@authyon/server 0.2.0-beta.1 → 0.2.0-beta.12

package/dist/bff.d.cts

@@ -0,0 +1,142 @@
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-t82mwTws.cjs';
+import 'jose';
+
+interface BffLoginInput {
+    email?: string;
+    username?: string;
+    password: string;
+    organizationSlug?: string;
+    sessionPersistence?: BffSessionPersistence;
+}
+interface BffVerifyTwoFactorInput {
+    challengeToken: string;
+    method: string;
+    code?: string;
+    sessionPersistence?: BffSessionPersistence;
+    webAuthnAssertion?: {
+        ceremonyToken: string;
+        assertionJson: string;
+    };
+}
+type BffSessionPersistence = "standard" | "remembered";
+interface BffSessionLifetime {
+    absoluteTimeoutMs: number;
+    idleTimeoutMs: number;
+}
+interface BffTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+}
+/** Explicit public projection; upstream objects must never be spread into responses. */
+interface BffUser {
+    id: string;
+    email: string;
+    organization: {
+        id: string;
+        slug: string;
+    } | null;
+}
+interface BffChallenge {
+    twoFactorRequired: true;
+    challengeToken: string;
+    methods: string[];
+}
+interface BffAuthProvider {
+    login(input: BffLoginInput): Promise<BffTokens | BffChallenge>;
+    verifyTwoFactor(input: BffVerifyTwoFactorInput): Promise<BffTokens>;
+    refresh(refreshToken: string): Promise<BffTokens>;
+    logout(refreshToken: string): Promise<void>;
+    switchOrganization(accessToken: string, slug: string): Promise<BffTokens>;
+    validate(accessToken: string): Promise<boolean>;
+    profile(accessToken: string): Promise<BffUser>;
+}
+interface BffSessionRecord {
+    revision: string;
+    tokens: BffTokens;
+    user: BffUser;
+    /** Missing on records created before persistent sessions; those retain the standard policy. */
+    sessionPersistence?: BffSessionPersistence;
+    expiresAt: number;
+    idleExpiresAt: number;
+    /** A crashed token rotation must invalidate the session, never replay its old token. */
+    busyUntil: number | null;
+}
+interface BffSessionStore {
+    read(key: string): Promise<BffSessionRecord | null>;
+    /** Atomic across all processes. null expectedRevision means insert only if absent. */
+    compareAndSwap(key: string, expectedRevision: string | null, next: BffSessionRecord | null): Promise<boolean>;
+}
+interface BffSessionOptions {
+    origin: string;
+    provider: BffAuthProvider;
+    store: BffSessionStore;
+    absoluteTimeoutMs?: number;
+    idleTimeoutMs?: number;
+    /** Server-controlled limits used only after an explicit remembered login. */
+    rememberedSession?: Partial<BffSessionLifetime>;
+    refreshAheadMs?: number;
+    /** Only permits HTTP on localhost/loopback. Never enables remote HTTP. */
+    allowInsecureLocalhost?: boolean;
+}
+declare class BffSessionError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly clearCookie: boolean;
+    constructor(code: string, status: number, clearCookie?: boolean);
+}
+
+/** Mount each handler explicitly. Never expose a catch-all proxy for the provider. */
+declare function createBffSession(options: BffSessionOptions): {
+    login: (request: Request) => Promise<Response>;
+    verifyTwoFactor: (request: Request) => Promise<Response>;
+    session: (request: Request) => Promise<Response>;
+    switchOrganization: (request: Request) => Promise<Response>;
+    logout: (request: Request) => Promise<Response>;
+    /** Server-only credential for downstream calls. Never serialize this result to the browser. */
+    requireSession(request: Request): Promise<{
+        accessToken: string;
+        user: BffUser;
+        expiresAt: number;
+    }>;
+    errorResponse: (error: unknown) => Response;
