@absolutejs/auth 0.56.3 → 0.56.5

package/dist/mfa/secret.d.ts

@@ -0,0 +1,2 @@
+export declare const decryptTotpSecret: (ciphertext: string, encryptionKey?: string) => Promise<string>;
+export declare const encryptTotpSecret: (secret: string, encryptionKey?: string) => Promise<string>;

package/dist/mfa/sms.d.ts

@@ -0,0 +1,105 @@
+import { Elysia } from 'elysia';
+import { type MfaRouteProps, type SmsCodeMessage } from './config';
+import type { MfaEnrollment, MFAStore } from './types';
+export declare const isE164Phone: (phone: string) => boolean;
+export declare const issueAndStoreSmsCode: ({ codeLength, enrollment, mfaStore, onSendSmsCode, ttlMs }: {
+    codeLength: number;
+    enrollment: MfaEnrollment;
+    mfaStore: MFAStore;
+    onSendSmsCode?: (message: SmsCodeMessage) => void | Promise<void>;
+    ttlMs: number;
+}) => Promise<number | undefined>;
+export declare const maskPhone: (phone: string) => string;
+export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfaStore, onMfaEnrolled, onSendSmsCode, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsSetupRoute, smsVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: {
+                phone: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "Phone must be in E.164 format";
+                401: "Authentication required";
+                501: "SMS MFA is not configured";
+                200: {
+                    readonly phone: string;
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                code: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "No SMS enrollment in progress" | "SMS code expired" | "Invalid SMS code";
+                401: "Authentication required";
+                200: {
+                    readonly status: "enrolled";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                429: "Too many attempts";
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/mfa/totp.d.ts

@@ -0,0 +1,91 @@
+import { Elysia } from 'elysia';
+import { type MfaRouteProps } from './config';
+export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCount, encryptionKey, getUserId, issuer, mfaStore, onMfaEnrolled, totpSetupRoute, totpVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Authentication required";
+                200: {
+                    readonly secret: string;
+                    readonly uri: string;
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                code: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
+                401: "Authentication required";
+                200: {
+                    readonly backupCodes: string[];
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/mfa/types.d.ts

@@ -0,0 +1,23 @@
+export type MfaFactorType = 'backup_codes' | 'sms' | 'totp';
+export type MfaEnrollment = {
+    backupCodeHashes: string[];
+    createdAt: number;
+    lastUsedAt?: number;
+    smsFailedAttempts?: number;
+    smsPendingCodeHash?: string;
+    smsPendingCodeExpiresAt?: number;
+    smsPhone?: string;
+    smsVerified: boolean;
+    totpFailedAttempts?: number;
+    totpSecretCiphertext?: string;
+    totpVerified: boolean;
+    updatedAt: number;
+    userId: string;
+};
+export type MFAStore = {
+    getEnrollment: (userId: string) => Promise<MfaEnrollment | undefined>;
+    listEnrollments: () => Promise<MfaEnrollment[]>;
+    removeEnrollment: (userId: string) => Promise<void>;
+    saveEnrollment: (enrollment: MfaEnrollment) => Promise<void>;
+};
+export declare const isMfaEnrolled: (enrollment: MfaEnrollment | undefined) => boolean;

package/dist/oidc/clientAuth.d.ts

@@ -0,0 +1,19 @@
+import type { ClientAssertionJtiStore, OAuthClient } from './types';
+export declare const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+export declare const verifyClientAssertion: ({ assertion, expectedAudience, jtiStore, resolveClient }: {
+    assertion: string;
+    expectedAudience: string;
+    jtiStore?: ClientAssertionJtiStore;
+    resolveClient: (clientId: string) => Promise<OAuthClient | undefined>;
+}) => Promise<OAuthClient | undefined>;
+export declare const verifyJwtSignedByClient: ({ jwt, client }: {
+    client: OAuthClient;
+    jwt: string;
+}) => Promise<{
+    header: {
+        [k: string]: any;
+    };
+    payload: {
+        [k: string]: any;
+    };
+} | undefined>;

