@bajustone/fortress 1.0.0-rc.1

package/dist/plugins/email-verification.js

@@ -0,0 +1,246 @@
+// src/core/auth/refresh-token.ts
+async function generateRefreshToken() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  const raw = base64UrlEncode(bytes);
+  const hash = await hashToken(raw);
+  return { raw, hash };
+}
+async function hashToken(raw) {
+  const data = new TextEncoder().encode(raw);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return hexEncode(new Uint8Array(hashBuffer));
+}
+function base64UrlEncode(bytes) {
+  const binString = Array.from(bytes, (b) => String.fromCodePoint(b)).join("");
+  return btoa(binString).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function hexEncode(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/plugins/email-verification/index.ts
+function emailVerification(config = {}) {
+  const tokenExpirySeconds = config.tokenExpirySeconds ?? 86400;
+  const requireVerification = config.requireVerification ?? true;
+  async function consumeVerificationToken(db, rawToken, expectedUserId) {
+    const hash = await hashToken(rawToken);
+    const usedAt = /* @__PURE__ */ new Date();
+    const record = await db.update({
+      model: "email_verification_token",
+      where: [
+        { field: "token", operator: "=", value: hash },
+        { field: "usedAt", operator: "isNull", value: null },
+        { field: "expiresAt", operator: "gt", value: usedAt },
+        ...expectedUserId ? [{ field: "userId", operator: "=", value: expectedUserId }] : []
+      ],
+      data: { usedAt }
+    });
+    if (!record)
+      throw Errors.notFound("Invalid or expired verification token");
+    await db.update({
+      model: "user",
+      where: [{ field: "id", operator: "=", value: record.userId }],
+      data: { email: record.email, emailVerified: true }
+    });
+    return record;
+  }
+  return {
+    name: "email-verification",
+    models: [{
+      name: "email_verification_token",
+      fields: {
+        id: { type: "number", required: true },
+        userId: { type: "number", required: true, references: { model: "user", field: "id" } },
+        token: { type: "string", required: true },
+        email: { type: "string", required: true },
+        expiresAt: { type: "date", required: true },
+        usedAt: { type: "date" },
+        createdAt: { type: "date", required: true }
+      }
+    }],
+    hooks: {
+      postAuthGate: {
+        reason: "email-verification",
+        async evaluate(ctx) {
+          if (!requireVerification || ctx.user.emailVerified)
+            return;
+          const tokens = await ctx.db.findMany({
+            model: "email_verification_token",
+            where: [{ field: "userId", operator: "=", value: ctx.user.id }]
+          });
+          return tokens.some((token) => token.usedAt !== null) ? void 0 : { pluginData: { requiresEmailVerification: true } };
+        },
+        async verify(ctx, completion) {
+          if (typeof completion !== "string")
+            throw Errors.unauthorized("Invalid verification token");
+          await consumeVerificationToken(ctx.db, completion, ctx.user.id);
+        }
+      },
+      async afterRegister(ctx, user) {
+        const { raw, hash } = await generateRefreshToken();
+        const expiresAt = new Date(Date.now() + tokenExpirySeconds * 1e3);
+        await ctx.db.create({
+          model: "email_verification_token",
+          data: {
+            userId: user.id,
+            token: hash,
+            email: user.email,
+            expiresAt,
+            usedAt: null
+          }
+        });
+        if (config.onSendVerification) {
+          await config.onSendVerification(user.email, raw, user.id);
+        }
+      }
+    },
+    methods: (ctx) => ({
+      async sendVerification(userId, email) {
+        const user = await ctx.db.findOne({
+          model: "user",
+          where: [{ field: "id", operator: "=", value: userId }]
+        });
+        if (!user)
+          throw Errors.notFound("User not found");
+        const targetEmail = email ?? user.email;
+        const { raw, hash } = await generateRefreshToken();
+        const expiresAt = new Date(Date.now() + tokenExpirySeconds * 1e3);
+        await ctx.db.create({
+          model: "email_verification_token",
+          data: {
+            userId,
+            token: hash,
+            email: targetEmail,
+            expiresAt,
+            usedAt: null
+          }
+        });
+        if (config.onSendVerification) {
+          await config.onSendVerification(targetEmail, raw, userId);
+        }
+        return { sent: true };
+      },
+      async verify(rawToken) {
+        const record = await ctx.db.transaction((tx) => consumeVerificationToken(tx, rawToken));
+        return { userId: record.userId, email: record.email };
+      },
+      async completeVerification(continuationToken, verificationToken, meta) {
+        if (!ctx.auth)
+          throw Errors.badRequest("Auth service is unavailable");
+        return ctx.auth.completePendingAuth(continuationToken, verificationToken, meta);
+      }
+    })
+  };
+}
+export {
+  emailVerification
+};

