@chidchanun/bcp 0.1.15 → 0.1.16

package/docs/authentication.md

@@ -0,0 +1,201 @@
+# Authentication
+
+BCP Framework 0.1.16 adds a server-only authentication layer through `bcp/auth`.
+It builds on the signed JWT cookie/session primitives from `bcp/server` and provides a higher-level API for application authentication.
+
+## Environment
+
+Set a session secret with at least 32 bytes:
+
+```env
+BCP_SESSION_SECRET=replace-with-a-long-random-secret-at-least-32-bytes
+```
+
+The default cookie is `bcp_session`. It is HttpOnly, uses `SameSite=Lax`, has a 12-hour lifetime, and is Secure automatically when `NODE_ENV=production`.
+
+## Basic usage
+
+```ts
+import {
+    auth,
+    login,
+    logout,
+} from "bcp/auth";
+
+export async function POST() {
+    await login({
+        id: 42,
+        email: "user@example.com",
+        role: "admin",
+    });
+
+    return Response.json({
+        ok: true,
+    });
+}
+```
+
+Read the current authenticated session:
+
+```ts
+import {
+    auth,
+} from "bcp/auth";
+
+const session =
+    await auth<{
+        id: number;
+        email: string;
+        role: string;
+    }>();
+
+if (!session) {
+    // Not authenticated.
+}
+
+console.log(
+    session?.user.id
+);
+```
+
+`getSession()` is an alias for `auth()` when that naming is clearer in application code.
+
+## Typed auth factory
+
+For application-wide types and cookie settings, create a typed auth instance:
+
+```ts
+import {
+    createAuth,
+} from "bcp/auth";
+
+interface AppUser {
+    id: number;
+    email: string;
+    role: "admin" | "user";
+}
+
+interface AppSessionData {
+    tenantId: string;
+}
+
+export const appAuth =
+    createAuth<
+        AppUser,
+        AppSessionData
+    >({
+        cookieName:
+            "app_session",
+        expiresIn:
+            60 * 60 * 8,
+        issuer:
+            "my-app",
+        audience:
+            "web",
+    });
+```
+
+Login with typed session data:
+
+```ts
+await appAuth.login(
+    {
+        id: 42,
+        email: "user@example.com",
+        role: "admin",
+    },
+    {
+        data: {
+            tenantId:
+                "tenant-1",
+        },
+    }
+);
+```
+
+Read it later:
+
+```ts
+const session =
+    await appAuth.auth();
+
+console.log(
+    session?.user.email
+);
+console.log(
+    session?.data?.tenantId
+);
+```
+
+## Logout
+
+```ts
+await logout();
+```
+
+Or with a factory:
+
+```ts
+await appAuth.logout();
+```
+
+Logout expires the configured authentication cookie.
+
+## Session rotation
+
+Each auth login receives a unique `sid` (session identifier). `rotateSession()` keeps the current user and session data but issues a new `sid`, JWT, expiry window, and cookie.
+
+```ts
+const rotated =
+    await appAuth.rotateSession();
+
+if (rotated) {
+    console.log(
+        rotated.sid
+    );
+}
+```
+
+Rotation returns `null` when no valid auth session exists.
+
+A useful policy is to rotate after a security-sensitive event such as a privilege change or successful re-authentication.
+
+## Session shape
+
+An authenticated session contains the user, optional application session data, and signed JWT claims:
+
+```ts
+{
+    sid: string;
+    user: AppUser;
+    data?: AppSessionData;
+    iat: number;
+    exp: number;
+    iss?: string;
+    aud?: string | string[];
+}
+```
+
+## Security notes
+
+- `bcp/auth` is server-only and must not be imported into pages or client islands.
+- Never put passwords, password hashes, API secrets, access keys, or other sensitive credentials in the auth user/session payload. JWT cookie payloads are signed, not encrypted.
+- Keep `BCP_SESSION_SECRET` out of source control and use a strong random value of at least 32 bytes.
+- Authentication verifies identity/session state. Application authorization such as roles and permissions belongs in route guards or server actions.
+- Use HTTPS in production so Secure cookies are transmitted only over encrypted connections.
+
+## create-bcp-app
+
+When `JWT Cookie` authentication is selected, generated applications use `createAuth()` internally and expose helpers from `lib/auth.ts`:
+
+```ts
+import {
+    auth,
+    getSession,
+    login,
+    logout,
+    rotateSession,
+} from "@/lib/auth";
+```
+
+The generated `authenticateCredentials()` intentionally returns `null` until the application implements its own user lookup and password verification strategy.

