@cogenta/auth 0.1.0

package/dist/sessions.js

@@ -0,0 +1,82 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { identifier, newId, sql } from '@cogenta/core';
+import { TABLES } from './tables.js';
+const TOKEN_BYTES = 32;
+const DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days, sliding on use.
+/**
+ * A session token is opaque random bytes, never a JWT.
+ *
+ * A JWT is a claim the server made and stopped being able to take back the
+ * moment it left the process — revoking one means keeping a blocklist anyway,
+ * which is the session table this already is. An opaque token looked up on
+ * every request costs one indexed read and buys back revocation that actually
+ * revokes, including "sign out of every device".
+ */
+function issueToken() {
+    return randomBytes(TOKEN_BYTES).toString('base64url');
+}
+/** Stored hashed, like a password, so a leaked table hands out nothing live. */
+function hashToken(token) {
+    return createHash('sha256').update(token).digest('base64url');
+}
+function fromRow(row) {
+    return {
+        id: row.id,
+        userId: row.user_id,
+        createdAt: row.created_at,
+        expiresAt: row.expires_at,
+        lastSeenAt: row.last_seen_at,
+        label: row.label ?? undefined,
+    };
+}
+export function createSessionStore(db, now = Date.now) {
+    const table = identifier(TABLES.sessions, db.dialect);
+    return {
+        create: async (userId, options) => {
+            const token = issueToken();
+            const id = newId(now);
+            const created = new Date(now()).toISOString();
+            const expires = new Date(now() + (options?.ttlMs ?? DEFAULT_TTL_MS)).toISOString();
+            await db.query(sql `
+        insert into ${table} (id, user_id, token_hash, label, created_at, expires_at, last_seen_at, revoked)
+        values (${id}, ${userId}, ${hashToken(token)}, ${options?.label ?? null}, ${created}, ${expires}, ${created}, ${false})`);
+            return {
+                id,
+                userId,
+                token,
+                createdAt: created,
+                expiresAt: expires,
+                lastSeenAt: created,
+                label: options?.label,
+            };
+        },
+        resolve: async (token) => {
+            // Looked up by the hash, never by the token — the table never contains
+            // anything that would let a database read alone impersonate a session.
+            const targetHash = hashToken(token);
+            const result = await db.query(sql `select * from ${table} where token_hash = ${targetHash}`);
+            const row = result.rows[0];
+            if (row === undefined)
+                return null;
+            if (row.revoked)
+                return null;
+            const nowMs = now();
+            if (new Date(row.expires_at).getTime() <= nowMs)
+                return null;
+            const lastSeen = new Date(nowMs).toISOString();
+            await db.query(sql `update ${table} set last_seen_at = ${lastSeen} where id = ${row.id}`);
+            return fromRow({ ...row, last_seen_at: lastSeen });
+        },
+        list: async (userId) => {
+            const result = await db.query(sql `select * from ${table} where user_id = ${userId} and revoked = ${false} order by last_seen_at desc`);
+            return result.rows.map(fromRow);
+        },
+        revoke: async (sessionId) => {
+            await db.query(sql `update ${table} set revoked = ${true} where id = ${sessionId}`);
+        },
+        revokeAll: async (userId) => {
+            await db.query(sql `update ${table} set revoked = ${true} where user_id = ${userId}`);
+        },
+    };
+}
+//# sourceMappingURL=sessions.js.map

