@airdraft/plugin-auth 0.1.0

package/dist/GitHubOAuthProvider.js

@@ -0,0 +1,224 @@
+import { randomBytes } from 'node:crypto';
+import { signAccessToken, signRefreshToken, verifyAccessToken, } from '@airdraft/auth';
+import { refreshTokenBlocklist } from './blocklist.js';
+async function getGitHubUser(accessToken) {
+    const res = await fetch('https://api.github.com/user', {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            Accept: 'application/vnd.github+json',
+            'X-GitHub-Api-Version': '2022-11-28',
+        },
+    });
+    return res.ok ? (await res.json()) : null;
+}
+async function getGitHubEmail(accessToken) {
+    const res = await fetch('https://api.github.com/user/emails', {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            Accept: 'application/vnd.github+json',
+            'X-GitHub-Api-Version': '2022-11-28',
+        },
+    });
+    if (!res.ok)
+        return null;
+    const emails = (await res.json());
+    return emails.find((e) => e.primary && e.verified)?.email ?? null;
+}
+// ---------------------------------------------------------------------------
+// Cookie helpers (shared with CredentialsProvider)
+// ---------------------------------------------------------------------------
+function parseCookie(header, name) {
+    if (!header)
+        return null;
+    for (const part of header.split(';')) {
+        const [key, ...rest] = part.trim().split('=');
+        if (key?.trim() === name)
+            return decodeURIComponent(rest.join('='));
+    }
+    return null;
+}
+function isSecure(req) {
+    try {
+        return new URL(req.url).protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+function setCookieHeader(name, value, attrs) {
+    return [`${name}=${encodeURIComponent(value)}`, ...attrs].join('; ');
+}
+// ---------------------------------------------------------------------------
+// GitHubOAuthProvider  (C12)
+// ---------------------------------------------------------------------------
+/**
+ * GitHub OAuth2 provider for Airdraft CMS.
+ *
+ * Flow:
+ *   1. Browser hits `GET /auth/github`  → redirected to GitHub OAuth
+ *   2. GitHub redirects back to `GET /auth/github/callback?code=...&state=...`
+ *   3. Server exchanges code for token, fetches GitHub user, issues JWT
+ *
+ * CSRF protection: `state` param is a random nonce stored in a session cookie.
+ *
+ * ```ts
+ * withAuth({
+ *   provider: GitHubOAuthProvider({
+ *     clientId: process.env.GITHUB_CLIENT_ID!,
+ *     clientSecret: process.env.GITHUB_CLIENT_SECRET!,
+ *     secret: process.env.AIRDRAFT_JWT_SECRET!,
+ *     roles: { 'alice@example.com': 'admin' },
+ *   })
+ * })
+ * ```
+ */
+export function GitHubOAuthProvider(opts) {
+    const secret = opts.secret ?? process.env['AIRDRAFT_JWT_SECRET'] ?? '';
+    if (!secret || secret.length < 32) {
+        throw new Error('[airdraft] AIRDRAFT_JWT_SECRET must be at least 32 characters. ' +
+            'Generate one with: npx airdraft generate-secret');
+    }
+    const configRoles = opts.roles ?? {};
+    const basePath = opts.basePath ?? '/api/cms';
+    const defaultRole = opts.defaultRole ?? 'editor';
+    const ACCESS_TTL = 15 * 60;
+    const REFRESH_TTL = 7 * 24 * 60 * 60;
+    function resolveRole(email) {
+        return configRoles[email.toLowerCase()] ?? defaultRole;
+    }
+    async function verify(req) {
+        const cookie = req.headers.get('cookie');
+        const token = parseCookie(cookie, 'airdraft_session');
+        if (!token)
+            return null;
+        return verifyAccessToken(token, secret);
+    }
+    /** GET /auth/github — redirect to GitHub OAuth */
+    async function githubInitHandler(req) {
+        const callbackUrl = opts.callbackUrl ?? `${new URL(req.url).origin}${basePath}/auth/github/callback`;
+        const state = randomBytes(16).toString('hex');
+        const params = new URLSearchParams({
+            client_id: opts.clientId,
+            redirect_uri: callbackUrl,
+            scope: 'user:email read:org',
+            state,
+        });
+        const headers = new Headers({
+            Location: `https://github.com/login/oauth/authorize?${params.toString()}`,
+        });
