@c9up/warden 0.1.3 → 0.1.5

package/README.md

@@ -29,6 +29,63 @@ class OrderController {
 - RBAC: `hasRole`, `hasPermission`, `hasAllPermissions`
 - Strategy exception safety (catch → AuthResult)
 - Runtime strategy registration
+- **Multi-factor authentication** — TOTP, backup codes, email/SMS OTP, WebAuthn/passkeys, all dependency-free
+- JWT revocation blacklist (Memory / Redis-KeyDB / resilient fallback drivers)
+
+## Multi-factor authentication
+
+Four providers, all implemented on `node:crypto` with **zero third-party dependency**
+(WebAuthn included). Every provider and the manager take pluggable stores, defaulting
+to in-memory — supply persistent stores (Atlas, KeyDB…) in production.
+
+```typescript
+import {
+  MfaManager,
+  TotpProvider,
+  BackupCodesProvider,
+  RequireMfa,
+} from '@c9up/warden'
+
+const mfa = new MfaManager({
+  issuer: 'Fluveo',
+  totp: new TotpProvider(),
+  backupCodes: new BackupCodesProvider(),
+  // store: new AtlasMfaFactorStore(db),   // persistent factors in production
+  rateLimit: { maxAttempts: 5, windowSeconds: 900 }, // per-user brute-force lock
+})
+
+// Enroll (returns the otpauth:// URI to render as a QR code)
+const { factorId, uri } = await mfa.enrollTotp({ id: user.id, name: user.email })
+await mfa.confirmTotp(factorId, codeFromAuthenticatorApp)   // → true once confirmed
+const recoveryCodes = await mfa.createBackupCodes(user.id)  // show once
+
+// At sign-in step-up: TOTP code OR a backup code (rate-limited)
+if (await mfa.verify(user.id, submittedCode)) {
+  // issue a JWT carrying `mfa: true`
+}
+```
+
+Gate sensitive routes — the middleware returns `403 MFA_REQUIRED` unless the
+authenticated user's payload carries a truthy `mfa` claim:
+
+```typescript
+class TransferController {
+  @Guard('jwt')
+  @RequireMfa()
+  async transfer() { /* only reachable after MFA step-up */ }
+}
+```
+
+Wire the manager into the container via config:
+
+```typescript
+// config/auth.ts
+import { defineConfig } from '@c9up/warden/config'
+export default defineConfig({ jwt: { /* … */ }, mfa: { manager: mfa } })
+```
+
+Email/SMS OTP (`OtpProvider`) and WebAuthn/passkeys (`WebauthnProvider`) are used
+directly — OTP needs a delivery channel, WebAuthn persists passkeys in its own store.
 
