@binary1702/auth 0.2.4 → 0.3.0

package/dist/core/reset.d.ts

@@ -0,0 +1,9 @@
+import type { EmailMessage } from "./email.ts";
+export declare const FORGOT_PATH = "/auth/forgot";
+export declare const RESET_PATH = "/auth/reset";
+export declare const RESET_TTL_SECONDS: number;
+export declare const FORGOT_SENT = "If that address has an account, we sent a link to reset the password.";
+export declare const RESET_LINK_INVALID = "This reset link is invalid, already used, or older than an hour.";
+/** The absolute link that goes in the email */
+export declare function resetLink(base: string, rawToken: string): string;
+export declare function resetEmail(to: string, link: string, site: string): EmailMessage;

package/dist/core/reset.js

@@ -0,0 +1,31 @@
+// ─────────────────────────────────────────────────────────────
+// Password reset. Pure: the link, the email, the constants.
+//
+//   POST /auth/forgot   always answers "if that address has an account,
+//                       we sent a link", so it never reveals who exists.
+//                       When the user exists: a `reset` token (1 h) in
+//                       an emailed link to /auth/reset?token=…
+//   POST /auth/reset    consumes the token, sets the password (which
+//                       bumps session_epoch: every old session dies),
+//                       marks the email verified (the link proved it),
+//                       signs the user in.
+// ─────────────────────────────────────────────────────────────
+export const FORGOT_PATH = "/auth/forgot";
+export const RESET_PATH = "/auth/reset";
+export const RESET_TTL_SECONDS = 60 * 60;
+export const FORGOT_SENT = "If that address has an account, we sent a link to reset the password.";
+export const RESET_LINK_INVALID = "This reset link is invalid, already used, or older than an hour.";
+/** The absolute link that goes in the email */
+export function resetLink(base, rawToken) {
+    const url = new URL(RESET_PATH, base);
+    url.searchParams.set("token", rawToken);
+    return url.toString();
+}
+export function resetEmail(to, link, site) {
+    return {
+        to,
+        subject: `Reset your password for ${site}`,
+        text: `Someone asked to reset the password for this address on ${site}. If that was you, open the link below. It works once and expires in one hour.\n\n${link}\n\nIf it was not you, ignore this email: nothing changes until the link is used.`,
+        html: `<p>Someone asked to reset the password for this address on ${site}. If that was you, open the link below. It works once and expires in one hour.</p><p><a href="${link}">${link}</a></p><p>If it was not you, ignore this email: nothing changes until the link is used.</p>`,
+    };
+}

package/dist/core/session.d.ts

@@ -2,5 +2,26 @@ export type User = {
     id: string;
     email: string;
 };
-export declare function signSession(user: User, secret: string): Promise<string>;
-export declare function verifySession(token: string, secret: string): Promise<User | null>;
+/** What a valid token says: who, and under which epoch it was signed */
+export type Claim = User & {
+    epoch: number;
+};
+export declare const ISSUER = "@binary1702/auth";
+export declare const AUDIENCE = "session";
+/** Tokens issued at or after this moment must carry iss and aud (0.3.0's release day) */
+export declare const CLAIMS_REQUIRED_FROM: number;
+export declare function signSession(user: User & {
+    epoch?: number;
+}, secret: string, days?: number): Promise<string>;
+/** The iss/aud rule: required for new tokens, forgiven for old ones. Pure. */
+export declare function claimsAcceptable(payload: {
+    iat?: number;
+    iss?: string;
+    aud?: string | string[];
+}): boolean;
+export declare function verifySession(token: string, secret: string): Promise<Claim | null>;
+/**
+ * The revocation rule. `epoch` is the user's current session_epoch,
+ * or null when the user no longer exists.
+ */
+export declare function isCurrent(claim: Claim, epoch: number | null): boolean;

