@absolutejs/auth 0.56.2 → 0.56.3

package/dist/mfa/sms.d.ts

@@ -1,105 +0,0 @@
-import { Elysia } from 'elysia';
-import { type MfaRouteProps, type SmsCodeMessage } from './config';
-import type { MfaEnrollment, MFAStore } from './types';
-export declare const isE164Phone: (phone: string) => boolean;
-export declare const issueAndStoreSmsCode: ({ codeLength, enrollment, mfaStore, onSendSmsCode, ttlMs }: {
-    codeLength: number;
-    enrollment: MfaEnrollment;
-    mfaStore: MFAStore;
-    onSendSmsCode?: (message: SmsCodeMessage) => void | Promise<void>;
-    ttlMs: number;
-}) => Promise<number | undefined>;
-export declare const maskPhone: (phone: string) => string;
-export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfaStore, onMfaEnrolled, onSendSmsCode, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsSetupRoute, smsVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
-    decorator: {};
-    store: {
-        session: import("..").SessionRecord<UserType>;
-        unregisteredSession: import("..").UnregisteredSessionRecord;
-    };
-    derive: {};
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: {};
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: {};
-}, {
-    [x: string]: {
-        post: {
-            body: {
-                phone: string;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                400: "Phone must be in E.164 format";
-                401: "Authentication required";
-                501: "SMS MFA is not configured";
-                200: {
-                    readonly phone: string;
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        post: {
-            body: {
-                code: string;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                400: "No SMS enrollment in progress" | "SMS code expired" | "Invalid SMS code";
-                401: "Authentication required";
-                200: {
-                    readonly status: "enrolled";
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-                429: "Too many attempts";
-            };
-        };
-    };
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-} & {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}>;

package/dist/mfa/totp.d.ts

@@ -1,91 +0,0 @@
-import { Elysia } from 'elysia';
-import { type MfaRouteProps } from './config';
-export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCount, encryptionKey, getUserId, issuer, mfaStore, onMfaEnrolled, totpSetupRoute, totpVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
-    decorator: {};
-    store: {
-        session: import("..").SessionRecord<UserType>;
-        unregisteredSession: import("..").UnregisteredSessionRecord;
-    };
-    derive: {};
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: {};
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: {};
-}, {
-    [x: string]: {
-        post: {
-            body: unknown;
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                401: "Authentication required";
-                200: {
-                    readonly secret: string;
-                    readonly uri: string;
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-} & {
-    [x: string]: {
-        post: {
-            body: {
-                code: string;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
-                401: "Authentication required";
-                200: {
-                    readonly backupCodes: string[];
-                };
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-} & {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}>;

package/dist/mfa/types.d.ts

@@ -1,23 +0,0 @@
-export type MfaFactorType = 'backup_codes' | 'sms' | 'totp';
-export type MfaEnrollment = {
-    backupCodeHashes: string[];
-    createdAt: number;
-    lastUsedAt?: number;
-    smsFailedAttempts?: number;
-    smsPendingCodeHash?: string;
-    smsPendingCodeExpiresAt?: number;
-    smsPhone?: string;
-    smsVerified: boolean;
-    totpFailedAttempts?: number;
-    totpSecretCiphertext?: string;
-    totpVerified: boolean;
-    updatedAt: number;
-    userId: string;
-};
-export type MFAStore = {
-    getEnrollment: (userId: string) => Promise<MfaEnrollment | undefined>;
-    listEnrollments: () => Promise<MfaEnrollment[]>;
-    removeEnrollment: (userId: string) => Promise<void>;
-    saveEnrollment: (enrollment: MfaEnrollment) => Promise<void>;
-};
-export declare const isMfaEnrolled: (enrollment: MfaEnrollment | undefined) => boolean;

package/dist/oidc/clientAuth.d.ts

@@ -1,19 +0,0 @@
-import type { ClientAssertionJtiStore, OAuthClient } from './types';
-export declare const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
-export declare const verifyClientAssertion: ({ assertion, expectedAudience, jtiStore, resolveClient }: {
-    assertion: string;
-    expectedAudience: string;
-    jtiStore?: ClientAssertionJtiStore;
-    resolveClient: (clientId: string) => Promise<OAuthClient | undefined>;
-}) => Promise<OAuthClient | undefined>;
-export declare const verifyJwtSignedByClient: ({ jwt, client }: {
-    client: OAuthClient;
-    jwt: string;
-}) => Promise<{
-    header: {
-        [k: string]: any;
-    };
-    payload: {
-        [k: string]: any;
-    };
-} | undefined>;

