@better-forge/auth 0.0.0-stage → 0.1.1

package/dist/createAuth.d.ts

@@ -0,0 +1,146 @@
+import type { AuthOptions } from './context.js';
+/**
+ * Accounts, sessions, two-factor sign-in, single sign-on, API tokens and the routes that manage them. Everything is
+ * built from `options` and kept in the returned closures; nothing is shared between two calls.
+ */
+export declare function createAuth(options: AuthOptions): {
+    sessions: {
+        createAuthSession: (app: import("fastify").FastifyInstance, reply: import("fastify").FastifyReply, user: {
+            id: number;
+            email: string;
+            role: string;
+            mustChangePassword: number;
+            totpEnabled: number;
+        }, authMethod?: import("./sessions.js").AuthMethod) => Promise<import("./sessions.js").AuthIdentity>;
+        clearAuthCookies: (reply: import("fastify").FastifyReply) => void;
+        authenticateRequest: (req: import("fastify").FastifyRequest, options?: import("./sessions.js").AuthenticateOptions) => Promise<import("./sessions.js").AuthIdentity>;
+        verifyCsrf: (req: import("fastify").FastifyRequest, identity: import("./sessions.js").AuthIdentity) => Promise<void>;
+        revokeSession: (sessionId: string) => Promise<void>;
+        revokeUserSessions: (userId: number, exceptSessionId?: string) => Promise<void>;
+    };
+    middleware: {
+        authenticateOrReject: (req: import("fastify").FastifyRequest, reply: import("fastify").FastifyReply, unauthorized?: Record<string, string>) => Promise<import("./sessions.js").AuthIdentity | null>;
+        requireAuth: ((req: import("fastify").FastifyRequest, reply: import("fastify").FastifyReply) => Promise<undefined>) & {
+            requiresAuth: boolean;
+        };
+        requireRole: (...allowed: string[]) => ((req: import("fastify").FastifyRequest, reply: import("fastify").FastifyReply) => Promise<undefined>) & {
+            allowedRoles: string[];
+            requiresAuth: boolean;
+        };
+    };
+    identityConfirmation: {
+        confirmIdentity: (identity: import("./sessions.js").AuthIdentity, currentPassword: unknown, reply: import("fastify").FastifyReply) => Promise<boolean>;
+        markSessionVerified: (sessionId: string, userId: number) => Promise<boolean>;
+    };
+    twoFactor: {
+        verifySecondFactor: (user: {
+            id: number;
+            totpSecret: string | null;
+            totpEnabled: number;
+            totpRecoveryCodes: string | null;
+        }, code: string) => Promise<boolean>;
+        resetTwoFactor: (userId: number) => Promise<boolean>;
+    };
+    signInAudit: {
+        auditSignIn: (user: {
+            id: number;
+            email: string;
+        }, method: import("./signInAudit.js").SignInMethod, twoFactor: boolean) => Promise<void>;
+        auditSignInDenial: (method: import("./signInAudit.js").SignInMethod, denial: import("./signInAudit.js").SignInDenial, extra?: Record<string, unknown>) => Promise<void>;
+    };
+    oidcConfig: {
+        defaultOidcRedirectUri: (env?: NodeJS.ProcessEnv) => string;
+        buildOidcConfig: (input: import("./oidcConfig.js").OidcSettingsInput, env?: NodeJS.ProcessEnv) => import("./oidcConfig.js").OidcConfig | null;
+        resolveOidcConfigFromEnv: (env?: NodeJS.ProcessEnv) => import("./oidcConfig.js").OidcConfig | null;
+    };
+    oidcSettings: {
+        getOidcSettingsRow: () => Promise<import("./oidcSettings.js").OidcSettingsRow | null>;
+        oidcConfigFromRow: (row: import("./oidcSettings.js").OidcSettingsRow) => import("./oidcConfig.js").OidcConfig | null;
+        getOidcConfig: () => Promise<{
+            config: import("./oidcConfig.js").OidcConfig | null;
+            source: "env" | "database" | "none";
+        }>;
+        getOidcTestConfig: () => Promise<import("./oidcConfig.js").OidcConfig | null>;
