@absolutejs/auth 0.76.3 → 0.77.1

package/dist/routes/protectRoute.d.ts

@@ -1,4 +1,4 @@
-import { Elysia } from 'elysia';
+import { Elysia, StatusMap, type ElysiaStatus } from 'elysia';
 import type { AuthSessionSource } from '../session/types';
 import { type AccessTokenPrincipalConfig, type AuthPrincipal } from '../principal';
 type AuthFailError = {
@@ -8,6 +8,11 @@ type AuthFailError = {
     readonly code: 'Unauthorized';
     readonly message: 'User is not authenticated';
 };
+type AuthFailureResponse = ElysiaStatus<'Bad Request', 'Cookies are missing', (typeof StatusMap)['Bad Request']> | ElysiaStatus<'Unauthorized', 'User is not authenticated', (typeof StatusMap)['Unauthorized']>;
+type ProtectRoute<UserType> = {
+    <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => Promise<AuthReturn>, handleAuthFail?: (error: AuthFailError) => AuthFailReturn): Promise<AuthFailureResponse | AuthReturn | Awaited<AuthFailReturn>>;
+    <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn, handleAuthFail?: (error: AuthFailError) => AuthFailReturn): Promise<AuthFailureResponse | AuthReturn | Awaited<AuthFailReturn>>;
+};
 export declare const protectRoutePlugin: <UserType>({ accessTokens, authSessionStore }?: {
     accessTokens?: AccessTokenPrincipalConfig<UserType>;
     authSessionStore?: AuthSessionSource<UserType>;
@@ -18,8 +23,21 @@ export declare const protectRoutePlugin: <UserType>({ accessTokens, authSessionS
         unregisteredSession: import("..").UnregisteredSessionRecord;
     };
     derive: {
+        readonly absoluteAuthStatus: {
+            error: {
+                readonly code: "Bad Request";
+                readonly message: "Cookies are missing";
+            };
+            user: null;
+            impersonator?: undefined;
+        } | {
+            error: null;
+            impersonator: import("..").Impersonator | undefined;
+            user: NonNullable<UserType> | null;
+        };
         readonly authPrincipal: AuthPrincipal<UserType> | undefined;
-        readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AuthFailError) => AuthFailReturn) => import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
+    } & {
+        readonly protectRoute: ProtectRoute<UserType>;
     };
 }, {
     typebox: {};
@@ -36,8 +54,7 @@ export declare const protectRoutePlugin: <UserType>({ accessTokens, authSessionS
     macroFn: {};
     parser: {};
     response: import("elysia/types").ExtractErrorFromHandle<{
-        readonly authPrincipal: AuthPrincipal<UserType> | undefined;
-        readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AuthFailError) => AuthFailReturn) => import("elysia").ElysiaStatus<"Unauthorized", "User is not authenticated", 401> | import("elysia").ElysiaStatus<"Bad Request", "Cookies are missing", 400> | AuthReturn | Promise<AuthReturn> | NonNullable<AuthFailReturn>;
+        readonly protectRoute: ProtectRoute<UserType>;
     }>;
 }, {}, import("elysia/types").DefaultEphemeral, import("elysia/types").DefaultEphemeral>;
 export {};

package/dist/routes/stepUp.d.ts

@@ -1,9 +1,14 @@
-import { Elysia } from 'elysia';
+import { Elysia, StatusMap, type ElysiaStatus } from 'elysia';
 import type { AuthSessionSource } from '../session/types';
 type ReauthFailError = {
     readonly code: 'Unauthorized';
     readonly message: 'Recent authentication required';
 };
+type ReauthFailureResponse = ElysiaStatus<'Unauthorized', 'Recent authentication required', (typeof StatusMap)['Unauthorized']>;
+type RequireRecentAuth<UserType> = {
+    <AuthReturn, AuthFailReturn = never>(maxAgeMs: number, handleAuth: (user: UserType) => Promise<AuthReturn>, handleAuthFail?: (error: ReauthFailError) => AuthFailReturn): Promise<ReauthFailureResponse | AuthReturn | Awaited<AuthFailReturn>>;
+    <AuthReturn, AuthFailReturn = never>(maxAgeMs: number, handleAuth: (user: UserType) => AuthReturn, handleAuthFail?: (error: ReauthFailError) => AuthFailReturn): Promise<ReauthFailureResponse | AuthReturn | Awaited<AuthFailReturn>>;
+};
 export declare const stepUpPlugin: <UserType>({ authSessionStore }?: {
     authSessionStore?: AuthSessionSource<UserType>;
 }) => Elysia<"", "local", {
@@ -13,7 +18,7 @@ export declare const stepUpPlugin: <UserType>({ authSessionStore }?: {
         unregisteredSession: import("..").UnregisteredSessionRecord;
     };
     derive: {
-        readonly requireRecentAuth: <AuthReturn, AuthFailReturn>(maxAgeMs: number, handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: ReauthFailError) => AuthFailReturn) => Promise<AuthReturn | import("elysia").ElysiaStatus<"Unauthorized", "Recent authentication required", 401> | NonNullable<AuthFailReturn>>;
+        readonly requireRecentAuth: RequireRecentAuth<UserType>;
     };
 }, {
     typebox: {};
@@ -30,7 +35,7 @@ export declare const stepUpPlugin: <UserType>({ authSessionStore }?: {
     macroFn: {};
     parser: {};
     response: import("elysia/types").ExtractErrorFromHandle<{
-        readonly requireRecentAuth: <AuthReturn, AuthFailReturn>(maxAgeMs: number, handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: ReauthFailError) => AuthFailReturn) => Promise<AuthReturn | import("elysia").ElysiaStatus<"Unauthorized", "Recent authentication required", 401> | NonNullable<AuthFailReturn>>;
+        readonly requireRecentAuth: RequireRecentAuth<UserType>;
     }>;
 }, {}, import("elysia/types").DefaultEphemeral, import("elysia/types").DefaultEphemeral>;
 export {};

