@absolutejs/auth 0.65.1 → 0.65.2

package/dist/scim/routes.d.ts

@@ -0,0 +1,366 @@
+import { Elysia } from 'elysia';
+import { type ScimConfig } from './config';
+export declare const scimRoutes: ({ customAttributes, getScimGroup, getScimUser, listScimGroups, listScimUsers, onScimGroupCreate, onScimGroupDelete, onScimGroupReplace, onScimUserCreate, onScimUserDeactivate, onScimUserReplace, scimRoute, scimTokenStore }: ScimConfig) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: {
+                filter?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        put: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        patch: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        delete: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: {
+                filter?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        put: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        patch: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        delete: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                id: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/scim/serialize.d.ts

@@ -0,0 +1,83 @@
+import type { ScimAttributeMap, ScimSchemaDefinition } from './extensions';
+import type { ScimFilter, ScimGroup, ScimGroupInput, ScimUser, ScimUserInput } from './types';
+declare const SCHEMA_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Schema";
+declare const RESOURCE_TYPE_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:ResourceType";
+export declare const toUserResource: (user: ScimUser, location: string, map?: ScimAttributeMap) => Record<string, unknown>;
+export declare const parseUserInput: (body: unknown, map?: ScimAttributeMap) => ScimUserInput | undefined;
+export declare const applyPatch: (user: ScimUser, body: unknown) => ScimUserInput;
+export declare const listResponse: (resources: Record<string, unknown>[]) => {
+    itemsPerPage: number;
+    Resources: Record<string, unknown>[];
+    schemas: string[];
+    startIndex: number;
+    totalResults: number;
+};
+export declare const parseFilter: (filter: string | undefined) => ScimFilter | undefined;
+export declare const scimError: (httpStatus: number, detail: string, scimType?: string) => Response;
+export declare const scimJson: (resource: unknown, httpStatus: number) => Response;
+export declare const serviceProviderConfig: (location: string) => {
+    authenticationSchemes: {
+        description: string;
+        name: string;
+        primary: boolean;
+        specUri: string;
+        type: string;
+    }[];
+    bulk: {
+        maxOperations: number;
+        maxPayloadSize: number;
+        supported: boolean;
+    };
+    changePassword: {
+        supported: boolean;
+    };
+    etag: {
+        supported: boolean;
+    };
+    filter: {
+        maxResults: number;
+        supported: boolean;
+    };
+    meta: {
+        location: string;
+        resourceType: string;
+    };
+    patch: {
+        supported: boolean;
+    };
+    schemas: string[];
+    sort: {
+        supported: boolean;
+    };
+};
+export declare const schemaList: (location: string, extras?: ScimSchemaDefinition[]) => {
+    itemsPerPage: number;
+    Resources: Record<string, unknown>[];
+    schemas: string[];
+    startIndex: number;
+    totalResults: number;
+};
+export declare const schemaOne: (location: string, id: string, extras?: ScimSchemaDefinition[]) => Record<string, unknown> | undefined;
+export declare const resourceTypeList: (location: string, usersEndpoint: string, groupsEndpoint: string, extras?: ScimSchemaDefinition[]) => {
+    itemsPerPage: number;
+    Resources: Record<string, unknown>[];
+    schemas: string[];
+    startIndex: number;
+    totalResults: number;
+};
+export declare const resourceTypeOne: (location: string, id: string, usersEndpoint: string, groupsEndpoint: string, extras?: ScimSchemaDefinition[]) => {
+    description: string;
+    endpoint: string;
+    id: string;
+    meta: {
+        location: string;
+        resourceType: string;
+    };
+    name: string;
+    schema: string;
+    schemas: string[];
+} | undefined;
+export { RESOURCE_TYPE_SCHEMA, SCHEMA_SCHEMA };
+export declare const applyGroupPatch: (group: ScimGroup, body: unknown) => ScimGroupInput;
+export declare const parseGroupInput: (body: unknown) => ScimGroupInput | undefined;
+export declare const toGroupResource: (group: ScimGroup, location: string) => Record<string, unknown>;

package/dist/scim/types.d.ts

@@ -0,0 +1,54 @@
+import type { OrganizationId } from '../tenancy';
+export type ScimToken = {
+    createdAt: number;
+    hashedToken: string;
+    lastUsedAt?: number;
+    organizationId: OrganizationId;
+    tokenId: string;
+};
+export type ScimTokenStore = {
+    deleteToken: (tokenId: string) => Promise<void>;
+    findByHashedToken: (hashedToken: string) => Promise<ScimToken | undefined>;
+    listTokens: (organizationId: OrganizationId) => Promise<ScimToken[]>;
+    saveToken: (token: ScimToken) => Promise<void>;
+};
+export type ScimUser = {
+    active: boolean;
+    custom?: Record<string, unknown>;
+    displayName?: string;
+    email?: string;
+    externalId?: string;
+    familyName?: string;
+    givenName?: string;
+    id: string;
+    userName: string;
+};
+export type ScimUserInput = {
+    active: boolean;
+    custom?: Record<string, unknown>;
+    displayName?: string;
+    email?: string;
+    externalId?: string;
+    familyName?: string;
+    givenName?: string;
+    userName: string;
+};
+export type ScimGroupMember = {
+    display?: string;
+    value: string;
+};
+export type ScimGroup = {
+    displayName: string;
+    externalId?: string;
+    id: string;
+    members: ScimGroupMember[];
+};
+export type ScimGroupInput = {
+    displayName: string;
+    externalId?: string;
+    members: ScimGroupMember[];
+};
+export type ScimFilter = {
+    attribute: string;
+    value: string;
+};

