@absolutejs/auth 0.61.0 → 0.63.0

package/dist/routes/requireAuth.d.ts

@@ -0,0 +1,43 @@
+import { Elysia } from 'elysia';
+import type { AuthSessionSource } from '../session/types';
+export declare const requireAuthPlugin: <UserType>({ authSessionStore }?: {
+    authSessionStore?: AuthSessionSource<UserType>;
+}) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {
+        readonly user: NonNullable<UserType> | null;
+    };
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: import("elysia").UnwrapRoute<{
+        cookie: import("@sinclair/typebox").TObject<{
+            user_session_id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TTemplateLiteralSyntax<"${string}-${string}-${string}-${string}-${string}">>;
+        }>;
+    }, {}, "">;
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {
+        401: "User is not authenticated";
+    };
+}, {}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/server.d.ts

@@ -14,6 +14,7 @@ export type { SetupCapability, SetupSession, SetupSessionStore } from './portal/
 export { createSetupSession } from './portal/operations';
 export { createPostgresSetupSessionStore } from './portal/postgresSetupSessionStore';
 export { protectRoutePlugin } from './routes/protectRoute';
+export { requireAuthPlugin } from './routes/requireAuth';
 export type { ScimConfig } from './scim/config';
 export type { ScimFilter, ScimGroup, ScimGroupInput, ScimTokenStore, ScimUser, ScimUserInput } from './scim/types';
 export { createPostgresScimTokenStore } from './scim/postgresScimTokenStore';

package/dist/server.js

@@ -3978,7 +3978,7 @@ var createCustomOAuth2Client = (providerConfig, credentials) => buildOAuth2Clien
 var createOAuth2Client = (providerName, config) => buildOAuth2Client(providers[providerName], config);
 
 // src/index.ts
-import { Elysia as Elysia45 } from "elysia";
+import { Elysia as Elysia46 } from "elysia";
 
 // src/apikeys/routes.ts
 import { Elysia, t } from "elysia";
@@ -6141,6 +6141,15 @@ init_constants();
 init_crypto();
 import { Elysia as Elysia11, t as t8 } from "elysia";
 