package/dist/server.js

@@ -4368,8 +4368,8 @@ var failureResponse = (config, failure, requiredScopes) => new Response(JSON.str
 var agentAuthContextPlugin = (config) => new Elysia2({
   name: "@absolutejs/auth/agent-context",
   seed: pluginDependencySeed(config)
-}).derive(({ request }) => ({
-  protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
+}).derive(({ request }) => {
+  const protectAgent = async (requiredScopes, handleAuth, handleAuthFail) => {
     if (config === undefined) {
       const failure = {
         code: "Unauthorized",
@@ -4395,8 +4395,9 @@ var agentAuthContextPlugin = (config) => new Elysia2({
       return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
     }
     return handleAuth(principal);
-  }
-})).as("global");
+  };
+  return { protectAgent };
+}).as("global");
 
 // src/agents/oauthGuide.ts
 var DEFAULT_GUIDE_ROUTE = "/auth.md";
@@ -5607,17 +5608,17 @@ var protectPermissionPlugin = ({
 }).use(sessionStore()).guard({
   cookie: t3.Cookie({ user_session_id: userSessionIdTypebox }),
   schema: "merge"
-}).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
-  protectPermission: (check, handleAuth, handleAuthFail) => getStatusFromSource({
+}).derive(({ store: { session }, cookie: { user_session_id }, status }) => {
+  const protectPermission = (check, handleAuth, handleAuthFail) => getStatusFromSource({
     authSessionStore,
     session,
     user_session_id
   }).then(async ({ user, error }) => {
     if (error) {
-      return handleAuthFail?.(error) ?? status(error.code, error.message);
+      return await handleAuthFail?.(error) ?? status(error.code, error.message);
     }
     if (!user) {
-      return handleAuthFail?.({
+      return await handleAuthFail?.({
         code: "Unauthorized",
         message: "User is not authenticated"
       }) ?? status("Unauthorized", "User is not authenticated");
@@ -5634,14 +5635,15 @@ var protectPermissionPlugin = ({
         organizationId: check.organizationId,
         type: "authorization_denied"
       });
-      return handleAuthFail?.({
+      return await handleAuthFail?.({
         code: "Forbidden",
         message: "Insufficient permissions"
       }) ?? status("Forbidden", "Insufficient permissions");
     }
     return handleAuth(user);
-  })
-})).as("global");
+  });
+  return { protectPermission };
+}).as("global");
 