+};
+
+interface SharedTransportOptions {
+    baseUrl: string;
+    allowInsecureHttp?: boolean;
+    timeoutMs?: number;
+    httpAdapter?: HttpAdapter;
+    httpLogger?: HttpLoggerOptions;
+    /** @deprecated Prefer `httpAdapter`. */
+    fetch?: typeof fetch;
+}
+
+interface AuthyonBffProviderOptions extends Omit<SharedTransportOptions, "baseUrl"> {
+    baseUrl?: string;
+    envKey: string;
+    /** Reuses the server client's database-backed validation, not offline JWT verification. */
+    validator: Pick<AuthyonServerClient, "validate">;
+}
+declare function createAuthyonBffProvider(options: AuthyonBffProviderOptions): BffAuthProvider;
+
+/** Single-process test/development store. Supply a shared store in production. */
+declare function createMemoryBffSessionStore(): BffSessionStore;
+
+interface BffRedisClient {
+    get(key: string): Promise<string | null>;
+    eval(script: string, options: {
+        keys: string[];
+        arguments: string[];
+    }): Promise<unknown>;
+}
+interface RedisBffSessionStoreOptions {
+    client: BffRedisClient;
+    /** 32 random bytes kept outside Redis; changing this key invalidates existing sessions. */
+    encryptionKey: Uint8Array;
+    prefix?: string;
+}
+/** node-redis-compatible adapter. Lua fences stale writers using the record revision. */
+declare function createRedisBffSessionStore(options: RedisBffSessionStoreOptions): BffSessionStore;
+
+export { type AuthyonBffProviderOptions, type BffAuthProvider, type BffChallenge, type BffLoginInput, type BffRedisClient, BffSessionError, type BffSessionLifetime, type BffSessionOptions, type BffSessionPersistence, type BffSessionRecord, type BffSessionStore, type BffTokens, type BffUser, type BffVerifyTwoFactorInput, type RedisBffSessionStoreOptions, createAuthyonBffProvider, createBffSession, createMemoryBffSessionStore, createRedisBffSessionStore };

package/dist/bff.d.ts

@@ -0,0 +1,142 @@
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-t82mwTws.js';
+import 'jose';
+
+interface BffLoginInput {
+    email?: string;
+    username?: string;
+    password: string;
+    organizationSlug?: string;
+    sessionPersistence?: BffSessionPersistence;
+}
+interface BffVerifyTwoFactorInput {
+    challengeToken: string;
+    method: string;
+    code?: string;
+    sessionPersistence?: BffSessionPersistence;
+    webAuthnAssertion?: {
+        ceremonyToken: string;
+        assertionJson: string;
+    };
+}
+type BffSessionPersistence = "standard" | "remembered";
+interface BffSessionLifetime {
+    absoluteTimeoutMs: number;
+    idleTimeoutMs: number;
+}
+interface BffTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+}
+/** Explicit public projection; upstream objects must never be spread into responses. */
+interface BffUser {
+    id: string;
+    email: string;
+    organization: {
+        id: string;
+        slug: string;
+    } | null;
+}
+interface BffChallenge {
+    twoFactorRequired: true;
+    challengeToken: string;
+    methods: string[];
+}
+interface BffAuthProvider {
+    login(input: BffLoginInput): Promise<BffTokens | BffChallenge>;
+    verifyTwoFactor(input: BffVerifyTwoFactorInput): Promise<BffTokens>;
+    refresh(refreshToken: string): Promise<BffTokens>;
+    logout(refreshToken: string): Promise<void>;
+    switchOrganization(accessToken: string, slug: string): Promise<BffTokens>;
+    validate(accessToken: string): Promise<boolean>;
+    profile(accessToken: string): Promise<BffUser>;
+}
+interface BffSessionRecord {
+    revision: string;
+    tokens: BffTokens;
+    user: BffUser;
+    /** Missing on records created before persistent sessions; those retain the standard policy. */
+    sessionPersistence?: BffSessionPersistence;
