@absolutejs/auth 0.56.3 → 0.56.5

package/dist/credentials/routes.d.ts

@@ -0,0 +1,201 @@
+import { Elysia } from 'elysia';
+import type { CredentialRouteProps } from './config';
+export declare const credentialRoutes: <UserType>(config: CredentialRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: {
+                email: string;
+                password: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                [x: string]: any;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                token: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "Invalid or expired verification token";
+                200: {
+                    readonly status: "email_verified";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        request: {
+            post: {
+                body: {
+                    email: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        readonly status: "verification_requested";
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                email: string;
+                password: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Invalid email or password";
+                403: {
+                    readonly status: "email_not_verified";
+                };
+                200: {
+                    readonly status: "mfa_required";
+                } | {
+                    readonly passwordCompromised: boolean;
+                    readonly status: "authenticated";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                429: {
+                    readonly retryAfterMs: number | undefined;
+                    readonly status: "account_locked";
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        request: {
+            post: {
+                body: {
+                    email: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        readonly status: "reset_requested";
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                token: string;
+                password: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "Invalid or expired reset token" | {
+                    readonly message: "Password does not meet the policy";
+                    readonly violations: import("./passwordPolicy").PasswordPolicyViolation[];
+                };
+                200: {
+                    readonly status: "password_reset";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/credentials/types.d.ts

@@ -0,0 +1,26 @@
+import type { OrganizationId } from '../tenancy';
+export type CredentialStatus = 'active' | 'disabled';
+export type CredentialRecord = {
+    createdAt: number;
+    email: string;
+    emailVerified: boolean;
+    organizationId?: OrganizationId;
+    passwordHash: string;
+    status: CredentialStatus;
+    updatedAt: number;
+    userId?: string;
+};
+export type CredentialToken = {
+    email: string;
+    expiresAt: number;
+    tokenHash: string;
+};
+export type CredentialStore = {
+    consumeResetToken: (tokenHash: string) => Promise<CredentialToken | undefined>;
+    consumeVerificationToken: (tokenHash: string) => Promise<CredentialToken | undefined>;
+    getCredentialByEmail: (email: string) => Promise<CredentialRecord | undefined>;
+    saveCredential: (credential: CredentialRecord) => Promise<void>;
+    saveResetToken: (token: CredentialToken) => Promise<void>;
+    saveVerificationToken: (token: CredentialToken) => Promise<void>;
+    setEmailVerified: (email: string) => Promise<void>;
+};

package/dist/crypto.d.ts

@@ -0,0 +1,32 @@
+export declare const base32Decode: (encoded: string) => Uint8Array<ArrayBuffer>;
+export declare const base32Encode: (bytes: Uint8Array) => string;
+export declare const constantTimeEqual: (left: string, right: string) => Promise<boolean>;
+export declare const createTotpKeyUri: ({ accountName, digits, issuer, period, secret }: {
+    accountName: string;
+    digits?: number;
+    issuer: string;
+    period?: number;
+    secret: string;
+}) => string;
+export declare const decryptSecret: (ciphertext: string, keyMaterial: string) => Promise<string>;
+export declare const encryptSecret: (plaintext: string, keyMaterial: string) => Promise<string>;
+export declare const generateEncryptionKey: () => string;
+export declare const generateSecureToken: (byteLength?: number) => string;
+export declare const generateTotp: ({ digits, now, period, secret }: {
+    digits?: number;
+    now?: number;
+    period?: number;
+    secret: string;
+}) => Promise<string>;
+export declare const generateTotpSecret: (byteLength?: number) => string;
+export declare const hashPassword: (password: string) => Promise<string>;
+export declare const hashToken: (token: string) => Promise<string>;
+export declare const verifyPassword: (password: string, hash: string) => Promise<boolean>;
+export declare const verifyTotp: ({ digits, now, period, secret, token, window }: {
+    digits?: number;
+    now?: number;
+    period?: number;
+    secret: string;
+    token: string;
+    window?: number;
+}) => Promise<boolean>;

package/dist/errors.d.ts

@@ -0,0 +1,12 @@
+import { AuthIntent } from './types';
+export type AuthIdentityConflict = {
+    authProvider: string;
+    providerSubject: string;
+    existingUserAuthSub: string;
+    currentUserAuthSub?: string;
+    intent?: AuthIntent;
+};
+export declare class AuthIdentityConflictError extends Error {
+    conflict: AuthIdentityConflict;
+    constructor(conflict: AuthIdentityConflict);
+}

package/dist/federation/tokenStore.d.ts

@@ -0,0 +1,29 @@
+import type { Vault } from '../vault/config';
+export type FederatedTokenSet = {
+    accessToken: string;
+    expiresAt?: number;
+    refreshToken?: string;
+    scopes?: string[];
+    storedAt: number;
+    tokenType?: string;
+};
+export type FederatedTokenStore = {
+    delete: (userId: string, provider: string, revoke?: (tokens: FederatedTokenSet) => Promise<void>) => Promise<void>;
+    get: (userId: string, provider: string) => Promise<FederatedTokenSet | undefined>;
+    list: (userId: string) => Promise<string[]>;
+    save: (userId: string, provider: string, tokens: Omit<FederatedTokenSet, 'storedAt'>) => Promise<void>;
+};
+export declare const createFederatedTokenStore: (vault: Vault) => FederatedTokenStore;
+export type FederatedTokenRefresher = (refreshToken: string) => Promise<{
+    access_token: string;
+    expires_in?: number;
+    refresh_token?: string;
+    token_type?: string;
+}>;
+export declare const getOrRefreshFederatedTokens: ({ now, provider, refresh, store, userId }: {
+    now?: number;
+    provider: string;
+    refresh?: FederatedTokenRefresher;
+    store: FederatedTokenStore;
+    userId: string;
+}) => Promise<FederatedTokenSet | undefined>;