@focura/auth-core 1.0.0 → 1.1.1

package/dist/index.d.ts

@@ -165,6 +165,54 @@ interface SessionMetadata {
 type AuditEventType = "LOGIN_SUCCESS" | "LOGIN_FAILED" | "LOGIN_BLOCKED" | "LOGOUT" | "LOGOUT_ALL_DEVICES" | "TOKEN_REFRESHED" | "TOKEN_REVOKED" | "TOKEN_EXPIRED" | "TOKEN_VERSION_MISMATCH" | "TOKEN_REPLAY_DETECTED" | "EXCHANGE_SUCCESS" | "EXCHANGE_FAILED" | "SSE_CONNECTED" | "SSE_DISCONNECTED" | "ACCOUNT_LOCKED" | "TOTP_VERIFIED" | "TOTP_FAILED" | "PERMISSION_DENIED" | "EMAIL_NOT_VERIFIED" | "SESSION_BOUND" | "SESSION_REBOUND" | "SESSION_HIJACK_DETECTED" | "SESSION_TIMEOUT" | "SESSION_REVOKED" | "SESSIONS_REVOKED" | "MAX_SESSIONS_REACHED" | "DEVICE_MISMATCH" | "SUSPICIOUS_IP_CHANGE" | "CSRF_VALIDATION_FAILED" | "UNAUTHORIZED_ACCESS" | "RATE_LIMIT_EXCEEDED" | "MALWARE_DETECTED" | "SUSPICIOUS_ACTIVITY" | "DATA_EXPORT" | "DATA_DELETION" | "SENSITIVE_DATA_ACCESS" | "WORKSPACE_CREATED" | "WORKSPACE_DELETED" | "MEMBER_ADDED" | "MEMBER_REMOVED" | "ROLE_CHANGED" | "SUBSCRIPTION_CREATED" | "SUBSCRIPTION_CANCELLED" | "PAYMENT_FAILED";
 type AuditSeverity = "info" | "warn" | "critical";
 
+declare const DEFAULTS: {
+    readonly keyPrefix: "focura:";
+    readonly issuer: "focura-app";
+    readonly audience: "focura-backend";
+    readonly accessTokenExpiry: "15m";
+    readonly refreshTokenExpiry: "7d";
+    readonly sseTokenExpiry: "30s";
+    readonly currentVersion: 1;
+    readonly maxConcurrentSessions: 5;
+    readonly sessionMetadataTtl: number;
+    readonly lockoutMaxFailures: 10;
+    readonly lockoutSeconds: number;
+    readonly lockoutWindowSeconds: number;
+    readonly refreshLockTtlSeconds: 45;
+    readonly refreshDedupeTtlSeconds: 30;
+    readonly revokedSessionTtl: number;
+    readonly inactivityTimeout: number;
+    readonly absoluteTimeout: number;
+};
+declare function resolveConfig(raw: AuthCoreConfig): {
+    keyPrefix: string;
+    issuer: string;
+    audience: string;
+    accessTokenExpiry: string;
+    refreshTokenExpiry: string;
+    sseTokenExpiry: string;
+    currentVersion: number;
+    maxConcurrentSessions: number;
+    sessionMetadataTtl: number;
+    lockoutMaxFailures: number;
+    lockoutSeconds: number;
+    lockoutWindowSeconds: number;
+    inactivityTimeout: number;
+    absoluteTimeout: number;
+    redis: RedisAdapter;
+    userStore: UserStore;
+    hmacSecret: string;
+    jwt: TokenConfig;
+    cache?: CacheAdapter;
+    auditLogger?: AuditLogger;
+    observability?: ObservabilitySink;
+    errors?: ErrorFactory;
+    lockout?: LockoutConfig;
+    session?: SessionConfig;
+};
+type ResolvedConfig = ReturnType<typeof resolveConfig>;
+declare const AUDIT_SEVERITY: Record<AuditEventType, AuditSeverity>;
+
 declare class TokenManager {
     private readonly privateKey;
     private readonly publicKey;
@@ -228,16 +276,6 @@ declare class TokenRevocation {
     isSessionRevoked(sessionId: string): Promise<boolean>;
 }
 
