@c9up/warden 0.1.18 → 0.1.20
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/AuthManager.d.ts +46 -1
- package/dist/AuthManager.d.ts.map +1 -1
- package/dist/AuthManager.js +71 -10
- package/dist/AuthManager.js.map +1 -1
- package/dist/Authenticator.d.ts +13 -1
- package/dist/Authenticator.d.ts.map +1 -1
- package/dist/Authenticator.js +33 -15
- package/dist/Authenticator.js.map +1 -1
- package/dist/RememberMeToken.d.ts +70 -0
- package/dist/RememberMeToken.d.ts.map +1 -1
- package/dist/RememberMeToken.js +102 -0
- package/dist/RememberMeToken.js.map +1 -1
- package/dist/Secret.d.ts +11 -0
- package/dist/Secret.d.ts.map +1 -0
- package/dist/Secret.js +36 -0
- package/dist/Secret.js.map +1 -0
- package/dist/augmentations.d.ts +23 -0
- package/dist/augmentations.d.ts.map +1 -0
- package/dist/augmentations.js +17 -0
- package/dist/augmentations.js.map +1 -0
- package/dist/bouncer/Bouncer.d.ts +14 -0
- package/dist/bouncer/Bouncer.d.ts.map +1 -1
- package/dist/bouncer/Bouncer.js +23 -4
- package/dist/bouncer/Bouncer.js.map +1 -1
- package/dist/bouncer/PolicyAuthorizer.d.ts +9 -1
- package/dist/bouncer/PolicyAuthorizer.d.ts.map +1 -1
- package/dist/bouncer/PolicyAuthorizer.js +17 -1
- package/dist/bouncer/PolicyAuthorizer.js.map +1 -1
- package/dist/bouncer/evaluate.d.ts +14 -2
- package/dist/bouncer/evaluate.d.ts.map +1 -1
- package/dist/bouncer/evaluate.js +16 -5
- package/dist/bouncer/evaluate.js.map +1 -1
- package/dist/bouncer/types.d.ts +4 -2
- package/dist/bouncer/types.d.ts.map +1 -1
- package/dist/index.d.ts +4 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -2
- package/dist/index.js.map +1 -1
- package/dist/sanitize.d.ts +10 -0
- package/dist/sanitize.d.ts.map +1 -0
- package/dist/sanitize.js +15 -0
- package/dist/sanitize.js.map +1 -0
- package/dist/strategies/SessionStrategy.d.ts +26 -0
- package/dist/strategies/SessionStrategy.d.ts.map +1 -1
- package/dist/strategies/SessionStrategy.js +49 -0
- package/dist/strategies/SessionStrategy.js.map +1 -1
- package/index.win32-x64-msvc.node +0 -0
- package/package.json +3 -2
- package/src/AuthManager.ts +86 -10
- package/src/Authenticator.ts +49 -20
- package/src/RememberMeToken.ts +134 -0
- package/src/Secret.ts +41 -0
- package/src/augmentations.ts +27 -0
- package/src/bouncer/Bouncer.ts +32 -3
- package/src/bouncer/PolicyAuthorizer.ts +20 -1
- package/src/bouncer/evaluate.ts +26 -6
- package/src/bouncer/types.ts +4 -2
- package/src/index.ts +9 -1
- package/src/sanitize.ts +17 -0
- package/src/strategies/SessionStrategy.ts +54 -0
package/dist/AuthManager.d.ts
CHANGED
|
@@ -3,6 +3,10 @@
|
|
|
3
3
|
*
|
|
4
4
|
* @implements FR48, FR50, FR51
|
|
5
5
|
*/
|
|
6
|
+
import { Authenticator } from "./Authenticator.js";
|
|
7
|
+
import type { WardenContext } from "./middleware.js";
|
|
8
|
+
import { sanitizePayload } from "./sanitize.js";
|
|
9
|
+
export { sanitizePayload };
|
|
6
10
|
import { RightsResolver } from "./rights/RightsResolver.js";
|
|
7
11
|
import type { EffectivePermissions, Scope } from "./rights/types.js";
|
|
8
12
|
import type { SessionStore } from "./strategies/SessionStrategy.js";
|
|
@@ -40,6 +44,21 @@ export interface AuthClientResponse {
|
|
|
40
44
|
/** Cookies to send. */
|
|
41
45
|
cookies?: Record<string, string>;
|
|
42
46
|
}
|
|
47
|
+
/**
|
|
48
|
+
* The event namespace for a guard, taken from its DRIVER.
|
|
49
|
+
*
|
|
50
|
+
* AdonisJS namespaces auth events per driver — `session_auth:*`,
|
|
51
|
+
* `access_tokens_auth:*`, `basic_auth:*` — so an app can audit session logins
|
|
52
|
+
* without also hearing about every bearer token. Warden emitted `session_auth:*`
|
|
53
|
+
* whatever authenticated, which told a session listener about JWT traffic and
|
|
54
|
+
* left no name to subscribe to for the others.
|
|
55
|
+
*
|
|
56
|
+
* Driven by the strategy's `name` rather than the guard's config key: a guard
|
|
57
|
+
* called `web` running a `SessionStrategy` is still the session driver, exactly
|
|
58
|
+
* as upstream. A driver already ending in `_auth` (`basic_auth`) keeps its name
|
|
59
|
+
* rather than growing a second suffix, which is how AdonisJS spells it.
|
|
60
|
+
*/
|
|
61
|
+
export declare function authEventPrefix(driverName: string | undefined): string;
|
|
43
62
|
export interface AuthStrategy {
|
|
44
63
|
name: string;
|
|
45
64
|
authenticate(credentials: Record<string, unknown>): Promise<AuthResult>;
|
|
@@ -151,6 +170,33 @@ export declare class AuthManager {
|
|
|
151
170
|
*/
|
|
152
171
|
hasAllPermissions(user: UserPayload, permissions: string[], scope?: Scope): Promise<boolean>;
|
|
153
172
|
/** Get a registered strategy by name. */
|
|
173
|
+
/**
|
|
174
|
+
* An {@link Authenticator} bound to one request (AdonisJS
|
|
175
|
+
* `createAuthenticator`).
|
|
176
|
+
*
|
|
177
|
+
* What the HTTP middleware builds per request. Exposed so anything outside
|
|
178
|
+
* that path — a console command acting as a user, a background job — can
|
|
179
|
+
* build one without reaching for the class.