+    };
+    oidc: {
+        beginOidcLogin: (cfg: import("./oidcConfig.js").OidcConfig, options?: {
+            confirm?: boolean;
+        }) => Promise<{
+            url: string;
+            flow: import("./oidc.js").OidcFlowState;
+        }>;
+        exchangeOidcCode: (cfg: import("./oidcConfig.js").OidcConfig, callbackUrl: URL, flow: import("./oidc.js").OidcFlowState, maxAge?: number) => Promise<{
+            claims: Record<string, unknown>;
+            denial?: undefined;
+        } | {
+            claims?: undefined;
+            denial: import("./oidc.js").OidcDenial;
+        }>;
+        evaluateOidcClaims: (cfg: import("./oidcConfig.js").OidcConfig, claims: Record<string, unknown>) => Promise<import("./oidc.js").OidcDecision>;
+        linkOidcIdentity: (cfg: import("./oidcConfig.js").OidcConfig, user: {
+            id: number;
+            email: string;
+            passwordHash: string;
+            role: string;
+            createdAt: number;
+            mustChangePassword: number;
+            totpSecret: string | null;
+            totpEnabled: number;
+            totpRecoveryCodes: string | null;
+            oidcIssuer: string | null;
+            oidcSubject: string | null;
+        }, subject: string) => Promise<void>;
+        provisionSsoUser: (cfg: import("./oidcConfig.js").OidcConfig, provision: import("./oidc.js").SsoProvisioning) => Promise<{
+            id: number;
+            email: string;
+            passwordHash: string;
+            role: string;
+            createdAt: number;
+            mustChangePassword: number;
+            totpSecret: string | null;
+            totpEnabled: number;
+            totpRecoveryCodes: string | null;
+            oidcIssuer: string | null;
+            oidcSubject: string | null;
+        }>;
+        auditOidcDenial: (cfg: import("./oidcConfig.js").OidcConfig, denial: import("./oidc.js").OidcDenial) => Promise<void>;
+        testOidcDiscovery: (cfg: import("./oidcConfig.js").OidcConfig) => Promise<{
+            issuer: string;
+            authorizationEndpoint: string | null;
+        }>;
+        storeOidcTestResult: (adminUserId: number, result: import("./oidc.js").OidcTestResult) => string;
+        readOidcTestResult: (id: string, adminUserId: number) => import("./oidc.js").OidcTestResult | null;
+        runOidcTest: (cfg: import("./oidcConfig.js").OidcConfig, callbackUrl: URL, flow: import("./oidc.js").OidcFlowState) => Promise<import("./oidc.js").OidcTestResult>;
+    };
+    apiTokens: {
+        parseScopes: (stored: string) => string[];
+        isApiToken: (value: string) => boolean;
+        hashApiToken: (token: string) => string;
+        generateApiToken: () => {
+            token: string;
+            hash: string;
+            prefix: string;
+        };
+        findUsableApiToken: (token: string) => Promise<{
+            id: number;
+            name: string;
+            tokenHash: string;
+            prefix: string;
+            createdAt: number;
+            expiresAt: number | null;
+            lastUsedAt: number | null;
+            scopes: string;
+        } | null>;
+        consumeApiTokenBudget: (tokenId: number, now?: number) => boolean;
+        resetApiTokenBudgets: () => void;
+    };
+    /** Plain plugins (not wrapped for encapsulation), so the hooks of the scope they are registered in apply to them. */
+    routes: {
+        signIn: (app: import("fastify").FastifyInstance) => Promise<void>;
+        users: (app: import("fastify").FastifyInstance) => Promise<void>;
+        oidcSettings: (app: import("fastify").FastifyInstance) => Promise<void>;
+        apiTokens: (app: import("fastify").FastifyInstance) => Promise<void>;
+    };
+};
+export type Auth = ReturnType<typeof createAuth>;
+//# sourceMappingURL=createAuth.d.ts.map

