@better-forge/auth 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BetterStatusPage contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,5 @@
-# Temporary Holding Version
+# @better-forge/auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Users, sessions, 2FA, SSO/OIDC, roles, API tokens and sign-in routes.
+
+Status: skeleton. Depends on: `@better-forge/db`, `@better-forge/audit`.

package/dist/apiTokenRoutes.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyInstance } from 'fastify';
+import type { AuthOptions } from './context.js';
+import type { ApiTokens } from './apiTokens.js';
+import type { IdentityConfirmation } from './identityConfirmation.js';
+export declare function createApiTokenRoutes(ctx: AuthOptions, tokens: ApiTokens, identityConfirmation: IdentityConfirmation): {
+    apiTokenRoutes: (app: FastifyInstance) => Promise<void>;
+};
+//# sourceMappingURL=apiTokenRoutes.d.ts.map

package/dist/apiTokenRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiTokenRoutes.d.ts","sourceRoot":"","sources":["../src/apiTokenRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAI9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAWrE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,oBAAoB;0BAM/E,eAAe;EA0DnD"}

package/dist/apiTokenRoutes.js

@@ -0,0 +1,67 @@
+import { eq } from 'drizzle-orm';
+import { apiTokens } from './tables.js';
+import { requestIdentity } from './middleware.js';
+const MAX_NAME_LENGTH = 80;
+const MAX_EXPIRY_DAYS = 3650;
+/** A token that nobody asked to live forever should not. */
+const DEFAULT_EXPIRY_DAYS = 90;
+const DAY_MS = 24 * 60 * 60 * 1000;
+export function createApiTokenRoutes(ctx, tokens, identityConfirmation) {
+    const { db, audit } = ctx;
+    const hooks = ctx.hooks ?? {};
+    const { generateApiToken, parseScopes } = tokens;
+    const { confirmIdentity } = identityConfirmation;
+    async function apiTokenRoutes(app) {
+        function publicToken(row) {
+            const { tokenHash: _tokenHash, scopes, ...rest } = row;
+            return { ...rest, scopes: parseScopes(scopes) };
+        }
+        app.get('/', async () => (await db.select().from(apiTokens)).map(publicToken));
+        // `expiresInDays` left out means the default; `null` is the explicit "never".
+        app.post('/', {
+            config: { rateLimit: ctx.rateLimits.sensitiveAction },
+        }, async (req, reply) => {
+            const { name, scopes: requested, expiresInDays } = req.body ?? {};
+            if (typeof name !== 'string' || !name.trim() || name.trim().length > MAX_NAME_LENGTH) {
+                return reply.code(400).send({ error: `Name is required (up to ${MAX_NAME_LENGTH} characters)` });
+            }
+            const scopes = ctx.tokens.normalize(requested);
+            if (!scopes)
+                return reply.code(400).send({ error: 'scopes must be a list with at least one known permission' });
+            if (expiresInDays !== undefined && expiresInDays !== null
+                && (!Number.isInteger(expiresInDays) || expiresInDays < 1 || expiresInDays > MAX_EXPIRY_DAYS)) {
+                return reply.code(400).send({ error: `expiresInDays must be a whole number from 1 to ${MAX_EXPIRY_DAYS}, or null for no expiry` });
+            }
+            const identity = requestIdentity(req);
+            if (!await confirmIdentity(identity, req.body?.currentPassword, reply))
+                return reply;
+            const now = Date.now();
+            const generated = generateApiToken();
+            const days = expiresInDays === undefined ? DEFAULT_EXPIRY_DAYS : expiresInDays;
+            const row = (await db.insert(apiTokens).values({
+                name: name.trim(),
+                tokenHash: generated.hash,
+                prefix: generated.prefix,
+                scopes: JSON.stringify(scopes),
+                createdAt: now,
+                expiresAt: typeof days === 'number' ? now + days * DAY_MS : null,
+            }).returning())[0];
+            await audit.write(audit.actor(identity), 'create', 'api_token', row.id, row.name, audit.snapshot({ name: row.name, permissions: scopes.join(', '), prefix: row.prefix, expiresAt: row.expiresAt }));
+            // The only time the plaintext token leaves the server.
+            return { ...publicToken(row), token: generated.token };
+        });
+        app.delete('/:id', async (req, reply) => {
+            const id = Number(req.params.id);
+            const existing = Number.isSafeInteger(id) ? (await db.select().from(apiTokens).where(eq(apiTokens.id, id)))[0] : undefined;
+            if (!existing)
+                return reply.code(404).send({ error: 'Not found' });
+            await db.delete(apiTokens).where(eq(apiTokens.id, id));
+            // A live event stream opened with the token must not outlast it.
+            hooks.onSessionsRevoked?.({ sessionId: `api-token:${id}` });
+            await audit.write(audit.actor(requestIdentity(req)), 'delete', 'api_token', id, existing.name, audit.snapshot({ name: existing.name, permissions: parseScopes(existing.scopes).join(', '), prefix: existing.prefix }));
+            return reply.code(204).send();
+        });
+    }
+    return { apiTokenRoutes };
+}
+//# sourceMappingURL=apiTokenRoutes.js.map

