@binary1702/auth 0.1.1 → 0.2.0

package/INSTALL.md

@@ -40,8 +40,19 @@ const user = await requireUser()   // { id, username } or throws 401
 
 ## More users
 
+From the terminal:
+
 ```bash
 npx @binary1702/auth add-user
 npx @binary1702/auth set-password
 npx @binary1702/auth list-users
 ```
+
+Or let people register themselves at `/auth/sign-up`. Add to `.env.local`:
+
+```
+AUTH_SIGNUP=open             # anyone can create an account
+AUTH_INVITE_CODE=secret      # optional: the form then asks for this code
+```
+
+Without `AUTH_SIGNUP`, sign-up is closed. The one exception is a fresh install with zero users, where `/auth/sign-in` takes you to create the first account.

package/PROMPT.md

@@ -67,7 +67,7 @@ const user = await requireUser()   // { id, username } or throws AuthError (401)
 
 For sign-out, link to `/auth/sign-out`. For client code, `fetch("/auth/session")`.
 
-Do not build a sign-up page. Users are created with `npx @binary1702/auth add-user`.
+Do not build a sign-up page. One exists at `/auth/sign-up`. It is closed by default (except for the very first user on an empty install). To let people register, add `AUTH_SIGNUP=open` to `.env.local`, optionally with `AUTH_INVITE_CODE=<code>` to require a code on the form. Users can also be created with `npx @binary1702/auth add-user`.
 
 ## Deploy
 

package/README.md

@@ -77,6 +77,7 @@ Works in route handlers, server components, and server actions.
 | URL | What it does |
 |---|---|
 | `/auth/sign-in` | The sign-in page. Served by the package, no React, no styling work. |
+| `/auth/sign-up` | Self registration. Closed unless `AUTH_SIGNUP=open`. See [Users](#users). |
 | `/auth/sign-out` | Clears the session and sends you back to sign-in. Link to it. |
 | `/auth/session` | `{ user }` or `{ user: null }` as JSON, for client code. |
 
@@ -84,9 +85,11 @@ Everything else on the site requires a session. Unauthenticated page requests re
 
 ---
 
-## Managing users
+## Users
 
-There is no sign-up page. Users are created from the terminal.
+Two ways in. Pick one or use both.
+
+**From the terminal** (always works):
 
 ```bash
 npx @binary1702/auth add-user           # prompts for username and password
@@ -95,6 +98,18 @@ npx @binary1702/auth set-password ben
 npx @binary1702/auth list-users
 ```
 
+**Self sign-up at `/auth/sign-up`**, controlled by one env var:
+
+| `.env.local` | Who can sign up |
+|---|---|
+| nothing set | Nobody. Except on a fresh install with zero users: `/auth/sign-in` sends you to create the first account. |
+| `AUTH_SIGNUP=open` | Anyone. The sign-in page gets a "Create one" link. |
+| `AUTH_SIGNUP=open` + `AUTH_INVITE_CODE=secret` | Anyone who knows the code. The form gets an invite field. |
+
+Rules on the form: username 2 to 32 characters (letters, numbers, `. _ -`), password at least 8. Accounts are created and signed in immediately. Nothing to approve.
+
+Programmatic: `POST /auth/sign-up` as JSON `{ username, password, invite? }` returns `200 { user }` and the cookie, or `400 / 403 / 404 / 409` with `{ error }`.
+
 ---
 
 ## The two files it wrote

package/dist/cli.js

@@ -234,6 +234,9 @@ Get the user in any route or server component:
   const user = await requireUser()   // { id, username }
 
