@baseplate-dev/plugin-auth 0.6.17 → 0.6.19

package/dist/local-auth/core/generators/auth-email-password/generated/typed-templates.js

@@ -1,8 +1,17 @@
 import { createTsTemplateFile } from '@baseplate-dev/core-generators';
-import { configServiceImportsProvider, errorHandlerServiceImportsProvider, passwordHasherServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { appUrlsImportsProvider, configServiceImportsProvider, errorHandlerServiceImportsProvider, passwordHasherServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
 import { rateLimitImportsProvider } from '@baseplate-dev/plugin-rate-limit';
 import path from 'node:path';
 import { authModuleImportsProvider } from '#src/local-auth/core/generators/auth-module/generated/ts-import-providers.js';
+const constantsOtp = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {},
+    name: 'constants-otp',
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/constants/otp.constants.ts'),
+    },
+    variables: {},
+});
 const constantsPassword = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     group: 'module',
@@ -41,14 +50,18 @@ const schemaUserPasswordMutations = createTsTemplateFile({
     source: {
         path: path.join(import.meta.dirname, '../templates/module/schema/user-password.mutations.ts'),
     },
-    variables: { TPL_ADMIN_ROLES: {}, TPL_USER_OBJECT_TYPE: {} },
+    variables: {
+        TPL_ADMIN_ROLES: {},
+        TPL_REGISTER_MUTATION: {},
+        TPL_USER_OBJECT_TYPE: {},
+    },
 });
 const servicesPasswordReset = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     group: 'module',
     importMapProviders: {
+        appUrlsImports: appUrlsImportsProvider,
         authModuleImports: authModuleImportsProvider,
-        configServiceImports: configServiceImportsProvider,
         errorHandlerServiceImports: errorHandlerServiceImportsProvider,
         passwordHasherServiceImports: passwordHasherServiceImportsProvider,
         prismaImports: prismaImportsProvider,
@@ -57,7 +70,6 @@ const servicesPasswordReset = createTsTemplateFile({
     },
     name: 'services-password-reset',
     projectExports: {
-        cleanupExpiredPasswordResetTokens: { isTypeOnly: false },
         completePasswordReset: { isTypeOnly: false },
         requestPasswordReset: { isTypeOnly: false },
         validatePasswordResetToken: { isTypeOnly: false },
@@ -69,7 +81,11 @@ const servicesPasswordReset = createTsTemplateFile({
     source: {
         path: path.join(import.meta.dirname, '../templates/module/services/password-reset.service.ts'),
     },
-    variables: { TPL_PASSWORD_CHANGED_EMAIL: {}, TPL_PASSWORD_RESET_EMAIL: {} },
+    variables: {
+        TPL_AUTH_WEB_APP: {},
+        TPL_PASSWORD_CHANGED_EMAIL: {},
+        TPL_PASSWORD_RESET_EMAIL: {},
+    },
 });
 const servicesUserPassword = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
@@ -105,6 +121,19 @@ export const moduleGroup = {
     servicesPasswordReset,
     servicesUserPassword,
 };
+const schemaEmailOtpMutations = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {
+        authModuleImports: authModuleImportsProvider,
+        pothosImports: pothosImportsProvider,
+    },
+    name: 'schema-email-otp-mutations',
+    referencedGeneratorTemplates: { servicesEmailOtp: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/schema/email-otp.mutations.ts'),
+    },
+    variables: {},
+});
 const schemaEmailVerificationMutations = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     importMapProviders: { pothosImports: pothosImportsProvider },
@@ -115,7 +144,20 @@ const schemaEmailVerificationMutations = createTsTemplateFile({
     },
     variables: {},
 });
-const servicesEmailVerification = createTsTemplateFile({
+const schemaInviteMutations = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {
+        authModuleImports: authModuleImportsProvider,
+        pothosImports: pothosImportsProvider,
+    },
