@dbx-tools/shared-auth 0.9.36 → 0.9.38
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +53 -17
- package/index.ts +1 -1
- package/lib/index.d.ts +1 -1
- package/lib/index.js +2 -2
- package/lib/src/auth.d.ts +13 -0
- package/lib/src/auth.js +8 -1
- package/package.json +1 -1
- package/src/auth.ts +13 -0
package/README.md
CHANGED
|
@@ -1,28 +1,64 @@
|
|
|
1
1
|
# `@dbx-tools/shared-auth`
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
3
|
+
Keep passwordless sign-in, passkey controls, and Databricks profile selectors
|
|
4
|
+
consistent across browser and server packages. The package provides shared
|
|
5
|
+
schemas for validating responses at the network boundary plus browser helpers
|
|
6
|
+
that work with `@dbx-tools/auth-gate`.
|
|
5
7
|
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
- compatibility schemas for email OTP request and verification routes;
|
|
9
|
-
- logout result and redirect contract;
|
|
10
|
-
- gate status with optional passkey capability;
|
|
11
|
-
- Databricks auth-type and target values;
|
|
12
|
-
- secret-free profile summaries, profile lists, and selector values;
|
|
13
|
-
- resolved Databricks authentication client fields for browser auth checks;
|
|
14
|
-
- one shared session-cookie name for Node transports and browser clients.
|
|
8
|
+
## Read Authentication Status
|
|
15
9
|
|
|
16
10
|
```ts
|
|
17
11
|
import { authStatusSchema } from "@dbx-tools/shared-auth";
|
|
18
12
|
|
|
13
|
+
const response = await fetch("/api/auth/status", { credentials: "include" });
|
|
19
14
|
const status = authStatusSchema.parse(await response.json());
|
|
15
|
+
|
|
16
|
+
if (status.enabled && !status.authenticated) {
|
|
17
|
+
showSignIn();
|
|
18
|
+
}
|
|
19
|
+
```
|
|
20
|
+
|
|
21
|
+
Use the request, verification, logout, and status schemas when custom UI or
|
|
22
|
+
transport code calls the auth gate directly.
|
|
23
|
+
|
|
24
|
+
## Build A Profile Selector
|
|
25
|
+
|
|
26
|
+
Profile summaries never include tokens or client secrets. Validate values before
|
|
27
|
+
rendering or persisting a selection:
|
|
28
|
+
|
|
29
|
+
```ts
|
|
30
|
+
import {
|
|
31
|
+
databricksProfileListSchema,
|
|
32
|
+
databricksProfileSelectionSchema,
|
|
33
|
+
} from "@dbx-tools/shared-auth";
|
|
34
|
+
|
|
35
|
+
const profiles = databricksProfileListSchema.parse(await response.json());
|
|
36
|
+
const selection = databricksProfileSelectionSchema.parse({
|
|
37
|
+
kind: "profile",
|
|
38
|
+
profile: profiles[0].name,
|
|
39
|
+
});
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
Use `{ kind: "ambient" }` when the consuming runtime should choose its normal
|
|
43
|
+
Databricks authentication source.
|
|
44
|
+
|
|
45
|
+
## Use Browser Sign-In Helpers
|
|
46
|
+
|
|
47
|
+
The `browser` module requests and verifies email OTPs, starts passkey sign-in or
|
|
48
|
+
enrollment, manages enrolled passkeys, reads gate status, and logs out through
|
|
49
|
+
the server-provided same-origin redirect.
|
|
50
|
+
|
|
51
|
+
```ts
|
|
52
|
+
import { requestEmailOtp, verifyEmailOtp } from "@dbx-tools/shared-auth/browser";
|
|
53
|
+
|
|
54
|
+
await requestEmailOtp("person@example.com");
|
|
55
|
+
await verifyEmailOtp("person@example.com", code, "Person");
|
|
20
56
|
```
|
|
21
57
|
|
|
22
|
-
##
|
|
58
|
+
## Package API
|
|
23
59
|
|
|
24
|
-
- `auth`
|
|
25
|
-
- `browser`
|
|
26
|
-
- `config`
|
|
27
|
-
- `profile`
|
|
28
|
-
- `client`
|
|
60
|
+
- `auth` validates passwordless gate requests and responses.
