@everystack/auth 0.1.0

package/src/index.ts

@@ -0,0 +1,526 @@
+/**
+ * @everystack/auth — JWT authentication handlers and password hashing.
+ *
+ * Two modes:
+ *   - 'node' (default): bcrypt for passwords (cost via BCRYPT_COST env, default 10), in-house HS256 for JWTs
+ *   - 'postgres': pgcrypto bcrypt (cost 10) for passwords, pgcrypto HMAC for JWTs
+ *
+ * Both modes produce byte-compatible bcrypt hashes and HS256 JWTs — credentials
+ * and tokens are interchangeable across modes.
+ *
+ * Usage:
+ *   import { createAuthHandlers, hashPassword, verifyPassword } from '@everystack/auth';
+ *
+ *   // Node mode (default):
+ *   const auth = createAuthHandlers(db, { users, profiles }, jwtSecret);
+ *
+ *   // Postgres mode (requires pgcrypto + auth SQL functions):
+ *   const auth = createAuthHandlers(db, { users, profiles }, jwtSecret, { mode: 'postgres' });
+ *
+ * With DB-backed refresh tokens (recommended for production):
+ *   import { sessions } from '@everystack/auth/schema';
+ *
+ *   const auth = createAuthHandlers(db, { users, profiles, sessions }, jwtSecret);
+ */
+
+import { createJwt } from './jwt';
+import { hmacNode } from './jwt/hmac-node';
+import { and, eq } from 'drizzle-orm';
+import {
+  createRefreshToken,
+  rotateRefreshToken,
+  revokeAllRefreshTokens,
+  TokenError,
+} from './refresh';
+import type { OAuthProvider } from './oauth';
+export type { OAuthProvider, OAuthUserInfo } from './oauth';
+export { createAppleProvider, createGoogleProvider } from './oauth';
+import { createPostgresAuthHandlers } from './postgres';
+import { getRefreshFromCookies } from './cookies';
+import { authResponse, signoutResponse } from './response';
+import type { CookieConfig } from './response';
+
+const TOKEN_EXPIRY_SEC = 3600; // 1h
+const REFRESH_EXPIRY_SEC = 7 * 24 * 3600; // 7d
+
+export interface TokenPayload {
+  sub: string;
+  email: string;
+  role: string;
+}
+
+export interface AuthHandlers {
+  signup: (request: Request) => Promise<Response>;
+  signin: (request: Request) => Promise<Response>;
+  refresh: (request: Request) => Promise<Response>;
+  signout: (request: Request) => Promise<Response>;
+  oauth?: (request: Request) => Promise<Response>;
+  verifyToken: (token: string) => Promise<TokenPayload | null>;
+  revokeRefreshTokens: (userId: string) => Promise<void>;
+}
+
+export interface AuthOptions {
+  mode?: 'node' | 'postgres';
+  /** postgres.js sql client — required when mode is 'postgres' */
+  sql?: any;
+  oauth?: { providers: OAuthProvider[] };
+  /** When set, auth responses also set HttpOnly cookies. `true` uses defaults. */
+  cookies?: CookieConfig;
+}
+
+export {
+  hashPassword,
+  verifyPassword,
+  BCRYPT_COST,
+  BCRYPT_MAX_BYTES,
+} from './passwords';
+import { hashPassword, verifyPassword } from './passwords';
+
+/**
+ * Create JWT auth handlers for signup, signin, refresh, and token verification.
+ *
+ * When `options.mode` is `'postgres'`, delegates password hashing and JWT signing
+ * to PostgreSQL functions via pgcrypto. Requires auth SQL functions from `@everystack/auth/sql`.
+ *
+ * When `schema.sessions` is provided, refresh tokens are stored as
+ * SHA-256 hashes in auth.sessions with one-time-use rotation.
+ * When omitted, refresh tokens are stateless JWTs (original behavior).
+ *
+ * @param db - Drizzle database instance
+ * @param schema - Object with `users`, `profiles`, and optional `sessions`/`credentials`/`identities` table references
+ * @param jwtSecret - Secret key for JWT signing (Uint8Array)
+ * @param options - Mode ('node' | 'postgres') and OAuth config
+ */
+export function createAuthHandlers(
+  db: any,
+  schema: { users: any; profiles: any; sessions?: any; credentials?: any; identities?: any },
+  jwtSecret: Uint8Array,
+  options?: AuthOptions
+): AuthHandlers {
+  if (options?.mode === 'postgres') {
+    return createPostgresAuthHandlers(db, schema, jwtSecret, options);
+  }
+
+  const { users, profiles } = schema;
+
+  const accessJwt = createJwt({
+    secret: jwtSecret,
+    hmac: hmacNode,
+    ttlSec: TOKEN_EXPIRY_SEC,
+  });
+  const refreshJwt = createJwt({
+    secret: jwtSecret,
+    hmac: hmacNode,
+    ttlSec: REFRESH_EXPIRY_SEC,
+  });
+
+  async function signToken(payload: TokenPayload): Promise<string> {
+    return accessJwt.sign(payload as unknown as Record<string, unknown>);
+  }
+
+  async function signRefreshToken(payload: { sub: string }): Promise<string> {
+    return refreshJwt.sign(payload as unknown as Record<string, unknown>);
+  }
+
+  return {
+    verifyToken: async (token: string): Promise<TokenPayload | null> => {
+      const claims = await accessJwt.verify(token);
+      return (claims as TokenPayload | null) ?? null;
+    },
+
+    signup: async (request: Request): Promise<Response> => {
+      const { email, password, username, displayName } = await request.json();
+
+      if (!email || !password || !username || !displayName) {
+        return Response.json(
+          { message: 'email, password, username, and displayName are required' },
+          { status: 400 }
+        );
+      }
+
+      const existing = await db
+        .select()
+        .from(users)
+        .where(eq(users.email, email))
+        .limit(1);
+      if (existing.length > 0) {
+        return Response.json(
+          { message: 'Email already registered' },
+          { status: 409 }
+        );
+      }
+
+      const passwordHash = await hashPassword(password);
+      const { user, profile } = await db.transaction(async (tx: any) => {
+        const [u] = await tx.insert(users).values({ email, passwordHash }).returning();
+        const [p] = await tx.insert(profiles).values({ id: u.id, username, displayName }).returning();
+        return { user: u, profile: p };
+      });
+