+    name: 'schema-invite-mutations',
+    referencedGeneratorTemplates: { servicesInvite: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/schema/invite.mutations.ts'),
+    },
+    variables: { TPL_ADMIN_ROLES: {}, TPL_USER_OBJECT_TYPE: {} },
+});
+const servicesEmailOtp = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     importMapProviders: {
         authModuleImports: authModuleImportsProvider,
@@ -124,17 +166,59 @@ const servicesEmailVerification = createTsTemplateFile({
         prismaImports: prismaImportsProvider,
         rateLimitImports: rateLimitImportsProvider,
         requestServiceContextImports: requestServiceContextImportsProvider,
+        userSessionTypesImports: userSessionTypesImportsProvider,
+    },
+    name: 'services-email-otp',
+    referencedGeneratorTemplates: { constantsOtp: {}, constantsPassword: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/services/email-otp.service.ts'),
+    },
+    variables: { TPL_EMAIL_OTP_EMAIL: {}, TPL_NAME_REQUIRED_CHECK: {} },
+});
+const servicesEmailVerification = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {
+        appUrlsImports: appUrlsImportsProvider,
+        authModuleImports: authModuleImportsProvider,
+        errorHandlerServiceImports: errorHandlerServiceImportsProvider,
+        prismaImports: prismaImportsProvider,
+        rateLimitImports: rateLimitImportsProvider,
+        requestServiceContextImports: requestServiceContextImportsProvider,
     },
     name: 'services-email-verification',
     referencedGeneratorTemplates: { constantsPassword: {} },
     source: {
         path: path.join(import.meta.dirname, '../templates/module/services/email-verification.service.ts'),
     },
-    variables: { TPL_ACCOUNT_VERIFICATION_EMAIL: {} },
+    variables: { TPL_ACCOUNT_VERIFICATION_EMAIL: {}, TPL_AUTH_WEB_APP: {} },
+});
+const servicesInvite = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {
+        appUrlsImports: appUrlsImportsProvider,
+        authModuleImports: authModuleImportsProvider,
+        errorHandlerServiceImports: errorHandlerServiceImportsProvider,
+        passwordHasherServiceImports: passwordHasherServiceImportsProvider,
+        prismaGeneratedImports: prismaGeneratedImportsProvider,
+        prismaImports: prismaImportsProvider,
+        requestServiceContextImports: requestServiceContextImportsProvider,
+        userSessionTypesImports: userSessionTypesImportsProvider,
+    },
+    name: 'services-invite',
+    referencedGeneratorTemplates: { constantsPassword: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/services/invite.service.ts'),
+    },
+    variables: { TPL_AUTH_WEB_APP: {}, TPL_INVITE_EMAIL: {} },
 });
 export const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES = {
+    constantsOtp,
     moduleGroup,
+    schemaEmailOtpMutations,
     schemaEmailVerificationMutations,
+    schemaInviteMutations,
+    servicesEmailOtp,
     servicesEmailVerification,
+    servicesInvite,
 };
 //# sourceMappingURL=typed-templates.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/otp.constants.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Number of digits in an emailed sign-in code.
+ *
+ * Six is the length users expect from a one-time code. At this length the
+ * keyspace alone is not much of a barrier, so what keeps guessing impractical
+ * is the attempt budget below, the endpoint rate limits, and the short expiry.
+ */
+export declare const EMAIL_OTP_LENGTH = 6;
+/**
+ * Emailed sign-in code expiration time in seconds (10 minutes)
+ */
+export declare const EMAIL_OTP_EXPIRY_SEC: number;
+/**
+ * Maximum number of guesses allowed per emailed sign-in code before it is
+ * discarded. A short numeric code needs its own attempt budget on top of the
+ * endpoint rate limits.
+ */
+export declare const EMAIL_OTP_MAX_ATTEMPTS = 5;
+//# sourceMappingURL=otp.constants.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/otp.constants.js