package/docs/releases/0.1.16.md

@@ -0,0 +1,53 @@
+# BCP Framework 0.1.16
+
+## Authentication Core
+
+BCP 0.1.16 introduces the server-only `bcp/auth` entrypoint.
+
+### New APIs
+
+- `auth()` reads and validates the current authentication session.
+- `getSession()` is an auth-focused alias for `auth()`.
+- `login(user, options)` creates an authenticated JWT cookie session.
+- `logout(options)` expires the authentication cookie.
+- `rotateSession(options)` preserves the authenticated user/session data while issuing a new session identifier and token.
+- `createAuth<User, SessionData>(defaults)` creates a typed application auth instance with shared cookie/token configuration.
+
+### Session identity
+
+Every login now receives a random UUID `sid`. Session rotation always issues a new `sid`, so rotation produces a distinct signed token even if it happens within the same second.
+
+### Security
+
+- `bcp/auth` is exported as server-only in the package manifest.
+- The client-boundary validator blocks `bcp/auth` from page/client graphs.
+- The same validator now explicitly blocks direct `bcp/database` imports from client graphs as well.
+- Existing JWT signing, expiration, issuer/audience validation, HttpOnly cookies, production Secure defaults, and minimum 32-byte session secrets remain provided by the underlying session runtime.
+
+### create-bcp-app
+
+The JWT Cookie preset now uses the framework auth core through `createAuth()` while keeping the existing starter helper names and API routes compatible.
+
+Generated `lib/auth.ts` also exposes:
+
+```ts
+export const auth = frameworkAuth.auth;
+export const getSession = frameworkAuth.getSession;
+export const login = frameworkAuth.login;
+export const logout = frameworkAuth.logout;
+export const rotateSession = frameworkAuth.rotateSession;
+```
+
+`authenticateCredentials()` still returns `null` until the application implements its own user lookup and password verification.
+
+### Tests
+
+0.1.16 adds regression coverage for:
+
+- typed login/read/logout lifecycle;
+- typed `createAuth()` defaults;
+- session rotation and changing `sid` values;
+- invalid auth payload rejection;
+- published `bcp/auth` export wiring;
+- client-boundary blocking for auth/database;
+- JWT Cookie scaffold integration with the framework auth core.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chidchanun/bcp",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "BCP Framework - a React full-stack framework with file-based routing, SSR, APIs, middleware, islands, caching and standalone production builds.",
   "type": "module",
   "license": "MIT",
@@ -48,6 +48,11 @@
       "browser": "./packages/client/src/server-only.browser.mjs",
       "default": "./packages/client/src/database.ts"
     },
+    "./auth": {
+      "types": "./packages/client/src/auth.ts",
+      "browser": "./packages/client/src/server-only.browser.mjs",
+      "default": "./packages/client/src/auth.ts"
+    },
     "./server": {
       "types": "./packages/client/src/server.ts",
       "browser": "./packages/client/src/server-only.browser.mjs",

package/packages/bundler/src/client-boundary.ts

@@ -22,7 +22,13 @@ const MODULE_EXTENSIONS = [
     ".cjs",
 ] as const;
 
