@absolutejs/auth 0.68.2 → 0.69.1

package/README.md

@@ -66,6 +66,75 @@ installSessionExpiryGuard({
 });
 ```
 
+### Installed-app authentication
+
+`createMobileAuthClient` keeps the public auth surface provider-neutral while
+using the installed-app security model: system-browser Authorization Code with
+S256 PKCE, exact state/issuer/redirect validation, rotating refresh credentials
+in native secure storage, in-memory access tokens, serialized refresh, and an
+origin allowlist for bearer requests. Passwords are entered in the external
+authorization UI and never posted through the app WebView.
+
+```ts
+import {
+	createMobileAuthClient,
+	createMobileAuthTransport,
+	createAuthClient
+} from '@absolutejs/auth/client';
+import { lifecycle, links, secureStorage } from '@absolutejs/devices';
+
+const mobile = createMobileAuthClient({
+	clientId: 'com.example.app',
+	issuer: 'https://app.example',
+	lifecycle,
+	links,
+	redirectUri: 'com.example.app:/oauth/callback',
+	storage: secureStorage
+});
+const authClient = createAuthClient({
+	transport: createMobileAuthTransport(mobile)
+});
+```
+
+The OIDC client registration must be public (no client secret), include the
+exact redirect URI, permit the requested scopes/resource, and require PKCE.
+Browser applications continue using HTTP-only session cookies.
+
+AbsoluteJS mobile builds provision that public client automatically when the
+application declares `@absolutejs/auth`. The CLI passes a strict
+`ABSOLUTE_AUTH_NATIVE_CLIENTS` deployment declaration into the server runtime;
+Auth layers matching issuer clients over `oidc.clientStore` without writing to
+the consumer's database. An explicitly stored client with the same ID remains
+authoritative. Applications that use Auth on mobile must mount the OIDC
+provider; the mobile build fails with an actionable error when it is absent.
+`mobile.fetchOptional()` is intended for application-shell/page-envelope
+requests: it sends a bearer token when a renewable session exists and otherwise
+performs a credential-free request so public pages still load before sign-in.
+
+For WebSocket/Sync authentication, enable a ticket store on the provider. A
+valid audience-bound access token can then obtain a 30-second, hashed-at-rest,
+single-use ticket from `/oauth2/socket-ticket`:
+
+```ts
+const socketTicketStore = createPostgresSocketTicketStore(db);
+
+await auth({
+	oidc: {
+		// ...normal provider configuration
+		socketTicketStore
+	}
+});
+
+const ticket = await mobile.socketTicket('https://app.example/sync');
+```
+
+Run the `oidc` migration block after upgrading; migration
+`0004_socket_tickets` creates the ticket table. Resource servers may use
+`requireAuthPlugin({ accessTokens: { getUser, oidc } })` to resolve cookie
+sessions and bearer access tokens into the same typed `authPrincipal`. DPoP-
+bound bearer tokens currently fail closed until resource-proof verification is
+enabled.
