@arcote.tech/arc-auth 0.7.26 → 0.7.28

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@arcote.tech/arc-auth",
   "type": "module",
-  "version": "0.7.26",
+  "version": "0.7.28",
   "private": false,
   "description": "Reusable authentication module for Arc framework — aggregate-based auth with factory pattern",
   "main": "./src/index.ts",
@@ -10,8 +10,8 @@
     "type-check": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@arcote.tech/arc": "^0.7.26",
-    "@arcote.tech/platform": "^0.7.26",
+    "@arcote.tech/arc": "^0.7.28",
+    "@arcote.tech/platform": "^0.7.28",
     "react": "^18.0.0 || ^19.0.0",
     "typescript": "^5.0.0"
   },

package/src/aggregates/account.ts

@@ -36,24 +36,34 @@ async function hashPassword(password: string): Promise<string> {
   return await Bun.password.hash(password);
 }
 
-export type AccountAggregateData<CustomFields extends ArcRawShape> = {
-  name: string;
+export type AccountAggregateData<
+  Name extends string,
+  CustomFields extends ArcRawShape,
+  TokenFields extends ArcRawShape = {},
+> = {
+  name: Name;
   accountId: AccountId;
-  token: Token;
+  token: Token<TokenFields>;
   customFields: CustomFields;
-  tokenFields?: string[];
+  tokenFields: TokenFields;
 };
 
 export const createAccountAggregate = <
+  const Name extends string,
   const CustomFields extends ArcRawShape,
-  const Data extends AccountAggregateData<CustomFields>,
+  const TokenFields extends ArcRawShape = {},
 >(
-  data: Data,
+  data: AccountAggregateData<Name, CustomFields, TokenFields>,
 ) => {
-  const { accountId, token, customFields } = data;
-  const tokenFields = data.tokenFields ?? [];
+  const { accountId, token, customFields, tokenFields } = data;
 
-  const name = data.name as Data["name"];
+  const name = data.name;
+
+  // Pola tokena to też pola konta — schemat agregatu (i eventy/komendy, które
+  // dziś mergują `customFields`) używają sumy `customFields ∪ tokenFields`,
+  // żeby np. `role` było składowane/queryowalne. Token niesie tylko tokenFields.
+  const accountFields = mergeUnsafe(customFields, tokenFields);
+  const tokenFieldNames = Object.keys(tokenFields);
 
   /** Build JWT params from account — includes accountId + tokenFields */
   const buildTokenParams = (account: {
@@ -64,7 +74,7 @@ export const createAccountAggregate = <
       string,
       unknown
     > & { accountId: string };
-    for (const field of tokenFields) {
+    for (const field of tokenFieldNames) {
       params[field] = account[field];
     }
     return params;
@@ -86,7 +96,7 @@ export const createAccountAggregate = <
           failedLoginCount: number(),
           lockedUntil: date().optional(),
         },
-        customFields,
+        accountFields,
       ),
     )
       // --- Public Events ---
@@ -99,7 +109,7 @@ export const createAccountAggregate = <
             email: string().email(),
             passwordHash: string(),
           },
-          customFields,
+          accountFields,
         ),
         async (ctx, event) => {
           // Auto-verify email on registration. Framework no longer assumes
@@ -126,7 +136,7 @@ export const createAccountAggregate = <
             provider: string(),
             providerUserId: string(),
           },
-          customFields,
+          accountFields,
         ),
         async (ctx, event) => {
           await ctx.set(event.payload.accountId, {
@@ -188,7 +198,7 @@ export const createAccountAggregate = <
                 // prawdy z checklistą klienta).
                 password: string().minLength(1).maxLength(72),
               },
-              customFields,
+              accountFields,
             ),
           )
           .withResult(
@@ -214,7 +224,7 @@ export const createAccountAggregate = <
                   return {
                     error: "EMAIL_ALREADY_TAKEN" as const,
                     accountId: existing._id,
-                    token: token.generateJWT(buildTokenParams(existing)),
+                    token: await token.generateJWT(buildTokenParams(existing)),
                   };
                 }
 
@@ -229,7 +239,7 @@ export const createAccountAggregate = <
 
                 return {
                   accountId: id,
-                  token: token.generateJWT(
+                  token: await token.generateJWT(
                     buildTokenParams({ _id: id, ...params }),
                   ),
                 };
@@ -300,7 +310,7 @@ export const createAccountAggregate = <
                   return { error: "INVALID_EMAIL_OR_PASSWORD" as const };
                 }
 