package/dist/oidc/config.d.ts

@@ -1,296 +0,0 @@
-import type { RouteString } from '../types';
-import { type SigningKey } from './keys';
-import type { OnClientRegistered, OnClientRegistration } from './registration';
-import type { VciConfig } from './vci';
-import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
-export declare const DEFAULT_OIDC_ROUTE: RouteString;
-export type PublicTokenGrantResult = {
-    body: Record<string, unknown>;
-    status: number;
-};
-export type OidcProviderConfig<UserType> = {
-    /** Additional non-conflicting RFC 8414 metadata. Reserved core OAuth keys
-     * cannot be replaced. Used by profiles such as open agent registration. */
-    additionalDiscoveryMetadata?: Record<string, unknown>;
-    /** Public extension grants whose bearer material is carried in their body
-     * (for example an agent claim_token). They run before OAuth client auth. */
-    publicTokenGrantTypes?: string[];
-    handlePublicTokenGrant?: (context: {
-        body: Record<string, string | undefined>;
-        request: Request;
-    }) => Promise<PublicTokenGrantResult | undefined>;
-    accessTokenTtlMs?: number | ((context: {
-        scopes: string[];
-    }) => number);
-    acrValuesSupported?: string[];
-    authorizationCodeStore: AuthorizationCodeStore;
-    clientAssertionJtiStore?: ClientAssertionJtiStore;
-    clientRegistrationTokenStore?: ClientRegistrationTokenStore;
-    clientStore: OAuthClientStore;
-    resolveClientIdMetadata?: (clientId: string) => Promise<OAuthClient | undefined>;
-    deviceAuthorizationStore?: DeviceAuthorizationStore;
-    deviceCodeTtlMs?: number;
-    devicePollIntervalSeconds?: number;
-    backchannelAuthStore?: BackchannelAuthStore;
-    backchannelAuthTtlMs?: number;
-    backchannelPollIntervalSeconds?: number;
-    resolveBackchannelUser?: (hint: {
-        client: OAuthClient;
-        loginHint: string;
-    }) => Promise<{
-        sub: string;
-    } | undefined>;
-    onBackchannelAuthRequest?: (context: {
-        authReqId: string;
-        bindingMessage: string | undefined;
-        clientId: string;
-        scopes: string[];
-        userSub: string;
-    }) => Promise<void> | void;
-    getAccessTokenClaims?: (context: {
-        audience?: string;
-        clientId: string;
-        scopes: string[];
-        sub: string;
-    }) => Record<string, unknown> | Promise<Record<string, unknown>>;
-    getClaims?: (user: UserType) => Record<string, unknown>;
-    consentUrl?: string;
-    needsConsent?: (context: {
-        client: {
-            clientId: string;
-            name: string;
-        };
-        requestedScopes: string[];
-        user: UserType;
-    }) => boolean | Promise<boolean>;
-    getGrantedScopes?: (context: {
-        client: {
-            clientId: string;
-            name: string;
-        };
-        requestedScopes: string[];
-        user: UserType;
-    }) => string[] | undefined | Promise<string[] | undefined>;
-    getUserId: (user: UserType) => string;
-    getUserInfo?: (sub: string) => Promise<Record<string, unknown> | undefined>;
-    idTokenTtlMs?: number;
-    issuer: string;
-    dpopNonce?: {
-        secret: string;
-    };
-    extractTlsClientCert?: (headers: Headers) => Promise<Uint8Array | undefined> | Uint8Array | undefined;
-    getAcr?: (context: {
-        scopes: string[];
-        user: UserType;
-    }) => string | undefined;
-    initialAccessTokenStore?: InitialAccessTokenStore;
-    loginUrl?: string;
-    logoutDeliveryStore?: LogoutDeliveryStore;
-    oidcRoute?: RouteString;
-    onClientRegistration?: OnClientRegistration;
-    /** Fires after RFC 7591 registration has been persisted and has a generated client id. */
-    onClientRegistered?: OnClientRegistered;
-    /** Fires after the authenticated user approves an RFC 8628 device request. */
-    onDeviceAuthorizationApproved?: (context: {
-        clientId: string;
-        scopes: string[];
-        userSub: string;
-    }) => void | Promise<void>;
-    pushedAuthorizationRequestStore?: PushedAuthorizationRequestStore;
-    pushedAuthorizationRequestTtlMs?: number;
-    refreshTokenStore: OidcRefreshTokenStore;
-    refreshTokenTtlMs?: number;
-    signingKey: SigningKey;
-    strictFapi?: boolean;
-    vciConfig?: VciConfig;
-};
-export type TokenExchangeResult = {
-    error: 'invalid_grant' | 'invalid_scope';
-    ok: false;
-} | {
-    accessToken: string;
-    expiresIn: number;
-    ok: true;
-    scope: string;
-};
-export declare const exchangeToken: <UserType>({ actorClientId, audience, config, dpopJkt, now, requestedScopes, subjectToken }: {
-    actorClientId: string;
-    audience?: string;
-    config: OidcProviderConfig<UserType>;
-    dpopJkt?: string;
-    now?: number;
-    requestedScopes?: string[];
-    subjectToken: string;
-}) => Promise<TokenExchangeResult>;
-export declare const issueTokenSet: <UserType>({ acr, audience, claims, clientCertThumbprint, clientId, config, dpopJkt, nonce, now, scopes, sub }: {
-    acr?: string;
-    audience?: string;
-    claims?: Record<string, unknown>;
-    clientCertThumbprint?: string;
-    clientId: string;
-    config: OidcProviderConfig<UserType>;
-    dpopJkt?: string;
-    nonce?: string;
-    now?: number;
-    scopes: string[];
-    sub: string;
-}) => Promise<{