|
|
180
|
+
*/
|
|
181
|
+
createAuthenticator(ctx: WardenContext): Authenticator;
|
|
182
|
+
/**
|
|
183
|
+
* What a test client needs to authenticate as a user (AdonisJS
|
|
184
|
+
* `createAuthenticatorClient`).
|
|
185
|
+
*
|
|
186
|
+
* Delegates to the guard's own `authenticateAsClient`, so a guard with no
|
|
187
|
+
* test seam says so instead of having one forged for it.
|
|
188
|
+
*/
|
|
189
|
+
createAuthenticatorClient(): {
|
|
190
|
+
use(guard?: string): {
|
|
191
|
+
authenticateAsClient(...args: never[]): Promise<AuthClientResponse> | AuthClientResponse;
|
|
192
|
+
};
|
|
193
|
+
};
|
|
194
|
+
/**
|
|
195
|
+
* The event namespace a guard's events carry, resolved from its driver.
|
|
196
|
+
* Falls back to `session_auth` when the guard cannot be resolved, so a
|
|
197
|
+
* failure to look one up never becomes a second failure at emit time.
|
|
198
|
+
*/
|
|
199
|
+
eventPrefixFor(guardName?: string): string;
|
|
154
200
|
getStrategy(name?: string): AuthStrategy;
|
|
155
201
|
/**
|
|
156
202
|
* Name of the default guard (Adonis's "default guard"). Used by `silentAuth`
|
|
@@ -188,5 +234,4 @@ export declare class AuthManager {
|
|
|
188
234
|
* directly (not `AuthManager.verify`), so without this it would skip
|
|
189
235
|
* the guard JWT / api-key users get.
|
|
190
236
|
*/
|
|
191
|
-
export declare function sanitizePayload(user: UserPayload): void;
|
|
192
237
|
//# sourceMappingURL=AuthManager.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthManager.d.ts","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;
|
|
1
|
+
{"version":3,"file":"AuthManager.d.ts","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,CAAC;AAG3B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAEpE,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAClC,qCAAqC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGtE;AAED,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9E;;;;OAIG;IACH,oBAAoB,CAAC,CACpB,GAAG,IAAI,EAAE,KAAK,EAAE,GACd,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;CACpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IAC1B,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB;AAkBD;;GAEG;AACH;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC7B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CAC5C;AAED,qBAAa,WAAW;;IAGvB,OAAO,CAAC,MAAM,CAAwC;IACtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IASxC;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAKxC;;;;OAIG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;gBAaxD,MAAM,EAAE,UAAU;IAoC9B,0EAA0E;IACpE,YAAY,CACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC;IAmBtB,8CAA8C;IACxC,MAAM,CACX,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,UAAU,CAAC;IAoBtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM;IAc1D;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAI,EAAE,WAAW,EACjB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,oBAAoB,CAAC;IAIhC;;;;OAIG;IACG,OAAO,CACZ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;;OAIG;IACG,aAAa,CAClB,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;OAGG;IACG,iBAAiB,CACtB,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,MAAM,EAAE,EACrB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB,yCAAyC;IACzC;;;;;;;OAOG;IACH,mBAAmB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa;IAItD;;;;;;OAMG;IACH,yBAAyB,IAAI;QAC5B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;YACpB,oBAAoB,CACnB,GAAG,IAAI,EAAE,KAAK,EAAE,GACd,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;SACpD,CAAC;KACF;IAmBD;;;;OAIG;IACH,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM;IAQ1C,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,YAAY;IAexC;;;;OAIG;IACH,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAI5D,yCAAyC;IACzC,gBAAgB,IAAI,MAAM,EAAE;IAI5B;;;;;;;;;OASG;IACG,KAAK,CACV,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,YAAY,EACrB,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAwBhB;;;;OAIG;IACG,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAezE;AAwBD,kEAAkE;AAClE;;;;;;GAMG"}
|
package/dist/AuthManager.js
CHANGED
|
@@ -3,9 +3,31 @@
|
|
|
3
3
|
*
|
|
4
4
|
* @implements FR48, FR50, FR51
|
|
5
5
|
*/
|
|
6
|
+
import { Authenticator } from "./Authenticator.js";
|
|
6
7
|
import { WardenError } from "./errors.js";
|
|
8
|
+
import { sanitizePayload } from "./sanitize.js";
|
|
9
|
+
export { sanitizePayload };
|
|
7
10
|
import { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
|
|
8
11
|
import { RightsResolver } from "./rights/RightsResolver.js";
|
|
12
|
+
/**
|
|
13
|
+
* The event namespace for a guard, taken from its DRIVER.
|
|
14
|
+
*
|
|
15
|
+
* AdonisJS namespaces auth events per driver — `session_auth:*`,
|
|
16
|
+
* `access_tokens_auth:*`, `basic_auth:*` — so an app can audit session logins
|
|
17
|
+
* without also hearing about every bearer token. Warden emitted `session_auth:*`
|
|
18
|
+
* whatever authenticated, which told a session listener about JWT traffic and
|
|
19
|
+
* left no name to subscribe to for the others.
|
|
20
|
+
*
|
|
21
|
+
* Driven by the strategy's `name` rather than the guard's config key: a guard
|
|
22
|
+
* called `web` running a `SessionStrategy` is still the session driver, exactly
|
|
23
|
+
* as upstream. A driver already ending in `_auth` (`basic_auth`) keeps its name
|
|
24
|
+
* rather than growing a second suffix, which is how AdonisJS spells it.
|
|
25
|
+
*/
|
|
26
|
+
export function authEventPrefix(driverName) {
|
|
27
|
+
if (!driverName)
|
|
28
|
+
return "session_auth";
|
|
29
|
+
return driverName.endsWith("_auth") ? driverName : `${driverName}_auth`;
|
|
30
|
+
}
|
|
9
31
|
/**
|
|
10
32
|
* Capability check for {@link AuthManager.issueFor}. `signToken` is not on the
|
|
11
33
|
* `AuthStrategy` interface (only token-minting strategies have it), so narrow
|
|
@@ -176,6 +198,51 @@ export class AuthManager {
|
|
|
176
198
|
return (await this.resolvePermissions(user, scope)).hasAll(permissions);
|
|
177
199
|
}
|
|
178
200
|
/** Get a registered strategy by name. */
|
|
201
|
+
/**
|
|
202
|
+
* An {@link Authenticator} bound to one request (AdonisJS
|
|
203
|
+
* `createAuthenticator`).