+      const token = await signToken({
+        sub: user.id,
+        email: user.email,
+        role: user.role ?? 'authenticated',
+      });
+      const refreshToken = schema.sessions
+        ? (await createRefreshToken(db, schema.sessions, user.id)).token
+        : await signRefreshToken({ sub: user.id });
+
+      return authResponse(
+        {
+          token,
+          refreshToken,
+          user: {
+            id: user.id,
+            email: user.email,
+            username: profile.username,
+            displayName: profile.displayName,
+            role: user.role ?? 'authenticated',
+          },
+        },
+        201,
+        options?.cookies,
+      );
+    },
+
+    signin: async (request: Request): Promise<Response> => {
+      const { email, password } = await request.json();
+
+      if (!email || !password) {
+        return Response.json(
+          { message: 'email and password are required' },
+          { status: 400 }
+        );
+      }
+
+      const [user] = await db
+        .select()
+        .from(users)
+        .where(eq(users.email, email))
+        .limit(1);
+      if (!user) {
+        return Response.json(
+          { message: 'Invalid email or password' },
+          { status: 401 }
+        );
+      }
+
+      const valid = await verifyPassword(password, user.passwordHash);
+      if (!valid) {
+        return Response.json(
+          { message: 'Invalid email or password' },
+          { status: 401 }
+        );
+      }
+
+      const [profile] = await db
+        .select()
+        .from(profiles)
+        .where(eq(profiles.id, user.id))
+        .limit(1);
+
+      const token = await signToken({
+        sub: user.id,
+        email: user.email,
+        role: user.role ?? 'authenticated',
+      });
+      const refreshToken = schema.sessions
+        ? (await createRefreshToken(db, schema.sessions, user.id)).token
+        : await signRefreshToken({ sub: user.id });
+
+      return authResponse(
+        {
+          token,
+          refreshToken,
+          user: {
+            id: user.id,
+            email: user.email,
+            username: profile?.username,
+            displayName: profile?.displayName,
+            role: user.role ?? 'authenticated',
+          },
+        },
+        200,
+        options?.cookies,
+      );
+    },
+
+    refresh: async (request: Request): Promise<Response> => {
+      // Read refresh token from JSON body (mobile) or cookie (web SSR)
+      let refreshToken: string | undefined;
+      try {
+        const body = await request.clone().json();
+        refreshToken = body?.refreshToken;
+      } catch {
+        // Empty body is fine — fall through to cookie
+      }
+      if (!refreshToken) {
+        refreshToken = getRefreshFromCookies(request.headers.get('cookie')) ?? undefined;
+      }
+      if (!refreshToken) {
+        return Response.json(
+          { message: 'refreshToken is required' },
+          { status: 400 }
+        );
+      }
+
+      if (schema.sessions) {
+        // DB-backed rotation path
+        try {
+          const result = await rotateRefreshToken(db, schema.sessions, refreshToken);
+
+          const [user] = await db
+            .select()
+            .from(users)
+            .where(eq(users.id, result.userId))
+            .limit(1);
+          if (!user) {
+            await revokeAllRefreshTokens(db, schema.sessions, result.userId);
+            return Response.json({ message: 'User not found' }, { status: 401 });
+          }
+
+          const token = await signToken({
+            sub: user.id,
+            email: user.email,
+            role: user.role ?? 'authenticated',
+          });
+
+          return authResponse(
+            { token, refreshToken: result.token },
+            200,
+            options?.cookies,
+          );
+        } catch (err) {
+          if (err instanceof TokenError) {
+            return Response.json(
+              { message: 'Invalid or expired refresh token' },
+              { status: 401 }
+            );
+          }
+          throw err;
+        }
+      } else {
+        // Legacy JWT-based path
+        try {
+          const payload = await refreshJwt.verify(refreshToken);
+          if (!payload) {
+            return Response.json({ message: 'Invalid refresh token' }, { status: 401 });
+          }
+          const userId = payload.sub as string;
+
+          const [user] = await db
+            .select()
+            .from(users)
+            .where(eq(users.id, userId))
+            .limit(1);
+          if (!user) {
+            return Response.json({ message: 'User not found' }, { status: 401 });
+          }
+
+          const token = await signToken({
+            sub: user.id,
+            email: user.email,
+            role: user.role ?? 'authenticated',
+          });
+          const newRefreshToken = await signRefreshToken({ sub: user.id });
+
+          return authResponse(
+            { token, refreshToken: newRefreshToken },
+            200,
+            options?.cookies,
+          );
+        } catch {
+          return Response.json(
+            { message: 'Invalid or expired refresh token' },
+            { status: 401 }
+          );
+        }
+      }
+    },
+
+    oauth: options?.oauth?.providers.length
+      ? async (request: Request): Promise<Response> => {
+          if (!schema.credentials || !schema.identities) {
+            return Response.json(
+              { message: 'OAuth not configured: credentials and identities tables required in schema' },
+              { status: 500 }
+            );
+          }
+
+          let body: { provider?: string; token?: string };
+          try {
+            body = await request.json();
+          } catch {