-const SERVER_ONLY_IMPORTS = new Set(["bcp/server","bcp/server-only"])
+const SERVER_ONLY_IMPORTS =
+    new Set([
+        "bcp/server",
+        "bcp/server-only",
+        "bcp/database",
+        "bcp/auth",
+    ]);
 
 export function validateClientBoundaries(
     routes: Route[],
@@ -129,13 +135,17 @@ function visitClientModule(
             source
         )
     ) {
-        if (SERVER_ONLY_IMPORTS.has(specifier)){
+        if (
+            SERVER_ONLY_IMPORTS.has(
+                specifier
+            )
+        ) {
             throw new Error(
                 `BCP Framework: ${formatApplicationPath(
                     rootDirectory,
                     filePath
                 )} imports ${specifier} but is reachable from the client bundle for ${routeName}. Move the server dependency behind an API route.`
-            )
+            );
         }
 
         const dependency =

package/packages/client/src/auth.ts

@@ -0,0 +1,14 @@
+export {
+    auth,
+    createAuth,
+    getSession,
+    login,
+    logout,
+    rotateSession,
+
+    type AuthApi,
+    type AuthLoginOptions,
+    type AuthOptions,
+    type AuthSession,
+    type AuthUser,
+} from "../../server/src/auth.js";

package/packages/server/src/auth.ts

@@ -0,0 +1,376 @@
+import {
+    randomUUID,
+} from "node:crypto";
+
+import {
+    createSession,
+    destroySession,
+    getSession as readSession,
+    type SessionClaims,
+    type SessionCookieOptions,
+} from "./session.js";
+
+export interface AuthUser {
+    id: string | number;
+}
+
+export interface AuthSession<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+> extends SessionClaims {
+    sid: string;
+    user: TUser;
+    data?: TData;
+}
+
+export interface AuthOptions
+extends SessionCookieOptions {}
+
+export interface AuthLoginOptions<
+    TData extends object = Record<string, never>
+> extends AuthOptions {
+    data?: TData;
+}
+
+export interface AuthApi<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+> {
+    auth(
+        options?: AuthOptions
+    ): Promise<AuthSession<TUser, TData> | null>;
+    getSession(
+        options?: AuthOptions
+    ): Promise<AuthSession<TUser, TData> | null>;
+    login(
+        user: TUser,
+        options?: AuthLoginOptions<TData>
+    ): Promise<AuthSession<TUser, TData>>;
+    logout(
+        options?: AuthOptions
+    ): Promise<void>;
+    rotateSession(
+        options?: AuthOptions
+    ): Promise<AuthSession<TUser, TData> | null>;
+}
+
+interface AuthSessionPayload<
+    TUser extends AuthUser,
+    TData extends object
+> {
+    sid: string;
+    user: TUser;
+    data?: TData;
+}
+
+export async function auth<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+>(
+    options: AuthOptions = {}
+): Promise<AuthSession<TUser, TData> | null> {
+    const session =
+        await readSession<
+            AuthSessionPayload<
+                TUser,
+                TData
+            >
+        >(
+            options
+        );
+
+    if (!session) {
+        return null;
+    }
+
+    if (
+        typeof session.sid !==
+            "string" ||
+        session.sid.trim().length ===
+            0 ||
+        !isAuthUser(
+            session.user
+        )
+    ) {
+        return null;
+    }
+
+    if (
+        session.data !== undefined &&
+        !isPlainObject(
+            session.data
+        )
+    ) {
+        return null;
+    }
+
+    return session as
+        AuthSession<
+            TUser,
+            TData
+        >;
+}
+
+export async function getSession<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+>(
+    options: AuthOptions = {}
+): Promise<AuthSession<TUser, TData> | null> {
+    return auth<
+        TUser,
+        TData
+    >(
+        options
+    );
+}
+
+export async function login<
+    TUser extends AuthUser,
+    TData extends object = Record<string, never>
+>(
+    user: TUser,
+    options:
+        AuthLoginOptions<TData> = {}
+): Promise<AuthSession<TUser, TData>> {
+    assertAuthUser(
+        user
+    );
+
+    if (
+        options.data !== undefined &&
+        !isPlainObject(
+            options.data
+        )
+    ) {
+        throw new TypeError(
+            "BCP Auth: session data must be a plain object."
+        );
+    }
+
+    const {
+        data,
+        ...sessionOptions
+    } = options;
+    const payload:
