@aooth/auth 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 aoothjs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,40 @@
+<p align="center">
+  <a href="https://aooth.moost.org">
+    <img src="https://aooth.moost.org/logo.svg" alt="aoothjs" width="120" />
+  </a>
+</p>
+
+<h1 align="center">@aooth/auth</h1>
+
+<p align="center">
+  Framework-agnostic auth method layer for aoothjs — session and token stores (in-memory, JWT, encapsulated AES-GCM), refresh rotation, denylist, magic-link + email primitives.
+</p>
+
+<p align="center">
+  <a href="https://aooth.moost.org/auth/"><strong>Documentation →</strong></a>
+</p>
+
+---
+
+## Install
+
+```bash
+pnpm add @aooth/auth @aooth/user
+```
+
+## Documentation
+
+Full docs, API reference, and recipes: **https://aooth.moost.org/auth/**
+
+- [Quick start](https://aooth.moost.org/guide/quick-start)
+- [Credentials orchestrator](https://aooth.moost.org/auth/credentials)
+- [Token stores](https://aooth.moost.org/auth/tokens)
+- [Refresh rotation](https://aooth.moost.org/auth/refresh)
+- [Magic links](https://aooth.moost.org/auth/magic-links)
+- [Password reset](https://aooth.moost.org/auth/password-reset)
+- [Stores (Redis, atscript-db)](https://aooth.moost.org/auth/stores)
+- [API reference](https://aooth.moost.org/api/auth)
+
+## License
+
+MIT

package/dist/atscript-db.cjs

@@ -0,0 +1,113 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let node_crypto = require("node:crypto");
+//#region src/atscript-db/index.ts
+/**
+* atscript-db-backed `CredentialStore`.
+*
+* - `persist` generates a random UUID token id, inserts a row.
+* - `retrieve` filters by `{ token }` and rejects rows past `expiresAt`,
+*   deleting the dead row opportunistically.
+* - `revokeAllForUser` uses `deleteMany({ userId })` — one round trip.
+* - `listForUser` uses `findMany({ filter: { userId } })` — native.
+*
+* The store assumes the table is keyed on `token` (matches the shipped
+* `.as` model). Custom tables must keep `token` as PK or override the
+* adapter.
+*/
+var CredentialStoreAtscriptDb = class {
+	table;
+	constructor(opts) {
+		this.table = opts.table;
+	}
+	async persist(state, ttl) {
+		const token = (0, node_crypto.randomUUID)();
+		const expiresAt = typeof ttl === "number" ? Date.now() + ttl : state.expiresAt;
+		const row = {
+			token,
+			userId: state.userId,
+			issuedAt: state.issuedAt,
+			expiresAt,
+			kind: state.kind,
+			claims: state.claims,
+			metadata: state.metadata,
+			parentCredentialId: state.parentCredentialId,
+			rotatedAt: state.rotatedAt
+		};
+		await this.table.insertOne(row);
+		return token;
+	}
+	async retrieve(token) {
+		const row = await this.table.findOne({ filter: { token } });
+		if (!row) return null;
+		if (row.expiresAt <= Date.now()) {
+			await this.table.deleteOne(token).catch(() => {});
+			return null;
+		}
+		return rowToState(row);
+	}
+	async consume(token) {
+		const state = await this.retrieve(token);
+		if (!state) return null;
+		await this.revoke(token);
+		return state;
+	}
+	async update(token, state) {
+		if (!await this.table.findOne({ filter: { token } })) return token;
+		if (state.expiresAt <= Date.now()) {
+			await this.revoke(token);
+			return token;
+		}
+		const row = {
+			token,
+			userId: state.userId,
+			issuedAt: state.issuedAt,
+			expiresAt: state.expiresAt,
+			kind: state.kind,
+			claims: state.claims,
+			metadata: state.metadata,
+			parentCredentialId: state.parentCredentialId,
+			rotatedAt: state.rotatedAt
+		};
+		await this.table.replaceOne(row);
+		return token;
+	}
+	async revoke(token) {
+		await this.table.deleteOne(token);
+	}
+	async revokeAllForUser(userId) {
+		return (await this.table.deleteMany({ userId })).deletedCount;
+	}
+	async listForUser(userId) {
+		const now = Date.now();
+		const rows = await this.table.findMany({ filter: { userId } });
+		const out = [];
+		const expired = [];
+		for (const row of rows) {
+			if (row.expiresAt <= now) {
+				expired.push(row.token);
+				continue;
+			}
+			out.push({
+				...rowToState(row),
+				token: row.token
+			});
+		}
+		if (expired.length > 0) await this.table.deleteMany({ token: { $in: expired } }).catch(() => {});
+		return out;
+	}
+};
+function rowToState(row) {
+	const state = {
+		userId: row.userId,
+		issuedAt: row.issuedAt,
+		expiresAt: row.expiresAt
+	};
+	if (row.claims !== void 0) state.claims = row.claims;
+	if (row.metadata !== void 0) state.metadata = row.metadata;
+	if (row.kind === "access" || row.kind === "refresh") state.kind = row.kind;
+	if (row.parentCredentialId !== void 0) state.parentCredentialId = row.parentCredentialId;
+	if (row.rotatedAt !== void 0) state.rotatedAt = row.rotatedAt;
+	return state;
+}
+//#endregion
+exports.CredentialStoreAtscriptDb = CredentialStoreAtscriptDb;

