@better-forge/auth 0.1.0 → 0.1.1

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 BetterStatusPage contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 BetterStatusPage contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,5 +1,5 @@
-# @better-forge/auth
-
-Users, sessions, 2FA, SSO/OIDC, roles, API tokens and sign-in routes.
-
-Status: skeleton. Depends on: `@better-forge/db`, `@better-forge/audit`.
+# @better-forge/auth
+
+Users, sessions, 2FA, SSO/OIDC, roles, API tokens and sign-in routes.
+
+Status: skeleton. Depends on: `@better-forge/db`, `@better-forge/audit`.

package/dist/createAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAuth.d.ts","sourceRoot":"","sources":["../src/createAuth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAe/C;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAuCu7E,CAAC;;;;;;;kBAA2kC,CAAC;;kBAAwB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAXxkH,qHAAqH;;;;;;;EAQxH;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAA"}
+{"version":3,"file":"createAuth.d.ts","sourceRoot":"","sources":["../src/createAuth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAe/C;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAuC03E,CAAC;;;;;;;kBAAkjC,CAAC;;kBAAwB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAXl/G,qHAAqH;;;;;;;EAQxH;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAA"}

package/dist/migrations.js

@@ -2,56 +2,56 @@ import { randomBytes } from 'node:crypto';
 import bcrypt from 'bcryptjs';
 /** Users, sign-in sessions, SSO settings and API tokens. Steps run in this order. */
 export const authMigrations = [
-    { kind: 'exec', sql: `
-CREATE TABLE IF NOT EXISTS users (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  email TEXT NOT NULL UNIQUE,
-  password_hash TEXT NOT NULL,
-  role TEXT NOT NULL DEFAULT 'admin',
-  created_at INTEGER NOT NULL
-);
+    { kind: 'exec', sql: `
+CREATE TABLE IF NOT EXISTS users (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  email TEXT NOT NULL UNIQUE,
+  password_hash TEXT NOT NULL,
+  role TEXT NOT NULL DEFAULT 'admin',
+  created_at INTEGER NOT NULL
+);
 ` },
-    { kind: 'exec', sql: `
-CREATE TABLE IF NOT EXISTS oidc_settings (
-  id INTEGER PRIMARY KEY,
-  enabled INTEGER NOT NULL DEFAULT 0,
-  issuer TEXT NOT NULL DEFAULT '',
-  client_id TEXT NOT NULL DEFAULT '',
-  client_secret TEXT NOT NULL DEFAULT '',
-  scopes TEXT NOT NULL DEFAULT '',
-  redirect_uri TEXT NOT NULL DEFAULT '',
-  button_label TEXT NOT NULL DEFAULT '',
-  allow_unverified_email INTEGER NOT NULL DEFAULT 0,
-  disable_password_login INTEGER NOT NULL DEFAULT 0,
-  updated_at INTEGER NOT NULL
-);
+    { kind: 'exec', sql: `
+CREATE TABLE IF NOT EXISTS oidc_settings (
+  id INTEGER PRIMARY KEY,
+  enabled INTEGER NOT NULL DEFAULT 0,
+  issuer TEXT NOT NULL DEFAULT '',
+  client_id TEXT NOT NULL DEFAULT '',
+  client_secret TEXT NOT NULL DEFAULT '',
+  scopes TEXT NOT NULL DEFAULT '',
+  redirect_uri TEXT NOT NULL DEFAULT '',
+  button_label TEXT NOT NULL DEFAULT '',
+  allow_unverified_email INTEGER NOT NULL DEFAULT 0,
+  disable_password_login INTEGER NOT NULL DEFAULT 0,
+  updated_at INTEGER NOT NULL
+);
 ` },
-    { kind: 'exec', sql: `
-CREATE TABLE IF NOT EXISTS auth_sessions (
-  id TEXT PRIMARY KEY,
-  user_id INTEGER NOT NULL,
-  csrf_token_hash TEXT NOT NULL,
-  created_at INTEGER NOT NULL,
-  last_seen_at INTEGER NOT NULL,
-  expires_at INTEGER NOT NULL,
-  auth_method TEXT NOT NULL DEFAULT 'password',
-  verified_at INTEGER,
-  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
-);
-CREATE INDEX IF NOT EXISTS idx_auth_sessions_user ON auth_sessions(user_id);
-CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires ON auth_sessions(expires_at);
+    { kind: 'exec', sql: `
+CREATE TABLE IF NOT EXISTS auth_sessions (
+  id TEXT PRIMARY KEY,
+  user_id INTEGER NOT NULL,
+  csrf_token_hash TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  last_seen_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  auth_method TEXT NOT NULL DEFAULT 'password',
+  verified_at INTEGER,
+  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS idx_auth_sessions_user ON auth_sessions(user_id);
+CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires ON auth_sessions(expires_at);
 ` },
-    { kind: 'exec', sql: `
-CREATE TABLE IF NOT EXISTS api_tokens (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  name TEXT NOT NULL,
-  token_hash TEXT NOT NULL UNIQUE,
-  prefix TEXT NOT NULL,
-  created_at INTEGER NOT NULL,
-  expires_at INTEGER,
-  last_used_at INTEGER,
-  scopes TEXT NOT NULL
-);
+    { kind: 'exec', sql: `
+CREATE TABLE IF NOT EXISTS api_tokens (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name TEXT NOT NULL,
+  token_hash TEXT NOT NULL UNIQUE,
+  prefix TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER,
+  last_used_at INTEGER,
+  scopes TEXT NOT NULL
+);
 ` },
     { kind: 'column', sql: `ALTER TABLE users ADD COLUMN must_change_password INTEGER NOT NULL DEFAULT 0`, desc: 'users.must_change_password' },
     { kind: 'column', sql: `ALTER TABLE users ADD COLUMN totp_secret TEXT`, desc: 'users.totp_secret' },

package/package.json

@@ -1,68 +1,68 @@
-{
-  "name": "@better-forge/auth",
-  "version": "0.1.0",
-  "description": "Users, sessions, 2FA, SSO/OIDC, roles, API tokens and sign-in routes.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/BElluu/Better-Forge.git",
-    "directory": "packages/auth"
-  },
-  "homepage": "https://github.com/BElluu/Better-Forge/tree/main/packages/auth#readme",
-  "bugs": {
-    "url": "https://github.com/BElluu/Better-Forge/issues"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "type": "module",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "dist",
-    "src",
-    "!src/**/*.test.*"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput"
-  },
-  "peerDependencies": {
-    "@fastify/cookie": "^11.1.1",
-    "@fastify/jwt": "^10.1.0",
-    "bcryptjs": "^3.0.2",
-    "drizzle-orm": "^0.45.2",
-    "fastify": "^5.3.2",
-    "openid-client": "^6.8.8",
-    "qrcode": "^1.5.4",
-    "@fastify/rate-limit": "^10.3.0"
-  },
-  "devDependencies": {
-    "@types/node": "^26.6.2",
-    "@types/qrcode": "^1.5.6",
-    "@fastify/cookie": "^11.1.1",
-    "@fastify/jwt": "^10.1.0",
-    "bcryptjs": "^3.0.2",
-    "drizzle-orm": "^0.45.2",
-    "fastify": "^5.3.2",
-    "openid-client": "^6.8.8",
-    "qrcode": "^1.5.4",
-    "typescript": "^5.7.3",
-    "@fastify/rate-limit": "^10.3.0"
-  },
-  "dependencies": {
-    "@better-forge/audit": "0.1.0",
-    "@better-forge/contracts": "0.1.0",
-    "@better-forge/db": "0.1.0"
-  },
-  "engines": {
-    "node": ">=26.10.0"
-  }
-}
+{
+  "name": "@better-forge/auth",
+  "version": "0.1.1",
+  "description": "Users, sessions, 2FA, SSO/OIDC, roles, API tokens and sign-in routes.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/BElluu/Better-Forge.git",
+    "directory": "packages/auth"
+  },
+  "homepage": "https://github.com/BElluu/Better-Forge/tree/main/packages/auth#readme",
+  "bugs": {
+    "url": "https://github.com/BElluu/Better-Forge/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.*"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput"
+  },
+  "peerDependencies": {
+    "@fastify/cookie": "^11.1.1",
+    "@fastify/jwt": "^10.1.0",
+    "bcryptjs": "^3.0.2",
