@absolutejs/auth 0.78.0 → 0.80.0

package/CHANGELOG.md

@@ -0,0 +1,24 @@
+# Changelog
+
+All notable changes to `@absolutejs/auth`.
+
+This file is generated by `absolute-changelog` from the entries in
+`changelog/`. Edit an entry, not this file — and add new ones under
+`changelog/unreleased/`.
+
+## 0.80.0 — 2026-09-22
+
+### Added
+
+- **Support existing Drizzle PostgreSQL clients for durable auth sessions** (`createPostgresAuthSessionStore`)
+
+### Fixed
+
+- **Run auth setup according to the selected session store instead of always requiring PostgreSQL**
+
+## 0.79.0 — 2026-09-10
+
+### Breaking
+
+- **Separate API credential token routes from OIDC and reject conflicting configuration** (`apiKeysRoutes`, `auth`, `createAuthApplications`, `AuthConfig`, `ApiKeysConfig`)
+  _Migration:_ Send client_credentials requests to /auth/api/token instead of /oauth2/token and update advertised enterprise token URLs. Keep authorization_code and refresh_token requests at /oauth2/token. Prefer auth({ oidc, apikeys }) for configuration validation. API-only consumers may explicitly keep tokenRoute: /oauth2/token if no OIDC handler uses that path.

package/README.md

@@ -392,3 +392,51 @@ using it has expired; duplicate key IDs fail closed.
 ## Note
 
 This project uses Bun and is built for Elysia.
+
+## OAuth and API credential token routes
+
+As of 0.79.0, `apiKeysRoutes()` and `auth({ apikeys })` serve the
+`client_credentials` grant at `/auth/api/token` by default. OIDC authorization
+code and refresh grants continue to use `/oauth2/token`. This keeps separately
+mounted plugins from replacing each other's token handler.
+
+Update enterprise integrations and displayed token URLs to `/auth/api/token`.
+API-only applications can retain the previous URL by explicitly setting
+`apikeys.tokenRoute: '/oauth2/token'`, provided no OIDC handler uses that path.
+
+Prefer configuring both features in `auth({ oidc, apikeys })`: conflicting token
+paths are rejected during construction, including a trailing-slash alias.
+When mounting standalone plugins with custom paths, the consumer must keep
+the paths distinct; Elysia does not reject arbitrary duplicate routes.
+
+### Persistent sessions with an existing PostgreSQL client
+
+Use `createPostgresAuthSessionStore(db, decodeUser)` with an existing Drizzle
+PostgreSQL client. It uses the same session tables as the Neon convenience
+adapter; `decodeUser` validates the stored user shape when a session is read.
+Pair it with `createPostgresCredentialStore(db)` for persistent passwords.
+Your application must also persist its own user records.
+
+```ts
+import { SQL } from 'bun';
+import { drizzle } from 'drizzle-orm/bun-sql';
+import { createPostgresAuthSessionStore, createPostgresCredentialStore } from '@absolutejs/auth';
+
+const databaseUrl = process.env.DATABASE_URL;
+if (!databaseUrl) throw new Error('DATABASE_URL is required');
+const client = new SQL(databaseUrl);
+const db = drizzle({ client });
+const sessionStore = createPostgresAuthSessionStore(db, decodeUser);
+const credentialStore = createPostgresCredentialStore(db);
+```
+
+Apply the `sessions` and `credentials` migrations before serving requests.
+`runMigrations` accepts a `MigrationClient` for non-Neon PostgreSQL drivers.
+With Bun SQL, use a separate `prepare: false` client for migration scripts,
+and the default prepared-query mode for application queries and JSON columns.
+
+Studio's `absolute-auth setup` reads the selected adapter from
+`src/backend/packages/auth.config.ts`. Explicit memory storage skips database
+migrations and warns that sessions reset on restart. The Neon adapter requires
+a real `DATABASE_URL` and runs migrations. Missing or unknown selections fail
+with an actionable error; custom adapters must configure their own migrations.

package/changelog.json

@@ -0,0 +1,44 @@
+{
+	"contract": 1,
+	"name": "@absolutejs/auth",
+	"releases": [
+		{
+			"changes": [
+				{
+					"kind": "fixed",
+					"summary": "Run auth setup according to the selected session store instead of always requiring PostgreSQL"
+				},
+				{
+					"kind": "added",
+					"summary": "Support existing Drizzle PostgreSQL clients for durable auth sessions",
+					"symbols": [
+						"createPostgresAuthSessionStore"
+					]
+				}
+			],
+			"date": "2026-09-22",
+			"version": "0.80.0"
+		},
+		{
+			"changes": [
+				{
+					"kind": "breaking",
+					"migration": {
+						"instruction": "Send client_credentials requests to /auth/api/token instead of /oauth2/token and update advertised enterprise token URLs. Keep authorization_code and refresh_token requests at /oauth2/token. Prefer auth({ oidc, apikeys }) for configuration validation. API-only consumers may explicitly keep tokenRoute: /oauth2/token if no OIDC handler uses that path.",
+						"manual": true
+					},
+					"summary": "Separate API credential token routes from OIDC and reject conflicting configuration",
+					"symbols": [
+						"apiKeysRoutes",
+						"auth",
+						"createAuthApplications",
+						"AuthConfig",
+						"ApiKeysConfig"
+					]
+				}
+			],
+			"date": "2026-09-10",
+			"version": "0.79.0"
+		}
+	]
+}

