@absolutejs/auth 0.68.2 → 0.69.1

package/dist/oidc/nativeClients.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthClientStore } from './types';
+export declare const ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV: "ABSOLUTE_AUTH_NATIVE_CLIENTS";
+export type AbsoluteNativeAuthClient = {
+    clientId: string;
+    issuer: string;
+    name: string;
+    redirectUri: string;
+    scopes: string[];
+};
+export declare const parseAbsoluteNativeAuthClients: (source?: string | undefined) => AbsoluteNativeAuthClient[];
+export declare const withAbsoluteNativeAuthClients: (clientStore: OAuthClientStore, issuer: string, clients?: AbsoluteNativeAuthClient[]) => OAuthClientStore;

package/dist/oidc/postgresStores.d.ts

@@ -1,5 +1,5 @@
 import { type AnyPgDatabase } from '../stores/postgres';
-import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
+import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore, SocketTicketStore } from './types';
 export declare const oauthBackchannelAuthRequestsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_oauth_backchannel_auth_requests";
     schema: undefined;
@@ -1102,6 +1102,21 @@ export declare const oauthRefreshTokensTable: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }>;
+        consumed_token_hashes: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_refresh_tokens", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").SetDimensions<import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, 1>>>, {
+            name: string;
+            tableName: "auth_oauth_refresh_tokens";
+            dataType: "string";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_refresh_tokens", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
             name: string;
             tableName: "auth_oauth_refresh_tokens";
@@ -1147,6 +1162,36 @@ export declare const oauthRefreshTokensTable: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }>;
+        family_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_refresh_tokens", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_oauth_refresh_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        revoked_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_refresh_tokens", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_oauth_refresh_tokens";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         scopes: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_refresh_tokens", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").SetDimensions<import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, 1>>, {
             name: string;
             tableName: "auth_oauth_refresh_tokens";
@@ -1195,6 +1240,103 @@ export declare const oauthRefreshTokensTable: import("drizzle-orm/pg-core").PgTa
     };
     dialect: "pg";
 }>;
+export declare const oauthSocketTicketsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_oauth_socket_tickets";
+    schema: undefined;
+    columns: {
+        audience: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_socket_tickets", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_oauth_socket_tickets";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        client_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_socket_tickets", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_oauth_socket_tickets";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_socket_tickets", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_oauth_socket_tickets";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        scopes: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_socket_tickets", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").SetDimensions<import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, 1>>, {
+            name: string;
+            tableName: "auth_oauth_socket_tickets";
+            dataType: "string";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        subject: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_socket_tickets", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_oauth_socket_tickets";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        ticket_hash: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_socket_tickets", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_oauth_socket_tickets";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
 export declare const createNeonAuthorizationCodeStore: (databaseUrl: string) => AuthorizationCodeStore;
 export declare const createNeonClientAssertionJtiStore: (databaseUrl: string) => ClientAssertionJtiStore;
 export declare const createNeonClientRegistrationTokenStore: (databaseUrl: string) => ClientRegistrationTokenStore;
@@ -1215,3 +1357,5 @@ export declare const createPostgresOidcRefreshTokenStore: <DB extends AnyPgDatab
 export declare const createPostgresPushedAuthorizationRequestStore: <DB extends AnyPgDatabase>(db: DB) => PushedAuthorizationRequestStore;
 export declare const createNeonBackchannelAuthStore: (databaseUrl: string) => BackchannelAuthStore;
 export declare const createPostgresBackchannelAuthStore: <DB extends AnyPgDatabase>(db: DB) => BackchannelAuthStore;
+export declare const createNeonSocketTicketStore: (databaseUrl: string) => SocketTicketStore;
+export declare const createPostgresSocketTicketStore: <DB extends AnyPgDatabase>(db: DB) => SocketTicketStore;

package/dist/oidc/socketTicketRoutes.d.ts

@@ -0,0 +1,7 @@
+import { Elysia } from 'elysia';
+import { type OidcProviderConfig } from './config';
+/** Isolated plugin keeps the already-large provider route type from expanding
+ * for applications that do not enable socket tickets. */
+type SocketTicketRoutes = <UserType>(config: OidcProviderConfig<UserType>) => Elysia;
+export declare const socketTicketRoutes: SocketTicketRoutes;
+export {};

package/dist/oidc/socketTickets.d.ts

@@ -0,0 +1,21 @@
+import type { AuthPrincipal } from '../principal';
+import type { SocketTicketStore } from './types';
+export declare const consumeSocketTicket: <UserType>({ audience, getUser, now, store, ticket }: {
+    audience: string;
+    getUser: (subject: string) => Promise<UserType | null> | UserType | null;
+    now?: number;
+    store: SocketTicketStore;
+    ticket: string;
+}) => Promise<AuthPrincipal<UserType> | undefined>;
+export declare const issueSocketTicket: ({ audience, clientId, now, scopes, store, subject, ttlMs }: {
+    audience: string;
+    clientId: string;
+    now?: number;
+    scopes: string[];
+    store: SocketTicketStore;
+    subject: string;
+    ttlMs?: number;
+}) => Promise<{
+    expiresInMs: number;
+    ticket: string;
+}>;