+    "drizzle-orm": "^0.45.2",
+    "fastify": "^5.3.2",
+    "openid-client": "^6.8.8",
+    "qrcode": "^1.5.4",
+    "@fastify/rate-limit": "^10.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.2",
+    "@types/qrcode": "^1.5.6",
+    "@fastify/cookie": "^11.1.1",
+    "@fastify/jwt": "^10.1.0",
+    "bcryptjs": "^3.0.2",
+    "drizzle-orm": "^0.45.2",
+    "fastify": "^5.3.2",
+    "openid-client": "^6.8.8",
+    "qrcode": "^1.5.4",
+    "typescript": "^5.7.3",
+    "@fastify/rate-limit": "^10.3.0"
+  },
+  "dependencies": {
+    "@better-forge/audit": "0.1.1",
+    "@better-forge/contracts": "0.1.1",
+    "@better-forge/db": "0.1.1"
+  },
+  "engines": {
+    "node": ">=26.10.0"
+  }
+}

package/src/apiTokenRoutes.ts

@@ -1,82 +1,82 @@
-import type { FastifyInstance } from 'fastify'
-import { eq } from 'drizzle-orm'
-import { apiTokens } from './tables.js'
-import { requestIdentity } from './middleware.js'
-import type { AuthOptions } from './context.js'
-import type { ApiTokens } from './apiTokens.js'
-import type { IdentityConfirmation } from './identityConfirmation.js'
-
-const MAX_NAME_LENGTH = 80
-
-const MAX_EXPIRY_DAYS = 3650
-
-/** A token that nobody asked to live forever should not. */
-const DEFAULT_EXPIRY_DAYS = 90
-
-const DAY_MS = 24 * 60 * 60 * 1000
-
-export function createApiTokenRoutes(ctx: AuthOptions, tokens: ApiTokens, identityConfirmation: IdentityConfirmation) {
-  const { db, audit } = ctx
-  const hooks = ctx.hooks ?? {}
-  const { generateApiToken, parseScopes } = tokens
-  const { confirmIdentity } = identityConfirmation
-
-  async function apiTokenRoutes(app: FastifyInstance) {
-    type TokenRow = typeof apiTokens.$inferSelect
-
-    function publicToken(row: TokenRow) {
-      const { tokenHash: _tokenHash, scopes, ...rest } = row
-      return { ...rest, scopes: parseScopes(scopes) }
-    }
-
-    app.get('/', async () => (await db.select().from(apiTokens)).map(publicToken))
-
-    // `expiresInDays` left out means the default; `null` is the explicit "never".
-    app.post<{ Body: { name?: unknown; scopes?: unknown; expiresInDays?: unknown; currentPassword?: unknown } }>('/', {
-      config: { rateLimit: ctx.rateLimits.sensitiveAction },
-    }, async (req, reply) => {
-      const { name, scopes: requested, expiresInDays } = req.body ?? {}
-      if (typeof name !== 'string' || !name.trim() || name.trim().length > MAX_NAME_LENGTH) {
-        return reply.code(400).send({ error: `Name is required (up to ${MAX_NAME_LENGTH} characters)` })
-      }
-      const scopes = ctx.tokens.normalize(requested)
-      if (!scopes) return reply.code(400).send({ error: 'scopes must be a list with at least one known permission' })
-      if (expiresInDays !== undefined && expiresInDays !== null
-        && (!Number.isInteger(expiresInDays) || (expiresInDays as number) < 1 || (expiresInDays as number) > MAX_EXPIRY_DAYS)) {
-        return reply.code(400).send({ error: `expiresInDays must be a whole number from 1 to ${MAX_EXPIRY_DAYS}, or null for no expiry` })
-      }
-
-      const identity = requestIdentity(req)
-      if (!await confirmIdentity(identity, req.body?.currentPassword, reply)) return reply
-      const now = Date.now()
-      const generated = generateApiToken()
-      const days = expiresInDays === undefined ? DEFAULT_EXPIRY_DAYS : expiresInDays
-      const row = (await db.insert(apiTokens).values({
-        name: name.trim(),
-        tokenHash: generated.hash,
-        prefix: generated.prefix,
-        scopes: JSON.stringify(scopes),
-        createdAt: now,
-        expiresAt: typeof days === 'number' ? now + days * DAY_MS : null,
-      }).returning())[0]!