 Add users later:  npx ${PKG} add-user
+Or let people register themselves at /auth/sign-up:
+  AUTH_SIGNUP=open            in .env.local (anyone)
+  AUTH_INVITE_CODE=<code>     optional, the form then needs it
 `);
 }
 // ── main ──────────────────────────────────────────────────────

package/dist/core/config.d.ts

@@ -2,6 +2,7 @@ export declare const COOKIE_NAME = "auth_session";
 export declare const SESSION_DAYS = 7;
 export declare const SIGN_IN_PATH = "/auth/sign-in";
 export declare const SIGN_OUT_PATH = "/auth/sign-out";
+export declare const SIGN_UP_PATH = "/auth/sign-up";
 export declare const TABLE = "auth_users";
 export declare function getSecret(): string;
 export declare function getDatabaseUrl(): string;

package/dist/core/config.js

@@ -8,6 +8,7 @@ export const COOKIE_NAME = "auth_session";
 export const SESSION_DAYS = 7;
 export const SIGN_IN_PATH = "/auth/sign-in";
 export const SIGN_OUT_PATH = "/auth/sign-out";
+export const SIGN_UP_PATH = "/auth/sign-up";
 export const TABLE = "auth_users";
 export function getSecret() {
     const secret = process.env.AUTH_SECRET;

package/dist/core/html.d.ts

@@ -2,4 +2,12 @@ export declare function signInPage(opts?: {
     error?: string;
     next?: string;
     title?: string;
+    canSignUp?: boolean;
+}): string;
+export declare function signUpPage(opts?: {
+    error?: string;
+    next?: string;
+    title?: string;
+    inviteRequired?: boolean;
+    first?: boolean;
 }): string;

package/dist/core/html.js

@@ -1,20 +1,10 @@
 // ─────────────────────────────────────────────────────────────
-// The sign-in page. Plain HTML served by the route handler,
-// so the consumer never builds a form or a page.
+// The sign-in and sign-up pages. Plain HTML served by the route
+// handler, so the consumer never builds a form or a page.
 // ─────────────────────────────────────────────────────────────
-import { SIGN_IN_PATH } from "./config.js";
+import { SIGN_IN_PATH, SIGN_UP_PATH } from "./config.js";
 const escape = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
-export function signInPage(opts = {}) {
-    const title = escape(opts.title ?? "Sign in");
-    const next = escape(opts.next ?? "/");
-    const error = opts.error ? `<p class="error">${escape(opts.error)}</p>` : "";
-    return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${title}</title>
-<style>
+const STYLE = `
   :root { color-scheme: light dark; --fg: #111; --bg: #fff; --line: #ddd; --muted: #666; --err: #c0392b; }
   @media (prefers-color-scheme: dark) { :root { --fg: #eee; --bg: #111; --line: #333; --muted: #999; --err: #ff6b6b; } }
   * { box-sizing: border-box; }
@@ -27,17 +17,58 @@ export function signInPage(opts = {}) {
   input:focus { outline: 2px solid var(--fg); outline-offset: 1px; }
   button { font: inherit; font-weight: 500; padding: 9px; border: 0; border-radius: 6px; background: var(--fg); color: var(--bg); cursor: pointer; }
   .error { margin: 0; font-size: 13px; color: var(--err); }
-</style>
+  .alt { margin: 4px 0 0; font-size: 13px; color: var(--muted); text-align: center; }
+  .alt a { color: var(--fg); }
+`;
+function page(opts) {
+    const title = escape(opts.title);
+    const next = escape(opts.next ?? "/");
+    const error = opts.error ? `<p class="error">${escape(opts.error)}</p>` : "";
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title}</title>
+<style>${STYLE}</style>
 </head>
 <body>
-<form method="post" action="${SIGN_IN_PATH}">
+<form method="post" action="${opts.action}">
   <h1>${title}</h1>
   ${error}
-  <label>Username <input name="username" autocomplete="username" autofocus required></label>
-  <label>Password <input name="password" type="password" autocomplete="current-password" required></label>
+  ${opts.fields}
   <input type="hidden" name="next" value="${next}">
-  <button type="submit">Sign in</button>
+  <button type="submit">${escape(opts.button)}</button>
+  ${opts.alt ?? ""}
 </form>
 </body>
 </html>`;
 }
+export function signInPage(opts = {}) {
+    const next = opts.next && opts.next !== "/" ? `?next=${encodeURIComponent(opts.next)}` : "";
+    return page({
+        title: opts.title ?? "Sign in",
+        action: SIGN_IN_PATH,
+        error: opts.error,
+        next: opts.next,
+        button: "Sign in",
+        fields: `
+  <label>Username <input name="username" autocomplete="username" autofocus required></label>
+  <label>Password <input name="password" type="password" autocomplete="current-password" required></label>`,
+        alt: opts.canSignUp ? `<p class="alt">No account? <a href="${SIGN_UP_PATH}${next}">Create one</a></p>` : undefined,
+    });
+}
+export function signUpPage(opts = {}) {
+    const next = opts.next && opts.next !== "/" ? `?next=${encodeURIComponent(opts.next)}` : "";
+    return page({
+        title: opts.title ?? (opts.first ? "Create the first account" : "Create account"),
+        action: SIGN_UP_PATH,
+        error: opts.error,
+        next: opts.next,
+        button: "Create account",
+        fields: `
+  <label>Username <input name="username" autocomplete="username" autofocus required></label>
+  <label>Password <input name="password" type="password" autocomplete="new-password" minlength="8" required></label>${opts.inviteRequired ? `\n  <label>Invite code <input name="invite" autocomplete="off" required></label>` : ""}`,
+        alt: opts.first ? undefined : `<p class="alt">Have an account? <a href="${SIGN_IN_PATH}${next}">Sign in</a></p>`,
+    });
+}

