@auth/dgraph-adapter 1.0.0

package/LICENSE

@@ -0,0 +1,15 @@
+ISC License
+
+Copyright (c) 2022-2023, Balázs Orbán
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -0,0 +1,28 @@
+<p align="center">
+  <br/>
+  <a href="https://authjs.dev" target="_blank">
+    <img height="64px" src="https://authjs.dev/img/logo/logo-sm.png" />
+  </a>
+  <a href="https://dgraph.io" target="_blank">
+    <img height="64px" src="https://authjs.dev/img/adapters/dgraph.svg"/>
+  </a>
+  <h3 align="center"><b>Dgraph Adapter</b> - NextAuth.js / Auth.js</a></h3>
+  <p align="center" style="align: center;">
+    <a href="https://npm.im/@auth/dgraph-adapter">
+      <img src="https://img.shields.io/badge/TypeScript-blue?style=flat-square" alt="TypeScript" />
+    </a>
+    <a href="https://npm.im/@auth/dgraph-adapter">
+      <img alt="npm" src="https://img.shields.io/npm/v/@auth/dgraph-adapter?color=green&label=@auth/dgraph-adapter&style=flat-square">
+    </a>
+    <a href="https://www.npmtrends.com/@auth/dgraph-adapter">
+      <img src="https://img.shields.io/npm/dm/@auth/dgraph-adapter?label=%20downloads&style=flat-square" alt="Downloads" />
+    </a>
+    <a href="https://github.com/nextauthjs/next-auth/stargazers">
+      <img src="https://img.shields.io/github/stars/nextauthjs/next-auth?style=flat-square" alt="Github Stars" />
+    </a>
+  </p>
+</p>
+
+---
+
+Check out the documentation at [authjs.dev](https://authjs.dev/reference/adapter/dgraph).

