@c9up/warden 0.1.3 → 0.1.4

package/dist/AuthManager.d.ts

@@ -0,0 +1,98 @@
+/**
+ * AuthManager — manages multiple authentication strategies.
+ *
+ * @implements FR48, FR50, FR51
+ */
+import { RightsResolver } from "./rights/RightsResolver.js";
+import type { EffectivePermissions, Scope } from "./rights/types.js";
+export interface UserPayload {
+    id: string;
+    roles?: string[];
+    permissions?: string[];
+    [key: string]: unknown;
+}
+export interface AuthResult {
+    authenticated: boolean;
+    user?: UserPayload;
+    error?: string;
+    /**
+     * @internal Set when the strategy's `verify()` / `authenticate()` THREW
+     * a generic error (vs returned a deliberate `{ authenticated: false }`
+     * rejection). The middleware uses this to distinguish credential
+     * failures (→ 401) from strategy crashes (→ 500). Not part of the
+     * public consumer-facing API.
+     */
+    strategyCrash?: true;
+}
+export interface AuthStrategy {
+    name: string;
+    authenticate(credentials: Record<string, unknown>): Promise<AuthResult>;
+    verify(token: string, context?: Record<string, unknown>): Promise<AuthResult>;
+}
+export interface AuthConfig {
+    defaultStrategy: string;
+    strategies: Record<string, AuthStrategy>;
+    /**
+     * The rights resolver backing the coarse RBAC helpers (Epic 56). When
+     * absent, a default `RightsResolver(new MemoryRightsStore())` is used so
+     * `new AuthManager({ defaultStrategy, strategies })` keeps working — with
+     * an empty store, payload roles still fold in (D2) and permissions are
+     * empty (token `user.permissions` is not an input — D1).
+     */
+    rights?: RightsResolver;
+}
+/**
+ * Manages authentication strategies and provides guard/permission checks.
+ */
+export declare class AuthManager {
+    private strategies;
+    private defaultStrategy;
+    private readonly rights;
+    constructor(config: AuthConfig);
+    /** Authenticate with credentials using a specific or default strategy. */
+    authenticate(credentials: Record<string, unknown>, strategyName?: string): Promise<AuthResult>;
+    /** Verify a token (JWT, session, API key). */
+    verify(token: string, strategyName?: string, context?: Record<string, unknown>): Promise<AuthResult>;
+    /**
+     * Resolve a user's effective permissions for a scope (Epic 56). The single
+     * resolution entry the coarse helpers wrap — `hasRole`/`hasPermission`/
+     * `hasAllPermissions` read this set, never the token payload directly. The
+     * Bouncer policy path (`this.permissions`, 56.3) consults the SAME resolver,
+     * so a coarse question and a policy question return the same answer for the
+     * same `(user, scope)` (the single unification point — AC-E3).
+     */
+    resolvePermissions(user: UserPayload, scope?: Scope): Promise<EffectivePermissions>;
+    /**
+     * Check if a user has a specific role within a scope (default `"global"`).
+     * Reflects payload roles ∪ store roles (D2) — a token-carried role still
+     * satisfies it with no store config.
+     */
+    hasRole(user: UserPayload, role: string, scope?: Scope): Promise<boolean>;
+    /**
+     * Check if a user has a specific permission within a scope (default
+     * `"global"`). Derived from roles + store grants ONLY — token
+     * `user.permissions` is NOT read (D1, cerebrum 459).
+     */
+    hasPermission(user: UserPayload, permission: string, scope?: Scope): Promise<boolean>;
+    /**
+     * Check if a user has ALL required permissions within a scope (default
+     * `"global"`). Empty list ⇒ vacuously true.
+     */
+    hasAllPermissions(user: UserPayload, permissions: string[], scope?: Scope): Promise<boolean>;
+    /** Get a registered strategy by name. */
+    getStrategy(name?: string): AuthStrategy;
+    /** Register a new strategy at runtime. */
+    registerStrategy(name: string, strategy: AuthStrategy): void;
+    /** Get all registered strategy names. */
+    getStrategyNames(): string[];
+}
+/** Strip dangerous prototype-pollution keys from user payload. */
+/**
+ * Strip prototype-pollution keys from a user payload before it's
+ * attached to the request. Exported so the middleware can apply it to
+ * the session path too — session auth goes through `verifyWithContext`
+ * directly (not `AuthManager.verify`), so without this it would skip
+ * the guard JWT / api-key users get.
+ */
+export declare function sanitizePayload(user: UserPayload): void;
+//# sourceMappingURL=AuthManager.d.ts.map