package/dist/apikeys/config.d.ts

@@ -13,7 +13,7 @@ export type ApiKeysConfig = {
     /** Static API keys. Used by the exported `verifyApiKey` / `resolveApiPrincipal`
      *  helpers; the consumer wires its own management + guard routes. */
     apiKeyStore?: ApiKeyStore;
-    /** Path of the client_credentials token endpoint (defaults to `/oauth2/token`). */
+    /** Path of the client_credentials token endpoint (defaults to `/auth/api/token`). */
     tokenRoute?: RouteString;
 };
 export type ClientCredentialsResult = {

package/dist/apikeys/tokenRoutes.d.ts

@@ -0,0 +1,7 @@
+import type { RouteString } from '../types';
+import { type ApiKeysConfig } from './config';
+/** Elysia replaces duplicate method/path registrations. Refuse that setup
+ * before composing the two independently configured token handlers. */
+export declare const assertTokenRouteConfiguration: (apikeys: ApiKeysConfig | undefined, oidc: {
+    oidcRoute?: RouteString;
+} | undefined) => void;

package/dist/cli/migrate.js

@@ -289,6 +289,10 @@ var runImport = async (result, options) => {
   };
 };
 
+// src/cli/setup.ts
+import { resolve } from "path";
+import { pathToFileURL } from "url";
+
 // src/adaptive/postgresStores.ts
 import { and, desc, eq } from "drizzle-orm";
 import {
@@ -3473,11 +3477,46 @@ var blockMigrations = {
   webhooks: initMigration("webhooks", [webhookDeliveriesTable])
 };
 
+// src/cli/setup.ts
+var readProperty = (value, key) => {
+  const property = typeof value === "object" && value !== null ? Reflect.get(value, key) : undefined;
+  return property;
+};
+var setupStorage = (configuration) => {
+  const selected = readProperty(readProperty(configuration, "adapters"), "sessionStore");
+  if (selected === "@absolutejs/auth#createInMemoryAuthSessionStore")
+    return "memory";
+  if (selected === "@absolutejs/auth#createNeonAuthSessionStore")
+    return "neon";
+  throw new Error("Select a supported auth sessionStore adapter in src/backend/packages/auth.config.ts before setup. Custom adapters need their own migrations.");
+};
+var loadConfiguration = async () => {
+  const module = await import(pathToFileURL(resolve("src/backend/packages/auth.config.ts")).href);
+  return readProperty(module, "default");
+};
+var runSetup = async ({
+  configuration,
+  databaseUrl = process.env["DATABASE_URL"],
+  migrate = runMigrations,
+  log = console.log
+} = {}) => {
+  const storage = setupStorage(configuration ?? await loadConfiguration());
+  if (storage === "memory") {
+    log("In-memory sessions selected: no database migration is needed. Sign-ins reset on restart; choose persistent storage for a live business.");
+    return { migrated: false, storage };
+  }
+  if (!databaseUrl?.trim())
+    throw new Error("The selected Neon session store requires DATABASE_URL. Configure a real Neon database connection; do not enter a placeholder.");
+  await migrate({ databaseUrl, log });
+  return { migrated: true, storage };
+};
+
 // src/cli/migrate.ts
 var TOP_USAGE = `Usage:
   bunx absolute-auth <command> [options]
 
 Commands:
+  setup                  Set up storage selected in the project auth config
   migrate                Apply the package's Drizzle migrations
   import <source> <file> Import a user export from another auth library
                          <source> is one of: ${Object.keys(importers).sort().join(", ")}
@@ -3647,6 +3686,12 @@ var main = async () => {
     process.stdout.write(TOP_USAGE);
     return;
   }
+  if (command === "setup") {
+    if (argv.length > 0)
+      throw new Error("setup takes no arguments; it reads src/backend/packages/auth.config.ts");
+    await runSetup();
+    return;
+  }
   if (command === "migrate") {
     await runMigrate(argv);
     return;
@@ -3659,5 +3704,5 @@ var main = async () => {
 };
 await main();
 
-//# debugId=1171B72D10FC06DD64756E2164756E21
+//# debugId=049EB7FB9B6E388E64756E2164756E21
 //# sourceMappingURL=migrate.js.map