package/dist/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGpC,MAAM,WAAW,GAAG,EAAE,CAAA;AACtB,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,2BAA2B;AAE3E;;;;;;;;GAQG;AACH,SAAS,UAAU;IACjB,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACvD,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAC/D,CAAC;AAYD,SAAS,OAAO,CAAC,GAAe;IAC9B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;KAC9B,CAAA;AACH,CAAC;AAgBD,MAAM,UAAU,kBAAkB,CAAC,EAAkB,EAAE,GAAG,GAAiB,IAAI,CAAC,GAAG;IACjF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAErD,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;YAC1B,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC7C,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAElF,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK;kBACT,EAAE,KAAK,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,KAAK,IAAI,IAAI,KAAK,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK,KAAK,GAAG,CAAC,CAAA;YAE3H,OAAO;gBACL,EAAE;gBACF,MAAM;gBACN,KAAK;gBACL,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,OAAO;gBAClB,UAAU,EAAE,OAAO;gBACnB,KAAK,EAAE,OAAO,EAAE,KAAK;aACtB,CAAA;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACvB,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;YACnC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,uBAAuB,UAAU,EAAE,CAC7D,CAAA;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAClC,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAA;YAC5B,MAAM,KAAK,GAAG,GAAG,EAAE,CAAA;YACnB,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK;gBAAE,OAAO,IAAI,CAAA;YAE5D,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;YAC9C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,UAAU,KAAK,uBAAuB,QAAQ,eAAe,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;YAExF,OAAO,OAAO,CAAC,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,oBAAoB,MAAM,kBAAkB,KAAK,6BAA6B,CACxG,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,UAAU,KAAK,kBAAkB,IAAI,eAAe,SAAS,EAAE,CAAC,CAAA;QACpF,CAAC;QAED,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,UAAU,KAAK,kBAAkB,IAAI,oBAAoB,MAAM,EAAE,CAAC,CAAA;QACtF,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,30 @@
+import type { DatabaseHandle } from '@cogenta/core';
+import type { CollectionDefinition } from '@cogenta/schema';
+import { createAuditLog } from './audit.js';
+import { createCredentialStore } from './credentials.js';
+import { createAuthService } from './login.js';
+import { createRateLimiter } from './rate-limit.js';
+import { createSessionStore } from './sessions.js';
+import { createUserStore } from './users.js';
+import type { WebAuthnConfig } from './webauthn.js';
+export interface AuthStoreOptions {
+    readonly db: DatabaseHandle;
+    readonly signingKey: string;
+    readonly collections: readonly CollectionDefinition[];
+    /** Shown in the authenticator app next to the account name. Defaults to "Cogenta". */
+    readonly issuer?: string;
+    /** Absent means passkeys are off. */
+    readonly webauthn?: WebAuthnConfig;
+    readonly now?: () => number;
+}
+/** Every piece of this package, wired together against one connection. */
+export interface AuthStore {
+    readonly users: ReturnType<typeof createUserStore>;
+    readonly credentials: ReturnType<typeof createCredentialStore>;
+    readonly sessions: ReturnType<typeof createSessionStore>;
+    readonly audit: ReturnType<typeof createAuditLog>;
+    readonly rateLimit: ReturnType<typeof createRateLimiter>;
+    readonly login: ReturnType<typeof createAuthService>;
+}
+export declare function createAuthStore(options: AuthStoreOptions): Promise<AuthStore>;
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,qCAAqC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;IAC9D,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;IACxD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;IACxD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;CACrD;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAmBnF"}

package/dist/store.js

@@ -0,0 +1,27 @@
+import { createAuditLog } from './audit.js';
+import { createCredentialStore } from './credentials.js';
+import { createAuthService } from './login.js';
+import { createRateLimiter } from './rate-limit.js';
+import { createSessionStore } from './sessions.js';
+import { ensureAuthTables } from './tables.js';
+import { createUserStore } from './users.js';
+export async function createAuthStore(options) {
+    await ensureAuthTables(options.db);
+    const now = options.now ?? Date.now;
+    return {
+        users: createUserStore(options.db, now),
+        credentials: createCredentialStore(options.db, now),
+        sessions: createSessionStore(options.db, now),
+        audit: createAuditLog(options.db, now),
+        rateLimit: createRateLimiter(options.db, now),
+        login: createAuthService({
+            db: options.db,
+            signingKey: options.signingKey,
+            collections: options.collections,
+            now,
+            ...(options.issuer === undefined ? {} : { issuer: options.issuer }),
+            ...(options.webauthn === undefined ? {} : { webauthn: options.webauthn }),
+        }),
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAwB5C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAyB;IAC7D,MAAM,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IAEnC,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QACvC,WAAW,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QACnD,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QAC7C,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QACtC,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QAC7C,KAAK,EAAE,iBAAiB,CAAC;YACvB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG;YACH,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SAC1E,CAAC;KACH,CAAA;AACH,CAAC"}