package/dist/apiTokenRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiTokenRoutes.js","sourceRoot":"","sources":["../src/apiTokenRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAKjD,MAAM,eAAe,GAAG,EAAE,CAAA;AAE1B,MAAM,eAAe,GAAG,IAAI,CAAA;AAE5B,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAElC,MAAM,UAAU,oBAAoB,CAAC,GAAgB,EAAE,MAAiB,EAAE,oBAA0C;IAClH,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,GAAG,CAAA;IACzB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAA;IAC7B,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,CAAA;IAChD,MAAM,EAAE,eAAe,EAAE,GAAG,oBAAoB,CAAA;IAEhD,KAAK,UAAU,cAAc,CAAC,GAAoB;QAGhD,SAAS,WAAW,CAAC,GAAa;YAChC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAA;YACtD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAA;QACjD,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;QAE9E,8EAA8E;QAC9E,GAAG,CAAC,IAAI,CAAqG,GAAG,EAAE;YAChH,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,eAAe,EAAE;SACtD,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;YACjE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;gBACrF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,eAAe,cAAc,EAAE,CAAC,CAAA;YAClG,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC9C,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC,CAAA;YAC/G,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI;mBACpD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAK,aAAwB,GAAG,CAAC,IAAK,aAAwB,GAAG,eAAe,CAAC,EAAE,CAAC;gBACxH,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kDAAkD,eAAe,yBAAyB,EAAE,CAAC,CAAA;YACpI,CAAC;YAED,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YACpF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACtB,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAA;YACpC,MAAM,IAAI,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAA;YAC9E,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;gBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;gBACjB,SAAS,EAAE,SAAS,CAAC,IAAI;gBACzB,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAC9B,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI;aACjE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;YACnB,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAC9E,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;YACnH,uDAAuD;YACvD,OAAO,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAA;QACxD,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,MAAM,CAA6B,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAClE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC1H,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;YAClE,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;YACtD,iEAAiE;YACjE,KAAK,CAAC,iBAAiB,EAAE,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,EAC3F,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACzH,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QAC/B,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,CAAA;AAC3B,CAAC"}

package/dist/apiTokens.d.ts

@@ -0,0 +1,25 @@
+import type { AuthOptions } from './context.js';
+export declare function createApiTokens(ctx: AuthOptions): {
+    parseScopes: (stored: string) => string[];
+    isApiToken: (value: string) => boolean;
+    hashApiToken: (token: string) => string;
+    generateApiToken: () => {
+        token: string;
+        hash: string;
+        prefix: string;
+    };
+    findUsableApiToken: (token: string) => Promise<{
+        id: number;
+        name: string;
+        tokenHash: string;
+        prefix: string;
+        createdAt: number;
+        expiresAt: number | null;
+        lastUsedAt: number | null;
+        scopes: string;
+    } | null>;
+    consumeApiTokenBudget: (tokenId: number, now?: number) => boolean;
+    resetApiTokenBudgets: () => void;
+};
+export type ApiTokens = ReturnType<typeof createApiTokens>;
+//# sourceMappingURL=apiTokens.d.ts.map

