@absolutejs/auth 0.56.3 → 0.56.5

package/dist/oidc/userinfo.d.ts

@@ -0,0 +1,21 @@
+import type { OidcProviderConfig } from './config';
+export type UserInfoResult = {
+    body: Record<string, unknown> & {
+        sub: string;
+    };
+    ok: true;
+} | {
+    body: {
+        error: string;
+        error_description?: string;
+    };
+    error: 'invalid_request' | 'invalid_token';
+    ok: false;
+};
+export declare const readUserInfoBearer: (authorization: string | undefined) => string | undefined;
+export declare const fetchUserInfo: <UserType>({ config, now, token }: {
+    config: OidcProviderConfig<UserType>;
+    now?: number;
+    token: string | undefined;
+}) => Promise<UserInfoResult>;
+export declare const userInfoChallengeHeader: (error: "invalid_request" | "invalid_token") => string;

package/dist/oidc/vci.d.ts

@@ -0,0 +1,159 @@
+import type { RouteString } from '../types';
+import { type SigningKey } from './keys';
+export declare const PRE_AUTHORIZED_CODE_GRANT = "urn:ietf:params:oauth:grant-type:pre-authorized_code";
+export type CredentialConfiguration = {
+    format: 'vc+sd-jwt';
+    id: string;
+    display?: Array<{
+        locale?: string;
+        name: string;
+    }>;
+    order?: string[];
+    claims?: Record<string, {
+        display?: Array<{
+            locale?: string;
+            name: string;
+        }>;
+    }>;
+    vct: string;
+};
+export type CredentialOffer = {
+    clientId: string;
+    configurationId: string;
+    createdAt: number;
+    expiresAt: number;
+    preAuthorizedCodeHash: string;
+    redeemed: boolean;
+    userId: string;
+};
+export type CredentialOfferStore = {
+    consumeOffer: (preAuthorizedCodeHash: string) => Promise<CredentialOffer | undefined>;
+    saveOffer: (offer: CredentialOffer) => Promise<void>;
+};
+export type CredentialNonceRecord = {
+    expiresAt: number;
+    nonceHash: string;
+};
+export type CredentialNonceStore = {
+    consumeNonce: (nonceHash: string) => Promise<CredentialNonceRecord | undefined>;
+    saveNonce: (record: CredentialNonceRecord) => Promise<void>;
+};
+export type VciConfig = {
+    accessTokenTtlMs?: number;
+    credentialConfigurations: CredentialConfiguration[];
+    credentialNonceStore?: CredentialNonceStore;
+    credentialOfferStore: CredentialOfferStore;
+    nonceTtlMs?: number;
+    offerTtlMs?: number;
+    resolveCredentialClaims: (context: {
+        configurationId: string;
+        userId: string;
+    }) => Promise<Record<string, unknown>> | Record<string, unknown>;
+    resolveProtectedClaims?: (context: {
+        configurationId: string;
+        userId: string;
+    }) => Promise<Record<string, unknown>> | Record<string, unknown>;
+    signingKey?: SigningKey;
+    vciRoute?: RouteString;
+};
+export declare const DEFAULT_VCI_ROUTE: RouteString;
+export declare const createCredentialOffer: ({ clientId, configurationId, now, store, ttlMs, userId }: {
+    clientId: string;
+    configurationId: string;
+    now?: number;
+    store: CredentialOfferStore;
+    ttlMs?: number;
+    userId: string;
+}) => Promise<{
+    offer: CredentialOffer;
+    preAuthorizedCode: string;
+}>;
+export type PreAuthExchangeResult = {
+    error: 'expired_token' | 'invalid_grant';
+    ok: false;
+} | {
+    access_token: string;
+    c_nonce?: string;
+    c_nonce_expires_in?: number;
+    expires_in: number;
+    ok: true;
+    token_type: 'Bearer';
+};
+export declare const exchangePreAuthorizedCode: ({ config, issuer, now, preAuthorizedCode, signingKey }: {
+    config: VciConfig;
+    issuer: string;
+    now?: number;
+    preAuthorizedCode: string;
+    signingKey: SigningKey;
+}) => Promise<{
+    error: "expired_token" | "invalid_grant";
+    ok: false;
+} | {
+    access_token: string;
+    c_nonce?: string;
+    c_nonce_expires_in?: number;
+    expires_in: number;
+    ok: true;
+    token_type: "Bearer";
+}>;
+export type CredentialIssueInput = {
+    accessToken: string;
+    proofJwt?: string;
+    requestedFormat?: 'vc+sd-jwt';
+};
+export type CredentialIssueResult = {
+    credential: string;
+    format: 'vc+sd-jwt';
+    ok: true;
+} | {
+    error: 'invalid_credential_request' | 'invalid_proof' | 'invalid_token' | 'unsupported_credential_format';
+    ok: false;
+};
+export declare const buildIssuerMetadata: ({ config, issuer, vciRoute }: {
+    config: VciConfig;
+    issuer: string;
+    vciRoute: RouteString;
+}) => {
+    credential_configurations_supported: {
+        [k: string]: {
+            claims: Record<string, {
+                display?: Array<{
+                    locale?: string;
+                    name: string;
+                }>;
+            }> | undefined;
+            credential_signing_alg_values_supported: string[];
+            cryptographic_binding_methods_supported: string[];
+            display: {
+                locale?: string;
+                name: string;
+            }[] | undefined;
+            format: "vc+sd-jwt";
+            order: string[] | undefined;
+            proof_types_supported: {
+                jwt: {
+                    proof_signing_alg_values_supported: string[];
+                };
+            };
+            vct: string;
+        };
+    };
+    credential_endpoint: string;
+    credential_issuer: string;
+    nonce_endpoint: string | undefined;
+    token_endpoint: string;
+};
+export declare const issueCredential: ({ config, input, issuer, now, signingKey }: {
+    config: VciConfig;
+    input: CredentialIssueInput;
+    issuer: string;
+    now?: number;
+    signingKey: SigningKey;
+}) => Promise<{
+    credential: string;
+    format: "vc+sd-jwt";
+    ok: true;
+} | {
+    error: "invalid_credential_request" | "invalid_proof" | "invalid_token" | "unsupported_credential_format";
+    ok: false;
+}>;