package/dist/tables.d.ts

@@ -0,0 +1,17 @@
+import { type DatabaseHandle } from '@cogenta/core';
+export declare const TABLES: {
+    readonly users: 'cogenta_users';
+    readonly credentials: 'cogenta_credentials';
+    readonly sessions: 'cogenta_sessions';
+    readonly loginAttempts: 'cogenta_login_attempts';
+    readonly auditLog: 'cogenta_audit_log';
+};
+/**
+ * Every table this package owns.
+ *
+ * Run once, at startup, the same way the migration engine and the queue driver
+ * do it: `create table if not exists`, so a fresh install and an upgrade take
+ * the same path.
+ */
+export declare function ensureAuthTables(db: DatabaseHandle): Promise<void>;
+//# sourceMappingURL=tables.d.ts.map

package/dist/tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../src/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EAKpB,MAAM,eAAe,CAAA;AAEtB,eAAO,MAAM,MAAM;aACjB,KAAK,EAAE,eAAe;aACtB,WAAW,EAAE,qBAAqB;aAClC,QAAQ,EAAE,kBAAkB;aAC5B,aAAa,EAAE,wBAAwB;aACvC,QAAQ,EAAE,mBAAmB;CACrB,CAAA;AAWV;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFxE"}

package/dist/tables.js

@@ -0,0 +1,103 @@
+import { identifier, sql, unsafeRaw, } from '@cogenta/core';
+export const TABLES = {
+    users: 'cogenta_users',
+    credentials: 'cogenta_credentials',
+    sessions: 'cogenta_sessions',
+    loginAttempts: 'cogenta_login_attempts',
+    auditLog: 'cogenta_audit_log',
+};
+/** `varchar` on Postgres/MySQL, `text` on SQLite — encapsulated once, here. */
+function textColumn(dialect, length) {
+    return unsafeRaw(dialect === 'sqlite' ? 'text' : `varchar(${length})`);
+}
+function booleanColumn(dialect) {
+    return unsafeRaw(dialect === 'postgres' ? 'boolean' : 'tinyint');
+}
+/**
+ * Every table this package owns.
+ *
+ * Run once, at startup, the same way the migration engine and the queue driver
+ * do it: `create table if not exists`, so a fresh install and an upgrade take
+ * the same path.
+ */
+export async function ensureAuthTables(db) {
+    const d = db.dialect;
+    const users = identifier(TABLES.users, d);
+    const credentials = identifier(TABLES.credentials, d);
+    const sessions = identifier(TABLES.sessions, d);
+    const loginAttempts = identifier(TABLES.loginAttempts, d);
+    const auditLog = identifier(TABLES.auditLog, d);
+    const t512 = textColumn(d, 512);
+    const t255 = textColumn(d, 255);
+    const t64 = textColumn(d, 64);
+    const bool = booleanColumn(d);
+    await db.query(sql `
+    create table if not exists ${users} (
+      id ${t64} not null primary key,
+      email ${t255} not null unique,
+      -- An open set of role names (contract A), stored as JSON text on every
+      -- dialect for the same reason the migration engine stores timestamps as
+      -- text: one representation that means the same thing everywhere, rather
+      -- than a native array type only Postgres has.
+      roles text not null,
+      status ${t64} not null,
+      created_at ${t64} not null,
+      updated_at ${t64} not null
+    )`);
+    await db.query(sql `
+    create table if not exists ${credentials} (
+      id ${t64} not null primary key,
+      user_id ${t64} not null,
+      kind ${t64} not null,
+      -- Kind-specific, never interpreted at this layer:
+      --   password: { hash }
+      --   totp:     { secret, verified }
+      --   webauthn: { credentialId, publicKey, counter, transports, label }
+      data text not null,
+      created_at ${t64} not null
+    )`);
+    await db.query(sql `
+    create table if not exists ${sessions} (
+      id ${t64} not null primary key,
+      user_id ${t64} not null,
+      -- The bearer token itself is never stored, only its hash — the same
+      -- reasoning as a password, applied to the thing that stands in for one
+      -- after login. A leaked database does not hand out live sessions.
+      token_hash ${t512} not null unique,
+      label ${t255},
+      created_at ${t64} not null,
+      expires_at ${t64} not null,
+      last_seen_at ${t64} not null,
+      revoked ${bool} not null
+    )`);
+    await db.query(sql `
+    create table if not exists ${loginAttempts} (
+      id ${t64} not null primary key,
+      -- Keyed by subject (email or IP), not by user id: an attacker probing a
+      -- nonexistent email must be rate-limited too, or enumeration is free.
+      subject ${t255} not null,
+      at ${t64} not null
+    )`);
+    await db.query(sql `
+    create table if not exists ${auditLog} (
+      id ${t64} not null primary key,
+      at ${t64} not null,
+      actor_id ${t64},
+      actor_roles text not null,
+      action ${t255} not null,
+      collection_name ${t255},
+      entry_id ${t64},
+      diff text,
+      hash ${t64} not null,
+      previous_hash ${t64}
+    )`);
+    await createIndexIfMissing(db, 'cogenta_credentials_user', credentials, sql `(user_id)`);
+    await createIndexIfMissing(db, 'cogenta_sessions_user', sessions, sql `(user_id)`);
+    await createIndexIfMissing(db, 'cogenta_login_attempts_subject_at', loginAttempts, sql `(subject, at)`);
+}
+async function createIndexIfMissing(db, name, table, columns) {
+    await db
+        .query(sql `create index ${identifier(name, db.dialect)} on ${table} ${columns}`)
+        .catch(() => undefined); // already there — no portable "if not exists" for indexes
+}
+//# sourceMappingURL=tables.js.map