package/dist/AuthManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthManager.d.ts","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAErE,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,UAAU;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,WAAW;IACvB,OAAO,CAAC,UAAU,CAAwC;IAC1D,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAE5B,MAAM,EAAE,UAAU;IA0B9B,0EAA0E;IACpE,YAAY,CACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC;IAmBtB,8CAA8C;IACxC,MAAM,CACX,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,UAAU,CAAC;IAoBtB;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAI,EAAE,WAAW,EACjB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,oBAAoB,CAAC;IAIhC;;;;OAIG;IACG,OAAO,CACZ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;;OAIG;IACG,aAAa,CAClB,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;OAGG;IACG,iBAAiB,CACtB,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,MAAM,EAAE,EACrB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB,yCAAyC;IACzC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,YAAY;IAexC,0CAA0C;IAC1C,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAI5D,yCAAyC;IACzC,gBAAgB,IAAI,MAAM,EAAE;CAG5B;AAED,kEAAkE;AAClE;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAMvD"}

package/dist/AuthManager.js

@@ -0,0 +1,147 @@
+/**
+ * AuthManager — manages multiple authentication strategies.
+ *
+ * @implements FR48, FR50, FR51
+ */
+import { WardenError } from "./errors.js";
+import { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
+import { RightsResolver } from "./rights/RightsResolver.js";
+/**
+ * Manages authentication strategies and provides guard/permission checks.
+ */
+export class AuthManager {
+    strategies = new Map();
+    defaultStrategy;
+    rights;
+    constructor(config) {
+        this.defaultStrategy = config.defaultStrategy;
+        this.rights = config.rights ?? new RightsResolver(new MemoryRightsStore());
+        for (const [name, strategy] of Object.entries(config.strategies)) {
+            this.strategies.set(name, strategy);
+        }
+        // Fail-fast at construction: an AuthManager with zero strategies
+        // is a configuration bug. Previously, an empty `strategies: {}`
+        // passed the constructor cleanly and the first protected request
+        // crashed at runtime when `getStrategy('jwt')` threw — opaque 401
+        // or 500 instead of a boot-time INVALID_CONFIG that points the
+        // operator at the missing `config.auth.jwt` (or other strategy).
+        if (Object.keys(config.strategies).length === 0) {
+            throw new WardenError("INVALID_CONFIG", `AuthManager: no authentication strategies registered. Configure at least one strategy (e.g. config.warden.auth.jwt) before booting WardenProvider.`);
+        }
+        if (!this.strategies.has(config.defaultStrategy)) {
+            throw new WardenError("INVALID_CONFIG", `defaultStrategy '${config.defaultStrategy}' is not present in strategies`);
+        }
+    }
+    /** Authenticate with credentials using a specific or default strategy. */
+    async authenticate(credentials, strategyName) {
+        const strategy = this.getStrategy(strategyName);
+        try {
+            const result = await strategy.authenticate(credentials);
+            if (result.user)
+                sanitizePayload(result.user);
+            return result;
+        }
+        catch (err) {
+            // Re-throw structured WardenError sentinels (e.g. SessionStrategy's
+            // USE_LOGIN throw) so callers see the design-boundary signal instead
+            // of a soft `{ authenticated: false }`. Generic errors stay soft.
+            if (err instanceof WardenError)
+                throw err;
+            return {
+                authenticated: false,
+                error: err instanceof Error ? err.message : "Unknown authentication error",
+            };
+        }