-    access_token: string;
-    expires_in: number;
-    id_token: string;
-    refresh_token: string;
-    scope: string;
-    token_type: "Bearer" | "DPoP";
-}>;
-export declare const mcpProtectedResourceMetadata: ({ issuer, resource, scopes }: {
-    issuer: string;
-    resource: string;
-    scopes?: string[];
-}) => {
-    authorization_servers: string[];
-    resource: string;
-    scopes_supported: string[];
-};
-export declare const verifyPkce: (codeVerifier: string, codeChallenge: string) => Promise<boolean>;
-export type TokenIntrospection = {
-    active: false;
-} | {
-    active: true;
-    client_id: string;
-    exp: number;
-    iat: number;
-    scope: string;
-    sub: string;
-    token_type: 'access_token' | 'refresh_token';
-};
-export type TokenTypeHint = 'access_token' | 'refresh_token';
-export declare const introspectToken: <UserType>({ config, hint, now, token }: {
-    config: OidcProviderConfig<UserType>;
-    hint?: TokenTypeHint;
-    now?: number;
-    token: string;
-}) => Promise<{
-    active: false;
-} | {
-    active: true;
-    client_id: string;
-    exp: number;
-    iat: number;
-    scope: string;
-    sub: string;
-    token_type: "access_token";
-} | {
-    active: true;
-    client_id: string;
-    exp: number;
-    iat: number;
-    scope: string;
-    sub: string;
-    token_type: "refresh_token";
-}>;
-export declare const revokeRefreshToken: <UserType>(config: OidcProviderConfig<UserType>, token: string) => Promise<boolean>;
-export type DeviceAuthorizationResponse = {
-    device_code: string;
-    expires_in: number;
-    interval: number;
-    user_code: string;
-    verification_uri: string;
-    verification_uri_complete: string;
-};
-export declare const issueDeviceAuthorization: <UserType>({ clientId, config, now, requestedScopes }: {
-    clientId: string;
-    config: OidcProviderConfig<UserType>;
-    now?: number;
-    requestedScopes: string[];
-}) => Promise<DeviceAuthorizationResponse>;
-export type DeviceDecisionResult = {
-    error: 'already_decided' | 'expired_token' | 'invalid_user_code' | 'not_configured';
-    ok: false;
-} | {
-    ok: true;
-};
-export declare const approveDeviceAuthorization: <UserType>({ config, userCode, userSub }: {
-    config: OidcProviderConfig<UserType>;
-    userCode: string;
-    userSub: string;
-}) => Promise<DeviceDecisionResult>;
-export declare const denyDeviceAuthorization: <UserType>({ config, userCode }: {
-    config: OidcProviderConfig<UserType>;
-    userCode: string;
-}) => Promise<DeviceDecisionResult>;
-export type DeviceCodeExchangeError = 'access_denied' | 'authorization_pending' | 'expired_token' | 'invalid_grant' | 'slow_down';
-export type DeviceCodeExchangeResult = {
-    access_token: string;
-    expires_in: number;
-    id_token: string;
-    ok: true;
-    refresh_token: string;
-    scope: string;
-    token_type: 'Bearer' | 'DPoP';
-} | {
-    error: DeviceCodeExchangeError;
-    ok: false;
-};
-export declare const exchangeDeviceCode: <UserType>({ clientId, config, deviceCode, dpopJkt, now }: {
-    clientId: string;
-    config: OidcProviderConfig<UserType>;
-    deviceCode: string;
-    dpopJkt?: string;
-    now?: number;
-}) => Promise<DeviceCodeExchangeResult>;
-export declare const CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
-export type BackchannelAuthResponse = {
-    auth_req_id: string;
-    expires_in: number;
-    interval: number;
-};
-export type BackchannelAuthError = 'expired_login_hint_token' | 'invalid_client' | 'invalid_request' | 'unknown_user_id';
-export declare const issueBackchannelAuth: <UserType>({ clientId, config, loginHint, bindingMessage, now, requestedScopes }: {
-    clientId: string;
-    config: OidcProviderConfig<UserType>;
-    loginHint: string;
-    bindingMessage?: string;
-    now?: number;
-    requestedScopes: string[];
-}) => Promise<{
-    error: BackchannelAuthError;
-    ok: false;
-} | ({
-    ok: true;
-} & BackchannelAuthResponse)>;
-export type BackchannelDecisionResult = {
-    error: 'already_decided' | 'expired_token' | 'invalid_auth_req_id' | 'not_configured';
-    ok: false;
-} | {
-    ok: true;
-};
-export declare const approveBackchannelAuth: <UserType>({ authReqId, config, userSub }: {
-    authReqId: string;
-    config: OidcProviderConfig<UserType>;
-    userSub?: string;
-}) => Promise<BackchannelDecisionResult>;
-export declare const denyBackchannelAuth: <UserType>({ authReqId, config }: {
-    authReqId: string;
-    config: OidcProviderConfig<UserType>;
-}) => Promise<BackchannelDecisionResult>;
-export type BackchannelExchangeError = 'access_denied' | 'authorization_pending' | 'expired_token' | 'invalid_grant' | 'slow_down';
-export type BackchannelExchangeResult = {
-    access_token: string;
-    expires_in: number;
-    id_token: string;
-    ok: true;
-    refresh_token: string;
-    scope: string;
-    token_type: 'Bearer' | 'DPoP';
-} | {
-    error: BackchannelExchangeError;
-    ok: false;
-};
-export declare const exchangeBackchannelAuth: <UserType>({ authReqId, clientCertThumbprint, clientId, config, dpopJkt, now }: {
-    authReqId: string;
-    clientCertThumbprint?: string;
-    clientId: string;
-    config: OidcProviderConfig<UserType>;
-    dpopJkt?: string;
-    now?: number;
-}) => Promise<BackchannelExchangeResult>;

