@everystack/auth 0.4.3 → 0.4.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/CHANGELOG.md +128 -0
  2. package/package.json +22 -5
  3. package/src/models/functions.ts +15 -0
package/CHANGELOG.md ADDED
@@ -0,0 +1,128 @@
1
+ # Changelog
2
+
3
+ All notable changes to `@everystack/auth` are documented here.
4
+
5
+ Format based on [Keep a Changelog](https://keepachangelog.com/).
6
+
7
+ ## [0.4.5] - 2026-09-16
8
+
9
+ ### Added
10
+
11
+ - auto-generated changelogs from conventional commits
12
+ - automate the version-drift check — a manual note is not a gate
13
+
14
+ ## [0.4.4] - 2026-08-15
15
+
16
+ ### Fixed
17
+
18
+ - compile owner-scoped `manage` to write policies + add `internal` flag for functions
19
+
20
+ ## [0.4.3] - 2026-08-12
21
+
22
+ ### Fixed
23
+
24
+ - link workspace siblings instead of resolving them from the registry
25
+ - the softDelete guard asked about visibility, not about DELETE
26
+ - close the gate findings — the rule was still one grant short
27
+
28
+ ## [0.4.2] - 2026-08-04
29
+
30
+ ### Added
31
+
32
+ - declare the SECURITY DEFINER functions, so db:reconcile can see them
33
+ - writtenBy: 'functions' must have functions, checked at composition
34
+
35
+ ## [0.4.1] - 2026-08-04
36
+
37
+ ### Fixed
38
+
39
+ - pin React to a single 19.2.0 across the monorepo
40
+ - guard npm publish on workspace-dep packages; cli 0.3.8
41
+ - republish @everystack/auth as 0.4.0, aligned to model 0.4.x
42
+ - revoke PUBLIC EXECUTE on the seven functions that shipped open
43
+
44
+ ## [0.3.1] - 2026-06-30
45
+
46
+ ### Added
47
+
48
+ - token-gated wrapper functions confirm_email + reset_password
49
+ - anon-safe session wrappers sign_in_session + sign_up_session
50
+ - least-priv signin + signup via anon session wrappers
51
+ - least-priv refresh — rotate as anon, read identity via RLS
52
+ - create profile as an invoker insert under RLS, atomically
53
+ - wire least-priv auth — session wrappers, grants, RLS
54
+ - least-priv confirmEmail + resetPassword via token-gated wrappers
55
+ - least-priv changePassword via auth.change_password wrapper
56
+ - forgot-password + signup-confirmation mint on the worker
57
+ - own the seven auth tables as v3 Models
58
+ - export package Modules
59
+
60
+ ### Fixed
61
+
62
+ - pin search_path on the core SECURITY DEFINER functions
63
+ - extensionless relative imports (repo convention; Metro resolution)
64
+ - generateAuthGrantsSQL — the generated migration grants its own roles
65
+
66
+ ## [0.2.5] - 2026-06-18
67
+
68
+ ### Fixed
69
+
70
+ - fail closed on cookie auth without allowedOrigins
71
+
72
+ ## [0.2.4] - 2026-06-17
73
+
74
+ ### Added
75
+
76
+ - IAM auth for web deploys, replace Sharp layer with SST bundling
77
+ - add DB-backed refresh token rotation
78
+ - add OAuth sign-in with pluggable providers
79
+ - wire RBAC end-to-end from database to admin guard
80
+ - add mode: postgres — pgcrypto auth via postgres.js
81
+ - runtime-agnostic HS256 JWT with conformance vectors
82
+ - SQL twin (pgcrypto) — jwt_sign / jwt_sign_raw / jwt_verify
83
+ - drop jose, native RS256+JWKS OIDC verifier
84
+ - cff generator — verify HS256 JWTs at the edge
85
+ - bcrypt cost 12 password hashing (OWASP-aligned)
86
+ - cookie-based SSR authentication
87
+ - compact CFF verifier + dead code stripping for 10KB budget
88
