@absolutejs/auth 0.65.1 → 0.65.3

package/dist/lockout/types.d.ts

@@ -0,0 +1,12 @@
+export type LockoutRecord = {
+    failedAttempts: number;
+    key: string;
+    lockedUntil?: number;
+    windowStartedAt: number;
+};
+export type LockoutStore = {
+    get: (key: string) => Promise<LockoutRecord | undefined>;
+    increment: (key: string, windowMs: number) => Promise<LockoutRecord>;
+    lock: (key: string, lockedUntil: number) => Promise<void>;
+    reset: (key: string) => Promise<void>;
+};

package/dist/manifest.d.ts

@@ -0,0 +1,18 @@
+import type { AuthConfig } from './types';
+export declare const manifest: Omit<import("@absolutejs/manifest").PackageManifest<AuthConfig<unknown>, never>, "contract" | "settings" | "tools"> & (({
+    contract: 1;
+    tools?: Record<string, import("@absolutejs/manifest").LegacyManifestTool<never>> | undefined;
+} | {
+    contract: 2;
+    tools?: Record<string, import("@absolutejs/manifest").AuthorizedManifestTool<never>> | undefined;
+}) & {
+    settings: import("@sinclair/typebox").TObject<{
+        cleanupIntervalMs: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TNumber>;
+        cookieSecure: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        maxSessions: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+        providersConfiguration: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TObject<{
+            scope: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        }>>>;
+        sessionDurationMs: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TNumber>;
+    }>;
+});

