@everystack/auth 0.2.1 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/auth",
-  "version": "0.2.1",
+  "version": "0.2.4",
   "description": "JWT authentication handlers, password hashing, and React auth context",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/client/index.tsx

@@ -11,7 +11,7 @@
  *   const { user, token, signIn, signUp, signOut, isLoading } = useAuth();
  */
 
-import React, { createContext, useContext, useState, useEffect, useCallback } from 'react';
+import React, { createContext, useContext, useState, useEffect, useCallback, useRef } from 'react';
 import { refreshAuthToken } from '../api';
 
 export interface AuthUser {
@@ -81,11 +81,26 @@ export function isTokenExpired(token: string): boolean {
   } catch { return true; }
 }
 
-export function AuthProvider({ children }: { children: React.ReactNode }): React.ReactElement {
+export interface AuthProviderProps {
+  children: React.ReactNode;
+  /**
+   * Called after a successful auth transition — the seam for product-analytics
+   * emitters (e.g. createAnalyticsClient().track('login')). Optional; kept generic
+   * so the auth package never depends on the analytics client.
+   */
+  onAuthEvent?: (event: 'login' | 'signup' | 'logout', user: AuthUser | null) => void;
+}
+
+export function AuthProvider({ children, onAuthEvent }: AuthProviderProps): React.ReactElement {
   const [user, setUser] = useState<AuthUser | null>(null);
   const [token, setToken] = useState<string | null>(null);
   const [isLoading, setIsLoading] = useState(true);
 
+  // Ref-backed so signIn/signUp/signOut stay stable (no dep churn) yet always
+  // call the latest handler.
+  const onAuthEventRef = useRef(onAuthEvent);
+  onAuthEventRef.current = onAuthEvent;
+
   useEffect(() => {
     const init = async () => {
       const savedToken = storage.getToken();
@@ -129,6 +144,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }): React
     storage.save(body.token, body.refreshToken, body.user);
     setToken(body.token);
     setUser(body.user);
+    onAuthEventRef.current?.('login', body.user);
   }, []);
 
   const signUp = useCallback(async (email: string, password: string, username: string, displayName: string) => {
@@ -147,11 +163,13 @@ export function AuthProvider({ children }: { children: React.ReactNode }): React
     storage.save(body.token, body.refreshToken, body.user);
     setToken(body.token);
     setUser(body.user);
+    onAuthEventRef.current?.('signup', body.user);
   }, []);
 
   const signOut = useCallback(() => {
     // Clear server-side cookies (best-effort, don't block UI)
     fetch('/api/auth/signout', { method: 'POST' }).catch(() => {});
+    onAuthEventRef.current?.('logout', storage.getUser());
     storage.clear();
     setToken(null);
     setUser(null);

package/src/index.ts

@@ -87,6 +87,10 @@ export interface AuthHandlers {
   oauth?: (request: Request) => Promise<Response>;
   verifyToken: (token: string) => Promise<TokenPayload | null>;
   revokeRefreshTokens: (userId: string) => Promise<void>;
+  confirmEmail?: (request: Request) => Promise<Response>;
+  forgotPassword?: (request: Request) => Promise<Response>;
+  resetPassword?: (request: Request) => Promise<Response>;
+  changePassword?: (request: Request) => Promise<Response>;
 }
 
 /**
@@ -110,6 +114,11 @@ export interface OAuthCallbacks {
   }>;
 }
 
+export interface TokenOperations {
+  create: (userId: string, type: string, relatesTo: string) => Promise<string>;
+  verify: (token: string, type: string) => Promise<{ userId: string; relatesTo: string }>;
+}
+
 export interface AuthOptions {
   mode?: 'node' | 'postgres';
   /** postgres.js sql client — required when mode is 'postgres' */
@@ -135,6 +144,15 @@ export interface AuthOptions {
   /** Callback to add extra claims (client_id, aud) during token signing.
    *  Receives base claims and the original request; returns extra claims to merge. */
   enrichClaims?: EnrichClaimsFn;
+  /** One-time token operations for email confirmation and password recovery.
+   *  Required for confirmEmail, forgotPassword, and resetPassword handlers. */
+  tokens?: TokenOperations;
+  /** Called after successful signup when tokens are configured. App sends confirmation email. */
+  onConfirmationRequired?: (user: { id: string; email: string }, token: string) => Promise<void>;
+  /** Called on forgot-password — app sends recovery email. */
+  onRecoveryRequired?: (user: { id: string; email: string }, token: string) => Promise<void>;
+  /** Called after email confirmed via one-time token — app updates user record. */
+  onEmailConfirmed?: (userId: string) => Promise<void>;
 }
 