package/dist/server.d.ts

@@ -0,0 +1,34 @@
+import type { AuthInstance } from './authContext';
+import type { AuthConfig } from './types';
+/**
+ * Create the complete AbsoluteJS auth application through a declaration-stable
+ * server entry point. Import this subpath in server applications so TypeScript
+ * does not need to load declarations for every optional Auth feature.
+ */
+export declare const auth: <UserType>(configuration: AuthConfig<UserType>) => Promise<AuthInstance<UserType>>;
+export { createAuthContext } from './authContext';
+export type { AuthInstance } from './authContext';
+export type { AuditSink } from './audit/types';
+export type { PortalConfig } from './portal/config';
+export type { SetupCapability, SetupSession, SetupSessionStore } from './portal/types';
+export { createSetupSession } from './portal/operations';
+export { createPostgresSetupSessionStore } from './portal/postgresSetupSessionStore';
+export { protectRoutePlugin } from './routes/protectRoute';
+export { readSessionCookie } from './session/cookieReader';
+export { requireAuthPlugin } from './routes/requireAuth';
+export type { ScimConfig } from './scim/config';
+export type { ScimFilter, ScimGroup, ScimGroupInput, ScimTokenStore, ScimUser, ScimUserInput } from './scim/types';
+export { createPostgresScimTokenStore } from './scim/postgresScimTokenStore';
+export type { AuthSessionStore } from './session/types';
+export { VerificationProviderError, type VerificationCheckInput, type VerificationCheckResult, type VerificationCheckStatus, type VerificationProvider, type VerificationProviderErrorKind, type VerificationPurpose, type VerificationStartInput, type VerificationStartResult } from './verification/types';
+export type { NodeSamlAdapterOptions } from './sso/nodeSamlAdapter';
+export { createNodeSamlAdapter } from './sso/nodeSamlAdapter';
+export type { SsoIdentity, SSOConfig } from './sso/config';
+export type { SSOConnection, SSOConnectionStore } from './sso/types';
+export { createPostgresSsoConnectionStore } from './sso/postgresSsoConnectionStore';
+export { isUserSessionId } from './typeGuards';
+export { userSessionIdTypebox } from './typebox';
+export type { AuthConfig, OAuth2ConfigurationOptions, SessionData, UnregisteredSessionData, UserSessionId } from './types';
+export { instantiateUserSession } from './utils';
+export type { OAuth2TokenResponse, ProviderOption } from 'citra';
+export { extractPropFromIdentity, isValidProviderOption, providers } from 'citra';

package/dist/session/access.d.ts

@@ -0,0 +1,33 @@
+import type { Cookie } from 'elysia';
+import type { SessionData, SessionRecord, UnregisteredSessionRecord, UserSessionId } from '../types';
+import type { AuthSessionSource, AuthSessionStore } from './types';
+export declare const createSessionCompatibilityLayer: <UserType>({ authSessionStore, userSessionId }: {
+    authSessionStore?: AuthSessionStore<UserType>;
+    userSessionId?: UserSessionId;
+}) => Promise<{
+    session: SessionRecord<UserType>;
+    unregisteredSession: UnregisteredSessionRecord;
+    persist: () => Promise<void>;
+}>;
+export declare const getStatusFromSource: <UserType>({ authSessionStore, session, user_session_id }: {
+    authSessionStore?: AuthSessionSource<UserType>;
+    session?: SessionRecord<UserType>;
+    user_session_id: Cookie<UserSessionId | undefined>;
+}) => Promise<{
+    error: {
+        readonly code: "Bad Request";
+        readonly message: "Cookies are missing";
+    };
+    user: null;
+    impersonator?: undefined;
+} | {
+    error: null;
+    impersonator: import("..").Impersonator | undefined;
+    user: NonNullable<UserType> | null;
+}>;
+export declare const loadSessionFromSource: <UserType>({ authSessionStore, session, userSessionId, removeExpired }: {
+    authSessionStore?: AuthSessionSource<UserType>;
+    session?: SessionRecord<UserType>;
+    userSessionId?: UserSessionId;
+    removeExpired?: boolean;
+}) => Promise<SessionData<UserType> | undefined>;