package/dist/plugins/magic-link.cjs

@@ -0,0 +1,231 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/plugins/magic-link/index.ts
+var magic_link_exports = {};
+__export(magic_link_exports, {
+  magicLink: () => magicLink
+});
+module.exports = __toCommonJS(magic_link_exports);
+
+// src/core/auth/refresh-token.ts
+async function generateRefreshToken() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  const raw = base64UrlEncode(bytes);
+  const hash = await hashToken(raw);
+  return { raw, hash };
+}
+async function hashToken(raw) {
+  const data = new TextEncoder().encode(raw);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return hexEncode(new Uint8Array(hashBuffer));
+}
+function base64UrlEncode(bytes) {
+  const binString = Array.from(bytes, (b) => String.fromCodePoint(b)).join("");
+  return btoa(binString).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function hexEncode(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/plugins/magic-link/index.ts
+function magicLink(config = {}) {
+  const tokenExpirySeconds = config.tokenExpirySeconds ?? 600;
+  return {
+    name: "magic-link",
+    models: [{
+      name: "magic_link_token",
+      fields: {
+        id: { type: "number", required: true },
+        email: { type: "string", required: true },
+        token: { type: "string", required: true },
+        expiresAt: { type: "date", required: true },
+        usedAt: { type: "date" },
+        createdAt: { type: "date", required: true }
+      }
+    }],
+    methods: (ctx) => ({
+      async sendMagicLink(email) {
+        const { raw, hash } = await generateRefreshToken();
+        const expiresAt = new Date(Date.now() + tokenExpirySeconds * 1e3);
+        await ctx.db.create({
+          model: "magic_link_token",
+          data: {
+            email,
+            token: hash,
+            expiresAt,
+            usedAt: null
+          }
+        });
+        if (config.onSendMagicLink) {
+          await config.onSendMagicLink(email, raw);
+        }
+        return { sent: true };
+      },
+      async verify(rawToken, meta) {
+        const hash = await hashToken(rawToken);
+        const usedAt = /* @__PURE__ */ new Date();
+        const record = await ctx.db.transaction((tx) => tx.update({
+          model: "magic_link_token",
+          where: [
+            { field: "token", operator: "=", value: hash },
+            { field: "usedAt", operator: "isNull", value: null },
+            { field: "expiresAt", operator: "gt", value: usedAt }
+          ],
+          data: { usedAt }
+        }));
+        if (!record)
+          throw Errors.notFound("Invalid or expired magic link token");
+        let user = await ctx.db.findOne({
+          model: "user",
+          where: [{ field: "email", operator: "=", value: record.email }]
+        });
+        if (!user) {
+          user = await ctx.auth.createUser({
+            email: record.email,
+            name: record.email.split("@")[0]
+          });
+        }
+        if (!user.emailVerified) {
+          await ctx.db.update({
+            model: "user",
+            where: [{ field: "id", operator: "=", value: user.id }],
+            data: { emailVerified: true }
+          });
+        }
+        if (!ctx.auth)
+          throw Errors.badRequest("Auth service is unavailable");
+        return ctx.auth.completePluginAuth(user.id, "magic-link", meta);
+      }
+    })
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  magicLink
+});

package/dist/plugins/magic-link.d.cts

@@ -0,0 +1,39 @@
+import { F as FortressPlugin } from '../config-GtlVt6ZD.cjs';
+import { R as RequestMeta, A as AuthResult } from '../types-et0R8tsC.cjs';
+import '../index-CxEkfCA0.cjs';
+import '../jwt.cjs';
+import '../auth-service-BcyQ2PuZ.cjs';
+
+/**
+ * Passwordless magic-link plugin for fortress.
+ *
+ * Issues short-lived hashed tokens delivered out-of-band (typically by email)
+ * and exchanges a valid token for a fortress access/refresh token pair.
+ * Useful as a passwordless sign-in flow or as a recovery mechanism.
+ *
+ * @module
+ */
+
+interface MagicLinkConfig {
+    /** Token expiry in seconds. Default: 600 (10 minutes). */
+    tokenExpirySeconds?: number;
+    /** Called when a magic link token is created -- send the link to the user */
+    onSendMagicLink?: (email: string, token: string) => Promise<void>;
+}
+interface MagicLinkMethods {
+    sendMagicLink: (email: string) => Promise<{
+        sent: true;
+    }>;
+    verify: (rawToken: string, meta?: RequestMeta) => Promise<AuthResult>;
+}
+/**
+ * Magic link plugin factory. Returns a {@link FortressPlugin} that issues
+ * short-lived hashed tokens for passwordless sign-in. Tokens are typically
+ * delivered out-of-band (email) and exchanged for fortress access/refresh
+ * tokens via the verify endpoint.
+ */
+declare function magicLink(config?: MagicLinkConfig): FortressPlugin & {
+    readonly name: 'magic-link';
+};
+
+export { type MagicLinkConfig, type MagicLinkMethods, magicLink };

package/dist/plugins/magic-link.d.ts

@@ -0,0 +1,39 @@
+import { F as FortressPlugin } from '../config-B2366s_G.js';
+import { R as RequestMeta, A as AuthResult } from '../types-et0R8tsC.js';
+import '../index-CxEkfCA0.js';
+import '../jwt.js';
+import '../auth-service-BkzZkWfH.js';
+
+/**
+ * Passwordless magic-link plugin for fortress.
+ *
+ * Issues short-lived hashed tokens delivered out-of-band (typically by email)
+ * and exchanges a valid token for a fortress access/refresh token pair.
+ * Useful as a passwordless sign-in flow or as a recovery mechanism.
+ *
+ * @module
+ */
+
+interface MagicLinkConfig {
+    /** Token expiry in seconds. Default: 600 (10 minutes). */
+    tokenExpirySeconds?: number;
+    /** Called when a magic link token is created -- send the link to the user */
+    onSendMagicLink?: (email: string, token: string) => Promise<void>;
+}
+interface MagicLinkMethods {
+    sendMagicLink: (email: string) => Promise<{
+        sent: true;
+    }>;
+    verify: (rawToken: string, meta?: RequestMeta) => Promise<AuthResult>;
+}
+/**
+ * Magic link plugin factory. Returns a {@link FortressPlugin} that issues
+ * short-lived hashed tokens for passwordless sign-in. Tokens are typically
+ * delivered out-of-band (email) and exchanged for fortress access/refresh
+ * tokens via the verify endpoint.
+ */
+declare function magicLink(config?: MagicLinkConfig): FortressPlugin & {
+    readonly name: 'magic-link';
+};
+
+export { type MagicLinkConfig, type MagicLinkMethods, magicLink };