package/dist/oidc/vciRoutes.d.ts

@@ -0,0 +1,92 @@
+import { Elysia } from 'elysia';
+import type { SigningKey } from './keys';
+import { type VciConfig } from './vci';
+export declare const vciRoutes: ({ issuerUrl, signingKey, vciConfig }: {
+    issuerUrl: string;
+    signingKey: SigningKey;
+    vciConfig: VciConfig;
+}) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    ".well-known": {
+        "openid-credential-issuer": {
+            get: {
+                body: unknown;
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        credential: {
+            post: {
+                body: {
+                    format?: "vc+sd-jwt" | undefined;
+                    proof?: {
+                        jwt: string;
+                        proof_type: "jwt";
+                    } | undefined;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        nonce: {
+            post: {
+                body: unknown;
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/organizations/config.d.ts

@@ -0,0 +1,46 @@
+import type { AuditEmitter } from '../audit/config';
+import type { AuthSessionStore } from '../session/types';
+import type { OrganizationId } from '../tenancy';
+import type { RouteString } from '../types';
+import type { OrganizationMembership, OrganizationStore } from './types';
+export declare const DEFAULT_INVITATION_TTL_MS: number;
+export declare const DEFAULT_ORGANIZATIONS_ROUTE: RouteString;
+export declare const DEFAULT_OWNER_ROLES: string[];
+export type OrganizationInvitationMessage = {
+    email: string;
+    expiresAt: number;
+    inviterUserId?: string;
+    organizationId: OrganizationId;
+    token: string;
+};
+export type OrganizationsConfig<UserType> = {
+    getUserId: (user: UserType) => string;
+    organizationStore: OrganizationStore;
+    canCreateOrganization?: (user: UserType) => boolean | Promise<boolean>;
+    canManageMembers?: (context: {
+        membership?: OrganizationMembership;
+        organizationId: OrganizationId;
+        user: UserType;
+    }) => boolean | Promise<boolean>;
+    invitationDurationMs?: number;
+    onMembershipAdded?: (context: {
+        organizationId: OrganizationId;
+        roles: string[];
+        userId: string;
+    }) => void | Promise<void>;
+    onMembershipRemoved?: (context: {
+        organizationId: OrganizationId;
+        userId: string;
+    }) => void | Promise<void>;
+    onOrganizationCreated?: (context: {
+        organizationId: OrganizationId;
+        ownerUserId: string;
+    }) => void | Promise<void>;
+    onSendInvitation?: (message: OrganizationInvitationMessage) => void | Promise<void>;
+    organizationsRoute?: RouteString;
+    ownerRoles?: string[];
+};
+export type OrganizationsRouteProps<UserType> = OrganizationsConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+    emit?: AuditEmitter;
+};