|
|
61
|
+
- `browser` performs email OTP, passkey, status, and logout operations.
|
|
62
|
+
- `config` defines Databricks authentication and target values.
|
|
63
|
+
- `profile` validates secret-free profile lists and selections.
|
|
64
|
+
- `client` validates resolved, secret-free Databricks client information.
|
package/index.ts
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
// Hand edits are overwritten on the next watch; this file is read-only.
|
|
4
4
|
|
|
5
5
|
export const PACKAGE_IDENTIFIER = "@dbx-tools/shared-auth";
|
|
6
|
-
export const PACKAGE_VERSION = "0.9.
|
|
6
|
+
export const PACKAGE_VERSION = "0.9.38";
|
|
7
7
|
export * as auth from "./src/auth.ts";
|
|
8
8
|
export * as browser from "./src/browser.ts";
|
|
9
9
|
export * as client from "./src/client.ts";
|
package/lib/index.d.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
export declare const PACKAGE_IDENTIFIER = "@dbx-tools/shared-auth";
|
|
2
|
-
export declare const PACKAGE_VERSION = "0.9.
|
|
2
|
+
export declare const PACKAGE_VERSION = "0.9.38";
|
|
3
3
|
export * as auth from "./src/auth.ts";
|
|
4
4
|
export * as browser from "./src/browser.ts";
|
|
5
5
|
export * as client from "./src/client.ts";
|
package/lib/index.js
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
// Regenerated from the exporting modules in ./src.
|
|
3
3
|
// Hand edits are overwritten on the next watch; this file is read-only.
|
|
4
4
|
export const PACKAGE_IDENTIFIER = "@dbx-tools/shared-auth";
|
|
5
|
-
export const PACKAGE_VERSION = "0.9.
|
|
5
|
+
export const PACKAGE_VERSION = "0.9.38";
|
|
6
6
|
export * as auth from "./src/auth.js";
|
|
7
7
|
export * as browser from "./src/browser.js";
|
|
8
8
|
export * as client from "./src/client.js";
|
|
@@ -14,4 +14,4 @@ export { databricksAuthClientInfoSchema } from "./src/client.js";
|
|
|
14
14
|
export { AuthType, TargetKind } from "./src/config.js";
|
|
15
15
|
export { authTypeSchema, targetKindSchema } from "./src/config-schema.js";
|
|
16
16
|
export { databricksProfileSummarySchema, databricksProfileListSchema, databricksProfileSelectionSchema } from "./src/profile.js";
|
|
17
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
17
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyx3QkFBd0IsQ0FBQztBQUMzRCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsUUFBUSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxJQUFJLE1BQU0sZUFBZSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFDNUMsT0FBTyxLQUFLLE1BQU0sTUFBTSxpQkFBaUIsQ0FBQztBQUMxQyxPQUFPLEtBQUssTUFBTSxNQUFNLGlCQUFpQixDQUFDO0FBQzFDLE9BQU8sS0FBSyxZQUFZLE1BQU0sd0JBQXdCLENBQUM7QUFDdkQsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUM1QyxPQUFPLEVBQUUsY0FBYyxFQUFFLG1