@absolutejs/auth 0.69.4 → 0.69.6

package/dist/linkedProviders/index.d.ts

@@ -0,0 +1,3 @@
+export { createOAuthAccountLinkedProviderCredentialResolver, type OAuthLinkedProviderAccount, type OAuthLinkedProviderAccountStore } from './oauthAccountResolver';
+export { createOAuthLinkedProviderCredentialResolver } from './oauthResolver';
+export { createLinkedProviderCredentialResolver } from './resolver';

package/dist/lockout/inMemoryLockoutStore.d.ts

@@ -0,0 +1,2 @@
+import type { LockoutStore } from './types';
+export declare const createInMemoryLockoutStore: () => LockoutStore;

package/dist/lockout/postgresLockoutStore.d.ts

@@ -0,0 +1,71 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { LockoutStore } from './types';
+export declare const lockoutsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_lockouts";
+    schema: undefined;
+    columns: {
+        failed_attempts: import("drizzle-orm/pg-core").PgBuildColumn<"auth_lockouts", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgIntegerBuilder>>, {
+            name: string;
+            tableName: "auth_lockouts";
+            dataType: "number int32";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        key: import("drizzle-orm/pg-core").PgBuildColumn<"auth_lockouts", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_lockouts";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        locked_until_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_lockouts", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_lockouts";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        window_started_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_lockouts", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_lockouts";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonLockoutStore: (databaseUrl: string) => LockoutStore;
+export declare const createPostgresLockoutStore: <DB extends AnyPgDatabase>(db: DB) => LockoutStore;

package/dist/lockout/redisLockoutStore.d.ts

@@ -0,0 +1,3 @@
+import type { RedisLike } from '../stores/redis';
+import type { LockoutStore } from './types';
+export declare const createRedisLockoutStore: (redis: RedisLike, keyPrefix?: string) => LockoutStore;

package/dist/manifest.d.ts

@@ -0,0 +1,19 @@
+import { Type } from 'typebox';
+import type { AuthConfig } from './types';
+export declare const manifest: Omit<import("@absolutejs/manifest").PackageManifest<AuthConfig<unknown>, never>, "contract" | "settings" | "tools"> & (({
+    contract: 1;
+    tools?: Record<string, import("@absolutejs/manifest").LegacyManifestTool<never>> | undefined;
+} | {
+    contract: 2;
+    tools?: Record<string, import("@absolutejs/manifest").AuthorizedManifestTool<never>> | undefined;
+}) & {
+    settings: Type.TObject<{
+        cleanupIntervalMs: Type.TOptional<Type.TNumber>;
+        cookieSecure: Type.TOptional<Type.TBoolean>;
+        maxSessions: Type.TOptional<Type.TInteger>;
+        providersConfiguration: Type.TOptional<Type.TRecord<"^.*$", Type.TObject<{
+            scope: Type.TOptional<Type.TArray<Type.TString>>;
+        }>>>;
+        sessionDurationMs: Type.TOptional<Type.TNumber>;
+    }>;
+});

