@absolutejs/auth 0.65.1 → 0.65.2

package/dist/compliance/config.d.ts

@@ -0,0 +1,18 @@
+import type { AuditEmitter } from '../audit/config';
+import type { AuthSessionStore } from '../session/types';
+import type { RouteString } from '../types';
+export type ComplianceConfig<UserType> = {
+    complianceRoute?: RouteString;
+    deleteUserData: (context: {
+        user: UserType;
+        userId?: string;
+    }) => void | Promise<void>;
+    exportUserData: (context: {
+        user: UserType;
+    }) => Record<string, unknown> | Promise<Record<string, unknown>>;
+    getUserId?: (user: UserType) => string;
+};
+export type CompliancePluginProps<UserType> = ComplianceConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+    emit?: AuditEmitter;
+};

package/dist/compliance/redaction.d.ts

@@ -0,0 +1,8 @@
+import type { AuditEvent } from '../audit/types';
+type AuditRedactorOptions = {
+    dropFields?: string[];
+    hashFields?: string[];
+    redactIp?: boolean;
+};
+export declare const createAuditRedactor: ({ dropFields, hashFields, redactIp }: AuditRedactorOptions) => (event: AuditEvent) => Promise<AuditEvent>;
+export {};

package/dist/compliance/routes.d.ts

@@ -0,0 +1,89 @@
+import { Elysia } from 'elysia';
+import type { CompliancePluginProps } from './config';
+export declare const complianceRoutes: <UserType>({ authSessionStore, complianceRoute, deleteUserData, emit, exportUserData, getUserId }: CompliancePluginProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        export: {
+            get: {
+                body: unknown;
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    401: "Authentication required";
+                    200: {
+                        [x: string]: unknown;
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        delete: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Authentication required";
+                200: {
+                    readonly deleted: true;
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/constants.d.ts

@@ -0,0 +1,10 @@
+export declare const SECONDS_IN_A_MINUTE = 60;
+export declare const MILLISECONDS_IN_A_SECOND = 1000;
+export declare const MILLISECONDS_IN_A_MINUTE: number;
+export declare const MINUTES_IN_AN_HOUR = 60;
+export declare const HOURS_IN_A_DAY = 24;
+export declare const MILLISECONDS_IN_A_DAY: number;
+export declare const MILLISECONDS_IN_AN_HOUR: number;
+export declare const COOKIE_MINUTES = 30;
+export declare const COOKIE_DURATION: number;
+export declare const DEFAULT_MAX_SESSIONS = 10000;

package/dist/credentials/backgroundOps.d.ts

@@ -0,0 +1,45 @@
+export type BreachRecord = {
+    addedDate: string;
+    dataClasses?: string[];
+    name: string;
+};
+export type EmailBreachEvent = {
+    breaches: BreachRecord[];
+    email: string;
+};
+export type EmailBreachScanInput = {
+    hibpApiKey: string;
+    iterateEmails: (cursor: string | undefined) => Promise<{
+        emails: string[];
+        nextCursor: string | undefined;
+    }>;
+    onBreachFound: (event: EmailBreachEvent) => Promise<void> | void;
+    pauseMs?: number;
+    truncateResponse?: boolean;
+};
+export type EmailBreachScanResult = {
+    breached: number;
+    scanned: number;
+};
+export declare const runEmailBreachScan: (input: EmailBreachScanInput) => Promise<EmailBreachScanResult>;
+export type InactiveUserCandidate = {
+    createdAt?: number;
+    lastLoginAt: number | null;
+    userId: string;
+};
+export type PruneInactiveUsersInput = {
+    dryRun?: boolean;
+    iterateUsers: (cursor: string | undefined) => Promise<{
+        nextCursor: string | undefined;
+        users: InactiveUserCandidate[];
+    }>;
+    now?: () => number;
+    olderThanDays: number;
+    onDelete: (userId: string) => Promise<void> | void;
+};
+export type PruneInactiveUsersResult = {
+    dryRun: boolean;
+    prunedUserIds: string[];
+    scanned: number;
+};
+export declare const pruneInactiveUsers: (input: PruneInactiveUsersInput) => Promise<PruneInactiveUsersResult>;

