@absolutejs/auth 0.62.0 → 0.64.0

package/dist/credentials/config.d.ts

@@ -21,6 +21,10 @@ export type CredentialEmailMessage = {
 export type CredentialsConfig<UserType> = {
     checkBreachesOnLogin?: boolean;
     credentialStore: CredentialStore;
+    /** When `trustedOrigins` is set, whether an untrusted Origin is REJECTED
+     *  (default true) or merely reported via `onUntrustedOrigin` (false = a
+     *  report-only rollout that never blocks). */
+    enforceTrustedOrigins?: boolean;
     getUserByEmail: (email: string) => Promise<UserType | null | undefined> | UserType | null | undefined;
     isMfaRequired?: (user: UserType, context?: {
         headers: Record<string, string | undefined>;
@@ -56,6 +60,13 @@ export type CredentialsConfig<UserType> = {
         user: UserType;
     }) => void | Promise<void>;
     onSendEmail: (message: CredentialEmailMessage) => void | Promise<void>;
+    /** Called on login/register when the request's Origin is not in
+     *  `trustedOrigins`. Fires whether or not `enforceTrustedOrigins` blocks the
+     *  request, so it can drive a report-only rollout (log/surface the Origin). */
+    onUntrustedOrigin?: (context: {
+        origin: string | null;
+        request: Request;
+    }) => void | Promise<void>;
     passwordPolicy?: PasswordPolicy;
     registerRoute?: RouteString;
     /** When true, registration creates the account but NOT a session, and login is

package/dist/credentials/login.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type CredentialRouteProps } from './config';
-export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, cookieSecure, credentialStore, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, passwordVerifier, rehashOnLogin, requireEmailVerification, sessionDurationMs, trustedOrigins }: CredentialRouteProps<UserType>) => Elysia<"", {
+export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, cookieSecure, credentialStore, enforceTrustedOrigins, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, onUntrustedOrigin, passwordVerifier, rehashOnLogin, requireEmailVerification, sessionDurationMs, trustedOrigins }: CredentialRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;

package/dist/credentials/register.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type CredentialRouteProps } from './config';
-export declare const credentialsRegister: <UserType>({ authSessionStore, cookieSecure, credentialStore, onCreateCredentialUser, onCredentialsLoginSuccess, onExistingAccount, onRegistrationSuccess, onSendEmail, passwordPolicy, registerRoute, requireEmailVerification, revealRegistrationConflicts, sessionDurationMs, trustedOrigins, verificationTokenDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
+export declare const credentialsRegister: <UserType>({ authSessionStore, cookieSecure, credentialStore, enforceTrustedOrigins, onCreateCredentialUser, onCredentialsLoginSuccess, onExistingAccount, onRegistrationSuccess, onSendEmail, onUntrustedOrigin, passwordPolicy, registerRoute, requireEmailVerification, revealRegistrationConflicts, sessionDurationMs, trustedOrigins, verificationTokenDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;

package/dist/csrf.d.ts

@@ -1 +1,10 @@
 export declare const isTrustedOrigin: (request: Request, trustedOrigins?: readonly string[]) => boolean;
+export declare const resolveOriginAllowed: ({ enforce, onUntrustedOrigin, request, trustedOrigins }: {
+    enforce?: boolean;
+    onUntrustedOrigin?: (context: {
+        origin: string | null;
+        request: Request;
+    }) => void | Promise<void>;
+    request: Request;
+    trustedOrigins?: readonly string[];
+}) => Promise<boolean>;

package/dist/index.d.ts

@@ -3454,6 +3454,7 @@ export { createOAuthAccountLinkedProviderCredentialResolver, type OAuthLinkedPro
 export { createNeonLinkedProviderStores, createNeonOAuthLinkedProviderCredentialResolver } from './linkedProviders/neonStores';
 export { createInMemoryLinkedProviderStores } from './linkedProviders/inMemoryStores';
 export { protectRoutePlugin } from './routes/protectRoute';
+export { requireAuthPlugin } from './routes/requireAuth';
 export { sessionRoutes } from './routes/sessions';
 export { stepUpPlugin } from './routes/stepUp';
 export * from './session/sessionsConfig';

package/dist/index.js

@@ -2982,7 +2982,7 @@ var createCustomOAuth2Client = (providerConfig, credentials) => buildOAuth2Clien
 var createOAuth2Client = (providerName, config) => buildOAuth2Client(providers[providerName], config);
 
