@crossfox/elysia-auth 0.1.0

package/LICENSE

@@ -0,0 +1,118 @@
+# PolyForm Noncommercial License 1.0.0
+
+<https://polyformproject.org/licenses/noncommercial/1.0.0>
+
+## Acceptance
+
+In order to get any license under these terms, you must agree to them as both
+strict conditions and as covenants.
+
+## Copyright License
+
+The licensor grants you a copyright license for the software to do everything
+you might do with the software that would otherwise infringe the licensor's
+copyright in it for any permitted purpose.  However, you may only distribute
+the software according to [Distribution License](#distribution-license) and
+make modifications or new works based on the software according to
+[Changes and New Works License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license to distribute copies
+of the software.  Your license to distribute covers distributing the software
+with changes and new works permitted by
+[Changes and New Works License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from
+you also gets a copy of these terms or the URL for them above, as well as
+copies of any plain-text lines beginning with `Required Notice:` that the
+licensor provided with the software.  For example:
+
+> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
+
+Required Notice: Copyright Oleksii Fursov (https://crossfox.online)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to make modifications
+and new works based on the software for any permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that covers patent
+claims the licensor can license, or becomes able to license, that you infringe
+by using the software.
+
+## Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for the benefit of public
+knowledge, personal study, private entertainment, hobby projects, amateur
+pursuits, or religious observance, without any anticipated commercial
+application, is use for a permitted purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution, public research
+organization, public safety or health organization, environmental protection
+organization, or government institution is use for a permitted purpose.
+Use by a for-profit organization, or for-profit activity by a nonprofit
+organization, is not use for a permitted purpose.  The licensor may make an
+exception for a specific organization in writing.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the law. These terms do
+not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of your licenses
+to anyone else, or prevent the licensor from granting licenses to anyone else.
+These terms do not imply any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or contributes to
+infringement of any patent, your patent license for the software granted under
+these terms ends immediately. If your company makes such a claim, your patent
+license ends immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have violated any of these
+terms, or done anything with the software that is not licensed, your license
+can nonetheless continue if you come into full compliance with these terms,
+and take practical steps to correct past violations, within 32 days of
+receiving notice.  Otherwise, all your licenses end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without any warranty
+or condition, and the licensor will not be liable to you for any damages
+arising out of these terms or the use or nature of the software, under any
+kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these terms, and the
+**software** is the software the licensor makes available under these terms.
+
+**You** refers to the individual or entity agreeing to these terms.
+
+**Your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
+**Control** means ownership of substantially all the assets of an entity, or
+the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**Use** means anything you do with the software requiring one of your licenses.

package/README.md

@@ -0,0 +1,78 @@
+# @crossfox/elysia-auth
+
+Auth for **Elysia** on Bun: **opaque** access/refresh tokens (hashed at rest), login, refresh rotation, password reset, OAuth (Google / Facebook / Instagram via Meta).
+
+Peers: `@crossfox/elysia-kit`, `elysia`.
+
+[![npm version](https://img.shields.io/npm/v/@crossfox/elysia-auth.svg)](https://www.npmjs.com/package/@crossfox/elysia-auth)
+
+## Install
+
+```bash
+bun add @crossfox/elysia-auth @crossfox/elysia-kit elysia
+```
+
+## Quick start
+
+```ts
+import { createApp } from "@crossfox/elysia-kit";
+import {
+  createAuth,
+  createMemoryAuthStore,
+  hashPassword,
+} from "@crossfox/elysia-auth";
+
+const store = createMemoryAuthStore();
+store.seedUser({
+  id: 1,
+  email: "me@example.com",
+  role: "user",
+  passwordHash: await hashPassword("secret-pass"),
+});
+
+const auth = createAuth({
+  baseUrl: "https://api.example.com",
+  users: store.users,
+  tokens: store.tokens,
+  resets: store.resets,
+  mailer: {
+    async sendPasswordReset({ to, resetUrl }) {
+      console.log("reset", to, resetUrl);
+    },
+  },
+  frontendResetUrl: "https://app.example.com/reset-password",
+  providers: {
+    google: {
+      clientId: Bun.env.GOOGLE_CLIENT_ID!,
+      clientSecret: Bun.env.GOOGLE_CLIENT_SECRET!,
+    },
+    facebook: { clientId: "...", clientSecret: "..." },
+    instagram: { clientId: "...", clientSecret: "..." }, // Meta app
+  },
+  bearer: true,
+  cookies: { enabled: true },
+});
+
+createApp({ plugins: [auth.plugin] });
+```
+
+### Routes
+
+| Method | Path | |
+|--------|------|--|
+| POST | `/auth/login` | `{ login, password }` → tokens |
+| POST | `/auth/refresh` | cookie/body refresh + CSRF header |
+| POST | `/auth/logout` | revoke refresh |
+| POST | `/auth/password/forgot` | `{ email }` |
+| POST | `/auth/password/reset` | `{ token, password }` |
+| GET | `/auth/google` … | OAuth start |
+| GET | `/auth/*/callback` | OAuth finish |
+
+Wire your own `UserAdapter` / `TokenAdapter` / `PasswordResetAdapter` (store `hashToken(token)` only).
+
+## License
+
+[PolyForm Noncommercial 1.0.0](https://polyformproject.org/licenses/noncommercial/1.0.0) —
+`Required Notice: Copyright Oleksii Fursov`.
+
+Commercial use: [nodepro777@gmail.com](mailto:nodepro777@gmail.com).