package/dist/createAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAuth.d.ts","sourceRoot":"","sources":["../src/createAuth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAe/C;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAuC03E,CAAC;;;;;;;kBAAkjC,CAAC;;kBAAwB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAXl/G,qHAAqH;;;;;;;EAQxH;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAA"}

package/dist/createAuth.js

@@ -0,0 +1,52 @@
+import { createApiTokenRoutes } from './apiTokenRoutes.js';
+import { createApiTokens } from './apiTokens.js';
+import { createIdentityConfirmation } from './identityConfirmation.js';
+import { createMiddleware } from './middleware.js';
+import { createOidc } from './oidc.js';
+import { createOidcConfigResolver } from './oidcConfig.js';
+import { createOidcSettings } from './oidcSettings.js';
+import { createOidcSettingsRoutes } from './oidcSettingsRoutes.js';
+import { createSessions } from './sessions.js';
+import { createSignInAudit } from './signInAudit.js';
+import { createSignInRoutes } from './authRoutes.js';
+import { createTwoFactor } from './twoFactor.js';
+import { createUserRoutes } from './userRoutes.js';
+/**
+ * Accounts, sessions, two-factor sign-in, single sign-on, API tokens and the routes that manage them. Everything is
+ * built from `options` and kept in the returned closures; nothing is shared between two calls.
+ */
+export function createAuth(options) {
+    options.roles.freeze();
+    const apiTokens = createApiTokens(options);
+    const sessions = createSessions(options, apiTokens);
+    const middleware = createMiddleware(sessions, apiTokens);
+    const identityConfirmation = createIdentityConfirmation(options);
+    const twoFactor = createTwoFactor(options);
+    const signInAudit = createSignInAudit(options);
+    const oidcConfig = createOidcConfigResolver({ publicUrl: options.publicUrl, callbackPath: `${options.basePath}/oidc/callback` });
+    const oidcSettings = createOidcSettings(options, oidcConfig);
+    const oidc = createOidc(options, signInAudit);
+    const signIn = createSignInRoutes(options, { sessions, middleware, twoFactor, identityConfirmation, signInAudit, oidcSettings, oidc });
+    const users = createUserRoutes(options, { sessions, twoFactor, identityConfirmation });
+    const oidcSettingsRoutes = createOidcSettingsRoutes(options, { identityConfirmation, oidc, oidcSettings, resolver: oidcConfig, startOidcFlow: signIn.startOidcFlow });
+    const tokenRoutes = createApiTokenRoutes(options, apiTokens, identityConfirmation);
+    return {
+        sessions,
+        middleware,
+        identityConfirmation,
+        twoFactor,
+        signInAudit,
+        oidcConfig,
+        oidcSettings,
+        oidc,
+        apiTokens,
+        /** Plain plugins (not wrapped for encapsulation), so the hooks of the scope they are registered in apply to them. */
+        routes: {
+            signIn: signIn.authRoutes,
+            users: users.userRoutes,
+            oidcSettings: oidcSettingsRoutes.oidcSettingsRoutes,
+            apiTokens: tokenRoutes.apiTokenRoutes,
+        },
+    };
+}
+//# sourceMappingURL=createAuth.js.map