|
|
204
|
+
*
|
|
205
|
+
* What the HTTP middleware builds per request. Exposed so anything outside
|
|
206
|
+
* that path — a console command acting as a user, a background job — can
|
|
207
|
+
* build one without reaching for the class.
|
|
208
|
+
*/
|
|
209
|
+
createAuthenticator(ctx) {
|
|
210
|
+
return new Authenticator(ctx, this);
|
|
211
|
+
}
|
|
212
|
+
/**
|
|
213
|
+
* What a test client needs to authenticate as a user (AdonisJS
|
|
214
|
+
* `createAuthenticatorClient`).
|
|
215
|
+
*
|
|
216
|
+
* Delegates to the guard's own `authenticateAsClient`, so a guard with no
|
|
217
|
+
* test seam says so instead of having one forged for it.
|
|
218
|
+
*/
|
|
219
|
+
createAuthenticatorClient() {
|
|
220
|
+
return {
|
|
221
|
+
use: (guard) => {
|
|
222
|
+
const strategy = this.getStrategy(guard);
|
|
223
|
+
const seam = strategy.authenticateAsClient?.bind(strategy);
|
|
224
|
+
if (!seam) {
|
|
225
|
+
throw new WardenError("STRATEGY_HAS_NO_CLIENT", `Auth strategy '${guard ?? this.default}' has no authenticateAsClient() — it cannot forge a client request.`, {
|
|
226
|
+
hint: "Implement authenticateAsClient() on the strategy, or authenticate through a real login in the test.",
|
|
227
|
+
});
|
|
228
|
+
}
|
|
229
|
+
return { authenticateAsClient: seam };
|
|
230
|
+
},
|
|
231
|
+
};
|
|
232
|
+
}
|
|
233
|
+
/**
|
|
234
|
+
* The event namespace a guard's events carry, resolved from its driver.
|
|
235
|
+
* Falls back to `session_auth` when the guard cannot be resolved, so a
|
|
236
|
+
* failure to look one up never becomes a second failure at emit time.
|
|
237
|
+
*/
|
|
238
|
+
eventPrefixFor(guardName) {
|
|
239
|
+
try {
|
|
240
|
+
return authEventPrefix(this.getStrategy(guardName).name);
|
|
241
|
+
}
|
|
242
|
+
catch {
|
|
243
|
+
return authEventPrefix(undefined);
|
|
244
|
+
}
|
|
245
|
+
}
|
|
179
246
|
getStrategy(name) {
|
|
180
247
|
const strategyName = name ?? this.default;
|
|
181
248
|
const strategy = this.guards.get(strategyName);
|
|
@@ -219,12 +286,13 @@ export class AuthManager {
|
|
|
219
286
|
hint: "login()/logout() need a stateful guard (e.g. SessionStrategy). JWT / API-key guards are stateless — mint a token with issueFor() instead.",
|
|
220
287
|
});
|
|
221
288
|
}
|
|
222
|
-
|
|
289
|
+
const prefix = authEventPrefix(strategy.name);
|
|
290
|
+
this.#emit(`${prefix}:login_attempted`, {
|
|
223
291
|
guardName: strategyName ?? this.default,
|
|
224
292
|
user,
|
|
225
293
|
});
|
|
226
294
|
await strategy.login(user, session);
|
|
227
|
-
this.#emit(
|
|
295
|
+
this.#emit(`${prefix}:login_succeeded`, {
|
|
228
296
|
guardName: strategyName ?? this.default,
|
|
229
297
|
user,
|
|
230
298
|
sessionId: undefined,
|
|
@@ -241,7 +309,7 @@ export class AuthManager {
|
|
|
241
309
|
throw new WardenError("STRATEGY_CANNOT_LOGIN", `Auth strategy '${strategyName ?? this.default}' does not support session logout.`);
|
|
242
310
|
}
|
|
243
311
|
await strategy.logout(session);
|
|
244
|
-
this.#emit(
|
|
312
|
+
this.#emit(`${authEventPrefix(strategy.name)}:logged_out`, {
|
|
245
313
|
guardName: strategyName ?? this.default,
|
|
246
314
|
user: null,
|
|
247
315
|
error: null,
|
|
@@ -267,11 +335,4 @@ function isLoginCapable(strategy) {
|
|
|
267
335
|
* directly (not `AuthManager.verify`), so without this it would skip
|
|
268
336
|
* the guard JWT / api-key users get.
|
|
269
337
|
*/
|
|
270
|
-
export function sanitizePayload(user) {
|
|
271
|
-
for (const key of ["__proto__", "constructor", "prototype"]) {
|
|
272
|
-
if (key in user) {
|
|
273
|
-
delete user[key];
|
|
274
|
-
}
|
|
275
|
-
}
|
|
276
|
-
}
|
|
277
338
|
//# sourceMappingURL=AuthManager.js.map
|
package/dist/AuthManager.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthManager.js","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"AuthManager.js","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAyC5D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,UAA8B;IAC7D,IAAI,CAAC,UAAU;QAAE,OAAO,cAAc,CAAC;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,OAAO,CAAC;AACzE,CAAC;AAmDD;;;;GAIG;AACH,SAAS,aAAa,CACrB,QAAsB;IAEtB,OAAO,WAAW,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC;AAC5E,CAAC;AAaD,MAAM,OAAO,WAAW;IACvB,2EAA2E;IAC3E,iFAAiF;IACzE,MAAM,GAA8B,IAAI,GAAG,EAAE,CAAC;IAC9C,OAAO,CAAS;IACP,MAAM,CAAiB;IAExC;;;;OAIG;IACH,QAAQ,CAA4B;IAEpC;;;OAGG;IACH,UAAU,CAAC,OAAsB;QAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,KAAa,EAAE,OAAgC;QAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,KAAa,EAAE,OAAgC;QACpD,IAAI,CAAC;YACJ,KAAK,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACR,kEAAkE;QACnE,CAAC;IACF,CAAC;IAED,YAAY,MAAkB;QAC7B,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC;QAC9D,IAAI,CAAC,MAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,wGAAwG,CACxG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,sEAAsE;QACtE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,6IAA6I,CAC7I,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,kBAAkB,YAAY,4BAA4B,CAC1D,CAAC;QACH,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,YAAY,CACjB,WAAoC,EACpC,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;aACpE,CAAC;QACH,CAAC;IACF,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,MAAM,CACX,KAAa,EACb,YAAqB,EACrB,OAAiC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;gBAClE,aAAa,EAAE,IAAI;aACnB,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAiB,EAAE,YAAqB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,OAAO,wBAAwB,EACtE;gBACC,IAAI,EAAE,8HAA8H;aACpI,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAiB,EACjB,QAAe,QAAQ;QAEvB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACZ,IAAiB,EACjB,IAAY,EACZ,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAClB,IAAiB,EACjB,UAAkB,EAClB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CACtB,IAAiB,EACjB,WAAqB,EACrB