package/dist/adapters/memory.d.ts

@@ -0,0 +1,38 @@
+import { type AuthUser, type AuthUserWithPassword, type PasswordResetAdapter, type RefreshRecord, type TokenAdapter, type UserAdapter, type AuthTtlOptions } from "../types";
+interface AccessRow {
+    tokenHash: string;
+    userId: string | number;
+    expiresAt: Date;
+    user: AuthUser;
+}
+interface RefreshRow extends RefreshRecord {
+}
+interface ResetRow {
+    tokenHash: string;
+    userId: string | number;
+    expiresAt: Date;
+    used: boolean;
+}
+/** In-memory adapters для тестов / локальной разработки. */
+export declare function createMemoryAuthStore(opts?: {
+    ttl?: AuthTtlOptions;
+    users?: AuthUserWithPassword[];
+}): {
+    users: UserAdapter;
+    tokens: TokenAdapter;
+    resets: PasswordResetAdapter;
+    /** Для тестов: добавить юзера с уже готовым passwordHash. */
+    seedUser(user: AuthUserWithPassword): void;
+    _debug: {
+        accessStore: Map<string, AccessRow>;
+        refreshStore: Map<string, RefreshRow>;
+        resetStore: Map<string, ResetRow>;
+        users: Map<string, AuthUserWithPassword>;
+    };
+    ttl: {
+        accessTtlMs: number;
+        refreshTtlMs: number;
+        resetTtlMs: number;
+    };
+};
+export {};

package/dist/adapters/memory.js

@@ -0,0 +1,158 @@
+import { createOpaqueToken, hashToken, } from "../types";
+/** In-memory adapters для тестов / локальной разработки. */
+export function createMemoryAuthStore(opts = {}) {
+    const accessTtlMs = opts.ttl?.accessTtlMs ?? 15 * 60_000;
+    const refreshTtlMs = opts.ttl?.refreshTtlMs ?? 30 * 24 * 60 * 60_000;
+    const resetTtlMs = opts.ttl?.resetTtlMs ?? 60 * 60_000;
+    const users = new Map();
+    const byEmail = new Map();
+    const byLogin = new Map();
+    const oauth = new Map(); // provider:accountId → userId
+    for (const u of opts.users ?? []) {
+        const id = String(u.id);
+        users.set(id, u);
+        if (u.email) {
+            byEmail.set(u.email.toLowerCase(), id);
+            byLogin.set(u.email.toLowerCase(), id);
+        }
+    }
+    const accessStore = new Map();
+    const refreshStore = new Map();
+    const resetStore = new Map();
+    const userAdapter = {
+        async findByLogin(login) {
+            const id = byLogin.get(login.toLowerCase());
+            return id ? users.get(id) ?? null : null;
+        },
+        async findById(id) {
+            const u = users.get(String(id));
+            if (!u)
+                return null;
+            const { passwordHash: _, ...rest } = u;
+            return rest;
+        },
+        async findByEmail(email) {
+            const id = byEmail.get(email.toLowerCase());
+            if (!id)
+                return null;
+            const u = users.get(id);
+            const { passwordHash: _, ...rest } = u;
+            return rest;
+        },
+        async updatePassword(userId, passwordHash) {
+            const u = users.get(String(userId));
+            if (!u)
+                return;
+            u.passwordHash = passwordHash;
+        },
+        async findOrCreateFromOAuth(profile) {
+            const key = `${profile.provider}:${profile.providerAccountId}`;
+            const existing = oauth.get(key);
+            if (existing) {
+                const u = users.get(existing);
+                const { passwordHash: _, ...rest } = u;
+                return rest;
+            }
+            const id = `oauth_${users.size + 1}`;
+            const user = {
+                id,
+                email: profile.email ?? null,
+                name: profile.name ?? null,
+                role: "user",
+                passwordHash: "",
+            };
+            users.set(id, user);
+            oauth.set(key, id);
+            if (user.email) {
+                byEmail.set(user.email.toLowerCase(), id);
+                byLogin.set(user.email.toLowerCase(), id);
+            }
+            const { passwordHash: _, ...rest } = user;
+            return rest;
+        },
+    };
+    function issue(type, user, ttl) {
+        const token = createOpaqueToken(type === "access" ? "at" : "rt");
+        const tokenHash = hashToken(token);
+        const expiresAt = new Date(Date.now() + ttl);
+        if (type === "access") {
+            accessStore.set(tokenHash, { tokenHash, userId: user.id, expiresAt, user });
+        }
+        else {
+            refreshStore.set(tokenHash, {
+                tokenHash,
+                userId: user.id,
+                expiresAt,
+                revoked: false,
+                role: user.role,
+            });
+        }
+        return { token, tokenHash, expiresAt };
+    }
+    const tokenAdapter = {
+        async issueTokens(user, _meta) {
+            return {
+                access: issue("access", user, accessTtlMs),
+                refresh: issue("refresh", user, refreshTtlMs),
+            };
+        },
+        async verifyAccessToken(token, meta) {
+            const row = accessStore.get(meta.tokenHash || hashToken(token));
+            if (!row)
+                return null;
+            if (row.expiresAt.getTime() <= Date.now()) {
+                accessStore.delete(row.tokenHash);
+                return null;
+            }
+            return row.user;
+        },
+        async findRefresh(tokenHash) {
+            return refreshStore.get(tokenHash) ?? null;
+        },
+        async revokeRefresh(tokenHash) {
+            const row = refreshStore.get(tokenHash);
+            if (row)
+                row.revoked = true;
+        },
+        async revokeAllForUser(userId) {
+            for (const row of refreshStore.values()) {
+                if (String(row.userId) === String(userId))
+                    row.revoked = true;
+            }
+            for (const [k, row] of accessStore) {
+                if (String(row.userId) === String(userId))
+                    accessStore.delete(k);
+            }
+        },
+    };
+    const resetAdapter = {
+        async create(userId, tokenHash, expiresAt) {
+            resetStore.set(tokenHash, { tokenHash, userId, expiresAt, used: false });
+        },
+        async consume(tokenHash) {
+            const row = resetStore.get(tokenHash);
+            if (!row || row.used)
+                return null;
+            if (row.expiresAt.getTime() <= Date.now())
+                return null;
+            row.used = true;
+            return { userId: row.userId };
+        },
+    };
+    return {
+        users: userAdapter,
+        tokens: tokenAdapter,
+        resets: resetAdapter,
+        /** Для тестов: добавить юзера с уже готовым passwordHash. */
+        seedUser(user) {
+            const id = String(user.id);
+            users.set(id, user);
+            if (user.email) {
+                byEmail.set(user.email.toLowerCase(), id);
+                byLogin.set(user.email.toLowerCase(), id);
+            }
+        },
+        _debug: { accessStore, refreshStore, resetStore, users },
+        ttl: { accessTtlMs, refreshTtlMs, resetTtlMs },
+    };
+}

