@binary1702/auth 0.3.0 → 0.4.0

package/dist/core/pages.js

@@ -0,0 +1,73 @@
+// ─────────────────────────────────────────────────────────────
+// Where the sign-in and sign-up pages live. Pure.
+//
+// The package serves plain HTML pages under /auth/. An app that wants
+// its own design names its pages in b17_auth.yaml:
+//
+//   pages:
+//     signIn: /sign-in
+//     signUp: /sign-up
+//
+// Then every place the package sends a browser (the proxy, sign-out,
+// a verified email, "create the first account") goes to the app's page,
+// and GET /auth/sign-in redirects there too, so old links still land.
+// The protocol does not move: the app's page still POSTs to
+// /auth/sign-in and /auth/sign-up (JSON or a form). The package owns
+// the protocol; the app owns the pixels.
+// ─────────────────────────────────────────────────────────────
+// The built-in paths live here (not in config.ts, which imports options.ts,
+// which imports this file): no import cycle at module load.
+export const SIGN_IN_PATH = "/auth/sign-in";
+export const SIGN_UP_PATH = "/auth/sign-up";
+export const PAGE_KEYS = ["signIn", "signUp"];
+const BUILT_IN = { signIn: SIGN_IN_PATH, signUp: SIGN_UP_PATH };
+/** The app's path for a page, or undefined when the package serves it */
+export function pageOverride(pages, key) {
+    return pages?.[key];
+}
+/** Where a browser is sent for a page: the app's path if named, else the package's */
+export function pagePath(pages, key) {
+    return pageOverride(pages, key) ?? BUILT_IN[key];
+}
+/** The app's pages, for the proxy: they must open without a session */
+export function appPages(pages) {
+    return PAGE_KEYS.map((k) => pages?.[k]).filter((p) => typeof p === "string");
+}
+/**
+ * An app path is an absolute path on this site, outside /auth/ (which the
+ * package serves), with no pattern, query or fragment. Error text or null.
+ */
+export function validateAppPath(key, path) {
+    if (!path.startsWith("/"))
+        return `${key} must be a path starting with /, not "${path}"`;
+    if (/^\/auth(\/|$)/.test(path))
+        return `${key} cannot be under /auth/, which the package serves`;
+    if (/[*?#\s]/.test(path))
+        return `${key} is one plain path, no * ? # or spaces: "${path}"`;
+    return null;
+}
+export function validatePagePath(key, path) {
+    return validateAppPath(`pages.${key}`, path);
+}
+/**
+ * Where a signed-in visitor lands when nothing says otherwise: `home:` from
+ * b17_auth.yaml (the app's signed-in home, say /app), else the site root.
+ *   after sign-in with no `next`, or `next` reduced to "/" by safeNext
+ *   the admin page's "app" link
+ *   a signed-in visitor opening "/" (the proxy sends them home: the root is
+ *   the public site, the app is where they were going)
+ */
+export function landing(next, home) {
+    return next && next !== "/" ? next : (home ?? "/");
+}
+/** Should the proxy send this signed-in request home? Only the root, only when home is elsewhere. */
+export function sendsHome(pathname, home) {
+    return pathname === "/" && !!home && home !== "/";
+}
+/**
+ * The same URL on the app's page: GET /auth/sign-in?next=/x&error=1 becomes
+ * /sign-in?next=/x&error=1, so a bookmark or an old link keeps working.
+ */
+export function movedTo(path, search) {
+    return path + search;
+}

package/dist/core/signup.d.ts

@@ -14,6 +14,10 @@ export declare const PASSWORD_MIN = 8;
 export declare const PASSWORD_MAX = 256;
 /** Returns an error message, or null when the password is acceptable. */
 export declare function validatePassword(password: string): string | null;
+/** Returns an error message, or null when the address is acceptable (shape, and the domain rule if any). */
+export declare function validateEmail(email: string, opts?: {
+    emailDomain?: string;
+}): string | null;
 /** Returns an error message, or null when the pair is acceptable. */
 export declare function validateCredentials(email: string, password: string, opts?: {
     emailDomain?: string;