package/dist/core/session.js

@@ -1,29 +1,67 @@
 // ─────────────────────────────────────────────────────────────
 // Session token. A signed JWT (HS256) carried in an httpOnly cookie.
 //
-// Stateless: verifying needs the secret only, never the database.
-// That is what lets the proxy run on every request at zero cost.
-// Trade-off: a token cannot be revoked before it expires (7 days).
+// Two gates, two costs:
+//   signature  verifySession()  needs the secret only, never the
+//              database. The proxy runs this on every request, free.
+//   epoch      isCurrent()      the token carries the user's
+//              session_epoch from when it was signed. getSession()
+//              looks the user up and compares. Deleting the user (no
+//              row) or bumping the epoch (password change, sign-out-
+//              everywhere) makes every older token stop matching.
+//
+// So a revoked token still passes the proxy and loads a page shell,
+// but getSession()/requireSession() say no, and those guard the data.
+//
+// Since 0.3.0 tokens carry iss and aud, so a token minted by another
+// app that happens to share the secret is refused. Tokens from before
+// have neither; they are accepted only if signed before the cutoff.
 // ─────────────────────────────────────────────────────────────
 import { SignJWT, jwtVerify } from "jose";
 import { SESSION_DAYS } from "./config.js";
+export const ISSUER = "@binary1702/auth";
+export const AUDIENCE = "session";
+/** Tokens issued at or after this moment must carry iss and aud (0.3.0's release day) */
+export const CLAIMS_REQUIRED_FROM = Date.UTC(2026, 9, 22) / 1000;
 const key = (secret) => new TextEncoder().encode(secret);
-export async function signSession(user, secret) {
-    return new SignJWT({ email: user.email })
+export async function signSession(user, secret, days = SESSION_DAYS) {
+    return new SignJWT({ email: user.email, ep: user.epoch ?? 0 })
         .setProtectedHeader({ alg: "HS256" })
         .setSubject(user.id)
+        .setIssuer(ISSUER)
+        .setAudience(AUDIENCE)
         .setIssuedAt()
-        .setExpirationTime(`${SESSION_DAYS}d`)
+        .setExpirationTime(`${days}d`)
         .sign(key(secret));
 }
+/** The iss/aud rule: required for new tokens, forgiven for old ones. Pure. */
+export function claimsAcceptable(payload) {
+    const aud = Array.isArray(payload.aud) ? payload.aud : payload.aud ? [payload.aud] : [];
+    const has = payload.iss === ISSUER && aud.includes(AUDIENCE);
+    if (has)
+        return true;
+    return typeof payload.iat === "number" && payload.iat < CLAIMS_REQUIRED_FROM;
+}
 export async function verifySession(token, secret) {
     try {
         const { payload } = await jwtVerify(token, key(secret), { algorithms: ["HS256"] });
         if (typeof payload.sub !== "string" || typeof payload.email !== "string")
             return null;
-        return { id: payload.sub, email: payload.email };
+        if (!claimsAcceptable(payload))
+            return null;
+        // Tokens from before epochs existed carry no `ep`: they count as 0,
+        // so upgrading the package signs nobody out
+        const epoch = typeof payload.ep === "number" ? payload.ep : 0;
+        return { id: payload.sub, email: payload.email, epoch };
     }
     catch {
         return null;
     }
 }
+/**
+ * The revocation rule. `epoch` is the user's current session_epoch,
+ * or null when the user no longer exists.
+ */
+export function isCurrent(claim, epoch) {
+    return epoch !== null && claim.epoch === epoch;
+}

package/dist/core/signup.d.ts

@@ -1,3 +1,4 @@
+import type { SignupMode } from "./options.ts";
 export type SignupPolicy = {
     /** Can anyone reach the sign-up page right now? */
     allowed: boolean;
@@ -6,12 +7,14 @@ export type SignupPolicy = {
     /** Why it is allowed. "first" skips the invite code: there is nobody to invite you. */
     reason: "open" | "first" | "closed";
 };
-export declare function signupPolicy(env: {
-    AUTH_SIGNUP?: string;
-    AUTH_INVITE_CODE?: string;
-}, userCount: number): SignupPolicy;
+export declare function signupPolicy(mode: SignupMode, userCount: number): SignupPolicy;
 export declare const EMAIL_RE: RegExp;
+export declare const PASSWORD_MIN = 8;
+/** scrypt on a megabyte of password is a denial of service; cap before hashing */
+export declare const PASSWORD_MAX = 256;
+/** Returns an error message, or null when the password is acceptable. */
+export declare function validatePassword(password: string): string | null;
 /** Returns an error message, or null when the pair is acceptable. */
-export declare function validateCredentials(email: string, password: string, env?: {
-    AUTH_EMAIL_DOMAIN?: string;
+export declare function validateCredentials(email: string, password: string, opts?: {
+    emailDomain?: string;
 }): string | null;

