@absolutejs/auth 0.65.1 → 0.65.3

package/dist/session/userSessions.d.ts

@@ -0,0 +1,19 @@
+import type { SessionData, UserSessionId } from '../types';
+import type { AuthSessionStore } from './types';
+export type UserSession<UserType> = {
+    id: UserSessionId;
+    session: SessionData<UserType>;
+};
+type ListUserSessionsProps<UserType> = {
+    authSessionStore: AuthSessionStore<UserType>;
+    getUserId: (user: UserType) => string;
+    userId: string;
+};
+export declare const listUserSessions: <UserType>({ authSessionStore, getUserId, userId }: ListUserSessionsProps<UserType>) => Promise<UserSession<UserType>[]>;
+export declare const refreshUserSessions: <UserType>({ authSessionStore, getUserId, user, userId }: ListUserSessionsProps<UserType> & {
+    user: UserType;
+}) => Promise<number>;
+export declare const revokeUserSessions: <UserType>({ authSessionStore, exceptSessionId, getUserId, userId }: ListUserSessionsProps<UserType> & {
+    exceptSessionId?: UserSessionId;
+}) => Promise<number>;
+export {};

package/dist/sso/config.d.ts

@@ -0,0 +1,149 @@
+import type { OAuth2TokenResponse, OIDCIdTokenClaims } from 'citra';
+import type { OrganizationId } from '../tenancy';
+import type { RouteString, UserSessionId } from '../types';
+import type { OidcConnection, SamlConnection, SSOConnectionStore } from './types';
+export declare const DEFAULT_SSO_ROUTE = "/sso";
+export declare const DEFAULT_SSO_SESSION_TTL_MS: number;
+export type SamlProfile = {
+    attributes: Record<string, unknown>;
+    email?: string;
+    nameId: string;
+    sessionIndex?: string;
+};
+type SamlAuthorizeRequest = {
+    acsUrl: string;
+    connection: SamlConnection;
+    relayState?: string;
+};
+type SamlAssertionRequest = {
+    acsUrl: string;
+    connection: SamlConnection;
+    relayState?: string;
+    samlResponse: string;
+};
+type SamlMetadataRequest = {
+    acsUrl: string;
+    connection: SamlConnection;
+    sloUrl?: string;
+};
+type SamlLogoutRequest = {
+    connection: SamlConnection;
+    nameId: string;
+    relayState?: string;
+    sessionIndex?: string;
+    sloUrl: string;
+};
+type SamlLogoutResponseRequest = {
+    connection: SamlConnection;
+    relayState?: string;
+    samlResponse: string;
+    signature?: string;
+    signatureAlgorithm?: string;
+    signedQueryString?: string;
+    sloUrl: string;
+};
+type SamlIdpLogoutRequest = {
+    connection: SamlConnection;
+    relayState?: string;
+    samlRequest: string;
+    signature?: string;
+    signatureAlgorithm?: string;
+    signedQueryString?: string;
+    sloUrl: string;
+};
+type SamlLogoutResponseAck = {
+    connection: SamlConnection;
+    inResponseTo?: string;
+    nameId?: string;
+    relayState?: string;
+    sloUrl: string;
+};
+export type SamlLogoutInfo = {
+    nameId?: string;
+    relayState?: string;
+    requestId?: string;
+    sessionIndex?: string;
+};
+export type SamlAuthnRequestInfo = {
+    acsUrl?: string;
+    forceAuthn?: boolean;
+    id: string;
+    issuer: string;
+    relayState?: string;
+};
+export type SamlIdpResponseRequest = {
+    acsUrl: string;
+    attributes?: Record<string, unknown>;
+    audience: string;
+    idpEntityId: string;
+    inResponseTo?: string;
+    nameId: string;
+    nameIdFormat?: string;
+    relayState?: string;
+    sessionIndex: string;
+};
+export type SamlIdpAdapter = {
+    buildAutoPostForm: (input: {
+        acsUrl: string;
+        relayState?: string;
+        samlResponse: string;
+    }) => string;
+    createSamlResponse: (request: SamlIdpResponseRequest) => Promise<string> | string;
+    getIdpMetadata: (input: {
+        entityId: string;
+        ssoUrl: string;
+    }) => Promise<string> | string;
+    parseAuthnRequest: (input: {
+        binding: 'POST' | 'Redirect';
+        samlRequest: string;
+        serviceProvider?: import('./types').SamlServiceProvider;
+        signature?: string;
+        signatureAlgorithm?: string;
+        signedQueryString?: string;
+    }) => Promise<SamlAuthnRequestInfo> | SamlAuthnRequestInfo;
+};
+export type SamlAdapter = {
+    createAuthorizationUrl: (request: SamlAuthorizeRequest) => Promise<string> | string;
+    createLogoutRequestUrl?: (request: SamlLogoutRequest) => Promise<string> | string;
+    createLogoutResponseUrl?: (request: SamlLogoutResponseAck) => Promise<string> | string;
+    getServiceProviderMetadata: (request: SamlMetadataRequest) => Promise<string> | string;
+    validateAssertion: (request: SamlAssertionRequest) => Promise<SamlProfile>;
+    validateLogoutRequest?: (request: SamlIdpLogoutRequest) => Promise<SamlLogoutInfo> | SamlLogoutInfo;
+    validateLogoutResponse?: (request: SamlLogoutResponseRequest) => Promise<void> | void;
+};
+type SsoIdentityBase = {
+    email?: string;
+    organizationId: OrganizationId;
+    sub: string;
+};
+export type OidcSsoIdentity = SsoIdentityBase & {
+    claims: OIDCIdTokenClaims;
+    connection: OidcConnection;
+    protocol: 'oidc';
+    tokenResponse: OAuth2TokenResponse;
+};
+export type SamlSsoIdentity = SsoIdentityBase & {
+    attributes: Record<string, unknown>;
+    connection: SamlConnection;
+    protocol: 'saml';
+    sessionIndex?: string;
+};
+export type SsoIdentity = OidcSsoIdentity | SamlSsoIdentity;
+export type SSOConfig<UserType> = {
+    getOrganizationByEmailDomain?: (domain: string) => OrganizationId | undefined | Promise<OrganizationId | undefined>;
+    getSsoUser: (identity: SsoIdentity) => Promise<UserType> | UserType;
+    onSsoCallbackError?: (context: {
+        error: unknown;
+        organizationId: string;
+    }) => void | Promise<void>;
+    onSsoCallbackSuccess?: (context: {
+        identity: SsoIdentity;
+        user: UserType;
+        userSessionId: UserSessionId;
+    }) => void | Promise<void>;
+    samlAdapter?: SamlAdapter;
+    sessionDurationMs?: number;
+    ssoConnectionStore: SSOConnectionStore;
+    ssoRoute?: RouteString;
+};
+export {};