CQUFtQixFQUFFLGlCQUFpQixFQUFFLHVCQUF1QixFQUFFLGdCQUFnQixFQUFFLHNCQUFzQixFQUFFLHNCQUFzQixFQUFFLGdCQUFnQixFQUFFLE1BQU0sZUFBZSxDQUFDO0FBR3BNLE9BQU8sRUFBRSw4QkFBOEIsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBRWpFLE9BQU8sRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDdkQsT0FBTyxFQUFFLGNBQWMsRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQzFFLE9BQU8sRUFBRSw4QkFBOEIsRUFBRSwyQkFBMkIsRUFBRSxnQ0FBZ0MsRUFBRSxNQUFNLGtCQUFrQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gR0VORVJBVEVEIGJ5IHByb2plbiB3YXRjaCAtIERPIE5PVCBFRElULlxuLy8gUmVnZW5lcmF0ZWQgZnJvbSB0aGUgZXhwb3J0aW5nIG1vZHVsZXMgaW4gLi9zcmMuXG4vLyBIYW5kIGVkaXRzIGFyZSBvdmVyd3JpdHRlbiBvbiB0aGUgbmV4dCB3YXRjaDsgdGhpcyBmaWxlIGlzIHJlYWQtb25seS5cblxuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfSURFTlRJRklFUiA9IFwiQGRieC10b29scy9zaGFyZWQtYXV0aFwiO1xuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfVkVSU0lPTiA9IFwiMC45LjM4XCI7XG5leHBvcnQgKiBhcyBhdXRoIGZyb20gXCIuL3NyYy9hdXRoLnRzXCI7XG5leHBvcnQgKiBhcyBicm93c2VyIGZyb20gXCIuL3NyYy9icm93c2VyLnRzXCI7XG5leHBvcnQgKiBhcyBjbGllbnQgZnJvbSBcIi4vc3JjL2NsaWVudC50c1wiO1xuZXhwb3J0ICogYXMgY29uZmlnIGZyb20gXCIuL3NyYy9jb25maWcudHNcIjtcbmV4cG9ydCAqIGFzIGNvbmZpZ1NjaGVtYSBmcm9tIFwiLi9zcmMvY29uZmlnLXNjaGVtYS50c1wiO1xuZXhwb3J0ICogYXMgcHJvZmlsZSBmcm9tIFwiLi9zcmMvcHJvZmlsZS50c1wiO1xuZXhwb3J0IHsgQVVUSF9CQVNFX1BBVEgsIFNFU1NJT05fQ09PS0lFX05BTUUsIGF1dGhSZXF1ZXN0U2NoZW1hLCBhdXRoUmVxdWVzdFJlc3VsdFNjaGVtYSwgYXV0aFZlcmlmeVNjaGVtYSwgYXV0aFZlcmlmeVJlc3VsdFNjaGVtYSwgYXV0aExvZ291dFJlc3VsdFNjaGVtYSwgYXV0aFN0YXR1c1NjaGVtYSB9IGZyb20gXCIuL3NyYy9hdXRoLnRzXCI7XG5leHBvcnQgdHlwZSB7IEF1dGhSZXF1ZXN0LCBBdXRoUmVxdWVzdFJlc3VsdCwgQXV0aFZlcmlmeSwgQXV0aFZlcmlmeVJlc3VsdCwgQXV0aExvZ291dFJlc3VsdCwgQXV0aFN0YXR1cyB9IGZyb20gXCIuL3NyYy9hdXRoLnRzXCI7XG5leHBvcnQgdHlwZSB7IFBhc3NrZXlPcGVyYXRpb24gfSBmcm9tIFwiLi9zcmMvYnJvd3Nlci50c1wiO1xuZXhwb3J0IHsgZGF0YWJyaWNrc0F1dGhDbGllbnRJbmZvU2NoZW1hIH0gZnJvbSBcIi4vc3JjL2NsaWVudC50c1wiO1xuZXhwb3J0IHR5cGUgeyBEYXRhYnJpY2tzQXV0aENsaWVudEluZm8gfSBmcm9tIFwiLi9zcmMvY2xpZW50LnRzXCI7XG5leHBvcnQgeyBBdXRoVHlwZSwgVGFyZ2V0S2luZCB9IGZyb20gXCIuL3NyYy9jb25maWcudHNcIjtcbmV4cG9ydCB7IGF1dGhUeXBlU2NoZW1hLCB0YXJnZXRLaW5kU2NoZW1hIH0gZnJvbSBcIi4vc3JjL2NvbmZpZy1zY2hlbWEudHNcIjtcbmV4cG9ydCB7IGRhdGFicmlja3NQcm9maWxlU3VtbWFyeVNjaGVtYSwgZGF0YWJyaWNrc1Byb2ZpbGVMaXN0U2NoZW1hLCBkYXRhYnJpY2tzUHJvZmlsZVNlbGVjdGlvblNjaGVtYSB9IGZyb20gXCIuL3NyYy9wcm9maWxlLnRzXCI7XG5leHBvcnQgdHlwZSB7IERhdGFicmlja3NQcm9maWxlU3VtbWFyeSwgRGF0YWJyaWNrc1Byb2ZpbGVMaXN0LCBEYXRhYnJpY2tzUHJvZmlsZVNlbGVjdGlvbiB9IGZyb20gXCIuL3NyYy9wcm9maWxlLnRzXCI7XG4iXX0=
|
package/lib/src/auth.d.ts
CHANGED
|
@@ -17,35 +17,48 @@ export { AUTH_BASE_PATH };
|
|
|
17
17
|
* `/api/email/authz` from being treated as public authentication endpoints.
