@assemora/auth 0.1.0

package/dist/queries.js

@@ -0,0 +1,236 @@
+/**
+ * Reading who exists and what they may do (SPEC.md §15, §50).
+ *
+ * Administration screens need to see users, roles, permissions, tokens and agents,
+ * and every one of those reads travels the Query Bus — so it is validated, it is
+ * authorized, and no layer above this one has to depend on it (ADR-0014).
+ *
+ * Nothing sensitive is projected. A password hash and a token digest exist in this
+ * package and stop here (SPEC.md §85).
+ */
+import { NotFoundError, query } from '@assemora/core';
+import { array, boolean, email as emailSchema, number, object, string, timestamp, uuid, } from '@assemora/schema';
+import { Agent, ApiToken, Permission, Role, RolePermission, User, UserRole } from './models.js';
+import { permissionsOf } from './permissions.js';
+const paging = {
+    page: number().integer().optional(),
+    perPage: number().integer().optional(),
+};
+/** What every listing answers beside its rows: the page it is, and how many there are. */
+const paged = {
+    total: number().integer(),
+    page: number().integer(),
+    perPage: number().integer(),
+    lastPage: number().integer(),
+};
+const limit = (perPage) => Math.min(perPage ?? 20, 100);
+/** The role names a set of users hold, in one query rather than one per user. */
+const rolesByUser = async (userIds) => {
+    const byUser = new Map();
+    if (userIds.length === 0)
+        return byUser;
+    const links = await UserRole.whereIn('userId', [...userIds]);
+    if (links.length === 0)
+        return byUser;
+    const roles = await Role.whereIn('id', [...new Set(links.map((link) => link.roleId))]);
+    const nameById = new Map(roles.map((role) => [role.id, role.name]));
+    for (const link of links) {
+        const name = nameById.get(link.roleId);
+        if (name === undefined)
+            continue;
+        byUser.set(link.userId, [...(byUser.get(link.userId) ?? []), name]);
+    }
+    return byUser;
+};
+export const ListUsers = query('auth.users.list', {
+    description: 'A page of users, with the roles they hold',
+    input: { search: string().optional(), active: boolean().optional(), ...paging },
+    output: {
+        data: array(object({
+            id: uuid(),
+            email: emailSchema(),
+            name: string(),
+            active: boolean(),
+            roles: array(string()),
+            version: number().integer(),
+            createdAt: timestamp(),
+        })),
+        ...paged,
+    },
+    handle: async ({ search, active, page, perPage }) => {
+        let found = User.orderBy('createdAt', 'desc');
+        if (active !== undefined)
+            found = found.where('active', active);
+        if (search !== undefined && search !== '') {
+            found = found.where((builder) => builder.whereLike('name', `%${search}%`).orWhere('email', 'like', `%${search}%`));
+        }
+        const listed = await found.paginate(page ?? 1, limit(perPage));
+        const roles = await rolesByUser(listed.data.map((user) => user.id));
+        return {
+            ...listed,
+            data: listed.data.map((user) => ({
+                id: user.id,
+                email: user.email,
+                name: user.name,
+                active: user.active,
+                roles: roles.get(user.id) ?? [],
+                /** Echoed back as `expectedVersion` by any edit (SPEC.md §66). */
+                version: user.version,
+                createdAt: user.createdAt,
+            })),
+        };
+    },
+});
+export const GetUser = query('auth.users.get', {
+    description: 'One user, with their roles and everything those roles allow',
+    input: { id: uuid() },
+    output: {
+        id: uuid(),
+        email: emailSchema(),
+        name: string(),
+        active: boolean(),
+        roles: array(string()),
+        permissions: array(string()),
+        version: number().integer(),
+        createdAt: timestamp(),
+        updatedAt: timestamp(),
+    },
+    handle: async ({ id }) => {
+        const user = await User.find(id);
+        if (user === null)
+            throw new NotFoundError('user', id);
+        const roles = await rolesByUser([user.id]);
+        return {
+            id: user.id,
+            email: user.email,
+            name: user.name,
+            active: user.active,
+            roles: roles.get(user.id) ?? [],
+            permissions: [...(await permissionsOf({ type: 'user', id: user.id }))],
+            version: user.version,
+            createdAt: user.createdAt,
+            updatedAt: user.updatedAt,
+        };
+    },
+});
+export const ListRoles = query('auth.roles.list', {
+    description: 'Every role, with the permissions it carries',
+    input: {},
+    output: {
+        data: array(object({
+            id: uuid(),
+            name: string(),
+            label: string(),
+            version: number().integer(),
+            permissions: array(string()),
+        })),
+    },
+    handle: async () => {
+        const roles = await Role.orderBy('name', 'asc').get();
+        const links = await RolePermission.whereIn('roleId', roles.map((role) => role.id));
+        const permissions = await Permission.whereIn('id', [
+            ...new Set(links.map((link) => link.permissionId)),
+        ]);
+        const nameById = new Map(permissions.map((permission) => [permission.id, permission.name]));
+        return {
+            data: roles.map((role) => ({
+                id: role.id,
+                name: role.name,
+                label: role.label,
+                version: role.version,
+                permissions: links
+                    .filter((link) => link.roleId === role.id)
+                    .map((link) => nameById.get(link.permissionId))
+                    .filter((name) => name !== undefined)
+                    .sort(),
+            })),
+        };
+    },
+});
+export const ListPermissions = query('auth.permissions.list', {
+    description: 'Every permission that has been recorded',
+    input: {},
+    output: {
+        data: array(object({ id: uuid(), name: string(), description: string().nullable() })),
+    },
+    handle: async () => ({
+        data: (await Permission.orderBy('name', 'asc').get()).map((permission) => ({
+            id: permission.id,
+            name: permission.name,
+            description: permission.description,
+        })),
+    }),
+});
+export const ListApiTokens = query('auth.tokens.list', {
+    description: 'Which API tokens exist. Never what they are',
+    input: { userId: uuid().optional(), ...paging },
+    output: {
+        data: array(object({
+            id: uuid(),
+            name: string(),
+            userId: uuid().nullable(),
+            /** As the column declares it: `array()` infers a mutable array, and the row's is not. */
+            permissions: array(string()),
+            expiresAt: timestamp().nullable(),
+            lastUsedAt: timestamp().nullable(),
+            createdAt: timestamp(),
+        })),
+        ...paged,
+    },
+    handle: async ({ userId, page, perPage }) => {
+        let found = ApiToken.orderBy('createdAt', 'desc');
+        if (userId !== undefined)
+            found = found.where('userId', userId);
+        const listed = await found.paginate(page ?? 1, limit(perPage));
+        return {
+            ...listed,
+            data: listed.data.map((token) => ({
+                id: token.id,
+                name: token.name,
+                userId: token.userId,
+                permissions: token.permissions,
+                expiresAt: token.expiresAt,
+                lastUsedAt: token.lastUsedAt,
+                createdAt: token.createdAt,
+            })),
+        };
+    },
+});
+export const ListAgents = query('auth.agents.list', {
+    description: 'The agent identities this application knows (SPEC.md §72)',
+    input: paging,
+    output: {
+        data: array(object({
+            id: uuid(),
+            name: string(),
+            description: string().nullable(),
+            permissions: array(string()),
+            enabled: boolean(),
+            createdAt: timestamp(),
+        })),
+        ...paged,
+    },
+    handle: async ({ page, perPage }) => {
+        const listed = await Agent.orderBy('name', 'asc').paginate(page ?? 1, limit(perPage));
+        return {
+            ...listed,
+            data: listed.data.map((agent) => ({
+                id: agent.id,
+                name: agent.name,
+                description: agent.description,
+                permissions: agent.permissions,
+                enabled: agent.enabled,
+                createdAt: agent.createdAt,
+            })),
+        };
+    },
+});
+export const authQueries = [
+    ListUsers,
+    GetUser,
+    ListRoles,
+    ListPermissions,
+    ListApiTokens,
+    ListAgents,
+];
+//# sourceMappingURL=queries.js.map