package/dist/sso/discoveryRoute.d.ts

@@ -0,0 +1,63 @@
+import { Elysia } from 'elysia';
+import type { OrganizationId } from '../tenancy';
+import type { RouteString } from '../types';
+import type { SSOConnectionStore } from './types';
+type SsoDiscoveryProps = {
+    getOrganizationByEmailDomain: (domain: string) => OrganizationId | undefined | Promise<OrganizationId | undefined>;
+    ssoConnectionStore: SSOConnectionStore;
+    ssoRoute?: RouteString;
+};
+export declare const ssoDiscoveryRoute: ({ getOrganizationByEmailDomain, ssoConnectionStore, ssoRoute }: SsoDiscoveryProps) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: {
+                email?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                400: "An \"email\" query parameter is required" | "A valid email address is required";
+                404: "No SSO organization is configured for this email domain" | "No SSO connection is configured for this organization";
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};

package/dist/sso/inMemorySamlServiceProviderStore.d.ts

@@ -0,0 +1,2 @@
+import type { SamlServiceProviderStore } from './types';
+export declare const createInMemorySamlServiceProviderStore: () => SamlServiceProviderStore;

package/dist/sso/inMemorySsoConnectionStore.d.ts

@@ -0,0 +1,2 @@
+import type { SSOConnectionStore } from './types';
+export declare const createInMemorySsoConnectionStore: () => SSOConnectionStore;