package/dist/cookies.d.ts

@@ -0,0 +1,21 @@
+import type { AuthCookieOptions, IssuedTokenPair } from "./types";
+export declare const REFRESH_COOKIE = "refresh_token";
+export declare const ACCESS_COOKIE = "access_token";
+export declare const CSRF_COOKIE = "csrf_token";
+export declare const CSRF_HEADER = "x-csrf-token";
+export declare function cookieBase(opts: AuthCookieOptions | undefined, maxAge: number): {
+    httpOnly: boolean;
+    path: string;
+    sameSite: "strict" | "lax" | "none";
+    secure: boolean;
+    domain: string | undefined;
+    maxAge: number;
+};
+export declare function applyAuthCookies(cookie: Record<string, {
+    set: (v: unknown, o?: object) => void;
+    remove?: () => void;
+}>, opts: AuthCookieOptions | undefined, pair: IssuedTokenPair, csrf: string): void;
+export declare function clearAuthCookies(cookie: Record<string, {
+    set: (v: unknown, o?: object) => void;
+    remove?: () => void;
+}>, opts: AuthCookieOptions | undefined): void;

package/dist/cookies.js

@@ -0,0 +1,34 @@
+export const REFRESH_COOKIE = "refresh_token";
+export const ACCESS_COOKIE = "access_token";
+export const CSRF_COOKIE = "csrf_token";
+export const CSRF_HEADER = "x-csrf-token";
+export function cookieBase(opts, maxAge) {
+    return {
+        httpOnly: true,
+        path: opts?.path ?? "/",
+        sameSite: opts?.sameSite ?? "lax",
+        secure: opts?.secure ?? process.env.NODE_ENV === "production",
+        domain: opts?.domain,
+        maxAge,
+    };
+}
+export function applyAuthCookies(cookie, opts, pair, csrf) {
+    const accessName = opts?.accessName ?? ACCESS_COOKIE;
+    const refreshName = opts?.refreshName ?? REFRESH_COOKIE;
+    const csrfName = opts?.csrfName ?? CSRF_COOKIE;
+    const accessMax = Math.max(60, Math.floor((pair.access.expiresAt.getTime() - Date.now()) / 1000));
+    const refreshMax = Math.max(60, Math.floor((pair.refresh.expiresAt.getTime() - Date.now()) / 1000));
+    cookie[accessName]?.set(pair.access.token, cookieBase(opts, accessMax));
+    cookie[refreshName]?.set(pair.refresh.token, cookieBase(opts, refreshMax));
+    // CSRF readable by JS for double-submit
+    cookie[csrfName]?.set(csrf, { ...cookieBase(opts, refreshMax), httpOnly: false });
+}
+export function clearAuthCookies(cookie, opts) {
+    const accessName = opts?.accessName ?? ACCESS_COOKIE;
+    const refreshName = opts?.refreshName ?? REFRESH_COOKIE;
+    const csrfName = opts?.csrfName ?? CSRF_COOKIE;
+    const empty = cookieBase(opts, 0);
+    cookie[accessName]?.set("", empty);
+    cookie[refreshName]?.set("", empty);
+    cookie[csrfName]?.set("", { ...empty, httpOnly: false });
+}

package/dist/createAuth.d.ts

@@ -0,0 +1,29 @@
+import { Elysia } from "elysia";
+import { AuthService, type AuthServiceOptions } from "./service";
+import type { AuthCookieOptions, AuthProviderId, OAuthProviderCredentials } from "./types";
+export interface CreateAuthOptions extends AuthServiceOptions {
+    baseUrl: string;
+    prefix?: string;
+    cookies?: AuthCookieOptions;
+    /** Bearer verify на все роуты кроме isPublic. */
+    bearer?: boolean;
+    /** CSRF double-submit для refresh (default true если cookies). */
+    csrf?: boolean;
+    providers?: {
+        google?: OAuthProviderCredentials;
+        facebook?: OAuthProviderCredentials;
+        instagram?: OAuthProviderCredentials;
+    };
+    oauthResponseMode?: "json" | "redirect" | "cookies";
+    successRedirect?: string;
+    failureRedirect?: string;
+}
+export interface AuthInstance {
+    service: AuthService;
+    plugin: Elysia;
+    providers: AuthProviderId[];
+}
+/**
+ * Полный auth: login / refresh / logout / password reset / OAuth + Bearer.
+ */
+export declare function createAuth(opts: CreateAuthOptions): AuthInstance;