 // src/index.ts
-import { Elysia as Elysia45 } from "elysia";
+import { Elysia as Elysia46 } from "elysia";
 
 // src/apikeys/routes.ts
 import { Elysia, t } from "elysia";
@@ -5153,6 +5153,20 @@ var isTrustedOrigin = (request, trustedOrigins) => {
   const origin = request.headers.get("origin");
   return origin !== null && trustedOrigins.includes(origin);
 };
+var resolveOriginAllowed = async ({
+  enforce = true,
+  onUntrustedOrigin,
+  request,
+  trustedOrigins
+}) => {
+  if (isTrustedOrigin(request, trustedOrigins))
+    return true;
+  await onUntrustedOrigin?.({
+    origin: request.headers.get("origin"),
+    request
+  });
+  return enforce === false;
+};
 
 // src/credentials/import.ts
 init_crypto();
@@ -5349,12 +5363,14 @@ var credentialsLogin = ({
   checkBreachesOnLogin,
   cookieSecure,
   credentialStore,
+  enforceTrustedOrigins,
   getUserByEmail,
   isMfaRequired,
   lockoutGuard,
   loginRoute = "/auth/login",
   onCredentialsLoginError,
   onCredentialsLoginSuccess,
+  onUntrustedOrigin,
   passwordVerifier,
   rehashOnLogin = false,
   requireEmailVerification = false,
@@ -5367,7 +5383,12 @@ var credentialsLogin = ({
   status,
   store: { session, unregisteredSession }
 }) => withSpan("auth.credentials.login", undefined, async (span) => {
-  if (!isTrustedOrigin(request, trustedOrigins)) {
+  if (!await resolveOriginAllowed({
+    enforce: enforceTrustedOrigins,
+    onUntrustedOrigin,
+    request,
+    trustedOrigins
+  })) {
     return status("Forbidden", "Request origin is not allowed");
   }
   const headerBag = {};
@@ -5525,11 +5546,13 @@ var credentialsRegister = ({
   authSessionStore,
   cookieSecure,
   credentialStore,
+  enforceTrustedOrigins,
   onCreateCredentialUser,
   onCredentialsLoginSuccess,
   onExistingAccount,
   onRegistrationSuccess,
   onSendEmail,
+  onUntrustedOrigin,
   passwordPolicy,
   registerRoute = "/auth/register",
   requireEmailVerification = false,
@@ -5544,7 +5567,12 @@ var credentialsRegister = ({
   status,
   store: { session }
 }) => withSpan("auth.credentials.register", undefined, async () => {
-  if (!isTrustedOrigin(request, trustedOrigins)) {
+  if (!await resolveOriginAllowed({
+    enforce: enforceTrustedOrigins,
+    onUntrustedOrigin,
+    request,
+    trustedOrigins
+  })) {
     return status("Forbidden", "Request origin is not allowed");
   }
   const normalizedEmail = email.trim().toLowerCase();
@@ -31532,6 +31560,21 @@ var createInMemoryLinkedProviderStores = (input = {}) => {
   };
   return { bindingStore, grantStore };
 };
+// src/routes/requireAuth.ts
+import { Elysia as Elysia41, t as t33 } from "elysia";
+var requireAuthPlugin = ({
+  authSessionStore
+} = {}) => new Elysia41({
+  name: "@absolutejs/auth/require-auth",
+  seed: pluginDependencySeed(authSessionStore)
+}).use(sessionStore()).guard({ cookie: t33.Cookie({ user_session_id: userSessionIdTypebox }) }).resolve(async ({ store: { session }, cookie: { user_session_id } }) => {
+  const { user } = await getStatusFromSource({
+    authSessionStore,
+    session,
+    user_session_id
+  });
+  return { user: user ?? null };
+}).onBeforeHandle(({ user, status }) => user === null ? status("Unauthorized", "User is not authenticated") : undefined).as("global");
 // src/session/impersonation.ts
 init_constants();
 var DEFAULT_IMPERSONATION_TTL_MS = MILLISECONDS_IN_AN_HOUR;
@@ -32950,7 +32993,7 @@ var createInMemoryCredentialOfferStore = () => {
   };
 };
 // src/oidc/vciRoutes.ts
-import { Elysia as Elysia41, t as t33 } from "elysia";
+import { Elysia as Elysia42, t as t34 } from "elysia";
 var HTTP_OK4 = 200;
 var HTTP_BAD_REQUEST4 = 400;
 var HTTP_UNAUTHORIZED5 = 401;
@@ -32975,7 +33018,7 @@ var vciRoutes = ({
   const credentialRoute = `${vciRoute}/credential`;