+// src/csrf.ts
+var isTrustedOrigin = (request, trustedOrigins) => {
+  if (trustedOrigins === undefined || trustedOrigins.length === 0) {
+    return true;
+  }
+  const origin = request.headers.get("origin");
+  return origin !== null && trustedOrigins.includes(origin);
+};
+
 // src/credentials/import.ts
 init_crypto();
 var normalizeEmail = (email) => email.trim().toLowerCase();
@@ -6345,7 +6354,8 @@ var credentialsLogin = ({
   passwordVerifier,
   rehashOnLogin = false,
   requireEmailVerification = false,
-  sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS
+  sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
+  trustedOrigins
 }) => new Elysia11().use(sessionStore()).post(loginRoute, async ({
   body: { email, password },
   cookie: { user_session_id },
@@ -6353,6 +6363,9 @@ var credentialsLogin = ({
   status,
   store: { session, unregisteredSession }
 }) => withSpan("auth.credentials.login", undefined, async (span) => {
+  if (!isTrustedOrigin(request, trustedOrigins)) {
+    return status("Forbidden", "Request origin is not allowed");
+  }
   const headerBag = {};
   request.headers.forEach((value, key) => {
     headerBag[key] = value;
@@ -6510,19 +6523,26 @@ var credentialsRegister = ({
   credentialStore,
   onCreateCredentialUser,
   onCredentialsLoginSuccess,
+  onExistingAccount,
   onRegistrationSuccess,
   onSendEmail,
   passwordPolicy,
   registerRoute = "/auth/register",
   requireEmailVerification = false,
+  revealRegistrationConflicts = false,
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
+  trustedOrigins,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS
 }) => new Elysia13().use(sessionStore()).post(registerRoute, async ({
   body: { email, password, ...extraFields },
   cookie: { user_session_id },
+  request,
   status,
   store: { session }
 }) => withSpan("auth.credentials.register", undefined, async () => {
+  if (!isTrustedOrigin(request, trustedOrigins)) {
+    return status("Forbidden", "Request origin is not allowed");
+  }
   const normalizedEmail = email.trim().toLowerCase();
   if (!normalizedEmail.includes("@")) {
     return status("Bad Request", "A valid email is required");
@@ -6536,7 +6556,13 @@ var credentialsRegister = ({
   }
   const existing = await credentialStore.getCredentialByEmail(normalizedEmail);
   if (existing) {
-    return status("Conflict", "Email is already registered");
+    if (revealRegistrationConflicts) {
+      return status("Conflict", "Email is already registered");
+    }
+    await onExistingAccount?.({ email: normalizedEmail });
+    return status("Created", {
+      status: "verification_required"
+    });
   }
   const created = await onCreateCredentialUser({
     ...extraFields,
@@ -32502,6 +32528,21 @@ var createInMemoryLinkedProviderStores = (input = {}) => {
   };
   return { bindingStore, grantStore };
 };
+// src/routes/requireAuth.ts
+import { Elysia as Elysia41, t as t33 } from "elysia";
+var requireAuthPlugin = ({
+  authSessionStore
+} = {}) => new Elysia41({
+  name: "@absolutejs/auth/require-auth",
+  seed: pluginDependencySeed(authSessionStore)
+}).use(sessionStore()).guard({ cookie: t33.Cookie({ user_session_id: userSessionIdTypebox }) }).resolve(async ({ store: { session }, cookie: { user_session_id } }) => {
+  const { user } = await getStatusFromSource({
+    authSessionStore,
+    session,
+    user_session_id
+  });
+  return { user: user ?? null };
+}).onBeforeHandle(({ user, status }) => user === null ? status("Unauthorized", "User is not authenticated") : undefined).as("global");
 // src/session/impersonation.ts
 init_constants();
 var DEFAULT_IMPERSONATION_TTL_MS = MILLISECONDS_IN_AN_HOUR;
@@ -33920,7 +33961,7 @@ var createInMemoryCredentialOfferStore = () => {
   };
 };
 // src/oidc/vciRoutes.ts
-import { Elysia as Elysia41, t as t33 } from "elysia";
+import { Elysia as Elysia42, t as t34 } from "elysia";
 var HTTP_OK4 = 200;
 var HTTP_BAD_REQUEST4 = 400;
 var HTTP_UNAUTHORIZED5 = 401;
@@ -33945,7 +33986,7 @@ var vciRoutes = ({
   const credentialRoute = `${vciRoute}/credential`;
   const nonceRoute = `${vciRoute}/nonce`;
   const vciSigningKey = vciConfig.signingKey ?? signingKey;
-  return new Elysia41().get("/.well-known/openid-credential-issuer", () => Response.json(buildIssuerMetadata({
+  return new Elysia42().get("/.well-known/openid-credential-issuer", () => Response.json(buildIssuerMetadata({
     config: vciConfig,
     issuer: issuerUrl,
     vciRoute
@@ -33968,11 +34009,11 @@ var vciRoutes = ({
       return errorBody(result.error, HTTP_BAD_REQUEST4);
     return Response.json({ credential: result.credential, format: result.format }, { status: HTTP_OK4 });
   }, {
-    body: t33.Object({
-      format: t33.Optional(t33.Union([t33.Literal("vc+sd-jwt")])),
-      proof: t33.Optional(t33.Object({
-        jwt: t33.String(),
-        proof_type: t33.Literal("jwt")
+    body: t34.Object({
+      format: t34.Optional(t34.Union([t34.Literal("vc+sd-jwt")])),
+      proof: t34.Optional(t34.Object({
+        jwt: t34.String(),
+        proof_type: t34.Literal("jwt")