package/dist/core/signup.js

@@ -1,30 +1,41 @@
 // ─────────────────────────────────────────────────────────────
-// Sign-up policy. One pure function, so it can be tested and read.
+// Sign-up policy. Pure functions, so they can be tested and read.
 //
-//   AUTH_SIGNUP=open          anyone may register at /auth/sign-up
-//   AUTH_INVITE_CODE=<code>   with "open": the form also needs this code
-//   (unset)                   closed, EXCEPT when there are no users yet,
-//                             so a fresh install can create its first
-//                             account in the browser instead of the CLI
+//   signup: open      anyone may register at /auth/sign-up
+//   signup: invite    anyone who knows inviteCode
+//   signup: closed    nobody, EXCEPT when there are no users yet, so a
+//                     fresh install can create its first account in the
+//                     browser instead of the CLI
+// (b17_auth.yaml keys; AUTH_SIGNUP=open and AUTH_INVITE_CODE map onto them)
 // ─────────────────────────────────────────────────────────────
-export function signupPolicy(env, userCount) {
+export function signupPolicy(mode, userCount) {
     if (userCount === 0)
         return { allowed: true, inviteRequired: false, reason: "first" };
-    if (env.AUTH_SIGNUP === "open") {
-        return { allowed: true, inviteRequired: Boolean(env.AUTH_INVITE_CODE), reason: "open" };
-    }
+    if (mode === "open")
+        return { allowed: true, inviteRequired: false, reason: "open" };
+    if (mode === "invite")
+        return { allowed: true, inviteRequired: true, reason: "open" };
     return { allowed: false, inviteRequired: false, reason: "closed" };
 }
 export const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+export const PASSWORD_MIN = 8;
+/** scrypt on a megabyte of password is a denial of service; cap before hashing */
+export const PASSWORD_MAX = 256;
+/** Returns an error message, or null when the password is acceptable. */
+export function validatePassword(password) {
+    if (password.length < PASSWORD_MIN)
+        return `Password must be at least ${PASSWORD_MIN} characters.`;
+    if (password.length > PASSWORD_MAX)
+        return `Password must be at most ${PASSWORD_MAX} characters.`;
+    return null;
+}
 /** Returns an error message, or null when the pair is acceptable. */
-export function validateCredentials(email, password, env) {
+export function validateCredentials(email, password, opts) {
     if (!EMAIL_RE.test(email))
         return "Please enter a valid email address.";
-    const domain = env?.AUTH_EMAIL_DOMAIN;
+    const domain = opts?.emailDomain;
     if (domain && !email.toLowerCase().endsWith(`@${domain.toLowerCase()}`)) {
         return `Only @${domain} emails are allowed.`;
     }
-    if (password.length < 8)
-        return "Password must be at least 8 characters.";
-    return null;
+    return validatePassword(password);
 }

package/dist/core/tokens.d.ts

@@ -0,0 +1,29 @@
+import { type Db } from "./db.ts";
+export type TokenKind = "verify" | "reset" | "magic" | "invite";
+/** What a consumed token tells the handler */
+export type Token = {
+    id: string;
+    userId: string;
+    kind: TokenKind;
+    meta: Record<string, unknown>;
+};
+export type TokenRow = {
+    id: string;
+    user_id: string;
+    kind: TokenKind;
+    token_hash: string;
+    expires_at: string | Date;
+    used_at: string | Date | null;
+    meta: Record<string, unknown> | null;
+};
+/** 256 bits of randomness, URL-safe: 43 characters */
+export declare function newRawToken(): string;
+export declare function hashToken(raw: string): string;
+/** Constant-time equality of two hashes, false on a length mismatch instead of throwing */
+export declare function sameHash(a: string, b: string): boolean;
+/** Why a stored token may or may not be consumed right now */
+export declare function tokenState(row: Pick<TokenRow, "expires_at" | "used_at">, now?: Date): "ok" | "used" | "expired";
+/** Create a token for the user and return the raw value to put in a link. */
+export declare function issueToken(userId: string, kind: TokenKind, ttlSeconds: number, meta?: Record<string, unknown>, store?: Db): Promise<string>;
+/** Redeem a raw token of the given kind. Null for anything but a live, unused token; works once. */
+export declare function consumeToken(raw: string, kind: TokenKind, store?: Db, now?: Date): Promise<Token | null>;

