        [k: string]: any;
-    };
-    payload: {
-        [k: string]: any;
-    };
-} | undefined>;

package/dist/oidc/clientIdMetadata.d.ts

@@ -1,32 +0,0 @@
-import type { OAuthClient } from './types';
-export type ClientIdMetadataDocument = {
-    client_id: string;
-    client_name?: string;
-    redirect_uris: string[];
-    grant_types?: string[];
-    response_types?: string[];
-    token_endpoint_auth_method?: 'none' | 'private_key_jwt' | 'self_signed_tls_client_auth';
-    application_type?: 'native' | 'web';
-    client_uri?: string;
-    logo_uri?: string;
-    policy_uri?: string;
-    tos_uri?: string;
-    jwks_uri?: string;
-    jwks?: {
-        keys: JsonWebKey[];
-    };
-    scope?: string;
-};
-export declare const validateClientIdMetadataDocument: (document: ClientIdMetadataDocument, expectedClientId: string) => string[];
-export declare const clientIdMetadataToOAuthClient: (document: ClientIdMetadataDocument) => OAuthClient;
-/** Resolve an HTTPS URL client_id into OAuth client metadata without prior
-    registration. Network access is injected so callers can enforce DNS/IP/redirect
-    policy with @absolutejs/egress. Redirects are forbidden and documents are capped
-    at 5 KiB per the IETF Client ID Metadata Document security guidance. */
-export declare const createClientIdMetadataResolver: ({ fetch: fetcher, allow, cacheTtlMs, maxBytes, now }: {
-    fetch: (input: string | URL, init?: RequestInit) => Promise<Response>;
-    allow?: (clientId: string) => boolean | Promise<boolean>;
-    cacheTtlMs?: number;
-    maxBytes?: number;
-    now?: () => number;
-}) => (clientId: string) => Promise<OAuthClient | undefined>;