@absolutejs/auth 0.56.19 → 0.57.1

package/dist/audit/postgresAuditStore.d.ts

@@ -1,5 +1,5 @@
 import { type AnyPgDatabase } from '../stores/postgres';
-import type { AuditSink } from './types';
+import { type AuditSink } from './types';
 export declare const auditEventsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_audit_events";
     schema: undefined;

package/dist/audit/types.d.ts

@@ -1,5 +1,7 @@
 import type { OrganizationId } from '../tenancy';
 export type AuditEventType = 'account_deleted' | 'agent_credential_issued' | 'agent_delegated' | 'agent_registered' | 'agent_revoked' | 'authorization_denied' | 'credentials_login' | 'credentials_login_failed' | 'data_exported' | 'email_verified' | 'identity_conflict' | 'impersonation_ended' | 'impersonation_started' | 'invitation_accepted' | 'invitation_created' | 'logout' | 'membership_removed' | 'mfa_challenge' | 'mfa_challenge_failed' | 'mfa_enrolled' | 'oauth_login' | 'organization_created' | 'password_reset' | 'passwordless_login' | 'register' | 'role_assigned' | 'scim_provision' | 'scim_token_created' | 'session_revoked' | 'setup_session_created' | 'sso_connection_configured' | 'sso_login' | 'token_refreshed' | 'token_revoked' | 'webauthn_authenticated' | 'webauthn_registered';
+export declare const AUDIT_EVENT_TYPES: readonly AuditEventType[];
+export declare const isAuditEventType: (value: string) => value is AuditEventType;
 export type AuditEvent = {
     at: number;
     ip?: string;

package/dist/audit/wrap.d.ts

@@ -1,8 +1,10 @@
 import type { CredentialsConfig } from '../credentials/config';
 import type { MfaConfig } from '../mfa/config';
-import type { OnCallbackSuccess, OnRevocationSuccess, OnSignOut } from '../types';
+import type { OnRevocationSuccess, OnSignOut } from '../types';
 import type { AuditEmitter } from './config';
-export declare const composeCallbackAudit: <UserType>(onCallbackSuccess: OnCallbackSuccess<UserType>, emit: AuditEmitter) => (context: Parameters<NonNullable<OnCallbackSuccess<UserType>>>[0]) => Promise<void | Response | import("..").StatusReturn>;
+export declare const composeCallbackAudit: <Context extends {
+    authProvider: string;
+}, Result>(onCallbackSuccess: ((context: Context) => Promise<Result> | Result) | undefined, emit: AuditEmitter) => (context: Context) => Promise<Result | undefined>;
 export declare const composeCredentialsAudit: <UserType>(credentials: CredentialsConfig<UserType>, emit: AuditEmitter, getUserId?: (user: UserType) => string) => CredentialsConfig<UserType>;
 export declare const composeMfaAudit: <UserType>(mfa: MfaConfig<UserType>, emit: AuditEmitter) => MfaConfig<UserType>;
 export declare const composeRevocationAudit: (onRevocationSuccess: OnRevocationSuccess, emit: AuditEmitter) => (context: Parameters<NonNullable<OnRevocationSuccess>>[0]) => Promise<void | undefined>;

package/dist/cli/import/auth0.d.ts

@@ -1,2 +1,2 @@
-import type { Importer } from './types';
+import { type Importer } from './types';
 export declare const auth0Importer: Importer;

package/dist/cli/import/clerk.d.ts

@@ -1,2 +1,2 @@
-import type { Importer } from './types';
+import { type Importer } from './types';
 export declare const clerkImporter: Importer;

package/dist/cli/import/lucia.d.ts

@@ -1,2 +1,2 @@
-import type { Importer } from './types';
+import { type Importer } from './types';
 export declare const luciaImporter: Importer;

package/dist/cli/import/nextauth.d.ts

@@ -1,2 +1,2 @@
-import type { Importer } from './types';
+import { type Importer } from './types';
 export declare const nextauthImporter: Importer;

package/dist/cli/import/types.d.ts

@@ -1,3 +1,4 @@
+export declare const detectPasswordHashAlgorithm: (hash?: string) => ImportedUser['passwordHashAlgo'];
 export type ImportedUser = {
     createdAtMs: number;
     email: string;

package/dist/cli/migrate.js

@@ -6,13 +6,34 @@ import { neon } from "@neondatabase/serverless";
 
