@aooth/auth 0.1.1

package/dist/store-untAtWQz.d.cts

@@ -0,0 +1,124 @@
+//#region src/credential/types.d.ts
+/**
+ * What a successful auth check produces.
+ * Generic over TClaims for typed custom claims.
+ */
+interface AuthContext<TClaims extends object = object> {
+  userId: string;
+  method: "session" | "token";
+  credentialId: string;
+  expiresAt: number;
+  claims?: TClaims;
+}
+/**
+ * Display metadata for stateful credentials.
+ * Extensible via TypeScript declaration merging:
+ *   declare module '@aooth/auth' {
+ *     interface CredentialMetadata { geoCountry?: string }
+ *   }
+ */
+interface CredentialMetadata {
+  ip?: string;
+  userAgent?: string;
+  fingerprint?: string;
+  label?: string;
+}
+/**
+ * Persisted state of a credential.
+ */
+interface CredentialState<TClaims extends object = object> {
+  userId: string;
+  issuedAt: number;
+  expiresAt: number;
+  claims?: TClaims;
+  metadata?: CredentialMetadata;
+  /**
+   * Discriminant between access and refresh credentials persisted in the same store.
+   * Defaults to "access" when omitted.
+   */
+  kind?: "access" | "refresh";
+  /** For rotated refresh tokens — id of the parent credential this one replaced */
+  parentCredentialId?: string;
+  /** Timestamp of rotation; used by sliding rotation grace period */
+  rotatedAt?: number;
+}
+/**
+ * Result of issuing a credential or refreshing it.
+ */
+interface IssueResult {
+  accessToken: string;
+  refreshToken?: string;
+  accessExpiresAt: number;
+  refreshExpiresAt?: number;
+}
+/**
+ * Refresh token configuration.
+ */
+interface RefreshConfig {
+  /** Refresh token lifetime in milliseconds. */
+  ttl: number;
+  /**
+   * Rotation strategy. Defaults to 'sliding'.
+   *
+   * Note: 'sliding' grace-period replay tolerance only works against stateful
+   * stores (e.g. {@link CredentialStoreMemory}). Stateless stores (JWT,
+   * Encapsulated) cannot mutate an issued token in place; after the first
+   * rotation the old refresh becomes unusable, so 'sliding' degrades to
+   * 'always' semantics. Use 'always' explicitly for stateless deployments.
+   */
+  rotation?: "none" | "always" | "sliding";
+  /** Grace period for sliding rotation, in milliseconds. Defaults to 30_000. */
+  rotationGraceMs?: number;
+  /** Theft detection hook — invoked when a previously-rotated refresh is reused. */
+  onRotationReuse?: (state: CredentialState) => void;
+}
+//#endregion
+//#region src/stores/store.d.ts
+/**
+ * Pluggable credential storage. Implementations: Memory, JWT, Encapsulated.
+ * Same shape works for stateful and stateless stores. Stateless stores treat
+ * the token as the state itself (sign/encrypt on persist, verify/decrypt on retrieve).
+ *
+ * `TClaims` is constrained to `extends object`, which TypeScript widens to
+ * include arrays, class instances, and `Function`. Pass a plain object type
+ * (e.g. `{ role: string; tenant: string }`); using arrays/classes will type-
+ * check but won't survive JSON-serialised stateless storage round-trips.
+ */
+interface CredentialStore<TClaims extends object = object> {
+  /** Persist state, return token. For stateless stores, token IS the state. */
+  persist(state: CredentialState<TClaims>, ttl?: number): Promise<string>;
+  /** Retrieve state from token. Returns null if expired/invalid/revoked. */
+  retrieve(token: string): Promise<CredentialState<TClaims> | null>;
+  /** Retrieve + invalidate (single-use). For stateless: needs denylist. */
+  consume(token: string): Promise<CredentialState<TClaims> | null>;
+  /**
+   * Update state. The returned token MAY differ from the input — stateful
+   * stores typically return the same token, while stateless stores re-issue
+   * a new token (denylisting the old). Callers must use the returned value.
+   */
+  update(token: string, state: CredentialState<TClaims>): Promise<string>;
+  /** Revoke a single token. For stateless: requires denylist; otherwise throws. */
+  revoke(token: string): Promise<void>;
+  /**
+   * Revoke all credentials for a user. Returns count revoked.
+   * Stateless stores cannot enumerate individual tokens; they MAY implement
+   * the cascade via a per-user revocation epoch (see `CredentialStoreJwt`)
+   * and return a sentinel `1` to indicate "revocation took effect".
+   */
+  revokeAllForUser(userId: string): Promise<number>;
+  /** List active credentials for a user (stateful only). */
+  listForUser?(userId: string): Promise<Array<CredentialState<TClaims> & {
+    token: string;
+  }>>;
+}
+/**
+ * Denylist for stateless revocation. Stores revoked-but-not-yet-expired token IDs.
+ * Auto-bounded by token TTLs.
+ */
+interface DenylistStore {
+  add(jti: string, expiresAt: number): Promise<void>;
+  has(jti: string): Promise<boolean>;
+  cleanup(): Promise<number>;
+}
+//#endregion
+export { CredentialState as a, CredentialMetadata as i, DenylistStore as n, IssueResult as o, AuthContext as r, RefreshConfig as s, CredentialStore as t };

