@binary1702/auth 0.2.5 → 0.3.0

package/dist/core/admin.d.ts

@@ -0,0 +1,26 @@
+import type { Session } from "./org.ts";
+export declare const ADMIN_PATH = "/auth/admin";
+export declare function isAdmin(session: Pick<Session, "user"> | null, admins: readonly string[]): boolean;
+/** The forms on the page. Each is one POST with `action` and a few fields. */
+export declare const USER_ACTIONS: readonly ["add", "set-password", "sign-out", "verify", "send-verify", "remove"];
+export declare const ORG_ACTIONS: readonly ["create", "add-member", "set-role", "remove-member", "remove-org"];
+export type UserAction = (typeof USER_ACTIONS)[number];
+export type OrgAction = (typeof ORG_ACTIONS)[number];
+export declare const isUserAction: (a: string) => a is UserAction;
+export declare const isOrgAction: (a: string) => a is OrgAction;
+/**
+ * What an admin may not do to themselves: remove or lock out the account
+ * they are using. (Their own password change is fine: it ends their other
+ * sessions, and the page signs them in again.)
+ */
+export declare function refusedOnSelf(action: UserAction, targetEmail: string, selfEmail: string): string | null;
+/**
+ * Where to land after an action: the view the form was on. Only two shapes
+ * exist, so the value is rebuilt from parts, never taken from the form as is.
+ */
+export declare function backTo(fields: {
+    org?: string;
+    tab?: string;
+}): string;
+/** Roles the page offers in its dropdowns: whatever the yaml defines, plus any role already in use. */
+export declare function roleChoices(defined: readonly string[], inUse: readonly string[]): string[];

package/dist/core/admin.js

@@ -0,0 +1,48 @@
+// ─────────────────────────────────────────────────────────────
+// The admin page's rules. Pure.
+//
+//   admins: ben@example.com …   (b17_auth.yaml, or AUTH_ADMINS) may open
+//                               /auth/admin and do what the CLI does:
+//                               users and memberships. Never the yaml.
+//
+// An admin is an email, not a role: a role lives in one organization,
+// the admin page spans all of them.
+// ─────────────────────────────────────────────────────────────
+export const ADMIN_PATH = "/auth/admin";
+export function isAdmin(session, admins) {
+    return !!session && admins.includes(session.user.email.toLowerCase());
+}
+/** The forms on the page. Each is one POST with `action` and a few fields. */
+export const USER_ACTIONS = ["add", "set-password", "sign-out", "verify", "send-verify", "remove"];
+export const ORG_ACTIONS = ["create", "add-member", "set-role", "remove-member", "remove-org"];
+export const isUserAction = (a) => USER_ACTIONS.includes(a);
+export const isOrgAction = (a) => ORG_ACTIONS.includes(a);
+/**
+ * What an admin may not do to themselves: remove or lock out the account
+ * they are using. (Their own password change is fine: it ends their other
+ * sessions, and the page signs them in again.)
+ */
+export function refusedOnSelf(action, targetEmail, selfEmail) {
+    if (targetEmail.toLowerCase() !== selfEmail.toLowerCase())
+        return null;
+    if (action === "remove")
+        return "You cannot remove the account you are signed in with.";
+    if (action === "sign-out")
+        return "Use /auth/sign-out to end your own session.";
+    return null;
+}
+/**
+ * Where to land after an action: the view the form was on. Only two shapes
+ * exist, so the value is rebuilt from parts, never taken from the form as is.
+ */
+export function backTo(fields) {
+    if (fields.org && /^[0-9a-f-]{36}$/i.test(fields.org))
+        return `org=${fields.org}`;
+    if (fields.tab === "users" || fields.tab === "settings")
+        return `tab=${fields.tab}`;
+    return "";
+}
+/** Roles the page offers in its dropdowns: whatever the yaml defines, plus any role already in use. */
+export function roleChoices(defined, inUse) {
+    return [...new Set(["owner", "admin", "member", ...defined, ...inUse])];
+}

package/dist/core/config.d.ts

@@ -1,8 +1,15 @@
 export declare const COOKIE_NAME = "auth_session";
+/**
+ * In production the cookie carries the __Host- prefix: the browser then
+ * refuses it unless it is Secure, has Path=/ and no Domain, so a
+ * subdomain or a plain-http page cannot plant one. Pure.
+ */
+export declare function cookieName(production: boolean): string;
+/** The default; b17_auth.yaml `sessionDays` overrides it */
 export declare const SESSION_DAYS = 7;
 export declare const SIGN_IN_PATH = "/auth/sign-in";
 export declare const SIGN_OUT_PATH = "/auth/sign-out";
 export declare const SIGN_UP_PATH = "/auth/sign-up";
-export declare const TABLE = "auth_users";
+export declare const TABLE = "users";
 export declare function getSecret(): string;
 export declare function getDatabaseUrl(): string;

