@arcote.tech/arc-auth 0.4.10 → 0.5.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@arcote.tech/arc-auth",
   "type": "module",
-  "version": "0.4.10",
+  "version": "0.5.0",
   "private": false,
   "description": "Reusable authentication module for Arc framework — aggregate-based auth with factory pattern",
   "main": "./src/index.ts",
@@ -10,7 +10,7 @@
     "type-check": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@arcote.tech/arc": "^0.4.10",
+    "@arcote.tech/arc": "^0.5.0",
     "react": "^18.0.0 || ^19.0.0",
     "typescript": "^5.0.0"
   },

package/src/aggregates/account.ts

@@ -3,8 +3,8 @@ import {
   aggregate,
   boolean,
   date,
+  mergeUnsafe,
   string,
-  type $type,
   type ArcRawShape,
 } from "@arcote.tech/arc";
 import type { AccountId } from "../ids/account";
@@ -41,9 +41,17 @@ export const createAccountAggregate = <
   const { accountId, token, customFields } = data;
   const tokenFields = data.tokenFields ?? [];
 
+  const name = data.name as Data["name"];
+
   /** Build JWT params from account — includes accountId + tokenFields */
-  const buildTokenParams = (account: any) => {
-    const params: any = { accountId: account._id };
+  const buildTokenParams = (account: {
+    _id: unknown;
+    [key: string]: unknown;
+  }) => {
+    const params = { accountId: account._id as string } as Record<
+      string,
+      unknown
+    > & { accountId: string };
     for (const field of tokenFields) {
       params[field] = account[field];
     }
@@ -51,70 +59,65 @@ export const createAccountAggregate = <
   };
 
   return (
-    aggregate(`${data.name}Accounts`, accountId, {
-      email: string().email(),
-      isEmailVerified: boolean(),
-      passwordHash: string().optional(),
-      authMethod: string(),
-      registeredAt: date(),
-      lastSignedInAt: date().optional(),
-      ...customFields,
-    })
+    aggregate(
+      `${name}Accounts`,
+      accountId,
+      mergeUnsafe(
+        {
+          email: string().email(),
+          isEmailVerified: boolean(),
+          passwordHash: string().optional(),
+          authMethod: string(),
+          registeredAt: date(),
+          lastSignedInAt: date().optional(),
+        },
+        customFields,
+      ),
+    )
       // --- Public Events ---
 
       .publicEvent(
         "accountRegistered",
-        {
-          accountId,
-          email: string().email(),
-          passwordHash: string(),
-          ...customFields,
-        },
+        mergeUnsafe(
+          {
+            accountId,
+            email: string().email(),
+            passwordHash: string(),
+          },
+          customFields,
+        ),
         async (ctx, event) => {
-          const {
-            accountId: id,
-            email,
-            passwordHash,
-            ...customData
-          } = event.payload as any;
-          await ctx.set(id, {
-            email,
+          event.payload;
+          await ctx.set(event.payload.accountId, {
             isEmailVerified: false,
-            passwordHash,
             authMethod: "email",
             registeredAt: event.createdAt,
-            lastSignedInAt: null,
-            ...customData,
-          } as any);
+            lastSignedInAt: undefined,
+            ...event.payload,
+          });
         },
       )
 
       .publicEvent(
         "accountRegisteredViaOAuth",
-        {
-          accountId,
-          email: string().email(),
-          provider: string(),
-          providerUserId: string(),
-          ...customFields,
-        },
+        mergeUnsafe(
+          {
+            accountId,
+            email: string().email(),
+            provider: string(),
+            providerUserId: string(),
+          },
+          customFields,
+        ),
         async (ctx, event) => {
-          const {
-            accountId: id,
-            email,
-            provider: _provider,
-            providerUserId: _providerUserId,
-            ...customData
-          } = event.payload as any;
-          await ctx.set(id, {
-            email,
+          await ctx.set(event.payload.accountId, {
             isEmailVerified: true,
-            passwordHash: null,
+            passwordHash: undefined,
             authMethod: "oauth",
             registeredAt: event.createdAt,
             lastSignedInAt: event.createdAt,
-            ...customData,
-          } as any);
+            ...event.payload,
+          });
         },
       )
 
@@ -122,192 +125,180 @@ export const createAccountAggregate = <
         "signedIn",
         { accountId, email: string().email() },
         async (ctx, event) => {
-          await ctx.modify(
-            event.payload.accountId as any,
-            {
-              lastSignedInAt: event.createdAt,
-            } as any,
-          );
+          await ctx.modify(event.payload.accountId, {
+            lastSignedInAt: event.createdAt,
+          });
         },
       )
 
