@forjakit/auth-fastify 0.1.0

package/README.md

@@ -0,0 +1,527 @@
+# @forjakit/auth-fastify
+
+Fastify plugin that exposes `@forjakit/auth` as a REST API. Registers auth routes with tenant isolation, input validation, rate limiting, optional cookie-based token delivery, and structured error responses. Also provides standalone middleware factories for protecting routes in other plugins.
+
+## Installation
+
+```bash
+pnpm add @forjakit/auth-fastify
+```
+
+Peer dependencies: `@forjakit/auth`, `fastify >= 5`, `zod >= 3.24`.
+
+## Plugin Registration
+
+```ts
+import Fastify from "fastify";
+import { authPlugin } from "@forjakit/auth-fastify";
+import { createAuthService } from "@forjakit/auth";
+
+const app = Fastify();
+
+const service = createAuthService({
+  storage: myStorage,
+  tokens: { secret: process.env.JWT_SECRET! },
+  roles: myRoles,
+  defaultRole: "client",
+});
+
+app.register(authPlugin, {
+  service,
+  prefix: "/auth",
+  tenantResolver: (req) => req.headers["x-tenant-id"] as string,
+  rateLimiter: myRateLimiter,
+  onPasswordResetToken: async (token, { email, tenantId }) => {
+    await sendResetEmail(email, token);
+  },
+  onVerificationToken: async (token, { email, tenantId }) => {
+    await sendVerificationEmail(email, token);
+  },
+});
+```
+
+### AuthPluginOptions
+
+| Option | Type | Required | Default | Description |
+| ------ | ---- | -------- | ------- | ----------- |
+| `service` | `AuthService` | Yes | -- | Service instance from `createAuthService` |
+| `prefix` | `string` | No | `""` | Route prefix (e.g., `"/auth"`) |
+| `tenantResolver` | `(req: FastifyRequest) => string` | No | `x-tenant-id` header or subdomain | Extracts tenant ID from the request |
+| `rateLimiter` | `RateLimiter` | No | None | Applied to register, login, and password reset routes |
+| `rateLimitKeyResolver` | `(req: FastifyRequest) => string` | No | `req.ip` | Extracts the rate limit key from a request |
+| `onPasswordResetToken` | `(token, { email, tenantId }) => Promise<void>` | No | -- | Callback to send the reset email |
+| `onVerificationToken` | `(token, { email, tenantId }) => Promise<void>` | No | -- | Callback to send the verification email |
+| `cookie` | `AuthCookieOptions` | No | Disabled | Cookie-based token delivery configuration |
+
+## Routes
+
+All routes are relative to the configured `prefix`. Tenant ID is resolved from every request via `tenantResolver`.
+
+| Method | Path | Rate Limited | Description |
+| ------ | ---- | ------------ | ----------- |
+| `POST` | `/register` | Yes | Register a new user |
+| `POST` | `/login` | Yes | Login with email and password |
+| `POST` | `/refresh` | No | Exchange refresh token for new token pair |
+| `GET` | `/me` | No | Get the authenticated user |
+| `POST` | `/logout` | No | Blacklist the access token |
+| `POST` | `/request-password-reset` | Yes | Request a password reset token |
+| `POST` | `/reset-password` | No | Reset password with token |
+| `POST` | `/verify-email` | No | Verify email with token |
+| `POST` | `/resend-verification` | No | Resend verification email |
+
+### POST /register
+
+Creates a new user and returns tokens.
+
+**Request body:**
+
+```json
+{
+  "email": "user@example.com",
+  "password": "Str0ng!Pass",
+  "name": "Jane Doe",
+  "role": "client"
+}
+```
+
+Note: `tenantId` is injected by the plugin from `tenantResolver`, not from the request body. `role` is optional and defaults to the configured `defaultRole`.
+
+**Response:** `201 Created`
+
+```json
+{
+  "user": { "id": "...", "email": "user@example.com", "name": "Jane Doe", "role": "client", "tenantId": "..." },
+  "accessToken": "eyJ...",
+  "refreshToken": "eyJ..."
+}
+```
+
+If email verification is enabled and `onVerificationToken` is provided, the callback is invoked with the raw verification token. The `verificationToken` is not included in the response.
+
+### POST /login
+
+Authenticates a user.