+        headers.set('Set-Cookie', setCookieHeader('airdraft_oauth_state', state, [
+            'HttpOnly',
+            'SameSite=Lax',
+            'Path=/',
+            'Max-Age=600',
+            ...(isSecure(req) ? ['Secure'] : []),
+        ]));
+        return new Response(null, { status: 302, headers });
+    }
+    /** GET /auth/github/callback */
+    async function githubCallbackHandler(req) {
+        const url = new URL(req.url);
+        const code = url.searchParams.get('code');
+        const state = url.searchParams.get('state');
+        // CSRF check
+        const savedState = parseCookie(req.headers.get('cookie'), 'airdraft_oauth_state');
+        if (!code || !state || state !== savedState) {
+            return new Response('OAuth state mismatch', { status: 400 });
+        }
+        // Exchange code for token
+        const callbackUrl = opts.callbackUrl ?? `${url.origin}${basePath}/auth/github/callback`;
+        const tokenRes = await fetch('https://github.com/login/oauth/access_token', {
+            method: 'POST',
+            headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                client_id: opts.clientId,
+                client_secret: opts.clientSecret,
+                code,
+                redirect_uri: callbackUrl,
+            }),
+        });
+        if (!tokenRes.ok)
+            return new Response('Failed to exchange OAuth code', { status: 502 });
+        const { access_token } = (await tokenRes.json());
+        if (!access_token)
+            return new Response('No access token in GitHub response', { status: 502 });
+        // Fetch user
+        const ghUser = await getGitHubUser(access_token);
+        if (!ghUser)
+            return new Response('Failed to fetch GitHub user', { status: 502 });
+        const email = ghUser.email ?? (await getGitHubEmail(access_token)) ?? `${ghUser.login}@users.noreply.github.com`;
+        // Check allowlists
+        if (opts.allowedUsers?.length && !opts.allowedUsers.includes(ghUser.login)) {
+            return new Response('GitHub user not authorised', { status: 403 });
+        }
+        if (opts.allowedOrgs?.length) {
+            const orgsRes = await fetch('https://api.github.com/user/orgs', {
+                headers: { Authorization: `Bearer ${access_token}`, Accept: 'application/vnd.github+json' },
+            });
+            const orgs = orgsRes.ok ? (await orgsRes.json()) : [];
+            const memberOf = orgs.map((o) => o.login);
+            if (!opts.allowedOrgs.some((o) => memberOf.includes(o))) {
+                return new Response('GitHub org not authorised', { status: 403 });
+            }
+        }
+        const role = resolveRole(email);
+        const user = {
+            id: `github:${ghUser.id}`,
+            email,
+            name: ghUser.name ?? ghUser.login,
+            role,
+        };
+        const accessToken = signAccessToken(user, secret);
+        const refreshToken = signRefreshToken();
+        const secure = isSecure(req);
+        const headers = new Headers({
+            'Content-Type': 'application/json',
+            Location: `${url.origin}${basePath.replace('/api/cms', '')}/cms`,
+        });
+        headers.append('Set-Cookie', setCookieHeader('airdraft_session', accessToken, [
+            'HttpOnly',
+            'SameSite=Strict',
+            'Path=/',
+            `Max-Age=${ACCESS_TTL}`,
+            ...(secure ? ['Secure'] : []),
+        ]));
+        headers.append('Set-Cookie', setCookieHeader('airdraft_refresh', refreshToken, [
+            'HttpOnly',
+            'SameSite=Strict',
+            `Path=${basePath}/auth/refresh`,
+            `Max-Age=${REFRESH_TTL}`,
+            ...(secure ? ['Secure'] : []),
+        ]));
+        // Clear state cookie
+        headers.append('Set-Cookie', 'airdraft_oauth_state=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0');
+        return new Response(null, { status: 302, headers });
+    }
+    /** POST /auth/logout */
+    async function logoutHandler(req) {
+        const cookie = req.headers.get('cookie');
+        const refreshToken = parseCookie(cookie, 'airdraft_refresh');
+        if (refreshToken)
+            refreshTokenBlocklist.add(refreshToken);
