@binary1702/auth 0.2.5 → 0.4.0

package/dist/core/yaml.js

@@ -0,0 +1,85 @@
+// ─────────────────────────────────────────────────────────────
+// The subset of YAML that b17_auth.yaml uses. No dependency.
+//
+//   key: value          a string (quotes optional; "…" or '…' strip them)
+//   key:                a section; children indented deeper than the key
+//   # …                 a comment, whole line or after a value
+//   no arrays, no anchors, no multi-line scalars. Lists are words
+//   separated by spaces, split by whoever reads the key.
+//
+// Everything is a string or a section. Typing happens in options.ts,
+// which knows what each key means. Pure.
+// ─────────────────────────────────────────────────────────────
+export class YamlError extends Error {
+    line;
+    constructor(message, line) {
+        super(`b17_auth.yaml line ${line}: ${message}`);
+        this.name = "YamlError";
+        this.line = line;
+    }
+}
+/** Strip a trailing comment, respecting quotes. */
+function stripComment(s) {
+    let quote = null;
+    for (let i = 0; i < s.length; i++) {
+        const c = s[i];
+        if (quote) {
+            if (c === quote)
+                quote = null;
+        }
+        else if (c === '"' || c === "'") {
+            quote = c;
+        }
+        else if (c === "#" && (i === 0 || /\s/.test(s[i - 1]))) {
+            return s.slice(0, i);
+        }
+    }
+    return s;
+}
+function unquote(v) {
+    const m = v.match(/^(["'])(.*)\1$/s);
+    return m ? m[2] : v;
+}
+export function parseYaml(text) {
+    const root = {};
+    // The stack of open sections with the indentation of their keys
+    const stack = [{ indent: -1, node: root }];
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const lineNo = i + 1;
+        const raw = lines[i];
+        if (raw.includes("\t"))
+            throw new YamlError("tabs are not allowed; indent with spaces", lineNo);
+        const content = stripComment(raw).trimEnd();
+        if (!content.trim())
+            continue;
+        const indent = content.length - content.trimStart().length;
+        const body = content.trim();
+        if (body.startsWith("- "))
+            throw new YamlError("lists use spaces between items, not dashes", lineNo);
+        const m = body.match(/^([^\s:#][^:]*?)\s*:(?:\s+(.*))?$/);
+        if (!m)
+            throw new YamlError(`expected "key: value" or "key:", got "${body}"`, lineNo);
+        const key = unquote(m[1].trim());
+        const value = m[2]?.trim();
+        // Close sections that this line is not inside of
+        while (stack.length > 1 && indent <= stack[stack.length - 1].indent)
+            stack.pop();
+        const parent = stack[stack.length - 1].node;
+        if (key in parent)
+            throw new YamlError(`duplicate key "${key}"`, lineNo);
+        if (value === undefined || value === "") {
+            const section = {};
+            parent[key] = section;
+            stack.push({ indent, node: section });
+        }
+        else {
+            parent[key] = unquote(value);
+        }
+    }
+    return root;
+}
+/** Words of a space-separated value. "" → []. */
+export function words(value) {
+    return (value ?? "").split(/\s+/).filter(Boolean);
+}

package/dist/index.d.ts

@@ -1,6 +1,18 @@
-export { hashPassword, verifyPassword } from "./core/password.ts";
-export { isCurrent, signSession, verifySession, type Claim, type User } from "./core/session.ts";
-export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword, sessionEpoch, revokeSessions, removeUser } from "./core/db.ts";
-export { signInPage, signUpPage } from "./core/html.ts";
-export { signupPolicy, validateCredentials, type SignupPolicy } from "./core/signup.ts";
-export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.ts";
+export { hashPassword, verifyPassword, needsRehash, parseHash, SCRYPT_N } from "./core/password.ts";
+export { isCurrent, signSession, verifySession, claimsAcceptable, ISSUER, AUDIENCE, CLAIMS_REQUIRED_FROM, type Claim, type User } from "./core/session.ts";
+export { db, ensureSchema, pendingSteps, MIGRATIONS, findUser, createUser, countUsers, listUsers, setPassword, setPasswordById, sessionEpoch, userState, sessionRow, markVerified, revokeSessions, removeUser, createOrg, findOrg, listOrgs, addMember, removeMember, removeOrg, adminUsers, adminOrgs, setActiveOrg, storedRoles, setRolePermissions, resetRole, seedRoles, memberRole, type StoredRole, type Db, type UserState, type SessionRow, type OrgRow, type Migration, type Statement, type UserRow, } from "./core/db.ts";
+export { signInPage, signUpPage, forgotPage, resetPage, messagePage, securityHeaders } from "./core/html.ts";
+export { resetLink, resetEmail, FORGOT_PATH, RESET_PATH, RESET_TTL_SECONDS } from "./core/reset.ts";
+export { mayAccess, verifyLink, verifyEmail, VERIFY_PATH, VERIFY_TTL_SECONDS } from "./core/verify.ts";
+export { options, loadOptions, resolveOptions, resetOptions, literalSecrets, looksLikeRoleMap, PERMISSION_ID, CONFIG_FILE, DEFAULTS, type Options, type EmailOptions, type SignupMode, } from "./core/options.ts";
+export { parseYaml, YamlError, type YamlTree } from "./core/yaml.ts";
+export { isAdmin, mayEditRoles, refusedOnSelf, roleChoices, checkedFor, grantedFromFields, ADMIN_PATH, ROLE_NAME, ROLE_ACTIONS } from "./core/admin.ts";
+export { rateLimit, decide, clientIp, bucketKey, retryMessage, LIMITS, type Bucket, type Decision } from "./core/rate.ts";
+export { adminPage } from "./core/admin-html.ts";
+export { buildSession, hasPermission, permissionsFor, NO_SESSION, OWNER, type Session, type Organization, type Authorization, type PermissionSource, type StoredGrants, } from "./core/org.ts";
+export { sendEmail, emailTransport, type EmailMessage, type Transport } from "./core/email.ts";
+export { issueToken, consumeToken, hashToken, tokenState, type Token, type TokenKind } from "./core/tokens.ts";
+export { signupPolicy, validateCredentials, validatePassword, PASSWORD_MIN, PASSWORD_MAX, type SignupPolicy } from "./core/signup.ts";
+export { safeNext, safeEqual, isPublic, matchesPattern, isSameOrigin, MATCHER } from "./core/guard.ts";
+export { pagePath, pageOverride, appPages, validatePagePath, validateAppPath, landing, sendsHome, PAGE_KEYS, type Pages, type PageKey } from "./core/pages.ts";
+export { COOKIE_NAME, cookieName, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.ts";