package/dist/core/tokens.js

@@ -0,0 +1,64 @@
+// ─────────────────────────────────────────────────────────────
+// One-time tokens: the thing in an emailed link.
+//
+//   issueToken()    32 random bytes → base64url. Only the SHA-256 is
+//                   stored, so a database leak gives away no live link.
+//   consumeToken()  returns the row once: unknown, expired, used, or
+//                   wrong kind all come back null, and the claim is one
+//                   UPDATE ... WHERE used_at IS NULL, so two clicks at
+//                   the same instant cannot both succeed.
+//
+// Kinds in use: verify (email), reset (password).
+// Reserved for later versions: magic (sign-in link), invite (org).
+//
+// The rules are pure functions; the store is injected (see core/db.ts).
+// ─────────────────────────────────────────────────────────────
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { db, ensureSchema } from "./db.js";
+// ── pure ──────────────────────────────────────────────────────
+/** 256 bits of randomness, URL-safe: 43 characters */
+export function newRawToken() {
+    return randomBytes(32).toString("base64url");
+}
+export function hashToken(raw) {
+    return createHash("sha256").update(raw).digest("hex");
+}
+/** Constant-time equality of two hashes, false on a length mismatch instead of throwing */
+export function sameHash(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+/** Why a stored token may or may not be consumed right now */
+export function tokenState(row, now = new Date()) {
+    if (row.used_at)
+        return "used";
+    if (new Date(row.expires_at).getTime() <= now.getTime())
+        return "expired";
+    return "ok";
+}
+// ── store ─────────────────────────────────────────────────────
+/** Create a token for the user and return the raw value to put in a link. */
+export async function issueToken(userId, kind, ttlSeconds, meta = {}, store = db()) {
+    await ensureSchema(store);
+    const raw = newRawToken();
+    const expiresAt = new Date(Date.now() + ttlSeconds * 1000).toISOString();
+    await store.query(`INSERT INTO tokens (user_id, kind, token_hash, expires_at, meta) VALUES ($1, $2, $3, $4, $5::jsonb)`, [userId, kind, hashToken(raw), expiresAt, JSON.stringify(meta)]);
+    // Housekeeping: rows nobody can use any more
+    await store.query(`DELETE FROM tokens WHERE expires_at < now() - interval '7 days'`);
+    return raw;
+}
+/** Redeem a raw token of the given kind. Null for anything but a live, unused token; works once. */
+export async function consumeToken(raw, kind, store = db(), now = new Date()) {
+    if (!/^[A-Za-z0-9_-]{43}$/.test(raw))
+        return null;
+    await ensureSchema(store);
+    const hash = hashToken(raw);
+    const [row] = await store.query(`SELECT id, user_id, kind, token_hash, expires_at, used_at, meta FROM tokens WHERE token_hash = $1 AND kind = $2`, [hash, kind]);
+    if (!row || !sameHash(hash, row.token_hash) || tokenState(row, now) !== "ok")
+        return null;
+    const claimed = await store.query(`UPDATE tokens SET used_at = now() WHERE id = $1 AND used_at IS NULL RETURNING id`, [row.id]);
+    if (claimed.length === 0)
+        return null;
+    return { id: row.id, userId: row.user_id, kind: row.kind, meta: row.meta ?? {} };
+}

package/dist/core/verify.d.ts

@@ -0,0 +1,8 @@
+import type { EmailMessage } from "./email.ts";
+export declare const VERIFY_PATH = "/auth/verify";
+export declare const VERIFY_TTL_SECONDS: number;
+/** The gate: may a user with this verification state have a session? */
+export declare function mayAccess(verified: boolean, requireVerified: boolean): boolean;
+/** The absolute link that goes in the email */
+export declare function verifyLink(base: string, rawToken: string, next?: string): string;
+export declare function verifyEmail(to: string, link: string, site: string): EmailMessage;

