@absolutejs/auth 0.65.1 → 0.65.2

package/dist/providers/index.d.ts

@@ -0,0 +1,2 @@
+export type { CredentialsFor, OAuth2Client, OAuth2TokenResponse, OIDCProvider, PKCEProvider, ProviderConfiguration, ProviderOption, ProvidersMap, RefreshableProvider, RevocableProvider, ScopeRequiredProvider } from 'citra';
+export { decodeJWT, extractPropFromIdentity, isOIDCProviderOption, isPKCEProviderOption, isRefreshableOAuth2Client, isRefreshableProviderOption, isRevocableOAuth2Client, isRevocableProviderOption, isValidProviderOption, oidcProviderOptions, pkceProviderOptions, providerOptions, providers, refreshableProviderOptions, revocableProviderOptions, scopeRequiredProviderOptions } from 'citra';

package/dist/providersFromEnv.d.ts

@@ -0,0 +1,19 @@
+import type { OAuth2ConfigurationOptions } from './types';
+export type ProviderSelection = Record<string, {
+    scope?: string[];
+    searchParams?: [string, string][];
+}>;
+/**
+ * Build `providersConfiguration` from a serializable provider selection plus
+ * environment credentials, by convention: `<PROVIDER>_CLIENT_ID` and
+ * `<PROVIDER>_CLIENT_SECRET` (e.g. `GOOGLE_CLIENT_ID`). This is the bridge
+ * between no-code/manifest-driven configuration (which must never contain
+ * secrets) and `auth()`'s credential-bearing provider entries — the host app
+ * wires env → config, the selection stays serializable.
+ *
+ * Covers providers whose citra credentials are the standard
+ * clientId/clientSecret pair. Providers with richer credential shapes
+ * (e.g. Apple's team/key ids) should be configured directly in
+ * `providersConfiguration`.
+ */
+export declare const providersFromEnv: (selection: ProviderSelection, env?: Record<string, string | undefined>) => OAuth2ConfigurationOptions;

package/dist/redirect.d.ts

@@ -0,0 +1,2 @@
+export declare const isSafeLocalPath: (value: string) => boolean;
+export declare const toSafeLocalPath: (value: string | undefined, fallback?: string) => string;

package/dist/roles/config.d.ts

@@ -0,0 +1,27 @@
+import type { AuditEmitter } from '../audit/config';
+import type { OrganizationMembership, OrganizationStore } from '../organizations/types';
+import type { AuthSessionStore } from '../session/types';
+import type { OrganizationId } from '../tenancy';
+import type { RouteString } from '../types';
+import type { RoleStore } from './types';
+export declare const DEFAULT_ROLES_ROUTE: RouteString;
+export type RolesConfig<UserType> = {
+    getUserId: (user: UserType) => string;
+    organizationStore: OrganizationStore;
+    roleStore: RoleStore;
+    canManageRoles?: (context: {
+        membership?: OrganizationMembership;
+        organizationId: OrganizationId;
+        user: UserType;
+    }) => boolean | Promise<boolean>;
+    onRolesAssigned?: (context: {
+        organizationId: OrganizationId;
+        roles: string[];
+        userId: string;
+    }) => void | Promise<void>;
+    rolesRoute?: RouteString;
+};
+export type RolesRouteProps<UserType> = RolesConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+    emit?: AuditEmitter;
+};

package/dist/roles/inMemoryRoleStore.d.ts

@@ -0,0 +1,2 @@
+import type { RoleStore } from './types';
+export declare const createInMemoryRoleStore: () => RoleStore;

package/dist/roles/operations.d.ts

@@ -0,0 +1,8 @@
+import type { OrganizationMembership, OrganizationStore } from '../organizations/types';
+import type { OrganizationId } from '../tenancy';
+export declare const setMemberRoles: ({ organizationId, organizationStore, roles, userId }: {
+    organizationId: OrganizationId;
+    organizationStore: OrganizationStore;
+    roles: string[];
+    userId: string;
+}) => Promise<OrganizationMembership | undefined>;

package/dist/roles/postgresRoleStore.d.ts

@@ -0,0 +1,86 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { RoleStore } from './types';
+export declare const rolesTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_roles";
+    schema: undefined;
+    columns: {
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_roles", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_roles";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        organization_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_roles", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>>, {
+            name: string;
+            tableName: "auth_roles";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        permissions: import("drizzle-orm/pg-core").PgBuildColumn<"auth_roles", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, string[]>>>, {
+            name: string;
+            tableName: "auth_roles";
+            dataType: "object json";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        slug: import("drizzle-orm/pg-core").PgBuildColumn<"auth_roles", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_roles";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updated_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_roles", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_roles";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonRoleStore: (databaseUrl: string) => RoleStore;
+export declare const createPostgresRoleStore: <DB extends AnyPgDatabase>(db: DB) => RoleStore;

