@absolutejs/auth 0.65.1 → 0.65.3

package/dist/credentials/postgresCredentialStore.d.ts

@@ -0,0 +1,235 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { CredentialStore } from './types';
+export declare const credentialsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_credentials";
+    schema: undefined;
+    columns: {
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_credentials", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_credentials";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        email: import("drizzle-orm/pg-core").PgBuildColumn<"auth_credentials", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_credentials";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        email_verified: import("drizzle-orm/pg-core").PgBuildColumn<"auth_credentials", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBooleanBuilder>>, {
+            name: string;
+            tableName: "auth_credentials";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        organization_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_credentials", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_credentials";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        password_hash: import("drizzle-orm/pg-core").PgBuildColumn<"auth_credentials", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_credentials";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        status: import("drizzle-orm/pg-core").PgBuildColumn<"auth_credentials", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>>, {
+            name: string;
+            tableName: "auth_credentials";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updated_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_credentials", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_credentials";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_credentials", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_credentials";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const credentialResetTokensTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: string;
+    schema: undefined;
+    columns: {
+        email: import("drizzle-orm/pg-core").PgBuildColumn<string, import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: string;
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<string, import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: string;
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        token_hash: import("drizzle-orm/pg-core").PgBuildColumn<string, import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: string;
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const credentialVerificationTokensTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: string;
+    schema: undefined;
+    columns: {
+        email: import("drizzle-orm/pg-core").PgBuildColumn<string, import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: string;
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<string, import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: string;
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        token_hash: import("drizzle-orm/pg-core").PgBuildColumn<string, import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: string;
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonCredentialStore: (databaseUrl: string) => CredentialStore;
+export declare const createPostgresCredentialStore: <DB extends AnyPgDatabase>(db: DB) => CredentialStore;

package/dist/credentials/register.d.ts

@@ -0,0 +1,54 @@
+import { Elysia } from 'elysia';
+import { type CredentialRouteProps } from './config';
+export declare const credentialsRegister: <UserType>({ authSessionStore, cookieSecure, credentialStore, enforceTrustedOrigins, getUserByEmail, onCreateCredentialUser, onCredentialsLoginSuccess, onExistingAccount, onRegistrationSuccess, onSendEmail, onUntrustedOrigin, passwordPolicy, registerRoute, requireEmailVerification, revealRegistrationConflicts, sessionDurationMs, trustedOrigins, verificationTokenDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: {
+                email: string;
+                password: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                [x: number]: {};
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/credentials/routes.d.ts

@@ -0,0 +1,201 @@
+import { Elysia } from 'elysia';
+import type { CredentialRouteProps } from './config';
+export declare const credentialRoutes: <UserType>(config: CredentialRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: {
+                email: string;
+                password: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                [x: number]: {};
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                token: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "Invalid or expired verification token";
+                200: {
+                    readonly status: "email_verified";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        request: {
+            post: {
+                body: {
+                    email: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        readonly status: "verification_requested";
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                email: string;
+                password: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Invalid email or password";
+                403: "Request origin is not allowed" | {
+                    readonly status: "email_not_verified";
+                };
+                200: {
+                    readonly status: "mfa_required";
+                } | {
+                    readonly passwordCompromised: boolean;
+                    readonly status: "authenticated";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+                429: {
+                    readonly retryAfterMs: number | undefined;
+                    readonly status: "account_locked";
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        request: {
+            post: {
+                body: {
+                    email: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        readonly status: "reset_requested";
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                token: string;
+                password: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "Invalid or expired reset token" | {
+                    readonly message: "Password does not meet the policy";
+                    readonly violations: import("./passwordPolicy").PasswordPolicyViolation[];
+                };
+                200: {
+                    readonly status: "password_reset";
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/credentials/types.d.ts

@@ -0,0 +1,26 @@
+import type { OrganizationId } from '../tenancy';
+export type CredentialStatus = 'active' | 'disabled';
+export type CredentialRecord = {
+    createdAt: number;
+    email: string;
+    emailVerified: boolean;
+    organizationId?: OrganizationId;
+    passwordHash: string;
+    status: CredentialStatus;
+    updatedAt: number;
+    userId?: string;
+};
+export type CredentialToken = {
+    email: string;
+    expiresAt: number;
+    tokenHash: string;
+};
+export type CredentialStore = {
+    consumeResetToken: (tokenHash: string) => Promise<CredentialToken | undefined>;
+    consumeVerificationToken: (tokenHash: string) => Promise<CredentialToken | undefined>;
+    getCredentialByEmail: (email: string) => Promise<CredentialRecord | undefined>;
+    saveCredential: (credential: CredentialRecord) => Promise<void>;
+    saveResetToken: (token: CredentialToken) => Promise<void>;
+    saveVerificationToken: (token: CredentialToken) => Promise<void>;
+    setEmailVerified: (email: string) => Promise<void>;
+};

package/dist/crypto.d.ts

@@ -0,0 +1,32 @@
+export declare const base32Decode: (encoded: string) => Uint8Array<ArrayBuffer>;
+export declare const base32Encode: (bytes: Uint8Array) => string;
+export declare const constantTimeEqual: (left: string, right: string) => Promise<boolean>;
+export declare const createTotpKeyUri: ({ accountName, digits, issuer, period, secret }: {
+    accountName: string;
+    digits?: number;
+    issuer: string;
+    period?: number;
+    secret: string;
+}) => string;
+export declare const decryptSecret: (ciphertext: string, keyMaterial: string) => Promise<string>;
+export declare const encryptSecret: (plaintext: string, keyMaterial: string) => Promise<string>;
+export declare const generateEncryptionKey: () => string;
+export declare const generateSecureToken: (byteLength?: number) => string;
+export declare const generateTotp: ({ digits, now, period, secret }: {
+    digits?: number;
+    now?: number;
+    period?: number;
+    secret: string;
+}) => Promise<string>;
+export declare const generateTotpSecret: (byteLength?: number) => string;
+export declare const hashPassword: (password: string) => Promise<string>;
+export declare const hashToken: (token: string) => Promise<string>;
+export declare const verifyPassword: (password: string, hash: string) => Promise<boolean>;
+export declare const verifyTotp: ({ digits, now, period, secret, token, window }: {
+    digits?: number;
+    now?: number;
+    period?: number;
+    secret: string;
+    token: string;
+    window?: number;
+}) => Promise<boolean>;