 // src/cli/import/auth0.ts
 import { readFile } from "fs/promises";
+
+// src/cli/import/types.ts
+var detectPasswordHashAlgorithm = (hash) => {
+  if (hash?.startsWith("$argon2id"))
+    return "argon2id";
+  if (hash?.startsWith("$2b$") || hash?.startsWith("$2a$") || hash?.startsWith("$2y$") || hash?.startsWith("$2"))
+    return "bcrypt";
+  return;
+};
+
+// src/cli/import/auth0.ts
+var isAuth0Identity = (value) => typeof value === "object" && value !== null && typeof Reflect.get(value, "provider") === "string" && typeof Reflect.get(value, "user_id") === "string";
+var isAuth0User = (value) => typeof value === "object" && value !== null && typeof Reflect.get(value, "email") === "string" && typeof Reflect.get(value, "user_id") === "string" && (Reflect.get(value, "identities") === undefined || Array.isArray(Reflect.get(value, "identities")) && Reflect.get(value, "identities").every(isAuth0Identity));
+var requireAuth0User = (value) => {
+  if (!isAuth0User(value))
+    throw new Error("Invalid Auth0 user export record");
+  return value;
+};
 var parseUsersFromText = (text) => {
   const trimmed = text.trim();
   if (trimmed.startsWith("[")) {
-    return JSON.parse(trimmed);
+    const parsed = JSON.parse(trimmed);
+    if (!Array.isArray(parsed))
+      throw new Error("Auth0 JSON export must be an array");
+    return parsed.map(requireAuth0User);
   }
   return trimmed.split(`
-`).filter((line) => line.length > 0).map((line) => JSON.parse(line));
+`).filter((line) => line.length > 0).map((line) => requireAuth0User(JSON.parse(line)));
 };
 var auth0Importer = {
   source: "auth0",
@@ -27,7 +48,7 @@ var auth0Importer = {
       familyName: raw.family_name,
       givenName: raw.given_name,
       passwordHash: raw.password_hash,
-      passwordHashAlgo: raw.password_hash?.startsWith("$2b$") || raw.password_hash?.startsWith("$2a$") || raw.password_hash?.startsWith("$2y$") ? "bcrypt" : undefined
+      passwordHashAlgo: detectPasswordHashAlgorithm(raw.password_hash)
     }));
     const identities = auth0Users.flatMap((raw) => (raw.identities ?? []).filter((identity) => identity.provider !== "auth0").map((identity) => ({
       authProvider: identity.provider.replace("-oauth2", ""),
@@ -49,7 +70,7 @@ var clerkImporter = {
     const text = await readFile2(path, "utf-8");
     const clerkUsers = JSON.parse(text);
     const users = clerkUsers.filter((raw) => raw.email_addresses !== undefined && raw.email_addresses.length > 0).map((raw) => {
-      const primary = raw.email_addresses?.find((e) => raw.primary_email_address_id === undefined || e.email_address.length > 0) ?? raw.email_addresses?.[0];
+      const primary = raw.email_addresses?.find((email) => raw.primary_email_address_id === undefined || email.email_address.length > 0) ?? raw.email_addresses?.[0];
       return {