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzE,CAAC;IAED,yCAAyC;IACzC;;;;;;;OAOG;IACH,mBAAmB,CAAC,GAAkB;QACrC,OAAO,IAAI,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,yBAAyB;QAOxB,OAAO;YACN,GAAG,EAAE,CAAC,KAAc,EAAE,EAAE;gBACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;oBACX,MAAM,IAAI,WAAW,CACpB,wBAAwB,EACxB,kBAAkB,KAAK,IAAI,IAAI,CAAC,OAAO,qEAAqE,EAC5G;wBACC,IAAI,EAAE,qGAAqG;qBAC3G,CACD,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;SACD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,SAAkB;QAChC,IAAI,CAAC;YACJ,OAAO,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACF,CAAC;IAED,WAAW,CAAC,IAAa;QACxB,MAAM,YAAY,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACpB,oBAAoB,EACpB,kBAAkB,YAAY,kBAAkB,EAChD;gBACC,IAAI,EAAE,0DAA0D;aAChE,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,IAAI,mBAAmB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAY,EAAE,QAAsB;QACpD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,yCAAyC;IACzC,gBAAgB;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,KAAK,CACV,IAAiB,EACjB,OAAqB,EACrB,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,OAAO,mCAAmC,EACjF;gBACC,IAAI,EAAE,2IAA2I;aACjJ,CACD,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE;YACvC,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,OAAO;YACvC,IAAI;SACJ,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE;YACvC,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,OAAO;YACvC,IAAI;YACJ,SAAS,EAAE,SAAS;SACpB,CAAC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAqB,EAAE,YAAqB;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,OAAO,oCAAoC,CAClF,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE;YAC1D,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,OAAO;YACvC,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI;SACX,CAAC,CAAC;IACJ,CAAC;CACD;AAQD;;;;GAIG;AACH,SAAS,cAAc,CACtB,QAAsB;IAEtB,OAAO,CACN,OAAO,IAAI,QAAQ;QACnB,OAAO,QAAQ,CAAC,KAAK,KAAK,UAAU;QACpC,QAAQ,IAAI,QAAQ;QACpB,OAAO,QAAQ,CAAC,MAAM,KAAK,UAAU,CACrC,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE;;;;;;GAMG"}
|
package/dist/Authenticator.d.ts
CHANGED
|
@@ -13,7 +13,7 @@
|
|
|
13
13
|
* (resolved via `ctx.containerResolver`) + the request `ctx`; it never imports
|
|
14
14
|
* `@c9up/ream`.
|
|
15
15
|
*/
|
|
16
|
-
import {
|
|
16
|
+
import type { AuthManager, AuthResult, UserPayload } from "./AuthManager.js";
|
|
17
17
|
import type { WardenContext } from "./middleware.js";
|
|
18
18
|
import type { SessionStore } from "./strategies/SessionStrategy.js";
|
|
19
19
|
/**
|
|
@@ -105,6 +105,18 @@ export declare class Authenticator {
|
|
|
105
105
|
* propagates (a server incident must not be silently swallowed as "guest").
|
|
106
106
|
*/
|
|
107
107
|
check(): Promise<boolean>;
|
|
108
|
+
/**
|
|
109
|
+
* Try the given guards in order and report whether one succeeded, without
|
|
110
|
+
* throwing (AdonisJS `checkUsing`).
|
|
111
|
+
*
|
|
112
|
+
* The non-throwing sibling of {@link authenticateUsing}: `check()` is to
|
|
113
|
+
* `authenticate()` what this is to it. A handler that wants to branch on
|
|
114
|
+
* "is anyone signed in through either of these" had to wrap the throwing
|
|
115
|
+
* form in a try/catch itself.
|
|
116
|
+
*/
|
|
117
|
+
checkUsing(guards?: string[], options?: {
|
|
118
|
+
loginRoute?: string;
|
|
119
|
+
}): Promise<boolean>;
|
|
108
120
|
/**
|
|
109
121
|
* Authenticate by trying the given guards in order (default: the default
|
|
110
122
|
* guard). Sets the user on the first success; throws `E_UNAUTHORIZED_ACCESS`
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Authenticator.d.ts","sourceRoot":"","sources":["../src/Authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,
|
|
1
|
+
{"version":3,"file":"Authenticator.d.ts","sourceRoot":"","sources":["../src/Authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,UAAU,EAEV,WAAW,EACX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAGhD,CAAC;AAcF,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,GAAG,SAAS,CAAC;CAClC;AAoBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,WAAW,GACf,oBAAoB,CAUtB;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC3B,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACpC,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,EAAE;IACN,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,kBAAkB,EAAE,OAAO,CAAC;CAC5B,GACC,OAAO,CAAC,WAAW,CAAC,CAyDtB;AAED;;;GAGG;AACH,qBAAa,aAAa;;gBAOxB,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,aAAa;IAQtB,kEAAkE;IAClE,IAAI,IAAI,IAAI,WAAW,GAAG,SAAS,CAIlC;IAED,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,0EAA0E;IAC1E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,yDAAyD;IACzD,KAAK,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,+DAA+D;IAC/D,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAavB;AAED;;;;;GAKG;AACH,qBAAa,aAAa;;gBAQb,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW;IAKjD,0DAA0D;IAC1D,IAAI,IAAI,IAAI,WAAW,GAAG,SAAS,CAElC;IAED,qEAAqE;IACrE,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,2EAA2E;IAC3E,IAAI,uBAAuB,IAAI,OAAO,CAErC;IAED,gEAAgE;IAChE,IAAI,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAE9C;IAED;;;;OAIG;IACH,IAAI,KAAK,IAAI,MAAM,EAAE,GAAG,SAAS,CAEhC;IAED,+EAA+E;IAC/E,IAAI,WAAW,IAAI,MAAM,EAAE,GAAG,SAAS,CAEtC;IAED,qFAAqF;IACrF,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAU/B;;;;;;;;OAQG;IACG,UAAU,CACf,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,OAAO,CAAC;IAanB;;;;;OAKG;IACG,iBAAiB,CACtB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;IAuDhB,sEAAsE;IACtE,aAAa,IAAI,WAAW;IAU5B,2FAA2F;IAC3F,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IAShC;;;;OAIG;IACH,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;CAOpE"}
|
package/dist/Authenticator.js
CHANGED
|
@@ -13,8 +13,8 @@
|
|
|
13
13
|
* (resolved via `ctx.containerResolver`) + the request `ctx`; it never imports
|
|
14
14
|
* `@c9up/ream`.