package/dist/credentials/config.d.ts

@@ -0,0 +1,94 @@
+import type { LockoutGuard } from '../lockout/config';
+import type { AuthSessionStore } from '../session/types';
+import type { OrganizationId } from '../tenancy';
+import type { RouteString, StatusReturn, UserSessionId } from '../types';
+import type { PasswordPolicy } from './passwordPolicy';
+import type { CredentialStore } from './types';
+export declare const DEFAULT_CREDENTIAL_SESSION_TTL_MS: number;
+export declare const DEFAULT_RESET_TOKEN_TTL_MS: number;
+export declare const DEFAULT_VERIFICATION_TOKEN_TTL_MS: number;
+export type CredentialIdentity = {
+    email: string;
+    organizationId?: OrganizationId;
+};
+export type CredentialEmailType = 'reset_password' | 'verify_email';
+export type CredentialEmailMessage = {
+    email: string;
+    expiresAt: number;
+    token: string;
+    type: CredentialEmailType;
+};
+export type CredentialsConfig<UserType> = {
+    checkBreachesOnLogin?: boolean;
+    credentialStore: CredentialStore;
+    /** When `trustedOrigins` is set, whether an untrusted Origin is REJECTED
+     *  (default true) or merely reported via `onUntrustedOrigin` (false = a
+     *  report-only rollout that never blocks). */
+    enforceTrustedOrigins?: boolean;
+    getUserByEmail: (email: string) => Promise<UserType | null | undefined> | UserType | null | undefined;
+    isMfaRequired?: (user: UserType, context?: {
+        headers: Record<string, string | undefined>;
+        ip?: string;
+    }) => boolean | Promise<boolean>;
+    passwordVerifier?: (plainPassword: string, storedHash: string) => Promise<boolean>;
+    rehashOnLogin?: boolean;
+    loginRoute?: RouteString;
+    onCreateCredentialUser: (identity: CredentialIdentity & Record<string, unknown>) => Promise<Response | StatusReturn | UserType> | Response | StatusReturn | UserType;
+    onCredentialsLoginError?: (context: {
+        email: string;
+        error: unknown;
+    }) => void | Promise<void>;
+    onCredentialsLoginSuccess?: (context: {
+        user: UserType;
+        userSessionId: UserSessionId;
+    }) => void | Promise<void>;
+    onEmailVerified?: (context: {
+        email: string;
+    }) => void | Promise<void>;
+    /** Called (in the enumeration-safe default) when someone tries to register an
+     *  email that already exists — send the real owner a "you already have an
+     *  account, sign in" email out-of-band. Not called when
+     *  `revealRegistrationConflicts` is true. */
+    onExistingAccount?: (context: {
+        email: string;
+    }) => void | Promise<void>;
+    onPasswordReset?: (context: {
+        email: string;
+    }) => void | Promise<void>;
+    onRegistrationSuccess?: (context: {
+        email: string;
+        user: UserType;
+    }) => void | Promise<void>;
+    onSendEmail: (message: CredentialEmailMessage) => void | Promise<void>;
+    /** Called on login/register when the request's Origin is not in
+     *  `trustedOrigins`. Fires whether or not `enforceTrustedOrigins` blocks the
+     *  request, so it can drive a report-only rollout (log/surface the Origin). */
+    onUntrustedOrigin?: (context: {
+        origin: string | null;
+        request: Request;
+    }) => void | Promise<void>;
+    passwordPolicy?: PasswordPolicy;
+    registerRoute?: RouteString;
+    /** When true, registration creates the account but NOT a session, and login is
+     *  rejected until the email is verified. Default false = auto-login on register and
+     *  verification acts as a soft, later gate. */
+    requireEmailVerification?: boolean;
+    /** When true, `POST /register` returns 409 "Email is already registered" for a
+     *  known email. Default false = enumeration-safe: return the same generic
+     *  response a new pending registration does and call `onExistingAccount`
+     *  instead of confirming the account exists. */
+    revealRegistrationConflicts?: boolean;
+    resetPasswordRoute?: RouteString;
+    resetTokenDurationMs?: number;
+    sessionDurationMs?: number;
+    /** When set, login/register reject requests whose `Origin` header is not in
+     *  this list (defense against login/registration CSRF). Omit to disable. */
+    trustedOrigins?: readonly string[];
+    verificationTokenDurationMs?: number;
+    verifyEmailRoute?: RouteString;
+};
+export type CredentialRouteProps<UserType> = CredentialsConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+    cookieSecure?: boolean;
+    lockoutGuard?: LockoutGuard;
+};

package/dist/credentials/emailValidation.d.ts

@@ -0,0 +1,9 @@
+export type EmailValidationResult = {
+    ok: boolean;
+    reason?: 'disposable' | 'invalid_format' | 'no_mx';
+};
+export declare const isDisposableEmail: (email: string, extraDomains?: Iterable<string>) => boolean;
+export declare const validateEmailDeliverability: (email: string, options?: {
+    checkMx?: boolean;
+    disposableDomains?: Iterable<string>;
+}) => Promise<EmailValidationResult>;

package/dist/credentials/emailVerification.d.ts

@@ -0,0 +1,83 @@
+import { Elysia } from 'elysia';
+import { type CredentialsConfig } from './config';
+export declare const credentialsEmailVerification: <UserType>({ credentialStore, onEmailVerified, onSendEmail, verificationTokenDurationMs, verifyEmailRoute }: CredentialsConfig<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: {
+                token: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "Invalid or expired verification token";
+                200: {
+                    readonly status: "email_verified";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        request: {
+            post: {
+                body: {
+                    email: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        readonly status: "verification_requested";
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/credentials/import.d.ts