-                const jwtToken = token.generateJWT(buildTokenParams(account));
+                const jwtToken = await token.generateJWT(buildTokenParams(account));
 
                 await ctx.signedIn.emit({
                   accountId: account._id,
@@ -334,7 +344,7 @@ export const createAccountAggregate = <
                   return {
                     error: "EMAIL_ALREADY_TAKEN" as const,
                     accountId: existing._id,
-                    token: token.generateJWT(buildTokenParams(existing)),
+                    token: await token.generateJWT(buildTokenParams(existing)),
                   };
                 }
 
@@ -347,7 +357,7 @@ export const createAccountAggregate = <
 
                 return {
                   accountId: id,
-                  token: token.generateJWT(
+                  token: await token.generateJWT(
                     buildTokenParams({ _id: id, ...params }),
                   ),
                 };
@@ -373,7 +383,7 @@ export const createAccountAggregate = <
                   return { error: "ACCOUNT_NOT_FOUND" as const };
                 }
 
-                const jwtToken = token.generateJWT(buildTokenParams(account));
+                const jwtToken = await token.generateJWT(buildTokenParams(account));
 
                 await ctx.signedIn.emit({
                   accountId: account._id,
@@ -395,6 +405,7 @@ export const createAccountAggregate = <
 
 export type AccountAggregate<
   CustomFields extends ArcRawShape = ArcRawShape,
-  Data extends AccountAggregateData<CustomFields> =
-    AccountAggregateData<CustomFields>,
-> = ReturnType<typeof createAccountAggregate<CustomFields, Data>>;
+  TokenFields extends ArcRawShape = ArcRawShape,
+> = ReturnType<
+  typeof createAccountAggregate<string, CustomFields, TokenFields>
+>;

package/src/auth-builder.ts

@@ -3,23 +3,23 @@ import {
   route,
   type ArcContextElement,
   type ArcRawShape,
+  type ArcTokenAny,
 } from "@arcote.tech/arc";
 import type { AccountAggregate } from "./aggregates/account";
-import type { OAuthIdentityAggregate } from "./aggregates/oauth-identity";
 import { createAccountAggregate } from "./aggregates/account";
+import type { OAuthIdentityAggregate } from "./aggregates/oauth-identity";
 import { createOAuthIdentityAggregate } from "./aggregates/oauth-identity";
+import type { AccountId } from "./ids/account";
 import { createAccountId } from "./ids/account";
 import { createOAuthIdentityId } from "./ids/oauth-identity";
-import { createToken } from "./tokens/token";
-import { createOAuthRoutes } from "./routes/oauth-routes";
-import { createLogoutRoute } from "./routes/logout-route";
-import type { AccountId } from "./ids/account";
 import type { OAuthProvidersConfig } from "./providers/types";
-import type { Token } from "./tokens/token";
+import { createLogoutRoute } from "./routes/logout-route";
+import { createOAuthRoutes } from "./routes/oauth-routes";
+import { createToken } from "./tokens/token";
 
 export class AuthBuilder<
   AccId extends AccountId,
-  Tok extends Token,
+  Tok extends ArcTokenAny,
   Account extends AccountAggregate,
   OAuthIdentity extends OAuthIdentityAggregate | undefined,
   EnabledProviders extends string[],
@@ -35,10 +35,7 @@ export class AuthBuilder<
     readonly elements: Elements,
   ) {}
 
-  useOAuth(config: {
-    providers?: OAuthProvidersConfig;
-    baseUrl?: string;
-  }) {
+  useOAuth(config: { providers?: OAuthProvidersConfig; baseUrl?: string }) {
     const oauthIdentityId = createOAuthIdentityId({ name: this._name });
     const OAuthIdentity = createOAuthIdentityAggregate({
       name: this._name,
@@ -77,12 +74,7 @@ export class AuthBuilder<
       this.Account,
       OAuthIdentity,
       routes?.enabledProviders ?? ([] as string[]),
-      [
-        this.Account,
-        OAuthIdentity,
-        oauthStart,
-        oauthCallback,
-      ] as const,
+      [this.Account, OAuthIdentity, oauthStart, oauthCallback] as const,
     );
   }
 
