@awesome-lang-auth/node 1.10.1

package/README.md

@@ -0,0 +1,248 @@
+# awesome-node-auth
+
+![npm version](https://img.shields.io/npm/v/@awesome-lang-auth/node)
+![license](https://img.shields.io/github/license/nik2208/awesome-node-auth)
+![github stars](https://img.shields.io/github/stars/nik2208/awesome-node-auth)
+[![](https://img.shields.io/static/v1?label=Sponsor&message=%E2%9D%A4&logo=GitHub&color=%23fe8e86)](https://github.com/sponsors/nik2208)
+
+[![NPM](https://nodei.co/npm/@awesome-lang-auth/node.png?downloads=true&downloadRank=true)](https://nodei.co/npm/@awesome-lang-auth/node/)
+
+A production-ready, **database-agnostic** JWT authentication library for Node.js written in TypeScript. Drop-in auth for Express, NestJS, Next.js, Fastify and any other Node.js framework — connect to any database through a single interface.
+
+> **The self-hosted alternative to Supertokens and Supabase Auth.** Same enterprise-grade features, zero vendor lock-in.
+
+---
+
+## Installation
+
+```bash
+npm install @awesome-lang-auth/node
+```
+
+> Up to 1.10.0 the package was published as `awesome-node-auth`. To migrate, replace the dependency with `@awesome-lang-auth/node` and change your imports from `'awesome-node-auth'` to `'@awesome-lang-auth/node'`; the API is the same.
+
+## Quick Start
+
+```typescript
+import express from 'express';
+import { AuthConfigurator, AuthEventBus } from '@awesome-lang-auth/node';
+import { myUserStore } from './my-user-store'; // your IUserStore impl
+
+const app = express();
+app.use(express.json());
+
+const eventBus = new AuthEventBus();
+
+const auth = new AuthConfigurator(
+  {
+    accessTokenSecret: process.env.ACCESS_TOKEN_SECRET!,
+    refreshTokenSecret: process.env.REFRESH_TOKEN_SECRET!,
+    accessTokenExpiresIn: '15m',
+    refreshTokenExpiresIn: '7d',
+  },
+  myUserStore,
+  { eventBus },
+);
+
+app.use(auth.buildAllRouters({
+  admin: {
+    accessPolicy: 'is-admin-flag', // admin panel for users with isAdmin: true
+  },
+})); // mounts /auth/* and /auth/admin/*
+
+// Grant the admin panel from a seed script or CLI task (sets isAdmin; needs IUserStore.update):
+//   await auth.promoteToAdmin(userId, { method: 'flag' });
+
+app.get('/protected', auth.middleware(), (req, res) => {
+  res.json({ user: req.user });
+});
+
+app.listen(3000);
+```
+
+Implement `IUserStore` once for your database and you're done.  
+Full DB examples (MongoDB, PostgreSQL, MySQL, in-memory) → [README.detailed.md](./README.detailed.md).
+
+---
+
+## Features
+
+| Area | Highlights |
+|---|---|
+| **Auth strategies** | Email/password · OAuth 2.0 (Google, GitHub, custom) · Magic links · SMS OTP · TOTP 2FA |
+| **Token management** | HttpOnly-cookie or Bearer mode · automatic access/refresh rotation · `__Host-`/`__Secure-` cookie prefixes |
+| **Identity Provider (IdP) mode** *(v1.9)* | RS256-signed JWTs · public JWKS endpoint (`/.well-known/jwks.json`) · Resource Server middleware · zero new dependencies |
+| **Stateful sessions** *(v1.5)* | `ISessionStore` + real-time revocation (`checkOn: allcalls\|refresh\|none`) · works behind your own L1/L2 cache layers |
+| **Dynamic email templates** *(v1.6)* | `ITemplateStore` — per-language mail templates + UI i18n with safe hardcoded fallback · built-in `MemoryTemplateStore` |
+| **CSRF protection** | Double-submit cookie pattern · `__Host-` prefix hardening against cookie-tossing |
+| **Account management** | Registration · change email/password · account deletion · email verification (none/lazy/strict) |
+| **Account linking** | Link multiple OAuth providers · conflict resolution via `IPendingLinkStore` |
+| **RBAC** | `IRolesPermissionsStore` with tenant awareness |
+| **Multi-tenancy** | `ITenantStore` for isolated tenant apps |
+| **Admin panel** | Full-featured admin UI: user management, sessions, roles, tenants, metadata, API keys, webhooks |