 // src/routes/protectRoute.ts
 import { Elysia as Elysia6, t as t4 } from "elysia";
@@ -5705,8 +5707,7 @@ var protectRoutePlugin = ({
 }).derive(async ({
   store: { session },
   cookie: { user_session_id },
-  headers,
-  status
+  headers
 }) => {
   const sessionStatus = await getStatusFromSource({
     authSessionStore,
@@ -5725,25 +5726,30 @@ var protectRoutePlugin = ({
       authorization: headers.authorization,
       config: accessTokens
     });
-  return {
-    authPrincipal,
-    protectRoute: (handleAuth, handleAuthFail) => {
-      const user = authPrincipal?.user;
-      const { error } = sessionStatus;
-      if (error) {
-        if (user)
-          return handleAuth(user);
-        return handleAuthFail?.(error) ?? status(error.code, error.message);
-      }
-      if (!user) {
-        return handleAuthFail?.({
-          code: "Unauthorized",
-          message: "User is not authenticated"
-        }) ?? status("Unauthorized", "User is not authenticated");
-      }
-      return handleAuth(user);
+  return { absoluteAuthStatus: sessionStatus, authPrincipal };
+}).derive(({ absoluteAuthStatus, authPrincipal, status }) => {
+  const protectRoute = async (handleAuth, handleAuthFail) => {
+    if (!absoluteAuthStatus)
+      return await handleAuthFail?.({
+        code: "Unauthorized",
+        message: "User is not authenticated"
+      }) ?? status("Unauthorized", "User is not authenticated");
+    const user = authPrincipal?.user;
+    const { error } = absoluteAuthStatus;
+    if (error) {
+      if (user)
+        return handleAuth(user);
+      return await handleAuthFail?.(error) ?? status(error.code, error.message);
     }
+    if (!user) {
+      return await handleAuthFail?.({
+        code: "Unauthorized",
+        message: "User is not authenticated"
+      }) ?? status("Unauthorized", "User is not authenticated");
+    }
+    return handleAuth(user);
   };
+  return { protectRoute };
 }).as("global");
 
 // src/routes/stepUp.ts
@@ -5756,23 +5762,24 @@ var stepUpPlugin = ({
 }).use(sessionStore()).guard({
   cookie: t5.Cookie({ user_session_id: userSessionIdTypebox }),
   schema: "merge"
-}).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
-  requireRecentAuth: (maxAgeMs, handleAuth, handleAuthFail) => loadSessionFromSource({
+}).derive(({ store: { session }, cookie: { user_session_id }, status }) => {
+  const requireRecentAuth = (maxAgeMs, handleAuth, handleAuthFail) => loadSessionFromSource({
     authSessionStore,
     session,
     userSessionId: user_session_id.value
-  }).then((userSession) => {
+  }).then(async (userSession) => {
     const authenticatedAt = userSession?.authenticatedAt;
     const isRecent = authenticatedAt !== undefined && Date.now() - authenticatedAt <= maxAgeMs;
     if (!userSession || !isRecent) {
-      return handleAuthFail?.({
+      return await handleAuthFail?.({
         code: "Unauthorized",
         message: "Recent authentication required"
       }) ?? status("Unauthorized", "Recent authentication required");
     }
     return handleAuth(userSession.user);
-  })
-})).as("global");
+  });
+  return { requireRecentAuth };
+}).as("global");
 