@@ -0,0 +1,20 @@
+// @ts-nocheck
+/**
+ * Number of digits in an emailed sign-in code.
+ *
+ * Six is the length users expect from a one-time code. At this length the
+ * keyspace alone is not much of a barrier, so what keeps guessing impractical
+ * is the attempt budget below, the endpoint rate limits, and the short expiry.
+ */
+export const EMAIL_OTP_LENGTH = 6;
+/**
+ * Emailed sign-in code expiration time in seconds (10 minutes)
+ */
+export const EMAIL_OTP_EXPIRY_SEC = 60 * 10;
+/**
+ * Maximum number of guesses allowed per emailed sign-in code before it is
+ * discarded. A short numeric code needs its own attempt budget on top of the
+ * endpoint rate limits.
+ */
+export const EMAIL_OTP_MAX_ATTEMPTS = 5;
+//# sourceMappingURL=otp.constants.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/otp.constants.ts

@@ -0,0 +1,22 @@
+// @ts-nocheck
+
+/**
+ * Number of digits in an emailed sign-in code.
+ *
+ * Six is the length users expect from a one-time code. At this length the
+ * keyspace alone is not much of a barrier, so what keeps guessing impractical
+ * is the attempt budget below, the endpoint rate limits, and the short expiry.
+ */
+export const EMAIL_OTP_LENGTH = 6;
+
+/**
+ * Emailed sign-in code expiration time in seconds (10 minutes)
+ */
+export const EMAIL_OTP_EXPIRY_SEC = 60 * 10;
+
+/**
+ * Maximum number of guesses allowed per emailed sign-in code before it is
+ * discarded. A short numeric code needs its own attempt budget on top of the
+ * endpoint rate limits.
+ */
+export const EMAIL_OTP_MAX_ATTEMPTS = 5;

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.d.ts

@@ -14,4 +14,16 @@ export declare const PASSWORD_RESET_TOKEN_EXPIRY_SEC: number;
  * Email verification token expiration time in seconds (24 hours)
  */
 export declare const EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC: number;
+/**
+ * Invite token expiration time in seconds (7 days, since invites are
+ * admin-initiated and not tied to a login attempt in progress)
+ */
+export declare const INVITE_TOKEN_EXPIRY_SEC: number;
+/**
+ * Safety upper bound on auth verification token length (password reset,
+ * invite, etc.), generous relative to the actual token format produced by
+ * `generateSplitToken` in `auth-verification.service.ts` so validation
+ * doesn't need to track that format exactly.
+ */
+export declare const AUTH_TOKEN_MAX_LENGTH = 100;
 //# sourceMappingURL=password.constants.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.js

@@ -15,4 +15,16 @@ export const PASSWORD_RESET_TOKEN_EXPIRY_SEC = 60 * 60;
  * Email verification token expiration time in seconds (24 hours)
  */
 export const EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC = 60 * 60 * 24;
+/**
+ * Invite token expiration time in seconds (7 days, since invites are
+ * admin-initiated and not tied to a login attempt in progress)
+ */
+export const INVITE_TOKEN_EXPIRY_SEC = 60 * 60 * 24 * 7;
+/**
+ * Safety upper bound on auth verification token length (password reset,
+ * invite, etc.), generous relative to the actual token format produced by
+ * `generateSplitToken` in `auth-verification.service.ts` so validation
+ * doesn't need to track that format exactly.
+ */
+export const AUTH_TOKEN_MAX_LENGTH = 100;
 //# sourceMappingURL=password.constants.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.ts

@@ -19,3 +19,17 @@ export const PASSWORD_RESET_TOKEN_EXPIRY_SEC = 60 * 60;
  * Email verification token expiration time in seconds (24 hours)
  */
 export const EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC = 60 * 60 * 24;
+
+/**
+ * Invite token expiration time in seconds (7 days, since invites are
+ * admin-initiated and not tied to a login attempt in progress)
+ */
+export const INVITE_TOKEN_EXPIRY_SEC = 60 * 60 * 24 * 7;
+
+/**
+ * Safety upper bound on auth verification token length (password reset,
+ * invite, etc.), generous relative to the actual token format produced by
+ * `generateSplitToken` in `auth-verification.service.ts` so validation
+ * doesn't need to track that format exactly.
+ */
+export const AUTH_TOKEN_MAX_LENGTH = 100;

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-otp.mutations.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=email-otp.mutations.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-otp.mutations.js