package/dist/createAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAuth.js","sourceRoot":"","sources":["../src/createAuth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAElD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;IAEtB,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IACxD,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC1C,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,wBAAwB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,QAAQ,gBAAgB,EAAE,CAAC,CAAA;IAChI,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAE7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;IACtI,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACtF,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,OAAO,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;IACrK,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAA;IAElF,OAAO;QACL,QAAQ;QACR,UAAU;QACV,oBAAoB;QACpB,SAAS;QACT,WAAW;QACX,UAAU;QACV,YAAY;QACZ,IAAI;QACJ,SAAS;QACT,qHAAqH;QACrH,MAAM,EAAE;YACN,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,KAAK,EAAE,KAAK,CAAC,UAAU;YACvB,YAAY,EAAE,kBAAkB,CAAC,kBAAkB;YACnD,SAAS,EAAE,WAAW,CAAC,cAAc;SACtC;KACF,CAAA;AACH,CAAC"}

package/dist/identityConfirmation.d.ts

@@ -0,0 +1,13 @@
+import type { FastifyReply } from 'fastify';
+import type { AuthOptions } from './context.js';
+import type { AuthIdentity } from './sessions.js';
+/** Error code telling the admin UI to confirm the user through the identity provider, then retry. */
+export declare const SSO_CONFIRMATION_REQUIRED = "SSO_CONFIRMATION_REQUIRED";
+/** How long an SSO sign-in or SSO confirmation covers sensitive actions in that session. */
+export declare const SSO_CONFIRMATION_WINDOW_MS: number;
+export declare function createIdentityConfirmation(ctx: AuthOptions): {
+    confirmIdentity: (identity: AuthIdentity, currentPassword: unknown, reply: FastifyReply) => Promise<boolean>;
+    markSessionVerified: (sessionId: string, userId: number) => Promise<boolean>;
+};
+export type IdentityConfirmation = ReturnType<typeof createIdentityConfirmation>;
+//# sourceMappingURL=identityConfirmation.d.ts.map

package/dist/identityConfirmation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identityConfirmation.d.ts","sourceRoot":"","sources":["../src/identityConfirmation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,qGAAqG;AACrG,eAAO,MAAM,yBAAyB,8BAA8B,CAAA;AAEpE,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,QAAiB,CAAA;AAExD,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,WAAW;gCAQhB,YAAY,mBAAmB,OAAO,SAAS,YAAY,KAAG,OAAO,CAAC,OAAO,CAAC;qCAezE,MAAM,UAAU,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;EAWxF;AAED,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAA"}