package/dist/queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queries.js","sourceRoot":"","sources":["../src/queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EACL,KAAK,EACL,OAAO,EACP,KAAK,IAAI,WAAW,EACpB,MAAM,EACN,MAAM,EACN,MAAM,EACN,SAAS,EACT,IAAI,GACL,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD,MAAM,MAAM,GAAG;IACb,IAAI,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAA;AAED,0FAA0F;AAC1F,MAAM,KAAK,GAAG;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE;IACzB,IAAI,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE;CAC7B,CAAA;AAED,MAAM,KAAK,GAAG,CAAC,OAA2B,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;AAEnF,iFAAiF;AACjF,MAAM,WAAW,GAAG,KAAK,EAAE,OAA0B,EAAkC,EAAE;IACvF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAA;IAE1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IAEvC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAA;IAE5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IAErC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IACtF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAEnE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAEtC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAEhC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;IACrE,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,iBAAiB,EAAE;IAChD,WAAW,EAAE,2CAA2C;IACxD,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE;IAC/E,MAAM,EAAE;QACN,IAAI,EAAE,KAAK,CACT,MAAM,CAAC;YACL,EAAE,EAAE,IAAI,EAAE;YACV,KAAK,EAAE,WAAW,EAAE;YACpB,IAAI,EAAE,MAAM,EAAE;YACd,MAAM,EAAE,OAAO,EAAE;YACjB,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE;YAC3B,SAAS,EAAE,SAAS,EAAE;SACvB,CAAC,CACH;QACD,GAAG,KAAK;KACT;IACD,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAClD,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAE7C,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAC1C,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9B,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,MAAM,GAAG,CAAC,CACjF,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAEnE,OAAO;YACL,GAAG,MAAM;YACT,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC/B,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE;gBAC/B,kEAAkE;gBAClE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;SACJ,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,EAAE;IAC7C,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,EAAE;QACN,EAAE,EAAE,IAAI,EAAE;QACV,KAAK,EAAE,WAAW,EAAE;QACpB,IAAI,EAAE,MAAM,EAAE;QACd,MAAM,EAAE,OAAO,EAAE;QACjB,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACtB,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE;QAC3B,SAAS,EAAE,SAAS,EAAE;QACtB,SAAS,EAAE,SAAS,EAAE;KACvB;IACD,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAEhC,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAEtD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAE1C,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE;YAC/B,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACtE,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,iBAAiB,EAAE;IAChD,WAAW,EAAE,6CAA6C;IAC1D,KAAK,EAAE,EAAE;IACT,MAAM,EAAE;QACN,IAAI,EAAE,KAAK,CACT,MAAM,CAAC;YACL,EAAE,EAAE,IAAI,EAAE;YACV,IAAI,EAAE,MAAM,EAAE;YACd,KAAK,EAAE,MAAM,EAAE;YACf,OAAO,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE;YAC3B,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAC7B,CAAC,CACH;KACF;IACD,MAAM,EAAE,KAAK,IAAI,EAAE;QACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,CAAA;QACrD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CACxC,QAAQ,EACR,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAC7B,CAAA;QACD,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE;YACjD,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SACnD,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAE3F,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACzB,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,WAAW,EAAE,KAAK;qBACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;qBACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;qBAC9C,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;qBACpD,IAAI,EAAE;aACV,CAAC,CAAC;SACJ,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC,uBAAuB,EAAE;IAC5D,WAAW,EAAE,yCAAyC;IACtD,KAAK,EAAE,EAAE;IACT,MAAM,EAAE;QACN,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;KACtF;IACD,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACnB,IAAI,EAAE,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACzE,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;KACJ,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC,kBAAkB,EAAE;IACrD,WAAW,EAAE,6CAA6C;IAC1D,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE;IAC/C,MAAM,EAAE;QACN,IAAI,EAAE,KAAK,CACT,MAAM,CAAC;YACL,EAAE,EAAE,IAAI,EAAE;YACV,IAAI,EAAE,MAAM,EAAE;YACd,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE;YACzB,yFAAyF;YACzF,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,SAAS,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE;YAClC,SAAS,EAAE,SAAS,EAAE;SACvB,CAAC,CACH;QACD,GAAG,KAAK;KACT;IACD,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,IAAI,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAEjD,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAE/D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QAE9D,OAAO;YACL,GAAG,MAAM;YACT,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAChC,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;SACJ,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,kBAAkB,EAAE;IAClD,WAAW,EAAE,2DAA2D;IACxE,KAAK,EAAE,MAAM;IACb,MAAM,EAAE;QACN,IAAI,EAAE,KAAK,CACT,MAAM,CAAC;YACL,EAAE,EAAE,IAAI,EAAE;YACV,IAAI,EAAE,MAAM,EAAE;YACd,WAAW,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE;YAClB,SAAS,EAAE,SAAS,EAAE;SACvB,CAAC,CACH;QACD,GAAG,KAAK;KACT;IACD,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QAErF,OAAO;YACL,GAAG,MAAM;YACT,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAChC,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;SACJ,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,SAAS;IACT,OAAO;IACP,SAAS;IACT,eAAe;IACf,aAAa;IACb,UAAU;CACF,CAAA"}