+    }
+    /** Verify a token (JWT, session, API key). */
+    async verify(token, strategyName, context) {
+        const strategy = this.getStrategy(strategyName);
+        try {
+            const result = await strategy.verify(token, context);
+            if (result.user)
+                sanitizePayload(result.user);
+            return result;
+        }
+        catch (err) {
+            // Mirror authenticate(): rethrow structured WardenError sentinels;
+            // soft-fail generic throws but TAG them as strategy crashes so the
+            // middleware can flip 401 → 500 when every attempted strategy bombed.
+            if (err instanceof WardenError)
+                throw err;
+            return {
+                authenticated: false,
+                error: err instanceof Error ? err.message : "Unknown verification error",
+                strategyCrash: true,
+            };
+        }
+    }
+    /**
+     * Resolve a user's effective permissions for a scope (Epic 56). The single
+     * resolution entry the coarse helpers wrap — `hasRole`/`hasPermission`/
+     * `hasAllPermissions` read this set, never the token payload directly. The
+     * Bouncer policy path (`this.permissions`, 56.3) consults the SAME resolver,
+     * so a coarse question and a policy question return the same answer for the
+     * same `(user, scope)` (the single unification point — AC-E3).
+     */
+    resolvePermissions(user, scope = "global") {
+        return this.rights.resolve(user, scope);
+    }
+    /**
+     * Check if a user has a specific role within a scope (default `"global"`).
+     * Reflects payload roles ∪ store roles (D2) — a token-carried role still
+     * satisfies it with no store config.
+     */
+    async hasRole(user, role, scope = "global") {
+        return (await this.resolvePermissions(user, scope)).roles.has(role);
+    }
+    /**
+     * Check if a user has a specific permission within a scope (default
+     * `"global"`). Derived from roles + store grants ONLY — token
+     * `user.permissions` is NOT read (D1, cerebrum 459).
+     */
+    async hasPermission(user, permission, scope = "global") {
+        return (await this.resolvePermissions(user, scope)).has(permission);
+    }
+    /**
+     * Check if a user has ALL required permissions within a scope (default
+     * `"global"`). Empty list ⇒ vacuously true.
+     */
+    async hasAllPermissions(user, permissions, scope = "global") {
+        return (await this.resolvePermissions(user, scope)).hasAll(permissions);
+    }
+    /** Get a registered strategy by name. */
+    getStrategy(name) {
+        const strategyName = name ?? this.defaultStrategy;
+        const strategy = this.strategies.get(strategyName);
+        if (!strategy) {
+            throw new WardenError("STRATEGY_NOT_FOUND", `Auth strategy '${strategyName}' not registered`, {
+                hint: "Call registerStrategy() before using this strategy name.",
+            });
+        }
+        return strategy;
+    }
+    /** Register a new strategy at runtime. */
+    registerStrategy(name, strategy) {
+        this.strategies.set(name, strategy);
+    }
+    /** Get all registered strategy names. */
+    getStrategyNames() {
+        return [...this.strategies.keys()];
+    }
+}
+/** Strip dangerous prototype-pollution keys from user payload. */
+/**
+ * Strip prototype-pollution keys from a user payload before it's
+ * attached to the request. Exported so the middleware can apply it to
+ * the session path too — session auth goes through `verifyWithContext`
+ * directly (not `AuthManager.verify`), so without this it would skip
+ * the guard JWT / api-key users get.
+ */
+export function sanitizePayload(user) {
+    for (const key of ["__proto__", "constructor", "prototype"]) {
+        if (key in user) {
+            delete user[key];
+        }
+    }
+}
+//# sourceMappingURL=AuthManager.js.map