+| **Built-in UI** | Zero-dependency HTML/CSS/JS login UI served at `<apiPrefix>/ui/` · **headless mode** for SPAs |
+| **Client libraries** | Angular · Flutter · React · served `auth.js` — see [Ecosystem](#ecosystem) |
+| **Event-driven** | `AuthEventBus` · SSE push · inbound/outbound webhooks · telemetry |
+| **API keys** | M2M bcrypt-hashed keys with scopes, expiry, IP allowlist and audit log |
+| **OpenAPI / Swagger** | Auto-generated specs for auth, admin and tools routers |
+
+---
+
+## Identity Provider (IdP) Mode *(v1.9)*
+
+Turn any Provisioner into a central IdP that issues RS256-signed JWTs. Downstream Resource Servers validate tokens via the public JWKS endpoint — no shared secrets.
+
+**Generate the RSA private key for your `.env`** (uses Node.js built-in `crypto` — no install needed):
+
+```bash
+node -e "
+const { generateKeyPairSync } = require('crypto');
+const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+const pem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+console.log('IDP_PRIVATE_KEY=' + Buffer.from(pem).toString('base64'));
+"
+```
+
+Then in your config:
+
+```typescript
+// Provisioner (IdP)
+const auth = new AuthConfigurator({
+  accessTokenSecret: '...',
+  refreshTokenSecret: '...',
+  idProvider: {
+    enabled: true,
+    issuer: 'https://auth.myplatform.com',
+    privateKey: Buffer.from(process.env.IDP_PRIVATE_KEY!, 'base64').toString('utf8'),
+  },
+}, userStore);
+
+// Resource Server (downstream)
+import { createJwksAuthMiddleware } from '@awesome-lang-auth/node';
+
+app.use('/api', createJwksAuthMiddleware({
+  jwksUrl: 'https://auth.myplatform.com/.well-known/jwks.json',
+  issuer:  'https://auth.myplatform.com',
+}), myApiRouter);
+```
+
+> In **development**, if you omit `privateKey` an ephemeral keypair is auto-generated at startup.
+
+→ Full guide: [awesomenodeauth.com/docs/advanced/idp-mode](https://awesomenodeauth.com/docs/advanced/idp-mode)
+
+---
+
+## Key Endpoints
+
+```
+POST   /auth/login              POST /auth/refresh           GET  /auth/me
+POST   /auth/register           POST /auth/logout            GET  /auth/sessions        ← device list
+POST   /auth/forgot-password    POST /auth/change-password   DELETE /auth/sessions/:h   ← revoke device
+POST   /auth/magic-link/send    POST /auth/2fa/verify        DELETE /auth/account
+GET    /auth/oauth/:provider    GET  /auth/oauth/:provider/callback
+POST   /auth/sessions/cleanup   POST /auth/add-phone         PATCH /auth/profile
+GET    /.well-known/jwks.json                                                            ← IdP mode only
+```
+
+---
+
+## Optional Stores Snapshot
+
+```typescript
+const auth = new AuthConfigurator(
+  { ...config, templateStore }, // ITemplateStore — dynamic email templates + UI i18n (v1.6), part of AuthConfig
+  userStore,
+  { eventBus },                 // optional; the third argument only accepts { eventBus }
+);
+
+app.use('/auth', auth.router({
+  sessionStore,        // ISessionStore        — stateful sessions + device management
+  metadataStore,       // IUserMetadataStore   — arbitrary per-user key/value pairs
+  rbacStore,           // IRolesPermissionsStore
+  tenantStore,         // ITenantStore
+  linkedAccountsStore, // ILinkedAccountsStore — several OAuth providers per user
+  pendingLinkStore,    // IPendingLinkStore    — OAuth account-linking conflicts (with linkedAccountsStore)
+}));
+
+app.get('/protected', auth.middleware(), handler); // uses the sessionStore passed to router() above (call router() first)
+```
+
+With `buildAllRouters()`, pass the same stores as `auth: { … }`; the admin panel takes its own in `admin: { … }` (see [Admin UI](#admin-ui)).
+
+Full configuration reference → [README.detailed.md § Configuration](./README.detailed.md#configuration)
+
+---
+
+## Admin UI
+