package/dist/sessions.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Studio sessions (SPEC.md §49).
+ *
+ * The session lives on the server; the browser holds only a secret, which the HTTP
+ * layer keeps in an `httpOnly`, `Secure`, `SameSite` cookie. What is stored here is a
+ * digest of that secret, so a leaked database does not hand anyone a live session.
+ */
+import type { Actor } from '@assemora/core';
+export declare const SESSION_PREFIX = "ses";
+/** Two weeks, the usual compromise between a nuisance and a risk. */
+export declare const DEFAULT_SESSION_TTL_MS: number;
+export type StartedSession = {
+    /** Goes into the cookie. Never stored, never logged. */
+    readonly token: string;
+    readonly expiresAt: Date;
+    readonly sessionId: string;
+};
+export type SessionDetails = {
+    readonly userAgent?: string;
+    /**
+     * Where the sign-in came from, when the host genuinely knows.
+     *
+     * `auth.login` does not fill it, and deliberately does not accept one either: the
+     * process cannot know the client's address on its own. Behind any proxy the socket
+     * peer is the proxy, and believing `X-Forwarded-For` without a configured chain of
+     * trusted hops is a value the client chose. Closing that means a trusted-proxy
+     * option on `createHttpServer` and an `ipAddress` on the context; until then an
+     * empty column is the truthful answer, and this stays for a host that has already
+     * resolved the address by other means (SPEC.md §85).
+     */
+    readonly ipAddress?: string;
+    readonly ttlMs?: number;
+};
+export declare const startSession: (userId: string, details?: SessionDetails) => Promise<StartedSession>;
+/** The actor behind a session secret, or nobody. */
+export declare const sessionActor: (token: string) => Promise<Actor | undefined>;
+export declare const endSession: (token: string) => Promise<void>;
+/** Removes what has expired. Called on a schedule, never on the request path. */
+export declare const purgeExpiredSessions: () => Promise<number>;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAK3C,eAAO,MAAM,cAAc,QAAQ,CAAA;AAEnC,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAE9D,MAAM,MAAM,cAAc,GAAG;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,YAAY,WACf,MAAM,YACL,cAAc,KACtB,OAAO,CAAC,cAAc,CAaxB,CAAA;AAED,oDAAoD;AACpD,eAAO,MAAM,YAAY,UAAiB,MAAM,KAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAU3E,CAAA;AAED,eAAO,MAAM,UAAU,UAAiB,MAAM,KAAG,OAAO,CAAC,IAAI,CAI5D,CAAA;AAED,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,QAAa,OAAO,CAAC,MAAM,CAM3D,CAAA"}

