@binary1702/auth 0.2.0 → 0.2.1

package/dist/cli.js

@@ -197,22 +197,22 @@ async function stepSchema() {
     await ensureSchema().catch((e) => fail(`Could not reach the database: ${e.message}`));
     done("auth_users table ready");
 }
-async function createUserInteractive(presetName) {
+async function createUserInteractive(presetEmail) {
     const { createUser, findUser } = await db();
     const { hashPassword } = await import("./core/password.js");
-    const username = presetName ?? (await ask("Username"));
-    if (!username)
-        fail("Username is required.");
-    if (await findUser(username))
-        fail(`User "${username}" already exists.`);
+    const email = (presetEmail ?? (await ask("Email"))).trim().toLowerCase();
+    if (!email)
+        fail("Email is required.");
+    if (await findUser(email))
+        fail(`User "${email}" already exists.`);
     const password = await ask("Password", { hidden: true });
     if (password.length < 8)
         fail("Password must be at least 8 characters.");
     const again = await ask("Password again", { hidden: true });
     if (password !== again)
         fail("Passwords do not match.");
-    await createUser(username, await hashPassword(password));
-    done(`user "${username}" created`);
+    await createUser(email, await hashPassword(password));
+    done(`user "${email}" created`);
 }
 async function stepFirstUser() {
     const { countUsers } = await db();
@@ -231,7 +231,7 @@ ${c.bold("Done.")} Start the dev server and open ${c.bold("/auth/sign-in")}.
 Get the user in any route or server component:
 
   import { requireUser } from "${PKG}/next"
-  const user = await requireUser()   // { id, username }
+  const user = await requireUser()   // { id, email }
 
 Add users later:  npx ${PKG} add-user
 Or let people register themselves at /auth/sign-up:
@@ -245,8 +245,8 @@ async function main() {
     console.log(`\n${c.bold(PKG)}\n`);
     if (cmd === "help" || cmd === "--help" || cmd === "-h") {
         console.log(`  npx ${PKG}                    set up auth in this project (safe to re-run)
-  npx ${PKG} add-user [name]    create a user
-  npx ${PKG} set-password [name]
+  npx ${PKG} add-user [email]   create a user
+  npx ${PKG} set-password [email]
   npx ${PKG} list-users
 `);
         return;
@@ -259,16 +259,16 @@ async function main() {
             await createUserInteractive(arg);
         if (cmd === "list-users") {
             for (const u of await d.listUsers())
-                console.log(`  ${u.username}  ${c.dim(u.id)}`);
+                console.log(`  ${u.email}  ${c.dim(u.id)}`);
         }
         if (cmd === "set-password") {
-            const username = arg ?? (await ask("Username"));
+            const email = (arg ?? (await ask("Email"))).trim().toLowerCase();
             const password = await ask("New password", { hidden: true });
             if (password.length < 8)
                 fail("Password must be at least 8 characters.");
             const { hashPassword } = await import("./core/password.js");
-            const ok = await d.setPassword(username, await hashPassword(password));
-            ok ? done(`password updated for "${username}"`) : fail(`No user "${username}".`);
+            const ok = await d.setPassword(email, await hashPassword(password));
+            ok ? done(`password updated for "${email}"`) : fail(`No user "${email}".`);
         }
         console.log();
         return;

package/dist/core/db.d.ts

@@ -3,14 +3,14 @@ import type { User } from "./session.ts";
 export declare function ensureSchema(): Promise<void>;
 type Row = {
     id: string;
-    username: string;
+    email: string;
     password_hash: string;
 };
-export declare function findUser(username: string): Promise<Row | null>;
-export declare function createUser(username: string, passwordHash: string): Promise<User>;
+export declare function findUser(email: string): Promise<Row | null>;
+export declare function createUser(email: string, passwordHash: string): Promise<User>;
 export declare function countUsers(): Promise<number>;
 export declare function listUsers(): Promise<(User & {
     created_at: string;
 })[]>;
-export declare function setPassword(username: string, passwordHash: string): Promise<boolean>;
+export declare function setPassword(email: string, passwordHash: string): Promise<boolean>;
 export { TABLE };