package/dist/AuthManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthManager.js","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA2C5D;;GAEG;AACH,MAAM,OAAO,WAAW;IACf,UAAU,GAA8B,IAAI,GAAG,EAAE,CAAC;IAClD,eAAe,CAAS;IACf,MAAM,CAAiB;IAExC,YAAY,MAAkB;QAC7B,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;QACD,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,+DAA+D;QAC/D,iEAAiE;QACjE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,oJAAoJ,CACpJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,oBAAoB,MAAM,CAAC,eAAe,gCAAgC,CAC1E,CAAC;QACH,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,YAAY,CACjB,WAAoC,EACpC,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;aACpE,CAAC;QACH,CAAC;IACF,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,MAAM,CACX,KAAa,EACb,YAAqB,EACrB,OAAiC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;gBAClE,aAAa,EAAE,IAAI;aACnB,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAiB,EACjB,QAAe,QAAQ;QAEvB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACZ,IAAiB,EACjB,IAAY,EACZ,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAClB,IAAiB,EACjB,UAAkB,EAClB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CACtB,IAAiB,EACjB,WAAqB,EACrB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzE,CAAC;IAED,yCAAyC;IACzC,WAAW,CAAC,IAAa;QACxB,MAAM,YAAY,GAAG,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACpB,oBAAoB,EACpB,kBAAkB,YAAY,kBAAkB,EAChD;gBACC,IAAI,EAAE,0DAA0D;aAChE,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAY,EAAE,QAAsB;QACpD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,yCAAyC;IACzC,gBAAgB;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;CACD;AAED,kEAAkE;AAClE;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAiB;IAChD,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7D,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YACjB,OAAQ,IAAgC,CAAC,GAAG,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/AuthRateLimiter.d.ts

@@ -0,0 +1,29 @@
+/**
+ * AuthRateLimiter — brute force protection for login endpoints.
+ *
+ * Dual-key rate limiting: IP + email to prevent distributed attacks.
+ *
+ * @implements MISS-26
+ */
+export interface AuthRateLimiterConfig {
+    maxAttempts?: number;
+    windowSeconds?: number;
+}
+export declare class AuthRateLimiter {
+    private maxAttempts;
+    private window;
+    private store;
+    private maxStoreSize;
+    constructor(config?: AuthRateLimiterConfig);
+    /** Check if an attempt is allowed. Returns false if rate limited. */
+    check(ip: string, identifier: string): boolean;
+    /** Record a failed attempt. */
+    recordFailure(ip: string, identifier: string): void;
+    /** Reset counters on successful login. */
+    recordSuccess(ip: string, identifier: string): void;
+    /** Get remaining attempts for an identifier. */
+    remaining(ip: string, identifier: string): number;
+    private checkKey;
+    private increment;
+}
+//# sourceMappingURL=AuthRateLimiter.d.ts.map

package/dist/AuthRateLimiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthRateLimiter.d.ts","sourceRoot":"","sources":["../src/AuthRateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,qBAAqB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAOD,qBAAa,eAAe;IAC3B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAwC;IACrD,OAAO,CAAC,YAAY,CAAW;gBAEnB,MAAM,CAAC,EAAE,qBAAqB;IAO1C,qEAAqE;IACrE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAW9C,+BAA+B;IAC/B,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAQnD,0CAA0C;IAC1C,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAOnD,gDAAgD;IAChD,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAcjD,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,SAAS;CAejB"}