+    expiresAt: number;
+    idleExpiresAt: number;
+    /** A crashed token rotation must invalidate the session, never replay its old token. */
+    busyUntil: number | null;
+}
+interface BffSessionStore {
+    read(key: string): Promise<BffSessionRecord | null>;
+    /** Atomic across all processes. null expectedRevision means insert only if absent. */
+    compareAndSwap(key: string, expectedRevision: string | null, next: BffSessionRecord | null): Promise<boolean>;
+}
+interface BffSessionOptions {
+    origin: string;
+    provider: BffAuthProvider;
+    store: BffSessionStore;
+    absoluteTimeoutMs?: number;
+    idleTimeoutMs?: number;
+    /** Server-controlled limits used only after an explicit remembered login. */
+    rememberedSession?: Partial<BffSessionLifetime>;
+    refreshAheadMs?: number;
+    /** Only permits HTTP on localhost/loopback. Never enables remote HTTP. */
+    allowInsecureLocalhost?: boolean;
+}
+declare class BffSessionError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly clearCookie: boolean;
+    constructor(code: string, status: number, clearCookie?: boolean);
+}
+
+/** Mount each handler explicitly. Never expose a catch-all proxy for the provider. */
+declare function createBffSession(options: BffSessionOptions): {
+    login: (request: Request) => Promise<Response>;
+    verifyTwoFactor: (request: Request) => Promise<Response>;
+    session: (request: Request) => Promise<Response>;
+    switchOrganization: (request: Request) => Promise<Response>;
+    logout: (request: Request) => Promise<Response>;
+    /** Server-only credential for downstream calls. Never serialize this result to the browser. */
+    requireSession(request: Request): Promise<{
+        accessToken: string;
+        user: BffUser;
+        expiresAt: number;
+    }>;
+    errorResponse: (error: unknown) => Response;
+};
+
+interface SharedTransportOptions {
+    baseUrl: string;
+    allowInsecureHttp?: boolean;
+    timeoutMs?: number;
+    httpAdapter?: HttpAdapter;
+    httpLogger?: HttpLoggerOptions;
+    /** @deprecated Prefer `httpAdapter`. */
+    fetch?: typeof fetch;
+}
+
+interface AuthyonBffProviderOptions extends Omit<SharedTransportOptions, "baseUrl"> {
+    baseUrl?: string;
+    envKey: string;
+    /** Reuses the server client's database-backed validation, not offline JWT verification. */
+    validator: Pick<AuthyonServerClient, "validate">;
+}
+declare function createAuthyonBffProvider(options: AuthyonBffProviderOptions): BffAuthProvider;
+
+/** Single-process test/development store. Supply a shared store in production. */
+declare function createMemoryBffSessionStore(): BffSessionStore;
+
+interface BffRedisClient {
+    get(key: string): Promise<string | null>;
+    eval(script: string, options: {
+        keys: string[];
+        arguments: string[];
+    }): Promise<unknown>;
+}
+interface RedisBffSessionStoreOptions {
+    client: BffRedisClient;
+    /** 32 random bytes kept outside Redis; changing this key invalidates existing sessions. */
+    encryptionKey: Uint8Array;
+    prefix?: string;
+}
+/** node-redis-compatible adapter. Lua fences stale writers using the record revision. */
+declare function createRedisBffSessionStore(options: RedisBffSessionStoreOptions): BffSessionStore;
+
+export { type AuthyonBffProviderOptions, type BffAuthProvider, type BffChallenge, type BffLoginInput, type BffRedisClient, BffSessionError, type BffSessionLifetime, type BffSessionOptions, type BffSessionPersistence, type BffSessionRecord, type BffSessionStore, type BffTokens, type BffUser, type BffVerifyTwoFactorInput, type RedisBffSessionStoreOptions, createAuthyonBffProvider, createBffSession, createMemoryBffSessionStore, createRedisBffSessionStore };