package/dist/roles/resolver.d.ts

@@ -0,0 +1,17 @@
+import type { OrganizationStore } from '../organizations/types';
+import type { OrganizationId } from '../tenancy';
+import type { RoleStore } from './types';
+export declare const createMembershipPermissionResolver: <UserType>({ getUserId, organizationStore, roleStore }: {
+    getUserId: (user: UserType) => string;
+    organizationStore: OrganizationStore;
+    roleStore: RoleStore;
+}) => ({ organizationId, permission, user }: {
+    organizationId?: OrganizationId;
+    permission: string;
+    user: UserType;
+}) => Promise<boolean>;
+export declare const resolvePermissions: ({ organizationId, roleStore, roles }: {
+    organizationId?: OrganizationId;
+    roleStore: RoleStore;
+    roles: string[];
+}) => Promise<Set<string>>;

package/dist/roles/routes.d.ts

@@ -0,0 +1,106 @@
+import { Elysia } from 'elysia';
+import type { SessionRecord } from '../types';
+import { type RolesRouteProps } from './config';
+export declare const roleRoutes: <UserType>({ authSessionStore, canManageRoles, emit, getUserId, onRolesAssigned, organizationStore, roleStore, rolesRoute }: RolesRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        ":organizationId": {
+            get: {
+                body: unknown;
+                params: {
+                    organizationId: string;
+                };
+                query: unknown;
+                headers: unknown;
+                response: {
+                    401: "Authentication required";
+                    403: "Cannot manage roles";
+                    200: {
+                        readonly roles: readonly import("./types").Role[];
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":organizationId": {
+            members: {
+                ":userId": {
+                    put: {
+                        body: {
+                            roles: string[];
+                        };
+                        params: {
+                            userId: string;
+                            organizationId: string;
+                        };
+                        query: unknown;
+                        headers: unknown;
+                        response: {
+                            401: "Authentication required";
+                            403: "Cannot manage roles";
+                            404: "Membership not found";
+                            200: {
+                                readonly roles: string[];
+                            };
+                            422: {
+                                type: "validation";
+                                on: string;
+                                summary?: string;
+                                message?: string;
+                                found?: unknown;
+                                property?: string;
+                                expected?: string;
+                            };
+                        };
+                    };
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/roles/types.d.ts

@@ -0,0 +1,14 @@
+import type { OrganizationId } from '../tenancy';
+export type Role = {
+    createdAt: number;
+    organizationId?: OrganizationId;
+    permissions: string[];
+    slug: string;
+    updatedAt: number;
+};
+export type RoleStore = {
+    deleteRole: (slug: string, organizationId?: OrganizationId) => Promise<void>;
+    getRole: (slug: string, organizationId?: OrganizationId) => Promise<Role | undefined>;
+    listRoles: (organizationId?: OrganizationId) => Promise<Role[]>;
+    saveRole: (role: Role) => Promise<void>;
+};

package/dist/routes/authorize.d.ts

@@ -0,0 +1,102 @@
+import { Elysia } from 'elysia';
+import { AuthorizeRoute, ClientProviders, OnAuthorizeError, OnAuthorizeSuccess } from '../types';
+type AuthorizeProps = {
+    clientProviders: ClientProviders;
+    authorizeRoute?: AuthorizeRoute;
+    cookieSecure?: boolean;
+    onAuthorizeSuccess: OnAuthorizeSuccess;
+    onAuthorizeError: OnAuthorizeError;
+};
+export declare const authorize: ({ clientProviders, authorizeRoute, cookieSecure, onAuthorizeSuccess, onAuthorizeError }: AuthorizeProps) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        ":provider": {
+            get: {
+                body: unknown;
+                params: {
+                    provider: string;
+                };
+                query: {
+                    client?: string | undefined;
+                    intent?: "login" | "link_identity" | "link_connector" | undefined;
+                };
+                headers: unknown;
+                response: {
+                    400: "Cookies are missing" | "Provider is required";
+                    401: "Provider is required" | "Client provider not found" | "Client variant is required" | "Client variant not found";
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                    500: "Failed to create authorization URL";
+                };
+            };
+        };
+    };
+} | {
+    [x: string]: {
+        ":provider": {
+            [x: string]: {
+                get: {
+                    body: unknown;
+                    params: {
+                        provider: string;
+                    };
+                    query: {
+                        client?: string | undefined;
+                        intent?: "login" | "link_identity" | "link_connector" | undefined;
+                    };
+                    headers: unknown;
+                    response: {
+                        400: "Cookies are missing" | "Provider is required";
+                        401: "Provider is required" | "Client provider not found" | "Client variant is required" | "Client variant not found";
+                        200: Response;
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                        500: "Failed to create authorization URL";
+                    };
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};