package/dist/createAuth.js

@@ -0,0 +1,199 @@
+import { Elysia } from "elysia";
+import { generateCodeVerifier, generateState } from "arctic";
+import { clientIp, error, hashToken, routeMacros, storage, } from "@crossfox/elysia-kit";
+import { AuthService } from "./service";
+import { applyAuthCookies, clearAuthCookies, cookieBase, CSRF_COOKIE, CSRF_HEADER, REFRESH_COOKIE, } from "./cookies";
+import { buildFacebook, buildGoogle, buildInstagram, } from "./oauth/providers";
+const STATE_COOKIE = "oauth_state";
+const PKCE_COOKIE = "oauth_pkce";
+function joinUrl(base, path) {
+    return `${base.replace(/\/$/, "")}${path.startsWith("/") ? path : `/${path}`}`;
+}
+/**
+ * Полный auth: login / refresh / logout / password reset / OAuth + Bearer.
+ */
+export function createAuth(opts) {
+    const service = new AuthService(opts);
+    const prefix = opts.prefix ?? "/auth";
+    const baseUrl = opts.baseUrl.replace(/\/$/, "");
+    const cookiesCfg = opts.cookies ?? { enabled: true };
+    const useCsrf = opts.csrf ?? Boolean(cookiesCfg.enabled !== false);
+    const oauthMode = opts.oauthResponseMode ?? "json";
+    const clients = new Map();
+    const register = (id, build, creds) => {
+        if (!creds)
+            return;
+        const redirectUri = creds.redirectUri ?? joinUrl(baseUrl, `${prefix}/${id}/callback`);
+        clients.set(id, build(redirectUri));
+    };
+    register("google", (u) => buildGoogle(opts.providers.google, u), opts.providers?.google);
+    register("facebook", (u) => buildFacebook(opts.providers.facebook, u), opts.providers?.facebook);
+    register("instagram", (u) => buildInstagram(opts.providers.instagram, u), opts.providers?.instagram);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    let plugin = new Elysia({ name: "crossfox-elysia-auth" }).use(routeMacros);
+    if (opts.bearer !== false) {
+        plugin = plugin
+            .derive({ as: "global" }, async ({ request, server }) => {
+            const meta = storage.getStore() ?? {
+                userAgent: request.headers.get("user-agent") ?? null,
+                ip: null,
+                url: request.url ?? null,
+            };
+            meta.ip = clientIp(request, server);
+            return { meta };
+        })
+            .onBeforeHandle({ as: "global" }, async (context) => {
+            const c = context;
+            c.meta.method = c.request.method ?? null;
+            c.meta.route = c.route ?? null;
+            if (c.skipAuthVerify === true) {
+                c.auth = null;
+                return;
+            }
+            const header = c.headers.authorization ?? c.request.headers.get("authorization") ?? "";
+            const m = /^Bearer\s+(.+)$/i.exec(header);
+            if (!m?.[1])
+                error(401, "Unauthorized");
+            const raw = m[1].trim();
+            c.meta.tokenHash = hashToken(raw);
+            const user = await service.verifyAccess(raw, {
+                ip: c.meta.ip ?? null,
+                userAgent: c.meta.userAgent ?? null,
+            });
+            c.auth = user;
+            c.meta.userId = typeof user.id === "number" ? user.id : Number(user.id) || undefined;
+            c.meta.role = user.role;
+        });
+    }
+    const metaFrom = (request, server) => ({
+        ip: clientIp(request, server),
+        userAgent: request.headers.get("user-agent"),
+    });
+    plugin = plugin
+        .post(`${prefix}/login`, async ({ body, request, server, cookie }) => {
+        const login = String(body?.login ?? body?.email ?? "");
+        const password = String(body?.password ?? "");
+        const { user, tokens } = await service.login(login, password, metaFrom(request, server));
+        const csrf = service.issueCsrfToken();
+        if (cookiesCfg.enabled !== false) {
+            applyAuthCookies(cookie, cookiesCfg, tokens, csrf);
+        }
+        return {
+            ok: true,
+            user,
+            access_token: tokens.access.token,
+            refresh_token: tokens.refresh.token,
+            expires_at: tokens.access.expiresAt.toISOString(),
+            csrf_token: csrf,
+        };
+    }, { isPublic: true })
+        .post(`${prefix}/refresh`, async ({ body, request, server, cookie, headers }) => {
+        const fromCookie = cookie[cookiesCfg.refreshName ?? REFRESH_COOKIE]?.value;
+        const refreshToken = String(body?.refresh_token ?? fromCookie ?? "");
+        if (!refreshToken)
+            error(401, "Missing refresh token");
+        if (useCsrf && cookiesCfg.enabled !== false) {
+            const csrfCookie = String(cookie[cookiesCfg.csrfName ?? CSRF_COOKIE]?.value ?? "");
+            const csrfHeader = String(headers[CSRF_HEADER] ?? request.headers.get(CSRF_HEADER) ?? "");
+            if (!csrfCookie || !csrfHeader || csrfCookie !== csrfHeader) {
+                error(403, "Invalid CSRF token");
+            }
+        }
+        const { user, tokens } = await service.refresh(refreshToken, metaFrom(request, server));
+        const csrf = useCsrf
+            ? String(cookie[cookiesCfg.csrfName ?? CSRF_COOKIE]?.value ?? "") || service.issueCsrfToken()
+            : service.issueCsrfToken();
+        if (cookiesCfg.enabled !== false) {
+            applyAuthCookies(cookie, cookiesCfg, tokens, csrf);
+        }
+        return {
+            ok: true,
+            user,
+            access_token: tokens.access.token,
+            refresh_token: tokens.refresh.token,
+            expires_at: tokens.access.expiresAt.toISOString(),
+            csrf_token: csrf,
+        };
+    }, { isPublic: true })
+        .post(`${prefix}/logout`, async ({ body, cookie }) => {
+        const fromCookie = cookie[cookiesCfg.refreshName ?? REFRESH_COOKIE]?.value;
+        await service.logout(String(body?.refresh_token ?? fromCookie ?? "") || null);
+        clearAuthCookies(cookie, cookiesCfg);
+        return { ok: true };
+    }, { isPublic: true })
+        .post(`${prefix}/password/forgot`, async ({ body }) => {
+        const email = String(body?.email ?? "");
+        return service.requestPasswordReset(email);
+    }, { isPublic: true })
+        .post(`${prefix}/password/reset`, async ({ body }) => {
+        return service.resetPassword(String(body?.token ?? ""), String(body?.password ?? ""));
+    }, { isPublic: true });
+    for (const [id, client] of clients) {
+        plugin = plugin
+            .get(`${prefix}/${id}`, ({ cookie, redirect, set }) => {
+            const state = generateState();
+            cookie[STATE_COOKIE].set(state, cookieBase(cookiesCfg, 600));
+            let codeVerifier = null;
+            if (client.usesPkce) {
+                codeVerifier = generateCodeVerifier();
+                cookie[PKCE_COOKIE].set(codeVerifier, cookieBase(cookiesCfg, 600));
+            }
+            const url = client.createAuthorizationURL(state, codeVerifier);
+            set.redirect = url.toString();
+            return redirect(url.toString());
+        }, { isPublic: true })
+            .get(`${prefix}/${id}/callback`, async ({ query, cookie, request, server, redirect, set }) => {
+            try {
+                const code = String(query.code ?? "");
+                const state = String(query.state ?? "");
+                const storedState = cookie[STATE_COOKIE]?.value;
+                const codeVerifier = client.usesPkce
+                    ? String(cookie[PKCE_COOKIE]?.value ?? "")
+                    : null;
+                cookie[STATE_COOKIE]?.remove?.();
+                cookie[PKCE_COOKIE]?.remove?.();
+                if (!code || !state || !storedState || state !== storedState) {
+                    error(400, "Invalid OAuth state");
+                }
+                const providerAccess = await client.validateAuthorizationCode(code, client.usesPkce ? codeVerifier : null);
+                const profile = await client.fetchProfile(providerAccess);
+                const { user, tokens } = await service.loginWithOAuth(profile, metaFrom(request, server));
+                const csrf = service.issueCsrfToken();
+                if (cookiesCfg.enabled !== false || oauthMode === "cookies") {
+                    applyAuthCookies(cookie, cookiesCfg, tokens, csrf);
+                }
+                if (oauthMode === "redirect") {
+                    if (!opts.successRedirect)
+                        error(500, "successRedirect required");
+                    const u = new URL(opts.successRedirect, baseUrl);
+                    u.searchParams.set("access_token", tokens.access.token);
+                    set.redirect = u.toString();
+                    return redirect(u.toString());
+                }
+                if (oauthMode === "cookies") {
+                    return { ok: true, user, csrf_token: csrf };
+                }
+                return {
+                    ok: true,
+                    user,
+                    access_token: tokens.access.token,
+                    refresh_token: tokens.refresh.token,
+                    expires_at: tokens.access.expiresAt.toISOString(),
+                    csrf_token: csrf,
+                };
+            }
+            catch (e) {
+                if (opts.failureRedirect) {
+                    set.redirect = opts.failureRedirect;
+                    return redirect(opts.failureRedirect);
+                }
+                throw e;
+            }
+        }, { isPublic: true });
+    }
+    return {
+        service,
+        plugin: plugin,
+        providers: [...clients.keys()],
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { createAuth, type CreateAuthOptions, type AuthInstance } from "./createAuth";
+export { AuthService, type AuthServiceOptions } from "./service";
+export { createMemoryAuthStore } from "./adapters/memory";
+export { REFRESH_COOKIE, ACCESS_COOKIE, CSRF_COOKIE, CSRF_HEADER, applyAuthCookies, clearAuthCookies, } from "./cookies";
+export type { AuthProviderId, AuthUser, AuthUserWithPassword, OAuthProfile, UserAdapter, TokenAdapter, PasswordResetAdapter, Mailer, IssuedToken, IssuedTokenPair, RefreshRecord, RequestMetaLite, OAuthProviderCredentials, AuthCookieOptions, AuthTtlOptions, } from "./types";
+export { createOpaqueToken, hashToken, hashPassword, verifyPassword, } from "./types";