package/dist/tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../src/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EAEV,GAAG,EACH,SAAS,GACV,MAAM,eAAe,CAAA;AAEtB,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,EAAE,eAAe;IACtB,WAAW,EAAE,qBAAqB;IAClC,QAAQ,EAAE,kBAAkB;IAC5B,aAAa,EAAE,wBAAwB;IACvC,QAAQ,EAAE,mBAAmB;CACrB,CAAA;AAEV,+EAA+E;AAC/E,SAAS,UAAU,CAAC,OAAwB,EAAE,MAAc;IAC1D,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC,CAAA;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,OAAwB;IAC7C,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAkB;IACvD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAA;IACpB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;IAE7B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,KAAK;WAC3B,GAAG;cACA,IAAI;;;;;;eAMH,GAAG;mBACC,GAAG;mBACH,GAAG;MAChB,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,WAAW;WACjC,GAAG;gBACE,GAAG;aACN,GAAG;;;;;;mBAMG,GAAG;MAChB,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,QAAQ;WAC9B,GAAG;gBACE,GAAG;;;;mBAIA,IAAI;cACT,IAAI;mBACC,GAAG;mBACH,GAAG;qBACD,GAAG;gBACR,IAAI;MACd,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,aAAa;WACnC,GAAG;;;gBAGE,IAAI;WACT,GAAG;MACR,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,QAAQ;WAC9B,GAAG;WACH,GAAG;iBACG,GAAG;;eAEL,IAAI;wBACK,IAAI;iBACX,GAAG;;aAEP,GAAG;sBACM,GAAG;MACnB,CAAC,CAAA;IAEL,MAAM,oBAAoB,CAAC,EAAE,EAAE,0BAA0B,EAAE,WAAW,EAAE,GAAG,CAAA,WAAW,CAAC,CAAA;IACvF,MAAM,oBAAoB,CAAC,EAAE,EAAE,uBAAuB,EAAE,QAAQ,EAAE,GAAG,CAAA,WAAW,CAAC,CAAA;IACjF,MAAM,oBAAoB,CACxB,EAAE,EACF,mCAAmC,EACnC,aAAa,EACb,GAAG,CAAA,eAAe,CACnB,CAAA;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,EAAkB,EAClB,IAAY,EACZ,KAAkB,EAClB,OAAoB;IAEpB,MAAM,EAAE;SACL,KAAK,CAAC,GAAG,CAAA,gBAAgB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAC;SAC/E,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA,CAAC,0DAA0D;AACtF,CAAC"}