package/dist/core/verify.js

@@ -0,0 +1,33 @@
+// ─────────────────────────────────────────────────────────────
+// Email verification policy and the email itself. Pure.
+//
+//   requireVerified: true   (b17_auth.yaml, or AUTH_REQUIRE_VERIFIED=true)
+//                           an unverified user gets no session: getUser()
+//                           is null, sign-in says "check your email".
+//                           Default off, so existing installs change nothing.
+//
+// Sign-up always issues a `verify` token (24 h) and emails the link;
+// the flag only decides whether that gate is closed meanwhile.
+// ─────────────────────────────────────────────────────────────
+export const VERIFY_PATH = "/auth/verify";
+export const VERIFY_TTL_SECONDS = 24 * 60 * 60;
+/** The gate: may a user with this verification state have a session? */
+export function mayAccess(verified, requireVerified) {
+    return verified || !requireVerified;
+}
+/** The absolute link that goes in the email */
+export function verifyLink(base, rawToken, next) {
+    const url = new URL(VERIFY_PATH, base);
+    url.searchParams.set("token", rawToken);
+    if (next && next !== "/")
+        url.searchParams.set("next", next);
+    return url.toString();
+}
+export function verifyEmail(to, link, site) {
+    return {
+        to,
+        subject: `Verify your email for ${site}`,
+        text: `Confirm this is your address by opening the link below. It works once and expires in 24 hours.\n\n${link}\n\nIf you did not create an account, ignore this email.`,
+        html: `<p>Confirm this is your address by opening the link below. It works once and expires in 24 hours.</p><p><a href="${link}">${link}</a></p><p>If you did not create an account, ignore this email.</p>`,
+    };
+}

package/dist/core/yaml.d.ts

@@ -0,0 +1,10 @@
+export type YamlTree = {
+    [key: string]: string | YamlTree;
+};
+export declare class YamlError extends Error {
+    line: number;
+    constructor(message: string, line: number);
+}
+export declare function parseYaml(text: string): YamlTree;
+/** Words of a space-separated value. "" → []. */
+export declare function words(value: string | undefined): string[];

package/dist/core/yaml.js

@@ -0,0 +1,85 @@
+// ─────────────────────────────────────────────────────────────
+// The subset of YAML that b17_auth.yaml uses. No dependency.
+//
+//   key: value          a string (quotes optional; "…" or '…' strip them)
+//   key:                a section; children indented deeper than the key
+//   # …                 a comment, whole line or after a value
+//   no arrays, no anchors, no multi-line scalars. Lists are words
+//   separated by spaces, split by whoever reads the key.
+//
+// Everything is a string or a section. Typing happens in options.ts,
+// which knows what each key means. Pure.
+// ─────────────────────────────────────────────────────────────
+export class YamlError extends Error {
+    line;
+    constructor(message, line) {
+        super(`b17_auth.yaml line ${line}: ${message}`);
+        this.name = "YamlError";
+        this.line = line;
+    }
+}
+/** Strip a trailing comment, respecting quotes. */
+function stripComment(s) {
+    let quote = null;
+    for (let i = 0; i < s.length; i++) {
+        const c = s[i];
+        if (quote) {
+            if (c === quote)
+                quote = null;
+        }
+        else if (c === '"' || c === "'") {
+            quote = c;
+        }
+        else if (c === "#" && (i === 0 || /\s/.test(s[i - 1]))) {
+            return s.slice(0, i);
+        }
+    }
+    return s;
+}
+function unquote(v) {
+    const m = v.match(/^(["'])(.*)\1$/s);
+    return m ? m[2] : v;
+}
+export function parseYaml(text) {
+    const root = {};
+    // The stack of open sections with the indentation of their keys
+    const stack = [{ indent: -1, node: root }];
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const lineNo = i + 1;
+        const raw = lines[i];
+        if (raw.includes("\t"))
+            throw new YamlError("tabs are not allowed; indent with spaces", lineNo);
+        const content = stripComment(raw).trimEnd();
+        if (!content.trim())
+            continue;
+        const indent = content.length - content.trimStart().length;
+        const body = content.trim();
+        if (body.startsWith("- "))
+            throw new YamlError("lists use spaces between items, not dashes", lineNo);
+        const m = body.match(/^([^\s:#][^:]*?)\s*:(?:\s+(.*))?$/);
+        if (!m)
+            throw new YamlError(`expected "key: value" or "key:", got "${body}"`, lineNo);
+        const key = unquote(m[1].trim());
+        const value = m[2]?.trim();
+        // Close sections that this line is not inside of
+        while (stack.length > 1 && indent <= stack[stack.length - 1].indent)
+            stack.pop();
+        const parent = stack[stack.length - 1].node;
+        if (key in parent)
+            throw new YamlError(`duplicate key "${key}"`, lineNo);
+        if (value === undefined || value === "") {
+            const section = {};
+            parent[key] = section;
+            stack.push({ indent, node: section });
+        }
+        else {
+            parent[key] = unquote(value);
+        }
+    }
+    return root;
+}
+/** Words of a space-separated value. "" → []. */
+export function words(value) {
+    return (value ?? "").split(/\s+/).filter(Boolean);
+}