 ## License
 

package/dist/AuthManager.d.ts

@@ -0,0 +1,98 @@
+/**
+ * AuthManager — manages multiple authentication strategies.
+ *
+ * @implements FR48, FR50, FR51
+ */
+import { RightsResolver } from "./rights/RightsResolver.js";
+import type { EffectivePermissions, Scope } from "./rights/types.js";
+export interface UserPayload {
+    id: string;
+    roles?: string[];
+    permissions?: string[];
+    [key: string]: unknown;
+}
+export interface AuthResult {
+    authenticated: boolean;
+    user?: UserPayload;
+    error?: string;
+    /**
+     * @internal Set when the strategy's `verify()` / `authenticate()` THREW
+     * a generic error (vs returned a deliberate `{ authenticated: false }`
+     * rejection). The middleware uses this to distinguish credential
+     * failures (→ 401) from strategy crashes (→ 500). Not part of the
+     * public consumer-facing API.
+     */
+    strategyCrash?: true;
+}
+export interface AuthStrategy {
+    name: string;
+    authenticate(credentials: Record<string, unknown>): Promise<AuthResult>;
+    verify(token: string, context?: Record<string, unknown>): Promise<AuthResult>;
+}
+export interface AuthConfig {
+    defaultStrategy: string;
+    strategies: Record<string, AuthStrategy>;
+    /**
+     * The rights resolver backing the coarse RBAC helpers (Epic 56). When
+     * absent, a default `RightsResolver(new MemoryRightsStore())` is used so
+     * `new AuthManager({ defaultStrategy, strategies })` keeps working — with
+     * an empty store, payload roles still fold in (D2) and permissions are
+     * empty (token `user.permissions` is not an input — D1).
+     */
+    rights?: RightsResolver;
+}
+/**
+ * Manages authentication strategies and provides guard/permission checks.
+ */
+export declare class AuthManager {
+    private strategies;
+    private defaultStrategy;
+    private readonly rights;
+    constructor(config: AuthConfig);
+    /** Authenticate with credentials using a specific or default strategy. */
+    authenticate(credentials: Record<string, unknown>, strategyName?: string): Promise<AuthResult>;
+    /** Verify a token (JWT, session, API key). */
+    verify(token: string, strategyName?: string, context?: Record<string, unknown>): Promise<AuthResult>;
+    /**
+     * Resolve a user's effective permissions for a scope (Epic 56). The single
+     * resolution entry the coarse helpers wrap — `hasRole`/`hasPermission`/
+     * `hasAllPermissions` read this set, never the token payload directly. The
+     * Bouncer policy path (`this.permissions`, 56.3) consults the SAME resolver,
+     * so a coarse question and a policy question return the same answer for the
+     * same `(user, scope)` (the single unification point — AC-E3).
+     */
+    resolvePermissions(user: UserPayload, scope?: Scope): Promise<EffectivePermissions>;
+    /**
+     * Check if a user has a specific role within a scope (default `"global"`).
+     * Reflects payload roles ∪ store roles (D2) — a token-carried role still
+     * satisfies it with no store config.
+     */
+    hasRole(user: UserPayload, role: string, scope?: Scope): Promise<boolean>;
+    /**
+     * Check if a user has a specific permission within a scope (default
+     * `"global"`). Derived from roles + store grants ONLY — token
+     * `user.permissions` is NOT read (D1, cerebrum 459).
+     */
+    hasPermission(user: UserPayload, permission: string, scope?: Scope): Promise<boolean>;
+    /**
+     * Check if a user has ALL required permissions within a scope (default
+     * `"global"`). Empty list ⇒ vacuously true.
+     */
+    hasAllPermissions(user: UserPayload, permissions: string[], scope?: Scope): Promise<boolean>;
+    /** Get a registered strategy by name. */
+    getStrategy(name?: string): AuthStrategy;
+    /** Register a new strategy at runtime. */
+    registerStrategy(name: string, strategy: AuthStrategy): void;
+    /** Get all registered strategy names. */
+    getStrategyNames(): string[];
+}
+/** Strip dangerous prototype-pollution keys from user payload. */
+/**
+ * Strip prototype-pollution keys from a user payload before it's
+ * attached to the request. Exported so the middleware can apply it to
+ * the session path too — session auth goes through `verifyWithContext`
+ * directly (not `AuthManager.verify`), so without this it would skip
+ * the guard JWT / api-key users get.
+ */
+export declare function sanitizePayload(user: UserPayload): void;
+//# sourceMappingURL=AuthManager.d.ts.map

package/dist/AuthManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthManager.d.ts","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAErE,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,UAAU;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,WAAW;IACvB,OAAO,CAAC,UAAU,CAAwC;IAC1D,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAE5B,MAAM,EAAE,UAAU;IA0B9B,0EAA0E;IACpE,YAAY,CACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC;IAmBtB,8CAA8C;IACxC,MAAM,CACX,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,UAAU,CAAC;IAoBtB;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAI,EAAE,WAAW,EACjB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,oBAAoB,CAAC;IAIhC;;;;OAIG;IACG,OAAO,CACZ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;;OAIG;IACG,aAAa,CAClB,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;OAGG;IACG,iBAAiB,CACtB,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,MAAM,EAAE,EACrB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB,yCAAyC;IACzC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,YAAY;IAexC,0CAA0C;IAC1C,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAI5D,yCAAyC;IACzC,gBAAgB,IAAI,MAAM,EAAE;CAG5B;AAED,kEAAkE;AAClE;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAMvD"}