package/dist/totp.d.ts

@@ -0,0 +1,22 @@
+export declare function generateTotpSecret(): string;
+/**
+ * The `otpauth://` URI an authenticator app scans as a QR code.
+ *
+ * `issuer` and `label` are URL-encoded independently: a site name or a user
+ * email containing `&` or `:` must not be able to smuggle extra URI parameters
+ * into what the app parses.
+ */
+export declare function totpUri(secret: string, issuer: string, label: string): string;
+export interface VerifyTotpOptions {
+    /** Epoch seconds. Injected so a test never races the real clock. */
+    readonly now?: number;
+    /**
+     * Time steps of drift accepted either side of now, to absorb clock skew
+     * between the server and a phone that has not synced in a while. 1 means
+     * the previous, current and next 30-second window all validate.
+     */
+    readonly windowSteps?: number;
+}
+export declare function verifyTotp(token: string, secret: string, options?: VerifyTotpOptions): boolean;
+export declare function assertTotpSecretFormat(secret: string): void;
+//# sourceMappingURL=totp.d.ts.map

package/dist/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../src/totp.ts"],"names":[],"mappings":"AAgBA,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAS7E;AAiBD,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,wBAAgB,UAAU,CACxB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAmBT;AA8CD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAQ3D"}

package/dist/totp.js

@@ -0,0 +1,115 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { CogentaError } from '@cogenta/core';
+/**
+ * TOTP, RFC 6238 over HOTP, RFC 4226 — hand-written rather than a dependency.
+ *
+ * It is forty lines of HMAC and modular arithmetic with no ambiguity in the
+ * spec and no ceremony to get subtly wrong, which is the opposite of WebAuthn:
+ * that one is a dependency for exactly the reasons this one is not.
+ */
+const DIGITS = 6;
+const PERIOD_SECONDS = 30;
+const ALGORITHM = 'sha1'; // What every authenticator app (contract: RFC 6238 default) expects.
+const BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+export function generateTotpSecret() {
+    return base32Encode(randomBytes(20));
+}
+/**
+ * The `otpauth://` URI an authenticator app scans as a QR code.
+ *
+ * `issuer` and `label` are URL-encoded independently: a site name or a user
+ * email containing `&` or `:` must not be able to smuggle extra URI parameters
+ * into what the app parses.
+ */
+export function totpUri(secret, issuer, label) {
+    const params = new URLSearchParams({
+        secret,
+        issuer,
+        algorithm: 'SHA1',
+        digits: String(DIGITS),
+        period: String(PERIOD_SECONDS),
+    });
+    return `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(label)}?${params.toString()}`;
+}
+function hotp(secret, counter) {
+    const counterBytes = Buffer.alloc(8);
+    counterBytes.writeBigUInt64BE(counter);
+    const digest = createHmac(ALGORITHM, secret).update(counterBytes).digest();
+    const offset = (digest.at(-1) ?? 0) & 0x0f;
+    const truncated = ((digest[offset] ?? 0) & 0x7f) * 2 ** 24 +
+        ((digest[offset + 1] ?? 0) & 0xff) * 2 ** 16 +
+        ((digest[offset + 2] ?? 0) & 0xff) * 2 ** 8 +
+        ((digest[offset + 3] ?? 0) & 0xff);
+    return String(truncated % 10 ** DIGITS).padStart(DIGITS, '0');
+}
+export function verifyTotp(token, secret, options = {}) {
+    if (!/^\d{6}$/.test(token))
+        return false;
+    const key = base32Decode(secret);
+    if (key === null)
+        return false;
+    const now = options.now ?? Math.floor(Date.now() / 1000);
+    const windowSteps = options.windowSteps ?? 1;
+    const currentStep = BigInt(Math.floor(now / PERIOD_SECONDS));
+    // Every candidate in the window is checked — never short-circuited on the
+    // first comparison — and each comparison is constant-time, so accepting on
+    // the third of three steps takes the same time as rejecting on the first.
+    let matched = false;
+    for (let offset = -windowSteps; offset <= windowSteps; offset += 1) {
+        const candidate = hotp(key, currentStep + BigInt(offset));
+        if (constantTimeEquals(candidate, token))
+            matched = true;
+    }
+    return matched;
+}
+function constantTimeEquals(a, b) {
+    const bufferA = Buffer.from(a);
+    const bufferB = Buffer.from(b);
+    if (bufferA.length !== bufferB.length)
+        return false;
+    return timingSafeEqual(bufferA, bufferB);
+}
+function base32Encode(bytes) {
+    let bits = 0;
+    let value = 0;
+    let output = '';
+    for (const byte of bytes) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            output += BASE32_ALPHABET[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0)
+        output += BASE32_ALPHABET[(value << (5 - bits)) & 31];
+    return output;
+}
+function base32Decode(text) {
+    const normalised = text.toUpperCase().replace(/=+$/u, '');
+    if (normalised.length === 0 || !/^[A-Z2-7]+$/u.test(normalised))
+        return null;
+    const bytes = [];
+    let bits = 0;
+    let value = 0;
+    for (const char of normalised) {
+        const index = BASE32_ALPHABET.indexOf(char);
+        value = (value << 5) | index;
+        bits += 5;
+        if (bits >= 8) {
+            bytes.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(bytes);
+}
+export function assertTotpSecretFormat(secret) {
+    if (base32Decode(secret) === null) {
+        throw new CogentaError({
+            code: 'AUTH_TOTP_INVALID',
+            message: 'A TOTP secret must be base32 text.',
+            hint: 'Generate one with generateTotpSecret() rather than constructing it by hand.',
+        });
+    }
+}
+//# sourceMappingURL=totp.js.map