package/dist/core/config.js

@@ -1,24 +1,38 @@
 // ─────────────────────────────────────────────────────────────
-// Configuration. Two env vars, nothing else.
+// Constants, and the two values nothing works without.
 //
-//   DATABASE_URL  Postgres connection string (Neon)
-//   AUTH_SECRET   signs the session cookie; generated by the CLI
+// Everything configurable comes from core/options.ts: b17_auth.yaml
+// with ${NAME} references, or the env vars on their own:
+//
+//   DATABASE_URL   Postgres connection string (Neon)      required
+//   AUTH_SECRET    signs the session cookie               generated by the CLI
+//   the rest       see core/options.ts
 // ─────────────────────────────────────────────────────────────
+import { options } from "./options.js";
 export const COOKIE_NAME = "auth_session";
+/**
+ * In production the cookie carries the __Host- prefix: the browser then
+ * refuses it unless it is Secure, has Path=/ and no Domain, so a
+ * subdomain or a plain-http page cannot plant one. Pure.
+ */
+export function cookieName(production) {
+    return production ? `__Host-${COOKIE_NAME}` : COOKIE_NAME;
+}
+/** The default; b17_auth.yaml `sessionDays` overrides it */
 export const SESSION_DAYS = 7;
 export const SIGN_IN_PATH = "/auth/sign-in";
 export const SIGN_OUT_PATH = "/auth/sign-out";
 export const SIGN_UP_PATH = "/auth/sign-up";
-export const TABLE = "auth_users";
+export const TABLE = "users";
 export function getSecret() {
-    const secret = process.env.AUTH_SECRET;
+    const secret = options().secret;
     if (!secret || secret.length < 16) {
         throw new Error("AUTH_SECRET is missing. Run: npx @binary1702/auth");
     }
     return secret;
 }
 export function getDatabaseUrl() {
-    const url = process.env.DATABASE_URL;
+    const url = options().database;
     if (!url) {
         throw new Error("DATABASE_URL is missing. Run: npx @binary1702/auth");
     }