+        const headers = new Headers({ 'Content-Type': 'application/json' });
+        headers.append('Set-Cookie', `airdraft_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0`);
+        headers.append('Set-Cookie', `airdraft_refresh=; HttpOnly; SameSite=Strict; Path=${basePath}/auth/refresh; Max-Age=0`);
+        return new Response(JSON.stringify({ ok: true }), { status: 200, headers });
+    }
+    /** GET /auth/me */
+    async function meHandler(req) {
+        const user = await verify(req);
+        if (!user)
+            return new Response(JSON.stringify({ error: 'Not authenticated' }), { status: 401 });
+        return new Response(JSON.stringify({ user: { id: user.id, email: user.email, name: user.name, role: user.role } }), { status: 200, headers: { 'Content-Type': 'application/json' } });
+    }
+    function handlers() {
+        return [
+            { path: '/auth/github', handler: githubInitHandler },
+            { path: '/auth/github/callback', handler: githubCallbackHandler },
+            { path: '/auth/logout', handler: logoutHandler },
+            { path: '/auth/me', handler: meHandler },
+        ];
+    }
+    return { verify, handlers };
+}
+//# sourceMappingURL=GitHubOAuthProvider.js.map

package/dist/GitHubOAuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubOAuthProvider.js","sourceRoot":"","sources":["../src/GitHubOAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAmBtD,KAAK,UAAU,aAAa,CAAC,WAAmB;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;QACrD,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,MAAM,EAAE,6BAA6B;YACrC,sBAAsB,EAAE,YAAY;SACrC;KACF,CAAC,CAAA;IACF,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgB,CAAC,CAAC,CAAC,IAAI,CAAA;AAC3D,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,WAAmB;IAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oCAAoC,EAAE;QAC5D,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,MAAM,EAAE,6BAA6B;YACrC,sBAAsB,EAAE,YAAY;SACrC;KACF,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,IAAI,CAAA;AACnE,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,SAAS,WAAW,CAAC,MAAqB,EAAE,IAAY;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,KAAe;IACnE,OAAO,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACtE,CAAC;AA+BD,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAA;IACtE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,iDAAiD,CACpD,CAAA;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAA;IAC5C,MAAM,WAAW,GAAS,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAA;IACtD,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,CAAA;IAC1B,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;IAEpC,SAAS,WAAW,CAAC,KAAa;QAChC,OAAQ,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,CAAsB,IAAI,WAAW,CAAA;IAC9E,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,GAAY;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,OAAO,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACzC,CAAC;IAED,kDAAkD;IAClD,KAAK,UAAU,iBAAiB,CAAC,GAAY;QAC3C,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,QAAQ,uBAAuB,CAAA;QAClF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,qBAAqB;YAC5B,KAAK;SACN,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,QAAQ,EAAE,4CAA4C,MAAM,CAAC,QAAQ,EAAE,EAAE;SAC1E,CAAC,CAAA;QACF,OAAO,CAAC,GAAG,CACT,YAAY,EACZ,eAAe,CAAC,sBAAsB,EAAE,KAAK,EAAE;YAC7C,UAAU;YACV,cAAc;YACd,QAAQ;YACR,aAAa;YACb,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrC,CAAC,CACH,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IACrD,CAAC;IAED,gCAAgC;IAChC,KAAK,UAAU,qBAAqB,CAAC,GAAY;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAE3C,aAAa;QACb,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAA;QACjF,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAC5C,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9D,CAAC;QAED,0BAA0B;QAC1B,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,uBAAuB,CAAA;QACrE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,6CAA6C,EAAE;YAC1E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,aAAa,EAAE,IAAI,CAAC,YAAY;gBAChC,IAAI;gBACJ,YAAY,EAAE,WAAW;aAC1B,CAAC;SACH,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,QAAQ,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACvF,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAA;QAC7E,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,QAAQ,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAE7F,aAAa;QACb,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAA;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEhF,MAAM,KAAK,GACT,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,2BAA2B,CAAA;QAEpG,mBAAmB;QACnB,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,kCAAkC,EAAE;gBAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE;aAC5F,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA8B,CAAC,CAAC,CAAC,EAAE,CAAA;YACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YACzC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,OAAO,IAAI,QAAQ,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACnE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAa;YACrB,EAAE,EAAE,UAAU,MAAM,CAAC,EAAE,EAAE;YACzB,KAAK;YACL,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK;YACjC,IAAI;SACL,CAAA;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAA;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAE5B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,cAAc,EAAE,kBAAkB;YAClC,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM;SACjE,CAAC,CAAA;QACF,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,eAAe,CAAC,kBAAkB,EAAE,WAAW,EAAE;YAC/C,UAAU;YACV,iBAAiB;YACjB,QAAQ;YACR,WAAW,UAAU,EAAE;YACvB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CACH,CAAA;QACD,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,eAAe,CAAC,kBAAkB,EAAE,YAAY,EAAE;YAChD,UAAU;YACV,iBAAiB;YACjB,QAAQ,QAAQ,eAAe;YAC/B,WAAW,WAAW,EAAE;YACxB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CACH,CAAA;QACD,qBAAqB;QACrB,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,kEAAkE,CACnE,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IACrD,CAAC;IAED,wBAAwB;IACxB,KAAK,UAAU,aAAa,CAAC,GAAY;QACvC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QAC5D,IAAI,YAAY;YAAE,qBAAqB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACzD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACnE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,iEAAiE,CAAC,CAAA;QAC/F,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,sDAAsD,QAAQ,0BAA0B,CACzF,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,mBAAmB;IACnB,KAAK,UAAU,SAAS,CAAC,GAAY;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC/F,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAC9F,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAA;IACH,CAAC;IAED,SAAS,QAAQ;QACf,OAAO;YACL,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE;YACpD,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,qBAAqB,EAAE;YACjE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE;YAChD,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;SACzC,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC"}

package/dist/GoogleOAuthProvider.d.ts

@@ -0,0 +1,49 @@
+import type { Role } from '@airdraft/auth';
+import type { AuthProvider } from './types.js';
+export interface GoogleOAuthProviderOptions {
+    clientId: string;
+    clientSecret: string;
+    /**
+     * AIRDRAFT_JWT_SECRET — must be ≥ 32 chars (C7).
+     * Defaults to `process.env.AIRDRAFT_JWT_SECRET`.
+     */
+    secret?: string;
+    /** Email-keyed role overrides (C3). */
+    roles?: Record<string, Role>;
+    /** Only these verified email addresses may access the CMS. */
+    allowedEmails?: string[];
+    /** Only emails with these domains may access (e.g. `['mycompany.com']`). */
+    allowedDomains?: string[];
+    /**
+     * Default role for Google users not in `roles`.
+     * Defaults to 'editor'.
+     */
+    defaultRole?: Role;
+    /** Base path for the CMS API (default: '/api/cms'). */
+    basePath?: string;
+    /** OAuth callback URL (default: `{origin}{basePath}/auth/google/callback`). */
+    callbackUrl?: string;
+}
+/**
+ * Google OAuth2 provider for Airdraft CMS.
+ *
+ * Flow:
+ *   1. Browser hits `GET /auth/google`  → redirected to Google OAuth
+ *   2. Google redirects back to `GET /auth/google/callback?code=...&state=...`
+ *   3. Server exchanges code for token, fetches Google user info, issues JWT
+ *
+ * CSRF protection: `state` param is a random nonce stored in a session cookie.