-      await audit.write(audit.actor(identity), 'create', 'api_token', row.id, row.name,
-        audit.snapshot({ name: row.name, permissions: scopes.join(', '), prefix: row.prefix, expiresAt: row.expiresAt }))
-      // The only time the plaintext token leaves the server.
-      return { ...publicToken(row), token: generated.token }
-    })
-
-    app.delete<{ Params: { id: string } }>('/:id', async (req, reply) => {
-      const id = Number(req.params.id)
-      const existing = Number.isSafeInteger(id) ? (await db.select().from(apiTokens).where(eq(apiTokens.id, id)))[0] : undefined
-      if (!existing) return reply.code(404).send({ error: 'Not found' })
-      await db.delete(apiTokens).where(eq(apiTokens.id, id))
-      // A live event stream opened with the token must not outlast it.
-      hooks.onSessionsRevoked?.({ sessionId: `api-token:${id}` })
-      await audit.write(audit.actor(requestIdentity(req)), 'delete', 'api_token', id, existing.name,
-        audit.snapshot({ name: existing.name, permissions: parseScopes(existing.scopes).join(', '), prefix: existing.prefix }))
-      return reply.code(204).send()
-    })
-  }
-
-  return { apiTokenRoutes }
-}
+import type { FastifyInstance } from 'fastify'
+import { eq } from 'drizzle-orm'
+import { apiTokens } from './tables.js'
+import { requestIdentity } from './middleware.js'
+import type { AuthOptions } from './context.js'
+import type { ApiTokens } from './apiTokens.js'
+import type { IdentityConfirmation } from './identityConfirmation.js'
+
+const MAX_NAME_LENGTH = 80
+
+const MAX_EXPIRY_DAYS = 3650
+
+/** A token that nobody asked to live forever should not. */
+const DEFAULT_EXPIRY_DAYS = 90
+
+const DAY_MS = 24 * 60 * 60 * 1000
+
+export function createApiTokenRoutes(ctx: AuthOptions, tokens: ApiTokens, identityConfirmation: IdentityConfirmation) {
+  const { db, audit } = ctx
+  const hooks = ctx.hooks ?? {}
+  const { generateApiToken, parseScopes } = tokens
+  const { confirmIdentity } = identityConfirmation
+
+  async function apiTokenRoutes(app: FastifyInstance) {
+    type TokenRow = typeof apiTokens.$inferSelect
+
+    function publicToken(row: TokenRow) {
+      const { tokenHash: _tokenHash, scopes, ...rest } = row
+      return { ...rest, scopes: parseScopes(scopes) }
+    }
+
+    app.get('/', async () => (await db.select().from(apiTokens)).map(publicToken))
+
+    // `expiresInDays` left out means the default; `null` is the explicit "never".