package/dist/identityConfirmation.js

@@ -0,0 +1,37 @@
+import bcrypt from 'bcryptjs';
+import { and, eq, gt } from 'drizzle-orm';
+import { authSessions, users } from './tables.js';
+/** Error code telling the admin UI to confirm the user through the identity provider, then retry. */
+export const SSO_CONFIRMATION_REQUIRED = 'SSO_CONFIRMATION_REQUIRED';
+/** How long an SSO sign-in or SSO confirmation covers sensitive actions in that session. */
+export const SSO_CONFIRMATION_WINDOW_MS = 10 * 60 * 1000;
+export function createIdentityConfirmation(ctx) {
+    const { db } = ctx;
+    /**
+     * Sensitive actions are confirmed the way the session signed in: a password session with the current
+     * password, an SSO session with a recent sign-in at the identity provider (the sign-in itself, or a
+     * confirmation popup started from the UI). Returns true, or sends the refusal and returns false.
+     */
+    async function confirmIdentity(identity, currentPassword, reply) {
+        if (identity.authMethod === 'oidc') {
+            const session = (await db.select().from(authSessions).where(eq(authSessions.id, identity.sessionId)))[0];
+            const verifiedAt = session?.verifiedAt ?? session?.createdAt ?? 0;
+            if (Date.now() - verifiedAt <= SSO_CONFIRMATION_WINDOW_MS)
+                return true;
+            await reply.code(403).send({ error: 'Confirm your identity with single sign-on to continue', code: SSO_CONFIRMATION_REQUIRED });
+            return false;
+        }
+        const user = (await db.select().from(users).where(eq(users.id, identity.userId)))[0];
+        if (user && typeof currentPassword === 'string' && currentPassword && await bcrypt.compare(currentPassword, user.passwordHash))
+            return true;
+        await reply.code(400).send({ error: 'Current password is incorrect' });
+        return false;
+    }
+    /** Records a successful SSO confirmation on a live SSO session of that user. False when there is no such session. */
+    async function markSessionVerified(sessionId, userId) {
+        const updated = await db.update(authSessions).set({ verifiedAt: Date.now() }).where(and(eq(authSessions.id, sessionId), eq(authSessions.userId, userId), eq(authSessions.authMethod, 'oidc'), gt(authSessions.expiresAt, Date.now()))).returning({ id: authSessions.id });
+        return updated.length > 0;
+    }
+    return { confirmIdentity, markSessionVerified };
+}
+//# sourceMappingURL=identityConfirmation.js.map

package/dist/identityConfirmation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identityConfirmation.js","sourceRoot":"","sources":["../src/identityConfirmation.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,UAAU,CAAA;AAC7B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAIjD,qGAAqG;AACrG,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AAEpE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAExD,MAAM,UAAU,0BAA0B,CAAC,GAAgB;IACzD,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAA;IAElB;;;;OAIG;IACH,KAAK,UAAU,eAAe,CAAC,QAAsB,EAAE,eAAwB,EAAE,KAAmB;QAClG,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACxG,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC,CAAA;YACjE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,IAAI,0BAA0B;gBAAE,OAAO,IAAI,CAAA;YACtE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uDAAuD,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAA;YAC/H,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACpF,IAAI,IAAI,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,IAAI,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAA;QAC3I,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAA;QACtE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,qHAAqH;IACrH,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc;QAClE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CACrF,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC,EAC9B,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,EACnC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CACvC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAA;QACrC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;IAC3B,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,CAAA;AACjD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+export { createAuth, type Auth } from './createAuth.js';
+export { authDbModule } from './module.js';
+export { apiTokens, authSessions, oidcSettings, users } from './tables.js';
+export { acceptApiTokens, belongsTo, registerAdminApi, type AdminRouteGroup } from './routeScope.js';
+export { createSetupRoutes, type SetupRoutesOptions } from './setupRoutes.js';
+export { ADMIN_ROLE, createRoleRegistry, type RoleRegistry } from './roles.js';
+export { createTokenCatalogue, type TokenCatalogue } from './tokenCatalogue.js';
+export type { AuthHooks, AuthOptions, RateLimitConfig, SessionsRevoked, SignInOutcome, UnknownSsoUser } from './context.js';
+export { ALLOW_PENDING_PASSWORD_CHANGE, PASSWORD_CHANGE_REQUIRED, requestIdentity } from './middleware.js';
+export { API_TOKEN_NOT_ACCEPTED, type AuthenticateOptions, type AuthIdentity, type AuthMethod } from './sessions.js';
+export { SSO_CONFIRMATION_REQUIRED, SSO_CONFIRMATION_WINDOW_MS } from './identityConfirmation.js';
+export { checkEmailVerified, OIDC_CONFIRMATION_MAX_AGE_SECONDS } from './oidc.js';
+export type { OidcDecision, OidcDenial, OidcDenialCode, OidcFlowState, OidcTestResult, SsoProvisioning } from './oidc.js';
+export type { OidcSettingsRow } from './oidcSettings.js';
+export { createOidcConfigResolver, DEFAULT_OIDC_BUTTON_LABEL, DEFAULT_OIDC_SCOPES, isHttpUrl, passwordLoginEnabled, type OidcConfig, type OidcSettingsInput } from './oidcConfig.js';
+export { consumeRecoveryCode, generateRecoveryCodes, generateTotpCode, generateTotpSecret, hashRecoveryCode, totpUri, verifyTotp } from './totp.js';
+export type { CredentialDenialCode, SignInDenial, SignInMethod } from './signInAudit.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACpG,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9E,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC/E,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC3H,OAAO,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAC1G,OAAO,EAAE,sBAAsB,EAAE,KAAK,mBAAmB,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AACpH,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA;AACjG,OAAO,EAAE,kBAAkB,EAAE,iCAAiC,EAAE,MAAM,WAAW,CAAA;AACjF,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACzH,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,SAAS,EAAE,oBAAoB,EAAE,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACpL,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACnJ,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/index.js