+ *
+ * ```ts
+ * withAuth({
+ *   provider: GoogleOAuthProvider({
+ *     clientId: process.env.GOOGLE_CLIENT_ID!,
+ *     clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+ *     secret: process.env.AIRDRAFT_JWT_SECRET!,
+ *     allowedDomains: ['mycompany.com'],
+ *   })
+ * })
+ * ```
+ */
+export declare function GoogleOAuthProvider(opts: GoogleOAuthProviderOptions): AuthProvider;
+//# sourceMappingURL=GoogleOAuthProvider.d.ts.map

package/dist/GoogleOAuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleOAuthProvider.d.ts","sourceRoot":"","sources":["../src/GoogleOAuthProvider.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAY,IAAI,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAA;AA0D/D,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC5B,8DAA8D;IAC9D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB;;;OAGG;IACH,WAAW,CAAC,EAAE,IAAI,CAAA;IAClB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,YAAY,CAmLlF"}

package/dist/GoogleOAuthProvider.js

@@ -0,0 +1,205 @@
+import { randomBytes } from 'node:crypto';
+import { signAccessToken, signRefreshToken, verifyAccessToken, } from '@airdraft/auth';
+import { refreshTokenBlocklist } from './blocklist.js';
+async function getGoogleUserInfo(accessToken) {
+    const res = await fetch('https://www.googleapis.com/oauth2/v3/userinfo', {
+        headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    return res.ok ? (await res.json()) : null;
+}
+// ---------------------------------------------------------------------------
+// Cookie helpers
+// ---------------------------------------------------------------------------
+function parseCookie(header, name) {
+    if (!header)
+        return null;
+    for (const part of header.split(';')) {
+        const [key, ...rest] = part.trim().split('=');
+        if (key?.trim() === name)
+            return decodeURIComponent(rest.join('='));
+    }
+    return null;
+}
+function isSecure(req) {
+    try {
+        return new URL(req.url).protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+function setCookieHeader(name, value, attrs) {
+    return [`${name}=${encodeURIComponent(value)}`, ...attrs].join('; ');
+}
+// ---------------------------------------------------------------------------
+// GoogleOAuthProvider  (C12)
+// ---------------------------------------------------------------------------
+/**
+ * Google OAuth2 provider for Airdraft CMS.
+ *
+ * Flow:
+ *   1. Browser hits `GET /auth/google`  → redirected to Google OAuth
+ *   2. Google redirects back to `GET /auth/google/callback?code=...&state=...`
+ *   3. Server exchanges code for token, fetches Google user info, issues JWT
+ *
+ * CSRF protection: `state` param is a random nonce stored in a session cookie.
+ *
+ * ```ts
+ * withAuth({
+ *   provider: GoogleOAuthProvider({
+ *     clientId: process.env.GOOGLE_CLIENT_ID!,
+ *     clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+ *     secret: process.env.AIRDRAFT_JWT_SECRET!,
+ *     allowedDomains: ['mycompany.com'],
+ *   })
+ * })
+ * ```
+ */
+export function GoogleOAuthProvider(opts) {
+    const secret = opts.secret ?? process.env['AIRDRAFT_JWT_SECRET'] ?? '';
+    if (!secret || secret.length < 32) {
+        throw new Error('[airdraft] AIRDRAFT_JWT_SECRET must be at least 32 characters. ' +
+            'Generate one with: npx airdraft generate-secret');
+    }
+    const configRoles = opts.roles ?? {};
+    const basePath = opts.basePath ?? '/api/cms';
+    const defaultRole = opts.defaultRole ?? 'editor';
+    const ACCESS_TTL = 15 * 60;
+    const REFRESH_TTL = 7 * 24 * 60 * 60;
+    function resolveRole(email) {
+        return configRoles[email.toLowerCase()] ?? defaultRole;
+    }
+    async function verify(req) {
+        const cookie = req.headers.get('cookie');
+        const token = parseCookie(cookie, 'airdraft_session');
+        if (!token)
+            return null;
+        return verifyAccessToken(token, secret);
+    }
+    /** GET /auth/google — redirect to Google OAuth */
+    async function googleInitHandler(req) {
+        const callbackUrl = opts.callbackUrl ?? `${new URL(req.url).origin}${basePath}/auth/google/callback`;
+        const state = randomBytes(16).toString('hex');
+        const params = new URLSearchParams({
+            client_id: opts.clientId,
+            redirect_uri: callbackUrl,
+            response_type: 'code',
+            scope: 'openid email profile',
+            access_type: 'offline',
+            prompt: 'consent',
+            state,
+        });
+        const headers = new Headers({
+            Location: `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`,
+        });
+        headers.set('Set-Cookie', setCookieHeader('airdraft_oauth_state', state, [
+            'HttpOnly',
+            'SameSite=Lax',
+            'Path=/',
+            'Max-Age=600',
+            ...(isSecure(req) ? ['Secure'] : []),
+        ]));
+        return new Response(null, { status: 302, headers });
+    }
+    /** GET /auth/google/callback */
+    async function googleCallbackHandler(req) {
+        const url = new URL(req.url);
