@elysiumjs/themis 0.0.0-stage → 0.1.0

package/dist/signed-url.d.ts

@@ -0,0 +1,72 @@
+declare const InvalidSignatureError_base: {
+    new (detail?: string, options?: import("@elysiumjs/core").DomainErrorOptions): {
+        name: string;
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        value?(): import("elysia/types").MaybePromise<unknown>;
+        readonly code: "INVALID_SIGNATURE";
+        readonly status: 403;
+        readonly detail: string | undefined;
+        readonly title: string;
+        readonly errors: readonly import("@elysiumjs/core").ProblemValidationError[] | undefined;
+        readonly retryAfterSeconds: number | undefined;
+        readonly extensions: Readonly<Record<string, unknown>>;
+        readonly headers: Record<string, string> | undefined;
+        readonly type: string;
+        extension(): Record<string, unknown>;
+    };
+    isError(error: unknown): error is Error;
+    isError(value: unknown): value is Error;
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+    id<const Type extends string>(code: Type): import("elysia").TaggedHTTPError<Type>;
+    id<const Type extends string, const S_1 extends number | keyof import("elysia").StatusMap>(code: Type, status: S_1): import("elysia").TaggedHTTPError<Type, {
+        readonly status: S_1 extends keyof import("elysia").StatusMap ? import("elysia").StatusMap[S_1] : S_1;
+    }>;
+    typeBase?: string;
+    for<const C extends import("@elysiumjs/core").ProblemCode, const S extends number>(code: C, status: S): any;
+};
+/**
+ * Raised when a signed URL was tampered with or has expired. Rendered as a 403 problem.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export declare class InvalidSignatureError extends InvalidSignatureError_base {
+    constructor(expired: boolean);
+}
+export declare namespace SignedUrl {
+    /**
+     * Signs a URL with HMAC-SHA256: adds `expires` (when asked) and `signature` parameters. The
+     * path and every parameter are signed; the origin is not, so that the link works behind any
+     * host name.
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @param url The URL.
+     * @param options The secret, and how long the link lives, in seconds.
+     * @example
+     * ```ts
+     * const link = await SignedUrl.sign(`${base}/invoices/42/pdf`, { secret, expiresIn: 3600 });
+     * ```
+     */
+    const sign: (url: string | URL, options: {
+        secret: string;
+        expiresIn?: number;
+    }) => Promise<string>;
+    /**
+     * Whether a URL carries a valid signature and has not expired.
+     * @author Axel Nana <axel.nana@workbud.com>
+     */
+    const verify: (url: string | URL, options: {
+        secret: string;
+    }) => Promise<boolean>;
+    /**
+     * Checks the signature of a URL, such as `request.url` in a handler.
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @throws {InvalidSignatureError} When the URL was tampered with or has expired (403).
+     */
+    const assert: (url: string | URL, options: {
+        secret: string;
+    }) => Promise<void>;
+}
+export {};

package/dist/themis.module.d.ts

@@ -0,0 +1,34 @@
+import type { ThemisConfig } from './config';
+declare const ThemisModule_base: (abstract new () => {
+    readonly config: ThemisConfig;
+    onInit(): Promise<void> | void;
+    onDestroy(): Promise<void> | void;
+    onServe(_app: import("elysia").Elysia<any>): Promise<void> | void;
+}) & {
+    readonly config: string;
+    with(config: Partial<ThemisConfig> | (() => Partial<ThemisConfig> | Promise<Partial<ThemisConfig>>)): import("@elysiumjs/core").ConfiguredModule<ThemisConfig>;
+    resolveConfig(input?: Partial<ThemisConfig> | undefined): ThemisConfig;
+    register<TConfig_1 = any>(props?: import("@elysiumjs/core").ModuleProps<TConfig_1>): (target: import("@elysiumjs/core").ModuleClass) => void;
+    configurable<TConfig extends object>(options?: {
+        defaults?: Partial<TConfig>;
+        required?: (keyof TConfig)[];
+    }): any;
+};
+/**
+ * Configures Themis: the secret, the sessions and the guards of `@Auth()`.
+ * @author Axel Nana <axel.nana@workbud.com>
+ * @example
+ * ```ts
+ * ThemisModule.with({
+ * 	secret: env.APP_SECRET,
+ * 	session: { store: new RedisSessionStore({ connection: () => Redis.connection() }) },
+ * 	guards: {
+ * 		session: sessionGuard({ user: (id) => users.find(id) }),
+ * 		jwt: jwtGuard({ secret: env.JWT_SECRET })
+ * 	}
+ * });
+ * ```
+ */
+export declare class ThemisModule extends ThemisModule_base {
+}
+export {};

