@absolutejs/auth 0.69.4 → 0.69.5

package/dist/abuse/captcha.d.ts

@@ -0,0 +1,11 @@
+import type { AbuseContext } from './config';
+export declare const verifyHcaptcha: ({ secret }: {
+    secret: string;
+}) => (token: string | undefined, context: AbuseContext) => Promise<boolean>;
+export declare const verifyRecaptcha: ({ minScore, secret }: {
+    minScore?: number;
+    secret: string;
+}) => (token: string | undefined, context: AbuseContext) => Promise<boolean>;
+export declare const verifyTurnstile: ({ secret }: {
+    secret: string;
+}) => (token: string | undefined, context: AbuseContext) => Promise<boolean>;

package/dist/abuse/config.d.ts

@@ -0,0 +1,29 @@
+export type AbuseAction = 'allow' | 'challenge' | 'deny';
+export type AbuseSignal = 'blocked_ip' | 'bot' | 'captcha_failed' | 'not_allowlisted';
+export type BotClass = 'agent' | 'bot' | 'crawler' | 'human';
+export type AbuseContext = {
+    captchaToken?: string;
+    ip?: string;
+    userAgent?: string;
+};
+export type AbuseReason = {
+    action: AbuseAction;
+    signal: AbuseSignal;
+};
+export type AbuseAssessment = {
+    action: AbuseAction;
+    reasons: AbuseReason[];
+};
+export type AbuseConfig = {
+    botAction?: AbuseAction;
+    captchaAction?: AbuseAction;
+    classifyBot?: (context: AbuseContext) => BotClass | Promise<BotClass>;
+    ipAllow?: string[];
+    ipDeny?: string[];
+    verifyCaptcha?: (token: string | undefined, context: AbuseContext) => boolean | Promise<boolean>;
+};
+export declare const assessAbuse: (config: AbuseConfig, context: AbuseContext) => Promise<AbuseAssessment>;
+export declare const createAbuseGuard: (config: AbuseConfig) => {
+    assess: (context: AbuseContext) => Promise<AbuseAssessment>;
+};
+export declare const defaultBotClassifier: (context: AbuseContext) => "bot" | "crawler" | "human";

package/dist/adaptive/config.d.ts

@@ -0,0 +1,34 @@
+import type { KnownDeviceStore, LoginHistoryStore, RiskAction, RiskAssessment, RiskContext, RiskSignal, RiskThresholds, RiskWeights, WeightedRiskAssessment } from './types';
+export type AdaptiveConfig = {
+    historyLimit?: number;
+    knownDeviceStore: KnownDeviceStore;
+    loginHistoryStore: LoginHistoryStore;
+    maxTravelKmh?: number;
+    offHours?: {
+        end: number;
+        start: number;
+    };
+    rules?: Partial<Record<RiskSignal, RiskAction>>;
+    velocityMaxAttempts?: number;
+    velocityWindowMs?: number;
+};
+export declare const assessRisk: (config: AdaptiveConfig, context: RiskContext) => Promise<RiskAssessment>;
+export declare const createRiskEngine: (config: AdaptiveConfig) => {
+    assessRisk: (context: RiskContext) => Promise<RiskAssessment>;
+    recordAttempt: (context: RiskContext & {
+        outcome: RiskAction;
+    }) => Promise<void>;
+    scoreRisk: (context: RiskContext, options?: {
+        thresholds?: RiskThresholds;
+        weights?: RiskWeights;
+    }) => Promise<WeightedRiskAssessment>;
+    trustDevice: (userId: string, deviceId: string, label?: string) => Promise<void>;
+};
+export declare const recordLoginAttempt: (config: AdaptiveConfig, context: RiskContext & {
+    outcome: RiskAction;
+}) => Promise<void>;
+export declare const scoreRisk: (config: AdaptiveConfig & {
+    thresholds?: RiskThresholds;
+    weights?: RiskWeights;
+}, context: RiskContext) => Promise<WeightedRiskAssessment>;
+export declare const trustDevice: (config: AdaptiveConfig, userId: string, deviceId: string, label?: string) => Promise<void>;

package/dist/adaptive/fingerprint.d.ts

@@ -0,0 +1,2 @@
+export type DeviceSignals = Record<string, unknown>;
+export declare const fingerprintDevice: (signals: DeviceSignals) => Promise<string>;

package/dist/adaptive/inMemoryStores.d.ts

@@ -0,0 +1,3 @@
+import type { KnownDeviceStore, LoginHistoryStore } from './types';
+export declare const createInMemoryKnownDeviceStore: () => KnownDeviceStore;
+export declare const createInMemoryLoginHistoryStore: () => LoginHistoryStore;