package/dist/index.d.ts

@@ -1,6 +1,17 @@
-export { hashPassword, verifyPassword } from "./core/password.ts";
-export { signSession, verifySession, type User } from "./core/session.ts";
-export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword } from "./core/db.ts";
-export { signInPage, signUpPage } from "./core/html.ts";
-export { signupPolicy, validateCredentials, type SignupPolicy } from "./core/signup.ts";
-export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.ts";
+export { hashPassword, verifyPassword, needsRehash, parseHash, SCRYPT_N } from "./core/password.ts";
+export { isCurrent, signSession, verifySession, claimsAcceptable, ISSUER, AUDIENCE, CLAIMS_REQUIRED_FROM, type Claim, type User } from "./core/session.ts";
+export { db, ensureSchema, pendingSteps, MIGRATIONS, findUser, createUser, countUsers, listUsers, setPassword, setPasswordById, sessionEpoch, userState, sessionRow, markVerified, revokeSessions, removeUser, createOrg, findOrg, listOrgs, addMember, removeMember, removeOrg, adminUsers, adminOrgs, setActiveOrg, type Db, type UserState, type SessionRow, type OrgRow, type Migration, type Statement, type UserRow, } from "./core/db.ts";
+export { signInPage, signUpPage, forgotPage, resetPage, messagePage, securityHeaders } from "./core/html.ts";
+export { resetLink, resetEmail, FORGOT_PATH, RESET_PATH, RESET_TTL_SECONDS } from "./core/reset.ts";
+export { mayAccess, verifyLink, verifyEmail, VERIFY_PATH, VERIFY_TTL_SECONDS } from "./core/verify.ts";
+export { options, loadOptions, resolveOptions, resetOptions, literalSecrets, CONFIG_FILE, DEFAULTS, type Options, type EmailOptions, type SignupMode, } from "./core/options.ts";
+export { parseYaml, YamlError, type YamlTree } from "./core/yaml.ts";
+export { isAdmin, refusedOnSelf, roleChoices, ADMIN_PATH } from "./core/admin.ts";
+export { rateLimit, decide, clientIp, bucketKey, retryMessage, LIMITS, type Bucket, type Decision } from "./core/rate.ts";
+export { adminPage } from "./core/admin-html.ts";
+export { buildSession, hasPermission, permissionsFor, NO_SESSION, type Session, type Organization, type Authorization, type PermissionSource, } from "./core/org.ts";
+export { sendEmail, emailTransport, type EmailMessage, type Transport } from "./core/email.ts";
+export { issueToken, consumeToken, hashToken, tokenState, type Token, type TokenKind } from "./core/tokens.ts";
+export { signupPolicy, validateCredentials, validatePassword, PASSWORD_MIN, PASSWORD_MAX, type SignupPolicy } from "./core/signup.ts";
+export { safeNext, safeEqual, isPublic, matchesPattern, isSameOrigin, MATCHER } from "./core/guard.ts";
+export { COOKIE_NAME, cookieName, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.ts";