-declare class RefreshLock {
-    private readonly redis;
-    private readonly prefix;
-    constructor(redis: RedisAdapter, prefix?: string);
-    private lockKey;
-    acquire(sessionId: string): Promise<boolean>;
-    release(sessionId: string): Promise<void>;
-    isLocked(sessionId: string): Promise<boolean>;
-}
-
 declare class SessionManager {
     private readonly redis;
     private readonly tokenRevocation;
@@ -261,40 +299,6 @@ declare class SessionManager {
     }>>;
 }
 
-declare function looksLikeServerToServerUA(userAgent: string): boolean;
-declare function looksLikeServerToServerRequest(req: {
-    headers: Record<string, string | string[] | undefined>;
-}): boolean;
-declare function normalizeUserAgent(userAgent: string): string;
-declare function generateDeviceFingerprint(req: {
-    headers: Record<string, string | string[] | undefined>;
-}): string;
-declare function getClientIp(req: {
-    ip?: string;
-    headers: Record<string, string | string[] | undefined>;
-    socket?: {
-        remoteAddress?: string;
-    };
-}): string;
-declare function createSessionMetadata(req: {
-    ip?: string;
-    headers: Record<string, string | string[] | undefined>;
-    socket?: {
-        remoteAddress?: string;
-    };
-}): SessionMetadata;
-declare function isPrivateIp(ip: string): boolean;
-declare function validateSessionBinding(req: {
-    headers: Record<string, string | string[] | undefined>;
-    ip?: string;
-    socket?: {
-        remoteAddress?: string;
-    };
-}, storedMetadata: SessionMetadata): {
-    valid: boolean;
-    reason?: string;
-};
-
 declare class AccountLockout {
     private readonly redis;
     private readonly maxFailures;
@@ -333,6 +337,139 @@ declare class TotpManager {
     verify(token: string, secret: string): Promise<boolean>;
 }
 