   const nonceRoute = `${vciRoute}/nonce`;
   const vciSigningKey = vciConfig.signingKey ?? signingKey;
-  return new Elysia41().get("/.well-known/openid-credential-issuer", () => Response.json(buildIssuerMetadata({
+  return new Elysia42().get("/.well-known/openid-credential-issuer", () => Response.json(buildIssuerMetadata({
     config: vciConfig,
     issuer: issuerUrl,
     vciRoute
@@ -32998,11 +33041,11 @@ var vciRoutes = ({
       return errorBody(result.error, HTTP_BAD_REQUEST4);
     return Response.json({ credential: result.credential, format: result.format }, { status: HTTP_OK4 });
   }, {
-    body: t33.Object({
-      format: t33.Optional(t33.Union([t33.Literal("vc+sd-jwt")])),
-      proof: t33.Optional(t33.Object({
-        jwt: t33.String(),
-        proof_type: t33.Literal("jwt")
+    body: t34.Object({
+      format: t34.Optional(t34.Union([t34.Literal("vc+sd-jwt")])),
+      proof: t34.Optional(t34.Object({
+        jwt: t34.String(),
+        proof_type: t34.Literal("jwt")
       }))
     })
   }).post(nonceRoute, async () => {
@@ -33124,7 +33167,7 @@ var verifyStatusListJwt = async ({
   };
 };
 // src/vc/statusListRoutes.ts
-import { Elysia as Elysia42, t as t34 } from "elysia";
+import { Elysia as Elysia43, t as t35 } from "elysia";
 var HTTP_OK5 = 200;
 var HTTP_NOT_FOUND = 404;
 var DEFAULT_STATUS_ROUTE = "/vc/status";
@@ -33136,7 +33179,7 @@ var statusListRoutes = ({
   ttlSeconds
 }) => {
   const listRoute = `${statusRoute}/:listId`;
-  return new Elysia42().get(listRoute, async ({ params: { listId } }) => {
+  return new Elysia43().get(listRoute, async ({ params: { listId } }) => {
     const bits = await getStatusList(listId);
     if (bits === undefined) {
       return new Response("Not found", { status: HTTP_NOT_FOUND });
@@ -33152,7 +33195,7 @@ var statusListRoutes = ({
       headers: { "content-type": STATUS_LIST_SUB_TYP },
       status: HTTP_OK5
     });
-  }, { params: t34.Object({ listId: t34.String() }) });
+  }, { params: t35.Object({ listId: t35.String() }) });
 };
 // src/vc/openid4vp.ts
 init_crypto();
@@ -33357,7 +33400,7 @@ var createInMemoryPresentationRequestStore = () => {
   };
 };
 // src/vc/vpRoutes.ts
-import { Elysia as Elysia43, t as t35 } from "elysia";
+import { Elysia as Elysia44, t as t36 } from "elysia";
 var HTTP_OK6 = 200;
 var HTTP_BAD_REQUEST5 = 400;
 var HTTP_NOT_FOUND2 = 404;
@@ -33376,7 +33419,7 @@ var vpRoutes = ({
   const authorizeRoute = `${vpRoute}/authorize`;
   const requestRoute = `${vpRoute}/request/:id`;
   const responseRoute = `${vpRoute}/response`;
-  return new Elysia43().post(authorizeRoute, async ({ body }) => {
+  return new Elysia44().post(authorizeRoute, async ({ body }) => {
     const input = {
       clientId: body.client_id ?? defaultClientId,
       requestedClaims: body.requested_claims,
@@ -33394,10 +33437,10 @@ var vpRoutes = ({
       requestId: result.request.requestId
     }, { status: HTTP_OK6 });
   }, {
-    body: t35.Object({
-      client_id: t35.Optional(t35.String()),
-      requested_claims: t35.Array(t35.String()),
-      state: t35.Optional(t35.String())
+    body: t36.Object({
+      client_id: t36.Optional(t36.String()),
+      requested_claims: t36.Array(t36.String()),
+      state: t36.Optional(t36.String())
     })
   }).get(requestRoute, async ({ params: { id } }) => {
     const stored = await vpConfig.requestStore.getRequest(id);
@@ -33423,7 +33466,7 @@ var vpRoutes = ({
       },
       status: HTTP_OK6
     });
-  }, { params: t35.Object({ id: t35.String() }) }).post(responseRoute, async ({ body }) => {
+  }, { params: t36.Object({ id: t36.String() }) }).post(responseRoute, async ({ body }) => {
     const requestId = body.state;
     if (requestId === undefined) {
       return errorBody2("missing_state", HTTP_BAD_REQUEST5);