package/dist/AuthRateLimiter.js

@@ -0,0 +1,88 @@
+/**
+ * AuthRateLimiter — brute force protection for login endpoints.
+ *
+ * Dual-key rate limiting: IP + email to prevent distributed attacks.
+ *
+ * @implements MISS-26
+ */
+export class AuthRateLimiter {
+    maxAttempts;
+    window;
+    store = new Map();
+    maxStoreSize = 100_000;
+    constructor(config) {
+        this.maxAttempts = config?.maxAttempts ?? 5;
+        if (this.maxAttempts <= 0)
+            this.maxAttempts = 1;
+        this.window = (config?.windowSeconds ?? 900) * 1000;
+        if (this.window <= 0)
+            this.window = 900_000; // prevent bypass via 0/negative
+    }
+    /** Check if an attempt is allowed. Returns false if rate limited. */
+    check(ip, identifier) {
+        const now = Date.now();
+        const ipNorm = normalizeIp(ip);
+        const identifierNorm = normalizeIdentifier(identifier);
+        // Dual key: limit both by IP and by identifier (email)
+        const ipKey = `ip:${ipNorm}`;
+        const idKey = `id:${identifierNorm}`;
+        return this.checkKey(ipKey, now) && this.checkKey(idKey, now);
+    }
+    /** Record a failed attempt. */
+    recordFailure(ip, identifier) {
+        const now = Date.now();
+        const ipNorm = normalizeIp(ip);
+        const identifierNorm = normalizeIdentifier(identifier);
+        this.increment(`ip:${ipNorm}`, now);
+        this.increment(`id:${identifierNorm}`, now);
+    }
+    /** Reset counters on successful login. */
+    recordSuccess(ip, identifier) {
+        const ipNorm = normalizeIp(ip);
+        const identifierNorm = normalizeIdentifier(identifier);
+        this.store.delete(`ip:${ipNorm}`);
+        this.store.delete(`id:${identifierNorm}`);
+    }
+    /** Get remaining attempts for an identifier. */
+    remaining(ip, identifier) {
+        const ipNorm = normalizeIp(ip);
+        const identifierNorm = normalizeIdentifier(identifier);
+        const ipEntry = this.store.get(`ip:${ipNorm}`);
+        const idEntry = this.store.get(`id:${identifierNorm}`);
+        const ipRemaining = ipEntry
+            ? Math.max(0, this.maxAttempts - ipEntry.count)
+            : this.maxAttempts;
+        const idRemaining = idEntry
+            ? Math.max(0, this.maxAttempts - idEntry.count)
+            : this.maxAttempts;
+        return Math.min(ipRemaining, idRemaining);
+    }
+    checkKey(key, now) {
+        const entry = this.store.get(key);
+        if (!entry || entry.resetAt < now)
+            return true;
+        return entry.count < this.maxAttempts;
+    }
+    increment(key, now) {
+        // Evict expired entries when store grows too large (prevent OOM)
+        if (this.store.size > this.maxStoreSize) {
+            for (const [k, v] of this.store) {
+                if (v.resetAt < now)
+                    this.store.delete(k);
+            }
+        }
+        let entry = this.store.get(key);
+        if (!entry || entry.resetAt < now) {
+            entry = { count: 0, resetAt: now + this.window };
+            this.store.set(key, entry);
+        }
+        entry.count++;
+    }
+}
+function normalizeIdentifier(identifier) {
+    return identifier.trim().toLowerCase();
+}
+function normalizeIp(ip) {
+    return ip.trim();
+}
+//# sourceMappingURL=AuthRateLimiter.js.map

package/dist/AuthRateLimiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthRateLimiter.js","sourceRoot":"","sources":["../src/AuthRateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,MAAM,OAAO,eAAe;IACnB,WAAW,CAAS;IACpB,MAAM,CAAS;IACf,KAAK,GAA8B,IAAI,GAAG,EAAE,CAAC;IAC7C,YAAY,GAAG,OAAO,CAAC;IAE/B,YAAY,MAA8B;QACzC,IAAI,CAAC,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC;YAAE,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;QACpD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;YAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,gCAAgC;IAC9E,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,EAAU,EAAE,UAAkB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,uDAAuD;QACvD,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;QAErC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED,+BAA+B;IAC/B,aAAa,CAAC,EAAU,EAAE,UAAkB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,CAAC,MAAM,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,MAAM,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,0CAA0C;IAC1C,aAAa,CAAC,EAAU,EAAE,UAAkB;QAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,gDAAgD;IAChD,SAAS,CAAC,EAAU,EAAE,UAAkB;QACvC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,OAAO;YAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACpB,MAAM,WAAW,GAAG,OAAO;YAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,GAAW;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;IACvC,CAAC;IAEO,SAAS,CAAC,GAAW,EAAE,GAAW;QACzC,iEAAiE;QACjE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACjC,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG;oBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;QACF,CAAC;QAED,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YACnC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;CACD;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC9C,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/dist/Guard.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @Guard() decorator — protects route handlers with authentication.
+ *
+ * @implements FR50, FR51
+ */
+import "reflect-metadata";
+/**
+ * @Guard('jwt') — require authentication via the named strategy.
+ * At least one strategy name is required.
+ */
+export declare function Guard(first: string, ...rest: string[]): MethodDecorator;
+/**
+ * @Permission('orders.create') — require specific permissions.
+ */
+export declare function Permission(...permissions: string[]): MethodDecorator;
+/**
+ * @Role('admin') — require specific roles.
+ */
+export declare function Role(...roles: string[]): MethodDecorator;
+/** Get guard metadata. */
+export declare function getGuardMetadata(target: object, propertyKey: string | symbol): string[];
+/** Get permission metadata. */
+export declare function getPermissionMetadata(target: object, propertyKey: string | symbol): string[];
+/** Get role metadata. */
+export declare function getRoleMetadata(target: object, propertyKey: string | symbol): string[];
+//# sourceMappingURL=Guard.d.ts.map