package/dist/oidc/config.d.ts

@@ -0,0 +1,296 @@
+import type { RouteString } from '../types';
+import { type SigningKey } from './keys';
+import type { OnClientRegistered, OnClientRegistration } from './registration';
+import type { VciConfig } from './vci';
+import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
+export declare const DEFAULT_OIDC_ROUTE: RouteString;
+export type PublicTokenGrantResult = {
+    body: Record<string, unknown>;
+    status: number;
+};
+export type OidcProviderConfig<UserType> = {
+    /** Additional non-conflicting RFC 8414 metadata. Reserved core OAuth keys
+     * cannot be replaced. Used by profiles such as open agent registration. */
+    additionalDiscoveryMetadata?: Record<string, unknown>;
+    /** Public extension grants whose bearer material is carried in their body
+     * (for example an agent claim_token). They run before OAuth client auth. */
+    publicTokenGrantTypes?: string[];
+    handlePublicTokenGrant?: (context: {
+        body: Record<string, string | undefined>;
+        request: Request;
+    }) => Promise<PublicTokenGrantResult | undefined>;
+    accessTokenTtlMs?: number | ((context: {
+        scopes: string[];
+    }) => number);
+    acrValuesSupported?: string[];
+    authorizationCodeStore: AuthorizationCodeStore;
+    clientAssertionJtiStore?: ClientAssertionJtiStore;
+    clientRegistrationTokenStore?: ClientRegistrationTokenStore;
+    clientStore: OAuthClientStore;
+    resolveClientIdMetadata?: (clientId: string) => Promise<OAuthClient | undefined>;
+    deviceAuthorizationStore?: DeviceAuthorizationStore;
+    deviceCodeTtlMs?: number;
+    devicePollIntervalSeconds?: number;
+    backchannelAuthStore?: BackchannelAuthStore;
+    backchannelAuthTtlMs?: number;
+    backchannelPollIntervalSeconds?: number;
+    resolveBackchannelUser?: (hint: {
+        client: OAuthClient;
+        loginHint: string;
+    }) => Promise<{
+        sub: string;
+    } | undefined>;
+    onBackchannelAuthRequest?: (context: {
+        authReqId: string;
+        bindingMessage: string | undefined;
+        clientId: string;
+        scopes: string[];
+        userSub: string;
+    }) => Promise<void> | void;
+    getAccessTokenClaims?: (context: {
+        audience?: string;
+        clientId: string;
+        scopes: string[];
+        sub: string;
+    }) => Record<string, unknown> | Promise<Record<string, unknown>>;
+    getClaims?: (user: UserType) => Record<string, unknown>;
+    consentUrl?: string;
+    needsConsent?: (context: {
+        client: {
+            clientId: string;
+            name: string;
+        };
+        requestedScopes: string[];
+        user: UserType;
+    }) => boolean | Promise<boolean>;
+    getGrantedScopes?: (context: {
+        client: {
+            clientId: string;
+            name: string;
+        };
+        requestedScopes: string[];
+        user: UserType;
+    }) => string[] | undefined | Promise<string[] | undefined>;
+    getUserId: (user: UserType) => string;
+    getUserInfo?: (sub: string) => Promise<Record<string, unknown> | undefined>;
+    idTokenTtlMs?: number;
+    issuer: string;
+    dpopNonce?: {
+        secret: string;
+    };
+    extractTlsClientCert?: (headers: Headers) => Promise<Uint8Array | undefined> | Uint8Array | undefined;
+    getAcr?: (context: {
+        scopes: string[];
+        user: UserType;
+    }) => string | undefined;
+    initialAccessTokenStore?: InitialAccessTokenStore;
+    loginUrl?: string;
+    logoutDeliveryStore?: LogoutDeliveryStore;
+    oidcRoute?: RouteString;
+    onClientRegistration?: OnClientRegistration;
+    /** Fires after RFC 7591 registration has been persisted and has a generated client id. */
+    onClientRegistered?: OnClientRegistered;
+    /** Fires after the authenticated user approves an RFC 8628 device request. */
+    onDeviceAuthorizationApproved?: (context: {
+        clientId: string;
+        scopes: string[];
+        userSub: string;
+    }) => void | Promise<void>;
+    pushedAuthorizationRequestStore?: PushedAuthorizationRequestStore;
+    pushedAuthorizationRequestTtlMs?: number;
+    refreshTokenStore: OidcRefreshTokenStore;
+    refreshTokenTtlMs?: number;
+    signingKey: SigningKey;
+    strictFapi?: boolean;
+    vciConfig?: VciConfig;
+};
+export type TokenExchangeResult = {
+    error: 'invalid_grant' | 'invalid_scope';
+    ok: false;
+} | {
+    accessToken: string;
+    expiresIn: number;
+    ok: true;
+    scope: string;
+};
+export declare const exchangeToken: <UserType>({ actorClientId, audience, config, dpopJkt, now, requestedScopes, subjectToken }: {
+    actorClientId: string;
+    audience?: string;
+    config: OidcProviderConfig<UserType>;
+    dpopJkt?: string;
+    now?: number;
+    requestedScopes?: string[];
+    subjectToken: string;
+}) => Promise<TokenExchangeResult>;
+export declare const issueTokenSet: <UserType>({ acr, audience, claims, clientCertThumbprint, clientId, config, dpopJkt, nonce, now, scopes, sub }: {
+    acr?: string;
+    audience?: string;
+    claims?: Record<string, unknown>;
+    clientCertThumbprint?: string;
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    dpopJkt?: string;
+    nonce?: string;
+    now?: number;
+    scopes: string[];
