@everystack/auth 0.4.2 → 0.4.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/auth",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "JWT authentication handlers, password hashing, and React auth context",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -22,42 +22,52 @@
   ],
   "exports": {
     ".": {
+      "source": "./src/index.ts",
       "types": "./src/index.ts",
       "default": "./src/index.ts"
     },
     "./client": {
+      "source": "./src/client/index.tsx",
       "types": "./src/client/index.tsx",
       "default": "./src/client/index.tsx"
     },
     "./api": {
+      "source": "./src/api.ts",
       "types": "./src/api.ts",
       "default": "./src/api.ts"
     },
     "./schema": {
+      "source": "./src/schema.ts",
       "types": "./src/schema.ts",
       "default": "./src/schema.ts"
     },
     "./models": {
+      "source": "./src/models/index.ts",
       "types": "./src/models/index.ts",
       "default": "./src/models/index.ts"
     },
     "./sql": {
+      "source": "./src/sql.ts",
       "types": "./src/sql.ts",
       "default": "./src/sql.ts"
     },
     "./postgres": {
+      "source": "./src/postgres.ts",
       "types": "./src/postgres.ts",
       "default": "./src/postgres.ts"
     },
     "./jwt": {
+      "source": "./src/jwt/index.ts",
       "types": "./src/jwt/index.ts",
       "default": "./src/jwt/index.ts"
     },
     "./jwt/node": {
+      "source": "./src/jwt/hmac-node.ts",
       "types": "./src/jwt/hmac-node.ts",
       "default": "./src/jwt/hmac-node.ts"
     },
     "./jwt/web": {
+      "source": "./src/jwt/hmac-web.ts",
       "types": "./src/jwt/hmac-web.ts",
       "default": "./src/jwt/hmac-web.ts"
     },
@@ -65,33 +75,39 @@
       "default": "./src/jwt/jwt.sql"
     },
     "./oauth": {
+      "source": "./src/oauth/index.ts",
       "types": "./src/oauth/index.ts",
       "default": "./src/oauth/index.ts"
     },
     "./cookies": {
+      "source": "./src/cookies.ts",
       "types": "./src/cookies.ts",
       "default": "./src/cookies.ts"
     },
     "./context": {
+      "source": "./src/context.ts",
       "types": "./src/context.ts",
       "default": "./src/context.ts"
     },
     "./cff": {
+      "source": "./src/cff/index.ts",
       "types": "./src/cff/index.ts",
       "default": "./src/cff/index.ts"
     },
     "./plugin": {
+      "source": "./src/plugin.ts",
       "types": "./src/plugin.ts",
       "default": "./src/plugin.ts"
     },
     "./testing": {
+      "source": "./src/testing.ts",
       "types": "./src/testing.ts",
       "default": "./src/testing.ts"
     }
   },
   "dependencies": {
     "bcryptjs": "3.0.3",
-    "@everystack/model": "0.4.12"
+    "@everystack/model": "0.4.17"
   },
   "peerDependencies": {
     "@everystack/api": ">=0.1.0",
@@ -120,7 +136,8 @@
     "postgres": "3.4.9",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/api": "0.4.0"
+    "@everystack/api": "0.4.0",
+    "@everystack/server": "0.4.26"
   },
   "scripts": {
     "test": "jest",

package/src/models/functions.ts

@@ -89,6 +89,7 @@ export const cleanupRefreshTokensFn = defineFunction('auth.cleanup_refresh_token
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_count INTEGER;
@@ -134,6 +135,7 @@ export const createOneTimeTokenFn = defineFunction('auth.create_one_time_token',
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_raw_token TEXT;
@@ -165,6 +167,7 @@ export const hashPasswordFn = defineFunction('auth.hash_password', {
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 BEGIN
   RETURN crypt(p_password, gen_salt('bf', 10));
@@ -178,6 +181,7 @@ export const issueRefreshTokenFn = defineFunction('auth.issue_refresh_token', {
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_raw_token TEXT;
@@ -265,6 +269,7 @@ export const oauthSignInFn = defineFunction('auth.oauth_sign_in', {
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_identity RECORD;
@@ -358,6 +363,7 @@ export const oauthSignInJwtFn = defineFunction('auth.oauth_sign_in_jwt', {
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_payload JSONB;
@@ -418,6 +424,7 @@ export const revokeRefreshTokensFn = defineFunction('auth.revoke_refresh_tokens'
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_count INTEGER;
@@ -458,6 +465,7 @@ export const signInFn = defineFunction('auth.sign_in', {
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_user RECORD;
@@ -502,6 +510,7 @@ export const signInJwtFn = defineFunction('auth.sign_in_jwt', {
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_payload JSONB;
@@ -556,6 +565,7 @@ export const signJwtFn = defineFunction('auth.sign_jwt', {
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_header TEXT;
@@ -601,6 +611,7 @@ export const signUpFn = defineFunction('auth.sign_up', {
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_user RECORD;
@@ -645,6 +656,7 @@ export const signUpJwtFn = defineFunction('auth.sign_up_jwt', {
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_payload JSONB;
@@ -794,6 +806,7 @@ export const verifyJwtFn = defineFunction('auth.verify_jwt', {
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_parts TEXT[];
@@ -853,6 +866,7 @@ export const verifyOneTimeTokenFn = defineFunction('auth.verify_one_time_token',
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_token_hash TEXT;
@@ -888,6 +902,7 @@ export const verifyPasswordFn = defineFunction('auth.verify_password', {
   language: 'plpgsql',
   security: 'definer',
   searchPath: ['auth', 'public', 'pg_temp'],
+  internal: true,
   body: sql`
 DECLARE
   v_normalized TEXT;

package/src/models/user.ts

@@ -51,6 +51,19 @@ export const User = defineModel('users', {
     updatedAt: field.timestamptz().defaultNow().notNull(),
   },
   constraints: [index('instanceId')],
+  // `deletedAt` on a user means a soft delete: the row stays, because auth rows are referenced
+  // by half the schema and destroying one breaks those references rather than cleaning them up.
+  // Every reader in this package already assumes that shape — the sign-in path and the auth
+  // SQL functions gate on `deleted_at IS NULL` rather than on the row's absence.
+  //
+  // Declared rather than defaulted because the admin `manage` ability below grants DELETE
+  // ("all actions"), which is the axis that matters here. It is INERT in both directions today,
+  // which is what makes it safe to add to a published package: no public read, so the compiled
+  // contract is unchanged (no fingerprint movement for any consumer); and `private: true` keeps
+  // this model out of the generic data API, so none of the handler's soft-delete behaviour
+  // applies either. It states the intent that the readers already depend on, and it stops the
+  // model from silently acquiring the opposite one.
+  softDelete: true,
   abilities: [
     can('manage', { role: 'admin' }),
     // Self-read, column-scoped: id/email/role of your own row, never the hash.