package/index.d.ts

@@ -0,0 +1,255 @@
+import { format } from "./lib/utils";
+import type { Adapter } from "@auth/core/adapters";
+import type { DgraphClientParams } from "./lib/client";
+export type { DgraphClientParams, DgraphClientError } from "./lib/client";
+/** This is the interface of the Dgraph adapter options. */
+export interface DgraphAdapterOptions {
+    /**
+     * The GraphQL {@link https://dgraph.io/docs/query-language/fragments/ Fragments} you can supply to the adapter
+     * to define how the shapes of the `user`, `account`, `session`, `verificationToken` entities look.
+     *
+     * By default the adapter will uses the [default defined fragments](https://github.com/nextauthjs/next-auth/blob/main/packages/adapter-dgraph/src/lib/graphql/fragments.ts)
+     * , this config option allows to extend them.
+     */
+    fragments?: {
+        User?: string;
+        Account?: string;
+        Session?: string;
+        VerificationToken?: string;
+    };
+}
+export { format };
+/**
+ * ## Setup
+ *
+ * Add this adapter to your `pages/api/[...nextauth].js` next-auth configuration object:
+ *
+ * ```ts title="pages/api/auth/[...nextauth].js"
+ * import NextAuth from "next-auth"
+ * import { DgraphAdapter } from "@auth/dgraph-adapter"
+ *
+ * export default NextAuth({
+ *   providers: [],
+ *   adapter: DgraphAdapter({
+ *     endpoint: process.env.DGRAPH_GRAPHQL_ENDPOINT,
+ *     authToken: process.env.DGRAPH_GRAPHQL_KEY,
+ *     // you can omit the following properties if you are running an unsecure schema
+ *     authHeader: process.env.AUTH_HEADER, // default: "Authorization",
+ *     jwtSecret: process.env.SECRET,
+ *   }),
+ * })
+ * ```
+ *
+ * ### Unsecure schema
+ *
+ * The quickest way to use Dgraph is by applying the unsecure schema to your [local](https://dgraph.io/docs/graphql/admin/#modifying-a-schema) Dgraph instance or if using Dgraph [cloud](https://dgraph.io/docs/cloud/cloud-quick-start/#the-schema) you can paste the schema in the codebox to update.
+ *
+ * :::warning
+ * This approach is not secure or for production use, and does not require a `jwtSecret`.
+ * :::
+ *
+ * > This schema is adapted for use in Dgraph and based upon our main [schema](https://authjs.dev/reference/adapters#models)
+ *
+ * #### Example
+ *
+ *```graphql
+ *  type Account {
+ *    id: ID
+ *    type: String
+ *    provider: String @search(by: [hash])
+ *    providerAccountId: String @search(by: [hash])
+ *    refreshToken: String
+ *    expires_at: Int64
+ *    accessToken: String
+ *    token_type: String
+ *    refresh_token: String
+ *    access_token: String
+ *    scope: String
+ *    id_token: String
+ *    session_state: String
+ *    user: User @hasInverse(field: "accounts")
+ *  }
+ *  type Session {
+ *    id: ID
+ *    expires: DateTime
+ *    sessionToken: String @search(by: [hash])
+ *    user: User @hasInverse(field: "sessions")
+ *  }
+ *  type User {
+ *    id: ID
+ *    name: String
+ *    email: String @search(by: [hash])
+ *    emailVerified: DateTime
+ *    image: String
+ *    accounts: [Account] @hasInverse(field: "user")
+ *    sessions: [Session] @hasInverse(field: "user")
+ *  }
+ *
+ *  type VerificationToken {
+ *    id: ID
+ *    identifier: String @search(by: [hash])
+ *    token: String @search(by: [hash])
+ *    expires: DateTime
+ *  }
+ *```
+ *
+ * ### Secure schema
+ *
+ * For production deployments you will want to restrict the access to the types used
+ * by next-auth. The main form of access control used in Dgraph is via `@auth` directive alongside types in the schema.
+ * #### Example
+ *
+ * ```graphql
+ * type Account
+ *   @auth(
+ *     delete: { rule: "{$nextAuth: { eq: true } }" }
+ *     add: { rule: "{$nextAuth: { eq: true } }" }
+ *     query: { rule: "{$nextAuth: { eq: true } }" }
+ *     update: { rule: "{$nextAuth: { eq: true } }" }
+ *   ) {
+ *   id: ID
+ *   type: String
+ *   provider: String @search(by: [hash])
+ *   providerAccountId: String @search(by: [hash])
+ *   refreshToken: String
+ *   expires_at: Int64
+ *   accessToken: String
+ *   token_type: String
+ *   refresh_token: String
+ *   access_token: String
+ *   scope: String
+ *   id_token: String
+ *   session_state: String
+ *   user: User @hasInverse(field: "accounts")
+ * }
+ * type Session
+ *   @auth(
+ *     delete: { rule: "{$nextAuth: { eq: true } }" }
+ *     add: { rule: "{$nextAuth: { eq: true } }" }
+ *     query: { rule: "{$nextAuth: { eq: true } }" }
+ *     update: { rule: "{$nextAuth: { eq: true } }" }
+ *   ) {
+ *   id: ID
+ *   expires: DateTime
+ *   sessionToken: String @search(by: [hash])
+ *   user: User @hasInverse(field: "sessions")
+ * }
+ * type User
+ *   @auth(
+ *     query: {
+ *       or: [
+ *         {
+ *           rule: """
+ *           query ($userId: String!) {queryUser(filter: { id: { eq: $userId } } ) {id}}
+ *           """
+ *         }