+ - add plugin architecture for composable Lambda handlers
89
+ - add auth plugin with layered security and client credentials
90
+ - replace publicPaths with requireAuth pattern
91
+ - add @everystack/auth/testing — JWT helpers, role tokens, and test user seeding
92
+ - add CSRF Origin validation, remove sessions alias
93
+ - default Supabase-compatible schema, example app migration, docs
94
+ - add email confirmation, password recovery, and change-password flows
95
+ - product-analytics producer — track() + /track route + auth emitters
96
+ - consolidate drizzle migrations + logging schema updates
97
+
98
+ ### Fixed
99
+
100
+ - transactional signup, shared handler factory, drop dead routes
101
+ - normalize bcrypt prefix and strip MIME newlines in SQL functions
102
+ - configurable bcrypt cost, default 10 (OWASP minimum)
103
+ - require crypto module in CFF verifiers, strip routeSite
104
+ - update CFF verifier tests for crypto require
105
+ - resolve 7 high-priority security findings from red team audit
106
+ - resolve 7 medium-priority security findings from red team audit
107
+ - resolve 9 low/medium-priority security findings from red team audit
108
+ - resolve auth test failures and logging build error
109
+ - pin all dependency versions to lockfile-resolved values
110
+ - accept JWT tokens without typ header (RFC 7519 §5.1)
111
+ - worker function discovery and log group resolution for SQS subscribers
112
+ - stamp the app audience on first-party tokens
113
+ - skip edge auth for non-API paths when tableFromPath is enabled
114
+
115
+ ### Changed
116
+
117
+ - extract server infra into @expo-stack/server + @expo-stack/auth packages
118
+ - migrate all package schemas to everyschema canonical tables
119
+ - drop type module from all packages, switch Jest to CJS mode
120
+ - consolidate Jest configs into shared base
121
+ - replace sessions STI with dedicated refresh_tokens table
122
+
123
+ ### Documentation
124
+
125
+ - rewrite documentation around V1→V2→V3 progressive complexity model
126
+ - update all documentation to reflect full API surface
127
+ - document zero-dep envelope, edge verification, SQL twin
128
+ - prepare documentation for open-source release
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@everystack/auth",
3
- "version": "0.4.3",
3
+ "version": "0.4.5",
4
4
  "description": "JWT authentication handlers, password hashing, and React auth context",
5
5
  "license": "AGPL-3.0-only",
6
6
  "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -18,46 +18,57 @@
18
18
  },
19
19
  "files": [
20
20
  "src",
21
- "README.md"
21
+ "README.md",
22
+ "CHANGELOG.md"
22
23
  ],
23
24
  "exports": {
24
25
  ".": {
26
+ "source": "./src/index.ts",
25
27
  "types": "./src/index.ts",
26
28
  "default": "./src/index.ts"
27
29
  },
28
30
  "./client": {
31
+ "source": "./src/client/index.tsx",
29
32
  "types": "./src/client/index.tsx",
30
33
  "default": "./src/client/index.tsx"
31
34
  },
32
35
  "./api": {
36
+ "source": "./src/api.ts",
33
37
  "types": "./src/api.ts",
34
38
  "default": "./src/api.ts"
35
39
  },
36
40
  "./schema": {
41
+ "source": "./src/schema.ts",
37
42
  "types": "./src/schema.ts",
38
43
  "default": "./src/schema.ts"
39
44
  },
40
45
  "./models": {
46
+ "source": "./src/models/index.ts",
41
47
  "types": "./src/models/index.ts",
42
48
  "default": "./src/models/index.ts"