+interface ExchangeInput {
+    userId: string;
+    email: string;
+    role: string;
+    sessionId?: string;
+    timestamp: number;
+    signature: string;
+}
+interface ExchangeResult extends TokenPair {
+    sseToken: string;
+    sessionId: string;
+}
+interface VerifyTokenInput {
+    token: string;
+    ipAddress?: string;
+    userAgent?: string;
+}
+interface VerifyTokenResult {
+    user: User;
+    payload: {
+        id: string;
+        email: string;
+        role: string;
+        jti: string;
+        sessionId?: string;
+    };
+}
+interface RefreshInput {
+    refreshToken: string;
+}
+interface RefreshResult extends TokenPair {
+    sseToken: string;
+}
+interface LogoutInput {
+    accessToken?: string;
+    accessTokenJti?: string;
+    userId?: string;
+    sessionId?: string;
+    logoutAll?: boolean;
+}
+interface TwoFactorSetupResult {
+    secret: string;
+    uri: string;
+}
+interface TwoFactorVerifyInput {
+    token: string;
+    secret: string;
+}
+declare class AuthService {
+    readonly tokenManager: TokenManager;
+    readonly tokenRevocation: TokenRevocation;
+    readonly sessionManager: SessionManager;
+    readonly accountLockout: AccountLockout;
+    readonly totpManager: TotpManager;
+    readonly audit: AuditLog;
+    readonly errors: ErrorFactory;
+    private readonly config;
+    private readonly userStore;
+    constructor(rawConfig: AuthCoreConfig);
+    getConfig(): ResolvedConfig;
+    getRedis(): AuthCoreConfig["redis"];
+    exchange(input: ExchangeInput): Promise<ExchangeResult>;
+    verifyToken(input: VerifyTokenInput): Promise<VerifyTokenResult>;
+    refresh(input: RefreshInput): Promise<RefreshResult>;
+    logout(input: LogoutInput): Promise<void>;
+    getActiveSessions(userId: string): Promise<{
+        sessionId: string;
+        deviceInfo: string;
+        ipAddress?: string;
+        lastActivity: string;
+        createdAt: string;
+    }[]>;
+    revokeSession(userId: string, sessionId: string): Promise<void>;
+    generateTwoFactor(): TwoFactorSetupResult;
+    createTwoFactorUri(secret: string, email: string): string;
+    verifyTwoFactor(input: TwoFactorVerifyInput): Promise<boolean>;
+    recordLoginFailure(email: string): Promise<{
+        locked: boolean;
+        unlocksAt?: Date;
+        attempts: number;
+    }>;
+    clearLoginFailures(email: string): Promise<void>;
+    isAccountLocked(email: string): Promise<{
+        locked: boolean;
+        unlocksAt?: Date;
+    }>;
+    log(event: AuditEventType, data: Record<string, unknown>): void;
+}
+
+declare class RefreshLock {
+    private readonly redis;
+    private readonly prefix;
+    constructor(redis: RedisAdapter, prefix?: string);
+    private lockKey;
+    acquire(sessionId: string): Promise<boolean>;
+    release(sessionId: string): Promise<void>;
+    isLocked(sessionId: string): Promise<boolean>;
+}
+
+declare function looksLikeServerToServerUA(userAgent: string): boolean;
+declare function looksLikeServerToServerRequest(req: {
+    headers: Record<string, string | string[] | undefined>;
+}): boolean;
+declare function normalizeUserAgent(userAgent: string): string;
+declare function generateDeviceFingerprint(req: {
+    headers: Record<string, string | string[] | undefined>;
+}): string;
+declare function getClientIp(req: {
+    ip?: string;
+    headers: Record<string, string | string[] | undefined>;
+    socket?: {
+        remoteAddress?: string;
+    };
+}): string;
+declare function createSessionMetadata(req: {
+    ip?: string;
+    headers: Record<string, string | string[] | undefined>;
+    socket?: {
+        remoteAddress?: string;
+    };
+}): SessionMetadata;
+declare function isPrivateIp(ip: string): boolean;
+declare function validateSessionBinding(req: {
+    headers: Record<string, string | string[] | undefined>;
+    ip?: string;
+    socket?: {
+        remoteAddress?: string;
+    };
+}, storedMetadata: SessionMetadata): {
+    valid: boolean;
+    reason?: string;
+};
+
 declare class SessionTimeoutManager implements SessionLifecycle {
     private readonly redis;
     private readonly inactivityTimeout;
@@ -352,54 +489,6 @@ declare class SessionTimeoutManager implements SessionLifecycle {
     updateActivity(sessionId: string): Promise<boolean>;
 }
 