       }))
     })
   }).post(nonceRoute, async () => {
@@ -34094,7 +34135,7 @@ var verifyStatusListJwt = async ({
   };
 };
 // src/vc/statusListRoutes.ts
-import { Elysia as Elysia42, t as t34 } from "elysia";
+import { Elysia as Elysia43, t as t35 } from "elysia";
 var HTTP_OK5 = 200;
 var HTTP_NOT_FOUND = 404;
 var DEFAULT_STATUS_ROUTE = "/vc/status";
@@ -34106,7 +34147,7 @@ var statusListRoutes = ({
   ttlSeconds
 }) => {
   const listRoute = `${statusRoute}/:listId`;
-  return new Elysia42().get(listRoute, async ({ params: { listId } }) => {
+  return new Elysia43().get(listRoute, async ({ params: { listId } }) => {
     const bits = await getStatusList(listId);
     if (bits === undefined) {
       return new Response("Not found", { status: HTTP_NOT_FOUND });
@@ -34122,7 +34163,7 @@ var statusListRoutes = ({
       headers: { "content-type": STATUS_LIST_SUB_TYP },
       status: HTTP_OK5
     });
-  }, { params: t34.Object({ listId: t34.String() }) });
+  }, { params: t35.Object({ listId: t35.String() }) });
 };
 // src/vc/openid4vp.ts
 init_crypto();
@@ -34327,7 +34368,7 @@ var createInMemoryPresentationRequestStore = () => {
   };
 };
 // src/vc/vpRoutes.ts
-import { Elysia as Elysia43, t as t35 } from "elysia";
+import { Elysia as Elysia44, t as t36 } from "elysia";
 var HTTP_OK6 = 200;
 var HTTP_BAD_REQUEST5 = 400;
 var HTTP_NOT_FOUND2 = 404;
@@ -34346,7 +34387,7 @@ var vpRoutes = ({
   const authorizeRoute = `${vpRoute}/authorize`;
   const requestRoute = `${vpRoute}/request/:id`;
   const responseRoute = `${vpRoute}/response`;
-  return new Elysia43().post(authorizeRoute, async ({ body }) => {
+  return new Elysia44().post(authorizeRoute, async ({ body }) => {
     const input = {
       clientId: body.client_id ?? defaultClientId,
       requestedClaims: body.requested_claims,
@@ -34364,10 +34405,10 @@ var vpRoutes = ({
       requestId: result.request.requestId
     }, { status: HTTP_OK6 });
   }, {
-    body: t35.Object({
-      client_id: t35.Optional(t35.String()),
-      requested_claims: t35.Array(t35.String()),
-      state: t35.Optional(t35.String())
+    body: t36.Object({
+      client_id: t36.Optional(t36.String()),
+      requested_claims: t36.Array(t36.String()),
+      state: t36.Optional(t36.String())
     })
   }).get(requestRoute, async ({ params: { id } }) => {
     const stored = await vpConfig.requestStore.getRequest(id);
@@ -34393,7 +34434,7 @@ var vpRoutes = ({
       },
       status: HTTP_OK6
     });
-  }, { params: t35.Object({ id: t35.String() }) }).post(responseRoute, async ({ body }) => {
+  }, { params: t36.Object({ id: t36.String() }) }).post(responseRoute, async ({ body }) => {
     const requestId = body.state;
     if (requestId === undefined) {
       return errorBody2("missing_state", HTTP_BAD_REQUEST5);
@@ -34414,10 +34455,10 @@ var vpRoutes = ({
       verified: true
     }, { status: HTTP_OK6 });
   }, {
-    body: t35.Object({
-      presentation_submission: t35.Optional(t35.Unknown()),
-      state: t35.Optional(t35.String()),
-      vp_token: t35.String()
+    body: t36.Object({
+      presentation_submission: t36.Optional(t36.Unknown()),
+      state: t36.Optional(t36.String()),
+      vp_token: t36.String()
     })
   });
 };
@@ -37773,7 +37814,7 @@ var blockMigrations = {
   webhooks: initMigration("webhooks", [webhookDeliveriesTable])
 };
 // src/sso/samlIdpRoutes.ts
-import { Elysia as Elysia44, t as t36 } from "elysia";
+import { Elysia as Elysia45, t as t37 } from "elysia";
 var HTTP_BAD_REQUEST6 = 400;
 var HTTP_UNAUTHORIZED6 = 401;
 var HTTP_FOUND2 = 302;
@@ -37883,19 +37924,19 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   };
-  return new Elysia44().use(sessionStore()).post(ssoIdpRoute, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
+  return new Elysia45().use(sessionStore()).post(ssoIdpRoute, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
     binding: "POST",
     body,
     inMemorySession: store.session,
     request,
     userSessionIdValue: user_session_id.value
   }), {
-    body: t36.Object({
-      RelayState: t36.Optional(t36.String()),
-      SAMLRequest: t36.Optional(t36.String())
+    body: t37.Object({
+      RelayState: t37.Optional(t37.String()),
+      SAMLRequest: t37.Optional(t37.String())
     }),
-    cookie: t36.Cookie({
-      user_session_id: t36.Optional(userSessionIdTypebox)
+    cookie: t37.Cookie({
+      user_session_id: t37.Optional(userSessionIdTypebox)
     })
   }).get(ssoIdpRoute, async ({ cookie: { user_session_id }, query, request, store }) => handleSpInitiated({
     binding: "Redirect",
@@ -37904,14 +37945,14 @@ var samlIdpRoutes = ({
     request,
     userSessionIdValue: user_session_id.value
   }), {
-    cookie: t36.Cookie({
-      user_session_id: t36.Optional(userSessionIdTypebox)
+    cookie: t37.Cookie({
+      user_session_id: t37.Optional(userSessionIdTypebox)
     }),
-    query: t36.Object({
-      RelayState: t36.Optional(t36.String()),
-      SAMLRequest: t36.Optional(t36.String()),
-      SigAlg: t36.Optional(t36.String()),