+    sub: string;
+}) => Promise<{
+    access_token: string;
+    expires_in: number;
+    id_token: string;
+    refresh_token: string;
+    scope: string;
+    token_type: "Bearer" | "DPoP";
+}>;
+export declare const mcpProtectedResourceMetadata: ({ issuer, resource, scopes }: {
+    issuer: string;
+    resource: string;
+    scopes?: string[];
+}) => {
+    authorization_servers: string[];
+    resource: string;
+    scopes_supported: string[];
+};
+export declare const verifyPkce: (codeVerifier: string, codeChallenge: string) => Promise<boolean>;
+export type TokenIntrospection = {
+    active: false;
+} | {
+    active: true;
+    client_id: string;
+    exp: number;
+    iat: number;
+    scope: string;
+    sub: string;
+    token_type: 'access_token' | 'refresh_token';
+};
+export type TokenTypeHint = 'access_token' | 'refresh_token';
+export declare const introspectToken: <UserType>({ config, hint, now, token }: {
+    config: OidcProviderConfig<UserType>;
+    hint?: TokenTypeHint;
+    now?: number;
+    token: string;
+}) => Promise<{
+    active: false;
+} | {
+    active: true;
+    client_id: string;
+    exp: number;
+    iat: number;
+    scope: string;
+    sub: string;
+    token_type: "access_token";
+} | {
+    active: true;
+    client_id: string;
+    exp: number;
+    iat: number;
+    scope: string;
+    sub: string;
+    token_type: "refresh_token";
+}>;
+export declare const revokeRefreshToken: <UserType>(config: OidcProviderConfig<UserType>, token: string) => Promise<boolean>;
+export type DeviceAuthorizationResponse = {
+    device_code: string;
+    expires_in: number;
+    interval: number;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+};
+export declare const issueDeviceAuthorization: <UserType>({ clientId, config, now, requestedScopes }: {
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    now?: number;
+    requestedScopes: string[];
+}) => Promise<DeviceAuthorizationResponse>;
+export type DeviceDecisionResult = {
+    error: 'already_decided' | 'expired_token' | 'invalid_user_code' | 'not_configured';
+    ok: false;
+} | {
+    ok: true;
+};
+export declare const approveDeviceAuthorization: <UserType>({ config, userCode, userSub }: {
+    config: OidcProviderConfig<UserType>;
+    userCode: string;
+    userSub: string;
+}) => Promise<DeviceDecisionResult>;
+export declare const denyDeviceAuthorization: <UserType>({ config, userCode }: {
+    config: OidcProviderConfig<UserType>;
+    userCode: string;
+}) => Promise<DeviceDecisionResult>;
+export type DeviceCodeExchangeError = 'access_denied' | 'authorization_pending' | 'expired_token' | 'invalid_grant' | 'slow_down';
+export type DeviceCodeExchangeResult = {
+    access_token: string;
+    expires_in: number;
+    id_token: string;
+    ok: true;
+    refresh_token: string;
+    scope: string;
+    token_type: 'Bearer' | 'DPoP';
+} | {
+    error: DeviceCodeExchangeError;
+    ok: false;
+};
+export declare const exchangeDeviceCode: <UserType>({ clientId, config, deviceCode, dpopJkt, now }: {
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    deviceCode: string;
+    dpopJkt?: string;
+    now?: number;
+}) => Promise<DeviceCodeExchangeResult>;
+export declare const CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
+export type BackchannelAuthResponse = {
+    auth_req_id: string;
+    expires_in: number;
+    interval: number;
+};
+export type BackchannelAuthError = 'expired_login_hint_token' | 'invalid_client' | 'invalid_request' | 'unknown_user_id';
+export declare const issueBackchannelAuth: <UserType>({ clientId, config, loginHint, bindingMessage, now, requestedScopes }: {
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    loginHint: string;
+    bindingMessage?: string;
+    now?: number;
+    requestedScopes: string[];
+}) => Promise<{
+    error: BackchannelAuthError;
+    ok: false;
+} | ({
+    ok: true;
+} & BackchannelAuthResponse)>;
+export type BackchannelDecisionResult = {
+    error: 'already_decided' | 'expired_token' | 'invalid_auth_req_id' | 'not_configured';
+    ok: false;
+} | {
+    ok: true;
+};
+export declare const approveBackchannelAuth: <UserType>({ authReqId, config, userSub }: {
+    authReqId: string;
+    config: OidcProviderConfig<UserType>;
+    userSub?: string;
+}) => Promise<BackchannelDecisionResult>;
+export declare const denyBackchannelAuth: <UserType>({ authReqId, config }: {
+    authReqId: string;
+    config: OidcProviderConfig<UserType>;
+}) => Promise<BackchannelDecisionResult>;
+export type BackchannelExchangeError = 'access_denied' | 'authorization_pending' | 'expired_token' | 'invalid_grant' | 'slow_down';
+export type BackchannelExchangeResult = {
+    access_token: string;
+    expires_in: number;
+    id_token: string;
+    ok: true;
+    refresh_token: string;
+    scope: string;
+    token_type: 'Bearer' | 'DPoP';
+} | {
+    error: BackchannelExchangeError;
+    ok: false;
+};
+export declare const exchangeBackchannelAuth: <UserType>({ authReqId, clientCertThumbprint, clientId, config, dpopJkt, now }: {
+    authReqId: string;
+    clientCertThumbprint?: string;
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    dpopJkt?: string;
+    now?: number;
+}) => Promise<BackchannelExchangeResult>;