package/dist/index.js

@@ -0,0 +1,5 @@
+export { createAuth } from "./createAuth";
+export { AuthService } from "./service";
+export { createMemoryAuthStore } from "./adapters/memory";
+export { REFRESH_COOKIE, ACCESS_COOKIE, CSRF_COOKIE, CSRF_HEADER, applyAuthCookies, clearAuthCookies, } from "./cookies";
+export { createOpaqueToken, hashToken, hashPassword, verifyPassword, } from "./types";

package/dist/oauth/providers.d.ts

@@ -0,0 +1,14 @@
+import * as arctic from "arctic";
+import type { AuthProviderId, OAuthProfile, OAuthProviderCredentials } from "../types";
+export interface ProviderClient {
+    id: AuthProviderId;
+    usesPkce: boolean;
+    createAuthorizationURL(state: string, codeVerifier: string | null): URL;
+    validateAuthorizationCode(code: string, codeVerifier: string | null): Promise<string>;
+    fetchProfile(accessToken: string): Promise<OAuthProfile>;
+}
+export declare function buildGoogle(creds: OAuthProviderCredentials, redirectUri: string): ProviderClient;
+export declare function buildFacebook(creds: OAuthProviderCredentials, redirectUri: string, providerId?: AuthProviderId): ProviderClient;
+/** Instagram через Meta App (Facebook Login + Graph). */
+export declare function buildInstagram(creds: OAuthProviderCredentials, redirectUri: string): ProviderClient;
+export { arctic };

