@absolutejs/auth 0.65.1 → 0.65.2

package/dist/passwordless/config.d.ts

@@ -0,0 +1,43 @@
+import type { AuditEmitter } from '../audit/config';
+import type { AuthSessionStore } from '../session/types';
+import type { RouteString, UserSessionId } from '../types';
+import type { PasswordlessTokenStore } from './types';
+export declare const DEFAULT_MAGIC_LINK_TTL_MS: number;
+export declare const DEFAULT_OTP_LENGTH = 6;
+export declare const DEFAULT_OTP_TTL_MS: number;
+export declare const DEFAULT_PASSWORDLESS_ROUTE: RouteString;
+export declare const DEFAULT_PASSWORDLESS_SESSION_TTL_MS: number;
+export type MagicLinkMessage = {
+    email: string;
+    expiresAt: number;
+    token: string;
+};
+export type PasswordlessOtpMessage = {
+    code: string;
+    email: string;
+    expiresAt: number;
+};
+export type PasswordlessConfig<UserType> = {
+    getUserByEmail: (email: string) => Promise<UserType | null | undefined> | UserType | null | undefined;
+    passwordlessTokenStore: PasswordlessTokenStore;
+    getUserId?: (user: UserType) => string;
+    magicLinkTokenDurationMs?: number;
+    onCreateUser?: (context: {
+        email: string;
+    }) => Promise<UserType> | UserType;
+    onPasswordlessLogin?: (context: {
+        user: UserType;
+        userSessionId: UserSessionId;
+    }) => void | Promise<void>;
+    onSendMagicLink?: (message: MagicLinkMessage) => void | Promise<void>;
+    onSendOtp?: (message: PasswordlessOtpMessage) => void | Promise<void>;
+    otpDurationMs?: number;
+    otpLength?: number;
+    passwordlessRoute?: RouteString;
+    sessionDurationMs?: number;
+};
+export type PasswordlessRouteProps<UserType> = PasswordlessConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+    cookieSecure?: boolean;
+    emit?: AuditEmitter;
+};

package/dist/passwordless/inMemoryPasswordlessTokenStore.d.ts

@@ -0,0 +1,2 @@
+import type { PasswordlessTokenStore } from './types';
+export declare const createInMemoryPasswordlessTokenStore: () => PasswordlessTokenStore;

package/dist/passwordless/postgresPasswordlessTokenStore.d.ts

@@ -0,0 +1,56 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { PasswordlessTokenStore } from './types';
+export declare const passwordlessTokensTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_passwordless_tokens";
+    schema: undefined;
+    columns: {
+        email: import("drizzle-orm/pg-core").PgBuildColumn<"auth_passwordless_tokens", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_passwordless_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_passwordless_tokens", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_passwordless_tokens";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        token_hash: import("drizzle-orm/pg-core").PgBuildColumn<"auth_passwordless_tokens", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_passwordless_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonPasswordlessTokenStore: (databaseUrl: string) => PasswordlessTokenStore;
+export declare const createPostgresPasswordlessTokenStore: <DB extends AnyPgDatabase>(db: DB) => PasswordlessTokenStore;

package/dist/passwordless/routes.d.ts

@@ -0,0 +1,163 @@
+import { Elysia } from 'elysia';
+import type { SessionRecord } from '../types';
+import { type PasswordlessRouteProps } from './config';
+export declare const passwordlessRoutes: <UserType>({ authSessionStore, cookieSecure, emit, getUserByEmail, getUserId, magicLinkTokenDurationMs, onCreateUser, onPasswordlessLogin, onSendMagicLink, onSendOtp, otpDurationMs, otpLength, passwordlessRoute, passwordlessTokenStore, sessionDurationMs }: PasswordlessRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {} | {
+        session: SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    } | {
+        session: SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    } | {
+        session: SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, ({} | ({
+    [x: string]: {
+        "magic-link": {
+            post: {
+                body: {
+                    email: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        readonly status: "magic_link_sent";
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        "magic-link": {
+            verify: {
+                post: {
+                    body: {
+                        token: string;
+                    };
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        400: "Invalid or expired link";
+                        401: "No account for this email";
+                        200: {
+                            readonly status: "authenticated";
+                        };
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+})) & ({} | ({
+    [x: string]: {
+        otp: {
+            post: {
+                body: {
+                    email: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        readonly status: "otp_sent";
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        otp: {
+            verify: {
+                post: {
+                    body: {
+                        email: string;
+                        code: string;
+                    };
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        400: "Invalid or expired code";
+                        401: "No account for this email";
+                        200: {
+                            readonly status: "authenticated";
+                        };
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+})), {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/passwordless/types.d.ts