package/dist/core/db.js

@@ -1,7 +1,7 @@
 // ─────────────────────────────────────────────────────────────
 // Storage. One table, owned by this package.
 //
-//   auth_users (id, username, password_hash, created_at)
+//   auth_users (id, email, password_hash, created_at)
 //
 // ensureSchema() is idempotent and memoized per process, so route
 // handlers can call it on every request for free after the first.
@@ -18,7 +18,7 @@ export function ensureSchema() {
         await sql() `
       CREATE TABLE IF NOT EXISTS auth_users (
         id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-        username      TEXT NOT NULL UNIQUE,
+        email         TEXT NOT NULL UNIQUE,
         password_hash TEXT NOT NULL,
         created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
       )
@@ -28,19 +28,19 @@ export function ensureSchema() {
         throw err;
     }));
 }
-export async function findUser(username) {
+export async function findUser(email) {
     await ensureSchema();
     const rows = (await sql() `
-    SELECT id, username, password_hash FROM auth_users WHERE username = ${username}
+    SELECT id, email, password_hash FROM auth_users WHERE email = ${email}
   `);
     return rows[0] ?? null;
 }
-export async function createUser(username, passwordHash) {
+export async function createUser(email, passwordHash) {
     await ensureSchema();
     const [row] = (await sql() `
-    INSERT INTO auth_users (username, password_hash)
-    VALUES (${username}, ${passwordHash})
-    RETURNING id, username
+    INSERT INTO auth_users (email, password_hash)
+    VALUES (${email}, ${passwordHash})
+    RETURNING id, email
   `);
     return row;
 }
@@ -52,13 +52,13 @@ export async function countUsers() {
 export async function listUsers() {
     await ensureSchema();
     return (await sql() `
-    SELECT id, username, created_at FROM auth_users ORDER BY created_at
+    SELECT id, email, created_at FROM auth_users ORDER BY created_at
   `);
 }
-export async function setPassword(username, passwordHash) {
+export async function setPassword(email, passwordHash) {
     await ensureSchema();
     const rows = (await sql() `
-    UPDATE auth_users SET password_hash = ${passwordHash} WHERE username = ${username} RETURNING id
+    UPDATE auth_users SET password_hash = ${passwordHash} WHERE email = ${email} RETURNING id
   `);
     return rows.length > 0;
 }

package/dist/core/html.js

@@ -53,7 +53,7 @@ export function signInPage(opts = {}) {
         next: opts.next,
         button: "Sign in",
         fields: `
-  <label>Username <input name="username" autocomplete="username" autofocus required></label>
+  <label>Email <input name="email" type="email" autocomplete="email" autofocus required></label>
   <label>Password <input name="password" type="password" autocomplete="current-password" required></label>`,
         alt: opts.canSignUp ? `<p class="alt">No account? <a href="${SIGN_UP_PATH}${next}">Create one</a></p>` : undefined,
     });
@@ -67,7 +67,7 @@ export function signUpPage(opts = {}) {
         next: opts.next,
         button: "Create account",
         fields: `
-  <label>Username <input name="username" autocomplete="username" autofocus required></label>
+  <label>Email <input name="email" type="email" autocomplete="email" autofocus required></label>
   <label>Password <input name="password" type="password" autocomplete="new-password" minlength="8" required></label>${opts.inviteRequired ? `\n  <label>Invite code <input name="invite" autocomplete="off" required></label>` : ""}`,
         alt: opts.first ? undefined : `<p class="alt">Have an account? <a href="${SIGN_IN_PATH}${next}">Sign in</a></p>`,
     });

package/dist/core/session.d.ts

@@ -1,6 +1,6 @@
 export type User = {
     id: string;
-    username: string;
+    email: string;
 };
 export declare function signSession(user: User, secret: string): Promise<string>;
 export declare function verifySession(token: string, secret: string): Promise<User | null>;

package/dist/core/session.js

@@ -9,7 +9,7 @@ import { SignJWT, jwtVerify } from "jose";
 import { SESSION_DAYS } from "./config.js";
 const key = (secret) => new TextEncoder().encode(secret);
 export async function signSession(user, secret) {
-    return new SignJWT({ username: user.username })
+    return new SignJWT({ email: user.email })
         .setProtectedHeader({ alg: "HS256" })
         .setSubject(user.id)
         .setIssuedAt()
@@ -19,9 +19,9 @@ export async function signSession(user, secret) {
 export async function verifySession(token, secret) {
     try {
         const { payload } = await jwtVerify(token, key(secret), { algorithms: ["HS256"] });
-        if (typeof payload.sub !== "string" || typeof payload.username !== "string")
+        if (typeof payload.sub !== "string" || typeof payload.email !== "string")
             return null;
-        return { id: payload.sub, username: payload.username };
+        return { id: payload.sub, email: payload.email };
     }
     catch {
         return null;

package/dist/core/signup.d.ts

@@ -10,6 +10,6 @@ export declare function signupPolicy(env: {
     AUTH_SIGNUP?: string;
     AUTH_INVITE_CODE?: string;
 }, userCount: number): SignupPolicy;
-export declare const USERNAME_RE: RegExp;
+export declare const EMAIL_RE: RegExp;
 /** Returns an error message, or null when the pair is acceptable. */
-export declare function validateCredentials(username: string, password: string): string | null;
+export declare function validateCredentials(email: string, password: string): string | null;

