@absolutejs/auth 0.65.1 → 0.65.2

package/dist/webauthn/adapter.d.ts

@@ -0,0 +1,59 @@
+export type WebAuthnCredentialDescriptor = {
+    id: string;
+    transports?: string[];
+};
+export type WebAuthnRegistrationOptions = {
+    challenge: string;
+    options: Record<string, unknown>;
+};
+export type WebAuthnAuthenticationOptions = {
+    challenge: string;
+    options: Record<string, unknown>;
+};
+export type WebAuthnRegistrationResult = {
+    credential?: {
+        backedUp?: boolean;
+        counter: number;
+        credentialId: string;
+        deviceType?: string;
+        publicKey: string;
+        transports?: string[];
+    };
+    verified: boolean;
+};
+export type WebAuthnAuthenticationResult = {
+    newCounter?: number;
+    verified: boolean;
+};
+export type WebAuthnAdapter = {
+    createAuthenticationOptions: (request: {
+        allowCredentials: WebAuthnCredentialDescriptor[];
+        rpId: string;
+    }) => Promise<WebAuthnAuthenticationOptions> | WebAuthnAuthenticationOptions;
+    createRegistrationOptions: (request: {
+        excludeCredentials: WebAuthnCredentialDescriptor[];
+        rpId: string;
+        rpName: string;
+        userDisplayName: string;
+        userId: string;
+        userName: string;
+    }) => Promise<WebAuthnRegistrationOptions> | WebAuthnRegistrationOptions;
+    verifyAuthentication: (request: {
+        credential: {
+            counter: number;
+            credentialId: string;
+            publicKey: string;
+            transports?: string[];
+        };
+        expectedChallenge: string;
+        expectedOrigin: string;
+        expectedRPID: string;
+        response: unknown;
+    }) => Promise<WebAuthnAuthenticationResult>;
+    verifyRegistration: (request: {
+        expectedChallenge: string;
+        expectedOrigin: string;
+        expectedRPID: string;
+        response: unknown;
+    }) => Promise<WebAuthnRegistrationResult>;
+};

package/dist/webauthn/config.d.ts

@@ -0,0 +1,36 @@
+import type { AuditEmitter } from '../audit/config';
+import type { AuthSessionStore } from '../session/types';
+import type { RouteString, UserSessionId } from '../types';
+import type { WebAuthnAdapter } from './adapter';
+import type { WebAuthnCredentialStore } from './types';
+export declare const DEFAULT_WEBAUTHN_CHALLENGE_TTL_MS = 300000;
+export declare const DEFAULT_WEBAUTHN_ROUTE: RouteString;
+export declare const DEFAULT_WEBAUTHN_SESSION_TTL_MS: number;
+export declare const WEBAUTHN_CHALLENGE_COOKIE = "webauthn_challenge";
+export type WebAuthnConfig<UserType> = {
+    credentialStore: WebAuthnCredentialStore;
+    getUserId: (user: UserType) => string;
+    getWebAuthnUser: (userId: string) => Promise<UserType | null | undefined> | UserType | null | undefined;
+    origin: string;
+    rpId: string;
+    rpName: string;
+    webauthnAdapter: WebAuthnAdapter;
+    challengeDurationMs?: number;
+    getUserDisplayName?: (user: UserType) => string;
+    getUserName?: (user: UserType) => string;
+    onWebAuthnAuthenticated?: (context: {
+        user: UserType;
+        userSessionId: UserSessionId;
+    }) => void | Promise<void>;
+    onWebAuthnRegistered?: (context: {
+        credentialId: string;
+        userId: string;
+    }) => void | Promise<void>;
+    sessionDurationMs?: number;
+    webauthnRoute?: RouteString;
+};
+export type WebAuthnRouteProps<UserType> = WebAuthnConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+    cookieSecure?: boolean;
+    emit?: AuditEmitter;
+};

package/dist/webauthn/inMemoryWebAuthnCredentialStore.d.ts

@@ -0,0 +1,2 @@
+import type { WebAuthnCredentialStore } from './types';
+export declare const createInMemoryWebAuthnCredentialStore: () => WebAuthnCredentialStore;