@@ -33444,10 +33487,10 @@ var vpRoutes = ({
       verified: true
     }, { status: HTTP_OK6 });
   }, {
-    body: t35.Object({
-      presentation_submission: t35.Optional(t35.Unknown()),
-      state: t35.Optional(t35.String()),
-      vp_token: t35.String()
+    body: t36.Object({
+      presentation_submission: t36.Optional(t36.Unknown()),
+      state: t36.Optional(t36.String()),
+      vp_token: t36.String()
     })
   });
 };
@@ -36803,7 +36846,7 @@ var blockMigrations = {
   webhooks: initMigration("webhooks", [webhookDeliveriesTable])
 };
 // src/sso/samlIdpRoutes.ts
-import { Elysia as Elysia44, t as t36 } from "elysia";
+import { Elysia as Elysia45, t as t37 } from "elysia";
 var HTTP_BAD_REQUEST6 = 400;
 var HTTP_UNAUTHORIZED6 = 401;
 var HTTP_FOUND2 = 302;
@@ -36913,19 +36956,19 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   };
-  return new Elysia44().use(sessionStore()).post(ssoIdpRoute, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
+  return new Elysia45().use(sessionStore()).post(ssoIdpRoute, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
     binding: "POST",
     body,
     inMemorySession: store.session,
     request,
     userSessionIdValue: user_session_id.value
   }), {
-    body: t36.Object({
-      RelayState: t36.Optional(t36.String()),
-      SAMLRequest: t36.Optional(t36.String())
+    body: t37.Object({
+      RelayState: t37.Optional(t37.String()),
+      SAMLRequest: t37.Optional(t37.String())
     }),
-    cookie: t36.Cookie({
-      user_session_id: t36.Optional(userSessionIdTypebox)
+    cookie: t37.Cookie({
+      user_session_id: t37.Optional(userSessionIdTypebox)
     })
   }).get(ssoIdpRoute, async ({ cookie: { user_session_id }, query, request, store }) => handleSpInitiated({
     binding: "Redirect",
@@ -36934,14 +36977,14 @@ var samlIdpRoutes = ({
     request,
     userSessionIdValue: user_session_id.value
   }), {
-    cookie: t36.Cookie({
-      user_session_id: t36.Optional(userSessionIdTypebox)
+    cookie: t37.Cookie({
+      user_session_id: t37.Optional(userSessionIdTypebox)
     }),
-    query: t36.Object({
-      RelayState: t36.Optional(t36.String()),
-      SAMLRequest: t36.Optional(t36.String()),
-      SigAlg: t36.Optional(t36.String()),
-      Signature: t36.Optional(t36.String())
+    query: t37.Object({
+      RelayState: t37.Optional(t37.String()),
+      SAMLRequest: t37.Optional(t37.String()),
+      SigAlg: t37.Optional(t37.String()),
+      Signature: t37.Optional(t37.String())
     })
   }).get(idpInitiateRoute, async ({
     cookie: { user_session_id },
@@ -36977,12 +37020,12 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   }, {
-    cookie: t36.Cookie({
-      user_session_id: t36.Optional(userSessionIdTypebox)
+    cookie: t37.Cookie({
+      user_session_id: t37.Optional(userSessionIdTypebox)
     }),
-    query: t36.Object({
-      RelayState: t36.Optional(t36.String()),
-      sp: t36.Optional(t36.String())
+    query: t37.Object({
+      RelayState: t37.Optional(t37.String()),
+      sp: t37.Optional(t37.String())
     })
   }).get(idpMetadataRoute, async ({ request }) => xmlResponse(await idpAdapter.getIdpMetadata({
     entityId: idpEntityId,
@@ -37431,7 +37474,7 @@ var buildAuthApplications = async (configuration) => {
   const auditedOnRevocationSuccess = auditEmit ? composeRevocationAudit(onRevocationSuccess, auditEmit) : onRevocationSuccess;
   const auditedOnSignOut = auditEmit ? composeSignOutAudit(onSignOut, auditEmit) : onSignOut;
   const pluginSeed = pluginDependencySeed(configuration);
-  const coreRoutes = new Elysia45({
+  const coreRoutes = new Elysia46({
     name: "@absolutejs/auth/core-routes",
     seed: pluginSeed
   }).use([