package/dist/core/signup.d.ts

@@ -0,0 +1,15 @@
+export type SignupPolicy = {
+    /** Can anyone reach the sign-up page right now? */
+    allowed: boolean;
+    /** Is an invite code required on the form? */
+    inviteRequired: boolean;
+    /** Why it is allowed. "first" skips the invite code: there is nobody to invite you. */
+    reason: "open" | "first" | "closed";
+};
+export declare function signupPolicy(env: {
+    AUTH_SIGNUP?: string;
+    AUTH_INVITE_CODE?: string;
+}, userCount: number): SignupPolicy;
+export declare const USERNAME_RE: RegExp;
+/** Returns an error message, or null when the pair is acceptable. */
+export declare function validateCredentials(username: string, password: string): string | null;

package/dist/core/signup.js

@@ -0,0 +1,26 @@
+// ─────────────────────────────────────────────────────────────
+// Sign-up policy. One pure function, so it can be tested and read.
+//
+//   AUTH_SIGNUP=open          anyone may register at /auth/sign-up
+//   AUTH_INVITE_CODE=<code>   with "open": the form also needs this code
+//   (unset)                   closed, EXCEPT when there are no users yet,
+//                             so a fresh install can create its first
+//                             account in the browser instead of the CLI
+// ─────────────────────────────────────────────────────────────
+export function signupPolicy(env, userCount) {
+    if (userCount === 0)
+        return { allowed: true, inviteRequired: false, reason: "first" };
+    if (env.AUTH_SIGNUP === "open") {
+        return { allowed: true, inviteRequired: Boolean(env.AUTH_INVITE_CODE), reason: "open" };
+    }
+    return { allowed: false, inviteRequired: false, reason: "closed" };
+}
+export const USERNAME_RE = /^[a-z0-9][a-z0-9._-]{1,31}$/i;
+/** Returns an error message, or null when the pair is acceptable. */
+export function validateCredentials(username, password) {
+    if (!USERNAME_RE.test(username))
+        return "Username: 2 to 32 letters, numbers, dots, dashes or underscores.";
+    if (password.length < 8)
+        return "Password must be at least 8 characters.";
+    return null;
+}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { hashPassword, verifyPassword } from "./core/password.ts";
 export { signSession, verifySession, type User } from "./core/session.ts";
 export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword } from "./core/db.ts";
-export { signInPage } from "./core/html.ts";
-export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, getSecret, getDatabaseUrl } from "./core/config.ts";
+export { signInPage, signUpPage } from "./core/html.ts";
+export { signupPolicy, validateCredentials, type SignupPolicy } from "./core/signup.ts";
+export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.ts";

package/dist/index.js

@@ -3,5 +3,6 @@
 export { hashPassword, verifyPassword } from "./core/password.js";
 export { signSession, verifySession } from "./core/session.js";
 export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword } from "./core/db.js";
-export { signInPage } from "./core/html.js";
-export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, getSecret, getDatabaseUrl } from "./core/config.js";
+export { signInPage, signUpPage } from "./core/html.js";
+export { signupPolicy, validateCredentials } from "./core/signup.js";
+export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.js";