package/dist/index.js

@@ -1,8 +1,20 @@
 // Core primitives. Framework-free. Use these if you are not on Next.js
 // or want to build your own handlers.
-export { hashPassword, verifyPassword } from "./core/password.js";
-export { isCurrent, signSession, verifySession } from "./core/session.js";
-export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword, sessionEpoch, revokeSessions, removeUser } from "./core/db.js";
-export { signInPage, signUpPage } from "./core/html.js";
-export { signupPolicy, validateCredentials } from "./core/signup.js";
-export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.js";
+export { hashPassword, verifyPassword, needsRehash, parseHash, SCRYPT_N } from "./core/password.js";
+export { isCurrent, signSession, verifySession, claimsAcceptable, ISSUER, AUDIENCE, CLAIMS_REQUIRED_FROM } from "./core/session.js";
+export { db, ensureSchema, pendingSteps, MIGRATIONS, findUser, createUser, countUsers, listUsers, setPassword, setPasswordById, sessionEpoch, userState, sessionRow, markVerified, revokeSessions, removeUser, createOrg, findOrg, listOrgs, addMember, removeMember, removeOrg, adminUsers, adminOrgs, setActiveOrg, storedRoles, setRolePermissions, resetRole, seedRoles, memberRole, } from "./core/db.js";
+export { signInPage, signUpPage, forgotPage, resetPage, messagePage, securityHeaders } from "./core/html.js";
+export { resetLink, resetEmail, FORGOT_PATH, RESET_PATH, RESET_TTL_SECONDS } from "./core/reset.js";
+export { mayAccess, verifyLink, verifyEmail, VERIFY_PATH, VERIFY_TTL_SECONDS } from "./core/verify.js";
+export { options, loadOptions, resolveOptions, resetOptions, literalSecrets, looksLikeRoleMap, PERMISSION_ID, CONFIG_FILE, DEFAULTS, } from "./core/options.js";
+export { parseYaml, YamlError } from "./core/yaml.js";
+export { isAdmin, mayEditRoles, refusedOnSelf, roleChoices, checkedFor, grantedFromFields, ADMIN_PATH, ROLE_NAME, ROLE_ACTIONS } from "./core/admin.js";
+export { rateLimit, decide, clientIp, bucketKey, retryMessage, LIMITS } from "./core/rate.js";
+export { adminPage } from "./core/admin-html.js";
+export { buildSession, hasPermission, permissionsFor, NO_SESSION, OWNER, } from "./core/org.js";
+export { sendEmail, emailTransport } from "./core/email.js";
+export { issueToken, consumeToken, hashToken, tokenState } from "./core/tokens.js";
+export { signupPolicy, validateCredentials, validatePassword, PASSWORD_MIN, PASSWORD_MAX } from "./core/signup.js";
+export { safeNext, safeEqual, isPublic, matchesPattern, isSameOrigin, MATCHER } from "./core/guard.js";
+export { pagePath, pageOverride, appPages, validatePagePath, validateAppPath, landing, sendsHome, PAGE_KEYS } from "./core/pages.js";
+export { COOKIE_NAME, cookieName, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.js";

package/dist/next/index.d.ts

@@ -1,15 +1,22 @@
 import { NextResponse, type NextRequest } from "next/server.js";
 import { type User } from "../core/session.ts";
-export type { User };
+import { type Authorization, type Organization, type Session } from "../core/org.ts";
+export type { User, Session, Organization, Authorization };
 export declare class AuthError extends Error {
     status: number;
-    constructor(message?: string);
+    constructor(message?: string, status?: number);
 }
+/** The session contract for the current request, or null if signed out, deleted or revoked. */
+export declare function getSession(): Promise<Session | null>;
+/** The session, or throw AuthError (status 401). */
+export declare function requireSession(): Promise<Session>;
+/** The session, or throw AuthError: 401 when signed out, 403 when the role lacks the permission. */
+export declare function requirePermission(permission: string): Promise<Session>;
 /** Current user from the session cookie, or null if signed out, deleted or revoked. */
 export declare function getUser(): Promise<User | null>;
 /** Current user, or throw AuthError (status 401). */
 export declare function requireUser(): Promise<User>;
-/** A 401 JSON response for catch blocks: `catch (e) { return unauthorized(e) }` */
+/** A 401/403 JSON response for catch blocks: `catch (e) { return unauthorized(e) }` */
 export declare function unauthorized(err?: unknown): NextResponse;
 type Ctx = {
     params: Promise<{