package/dist/organizations/operations.d.ts

@@ -0,0 +1,39 @@
+import type { OrganizationId } from '../tenancy';
+import type { Organization, OrganizationInvitation, OrganizationMembership, OrganizationStore } from './types';
+export declare const acceptInvitation: ({ organizationStore, token, userId }: {
+    organizationStore: OrganizationStore;
+    token: string;
+    userId: string;
+}) => Promise<OrganizationMembership | undefined>;
+export declare const autoAssignOrgsByEmail: ({ email, getOrgsForDomain, organizationStore, roles, userId }: {
+    email: string;
+    getOrgsForDomain: (domain: string) => Promise<OrganizationId[]> | OrganizationId[];
+    organizationStore: OrganizationStore;
+    roles?: string[];
+    userId: string;
+}) => Promise<string[]>;
+export declare const createOrganization: ({ metadata, name, organizationStore, ownerRoles, ownerUserId }: {
+    metadata?: Record<string, unknown>;
+    name: string;
+    organizationStore: OrganizationStore;
+    ownerRoles?: string[];
+    ownerUserId: string;
+}) => Promise<Organization>;
+export declare const inviteToOrganization: ({ email, invitationDurationMs, inviterUserId, organizationId, organizationStore, roles }: {
+    email: string;
+    invitationDurationMs?: number;
+    inviterUserId?: string;
+    organizationId: OrganizationId;
+    organizationStore: OrganizationStore;
+    roles?: string[];
+}) => Promise<{
+    invitation: OrganizationInvitation;
+    token: string;
+}>;
+export declare const listUserOrganizations: ({ organizationStore, userId }: {
+    organizationStore: OrganizationStore;
+    userId: string;
+}) => Promise<{
+    membership: OrganizationMembership;
+    organization: Organization | undefined;
+}[]>;