|
|
15
15
|
*/
|
|
16
|
-
import { sanitizePayload, } from "./AuthManager.js";
|
|
17
16
|
import { E_UNAUTHORIZED_ACCESS, WardenError } from "./errors.js";
|
|
17
|
+
import { sanitizePayload } from "./sanitize.js";
|
|
18
18
|
/**
|
|
19
19
|
* Guard names Warden accepts for the API-key / access-tokens driver. AdonisJS
|
|
20
20
|
* names the driver `access_tokens`; the legacy `api-key` spelling stays valid so
|
|
@@ -234,6 +234,29 @@ export class Authenticator {
|
|
|
234
234
|
throw err;
|
|
235
235
|
}
|
|
236
236
|
}
|
|
237
|
+
/**
|
|
238
|
+
* Try the given guards in order and report whether one succeeded, without
|
|
239
|
+
* throwing (AdonisJS `checkUsing`).
|
|
240
|
+
*
|
|
241
|
+
* The non-throwing sibling of {@link authenticateUsing}: `check()` is to
|
|
242
|
+
* `authenticate()` what this is to it. A handler that wants to branch on
|
|
243
|
+
* "is anyone signed in through either of these" had to wrap the throwing
|
|
244
|
+
* form in a try/catch itself.
|
|
245
|
+
*/
|
|
246
|
+
async checkUsing(guards, options) {
|
|
247
|
+
try {
|
|
248
|
+
await this.authenticateUsing(guards, options);
|
|
249
|
+
return this.isAuthenticated;
|
|
250
|
+
}
|
|
251
|
+
catch (err) {
|
|
252
|
+
// A credential rejection is an answer, not a failure. Anything else
|
|
253
|
+
// — a crashed strategy, a config error — is still a real problem and
|
|
254
|
+
// must not be reported as "not signed in".
|
|
255
|
+
if (err instanceof E_UNAUTHORIZED_ACCESS)
|
|
256
|
+
return false;
|
|
257
|
+
throw err;
|
|
258
|
+
}
|
|
259
|
+
}
|
|
237
260
|
/**
|
|
238
261
|
* Authenticate by trying the given guards in order (default: the default
|
|
239
262
|
* guard). Sets the user on the first success; throws `E_UNAUTHORIZED_ACCESS`
|
|
@@ -244,11 +267,10 @@ export class Authenticator {
|
|
|
244
267
|
this.#attempted = true;
|
|
245
268
|
const names = guards && guards.length > 0 ? guards : [this.#auth.defaultStrategyName];
|
|
246
269
|
const guardName = names[0] ?? this.#auth.defaultStrategyName;
|
|
247
|
-
//
|
|
248
|
-
//
|
|
249
|
-
|
|
250
|
-
|
|
251
|
-
});
|
|
270
|
+
// Namespaced by the guard's driver, as AdonisJS does: `session_auth:*`,
|
|
271
|
+
// `access_tokens_auth:*`, `basic_auth:*`. An app auditing session logins
|
|
272
|
+
// must not be told about bearer-token traffic under the same name.
|
|
273
|
+
this.#auth.emitAuthEvent(`${this.#auth.eventPrefixFor(guardName)}:authentication_attempted`, { guardName });
|
|
252
274
|
const creds = extractCredentials(this.#ctx, this.#auth);
|
|
253
275
|
const hasSessionStrategy = names.includes("session");
|
|
254
276
|
const { result, viaGuard, attemptCount, crashCount } = await tryAuthenticate(this.#auth, names, {
|
|
@@ -258,11 +280,10 @@ export class Authenticator {
|
|
|
258
280
|
if (result?.authenticated && result.user) {
|
|
259
281
|
this.#user = result.user;
|
|
260
282
|
this.#viaGuard = viaGuard;
|
|
261
|
-
|
|
262
|
-
|
|
263
|
-
|
|
264
|
-
|
|
265
|
-
});
|
|
283
|
+
// The guard that actually answered names the event, not the one asked
|
|
284
|
+
// for first.