package/dist/AuthManager.js

@@ -0,0 +1,147 @@
+/**
+ * AuthManager — manages multiple authentication strategies.
+ *
+ * @implements FR48, FR50, FR51
+ */
+import { WardenError } from "./errors.js";
+import { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
+import { RightsResolver } from "./rights/RightsResolver.js";
+/**
+ * Manages authentication strategies and provides guard/permission checks.
+ */
+export class AuthManager {
+    strategies = new Map();
+    defaultStrategy;
+    rights;
+    constructor(config) {
+        this.defaultStrategy = config.defaultStrategy;
+        this.rights = config.rights ?? new RightsResolver(new MemoryRightsStore());
+        for (const [name, strategy] of Object.entries(config.strategies)) {
+            this.strategies.set(name, strategy);
+        }
+        // Fail-fast at construction: an AuthManager with zero strategies
+        // is a configuration bug. Previously, an empty `strategies: {}`
+        // passed the constructor cleanly and the first protected request
+        // crashed at runtime when `getStrategy('jwt')` threw — opaque 401
+        // or 500 instead of a boot-time INVALID_CONFIG that points the
+        // operator at the missing `config.auth.jwt` (or other strategy).
+        if (Object.keys(config.strategies).length === 0) {
+            throw new WardenError("INVALID_CONFIG", `AuthManager: no authentication strategies registered. Configure at least one strategy (e.g. config.warden.auth.jwt) before booting WardenProvider.`);
+        }
+        if (!this.strategies.has(config.defaultStrategy)) {
+            throw new WardenError("INVALID_CONFIG", `defaultStrategy '${config.defaultStrategy}' is not present in strategies`);
+        }
+    }
+    /** Authenticate with credentials using a specific or default strategy. */
+    async authenticate(credentials, strategyName) {
+        const strategy = this.getStrategy(strategyName);
+        try {
+            const result = await strategy.authenticate(credentials);
+            if (result.user)
+                sanitizePayload(result.user);
+            return result;
+        }
+        catch (err) {
+            // Re-throw structured WardenError sentinels (e.g. SessionStrategy's
+            // USE_LOGIN throw) so callers see the design-boundary signal instead
+            // of a soft `{ authenticated: false }`. Generic errors stay soft.
+            if (err instanceof WardenError)
+                throw err;
+            return {
+                authenticated: false,
+                error: err instanceof Error ? err.message : "Unknown authentication error",
+            };
+        }
+    }
+    /** Verify a token (JWT, session, API key). */
+    async verify(token, strategyName, context) {
+        const strategy = this.getStrategy(strategyName);
+        try {
+            const result = await strategy.verify(token, context);
+            if (result.user)
+                sanitizePayload(result.user);
+            return result;
+        }
+        catch (err) {
+            // Mirror authenticate(): rethrow structured WardenError sentinels;
+            // soft-fail generic throws but TAG them as strategy crashes so the
+            // middleware can flip 401 → 500 when every attempted strategy bombed.
+            if (err instanceof WardenError)
+                throw err;
+            return {
+                authenticated: false,
+                error: err instanceof Error ? err.message : "Unknown verification error",
+                strategyCrash: true,
+            };
+        }
+    }
+    /**
+     * Resolve a user's effective permissions for a scope (Epic 56). The single
+     * resolution entry the coarse helpers wrap — `hasRole`/`hasPermission`/
+     * `hasAllPermissions` read this set, never the token payload directly. The
+     * Bouncer policy path (`this.permissions`, 56.3) consults the SAME resolver,
+     * so a coarse question and a policy question return the same answer for the
+     * same `(user, scope)` (the single unification point — AC-E3).
+     */
+    resolvePermissions(user, scope = "global") {
+        return this.rights.resolve(user, scope);
+    }
+    /**
+     * Check if a user has a specific role within a scope (default `"global"`).
+     * Reflects payload roles ∪ store roles (D2) — a token-carried role still
+     * satisfies it with no store config.
+     */
+    async hasRole(user, role, scope = "global") {
+        return (await this.resolvePermissions(user, scope)).roles.has(role);
+    }
+    /**
+     * Check if a user has a specific permission within a scope (default
+     * `"global"`). Derived from roles + store grants ONLY — token
+     * `user.permissions` is NOT read (D1, cerebrum 459).
+     */
+    async hasPermission(user, permission, scope = "global") {
+        return (await this.resolvePermissions(user, scope)).has(permission);
+    }
+    /**
+     * Check if a user has ALL required permissions within a scope (default
+     * `"global"`). Empty list ⇒ vacuously true.
+     */
+    async hasAllPermissions(user, permissions, scope = "global") {
+        return (await this.resolvePermissions(user, scope)).hasAll(permissions);
+    }
+    /** Get a registered strategy by name. */
+    getStrategy(name) {
+        const strategyName = name ?? this.defaultStrategy;
+        const strategy = this.strategies.get(strategyName);
+        if (!strategy) {
+            throw new WardenError("STRATEGY_NOT_FOUND", `Auth strategy '${strategyName}' not registered`, {
+                hint: "Call registerStrategy() before using this strategy name.",
+            });
+        }
+        return strategy;
+    }
+    /** Register a new strategy at runtime. */
+    registerStrategy(name, strategy) {
+        this.strategies.set(name, strategy);
+    }
+    /** Get all registered strategy names. */
+    getStrategyNames() {
+        return [...this.strategies.keys()];
+    }
+}
+/** Strip dangerous prototype-pollution keys from user payload. */
+/**
+ * Strip prototype-pollution keys from a user payload before it's
+ * attached to the request. Exported so the middleware can apply it to
+ * the session path too — session auth goes through `verifyWithContext`
+ * directly (not `AuthManager.verify`), so without this it would skip
+ * the guard JWT / api-key users get.
+ */
+export function sanitizePayload(user) {
+    for (const key of ["__proto__", "constructor", "prototype"]) {
+        if (key in user) {
+            delete user[key];
+        }
+    }
+}
+//# sourceMappingURL=AuthManager.js.map