 export {
@@ -162,6 +180,186 @@ function csrfCheck(request: Request, cookies?: CookieConfig): Response | null {
   return validateCsrfOrigin(request, cookies.allowedOrigins);
 }
 
+/**
+ * Add mode-independent email confirmation and password management handlers.
+ * Called after base handlers are created (works with both node and postgres modes).
+ */
+function addEmailPasswordFlows(
+  handlers: AuthHandlers,
+  db: any,
+  users: any,
+  options?: AuthOptions,
+): void {
+  if (options?.tokens) {
+    handlers.confirmEmail = async (request: Request): Promise<Response> => {
+      const csrfError = csrfCheck(request, options?.cookies);
+      if (csrfError) return csrfError;
+
+      let body: any;
+      try {
+        body = await request.json();
+      } catch {
+        return Response.json({ message: 'Invalid request body' }, { status: 400 });
+      }
+
+      const { token } = body;
+      if (!token) {
+        return Response.json({ message: 'token is required' }, { status: 400 });
+      }
+
+      try {
+        const result = await options.tokens!.verify(token, 'confirmation');
+        if (options.onEmailConfirmed) {
+          await options.onEmailConfirmed(result.userId);
+        }
+        return Response.json({ confirmed: true });
+      } catch {
+        return Response.json({ message: 'Invalid or expired token' }, { status: 401 });
+      }
+    };
+
+    handlers.forgotPassword = async (request: Request): Promise<Response> => {
+      const csrfError = csrfCheck(request, options?.cookies);
+      if (csrfError) return csrfError;
+
+      let body: any;
+      try {
+        body = await request.json();
+      } catch {
+        return Response.json({ message: 'Invalid request body' }, { status: 400 });
+      }
+
+      const { email } = body;
+      if (!email) {
+        return Response.json({ message: 'email is required' }, { status: 400 });
+      }
+
+      const [user] = await db.select().from(users).where(eq(users.email, email)).limit(1);
+
+      if (user) {
+        try {
+          const token = await options.tokens!.create(user.id, 'recovery', email);
+          if (options.onRecoveryRequired) {
+            await options.onRecoveryRequired({ id: user.id, email: user.email }, token);
+          }
+        } catch {
+          // Swallow — never reveal whether user exists
+        }
+      } else {
+        // Timing safety: consume roughly the same time as the success path
+        await verifyPassword('dummy', DUMMY_BCRYPT_HASH);
+      }
+
+      return Response.json({ sent: true });
+    };
+
+    handlers.resetPassword = async (request: Request): Promise<Response> => {
+      const csrfError = csrfCheck(request, options?.cookies);
+      if (csrfError) return csrfError;
+
+      let body: any;
+      try {
+        body = await request.json();
+      } catch {
+        return Response.json({ message: 'Invalid request body' }, { status: 400 });
+      }
+
+      const { token, password } = body;
+      if (!token || !password) {
+        return Response.json(
+          { message: 'token and password are required' },
+          { status: 400 },
+        );
+      }
+
+      let result: { userId: string; relatesTo: string };
+      try {
+        result = await options.tokens!.verify(token, 'recovery');
+      } catch {
+        return Response.json({ message: 'Invalid or expired token' }, { status: 401 });
+      }
+
+      const hash = await hashPassword(password);
+      await db.update(users).set(withPassword(users, {}, hash)).where(eq(users.id, result.userId));
+      await handlers.revokeRefreshTokens(result.userId);
+
+      return Response.json({ reset: true });
+    };
+  }
+
+  handlers.changePassword = async (request: Request): Promise<Response> => {
+    const csrfError = csrfCheck(request, options?.cookies);
+    if (csrfError) return csrfError;
+
+    const authHeader = request.headers.get('authorization');
+    if (!authHeader?.startsWith('Bearer ')) {
+      return Response.json({ message: 'Authentication required' }, { status: 401 });
+    }
+
+    const claims = await handlers.verifyToken(authHeader.slice(7));
+    if (!claims) {
+      return Response.json({ message: 'Invalid token' }, { status: 401 });
+    }
+
+    let body: any;
+    try {
+      body = await request.json();
+    } catch {
+      return Response.json({ message: 'Invalid request body' }, { status: 400 });
+    }
+
+    const { currentPassword, newPassword } = body;
+    if (!currentPassword || !newPassword) {
+      return Response.json(
+        { message: 'currentPassword and newPassword are required' },
+        { status: 400 },
+      );
+    }
+
+    const [user] = await db.select().from(users).where(eq(users.id, claims.sub)).limit(1);
+    if (!user) {
+      return Response.json({ message: 'User not found' }, { status: 404 });
+    }
+
+    const existingHash = getPasswordHash(user);
+    if (!existingHash) {
+      return Response.json(
+        { message: 'Password change not available for this account' },
+        { status: 400 },
+      );
+    }
+
+    const valid = await verifyPassword(currentPassword, existingHash);
+    if (!valid) {
+      return Response.json({ message: 'Current password is incorrect' }, { status: 401 });
+    }
+
+    const hash = await hashPassword(newPassword);
+    await db.update(users).set(withPassword(users, {}, hash)).where(eq(users.id, claims.sub));
+    await handlers.revokeRefreshTokens(claims.sub);
+
+    return Response.json({ changed: true });
+  };
+
+  // Wrap signup to trigger confirmation callback
+  if (options?.onConfirmationRequired && options?.tokens) {
+    const originalSignup = handlers.signup;
+    handlers.signup = async (request: Request): Promise<Response> => {
+      const response = await originalSignup(request);
+      if (response.status === 201) {
+        try {
+          const body = await response.clone().json();
+          const token = await options.tokens!.create(body.user.id, 'confirmation', body.user.email);
+          await options.onConfirmationRequired!({ id: body.user.id, email: body.user.email }, token);
+        } catch {
+          // Don't fail signup if confirmation email fails
+        }
+      }
+      return response;
+    };
+  }
+}
+
 /**
  * Create JWT auth handlers for signup, signin, refresh, and token verification.
  *
@@ -192,7 +390,9 @@ export function createAuthHandlers(
   options?: AuthOptions
 ): AuthHandlers {
   if (options?.mode === 'postgres') {
-    return createPostgresAuthHandlers(db, schema, jwtSecret, options);
+    const handlers = createPostgresAuthHandlers(db, schema, jwtSecret, options);
+    addEmailPasswordFlows(handlers, db, schema.users, options);
+    return handlers;
   }
 