package/dist/oauth/providers.js

@@ -0,0 +1,118 @@
+import * as arctic from "arctic";
+function requireCreds(id, c) {
+    if (!c?.clientId || !c?.clientSecret) {
+        throw new Error(`@crossfox/elysia-auth: provider "${id}" missing clientId/clientSecret`);
+    }
+    return c;
+}
+export function buildGoogle(creds, redirectUri) {
+    const c = requireCreds("google", creds);
+    const google = new arctic.Google(c.clientId, c.clientSecret, redirectUri);
+    const scopes = c.scopes ?? ["openid", "profile", "email"];
+    return {
+        id: "google",
+        usesPkce: true,
+        createAuthorizationURL(state, codeVerifier) {
+            if (!codeVerifier)
+                throw new Error("google requires PKCE code_verifier");
+            return google.createAuthorizationURL(state, codeVerifier, scopes);
+        },
+        async validateAuthorizationCode(code, codeVerifier) {
+            if (!codeVerifier)
+                throw new Error("google requires PKCE code_verifier");
+            const tokens = await google.validateAuthorizationCode(code, codeVerifier);
+            return tokens.accessToken();
+        },
+        async fetchProfile(accessToken) {
+            const res = await fetch("https://openidconnect.googleapis.com/v1/userinfo", {
+                headers: { Authorization: `Bearer ${accessToken}` },
+            });
+            if (!res.ok)
+                throw new Error(`Google userinfo failed: ${res.status}`);
+            const u = (await res.json());
+            return {
+                provider: "google",
+                providerAccountId: String(u.sub),
+                email: u.email ?? null,
+                name: u.name ?? null,
+                avatarUrl: u.picture ?? null,
+                raw: u,
+            };
+        },
+    };
+}
+export function buildFacebook(creds, redirectUri, providerId = "facebook") {
+    const c = requireCreds(providerId, creds);
+    const facebook = new arctic.Facebook(c.clientId, c.clientSecret, redirectUri);
+    const scopes = c.scopes ?? ["email", "public_profile"];
+    return {
+        id: providerId,
+        usesPkce: false,
+        createAuthorizationURL(state) {
+            return facebook.createAuthorizationURL(state, scopes);
+        },
+        async validateAuthorizationCode(code) {
+            const tokens = await facebook.validateAuthorizationCode(code);
+            return tokens.accessToken();
+        },
+        async fetchProfile(accessToken) {
+            const params = new URLSearchParams({
+                access_token: accessToken,
+                fields: "id,name,email,picture.type(large)",
+            });
+            const res = await fetch(`https://graph.facebook.com/me?${params}`);
+            if (!res.ok)
+                throw new Error(`Facebook /me failed: ${res.status}`);
+            const u = (await res.json());
+            return {
+                provider: providerId,
+                providerAccountId: String(u.id),
+                email: u.email ?? null,
+                name: u.name ?? null,
+                avatarUrl: u.picture?.data?.url ?? null,
+                raw: u,
+            };
+        },
+    };
+}
+/** Instagram через Meta App (Facebook Login + Graph). */
+export function buildInstagram(creds, redirectUri) {
+    const c = requireCreds("instagram", creds);
+    const scopes = c.scopes ?? ["email", "public_profile"];
+    const base = buildFacebook({ ...c, scopes }, redirectUri, "instagram");
+    return {
+        ...base,
+        async fetchProfile(accessToken) {
+            try {
+                const pagesRes = await fetch(`https://graph.facebook.com/v21.0/me/accounts?access_token=${encodeURIComponent(accessToken)}`);
+                if (pagesRes.ok) {
+                    const pages = (await pagesRes.json());
+                    const page = pages.data?.[0];
+                    if (page?.id) {
+                        const igRes = await fetch(`https://graph.facebook.com/v21.0/${page.id}?fields=instagram_business_account{id,username,profile_picture_url}&access_token=${encodeURIComponent(page.access_token ?? accessToken)}`);
+                        if (igRes.ok) {
+                            const ig = (await igRes.json());
+                            const acc = ig.instagram_business_account;
+                            if (acc?.id) {
+                                return {
+                                    provider: "instagram",
+                                    providerAccountId: String(acc.id),
+                                    email: null,
+                                    name: acc.username ?? null,
+                                    avatarUrl: acc.profile_picture_url ?? null,
+                                    raw: ig,
+                                };
+                            }
+                        }
+                    }
+                }
+            }
+            catch {
+                /* fall through */
+            }
+            const fb = await base.fetchProfile(accessToken);
+            return { ...fb, provider: "instagram" };
+        },
+    };
+}
+export { arctic };