package/dist/AuthManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthManager.js","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA2C5D;;GAEG;AACH,MAAM,OAAO,WAAW;IACf,UAAU,GAA8B,IAAI,GAAG,EAAE,CAAC;IAClD,eAAe,CAAS;IACf,MAAM,CAAiB;IAExC,YAAY,MAAkB;QAC7B,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;QACD,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,+DAA+D;QAC/D,iEAAiE;QACjE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,oJAAoJ,CACpJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,oBAAoB,MAAM,CAAC,eAAe,gCAAgC,CAC1E,CAAC;QACH,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,YAAY,CACjB,WAAoC,EACpC,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;aACpE,CAAC;QACH,CAAC;IACF,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,MAAM,CACX,KAAa,EACb,YAAqB,EACrB,OAAiC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;gBAClE,aAAa,EAAE,IAAI;aACnB,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAiB,EACjB,QAAe,QAAQ;QAEvB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACZ,IAAiB,EACjB,IAAY,EACZ,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAClB,IAAiB,EACjB,UAAkB,EAClB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CACtB,IAAiB,EACjB,WAAqB,EACrB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzE,CAAC;IAED,yCAAyC;IACzC,WAAW,CAAC,IAAa;QACxB,MAAM,YAAY,GAAG,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACpB,oBAAoB,EACpB,kBAAkB,YAAY,kBAAkB,EAChD;gBACC,IAAI,EAAE,0DAA0D;aAChE,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAY,EAAE,QAAsB;QACpD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,yCAAyC;IACzC,gBAAgB;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;CACD;AAED,kEAAkE;AAClE;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAiB;IAChD,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7D,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YACjB,OAAQ,IAAgC,CAAC,GAAG,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/AuthRateLimiter.d.ts

@@ -0,0 +1,29 @@
+/**
+ * AuthRateLimiter — brute force protection for login endpoints.
+ *
+ * Dual-key rate limiting: IP + email to prevent distributed attacks.
+ *
+ * @implements MISS-26
+ */
+export interface AuthRateLimiterConfig {
+    maxAttempts?: number;
+    windowSeconds?: number;
+}
+export declare class AuthRateLimiter {
+    private maxAttempts;
+    private window;
+    private store;
+    private maxStoreSize;
+    constructor(config?: AuthRateLimiterConfig);
+    /** Check if an attempt is allowed. Returns false if rate limited. */
+    check(ip: string, identifier: string): boolean;
+    /** Record a failed attempt. */
+    recordFailure(ip: string, identifier: string): void;
+    /** Reset counters on successful login. */
+    recordSuccess(ip: string, identifier: string): void;
+    /** Get remaining attempts for an identifier. */
+    remaining(ip: string, identifier: string): number;
+    private checkKey;
+    private increment;
+}
+//# sourceMappingURL=AuthRateLimiter.d.ts.map