package/dist/core/signup.js

@@ -15,11 +15,11 @@ export function signupPolicy(env, userCount) {
     }
     return { allowed: false, inviteRequired: false, reason: "closed" };
 }
-export const USERNAME_RE = /^[a-z0-9][a-z0-9._-]{1,31}$/i;
+export const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 /** Returns an error message, or null when the pair is acceptable. */
-export function validateCredentials(username, password) {
-    if (!USERNAME_RE.test(username))
-        return "Username: 2 to 32 letters, numbers, dots, dashes or underscores.";
+export function validateCredentials(email, password) {
+    if (!EMAIL_RE.test(email))
+        return "Please enter a valid email address.";
     if (password.length < 8)
         return "Password must be at least 8 characters.";
     return null;

package/dist/next/index.js

@@ -14,8 +14,8 @@
 //   GET  /auth/session    { user } or { user: null }
 //
 // Use anywhere on the server:
-//   const user = await requireUser()   // { id, username } or throws AuthError(401)
-//   const user = await getUser()       // { id, username } or null
+//   const user = await requireUser()   // { id, email } or throws AuthError(401)
+//   const user = await getUser()       // { id, email } or null
 // ─────────────────────────────────────────────────────────────
 import { cookies } from "next/headers.js";
 import { NextResponse } from "next/server.js";
@@ -75,7 +75,7 @@ async function readBody(req) {
         ? (await req.json().catch(() => ({})))
         : await req.formData();
     return {
-        username: get(b, "username").trim(),
+        email: get(b, "email").trim().toLowerCase(),
         password: get(b, "password"),
         invite: get(b, "invite").trim(),
         next: safeNext(get(b, "next")),
@@ -124,7 +124,7 @@ export async function GET(req, ctx) {
         // A fresh install has nobody to sign in: go straight to creating the first account.
         if (p.reason === "first")
             return NextResponse.redirect(new URL(SIGN_UP_PATH, req.url));
-        const error = q.get("error") === "1" ? "Wrong username or password." : (q.get("error") ?? undefined);
+        const error = q.get("error") === "1" ? "Wrong email or password." : (q.get("error") ?? undefined);
         return html(signInPage({ next, error, canSignUp: p.allowed }));
     }
     if (route === "sign-up") {
@@ -147,30 +147,30 @@ export async function POST(req, ctx) {
     if (route === "sign-out")
         return signOutResponse(req, true);
     if (route === "sign-in") {
-        const { username, password, next, json } = await readBody(req);
-        const row = username && password ? await findUser(username) : null;
+        const { email, password, next, json } = await readBody(req);
+        const row = email && password ? await findUser(email) : null;
         const ok = row ? await verifyPassword(password, row.password_hash) : false;
         if (!row || !ok) {
             if (json)
-                return NextResponse.json({ error: "Wrong username or password" }, { status: 401 });
+                return NextResponse.json({ error: "Wrong email or password" }, { status: 401 });
             return backTo(req, SIGN_IN_PATH, "1", next);
         }
-        return signedIn(req, { id: row.id, username: row.username }, next, json);
+        return signedIn(req, { id: row.id, email: row.email }, next, json);
     }
     if (route === "sign-up") {
-        const { username, password, invite, next, json } = await readBody(req);
+        const { email, password, invite, next, json } = await readBody(req);
         const p = await policy();
         const fail = (msg, status = 400) => json ? NextResponse.json({ error: msg }, { status }) : backTo(req, SIGN_UP_PATH, msg, next);
         if (!p.allowed)
             return NextResponse.json({ error: "Sign-up is closed" }, { status: 404 });
         if (p.inviteRequired && invite !== process.env.AUTH_INVITE_CODE)
             return fail("Wrong invite code.", 403);
-        const invalid = validateCredentials(username, password);
+        const invalid = validateCredentials(email, password);
         if (invalid)
             return fail(invalid);
-        if (await findUser(username))
-            return fail("That username is taken.", 409);
-        const user = await createUser(username, await hashPassword(password));
+        if (await findUser(email))
+            return fail("That email is already registered.", 409);
+        const user = await createUser(email, await hashPassword(password));
         return signedIn(req, user, next, json);
     }
     return NextResponse.json({ error: "Not found" }, { status: 404 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@binary1702/auth",
-  "version": "0.2.0",
-  "description": "Username + password auth for Next.js. One command: npx @binary1702/auth",
+  "version": "0.2.1",
+  "description": "Email + password auth for Next.js. One command: npx @binary1702/auth",
   "type": "module",
   "repository": {
     "type": "git",