+
 The defaults use `/oauth2/status`, `/signin`, `reason=session_expired`, and a
 `returnUrl` query parameter. Use `onExpired` when a router or application shell
 should own navigation. The returned guard exposes `check()` for an immediate

package/dist/authContext.d.ts

@@ -3,8 +3,10 @@ import type { AgentAuthConfig } from './agents/config';
 import type { AuditEmitter } from './audit/config';
 import type { AuthorizationConfig } from './authorization/config';
 import type { AuthSessionStore } from './session/types';
-export declare const createAuthContext: <UserType>({ agentAuth, authSessionStore, authorization, emit, seedSource }: {
+import type { AccessTokenPrincipalConfig } from './principal';
+export declare const createAuthContext: <UserType>({ agentAuth, accessTokens, authSessionStore, authorization, emit, seedSource }: {
     agentAuth?: AgentAuthConfig;
+    accessTokens?: AccessTokenPrincipalConfig<UserType>;
     authSessionStore?: AuthSessionStore<UserType>;
     authorization?: AuthorizationConfig<UserType>;
     emit?: AuditEmitter;
@@ -16,13 +18,14 @@ export declare const createAuthContext: <UserType>({ agentAuth, authSessionStore
         unregisteredSession: import("./types").UnregisteredSessionRecord;
     };
     derive: ({
+        readonly authPrincipal: import("./principal").AuthPrincipal<UserType> | undefined;
         readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
             readonly code: "Bad Request";
             readonly message: "Cookies are missing";
         } | {
             readonly code: "Unauthorized";
             readonly message: "User is not authenticated";
-        }) => AuthFailReturn) | undefined) => Promise<import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+        }) => AuthFailReturn) | undefined) => import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
     } & {
         readonly requireRecentAuth: <AuthReturn, AuthFailReturn_1>(maxAgeMs: number, handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
             readonly code: "Unauthorized";
@@ -34,13 +37,14 @@ export declare const createAuthContext: <UserType>({ agentAuth, authSessionStore
             message: "Agent is not authenticated" | "Insufficient agent scopes";
         }) => AuthFailReturn_2 | Promise<AuthFailReturn_2>) => Promise<Response | AuthReturn | NonNullable<Awaited<AuthFailReturn_2>>>;
     }) | ({
+        readonly authPrincipal: import("./principal").AuthPrincipal<UserType> | undefined;
         readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
             readonly code: "Bad Request";
             readonly message: "Cookies are missing";
         } | {
             readonly code: "Unauthorized";
             readonly message: "User is not authenticated";
-        }) => AuthFailReturn) | undefined) => Promise<import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+        }) => AuthFailReturn) | undefined) => import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
     } & {
         readonly requireRecentAuth: <AuthReturn, AuthFailReturn_1>(maxAgeMs: number, handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
             readonly code: "Unauthorized";
@@ -78,13 +82,14 @@ export declare const createAuthContext: <UserType>({ agentAuth, authSessionStore
     macroFn: {};
     parser: {};
     response: import("elysia/types").ExtractErrorFromHandle<{
+        readonly authPrincipal: import("./principal").AuthPrincipal<UserType> | undefined;
         readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
             readonly code: "Bad Request";
             readonly message: "Cookies are missing";
         } | {
             readonly code: "Unauthorized";
             readonly message: "User is not authenticated";
-        }) => AuthFailReturn) | undefined) => Promise<import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+        }) => AuthFailReturn) | undefined) => import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
     }>;
 } & {
     schema: {};

package/dist/cli/migrate.js

@@ -2748,7 +2748,7 @@ var mfaEnrollmentsTable = pgTable9("auth_mfa_enrollments", {
 });
 
 // src/oidc/postgresStores.ts
-import { and as and5, desc as desc6, eq as eq10, gt as gt2, lt as lt3 } from "drizzle-orm";