package/dist/AuthRateLimiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthRateLimiter.d.ts","sourceRoot":"","sources":["../src/AuthRateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,qBAAqB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAOD,qBAAa,eAAe;IAC3B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAwC;IACrD,OAAO,CAAC,YAAY,CAAW;gBAEnB,MAAM,CAAC,EAAE,qBAAqB;IAO1C,qEAAqE;IACrE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAW9C,+BAA+B;IAC/B,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAQnD,0CAA0C;IAC1C,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAOnD,gDAAgD;IAChD,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAcjD,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,SAAS;CAejB"}

package/dist/AuthRateLimiter.js

@@ -0,0 +1,88 @@
+/**
+ * AuthRateLimiter — brute force protection for login endpoints.
+ *
+ * Dual-key rate limiting: IP + email to prevent distributed attacks.
+ *
+ * @implements MISS-26
+ */
+export class AuthRateLimiter {
+    maxAttempts;
+    window;
+    store = new Map();
+    maxStoreSize = 100_000;
+    constructor(config) {
+        this.maxAttempts = config?.maxAttempts ?? 5;
+        if (this.maxAttempts <= 0)
+            this.maxAttempts = 1;
+        this.window = (config?.windowSeconds ?? 900) * 1000;
+        if (this.window <= 0)
+            this.window = 900_000; // prevent bypass via 0/negative
+    }
+    /** Check if an attempt is allowed. Returns false if rate limited. */
+    check(ip, identifier) {
+        const now = Date.now();
+        const ipNorm = normalizeIp(ip);
+        const identifierNorm = normalizeIdentifier(identifier);
+        // Dual key: limit both by IP and by identifier (email)
+        const ipKey = `ip:${ipNorm}`;
+        const idKey = `id:${identifierNorm}`;
+        return this.checkKey(ipKey, now) && this.checkKey(idKey, now);
+    }
+    /** Record a failed attempt. */
+    recordFailure(ip, identifier) {
+        const now = Date.now();
+        const ipNorm = normalizeIp(ip);
+        const identifierNorm = normalizeIdentifier(identifier);
+        this.increment(`ip:${ipNorm}`, now);
+        this.increment(`id:${identifierNorm}`, now);
+    }
+    /** Reset counters on successful login. */
+    recordSuccess(ip, identifier) {
+        const ipNorm = normalizeIp(ip);
+        const identifierNorm = normalizeIdentifier(identifier);
+        this.store.delete(`ip:${ipNorm}`);
+        this.store.delete(`id:${identifierNorm}`);
+    }
+    /** Get remaining attempts for an identifier. */
+    remaining(ip, identifier) {
+        const ipNorm = normalizeIp(ip);
+        const identifierNorm = normalizeIdentifier(identifier);
+        const ipEntry = this.store.get(`ip:${ipNorm}`);
+        const idEntry = this.store.get(`id:${identifierNorm}`);
+        const ipRemaining = ipEntry
+            ? Math.max(0, this.maxAttempts - ipEntry.count)
+            : this.maxAttempts;
+        const idRemaining = idEntry
+            ? Math.max(0, this.maxAttempts - idEntry.count)
+            : this.maxAttempts;
+        return Math.min(ipRemaining, idRemaining);
+    }
+    checkKey(key, now) {
+        const entry = this.store.get(key);
+        if (!entry || entry.resetAt < now)
+            return true;
+        return entry.count < this.maxAttempts;
+    }
+    increment(key, now) {
+        // Evict expired entries when store grows too large (prevent OOM)
+        if (this.store.size > this.maxStoreSize) {
+            for (const [k, v] of this.store) {
+                if (v.resetAt < now)
+                    this.store.delete(k);
+            }
+        }
+        let entry = this.store.get(key);
+        if (!entry || entry.resetAt < now) {
+            entry = { count: 0, resetAt: now + this.window };
+            this.store.set(key, entry);
+        }
+        entry.count++;
+    }
+}
+function normalizeIdentifier(identifier) {
+    return identifier.trim().toLowerCase();
+}
+function normalizeIp(ip) {
+    return ip.trim();
+}
+//# sourceMappingURL=AuthRateLimiter.js.map