@@ -104,40 +96,36 @@ export function auth<
   const Name extends string,
   const CustomFields extends ArcRawShape,
   const Secret extends string | undefined,
-  const TokenFields extends readonly (keyof CustomFields & string)[] = [],
+  const TokenFields extends ArcRawShape = {},
 >(config: {
   name: Name;
   customFields: CustomFields;
   secret: Secret;
+  /** Schemat pól wnoszonych do payloadu JWT (np. `{ role: stringEnum(...) }`).
+   *  Mergowany do schematu agregatu (są to też pola konta) i wprost do tokena. */
   tokenFields?: TokenFields;
 }) {
   const accountId = createAccountId({ name: config.name });
+  const tokenFields = (config.tokenFields ?? {}) as TokenFields;
 
-  // Extract token field schemas from customFields
-  const extraParams: Record<string, any> = {};
-  const tokenFieldsList = (config.tokenFields ?? []) as string[];
-  for (const field of tokenFieldsList) {
-    extraParams[field] = config.customFields[field];
-  }
-
-  const token = createToken({
+  const t = createToken({
     name: config.name,
     secret: config.secret,
-    extraParams: Object.keys(extraParams).length > 0 ? extraParams : undefined,
+    tokenFields,
   });
 
   const Account = createAccountAggregate({
     name: config.name,
     accountId,
-    token,
+    token: t,
     customFields: config.customFields,
-    tokenFields: tokenFieldsList,
+    tokenFields,
   });
 
   return new AuthBuilder(
     config.name,
     accountId,
-    token,
+    t,
     Account,
     undefined,
     [] as string[],

package/src/routes/oauth-routes.ts

@@ -1,4 +1,8 @@
-import { route, type ArcAggregateElement } from "@arcote.tech/arc";
+import {
+  route,
+  type ArcAggregateElement,
+  type ArcTokenAny,
+} from "@arcote.tech/arc";
 import type { AccountAggregate } from "../aggregates/account";
 import type { OAuthIdentityAggregate } from "../aggregates/oauth-identity";
 import {
@@ -15,7 +19,9 @@ import type { Token } from "../tokens/token";
 export type OAuthRoutesData = {
   providers: OAuthProvidersConfig;
   baseUrl: string;
-  token: Token;
+  // Konkretny token (z polami) — `ArcTokenAny` przepuszcza dowolny kształt;
+  // tu używamy tylko `generateJWT` w runtime, nie typu params.
+  token: ArcTokenAny;
   accountElement: AccountAggregate;
   oauthIdentityElement: OAuthIdentityAggregate;
 };

package/src/tokens/token.ts

@@ -1,17 +1,26 @@
-import { string, token, type ArcRawShape } from "@arcote.tech/arc";
+import { mergeUnsafe, string, token, type ArcRawShape } from "@arcote.tech/arc";
 
-export type TokenData = {
-  name: string;
+/**
+ * Buduje token konta. `tokenFields` to KONKRETNY schemat (`ArcRawShape`) pól,
+ * które mają trafić do payloadu JWT (np. `{ role: stringEnum(...) }`) — mergowany
+ * wprost z `accountId`. Dzięki temu typ params tokena pozostaje konkretnym
+ * kształtem (`{accountId} & TokenFields`), więc `protectBy(p => p.role)` widzi
+ * pola. KLUCZOWE: nigdy nie wpuszczać tu gołego `ArcRawShape`/`any` (index-
+ * signature degraduje typ agregatu → `ctx.query` = `unknown`).
+ */
+export const createToken = <
+  const Name extends string,
+  const TokenFields extends ArcRawShape = {},
+>(data: {
+  name: Name;
   secret: string | undefined;
-  extraParams?: ArcRawShape;
-};
+  tokenFields: TokenFields;
+}) =>
+  token(
+    `${data.name}Account`,
+    mergeUnsafe({ accountId: string() }, data.tokenFields),
+  ).secret(data.secret);
 
-export const createToken = <const Data extends TokenData>(data: Data) =>
-  token(`${data.name}Account`, {
-    accountId: string(),
-    ...(data.extraParams ?? {}),
-  }).secret(data.secret);
-
-export type Token<Data extends TokenData = TokenData> = ReturnType<
-  typeof createToken<Data>
+export type Token<TokenFields extends ArcRawShape = {}> = ReturnType<
+  typeof createToken<string, TokenFields>
 >;