@@ -0,0 +1,14 @@
+export { createAuth } from './createAuth.js';
+export { authDbModule } from './module.js';
+export { apiTokens, authSessions, oidcSettings, users } from './tables.js';
+export { acceptApiTokens, belongsTo, registerAdminApi } from './routeScope.js';
+export { createSetupRoutes } from './setupRoutes.js';
+export { ADMIN_ROLE, createRoleRegistry } from './roles.js';
+export { createTokenCatalogue } from './tokenCatalogue.js';
+export { ALLOW_PENDING_PASSWORD_CHANGE, PASSWORD_CHANGE_REQUIRED, requestIdentity } from './middleware.js';
+export { API_TOKEN_NOT_ACCEPTED } from './sessions.js';
+export { SSO_CONFIRMATION_REQUIRED, SSO_CONFIRMATION_WINDOW_MS } from './identityConfirmation.js';
+export { checkEmailVerified, OIDC_CONFIRMATION_MAX_AGE_SECONDS } from './oidc.js';
+export { createOidcConfigResolver, DEFAULT_OIDC_BUTTON_LABEL, DEFAULT_OIDC_SCOPES, isHttpUrl, passwordLoginEnabled } from './oidcConfig.js';
+export { consumeRecoveryCode, generateRecoveryCodes, generateTotpCode, generateTotpSecret, hashRecoveryCode, totpUri, verifyTotp } from './totp.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAwB,MAAM,iBAAiB,CAAA;AACpG,OAAO,EAAE,iBAAiB,EAA2B,MAAM,kBAAkB,CAAA;AAC7E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAqB,MAAM,YAAY,CAAA;AAC9E,OAAO,EAAE,oBAAoB,EAAuB,MAAM,qBAAqB,CAAA;AAE/E,OAAO,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAC1G,OAAO,EAAE,sBAAsB,EAAgE,MAAM,eAAe,CAAA;AACpH,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA;AACjG,OAAO,EAAE,kBAAkB,EAAE,iCAAiC,EAAE,MAAM,WAAW,CAAA;AAGjF,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,SAAS,EAAE,oBAAoB,EAA2C,MAAM,iBAAiB,CAAA;AACpL,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA"}

package/dist/middleware.d.ts

@@ -0,0 +1,41 @@
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import { type AuthIdentity, type Sessions } from './sessions.js';
+import type { ApiTokens } from './apiTokens.js';
+declare module 'fastify' {
+    interface FastifyContextConfig {
+        allowPendingPasswordChange?: boolean;
+        /** Routes that accept an API token. Everything else answers 403 to one, so tokens never reach account security. */
+        allowApiToken?: boolean;
+        /**
+         * The part of the admin API a route belongs to (a key of TOKEN_RESOURCES, or `vault`). A token needs `<part>:read`
+         * for GET and `<part>:write` for anything else. `custom` means the handler checks the token itself. A route a
+         * token may reach but that names no part is refused: tokens fail closed.
+         */
+        tokenScope?: string;
+    }
+}
+export declare const PASSWORD_CHANGE_REQUIRED = "PASSWORD_CHANGE_REQUIRED";
+/**
+ * Route config for the few routes a user with a pending forced password change may still call
+ * (session lookup, change-password, logout). Every other authenticated route answers 403 until
+ * the password is changed, so the requirement is enforced server-side, not only by the admin UI.
+ */
+export declare const ALLOW_PENDING_PASSWORD_CHANGE: {
+    readonly allowPendingPasswordChange: true;
+};
+/**
+ * The identity attached by requireAuth/requireRole. Only call from handlers behind one of them.
+ */
+export declare function requestIdentity(req: FastifyRequest): AuthIdentity;
+export declare function createMiddleware(sessions: Sessions, apiTokens: ApiTokens): {
+    authenticateOrReject: (req: FastifyRequest, reply: FastifyReply, unauthorized?: Record<string, string>) => Promise<AuthIdentity | null>;
+    requireAuth: ((req: FastifyRequest, reply: FastifyReply) => Promise<undefined>) & {
+        requiresAuth: boolean;
+    };
+    requireRole: (...allowed: string[]) => ((req: FastifyRequest, reply: FastifyReply) => Promise<undefined>) & {
+        allowedRoles: string[];
+        requiresAuth: boolean;
+    };
+};
+export type Middleware = ReturnType<typeof createMiddleware>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE3D,OAAO,EAA0B,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,oBAAoB;QAC5B,0BAA0B,CAAC,EAAE,OAAO,CAAA;QACpC,mHAAmH;QACnH,aAAa,CAAC,EAAE,OAAO,CAAA;QACvB;;;;WAIG;QACH,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB;CACF;AAED,eAAO,MAAM,wBAAwB,6BAA6B,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;CAAgD,CAAA;AAO1F;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY,CAIjE;AAWD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;gCAUhE,cAAc,SACZ,YAAY,iBACL,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KACnC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;wBAqCC,cAAc,SAAS,YAAY;;;8BAIlC,MAAM,EAAE,YACd,cAAc,SAAS,YAAY;;;;EAc/D;AAED,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA"}