package/dist/Guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Guard.d.ts","sourceRoot":"","sources":["../src/Guard.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,kBAAkB,CAAC;AAO1B;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAKvE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,eAAe,CAIpE;AAED;;GAEG;AACH,wBAAgB,IAAI,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,CAIxD;AAED,0BAA0B;AAC1B,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,MAAM,GAC1B,MAAM,EAAE,CAEV;AAED,+BAA+B;AAC/B,wBAAgB,qBAAqB,CACpC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,MAAM,GAC1B,MAAM,EAAE,CAEV;AAED,yBAAyB;AACzB,wBAAgB,eAAe,CAC9B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,MAAM,GAC1B,MAAM,EAAE,CAEV"}

package/dist/Guard.js

@@ -0,0 +1,52 @@
+/**
+ * @Guard() decorator — protects route handlers with authentication.
+ *
+ * @implements FR50, FR51
+ */
+// Side-effect import: registers the `Reflect.defineMetadata` / `getOwnMetadata`
+// methods used below. Pulled in here (not transitively via the framework)
+// so warden remains self-sufficient when published / consumed standalone.
+import "reflect-metadata";
+/** Guard decorator metadata key — Symbol.for ensures cross-module accessibility. */
+const GUARD_KEY = Symbol.for("warden:guard");
+const PERMISSION_KEY = Symbol.for("warden:permission");
+const ROLE_KEY = Symbol.for("warden:role");
+/**
+ * @Guard('jwt') — require authentication via the named strategy.
+ * At least one strategy name is required.
+ */
+export function Guard(first, ...rest) {
+    const strategies = [first, ...rest];
+    return (target, propertyKey) => {
+        Reflect.defineMetadata(GUARD_KEY, strategies, target, propertyKey);
+    };
+}
+/**
+ * @Permission('orders.create') — require specific permissions.
+ */
+export function Permission(...permissions) {
+    return (target, propertyKey) => {
+        Reflect.defineMetadata(PERMISSION_KEY, permissions, target, propertyKey);
+    };
+}
+/**
+ * @Role('admin') — require specific roles.
+ */
+export function Role(...roles) {
+    return (target, propertyKey) => {
+        Reflect.defineMetadata(ROLE_KEY, roles, target, propertyKey);
+    };
+}
+/** Get guard metadata. */
+export function getGuardMetadata(target, propertyKey) {
+    return Reflect.getOwnMetadata(GUARD_KEY, target, propertyKey) ?? [];
+}
+/** Get permission metadata. */
+export function getPermissionMetadata(target, propertyKey) {
+    return Reflect.getOwnMetadata(PERMISSION_KEY, target, propertyKey) ?? [];
+}
+/** Get role metadata. */
+export function getRoleMetadata(target, propertyKey) {
+    return Reflect.getOwnMetadata(ROLE_KEY, target, propertyKey) ?? [];
+}
+//# sourceMappingURL=Guard.js.map