package/dist/adaptive/postgresStores.d.ts

@@ -0,0 +1,245 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { KnownDeviceStore, LoginHistoryStore } from './types';
+export declare const knownDevicesTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_known_devices";
+    schema: undefined;
+    columns: {
+        device_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_known_devices";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        first_seen_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_known_devices";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        label: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_known_devices";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        last_seen_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_known_devices";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        trusted: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBooleanBuilder>>, {
+            name: string;
+            tableName: "auth_known_devices";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_known_devices";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const loginHistoryTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_login_history";
+    schema: undefined;
+    columns: {
+        attempt_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        country: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        device_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        ip_address: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        latitude: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").PgDoublePrecisionBuilder, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "number double";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        longitude: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").PgDoublePrecisionBuilder, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "number double";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        outcome: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        timestamp_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonKnownDeviceStore: (databaseUrl: string) => KnownDeviceStore;
+export declare const createNeonLoginHistoryStore: (databaseUrl: string) => LoginHistoryStore;
+export declare const createPostgresKnownDeviceStore: <DB extends AnyPgDatabase>(db: DB) => KnownDeviceStore;
+export declare const createPostgresLoginHistoryStore: <DB extends AnyPgDatabase>(db: DB) => LoginHistoryStore;

package/dist/adaptive/types.d.ts

@@ -0,0 +1,62 @@
+export type RiskAction = 'allow' | 'deny' | 'step_up';
+export type RiskSignal = 'impossible_travel' | 'new_country' | 'new_device' | 'off_hours' | 'proxy' | 'velocity';
+export type GeoPoint = {
+    country?: string;
+    latitude?: number;
+    longitude?: number;
+};
+export type RiskContext = {
+    deviceId: string;
+    geo?: GeoPoint;
+    ipAddress?: string;
+    isProxy?: boolean;
+    localHour?: number;
+    now?: number;
+    userId: string;
+};
+export type RiskReason = {
+    action: RiskAction;
+    signal: RiskSignal;
+};
+export type RiskAssessment = {
+    action: RiskAction;
+    reasons: RiskReason[];
+};
+export type RiskWeights = Partial<Record<RiskSignal, number>>;
+export type RiskThresholds = {
+    deny: number;
+    stepUp: number;
+};
+export type WeightedRiskAssessment = {
+    action: RiskAction;
+    reasons: RiskReason[];
+    score: number;
+};
+export type KnownDevice = {
+    deviceId: string;
+    firstSeenAt: number;
+    label?: string;
+    lastSeenAt: number;
+    trusted: boolean;
+    userId: string;
+};
+export type KnownDeviceStore = {
+    findDevice: (userId: string, deviceId: string) => Promise<KnownDevice | undefined>;
+    listDevices: (userId: string) => Promise<KnownDevice[]>;
+    saveDevice: (device: KnownDevice) => Promise<void>;
+};
+export type LoginAttempt = {
+    attemptId: string;
+    country?: string;
+    deviceId: string;
+    ipAddress?: string;
+    latitude?: number;
+    longitude?: number;
+    outcome: RiskAction;
+    timestamp: number;
+    userId: string;
+};
+export type LoginHistoryStore = {
+    listRecent: (userId: string, limit: number) => Promise<LoginAttempt[]>;
+    recordAttempt: (attempt: LoginAttempt) => Promise<void>;
+};