+        AuthSessionPayload<
+            TUser,
+            TData
+        > = {
+        sid:
+            randomUUID(),
+        user,
+        ...(data === undefined
+            ? {}
+            : {
+                data,
+            }),
+    };
+
+    await createSession(
+        payload,
+        sessionOptions
+    );
+
+    const session =
+        await auth<
+            TUser,
+            TData
+        >(
+            sessionOptions
+        );
+
+    if (!session) {
+        throw new Error(
+            "BCP Auth: login created a session but it could not be read back."
+        );
+    }
+
+    return session;
+}
+
+export async function logout(
+    options: AuthOptions = {}
+): Promise<void> {
+    await destroySession(
+        options
+    );
+}
+
+export async function rotateSession<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+>(
+    options: AuthOptions = {}
+): Promise<AuthSession<TUser, TData> | null> {
+    const current =
+        await auth<
+            TUser,
+            TData
+        >(
+            options
+        );
+
+    if (!current) {
+        return null;
+    }
+
+    return login<
+        TUser,
+        TData
+    >(
+        current.user,
+        {
+            ...options,
+            issuer:
+                options.issuer ??
+                current.iss,
+            audience:
+                options.audience ??
+                current.aud,
+            ...(current.data === undefined
+                ? {}
+                : {
+                    data:
+                        current.data,
+                }),
+        }
+    );
+}
+
+export function createAuth<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+>(
+    defaults: AuthOptions = {}
+): AuthApi<TUser, TData> {
+    return {
+        auth: (
+            options = {}
+        ) =>
+            auth<
+                TUser,
+                TData
+            >({
+                ...defaults,
+                ...options,
+            }),
+        getSession: (
+            options = {}
+        ) =>
+            auth<
+                TUser,
+                TData
+            >({
+                ...defaults,
+                ...options,
+            }),
+        login: (
+            user,
+            options = {}
+        ) => {
+            const {
+                data,
+                ...sessionOptions
+            } = options;
+
+            return login<
+                TUser,
+                TData
+            >(
+                user,
+                {
+                    ...defaults,
+                    ...sessionOptions,
+                    ...(data === undefined
+                        ? {}
+                        : {
+                            data,
+                        }),
+                }
+            );
+        },
+        logout: (
+            options = {}
+        ) =>
+            logout({
+                ...defaults,
+                ...options,
+            }),
+        rotateSession: (
+            options = {}
+        ) =>
+            rotateSession<
+                TUser,
+                TData
+            >({
+                ...defaults,
+                ...options,
+            }),
+    };
+}
+
+function assertAuthUser(
+    value: unknown
+): asserts value is AuthUser {
+    if (
+        !isAuthUser(
+            value
+        )
+    ) {
+        throw new TypeError(
+            "BCP Auth: user must be a plain object with a non-empty string or finite numeric id."
+        );
+    }
+}
+
+function isAuthUser(
+    value: unknown
+): value is AuthUser {
+    if (
+        !isPlainObject(
+            value
+        )
+    ) {
+        return false;
+    }
+
+    const id =
+        value.id;
+
+    return (
+        typeof id === "string" &&
+        id.trim().length > 0
+    ) || (
+        typeof id === "number" &&
+        Number.isFinite(
+            id
+        )
+    );
+}
+
+function isPlainObject(
+    value: unknown
+): value is Record<string, unknown> {
+    if (
+        value === null ||
+        typeof value !== "object" ||
+        Array.isArray(
+            value
+        )
+    ) {
+        return false;
+    }
+
+    const prototype =
+        Object.getPrototypeOf(
+            value
+        );
+
+    return (
+        prototype ===
+            Object.prototype ||
+        prototype ===
+            null
+    );
+}