+        const code = url.searchParams.get('code');
+        const state = url.searchParams.get('state');
+        // CSRF check
+        const savedState = parseCookie(req.headers.get('cookie'), 'airdraft_oauth_state');
+        if (!code || !state || state !== savedState) {
+            return new Response('OAuth state mismatch', { status: 400 });
+        }
+        const callbackUrl = opts.callbackUrl ?? `${url.origin}${basePath}/auth/google/callback`;
+        // Exchange code for token
+        const tokenRes = await fetch('https://oauth2.googleapis.com/token', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                code,
+                client_id: opts.clientId,
+                client_secret: opts.clientSecret,
+                redirect_uri: callbackUrl,
+                grant_type: 'authorization_code',
+            }).toString(),
+        });
+        if (!tokenRes.ok)
+            return new Response('Failed to exchange OAuth code', { status: 502 });
+        const tokens = (await tokenRes.json());
+        // Fetch user info
+        const googleUser = await getGoogleUserInfo(tokens.access_token);
+        if (!googleUser)
+            return new Response('Failed to fetch Google user info', { status: 502 });
+        if (!googleUser.email_verified)
+            return new Response('Google email not verified', { status: 403 });
+        const email = googleUser.email.toLowerCase();
+        // Allowlist checks
+        if (opts.allowedEmails?.length && !opts.allowedEmails.map((e) => e.toLowerCase()).includes(email)) {
+            return new Response('Email not authorised', { status: 403 });
+        }
+        if (opts.allowedDomains?.length) {
+            const domain = email.split('@')[1];
+            if (!domain || !opts.allowedDomains.includes(domain)) {
+                return new Response('Email domain not authorised', { status: 403 });
+            }
+        }
+        const role = resolveRole(email);
+        const user = {
+            id: `google:${googleUser.sub}`,
+            email,
+            name: googleUser.name,
+            role,
+        };
+        const accessToken = signAccessToken(user, secret);
+        const refreshToken = signRefreshToken();
+        const secure = isSecure(req);
+        const headers = new Headers({
+            Location: `${url.origin}${basePath.replace('/api/cms', '')}/cms`,
+        });
+        headers.append('Set-Cookie', setCookieHeader('airdraft_session', accessToken, [
+            'HttpOnly',
+            'SameSite=Strict',
+            'Path=/',
+            `Max-Age=${ACCESS_TTL}`,
+            ...(secure ? ['Secure'] : []),
+        ]));
+        headers.append('Set-Cookie', setCookieHeader('airdraft_refresh', refreshToken, [
+            'HttpOnly',
+            'SameSite=Strict',
+            `Path=${basePath}/auth/refresh`,
+            `Max-Age=${REFRESH_TTL}`,
+            ...(secure ? ['Secure'] : []),
+        ]));
+        headers.append('Set-Cookie', 'airdraft_oauth_state=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0');
+        return new Response(null, { status: 302, headers });
+    }
+    /** POST /auth/logout */
+    async function logoutHandler(req) {
+        const cookie = req.headers.get('cookie');
+        const refreshToken = parseCookie(cookie, 'airdraft_refresh');
+        if (refreshToken)
+            refreshTokenBlocklist.add(refreshToken);
+        const headers = new Headers({ 'Content-Type': 'application/json' });
+        headers.append('Set-Cookie', `airdraft_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0`);
+        headers.append('Set-Cookie', `airdraft_refresh=; HttpOnly; SameSite=Strict; Path=${basePath}/auth/refresh; Max-Age=0`);
+        return new Response(JSON.stringify({ ok: true }), { status: 200, headers });
+    }
+    /** GET /auth/me */
+    async function meHandler(req) {
+        const user = await verify(req);
+        if (!user)
+            return new Response(JSON.stringify({ error: 'Not authenticated' }), { status: 401 });
+        return new Response(JSON.stringify({ user: { id: user.id, email: user.email, name: user.name, role: user.role } }), { status: 200, headers: { 'Content-Type': 'application/json' } });
+    }
+    function handlers() {
+        return [
+            { path: '/auth/google', handler: googleInitHandler },
+            { path: '/auth/google/callback', handler: googleCallbackHandler },
+            { path: '/auth/logout', handler: logoutHandler },
+            { path: '/auth/me', handler: meHandler },
+        ];
+    }
+    return { verify, handlers };
+}
+//# sourceMappingURL=GoogleOAuthProvider.js.map