43
49
  },
44
50
  "./sql": {
51
+ "source": "./src/sql.ts",
45
52
  "types": "./src/sql.ts",
46
53
  "default": "./src/sql.ts"
47
54
  },
48
55
  "./postgres": {
56
+ "source": "./src/postgres.ts",
49
57
  "types": "./src/postgres.ts",
50
58
  "default": "./src/postgres.ts"
51
59
  },
52
60
  "./jwt": {
61
+ "source": "./src/jwt/index.ts",
53
62
  "types": "./src/jwt/index.ts",
54
63
  "default": "./src/jwt/index.ts"
55
64
  },
56
65
  "./jwt/node": {
66
+ "source": "./src/jwt/hmac-node.ts",
57
67
  "types": "./src/jwt/hmac-node.ts",
58
68
  "default": "./src/jwt/hmac-node.ts"
59
69
  },
60
70
  "./jwt/web": {
71
+ "source": "./src/jwt/hmac-web.ts",
61
72
  "types": "./src/jwt/hmac-web.ts",
62
73
  "default": "./src/jwt/hmac-web.ts"
63
74
  },
@@ -65,33 +76,39 @@
65
76
  "default": "./src/jwt/jwt.sql"
66
77
  },
67
78
  "./oauth": {
79
+ "source": "./src/oauth/index.ts",
68
80
  "types": "./src/oauth/index.ts",
69
81
  "default": "./src/oauth/index.ts"
70
82
  },
71
83
  "./cookies": {
84
+ "source": "./src/cookies.ts",
72
85
  "types": "./src/cookies.ts",
73
86
  "default": "./src/cookies.ts"
74
87
  },
75
88
  "./context": {
89
+ "source": "./src/context.ts",
76
90
  "types": "./src/context.ts",
77
91
  "default": "./src/context.ts"
78
92
  },
79
93
  "./cff": {
94
+ "source": "./src/cff/index.ts",
80
95
  "types": "./src/cff/index.ts",
81
96
  "default": "./src/cff/index.ts"
82
97
  },
83
98
  "./plugin": {
99
+ "source": "./src/plugin.ts",
84
100
  "types": "./src/plugin.ts",
85
101
  "default": "./src/plugin.ts"
86
102
  },
87
103
  "./testing": {
104
+ "source": "./src/testing.ts",
88
105
  "types": "./src/testing.ts",
89
106
  "default": "./src/testing.ts"
90
107
  }
91
108
  },
92
109
  "dependencies": {
93
110
  "bcryptjs": "3.0.3",
94
- "@everystack/model": "0.4.16"
111
+ "@everystack/model": "0.4.18"
95
112
  },
96
113
  "peerDependencies": {
97
114
  "@everystack/api": ">=0.1.0",
@@ -120,8 +137,8 @@
120
137
  "postgres": "3.4.9",
121
138
  "ts-jest": "29.4.9",
122
139
  "typescript": "5.9.3",
123
- "@everystack/server": "0.4.20",
124
- "@everystack/api": "0.4.0"
140
+ "@everystack/api": "0.4.0",
141
+ "@everystack/server": "0.4.30"
125
142
  },
126
143
  "scripts": {
127
144
  "test": "jest",
package/src/models/functions.ts CHANGED
@@ -89,6 +89,7 @@ export const cleanupRefreshTokensFn = defineFunction('auth.cleanup_refresh_token
89
89
  language: 'plpgsql',
90
90
  security: 'definer',
91
91
  searchPath: ['auth', 'public', 'pg_temp'],
92
+ internal: true,
92
93
  body: sql`
93
94
  DECLARE
94
95
  v_count INTEGER;
@@ -134,6 +135,7 @@ export const createOneTimeTokenFn = defineFunction('auth.create_one_time_token',
134
135
  language: 'plpgsql',
135
136
  security: 'definer',
136
137
  searchPath: ['auth', 'public', 'pg_temp'],
138
+ internal: true,
137
139
  body: sql`
138
140
  DECLARE
139
141
  v_raw_token TEXT;
@@ -165,6 +167,7 @@ export const hashPasswordFn = defineFunction('auth.hash_password', {
165
167
  language: 'plpgsql',
166
168
  security: 'definer',
167
169
  searchPath: ['auth', 'public', 'pg_temp'],
170
+ internal: true,
168
171
  body: sql`
169
172
  BEGIN
170
173
  RETURN crypt(p_password, gen_salt('bf', 10));
@@ -178,6 +181,7 @@ export const issueRefreshTokenFn = defineFunction('auth.issue_refresh_token', {
178
181
  language: 'plpgsql',
179
182