package/dist/sessions.js

@@ -0,0 +1,39 @@
+import { hashToken, issueToken } from './credentials.js';
+import { Session, User } from './models.js';
+export const SESSION_PREFIX = 'ses';
+/** Two weeks, the usual compromise between a nuisance and a risk. */
+export const DEFAULT_SESSION_TTL_MS = 14 * 24 * 60 * 60 * 1000;
+export const startSession = async (userId, details = {}) => {
+    const issued = issueToken(SESSION_PREFIX);
+    const expiresAt = new Date(Date.now() + (details.ttlMs ?? DEFAULT_SESSION_TTL_MS));
+    const session = await Session.create({
+        tokenHash: issued.hash,
+        userId,
+        userAgent: details.userAgent ?? null,
+        ipAddress: details.ipAddress ?? null,
+        expiresAt,
+    });
+    return { token: issued.token, expiresAt, sessionId: session.id };
+};
+/** The actor behind a session secret, or nobody. */
+export const sessionActor = async (token) => {
+    const session = await Session.where('tokenHash', hashToken(token)).first();
+    if (session === null || session.expiresAt.getTime() <= Date.now())
+        return undefined;
+    const user = await User.find(session.userId);
+    if (user === null || !user.active)
+        return undefined;
+    return { type: 'user', id: user.id };
+};
+export const endSession = async (token) => {
+    const session = await Session.where('tokenHash', hashToken(token)).first();
+    await session?.delete();
+};
+/** Removes what has expired. Called on a schedule, never on the request path. */
+export const purgeExpiredSessions = async () => {
+    const expired = await Session.where('expiresAt', '<=', new Date()).get();
+    for (const session of expired)
+        await session.delete();
+    return expired.length;
+};
+//# sourceMappingURL=sessions.js.map