|
|
18
18
|
*/
|
|
19
19
|
export declare function isAuthPath(path: string): boolean;
|
|
20
|
+
/** Shared Better Auth session-cookie name used by browser and server packages. */
|
|
20
21
|
export declare const SESSION_COOKIE_NAME = "dbx-tools-auth";
|
|
22
|
+
/** Request schema for sending an email one-time password. */
|
|
21
23
|
export declare const authRequestSchema: z.ZodObject<{
|
|
22
24
|
email: z.ZodString;
|
|
23
25
|
}, z.core.$strip>;
|
|
26
|
+
/** Validated request for an email one-time password. */
|
|
24
27
|
export type AuthRequest = z.infer<typeof authRequestSchema>;
|
|
28
|
+
/** Response schema for an accepted one-time-password request. */
|
|
25
29
|
export declare const authRequestResultSchema: z.ZodObject<{
|
|
26
30
|
ok: z.ZodLiteral<true>;
|
|
27
31
|
retryAfter: z.ZodOptional<z.ZodNumber>;
|
|
28
32
|
}, z.core.$strip>;
|
|
33
|
+
/** Accepted one-time-password request result and optional retry delay. */
|
|
29
34
|
export type AuthRequestResult = z.infer<typeof authRequestResultSchema>;
|
|
35
|
+
/** Request schema for verifying an email one-time password. */
|
|
30
36
|
export declare const authVerifySchema: z.ZodObject<{
|
|
31
37
|
email: z.ZodString;
|
|
32
38
|
code: z.ZodString;
|
|
33
39
|
}, z.core.$strip>;
|
|
40
|
+
/** Email address and code submitted to establish a session. */
|
|
34
41
|
export type AuthVerify = z.infer<typeof authVerifySchema>;
|
|
42
|
+
/** Response schema for one-time-password verification. */
|
|
35
43
|
export declare const authVerifyResultSchema: z.ZodObject<{
|
|
36
44
|
ok: z.ZodBoolean;
|
|
37
45
|
retryAfter: z.ZodOptional<z.ZodNumber>;
|
|
38
46
|
}, z.core.$strip>;
|
|
47
|
+
/** Verification outcome and optional retry delay. */
|
|
39
48
|
export type AuthVerifyResult = z.infer<typeof authVerifyResultSchema>;
|
|
49
|
+
/** Response schema returned after clearing an authentication session. */
|
|
40
50
|
export declare const authLogoutResultSchema: z.ZodObject<{
|
|
41
51
|
ok: z.ZodBoolean;
|
|
42
52
|
redirectTo: z.ZodString;
|
|
43
53
|
}, z.core.$strip>;
|
|
54
|
+
/** Logout outcome plus the validated same-origin destination. */
|
|
44
55
|
export type AuthLogoutResult = z.infer<typeof authLogoutResultSchema>;
|
|
56
|
+
/** Response schema describing gate availability and the current browser session. */
|
|
45
57
|
export declare const authStatusSchema: z.ZodObject<{
|
|
46
58
|
authenticated: z.ZodBoolean;
|
|
47
59
|
email: z.ZodOptional<z.ZodString>;
|
|
48
60
|
enabled: z.ZodBoolean;
|
|
49
61
|
passkeysEnabled: z.ZodOptional<z.ZodBoolean>;
|
|
50
62
|
}, z.core.$strip>;
|
|
63
|
+
/** Gate availability, session identity, and optional passkey capability. */
|
|
51
64
|
export type AuthStatus = z.infer<typeof authStatusSchema>;