package/dist/oidc/dpop.d.ts

@@ -1,23 +0,0 @@
-export declare const extractDpopNonceClaim: (proof: string) => string | undefined;
-export declare const mintDpopNonce: ({ now, secret }: {
-    now?: number;
-    secret: string;
-}) => Promise<string>;
-export declare const verifyDpopNonce: ({ now, nonce, secret }: {
-    nonce: string;
-    now?: number;
-    secret: string;
-}) => Promise<boolean>;
-export type DpopResult = {
-    jkt: string;
-    jti?: string;
-};
-export declare const verifyDpopProof: ({ accessToken, htm, htu, isUsedJti, maxAgeMs, now, proof }: {
-    accessToken?: string;
-    htm: string;
-    htu: string;
-    isUsedJti?: (jti: string) => boolean | Promise<boolean>;
-    maxAgeMs?: number;
-    now?: number;
-    proof: string | undefined;
-}) => Promise<DpopResult | undefined>;

package/dist/oidc/inMemoryVciStores.d.ts

@@ -1,3 +0,0 @@
-import type { CredentialNonceStore, CredentialOfferStore } from './vci';
-export declare const createInMemoryCredentialNonceStore: () => CredentialNonceStore;
-export declare const createInMemoryCredentialOfferStore: () => CredentialOfferStore;