package/dist/middleware.js

@@ -0,0 +1,100 @@
+import { requiredScope, tokenAllows } from '@better-forge/contracts';
+import { API_TOKEN_NOT_ACCEPTED } from './sessions.js';
+export const PASSWORD_CHANGE_REQUIRED = 'PASSWORD_CHANGE_REQUIRED';
+/**
+ * Route config for the few routes a user with a pending forced password change may still call
+ * (session lookup, change-password, logout). Every other authenticated route answers 403 until
+ * the password is changed, so the requirement is enforced server-side, not only by the admin UI.
+ */
+export const ALLOW_PENDING_PASSWORD_CHANGE = { allowPendingPasswordChange: true };
+function existingIdentity(req) {
+    const value = req.user;
+    return value?.sessionId && typeof value.userId === 'number' ? value : null;
+}
+/**
+ * The identity attached by requireAuth/requireRole. Only call from handlers behind one of them.
+ */
+export function requestIdentity(req) {
+    const value = req.user;
+    if (typeof value?.userId !== 'number')
+        throw new Error('requestIdentity called on an unauthenticated request');
+    return value;
+}
+function passwordChangeBlocks(req, identity) {
+    if (!identity.mustChangePassword)
+        return false;
+    return req.routeOptions.config?.allowPendingPasswordChange !== true;
+}
+function sendPasswordChangeRequired(reply) {
+    return reply.code(403).send({ error: 'Password change required', code: PASSWORD_CHANGE_REQUIRED });
+}
+export function createMiddleware(sessions, apiTokens) {
+    const { authenticateRequest, verifyCsrf } = sessions;
+    const { consumeApiTokenBudget } = apiTokens;
+    /**
+     * Authenticates the request and checks its CSRF token. Answers 401 (with `unauthorized` as the body) or 403
+     * itself and returns null when either fails, or when the user still has to replace a temporary password.
+     * A hook that gets null must return the reply.
+     */
+    async function authenticateOrReject(req, reply, unauthorized = { error: 'Unauthorized' }) {
+        const allowApiToken = req.routeOptions.config?.allowApiToken === true;
+        const existing = existingIdentity(req);
+        let identity;
+        try {
+            identity = existing ?? await authenticateRequest(req, { allowApiToken });
+            if (identity.apiToken && !allowApiToken)
+                throw new Error(API_TOKEN_NOT_ACCEPTED);
+            await verifyCsrf(req, identity);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : '';
+            if (message === 'Invalid CSRF token')
+                reply.code(403).send({ error: 'Invalid CSRF token' });
+            else if (message === API_TOKEN_NOT_ACCEPTED)
+                reply.code(403).send({ error: 'API tokens cannot call this endpoint' });
+            else
+                reply.code(401).send(unauthorized);
+            return null;
+        }
+        // Only a request that just authenticated spends budget; the later hooks of the same request reuse the identity.
+        if (identity.apiToken && !existing && !consumeApiTokenBudget(identity.apiToken.id)) {
+            reply.code(429).header('retry-after', '60').send({ error: 'Too many requests' });
+            return null;
+        }
+        if (identity.apiToken) {
+            const resource = req.routeOptions.config?.tokenScope;
+            if (resource !== 'custom') {
+                const required = resource ? requiredScope(resource, req.method) : null;
+                if (!required || !tokenAllows(identity.apiToken.scopes, required)) {
+                    reply.code(403).send({ error: required ? `This token does not have the "${required}" permission` : 'API tokens cannot call this endpoint' });
+                    return null;
+                }
+            }
+        }
+        if (passwordChangeBlocks(req, identity)) {
+            sendPasswordChangeRequired(reply);
+            return null;
+        }
+        return identity;
+    }
+    async function requireAuth(req, reply) {
+        if (!await authenticateOrReject(req, reply))
+            return reply;
+    }
+    function requireRole(...allowed) {
+        const hook = async (req, reply) => {
+            const identity = await authenticateOrReject(req, reply);
+            if (!identity)
+                return reply;
+            const { role } = identity;
+            if (role !== 'admin' && !allowed.includes(role)) {
+                return reply.code(403).send({ error: 'Forbidden' });
+            }
+        };
+        // Readable by the route-table snapshot test; the hook itself never looks at it.
+        return Object.assign(hook, { allowedRoles: allowed, requiresAuth: true });
+    }
+    // Readable by the route-table snapshot test, like `allowedRoles`; the hook itself never looks at it.
+    return { authenticateOrReject, requireAuth: Object.assign(requireAuth, { requiresAuth: true }), requireRole };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,sBAAsB,EAAoC,MAAM,eAAe,CAAA;AAiBxF,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAA;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,0BAA0B,EAAE,IAAI,EAAW,CAAA;AAE1F,SAAS,gBAAgB,CAAC,GAAmB;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAyC,CAAA;IAC3D,OAAO,KAAK,EAAE,SAAS,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAqB,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAmB;IACjD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAyC,CAAA;IAC3D,IAAI,OAAO,KAAK,EAAE,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IAC9G,OAAO,KAAqB,CAAA;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAmB,EAAE,QAAsB;IACvE,IAAI,CAAC,QAAQ,CAAC,kBAAkB;QAAE,OAAO,KAAK,CAAA;IAC9C,OAAO,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,0BAA0B,KAAK,IAAI,CAAA;AACrE,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAmB;IACrD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAA;AACpG,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,SAAoB;IACvE,MAAM,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAA;IACpD,MAAM,EAAE,qBAAqB,EAAE,GAAG,SAAS,CAAA;IAE3C;;;;OAIG;IACH,KAAK,UAAU,oBAAoB,CACjC,GAAmB,EACnB,KAAmB,EACnB,eAAuC,EAAE,KAAK,EAAE,cAAc,EAAE;QAEhE,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAA;QACrE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,QAAsB,CAAA;QAC1B,IAAI,CAAC;YACH,QAAQ,GAAG,QAAQ,IAAI,MAAM,mBAAmB,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAA;YACxE,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;YAChF,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;YAC3D,IAAI,OAAO,KAAK,oBAAoB;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;iBACtF,IAAI,OAAO,KAAK,sBAAsB;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAA;;gBAC/G,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YACvC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,gHAAgH;QAChH,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;YAChF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,UAAU,CAAA;YACpD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;gBACtE,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAClE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,iCAAiC,QAAQ,cAAc,CAAC,CAAC,CAAC,sCAAsC,EAAE,CAAC,CAAA;oBAC5I,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;YACxC,0BAA0B,CAAC,KAAK,CAAC,CAAA;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,GAAmB,EAAE,KAAmB;QACjE,IAAI,CAAC,MAAM,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;IAC3D,CAAC;IAED,SAAS,WAAW,CAAC,GAAG,OAAiB;QACvC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAE,EAAE;YAC9D,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACvD,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAA;YAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAA;YACzB,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;YACrD,CAAC;QACH,CAAC,CAAA;QACD,gFAAgF;QAChF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,qGAAqG;IACrG,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAA;AAC/G,CAAC"}