+Use `auth.buildAllRouters({ admin: ... })` to mount both the main auth router and the admin router together. The admin router lives at `/auth/admin/*`, and `jwtSecret` is auto-filled from `AuthConfig.accessTokenSecret`. Set `accessPolicy` (or a non-empty legacy `adminSecret`): without either, the admin routes are mounted **unprotected** and a `WARNING` is written to `stderr`. Without `accessPolicy`, an `adminSecret` that is present but empty (an unset environment variable, for example) throws a configuration error at startup.
+
+| `admin` option (`AdminOptions`) | Unlocks |
+|---|---|
+| `sessionStore` | Sessions tab |
+| `rbacStore` | Roles & Permissions tab |
+| `tenantStore` | Tenants tab |
+| `userMetadataStore` | Metadata section in user detail |
+| `settingsStore` | ⚙️ Control tab |
+| `linkedAccountsStore` | Linked Accounts column |
+| `apiKeyStore` | 🔑 API Keys tab |
+| `webhookStore` | 🔗 Webhooks tab |
+| `templateStore` | Email & UI tab |
+| `uploadDir` (optionally `uploadBaseUrl`) | Logo upload in branding |
+
+---
+
+## Two login endpoints, two audiences
+
+- `/auth/ui/login` — end-user login for your application (built-in UI, `ui: { enabled: true }`)
+- `/auth/admin/` — admin panel for operators (its sign-in form posts to `/auth/admin/login`)
+
+They are intentionally different flows. If you mount the admin UI for operators, keep linking end users to `/auth/ui/login`.
+
+The admin sign-in form checks the password only, with no second factor, and its session opens the admin console and nothing else. To send operators through the application login and its 2FA flow, set `admin.loginPath: '/auth/ui/login'` (after signing in they land on `/`; reopen `/auth/admin/`). `POST /auth/admin/login` stays mounted and still accepts the password alone, so block it at your proxy if operators must always pass 2FA.
+
+---
+
+## Ecosystem
+
+`awesome-node-auth` is the reference server of a family of libraries that port its HTTP API to other runtimes, plus client libraries for that API.
+
+**Servers**
+
+| Runtime | Repository | Status |
+|---|---|---|
+| Node.js | [`awesome-node-auth`](https://github.com/nik2208/awesome-node-auth) (this repo) | npm `@awesome-lang-auth/node` |
+| Go | [`awesome-go-auth`](https://github.com/awesome-lang-auth/awesome-go-auth) | Go module, 0.11.x · 1.0 in progress |
+| AWS Lambda | [`awesome-lambda-auth`](https://github.com/awesome-lang-auth/awesome-lambda-auth) | Preview |
+| Python | [`awesome-python-auth`](https://github.com/awesome-lang-auth/awesome-python-auth) | PyPI `awesome-python-auth` 1.1.0 |
+| Rust | [`awesome-rust-auth`](https://github.com/awesome-lang-auth/awesome-rust-auth) | Git only (not on crates.io) |
+| Dart | [`awesome-dart-auth`](https://github.com/awesome-lang-auth/awesome-dart-auth) | Git only (not on pub.dev) |
+
+**Clients**
+
+| Client | Package | Status |
+|---|---|---|
+| Angular | [`ng-awesome-node-auth`](https://github.com/awesome-lang-auth/awesome-angular-auth) | npm · to be renamed `@awesome-lang-auth/angular` |
+| Flutter | [`awesome_node_auth_flutter`](https://github.com/awesome-lang-auth/awesome-flutter-auth) | pub.dev · to be renamed `awesome_flutter_auth` |
+| React | [`@awesome-lang-auth/react`](https://github.com/awesome-lang-auth/awesome-react-auth) | npm 0.1.0 |
+| Browser | `auth.js` | Served by this library at `<apiPrefix>/ui/auth.js` when `ui.enabled` is set — see [Including `auth.js`](./README.detailed.md#including-authjs) |
+
+---
+
+## Documentation
+
+| Resource | Link |
+|---|---|
+| **Full reference** | [README.detailed.md](./README.detailed.md) |
+| **Wiki / Guides** | [awesomenodeauth.com](https://awesomenodeauth.com) |
+| **Changelog** | [CHANGELOG.md](./CHANGELOG.md) |
+| **Demo apps** | [demo/](./demo) |
+| **Framework examples** | [examples/](./examples) |
+
+> The companion MCP server (`awesome-node-auth-mcp-server`) has been retired and is no longer available.
+
+---
+
+## License
+
+[MIT](./LICENSE) · © 2026 nik2208 · [Sponsor ❤](https://github.com/sponsors/nik2208)

package/dist/abstract/base-auth-strategy.abstract.d.ts

@@ -0,0 +1,7 @@
+import { AuthConfig } from '../models/auth-config.model';
+import { BaseUser } from '../models/user.model';
+export declare abstract class BaseAuthStrategy<TInput = unknown, TUser = BaseUser> {
+    abstract name: string;
+    abstract authenticate(input: TInput, config: AuthConfig): Promise<TUser>;
+}
+//# sourceMappingURL=base-auth-strategy.abstract.d.ts.map

package/dist/abstract/base-auth-strategy.abstract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-auth-strategy.abstract.d.ts","sourceRoot":"","sources":["../../src/abstract/base-auth-strategy.abstract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,8BAAsB,gBAAgB,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,GAAG,QAAQ;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;CACzE"}

package/dist/abstract/base-auth-strategy.abstract.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BaseAuthStrategy = void 0;
+class BaseAuthStrategy {
+}
+exports.BaseAuthStrategy = BaseAuthStrategy;
+//# sourceMappingURL=base-auth-strategy.abstract.js.map

package/dist/abstract/base-auth-strategy.abstract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-auth-strategy.abstract.js","sourceRoot":"","sources":["../../src/abstract/base-auth-strategy.abstract.ts"],"names":[],"mappings":";;;AAGA,MAAsB,gBAAgB;CAGrC;AAHD,4CAGC"}

package/dist/abstract/base-oauth-strategy.abstract.d.ts

@@ -0,0 +1,27 @@
+import { AuthConfig } from '../models/auth-config.model';
+import { BaseUser } from '../models/user.model';
+import { BaseAuthStrategy } from './base-auth-strategy.abstract';
+export declare abstract class BaseOAuthStrategy<TUser extends BaseUser = BaseUser> extends BaseAuthStrategy<{
+    code: string;
+    state?: string;
+}, TUser> {
+    abstract name: string;
+    abstract getAuthorizationUrl(state?: string): string;
+    abstract handleCallback(code: string, state?: string): Promise<TUser>;
+    protected abstract exchangeCodeForTokens(code: string): Promise<{
+        accessToken: string;
+        idToken?: string;
+    }>;
+    protected abstract getUserProfile(accessToken: string): Promise<{
+        id: string;
+        email: string;
+        emailVerified?: boolean;
+        name?: string;
+        picture?: string;
+    }>;
+    authenticate(input: {
+        code: string;
+        state?: string;
+    }, _config: AuthConfig): Promise<TUser>;
+}
+//# sourceMappingURL=base-oauth-strategy.abstract.d.ts.map

package/dist/abstract/base-oauth-strategy.abstract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-oauth-strategy.abstract.d.ts","sourceRoot":"","sources":["../../src/abstract/base-oauth-strategy.abstract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,8BAAsB,iBAAiB,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ,CAAE,SAAQ,gBAAgB,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,CAAC;IAC1I,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IACpD,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IACrE,SAAS,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1G,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAElJ,YAAY,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;CAGjG"}

package/dist/abstract/base-oauth-strategy.abstract.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BaseOAuthStrategy = void 0;
+const base_auth_strategy_abstract_1 = require("./base-auth-strategy.abstract");
+class BaseOAuthStrategy extends base_auth_strategy_abstract_1.BaseAuthStrategy {
+    async authenticate(input, _config) {
+        return this.handleCallback(input.code, input.state);
+    }
+}
+exports.BaseOAuthStrategy = BaseOAuthStrategy;
+//# sourceMappingURL=base-oauth-strategy.abstract.js.map

package/dist/abstract/base-oauth-strategy.abstract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-oauth-strategy.abstract.js","sourceRoot":"","sources":["../../src/abstract/base-oauth-strategy.abstract.ts"],"names":[],"mappings":";;;AAEA,+EAAiE;AAEjE,MAAsB,iBAAqD,SAAQ,8CAAyD;IAQ1I,KAAK,CAAC,YAAY,CAAC,KAAuC,EAAE,OAAmB;QAC7E,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;CACF;AAXD,8CAWC"}

package/dist/adapters/express.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Express adapter for awesome-node-auth.
+ *
+ * Re-exports the Express `Router` and `RequestHandler` types so that Express
+ * applications can import them from a single, well-known path within the
+ * library.
+ *
+ * The `expressAdapter` helper is a zero-overhead cast: it accepts an
+ * `AuthRequestHandler` written against the framework-neutral types and returns
+ * the same function typed as an Express `RequestHandler`, bridging the two
+ * type systems without any runtime cost.
+ *
+ * @example
+ * ```ts
+ * import { expressAdapter } from '@awesome-lang-auth/node';
+ * import type { AuthRequestHandler } from '@awesome-lang-auth/node';
+ *
+ * const myMiddleware: AuthRequestHandler = (req, res, next) => {
+ *   // logic here
+ *   next();
+ * };
+ *
+ * // Mount on an Express app with proper Express types:
+ * app.use(expressAdapter(myMiddleware));
+ * ```
+ *
+ * @since 1.7.0
+ */
+import { Router, RequestHandler, Request, Response, NextFunction } from 'express';
+import type { AuthRequestHandler } from '../http-types';
+export { Router, RequestHandler };
+export type { Request, Response, NextFunction };
+/**
+ * Cast an `AuthRequestHandler` (framework-neutral) to an Express
+ * `RequestHandler`.
+ *
+ * There is no runtime overhead — the original function reference is returned
+ * unchanged; only the TypeScript type is adjusted.  Use this when you write
+ * middleware against the neutral `AuthRequestHandler` interface and need to
+ * pass it to `app.use()` / `router.use()` with correct Express typing.
+ *
+ * @since 1.7.0
+ */
+export declare function expressAdapter(handler: AuthRequestHandler): RequestHandler;
+//# sourceMappingURL=express.d.ts.map

package/dist/adapters/express.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AAClC,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,CAE1E"}

package/dist/adapters/express.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * Express adapter for awesome-node-auth.
+ *
+ * Re-exports the Express `Router` and `RequestHandler` types so that Express
+ * applications can import them from a single, well-known path within the
+ * library.
+ *
+ * The `expressAdapter` helper is a zero-overhead cast: it accepts an
+ * `AuthRequestHandler` written against the framework-neutral types and returns
+ * the same function typed as an Express `RequestHandler`, bridging the two
+ * type systems without any runtime cost.
+ *
+ * @example
+ * ```ts
+ * import { expressAdapter } from '@awesome-lang-auth/node';
+ * import type { AuthRequestHandler } from '@awesome-lang-auth/node';
+ *
+ * const myMiddleware: AuthRequestHandler = (req, res, next) => {
+ *   // logic here
+ *   next();
+ * };
+ *
+ * // Mount on an Express app with proper Express types:
+ * app.use(expressAdapter(myMiddleware));
+ * ```
+ *
+ * @since 1.7.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Router = void 0;
+exports.expressAdapter = expressAdapter;
+const express_1 = require("express");
+Object.defineProperty(exports, "Router", { enumerable: true, get: function () { return express_1.Router; } });
+/**
+ * Cast an `AuthRequestHandler` (framework-neutral) to an Express
+ * `RequestHandler`.
+ *
+ * There is no runtime overhead — the original function reference is returned
+ * unchanged; only the TypeScript type is adjusted.  Use this when you write
+ * middleware against the neutral `AuthRequestHandler` interface and need to
+ * pass it to `app.use()` / `router.use()` with correct Express typing.
+ *
+ * @since 1.7.0
+ */
+function expressAdapter(handler) {
+    return handler;
+}
+//# sourceMappingURL=express.js.map

package/dist/adapters/express.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/adapters/express.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;AAmBH,wCAEC;AAnBD,qCAAkF;AAGzE,uFAHA,gBAAM,OAGA;AAGf;;;;;;;;;;GAUG;AACH,SAAgB,cAAc,CAAC,OAA2B;IACxD,OAAO,OAAoC,CAAC;AAC9C,CAAC"}

package/dist/adapters/fastify.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Fastify adapter for awesome-node-auth.
+ *
+ * Bridges an `AuthRequestHandler` to Fastify's `preHandler` hook by
+ * delegating to `req.raw` / `reply.raw` — the underlying Node.js
+ * `IncomingMessage` / `ServerResponse` objects that Fastify exposes on
+ * every request and reply.
+ *
+ * **No extra dependencies required.** This adapter works with any Fastify
+ * version that exposes `.raw` on its request and reply objects (v3+).
+ *
+ * For mounting the full auth **router** (not just middleware) you still need
+ * `@fastify/express`, because `auth.router()` returns an Express `Router`
+ * that relies on Express-specific request decoration.
+ *
+ * @example
+ * ```ts
+ * import Fastify from 'fastify';
+ * import { fastifyAdapter } from '@awesome-lang-auth/node';
+ * import { createAuthMiddleware } from '@awesome-lang-auth/node';
+ *
+ * const fastify = Fastify();
+ * const authMiddleware = createAuthMiddleware(authConfig, userStore);
+ *
+ * // Protect all routes — verify the JWT on every request.
+ * fastify.addHook('preHandler', fastifyAdapter(authMiddleware));
+ *
+ * fastify.get('/profile', async (request) => {
+ *   return request.raw.user; // populated by awesome-node-auth middleware
+ * });
+ * ```
+ *
+ * @since 1.7.0
+ */
+import type { AuthRequestHandler } from '../http-types';
+/**
+ * Minimal duck-typed surface we use from a Fastify request.
+ * Avoids a hard dependency on the `fastify` package.
+ */
+interface FastifyLikeRequest {
+    raw: any;
+}
+/**
+ * Minimal duck-typed surface we use from a Fastify reply.
+ * Avoids a hard dependency on the `fastify` package.
+ */
+interface FastifyLikeReply {
+    raw: any;
+}
+/**
+ * Wrap an `AuthRequestHandler` as a Fastify `preHandler` hook.
+ *
+ * The adapter forwards `req.raw` and `reply.raw` (the underlying Node.js
+ * `IncomingMessage` and `ServerResponse`) to the handler, so that
+ * awesome-node-auth middleware operates on the same objects it would receive
+ * from Express.
+ *
+ * There is no runtime overhead beyond the extra function call; the original
+ * handler is invoked directly.
+ *
+ * @example
+ * ```ts
+ * import { fastifyAdapter } from '@awesome-lang-auth/node';
+ *
+ * fastify.addHook('preHandler', fastifyAdapter(authMiddleware));
+ * ```
+ *
+ * @since 1.7.0
+ */
+export declare function fastifyAdapter(handler: AuthRequestHandler): (req: FastifyLikeRequest, reply: FastifyLikeReply, done: (err?: Error) => void) => void;
+export {};
+//# sourceMappingURL=fastify.d.ts.map