package/dist/webauthn/postgresWebAuthnCredentialStore.d.ts

@@ -0,0 +1,146 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { WebAuthnCredentialStore } from './types';
+export declare const webauthnCredentialsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_webauthn_credentials";
+    schema: undefined;
+    columns: {
+        backed_up: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webauthn_credentials", import("drizzle-orm/pg-core").PgBooleanBuilder, {
+            name: string;
+            tableName: "auth_webauthn_credentials";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        counter: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webauthn_credentials", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>>, {
+            name: string;
+            tableName: "auth_webauthn_credentials";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webauthn_credentials", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_webauthn_credentials";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        credential_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webauthn_credentials", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_webauthn_credentials";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        device_type: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webauthn_credentials", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_webauthn_credentials";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        last_used_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webauthn_credentials", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_webauthn_credentials";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        public_key: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webauthn_credentials", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_webauthn_credentials";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        transports: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webauthn_credentials", import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, string[]>, {
+            name: string;
+            tableName: "auth_webauthn_credentials";
+            dataType: "object json";
+            data: string[];
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webauthn_credentials", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_webauthn_credentials";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonWebAuthnCredentialStore: (databaseUrl: string) => WebAuthnCredentialStore;
+export declare const createPostgresWebAuthnCredentialStore: <DB extends AnyPgDatabase>(db: DB) => WebAuthnCredentialStore;

package/dist/webauthn/routes.d.ts

@@ -0,0 +1,155 @@
+import { Elysia } from 'elysia';
+import { type WebAuthnRouteProps } from './config';
+export declare const webauthnRoutes: <UserType>({ authSessionStore, challengeDurationMs, cookieSecure, credentialStore, emit, getUserDisplayName, getUserId, getUserName, getWebAuthnUser, onWebAuthnAuthenticated, onWebAuthnRegistered, origin, rpId, rpName, sessionDurationMs, webauthnAdapter, webauthnRoute }: WebAuthnRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        register: {
+            options: {
+                post: {
+                    body: unknown;
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        401: "Authentication required";
+                        200: {
+                            [x: string]: unknown;
+                        };
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        register: {
+            verify: {
+                post: {
+                    body: {};
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        400: "No registration challenge in progress" | "WebAuthn registration failed";
+                        401: "Authentication required";
+                        200: {
+                            readonly credentialId: string;
+                            readonly verified: true;
+                        };
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        authenticate: {
+            options: {
+                post: {
+                    body: unknown;
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: {
+                            [x: string]: unknown;
+                        };
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        authenticate: {
+            verify: {
+                post: {
+                    body: {
+                        id: string;
+                    };
+                    params: {};
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        400: "No authentication challenge in progress";
+                        401: "Unknown credential" | "WebAuthn authentication failed";
+                        200: {
+                            readonly status: "authenticated";
+                        };
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/webauthn/simpleWebAuthnAdapter.d.ts

@@ -0,0 +1,3 @@
+import 'reflect-metadata';
+import type { WebAuthnAdapter } from './adapter';
+export declare const createSimpleWebAuthnAdapter: () => Promise<WebAuthnAdapter>;

package/dist/webauthn/types.d.ts

@@ -0,0 +1,17 @@
+export type WebAuthnCredential = {
+    backedUp?: boolean;
+    counter: number;
+    createdAt: number;
+    credentialId: string;
+    deviceType?: string;
+    lastUsedAt?: number;
+    publicKey: string;
+    transports?: string[];
+    userId: string;
+};
+export type WebAuthnCredentialStore = {
+    getCredential: (credentialId: string) => Promise<WebAuthnCredential | undefined>;
+    listCredentialsByUser: (userId: string) => Promise<WebAuthnCredential[]>;
+    removeCredential: (credentialId: string) => Promise<void>;
+    saveCredential: (credential: WebAuthnCredential) => Promise<void>;
+};

package/dist/webauthn.d.ts

@@ -0,0 +1 @@
+export { createSimpleWebAuthnAdapter } from './webauthn/simpleWebAuthnAdapter';