|
|
285
|
+
const winner = viaGuard ?? guardName;
|
|
286
|
+
this.#auth.emitAuthEvent(`${this.#auth.eventPrefixFor(winner)}:authentication_succeeded`, { guardName: winner, user: result.user, sessionId: undefined });
|
|
266
287
|
return;
|
|
267
288
|
}
|
|
268
289
|
// Every attempted guard crashed → a server-side incident, not a
|
|
@@ -274,10 +295,7 @@ export class Authenticator {
|
|
|
274
295
|
guardDriverName: guardName,
|
|
275
296
|
redirectTo: hasSessionStrategy ? options?.loginRoute : undefined,
|
|
276
297
|
});
|
|
277
|
-
this.#auth.emitAuthEvent(
|
|
278
|
-
guardName,
|
|
279
|
-
error: failure,
|
|
280
|
-
});
|
|
298
|
+
this.#auth.emitAuthEvent(`${this.#auth.eventPrefixFor(guardName)}:authentication_failed`, { guardName, error: failure });
|
|
281
299
|
throw failure;
|
|
282
300
|
}
|
|
283
301
|
/** Return the authenticated user or throw `E_UNAUTHORIZED_ACCESS`. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Authenticator.js","sourceRoot":"","sources":["../src/Authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;
|
|
1
|
+
{"version":3,"file":"Authenticator.js","sourceRoot":"","sources":["../src/Authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACrD,eAAe;IACf,SAAS;CACT,CAAC;AAMF,SAAS,oBAAoB,CAC5B,QAAsB;IAEtB,OAAO,CACN,OAAQ,QAAgC,CAAC,iBAAiB,KAAK,UAAU,CACzE,CAAC;AACH,CAAC;AASD;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,IAAiB;IAC7C,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACxC,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACR,uDAAuD;QACxD,CAAC;IACF,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,GAAkB,EAClB,IAAiB;IAEjB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QACnD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;IACN,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACtE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;AACtD,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,IAAiB,EACjB,UAAoB,EACpB,KAKC;IAED,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,IAAI,MAAM,GAAsB,IAAI,CAAC;IACrC,IAAI,QAA4B,CAAC;IACjC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC;YACJ,IAAI,CAAa,CAAC;YAClB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBAChD,MAAM,iBAAiB,GACtB,QAAQ,IAAI,oBAAoB,CAAC,QAAQ,CAAC;oBACzC,CAAC,CAAC,QAAQ,CAAC,iBAAiB;oBAC5B,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,iBAAiB,EAAE,CAAC;oBACvB,YAAY,EAAE,CAAC;oBACf,CAAC,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC5D,+DAA+D;oBAC/D,gEAAgE;oBAChE,IAAI,CAAC,CAAC,IAAI;wBAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACP,SAAS;gBACV,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,4DAA4D;gBAC5D,+DAA+D;gBAC/D,iEAAiE;gBACjE,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAC5D,CAAC,CAAC,MAAM,IAAI,WAAW;oBACvB,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;gBACzB,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC1B,YAAY,EAAE,CAAC;gBACf,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBACrB,MAAM,GAAG,CAAC,CAAC;gBACX,QAAQ,GAAG,YAAY,CAAC;gBACxB,MAAM;YACP,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC9B,UAAU,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,4BAA4B,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAC1F,CAAC;YACH,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,mEAAmE;YACnE,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,0BAA0B,EAC5D,GAAG,CACH,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,aAAa;IAChB,IAAI,CAAgB;IACpB,KAAK,CAAc;IACnB,KAAK,CAAS;IACd,OAAO,CAAgB;IAEhC,YACC,GAAkB,EAClB,IAAiB,EACjB,IAAY,EACZ,MAAqB;QAErB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,kEAAkE;IAClE,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,KAAK,IAAI,CAAC,KAAK;YACvD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;YACnB,CAAC,CAAC,SAAS,CAAC;IACd,CAAC;IAED,IAAI,eAAe;QAClB,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IAChC,CAAC;IAED,0EAA0E;IAC1E,YAAY;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,IAAiB;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAED,+DAA+D;IAC/D,MAAM;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,eAAe;QACd,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,WAAW,CACpB,YAAY,EACZ,UAAU,IAAI,CAAC,KAAK,4GAA4G,CAChI,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IAC1B,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IAChB,IAAI,CAAgB;IACpB,KAAK,CAAc;IAC5B,KAAK,CAAe;IACpB,SAAS,CAAU;IACnB,UAAU,GAAG,KAAK,CAAC;IACV,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAExD,YAAY,GAAkB,EAAE,IAAiB;QAChD,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,0DAA0D;IAC1D,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,qEAAqE;IACrE,IAAI,eAAe;QAClB,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IACjC,CAAC;IAED,2EAA2E;IAC3E,IAAI,uBAAuB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC;IACxB,CAAC;IAED,gEAAgE;IAChE,IAAI,qBAAqB;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;IAC1B,CAAC;IAED,+EAA+E;IAC/E,IAAI,WAAW;QACd,OAAO,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC;IAChC,CAAC;IAED,qFAAqF;IACrF,YAAY;QACX,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACV,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,eAAe,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,qBAAqB;gBAAE,OAAO,KAAK,CAAC;YACvD,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CACf,MAAiB,EACjB,OAAiC;QAEjC,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC,eAAe,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,2CAA2C;YAC3C,IAAI,GAAG,YAAY,qBAAqB;gBAAE,OAAO,KAAK,CAAC;YACvD,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACtB,MAAiB,EACjB,OAAiC;QAEjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,MAAM,KAAK,GACV,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAC7D,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,IAAI,CAAC,KAAK,CAAC,aAAa,CACvB,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,2BAA2B,EAClE,EAAE,SAAS,EAAE,CACb,CAAC;QACF,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,kBAAkB,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,GACnD,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE;YACxC,GAAG,KAAK;YACR,kBAAkB;SAClB,CAAC,CAAC;QAEJ,IAAI,MAAM,EAAE,aAAa,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC1B,sEAAsE;YACtE,aAAa;YACb,MAAM,MAAM,GAAG,QAAQ,IAAI,SAAS,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,aAAa,CACvB,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,2BAA2B,EAC/D,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAC9D,CAAC;YACF,OAAO;QACR,CAAC;QACD,gEAAgE;QAChE,0EAA0E;QAC1E,IAAI,YAAY,GAAG,CAAC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YACrD,MAAM,IAAI,WAAW,CACpB,qBAAqB,EACrB,gFAAgF,EAChF,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,qBAAqB,CACxC,MAAM,EAAE,KAAK,IAAI,qBAAqB,EACtC;YACC,eAAe,EAAE,SAAS;YAC1B,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS;SAChE,CACD,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,aAAa,CACvB,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,wBAAwB,EAC/D,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAC7B,CAAC;QACF,MAAM,OAAO,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,aAAa;QACZ,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,qBAAqB,CAC9B,yEAAyE,EACzE,EAAE,eAAe,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CACrE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,2FAA2F;IAC3F,GAAG,CAAC,IAAY;QACf,IAAI,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,QAAQ,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAyB,EAAE,QAA4B;QAC5D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,MAAM,EAAE,aAAa,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC3B,CAAC;IACF,CAAC;CACD"}
|
|
@@ -19,6 +19,7 @@
|
|
|
19
19
|
* invalidates the old one, so a stolen cookie stops working the moment the
|
|
20
20
|
* legitimate user comes back.
|
|
21
21
|
*/
|
|
22
|
+
import { Secret } from "./Secret.js";
|
|
22
23
|
/** Bytes of entropy in a token secret. Adonis defaults to 40. */
|
|
23
24
|
export declare const DEFAULT_SECRET_LENGTH = 40;
|
|
24
25
|
/** A token as persisted. The secret is NOT here — only its hash. */
|
|
@@ -96,4 +97,73 @@ export declare class MemoryRememberMeTokenDriver implements RememberMeTokenDrive
|
|
|
96
97
|
delete(identifier: string): Promise<void>;
|
|
97
98
|
deleteAllForUser(userId: string | number): Promise<void>;
|
|
98
99
|
}
|
|
100
|
+
/**
|
|
101
|
+
* A remember-me token as an object, matching `@adonisjs/auth`'s
|
|
102
|
+
* `RememberMeToken` (modules/session_guard/remember_me_token.ts).