-declare const DEFAULTS: {
-    readonly keyPrefix: "focura:";
-    readonly issuer: "focura-app";
-    readonly audience: "focura-backend";
-    readonly accessTokenExpiry: "15m";
-    readonly refreshTokenExpiry: "7d";
-    readonly sseTokenExpiry: "30s";
-    readonly currentVersion: 1;
-    readonly maxConcurrentSessions: 5;
-    readonly sessionMetadataTtl: number;
-    readonly lockoutMaxFailures: 10;
-    readonly lockoutSeconds: number;
-    readonly lockoutWindowSeconds: number;
-    readonly refreshLockTtlSeconds: 45;
-    readonly refreshDedupeTtlSeconds: 30;
-    readonly revokedSessionTtl: number;
-    readonly inactivityTimeout: number;
-    readonly absoluteTimeout: number;
-};
-declare function resolveConfig(raw: AuthCoreConfig): {
-    keyPrefix: string;
-    issuer: string;
-    audience: string;
-    accessTokenExpiry: string;
-    refreshTokenExpiry: string;
-    sseTokenExpiry: string;
-    currentVersion: number;
-    maxConcurrentSessions: number;
-    sessionMetadataTtl: number;
-    lockoutMaxFailures: number;
-    lockoutSeconds: number;
-    lockoutWindowSeconds: number;
-    inactivityTimeout: number;
-    absoluteTimeout: number;
-    redis: RedisAdapter;
-    userStore: UserStore;
-    hmacSecret: string;
-    jwt: TokenConfig;
-    cache?: CacheAdapter;
-    auditLogger?: AuditLogger;
-    observability?: ObservabilitySink;
-    errors?: ErrorFactory;
-    lockout?: LockoutConfig;
-    session?: SessionConfig;
-};
-type ResolvedConfig = ReturnType<typeof resolveConfig>;
-declare const AUDIT_SEVERITY: Record<AuditEventType, AuditSeverity>;
-
 interface AuthRequest {
     user?: {
         id: string;
@@ -590,4 +679,4 @@ declare class ValidationError extends Error {
 
 declare const defaultErrors: ErrorFactory;
 
-export { AUDIT_SEVERITY, AccountBannedError, AccountLockout, type AuditEventType, AuditLog, type AuditLogger, type AuditSeverity, type AuthCoreConfig, type AuthRequest, BadRequestError, type CacheAdapter, DEFAULTS, type DeviceFingerprint, EmailNotVerifiedError, type ErrorFactory, ForbiddenError, InvalidTokenError, type LockoutConfig, MiddlewareFactory, type ObservabilitySink, type RateLimiterFactory, type RedisAdapter, type RedisPipeline, RefreshLock, type ResolvedConfig, type SessionConfig, SessionHijackError, type SessionLifecycle, SessionManager, type SessionMetadata, SessionTimeoutManager, type TokenConfig, TokenExpiredError, TokenManager, type TokenPair, type TokenPayload, TokenRevocation, TokenRevokedError, TotpManager, UnauthorizedError, type User, type UserStore, ValidationError, type ZodSchema, createSessionMetadata, defaultErrors, exchangeSchema, generateDeviceFingerprint, getClientIp, isPrivateIp, logoutSchema, looksLikeServerToServerRequest, looksLikeServerToServerUA, normalizeUserAgent, refreshSchema, resolveConfig, validateSessionBinding };
+export { AUDIT_SEVERITY, AccountBannedError, AccountLockout, type AuditEventType, AuditLog, type AuditLogger, type AuditSeverity, type AuthCoreConfig, type RefreshResult as AuthRefreshResult, type AuthRequest, AuthService, BadRequestError, type CacheAdapter, DEFAULTS, type DeviceFingerprint, EmailNotVerifiedError, type ErrorFactory, type ExchangeInput, type ExchangeResult, ForbiddenError, InvalidTokenError, type LockoutConfig, type LogoutInput, MiddlewareFactory, type ObservabilitySink, type RateLimiterFactory, type RedisAdapter, type RedisPipeline, type RefreshInput, RefreshLock, type ResolvedConfig, type SessionConfig, SessionHijackError, type SessionLifecycle, SessionManager, type SessionMetadata, SessionTimeoutManager, type TokenConfig, TokenExpiredError, TokenManager, type TokenPair, type TokenPayload, TokenRevocation, TokenRevokedError, TotpManager, type TwoFactorSetupResult, type TwoFactorVerifyInput, UnauthorizedError, type User, type UserStore, ValidationError, type VerifyTokenInput, type VerifyTokenResult, type ZodSchema, createSessionMetadata, defaultErrors, exchangeSchema, generateDeviceFingerprint, getClientIp, isPrivateIp, logoutSchema, looksLikeServerToServerRequest, looksLikeServerToServerUA, normalizeUserAgent, refreshSchema, resolveConfig, validateSessionBinding };