@absolutejs/auth 0.82.0 → 0.84.0

package/dist/providers/neon.d.ts

@@ -0,0 +1,42 @@
+import type { CustomProviderClientConfiguration } from '../types';
+/** Neon requires a registered partner OAuth application. */
+export declare const neonProviderConfiguration: import("citra").CustomProviderDefinition<{
+    readonly authorizationUrl: "https://oauth2.neon.tech/oauth2/auth";
+    readonly isOIDC: true;
+    readonly isRefreshable: true;
+    readonly PKCEMethod: "S256";
+    readonly profileRequest: {
+        readonly authIn: "header";
+        readonly encoding: "application/json";
+        readonly method: "GET";
+        readonly url: "https://oauth2.neon.tech/userinfo";
+    };
+    readonly revocationRequest: {
+        readonly authIn: "body";
+        readonly encoding: "application/x-www-form-urlencoded";
+        readonly tokenParamName: "token";
+        readonly url: "https://oauth2.neon.tech/oauth2/revoke";
+    };
+    readonly scopeRequired: true;
+    readonly subject: ["sub"];
+    readonly subjectType: "string";
+    readonly tokenRequest: {
+        readonly authIn: "body";
+        readonly encoding: "application/x-www-form-urlencoded";
+        readonly url: "https://oauth2.neon.tech/oauth2/token";
+    };
+}, import("citra").CustomProviderCredentials>;
+export type NeonManagementScope = `urn:neoncloud:${'projects' | 'orgs'}:${'create' | 'read' | 'update' | 'delete' | 'permission'}`;
+export type NeonProviderOptions = {
+    credentials: {
+        clientId: string;
+        clientSecret: string;
+        redirectUri: string;
+    };
+    /** Select permissions deliberately; no management permissions are implicit. */
+    scopes: readonly NeonManagementScope[];
+    /** Request both scopes required by Neon to issue a refresh token. */
+    offlineAccess?: boolean;
+};
+/** Configure `customProviders.neon` without granting management permissions implicitly. */
+export declare const createNeonProviderConfiguration: ({ credentials, offlineAccess, scopes }: NeonProviderOptions) => CustomProviderClientConfiguration;