package/dist/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../src/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C;;;;;;GAMG;AAEH,MAAM,MAAM,GAAG,CAAC,CAAA;AAChB,MAAM,cAAc,GAAG,EAAE,CAAA;AACzB,MAAM,SAAS,GAAG,MAAM,CAAA,CAAC,qEAAqE;AAC9F,MAAM,eAAe,GAAG,kCAAkC,CAAA;AAE1D,MAAM,UAAU,kBAAkB;IAChC,OAAO,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,KAAa;IACnE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,MAAM;QACN,MAAM;QACN,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;KAC/B,CAAC,CAAA;IACF,OAAO,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;AACzG,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,OAAe;IAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACpC,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAEtC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAA;IAC1E,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;IAC1C,MAAM,SAAS,GACb,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QACxC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAC5C,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IAEpC,OAAO,MAAM,CAAC,SAAS,GAAG,EAAE,IAAI,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAC/D,CAAC;AAaD,MAAM,UAAU,UAAU,CACxB,KAAa,EACb,MAAc,EACd,OAAO,GAAsB,EAAE;IAE/B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAExC,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAE9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAA;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC,CAAA;IAE5D,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,KAAK,IAAI,MAAM,GAAG,CAAC,WAAW,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACzD,IAAI,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC;YAAE,OAAO,GAAG,IAAI,CAAA;IAC1D,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACnD,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,MAAM,GAAG,EAAE,CAAA;IAEf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;QAC3B,IAAI,IAAI,CAAC,CAAA;QACT,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;YACtD,IAAI,IAAI,CAAC,CAAA;QACX,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IACnE,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACzD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAE5E,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAA;QAC5B,IAAI,IAAI,CAAC,CAAA;QACT,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;YACzC,IAAI,IAAI,CAAC,CAAA;QACX,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,oCAAoC;YAC7C,IAAI,EAAE,6EAA6E;SACpF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Identity, sessions and credentials.
+ *
+ * Contract A deliberately stops at "roles are an open set of names declared in
+ * a collection's permissions" and says who attaches a role to a user is L2's
+ * concern (ADR-0014's neighbour decision, recorded in `docs/lots/L2-admin.md`).
+ * This package is that concern: it is what turns a role name into an actual
+ * signed-in person.
+ */
+export declare const CREDENTIAL_KINDS: readonly ['password', 'totp', 'webauthn'];
+export type CredentialKind = (typeof CREDENTIAL_KINDS)[number];
+export interface User {
+    readonly id: string;
+    readonly email: string;
+    /** An open set of names, exactly as contract A's collection permissions expect. */
+    readonly roles: readonly string[];
+    readonly status: 'active' | 'disabled';
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+export interface CreateUserInput {
+    readonly email: string;
+    readonly roles: readonly string[];
+}
+export interface Session {
+    readonly id: string;
+    readonly userId: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly lastSeenAt: string;
+    /** Free text, shown in "your sessions" so a person can recognise a device. */
+    readonly label: string | undefined;
+}
+/**
+ * A session as returned once, at creation. `token` is the bearer credential; it
+ * is never stored — only its hash is (the same reasoning as a password, applied
+ * to the thing that stands in for one after login).
+ */
+export interface IssuedSession extends Session {
+    readonly token: string;
+}
+export interface AuditEntry {
+    readonly id: string;
+    readonly at: string;
+    readonly actorId: string | null;
+    /** The roles the actor held at the time, not what they hold now. */
+    readonly actorRoles: readonly string[];
+    readonly action: string;
+    readonly collection: string | null;
+    readonly entryId: string | null;
+    readonly diff: Readonly<Record<string, unknown>> | null;
+    /** Chains to the previous entry's hash. The first entry chains to null. */
+    readonly hash: string;
+    readonly previousHash: string | null;
+}
+export interface RecordAuditInput {
+    readonly actorId: string | null;
+    readonly actorRoles: readonly string[];
+    readonly action: string;
+    readonly collection?: string | undefined;
+    readonly entryId?: string | undefined;
+    readonly diff?: Readonly<Record<string, unknown>> | undefined;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,gBAAgB,YAAI,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAA;AACzE,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE9D,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAc,SAAQ,OAAO;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAA;IACvD,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAA;CAC9D"}