package/dist/GoogleOAuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleOAuthProvider.js","sourceRoot":"","sources":["../src/GoogleOAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAqBtD,KAAK,UAAU,iBAAiB,CAAC,WAAmB;IAClD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+CAA+C,EAAE;QACvE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;KACpD,CAAC,CAAA;IACF,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/D,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,MAAqB,EAAE,IAAY;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,KAAe;IACnE,OAAO,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACtE,CAAC;AA+BD,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAA;IACtE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,iDAAiD,CACpD,CAAA;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAA;IAC5C,MAAM,WAAW,GAAS,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAA;IACtD,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,CAAA;IAC1B,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;IAEpC,SAAS,WAAW,CAAC,KAAa;QAChC,OAAQ,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,CAAsB,IAAI,WAAW,CAAA;IAC9E,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,GAAY;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,OAAO,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACzC,CAAC;IAED,kDAAkD;IAClD,KAAK,UAAU,iBAAiB,CAAC,GAAY;QAC3C,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,QAAQ,uBAAuB,CAAA;QAClF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,SAAS;YACjB,KAAK;SACN,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,QAAQ,EAAE,gDAAgD,MAAM,CAAC,QAAQ,EAAE,EAAE;SAC9E,CAAC,CAAA;QACF,OAAO,CAAC,GAAG,CACT,YAAY,EACZ,eAAe,CAAC,sBAAsB,EAAE,KAAK,EAAE;YAC7C,UAAU;YACV,cAAc;YACd,QAAQ;YACR,aAAa;YACb,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrC,CAAC,CACH,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IACrD,CAAC;IAED,gCAAgC;IAChC,KAAK,UAAU,qBAAqB,CAAC,GAAY;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAE3C,aAAa;QACb,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAA;QACjF,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAC5C,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,uBAAuB,CAAA;QAErE,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,IAAI;gBACJ,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,aAAa,EAAE,IAAI,CAAC,YAAY;gBAChC,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,oBAAoB;aACjC,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,QAAQ,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACvF,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAA;QAE7D,kBAAkB;QAClB,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAC/D,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACzF,IAAI,CAAC,UAAU,CAAC,cAAc;YAAE,OAAO,IAAI,QAAQ,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEjG,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;QAE5C,mBAAmB;QACnB,IAAI,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClG,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9D,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAClC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,OAAO,IAAI,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACrE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAa;YACrB,EAAE,EAAE,UAAU,UAAU,CAAC,GAAG,EAAE;YAC9B,KAAK;YACL,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI;SACL,CAAA;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAA;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAE5B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM;SACjE,CAAC,CAAA;QACF,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,eAAe,CAAC,kBAAkB,EAAE,WAAW,EAAE;YAC/C,UAAU;YACV,iBAAiB;YACjB,QAAQ;YACR,WAAW,UAAU,EAAE;YACvB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CACH,CAAA;QACD,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,eAAe,CAAC,kBAAkB,EAAE,YAAY,EAAE;YAChD,UAAU;YACV,iBAAiB;YACjB,QAAQ,QAAQ,eAAe;YAC/B,WAAW,WAAW,EAAE;YACxB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CACH,CAAA;QACD,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,kEAAkE,CACnE,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IACrD,CAAC;IAED,wBAAwB;IACxB,KAAK,UAAU,aAAa,CAAC,GAAY;QACvC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QAC5D,IAAI,YAAY;YAAE,qBAAqB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACzD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACnE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,iEAAiE,CAAC,CAAA;QAC/F,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,sDAAsD,QAAQ,0BAA0B,CACzF,CAAA;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,mBAAmB;IACnB,KAAK,UAAU,SAAS,CAAC,GAAY;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC/F,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAC9F,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAA;IACH,CAAC;IAED,SAAS,QAAQ;QACf,OAAO;YACL,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE;YACpD,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,qBAAqB,EAAE;YACjE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE;YAChD,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;SACzC,CAAA;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC"}

package/dist/UserStore.d.ts

@@ -0,0 +1,74 @@
+import type { Role } from '@airdraft/auth';
+export interface UserRecord {
+    id: string;
+    email: string;
+    name?: string;
+    role: Role;
+    /** `salt:hash` both hex-encoded. */
+    passwordHash: string;
+    createdAt: number;
+}
+export interface InviteRecord {
+    token: string;
+    email: string;
+    role: Role;
+    /** Unix epoch seconds. */
+    expiresAt: number;
+}
+/**
+ * Persistent user store backed by `.airdraft/users.json`.