package/dist/service.d.ts

@@ -0,0 +1,49 @@
+import { type AuthUser, type IssuedTokenPair, type Mailer, type OAuthProfile, type PasswordResetAdapter, type RequestMetaLite, type TokenAdapter, type UserAdapter, type AuthTtlOptions } from "./types";
+export interface AuthServiceOptions {
+    users: UserAdapter;
+    tokens: TokenAdapter;
+    resets?: PasswordResetAdapter;
+    mailer?: Mailer;
+    ttl?: AuthTtlOptions;
+    /**
+     * Базовый URL фронта для ссылки сброса:
+     * `{frontendResetUrl}?token=...`
+     */
+    frontendResetUrl?: string;
+}
+export declare class AuthService {
+    readonly users: UserAdapter;
+    readonly tokens: TokenAdapter;
+    readonly resets?: PasswordResetAdapter;
+    readonly mailer?: Mailer;
+    readonly ttl: Required<AuthTtlOptions>;
+    readonly frontendResetUrl?: string;
+    constructor(opts: AuthServiceOptions);
+    issueCsrfToken(): string;
+    /** Login + password → user + opaque token pair. */
+    login(login: string, password: string, meta: RequestMetaLite): Promise<{
+        user: AuthUser;
+        tokens: IssuedTokenPair;
+    }>;
+    /**
+     * Ротация refresh: старый revoke → новая пара.
+     * При reuse отозванного — revokeAllForUser (если реализовано) + 401.
+     */
+    refresh(refreshToken: string, meta: RequestMetaLite): Promise<{
+        user: AuthUser;
+        tokens: IssuedTokenPair;
+    }>;
+    logout(refreshToken: string | null | undefined): Promise<void>;
+    verifyAccess(accessToken: string, meta: RequestMetaLite): Promise<AuthUser>;
+    /** Всегда 200 — не светим, есть ли email. */
+    requestPasswordReset(email: string): Promise<{
+        ok: true;
+    }>;
+    resetPassword(token: string, newPassword: string): Promise<{
+        ok: true;
+    }>;
+    loginWithOAuth(profile: OAuthProfile, meta: RequestMetaLite): Promise<{
+        user: AuthUser;
+        tokens: IssuedTokenPair;
+    }>;
+}

package/dist/service.js

@@ -0,0 +1,121 @@
+import { createOpaqueToken, hashToken, hashPassword, verifyPassword, } from "./types";
+import { error } from "@crossfox/elysia-kit";
+export class AuthService {
+    users;
+    tokens;
+    resets;
+    mailer;
+    ttl;
+    frontendResetUrl;
+    constructor(opts) {
+        this.users = opts.users;
+        this.tokens = opts.tokens;
+        this.resets = opts.resets;
+        this.mailer = opts.mailer;
+        this.frontendResetUrl = opts.frontendResetUrl;
+        this.ttl = {
+            accessTtlMs: opts.ttl?.accessTtlMs ?? 15 * 60_000,
+            refreshTtlMs: opts.ttl?.refreshTtlMs ?? 30 * 24 * 60 * 60_000,
+            resetTtlMs: opts.ttl?.resetTtlMs ?? 60 * 60_000,
+        };
+    }
+    issueCsrfToken() {
+        return createOpaqueToken("csrf");
+    }
+    /** Login + password → user + opaque token pair. */
+    async login(login, password, meta) {
+        const row = await this.users.findByLogin(login.trim().toLowerCase());
+        if (!row)
+            error(401, "Login or password is incorrect");
+        const ok = await verifyPassword(password, row.passwordHash);
+        if (!ok)
+            error(401, "Login or password is incorrect");
+        const { passwordHash: _, ...user } = row;
+        const tokens = await this.tokens.issueTokens(user, meta);
+        return { user, tokens };
+    }
+    /**
+     * Ротация refresh: старый revoke → новая пара.
+     * При reuse отозванного — revokeAllForUser (если реализовано) + 401.
+     */
+    async refresh(refreshToken, meta) {
+        const tokenHash = hashToken(refreshToken);
+        const row = await this.tokens.findRefresh(tokenHash);
+        if (!row)
+            error(401, "Invalid refresh token");
+        if (row.revoked) {
+            await this.tokens.revokeAllForUser?.(row.userId);
+            error(401, "Refresh token revoked");
+        }
+        if (row.expiresAt.getTime() <= Date.now()) {
+            await this.tokens.revokeRefresh(tokenHash);
+            error(401, "Refresh token expired");
+        }
+        const user = await this.users.findById(row.userId);
+        if (!user)
+            error(401, "User not found");
+        await this.tokens.revokeRefresh(tokenHash);
+        const tokens = await this.tokens.issueTokens(user, meta);
+        return { user, tokens };
+    }
+    async logout(refreshToken) {
+        if (!refreshToken)
+            return;
+        await this.tokens.revokeRefresh(hashToken(refreshToken));
+    }
+    async verifyAccess(accessToken, meta) {
+        const tokenHash = hashToken(accessToken);
+        const user = await this.tokens.verifyAccessToken(accessToken, {
+            ...meta,
+            tokenHash,
+        });
+        if (!user)
+            error(401, "Unauthorized");
+        return user;
+    }
+    /** Всегда 200 — не светим, есть ли email. */
+    async requestPasswordReset(email) {
+        if (!this.resets || !this.mailer || !this.frontendResetUrl) {
+            error(500, "Password reset is not configured");
+        }
+        const normalized = email.trim().toLowerCase();
+        const user = await this.users.findByEmail(normalized);
+        if (user) {
+            const token = createOpaqueToken("rp");
+            const tokenHash = hashToken(token);
+            const expiresAt = new Date(Date.now() + this.ttl.resetTtlMs);
+            await this.resets.create(user.id, tokenHash, expiresAt);
+            const url = new URL(this.frontendResetUrl);
+            url.searchParams.set("token", token);
+            await this.mailer.sendPasswordReset({
+                to: normalized,
+                user,
+                token,
+                resetUrl: url.toString(),
+            });
+        }
+        return { ok: true };
+    }
+    async resetPassword(token, newPassword) {
+        if (!this.resets)
+            error(500, "Password reset is not configured");
+        if (!newPassword || newPassword.length < 8) {
+            error(422, "Password must be at least 8 characters");
+        }
+        const consumed = await this.resets.consume(hashToken(token));
+        if (!consumed)
+            error(400, "Invalid or expired reset token");
+        const passwordHash = await hashPassword(newPassword);
+        await this.users.updatePassword(consumed.userId, passwordHash);
+        await this.tokens.revokeAllForUser?.(consumed.userId);
+        return { ok: true };
+    }
+    async loginWithOAuth(profile, meta) {
+        if (!this.users.findOrCreateFromOAuth) {
+            error(500, "OAuth user adapter is not configured");
+        }
+        const user = await this.users.findOrCreateFromOAuth(profile);
+        const tokens = await this.tokens.issueTokens(user, meta);
+        return { user, tokens };
+    }
+}