@@ -0,0 +1,49 @@
+import type { CredentialRecord, CredentialStore } from './types';
+export type ImportableUser<UserType> = {
+    passwordHash?: string;
+    user: UserType;
+};
+export type ImportUserResult<UserType> = {
+    error: string;
+    ok: false;
+    user: UserType;
+} | {
+    credential?: CredentialRecord;
+    ok: true;
+    user: UserType;
+};
+export type ImportUsersOptions<UserType> = {
+    onCreateUser: (input: ImportableUser<UserType>) => Promise<{
+        email: string;
+        emailVerified?: boolean;
+        userId?: string;
+    } | null>;
+    concurrency?: number;
+    credentialStore: CredentialStore;
+};
+export declare const importUser: <UserType>(input: ImportableUser<UserType>, options: ImportUsersOptions<UserType>) => Promise<{
+    error: string;
+    ok: false;
+    user: UserType;
+    credential?: undefined;
+} | {
+    ok: true;
+    user: UserType;
+    readonly error?: undefined;
+    credential?: undefined;
+} | {
+    credential: CredentialRecord;
+    ok: true;
+    user: UserType;
+    readonly error?: undefined;
+}>;
+export declare const importUsers: <UserType>(inputs: readonly ImportableUser<UserType>[], options: ImportUsersOptions<UserType>) => Promise<{
+    failed: number;
+    results: ImportUserResult<UserType>[];
+    succeeded: number;
+}>;
+export declare const rehashCredentialPassword: ({ credentialStore, current, plainPassword }: {
+    credentialStore: CredentialStore;
+    current: CredentialRecord;
+    plainPassword: string;
+}) => Promise<void>;

package/dist/credentials/inMemoryCredentialStore.d.ts

@@ -0,0 +1,2 @@
+import type { CredentialStore } from './types';
+export declare const createInMemoryCredentialStore: () => CredentialStore;

package/dist/credentials/legacyHashers.d.ts

@@ -0,0 +1,3 @@
+export declare const isLegacyHash: (storedHash: string) => boolean;
+export declare const verifyAuth0Pbkdf2: (plainPassword: string, wrappedHash: string) => Promise<boolean>;
+export declare const verifyCognitoSha256: (plainPassword: string, wrappedHash: string) => Promise<boolean>;

package/dist/credentials/login.d.ts

@@ -0,0 +1,76 @@
+import { Elysia } from 'elysia';
+import { type CredentialRouteProps } from './config';
+export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, cookieSecure, credentialStore, enforceTrustedOrigins, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, onUntrustedOrigin, passwordVerifier, rehashOnLogin, requireEmailVerification, sessionDurationMs, trustedOrigins }: CredentialRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: {
+                email: string;
+                password: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Invalid email or password";
+                403: "Request origin is not allowed" | {
+                    readonly status: "email_not_verified";
+                };
+                200: {
+                    readonly status: "mfa_required";
+                } | {
+                    readonly passwordCompromised: boolean;
+                    readonly status: "authenticated";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                429: {
+                    readonly retryAfterMs: number | undefined;
+                    readonly status: "account_locked";
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/credentials/passwordPolicy.d.ts

@@ -0,0 +1,15 @@
+export type PasswordPolicy = {
+    checkBreaches?: boolean;
+    minLength?: number;
+    requireDigit?: boolean;
+    requireLowercase?: boolean;
+    requireSymbol?: boolean;
+    requireUppercase?: boolean;
+};
+export type PasswordPolicyViolation = 'breached' | 'missing_digit' | 'missing_lowercase' | 'missing_symbol' | 'missing_uppercase' | 'too_short';
+export type PasswordPolicyResult = {
+    ok: boolean;
+    violations: PasswordPolicyViolation[];
+};
+export declare const evaluatePassword: (password: string, policy?: PasswordPolicy) => Promise<PasswordPolicyResult>;
+export declare const isPasswordCompromised: (password: string) => Promise<boolean>;

package/dist/credentials/passwordReset.d.ts

@@ -0,0 +1,87 @@
+import { Elysia } from 'elysia';
+import { type CredentialsConfig } from './config';
+export declare const credentialsPasswordReset: <UserType>({ credentialStore, onPasswordReset, onSendEmail, passwordPolicy, resetPasswordRoute, resetTokenDurationMs }: CredentialsConfig<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        request: {
+            post: {
+                body: {
+                    email: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        readonly status: "reset_requested";
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                token: string;
+                password: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "Invalid or expired reset token" | {
+                    readonly message: "Password does not meet the policy";
+                    readonly violations: import("./passwordPolicy").PasswordPolicyViolation[];
+                };
+                200: {
+                    readonly status: "password_reset";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;