+ *
+ * - Passwords are hashed with `scrypt` (N=16384, r=8, p=1) — OWASP compliant.
+ * - On first write, auto-creates `.airdraft/.gitignore` to prevent accidental commits.
+ * - Emits a console.warn on serverless runtimes (no persistent filesystem).
+ *
+ * ```ts
+ * const store = UserStore.json() // uses .airdraft/users.json relative to cwd
+ * await store.create('alice@example.com', 'hunter2', 'admin', 'Alice')
+ * ```
+ */
+export declare class UserStore {
+    private readonly filePath;
+    private data;
+    constructor(filePath: string);
+    /** Creates a UserStore backed by `.airdraft/users.json` (or custom path). */
+    static json(path?: string): UserStore;
+    private load;
+    private save;
+    private warnIfServerless;
+    findByEmail(email: string): Promise<UserRecord | null>;
+    list(): Promise<UserRecord[]>;
+    /**
+     * Creates a new user with a scrypt-hashed password.
+     * Throws if a user with the same email already exists.
+     */
+    create(email: string, password: string, role: Role, name?: string): Promise<Omit<UserRecord, 'passwordHash'>>;
+    /**
+     * Verifies email + password and returns the user record (without hash) on success.
+     * Returns null if the user doesn't exist or the password is wrong.
+     */
+    verifyPassword(email: string, password: string): Promise<Omit<UserRecord, 'passwordHash'> | null>;
+    /**
+     * Updates the role of an existing user. Config-level roles take precedence
+     * over the store at runtime (C3), but this persists the base role.
+     */
+    updateRole(email: string, role: Role): Promise<Omit<UserRecord, 'passwordHash'> | null>;
+    /** Removes a user. Returns true if the user existed. */
+    remove(email: string): Promise<boolean>;
+    /**
+     * Creates an admin-generated invite token for the given email + role.
+     * The invite link is: `{basePath}/auth/invite/{token}` — displayed to the admin.
+     * Expiry: 48 hours.
+     */
+    createInvite(email: string, role: Role): Promise<InviteRecord>;
+    /** Returns all stored invites (including expired ones). */
+    listInvites(): Promise<InviteRecord[]>;
+    /** Removes an invite by token. No-op if the token doesn't exist. */
+    revokeInvite(token: string): Promise<void>;
+    /**
+     * Accepts an invite: sets the user's password and creates the account.
+     * Returns the new user record, or throws if the token is invalid/expired.
+     */
+    acceptInvite(token: string, password: string, name?: string): Promise<Omit<UserRecord, 'passwordHash'>>;
+}
+//# sourceMappingURL=UserStore.d.ts.map

package/dist/UserStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserStore.d.ts","sourceRoot":"","sources":["../src/UserStore.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAM1C,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,IAAI,CAAA;IACV,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,IAAI,CAAA;IACV,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAA;CAClB;AAiDD;;;;;;;;;;;GAWG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,IAAI,CAA6B;gBAE7B,QAAQ,EAAE,MAAM;IAK5B,6EAA6E;IAC7E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS;YASvB,IAAI;YAeJ,IAAI;IAelB,OAAO,CAAC,gBAAgB;IAclB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAKtD,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAKnC;;;OAGG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAqB5C;;;OAGG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC;IAYnD;;;OAGG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC;IAU7F,wDAAwD;IAClD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7C;;;;OAIG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAgBpE,2DAA2D;IACrD,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAK5C,oEAAoE;IAC9D,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMhD;;;OAGG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;CAY7C"}