package/dist/types.d.ts

@@ -0,0 +1,99 @@
+import { createOpaqueToken, hashToken, hashPassword, verifyPassword } from "@crossfox/elysia-kit";
+export type AuthProviderId = "google" | "facebook" | "instagram" | (string & {});
+export interface AuthUser {
+    id: string | number;
+    email?: string | null;
+    name?: string | null;
+    role?: string;
+    [key: string]: unknown;
+}
+export interface AuthUserWithPassword extends AuthUser {
+    /** Bun.password / argon2 / bcrypt hash */
+    passwordHash: string;
+}
+export interface OAuthProfile {
+    provider: AuthProviderId;
+    providerAccountId: string;
+    email?: string | null;
+    name?: string | null;
+    avatarUrl?: string | null;
+    raw?: unknown;
+}
+export interface RequestMetaLite {
+    ip: string | null;
+    userAgent: string | null;
+}
+export interface IssuedToken {
+    token: string;
+    tokenHash: string;
+    expiresAt: Date;
+}
+export interface IssuedTokenPair {
+    access: IssuedToken;
+    refresh: IssuedToken;
+}
+export interface RefreshRecord {
+    userId: string | number;
+    tokenHash: string;
+    expiresAt: Date;
+    revoked: boolean;
+    role?: string;
+}
+/** Пользователи + пароли + OAuth upsert. */
+export interface UserAdapter {
+    findByLogin(login: string): Promise<AuthUserWithPassword | null>;
+    findById(id: string | number): Promise<AuthUser | null>;
+    findByEmail(email: string): Promise<AuthUser | null>;
+    updatePassword(userId: string | number, passwordHash: string): Promise<void>;
+    findOrCreateFromOAuth?(profile: OAuthProfile): Promise<AuthUser>;
+}
+/** Opaque access/refresh — в БД только hash. */
+export interface TokenAdapter {
+    issueTokens(user: AuthUser, meta: RequestMetaLite): Promise<IssuedTokenPair>;
+    verifyAccessToken(token: string, meta: RequestMetaLite & {
+        tokenHash: string;
+    }): Promise<AuthUser | null>;
+    findRefresh(tokenHash: string): Promise<RefreshRecord | null>;
+    /** Пометить refresh отозванным (после logout / rotation / reuse). */
+    revokeRefresh(tokenHash: string): Promise<void>;
+    revokeAllForUser?(userId: string | number): Promise<void>;
+}
+/** Одноразовые токены сброса пароля (храните hash). */
+export interface PasswordResetAdapter {
+    create(userId: string | number, tokenHash: string, expiresAt: Date): Promise<void>;
+    /** Вернуть userId и инвалидировать токен; null если нет/истёк. */
+    consume(tokenHash: string): Promise<{
+        userId: string | number;
+    } | null>;
+}
+export interface Mailer {
+    sendPasswordReset(input: {
+        to: string;
+        user: AuthUser;
+        /** Сырой токен — только в письме, не в БД. */
+        token: string;
+        resetUrl: string;
+    }): Promise<void>;
+}
+export interface OAuthProviderCredentials {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[];
+    redirectUri?: string;
+}
+export interface AuthCookieOptions {
+    enabled?: boolean;
+    accessName?: string;
+    refreshName?: string;
+    csrfName?: string;
+    secure?: boolean;
+    sameSite?: "strict" | "lax" | "none";
+    path?: string;
+    domain?: string;
+}
+export interface AuthTtlOptions {
+    accessTtlMs?: number;
+    refreshTtlMs?: number;
+    resetTtlMs?: number;
+}
+export { createOpaqueToken, hashToken, hashPassword, verifyPassword, };

package/dist/types.js

@@ -0,0 +1,2 @@
+import { createOpaqueToken, hashToken, hashPassword, verifyPassword, } from "@crossfox/elysia-kit";
+export { createOpaqueToken, hashToken, hashPassword, verifyPassword, };

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@crossfox/elysia-auth",
+  "version": "0.1.0",
+  "description": "Elysia auth: opaque access/refresh tokens, login, password reset, OAuth (Google/Facebook/Instagram). Adapter-based.",
+  "license": "PolyForm-Noncommercial-1.0.0",
+  "author": "Oleksii Fursov <nodepro777@gmail.com>",
+  "homepage": "https://crossfox.online",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/OleksiiFursov/packages.git",
+    "directory": "elysia-auth"
+  },
+  "bugs": {
+    "url": "https://github.com/OleksiiFursov/packages/issues",
+    "email": "nodepro777@gmail.com"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "bun": ">=1.1.0"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": ["dist", "README.md", "LICENSE"],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "bun test",
+    "check": "bun run typecheck && bun test",
+    "prepublishOnly": "bun run check && bun run build"
+  },
+  "dependencies": {
+    "arctic": "^3.7.0"
+  },
+  "peerDependencies": {
+    "@crossfox/elysia-kit": ">=0.1.0",
+    "elysia": ">=1.4"
+  },
+  "devDependencies": {
+    "@crossfox/elysia-kit": "workspace:*",
+    "@types/bun": "^1.3.14",
+    "elysia": "^1.4.28",
+    "typescript": "6.0.3"
+  },
+  "keywords": [
+    "elysia",
+    "auth",
+    "oauth",
+    "refresh-token",
+    "opaque-token",
+    "password-reset",
+    "google",
+    "facebook",
+    "instagram",
+    "bun",
+    "crossfox"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}