@@ -0,0 +1,9 @@
+export type PasswordlessToken = {
+    email: string;
+    expiresAt: number;
+    tokenHash: string;
+};
+export type PasswordlessTokenStore = {
+    consumeToken: (tokenHash: string) => Promise<PasswordlessToken | undefined>;
+    saveToken: (token: PasswordlessToken) => Promise<void>;
+};

package/dist/pluginIdentity.d.ts

@@ -0,0 +1,2 @@
+/** Stable process-local seed for configured Elysia dependencies. */
+export declare const pluginDependencySeed: (dependency?: object) => number | "default";

package/dist/plugins/denyDisposableEmail.d.ts

@@ -0,0 +1,7 @@
+export type DenyDisposableEmailDecision = {
+    allow: false;
+    reason: string;
+} | {
+    allow: true;
+};
+export declare const denyDisposableEmailPlugin: (email: string) => Promise<DenyDisposableEmailDecision>;

package/dist/plugins/discordAlert.d.ts

@@ -0,0 +1,7 @@
+import type { AuditEvent, AuditEventType, AuditSink } from '../audit/types';
+export type DiscordAlertOptions = {
+    events?: readonly AuditEventType[];
+    formatContent?: (event: AuditEvent) => string;
+    webhookUrl: string;
+};
+export declare const discordAlertPlugin: ({ events, formatContent, webhookUrl }: DiscordAlertOptions) => AuditSink;

package/dist/plugins/geoBlock.d.ts

@@ -0,0 +1,8 @@
+export type GeoBlockOptions = {
+    allowCountries: readonly string[];
+    denyCountries?: never;
+} | {
+    allowCountries?: never;
+    denyCountries: readonly string[];
+};
+export declare const geoBlockPlugin: (options: GeoBlockOptions) => (headers: Record<string, string | undefined>) => boolean;

package/dist/plugins/index.d.ts

@@ -0,0 +1,12 @@
+export { denyDisposableEmailPlugin } from './denyDisposableEmail';
+export type { DenyDisposableEmailDecision } from './denyDisposableEmail';
+export { discordAlertPlugin } from './discordAlert';
+export type { DiscordAlertOptions } from './discordAlert';
+export { geoBlockPlugin } from './geoBlock';
+export type { GeoBlockOptions } from './geoBlock';
+export { pagerdutyAlertPlugin } from './pagerdutyAlert';
+export type { PagerDutyAlertOptions, PagerDutySeverity } from './pagerdutyAlert';
+export { posthogIdentifyPlugin } from './posthogIdentify';
+export type { PosthogIdentifyOptions } from './posthogIdentify';
+export { slackAlertPlugin } from './slackAlert';
+export type { SlackAlertOptions } from './slackAlert';

package/dist/plugins/pagerdutyAlert.d.ts

@@ -0,0 +1,9 @@
+import type { AuditEventType, AuditSink } from '../audit/types';
+export type PagerDutySeverity = 'critical' | 'error' | 'info' | 'warning';
+export type PagerDutyAlertOptions = {
+    events?: readonly AuditEventType[];
+    routingKey: string;
+    severity?: PagerDutySeverity;
+    source?: string;
+};
+export declare const pagerdutyAlertPlugin: ({ events, routingKey, severity, source }: PagerDutyAlertOptions) => AuditSink;

package/dist/plugins/posthogIdentify.d.ts

@@ -0,0 +1,7 @@
+import type { AuditEvent, AuditSink } from '../audit/types';
+export type PosthogIdentifyOptions = {
+    host?: string;
+    projectApiKey: string;
+    properties?: (event: AuditEvent) => Record<string, unknown>;
+};
+export declare const posthogIdentifyPlugin: ({ host, projectApiKey, properties }: PosthogIdentifyOptions) => AuditSink;

package/dist/plugins/slackAlert.d.ts

@@ -0,0 +1,7 @@
+import type { AuditEvent, AuditEventType, AuditSink } from '../audit/types';
+export type SlackAlertOptions = {
+    events?: readonly AuditEventType[];
+    formatMessage?: (event: AuditEvent) => string;
+    webhookUrl: string;
+};
+export declare const slackAlertPlugin: ({ events, formatMessage, webhookUrl }: SlackAlertOptions) => AuditSink;

package/dist/portal/config.d.ts

@@ -0,0 +1,34 @@
+import type { AuditEmitter } from '../audit/config';
+import type { ScimTokenStore } from '../scim/types';
+import type { SSOConnectionStore, SSOConnectionType } from '../sso/types';
+import type { OrganizationId } from '../tenancy';
+import type { RouteString } from '../types';
+import type { SetupCapability, SetupSessionStore } from './types';
+export declare const DEFAULT_PORTAL_ROUTE: RouteString;
+export declare const DEFAULT_SETUP_SESSION_TTL_MS: number;
+export type PortalConfig = {
+    setupSessionStore: SetupSessionStore;
+    onScimTokenCreated?: (context: {
+        organizationId: OrganizationId;
+        tokenId: string;
+    }) => void | Promise<void>;
+    onSsoConnectionConfigured?: (context: {
+        organizationId: OrganizationId;
+        type: SSOConnectionType;
+    }) => void | Promise<void>;
+    portalRoute?: RouteString;
+    scimRoute?: RouteString;
+    scimTokenStore?: ScimTokenStore;
+    ssoConnectionStore?: SSOConnectionStore;
+    ssoRoute?: RouteString;
+};
+export type PortalRouteProps = PortalConfig & {
+    emit?: AuditEmitter;
+};
+export type SetupSessionRequest = {
+    capabilities: SetupCapability[];
+    createdBy?: string;
+    organizationId: OrganizationId;
+    setupSessionDurationMs?: number;
+    setupSessionStore: SetupSessionStore;
+};