   const { users, profiles } = schema;
@@ -224,7 +424,7 @@ export function createAuthHandlers(
     return refreshJwt.sign(payload as unknown as Record<string, unknown>);
   }
 
-  return {
+  const handlers: AuthHandlers = {
     verifyToken: async (token: string): Promise<TokenPayload | null> => {
       const claims = await accessJwt.verify(token);
       return (claims as TokenPayload | null) ?? null;
@@ -753,4 +953,7 @@ export function createAuthHandlers(
       }
     },
   };
+
+  addEmailPasswordFlows(handlers, db, users, options);
+  return handlers;
 }

package/src/plugin.ts

@@ -117,6 +117,10 @@ interface AuthContext extends PluginContext {
     signin: (req: Request) => Promise<Response>;
     refresh: (req: Request) => Promise<Response>;
     signout: (req: Request) => Promise<Response>;
+    confirmEmail?: (req: Request) => Promise<Response>;
+    forgotPassword?: (req: Request) => Promise<Response>;
+    resetPassword?: (req: Request) => Promise<Response>;
+    changePassword?: (req: Request) => Promise<Response>;
   };
   enrichClaimsRef?: { current: EnrichClaimsFn | null };
 }
@@ -172,45 +176,69 @@ export function authPlugin(options: AuthPluginOptions = {}): Plugin {
 