package/dist/next/index.js

@@ -7,6 +7,8 @@
 // Serves:
 //   GET  /auth/sign-in    the sign-in page
 //   POST /auth/sign-in    verify, set cookie, redirect to ?next or /
+//   GET  /auth/sign-up    the sign-up page (see core/signup.ts for when)
+//   POST /auth/sign-up    create user, set cookie, redirect
 //   GET  /auth/sign-out   clear cookie, redirect to sign-in
 //   POST /auth/sign-out   same (for fetch callers)
 //   GET  /auth/session    { user } or { user: null }
@@ -17,11 +19,12 @@
 // ─────────────────────────────────────────────────────────────
 import { cookies } from "next/headers.js";
 import { NextResponse } from "next/server.js";
-import { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, getSecret } from "../core/config.js";
+import { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_UP_PATH, getSecret } from "../core/config.js";
 import { signSession, verifySession } from "../core/session.js";
-import { verifyPassword } from "../core/password.js";
-import { findUser } from "../core/db.js";
-import { signInPage } from "../core/html.js";
+import { hashPassword, verifyPassword } from "../core/password.js";
+import { countUsers, createUser, findUser } from "../core/db.js";
+import { signInPage, signUpPage } from "../core/html.js";
+import { signupPolicy, validateCredentials } from "../core/signup.js";
 export class AuthError extends Error {
     status = 401;
     constructor(message = "Unauthorized") {
@@ -67,18 +70,37 @@ function html(body, status = 200) {
 }
 async function readBody(req) {
     const type = req.headers.get("content-type") ?? "";
-    if (type.includes("application/json")) {
-        const b = (await req.json().catch(() => ({})));
-        return { username: String(b.username ?? ""), password: String(b.password ?? ""), next: safeNext(String(b.next ?? "")), json: true };
-    }
-    const f = await req.formData();
+    const get = (b, k) => String((b instanceof FormData ? b.get(k) : b[k]) ?? "");
+    const b = type.includes("application/json")
+        ? (await req.json().catch(() => ({})))
+        : await req.formData();
     return {
-        username: String(f.get("username") ?? ""),
-        password: String(f.get("password") ?? ""),
-        next: safeNext(String(f.get("next") ?? "")),
-        json: false,
+        username: get(b, "username").trim(),
+        password: get(b, "password"),
+        invite: get(b, "invite").trim(),
+        next: safeNext(get(b, "next")),
+        json: type.includes("application/json"),
     };
 }
+async function currentUser(req) {
+    const token = req.cookies.get(COOKIE_NAME)?.value;
+    return token ? verifySession(token, getSecret()) : null;
+}
+/** Sign the user in on a response: cookie + redirect (form) or JSON (fetch). */
+async function signedIn(req, user, next, json) {
+    const token = await signSession(user, getSecret());
+    const res = json ? NextResponse.json({ user }) : NextResponse.redirect(new URL(next, req.url), 303);
+    res.cookies.set(COOKIE_NAME, token, cookieOptions());
+    return res;
+}
+/** Back to a form with ?error=<msg>, keeping ?next. */
+function backTo(req, path, error, next) {
+    const url = new URL(path, req.url);
+    url.searchParams.set("error", error);
+    if (next !== "/")
+        url.searchParams.set("next", next);
+    return NextResponse.redirect(url, 303);
+}
 function signOutResponse(req, json) {
     const res = json
         ? NextResponse.json({ ok: true })
@@ -86,26 +108,37 @@ function signOutResponse(req, json) {
     res.cookies.set(COOKIE_NAME, "", { ...cookieOptions(), maxAge: 0 });
     return res;
 }
+async function policy() {
+    return signupPolicy(process.env, await countUsers());
+}
 // ── handlers ──────────────────────────────────────────────────
 export async function GET(req, ctx) {
     const { path } = await ctx.params;
     const route = path.join("/");
+    const q = req.nextUrl.searchParams;
+    const next = safeNext(q.get("next"));
     if (route === "sign-in") {
-        const next = safeNext(req.nextUrl.searchParams.get("next"));
-        const existing = req.cookies.get(COOKIE_NAME)?.value;
-        if (existing && (await verifySession(existing, getSecret()))) {
+        if (await currentUser(req))
             return NextResponse.redirect(new URL(next, req.url));
-        }