package/dist/webhooks/config.d.ts

@@ -0,0 +1,34 @@
+import type { WebhookDeliveryStore, WebhookEndpoint, WebhookEvent } from './types';
+export declare const DEFAULT_WEBHOOK_RETRY: {
+    readonly attempts: 3;
+    readonly backoffMultiplier: 2;
+    readonly initialDelayMs: 1000;
+};
+export declare const DEFAULT_WEBHOOK_TIMEOUT_MS: number;
+export type WebhookRetryConfig = {
+    attempts?: number;
+    backoffMultiplier?: number;
+    initialDelayMs?: number;
+};
+export type WebhookFetch = (url: string, init: {
+    body: string;
+    headers: Record<string, string>;
+    method: string;
+    signal: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+}>;
+export type WebhooksConfig = {
+    deliveryStore?: WebhookDeliveryStore;
+    endpoints: WebhookEndpoint[];
+    fetch?: WebhookFetch;
+    onDeliveryError?: (context: {
+        endpoint: WebhookEndpoint;
+        error: unknown;
+        event: WebhookEvent;
+    }) => void | Promise<void>;
+    retry?: WebhookRetryConfig;
+    sleep?: (ms: number) => Promise<void>;
+    timeoutMs?: number;
+};

package/dist/webhooks/dispatcher.d.ts

@@ -0,0 +1,3 @@
+import type { AuditEvent } from '../audit/types';
+import { type WebhooksConfig } from './config';
+export declare const createWebhookDispatcher: ({ deliveryStore, endpoints, fetch: fetchImpl, onDeliveryError, retry, sleep, timeoutMs }: WebhooksConfig) => (event: AuditEvent) => Promise<void>;

package/dist/webhooks/inMemoryStore.d.ts

@@ -0,0 +1,2 @@
+import type { WebhookDeliveryStore } from './types';
+export declare const createInMemoryWebhookDeliveryStore: () => WebhookDeliveryStore;

package/dist/webhooks/postgresStore.d.ts

@@ -0,0 +1,116 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { WebhookDeliveryStore, WebhookEvent } from './types';
+export declare const webhookDeliveriesTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_webhook_deliveries";
+    schema: undefined;
+    columns: {
+        attempts: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webhook_deliveries", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_webhook_deliveries";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webhook_deliveries", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_webhook_deliveries";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        endpoint_url: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webhook_deliveries", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_webhook_deliveries";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        envelope_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webhook_deliveries", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_webhook_deliveries";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        envelope_json: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webhook_deliveries", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, WebhookEvent>>, {
+            name: string;
+            tableName: "auth_webhook_deliveries";
+            dataType: "object json";
+            data: WebhookEvent;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        last_error: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webhook_deliveries", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_webhook_deliveries";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        last_status: import("drizzle-orm/pg-core").PgBuildColumn<"auth_webhook_deliveries", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_webhook_deliveries";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonWebhookDeliveryStore: (databaseUrl: string) => WebhookDeliveryStore;
+export declare const createPostgresWebhookDeliveryStore: <DB extends AnyPgDatabase>(db: DB) => WebhookDeliveryStore;

package/dist/webhooks/sign.d.ts

@@ -0,0 +1,11 @@
+export declare const signWebhook: ({ id, payload, secret, timestamp }: {
+    id: string;
+    payload: string;
+    secret: string;
+    timestamp: string;
+}) => Promise<string>;
+export declare const verifyWebhookSignature: ({ headers, payload, secret }: {
+    headers: Record<string, string | undefined>;
+    payload: string;
+    secret: string;
+}) => Promise<boolean>;

package/dist/webhooks/types.d.ts

@@ -0,0 +1,25 @@
+import type { AuditEvent, AuditEventType } from '../audit/types';
+export type WebhookEndpoint = {
+    events?: readonly AuditEventType[];
+    secret: string;
+    url: string;
+};
+export type WebhookEvent = {
+    createdAt: number;
+    data: AuditEvent;
+    id: string;
+    type: AuditEventType;
+};
+export type WebhookDelivery = {
+    attempts: number;
+    createdAt: number;
+    endpointUrl: string;
+    envelope: WebhookEvent;
+    lastError?: string;
+    lastStatus?: number;
+};
+export type WebhookDeliveryStore = {
+    listFailed: (limit?: number) => Promise<WebhookDelivery[]>;
+    recordFailure: (delivery: WebhookDelivery) => Promise<void>;
+    removeFailure: (envelopeId: string) => Promise<void>;
+};

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.65.1",
+	"version": "0.65.2",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {