@azlib/identity 0.2.0

package/dist/errors-C2xZAatu.d.cts

@@ -0,0 +1,481 @@
+import { c as AuthResult, d as AuthenticatedIdentity, h as IdentityEventType, m as IdentityEvent, r as IdentityStore, s as AccessTokenClaims, x as Permission } from "./identity-store-BRRahxcS.cjs";
+
+//#region core/authorization.d.ts
+/**
+ * Context passed to authorization checks. `resource` is an opaque consumer-supplied
+ * object (e.g. a loaded document) used by ownership/relationship policies.
+ */
+interface AuthorizationContext<TResource = unknown> {
+  principal: AuthenticatedIdentity;
+  /** The action being attempted, typically a permission string. */
+  action: string;
+  /** The target resource, if any. */
+  resource?: TResource;
+}
+/**
+ * A policy rule returns:
+ * - `true` to allow,
+ * - `false`/`undefined` to abstain (deny-by-default unless another rule allows),
+ * It must never throw for normal "denied" outcomes.
+ */
+type PolicyRule<TResource = unknown> = (context: AuthorizationContext<TResource>) => boolean | undefined | Promise<boolean | undefined>;
+/** A named requirement combining a required permission and optional ownership policy. */
+interface AuthorizationRequirement<TResource = unknown> {
+  /** Permission the principal must hold. Omit to rely solely on policies. */
+  permission?: Permission;
+  /** Optional ownership/relationship rule evaluated against the resource. */
+  policy?: PolicyRule<TResource>;
+}
+/** Result of an authorization decision. */
+interface AuthorizationDecision {
+  allowed: boolean;
+  /** Non-sensitive reason for diagnostics/audit. */
+  reason: string;
+}
+/**
+ * Evaluates a requirement using deny-by-default semantics:
+ * 1. If a `permission` is required and the principal lacks it, deny.
+ * 2. If a `policy` is provided, it must return `true` to allow.
+ * 3. If neither is provided, deny (nothing explicitly granted access).
+ */
+declare function evaluateAuthorization<TResource = unknown>(requirement: AuthorizationRequirement<TResource>, context: AuthorizationContext<TResource>): Promise<AuthorizationDecision>;
+/** Convenience boolean form of {@link evaluateAuthorization}. */
+declare function isAuthorized<TResource = unknown>(requirement: AuthorizationRequirement<TResource>, context: AuthorizationContext<TResource>): Promise<boolean>;
+//#endregion
+//#region core/logger.d.ts
+/**
+ * Pluggable logger interface for `@azlib/identity`.
+ *
+ * The package uses this interface for request/response logging in the Express router and
+ * for operational messages throughout the module. Consumers can hook any structured
+ * logging library (Winston, Pino, Bunyan, etc.) by implementing this interface.
+ *
+ * @example
+ * ```ts
+ * import pino from "pino";
+ *
+ * const logger = pino();
+ * createIdentityRouter(service, { logger });
+ * ```
+ */
+interface IdentityLogger {
+  debug(message: string, meta?: Record<string, unknown>): void;
+  info(message: string, meta?: Record<string, unknown>): void;
+  warn(message: string, meta?: Record<string, unknown>): void;
+  error(message: string, meta?: Record<string, unknown>): void;
+}
+/**
+ * Default logger that writes to the Node.js console with an `[identity]` prefix.
+ * Used when no custom logger is provided.
+ */
+declare const consoleLogger: IdentityLogger;
+/** No-op logger. Pass `false` or `noopLogger` to disable all identity logging. */
+declare const noopLogger: IdentityLogger;
+/**
+ * Resolves an `IdentityLogger | false | undefined` to a concrete `IdentityLogger`.
+ *
+ * - `false` → {@link noopLogger}
+ * - `undefined` → {@link consoleLogger}
+ * - anything else → returned as-is
+ */
+declare function resolveLogger(logger?: IdentityLogger | false): IdentityLogger;
+//#endregion
+//#region core/notification.d.ts
+/**
+ * Pluggable notification service interface.
+ *
+ * Implement this to send emails and SMS messages from your own infrastructure
+ * (SMTP, SendGrid, Twilio, etc.). The library only defines the interface; consumers
+ * provide the concrete implementation.
+ *
+ * Pass the implementation to `createIdentityService` via the `notifications` config key.
+ *
+ * @example
+ * ```ts
+ * import { createIdentityService } from "@azlib/identity/node";
+ * import type { NotificationService } from "@azlib/identity/node";
+ *
+ * const notifications: NotificationService = {
+ *   async sendEmailVerification({ email, token }) {
+ *     await mailer.send({
+ *       to: email,
+ *       subject: "Verify your email",
+ *       text: `Click to verify: https://example.com/verify-email?token=${token}`,
+ *     });
+ *   },
+ *   async sendPasswordReset({ email, token }) {
+ *     await mailer.send({
+ *       to: email,
+ *       subject: "Reset your password",
+ *       text: `Click to reset: https://example.com/reset-password?token=${token}`,
+ *     });
+ *   },
+ * };
+ *
+ * const identity = createIdentityService({ ..., notifications }, store);
+ * ```
+ */
+/** Parameters passed to {@link NotificationService.sendEmailVerification}. */
+interface EmailVerificationParams {
+  email: string;
+  displayName: string | null;
+  /**
+   * The raw verification token. Embed it in a URL, e.g.
+   * `https://example.com/verify-email?token=${token}`.
+   */
+  token: string;
+}
+/** Parameters passed to {@link NotificationService.sendPasswordReset}. */
+interface PasswordResetParams {
+  email: string;
+  displayName: string | null;
+  /**
+   * The raw reset token. Embed it in a URL, e.g.
+   * `https://example.com/reset-password?token=${token}`.
+   */
+  token: string;
+}
+/** Parameters passed to {@link NotificationService.sendTwoFactorCode}. */
+interface TwoFactorSmsParams {
+  phoneNumber: string;
+  /** 6-digit TOTP code to include in the SMS message. */
+  code: string;
+}
+/**
+ * Notification service for identity-related messages.
+ *
+ * All methods are optional — only implement the ones your application needs.
+ * The library calls each method only when the corresponding feature is active.
+ */
+interface NotificationService {
+  /** Called after a user registers or explicitly requests a new verification email. */
+  sendEmailVerification?(params: EmailVerificationParams): Promise<void>;
+  /** Called when a password reset is requested. */
+  sendPasswordReset?(params: PasswordResetParams): Promise<void>;
+  /** Called to deliver a 2FA code via SMS (when using SMS-based out-of-band 2FA). */
+  sendTwoFactorCode?(params: TwoFactorSmsParams): Promise<void>;
+}
+//#endregion
+//#region core/config.d.ts
+/**
+ * Pluggable override points for advanced consumers. All are optional; sensible Node
+ * defaults are supplied by the runtime entry (`@azlib/identity/node`).
+ */
+interface IdentityOverrides {
+  /** Returns the current time. Override in tests for deterministic clocks. */
+  now?: () => Date;
+  /** Generates a unique id (user ids, session ids). Defaults to `crypto.randomUUID`. */
+  generateId?: () => string;
+  /**
+   * Lifecycle hook invoked for every audit event (registration, login, refresh, etc.).
+   * Use it to forward events to your own logging/analytics pipeline. It must never throw
+   * for normal operation; failures are swallowed so auditing cannot break auth flows.
+   */
+  onEvent?: (event: IdentityEvent) => void | Promise<void>;
+}
+/** Account lockout policy applied after repeated failed logins. */
+interface LockoutConfig {
+  /**
+   * How many consecutive failed login attempts are allowed before the account is
+   * temporarily locked. Set to 0 to disable lockout. Default 10.
+   */
+  maxFailedAttempts: number;
+  /**
+   * How long (in seconds) a locked account is blocked before automatic unlock.
+   * Default 900 (15 minutes). Set to 0 for permanent lock (manual unlock required).
+   */
+  durationSeconds: number;
+}
+/** Raw configuration accepted from consumers. */
+interface IdentityConfigInput {
+  /**
+   * Secret used to sign and verify access tokens (HMAC). Must be at least 32 characters.
+   * Provide via environment, never hardcode.
+   */
+  accessTokenSecret: string;
+  /** Access-token lifetime in seconds. Default 900 (15 minutes). */
+  accessTokenTtlSeconds?: number;
+  /** Refresh-token lifetime in seconds. Default 1209600 (14 days). */
+  refreshTokenTtlSeconds?: number;
+  /** Token issuer (`iss`). Default `azlib-identity`. */
+  issuer?: string;
+  /** Token audience (`aud`). Optional. */
+  audience?: string;
+  /** scrypt cost parameter `N`. Default 16384. */
+  passwordScryptCost?: number;
+  /**
+   * Account lockout policy. Omit or set `maxFailedAttempts: 0` to disable. Default: 10
+   * attempts, 15-minute lockout.
+   */
+  lockout?: Partial<LockoutConfig>;
+  /**
+   * Pluggable notification service for email verification, password reset, and SMS 2FA.
+   * Omit if you do not need these features.
+   */
+  notifications?: NotificationService;
+  /**
+   * Logger used throughout the package. Pass your own `IdentityLogger` to route
+   * diagnostic output to Winston, Pino, or any other provider. Pass `false` to silence
+   * all logging. Defaults to a console-based logger when omitted.
+   */
+  logger?: IdentityLogger | false;
+  /** Override points for clock and id generation. */
+  overrides?: IdentityOverrides;
+}
+/** Fully resolved, validated configuration used internally. */
+interface IdentityConfig {
+  accessTokenSecret: string;
+  accessTokenTtlSeconds: number;
+  refreshTokenTtlSeconds: number;
+  issuer: string;
+  audience: string | undefined;
+  passwordScryptCost: number;
+  lockout: LockoutConfig;
+  notifications: NotificationService | undefined;
+  /** Resolved logger; never `false` — `false` becomes {@link noopLogger}. */
+  logger: IdentityLogger;
+  now: () => Date;
+  generateId: () => string;
+  onEvent: ((event: IdentityEvent) => void | Promise<void>) | undefined;
+}
+/**
+ * Validates and applies defaults to consumer-provided configuration.
+ * Throws {@link IdentityConfigError} when required values are missing or invalid.
+ */
+declare function resolveIdentityConfig(input: IdentityConfigInput): IdentityConfig;
+//#endregion
+//#region core/audit.d.ts
+/**
+ * Thin auditing helper. Persists events through the store's optional `recordEvent` hook
+ * when present and never throws — auditing must not break the primary auth flow.
+ *
+ * Metadata is restricted to non-sensitive scalars; never pass passwords or raw tokens.
+ */
+interface AuditLogger {
+  record(type: IdentityEventType, userId: string | null, metadata?: IdentityEvent["metadata"]): Promise<void>;
+}
+declare function createAuditLogger(store: IdentityStore, now: () => Date, onEvent?: (event: IdentityEvent) => void | Promise<void>): AuditLogger;
+//#endregion
+//#region core/token-service.d.ts
+/**
+ * Issues and verifies short-lived HS256 access tokens (via `jose`) and generates the
+ * opaque refresh tokens whose hashes are stored server-side.
+ */
+interface TokenService {
+  issueAccessToken(userId: string, authVersion: number): Promise<{
+    token: string;
+    expiresAt: Date;
+  }>;
+  verifyAccessToken(token: string): Promise<AccessTokenClaims>;
+  /**
+   * Creates a refresh token bound to a session id. The id prefix lets the server look up
+   * the session, while only the hash of the full token is stored.
+   */
+  createRefreshToken(sessionId: string): {
+    token: string;
+    hash: string;
+  };
+  /** Extracts the session id encoded in a refresh token, or null if malformed. */
+  parseSessionId(token: string): string | null;
+  /** Hashes a presented refresh token for comparison with the stored hash. */
+  hashRefreshToken(token: string): string;
+}
+declare function createTokenService(config: IdentityConfig): TokenService;
+//#endregion
+//#region core/session-state.d.ts
+/** Dependencies shared by the register/login/refresh flows. */
+interface SessionDeps {
+  config: IdentityConfig;
+  store: IdentityStore;
+  tokenService: TokenService;
+}
+//#endregion
+//#region core/oauth/oauth-provider.d.ts
+/**
+ * Framework-agnostic OAuth 2.0 / OpenID Connect provider interface.
+ *
+ * Implement this interface to add any OAuth2/OIDC provider. Pre-built implementations
+ * for Google and Microsoft are exported from `@azlib/identity/node`.
+ */
+/** Tokens received from an OAuth2 token endpoint. */
+interface OAuthTokens {
+  accessToken: string;
+  /** OIDC identity token (JWT). Present for OpenID Connect providers. */
+  idToken?: string;
+  tokenType: string;
+  /** Lifetime in seconds. */
+  expiresIn: number;
+  refreshToken?: string;
+  scope?: string;
+}
+/**
+ * Normalized user information extracted from the provider after a successful
+ * authorization flow.
+ */
+interface OAuthUserInfo {
+  /** The provider's stable user identifier (`sub` in OIDC). */
+  providerUserId: string;
+  email: string | null;
+  /** Whether the provider has verified the email address. */
+  emailVerified: boolean;
+  displayName: string | null;
+}
+/** Parameters passed to {@link OAuthProvider.buildAuthorizationUrl}. */
+interface BuildAuthUrlParams {
+  /** The URI the provider will redirect to after authorization. */
+  redirectUri: string;
+  /**
+   * An opaque value used to prevent CSRF attacks. Generate with `crypto.randomUUID()` or
+   * similar and verify it matches when handling the callback.
+   */
+  state: string;
+  /** Override the default scopes for this request. */
+  scopes?: string[];
+}
+/** Parameters passed to {@link OAuthProvider.exchangeCode}. */
+interface ExchangeCodeParams {
+  code: string;
+  redirectUri: string;
+}
+/**
+ * Describes a single OAuth2 / OpenID Connect provider. Implement this interface to
+ * plug in any authorization server.
+ */
+interface OAuthProvider {
+  /**
+   * Unique, lowercase identifier for this provider, e.g. `"google"` or `"microsoft"`.
+   * Used as the `provider` discriminator on {@link OAuthLinkedAccount}.
+   */
+  readonly name: string;
+  /**
+   * Builds the full authorization URL the user should be redirected to. The caller is
+   * responsible for storing `state` (e.g. in a signed cookie) and verifying it on
+   * callback to prevent CSRF.
+   */
+  buildAuthorizationUrl(params: BuildAuthUrlParams): string;
+  /**
+   * Exchanges an authorization code (from the callback) for provider tokens. Must only
+   * be called server-side — never expose `clientSecret` to the browser.
+   */
+  exchangeCode(params: ExchangeCodeParams): Promise<OAuthTokens>;
+  /**
+   * Fetches or extracts the authenticated user's info from the provider tokens. Called
+   * after a successful `exchangeCode`.
+   */
+  fetchUserInfo(tokens: OAuthTokens): Promise<OAuthUserInfo>;
+}
+//#endregion
+//#region core/oauth/oauth-service.d.ts
+/** Result of {@link OAuthService.buildAuthorizationUrl}. */
+interface OAuthAuthorizationUrl {
+  /** The full provider authorization URL to redirect the user to. */
+  url: string;
+  /**
+   * An opaque CSRF-prevention state value. Store this in a signed cookie or server
+   * session and pass it as `expectedState` when calling {@link OAuthService.handleCallback}.
+   */
+  state: string;
+}
+/** Parameters for {@link OAuthService.handleCallback}. */
+interface OAuthCallbackParams {
+  /** The authorization code received from the provider callback query string. */
+  code: string;
+  /** The `state` value received from the provider callback query string. */
+  state: string;
+  /**
+   * The expected state value previously returned by {@link OAuthService.buildAuthorizationUrl}.
+   * The callback will be rejected when they do not match (CSRF protection).
+   */
+  expectedState: string;
+  /** The same redirect URI that was used in the authorization request. */
+  redirectUri: string;
+  /** Optional scopes to override for this callback's code exchange. */
+  scopes?: string[];
+}
+/** The OAuth2 / OIDC surface of the identity service. */
+interface OAuthService {
+  /** Returns the registered provider names, e.g. `["google", "microsoft"]`. */
+  readonly providers: readonly string[];
+  /**
+   * Builds the authorization URL for the given provider. Redirect the user's browser to
+   * the returned `url`, then store `state` for later verification.
+   */
+  buildAuthorizationUrl(providerName: string, redirectUri: string, scopes?: string[]): OAuthAuthorizationUrl;
+  /**
+   * Handles the provider callback after user consent. Verifies state, exchanges the code
+   * for tokens, resolves or provisions a local user, and returns a full auth result.
+   *
+   * Throws {@link OAuthProviderNotFoundError} for unknown providers.
+   * Throws a generic {@link IdentityError} when state mismatches (CSRF guard).
+   */
+  handleCallback(providerName: string, params: OAuthCallbackParams): Promise<AuthResult>;
+}
+/** Thrown when an OAuth operation targets an unregistered provider name. */
+declare class OAuthProviderNotFoundError extends Error {
+  constructor(providerName: string);
+}
+/** Thrown when the callback state does not match the expected state (CSRF guard). */
+declare class OAuthStateMismatchError extends Error {
+  constructor();
+}
+/** Dependencies for {@link createOAuthService}. */
+interface OAuthServiceDeps {
+  providers: readonly OAuthProvider[];
+  config: IdentityConfig;
+  store: IdentityStore;
+  sessionDeps: SessionDeps;
+  audit: AuditLogger;
+}
+/**
+ * Creates the OAuth2 / OIDC service. Wire into the identity service by passing configured
+ * provider instances (e.g. `createGoogleOAuthProvider(...)`) to the `oauth.providers` list
+ * in {@link IdentityConfigInput}.
+ */
+declare function createOAuthService(deps: OAuthServiceDeps): OAuthService;
+//#endregion
+//#region core/errors.d.ts
+/**
+ * Error types for `@azlib/identity`.
+ *
+ * Authentication failures intentionally use a single generic message so callers cannot
+ * distinguish "unknown user" from "wrong password", which mitigates account enumeration.
+ */
+/** Base class for all identity errors. */
+declare class IdentityError extends Error {
+  /** Stable machine-readable code for programmatic handling. */
+  readonly code: string;
+  /** Suggested HTTP status for transport adapters. */
+  readonly statusCode: number;
+  constructor(code: string, message: string, statusCode: number);
+}
+/** Configuration is missing or invalid. */
+declare class IdentityConfigError extends IdentityError {
+  constructor(message: string);
+}
+/** Generic credential failure. Used for unknown user AND wrong password alike. */
+declare class InvalidCredentialsError extends IdentityError {
+  constructor();
+}
+/** A registration was attempted for an email that already exists. */
+declare class EmailAlreadyRegisteredError extends IdentityError {
+  constructor();
+}
+/** The provided access token is missing, malformed, expired, or stale. */
+declare class InvalidTokenError extends IdentityError {
+  constructor(message?: string);
+}
+/** No authenticated principal is present on the request. */
+declare class UnauthenticatedError extends IdentityError {
+  constructor(message?: string);
+}
+/** The authenticated principal is not permitted to perform the action. */
+declare class ForbiddenError extends IdentityError {
+  constructor(message?: string);
+}
+/** The user account is disabled or locked. */
+declare class AccountUnavailableError extends IdentityError {
+  constructor(message?: string);
+}
+//#endregion
+export { resolveIdentityConfig as A, AuthorizationDecision as B, createTokenService as C, IdentityConfigInput as D, IdentityConfig as E, IdentityLogger as F, PolicyRule as H, consoleLogger as I, noopLogger as L, NotificationService as M, PasswordResetParams as N, IdentityOverrides as O, TwoFactorSmsParams as P, resolveLogger as R, TokenService as S, createAuditLogger as T, evaluateAuthorization as U, AuthorizationRequirement as V, isAuthorized as W, ExchangeCodeParams as _, IdentityError as a, OAuthUserInfo as b, UnauthenticatedError as c, OAuthProviderNotFoundError as d, OAuthService as f, BuildAuthUrlParams as g, createOAuthService as h, IdentityConfigError as i, EmailVerificationParams as j, LockoutConfig as k, OAuthAuthorizationUrl as l, OAuthStateMismatchError as m, EmailAlreadyRegisteredError as n, InvalidCredentialsError as o, OAuthServiceDeps as p, ForbiddenError as r, InvalidTokenError as s, AccountUnavailableError as t, OAuthCallbackParams as u, OAuthProvider as v, AuditLogger as w, SessionDeps as x, OAuthTokens as y, AuthorizationContext as z };
+//# sourceMappingURL=errors-C2xZAatu.d.cts.map

package/dist/errors-C2xZAatu.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-C2xZAatu.d.cts","names":[],"sources":["../core/authorization.ts","../core/logger.ts","../core/notification.ts","../core/config.ts","../core/audit.ts","../core/token-service.ts","../core/session-state.ts","../core/oauth/oauth-provider.ts","../core/oauth/oauth-service.ts","../core/errors.ts"],"mappings":";;;;;AAMA;;UAAiB,oBAAA;EACf,SAAA,EAAW,qBAAA;EADyB;EAGpC,MAAA;EAFW;EAIX,QAAA,GAAW,SAAS;AAAA;;;AAAA;AAStB;;;KAAY,UAAA,yBACV,OAAA,EAAS,oBAAA,CAAqB,SAAA,4BACL,OAAA;;UAGV,wBAAA;EAHiB;EAKhC,UAAA,GAAa,UAAA;EAPQ;EASrB,MAAA,GAAS,UAAA,CAAW,SAAA;AAAA;;UAIL,qBAAA;EACf,OAAA;EAZgC;EAchC,MAAM;AAAA;;;;;;;iBAcc,qBAAA,qBAAA,CACpB,WAAA,EAAa,wBAAA,CAAyB,SAAA,GACtC,OAAA,EAAS,oBAAA,CAAqB,SAAA,IAC7B,OAAA,CAAQ,qBAAA;;iBAuBW,YAAA,qBAAA,CACpB,WAAA,EAAa,wBAAA,CAAyB,SAAA,GACtC,OAAA,EAAS,oBAAA,CAAqB,SAAA,IAC7B,OAAA;;;;;;AAzEH;;;;;;;;;;;AAKsB;UCIL,cAAA;EACf,KAAA,CAAM,OAAA,UAAiB,IAAA,GAAO,MAAA;EAC9B,IAAA,CAAK,OAAA,UAAiB,IAAA,GAAO,MAAA;EAC7B,IAAA,CAAK,OAAA,UAAiB,IAAA,GAAO,MAAA;EAC7B,KAAA,CAAM,OAAA,UAAiB,IAAA,GAAO,MAAA;AAAA;;;;;cAOnB,aAAA,EAAe,cAK3B;;cAGY,UAAA,EAAY,cAKxB;;ADjBiC;AAGlC;;;;;iBCuBgB,aAAA,CAAc,MAAA,GAAS,cAAA,WAAyB,cAAc;;;;;;AD1C9E;;;;;;;;;;;AAKsB;AAStB;;;;;;;;;;;;;;AAEkC;AAGlC;;;;;UEWiB,uBAAA;EACf,KAAA;EACA,WAAA;EFbwC;;;;EEkBxC,KAAA;AAAA;;UAIe,mBAAA;EACf,KAAA;EACA,WAAA;;;AFbM;AAcR;EEIE,KAAA;AAAA;;UAIe,kBAAA;EACf,WAAA;EFPS;EEST,IAAI;AAAA;;;;;;;UASW,mBAAA;EFlBe;EEoB9B,qBAAA,EAAuB,MAAA,EAAQ,uBAAA,GAA0B,OAAA;EFnBxD;EEqBD,iBAAA,EAAmB,MAAA,EAAQ,mBAAA,GAAsB,OAAA;EFrBnB;EEuB9B,iBAAA,EAAmB,MAAA,EAAQ,kBAAA,GAAqB,OAAA;AAAA;;;AFtElD;;;;AAAA,UGIiB,iBAAA;EHHf;EGKA,GAAA,SAAY,IAAA;EHHZ;EGKA,UAAA;EHHW;;AAAS;AAStB;;EGAE,OAAA,IAAW,KAAA,EAAO,aAAA,YAAyB,OAAA;AAAA;;UAI5B,aAAA;EHFiB;;;;EGOhC,iBAAA;EHRA;;;AACgC;EGYhC,eAAe;AAAA;;UAIA,mBAAA;EHTK;;;;EGcpB,iBAAA;EHhBA;EGkBA,qBAAA;EHhBA;EGkBA,sBAAA;EHlBoB;EGoBpB,MAAA;EHpB6B;EGsB7B,QAAA;EHlBoC;EGoBpC,kBAAA;EHnBA;AAEM;AAcR;;EGQE,OAAA,GAAU,OAAA,CAAQ,aAAA;EHPoB;;;;EGYtC,aAAA,GAAgB,mBAAA;EHVf;;;;;EGgBD,MAAA,GAAS,cAAA;EHlBT;EGoBA,SAAA,GAAY,iBAAA;AAAA;;UAIG,cAAA;EACf,iBAAA;EACA,qBAAA;EACA,sBAAA;EACA,MAAA;EACA,QAAA;EACA,kBAAA;EACA,OAAA,EAAS,aAAA;EACT,aAAA,EAAe,mBAAA;EHLe;EGO9B,MAAA,EAAQ,cAAA;EACR,GAAA,QAAW,IAAA;EACX,UAAA;EACA,OAAA,IAAW,KAAA,EAAO,aAAA,YAAyB,OAAA;AAAA;;;;;iBAY7B,qBAAA,CAAsB,KAAA,EAAO,mBAAA,GAAsB,cAAc;;;;AH9FjF;;;;;UIGiB,WAAA;EACf,MAAA,CACE,IAAA,EAAM,iBAAA,EACN,MAAA,iBACA,QAAA,GAAW,aAAA,eACV,OAAA;AAAA;AAAA,iBAGW,iBAAA,CACd,KAAA,EAAO,aAAA,EACP,GAAA,QAAW,IAAA,EACX,OAAA,IAAW,KAAA,EAAO,aAAA,YAAyB,OAAA,SAC1C,WAAA;;;;AJfH;;;UKKiB,YAAA;EACf,gBAAA,CAAiB,MAAA,UAAgB,WAAA,WAAsB,OAAA;IAAU,KAAA;IAAe,SAAA,EAAW,IAAA;EAAA;EAC3F,iBAAA,CAAkB,KAAA,WAAgB,OAAA,CAAQ,iBAAA;ELF/B;;AAAS;AAStB;EKFE,kBAAA,CAAmB,SAAA;IAAsB,KAAA;IAAe,IAAA;EAAA;ELI/B;EKFzB,cAAA,CAAe,KAAA;ELEiB;EKAhC,gBAAA,CAAiB,KAAA;AAAA;AAAA,iBAMH,kBAAA,CAAmB,MAAA,EAAQ,cAAA,GAAiB,YAAY;;;;UCtBvD,WAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,YAAA,EAAc,YAAA;AAAA;;;;;;ANHhB;;;;UOEiB,WAAA;EACf,WAAA;EPFW;EOIX,OAAA;EACA,SAAA;EPDW;EOGX,SAAA;EACA,YAAA;EACA,KAAA;AAAA;;;;;UAOe,aAAA;EPDiB;EOGhC,cAAA;EACA,KAAA;EPL8B;EOO9B,aAAA;EACA,WAAA;AAAA;APPgC;AAAA,UOWjB,kBAAA;EPRwB;EOUvC,WAAA;EPRa;;;;EOab,KAAA;EPfwC;EOiBxC,MAAA;AAAA;;UAIe,kBAAA;EACf,IAAA;EACA,WAAW;AAAA;APfb;;;;AAAA,UOsBiB,aAAA;EPLK;;;;EAAA,SOUX,IAAA;EPRqB;;;;;EOe9B,qBAAA,CAAsB,MAAA,EAAQ,kBAAA;EPjBY;;;;EOuB1C,YAAA,CAAa,MAAA,EAAQ,kBAAA,GAAqB,OAAA,CAAQ,WAAA;EPrBpB;;;;EO2B9B,aAAA,CAAc,MAAA,EAAQ,WAAA,GAAc,OAAA,CAAQ,aAAA;AAAA;;;;UCvE7B,qBAAA;ERDf;EQGA,GAAA;ERDA;;;;EQMA,KAAK;AAAA;;UAIU,mBAAA;EREe;EQA9B,IAAA;ERCyB;EQCzB,KAAA;ERDgC;;;;EQMhC,aAAA;ERNyB;EQQzB,WAAA;ERRgC;EQUhC,MAAA;AAAA;;UAIe,YAAA;ERPK;EAAA,SQSX,SAAA;ERTU;;;;EQenB,qBAAA,CAAsB,YAAA,UAAsB,WAAA,UAAqB,MAAA,cAAoB,qBAAA;ERfrF;;;;AAA6B;AAI/B;;EQoBE,cAAA,CAAe,YAAA,UAAsB,MAAA,EAAQ,mBAAA,GAAsB,OAAA,CAAQ,UAAA;AAAA;ARjBrE;AAAA,cQqBK,0BAAA,SAAmC,KAAK;cACvC,YAAA;AAAA;;cAOD,uBAAA,SAAgC,KAAK;EAAL,WAAA,CAAA;AAAA;;UAQ5B,gBAAA;EACf,SAAA,WAAoB,aAAA;EACpB,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,WAAA,EAAa,WAAA;EACb,KAAA,EAAO,WAAA;AAAA;;;;;;iBAQO,kBAAA,CAAmB,IAAA,EAAM,gBAAA,GAAmB,YAAY;;;;;;ARhFxE;;;;cSEa,aAAA,SAAsB,KAAK;ETDtC;EAAA,SSGS,IAAA;ETDT;EAAA,SSGS,UAAA;cAEG,IAAA,UAAc,OAAA,UAAiB,UAAA;AAAA;ATHvB;AAAA,cSYT,mBAAA,SAA4B,aAAa;cACxC,OAAA;AAAA;;cAMD,uBAAA,SAAgC,aAAa;EAAb,WAAA,CAAA;AAAA;;cAOhC,2BAAA,SAAoC,aAAa;EAAb,WAAA,CAAA;AAAA;;cAWpC,iBAAA,SAA0B,aAAa;cACtC,OAAA;AAAA;ATxBd;AAAA,cS8Ba,oBAAA,SAA6B,aAAa;cACzC,OAAA;AAAA;;cAMD,cAAA,SAAuB,aAAa;cACnC,OAAA;AAAA;;cAMD,uBAAA,SAAgC,aAAa;cAC5C,OAAA;AAAA"}

package/dist/errors-CEmnZxIn.mjs

@@ -0,0 +1,66 @@
+//#region core/errors.ts
+/**
+* Error types for `@azlib/identity`.
+*
+* Authentication failures intentionally use a single generic message so callers cannot
+* distinguish "unknown user" from "wrong password", which mitigates account enumeration.
+*/
+/** Base class for all identity errors. */
+var IdentityError = class extends Error {
+	/** Stable machine-readable code for programmatic handling. */
+	code;
+	/** Suggested HTTP status for transport adapters. */
+	statusCode;
+	constructor(code, message, statusCode) {
+		super(message);
+		this.name = new.target.name;
+		this.code = code;
+		this.statusCode = statusCode;
+	}
+};
+/** Configuration is missing or invalid. */
+var IdentityConfigError = class extends IdentityError {
+	constructor(message) {
+		super("identity/config-invalid", message, 500);
+	}
+};
+/** Generic credential failure. Used for unknown user AND wrong password alike. */
+var InvalidCredentialsError = class extends IdentityError {
+	constructor() {
+		super("identity/invalid-credentials", "Invalid email or password.", 401);
+	}
+};
+/** A registration was attempted for an email that already exists. */
+var EmailAlreadyRegisteredError = class extends IdentityError {
+	constructor() {
+		super("identity/email-already-registered", "An account with this email already exists.", 409);
+	}
+};
+/** The provided access token is missing, malformed, expired, or stale. */
+var InvalidTokenError = class extends IdentityError {
+	constructor(message = "Authentication token is invalid or expired.") {
+		super("identity/invalid-token", message, 401);
+	}
+};
+/** No authenticated principal is present on the request. */
+var UnauthenticatedError = class extends IdentityError {
+	constructor(message = "Authentication is required.") {
+		super("identity/unauthenticated", message, 401);
+	}
+};
+/** The authenticated principal is not permitted to perform the action. */
+var ForbiddenError = class extends IdentityError {
+	constructor(message = "You do not have permission to perform this action.") {
+		super("identity/forbidden", message, 403);
+	}
+};
+/** The user account is disabled or locked. */
+var AccountUnavailableError = class extends IdentityError {
+	constructor(message = "This account is not available.") {
+		super("identity/account-unavailable", message, 403);
+	}
+};
+//#endregion
+export { IdentityError as a, UnauthenticatedError as c, IdentityConfigError as i, EmailAlreadyRegisteredError as n, InvalidCredentialsError as o, ForbiddenError as r, InvalidTokenError as s, AccountUnavailableError as t };
+
+//# sourceMappingURL=errors-CEmnZxIn.mjs.map

package/dist/errors-CEmnZxIn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-CEmnZxIn.mjs","names":[],"sources":["../core/errors.ts"],"sourcesContent":["/**\n * Error types for `@azlib/identity`.\n *\n * Authentication failures intentionally use a single generic message so callers cannot\n * distinguish \"unknown user\" from \"wrong password\", which mitigates account enumeration.\n */\n\n/** Base class for all identity errors. */\nexport class IdentityError extends Error {\n  /** Stable machine-readable code for programmatic handling. */\n  readonly code: string;\n  /** Suggested HTTP status for transport adapters. */\n  readonly statusCode: number;\n\n  constructor(code: string, message: string, statusCode: number) {\n    super(message);\n    this.name = new.target.name;\n    this.code = code;\n    this.statusCode = statusCode;\n  }\n}\n\n/** Configuration is missing or invalid. */\nexport class IdentityConfigError extends IdentityError {\n  constructor(message: string) {\n    super(\"identity/config-invalid\", message, 500);\n  }\n}\n\n/** Generic credential failure. Used for unknown user AND wrong password alike. */\nexport class InvalidCredentialsError extends IdentityError {\n  constructor() {\n    super(\"identity/invalid-credentials\", \"Invalid email or password.\", 401);\n  }\n}\n\n/** A registration was attempted for an email that already exists. */\nexport class EmailAlreadyRegisteredError extends IdentityError {\n  constructor() {\n    super(\n      \"identity/email-already-registered\",\n      \"An account with this email already exists.\",\n      409,\n    );\n  }\n}\n\n/** The provided access token is missing, malformed, expired, or stale. */\nexport class InvalidTokenError extends IdentityError {\n  constructor(message = \"Authentication token is invalid or expired.\") {\n    super(\"identity/invalid-token\", message, 401);\n  }\n}\n\n/** No authenticated principal is present on the request. */\nexport class UnauthenticatedError extends IdentityError {\n  constructor(message = \"Authentication is required.\") {\n    super(\"identity/unauthenticated\", message, 401);\n  }\n}\n\n/** The authenticated principal is not permitted to perform the action. */\nexport class ForbiddenError extends IdentityError {\n  constructor(message = \"You do not have permission to perform this action.\") {\n    super(\"identity/forbidden\", message, 403);\n  }\n}\n\n/** The user account is disabled or locked. */\nexport class AccountUnavailableError extends IdentityError {\n  constructor(message = \"This account is not available.\") {\n    super(\"identity/account-unavailable\", message, 403);\n  }\n}\n"],"mappings":";;;;;;;;AAQA,IAAa,gBAAb,cAAmC,MAAM;;CAEvC;;CAEA;CAEA,YAAY,MAAc,SAAiB,YAAoB;EAC7D,MAAM,OAAO;EACb,KAAK,OAAO,IAAI,OAAO;EACvB,KAAK,OAAO;EACZ,KAAK,aAAa;CACpB;AACF;;AAGA,IAAa,sBAAb,cAAyC,cAAc;CACrD,YAAY,SAAiB;EAC3B,MAAM,2BAA2B,SAAS,GAAG;CAC/C;AACF;;AAGA,IAAa,0BAAb,cAA6C,cAAc;CACzD,cAAc;EACZ,MAAM,gCAAgC,8BAA8B,GAAG;CACzE;AACF;;AAGA,IAAa,8BAAb,cAAiD,cAAc;CAC7D,cAAc;EACZ,MACE,qCACA,8CACA,GACF;CACF;AACF;;AAGA,IAAa,oBAAb,cAAuC,cAAc;CACnD,YAAY,UAAU,+CAA+C;EACnE,MAAM,0BAA0B,SAAS,GAAG;CAC9C;AACF;;AAGA,IAAa,uBAAb,cAA0C,cAAc;CACtD,YAAY,UAAU,+BAA+B;EACnD,MAAM,4BAA4B,SAAS,GAAG;CAChD;AACF;;AAGA,IAAa,iBAAb,cAAoC,cAAc;CAChD,YAAY,UAAU,sDAAsD;EAC1E,MAAM,sBAAsB,SAAS,GAAG;CAC1C;AACF;;AAGA,IAAa,0BAAb,cAA6C,cAAc;CACzD,YAAY,UAAU,kCAAkC;EACtD,MAAM,gCAAgC,SAAS,GAAG;CACpD;AACF"}