  security: 'definer',
180
183
  searchPath: ['auth', 'public', 'pg_temp'],
184
+ internal: true,
181
185
  body: sql`
182
186
  DECLARE
183
187
  v_raw_token TEXT;
@@ -265,6 +269,7 @@ export const oauthSignInFn = defineFunction('auth.oauth_sign_in', {
265
269
  language: 'plpgsql',
266
270
  security: 'definer',
267
271
  searchPath: ['auth', 'public', 'pg_temp'],
272
+ internal: true,
268
273
  body: sql`
269
274
  DECLARE
270
275
  v_identity RECORD;
@@ -358,6 +363,7 @@ export const oauthSignInJwtFn = defineFunction('auth.oauth_sign_in_jwt', {
358
363
  language: 'plpgsql',
359
364
  security: 'definer',
360
365
  searchPath: ['auth', 'public', 'pg_temp'],
366
+ internal: true,
361
367
  body: sql`
362
368
  DECLARE
363
369
  v_payload JSONB;
@@ -418,6 +424,7 @@ export const revokeRefreshTokensFn = defineFunction('auth.revoke_refresh_tokens'
418
424
  language: 'plpgsql',
419
425
  security: 'definer',
420
426
  searchPath: ['auth', 'public', 'pg_temp'],
427
+ internal: true,
421
428
  body: sql`
422
429
  DECLARE
423
430
  v_count INTEGER;
@@ -458,6 +465,7 @@ export const signInFn = defineFunction('auth.sign_in', {
458
465
  language: 'plpgsql',
459
466
  security: 'definer',
460
467
  searchPath: ['auth', 'public', 'pg_temp'],
468
+ internal: true,
461
469
  body: sql`
462
470
  DECLARE
463
471
  v_user RECORD;
@@ -502,6 +510,7 @@ export const signInJwtFn = defineFunction('auth.sign_in_jwt', {
502
510
  language: 'plpgsql',
503
511
  security: 'definer',
504
512
  searchPath: ['auth', 'public', 'pg_temp'],
513
+ internal: true,
505
514
  body: sql`
506
515
  DECLARE
507
516
  v_payload JSONB;
@@ -556,6 +565,7 @@ export const signJwtFn = defineFunction('auth.sign_jwt', {
556
565
  language: 'plpgsql',
557
566
  security: 'definer',
558
567
  searchPath: ['auth', 'public', 'pg_temp'],
568
+ internal: true,
559
569
  body: sql`
560
570
  DECLARE
561
571
  v_header TEXT;
@@ -601,6 +611,7 @@ export const signUpFn = defineFunction('auth.sign_up', {
601
611
  language: 'plpgsql',
602
612
  security: 'definer',
603
613
  searchPath: ['auth', 'public', 'pg_temp'],
614
+ internal: true,
604
615
  body: sql`
605
616
  DECLARE
606
617
  v_user RECORD;
@@ -645,6 +656,7 @@ export const signUpJwtFn = defineFunction('auth.sign_up_jwt', {
645
656
  language: 'plpgsql',
646
657
  security: 'definer',
647
658
  searchPath: ['auth', 'public', 'pg_temp'],
659
+ internal: true,
648
660
  body: sql`
649
661
  DECLARE
650
662
  v_payload JSONB;
@@ -794,6 +806,7 @@ export const verifyJwtFn = defineFunction('auth.verify_jwt', {
794
806
  language: 'plpgsql',
795
807
  security: 'definer',
796
808
  searchPath: ['auth', 'public', 'pg_temp'],
809
+ internal: true,
797
810
  body: sql`
798
811
  DECLARE
799
812
  v_parts TEXT[];
@@ -853,6 +866,7 @@ export const verifyOneTimeTokenFn = defineFunction('auth.verify_one_time_token',
853
866
  language: 'plpgsql',
854
867
  security: 'definer',
855
868
  searchPath: ['auth', 'public', 'pg_temp'],
869
+ internal: true,
856
870
  body: sql`
857
871
  DECLARE
858
872
  v_token_hash TEXT;
@@ -888,6 +902,7 @@ export const verifyPasswordFn = defineFunction('auth.verify_password', {
888
902
  language: 'plpgsql',
889
903
  security: 'definer',
890
904
  searchPath: ['auth', 'public', 'pg_temp'],
905
+ internal: true,
891
906
  body: sql`
892
907
  DECLARE
893
908
  v_normalized TEXT;