package/dist/manifest.json

@@ -0,0 +1,373 @@
+{
+	"contract": 2,
+	"discovery": {
+		"audiences": [
+			"applications",
+			"agent-hosts"
+		],
+		"intents": [
+			"authenticate people and agents",
+			"issue scoped agent delegations",
+			"publish OAuth discovery"
+		],
+		"keywords": [
+			"auth",
+			"oauth",
+			"oidc",
+			"agents",
+			"delegation",
+			"device-flow"
+		],
+		"protocols": [
+			"OAuth 2.0",
+			"OpenID Connect",
+			"ID-JAG"
+		]
+	},
+	"identity": {
+		"accent": "#6366f1",
+		"category": "auth",
+		"description": "OAuth/OIDC sign-in for people and AI agents, including open auth.md registration, scoped delegation, agent account linking, 60+ providers, passkeys, MFA, enterprise SSO/SCIM, organizations, roles, and API keys.",
+		"docsUrl": "https://github.com/absolutejs/auth",
+		"name": "@absolutejs/auth",
+		"tagline": "Let people and agents create accounts and sign in."
+	},
+	"implements": [
+		{
+			"contract": "auth/session-store",
+			"factory": "createNeonAuthSessionStore",
+			"from": "@absolutejs/auth",
+			"requires": {
+				"env": [
+					{
+						"description": "Postgres connection string",
+						"example": "postgres://user:pass@host/db",
+						"key": "DATABASE_URL",
+						"secret": true
+					}
+				]
+			},
+			"title": "Your Postgres database (recommended)",
+			"wiring": {
+				"code": "createNeonAuthSessionStore(${env.DATABASE_URL} ?? \"\", decodeSessionUserRecord)",
+				"imports": [
+					{
+						"from": "@absolutejs/auth",
+						"names": [
+							"createNeonAuthSessionStore",
+							"decodeSessionUserRecord"
+						]
+					}
+				]
+			}
+		},
+		{
+			"contract": "auth/session-store",
+			"factory": "createInMemoryAuthSessionStore",
+			"from": "@absolutejs/auth",
+			"title": "In memory (development only — sign-ins reset on restart)",
+			"wiring": {
+				"code": "createInMemoryAuthSessionStore()",
+				"imports": [
+					{
+						"from": "@absolutejs/auth",
+						"names": [
+							"createInMemoryAuthSessionStore"
+						]
+					}
+				]
+			}
+		}
+	],
+	"lifecycle": [
+		{
+			"command": "bunx absolute-auth migrate",
+			"id": "migrate",
+			"idempotent": true,
+			"kind": "migration",
+			"title": "Set up the sign-in tables in your database",
+			"when": "after-install"
+		},
+		{
+			"command": "bunx absolute-auth migrate",
+			"id": "migrate-upgrade",
+			"idempotent": true,
+			"kind": "migration",
+			"title": "Apply new sign-in tables after upgrading",
+			"when": "after-upgrade"
+		}
+	],
+	"presets": [
+		{
+			"id": "social-login",
+			"title": "Social login (Google + GitHub)",
+			"values": {
+				"providersConfiguration": {
+					"github": {},
+					"google": {}
+				}
+			}
+		}
+	],
+	"requires": {
+		"env": [
+			{
+				"description": "Postgres connection string (sign-in tables live here)",
+				"example": "postgres://user:pass@host/db",
+				"key": "DATABASE_URL",
+				"secret": true
+			},
+			{
+				"description": "Discord OAuth client id",
+				"docsUrl": "https://discord.com/developers/applications",
+				"key": "DISCORD_CLIENT_ID",
+				"when": "providersConfiguration.discord"
+			},
+			{
+				"description": "Discord OAuth client secret",
+				"docsUrl": "https://discord.com/developers/applications",
+				"key": "DISCORD_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.discord"
+			},
+			{
+				"description": "Facebook OAuth client id",
+				"docsUrl": "https://developers.facebook.com/apps",
+				"key": "FACEBOOK_CLIENT_ID",
+				"when": "providersConfiguration.facebook"
+			},
+			{
+				"description": "Facebook OAuth client secret",
+				"docsUrl": "https://developers.facebook.com/apps",
+				"key": "FACEBOOK_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.facebook"
+			},
+			{
+				"description": "Github OAuth client id",
+				"docsUrl": "https://github.com/settings/developers",
+				"key": "GITHUB_CLIENT_ID",
+				"when": "providersConfiguration.github"
+			},
+			{
+				"description": "Github OAuth client secret",
+				"docsUrl": "https://github.com/settings/developers",
+				"key": "GITHUB_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.github"
+			},
+			{
+				"description": "Google OAuth client id",
+				"docsUrl": "https://console.cloud.google.com/apis/credentials",
+				"key": "GOOGLE_CLIENT_ID",
+				"when": "providersConfiguration.google"
+			},
+			{
+				"description": "Google OAuth client secret",
+				"docsUrl": "https://console.cloud.google.com/apis/credentials",
+				"key": "GOOGLE_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.google"
+			},
+			{
+				"description": "Linkedin OAuth client id",
+				"docsUrl": "https://www.linkedin.com/developers/apps",
+				"key": "LINKEDIN_CLIENT_ID",
+				"when": "providersConfiguration.linkedin"
+			},
+			{
+				"description": "Linkedin OAuth client secret",
+				"docsUrl": "https://www.linkedin.com/developers/apps",
+				"key": "LINKEDIN_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.linkedin"
+			},
+			{
+				"description": "Microsoft OAuth client id",
+				"docsUrl": "https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade",
+				"key": "MICROSOFT_CLIENT_ID",
+				"when": "providersConfiguration.microsoft"
+			},
+			{
+				"description": "Microsoft OAuth client secret",
+				"docsUrl": "https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade",
+				"key": "MICROSOFT_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.microsoft"
+			},
+			{
+				"description": "Slack OAuth client id",
+				"docsUrl": "https://api.slack.com/apps",
+				"key": "SLACK_CLIENT_ID",
+				"when": "providersConfiguration.slack"
+			},
+			{
+				"description": "Slack OAuth client secret",
+				"docsUrl": "https://api.slack.com/apps",
+				"key": "SLACK_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.slack"
+			},
+			{
+				"description": "Spotify OAuth client id",
+				"docsUrl": "https://developer.spotify.com/dashboard",
+				"key": "SPOTIFY_CLIENT_ID",
+				"when": "providersConfiguration.spotify"
+			},
+			{
+				"description": "Spotify OAuth client secret",
+				"docsUrl": "https://developer.spotify.com/dashboard",
+				"key": "SPOTIFY_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.spotify"
+			},
+			{
+				"description": "Twitch OAuth client id",
+				"docsUrl": "https://dev.twitch.tv/console/apps",
+				"key": "TWITCH_CLIENT_ID",
+				"when": "providersConfiguration.twitch"
+			},
+			{
+				"description": "Twitch OAuth client secret",
+				"docsUrl": "https://dev.twitch.tv/console/apps",
+				"key": "TWITCH_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.twitch"
+			}
+		],
+		"peers": [
+			{
+				"name": "elysia",
+				"range": ">=1.0",
+				"reason": "plugin host"
+			}
+		],
+		"services": [
+			{
+				"description": "Stores accounts, sessions, and audit events",
+				"id": "postgres"
+			}
+		]
+	},
+	"settings": {
+		"type": "object",
+		"properties": {
+			"cleanupIntervalMs": {
+				"description": "How often expired sessions are swept, in milliseconds.",
+				"minimum": 1000,
+				"title": "Session cleanup interval",
+				"x-group": "advanced",
+				"type": "number"
+			},
+			"cookieSecure": {
+				"description": "Only send the sign-in cookie over HTTPS. Leave off in local development.",
+				"title": "HTTPS-only cookies",
+				"x-group": "advanced",
+				"type": "boolean"
+			},
+			"maxSessions": {
+				"description": "How many devices someone can stay signed in on at once.",
+				"minimum": 1,
+				"title": "Signed-in devices per person",
+				"x-group": "sessions",
+				"type": "integer"
+			},
+			"providersConfiguration": {
+				"description": "Which services people can sign in with. Each needs a client id and secret from that provider.",
+				"title": "Sign-in providers",
+				"x-group": "providers",
+				"type": "object",
+				"patternProperties": {
+					"^(.*)$": {
+						"type": "object",
+						"properties": {
+							"scope": {
+								"description": "Extra permissions to request from the provider.",
+								"title": "Permissions",
+								"type": "array",
+								"items": {
+									"type": "string"
+								}
+							}
+						}
+					}
+				}
+			},
+			"sessionDurationMs": {
+				"description": "How long someone stays signed in, in milliseconds. Default is 7 days.",
+				"minimum": 60000,
+				"title": "Stay signed in for",
+				"x-group": "sessions",
+				"type": "number"
+			}
+		}
+	},
+	"slots": {
+		"sessionStore": {
+			"configPath": "authSessionStore",
+			"contract": "auth/session-store",
+			"description": "Where live sign-in sessions are kept",
+			"known": [
+				"@absolutejs/auth#postgres",
+				"@absolutejs/auth#memory"
+			],
+			"required": true
+		},
+		"verificationProvider": {
+			"configPath": "verificationProvider",
+			"contract": "auth/verification-provider",
+			"description": "Provider-managed phone verification for MFA and future passwordless flows",
+			"known": [
+				"@absolutejs/auth-twilio"
+			],
+			"required": false
+		}
+	},
+	"wiring": [
+		{
+			"description": "Sign in with Google, GitHub, and 60+ other services. Add email/password later from settings.",
+			"id": "default",
+			"server": {
+				"code": ".use(\n\tawait auth({\n\t\t// TODO: return your application user for a session subject.\n\t\tgetUser: (sub) => ({ sub }),\n\t\tauthSessionStore: ${slot.sessionStore},\n\t\tcookieSecure: ${settings.cookieSecure},\n\t\tmaxSessions: ${settings.maxSessions},\n\t\tprovidersConfiguration: providersFromEnv(${settings.providersConfiguration} ?? {}),\n\t\tsessionDurationMs: ${settings.sessionDurationMs}\n\t})\n)",
+				"imports": [
+					{
+						"from": "@absolutejs/auth",
+						"names": [
+							"auth",
+							"providersFromEnv"
+						]
+					}
+				],
+				"placement": "server-plugin"
+			},
+			"title": "Social sign-in (OAuth)"
+		}
+	],
+	"tools": {
+		"list_sign_in_providers": {
+			"annotations": {
+				"readOnlyHint": true
+			},
+			"authorization": {
+				"approval": "never",
+				"audience": "admin",
+				"effects": [
+					"read"
+				],
+				"requiredScopes": [
+					"auth:inspect"
+				]
+			},
+			"capabilities": [
+				"read",
+				"glob"
+			],
+			"description": "List which sign-in providers this project has configured, and which are missing credentials.",
+			"input": {
+				"type": "object",
+				"properties": {}
+			},
+			"kind": "workspace"
+		}
+	}
+}