+    app.post<{ Body: { name?: unknown; scopes?: unknown; expiresInDays?: unknown; currentPassword?: unknown } }>('/', {
+      config: { rateLimit: ctx.rateLimits.sensitiveAction },
+    }, async (req, reply) => {
+      const { name, scopes: requested, expiresInDays } = req.body ?? {}
+      if (typeof name !== 'string' || !name.trim() || name.trim().length > MAX_NAME_LENGTH) {
+        return reply.code(400).send({ error: `Name is required (up to ${MAX_NAME_LENGTH} characters)` })
+      }
+      const scopes = ctx.tokens.normalize(requested)
+      if (!scopes) return reply.code(400).send({ error: 'scopes must be a list with at least one known permission' })
+      if (expiresInDays !== undefined && expiresInDays !== null
+        && (!Number.isInteger(expiresInDays) || (expiresInDays as number) < 1 || (expiresInDays as number) > MAX_EXPIRY_DAYS)) {
+        return reply.code(400).send({ error: `expiresInDays must be a whole number from 1 to ${MAX_EXPIRY_DAYS}, or null for no expiry` })
+      }
+
+      const identity = requestIdentity(req)
+      if (!await confirmIdentity(identity, req.body?.currentPassword, reply)) return reply
+      const now = Date.now()
+      const generated = generateApiToken()
+      const days = expiresInDays === undefined ? DEFAULT_EXPIRY_DAYS : expiresInDays
+      const row = (await db.insert(apiTokens).values({
+        name: name.trim(),
+        tokenHash: generated.hash,
+        prefix: generated.prefix,
+        scopes: JSON.stringify(scopes),
+        createdAt: now,
+        expiresAt: typeof days === 'number' ? now + days * DAY_MS : null,
+      }).returning())[0]!
+      await audit.write(audit.actor(identity), 'create', 'api_token', row.id, row.name,
+        audit.snapshot({ name: row.name, permissions: scopes.join(', '), prefix: row.prefix, expiresAt: row.expiresAt }))
+      // The only time the plaintext token leaves the server.
+      return { ...publicToken(row), token: generated.token }
+    })
+
+    app.delete<{ Params: { id: string } }>('/:id', async (req, reply) => {
+      const id = Number(req.params.id)
+      const existing = Number.isSafeInteger(id) ? (await db.select().from(apiTokens).where(eq(apiTokens.id, id)))[0] : undefined
+      if (!existing) return reply.code(404).send({ error: 'Not found' })
+      await db.delete(apiTokens).where(eq(apiTokens.id, id))
+      // A live event stream opened with the token must not outlast it.
+      hooks.onSessionsRevoked?.({ sessionId: `api-token:${id}` })
+      await audit.write(audit.actor(requestIdentity(req)), 'delete', 'api_token', id, existing.name,
+        audit.snapshot({ name: existing.name, permissions: parseScopes(existing.scopes).join(', '), prefix: existing.prefix }))
+      return reply.code(204).send()
+    })
+  }
+
+  return { apiTokenRoutes }
+}

package/src/apiTokens.ts

@@ -1,62 +1,62 @@
-import { createHash, randomBytes } from 'node:crypto'
-import { eq } from 'drizzle-orm'
-import { apiTokens } from './tables.js'
-import type { AuthOptions } from './context.js'
-
-export function createApiTokens(ctx: AuthOptions) {
-  const { db, apiTokenPrefix: API_TOKEN_PREFIX } = ctx
-  const parseScopes = ctx.tokens.parse
-
-  const LAST_USED_RESOLUTION_MS = 60_000
-
-  const RATE_LIMIT_PER_MINUTE = 300
-
-  const RATE_WINDOW_MS = 60_000
-
-  function isApiToken(value: string): boolean {
-    return value.startsWith(API_TOKEN_PREFIX)
-  }
-
-  function hashApiToken(token: string): string {
-    return createHash('sha256').update(token).digest('hex')
-  }
-
-  /** 256 random bits, so a plain SHA-256 is enough to store them. The plaintext is shown once and never kept. */
-  function generateApiToken(): { token: string; hash: string; prefix: string } {
-    const token = `${API_TOKEN_PREFIX}${randomBytes(32).toString('base64url')}`
-    return { token, hash: hashApiToken(token), prefix: token.slice(0, API_TOKEN_PREFIX.length + 6) }