@@ -0,0 +1,30 @@
+// @ts-nocheck
+import { requestEmailOtp, signInWithEmailOtp } from '$servicesEmailOtp';
+import { userSessionPayload } from '%authModuleImports';
+import { builder } from '%pothosImports';
+builder.mutationField('requestEmailOtp', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+        email: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (root, { input }, context) => requestEmailOtp({ email: input.email, context }),
+}));
+builder.mutationField('signInWithEmailOtp', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        session: t.payload.field({ type: userSessionPayload }),
+    },
+    input: {
+        email: t.input.field({ required: true, type: 'String' }),
+        code: t.input.field({ required: true, type: 'String' }),
+        name: t.input.field({ required: false, type: 'String' }),
+    },
+    resolve: async (root, { input }, context) => signInWithEmailOtp({
+        input: { ...input, name: input.name ?? undefined },
+        context,
+    }),
+}));
+//# sourceMappingURL=email-otp.mutations.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-otp.mutations.ts

@@ -0,0 +1,38 @@
+// @ts-nocheck
+
+import { requestEmailOtp, signInWithEmailOtp } from '$servicesEmailOtp';
+import { userSessionPayload } from '%authModuleImports';
+import { builder } from '%pothosImports';
+
+builder.mutationField('requestEmailOtp', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+      email: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (root, { input }, context) =>
+      requestEmailOtp({ email: input.email, context }),
+  }),
+);
+
+builder.mutationField('signInWithEmailOtp', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      session: t.payload.field({ type: userSessionPayload }),
+    },
+    input: {
+      email: t.input.field({ required: true, type: 'String' }),
+      code: t.input.field({ required: true, type: 'String' }),
+      name: t.input.field({ required: false, type: 'String' }),
+    },
+    resolve: async (root, { input }, context) =>
+      signInWithEmailOtp({
+        input: { ...input, name: input.name ?? undefined },
+        context,
+      }),
+  }),
+);

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/invite.mutations.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=invite.mutations.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/invite.mutations.js

@@ -0,0 +1,42 @@
+// @ts-nocheck
+import { acceptInvite, inviteUser, validateInviteToken } from '$servicesInvite';
+import { userSessionPayload } from '%authModuleImports';
+import { builder } from '%pothosImports';
+builder.mutationField('inviteUser', (t) => t.fieldWithInputPayload({
+    authorize: TPL_ADMIN_ROLES,
+    payload: {
+        user: t.payload.field({
+            type: TPL_USER_OBJECT_TYPE,
+        }),
+    },
+    input: {
+        userId: t.input.field({ required: true, type: 'Uuid' }),
+    },
+    resolve: async (_root, { input }, context) => inviteUser({ userId: input.userId, context }),
+}));
+builder.mutationField('validateInviteToken', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        email: t.payload.field({ type: 'String' }),
+    },
+    input: {
+        token: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }) => validateInviteToken({ token: input.token }),
+}));
+builder.mutationField('acceptInvite', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        session: t.payload.field({ type: userSessionPayload }),
+    },
+    input: {
+        token: t.input.field({ required: true, type: 'String' }),
+        newPassword: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }, context) => acceptInvite({
+        token: input.token,
+        newPassword: input.newPassword,
+        context,
+    }),
+}));
+//# sourceMappingURL=invite.mutations.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/invite.mutations.ts

@@ -0,0 +1,54 @@
+// @ts-nocheck
+
+import { acceptInvite, inviteUser, validateInviteToken } from '$servicesInvite';
+import { userSessionPayload } from '%authModuleImports';
+import { builder } from '%pothosImports';
+
+builder.mutationField('inviteUser', (t) =>
+  t.fieldWithInputPayload({
+    authorize: TPL_ADMIN_ROLES,
+    payload: {
+      user: t.payload.field({
+        type: TPL_USER_OBJECT_TYPE,
+      }),
+    },
+    input: {
+      userId: t.input.field({ required: true, type: 'Uuid' }),
+    },
+    resolve: async (_root, { input }, context) =>
+      inviteUser({ userId: input.userId, context }),
+  }),
+);
+
+builder.mutationField('validateInviteToken', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      email: t.payload.field({ type: 'String' }),
+    },
+    input: {
+      token: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }) =>
+      validateInviteToken({ token: input.token }),
+  }),
+);
+
+builder.mutationField('acceptInvite', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      session: t.payload.field({ type: userSessionPayload }),
+    },
+    input: {
+      token: t.input.field({ required: true, type: 'String' }),
+      newPassword: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }, context) =>
+      acceptInvite({
+        token: input.token,
+        newPassword: input.newPassword,
+        context,
+      }),
+  }),
+);