package/dist/Guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Guard.js","sourceRoot":"","sources":["../src/Guard.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gFAAgF;AAChF,0EAA0E;AAC1E,0EAA0E;AAC1E,OAAO,kBAAkB,CAAC;AAE1B,oFAAoF;AACpF,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AAC7C,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAE3C;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa,EAAE,GAAG,IAAc;IACrD,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IACpC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QAC9B,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,GAAG,WAAqB;IAClD,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QAC9B,OAAO,CAAC,cAAc,CAAC,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI,CAAC,GAAG,KAAe;IACtC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QAC9B,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC;AACH,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,gBAAgB,CAC/B,MAAc,EACd,WAA4B;IAE5B,OAAO,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,qBAAqB,CACpC,MAAc,EACd,WAA4B;IAE5B,OAAO,OAAO,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,eAAe,CAC9B,MAAc,EACd,WAA4B;IAE5B,OAAO,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;AACpE,CAAC"}

package/dist/RefreshTokenStore.d.ts

@@ -0,0 +1,34 @@
+/**
+ * RefreshTokenStore — server-side opaque refresh token management.
+ *
+ * AdonisJS opaque token pattern:
+ *   { accessToken, refreshToken, expiresIn }
+ *   POST /auth/refresh → new pair, old token invalidated
+ *
+ * @implements MISS-5
+ */
+export interface StoredRefreshToken {
+    token: string;
+    userId: string | number;
+    expiresAt: number;
+    createdAt: number;
+}
+export interface RefreshTokenDriver {
+    store(token: StoredRefreshToken): Promise<void>;
+    find(token: string): Promise<StoredRefreshToken | null>;
+    revoke(token: string): Promise<void>;
+    revokeAllForUser(userId: string | number): Promise<void>;
+    cleanup(): Promise<void>;
+}
+/** In-memory driver for development. */
+export declare class MemoryRefreshTokenDriver implements RefreshTokenDriver {
+    private tokens;
+    store(token: StoredRefreshToken): Promise<void>;
+    find(token: string): Promise<StoredRefreshToken | null>;
+    revoke(token: string): Promise<void>;
+    revokeAllForUser(userId: string | number): Promise<void>;
+    cleanup(): Promise<void>;
+}
+/** Generate an opaque refresh token. */
+export declare function generateRefreshToken(): string;
+//# sourceMappingURL=RefreshTokenStore.d.ts.map

package/dist/RefreshTokenStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RefreshTokenStore.d.ts","sourceRoot":"","sources":["../src/RefreshTokenStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,kBAAkB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,wCAAwC;AACxC,qBAAa,wBAAyB,YAAW,kBAAkB;IAClE,OAAO,CAAC,MAAM,CAA8C;IAEtD,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAUvD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM9B;AAED,wCAAwC;AACxC,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/RefreshTokenStore.js

@@ -0,0 +1,48 @@
+/**
+ * RefreshTokenStore — server-side opaque refresh token management.
+ *
+ * AdonisJS opaque token pattern:
+ *   { accessToken, refreshToken, expiresIn }
+ *   POST /auth/refresh → new pair, old token invalidated
+ *
+ * @implements MISS-5
+ */
+import { randomBytes } from "node:crypto";
+/** In-memory driver for development. */
+export class MemoryRefreshTokenDriver {
+    tokens = new Map();
+    async store(token) {
+        this.tokens.set(token.token, token);
+    }
+    async find(token) {
+        const stored = this.tokens.get(token);
+        if (!stored)
+            return null;
+        if (stored.expiresAt < Date.now()) {
+            this.tokens.delete(token);
+            return null;
+        }
+        return stored;
+    }
+    async revoke(token) {
+        this.tokens.delete(token);
+    }
+    async revokeAllForUser(userId) {
+        for (const [key, val] of this.tokens) {
+            if (val.userId === userId)
+                this.tokens.delete(key);
+        }
+    }
+    async cleanup() {
+        const now = Date.now();
+        for (const [key, val] of this.tokens) {
+            if (val.expiresAt < now)
+                this.tokens.delete(key);
+        }
+    }
+}
+/** Generate an opaque refresh token. */
+export function generateRefreshToken() {
+    return randomBytes(48).toString("base64url");
+}
+//# sourceMappingURL=RefreshTokenStore.js.map