       .publicEvent("emailVerified", { accountId }, async (ctx, event) => {
-        await ctx.modify(
-          event.payload.accountId as any,
-          {
-            isEmailVerified: true,
-          } as any,
-        );
+        await ctx.modify(event.payload.accountId, {
+          isEmailVerified: true,
+        });
       })
 
       // --- Mutate Methods ---
 
-      /**
-       * register — server-only. Hashes password, emits accountRegistered.
-       */
-      .mutateMethod(
-        "register",
-        {
-          params: {
-            email: string().email(),
-            password: string().minLength(6).maxLength(32),
-            ...customFields,
-          },
-        },
-        ONLY_SERVER &&
-          (async (ctx: any, params: any) => {
-            const existing = await ctx.$query.findOne({ email: params.email });
-            if (existing) {
-              return { error: "EMAIL_ALREADY_TAKEN" as const };
-            }
-
-            const id = accountId.generate();
-            const pwHash = await hashPassword(params.password);
-            const { email, password: _pw, ...custom } = params;
-
-            await ctx.accountRegistered.emit({
-              accountId: id,
-              email,
-              passwordHash: pwHash,
-              ...custom,
-            });
-
-            return { accountId: id };
-          }),
+      .mutateMethod("register", (fn) =>
+        fn
+          .withParams(
+            mergeUnsafe(
+              {
+                email: string().email(),
+                password: string().minLength(6).maxLength(32),
+              },
+              customFields,
+            ),
+          )
+          .handle(
+            ONLY_SERVER &&
+              (async (ctx, params) => {
+                const existing = await ctx.$query.findOne({
+                  email: params.email,
+                });
+                if (existing) {
+                  return { error: "EMAIL_ALREADY_TAKEN" as const };
+                }
+
+                const id = accountId.generate();
+                const pwHash = await hashPassword(params.password);
+
+                await ctx.accountRegistered.emit({
+                  ...params,
+                  accountId: id,
+                  passwordHash: pwHash,
+                });
+
+                return { accountId: id };
+              }),
+          ),
       )
 
-      /**
-       * signIn — server-only. Verifies password, checks email verification, returns JWT.
-       */
-      .mutateMethod(
-        "signIn",
-        {
-          params: {
+      .mutateMethod("signIn", (fn) =>
+        fn
+          .withParams({
             email: string().email(),
             password: string().minLength(6).maxLength(32),
-          },
-        },
-        ONLY_SERVER &&
-          (async (ctx: any, params: any) => {
-            const account = await ctx.$query.findOne({ email: params.email });
-
-            if (!account) {
-              return { error: "INVALID_EMAIL_OR_PASSWORD" as const };
-            }
-
-            const isValid = await verifyPassword(
-              params.password,
-              account.passwordHash,
-            );
-            if (!isValid) {
-              return { error: "INVALID_EMAIL_OR_PASSWORD" as const };
-            }
-
-            if (!account.isEmailVerified) {
-              return {
-                error: "EMAIL_NOT_VERIFIED" as const,
-                email: params.email,
-              };
-            }
-
-            const jwtToken = token.generateJWT(buildTokenParams(account));
-
-            await ctx.signedIn.emit({
-              accountId: account._id,
-              email: params.email,
-            });
-
-            return { token: jwtToken };
-          }),
+          })
+          .handle(
+            ONLY_SERVER &&
+              (async (ctx, params) => {
+                const account = await ctx.$query.findOne({
+                  email: params.email,
+                });
+
+                if (!account) {
+                  return { error: "INVALID_EMAIL_OR_PASSWORD" as const };
+                }
+
+                const isValid = await verifyPassword(
+                  params.password,
+                  account.passwordHash!,
+                );
+                if (!isValid) {
+                  return { error: "INVALID_EMAIL_OR_PASSWORD" as const };
+                }
+
+                if (!account.isEmailVerified) {
+                  return {
+                    error: "EMAIL_NOT_VERIFIED" as const,
+                    email: params.email,
+                  };
+                }
+
+                const jwtToken = token.generateJWT(buildTokenParams(account));
+
+                await ctx.signedIn.emit({
+                  accountId: account._id,
+                  email: params.email,
+                });
+
+                return { token: jwtToken };
+              }),
+          ),
       )
 