-        const error = req.nextUrl.searchParams.get("error") ? "Wrong username or password." : undefined;
-        return html(signInPage({ next, error }));
+        const p = await policy();
+        // A fresh install has nobody to sign in: go straight to creating the first account.
+        if (p.reason === "first")
+            return NextResponse.redirect(new URL(SIGN_UP_PATH, req.url));
+        const error = q.get("error") === "1" ? "Wrong username or password." : (q.get("error") ?? undefined);
+        return html(signInPage({ next, error, canSignUp: p.allowed }));
+    }
+    if (route === "sign-up") {
+        if (await currentUser(req))
+            return NextResponse.redirect(new URL(next, req.url));
+        const p = await policy();
+        if (!p.allowed)
+            return NextResponse.json({ error: "Sign-up is closed" }, { status: 404 });
+        return html(signUpPage({ next, error: q.get("error") ?? undefined, inviteRequired: p.inviteRequired, first: p.reason === "first" }));
     }
     if (route === "sign-out")
         return signOutResponse(req, false);
-    if (route === "session") {
-        const token = req.cookies.get(COOKIE_NAME)?.value;
-        const user = token ? await verifySession(token, getSecret()) : null;
-        return NextResponse.json({ user });
-    }
+    if (route === "session")
+        return NextResponse.json({ user: await currentUser(req) });
     return NextResponse.json({ error: "Not found" }, { status: 404 });
 }
 export async function POST(req, ctx) {
@@ -113,23 +146,32 @@ export async function POST(req, ctx) {
     const route = path.join("/");
     if (route === "sign-out")
         return signOutResponse(req, true);
-    if (route !== "sign-in")
-        return NextResponse.json({ error: "Not found" }, { status: 404 });
-    const { username, password, next, json } = await readBody(req);
-    const row = username && password ? await findUser(username.trim()) : null;
-    const ok = row ? await verifyPassword(password, row.password_hash) : false;
-    if (!row || !ok) {
-        if (json)
-            return NextResponse.json({ error: "Wrong username or password" }, { status: 401 });
-        const url = new URL(SIGN_IN_PATH, req.url);
-        url.searchParams.set("error", "1");
-        if (next !== "/")
-            url.searchParams.set("next", next);
-        return NextResponse.redirect(url, 303);
+    if (route === "sign-in") {
+        const { username, password, next, json } = await readBody(req);
+        const row = username && password ? await findUser(username) : null;
+        const ok = row ? await verifyPassword(password, row.password_hash) : false;
+        if (!row || !ok) {
+            if (json)
+                return NextResponse.json({ error: "Wrong username or password" }, { status: 401 });
+            return backTo(req, SIGN_IN_PATH, "1", next);
+        }
+        return signedIn(req, { id: row.id, username: row.username }, next, json);
     }
-    const user = { id: row.id, username: row.username };
-    const token = await signSession(user, getSecret());
-    const res = json ? NextResponse.json({ user }) : NextResponse.redirect(new URL(next, req.url), 303);
-    res.cookies.set(COOKIE_NAME, token, cookieOptions());
-    return res;
+    if (route === "sign-up") {
+        const { username, password, invite, next, json } = await readBody(req);
+        const p = await policy();
+        const fail = (msg, status = 400) => json ? NextResponse.json({ error: msg }, { status }) : backTo(req, SIGN_UP_PATH, msg, next);
+        if (!p.allowed)
+            return NextResponse.json({ error: "Sign-up is closed" }, { status: 404 });
+        if (p.inviteRequired && invite !== process.env.AUTH_INVITE_CODE)
+            return fail("Wrong invite code.", 403);
+        const invalid = validateCredentials(username, password);
+        if (invalid)
+            return fail(invalid);
+        if (await findUser(username))
+            return fail("That username is taken.", 409);
+        const user = await createUser(username, await hashPassword(password));
+        return signedIn(req, user, next, json);
+    }
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@binary1702/auth",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Username + password auth for Next.js. One command: npx @binary1702/auth",
   "type": "module",
   "repository": {