package/dist/portal/inMemorySetupSessionStore.d.ts

@@ -0,0 +1,2 @@
+import type { SetupSessionStore } from './types';
+export declare const createInMemorySetupSessionStore: () => SetupSessionStore;

package/dist/portal/operations.d.ts

@@ -0,0 +1,10 @@
+import { type SetupSessionRequest } from './config';
+import type { SetupSession, SetupSessionStore } from './types';
+export declare const createSetupSession: ({ capabilities, createdBy, organizationId, setupSessionDurationMs, setupSessionStore }: SetupSessionRequest) => Promise<{
+    setupSession: SetupSession;
+    token: string;
+}>;
+export declare const resolveSetupSession: ({ authorization, setupSessionStore }: {
+    authorization: string | undefined;
+    setupSessionStore: SetupSessionStore;
+}) => Promise<SetupSession | undefined>;

package/dist/portal/postgresSetupSessionStore.d.ts

@@ -0,0 +1,116 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { SetupCapability, SetupSessionStore } from './types';
+export declare const setupSessionsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_setup_sessions";
+    schema: undefined;
+    columns: {
+        capabilities: import("drizzle-orm/pg-core").PgBuildColumn<"auth_setup_sessions", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, SetupCapability[]>>>, {
+            name: string;
+            tableName: "auth_setup_sessions";
+            dataType: "object json";
+            data: SetupCapability[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_setup_sessions", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_setup_sessions";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_by: import("drizzle-orm/pg-core").PgBuildColumn<"auth_setup_sessions", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_setup_sessions";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_setup_sessions", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_setup_sessions";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        organization_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_setup_sessions", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_setup_sessions";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        setup_session_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_setup_sessions", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_setup_sessions";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        token_hash: import("drizzle-orm/pg-core").PgBuildColumn<"auth_setup_sessions", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_setup_sessions";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonSetupSessionStore: (databaseUrl: string) => SetupSessionStore;
+export declare const createPostgresSetupSessionStore: <DB extends AnyPgDatabase>(db: DB) => SetupSessionStore;

package/dist/portal/routes.d.ts

@@ -0,0 +1,160 @@
+import { Elysia } from 'elysia';
+import { type PortalRouteProps } from './config';
+export declare const portalRoutes: ({ emit, onScimTokenCreated, onSsoConnectionConfigured, portalRoute, scimRoute, scimTokenStore, setupSessionStore, ssoConnectionStore, ssoRoute }: PortalRouteProps) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        session: {
+            get: {
+                body: unknown;
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    401: "Invalid or expired setup link";
+                    200: {
+                        readonly capabilities: import("./types").SetupCapability[];
+                        readonly configured: {
+                            readonly oidc: boolean;
+                            readonly saml: boolean;
+                        };
+                        readonly expiresAt: number;
+                        readonly oidc: {
+                            redirectUri: string;
+                        } | undefined;
+                        readonly organizationId: string;
+                        readonly saml: {
+                            acsUrl: string;
+                            entityId: string;
+                            metadataUrl: string;
+                        } | undefined;
+                        readonly scim: {
+                            baseUrl: string;
+                        } | undefined;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        connection: {
+            saml: {
+                put: {
+                    body: {
+                        idpSloUrl?: string | undefined;
+                        idpEntityId: string;
+                        idpSsoUrl: string;
+                        idpX509Cert: string;
+                    };
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        401: "Invalid or expired setup link";
+                        403: "This setup link cannot configure SAML";
+                        501: "SSO is not configured";
+                        200: {
+                            readonly configured: true;
+                            readonly type: "saml";
+                        };
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        connection: {
+            oidc: {
+                put: {
+                    body: {
+                        scopes?: string[] | undefined;
+                        redirectUri?: string | undefined;
+                        issuer: string;
+                        clientId: string;
+                        clientSecret: string;
+                    };
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        401: "Invalid or expired setup link";
+                        403: "This setup link cannot configure OIDC";
+                        501: "SSO is not configured";
+                        200: {
+                            readonly configured: true;
+                            readonly type: "oidc";
+                        };
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        scim: {
+            token: {
+                post: {
+                    body: unknown;
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        401: "Invalid or expired setup link";
+                        403: "This setup link cannot configure SCIM";
+                        501: "SCIM is not configured";
+                        200: {
+                            readonly baseUrl: `${string}/${string}`;
+                            readonly token: string;
+                            readonly tokenId: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;