package/dist/adapters/fastify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../../src/adapters/fastify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD;;;GAGG;AACH,UAAU,kBAAkB;IAE1B,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;GAGG;AACH,UAAU,gBAAgB;IAExB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,kBAAkB,GAC1B,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,KAAK,IAAI,CAIzF"}

package/dist/adapters/fastify.js

@@ -0,0 +1,63 @@
+"use strict";
+/**
+ * Fastify adapter for awesome-node-auth.
+ *
+ * Bridges an `AuthRequestHandler` to Fastify's `preHandler` hook by
+ * delegating to `req.raw` / `reply.raw` — the underlying Node.js
+ * `IncomingMessage` / `ServerResponse` objects that Fastify exposes on
+ * every request and reply.
+ *
+ * **No extra dependencies required.** This adapter works with any Fastify
+ * version that exposes `.raw` on its request and reply objects (v3+).
+ *
+ * For mounting the full auth **router** (not just middleware) you still need
+ * `@fastify/express`, because `auth.router()` returns an Express `Router`
+ * that relies on Express-specific request decoration.
+ *
+ * @example
+ * ```ts
+ * import Fastify from 'fastify';
+ * import { fastifyAdapter } from '@awesome-lang-auth/node';
+ * import { createAuthMiddleware } from '@awesome-lang-auth/node';
+ *
+ * const fastify = Fastify();
+ * const authMiddleware = createAuthMiddleware(authConfig, userStore);
+ *
+ * // Protect all routes — verify the JWT on every request.
+ * fastify.addHook('preHandler', fastifyAdapter(authMiddleware));
+ *
+ * fastify.get('/profile', async (request) => {
+ *   return request.raw.user; // populated by awesome-node-auth middleware
+ * });
+ * ```
+ *
+ * @since 1.7.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fastifyAdapter = fastifyAdapter;
+/**
+ * Wrap an `AuthRequestHandler` as a Fastify `preHandler` hook.
+ *
+ * The adapter forwards `req.raw` and `reply.raw` (the underlying Node.js
+ * `IncomingMessage` and `ServerResponse`) to the handler, so that
+ * awesome-node-auth middleware operates on the same objects it would receive
+ * from Express.
+ *
+ * There is no runtime overhead beyond the extra function call; the original
+ * handler is invoked directly.
+ *
+ * @example
+ * ```ts
+ * import { fastifyAdapter } from '@awesome-lang-auth/node';
+ *
+ * fastify.addHook('preHandler', fastifyAdapter(authMiddleware));
+ * ```
+ *
+ * @since 1.7.0
+ */
+function fastifyAdapter(handler) {
+    return (req, reply, done) => {
+        handler(req.raw, reply.raw, done);
+    };
+}
+//# sourceMappingURL=fastify.js.map

package/dist/adapters/fastify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.js","sourceRoot":"","sources":["../../src/adapters/fastify.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;AA0CH,wCAMC;AA1BD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,cAAc,CAC5B,OAA2B;IAE3B,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth-configurator.d.ts