package/dist/organizations/routes.d.ts

@@ -0,0 +1,299 @@
+import { Elysia } from 'elysia';
+import type { SessionRecord } from '../types';
+import { type OrganizationsRouteProps } from './config';
+export declare const organizationRoutes: <UserType>({ authSessionStore, canCreateOrganization, canManageMembers, emit, getUserId, invitationDurationMs, onMembershipAdded, onMembershipRemoved, onOrganizationCreated, onSendInvitation, organizationsRoute, organizationStore, ownerRoles }: OrganizationsRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Authentication required";
+                200: {
+                    readonly organizations: {
+                        membership: import("./types").OrganizationMembership;
+                        organization: import("./types").Organization | undefined;
+                    }[];
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                metadata?: {} | undefined;
+                name: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Authentication required";
+                403: "Cannot create organizations";
+                200: {
+                    readonly organization: import("./types").Organization;
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":organizationId": {
+            invitations: {
+                post: {
+                    body: {
+                        roles?: string[] | undefined;
+                        email: string;
+                    };
+                    params: {
+                        organizationId: string;
+                    };
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        401: "Authentication required";
+                        403: "Cannot manage members";
+                        200: {
+                            readonly invitationId: string;
+                            readonly token: string;
+                        };
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":organizationId": {
+            invitations: {
+                get: {
+                    body: unknown;
+                    params: {
+                        organizationId: string;
+                    };
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        401: "Authentication required";
+                        403: "Cannot manage members";
+                        200: {
+                            readonly invitations: {
+                                email: string;
+                                expiresAt: number;
+                                invitationId: string;
+                                roles: string[];
+                                state: import("./types").InvitationState;
+                            }[];
+                        };
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":organizationId": {
+            invitations: {
+                ":invitationId": {
+                    delete: {
+                        body: unknown;
+                        params: {
+                            organizationId: string;
+                            invitationId: string;
+                        };
+                        query: unknown;
+                        headers: unknown;
+                        response: {
+                            401: "Authentication required";
+                            403: "Cannot manage members";
+                            404: "Invitation not found";
+                            200: {
+                                readonly revoked: string;
+                            };
+                            422: {
+                                type: "validation";
+                                on: string;
+                                summary?: string;
+                                message?: string;
+                                found?: unknown;
+                                property?: string;
+                                expected?: string;
+                            };
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        invitations: {
+            accept: {
+                post: {
+                    body: {
+                        token: string;
+                    };
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        400: "Invalid or expired invitation";
+                        401: "Authentication required";
+                        200: {
+                            readonly organizationId: string;
+                            readonly roles: string[];
+                        };
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":organizationId": {
+            members: {
+                get: {
+                    body: unknown;
+                    params: {
+                        organizationId: string;
+                    };
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        401: "Authentication required";
+                        403: "Not a member";
+                        200: {
+                            readonly members: import("./types").OrganizationMembership[];
+                        };
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":organizationId": {
+            members: {
+                ":userId": {
+                    delete: {
+                        body: unknown;
+                        params: {
+                            userId: string;
+                            organizationId: string;
+                        };
+                        query: unknown;
+                        headers: unknown;
+                        response: {
+                            401: "Authentication required";
+                            403: "Cannot manage members";
+                            200: {
+                                readonly removed: string;
+                            };
+                            422: {
+                                type: "validation";
+                                on: string;
+                                summary?: string;
+                                message?: string;
+                                found?: unknown;
+                                property?: string;
+                                expected?: string;
+                            };
+                        };
+                    };
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/organizations/types.d.ts

@@ -0,0 +1,45 @@
+import type { OrganizationId } from '../tenancy';
+export type Organization = {
+    createdAt: number;
+    metadata?: Record<string, unknown>;
+    name: string;
+    organizationId: OrganizationId;
+    updatedAt: number;
+};
+export type MembershipStatus = 'active' | 'suspended';
+export type OrganizationMembership = {
+    createdAt: number;
+    organizationId: OrganizationId;
+    roles: string[];
+    status: MembershipStatus;
+    updatedAt: number;
+    userId: string;
+};
+export type InvitationState = 'accepted' | 'pending' | 'revoked';
+export type OrganizationInvitation = {
+    acceptedAt?: number;
+    createdAt: number;
+    email: string;
+    expiresAt: number;
+    invitationId: string;
+    inviterUserId?: string;
+    organizationId: OrganizationId;
+    roles: string[];
+    state: InvitationState;
+    tokenHash: string;
+};
+export type OrganizationStore = {
+    deleteOrganization: (organizationId: OrganizationId) => Promise<void>;
+    getInvitation: (invitationId: string) => Promise<OrganizationInvitation | undefined>;
+    getInvitationByTokenHash: (tokenHash: string) => Promise<OrganizationInvitation | undefined>;
+    getMembership: (organizationId: OrganizationId, userId: string) => Promise<OrganizationMembership | undefined>;
+    getOrganization: (organizationId: OrganizationId) => Promise<Organization | undefined>;
+    listInvitationsByOrganization: (organizationId: OrganizationId) => Promise<OrganizationInvitation[]>;
+    listMembershipsByOrganization: (organizationId: OrganizationId) => Promise<OrganizationMembership[]>;
+    listMembershipsByUser: (userId: string) => Promise<OrganizationMembership[]>;
+    listOrganizations: () => Promise<Organization[]>;
+    removeMembership: (organizationId: OrganizationId, userId: string) => Promise<void>;
+    saveInvitation: (invitation: OrganizationInvitation) => Promise<void>;
+    saveMembership: (membership: OrganizationMembership) => Promise<void>;
+    saveOrganization: (organization: Organization) => Promise<void>;
+};