-      Signature: t36.Optional(t36.String())
+    query: t37.Object({
+      RelayState: t37.Optional(t37.String()),
+      SAMLRequest: t37.Optional(t37.String()),
+      SigAlg: t37.Optional(t37.String()),
+      Signature: t37.Optional(t37.String())
     })
   }).get(idpInitiateRoute, async ({
     cookie: { user_session_id },
@@ -37947,12 +37988,12 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   }, {
-    cookie: t36.Cookie({
-      user_session_id: t36.Optional(userSessionIdTypebox)
+    cookie: t37.Cookie({
+      user_session_id: t37.Optional(userSessionIdTypebox)
     }),
-    query: t36.Object({
-      RelayState: t36.Optional(t36.String()),
-      sp: t36.Optional(t36.String())
+    query: t37.Object({
+      RelayState: t37.Optional(t37.String()),
+      sp: t37.Optional(t37.String())
     })
   }).get(idpMetadataRoute, async ({ request }) => xmlResponse(await idpAdapter.getIdpMetadata({
     entityId: idpEntityId,
@@ -38401,7 +38442,7 @@ var buildAuthApplications = async (configuration) => {
   const auditedOnRevocationSuccess = auditEmit ? composeRevocationAudit(onRevocationSuccess, auditEmit) : onRevocationSuccess;
   const auditedOnSignOut = auditEmit ? composeSignOutAudit(onSignOut, auditEmit) : onSignOut;
   const pluginSeed = pluginDependencySeed(configuration);
-  const coreRoutes = new Elysia45({
+  const coreRoutes = new Elysia46({
     name: "@absolutejs/auth/core-routes",
     seed: pluginSeed
   }).use([
@@ -38458,7 +38499,7 @@ var buildAuthApplications = async (configuration) => {
       profileRoute
     })
   ]);
-  const featureRoutes = new Elysia45({
+  const featureRoutes = new Elysia46({
     name: "@absolutejs/auth/feature-routes",
     seed: pluginSeed
   }).use([
@@ -38467,64 +38508,64 @@ var buildAuthApplications = async (configuration) => {
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       lockoutGuard
-    }) : new Elysia45,
+    }) : new Elysia46,
     auditedMfa ? mfaRoutes({
       ...auditedMfa,
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       verificationProvider
-    }) : new Elysia45,
+    }) : new Elysia46,
     passwordless ? passwordlessRoutes({
       ...passwordless,
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       emit: auditEmit
-    }) : new Elysia45,
-    sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia45,
+    }) : new Elysia46,
+    sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia46,
     sso ? oidcSsoRoutes({
       ...sso,
       authSessionStore,
       cookieSecure: resolvedCookieSecure
-    }) : new Elysia45,
+    }) : new Elysia46,
     sso && sso.samlAdapter ? samlSsoRoutes({
       ...sso,
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       samlAdapter: sso.samlAdapter
-    }) : new Elysia45,
+    }) : new Elysia46,
     sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
       getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
       ssoConnectionStore: sso.ssoConnectionStore,
       ssoRoute: sso.ssoRoute
-    }) : new Elysia45,
-    scim ? scimRoutes(scim) : new Elysia45,
-    apikeys ? apiKeysRoutes(apikeys) : new Elysia45,
+    }) : new Elysia46,
+    scim ? scimRoutes(scim) : new Elysia46,
+    apikeys ? apiKeysRoutes(apikeys) : new Elysia46,
     oidcConfig ? oidcProviderRoutes({
       ...oidcConfig,
       authSessionStore
-    }) : new Elysia45,
+    }) : new Elysia46,
     organizations ? organizationRoutes({
       ...organizations,
       authSessionStore,
       emit: auditEmit
-    }) : new Elysia45,
+    }) : new Elysia46,
     roles ? roleRoutes({
       ...roles,
       authSessionStore,
       emit: auditEmit
-    }) : new Elysia45,
-    portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia45,
+    }) : new Elysia46,
+    portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia46,
     webauthn ? webauthnRoutes({
       ...webauthn,
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       emit: auditEmit
-    }) : new Elysia45,
+    }) : new Elysia46,
     compliance ? complianceRoutes({
       ...compliance,
       authSessionStore,
       emit: auditEmit
-    }) : new Elysia45,
+    }) : new Elysia46,
     createConfiguredAuthHtmxRoutes({ authSessionStore, config: htmx }),
     agentAuthRoutes(resolvedAgentAuth)
   ]);
@@ -38539,7 +38580,7 @@ var buildAuthApplications = async (configuration) => {
 };
 var auth = async (configuration) => {
   const { authContext, coreRoutes, featureRoutes } = await buildAuthApplications(configuration);
-  const application = new Elysia45({
+  const application = new Elysia46({
     name: "@absolutejs/auth",
     seed: pluginDependencySeed(configuration)
   });
@@ -38707,6 +38748,7 @@ var createNodeSamlAdapter = async (options = {}) => {
 var auth2 = auth;
 export {
   userSessionIdTypebox,
+  requireAuthPlugin,
   providers,
   protectRoutePlugin,
   isValidProviderOption,
@@ -38723,5 +38765,5 @@ export {
   VerificationProviderError
 };
 
-//# debugId=D218332195145BB664756E2164756E21
+//# debugId=015C798311C7C14564756E2164756E21
 //# sourceMappingURL=server.js.map