package/dist/core/signup.js

@@ -29,13 +29,17 @@ export function validatePassword(password) {
         return `Password must be at most ${PASSWORD_MAX} characters.`;
     return null;
 }
-/** Returns an error message, or null when the pair is acceptable. */
-export function validateCredentials(email, password, opts) {
+/** Returns an error message, or null when the address is acceptable (shape, and the domain rule if any). */
+export function validateEmail(email, opts) {
     if (!EMAIL_RE.test(email))
         return "Please enter a valid email address.";
     const domain = opts?.emailDomain;
     if (domain && !email.toLowerCase().endsWith(`@${domain.toLowerCase()}`)) {
         return `Only @${domain} emails are allowed.`;
     }
-    return validatePassword(password);
+    return null;
+}
+/** Returns an error message, or null when the pair is acceptable. */
+export function validateCredentials(email, password, opts) {
+    return validateEmail(email, opts) ?? validatePassword(password);
 }

package/dist/index.d.ts

@@ -1,17 +1,18 @@
 export { hashPassword, verifyPassword, needsRehash, parseHash, SCRYPT_N } from "./core/password.ts";
 export { isCurrent, signSession, verifySession, claimsAcceptable, ISSUER, AUDIENCE, CLAIMS_REQUIRED_FROM, type Claim, type User } from "./core/session.ts";
-export { db, ensureSchema, pendingSteps, MIGRATIONS, findUser, createUser, countUsers, listUsers, setPassword, setPasswordById, sessionEpoch, userState, sessionRow, markVerified, revokeSessions, removeUser, createOrg, findOrg, listOrgs, addMember, removeMember, removeOrg, adminUsers, adminOrgs, setActiveOrg, type Db, type UserState, type SessionRow, type OrgRow, type Migration, type Statement, type UserRow, } from "./core/db.ts";
+export { db, ensureSchema, pendingSteps, MIGRATIONS, findUser, createUser, countUsers, listUsers, setPassword, setPasswordById, sessionEpoch, userState, sessionRow, markVerified, revokeSessions, removeUser, createOrg, findOrg, listOrgs, addMember, removeMember, removeOrg, adminUsers, adminOrgs, setActiveOrg, storedRoles, setRolePermissions, resetRole, seedRoles, memberRole, type StoredRole, type Db, type UserState, type SessionRow, type OrgRow, type Migration, type Statement, type UserRow, } from "./core/db.ts";
 export { signInPage, signUpPage, forgotPage, resetPage, messagePage, securityHeaders } from "./core/html.ts";
 export { resetLink, resetEmail, FORGOT_PATH, RESET_PATH, RESET_TTL_SECONDS } from "./core/reset.ts";
 export { mayAccess, verifyLink, verifyEmail, VERIFY_PATH, VERIFY_TTL_SECONDS } from "./core/verify.ts";
-export { options, loadOptions, resolveOptions, resetOptions, literalSecrets, CONFIG_FILE, DEFAULTS, type Options, type EmailOptions, type SignupMode, } from "./core/options.ts";
+export { options, loadOptions, resolveOptions, resetOptions, literalSecrets, looksLikeRoleMap, PERMISSION_ID, CONFIG_FILE, DEFAULTS, type Options, type EmailOptions, type SignupMode, } from "./core/options.ts";
 export { parseYaml, YamlError, type YamlTree } from "./core/yaml.ts";
-export { isAdmin, refusedOnSelf, roleChoices, ADMIN_PATH } from "./core/admin.ts";
+export { isAdmin, mayEditRoles, refusedOnSelf, roleChoices, checkedFor, grantedFromFields, ADMIN_PATH, ROLE_NAME, ROLE_ACTIONS } from "./core/admin.ts";
 export { rateLimit, decide, clientIp, bucketKey, retryMessage, LIMITS, type Bucket, type Decision } from "./core/rate.ts";
 export { adminPage } from "./core/admin-html.ts";
-export { buildSession, hasPermission, permissionsFor, NO_SESSION, type Session, type Organization, type Authorization, type PermissionSource, } from "./core/org.ts";
+export { buildSession, hasPermission, permissionsFor, NO_SESSION, OWNER, type Session, type Organization, type Authorization, type PermissionSource, type StoredGrants, } from "./core/org.ts";
 export { sendEmail, emailTransport, type EmailMessage, type Transport } from "./core/email.ts";
 export { issueToken, consumeToken, hashToken, tokenState, type Token, type TokenKind } from "./core/tokens.ts";
 export { signupPolicy, validateCredentials, validatePassword, PASSWORD_MIN, PASSWORD_MAX, type SignupPolicy } from "./core/signup.ts";
 export { safeNext, safeEqual, isPublic, matchesPattern, isSameOrigin, MATCHER } from "./core/guard.ts";
+export { pagePath, pageOverride, appPages, validatePagePath, validateAppPath, landing, sendsHome, PAGE_KEYS, type Pages, type PageKey } from "./core/pages.ts";
 export { COOKIE_NAME, cookieName, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.ts";