package/dist/AuthRateLimiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthRateLimiter.js","sourceRoot":"","sources":["../src/AuthRateLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,MAAM,OAAO,eAAe;IACnB,WAAW,CAAS;IACpB,MAAM,CAAS;IACf,KAAK,GAA8B,IAAI,GAAG,EAAE,CAAC;IAC7C,YAAY,GAAG,OAAO,CAAC;IAE/B,YAAY,MAA8B;QACzC,IAAI,CAAC,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC;YAAE,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;QACpD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;YAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,gCAAgC;IAC9E,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,EAAU,EAAE,UAAkB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,uDAAuD;QACvD,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;QAErC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED,+BAA+B;IAC/B,aAAa,CAAC,EAAU,EAAE,UAAkB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,CAAC,MAAM,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,MAAM,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,0CAA0C;IAC1C,aAAa,CAAC,EAAU,EAAE,UAAkB;QAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,gDAAgD;IAChD,SAAS,CAAC,EAAU,EAAE,UAAkB;QACvC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,OAAO;YAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACpB,MAAM,WAAW,GAAG,OAAO;YAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,GAAW;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;IACvC,CAAC;IAEO,SAAS,CAAC,GAAW,EAAE,GAAW;QACzC,iEAAiE;QACjE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACjC,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG;oBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;QACF,CAAC;QAED,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YACnC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;CACD;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC9C,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/dist/Guard.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @Guard() decorator — protects route handlers with authentication.
+ *
+ * @implements FR50, FR51
+ */
+import "reflect-metadata";
+/**
+ * @Guard('jwt') — require authentication via the named strategy.
+ * At least one strategy name is required.
+ */
+export declare function Guard(first: string, ...rest: string[]): MethodDecorator;
+/**
+ * @Permission('orders.create') — require specific permissions.
+ */
+export declare function Permission(...permissions: string[]): MethodDecorator;
+/**
+ * @Role('admin') — require specific roles.
+ */
+export declare function Role(...roles: string[]): MethodDecorator;
+/** Get guard metadata. */
+export declare function getGuardMetadata(target: object, propertyKey: string | symbol): string[];
+/** Get permission metadata. */
+export declare function getPermissionMetadata(target: object, propertyKey: string | symbol): string[];
+/** Get role metadata. */
+export declare function getRoleMetadata(target: object, propertyKey: string | symbol): string[];
+/**
+ * @RequireMfa() — require the authenticated user to have completed multi-factor
+ * authentication. The auth middleware rejects with 403 `MFA_REQUIRED` when the
+ * user payload lacks a truthy `mfa` claim (set by your MFA step-up flow once
+ * `MfaManager.verify()` succeeds).
+ */
+export declare function RequireMfa(): MethodDecorator;
+/** Whether the route requires completed MFA. */
+export declare function getRequireMfaMetadata(target: object, propertyKey: string | symbol): boolean;
+//# sourceMappingURL=Guard.d.ts.map

package/dist/Guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Guard.d.ts","sourceRoot":"","sources":["../src/Guard.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,kBAAkB,CAAC;AAQ1B;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAKvE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,eAAe,CAIpE;AAED;;GAEG;AACH,wBAAgB,IAAI,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,CAIxD;AAED,0BAA0B;AAC1B,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,MAAM,GAC1B,MAAM,EAAE,CAEV;AAED,+BAA+B;AAC/B,wBAAgB,qBAAqB,CACpC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,MAAM,GAC1B,MAAM,EAAE,CAEV;AAED,yBAAyB;AACzB,wBAAgB,eAAe,CAC9B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,MAAM,GAC1B,MAAM,EAAE,CAEV;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,eAAe,CAI5C;AAED,gDAAgD;AAChD,wBAAgB,qBAAqB,CACpC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,MAAM,GAC1B,OAAO,CAET"}