|
|
103
|
+
*
|
|
104
|
+
* The functions above are what warden's own guard uses and stay the primary
|
|
105
|
+
* API. This class exists because an app moving over calls
|
|
106
|
+
* `RememberMeToken.decode(...)` / `token.verify(secret)` directly — upstream
|
|
107
|
+
* exports it — and finding nothing under that name is a migration stopping at
|
|
108
|
+
* an import line. Both sit on the same encoding and the same hashing, so they
|
|
109
|
+
* cannot disagree about what a token is.
|
|
110
|
+
*
|
|
111
|
+
* Secrets come back wrapped in {@link Secret} so one cannot end up in a log by
|
|
112
|
+
* being interpolated into a string, which is what upstream does too.
|
|
113
|
+
*/
|
|
114
|
+
export declare class RememberMeToken {
|
|
115
|
+
/**
|
|
116
|
+
* Split a public token value into its identifier and secret. Returns `null`
|
|
117
|
+
* for anything malformed rather than throwing — a bad cookie is an ordinary
|
|
118
|
+
* event, not an exception.
|
|
119
|
+
*/
|
|
120
|
+
static decode(value: string): {
|
|
121
|
+
identifier: string;
|
|
122
|
+
secret: Secret<string>;
|
|
123
|
+
} | null;
|
|
124
|
+
/** A fresh secret and the hash to store for it. */
|
|
125
|
+
static seed(size?: number): {
|
|
126
|
+
secret: Secret<string>;
|
|
127
|
+
hash: string;
|
|
128
|
+
};
|
|
129
|
+
/**
|
|
130
|
+
* Everything the persistence layer needs for a new token, without deciding
|
|
131
|
+
* how it is stored (upstream `createTransientToken`).
|
|
132
|
+
*
|
|
133
|
+
* `expiresIn` is in SECONDS, as everywhere else in this module. AdonisJS
|
|
134
|
+
* also accepts a duration string there; warden takes the number, so the
|
|
135
|
+
* unit is never ambiguous at a call site.
|
|
136
|
+
*/
|
|
137
|
+
static createTransientToken(userId: string | number, size: number, expiresIn: number): {
|
|
138
|
+
secret: Secret<string>;
|
|
139
|
+
hash: string;
|
|
140
|
+
userId: string | number;
|
|
141
|
+
expiresAt: Date;
|
|
142
|
+
};
|
|
143
|
+
identifier: string;
|
|
144
|
+
tokenableId: string | number;
|
|
145
|
+
hash: string;
|
|
146
|
+
createdAt: Date;
|
|
147
|
+
updatedAt: Date;
|
|
148
|
+
expiresAt: Date;
|
|
149
|
+
/** The public `identifier.secret` value — only on a token just minted. */
|
|
150
|
+
value?: Secret<string>;
|
|
151
|
+
constructor(attributes: {
|
|
152
|
+
identifier: string;
|
|
153
|
+
tokenableId: string | number;
|
|
154
|
+
hash: string;
|
|
155
|
+
createdAt: Date;
|
|
156
|
+
updatedAt: Date;
|
|
157
|
+
expiresAt: Date;
|
|
158
|
+
secret?: Secret<string>;
|
|
159
|
+
});
|
|
160
|
+
/** Build one from a stored row, whose timestamps are epoch milliseconds. */
|
|
161
|
+
static fromStored(stored: StoredRememberMeToken): RememberMeToken;
|
|
162
|
+
/** The row to persist, in the shape {@link RememberMeTokenDriver} takes. */
|
|
163
|
+
toStored(): StoredRememberMeToken;
|
|
164
|
+
/** Whether the token is past its expiry. */
|
|
165
|
+
isExpired(): boolean;
|
|
166
|
+
/** Constant-time check of a presented secret against the stored hash. */
|
|
167
|
+
verify(secret: Secret<string>): boolean;
|
|
168
|
+
}
|
|
99
169
|
//# sourceMappingURL=RememberMeToken.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"RememberMeToken.d.ts","sourceRoot":"","sources":["../src/RememberMeToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;
|
|
1
|
+
{"version":3,"file":"RememberMeToken.d.ts","sourceRoot":"","sources":["../src/RememberMeToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACrC,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,wEAAwE;AACxE,MAAM,WAAW,qBAAqB;IACrC,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAChE,gEAAgE;IAChE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAoBD,kDAAkD;AAClD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAK/D;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAC/B,KAAK,EAAE,OAAO,GACZ;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAS/C;AAED,kDAAkD;AAClD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACrC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,UAAU,EAAE,MAAM,EAClB,YAAY,SAAwB,GAClC,qBAAqB,CAevB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,+BAA+B,CACpD,MAAM,EAAE,qBAAqB,EAC7B,WAAW,EAAE,OAAO,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,SAAwB,GAClC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAyB5D;AAED,8EAA8E;AAC9E,qBAAa,2BAA4B,YAAW,qBAAqB;;IAGlE,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAK/D,MAAM,CACX,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAWV,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAO9D;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,eAAe;IAC3B;;;;OAIG;IACH,MAAM,CAAC,MAAM,CACZ,KAAK,EAAE,MAAM,GACX;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI;IASxD,mDAAmD;IACnD,MAAM,CAAC,IAAI,CAAC,IAAI,GAAE,MAA8B,GAAG;QAClD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC;KACb;IAKD;;;;;;;OAOG;IACH,MAAM,CAAC,oBAAoB,CAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GACf;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;QACxB,SAAS,EAAE,IAAI,CAAC;KAChB;IAUD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBAEX,UAAU,EAAE;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;KACxB;IAcD,4EAA4E;IAC5E,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe;IAWjE,4EAA4E;IAC5E,QAAQ,IAAI,qBAAqB;IAWjC,4CAA4C;IAC5C,SAAS,IAAI,OAAO;IAIpB,yEAAyE;IACzE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO;CAGvC"}
|
package/dist/RememberMeToken.js
CHANGED
|
@@ -20,6 +20,7 @@
|
|
|
20
20
|
* legitimate user comes back.