package/dist/oidc/dpop.d.ts

@@ -0,0 +1,23 @@
+export declare const extractDpopNonceClaim: (proof: string) => string | undefined;
+export declare const mintDpopNonce: ({ now, secret }: {
+    now?: number;
+    secret: string;
+}) => Promise<string>;
+export declare const verifyDpopNonce: ({ now, nonce, secret }: {
+    nonce: string;
+    now?: number;
+    secret: string;
+}) => Promise<boolean>;
+export type DpopResult = {
+    jkt: string;
+    jti?: string;
+};
+export declare const verifyDpopProof: ({ accessToken, htm, htu, isUsedJti, maxAgeMs, now, proof }: {
+    accessToken?: string;
+    htm: string;
+    htu: string;
+    isUsedJti?: (jti: string) => boolean | Promise<boolean>;
+    maxAgeMs?: number;
+    now?: number;
+    proof: string | undefined;
+}) => Promise<DpopResult | undefined>;

package/dist/oidc/inMemoryVciStores.d.ts

@@ -0,0 +1,3 @@
+import type { CredentialNonceStore, CredentialOfferStore } from './vci';
+export declare const createInMemoryCredentialNonceStore: () => CredentialNonceStore;
+export declare const createInMemoryCredentialOfferStore: () => CredentialOfferStore;

package/dist/oidc/index.js

@@ -11190,6 +11190,10 @@ var createPostgresAuthorizationCodeStore = (db) => ({
     const [row] = await db.delete(oauthCodesTable).where(eq(oauthCodesTable.code_hash, codeHash)).returning();
     return row ? toCode(row) : undefined;
   },
+  deleteForUserClient: async (userId, clientId) => {
+    const deleted = await db.delete(oauthCodesTable).where(and(eq(oauthCodesTable.user_id, userId), eq(oauthCodesTable.client_id, clientId))).returning({ codeHash: oauthCodesTable.code_hash });
+    return deleted.length;
+  },
   saveCode: async (code) => {
     await db.insert(oauthCodesTable).values(toCodeValues(code));
   }
@@ -11239,6 +11243,12 @@ var createPostgresDeviceAuthorizationStore = (db) => ({
   deleteByDeviceCodeHash: async (deviceCodeHash) => {
     await db.delete(oauthDeviceAuthorizationsTable).where(eq(oauthDeviceAuthorizationsTable.device_code_hash, deviceCodeHash));
   },
+  deleteForUserClient: async (userId, clientId) => {
+    const deleted = await db.delete(oauthDeviceAuthorizationsTable).where(and(eq(oauthDeviceAuthorizationsTable.user_sub, userId), eq(oauthDeviceAuthorizationsTable.client_id, clientId))).returning({
+      deviceCodeHash: oauthDeviceAuthorizationsTable.device_code_hash
+    });
+    return deleted.length;
+  },
   findByDeviceCodeHash: async (deviceCodeHash) => {
     const [row] = await db.select().from(oauthDeviceAuthorizationsTable).where(eq(oauthDeviceAuthorizationsTable.device_code_hash, deviceCodeHash)).limit(1);
     return row ? toDeviceAuth(row) : undefined;
@@ -11437,5 +11447,5 @@ export {
   createNeonAuthorizationCodeStore
 };
 
-//# debugId=02F0CDEF2D22712F64756E2164756E21
+//# debugId=6012AEB9DD7CDF8264756E2164756E21
 //# sourceMappingURL=index.js.map