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "@aooth/auth",
+  "version": "0.1.1",
+  "description": "Auth method layer for aoothjs (sessions, tokens, password reset, MFA primitives)",
+  "keywords": [
+    "aoothjs",
+    "auth",
+    "authentication",
+    "jwt",
+    "mfa",
+    "password-reset",
+    "session",
+    "token"
+  ],
+  "homepage": "https://github.com/moostjs/aoothjs/tree/main/packages/auth#readme",
+  "bugs": {
+    "url": "https://github.com/moostjs/aoothjs/issues"
+  },
+  "license": "MIT",
+  "author": "Artem Maltsev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/moostjs/aoothjs.git",
+    "directory": "packages/auth"
+  },
+  "files": [
+    "dist",
+    "src/atscript-db/auth-credential.as"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "dist/index.mjs",
+  "module": "./dist/index.mjs",
+  "types": "dist/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs"
+    },
+    "./redis": {
+      "types": "./dist/redis.d.mts",
+      "import": "./dist/redis.mjs",
+      "require": "./dist/redis.cjs"
+    },
+    "./atscript-db": {
+      "types": "./dist/atscript-db.d.mts",
+      "import": "./dist/atscript-db.mjs",
+      "require": "./dist/atscript-db.cjs"
+    },
+    "./atscript-db/model.as": "./src/atscript-db/auth-credential.as",
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "jose": "^6.2.3",
+    "@aooth/user": "0.1.1"
+  },
+  "peerDependencies": {
+    "@atscript/db": ">=0.1.79"
+  },
+  "peerDependenciesMeta": {
+    "@atscript/db": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "vp pack",
+    "dev": "vp pack --watch",
+    "test": "vp test",
+    "check": "vp check"
+  }
+}

package/src/atscript-db/auth-credential.as

@@ -0,0 +1,44 @@
+@db.table 'aooth_credentials'
+@db.depth.limit 0
+export interface AoothAuthCredential {
+    /**
+     * Opaque token id. Server-generated UUID in `CredentialStoreAtscriptDb.persist`.
+     * Also serves as the row PK so `findOne({ filter: { token } })` and
+     * `deleteOne(token)` are O(1).
+     */
+    @meta.id
+    token: string
+
+    /** Owner. Indexed for `revokeAllForUser` / `listForUser` scans. */
+    @db.index.plain
+    userId: string
+
+    issuedAt: number.timestamp
+    expiresAt: number.timestamp
+
+    /**
+     * "access" | "refresh" discriminant. Stored as a plain string to keep
+     * the model adapter-portable — engines that lack an enum type collapse
+     * literal unions to strings anyway.
+     */
+    kind?: string
+
+    /** Custom claims, opaque JSON. */
+    @db.json
+    claims?: {
+        [key: string]: any
+    }
+
+    /** Display metadata: ip, userAgent, fingerprint, label. */
+    @db.json
+    metadata?: {
+        ip?: string
+        userAgent?: string
+        fingerprint?: string
+        label?: string
+    }
+
+    /** Set by refresh-token rotation. */
+    parentCredentialId?: string
+    rotatedAt?: number.timestamp
+}