package/dist/types.js

@@ -0,0 +1,11 @@
+/**
+ * Identity, sessions and credentials.
+ *
+ * Contract A deliberately stops at "roles are an open set of names declared in
+ * a collection's permissions" and says who attaches a role to a user is L2's
+ * concern (ADR-0014's neighbour decision, recorded in `docs/lots/L2-admin.md`).
+ * This package is that concern: it is what turns a role name into an actual
+ * signed-in person.
+ */
+export const CREDENTIAL_KINDS = ['password', 'totp', 'webauthn'];
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAA"}

package/dist/users.d.ts

@@ -0,0 +1,12 @@
+import { type DatabaseHandle } from '@cogenta/core';
+import type { CreateUserInput, User } from './types.js';
+export interface UserStore {
+    create(input: CreateUserInput): Promise<User>;
+    byEmail(email: string): Promise<User | null>;
+    byId(id: string): Promise<User | null>;
+    setRoles(id: string, roles: readonly string[]): Promise<void>;
+    setStatus(id: string, status: User['status']): Promise<void>;
+    list(): Promise<readonly User[]>;
+}
+export declare function createUserStore(db: DatabaseHandle, now?: () => number): UserStore;
+//# sourceMappingURL=users.d.ts.map

package/dist/users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../src/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAEzF,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AA0BvD,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAC5C,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7D,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5D,IAAI,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;CACjC;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,SAAS,CAgE3F"}