         createdAtMs: raw.created_at ?? Date.now(),
         email: primary?.email_address ?? "",
@@ -58,7 +79,7 @@ var clerkImporter = {
         familyName: raw.last_name,
         givenName: raw.first_name,
         passwordHash: raw.password_digest,
-        passwordHashAlgo: raw.password_digest?.startsWith("$argon2id") ? "argon2id" : raw.password_digest?.startsWith("$2") ? "bcrypt" : undefined
+        passwordHashAlgo: detectPasswordHashAlgorithm(raw.password_digest)
       };
     });
     const identities = clerkUsers.flatMap((raw) => (raw.external_accounts ?? []).map((account) => ({
@@ -80,6 +101,17 @@ var toMs = (value) => {
     return value < 1000000000000 ? value * 1000 : value;
   return Date.parse(value);
 };
+var classifyLuciaKey = (key, passwordByUserId, oauthKeys) => {
+  const separator = key.id.indexOf(":");
+  if (separator < 0)
+    return;
+  const provider = key.id.slice(0, separator);
+  if (provider === "email" || provider === "username") {
+    passwordByUserId.set(key.user_id, key.hashed_password);
+    return;
+  }
+  oauthKeys.push(key);
+};
 var luciaImporter = {
   source: "lucia",
   parse: async (path) => {
@@ -88,15 +120,7 @@ var luciaImporter = {
     const passwordByUserId = new Map;
     const oauthKeys = [];
     for (const key of parsed.keys ?? []) {
-      const separator = key.id.indexOf(":");
-      if (separator < 0)
-        continue;
-      const provider = key.id.slice(0, separator);
-      if (provider === "email" || provider === "username") {
-        passwordByUserId.set(key.user_id, key.hashed_password);
-      } else {
-        oauthKeys.push(key);
-      }
+      classifyLuciaKey(key, passwordByUserId, oauthKeys);
     }
     const users = parsed.users.map((raw) => ({
       createdAtMs: toMs(raw.created_at),
@@ -104,7 +128,7 @@ var luciaImporter = {
       emailVerified: true,
       externalId: raw.id,
       passwordHash: passwordByUserId.get(raw.id),
-      passwordHashAlgo: passwordByUserId.get(raw.id)?.startsWith("$argon2id") ? "argon2id" : passwordByUserId.get(raw.id)?.startsWith("$2") ? "bcrypt" : undefined
+      passwordHashAlgo: detectPasswordHashAlgorithm(passwordByUserId.get(raw.id))
     }));
     const identities = oauthKeys.map((key) => {
       const separator = key.id.indexOf(":");
@@ -148,7 +172,7 @@ var nextauthImporter = {
         familyName: split.familyName,
         givenName: split.givenName,
         passwordHash,
-        passwordHashAlgo: passwordHash?.startsWith("$argon2id") ? "argon2id" : passwordHash?.startsWith("$2") ? "bcrypt" : undefined
+        passwordHashAlgo: detectPasswordHashAlgorithm(passwordHash)
       };
     });
     const identities = (parsed.accounts ?? []).filter((account) => account.type === undefined || account.type === "oauth").map((account) => ({
@@ -340,7 +364,7 @@ var apiKeysTable = pgTable2("auth_api_keys", {
 });
 