|
package/lib/src/auth.js
CHANGED
|
@@ -20,30 +20,37 @@ export function isAuthPath(path) {
|
|
|
20
20
|
const pathname = path.split("?", 1)[0] ?? path;
|
|
21
21
|
return pathname === AUTH_BASE_PATH || pathname.startsWith(`${AUTH_BASE_PATH}/`);
|
|
22
22
|
}
|
|
23
|
+
/** Shared Better Auth session-cookie name used by browser and server packages. */
|
|
23
24
|
export const SESSION_COOKIE_NAME = "dbx-tools-auth";
|
|
25
|
+
/** Request schema for sending an email one-time password. */
|
|
24
26
|
export const authRequestSchema = z.object({
|
|
25
27
|
email: z.string().describe("Address to email a one-time code to, if it is authorized."),
|
|
26
28
|
});
|
|
29
|
+
/** Response schema for an accepted one-time-password request. */
|
|
27
30
|
export const authRequestResultSchema = z.object({
|
|
28
31
|
ok: z.literal(true),
|
|
29
32
|
retryAfter: z.number().optional(),
|
|
30
33
|
});
|
|
34
|
+
/** Request schema for verifying an email one-time password. */
|
|
31
35
|
export const authVerifySchema = z.object({
|
|
32
36
|
email: z.string(),
|
|
33
37
|
code: z.string(),
|
|
34
38
|
});
|
|
39
|
+
/** Response schema for one-time-password verification. */
|
|
35
40
|
export const authVerifyResultSchema = z.object({
|
|
36
41
|
ok: z.boolean(),
|
|
37
42
|
retryAfter: z.number().optional(),
|
|
38
43
|
});
|
|
44
|
+
/** Response schema returned after clearing an authentication session. */
|
|
39
45
|
export const authLogoutResultSchema = z.object({
|
|
40
46
|
ok: z.boolean(),
|
|
41
47
|
redirectTo: z.string(),
|
|
42
48
|
});
|
|
49
|
+
/** Response schema describing gate availability and the current browser session. */
|
|
43
50
|
export const authStatusSchema = z.object({
|
|
44
51
|
authenticated: z.boolean(),
|
|
45
52
|
email: z.string().optional(),
|
|
46
53
|
enabled: z.boolean(),
|
|
47
54
|
passkeysEnabled: z.boolean().optional(),
|
|
48
55
|
});
|
|
49
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
56
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hdXRoLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7OztHQVFHO0FBRUgsT0FBTyxFQUFFLENBQUMsRUFBRSxNQUFNLEtBQUssQ0FBQztBQUV4QixPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sYUFBYSxDQUFDO0FBRTdDLE9BQU8sRUFBRSxjQUFjLEVBQUUsQ0FBQztBQUUxQjs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSxVQUFVLENBQUMsSUFBWTtJQUNyQyxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUM7SUFDL0MsT0FBTyxRQUFRLEtBQUssY0FBYyxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsR0FBRyxjQUFjLEdBQUcsQ0FBQyxDQUFDO0FBQ2xGLENBQUM7QUFFRCxrRkFBa0Y7QUFDbEYsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsZ0JBQWdCLENBQUM7QUFFcEQsNkRBQTZEO0FBQzdELE1BQU0sQ0FBQyxNQUFNLGlCQUFpQixHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDeEMsS0FBSyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsMkRBQTJELENBQUM7Q0FDeEYsQ0FBQyxDQUFDO0FBSUgsaUVBQWlFO0FBQ2pFLE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDOUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDO0lBQ25CLFVBQVUsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsUUFBUSxFQUFFO0NBQ2xDLENBQUMsQ0FBQztBQUlILCtEQUErRDtBQUMvRCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDO0lBQ3ZDLEtBQUssRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFO0lBQ2pCLElBQUksRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFO0NBQ2pCLENBQUMsQ0FBQztBQUlILDBEQUEwRDtBQUMxRCxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDO0lBQzdDLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxFQUFFO0lBQ2YsVUFBVSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLEVBQUU7Q0FDbEMsQ0FBQyxDQUFDO0FBSUgseUVBQXlFO0FBQ3pFLE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDN0MsRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLEVBQUU7SUFDZixVQUFVLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRTtDQUN2QixDQUFDLENBQUM7QUFJSCxvRkFBb0Y7QUFDcEYsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUN2QyxhQUFhLEVBQUUsQ0FBQyxDQUFDLE9BQU8sRUFBRTtJQUMxQixLQUFLLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUM1QixPQUFPLEVBQUUsQ0FBQyxDQUFDLE9BQU8sRUFBRTtJQUNwQixlQUFlLEVBQUUsQ0FBQyxDQUFDLE9BQU8sRUFBRSxDQUFDLFFBQVEsRUFBRTtDQUN4QyxDQUFDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEJyb3dzZXItc2FmZSBwYXNzd29yZGxlc3MgYXV0aGVudGljYXRpb24gd2lyZSBjb250cmFjdHMuXG4gKlxuICogQmV0dGVyIEF1dGggb3ducyBpdHMgbmF0aXZlIGVuZHBvaW50IHBheWxvYWRzLiBUaGVzZSBzY2hlbWFzIGNvdmVyIHRoZVxuICogZGJ4LXRvb2xzIGNvbXBhdGliaWxpdHkgYW5kIGdhdGUtc3RhdHVzIHN1cmZhY2Ugc2hhcmVkIGJ5IHR1bm5lbCB0cmFuc3BvcnRzXG4gKiBhbmQgUmVhY3QgaG9zdHMuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB7IHogfSBmcm9tIFwiem9kXCI7XG5cbmltcG9ydCB7IEFVVEhfQkFTRV9QQVRIIH0gZnJvbSBcIi4vX3JvdXRlLnRzXCI7XG5cbmV4cG9ydCB7IEFVVEhfQkFTRV9QQVRIIH07XG5cbi8qKlxuICogVHJ1ZSBvbmx5IGZvciB0aGUgYXV0aCBtb3VudCBpdHNlbGYgb3Igb25lIG9mIGl0cyBkZXNjZW5kYW50cy5cbiAqXG4gKiBTZWdtZW50LWF3YXJlIG1hdGNoaW5nIHByZXZlbnRzIGxvb2thbGlrZSBhcHBsaWNhdGlvbiByb3V0ZXMgc3VjaCBhc1xuICogYC9hcGkvZW1haWwvYXV0aHpgIGZyb20gYmVpbmcgdHJlYXRlZCBhcyBwdWJsaWMgYXV0aGVudGljYXRpb24gZW5kcG9pbnRzLlxuICovXG5leHBvcnQgZnVuY3Rpb24gaXNBdXRoUGF0aChwYXRoOiBzdHJpbmcpOiBib29sZWFuIHtcbiAgY29uc3QgcGF0aG5hbWUgPSBwYXRoLnNwbGl0KFwiP1wiLCAxKVswXSA/PyBwYXRoO1xuICByZXR1cm4gcGF0aG5hbWUgPT09IEFVVEhfQkFTRV9QQVRIIHx8IHBhdGhuYW1lLnN0YXJ0c1dpdGgoYCR7QVVUSF9CQVNFX1BBVEh9L2ApO1xufVxuXG4vKiogU2hhcmVkIEJldHRlciBBdXRoIHNlc3Npb24tY29va2llIG5hbWUgdXNlZCBieSBicm93c2VyIGFuZCBzZXJ2ZXIgcGFja2FnZXMuICovXG5leHBvcnQgY29uc3QgU0VTU0lPTl9DT09LSUVfTkFNRSA9IFwiZGJ4LXRvb2xzLWF1dGhcIjtcblxuLyoqIFJlcXVlc3Qgc2NoZW1hIGZvciBzZW5kaW5nIGFuIGVtYWlsIG9uZS10aW1lIHBhc3N3b3JkLiAqL1xuZXhwb3J0IGNvbnN0IGF1dGhSZXF1ZXN0U2NoZW1hID0gei5vYmplY3Qoe1xuICBlbWFpbDogei5zdHJpbmcoKS5kZXNjcmliZShcIkFkZHJlc3MgdG8gZW1haWwgYSBvbmUtdGltZSBjb2RlIHRvLCBpZiBpdCBpcyBhdXRob3JpemVkLlwiKSxcbn0pO1xuLyoqIFZhbGlkYXRlZCByZXF1ZXN0IGZvciBhbiBlbWFpbCBvbmUtdGltZSBwYXNzd29yZC4gKi9cbmV4cG9ydCB0eXBlIEF1dGhSZXF1ZXN0ID0gei5pbmZlcjx0eXBlb2YgYXV0aFJlcXVlc3RTY2hlbWE+O1xuXG4vKiogUmVzcG9uc2Ugc2NoZW1hIGZvciBhbiBhY2NlcHRlZCBvbmUtdGltZS1wYXNzd29yZCByZXF1ZXN0LiAqL1xuZXhwb3J0IGNvbnN0IGF1dGhSZXF1ZXN0UmVzdWx0U2NoZW1hID0gei5vYmplY3Qoe1xuICBvazogei5saXRlcmFsKHRydWUpLFxuICByZXRyeUFmdGVyOiB6Lm51bWJlcigpLm9wdGlvbmFsKCksXG59KTtcbi8qKiBBY2NlcHRlZCBvbmUtdGltZS1wYXNzd29yZCByZXF1ZXN0IHJlc3VsdCBhbmQgb3B0aW9uYWwgcmV0cnkgZGVsYXkuICovXG5leHBvcnQgdHlwZSBBdXRoUmVxdWVzdFJlc3VsdCA9IHouaW5mZXI8dHlwZW9mIGF1dGhSZXF1ZXN0UmVzdWx0U2NoZW1hPjtcblxuLyoqIFJlcXVlc3Qgc2NoZW1hIGZvciB2ZXJpZnlpbmcgYW4gZW1haWwgb25lLXRpbWUgcGFzc3dvcmQuICovXG5leHBvcnQgY29uc3QgYXV0aFZlcmlmeVNjaGVtYSA9IHoub2JqZWN0KHtcbiAgZW1haWw6IHouc3RyaW5nKCksXG4gIGNvZGU6IHouc3RyaW5nKCksXG59KTtcbi8qKiBFbWFpbCBhZGRyZXNzIGFuZCBjb2RlIHN1Ym1pdHRlZCB0byBlc3RhYmxpc2ggYSBzZXNzaW9uLiAqL1xuZXhwb3J0IHR5cGUgQXV0aFZlcmlmeSA9IHouaW5mZXI8dHlwZW9mIGF1dGhWZXJpZnlTY2hlbWE+O1xuXG4vKiogUmVzcG9uc2Ugc2NoZW1hIGZvciBvbmUtdGltZS1wYXNzd29yZCB2ZXJpZmljYXRpb24uICovXG5leHBvcnQgY29uc3QgYXV0aFZlcmlmeVJlc3VsdFNjaGVtYSA9IHoub2JqZWN0KHtcbiAgb2s6IHouYm9vbGVhbigpLFxuICByZXRyeUFmdGVyOiB6Lm51bWJlcigpLm9wdGlvbmFsKCksXG59KTtcbi8qKiBWZXJpZmljYXRpb24gb3V0Y29tZSBhbmQgb3B0aW9uYWwgcmV0cnkgZGVsYXkuICovXG5leHBvcnQgdHlwZSBBdXRoVmVyaWZ5UmVzdWx0ID0gei5pbmZlcjx0eXBlb2YgYXV0aFZlcmlmeVJlc3VsdFNjaGVtYT47XG5cbi8qKiBSZXNwb25zZSBzY2hlbWEgcmV0dXJuZWQgYWZ0ZXIgY2xlYXJpbmcgYW4gYXV0aGVudGljYXRpb24gc2Vzc2lvbi4gKi9cbmV4cG9ydCBjb25zdCBhdXRoTG9nb3V0UmVzdWx0U2NoZW1hID0gei5vYmplY3Qoe1xuICBvazogei5ib29sZWFuKCksXG4gIHJlZGlyZWN0VG86IHouc3RyaW5nKCksXG59KTtcbi8qKiBMb2dvdXQgb3V0Y29tZSBwbHVzIHRoZSB2YWxpZGF0ZWQgc2FtZS1vcmlnaW4gZGVzdGluYXRpb24uICovXG5leHBvcnQgdHlwZSBBdXRoTG9nb3V0UmVzdWx0ID0gei5pbmZlcjx0eXBlb2YgYXV0aExvZ291dFJlc3VsdFNjaGVtYT47XG5cbi8qKiBSZXNwb25zZSBzY2hlbWEgZGVzY3JpYmluZyBnYXRlIGF2YWlsYWJpbGl0eSBhbmQgdGhlIGN1cnJlbnQgYnJvd3NlciBzZXNzaW9uLiAqL1xuZXhwb3J0IGNvbnN0IGF1dGhTdGF0dXNTY2hlbWEgPSB6Lm9iamVjdCh7XG4gIGF1dGhlbnRpY2F0ZWQ6IHouYm9vbGVhbigpLFxuICBlbWFpbDogei5zdHJpbmcoKS5vcHRpb25hbCgpLFxuICBlbmFibGVkOiB6LmJvb2xlYW4oKSxcbiAgcGFzc2tleXNFbmFibGVkOiB6LmJvb2xlYW4oKS5vcHRpb25hbCgpLFxufSk7XG4vKiogR2F0ZSBhdmFpbGFiaWxpdHksIHNlc3Npb24gaWRlbnRpdHksIGFuZCBvcHRpb25hbCBwYXNza2V5IGNhcGFiaWxpdHkuICovXG5leHBvcnQgdHlwZSBBdXRoU3RhdHVzID0gei5pbmZlcjx0eXBlb2YgYXV0aFN0YXR1c1NjaGVtYT47XG4iXX0=
|
package/package.json
CHANGED
package/src/auth.ts
CHANGED
|
@@ -25,41 +25,54 @@ export function isAuthPath(path: string): boolean {
|
|
|