package/dist/users.js

@@ -0,0 +1,69 @@
+import { CogentaError, identifier, newId, sql } from '@cogenta/core';
+import { TABLES } from './tables.js';
+function fromRow(row) {
+    return {
+        id: row.id,
+        email: row.email,
+        roles: JSON.parse(row.roles),
+        status: row.status,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}
+function normaliseEmail(email) {
+    return email.trim().toLowerCase();
+}
+export function createUserStore(db, now = Date.now) {
+    const table = identifier(TABLES.users, db.dialect);
+    return {
+        create: async (input) => {
+            const email = normaliseEmail(input.email);
+            const existing = await db.query(sql `select id from ${table} where email = ${email}`);
+            if (existing.rows.length > 0) {
+                throw new CogentaError({
+                    code: 'AUTH_USER_EXISTS',
+                    message: `A user with the email ${email} already exists.`,
+                    hint: 'Sign in with that account, or use a different email.',
+                });
+            }
+            const id = newId();
+            const timestamp = new Date(now()).toISOString();
+            await db.query(sql `
+        insert into ${table} (id, email, roles, status, created_at, updated_at)
+        values (${id}, ${email}, ${JSON.stringify(input.roles)}, ${'active'}, ${timestamp}, ${timestamp})`);
+            return {
+                id,
+                email,
+                roles: input.roles,
+                status: 'active',
+                createdAt: timestamp,
+                updatedAt: timestamp,
+            };
+        },
+        byEmail: async (email) => {
+            const result = await db.query(sql `select * from ${table} where email = ${normaliseEmail(email)}`);
+            const row = result.rows[0];
+            return row === undefined ? null : fromRow(row);
+        },
+        byId: async (id) => {
+            const result = await db.query(sql `select * from ${table} where id = ${id}`);
+            const row = result.rows[0];
+            return row === undefined ? null : fromRow(row);
+        },
+        setRoles: async (id, roles) => {
+            await db.query(sql `
+        update ${table} set roles = ${JSON.stringify(roles)}, updated_at = ${new Date(now()).toISOString()}
+        where id = ${id}`);
+        },
+        setStatus: async (id, status) => {
+            await db.query(sql `
+        update ${table} set status = ${status}, updated_at = ${new Date(now()).toISOString()}
+        where id = ${id}`);
+        },
+        list: async () => {
+            const result = await db.query(sql `select * from ${table} order by created_at asc`);
+            return result.rows.map(fromRow);
+        },
+    };
+}
+//# sourceMappingURL=users.js.map

package/dist/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../src/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAYpC,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAsB;QACjD,MAAM,EAAE,GAAG,CAAC,MAAwB;QACpC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;AACnC,CAAC;AAWD,MAAM,UAAU,eAAe,CAAC,EAAkB,EAAE,GAAG,GAAiB,IAAI,CAAC,GAAG;IAC9E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAElD,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAC7B,GAAG,CAAA,kBAAkB,KAAK,kBAAkB,KAAK,EAAE,CACpD,CAAA;YACD,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,yBAAyB,KAAK,kBAAkB;oBACzD,IAAI,EAAE,sDAAsD;iBAC7D,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;YAClB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK;kBACT,EAAE,KAAK,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,KAAK,SAAS,KAAK,SAAS,GAAG,CAAC,CAAA;YAErG,OAAO;gBACL,EAAE;gBACF,KAAK;gBACL,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,QAAQ;gBAChB,SAAS,EAAE,SAAS;gBACpB,SAAS,EAAE,SAAS;aACrB,CAAA;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,kBAAkB,cAAc,CAAC,KAAK,CAAC,EAAE,CACnE,CAAA;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;QAED,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACjB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAU,GAAG,CAAA,iBAAiB,KAAK,eAAe,EAAE,EAAE,CAAC,CAAA;YACpF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;QAED,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iBACP,KAAK,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;qBACrF,EAAE,EAAE,CAAC,CAAA;QACtB,CAAC;QAED,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;YAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iBACP,KAAK,iBAAiB,MAAM,kBAAkB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;qBACvE,EAAE,EAAE,CAAC,CAAA;QACtB,CAAC;QAED,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAU,GAAG,CAAA,iBAAiB,KAAK,0BAA0B,CAAC,CAAA;YAC3F,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;KACF,CAAA;AACH,CAAC"}