@@ -37488,7 +37531,7 @@ var buildAuthApplications = async (configuration) => {
       profileRoute
     })
   ]);
-  const featureRoutes = new Elysia45({
+  const featureRoutes = new Elysia46({
     name: "@absolutejs/auth/feature-routes",
     seed: pluginSeed
   }).use([
@@ -37497,64 +37540,64 @@ var buildAuthApplications = async (configuration) => {
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       lockoutGuard
-    }) : new Elysia45,
+    }) : new Elysia46,
     auditedMfa ? mfaRoutes({
       ...auditedMfa,
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       verificationProvider
-    }) : new Elysia45,
+    }) : new Elysia46,
     passwordless ? passwordlessRoutes({
       ...passwordless,
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       emit: auditEmit
-    }) : new Elysia45,
-    sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia45,
+    }) : new Elysia46,
+    sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia46,
     sso ? oidcSsoRoutes({
       ...sso,
       authSessionStore,
       cookieSecure: resolvedCookieSecure
-    }) : new Elysia45,
+    }) : new Elysia46,
     sso && sso.samlAdapter ? samlSsoRoutes({
       ...sso,
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       samlAdapter: sso.samlAdapter
-    }) : new Elysia45,
+    }) : new Elysia46,
     sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
       getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
       ssoConnectionStore: sso.ssoConnectionStore,
       ssoRoute: sso.ssoRoute
-    }) : new Elysia45,
-    scim ? scimRoutes(scim) : new Elysia45,
-    apikeys ? apiKeysRoutes(apikeys) : new Elysia45,
+    }) : new Elysia46,
+    scim ? scimRoutes(scim) : new Elysia46,
+    apikeys ? apiKeysRoutes(apikeys) : new Elysia46,
     oidcConfig ? oidcProviderRoutes({
       ...oidcConfig,
       authSessionStore
-    }) : new Elysia45,
+    }) : new Elysia46,
     organizations ? organizationRoutes({
       ...organizations,
       authSessionStore,
       emit: auditEmit
-    }) : new Elysia45,
+    }) : new Elysia46,
     roles ? roleRoutes({
       ...roles,
       authSessionStore,
       emit: auditEmit
-    }) : new Elysia45,
-    portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia45,
+    }) : new Elysia46,
+    portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia46,
     webauthn ? webauthnRoutes({
       ...webauthn,
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       emit: auditEmit
-    }) : new Elysia45,
+    }) : new Elysia46,
     compliance ? complianceRoutes({
       ...compliance,
       authSessionStore,
       emit: auditEmit
-    }) : new Elysia45,
+    }) : new Elysia46,
     createConfiguredAuthHtmxRoutes({ authSessionStore, config: htmx }),
     agentAuthRoutes(resolvedAgentAuth)
   ]);
@@ -37569,7 +37612,7 @@ var buildAuthApplications = async (configuration) => {
 };
 var auth = async (configuration) => {
   const { authContext, coreRoutes, featureRoutes } = await buildAuthApplications(configuration);
-  const application = new Elysia45({
+  const application = new Elysia46({
     name: "@absolutejs/auth",
     seed: pluginDependencySeed(configuration)
   });
@@ -37664,6 +37707,7 @@ export {
   resolveProviderClientConfiguration,
   resolvePostLogoutRedirect,
   resolvePermissions,
+  resolveOriginAllowed,
   resolveOAuthTokenExpiresAt,
   resolveOAuthAuthorization,
   resolveCookieSecure,
@@ -37672,6 +37716,7 @@ export {
   resolveAuthHtmxRenderers,
   resolveApiPrincipal,
   resolveAgentPrincipal,
+  requireAuthPlugin,
   removeFromSessionRing,
   rehashCredentialPassword,
   registerClient,
@@ -38084,5 +38129,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=A62F57FCBD818EE864756E2164756E21
+//# debugId=9C794F23428AA07964756E2164756E21
 //# sourceMappingURL=index.js.map