package/dist/index.js

@@ -1,8 +1,19 @@
 // Core primitives. Framework-free. Use these if you are not on Next.js
 // or want to build your own handlers.
-export { hashPassword, verifyPassword } from "./core/password.js";
-export { signSession, verifySession } from "./core/session.js";
-export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword } from "./core/db.js";
-export { signInPage, signUpPage } from "./core/html.js";
-export { signupPolicy, validateCredentials } from "./core/signup.js";
-export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.js";
+export { hashPassword, verifyPassword, needsRehash, parseHash, SCRYPT_N } from "./core/password.js";
+export { isCurrent, signSession, verifySession, claimsAcceptable, ISSUER, AUDIENCE, CLAIMS_REQUIRED_FROM } from "./core/session.js";
+export { db, ensureSchema, pendingSteps, MIGRATIONS, findUser, createUser, countUsers, listUsers, setPassword, setPasswordById, sessionEpoch, userState, sessionRow, markVerified, revokeSessions, removeUser, createOrg, findOrg, listOrgs, addMember, removeMember, removeOrg, adminUsers, adminOrgs, setActiveOrg, } from "./core/db.js";
+export { signInPage, signUpPage, forgotPage, resetPage, messagePage, securityHeaders } from "./core/html.js";
+export { resetLink, resetEmail, FORGOT_PATH, RESET_PATH, RESET_TTL_SECONDS } from "./core/reset.js";
+export { mayAccess, verifyLink, verifyEmail, VERIFY_PATH, VERIFY_TTL_SECONDS } from "./core/verify.js";
+export { options, loadOptions, resolveOptions, resetOptions, literalSecrets, CONFIG_FILE, DEFAULTS, } from "./core/options.js";
+export { parseYaml, YamlError } from "./core/yaml.js";
+export { isAdmin, refusedOnSelf, roleChoices, ADMIN_PATH } from "./core/admin.js";
+export { rateLimit, decide, clientIp, bucketKey, retryMessage, LIMITS } from "./core/rate.js";
+export { adminPage } from "./core/admin-html.js";
+export { buildSession, hasPermission, permissionsFor, NO_SESSION, } from "./core/org.js";
+export { sendEmail, emailTransport } from "./core/email.js";
+export { issueToken, consumeToken, hashToken, tokenState } from "./core/tokens.js";
+export { signupPolicy, validateCredentials, validatePassword, PASSWORD_MIN, PASSWORD_MAX } from "./core/signup.js";
+export { safeNext, safeEqual, isPublic, matchesPattern, isSameOrigin, MATCHER } from "./core/guard.js";
+export { COOKIE_NAME, cookieName, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.js";

package/dist/next/index.d.ts

@@ -1,15 +1,22 @@
 import { NextResponse, type NextRequest } from "next/server.js";
 import { type User } from "../core/session.ts";
-export type { User };
+import { type Authorization, type Organization, type Session } from "../core/org.ts";
+export type { User, Session, Organization, Authorization };
 export declare class AuthError extends Error {
     status: number;
-    constructor(message?: string);
+    constructor(message?: string, status?: number);
 }
-/** Current user from the session cookie, or null. Never touches the database. */
+/** The session contract for the current request, or null if signed out, deleted or revoked. */
+export declare function getSession(): Promise<Session | null>;
+/** The session, or throw AuthError (status 401). */
+export declare function requireSession(): Promise<Session>;
+/** The session, or throw AuthError: 401 when signed out, 403 when the role lacks the permission. */
+export declare function requirePermission(permission: string): Promise<Session>;
+/** Current user from the session cookie, or null if signed out, deleted or revoked. */
 export declare function getUser(): Promise<User | null>;
 /** Current user, or throw AuthError (status 401). */
 export declare function requireUser(): Promise<User>;
-/** A 401 JSON response for catch blocks: `catch (e) { return unauthorized(e) }` */
+/** A 401/403 JSON response for catch blocks: `catch (e) { return unauthorized(e) }` */
 export declare function unauthorized(err?: unknown): NextResponse;
 type Ctx = {
     params: Promise<{