@@ -0,0 +1,65 @@
+import { Router, RequestHandler } from 'express';
+import { AuthConfig } from './models/auth-config.model';
+import { IUserStore } from './interfaces/user-store.interface';
+import { TokenService } from './services/token.service';
+import { PasswordService } from './services/password.service';
+import { LocalStrategy } from './strategies/local/local.strategy';
+import { GoogleStrategy } from './strategies/oauth/google.strategy';
+import { GithubStrategy } from './strategies/oauth/github.strategy';
+import { RouterOptions } from './router/auth.router';
+import { ISessionStore } from './interfaces/session-store.interface';
+import { AdminOptions, AdminAccessPolicy } from './router/admin.router';
+import { AuthEventBus } from './events/auth-event-bus';
+import { IRolesPermissionsStore } from './interfaces/roles-permissions-store.interface';
+export interface AuthConfiguratorOptions {
+    eventBus?: AuthEventBus;
+}
+type BuildAllRoutersAdminOptions = Omit<AdminOptions, 'jwtSecret' | 'apiPrefix' | 'eventBus'> & {
+    jwtSecret?: string;
+    apiPrefix?: string;
+    eventBus?: AuthEventBus;
+};
+export interface BuildAllRoutersOptions {
+    auth?: RouterOptions;
+    /**
+     * Options for the admin router.  `accessPolicy` (or a non-empty legacy
+     * `adminSecret`) is required: without either, `createAdminRouter` mounts the
+     * admin routes unprotected.  The type cannot reject an empty `adminSecret`;
+     * `createAdminRouter` throws on it at runtime.  Pass `accessPolicy: 'open'`
+     * to opt out explicitly.
+     */
+    admin: BuildAllRoutersAdminOptions & ({
+        accessPolicy: AdminAccessPolicy;
+    } | {
+        adminSecret: string;
+    });
+}
+export declare class AuthConfigurator {
+    private readonly config;
+    private readonly userStore;
+    private readonly options;
+    private readonly _tokenService;
+    private readonly _passwordService;
+    private _sessionStore?;
+    constructor(config: AuthConfig, userStore: IUserStore, options?: AuthConfiguratorOptions);
+    middleware(options?: {
+        sessionStore?: ISessionStore;
+    }): RequestHandler;
+    router(options?: RouterOptions): Router;
+    buildAllRouters(options: BuildAllRoutersOptions): Router;
+    promoteToAdmin(userId: string, options?: {
+        method?: 'flag' | 'role';
+        rbacStore?: IRolesPermissionsStore;
+    }): Promise<void>;
+    revokeAdmin(userId: string, options?: {
+        method?: 'flag' | 'role' | 'both';
+        rbacStore?: IRolesPermissionsStore;
+    }): Promise<void>;
+    get tokenService(): TokenService;
+    get passwordService(): PasswordService;
+    strategy(name: 'local'): LocalStrategy;
+    strategy(name: 'google'): GoogleStrategy;
+    strategy(name: 'github'): GithubStrategy;
+}
+export {};
+//# sourceMappingURL=auth-configurator.d.ts.map

package/dist/auth-configurator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-configurator.d.ts","sourceRoot":"","sources":["../src/auth-configurator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE,OAAO,EAAsC,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAqB,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE3F,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAGxF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAED,KAAK,2BAA2B,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,GAAG,WAAW,GAAG,UAAU,CAAC,GAAG;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;;;;OAMG;IACH,KAAK,EAAE,2BAA2B,GAAG,CAAC;QAAE,YAAY,EAAE,iBAAiB,CAAA;KAAE,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtG;AAMD,qBAAa,gBAAgB;IAMzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAkB;IACnD,OAAO,CAAC,aAAa,CAAC,CAAgB;gBAGnB,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,UAAU,EACrB,OAAO,GAAE,uBAA4B;IAMxD,UAAU,CAAC,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,cAAc;IAItE,MAAM,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM;IAUvC,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM;IAkBlD,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,sBAAsB,CAAA;KAAO,GAC7E,OAAO,CAAC,IAAI,CAAC;IA8BV,WAAW,CACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,sBAAsB,CAAA;KAAO,GACtF,OAAO,CAAC,IAAI,CAAC;IAoChB,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED,IAAI,eAAe,IAAI,eAAe,CAErC;IAED,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa;IACtC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,cAAc;IACxC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,cAAc;CAazC"}