package/dist/session/anonymous.d.ts

@@ -0,0 +1,12 @@
+import type { Cookie } from 'elysia';
+import type { SessionData, SessionRecord, UserSessionId } from '../types';
+import type { AuthSessionStore } from './types';
+export declare const createAnonymousSession: <UserType>({ authSessionStore, cookie, cookieSecure, guestUser, inMemorySession, sessionDurationMs }: {
+    authSessionStore?: AuthSessionStore<UserType>;
+    cookie: Cookie<UserSessionId | undefined>;
+    cookieSecure?: boolean;
+    guestUser: UserType;
+    inMemorySession: SessionRecord<UserType>;
+    sessionDurationMs?: number;
+}) => Promise<`${string}-${string}-${string}-${string}-${string}`>;
+export declare const isAnonymousSession: <UserType>(session: SessionData<UserType> | undefined) => boolean;

package/dist/session/cleanup.d.ts

@@ -0,0 +1,45 @@
+import { Elysia } from 'elysia';
+import type { OnSessionCleanup, SessionRecord, UnregisteredSessionRecord } from '../types';
+import type { AuthSessionStore } from './types';
+type SessionCleanupProps<UserType> = {
+    authSessionStore?: AuthSessionStore<UserType>;
+    cleanupIntervalMs?: number;
+    maxSessions?: number;
+    onSessionCleanup?: OnSessionCleanup<UserType>;
+};
+export declare const sessionCleanup: <UserType>({ authSessionStore, cleanupIntervalMs, maxSessions, onSessionCleanup }: SessionCleanupProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: SessionRecord<UserType>;
+        unregisteredSession: UnregisteredSessionRecord;
+    };
+    derive: {
+        readonly cleanupSessions: () => Promise<void>;
+    };
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: import("elysia").ExtractErrorFromHandle<{
+        readonly cleanupSessions: () => Promise<void>;
+    }>;
+}, {}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};

package/dist/session/cookieReader.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Read the raw `user_session_id` cookie value from a request's Cookie header.
+ * Returns the (URL-decoded) value, or null when absent. Anchored so decoy
+ * cookies cannot shadow the real one. Validate the result with `isUserSessionId`
+ * before trusting it — this only parses, it does not vouch for the format.
+ *
+ * Use this instead of hand-rolling a Cookie-header regex in each consumer, so
+ * the anchoring lives in exactly one place.
+ */
+export declare const readSessionCookie: (request: Request) => string | null;

package/dist/session/impersonation.d.ts

@@ -0,0 +1,34 @@
+import type { Cookie } from 'elysia';
+import type { AuditEvent } from '../audit/types';
+import type { SessionData, SessionRecord, UserSessionId } from '../types';
+import type { AuthSessionStore } from './types';
+type Emit = (event: AuditEvent) => Promise<void> | void;
+export declare const endImpersonation: <UserType>({ authSessionStore, cookie, cookieSecure, emit, inMemorySession }: {
+    authSessionStore?: AuthSessionStore<UserType>;
+    cookie: Cookie<UserSessionId | undefined>;
+    cookieSecure?: boolean;
+    emit?: Emit;
+    inMemorySession: SessionRecord<UserType>;
+}) => Promise<{
+    restored: boolean;
+}>;
+export declare const isImpersonating: <UserType>(session: SessionData<UserType> | undefined) => boolean;
+export declare const startImpersonation: <UserType>({ allowNested, authSessionStore, cookie, cookieSecure, emit, getUserId, impersonator, inMemorySession, sessionDurationMs, user }: {
+    allowNested?: boolean;
+    authSessionStore?: AuthSessionStore<UserType>;
+    cookie: Cookie<UserSessionId | undefined>;
+    cookieSecure?: boolean;
+    emit?: Emit;
+    getUserId?: (user: UserType) => string;
+    impersonator: {
+        actorEmail?: string;
+        actorId: string;
+        readOnly?: boolean;
+        reason: string;
+        suppressSideEffects?: boolean;
+    };
+    inMemorySession: SessionRecord<UserType>;
+    sessionDurationMs?: number;
+    user: UserType;
+}) => Promise<`${string}-${string}-${string}-${string}-${string}`>;
+export {};

package/dist/session/inMemoryStore.d.ts

@@ -0,0 +1,7 @@
+import type { SessionData, UnregisteredSessionData, UserSessionId } from '../types';
+import type { AuthSessionStore } from './types';
+export type CreateInMemoryAuthSessionStoreOptions<UserType> = {
+    sessions?: Record<UserSessionId, SessionData<UserType>>;
+    unregisteredSessions?: Record<UserSessionId, UnregisteredSessionData>;
+};
+export declare const createInMemoryAuthSessionStore: <UserType>(input?: CreateInMemoryAuthSessionStoreOptions<UserType>) => AuthSessionStore<UserType>;