25
25
|
return pathname === AUTH_BASE_PATH || pathname.startsWith(`${AUTH_BASE_PATH}/`);
|
|
26
26
|
}
|
|
27
27
|
|
|
28
|
+
/** Shared Better Auth session-cookie name used by browser and server packages. */
|
|
28
29
|
export const SESSION_COOKIE_NAME = "dbx-tools-auth";
|
|
29
30
|
|
|
31
|
+
/** Request schema for sending an email one-time password. */
|
|
30
32
|
export const authRequestSchema = z.object({
|
|
31
33
|
email: z.string().describe("Address to email a one-time code to, if it is authorized."),
|
|
32
34
|
});
|
|
35
|
+
/** Validated request for an email one-time password. */
|
|
33
36
|
export type AuthRequest = z.infer<typeof authRequestSchema>;
|
|
34
37
|
|
|
38
|
+
/** Response schema for an accepted one-time-password request. */
|
|
35
39
|
export const authRequestResultSchema = z.object({
|
|
36
40
|
ok: z.literal(true),
|
|
37
41
|
retryAfter: z.number().optional(),
|
|
38
42
|
});
|
|
43
|
+
/** Accepted one-time-password request result and optional retry delay. */
|
|
39
44
|
export type AuthRequestResult = z.infer<typeof authRequestResultSchema>;
|
|
40
45
|
|
|
46
|
+
/** Request schema for verifying an email one-time password. */
|
|
41
47
|
export const authVerifySchema = z.object({
|
|
42
48
|
email: z.string(),
|
|
43
49
|
code: z.string(),
|
|
44
50
|
});
|
|
51
|
+
/** Email address and code submitted to establish a session. */
|
|
45
52
|
export type AuthVerify = z.infer<typeof authVerifySchema>;
|
|
46
53
|
|
|
54
|
+
/** Response schema for one-time-password verification. */
|
|
47
55
|
export const authVerifyResultSchema = z.object({
|
|
48
56
|
ok: z.boolean(),
|
|
49
57
|
retryAfter: z.number().optional(),
|
|
50
58
|
});
|
|
59
|
+
/** Verification outcome and optional retry delay. */
|
|
51
60
|
export type AuthVerifyResult = z.infer<typeof authVerifyResultSchema>;
|
|
52
61
|
|
|
62
|
+
/** Response schema returned after clearing an authentication session. */
|
|
53
63
|
export const authLogoutResultSchema = z.object({
|
|
54
64
|
ok: z.boolean(),
|
|
55
65
|
redirectTo: z.string(),
|
|
56
66
|
});
|
|
67
|
+
/** Logout outcome plus the validated same-origin destination. */
|
|
57
68
|
export type AuthLogoutResult = z.infer<typeof authLogoutResultSchema>;
|
|
58
69
|
|
|
70
|
+
/** Response schema describing gate availability and the current browser session. */
|
|
59
71
|
export const authStatusSchema = z.object({
|
|
60
72
|
authenticated: z.boolean(),
|
|
61
73
|
email: z.string().optional(),
|
|
62
74
|
enabled: z.boolean(),
|
|
63
75
|
passkeysEnabled: z.boolean().optional(),
|
|
64
76
|
});
|
|
77
|
+
/** Gate availability, session identity, and optional passkey capability. */
|
|
65
78
|
export type AuthStatus = z.infer<typeof authStatusSchema>;
|