package/dist/migrations.d.ts

@@ -0,0 +1,4 @@
+import type { MigrationStep } from '@better-forge/db';
+/** Users, sign-in sessions, SSO settings and API tokens. Steps run in this order. */
+export declare const authMigrations: readonly MigrationStep[];
+//# sourceMappingURL=migrations.d.ts.map

package/dist/migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAErD,qFAAqF;AACrF,eAAO,MAAM,cAAc,EAAE,SAAS,aAAa,EAuElD,CAAA"}

package/dist/migrations.js

@@ -0,0 +1,77 @@
+import { randomBytes } from 'node:crypto';
+import bcrypt from 'bcryptjs';
+/** Users, sign-in sessions, SSO settings and API tokens. Steps run in this order. */
+export const authMigrations = [
+    { kind: 'exec', sql: `
+CREATE TABLE IF NOT EXISTS users (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  email TEXT NOT NULL UNIQUE,
+  password_hash TEXT NOT NULL,
+  role TEXT NOT NULL DEFAULT 'admin',
+  created_at INTEGER NOT NULL
+);
+` },
+    { kind: 'exec', sql: `
+CREATE TABLE IF NOT EXISTS oidc_settings (
+  id INTEGER PRIMARY KEY,
+  enabled INTEGER NOT NULL DEFAULT 0,
+  issuer TEXT NOT NULL DEFAULT '',
+  client_id TEXT NOT NULL DEFAULT '',
+  client_secret TEXT NOT NULL DEFAULT '',
+  scopes TEXT NOT NULL DEFAULT '',
+  redirect_uri TEXT NOT NULL DEFAULT '',
+  button_label TEXT NOT NULL DEFAULT '',
+  allow_unverified_email INTEGER NOT NULL DEFAULT 0,
+  disable_password_login INTEGER NOT NULL DEFAULT 0,
+  updated_at INTEGER NOT NULL
+);
+` },
+    { kind: 'exec', sql: `
+CREATE TABLE IF NOT EXISTS auth_sessions (
+  id TEXT PRIMARY KEY,
+  user_id INTEGER NOT NULL,
+  csrf_token_hash TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  last_seen_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  auth_method TEXT NOT NULL DEFAULT 'password',
+  verified_at INTEGER,
+  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS idx_auth_sessions_user ON auth_sessions(user_id);
+CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires ON auth_sessions(expires_at);
+` },
+    { kind: 'exec', sql: `
+CREATE TABLE IF NOT EXISTS api_tokens (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name TEXT NOT NULL,
+  token_hash TEXT NOT NULL UNIQUE,
+  prefix TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER,
+  last_used_at INTEGER,
+  scopes TEXT NOT NULL
+);
+` },
+    { kind: 'column', sql: `ALTER TABLE users ADD COLUMN must_change_password INTEGER NOT NULL DEFAULT 0`, desc: 'users.must_change_password' },
+    { kind: 'column', sql: `ALTER TABLE users ADD COLUMN totp_secret TEXT`, desc: 'users.totp_secret' },
+    { kind: 'column', sql: `ALTER TABLE users ADD COLUMN totp_enabled INTEGER NOT NULL DEFAULT 0`, desc: 'users.totp_enabled' },
+    { kind: 'column', sql: `ALTER TABLE users ADD COLUMN totp_recovery_codes TEXT`, desc: 'users.totp_recovery_codes' },
+    { kind: 'column', sql: `ALTER TABLE auth_sessions ADD COLUMN auth_method TEXT NOT NULL DEFAULT 'password'`, desc: 'auth_sessions.auth_method' },
+    { kind: 'column', sql: `ALTER TABLE users ADD COLUMN oidc_issuer TEXT`, desc: 'users.oidc_issuer' },
+    { kind: 'column', sql: `ALTER TABLE users ADD COLUMN oidc_subject TEXT`, desc: 'users.oidc_subject' },
+    { kind: 'column', sql: `ALTER TABLE auth_sessions ADD COLUMN verified_at INTEGER`, desc: 'auth_sessions.verified_at' },
+    // One IdP identity can be bound to one user only. Needs the columns added above.
+    { kind: 'exec', sql: `CREATE UNIQUE INDEX IF NOT EXISTS idx_users_oidc_identity ON users(oidc_issuer, oidc_subject)` },
+    /**
+     * Accounts linked to SSO before a sign-in started revoking the temporary password may still have a working one
+     * that their administrator knows. Linking only happens on an SSO sign-in, so revoke it the same way.
+     */
+    { kind: 'data', name: 'sso-users-temporary-password-revoked-v1', run(sqlite) {
+            const pending = sqlite.prepare('SELECT id FROM users WHERE must_change_password = 1 AND oidc_subject IS NOT NULL').all();
+            const revoke = sqlite.prepare('UPDATE users SET password_hash = ?, must_change_password = 0 WHERE id = ?');
+            for (const { id } of pending)
+                revoke.run(bcrypt.hashSync(randomBytes(32).toString('base64url'), 10), id);
+        } },
+];
+//# sourceMappingURL=migrations.js.map

package/dist/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,MAAM,MAAM,UAAU,CAAA;AAG7B,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAA6B;IACtD,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;;;;;;;;CAQtB,EAAE;IACD,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;;;;;;;;;;;;;;CActB,EAAE;IACD,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;;;;;;;;;;;;;;CActB,EAAE;IACD,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;;;;;;;;;;;CAWtB,EAAE;IACD,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,8EAA8E,EAAE,IAAI,EAAE,4BAA4B,EAAE;IAC3I,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,+CAA+C,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACnG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,sEAAsE,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC3H,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,uDAAuD,EAAE,IAAI,EAAE,2BAA2B,EAAE;IACnH,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,mFAAmF,EAAE,IAAI,EAAE,2BAA2B,EAAE;IAC/I,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,+CAA+C,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACnG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,gDAAgD,EAAE,IAAI,EAAE,oBAAoB,EAAE;IACrG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,0DAA0D,EAAE,IAAI,EAAE,2BAA2B,EAAE;IACtH,iFAAiF;IACjF,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,+FAA+F,EAAE;IACtH;;;OAGG;IACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,yCAAyC,EAAE,GAAG,CAAC,MAAM;YACzE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,kFAAkF,CAAC,CAAC,GAAG,EAA2B,CAAA;YACjJ,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,2EAA2E,CAAC,CAAA;YAC1G,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,OAAO;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;QAC1G,CAAC,EAAE;CACJ,CAAA"}

package/dist/module.d.ts

@@ -0,0 +1,8 @@
+import * as tables from './tables.js';
+/** The tables of accounts, sessions, API tokens and SSO settings, with their migrations, for the application's list of database modules. */
+export declare const authDbModule: {
+    id: string;
+    tables: typeof tables;
+    migrations: readonly import("@better-forge/db").MigrationStep[];
+};
+//# sourceMappingURL=module.d.ts.map

package/dist/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAGrC,4IAA4I;AAC5I,eAAO,MAAM,YAAY;;;;CAAwE,CAAA"}

package/dist/module.js

@@ -0,0 +1,5 @@
+import * as tables from './tables.js';
+import { authMigrations } from './migrations.js';
+/** The tables of accounts, sessions, API tokens and SSO settings, with their migrations, for the application's list of database modules. */
+export const authDbModule = { id: 'auth', tables, migrations: authMigrations };
+//# sourceMappingURL=module.js.map

package/dist/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,4IAA4I;AAC5I,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAqB,CAAA"}