-      /**
-       * registerViaOAuth — server-only. Creates account from OAuth provider data.
-       */
-      .mutateMethod(
-        "registerViaOAuth",
-        {
-          params: {
-            email: string().email(),
-            provider: string(),
-            providerUserId: string(),
-            ...customFields,
-          },
-          result: {} as
-            | { accountId: $type<typeof accountId>; token: string }
-            | {
-                error: "EMAIL_ALREADY_TAKEN";
-                accountId: $type<typeof accountId>;
-                token: string;
+      .mutateMethod("registerViaOAuth", (fn) =>
+        fn
+          .withParams(
+            mergeUnsafe(
+              {
+                email: string().email(),
+                provider: string(),
+                providerUserId: string(),
               },
-        },
-        ONLY_SERVER &&
-          (async (ctx: any, params: any) => {
-            const existing = await ctx.$query.findOne({ email: params.email });
-            if (existing) {
-              return {
-                error: "EMAIL_ALREADY_TAKEN" as const,
-                accountId: existing._id,
-                token: token.generateJWT(buildTokenParams(existing)),
-              };
-            }
-
-            const id = accountId.generate();
-            const { email, provider, providerUserId, ...custom } = params;
-
-            await ctx.accountRegisteredViaOAuth.emit({
-              accountId: id,
-              email,
-              provider,
-              providerUserId,
-              ...custom,
-            });
-
-            // Fetch newly created account to get defaults (e.g. role)
-            const newAccount = await ctx.$query.findOne({ _id: id });
-            return {
-              accountId: id,
-              token: token.generateJWT(buildTokenParams(newAccount ?? { _id: id })),
-            };
-          }),
+              customFields,
+            ),
+          )
+          .handle(
+            ONLY_SERVER &&
+              (async (ctx, params) => {
+                const existing = await ctx.$query.findOne({
+                  email: params.email,
+                });
+                if (existing) {
+                  return {
+                    error: "EMAIL_ALREADY_TAKEN" as const,
+                    accountId: existing._id,
+                    token: token.generateJWT(buildTokenParams(existing)),
+                  };
+                }
+
+                const id = accountId.generate();
+
+                await ctx.accountRegisteredViaOAuth.emit({
+                  ...params,
+                  accountId: id,
+                });
+
+                const newAccount = await ctx.$query.findOne({ _id: id });
+                return {
+                  accountId: id,
+                  token: token.generateJWT(
+                    buildTokenParams(newAccount ?? { _id: id }),
+                  ),
+                };
+              }),
+          ),
       )
 
-      /**
-       * signInViaOAuth — server-only. Signs in via OAuth (no password check).
-       * Identity already verified by the OAuth provider.
-       */
-      .mutateMethod(
-        "signInViaOAuth",
-        {
-          params: {
+      .mutateMethod("signInViaOAuth", (fn) =>
+        fn
+          .withParams({
             email: string().email(),
             provider: string(),
             providerUserId: string(),
-          },
-          result: {} as { token: string } | { error: "ACCOUNT_NOT_FOUND" },
-        },
-        ONLY_SERVER &&
-          (async (ctx: any, params: any) => {
-            const account = await ctx.$query.findOne({ email: params.email });
-
-            if (!account) {
-              return { error: "ACCOUNT_NOT_FOUND" as const };
-            }
-
-            const jwtToken = token.generateJWT(buildTokenParams(account));
-
-            await ctx.signedIn.emit({
-              accountId: account._id,
-              email: params.email,
-            });
-
-            return { token: jwtToken };
-          }),
+          })
+          .handle(
+            ONLY_SERVER &&
+              (async (ctx, params) => {
+                const account = await ctx.$query.findOne({
+                  email: params.email,
+                });
+
+                if (!account) {
+                  return { error: "ACCOUNT_NOT_FOUND" as const };
+                }
+
+                const jwtToken = token.generateJWT(buildTokenParams(account));
+
+                await ctx.signedIn.emit({
+                  accountId: account._id,
+                  email: params.email,
+                });
+
+                return { token: jwtToken };
+              }),
+          ),
       )
 