package/dist/apiTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiTokens.d.ts","sourceRoot":"","sources":["../src/apiTokens.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,wBAAgB,eAAe,CAAC,GAAG,EAAE,WAAW;;wBAUnB,MAAM,KAAG,OAAO;0BAId,MAAM,KAAG,MAAM;4BAKf;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;gCAMnC,MAAM;;;;;;;;;;qCAcP,MAAM,mBAAqB,OAAO;gCAUzC,IAAI;EAKtC;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAA"}

package/dist/apiTokens.js

@@ -0,0 +1,50 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { apiTokens } from './tables.js';
+export function createApiTokens(ctx) {
+    const { db, apiTokenPrefix: API_TOKEN_PREFIX } = ctx;
+    const parseScopes = ctx.tokens.parse;
+    const LAST_USED_RESOLUTION_MS = 60_000;
+    const RATE_LIMIT_PER_MINUTE = 300;
+    const RATE_WINDOW_MS = 60_000;
+    function isApiToken(value) {
+        return value.startsWith(API_TOKEN_PREFIX);
+    }
+    function hashApiToken(token) {
+        return createHash('sha256').update(token).digest('hex');
+    }
+    /** 256 random bits, so a plain SHA-256 is enough to store them. The plaintext is shown once and never kept. */
+    function generateApiToken() {
+        const token = `${API_TOKEN_PREFIX}${randomBytes(32).toString('base64url')}`;
+        return { token, hash: hashApiToken(token), prefix: token.slice(0, API_TOKEN_PREFIX.length + 6) };
+    }
+    /** The token row when the token may be used right now: it exists and has not expired. */
+    async function findUsableApiToken(token) {
+        const row = (await db.select().from(apiTokens).where(eq(apiTokens.tokenHash, hashApiToken(token))))[0];
+        if (!row)
+            return null;
+        const now = Date.now();
+        if (row.expiresAt !== null && row.expiresAt <= now)
+            return null;
+        if (row.lastUsedAt === null || now - row.lastUsedAt >= LAST_USED_RESOLUTION_MS) {
+            await db.update(apiTokens).set({ lastUsedAt: now }).where(eq(apiTokens.id, row.id));
+        }
+        return row;
+    }
+    const windows = new Map();
+    /** Fixed-window limit per token, so one runaway script cannot starve the API. Returns false once the budget is spent. */
+    function consumeApiTokenBudget(tokenId, now = Date.now()) {
+        const current = windows.get(tokenId);
+        if (!current || now - current.startedAt >= RATE_WINDOW_MS) {
+            windows.set(tokenId, { startedAt: now, count: 1 });
+            return true;
+        }
+        current.count += 1;
+        return current.count <= RATE_LIMIT_PER_MINUTE;
+    }
+    function resetApiTokenBudgets() {
+        windows.clear();
+    }
+    return { parseScopes, isApiToken, hashApiToken, generateApiToken, findUsableApiToken, consumeApiTokenBudget, resetApiTokenBudgets };
+}
+//# sourceMappingURL=apiTokens.js.map