package/dist/Guard.js

@@ -0,0 +1,68 @@
+/**
+ * @Guard() decorator — protects route handlers with authentication.
+ *
+ * @implements FR50, FR51
+ */
+// Side-effect import: registers the `Reflect.defineMetadata` / `getOwnMetadata`
+// methods used below. Pulled in here (not transitively via the framework)
+// so warden remains self-sufficient when published / consumed standalone.
+import "reflect-metadata";
+/** Guard decorator metadata key — Symbol.for ensures cross-module accessibility. */
+const GUARD_KEY = Symbol.for("warden:guard");
+const PERMISSION_KEY = Symbol.for("warden:permission");
+const ROLE_KEY = Symbol.for("warden:role");
+const MFA_KEY = Symbol.for("warden:mfa");
+/**
+ * @Guard('jwt') — require authentication via the named strategy.
+ * At least one strategy name is required.
+ */
+export function Guard(first, ...rest) {
+    const strategies = [first, ...rest];
+    return (target, propertyKey) => {
+        Reflect.defineMetadata(GUARD_KEY, strategies, target, propertyKey);
+    };
+}
+/**
+ * @Permission('orders.create') — require specific permissions.
+ */
+export function Permission(...permissions) {
+    return (target, propertyKey) => {
+        Reflect.defineMetadata(PERMISSION_KEY, permissions, target, propertyKey);
+    };
+}
+/**
+ * @Role('admin') — require specific roles.
+ */
+export function Role(...roles) {
+    return (target, propertyKey) => {
+        Reflect.defineMetadata(ROLE_KEY, roles, target, propertyKey);
+    };
+}
+/** Get guard metadata. */
+export function getGuardMetadata(target, propertyKey) {
+    return Reflect.getOwnMetadata(GUARD_KEY, target, propertyKey) ?? [];
+}
+/** Get permission metadata. */
+export function getPermissionMetadata(target, propertyKey) {
+    return Reflect.getOwnMetadata(PERMISSION_KEY, target, propertyKey) ?? [];
+}
+/** Get role metadata. */
+export function getRoleMetadata(target, propertyKey) {
+    return Reflect.getOwnMetadata(ROLE_KEY, target, propertyKey) ?? [];
+}
+/**
+ * @RequireMfa() — require the authenticated user to have completed multi-factor
+ * authentication. The auth middleware rejects with 403 `MFA_REQUIRED` when the
+ * user payload lacks a truthy `mfa` claim (set by your MFA step-up flow once
+ * `MfaManager.verify()` succeeds).
+ */
+export function RequireMfa() {
+    return (target, propertyKey) => {
+        Reflect.defineMetadata(MFA_KEY, true, target, propertyKey);
+    };
+}
+/** Whether the route requires completed MFA. */
+export function getRequireMfaMetadata(target, propertyKey) {
+    return Reflect.getOwnMetadata(MFA_KEY, target, propertyKey) ?? false;
+}
+//# sourceMappingURL=Guard.js.map

package/dist/Guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Guard.js","sourceRoot":"","sources":["../src/Guard.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gFAAgF;AAChF,0EAA0E;AAC1E,0EAA0E;AAC1E,OAAO,kBAAkB,CAAC;AAE1B,oFAAoF;AACpF,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AAC7C,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa,EAAE,GAAG,IAAc;IACrD,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IACpC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QAC9B,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,GAAG,WAAqB;IAClD,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QAC9B,OAAO,CAAC,cAAc,CAAC,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI,CAAC,GAAG,KAAe;IACtC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QAC9B,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC;AACH,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,gBAAgB,CAC/B,MAAc,EACd,WAA4B;IAE5B,OAAO,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,qBAAqB,CACpC,MAAc,EACd,WAA4B;IAE5B,OAAO,OAAO,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,eAAe,CAC9B,MAAc,EACd,WAA4B;IAE5B,OAAO,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU;IACzB,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QAC9B,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC5D,CAAC,CAAC;AACH,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,qBAAqB,CACpC,MAAc,EACd,WAA4B;IAE5B,OAAO,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,KAAK,CAAC;AACtE,CAAC"}

