@everystack/auth 0.2.5 → 0.2.6

package/README.md

@@ -247,4 +247,8 @@ Part of [everystack](https://github.com/scalable-technology/everystack) — a se
 
 ## License
 
-MIT
+[AGPL-3.0-only](https://www.gnu.org/licenses/agpl-3.0.html) © Scalable Technology, Inc.
+
+A commercial license is available for organizations that cannot or do not wish to
+comply with the AGPL-3.0 terms. For commercial licensing, contact
+licensing@scalable.technology.

package/package.json

@@ -1,8 +1,18 @@
 {
   "name": "@everystack/auth",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "JWT authentication handlers, password hashing, and React auth context",
   "license": "AGPL-3.0-only",
+  "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/scalable-technology/everystack.git",
+    "directory": "packages/auth"
+  },
+  "homepage": "https://github.com/scalable-technology/everystack#readme",
+  "bugs": {
+    "url": "https://github.com/scalable-technology/everystack/issues"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -75,11 +85,6 @@
       "default": "./src/testing.ts"
     }
   },
-  "scripts": {
-    "test": "jest",
-    "build": "tsc --build",
-    "lint": "tsc --noEmit"
-  },
   "dependencies": {
     "bcryptjs": "3.0.3"
   },
@@ -101,7 +106,6 @@
     }
   },
   "devDependencies": {
-    "@everystack/api": "workspace:*",
     "@types/bcryptjs": "3.0.0",
     "@types/jest": "29.5.14",
     "@types/node": "22.19.18",
@@ -110,6 +114,12 @@
     "jest": "29.7.0",
     "postgres": "3.4.9",
     "ts-jest": "29.4.9",
-    "typescript": "5.9.3"
+    "typescript": "5.9.3",
+    "@everystack/api": "0.2.9"
+  },
+  "scripts": {
+    "test": "jest",
+    "build": "tsc --build",
+    "lint": "tsc --noEmit"
   }
-}
+}

package/src/index.ts

@@ -147,10 +147,22 @@ export interface AuthOptions {
   /** One-time token operations for email confirmation and password recovery.
    *  Required for confirmEmail, forgotPassword, and resetPassword handlers. */
   tokens?: TokenOperations;
-  /** Called after successful signup when tokens are configured. App sends confirmation email. */
+  /** Called after successful signup when tokens are configured. App sends confirmation email.
+   *  Receives a token MINTED IN THE API — owner-only, so this breaks under least-privilege.
+   *  Postgres least-priv path uses `onConfirmationRequested` instead (mint on the worker). */
   onConfirmationRequired?: (user: { id: string; email: string }, token: string) => Promise<void>;
-  /** Called on forgot-password — app sends recovery email. */
+  /** Called on forgot-password with a token MINTED IN THE API (owner-only — breaks under
+   *  least-privilege). Postgres least-priv path uses `onRecoveryRequested` instead. */
   onRecoveryRequired?: (user: { id: string; email: string }, token: string) => Promise<void>;
+  /** Least-privilege confirmation: called after signup with only the new user's identity.
+   *  The API does NOT mint a token — the app enqueues a job; the privileged worker mints the
+   *  one-time token and sends the email. Takes precedence over onConfirmationRequired. */
+  onConfirmationRequested?: (user: { id: string; email: string }) => Promise<void>;
+  /** Least-privilege recovery: called on forgot-password with ONLY the email. The API does
+   *  not read the user table or mint a token — it enqueues a job; the privileged worker
+   *  looks up the user, mints the recovery token, and sends the email. Always responds the
+   *  same to the client (no user enumeration). Takes precedence over onRecoveryRequired. */
+  onRecoveryRequested?: (email: string) => Promise<void>;
   /** Called after email confirmed via one-time token — app updates user record. */
   onEmailConfirmed?: (userId: string) => Promise<void>;
 }
@@ -209,6 +221,11 @@ function assertSafeCookieConfig(cookies: CookieConfig | undefined): void {
 /**
  * Add mode-independent email confirmation and password management handlers.
  * Called after base handlers are created (works with both node and postgres modes).
+ *
+ * Uses `??=` so a handler already provided by the base (e.g. the least-privilege
+ * postgres confirmEmail/resetPassword that run via SECDEF wrappers under withRole)
+ * is NOT overwritten by the generic owner-connection version. Node mode provides
+ * none of these, so it gets the generic implementations.
  */
 function addEmailPasswordFlows(
   handlers: AuthHandlers,
@@ -217,7 +234,7 @@ function addEmailPasswordFlows(
   options?: AuthOptions,
 ): void {
   if (options?.tokens) {
-    handlers.confirmEmail = async (request: Request): Promise<Response> => {
+    handlers.confirmEmail ??= async (request: Request): Promise<Response> => {
       const csrfError = csrfCheck(request, options?.cookies);
       if (csrfError) return csrfError;
 
@@ -244,7 +261,7 @@ function addEmailPasswordFlows(
       }
     };
 
-    handlers.forgotPassword = async (request: Request): Promise<Response> => {
+    handlers.forgotPassword ??= async (request: Request): Promise<Response> => {
       const csrfError = csrfCheck(request, options?.cookies);
       if (csrfError) return csrfError;
 
@@ -279,7 +296,7 @@ function addEmailPasswordFlows(
       return Response.json({ sent: true });
     };
 
-    handlers.resetPassword = async (request: Request): Promise<Response> => {
+    handlers.resetPassword ??= async (request: Request): Promise<Response> => {
       const csrfError = csrfCheck(request, options?.cookies);
       if (csrfError) return csrfError;
 
@@ -313,7 +330,7 @@ function addEmailPasswordFlows(
     };
   }
 
-  handlers.changePassword = async (request: Request): Promise<Response> => {
+  handlers.changePassword ??= async (request: Request): Promise<Response> => {
     const csrfError = csrfCheck(request, options?.cookies);
     if (csrfError) return csrfError;