     // --- Wire enrichClaims ref ---
     const authCtx = ctx as AuthContext;
-    if (authCtx.enrichClaimsRef && clientCallbacks) {
+    if (authCtx.enrichClaimsRef && (clientCallbacks || options.audience)) {
       authCtx.enrichClaimsRef.current = async (
         baseClaims: Record<string, unknown>,
         request: Request,
       ): Promise<Record<string, unknown>> => {
-        // Check baseClaims first (refresh path — client_id from session data)
-        let clientId = baseClaims.client_id as string | undefined;
-
-        // Fall back to request body (signin/signup path)
-        if (!clientId) {
-          try {
-            const body = await request.clone().json();
-            clientId = body?.client_id;
-          } catch {
-            // No JSON body or no client_id
+        if (clientCallbacks) {
+          // Check baseClaims first (refresh path — client_id from session data)
+          let clientId = baseClaims.client_id as string | undefined;
+
+          // Fall back to request body (signin/signup path)
+          if (!clientId) {
+            try {
+              const body = await request.clone().json();
+              clientId = body?.client_id;
+            } catch {
+              // No JSON body or no client_id
+            }
           }
-        }
-
-        if (!clientId) return {};
 
-        const client = await clientCallbacks.resolve(clientId);
-        if (!client || !client.active) return {};
+          if (clientId) {
+            // An explicit client_id is an assertion of client-credential auth:
+            // unknown or revoked clients get no claims, so under an audience
+            // config their tokens fail verification — never a silent downgrade
+            // to first-party.
+            const client = await clientCallbacks.resolve(clientId);
+            if (!client || !client.active) return {};
+
+            return {
+              client_id: clientId,
+              aud: client.audience ?? options.audience,
+            };
+          }
+        }
 
-        return {
-          client_id: clientId,
-          aud: client.audience ?? options.audience,
-        };
+        // First-party signin/refresh: tokens this app issues for its own
+        // users carry the app audience — the audience layer rejects any
+        // token without it, including the ones we mint ourselves.
+        return options.audience ? { aud: options.audience } : {};
       };
     }
 
     // --- Build contribution ---
-    const contribution: PluginContribution = {
-      routes: [
-        { path: `${basePath}/signup`, method: 'POST', exact: true, handler: auth.signup },
-        { path: `${basePath}/signin`, method: 'POST', exact: true, handler: auth.signin },
-        { path: `${basePath}/refresh`, method: 'POST', exact: true, handler: auth.refresh },
-        { path: `${basePath}/signout`, method: 'POST', exact: true, handler: auth.signout },
-      ],
-    };
+    const routes: Route[] = [
+      { path: `${basePath}/signup`, method: 'POST', exact: true, handler: auth.signup },
+      { path: `${basePath}/signin`, method: 'POST', exact: true, handler: auth.signin },
+      { path: `${basePath}/refresh`, method: 'POST', exact: true, handler: auth.refresh },
+      { path: `${basePath}/signout`, method: 'POST', exact: true, handler: auth.signout },
+    ];
+
+    if (auth.confirmEmail) {
+      routes.push({ path: `${basePath}/confirm-email`, method: 'POST', exact: true, handler: auth.confirmEmail });
+    }
+    if (auth.forgotPassword) {
+      routes.push({ path: `${basePath}/forgot-password`, method: 'POST', exact: true, handler: auth.forgotPassword });
+    }
+    if (auth.resetPassword) {
+      routes.push({ path: `${basePath}/reset-password`, method: 'POST', exact: true, handler: auth.resetPassword });
+    }
+    if (auth.changePassword) {
+      routes.push({ path: `${basePath}/change-password`, method: 'POST', exact: true, handler: auth.changePassword });
+    }
+
+    const contribution: PluginContribution = { routes };
 
     // --- Client management actions ---
     if (clientCallbacks) {