+            return Response.json(
+              { message: 'Invalid request body' },
+              { status: 400 }
+            );
+          }
+
+          const { provider: providerName, token } = body;
+          if (!providerName || !token) {
+            return Response.json(
+              { message: 'provider and token are required' },
+              { status: 400 }
+            );
+          }
+
+          const provider = options!.oauth!.providers.find(
+            (p) => p.name === providerName
+          );
+          if (!provider) {
+            return Response.json(
+              { message: `Unsupported provider: ${providerName}` },
+              { status: 400 }
+            );
+          }
+
+          const userInfo = await provider.verify(token);
+          if (!userInfo) {
+            return Response.json(
+              { message: 'Token verification failed' },
+              { status: 401 }
+            );
+          }
+
+          // Look up existing OAuth credential by (type='oauth', credentialId=providerUid)
+          // Join credentials → identities to get userId
+          const existingResults = await db
+            .select({
+              credentialId: schema.credentials.id,
+              userId: schema.identities.userId,
+            })
+            .from(schema.credentials)
+            .innerJoin(schema.identities, eq(schema.credentials.identityId, schema.identities.id))
+            .where(and(
+              eq(schema.credentials.type, 'oauth'),
+              eq(schema.credentials.credentialId, userInfo.uid),
+            ))
+            .limit(1);
+
+          const existingAccount = existingResults[0];
+
+          if (existingAccount) {
+            // Existing linked account — sign in the associated user
+            const [existingUser] = await db
+              .select()
+              .from(users)
+              .where(eq(users.id, existingAccount.userId))
+              .limit(1);
+
+            const [profile] = await db
+              .select()
+              .from(profiles)
+              .where(eq(profiles.id, existingAccount.userId))
+              .limit(1);
+
+            const accessToken = await signToken({
+              sub: existingUser.id,
+              email: existingUser.email,
+              role: existingUser.role ?? 'authenticated',
+            });
+            const refreshToken = schema.sessions
+              ? (await createRefreshToken(db, schema.sessions, existingUser.id)).token
+              : await signRefreshToken({ sub: existingUser.id });
+
+            return authResponse(
+              {
+                token: accessToken,
+                refreshToken,
+                user: {
+                  id: existingUser.id,
+                  email: existingUser.email,
+                  username: profile?.username,
+                  displayName: profile?.displayName,
+                  avatarUrl: profile?.avatarUrl,
+                  role: existingUser.role ?? 'authenticated',
+                },
+              },
+              200,
+              options?.cookies,
+            );
+          }
+
+          // New user — create account + identity + OAuth credential
+          const displayName = [userInfo.firstName, userInfo.lastName]
+            .filter(Boolean)
+            .join(' ') || userInfo.email.split('@')[0];
+          const username = userInfo.email.split('@')[0];
+
+          const { user, profile } = await db.transaction(async (tx: any) => {
+            const [u] = await tx
+              .insert(users)
+              .values({ email: userInfo.email, passwordHash: null })
+              .returning();
+
+            const [ident] = await tx
+              .insert(schema.identities)
+              .values({
+                type: 'user',
+                userId: u.id,
+                name: userInfo.email,
+              })
+              .returning();
+
+            await tx
+              .insert(schema.credentials)
+              .values({
+                type: 'oauth',
+                identityId: ident.id,
+                credentialId: userInfo.uid,
+                name: providerName,
+                metadata: { email: userInfo.email },
+              });
+
+            const [p] = await tx
+              .insert(profiles)
+              .values({
+                id: u.id,
+                username,
+                displayName,
+                avatarUrl: userInfo.avatarUrl || null,
+              })
+              .returning();
+
+            return { user: u, profile: p };
+          });
+
+          const accessToken = await signToken({
+            sub: user.id,
+            email: user.email,
+            role: user.role ?? 'authenticated',
+          });
+          const refreshToken = schema.sessions
+            ? (await createRefreshToken(db, schema.sessions, user.id)).token
+            : await signRefreshToken({ sub: user.id });
+
+          return authResponse(
+            {
+              token: accessToken,
+              refreshToken,
+              user: {
+                id: user.id,
+                email: user.email,
+                username: profile.username,
+                displayName: profile.displayName,
+                avatarUrl: profile.avatarUrl,
+                role: user.role ?? 'authenticated',
+              },
+            },
+            200,
+            options?.cookies,
+          );
+        }
+      : undefined,
+
+    signout: async (_request: Request): Promise<Response> => {
+      return signoutResponse(options?.cookies);
+    },
+
+    revokeRefreshTokens: async (userId: string): Promise<void> => {
+      if (schema.sessions) {
+        await revokeAllRefreshTokens(db, schema.sessions, userId);
+      }
+    },
+  };
+}