package/dist/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAA;AAEnC,qEAAqE;AACrE,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AA0B9D,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,MAAc,EACd,OAAO,GAAmB,EAAE,EACH,EAAE;IAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAAC,CAAC,CAAA;IAElF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;QACnC,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,SAAS;KACV,CAAC,CAAA;IAEF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;AAClE,CAAC,CAAA;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,KAAa,EAA8B,EAAE;IAC9E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAA;IAE1E,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAA;IAEnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAE5C,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAEnD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,KAAa,EAAiB,EAAE;IAC/D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAA;IAE1E,MAAM,OAAO,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC,CAAA;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,IAAqB,EAAE;IAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;IAExE,KAAK,MAAM,OAAO,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;IAErD,OAAO,OAAO,CAAC,MAAM,CAAA;AACvB,CAAC,CAAA"}

package/dist/tokens.d.ts

@@ -0,0 +1,40 @@
+/**
+ * API tokens and agent tokens (SPEC.md §49, §72).
+ *
+ * A token is shown once, at creation, and stored only as a digest. Nothing in the
+ * system can recover it, which is the point: a database dump is not a set of keys.
+ */
+import type { Actor } from '@assemora/core';
+export declare const API_TOKEN_PREFIX = "ast";
+export declare const AGENT_TOKEN_PREFIX = "agt";
+export type IssuedApiToken = {
+    /** Shown once. Store it somewhere safe or issue another. */
+    readonly token: string;
+    readonly id: string;
+};
+export type ApiTokenDetails = {
+    readonly name: string;
+    readonly permissions: readonly string[];
+    readonly userId?: string;
+    readonly expiresAt?: Date;
+};
+export declare const createApiToken: (details: ApiTokenDetails) => Promise<IssuedApiToken>;
+export type AgentDetails = {
+    readonly name: string;
+    readonly description?: string;
+    readonly permissions: readonly string[];
+};
+export type CreatedAgent = {
+    readonly agentId: string;
+    readonly token: string;
+    readonly tokenId: string;
+};
+/** An agent is an actor of its own, with a token of its own (SPEC.md §72). */
+export declare const createAgent: (details: AgentDetails) => Promise<CreatedAgent>;
+/** A credential with no expiry, or one whose expiry has not arrived. */
+export declare const isLive: (expiresAt: Date | null) => boolean;
+/** The actor a bearer token stands for, or nobody. */
+export declare const tokenActor: (token: string) => Promise<Actor | undefined>;
+export declare const revokeApiToken: (id: string) => Promise<void>;
+export declare const revokeAgentToken: (id: string) => Promise<void>;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAK3C,eAAO,MAAM,gBAAgB,QAAQ,CAAA;AACrC,eAAO,MAAM,kBAAkB,QAAQ,CAAA;AAEvC,MAAM,MAAM,cAAc,GAAG;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAA;CAC1B,CAAA;AAED,eAAO,MAAM,cAAc,YAAmB,eAAe,KAAG,OAAO,CAAC,cAAc,CAYrF,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB,CAAA;AAED,8EAA8E;AAC9E,eAAO,MAAM,WAAW,YAAmB,YAAY,KAAG,OAAO,CAAC,YAAY,CAkB7E,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,MAAM,cAAe,IAAI,GAAG,IAAI,KAAG,OACQ,CAAA;AAExD,sDAAsD;AACtD,eAAO,MAAM,UAAU,UAAiB,MAAM,KAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAwBzE,CAAA;AAED,eAAO,MAAM,cAAc,OAAc,MAAM,KAAG,OAAO,CAAC,IAAI,CAE7D,CAAA;AAED,eAAO,MAAM,gBAAgB,OAAc,MAAM,KAAG,OAAO,CAAC,IAAI,CAE/D,CAAA"}