-      .protectBy(token, (params: any) => ({ _id: params.accountId }))
-      .clientQuery("getAll", async (ctx) => ctx.$query.find({}))
-      .clientQuery("getMe", async (ctx) => ctx.$query.findOne({}))
+      .protectBy(token, (params) => ({ _id: params.accountId }))
+      .clientQuery("getAll", (fn) =>
+        fn.handle(async (ctx) => ctx.$query.find({})),
+      )
+      .clientQuery("getMe", (fn) =>
+        fn.handle(async (ctx) => ctx.$query.findOne({})),
+      )
   );
 };
 

package/src/aggregates/oauth-identity.ts

@@ -1,6 +1,6 @@
 import { aggregate, date, string } from "@arcote.tech/arc";
-import type { OAuthIdentityId } from "../ids/oauth-identity";
 import type { AccountId } from "../ids/account";
+import type { OAuthIdentityId } from "../ids/oauth-identity";
 
 export type OAuthIdentityAggregateData = {
   name: string;
@@ -14,8 +14,9 @@ export const createOAuthIdentityAggregate = <
   data: Data,
 ) => {
   const { oauthIdentityId, accountId } = data;
+  const name = data.name as Data["name"];
 
-  return aggregate(`${data.name}OAuthIdentities`, oauthIdentityId, {
+  return aggregate(`${name}OAuthIdentities`, oauthIdentityId, {
     accountId,
     provider: string(),
     providerUserId: string(),
@@ -39,15 +40,15 @@ export const createOAuthIdentityAggregate = <
           provider,
           providerUserId,
           providerEmail,
-        } = event.payload as any;
+        } = event.payload;
         await ctx.set(id, {
           accountId: accId,
           provider,
           providerUserId,
           providerEmail,
           linkedAt: event.createdAt,
-          lastUsedAt: null,
-        } as any);
+          lastUsedAt: undefined,
+        });
       },
     )
 
@@ -55,9 +56,9 @@ export const createOAuthIdentityAggregate = <
       "oauthIdentityUsed",
       { oauthIdentityId },
       async (ctx, event) => {
-        await ctx.modify(event.payload.oauthIdentityId as any, {
+        await ctx.modify(event.payload.oauthIdentityId, {
           lastUsedAt: event.createdAt,
-        } as any);
+        });
       },
     )
 
@@ -65,65 +66,68 @@ export const createOAuthIdentityAggregate = <
       "oauthIdentityUnlinked",
       { oauthIdentityId },
       async (ctx, event) => {
-        await ctx.remove(event.payload.oauthIdentityId as any);
+        await ctx.remove(event.payload.oauthIdentityId);
       },
     )
 
-    .mutateMethod(
-    "linkIdentity",
-    {
-        params: {
+    .mutateMethod("linkIdentity", (fn) =>
+      fn
+        .withParams({
           accountId,
           provider: string(),
           providerUserId: string(),
           providerEmail: string().email(),
-        },
-      },
-      ONLY_SERVER &&
-        (async (ctx: any, params: any) => {
-          // Check for duplicate (same provider + providerUserId)
-          const existing = await ctx.$query.findOne({
-            provider: params.provider,
-            providerUserId: params.providerUserId,
-          });
-          if (existing) {
-            return { error: "OAUTH_IDENTITY_ALREADY_LINKED" as const };
-          }
+        })
+        .handle(
+          ONLY_SERVER &&
+            (async (ctx, params) => {
+              const existing = await ctx.$query.findOne({
+                provider: params.provider,
+                providerUserId: params.providerUserId,
+              });
+              if (existing) {
+                return { error: "OAUTH_IDENTITY_ALREADY_LINKED" as const };
+              }
 
-          const id = oauthIdentityId.generate();
+              const id = oauthIdentityId.generate();
 
-          await ctx.oauthIdentityLinked.emit({
-            oauthIdentityId: id,
-            accountId: params.accountId,
-            provider: params.provider,
-            providerUserId: params.providerUserId,
-            providerEmail: params.providerEmail,
-          });
+              await ctx.oauthIdentityLinked.emit({
+                oauthIdentityId: id,
+                accountId: params.accountId,
+                provider: params.provider,
+                providerUserId: params.providerUserId,
+                providerEmail: params.providerEmail,
+              });
 
-          return { oauthIdentityId: id };
-        }),
+              return { oauthIdentityId: id };
+            }),
+        ),
     )
 