package/src/jwt/hmac-node.ts

@@ -0,0 +1,11 @@
+import { createHmac } from 'node:crypto';
+import type { HmacFn } from './hmac';
+
+/**
+ * HMAC-SHA256 via node:crypto. Synchronous under the hood; wrapped in a
+ * resolved promise to satisfy the async HmacFn contract.
+ */
+export const hmacNode: HmacFn = async (key, message) => {
+  const mac = createHmac('sha256', key).update(message).digest();
+  return new Uint8Array(mac.buffer, mac.byteOffset, mac.byteLength);
+};

package/src/jwt/hmac-web.ts

@@ -0,0 +1,17 @@
+import type { HmacFn } from './hmac';
+
+/**
+ * HMAC-SHA256 via Web Crypto (SubtleCrypto). Works in browsers, Workers,
+ * Deno, Bun, and Node 20+ (where SubtleCrypto is exposed on globalThis.crypto).
+ */
+export const hmacWeb: HmacFn = async (key, message) => {
+  const cryptoKey = await crypto.subtle.importKey(
+    'raw',
+    key as BufferSource,
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign']
+  );
+  const sig = await crypto.subtle.sign('HMAC', cryptoKey, message as BufferSource);
+  return new Uint8Array(sig);
+};

package/src/jwt/hmac.ts

@@ -0,0 +1,10 @@
+/**
+ * HMAC adapter contract.
+ *
+ * Both node:crypto and SubtleCrypto adapters implement this signature.
+ * Async-only to keep one seam for both runtimes.
+ */
+export type HmacFn = (
+  key: Uint8Array,
+  message: Uint8Array
+) => Promise<Uint8Array>;