package/dist/manifest.json

@@ -0,0 +1,386 @@
+{
+	"contract": 2,
+	"discovery": {
+		"audiences": [
+			"applications",
+			"agent-hosts"
+		],
+		"intents": [
+			"authenticate people and agents",
+			"issue scoped agent delegations",
+			"publish OAuth discovery"
+		],
+		"keywords": [
+			"auth",
+			"oauth",
+			"oidc",
+			"agents",
+			"delegation",
+			"device-flow"
+		],
+		"protocols": [
+			"OAuth 2.0",
+			"OpenID Connect",
+			"ID-JAG"
+		]
+	},
+	"identity": {
+		"accent": "#6366f1",
+		"category": "auth",
+		"description": "OAuth/OIDC sign-in for people and AI agents, including open auth.md registration, scoped delegation, agent account linking, 60+ providers, passkeys, MFA, enterprise SSO/SCIM, organizations, roles, and API keys.",
+		"docsUrl": "https://github.com/absolutejs/auth",
+		"name": "@absolutejs/auth",
+		"tagline": "Let people and agents create accounts and sign in."
+	},
+	"implements": [
+		{
+			"contract": "auth/session-store",
+			"factory": "createNeonAuthSessionStore",
+			"from": "@absolutejs/auth",
+			"requires": {
+				"env": [
+					{
+						"description": "Postgres connection string",
+						"example": "postgres://user:pass@host/db",
+						"key": "DATABASE_URL",
+						"secret": true
+					}
+				]
+			},
+			"title": "Your Postgres database (recommended)",
+			"wiring": {
+				"code": "createNeonAuthSessionStore(${env.DATABASE_URL} ?? \"\", decodeSessionUserRecord)",
+				"imports": [
+					{
+						"from": "@absolutejs/auth",
+						"names": [
+							"createNeonAuthSessionStore",
+							"decodeSessionUserRecord"
+						]
+					}
+				]
+			}
+		},
+		{
+			"contract": "auth/session-store",
+			"factory": "createInMemoryAuthSessionStore",
+			"from": "@absolutejs/auth",
+			"title": "In memory (development only — sign-ins reset on restart)",
+			"wiring": {
+				"code": "createInMemoryAuthSessionStore()",
+				"imports": [
+					{
+						"from": "@absolutejs/auth",
+						"names": [
+							"createInMemoryAuthSessionStore"
+						]
+					}
+				]
+			}
+		}
+	],
+	"lifecycle": [
+		{
+			"command": "bunx absolute-auth migrate",
+			"id": "migrate",
+			"idempotent": true,
+			"kind": "migration",
+			"title": "Set up the sign-in tables in your database",
+			"when": "after-install"
+		},
+		{
+			"command": "bunx absolute-auth migrate",
+			"id": "migrate-upgrade",
+			"idempotent": true,
+			"kind": "migration",
+			"title": "Apply new sign-in tables after upgrading",
+			"when": "after-upgrade"
+		}
+	],
+	"presets": [
+		{
+			"id": "social-login",
+			"title": "Social login (Google + GitHub)",
+			"values": {
+				"providersConfiguration": {
+					"github": {},
+					"google": {}
+				}
+			}
+		}
+	],
+	"requires": {
+		"env": [
+			{
+				"description": "Postgres connection string (sign-in tables live here)",
+				"example": "postgres://user:pass@host/db",
+				"key": "DATABASE_URL",
+				"secret": true
+			},
+			{
+				"description": "Absolutejs OAuth client id",
+				"docsUrl": "https://absolutejs.ai/dashboard",
+				"key": "ABSOLUTEJS_CLIENT_ID",
+				"when": "providersConfiguration.absolutejs"
+			},
+			{
+				"description": "Absolutejs OAuth client secret",
+				"docsUrl": "https://absolutejs.ai/dashboard",
+				"key": "ABSOLUTEJS_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.absolutejs"
+			},
+			{
+				"description": "Discord OAuth client id",
+				"docsUrl": "https://discord.com/developers/applications",
+				"key": "DISCORD_CLIENT_ID",
+				"when": "providersConfiguration.discord"
+			},
+			{
+				"description": "Discord OAuth client secret",
+				"docsUrl": "https://discord.com/developers/applications",
+				"key": "DISCORD_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.discord"
+			},
+			{
+				"description": "Facebook OAuth client id",
+				"docsUrl": "https://developers.facebook.com/apps",
+				"key": "FACEBOOK_CLIENT_ID",
+				"when": "providersConfiguration.facebook"
+			},
+			{
+				"description": "Facebook OAuth client secret",
+				"docsUrl": "https://developers.facebook.com/apps",
+				"key": "FACEBOOK_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.facebook"
+			},
+			{
+				"description": "Github OAuth client id",
+				"docsUrl": "https://github.com/settings/developers",
+				"key": "GITHUB_CLIENT_ID",
+				"when": "providersConfiguration.github"
+			},
+			{
+				"description": "Github OAuth client secret",
+				"docsUrl": "https://github.com/settings/developers",
+				"key": "GITHUB_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.github"
+			},
+			{
+				"description": "Google OAuth client id",
+				"docsUrl": "https://console.cloud.google.com/apis/credentials",
+				"key": "GOOGLE_CLIENT_ID",
+				"when": "providersConfiguration.google"
+			},
+			{
+				"description": "Google OAuth client secret",
+				"docsUrl": "https://console.cloud.google.com/apis/credentials",
+				"key": "GOOGLE_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.google"
+			},
+			{
+				"description": "Linkedin OAuth client id",
+				"docsUrl": "https://www.linkedin.com/developers/apps",
+				"key": "LINKEDIN_CLIENT_ID",
+				"when": "providersConfiguration.linkedin"
+			},
+			{
+				"description": "Linkedin OAuth client secret",
+				"docsUrl": "https://www.linkedin.com/developers/apps",
+				"key": "LINKEDIN_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.linkedin"
+			},
+			{