package/docs/PERSISTENT-CREDENTIALS.md

@@ -12,7 +12,8 @@ The application owns user records. The auth package owns credentials and session
 
 ```ts
 import { auth } from '@absolutejs/auth/server';
-import { createPostgresAuthSessionStore, createPostgresCredentialStore, runMigrations } from '@absolutejs/auth';
+import { runBunMigrations } from '@absolutejs/auth/bun';
+import { createPostgresAuthSessionStore, createPostgresCredentialStore } from '@absolutejs/auth';
 import { SQL } from 'bun';
 import { Database } from 'bun:sqlite';
 import { drizzle } from 'drizzle-orm/bun-sql';
@@ -25,20 +26,11 @@ if (!databaseUrl)
   throw new Error(
     "AUTH_DATABASE_URL must point to the isolated acceptance database",
   );
-const migrationClient = new SQL({ url: databaseUrl, max: 1, prepare: false });
-try {
-  await runMigrations({
-    blocks: ["sessions", "credentials"],
-    client: {
-      query: async (text, values) => ({
-        rows: await migrationClient.unsafe(text, values ? [...values] : []),
-      }),
-    },
-    log: () => undefined,
-  });
-} finally {
-  await migrationClient.close();
-}
+await runBunMigrations({
+  databaseUrl,
+  blocks: ['sessions', 'credentials'],
+  log: () => undefined,
+});
 const authDb = drizzle({ client: new SQL(databaseUrl) });
 const decodeCustomer = (value: unknown): Customer => {
   if (typeof value !== "object" || value === null)

package/docs/neon.md

@@ -0,0 +1,42 @@
+# Neon partner OAuth
+
+Neon direct OAuth requires a registered partner application and an active commercial
+relationship. This preset does not register an application or confer partner status.
+See https://neon.com/docs/guides/oauth-integration for registration and callback requirements.
+
+```ts
+import { createNeonProviderConfiguration } from '@absolutejs/auth/providers';
+
+const neon = createNeonProviderConfiguration({
+  credentials: {
+    clientId: process.env.NEON_CLIENT_ID!,
+    clientSecret: process.env.NEON_CLIENT_SECRET!,
+    redirectUri: 'https://app.example.com/auth/neon/callback'
+  },
+  scopes: ['urn:neoncloud:orgs:read', 'urn:neoncloud:projects:read'],
+  offlineAccess: true
+});
+// Pass customProviders: { neon } to your existing Auth configuration.
+```
+
+Keep credentials on the server. Register the exact callback used by your Auth
+mount. The preset enables S256 PKCE, identifies accounts by `sub`, and requests
+`openid`. Management permissions must be explicit. `offlineAccess` adds both
+`offline` and `offline_access`; it defaults to false. Request create/update only
+when the customer needs those operations. Delete and organization administration
+are never implicit. Do not infer an email or organization from the subject.
+
+The existing custom-provider authorization, callback, profile, refresh and revoke
+routes handle this definition. An account connection is separate from signing the
+customer into your application; enforce your application's account-linking policy.
+The generic `createOAuthLinkedProviderCredentialResolver` currently accepts only
+built-in providers. Applications using that resolver need a custom-provider-aware
+resolver before enabling unattended Neon management. This preset alone does not
+provide a resource picker, database provisioning, secret delivery or browser
+assistance. Do not enable the customer-facing connection until those pieces and
+partner credentials are in place.
+
+Use a provider-owned sign-in window where required. Do not proxy sign-in into an
+embedded browser that violates the identity provider's policies. Never put client
+secrets, refresh tokens or database connection strings into chat or referral URLs.
+Referral agreements and reporting are separate from OAuth permission grants.

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.82.0",
+	"version": "0.84.0",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {
@@ -17,7 +17,7 @@
 	"license": "BSL-1.1",
 	"author": "Alex Kahn",
 	"scripts": {
-		"build": "rm -rf dist && bun build src/index.ts src/server.ts src/agents/index.ts src/oidc/index.ts src/saml.ts src/webauthn.ts src/htmx/index.ts src/client/index.ts src/client/mobile.ts src/client/react.ts src/client/vue.ts src/client/solid.ts src/client/svelte.ts src/plugins/index.ts src/providers/index.ts src/linkedProviders/index.ts src/vault/index.ts src/manifest.ts --root src --outdir dist --sourcemap --target=bun --external elysia --external react --external vue --external solid-js --external svelte --external @opentelemetry/api --external @simplewebauthn/browser --external @simplewebauthn/server --external @node-saml/node-saml && bun build src/cli/migrate.ts --outdir dist/cli --sourcemap --target=bun --external @neondatabase/serverless --external drizzle-orm && bun build src/fingerprint-client/index.ts --outdir dist/fingerprint-client --sourcemap --target=browser && bun run scripts/emitDeclarations.ts && chmod +x dist/cli/migrate.js && absolute-manifest emit",
+		"build": "rm -rf dist && bun build src/bun.ts src/index.ts src/server.ts src/agents/index.ts src/oidc/index.ts src/saml.ts src/webauthn.ts src/htmx/index.ts src/client/index.ts src/client/mobile.ts src/client/react.ts src/client/vue.ts src/client/solid.ts src/client/svelte.ts src/plugins/index.ts src/providers/index.ts src/linkedProviders/index.ts src/vault/index.ts src/manifest.ts --root src --outdir dist --sourcemap --target=bun --external elysia --external react --external vue --external solid-js --external svelte --external @opentelemetry/api --external @simplewebauthn/browser --external @simplewebauthn/server --external @node-saml/node-saml && bun build src/cli/migrate.ts --outdir dist/cli --sourcemap --target=bun --external @neondatabase/serverless --external drizzle-orm && bun build src/fingerprint-client/index.ts --outdir dist/fingerprint-client --sourcemap --target=browser && bun run scripts/emitDeclarations.ts && chmod +x dist/cli/migrate.js && absolute-manifest emit",
 		"config": "absolute config",
 		"test": "bun test",
 		"format": "absolute prettier --write",
@@ -201,7 +201,12 @@
 			"import": "./dist/manifest.js",
 			"default": "./dist/manifest.js"
 		},
-		"./manifest.json": "./dist/manifest.json"
+		"./manifest.json": "./dist/manifest.json",
+		"./bun": {
+			"types": "./dist/bun.d.ts",
+			"import": "./dist/bun.js",
+			"require": "./dist/bun.js"
+		}
 	},
 	"type": "module",
 	"files": [