package/dist/atscript-db.d.cts

@@ -0,0 +1,85 @@
+import { a as CredentialState, t as CredentialStore } from "./store-untAtWQz.cjs";
+
+//#region src/atscript-db/index.d.ts
+/**
+ * Persisted row shape — mirrors `AoothAuthCredential` from
+ * `./auth-credential.as`. Re-declared here as a plain TS interface so
+ * consumers can use the adapter without running the atscript build (and so
+ * `@aooth/auth` doesn't need to depend on `@atscript/typescript` at build
+ * time). When you DO wire the `.as` model, the shapes match by construction.
+ */
+interface AuthCredentialRow<TClaims extends object = object> {
+  token: string;
+  userId: string;
+  issuedAt: number;
+  expiresAt: number;
+  kind?: string;
+  claims?: TClaims;
+  metadata?: {
+    ip?: string;
+    userAgent?: string;
+    fingerprint?: string;
+    label?: string;
+  };
+  parentCredentialId?: string;
+  rotatedAt?: number;
+}
+/**
+ * Structural surface of `AtscriptDbTable` covering exactly the methods this
+ * adapter calls. Kept loose to avoid pulling `@atscript/db` types into the
+ * `@aooth/auth` public surface — consumers pass `db.getTable(AoothAuthCredential)`
+ * directly and TypeScript matches by-shape.
+ */
+interface AuthCredentialTable<TClaims extends object = object> {
+  insertOne(row: AuthCredentialRow<TClaims>): Promise<{
+    insertedId: unknown;
+  }>;
+  findOne(query: {
+    filter: Record<string, unknown>;
+  }): Promise<AuthCredentialRow<TClaims> | null>;
+  findMany(query: {
+    filter?: Record<string, unknown>;
+    controls?: Record<string, unknown>;
+  }): Promise<AuthCredentialRow<TClaims>[]>;
+  replaceOne(row: AuthCredentialRow<TClaims>): Promise<{
+    matchedCount: number;
+    modifiedCount: number;
+  }>;
+  deleteOne(idOrPk: unknown): Promise<{
+    deletedCount: number;
+  }>;
+  deleteMany(filter: Record<string, unknown>): Promise<{
+    deletedCount: number;
+  }>;
+}
+interface CredentialStoreAtscriptDbOptions<TClaims extends object> {
+  table: AuthCredentialTable<TClaims>;
+}
+/**
+ * atscript-db-backed `CredentialStore`.
+ *
+ * - `persist` generates a random UUID token id, inserts a row.
+ * - `retrieve` filters by `{ token }` and rejects rows past `expiresAt`,
+ *   deleting the dead row opportunistically.
+ * - `revokeAllForUser` uses `deleteMany({ userId })` — one round trip.
+ * - `listForUser` uses `findMany({ filter: { userId } })` — native.
+ *
+ * The store assumes the table is keyed on `token` (matches the shipped
+ * `.as` model). Custom tables must keep `token` as PK or override the
+ * adapter.
+ */
+declare class CredentialStoreAtscriptDb<TClaims extends object = object> implements CredentialStore<TClaims> {
+  private readonly table;
+  constructor(opts: CredentialStoreAtscriptDbOptions<TClaims>);
+  persist(state: CredentialState<TClaims>, ttl?: number): Promise<string>;
+  retrieve(token: string): Promise<CredentialState<TClaims> | null>;
+  consume(token: string): Promise<CredentialState<TClaims> | null>;
+  update(token: string, state: CredentialState<TClaims>): Promise<string>;
+  revoke(token: string): Promise<void>;
+  revokeAllForUser(userId: string): Promise<number>;
+  listForUser(userId: string): Promise<Array<CredentialState<TClaims> & {
+    token: string;
+  }>>;
+}
+//#endregion
+export { AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb };

package/dist/atscript-db.d.mts

@@ -0,0 +1,85 @@
+import { a as CredentialState, t as CredentialStore } from "./store-B1t8KkfA.mjs";
+
+//#region src/atscript-db/index.d.ts
+/**
+ * Persisted row shape — mirrors `AoothAuthCredential` from
+ * `./auth-credential.as`. Re-declared here as a plain TS interface so
+ * consumers can use the adapter without running the atscript build (and so
+ * `@aooth/auth` doesn't need to depend on `@atscript/typescript` at build
+ * time). When you DO wire the `.as` model, the shapes match by construction.
+ */
+interface AuthCredentialRow<TClaims extends object = object> {
+  token: string;
+  userId: string;
+  issuedAt: number;
+  expiresAt: number;
+  kind?: string;
+  claims?: TClaims;
+  metadata?: {
+    ip?: string;
+    userAgent?: string;
+    fingerprint?: string;
+    label?: string;
+  };
+  parentCredentialId?: string;
+  rotatedAt?: number;
+}
+/**
+ * Structural surface of `AtscriptDbTable` covering exactly the methods this
+ * adapter calls. Kept loose to avoid pulling `@atscript/db` types into the
+ * `@aooth/auth` public surface — consumers pass `db.getTable(AoothAuthCredential)`
+ * directly and TypeScript matches by-shape.
+ */
+interface AuthCredentialTable<TClaims extends object = object> {
+  insertOne(row: AuthCredentialRow<TClaims>): Promise<{
+    insertedId: unknown;
+  }>;
+  findOne(query: {
+    filter: Record<string, unknown>;
+  }): Promise<AuthCredentialRow<TClaims> | null>;
+  findMany(query: {
+    filter?: Record<string, unknown>;
+    controls?: Record<string, unknown>;
+  }): Promise<AuthCredentialRow<TClaims>[]>;
+  replaceOne(row: AuthCredentialRow<TClaims>): Promise<{
+    matchedCount: number;
+    modifiedCount: number;
+  }>;
+  deleteOne(idOrPk: unknown): Promise<{
+    deletedCount: number;
+  }>;
+  deleteMany(filter: Record<string, unknown>): Promise<{
+    deletedCount: number;
+  }>;
+}
+interface CredentialStoreAtscriptDbOptions<TClaims extends object> {
+  table: AuthCredentialTable<TClaims>;
+}
+/**
+ * atscript-db-backed `CredentialStore`.
+ *
+ * - `persist` generates a random UUID token id, inserts a row.
+ * - `retrieve` filters by `{ token }` and rejects rows past `expiresAt`,
+ *   deleting the dead row opportunistically.
+ * - `revokeAllForUser` uses `deleteMany({ userId })` — one round trip.
+ * - `listForUser` uses `findMany({ filter: { userId } })` — native.
+ *
+ * The store assumes the table is keyed on `token` (matches the shipped
+ * `.as` model). Custom tables must keep `token` as PK or override the
+ * adapter.
+ */
+declare class CredentialStoreAtscriptDb<TClaims extends object = object> implements CredentialStore<TClaims> {
+  private readonly table;
+  constructor(opts: CredentialStoreAtscriptDbOptions<TClaims>);
+  persist(state: CredentialState<TClaims>, ttl?: number): Promise<string>;
+  retrieve(token: string): Promise<CredentialState<TClaims> | null>;
+  consume(token: string): Promise<CredentialState<TClaims> | null>;
+  update(token: string, state: CredentialState<TClaims>): Promise<string>;
+  revoke(token: string): Promise<void>;
+  revokeAllForUser(userId: string): Promise<number>;
+  listForUser(userId: string): Promise<Array<CredentialState<TClaims> & {
+    token: string;
+  }>>;
+}
+//#endregion
+export { AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb };

package/dist/atscript-db.mjs

@@ -0,0 +1,112 @@
+import { randomUUID } from "node:crypto";
+//#region src/atscript-db/index.ts
+/**
+* atscript-db-backed `CredentialStore`.
+*
+* - `persist` generates a random UUID token id, inserts a row.
+* - `retrieve` filters by `{ token }` and rejects rows past `expiresAt`,
+*   deleting the dead row opportunistically.
+* - `revokeAllForUser` uses `deleteMany({ userId })` — one round trip.
+* - `listForUser` uses `findMany({ filter: { userId } })` — native.
+*
+* The store assumes the table is keyed on `token` (matches the shipped
+* `.as` model). Custom tables must keep `token` as PK or override the
+* adapter.
+*/
+var CredentialStoreAtscriptDb = class {
+	table;
+	constructor(opts) {
+		this.table = opts.table;
+	}
+	async persist(state, ttl) {
+		const token = randomUUID();
+		const expiresAt = typeof ttl === "number" ? Date.now() + ttl : state.expiresAt;
+		const row = {
+			token,
+			userId: state.userId,
+			issuedAt: state.issuedAt,
+			expiresAt,
+			kind: state.kind,
+			claims: state.claims,
+			metadata: state.metadata,
+			parentCredentialId: state.parentCredentialId,
+			rotatedAt: state.rotatedAt
+		};
+		await this.table.insertOne(row);
+		return token;
+	}
+	async retrieve(token) {
+		const row = await this.table.findOne({ filter: { token } });
+		if (!row) return null;
+		if (row.expiresAt <= Date.now()) {
+			await this.table.deleteOne(token).catch(() => {});
+			return null;
+		}
+		return rowToState(row);
+	}
+	async consume(token) {
+		const state = await this.retrieve(token);
+		if (!state) return null;
+		await this.revoke(token);
+		return state;
+	}
+	async update(token, state) {
+		if (!await this.table.findOne({ filter: { token } })) return token;
+		if (state.expiresAt <= Date.now()) {
+			await this.revoke(token);
+			return token;
+		}
+		const row = {
+			token,
+			userId: state.userId,
+			issuedAt: state.issuedAt,
+			expiresAt: state.expiresAt,
+			kind: state.kind,
+			claims: state.claims,
+			metadata: state.metadata,
+			parentCredentialId: state.parentCredentialId,
+			rotatedAt: state.rotatedAt
+		};
+		await this.table.replaceOne(row);
+		return token;
+	}
+	async revoke(token) {
+		await this.table.deleteOne(token);
+	}
+	async revokeAllForUser(userId) {
+		return (await this.table.deleteMany({ userId })).deletedCount;
+	}
+	async listForUser(userId) {
+		const now = Date.now();
+		const rows = await this.table.findMany({ filter: { userId } });
+		const out = [];
+		const expired = [];
+		for (const row of rows) {
+			if (row.expiresAt <= now) {
+				expired.push(row.token);
+				continue;
+			}
+			out.push({
+				...rowToState(row),
+				token: row.token
+			});
+		}
+		if (expired.length > 0) await this.table.deleteMany({ token: { $in: expired } }).catch(() => {});
+		return out;
+	}
+};
+function rowToState(row) {
+	const state = {
+		userId: row.userId,
+		issuedAt: row.issuedAt,
+		expiresAt: row.expiresAt
+	};
+	if (row.claims !== void 0) state.claims = row.claims;
+	if (row.metadata !== void 0) state.metadata = row.metadata;
+	if (row.kind === "access" || row.kind === "refresh") state.kind = row.kind;
+	if (row.parentCredentialId !== void 0) state.parentCredentialId = row.parentCredentialId;
+	if (row.rotatedAt !== void 0) state.rotatedAt = row.rotatedAt;
+	return state;
+}
+//#endregion
+export { CredentialStoreAtscriptDb };