package/dist/sso/nodeSamlAdapter.d.ts

@@ -0,0 +1,8 @@
+import 'reflect-metadata';
+import type { SamlAdapter } from './config';
+export type NodeSamlAdapterOptions = {
+    spPrivateKey?: string;
+    spCertificate?: string;
+    signatureAlgorithm?: 'sha1' | 'sha256' | 'sha512';
+};
+export declare const createNodeSamlAdapter: (options?: NodeSamlAdapterOptions) => Promise<SamlAdapter>;

package/dist/sso/oidcRoutes.d.ts

@@ -0,0 +1,98 @@
+import { Elysia } from 'elysia';
+import type { AuthSessionStore } from '../session/types';
+import { type SSOConfig } from './config';
+type OidcRoutesProps<UserType> = SSOConfig<UserType> & {
+    authSessionStore?: AuthSessionStore<UserType>;
+    cookieSecure?: boolean;
+};
+export declare const oidcSsoRoutes: <UserType>({ authSessionStore, cookieSecure, getSsoUser, onSsoCallbackError, onSsoCallbackSuccess, sessionDurationMs, ssoConnectionStore, ssoRoute }: OidcRoutesProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                organizationId: string;
+            };
+            query: unknown;
+            headers: unknown;
+            response: {
+                404: "No OIDC connection is configured for this organization";
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {
+                organizationId: string;
+            };
+            query: {
+                code?: string | undefined;
+                state?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                400: "SSO session cookies are missing" | "Invalid SSO callback request" | "SSO organization mismatch" | "OIDC token response is missing an id_token";
+                404: "No OIDC connection is configured for this organization";
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                500: "OIDC sign-in failed";
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};

package/dist/sso/postgresSamlServiceProviderStore.d.ts

@@ -0,0 +1,101 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { SamlServiceProviderStore } from './types';
+export declare const samlServiceProvidersTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_saml_service_providers";
+    schema: undefined;
+    columns: {
+        acs_url: import("drizzle-orm/pg-core").PgBuildColumn<"auth_saml_service_providers", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_saml_service_providers";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_saml_service_providers", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_saml_service_providers";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        entity_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_saml_service_providers", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_saml_service_providers";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        name_id_format: import("drizzle-orm/pg-core").PgBuildColumn<"auth_saml_service_providers", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_saml_service_providers";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        signing_cert: import("drizzle-orm/pg-core").PgBuildColumn<"auth_saml_service_providers", import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_saml_service_providers";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updated_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_saml_service_providers", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_saml_service_providers";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonSamlServiceProviderStore: (databaseUrl: string) => SamlServiceProviderStore;
+export declare const createPostgresSamlServiceProviderStore: <DB extends AnyPgDatabase>(db: DB) => SamlServiceProviderStore;

package/dist/sso/postgresSsoConnectionStore.d.ts

@@ -0,0 +1,117 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { SecretCipher } from '../compliance/cipher';
+import type { OidcConnectionConfig, SamlConnectionConfig, SSOConnectionStore, SSOConnectionType } from './types';
+export declare const ssoConnectionsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_sso_connections";
+    schema: undefined;
+    columns: {
+        config: import("drizzle-orm/pg-core").PgBuildColumn<"auth_sso_connections", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, OidcConnectionConfig | SamlConnectionConfig>>, {
+            name: string;
+            tableName: "auth_sso_connections";
+            dataType: "object json";
+            data: OidcConnectionConfig | SamlConnectionConfig;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        connection_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_sso_connections", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_sso_connections";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_sso_connections", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_sso_connections";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        enabled: import("drizzle-orm/pg-core").PgBuildColumn<"auth_sso_connections", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBooleanBuilder>>, {
+            name: string;
+            tableName: "auth_sso_connections";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        organization_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_sso_connections", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_sso_connections";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        type: import("drizzle-orm/pg-core").PgBuildColumn<"auth_sso_connections", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, SSOConnectionType>>, {
+            name: string;
+            tableName: "auth_sso_connections";
+            dataType: "string";
+            data: SSOConnectionType;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updated_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_sso_connections", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_sso_connections";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonSsoConnectionStore: (databaseUrl: string) => SSOConnectionStore;
+export declare const createPostgresSsoConnectionStore: <DB extends AnyPgDatabase>(db: DB, cipher?: SecretCipher) => SSOConnectionStore;