package/dist/core/db.d.ts

@@ -1,26 +1,147 @@
 import { TABLE } from "./config.ts";
 import type { User } from "./session.ts";
-export declare function ensureSchema(): Promise<void>;
-type Row = {
+export type Statement = {
+    text: string;
+    params?: unknown[];
+};
+/** What the package needs from a database: parameterised queries, and a transaction if it has one. */
+export interface Db {
+    query<T = Record<string, unknown>>(text: string, params?: unknown[]): Promise<T[]>;
+    /** Run statements in one transaction. A store without it runs them one by one. */
+    transaction?(statements: Statement[]): Promise<void>;
+}
+/** The real store, created once per process from DATABASE_URL. */
+export declare function db(): Db;
+export type Migration = {
+    id: number;
+    name: string;
+    statements: string[];
+};
+/**
+ * Ordered, append-only. Never edit a step that has shipped: add a new
+ * one. Step 1 is the 0.2.5 schema exactly, so an existing install
+ * applies it as a no-op through IF NOT EXISTS.
+ */
+export declare const MIGRATIONS: Migration[];
+/**
+ * The package's tables have plain names (users, orgs, members, tokens).
+ * A database that already holds a `users` table of its own would be
+ * silently shared by CREATE TABLE IF NOT EXISTS, so a fresh install
+ * checks first. Pure: decides from what the store reports.
+ */
+export declare function foreignUsersTable(columns: string[]): boolean;
+export declare const FOREIGN_USERS_TABLE = "This database already has a `users` table that is not this package's. Point DATABASE_URL at a database (or Postgres schema) of its own.";
+/** The steps still to run, in order. Pure. */
+export declare function pendingSteps(applied: number[], steps?: Migration[]): Migration[];
+/** Everything a pending step needs to run, including recording that it ran. Pure. */
+export declare function migrationStatements(steps: Migration[]): Statement[];
+/**
+ * Apply pending migrations. Memoized per store and per process, so
+ * route handlers can call it on every request for free after the first.
+ * A failure clears the memo so the next call retries.
+ */
+export declare function ensureSchema(store?: Db): Promise<void>;
+export type UserRow = {
     id: string;
     email: string;
     password_hash: string;
     epoch: number;
+    /** When the email was verified, or null */
+    verified_at: string | Date | null;
 };
-export declare function findUser(email: string): Promise<Row | null>;
-export declare function createUser(email: string, passwordHash: string): Promise<User & {
+export declare function findUser(email: string, store?: Db): Promise<UserRow | null>;
+/** Two sign-ups raced on one email and the second lost: the handler answers 409. */
+export declare class DuplicateUserError extends Error {
+    constructor(email: string);
+}
+/** Postgres's unique_violation */
+export declare const isUniqueViolation: (err: unknown) => boolean;
+export declare function createUser(email: string, passwordHash: string, opts?: {
+    verified?: boolean;
+}, store?: Db): Promise<User & {
     epoch: number;
+    verified: boolean;
 }>;
+/** Replace a hash with one made under stronger parameters. No epoch bump: nothing about the session changes. */
+export declare function rehashPassword(id: string, passwordHash: string, store?: Db): Promise<void>;
+/** What a session check needs about the user: current epoch and verification. Null if the user is gone. */
+export type UserState = {
+    epoch: number;
+    verified: boolean;
+};
+export declare function userState(id: string, store?: Db): Promise<UserState | null>;
 /** The user's current session_epoch, or null if the user is gone */
-export declare function sessionEpoch(id: string): Promise<number | null>;
+export declare function sessionEpoch(id: string, store?: Db): Promise<number | null>;
+/** Everything a session needs, in one query: the user's state and their active organization. */
+export type SessionRow = UserState & {
+    id: string;
+    email: string;
+    org_id: string | null;
+    org_name: string | null;
+    role: string | null;
+};
+export declare function sessionRow(id: string, store?: Db): Promise<SessionRow | null>;
+export type OrgRow = {
+    id: string;
+    name: string;
+    created_at: string;
+};
+export declare function createOrg(name: string, store?: Db): Promise<OrgRow>;
+/** By id (UUID) or exact name. Null if there is no such organization. */
+export declare function findOrg(idOrName: string, store?: Db): Promise<OrgRow | null>;
+export declare function listOrgs(store?: Db): Promise<(OrgRow & {
+    members: number;
+})[]>;
+/** Add or update a membership. Becomes the user's active org if they had none. */
+export declare function addMember(orgId: string, userId: string, role: string, store?: Db): Promise<void>;
+export declare function removeMember(orgId: string, userId: string, store?: Db): Promise<boolean>;
+export declare function removeOrg(orgId: string, store?: Db): Promise<boolean>;
+export type Membership = {
+    org_id: string;
+    org: string;
+    role: string;
+};
+export type AdminUser = {
+    id: string;
+    email: string;
+    created_at: string;
+    verified: boolean;
+    memberships: Membership[];
+};
+export type AdminOrg = {
+    id: string;
+    name: string;
+    created_at: string;
+    members: {
+        user_id: string;
+        email: string;
+        role: string;
+    }[];
+};
+/** Every user with their memberships, one query. */
+export declare function adminUsers(store?: Db): Promise<AdminUser[]>;
+/** Every organization with its members, one query. */
+export declare function adminOrgs(store?: Db): Promise<AdminOrg[]>;
+/** Switch the user's active organization. False unless they are a member of it: the client's choice is checked, never trusted. */
+export declare function setActiveOrg(userId: string, orgId: string, store?: Db): Promise<boolean>;
+/** Record that the user followed the verification link. Idempotent. Null if the user is gone. */
+export declare function markVerified(id: string, store?: Db): Promise<User | null>;
 /** Revoke every session of this user. False if there is no such user. */
-export declare function revokeSessions(email: string): Promise<boolean>;
+export declare function revokeSessions(email: string, store?: Db): Promise<boolean>;
 /** Delete the user. Their sessions die with the row. False if none. */
-export declare function removeUser(email: string): Promise<boolean>;
-export declare function countUsers(): Promise<number>;
-export declare function listUsers(): Promise<(User & {
+export declare function removeUser(email: string, store?: Db): Promise<boolean>;
+export declare function countUsers(store?: Db): Promise<number>;
+export declare function listUsers(store?: Db): Promise<(User & {
     created_at: string;
 })[]>;
 /** Change a password. Also revokes every session, old password's included. */
-export declare function setPassword(email: string, passwordHash: string): Promise<boolean>;
+export declare function setPassword(email: string, passwordHash: string, store?: Db): Promise<boolean>;
+/**
+ * Same, by id, for a reset link. Also marks the email verified: following
+ * the link proved the address. Returns the user with the new epoch so the
+ * caller can sign them in; null if the user is gone.
+ */
+export declare function setPasswordById(id: string, passwordHash: string, store?: Db): Promise<(User & {
+    epoch: number;
+}) | null>;
 export { TABLE };