package/dist/index.js

@@ -2,18 +2,19 @@
 // or want to build your own handlers.
 export { hashPassword, verifyPassword, needsRehash, parseHash, SCRYPT_N } from "./core/password.js";
 export { isCurrent, signSession, verifySession, claimsAcceptable, ISSUER, AUDIENCE, CLAIMS_REQUIRED_FROM } from "./core/session.js";
-export { db, ensureSchema, pendingSteps, MIGRATIONS, findUser, createUser, countUsers, listUsers, setPassword, setPasswordById, sessionEpoch, userState, sessionRow, markVerified, revokeSessions, removeUser, createOrg, findOrg, listOrgs, addMember, removeMember, removeOrg, adminUsers, adminOrgs, setActiveOrg, } from "./core/db.js";
+export { db, ensureSchema, pendingSteps, MIGRATIONS, findUser, createUser, countUsers, listUsers, setPassword, setPasswordById, sessionEpoch, userState, sessionRow, markVerified, revokeSessions, removeUser, createOrg, findOrg, listOrgs, addMember, removeMember, removeOrg, adminUsers, adminOrgs, setActiveOrg, storedRoles, setRolePermissions, resetRole, seedRoles, memberRole, } from "./core/db.js";
 export { signInPage, signUpPage, forgotPage, resetPage, messagePage, securityHeaders } from "./core/html.js";
 export { resetLink, resetEmail, FORGOT_PATH, RESET_PATH, RESET_TTL_SECONDS } from "./core/reset.js";
 export { mayAccess, verifyLink, verifyEmail, VERIFY_PATH, VERIFY_TTL_SECONDS } from "./core/verify.js";
-export { options, loadOptions, resolveOptions, resetOptions, literalSecrets, CONFIG_FILE, DEFAULTS, } from "./core/options.js";
+export { options, loadOptions, resolveOptions, resetOptions, literalSecrets, looksLikeRoleMap, PERMISSION_ID, CONFIG_FILE, DEFAULTS, } from "./core/options.js";
 export { parseYaml, YamlError } from "./core/yaml.js";
-export { isAdmin, refusedOnSelf, roleChoices, ADMIN_PATH } from "./core/admin.js";
+export { isAdmin, mayEditRoles, refusedOnSelf, roleChoices, checkedFor, grantedFromFields, ADMIN_PATH, ROLE_NAME, ROLE_ACTIONS } from "./core/admin.js";
 export { rateLimit, decide, clientIp, bucketKey, retryMessage, LIMITS } from "./core/rate.js";
 export { adminPage } from "./core/admin-html.js";
-export { buildSession, hasPermission, permissionsFor, NO_SESSION, } from "./core/org.js";
+export { buildSession, hasPermission, permissionsFor, NO_SESSION, OWNER, } from "./core/org.js";
 export { sendEmail, emailTransport } from "./core/email.js";
 export { issueToken, consumeToken, hashToken, tokenState } from "./core/tokens.js";
 export { signupPolicy, validateCredentials, validatePassword, PASSWORD_MIN, PASSWORD_MAX } from "./core/signup.js";
 export { safeNext, safeEqual, isPublic, matchesPattern, isSameOrigin, MATCHER } from "./core/guard.js";
+export { pagePath, pageOverride, appPages, validatePagePath, validateAppPath, landing, sendsHome, PAGE_KEYS } from "./core/pages.js";
 export { COOKIE_NAME, cookieName, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.js";