package/dist/RefreshTokenStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RefreshTokenStore.js","sourceRoot":"","sources":["../src/RefreshTokenStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAiB1C,wCAAwC;AACxC,MAAM,OAAO,wBAAwB;IAC5B,MAAM,GAAoC,IAAI,GAAG,EAAE,CAAC;IAE5D,KAAK,CAAC,KAAK,CAAC,KAAyB;QACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAuB;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;CACD;AAED,wCAAwC;AACxC,MAAM,UAAU,oBAAoB;IACnC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC"}

package/dist/TokenBlacklist.d.ts

@@ -0,0 +1,30 @@
+/**
+ * TokenBlacklist — revoke JWT tokens before expiry.
+ *
+ * Stores JTI (JWT ID) with expiry. Supports Memory and Redis drivers.
+ *
+ * @implements MISS-6
+ */
+export interface BlacklistDriver {
+    add(jti: string, expiresAt: number): Promise<void>;
+    has(jti: string): Promise<boolean>;
+    cleanup(): Promise<void>;
+}
+/** In-memory blacklist for development. */
+export declare class MemoryBlacklistDriver implements BlacklistDriver {
+    private entries;
+    add(jti: string, expiresAt: number): Promise<void>;
+    has(jti: string): Promise<boolean>;
+    cleanup(): Promise<void>;
+}
+export declare class TokenBlacklist {
+    private driver;
+    constructor(driver: BlacklistDriver);
+    /** Revoke a token by its JTI claim. */
+    revoke(jti: string, expiresAt: number): Promise<void>;
+    /** Check if a token JTI is blacklisted. */
+    isRevoked(jti: string): Promise<boolean>;
+    /** Remove expired entries. */
+    cleanup(): Promise<void>;
+}
+//# sourceMappingURL=TokenBlacklist.d.ts.map

package/dist/TokenBlacklist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenBlacklist.d.ts","sourceRoot":"","sources":["../src/TokenBlacklist.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,eAAe;IAC/B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,2CAA2C;AAC3C,qBAAa,qBAAsB,YAAW,eAAe;IAC5D,OAAO,CAAC,OAAO,CAAkC;IAE3C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM9B;AAED,qBAAa,cAAc;IACd,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,eAAe;IAE3C,uCAAuC;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D,2CAA2C;IACrC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9C,8BAA8B;IACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG9B"}

package/dist/TokenBlacklist.js

@@ -0,0 +1,50 @@
+/**
+ * TokenBlacklist — revoke JWT tokens before expiry.
+ *
+ * Stores JTI (JWT ID) with expiry. Supports Memory and Redis drivers.
+ *
+ * @implements MISS-6
+ */
+/** In-memory blacklist for development. */
+export class MemoryBlacklistDriver {
+    entries = new Map();
+    async add(jti, expiresAt) {
+        this.entries.set(jti, expiresAt);
+    }
+    async has(jti) {
+        const expiresAt = this.entries.get(jti);
+        if (expiresAt === undefined)
+            return false;
+        if (expiresAt < Date.now()) {
+            this.entries.delete(jti);
+            return false;
+        }
+        return true;
+    }
+    async cleanup() {
+        const now = Date.now();
+        for (const [jti, exp] of this.entries) {
+            if (exp < now)
+                this.entries.delete(jti);
+        }
+    }
+}
+export class TokenBlacklist {
+    driver;
+    constructor(driver) {
+        this.driver = driver;
+    }
+    /** Revoke a token by its JTI claim. */
+    async revoke(jti, expiresAt) {
+        await this.driver.add(jti, expiresAt);
+    }
+    /** Check if a token JTI is blacklisted. */
+    async isRevoked(jti) {
+        return this.driver.has(jti);
+    }
+    /** Remove expired entries. */
+    async cleanup() {
+        return this.driver.cleanup();
+    }
+}
+//# sourceMappingURL=TokenBlacklist.js.map