package/dist/tokens.js

@@ -0,0 +1,60 @@
+import { hashToken, issueToken } from './credentials.js';
+import { Agent, AgentToken, ApiToken } from './models.js';
+export const API_TOKEN_PREFIX = 'ast';
+export const AGENT_TOKEN_PREFIX = 'agt';
+export const createApiToken = async (details) => {
+    const issued = issueToken(API_TOKEN_PREFIX);
+    const stored = await ApiToken.create({
+        name: details.name,
+        tokenHash: issued.hash,
+        userId: details.userId ?? null,
+        permissions: details.permissions,
+        expiresAt: details.expiresAt ?? null,
+    });
+    return { token: issued.token, id: stored.id };
+};
+/** An agent is an actor of its own, with a token of its own (SPEC.md §72). */
+export const createAgent = async (details) => {
+    const agent = await Agent.create({
+        name: details.name,
+        description: details.description ?? null,
+        permissions: details.permissions,
+        enabled: true,
+    });
+    const issued = issueToken(AGENT_TOKEN_PREFIX);
+    const token = await AgentToken.create({
+        agentId: agent.id,
+        name: `${details.name} default`,
+        tokenHash: issued.hash,
+        expiresAt: null,
+    });
+    return { agentId: agent.id, token: issued.token, tokenId: token.id };
+};
+/** A credential with no expiry, or one whose expiry has not arrived. */
+export const isLive = (expiresAt) => expiresAt === null || expiresAt.getTime() > Date.now();
+/** The actor a bearer token stands for, or nobody. */
+export const tokenActor = async (token) => {
+    const digest = hashToken(token);
+    if (token.startsWith(`${AGENT_TOKEN_PREFIX}_`)) {
+        const stored = await AgentToken.where('tokenHash', digest).first();
+        if (stored === null || !isLive(stored.expiresAt))
+            return undefined;
+        const agent = await Agent.find(stored.agentId);
+        if (agent === null || !agent.enabled)
+            return undefined;
+        await stored.update({ lastUsedAt: new Date() });
+        return { type: 'agent', id: agent.id };
+    }
+    const stored = await ApiToken.where('tokenHash', digest).first();
+    if (stored === null || !isLive(stored.expiresAt))
+        return undefined;
+    await stored.update({ lastUsedAt: new Date() });
+    return { type: 'api', id: stored.id };
+};
+export const revokeApiToken = async (id) => {
+    await (await ApiToken.find(id))?.delete();
+};
+export const revokeAgentToken = async (id) => {
+    await (await AgentToken.find(id))?.delete();
+};
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAA;AACrC,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAevC,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,OAAwB,EAA2B,EAAE;IACxF,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAA;IAE3C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACnC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;KACrC,CAAC,CAAA;IAEF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAA;AAC/C,CAAC,CAAA;AAcD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAAqB,EAAyB,EAAE;IAChF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAA;IAE7C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,UAAU;QAC/B,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAA;IAEF,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;AACtE,CAAC,CAAA;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,SAAsB,EAAW,EAAE,CACxD,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;AAExD,sDAAsD;AACtD,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,KAAa,EAA8B,EAAE;IAC5E,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAE/B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;QAElE,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;QAElE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAE9C,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAEtD,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;QAE/C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;IAEhE,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IAElE,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IAE/C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAA;AACvC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,EAAU,EAAiB,EAAE;IAChE,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAA;AAC3C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,EAAU,EAAiB,EAAE;IAClE,MAAM,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAA;AAC7C,CAAC,CAAA"}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@assemora/auth",
+  "version": "0.1.0",
+  "description": "Users, sessions, roles, permissions, policies, tokens",
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/assemora/assemora.git",
+    "directory": "packages/auth"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "!dist/.tsbuildinfo"
+  ],
+  "dependencies": {
+    "@node-rs/argon2": "2.1.0",
+    "@assemora/schema": "0.1.0",
+    "@assemora/core": "0.1.0",
+    "@assemora/data": "0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "24.13.3",
+    "@assemora/database": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsc -b tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "clean": "rm -rf dist *.tsbuildinfo"
+  }
+}