package/dist/agents/idJag.d.ts

@@ -0,0 +1,49 @@
+import { type SigningKey } from '../oidc/keys';
+import type { VerifiedAgentIdentityAssertion } from './types';
+export type AgentIdentityAssertionJtiStore = {
+    /** Atomically records an issuer+jti pair. Returns false for a replay. */
+    recordIfFresh: (issuer: string, jti: string, expiresAt: number) => Promise<boolean>;
+};
+export declare const createInMemoryAgentIdentityAssertionJtiStore: () => AgentIdentityAssertionJtiStore;
+export type AgentIdentityAssertionUser = {
+    authenticatedAt: number;
+    email?: string;
+    emailVerified?: boolean;
+    methods?: string[];
+    name?: string;
+    phoneNumber?: string;
+    phoneNumberVerified?: boolean;
+    subject: string;
+};
+/** Native provider-side ID-JAG issuance. The caller owns the user consent UI
+ * and must authorize the requested audience before invoking this helper. */
+export declare const issueAgentIdentityAssertion: ({ agentContextId, agentPlatform, audience, clientId, issuer, now, resource, signingKey, ttlMs, user }: {
+    agentContextId?: string;
+    agentPlatform?: string;
+    audience: string;
+    clientId: string;
+    issuer: string;
+    now?: number;
+    resource?: string;
+    signingKey: SigningKey;
+    ttlMs?: number;
+    user: AgentIdentityAssertionUser;
+}) => Promise<{
+    assertion: string;
+    assertionType: "urn:ietf:params:oauth:token-type:id-jag";
+    expiresAt: number;
+}>;
+/** Builds a fail-closed service-side verifier. Issuer resolution is injected so
+ * the application can use pinned configuration, CIMD, or an egress-guarded
+ * JWKS resolver without this package performing ambient network access. */
+export declare const createAgentIdentityAssertionVerifier: ({ audience, clockSkewMs, jtiStore, maxAssertionLifetimeMs, maxAuthenticationAgeMs, resolveIssuer }: {
+    audience: string;
+    clockSkewMs?: number;
+    jtiStore: AgentIdentityAssertionJtiStore;
+    maxAssertionLifetimeMs?: number;
+    maxAuthenticationAgeMs?: number;
+    resolveIssuer: (issuer: string) => Promise<{
+        allowedClientIds?: string[];
+        publicJwk: JsonWebKey;
+    } | undefined>;
+}) => (assertion: string, now?: number) => Promise<VerifiedAgentIdentityAssertion | undefined>;

package/dist/agents/inMemoryStores.d.ts

@@ -0,0 +1,4 @@
+import type { AgentDelegationStore, AgentIdentityRegistrationStore, AgentRegistrationStore } from './types';
+export declare const createInMemoryAgentDelegationStore: () => AgentDelegationStore;
+export declare const createInMemoryAgentIdentityRegistrationStore: () => AgentIdentityRegistrationStore;
+export declare const createInMemoryAgentRegistrationStore: () => AgentRegistrationStore;

package/dist/agents/index.d.ts

@@ -0,0 +1,13 @@
+export * from './config';
+export * from './types';
+export * from './registration';
+export * from './registrationClient';
+export * from './idJag';
+export * from './oauthGuide';
+export * from '../oidc/clientIdMetadata';
+export { createOidcAgentCredentialVerifier } from './oidcAdapter';
+export { agentHasScopes, resolveAgentPrincipal } from './principal';
+export { agentAuthChallenge, agentAuthContextPlugin } from './context';
+export { agentAuthPlugin } from './routes';
+export { createInMemoryAgentDelegationStore, createInMemoryAgentIdentityRegistrationStore, createInMemoryAgentRegistrationStore } from './inMemoryStores';
+export { agentDelegationsTable, agentDelegationsBunSqlTable, agentIdentityRegistrationsTable, agentIdentityRegistrationsBunSqlTable, agentRegistrationsTable, agentRegistrationsBunSqlTable, createBunSqlDrizzleAgentDelegationStore, createBunSqlDrizzleAgentIdentityRegistrationStore, createBunSqlDrizzleAgentRegistrationStore, createNeonAgentDelegationStore, createNeonAgentIdentityRegistrationStore, createNeonAgentRegistrationStore, createDrizzleAgentDelegationStore, createPostgresAgentDelegationStore, createPostgresAgentIdentityRegistrationStore, createPostgresAgentRegistrationStore } from './postgresStores';

package/dist/agents/oidcAdapter.d.ts

@@ -0,0 +1,20 @@
+import { type SigningKeyIdentity } from '../oidc/keys';
+import type { AgentCredentialVerifier } from './types';
+type OidcAgentCredentialVerifierKeys = {
+    publicJwk: JsonWebKey;
+    publicKeys?: never;
+} | {
+    publicJwk?: never;
+    publicKeys: readonly SigningKeyIdentity[];
+};
+/** Adapter for Absolute Auth's RFC 9068-style JWT access tokens. It validates
+ * signature, issuer, audience, expiry, and extracts the OAuth client as the
+ * agent identity while retaining `sub` as the authorizing user. */
+export declare const createOidcAgentCredentialVerifier: ({ issuer, isUsedDpopJti, maxDpopAgeMs, publicJwk, publicKeys, requireDpop, resource }: {
+    issuer: string;
+    isUsedDpopJti?: (jti: string) => boolean | Promise<boolean>;
+    maxDpopAgeMs?: number;
+    requireDpop?: boolean;
+    resource: string;
+} & OidcAgentCredentialVerifierKeys) => AgentCredentialVerifier;
+export {};