-  }
-
-  /** The token row when the token may be used right now: it exists and has not expired. */
-  async function findUsableApiToken(token: string) {
-    const row = (await db.select().from(apiTokens).where(eq(apiTokens.tokenHash, hashApiToken(token))))[0]
-    if (!row) return null
-    const now = Date.now()
-    if (row.expiresAt !== null && row.expiresAt <= now) return null
-    if (row.lastUsedAt === null || now - row.lastUsedAt >= LAST_USED_RESOLUTION_MS) {
-      await db.update(apiTokens).set({ lastUsedAt: now }).where(eq(apiTokens.id, row.id))
-    }
-    return row
-  }
-
-  const windows = new Map<number, { startedAt: number; count: number }>()
-
-  /** Fixed-window limit per token, so one runaway script cannot starve the API. Returns false once the budget is spent. */
-  function consumeApiTokenBudget(tokenId: number, now = Date.now()): boolean {
-    const current = windows.get(tokenId)
-    if (!current || now - current.startedAt >= RATE_WINDOW_MS) {
-      windows.set(tokenId, { startedAt: now, count: 1 })
-      return true
-    }
-    current.count += 1
-    return current.count <= RATE_LIMIT_PER_MINUTE
-  }
-
-  function resetApiTokenBudgets(): void {
-    windows.clear()
-  }
-
-  return { parseScopes, isApiToken, hashApiToken, generateApiToken, findUsableApiToken, consumeApiTokenBudget, resetApiTokenBudgets }
-}
-
-export type ApiTokens = ReturnType<typeof createApiTokens>
+import { createHash, randomBytes } from 'node:crypto'
+import { eq } from 'drizzle-orm'
+import { apiTokens } from './tables.js'
+import type { AuthOptions } from './context.js'
+
+export function createApiTokens(ctx: AuthOptions) {
+  const { db, apiTokenPrefix: API_TOKEN_PREFIX } = ctx
+  const parseScopes = ctx.tokens.parse
+
+  const LAST_USED_RESOLUTION_MS = 60_000
+
+  const RATE_LIMIT_PER_MINUTE = 300
+
+  const RATE_WINDOW_MS = 60_000
+
+  function isApiToken(value: string): boolean {
+    return value.startsWith(API_TOKEN_PREFIX)
+  }
+
+  function hashApiToken(token: string): string {
+    return createHash('sha256').update(token).digest('hex')
+  }
+
+  /** 256 random bits, so a plain SHA-256 is enough to store them. The plaintext is shown once and never kept. */
+  function generateApiToken(): { token: string; hash: string; prefix: string } {
+    const token = `${API_TOKEN_PREFIX}${randomBytes(32).toString('base64url')}`
+    return { token, hash: hashApiToken(token), prefix: token.slice(0, API_TOKEN_PREFIX.length + 6) }
+  }
+
+  /** The token row when the token may be used right now: it exists and has not expired. */
+  async function findUsableApiToken(token: string) {
+    const row = (await db.select().from(apiTokens).where(eq(apiTokens.tokenHash, hashApiToken(token))))[0]
+    if (!row) return null
+    const now = Date.now()
+    if (row.expiresAt !== null && row.expiresAt <= now) return null
+    if (row.lastUsedAt === null || now - row.lastUsedAt >= LAST_USED_RESOLUTION_MS) {
+      await db.update(apiTokens).set({ lastUsedAt: now }).where(eq(apiTokens.id, row.id))
+    }
+    return row
+  }
+
+  const windows = new Map<number, { startedAt: number; count: number }>()
+
+  /** Fixed-window limit per token, so one runaway script cannot starve the API. Returns false once the budget is spent. */
+  function consumeApiTokenBudget(tokenId: number, now = Date.now()): boolean {
+    const current = windows.get(tokenId)
+    if (!current || now - current.startedAt >= RATE_WINDOW_MS) {
+      windows.set(tokenId, { startedAt: now, count: 1 })
+      return true
+    }
+    current.count += 1
+    return current.count <= RATE_LIMIT_PER_MINUTE
+  }
+
+  function resetApiTokenBudgets(): void {
+    windows.clear()
+  }
+
+  return { parseScopes, isApiToken, hashApiToken, generateApiToken, findUsableApiToken, consumeApiTokenBudget, resetApiTokenBudgets }
+}
+
+export type ApiTokens = ReturnType<typeof createApiTokens>