package/dist/mfa/backupCodes.d.ts

@@ -0,0 +1,5 @@
+export declare const consumeBackupCode: (code: string, hashes: string[]) => Promise<string[] | undefined>;
+export declare const generateBackupCodes: (count: number) => Promise<{
+    codes: string[];
+    hashes: string[];
+}>;

package/dist/mfa/challenge.d.ts

@@ -0,0 +1,72 @@
+import { Elysia } from 'elysia';
+import { type MfaRouteProps } from './config';
+export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute, cookieSecure, encryptionKey, getChallengeUser, getUserId, mfaStore, onMfaChallengeError, onMfaChallengeSuccess, onSendSmsCode, verificationProvider, sessionDurationMs, smsCodeLength, smsCodeTtlMs, smsMaxAttempts, smsResendCooldownMs, totpMaxAttempts }: MfaRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: {
+                code?: string | undefined;
+                action?: "verify" | "send" | undefined;
+                factor?: "sms" | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: string;
+                401: "SMS code expired" | "Too many attempts" | "SMS challenge is no longer active" | "No MFA challenge in progress" | "Invalid MFA code";
+                200: {
+                    readonly status: "sent";
+                } | {
+                    readonly status: "authenticated";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                429: string;
+                503: string;
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/mfa/config.d.ts