package/dist/totp.d.ts

@@ -0,0 +1,73 @@
+/**
+ * The parameters of TOTP codes. The defaults (6 digits, 30 seconds, SHA-1) are the ones every
+ * authenticator app supports.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export type TotpOptions = {
+    digits?: number;
+    period?: number;
+    algorithm?: 'SHA1' | 'SHA256' | 'SHA512';
+};
+export declare namespace Totp {
+    /**
+     * Generates a TOTP secret: 20 random bytes as base32, as authenticator apps expect.
+     * @author Axel Nana <axel.nana@workbud.com>
+     */
+    const generateSecret: (bytes?: number) => string;
+    /**
+     * The `otpauth://` URI of a secret, to show as a QR code.
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @param options The secret, the issuer (the app name) and the account (such as the email).
+     */
+    const uri: (options: TotpOptions & {
+        secret: string;
+        issuer: string;
+        account: string;
+    }) => string;
+    /**
+     * The code of a secret at a time (RFC 6238).
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @param secret The base32 secret.
+     * @param options The parameters, and the time in milliseconds (now by default).
+     */
+    const generate: (secret: string, options?: TotpOptions & {
+        time?: number;
+    }) => Promise<string>;
+    /**
+     * Whether a code is the one of the current period, or of `window` periods around it, to allow
+     * for clock drift. Compare the returned counter with the last one used to refuse a replay.
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @param code The code the user typed.
+     * @param secret The base32 secret.
+     * @param options The parameters, the window (1 by default) and the time.
+     * @returns The counter of the matching period, or `null`.
+     */
+    const verify: (code: string, secret: string, options?: TotpOptions & {
+        window?: number;
+        time?: number;
+    }) => Promise<number | null>;
+}
+export declare namespace BackupCodes {
+    /**
+     * Generates one-time backup codes, such as `k3m9q-x7t2p`. Show the codes once and store only
+     * their hashes.
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @param count The number of codes. Defaults to 10.
+     * @returns The codes, and their hashes in the same order.
+     */
+    const generate: (count?: number) => Promise<{
+        codes: string[];
+        hashes: string[];
+    }>;
+    /**
+     * Uses a backup code: checks it against the stored hashes, and returns the hashes left once it
+     * is used up. Case, spaces and dashes do not matter.
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @param code The code the user typed.
+     * @param hashes The stored hashes.
+     */
+    const consume: (code: string, hashes: readonly string[]) => Promise<{
+        valid: boolean;
+        remaining: string[];
+    }>;
+}

package/package.json

@@ -1,6 +1,71 @@
 {
   "name": "@elysiumjs/themis",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "license": "Apache-2.0",
+  "description": "Authentication for the Elysium.js framework: passwords, tokens, sessions, guards, CSRF, TOTP, OAuth and passkeys.",
+  "private": false,
+  "author": {
+    "name": "Axel Nana",
+    "email": "axel.nana@workbud.com"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/na2axl/elysiumjs.git",
+    "directory": "@elysiumjs/themis"
+  },
+  "homepage": "https://github.com/na2axl/elysiumjs/tree/main/@elysiumjs/themis#readme",
+  "bugs": {
+    "url": "https://github.com/na2axl/elysiumjs/issues"
+  },
+  "scripts": {
+    "format": "prettier --write \"./src/**/*.ts\"",
+    "clean": "rimraf dist",
+    "build:js": "bun build ./src/index.ts ./src/scrypt.ts --outdir ./dist --target browser --packages external --splitting --root ./src --minify-syntax --minify-whitespace",
+    "build:ts": "tsc",
+    "build": "bun run clean && bun run build:js && bun run build:ts",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "bun run build",
+    "test": "bun test",
+    "test:coverage": "bun test --coverage"
+  },
+  "keywords": [
+    "elysium",
+    "framework",
+    "typescript",
+    "auth",
+    "sessions",
+    "jwt",
+    "passkeys"
+  ],
+  "type": "module",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./scrypt": {
+      "types": "./dist/scrypt.d.ts",
+      "import": "./dist/scrypt.js"
+    }
+  },
+  "files": [
+    "dist",
+    "CHANGELOG.md"
+  ],
+  "sideEffects": false,
+  "dependencies": {
+    "@simplewebauthn/server": "^14.0.3",
+    "jose": "^6.2.15",
+    "oauth4webapi": "^3.8.8"
+  },
+  "devDependencies": {
+    "@elysiumjs/core": "0.11.0",
+    "@elysiumjs/runtime-bun": "0.1.0",
+    "elysia": "^2.0.0-rc.1"
+  },
+  "peerDependencies": {
+    "@elysiumjs/core": "^0.11.0"
+  }
+}