 // src/agents/postgresStores.ts
-import { and as and2, desc as desc3, eq as eq3, gt, isNull, or, sql } from "drizzle-orm";
+import { and as and2, desc as desc3, eq as eq3, gt, isNull, or } from "drizzle-orm";
 import {
   bigint as bigint3,
   customType,
@@ -3074,19 +3098,20 @@ var JOURNAL_DDL = `CREATE TABLE IF NOT EXISTS "auth_migrations" (
 	"applied_at_ms" bigint NOT NULL
 );`;
 var isJournalRow = (value) => typeof value === "object" && value !== null && typeof Reflect.get(value, "id") === "string";
-var allBlockNames = () => Object.keys(blockMigrations);
-var applyOne = async (pool, id, sql2, log) => {
-  await pool.query(sql2);
+var isBlockName = (value) => Object.hasOwn(blockMigrations, value);
+var allBlockNames = () => Object.keys(blockMigrations).filter(isBlockName);
+var applyOne = async (pool, id, sql, log) => {
+  await pool.query(sql);
   await pool.query(`INSERT INTO "auth_migrations" ("id", "applied_at_ms") VALUES ($1, $2)`, [id, Date.now()]);
   log(`apply  ${id}`);
 };
-var runOne = async (pool, id, sql2, applied, result, log) => {
+var runOne = async (pool, id, sql, applied, result, log) => {
   if (applied.has(id)) {
     result.skipped.push(id);
     log(`skip   ${id}`);
     return;
   }
-  await applyOne(pool, id, sql2, log);
+  await applyOne(pool, id, sql, log);
   result.applied.push(id);
 };
 var runMigrations = async ({
@@ -3260,6 +3285,21 @@ Options:
   --commit                Without this, the run is a dry-run (counts only, no inserts)
   --help                  Print this message
 `;
+var isBlockName2 = (value) => Object.hasOwn(blockMigrations, value);
+var applyMigrateFlag = (parsed, args, flag) => {
+  if (flag === "--help" || flag === "-h") {
+    parsed.help = true;
+    return;
+  }
+  if (flag === "--db" || flag === "--database-url") {
+    parsed.databaseUrl = args.shift();
+    return;
+  }
+  if (flag !== "--blocks")
+    return;
+  const list = args.shift() ?? "";
+  parsed.blocks = list.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+};
 var parseMigrateArgs = (argv) => {
   const parsed = {
     blocks: undefined,
@@ -3268,18 +3308,28 @@ var parseMigrateArgs = (argv) => {
   };
   const args = [...argv];
   while (args.length > 0) {
-    const flag = args.shift();
-    if (flag === "--help" || flag === "-h") {
-      parsed.help = true;
-    } else if (flag === "--db" || flag === "--database-url") {
-      parsed.databaseUrl = args.shift();
-    } else if (flag === "--blocks") {
-      const list = args.shift() ?? "";
-      parsed.blocks = list.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0).map((entry) => entry);
-    }
+    applyMigrateFlag(parsed, args, args.shift());
   }
   return parsed;
 };
+var applyImportArgument = (parsed, args, positionals, next) => {
+  if (next === undefined)
+    return;
+  if (next === "--help" || next === "-h") {
+    parsed.help = true;
+    return;
+  }
+  if (next === "--db" || next === "--database-url") {
+    parsed.databaseUrl = args.shift();
+    return;
+  }
+  if (next === "--commit") {
+    parsed.commit = true;
+    return;
+  }
+  if (!next.startsWith("--"))
+    positionals.push(next);
+};
 var parseImportArgs = (argv) => {
   const parsed = {
     commit: false,
@@ -3291,21 +3341,11 @@ var parseImportArgs = (argv) => {
   const args = [...argv];
   const positionals = [];
   while (args.length > 0) {
-    const next = args.shift();
-    if (next === undefined)
-      break;
-    if (next === "--help" || next === "-h") {
-      parsed.help = true;
-    } else if (next === "--db" || next === "--database-url") {
-      parsed.databaseUrl = args.shift();
-    } else if (next === "--commit") {
-      parsed.commit = true;
-    } else if (!next.startsWith("--")) {
-      positionals.push(next);
-    }
+    applyImportArgument(parsed, args, positionals, args.shift());
   }
-  parsed.source = positionals[0];
-  parsed.file = positionals[1];
+  const [source, file] = positionals;
+  parsed.source = source;
+  parsed.file = file;
   return parsed;
 };
 var die = (message, usage) => {
@@ -3331,7 +3371,11 @@ var runMigrate = async (argv) => {
     die(`unknown block(s): ${unknown.join(", ")}`, MIGRATE_USAGE);
     return;
   }
-  const result = await runMigrations({ blocks, databaseUrl: resolved });
+  const selectedBlocks = blocks?.filter(isBlockName2);
+  const result = await runMigrations({
+    blocks: selectedBlocks,
+    databaseUrl: resolved
+  });
   process.stdout.write(`
 ${result.applied.length} migration(s) applied, ${result.skipped.length} skipped.
 `);
@@ -3393,5 +3437,5 @@ var main = async () => {
 };
 await main();
 
-//# debugId=65D4841F833D75BF64756E2164756E21
+//# debugId=F5FC77C8DEF0189164756E2164756E21
 //# sourceMappingURL=migrate.js.map