package/dist/oidc/jar.d.ts

@@ -1,14 +0,0 @@
-import type { OAuthClient } from './types';
-export type JarParseResult = {
-    error: 'invalid_request_object';
-    ok: false;
-} | {
-    ok: true;
-    params: Record<string, string>;
-};
-export declare const parseSignedRequestObject: ({ client, expectedIssuer, jwt, now }: {
-    client: OAuthClient;
-    expectedIssuer: string;
-    jwt: string;
-    now?: number;
-}) => Promise<JarParseResult>;

package/dist/oidc/keys.d.ts

@@ -1,35 +0,0 @@
-type SigningKeyIdentity = {
-    kid: string;
-    publicJwk: JsonWebKey;
-};
-/** ES256 signing material can remain local for development or be delegated to
- * a non-exportable KMS/HSM adapter. External signers return the 64-byte JOSE
- * ECDSA signature (r || s), not an ASN.1 DER envelope. */
-export type SigningKey = SigningKeyIdentity & ({
-    privateJwk: JsonWebKey;
-    sign?: never;
-} | {
-    privateJwk?: never;
-    sign: (input: Uint8Array) => Promise<Uint8Array>;
-});
-export declare const generateSigningKey: () => Promise<SigningKey>;
-export declare const jwkThumbprint: (jwk: JsonWebKey) => Promise<string>;
-export declare const signJwt: (payload: Record<string, unknown>, signing: SigningKey, typ?: string) => Promise<string>;
-export declare const toPublicJwk: (key: SigningKey) => {
-    alg: string;
-    crv: string | undefined;
-    kid: string;
-    kty: string | undefined;
-    use: string;
-    x: string | undefined;
-    y: string | undefined;
-};
-export declare const verifyJwt: (token: string, publicJwk: JsonWebKey) => Promise<{
-    header: {
-        [k: string]: any;
-    };
-    payload: {
-        [k: string]: any;
-    };
-} | undefined>;
-export {};

package/dist/oidc/logout.d.ts

@@ -1,38 +0,0 @@
-import type { OidcProviderConfig } from './config';
-import type { LogoutDelivery, OAuthClient } from './types';
-export declare const resolvePostLogoutRedirect: ({ client, requestedUri }: {
-    client: OAuthClient;
-    requestedUri: string | undefined;
-}) => string | undefined;
-export declare const verifyIdTokenHint: <UserType>({ config, idTokenHint }: {
-    config: OidcProviderConfig<UserType>;
-    idTokenHint: string;
-}) => Promise<{
-    audClientId: string;
-    sub: string;
-} | undefined>;
-type DeliveryFetch = (url: string, init: {
-    body: string;
-    headers: Record<string, string>;
-    method: string;
-    signal: AbortSignal;
-}) => Promise<{
-    ok: boolean;
-    status: number;
-}>;
-export declare const mintLogoutToken: <UserType>({ clientId, config, now, sub }: {
-    clientId: string;
-    config: OidcProviderConfig<UserType>;
-    now?: number;
-    sub: string;
-}) => Promise<string>;
-export declare const fanOutBackchannelLogout: <UserType>({ config, fetchImpl, now, onError, skipClientId, timeoutMs, userId }: {
-    config: OidcProviderConfig<UserType>;
-    fetchImpl?: DeliveryFetch;
-    now?: number;
-    onError?: (delivery: LogoutDelivery) => void | Promise<void>;
-    skipClientId?: string;
-    timeoutMs?: number;
-    userId: string;
-}) => Promise<string[]>;
-export {};

package/dist/oidc/mtls.d.ts

@@ -1,11 +0,0 @@
-export declare const computeCertThumbprint: (derBytes: Uint8Array) => Promise<string>;
-export declare const extractRfc9440ClientCert: (headers: Headers) => Uint8Array<ArrayBuffer> | undefined;
-export declare const resolveClientCert: ({ extract, headers }: {
-    extract: ((headers: Headers) => Promise<Uint8Array | undefined> | Uint8Array | undefined) | undefined;
-    headers: Headers;
-}) => Promise<Uint8Array<ArrayBufferLike> | undefined>;
-export declare const verifyCertificateBoundToken: ({ cnfThumbprint, extract, headers }: {
-    cnfThumbprint: string | undefined;
-    extract: ((headers: Headers) => Promise<Uint8Array | undefined> | Uint8Array | undefined) | undefined;
-    headers: Headers;
-}) => Promise<boolean>;