package/dist/RedisBlacklistDriver.d.ts

@@ -0,0 +1,32 @@
+/**
+ * RedisBlacklistDriver — a persistent JWT blacklist backed by Redis / KeyDB,
+ * so logout revocation survives a process restart (unlike MemoryBlacklistDriver).
+ *
+ * Agnostic by construction: it depends on no Redis package. The caller injects
+ * any ioredis-compatible client (KeyDB, Redis, a mock…) that exposes `set` with
+ * an `"EX"` ttl and `exists`. Native key expiry does the housekeeping, so
+ * `cleanup()` is a no-op.
+ */
+import type { BlacklistDriver } from "./TokenBlacklist.js";
+/** The minimal ioredis-shaped surface this driver needs. */
+export interface RedisLikeClient {
+    set(key: string, value: string, mode: "EX", ttlSeconds: number): Promise<unknown>;
+    exists(key: string): Promise<number>;
+}
+export interface RedisBlacklistConfig {
+    /** Key prefix for blacklist entries. Default `warden:blacklist:`. */
+    prefix?: string;
+}
+export declare class RedisBlacklistDriver implements BlacklistDriver {
+    #private;
+    constructor(client: RedisLikeClient, config?: RedisBlacklistConfig);
+    /**
+     * Blacklist a JTI until its natural expiry. Tokens already past `expiresAt`
+     * are skipped — there is nothing left to revoke.
+     */
+    add(jti: string, expiresAt: number): Promise<void>;
+    has(jti: string): Promise<boolean>;
+    /** No-op: Redis/KeyDB evicts expired keys on its own. */
+    cleanup(): Promise<void>;
+}
+//# sourceMappingURL=RedisBlacklistDriver.d.ts.map

package/dist/RedisBlacklistDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedisBlacklistDriver.d.ts","sourceRoot":"","sources":["../src/RedisBlacklistDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,4DAA4D;AAC5D,MAAM,WAAW,eAAe;IAC/B,GAAG,CACF,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACpC,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,oBAAqB,YAAW,eAAe;;gBAI/C,MAAM,EAAE,eAAe,EAAE,MAAM,GAAE,oBAAyB;IAKtE;;;OAGG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxC,yDAAyD;IACnD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAK9B"}

package/dist/RedisBlacklistDriver.js

@@ -0,0 +1,37 @@
+/**
+ * RedisBlacklistDriver — a persistent JWT blacklist backed by Redis / KeyDB,
+ * so logout revocation survives a process restart (unlike MemoryBlacklistDriver).
+ *
+ * Agnostic by construction: it depends on no Redis package. The caller injects
+ * any ioredis-compatible client (KeyDB, Redis, a mock…) that exposes `set` with
+ * an `"EX"` ttl and `exists`. Native key expiry does the housekeeping, so
+ * `cleanup()` is a no-op.
+ */
+export class RedisBlacklistDriver {
+    #client;
+    #prefix;
+    constructor(client, config = {}) {
+        this.#client = client;
+        this.#prefix = config.prefix ?? "warden:blacklist:";
+    }
+    /**
+     * Blacklist a JTI until its natural expiry. Tokens already past `expiresAt`
+     * are skipped — there is nothing left to revoke.
+     */
+    async add(jti, expiresAt) {
+        const ttlSeconds = Math.ceil((expiresAt - Date.now()) / 1000);
+        if (ttlSeconds <= 0) {
+            return;
+        }
+        await this.#client.set(this.#key(jti), "1", "EX", ttlSeconds);
+    }
+    async has(jti) {
+        return (await this.#client.exists(this.#key(jti))) > 0;
+    }
+    /** No-op: Redis/KeyDB evicts expired keys on its own. */
+    async cleanup() { }
+    #key(jti) {
+        return `${this.#prefix}${jti}`;
+    }
+}
+//# sourceMappingURL=RedisBlacklistDriver.js.map

package/dist/RedisBlacklistDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedisBlacklistDriver.js","sourceRoot":"","sources":["../src/RedisBlacklistDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoBH,MAAM,OAAO,oBAAoB;IACvB,OAAO,CAAkB;IACzB,OAAO,CAAS;IAEzB,YAAY,MAAuB,EAAE,SAA+B,EAAE;QACrE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,SAAiB;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9D,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO;QACR,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACpB,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,OAAO,KAAmB,CAAC;IAEjC,IAAI,CAAC,GAAW;QACf,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;IAChC,CAAC;CACD"}