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/user-password.mutations.js

@@ -1,25 +1,8 @@
 // @ts-nocheck
-import { authenticateUserWithEmailAndPassword, changeUserPassword, registerUserWithEmailAndPassword, resetUserPassword, } from '$servicesUserPassword';
+import { authenticateUserWithEmailAndPassword, changeUserPassword, resetUserPassword, } from '$servicesUserPassword';
 import { userSessionPayload } from '%authModuleImports';
 import { builder } from '%pothosImports';
-builder.mutationField('registerWithEmailPassword', (t) => t.fieldWithInputPayload({
-    authorize: ['public'],
-    payload: {
-        session: t.payload.field({ type: userSessionPayload }),
-    },
-    input: {
-        email: t.input.field({ required: true, type: 'String' }),
-        name: t.input.field({ required: false, type: 'String' }),
-        password: t.input.field({ required: true, type: 'String' }),
-    },
-    resolve: async (root, { input }, context) => registerUserWithEmailAndPassword({
-        input: {
-            ...input,
-            name: input.name ?? undefined,
-        },
-        context,
-    }),
-}));
+TPL_REGISTER_MUTATION;
 builder.mutationField('loginWithEmailPassword', (t) => t.fieldWithInputPayload({
     authorize: ['public'],
     payload: {

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/user-password.mutations.ts

@@ -3,33 +3,12 @@
 import {
   authenticateUserWithEmailAndPassword,
   changeUserPassword,
-  registerUserWithEmailAndPassword,
   resetUserPassword,
 } from '$servicesUserPassword';
 import { userSessionPayload } from '%authModuleImports';
 import { builder } from '%pothosImports';
 
-builder.mutationField('registerWithEmailPassword', (t) =>
-  t.fieldWithInputPayload({
-    authorize: ['public'],
-    payload: {
-      session: t.payload.field({ type: userSessionPayload }),
-    },
-    input: {
-      email: t.input.field({ required: true, type: 'String' }),
-      name: t.input.field({ required: false, type: 'String' }),
-      password: t.input.field({ required: true, type: 'String' }),
-    },
-    resolve: async (root, { input }, context) =>
-      registerUserWithEmailAndPassword({
-        input: {
-          ...input,
-          name: input.name ?? undefined,
-        },
-        context,
-      }),
-  }),
-);
+TPL_REGISTER_MUTATION;
 
 builder.mutationField('loginWithEmailPassword', (t) =>
   t.fieldWithInputPayload({

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-otp.service.d.ts

@@ -0,0 +1,37 @@
+import type { RequestServiceContext, RequestServiceContextWith } from '%requestServiceContextImports';
+import type { UserSessionPayload } from '%userSessionTypesImports';
+/**
+ * Emails a single-use sign-in code to the given address.
+ *
+ * A code is sent whether or not an account exists — verifying one signs the
+ * user in, creating the account on first use — so this endpoint reveals
+ * nothing about which addresses are registered.
+ */
+export declare function requestEmailOtp({ email: rawEmail, context, }: {
+    email: string;
+    context: RequestServiceContextWith<'email'>;
+}): Promise<{
+    success: true;
+}>;
+/**
+ * Signs a user in with an emailed code, creating the account on first use.
+ *
+ * A verified code proves control of the inbox, so the account it creates (or
+ * signs in to) is marked as having a verified email. Accounts created this way
+ * have no password until the user goes through the password reset flow.
+ *
+ * @throws BadRequestError `name-required` when the code is valid but the
+ * address has no account yet and no name was supplied. The code is left intact
+ * so the client can collect a name and retry with it.
+ */
+export declare function signInWithEmailOtp({ input, context, }: {
+    input: {
+        email: string;
+        code: string;
+        name?: string;
+    };
+    context: RequestServiceContext;
+}): Promise<{
+    session: UserSessionPayload;
+}>;
+//# sourceMappingURL=email-otp.service.d.ts.map