package/dist/routes/callback.d.ts

@@ -0,0 +1,64 @@
+import { Elysia } from 'elysia';
+import type { AuthSessionStore } from '../session/types';
+import { ClientProviders, OnCallbackError, OnCallbackSuccess, OnLinkConnector, OnLinkIdentity, OnLinkIdentityConflict, ResolveAuthIntent, RouteString } from '../types';
+type CallbackProps<UserType> = {
+    authSessionStore?: AuthSessionStore<UserType>;
+    clientProviders: ClientProviders;
+    callbackRoute?: RouteString;
+    resolveAuthIntent?: ResolveAuthIntent<UserType>;
+    onCallbackSuccess: OnCallbackSuccess<UserType>;
+    onLinkIdentity?: OnLinkIdentity<UserType>;
+    onLinkIdentityConflict?: OnLinkIdentityConflict<UserType>;
+    onLinkConnector?: OnLinkConnector<UserType>;
+    onCallbackError: OnCallbackError;
+};
+export declare const callback: <UserType>({ authSessionStore, clientProviders, callbackRoute, resolveAuthIntent, onCallbackSuccess, onLinkIdentity, onLinkIdentityConflict, onLinkConnector, onCallbackError }: CallbackProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                [x: number]: {};
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};

package/dist/routes/profile.d.ts

@@ -0,0 +1,73 @@
+import { Elysia } from 'elysia';
+import type { AuthSessionStore } from '../session/types';
+import { ClientProviders, OnProfileError, OnProfileSuccess, RouteString } from '../types';
+type ProfileProps<UserType> = {
+    authSessionStore?: AuthSessionStore<UserType>;
+    clientProviders: ClientProviders;
+    profileRoute?: RouteString;
+    onProfileSuccess: OnProfileSuccess;
+    onProfileError: OnProfileError;
+};
+export declare const profile: <UserType>({ authSessionStore, clientProviders, profileRoute, onProfileSuccess, onProfileError }: ProfileProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "Cookies are missing" | "Session has no access token to fetch a profile";
+                401: "Provider is required" | "Client provider not found" | "Client variant is required" | "Client variant not found" | "No auth provider found" | "No user session found";
+                501: "Provider does not expose a profile endpoint";
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                500: `${string} - ${string}` | `Failed to validate authorization code: Unknown status: ${string}`;
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};

package/dist/routes/protectRoute.d.ts

@@ -0,0 +1,51 @@
+import { Elysia } from 'elysia';
+import type { AuthSessionSource } from '../session/types';
+type AuthFailError = {
+    readonly code: 'Bad Request';
+    readonly message: 'Cookies are missing';
+} | {
+    readonly code: 'Unauthorized';
+    readonly message: 'User is not authenticated';
+};
+export declare const protectRoutePlugin: <UserType>({ authSessionStore }?: {
+    authSessionStore?: AuthSessionSource<UserType>;
+}) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {
+        readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AuthFailError) => AuthFailReturn) => Promise<import("elysia").ElysiaCustomStatusResponse<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaCustomStatusResponse<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+    };
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: import("elysia").UnwrapRoute<{
+        cookie: import("@sinclair/typebox").TObject<{
+            user_session_id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TTemplateLiteralSyntax<"${string}-${string}-${string}-${string}-${string}">>;
+        }>;
+    }, {}, "">;
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: import("elysia").ExtractErrorFromHandle<{
+        readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AuthFailError) => AuthFailReturn) => Promise<import("elysia").ElysiaCustomStatusResponse<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaCustomStatusResponse<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+    }>;
+}, {}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};

package/dist/routes/refresh.d.ts

@@ -0,0 +1,74 @@
+import { Elysia } from 'elysia';
+import type { AuthSessionStore } from '../session/types';
+import { ClientProviders, OnRefreshError, OnRefreshSuccess, RouteString } from '../types';
+type RefreshProps<UserType> = {
+    authSessionStore?: AuthSessionStore<UserType>;
+    clientProviders: ClientProviders;
+    refreshRoute?: RouteString;
+    onRefreshSuccess: OnRefreshSuccess;
+    onRefreshError: OnRefreshError;
+    sessionDurationMs?: number;
+};
+export declare const refresh: <UserType>({ authSessionStore, clientProviders, refreshRoute, onRefreshSuccess, onRefreshError, sessionDurationMs }: RefreshProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "Cookies are missing" | "No refresh token found";
+                401: "Provider is required" | "Client provider not found" | "Client variant is required" | "Client variant not found" | "No auth provider found" | "No user session found";
+                501: "Provider is not refreshable";
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                500: "Failed to refresh token";
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};