+import { and as and5, desc as desc6, eq as eq10, gt as gt2, isNull as isNull3, lt as lt3, or as or3, sql as sql2 } from "drizzle-orm";
 import {
   bigint as bigint8,
   boolean as boolean4,
@@ -2869,13 +2869,24 @@ var oauthRefreshTokensTable = pgTable10("auth_oauth_refresh_tokens", {
   audience: varchar10("audience", { length: URL_LENGTH }),
   claims_json: jsonb5("claims_json").$type(),
   client_id: varchar10("client_id", { length: ID_LENGTH8 }).notNull(),
+  consumed_token_hashes: text5("consumed_token_hashes").array().notNull().default([]),
   created_at_ms: bigint8("created_at_ms", { mode: "number" }).notNull(),
   dpop_jkt: varchar10("dpop_jkt", { length: ID_LENGTH8 }),
   expires_at_ms: bigint8("expires_at_ms", { mode: "number" }).notNull(),
+  family_id: varchar10("family_id", { length: ID_LENGTH8 }).notNull(),
+  revoked_at_ms: bigint8("revoked_at_ms", { mode: "number" }),
   scopes: text5("scopes").array().notNull(),
   token_hash: varchar10("token_hash", { length: ID_LENGTH8 }).primaryKey(),
   user_id: varchar10("user_id", { length: ID_LENGTH8 }).notNull()
 });
+var oauthSocketTicketsTable = pgTable10("auth_oauth_socket_tickets", {
+  audience: varchar10("audience", { length: URL_LENGTH }).notNull(),
+  client_id: varchar10("client_id", { length: ID_LENGTH8 }).notNull(),
+  expires_at_ms: bigint8("expires_at_ms", { mode: "number" }).notNull(),
+  scopes: text5("scopes").array().notNull(),
+  subject: varchar10("subject", { length: ID_LENGTH8 }).notNull(),
+  ticket_hash: varchar10("ticket_hash", { length: ID_LENGTH8 }).primaryKey()
+});
 
 // src/organizations/postgresOrganizationStore.ts
 import { and as and6, desc as desc7, eq as eq11 } from "drizzle-orm";
@@ -3220,18 +3231,18 @@ var JOURNAL_DDL = `CREATE TABLE IF NOT EXISTS "auth_migrations" (
 var isJournalRow = (value) => typeof value === "object" && value !== null && typeof Reflect.get(value, "id") === "string";
 var isBlockName = (value) => Object.hasOwn(blockMigrations, value);
 var allBlockNames = () => Object.keys(blockMigrations).filter(isBlockName);
-var applyOne = async (client, id, sql2, log) => {
-  await client.query(sql2);
+var applyOne = async (client, id, sql3, log) => {
+  await client.query(sql3);
   await client.query(`INSERT INTO "auth_migrations" ("id", "applied_at_ms") VALUES ($1, $2)`, [id, Date.now()]);
   log(`apply  ${id}`);
 };
-var runOne = async (client, id, sql2, applied, result, log) => {
+var runOne = async (client, id, sql3, applied, result, log) => {
   if (applied.has(id)) {
     result.skipped.push(id);
     log(`skip   ${id}`);
     return;
   }
-  await applyOne(client, id, sql2, log);
+  await applyOne(client, id, sql3, log);
   result.applied.push(id);
 };
 var runMigrations = async ({
@@ -3315,6 +3326,21 @@ var oidcResourceAudienceMigration = {
   ].join(`
 `)
 };
+var oidcRefreshTokenFamiliesMigration = {
+  id: "0003_refresh_token_families",
+  sql: [
+    'ALTER TABLE "auth_oauth_refresh_tokens" ADD COLUMN IF NOT EXISTS "family_id" varchar(255);',
+    'UPDATE "auth_oauth_refresh_tokens" SET "family_id" = "token_hash" WHERE "family_id" IS NULL;',
+    'ALTER TABLE "auth_oauth_refresh_tokens" ALTER COLUMN "family_id" SET NOT NULL;',
+    'ALTER TABLE "auth_oauth_refresh_tokens" ADD COLUMN IF NOT EXISTS "consumed_token_hashes" text[] NOT NULL DEFAULT ARRAY[]::text[];',
+    'ALTER TABLE "auth_oauth_refresh_tokens" ADD COLUMN IF NOT EXISTS "revoked_at_ms" bigint;'
+  ].join(`
+`)
+};
+var oidcSocketTicketsMigration = {
+  id: "0004_socket_tickets",
+  sql: tablesToInitSql([oauthSocketTicketsTable])
+};
 var sessionOAuthSubjectMigration = {
   id: "0002_oauth_subject",
   sql: [
@@ -3385,9 +3411,12 @@ var blockMigrations = {
         oauthInitialAccessTokensTable,
         oauthLogoutDeliveriesTable,
         oauthPushedAuthorizationRequestsTable,
-        oauthRefreshTokensTable
+        oauthRefreshTokensTable,
+        oauthSocketTicketsTable
       ]).migrations,
-      oidcResourceAudienceMigration
+      oidcResourceAudienceMigration,
+      oidcRefreshTokenFamiliesMigration,
+      oidcSocketTicketsMigration
     ]
   },
   organizations: initMigration("organizations", [
@@ -3606,5 +3635,5 @@ var main = async () => {
 };
 await main();
 
-//# debugId=03868D61AE219DE664756E2164756E21
+//# debugId=3B381D4CCB9C631A64756E2164756E21
 //# sourceMappingURL=migrate.js.map