-    .mutateMethod(
-    "markUsed",
-    { params: { oauthIdentityId } },
-      ONLY_SERVER &&
-        (async (ctx: any, params: any) => {
-          await ctx.oauthIdentityUsed.emit({
-            oauthIdentityId: params.oauthIdentityId,
-          });
-        }),
+    .mutateMethod("markUsed", (fn) =>
+      fn.withParams({ oauthIdentityId }).handle(
+        ONLY_SERVER &&
+          (async (ctx, params) => {
+            await ctx["oauthIdentityUsed"].emit({
+              oauthIdentityId: params.oauthIdentityId,
+            });
+          }),
+      ),
     )
-    .clientQuery("getAll", async (ctx) => ctx.$query.find({}))
-    .clientQuery(
-      "findByProvider",
-      async (ctx, params: { provider: string; providerUserId: string }) =>
-        ctx.$query.findOne({
-          provider: params.provider,
-          providerUserId: params.providerUserId,
-        }),
+    .clientQuery("getAll", (fn) =>
+      fn.handle(async (ctx) => ctx.$query.find({})),
     )
-;
+    .clientQuery("findByProvider", (fn) =>
+      fn
+        .withParams({ provider: string(), providerUserId: string() })
+        .handle(
+          async (ctx, params: { provider: string; providerUserId: string }) =>
+            ctx.$query.findOne({
+              provider: params.provider,
+              providerUserId: params.providerUserId,
+            }),
+        ),
+    );
 };
 
 export type OAuthIdentityAggregate<

package/src/auth-builder.ts

@@ -1,23 +1,26 @@
 import {
   context,
   route,
-  type ArcAggregateElement,
   type ArcContextElement,
   type ArcRawShape,
 } from "@arcote.tech/arc";
+import type { AccountAggregate } from "./aggregates/account";
+import type { OAuthIdentityAggregate } from "./aggregates/oauth-identity";
 import { createAccountAggregate } from "./aggregates/account";
 import { createOAuthIdentityAggregate } from "./aggregates/oauth-identity";
 import { createAccountId } from "./ids/account";
 import { createOAuthIdentityId } from "./ids/oauth-identity";
 import { createToken } from "./tokens/token";
 import { createOAuthRoutes } from "./routes/oauth-routes";
+import type { AccountId } from "./ids/account";
 import type { OAuthProvidersConfig } from "./providers/types";
+import type { Token } from "./tokens/token";
 
 export class AuthBuilder<
-  AccId,
-  Tok,
-  Account extends ArcAggregateElement<any, any, any, any, any, any>,
-  OAuthIdentity extends ArcAggregateElement<any, any, any, any, any, any> | undefined,
+  AccId extends AccountId,
+  Tok extends Token,
+  Account extends AccountAggregate,
+  OAuthIdentity extends OAuthIdentityAggregate | undefined,
   EnabledProviders extends string[],
   Elements extends ArcContextElement<any>[],
 > {
@@ -39,7 +42,7 @@ export class AuthBuilder<
     const OAuthIdentity = createOAuthIdentityAggregate({
       name: this._name,
       oauthIdentityId,
-      accountId: this.accountId as any,
+      accountId: this.accountId,
     });
 
     const hasProviders = config.providers && config.baseUrl;
@@ -47,7 +50,7 @@ export class AuthBuilder<
       ? createOAuthRoutes({
           providers: config.providers!,
           baseUrl: config.baseUrl!,
-          token: this.token as any,
+          token: this.token,
           accountElement: this.Account,
           oauthIdentityElement: OAuthIdentity,
         })

package/src/routes/oauth-routes.ts

@@ -248,9 +248,13 @@ export function createOAuthRoutes(data: OAuthRoutesData) {
         const targetUrl = new URL(decodedRedirect, baseUrl);
         targetUrl.searchParams.set("token", jwtToken);
 
-        // Clear state cookie
+        // Set auth cookie + clear state cookie
         const response = Response.redirect(targetUrl.toString(), 302);
         const headers = new Headers(response.headers);
+        headers.append(
+          "Set-Cookie",
+          `arc_token=${encodeURIComponent(jwtToken)}; HttpOnly; SameSite=Lax; Path=/; Max-Age=604800`,
+        );
         headers.append(
           "Set-Cookie",
           `oauth_state=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`,

package/src/tokens/token.ts

@@ -10,7 +10,7 @@ export const createToken = <const Data extends TokenData>(data: Data) =>
   token(`${data.name}Account`, {
     accountId: string(),
     ...(data.extraParams ?? {}),
-  } as any).secret(data.secret);
+  }).secret(data.secret);
 
 export type Token<Data extends TokenData = TokenData> = ReturnType<
   typeof createToken<Data>