@dbx-tools/auth 0.6.163 → 0.6.167

package/README.md

@@ -1,50 +1,38 @@
-# `@dbx-tools/auth`
+# @dbx-tools/auth
 
-Passwordless authentication runtime built on Better Auth, email OTP, passkeys,
-and caller-provided identity policy and delivery.
-
-Key features:
-
-- Better Auth ownership of users, sessions, OTP lifecycle, rate limits, and
-  passkey credentials;
-- session-required passkey enrollment and discoverable passkey login;
-- POST and browser-redirect logout routes with a same-origin destination;
-- caller-provided `authorizeIdentity`, email sender, secret, origin, and
-  database;
-- native AppKit Lakebase pool or local SQLite storage;
-- programmatic Better Auth migrations under advisory or file locks.
-
-## Relationship To Native AppKit
-
-Use the Databricks Apps front door and AppKit execution context when traffic
-arrives through the platform. Use this package for a public tunnel or another
-route that bypasses that identity-aware proxy and therefore needs its own
-passwordless session. A passkey session proves the configured identity only; it
-does not mint a Databricks OBO access token.
+Generated Node bindings for [provider-neutral Rust authentication](../../../rs/auth).
+This is outbound OAuth, not the incoming [`@dbx-tools/auth-gate`](../auth-gate).
 
 ```ts
-import { auth, storage } from "@dbx-tools/auth";
-
-const database = await storage.createAuthStorage({ storage: "sqlite" });
-const runtime = await auth.createPasswordlessAuth({
-  storage: database,
-  baseURL: "http://localhost:8000",
-  appName: "My app",
-  secret: process.env.AUTH_SECRET!,
-  logoutRedirectPath: "/",
-  sessionTtlSeconds: 2_592_000,
-  codeTtlSeconds: 600,
-  maxAttempts: 5,
-  authorizeIdentity: (email) => email.endsWith("@example.com"),
-  sendCode: async (email, code) => sendEmail(email, code),
-});
+import { createProviderAuth, ProviderOptions, OAuthGrant } from "@dbx-tools/auth";
+
+const auth = await createProviderAuth(
+  ProviderOptions.create({
+    provider: "example",
+    tokenEndpoint: "https://identity.example.com/oauth/token",
+    clientId: process.env.OAUTH_CLIENT_ID!,
+    clientSecret: process.env.OAUTH_CLIENT_SECRET!,
+    grant: OAuthGrant.ClientCredentials,
+    scopes: ["read"],
+  }),
+);
+const token = await auth.token(false);
 ```
 
-`POST <basePath>/logout` returns `{ ok, redirectTo }`; `GET` clears the same
-session and redirects with status `303`. The redirect defaults to `/` and is
-restricted to a same-origin path.
-
-## Modules
-
-- `auth` - Better Auth runtime and compatibility routes;
-- `storage` - Lakebase/SQLite selection and migration locking.
+Omit `profile` for providers without profiles. `fileLayout` selects one shared
+file or a separate file per provider/profile/sorted-scope identity. `cacheDir`
+overrides the file location. Rust owns storage, locking, refresh, and browser
+authorization; the TypeScript API is generated, not copied.
+
+Both `ProviderOptions.auth` and `DatabricksAuthOptions.auth` accept the same
+`AuthOptions` exported here. For example,
+`auth: AuthOptions.create({ lockTimeoutSeconds: 10n })` overrides only the lock
+timeout. Omit `auth` to use Rust defaults. Move former top-level timeout and
+`callbackImageSrc` fields into this record; see the
+[shared options guide](../../../rs/auth/README.md#shared-options-and-provider-implementations).
+
+Use `StorageAdapter` for custom persistence. Wrap it with `createStorageHandle`
+before passing it to either `createProviderAuthWithStorage` or
+`@dbx-tools/databricks-auth`'s `createPersistentAuthWithStorage`. No Postgres client is bundled.
+The standard package root exports generated contracts and `uniffiModule`, the
+generator-owned converter table used by dependent bindings.

package/index.ts

@@ -3,7 +3,6 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/auth";
-export * as auth from "./src/auth.ts";
-export * as storage from "./src/storage.ts";
-export type { AuthorizeIdentity, AuthEmailOptions, PasswordlessAuthOptions, PasswordlessAuthRuntime } from "./src/auth.ts";
-export type { AuthStorageMode, AuthStorageConfig, ResolvedAuthStorageConfig, AuthDatabase, AuthStorage } from "./src/storage.ts";
+export * as bindings from "./src/bindings.ts";
+export { uniffiModule } from "./src/bindings.ts";
+export * from "./exports.ts";