|
|
21
21
|
*/
|
|
22
22
|
import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
|
|
23
|
+
import { Secret } from "./Secret.js";
|
|
23
24
|
/** Bytes of entropy in a token secret. Adonis defaults to 40. */
|
|
24
25
|
export const DEFAULT_SECRET_LENGTH = 40;
|
|
25
26
|
/** Base64url without padding — the encoding Adonis uses for the token halves. */
|
|
@@ -164,4 +165,105 @@ export class MemoryRememberMeTokenDriver {
|
|
|
164
165
|
}
|
|
165
166
|
}
|
|
166
167
|
}
|
|
168
|
+
/**
|
|
169
|
+
* A remember-me token as an object, matching `@adonisjs/auth`'s
|
|
170
|
+
* `RememberMeToken` (modules/session_guard/remember_me_token.ts).
|
|
171
|
+
*
|
|
172
|
+
* The functions above are what warden's own guard uses and stay the primary
|
|
173
|
+
* API. This class exists because an app moving over calls
|
|
174
|
+
* `RememberMeToken.decode(...)` / `token.verify(secret)` directly — upstream
|
|
175
|
+
* exports it — and finding nothing under that name is a migration stopping at
|
|
176
|
+
* an import line. Both sit on the same encoding and the same hashing, so they
|
|
177
|
+
* cannot disagree about what a token is.
|
|
178
|
+
*
|
|
179
|
+
* Secrets come back wrapped in {@link Secret} so one cannot end up in a log by
|
|
180
|
+
* being interpolated into a string, which is what upstream does too.
|
|
181
|
+
*/
|
|
182
|
+
export class RememberMeToken {
|
|
183
|
+
/**
|
|
184
|
+
* Split a public token value into its identifier and secret. Returns `null`
|
|
185
|
+
* for anything malformed rather than throwing — a bad cookie is an ordinary
|
|
186
|
+
* event, not an exception.
|
|
187
|
+
*/
|
|
188
|
+
static decode(value) {
|
|
189
|
+
const decoded = decodeTokenValue(value);
|
|
190
|
+
if (!decoded)
|
|
191
|
+
return null;
|
|
192
|
+
return {
|
|
193
|
+
identifier: decoded.identifier,
|
|
194
|
+
secret: new Secret(decoded.secret),
|
|
195
|
+
};
|
|
196
|
+
}
|
|
197
|
+
/** A fresh secret and the hash to store for it. */
|
|
198
|
+
static seed(size = DEFAULT_SECRET_LENGTH) {
|
|
199
|
+
const secret = randomBytes(size).toString("base64url");
|
|
200
|
+
return { secret: new Secret(secret), hash: hashSecret(secret) };
|
|
201
|
+
}
|
|
202
|
+
/**
|
|
203
|
+
* Everything the persistence layer needs for a new token, without deciding
|
|
204
|
+
* how it is stored (upstream `createTransientToken`).
|
|
205
|
+
*
|
|
206
|
+
* `expiresIn` is in SECONDS, as everywhere else in this module. AdonisJS
|
|
207
|
+
* also accepts a duration string there; warden takes the number, so the
|
|
208
|
+
* unit is never ambiguous at a call site.
|
|
209
|
+
*/
|
|
210
|
+
static createTransientToken(userId, size, expiresIn) {
|
|
211
|
+
const { secret, hash } = RememberMeToken.seed(size);
|
|
212
|
+
return {
|
|
213
|
+
secret,
|
|
214
|
+
hash,
|
|
215
|
+
userId,
|
|
216
|
+
expiresAt: new Date(Date.now() + expiresIn * 1000),
|
|
217
|
+
};
|
|
218
|
+
}
|
|
219
|
+
identifier;
|
|
220
|
+
tokenableId;
|
|
221
|
+
hash;
|
|
222
|
+
createdAt;
|
|
223
|
+
updatedAt;
|
|
224
|
+
expiresAt;
|
|
225
|
+
/** The public `identifier.secret` value — only on a token just minted. */
|
|
226
|
+
value;
|
|
227
|
+
constructor(attributes) {
|
|
228
|
+
this.identifier = attributes.identifier;
|
|
229
|
+
this.tokenableId = attributes.tokenableId;
|
|
230
|
+
this.hash = attributes.hash;
|
|
231
|
+
this.createdAt = attributes.createdAt;
|
|
232
|
+
this.updatedAt = attributes.updatedAt;
|
|
233
|
+
this.expiresAt = attributes.expiresAt;
|
|
234
|
+
if (attributes.secret) {
|
|
235
|
+
this.value = new Secret(encodeTokenValue(attributes.identifier, attributes.secret.release()));
|
|
236
|
+
}
|
|
237
|
+
}
|
|
238
|
+
/** Build one from a stored row, whose timestamps are epoch milliseconds. */
|
|
239
|
+
static fromStored(stored) {
|
|
240
|
+
return new RememberMeToken({
|
|
241
|
+
identifier: stored.identifier,
|
|
242
|
+
tokenableId: stored.tokenableId,
|
|
243
|
+
hash: stored.hash,
|
|
244
|
+
createdAt: new Date(stored.createdAt),
|
|
245
|
+
updatedAt: new Date(stored.updatedAt),
|
|
246
|
+
expiresAt: new Date(stored.expiresAt),
|
|
247
|
+
});
|
|
248
|
+
}
|
|
249
|
+
/** The row to persist, in the shape {@link RememberMeTokenDriver} takes. */
|
|
250
|
+
toStored() {
|
|
251
|
+
return {
|
|
252
|
+
identifier: this.identifier,
|
|
253
|
+
tokenableId: this.tokenableId,
|
|
254
|
+
hash: this.hash,
|
|
255
|
+
createdAt: this.createdAt.getTime(),
|
|
256
|
+
updatedAt: this.updatedAt.getTime(),
|
|
257
|
+
expiresAt: this.expiresAt.getTime(),
|
|
258
|
+
};
|
|
259
|
+
}
|
|
260
|
+
/** Whether the token is past its expiry. */
|
|
261
|
+
isExpired() {
|
|
262
|
+
return this.expiresAt.getTime() <= Date.now();
|
|
263
|
+
}
|
|
264
|
+
/** Constant-time check of a presented secret against the stored hash. */
|
|
265
|
+
verify(secret) {
|
|
266
|
+
return safeCompareHashes(this.hash, hashSecret(secret.release()));
|
|
267
|
+
}
|
|
268
|
+
}
|
|
167
269
|
//# sourceMappingURL=RememberMeToken.js.map
|