+ *         { rule: "{$nextAuth: { eq: true } }" }
+ *       ]
+ *     }
+ *     delete: { rule: "{$nextAuth: { eq: true } }" }
+ *     add: { rule: "{$nextAuth: { eq: true } }" }
+ *     update: {
+ *       or: [
+ *         {
+ *           rule: """
+ *           query ($userId: String!) {queryUser(filter: { id: { eq: $userId } } ) {id}}
+ *           """
+ *         }
+ *         { rule: "{$nextAuth: { eq: true } }" }
+ *       ]
+ *     }
+ *   ) {
+ *   id: ID
+ *   name: String
+ *   email: String @search(by: [hash])
+ *   emailVerified: DateTime
+ *   image: String
+ *   accounts: [Account] @hasInverse(field: "user")
+ *   sessions: [Session] @hasInverse(field: "user")
+ * }
+ *
+ * type VerificationToken
+ *   @auth(
+ *     delete: { rule: "{$nextAuth: { eq: true } }" }
+ *     add: { rule: "{$nextAuth: { eq: true } }" }
+ *     query: { rule: "{$nextAuth: { eq: true } }" }
+ *     update: { rule: "{$nextAuth: { eq: true } }" }
+ *   ) {
+ *   id: ID
+ *   identifier: String @search(by: [hash])
+ *   token: String @search(by: [hash])
+ *   expires: DateTime
+ * }
+ *
+ * # Dgraph.Authorization {"VerificationKey":"<YOUR JWT SECRET HERE>","Header":"<YOUR AUTH HEADER HERE>","Namespace":"<YOUR CUSTOM NAMESPACE HERE>","Algo":"HS256"}
+ * ```
+ *
+ *  ### Dgraph.Authorization
+ *
+ *  In order to secure your graphql backend define the `Dgraph.Authorization` object at the
+ *  bottom of your schema and provide `authHeader` and `jwtSecret` values to the DgraphClient.
+ *
+ *  ```js
+ *  # Dgraph.Authorization {"VerificationKey":"<YOUR JWT SECRET HERE>","Header":"<YOUR AUTH HEADER HERE>","Namespace":"YOUR CUSTOM NAMESPACE HERE","Algo":"HS256"}
+ *  ```
+ *
+ *  ### VerificationKey and jwtSecret
+ *
+ *  This is the key used to sign the JWT. Ex. `process.env.SECRET` or `process.env.APP_SECRET`.
+ *
+ *  ### Header and authHeader
+ *
+ *  The `Header` tells Dgraph where to lookup a JWT within the headers of the incoming requests made to the dgraph server.
+ *  You have to configure it at the bottom of your schema file. This header is the same as the `authHeader` property you
+ *  provide when you instantiate the `DgraphClient`.
+ *
+ *  ### The nextAuth secret
+ *
+ *  The `$nextAuth` secret is securely generated using the `jwtSecret` and injected by the DgraphAdapter in order to allow interacting with the JWT DgraphClient for anonymous user requests made within the system `ie. login, register`. This allows
+ *  secure interactions to be made with all the auth types required by next-auth. You have to specify it for each auth rule of
+ *  each type defined in your secure schema.
+ *
+ *  ```js
+ *  type VerificationRequest
+ *    @auth(
+ *      delete: { rule: "{$nextAuth: { eq: true } }" },
+ *      add: { rule: "{$nextAuth: { eq: true } }" },
+ *      query: { rule: "{$nextAuth: { eq: true } }" },
+ *      update: { rule: "{$nextAuth: { eq: true } }" }
+ *    ) {
+ *   ...
+ *  }
+ *  ```
+ *
+ *  ### JWT session and `@auth` directive
+ *
+ * Dgraph only works with HS256 or RS256 algorithms. If you want to use session jwt to securely interact with your dgraph
+ * database you must customize next-auth `encode` and `decode` functions, as the default algorithm is HS512. You can
+ * further customize the jwt with roles if you want to implement [`RBAC logic`](https://dgraph.io/docs/graphql/authorization/directive/#role-based-access-control).
+ *
+ * ```js
+ * import * as jwt from "jsonwebtoken"
+ * export default NextAuth({
+ *   session: {
+ *     strategy: "jwt",
+ *   },
+ *   jwt: {
+ *     secret: process.env.SECRET,
+ *     encode: async ({ secret, token }) => {
+ *       return jwt.sign({ ...token, userId: token.id }, secret, {
+ *         algorithm: "HS256",
+ *         expiresIn: 30 * 24 * 60 * 60, // 30 days
+ *       })
+ *     },
+ *     decode: async ({ secret, token }) => {
+ *       return jwt.verify(token, secret, { algorithms: ["HS256"] })
+ *     },
+ *   },
+ * })
+ * ```
+ *
+ * Once your `Dgraph.Authorization` is defined in your schema and the JWT settings are set, this will allow you to define
+ * [`@auth rules`](https://dgraph.io/docs/graphql/authorization/authorization-overview/) for every part of your schema.
+ **/
+export declare function DgraphAdapter(client: DgraphClientParams, options?: DgraphAdapterOptions): Adapter;
+//# sourceMappingURL=index.d.ts.map

package/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["src/index.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAGtD,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEzE,2DAA2D;AAC3D,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE;QACV,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAC3B,CAAA;CACF;AAED,OAAO,EAAE,MAAM,EAAE,CAAA;AAEjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuOI;AACJ,wBAAgB,aAAa,CAC3B,MAAM,EAAE,kBAAkB,EAC1B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAmST"}