package/dist/apiTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiTokens.js","sourceRoot":"","sources":["../src/apiTokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAGvC,MAAM,UAAU,eAAe,CAAC,GAAgB;IAC9C,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,GAAG,CAAA;IACpD,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAA;IAEpC,MAAM,uBAAuB,GAAG,MAAM,CAAA;IAEtC,MAAM,qBAAqB,GAAG,GAAG,CAAA;IAEjC,MAAM,cAAc,GAAG,MAAM,CAAA;IAE7B,SAAS,UAAU,CAAC,KAAa;QAC/B,OAAO,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;IAC3C,CAAC;IAED,SAAS,YAAY,CAAC,KAAa;QACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACzD,CAAC;IAED,+GAA+G;IAC/G,SAAS,gBAAgB;QACvB,MAAM,KAAK,GAAG,GAAG,gBAAgB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;QAC3E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;IAClG,CAAC;IAED,yFAAyF;IACzF,KAAK,UAAU,kBAAkB,CAAC,KAAa;QAC7C,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACtG,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,IAAI,CAAA;QAC/D,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,UAAU,IAAI,uBAAuB,EAAE,CAAC;YAC/E,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACrF,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgD,CAAA;IAEvE,yHAAyH;IACzH,SAAS,qBAAqB,CAAC,OAAe,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpC,IAAI,CAAC,OAAO,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC;YAC1D,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,CAAC,KAAK,IAAI,CAAC,CAAA;QAClB,OAAO,OAAO,CAAC,KAAK,IAAI,qBAAqB,CAAA;IAC/C,CAAC;IAED,SAAS,oBAAoB;QAC3B,OAAO,CAAC,KAAK,EAAE,CAAA;IACjB,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAA;AACrI,CAAC"}

package/dist/authRoutes.d.ts

@@ -0,0 +1,37 @@
+import type { FastifyInstance, FastifyReply } from 'fastify';
+import { type OidcConfig } from './oidcConfig.js';
+import type { AuthOptions } from './context.js';
+import type { Sessions } from './sessions.js';
+import type { Middleware } from './middleware.js';
+import type { TwoFactor } from './twoFactor.js';
+import type { IdentityConfirmation } from './identityConfirmation.js';
+import type { SignInAudit } from './signInAudit.js';
+import type { OidcSettings } from './oidcSettings.js';
+import { type Oidc, type OidcFlowState } from './oidc.js';
+interface OidcFlowClaims extends OidcFlowState {
+    /**
+     * 'oidc-flow' signs a user in; 'oidc-test' only reports the outcome to the administrator who started it;
+     * 'oidc-confirm' re-authenticates the user of an existing SSO session before a sensitive action.
+     */
+    purpose?: 'oidc-flow' | 'oidc-test' | 'oidc-confirm';
+    adminUserId?: number;
+    /** 'oidc-confirm': the session to mark as confirmed and its user. The callback has no session cookie (SameSite=Strict). */
+    sessionId?: string;
+    userId?: number;
+    /** 'oidc-flow' started from a screen that named a `returnTo` target: the application's `signInRedirect` hook decides where it ends. */
+    returnTo?: string | undefined;
+}
+export declare function createSignInRoutes(ctx: AuthOptions, parts: {
+    sessions: Sessions;
+    middleware: Middleware;
+    twoFactor: TwoFactor;
+    identityConfirmation: IdentityConfirmation;
+    signInAudit: SignInAudit;
+    oidcSettings: OidcSettings;
+    oidc: Oidc;
+}): {
+    startOidcFlow: (app: FastifyInstance, reply: FastifyReply, cfg: OidcConfig, extra: Pick<OidcFlowClaims, "purpose" | "adminUserId" | "sessionId" | "userId" | "returnTo">) => Promise<never>;
+    authRoutes: (app: FastifyInstance) => Promise<void>;
+};
+export {};
+//# sourceMappingURL=authRoutes.d.ts.map

package/dist/authRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authRoutes.d.ts","sourceRoot":"","sources":["../src/authRoutes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAO5D,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,WAAW,EAAiB,MAAM,cAAc,CAAA;AAC9D,OAAO,KAAK,EAA4B,QAAQ,EAAE,MAAM,eAAe,CAAA;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAwB,WAAW,EAAgB,MAAM,kBAAkB,CAAA;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAqC,KAAK,IAAI,EAA0C,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAEpI,UAAU,cAAe,SAAQ,aAAa;IAC5C;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,cAAc,CAAA;IACpD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2HAA2H;IAC3H,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uIAAuI;IACvI,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC9B;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE;IAC1D,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,SAAS,CAAA;IACpB,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,IAAI,CAAA;CACX;yBA6BQ,eAAe,SAAS,YAAY,OAAO,UAAU,SACnD,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;sBAoE/D,eAAe;EAmT/C"}