@@ -0,0 +1,59 @@
+import type { AuthSessionStore } from '../session/types';
+import type { RouteString, UserSessionId } from '../types';
+import type { MFAStore } from './types';
+export declare const DEFAULT_BACKUP_CODE_COUNT = 10;
+export declare const DEFAULT_MFA_ISSUER = "AbsoluteAuth";
+export declare const DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS: number;
+export declare const DEFAULT_MFA_SESSION_TTL_MS: number;
+export declare const DEFAULT_SMS_CODE_LENGTH = 6;
+export declare const DEFAULT_SMS_CODE_TTL_MS: number;
+export declare const DEFAULT_SMS_MAX_ATTEMPTS = 3;
+export declare const DEFAULT_SMS_RESEND_COOLDOWN_MS: number;
+export declare const DEFAULT_TOTP_MAX_ATTEMPTS = 5;
+export type SmsCodeMessage = {
+    code: string;
+    expiresAt: number;
+    phone: string;
+    purpose: 'mfa_challenge' | 'mfa_enrollment';
+    userId: string;
+};
+export type MfaConfig<UserType> = {
+    mfaStore: MFAStore;
+    getUserId: (user: UserType) => string;
+    getChallengeUser: (userIdentity: Record<string, unknown>) => Promise<UserType | null | undefined> | UserType | null | undefined;
+    backupCodeCount?: number;
+    challengeRoute?: RouteString;
+    encryptionKey?: string;
+    issuer?: string;
+    managementRoute?: RouteString;
+    /** Maximum age of the authentication ceremony used to enroll, replace, or remove MFA. */
+    managementAuthMaxAgeMs?: number;
+    onMfaChallengeError?: (context: {
+        error: unknown;
+        userId?: string;
+    }) => void | Promise<void>;
+    onMfaChallengeSuccess?: (context: {
+        user: UserType;
+        userSessionId: UserSessionId;
+    }) => void | Promise<void>;
+    onMfaEnrolled?: (context: {
+        userId: string;
+    }) => void | Promise<void>;
+    onSendSmsCode?: (message: SmsCodeMessage) => void | Promise<void>;
+    sessionDurationMs?: number;
+    smsCodeLength?: number;
+    smsCodeTtlMs?: number;
+    smsMaxAttempts?: number;
+    /** Minimum delay between code sends for the same enrollment. */
+    smsResendCooldownMs?: number;
+    smsSetupRoute?: RouteString;
+    smsVerifyRoute?: RouteString;
+    totpMaxAttempts?: number;
+    totpSetupRoute?: RouteString;
+    totpVerifyRoute?: RouteString;
+};
+export type MfaRouteProps<UserType> = MfaConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+    cookieSecure?: boolean;
+    verificationProvider?: import('../verification/types').VerificationProvider;
+};

package/dist/mfa/gate.d.ts

@@ -0,0 +1,2 @@
+import type { MfaConfig } from './config';
+export declare const createMfaGate: <UserType>({ getUserId, mfaStore }: MfaConfig<UserType>) => (user: UserType) => Promise<boolean>;

package/dist/mfa/inMemoryMfaStore.d.ts

@@ -0,0 +1,2 @@
+import type { MFAStore } from './types';
+export declare const createInMemoryMfaStore: () => MFAStore;

package/dist/mfa/management.d.ts

@@ -0,0 +1,106 @@
+import { Elysia } from 'elysia';
+import { type MfaRouteProps } from './config';
+export type MfaStatus = {
+    backupCodesRemaining: number;
+    enabled: boolean;
+    smsBackup: {
+        enabled: boolean;
+        phone: string | null;
+    };
+    totp: {
+        enabled: boolean;
+    };
+};
+export declare const mfaManagementRoutes: <UserType>({ authSessionStore, getUserId, managementRoute, managementAuthMaxAgeMs, mfaStore }: MfaRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Authentication required";
+                200: {
+                    backupCodesRemaining: number;
+                    enabled: boolean;
+                    smsBackup: {
+                        enabled: boolean;
+                        phone: string | null;
+                    };
+                    totp: {
+                        enabled: boolean;
+                    };
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        delete: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Recent authentication required" | "Authentication required";
+                200: {
+                    readonly status: "disabled";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;