 // src/oidc/socketTickets.ts
 init_crypto();
@@ -8210,7 +8217,10 @@ var mfaTotpRoutes = ({
     verified: false
   };
   const factors = getMfaFactors(base).filter((existingFactor) => existingFactor.type !== "totp" || existingFactor.verified);
-  await mfaStore.saveEnrollment(withMfaFactors({ ...base, updatedAt: now }, [...factors, factor]));
+  await mfaStore.saveEnrollment(withMfaFactors({ ...base, updatedAt: now }, [
+    ...factors,
+    factor
+  ]));
   return status("OK", {
     factorId: factor.id,
     secret,
@@ -35018,17 +35028,17 @@ var resolveBindingFailureStatus = (binding, report) => {
   }
   return binding.status;
 };
-var buildNextGrant = (grant, report, currentTime) => ({
+var buildNextGrant = (grant, report, currentTime, failurePolicy) => ({
   ...grant,
   lastRefreshError: report.message ?? report.code,
   metadata: annotateFailureMetadata(grant.metadata, report, currentTime),
-  status: resolveGrantFailureStatus(grant, report),
+  status: failurePolicy === "record" ? grant.status : resolveGrantFailureStatus(grant, report),
   updatedAt: currentTime
 });
-var buildNextBinding = (binding, report, currentTime) => ({
+var buildNextBinding = (binding, report, currentTime, failurePolicy) => ({
   ...binding,
   metadata: annotateFailureMetadata(binding.metadata, report, currentTime),
-  status: resolveBindingFailureStatus(binding, report),
+  status: failurePolicy === "record" ? binding.status : resolveBindingFailureStatus(binding, report),
   updatedAt: currentTime
 });
 var resolveBindingCredential = async (grantStore, binding, input) => {
@@ -35045,6 +35055,7 @@ var resolveBindingCredential = async (grantStore, binding, input) => {
 var createLinkedProviderCredentialResolver = ({
   grantStore,
   bindingStore,
+  failurePolicy = "latch",
   loadAccessTokenLease,
   refreshAccessTokenLease,
   now = () => Date.now(),
@@ -35090,10 +35101,10 @@ var createLinkedProviderCredentialResolver = ({
     const grant = await grantStore.getGrant(credential.grantId);
     const binding = await bindingStore.getBinding(credential.bindingId);
     if (grant) {
-      await grantStore.saveGrant(buildNextGrant(grant, report, currentTime));
+      await grantStore.saveGrant(buildNextGrant(grant, report, currentTime, failurePolicy));
     }
     if (binding) {
-      await bindingStore.saveBinding(buildNextBinding(binding, report, currentTime));
+      await bindingStore.saveBinding(buildNextBinding(binding, report, currentTime, failurePolicy));
     }
     await onReportFailure?.({
       binding: binding ?? undefined,
@@ -35392,7 +35403,7 @@ var toBinding2 = (row) => ({
   updatedAt: row.updated_at.getTime(),
   username: row.username ?? undefined
 });
-var createNeonLinkedProviderBindingStore = (db) => ({
+var createLinkedProviderBindingStore = (db) => ({
   getBinding: async (id2) => {
     const [row] = await db.select().from(linkedProviderBindingsTable).where(eq(linkedProviderBindingsTable.id, id2)).limit(1);
     return row ? toBinding2(row) : undefined;
@@ -35443,7 +35454,7 @@ var createNeonLinkedProviderBindingStore = (db) => ({
     });
   }
 });
-var createNeonLinkedProviderGrantStore = (db) => ({
+var createLinkedProviderGrantStore = (db) => ({
   getGrant: async (id2) => {
     const [row] = await db.select().from(linkedProviderGrantsTable).where(eq(linkedProviderGrantsTable.id, id2)).limit(1);
     return row ? toGrant2(row) : undefined;
@@ -35499,9 +35510,9 @@ var createNeonLinkedProviderStores = (databaseUrl) => {
   const sql2 = as(databaseUrl);
   const db = drizzle({ client: sql2 });
   return {
-    bindingStore: createNeonLinkedProviderBindingStore(db),
+    bindingStore: createLinkedProviderBindingStore(db),
     db,
-    grantStore: createNeonLinkedProviderGrantStore(db)
+    grantStore: createLinkedProviderGrantStore(db)
   };
 };
 var createNeonOAuthLinkedProviderCredentialResolver = async ({
@@ -40789,7 +40800,12 @@ var renderChunk = (chunk) => {
   return "";
 };
 var formatSqlTemplate = (value) => value.queryChunks.map(renderChunk).join("");
-var formatDefault = (value) => {
+var columnSqlType = (column) => {
+  const dimensions = Reflect.get(column, "dimensions");
+  const elementType = column.getSQLType();
+  return typeof dimensions === "number" && dimensions > 0 ? `${elementType}${"[]".repeat(dimensions)}` : elementType;
+};
+var formatScalarDefault = (value) => {
   if (value === null || value === undefined)
     return "NULL";
   if (is(value, SQL))
@@ -40800,15 +40816,17 @@ var formatDefault = (value) => {
     return value ? "true" : "false";
   if (typeof value === "number")
     return String(value);
-  if (Array.isArray(value) || typeof value === "object") {
+  if (typeof value === "object") {
     return `'${JSON.stringify(value)}'::jsonb`;
   }
   return String(value);
 };
-var columnSqlType = (column) => {
+var formatArrayDefault = (values) => `ARRAY[${values.map((value) => Array.isArray(value) ? formatArrayDefault(value) : formatScalarDefault(value)).join(", ")}]`;
+var formatDefault = (column, value) => {
   const dimensions = Reflect.get(column, "dimensions");
-  const elementType = column.getSQLType();
-  return typeof dimensions === "number" && dimensions > 0 ? `${elementType}${"[]".repeat(dimensions)}` : elementType;
+  if (Array.isArray(value) && typeof dimensions === "number" && dimensions > 0)
+    return `${formatArrayDefault(value)}::${columnSqlType(column)}`;
+  return formatScalarDefault(value);
 };
 var columnSql = (column) => {
   const parts = [`"${column.name}"`, columnSqlType(column)];
@@ -40817,7 +40835,7 @@ var columnSql = (column) => {
   if (column.notNull && !column.primary)
     parts.push("NOT NULL");
   if (column.hasDefault && column.default !== undefined) {
-    parts.push(`DEFAULT ${formatDefault(column.default)}`);
+    parts.push(`DEFAULT ${formatDefault(column, column.default)}`);
   }
   if (column.isUnique)
     parts.push("UNIQUE");
@@ -42067,5 +42085,5 @@ export {
   userSessionIdTypebox
 };
 
-//# debugId=72D41A7F86EE7EF364756E2164756E21
+//# debugId=7D4E0B917AED1AD264756E2164756E21
 //# sourceMappingURL=server.js.map