package/dist/oidc/types.d.ts

@@ -78,6 +78,8 @@ export type OidcRefreshToken = {
     createdAt: number;
     dpopJkt?: string;
     expiresAt: number;
+    /** Stable identifier shared by every rotation descendant of one grant. */
+    familyId: string;
     scopes: string[];
     tokenHash: string;
     userId: string;
@@ -94,8 +96,26 @@ export type OidcRefreshTokenStore = {
     getToken: (tokenHash: string) => Promise<OidcRefreshToken | undefined>;
     listClientIdsForUser: (userId: string) => Promise<string[]>;
     listConnections: () => Promise<OidcRefreshTokenConnection[]>;
+    /** Revoke a family when a previously consumed token is presented again. */
+    revokeByConsumedToken: (tokenHash: string) => Promise<boolean>;
+    /** Atomically replace the active family token, or revoke on detected reuse. */
+    rotateToken: (currentTokenHash: string, replacement: OidcRefreshToken) => Promise<boolean>;
     saveToken: (token: OidcRefreshToken) => Promise<void>;
 };
+/** Server-side record for a short-lived, one-time WebSocket bootstrap ticket. */
+export type SocketTicket = {
+    audience: string;
+    clientId: string;
+    expiresAt: number;
+    scopes: string[];
+    subject: string;
+    ticketHash: string;
+};
+export type SocketTicketStore = {
+    /** Atomically delete and return a ticket. Expired tickets return undefined. */
+    consumeTicket: (ticketHash: string, now?: number) => Promise<SocketTicket | undefined>;
+    saveTicket: (ticket: SocketTicket) => Promise<void>;
+};
 export type DeviceAuthorizationStatus = 'approved' | 'denied' | 'pending';
 export type DeviceAuthorization = {
     clientId: string;

package/dist/principal.d.ts

@@ -0,0 +1,39 @@
+import type { OidcProviderConfig } from './oidc/config';
+export type AuthPrincipal<UserType> = {
+    kind: 'access-token';
+    audience: string;
+    clientId: string;
+    scopes: string[];
+    subject: string;
+    user: UserType;
+} | {
+    kind: 'session';
+    subject: string;
+    user: UserType;
+};
+export type AccessTokenPrincipalConfig<UserType> = {
+    audience?: string;
+    getUser: (subject: string) => Promise<UserType | null> | UserType | null;
+    oidc: OidcProviderConfig<UserType>;
+};
+export type VerifiedAccessToken = {
+    audience: string;
+    clientId: string;
+    scopes: string[];
+    subject: string;
+};
+/** Resolve a mobile/public-client access token into the same typed application
+ * user carried by a browser session. DPoP-bound tokens fail closed until the
+ * resource proof verifier is enabled in the next hardening phase. */
+export declare const resolveAccessTokenPrincipal: <UserType>({ authorization, config, now }: {
+    authorization?: string;
+    config: AccessTokenPrincipalConfig<UserType>;
+    now?: number;
+}) => Promise<AuthPrincipal<UserType> | undefined>;
+/** Verify an Absolute OAuth access token without resolving its application user. */
+export declare const verifyOidcAccessToken: <UserType>({ authorization, audience, now, oidc }: {
+    authorization?: string;
+    audience?: string;
+    now?: number;
+    oidc: OidcProviderConfig<UserType>;
+}) => Promise<VerifiedAccessToken | undefined>;

package/dist/routes/protectRoute.d.ts

@@ -1,5 +1,6 @@
 import { Elysia } from 'elysia';
 import type { AuthSessionSource } from '../session/types';
+import { type AccessTokenPrincipalConfig, type AuthPrincipal } from '../principal';
 type AuthFailError = {
     readonly code: 'Bad Request';
     readonly message: 'Cookies are missing';
@@ -7,7 +8,8 @@ type AuthFailError = {
     readonly code: 'Unauthorized';
     readonly message: 'User is not authenticated';
 };
-export declare const protectRoutePlugin: <UserType>({ authSessionStore }?: {
+export declare const protectRoutePlugin: <UserType>({ accessTokens, authSessionStore }?: {
+    accessTokens?: AccessTokenPrincipalConfig<UserType>;
     authSessionStore?: AuthSessionSource<UserType>;
 }) => Elysia<"", "local", {
     decorator: {};
@@ -16,7 +18,8 @@ export declare const protectRoutePlugin: <UserType>({ authSessionStore }?: {
         unregisteredSession: import("..").UnregisteredSessionRecord;
     };
     derive: {
-        readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AuthFailError) => AuthFailReturn) => Promise<import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+        readonly authPrincipal: AuthPrincipal<UserType> | undefined;
+        readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AuthFailError) => AuthFailReturn) => import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
     };
 }, {
     typebox: {};
@@ -33,7 +36,8 @@ export declare const protectRoutePlugin: <UserType>({ authSessionStore }?: {
     macroFn: {};
     parser: {};
     response: import("elysia/types").ExtractErrorFromHandle<{
-        readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AuthFailError) => AuthFailReturn) => Promise<import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+        readonly authPrincipal: AuthPrincipal<UserType> | undefined;
+        readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AuthFailError) => AuthFailReturn) => import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
     }>;
 }, {}, import("elysia/types").DefaultEphemeral, import("elysia/types").DefaultEphemeral>;
 export {};

package/dist/routes/requireAuth.d.ts

@@ -1,6 +1,8 @@
 import { Elysia } from 'elysia';
 import type { AuthSessionSource } from '../session/types';
-export declare const requireAuthPlugin: <UserType>({ authSessionStore }?: {
+import { type AccessTokenPrincipalConfig, type AuthPrincipal } from '../principal';
+export declare const requireAuthPlugin: <UserType>({ accessTokens, authSessionStore }?: {
+    accessTokens?: AccessTokenPrincipalConfig<UserType>;
     authSessionStore?: AuthSessionSource<UserType>;
 }) => Elysia<"", "local", {
     decorator: {};
@@ -9,6 +11,7 @@ export declare const requireAuthPlugin: <UserType>({ authSessionStore }?: {
         unregisteredSession: import("..").UnregisteredSessionRecord;
     };
     derive: {
+        readonly authPrincipal: AuthPrincipal<UserType> | undefined;
         readonly user: NonNullable<UserType> | null;
     };
 }, {