+				"description": "Microsoft OAuth client id",
+				"docsUrl": "https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade",
+				"key": "MICROSOFT_CLIENT_ID",
+				"when": "providersConfiguration.microsoft"
+			},
+			{
+				"description": "Microsoft OAuth client secret",
+				"docsUrl": "https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade",
+				"key": "MICROSOFT_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.microsoft"
+			},
+			{
+				"description": "Slack OAuth client id",
+				"docsUrl": "https://api.slack.com/apps",
+				"key": "SLACK_CLIENT_ID",
+				"when": "providersConfiguration.slack"
+			},
+			{
+				"description": "Slack OAuth client secret",
+				"docsUrl": "https://api.slack.com/apps",
+				"key": "SLACK_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.slack"
+			},
+			{
+				"description": "Spotify OAuth client id",
+				"docsUrl": "https://developer.spotify.com/dashboard",
+				"key": "SPOTIFY_CLIENT_ID",
+				"when": "providersConfiguration.spotify"
+			},
+			{
+				"description": "Spotify OAuth client secret",
+				"docsUrl": "https://developer.spotify.com/dashboard",
+				"key": "SPOTIFY_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.spotify"
+			},
+			{
+				"description": "Twitch OAuth client id",
+				"docsUrl": "https://dev.twitch.tv/console/apps",
+				"key": "TWITCH_CLIENT_ID",
+				"when": "providersConfiguration.twitch"
+			},
+			{
+				"description": "Twitch OAuth client secret",
+				"docsUrl": "https://dev.twitch.tv/console/apps",
+				"key": "TWITCH_CLIENT_SECRET",
+				"secret": true,
+				"when": "providersConfiguration.twitch"
+			}
+		],
+		"peers": [
+			{
+				"name": "elysia",
+				"range": ">=1.0",
+				"reason": "plugin host"
+			}
+		],
+		"services": [
+			{
+				"description": "Stores accounts, sessions, and audit events",
+				"id": "postgres"
+			}
+		]
+	},
+	"settings": {
+		"type": "object",
+		"properties": {
+			"cleanupIntervalMs": {
+				"type": "number",
+				"description": "How often expired sessions are swept, in milliseconds.",
+				"minimum": 1000,
+				"title": "Session cleanup interval",
+				"x-group": "advanced"
+			},
+			"cookieSecure": {
+				"type": "boolean",
+				"description": "Only send the sign-in cookie over HTTPS. Leave off in local development.",
+				"title": "HTTPS-only cookies",
+				"x-group": "advanced"
+			},
+			"maxSessions": {
+				"type": "integer",
+				"description": "How many devices someone can stay signed in on at once.",
+				"minimum": 1,
+				"title": "Signed-in devices per person",
+				"x-group": "sessions"
+			},
+			"providersConfiguration": {
+				"type": "object",
+				"patternProperties": {
+					"^.*$": {
+						"type": "object",
+						"properties": {
+							"scope": {
+								"type": "array",
+								"items": {
+									"type": "string"
+								},
+								"description": "Extra permissions to request from the provider.",
+								"title": "Permissions"
+							}
+						}
+					}
+				},
+				"description": "Which services people can sign in with. Each needs a client id and secret from that provider.",
+				"title": "Sign-in providers",
+				"x-group": "providers"
+			},
+			"sessionDurationMs": {
+				"type": "number",
+				"description": "How long someone stays signed in, in milliseconds. Default is 7 days.",
+				"minimum": 60000,
+				"title": "Stay signed in for",
+				"x-group": "sessions"
+			}
+		}
+	},
+	"slots": {
+		"sessionStore": {
+			"configPath": "authSessionStore",
+			"contract": "auth/session-store",
+			"description": "Where live sign-in sessions are kept",
+			"known": [
+				"@absolutejs/auth#postgres",
+				"@absolutejs/auth#memory"
+			],
+			"required": true
+		},
+		"verificationProvider": {
+			"configPath": "verificationProvider",
+			"contract": "auth/verification-provider",
+			"description": "Provider-managed phone verification for MFA and future passwordless flows",
+			"known": [
+				"@absolutejs/auth-twilio"
+			],
+			"required": false
+		}
+	},
+	"wiring": [
+		{
+			"description": "Sign in with Google, GitHub, and 60+ other services. Add email/password later from settings.",
+			"id": "default",
+			"server": {
+				"code": ".use(\n\tawait auth({\n\t\t// TODO: return your application user for a session subject.\n\t\tgetUser: (sub) => ({ sub }),\n\t\tauthSessionStore: ${slot.sessionStore},\n\t\tcookieSecure: ${settings.cookieSecure},\n\t\tmaxSessions: ${settings.maxSessions},\n\t\tprovidersConfiguration: providersFromEnv(${settings.providersConfiguration} ?? {}),\n\t\tsessionDurationMs: ${settings.sessionDurationMs}\n\t})\n)",
+				"imports": [
+					{
+						"from": "@absolutejs/auth",
+						"names": [
+							"auth",
+							"providersFromEnv"
+						]
+					}
+				],
+				"placement": "server-plugin"
+			},
+			"title": "Social sign-in (OAuth)"
+		}
+	],
+	"tools": {
+		"list_sign_in_providers": {
+			"annotations": {
+				"readOnlyHint": true
+			},
+			"authorization": {
+				"approval": "never",
+				"audience": "admin",
+				"effects": [
+					"read"
+				],
+				"requiredScopes": [
+					"auth:inspect"
+				]
+			},
+			"capabilities": [
+				"read",
+				"glob"
+			],
+			"description": "List which sign-in providers this project has configured, and which are missing credentials.",
+			"input": {
+				"type": "object",
+				"properties": {}
+			},
+			"kind": "workspace"
+		}
+	}
+}