package/dist/csrf.d.ts

@@ -0,0 +1,10 @@
+export declare const isTrustedOrigin: (request: Request, trustedOrigins?: readonly string[]) => boolean;
+export declare const resolveOriginAllowed: ({ enforce, onUntrustedOrigin, request, trustedOrigins }: {
+    enforce?: boolean;
+    onUntrustedOrigin?: (context: {
+        origin: string | null;
+        request: Request;
+    }) => void | Promise<void>;
+    request: Request;
+    trustedOrigins?: readonly string[];
+}) => Promise<boolean>;

package/dist/errors.d.ts

@@ -0,0 +1,12 @@
+import { AuthIntent } from './types';
+export type AuthIdentityConflict = {
+    authProvider: string;
+    providerSubject: string;
+    existingUserAuthSub: string;
+    currentUserAuthSub?: string;
+    intent?: AuthIntent;
+};
+export declare class AuthIdentityConflictError extends Error {
+    conflict: AuthIdentityConflict;
+    constructor(conflict: AuthIdentityConflict);
+}

package/dist/federation/tokenStore.d.ts

@@ -0,0 +1,29 @@
+import type { Vault } from '../vault/config';
+export type FederatedTokenSet = {
+    accessToken: string;
+    expiresAt?: number;
+    refreshToken?: string;
+    scopes?: string[];
+    storedAt: number;
+    tokenType?: string;
+};
+export type FederatedTokenStore = {
+    delete: (userId: string, provider: string, revoke?: (tokens: FederatedTokenSet) => Promise<void>) => Promise<void>;
+    get: (userId: string, provider: string) => Promise<FederatedTokenSet | undefined>;
+    list: (userId: string) => Promise<string[]>;
+    save: (userId: string, provider: string, tokens: Omit<FederatedTokenSet, 'storedAt'>) => Promise<void>;
+};
+export declare const createFederatedTokenStore: (vault: Vault) => FederatedTokenStore;
+export type FederatedTokenRefresher = (refreshToken: string) => Promise<{
+    access_token: string;
+    expires_in?: number;
+    refresh_token?: string;
+    token_type?: string;
+}>;
+export declare const getOrRefreshFederatedTokens: ({ now, provider, refresh, store, userId }: {
+    now?: number;
+    provider: string;
+    refresh?: FederatedTokenRefresher;
+    store: FederatedTokenStore;
+    userId: string;
+}) => Promise<FederatedTokenSet | undefined>;

package/dist/fga/config.d.ts

@@ -0,0 +1,53 @@
+import type { FgaSchema, Warrant, WarrantStore } from './types';
+export type FgaCache = {
+    clear: () => void | Promise<void>;
+    get: (key: string) => boolean | undefined | Promise<boolean | undefined>;
+    set: (key: string, value: boolean) => void | Promise<void>;
+};
+export type FgaConfig = {
+    cache?: FgaCache;
+    maxDepth?: number;
+    schema: FgaSchema;
+    warrantStore: WarrantStore;
+};
+export type CheckQuery = {
+    relation: string;
+    resourceId: string;
+    resourceType: string;
+    subjectId: string;
+    subjectType: string;
+};
+export type Subject = {
+    subjectId: string;
+    subjectType: string;
+};
+export type ObjectQuery = {
+    relation: string;
+    resourceType: string;
+    subjectId: string;
+    subjectType: string;
+};
+export declare const check: (config: FgaConfig, query: CheckQuery) => Promise<boolean>;
+export declare const createInMemoryCheckCache: ({ maxEntries, ttlMs }?: {
+    maxEntries?: number;
+    ttlMs?: number;
+}) => FgaCache;
+export declare const createFgaEngine: (config: FgaConfig) => {
+    check: (query: CheckQuery) => Promise<boolean>;
+    deleteWarrant: (warrant: Warrant) => Promise<void>;
+    listObjects: (query: ObjectQuery) => Promise<string[]>;
+    listSubjects: (query: {
+        relation: string;
+        resourceId: string;
+        resourceType: string;
+    }) => Promise<Subject[]>;
+    writeWarrant: (warrant: Warrant) => Promise<void>;
+};
+export declare const deleteWarrant: (config: FgaConfig, warrant: Warrant) => Promise<void>;
+export declare const listObjects: (config: FgaConfig, query: ObjectQuery) => Promise<string[]>;
+export declare const listSubjects: (config: FgaConfig, query: {
+    relation: string;
+    resourceId: string;
+    resourceType: string;
+}) => Promise<Subject[]>;
+export declare const writeWarrant: (config: FgaConfig, warrant: Warrant) => Promise<void>;

package/dist/fga/inMemoryStores.d.ts

@@ -0,0 +1,3 @@
+import type { Warrant, WarrantStore } from './types';
+export declare const createInMemoryWarrantStore: () => WarrantStore;
+export declare const warrantKey: (warrant: Warrant) => string;