+
+**Request body:**
+
+```json
+{
+  "email": "user@example.com",
+  "password": "Str0ng!Pass"
+}
+```
+
+**Response:** `200 OK`
+
+```json
+{
+  "user": { "id": "...", "email": "...", "name": "...", "role": "...", "tenantId": "..." },
+  "accessToken": "eyJ...",
+  "refreshToken": "eyJ..."
+}
+```
+
+### POST /refresh
+
+Exchanges a refresh token for a new token pair.
+
+**Request body:**
+
+```json
+{
+  "refreshToken": "eyJ..."
+}
+```
+
+**Response:** `200 OK`
+
+```json
+{
+  "accessToken": "eyJ...",
+  "refreshToken": "eyJ..."
+}
+```
+
+In cookie mode, the refresh token is read from the cookie. The response body contains `{ "message": "Tokens refreshed" }` instead of the tokens.
+
+### GET /me
+
+Returns the authenticated user. Requires a valid access token in the `Authorization: Bearer <token>` header or access token cookie.
+
+**Response:** `200 OK`
+
+```json
+{
+  "id": "...",
+  "email": "user@example.com",
+  "name": "Jane Doe",
+  "role": "client",
+  "tenantId": "..."
+}
+```
+
+### POST /logout
+
+Blacklists the access token. Requires `tokenBlacklist` to be configured on the auth service.
+
+**Response:** `204 No Content`
+
+In cookie mode, token cookies are cleared.
+
+### POST /request-password-reset
+
+Generates a reset token and invokes `onPasswordResetToken` if the user exists. Always returns the same response to avoid leaking whether the email is registered.
+
+**Request body:**
+
+```json
+{
+  "email": "user@example.com"
+}
+```
+
+**Response:** `200 OK`
+
+```json
+{
+  "message": "If the email exists, a reset link has been sent"
+}
+```
+
+### POST /reset-password
+
+Validates the reset token and updates the password.
+
+**Request body:**
+
+```json
+{
+  "token": "abc123...",
+  "password": "NewStr0ng!Pass"
+}
+```
+
+**Response:** `200 OK`
+
+```json
+{
+  "message": "Password has been reset"
+}
+```
+
+### POST /verify-email
+
+Validates the verification token and marks the email as verified.
+
+**Request body:**
+
+```json
+{
+  "token": "abc123..."
+}
+```
+
+**Response:** `200 OK`
+
+```json
+{
+  "message": "Email verified"
+}
+```
+
+### POST /resend-verification
+
+Generates a new verification token and invokes `onVerificationToken` if the user exists.
+
+**Request body:**
+
+```json
+{
+  "email": "user@example.com"
+}
+```
+
+**Response:** `200 OK`
+
+```json
+{
+  "message": "If the email exists, a verification link has been sent"
+}
+```
+
+## Cookie-Based Token Delivery
+
+When enabled, tokens are delivered as `HttpOnly` cookies instead of in the response body. The plugin automatically registers `@fastify/cookie`.
+
+```ts
+app.register(authPlugin, {
+  service,
+  cookie: {
+    enabled: true,
+    secure: true,           // default: true in production
+    sameSite: "lax",        // default: "lax"
+    domain: ".example.com", // default: request hostname
+    path: "/",              // default: "/"
+    accessTokenName: "access_token",   // default: "access_token"
+    refreshTokenName: "refresh_token", // default: "refresh_token"
+  },
+});
+```
+
+### AuthCookieOptions
+
+| Option | Type | Required | Default | Description |
+| ------ | ---- | -------- | ------- | ----------- |
+| `enabled` | `boolean` | Yes | -- | Enable cookie-based token delivery |
+| `secure` | `boolean` | No | `true` in production | Set the `Secure` flag (HTTPS only) |
+| `sameSite` | `"strict" \| "lax" \| "none"` | No | `"lax"` | SameSite attribute |
+| `domain` | `string` | No | Request hostname | Cookie domain |
+| `path` | `string` | No | `"/"` | Cookie path |
+| `accessTokenName` | `string` | No | `"access_token"` | Cookie name for the access token |
+| `refreshTokenName` | `string` | No | `"refresh_token"` | Cookie name for the refresh token |
+
+**How it works:**
+
+- On **login/register**, tokens are set as `HttpOnly` cookies. The response body contains the user data but not the tokens.
+- On **refresh**, the refresh token is read from the cookie. New tokens are set as cookies. The response body contains `{ "message": "Tokens refreshed" }`.
+- On **logout** and **401 errors**, token cookies are cleared (set to empty with `maxAge: 0`).
+- **Token extraction** always checks cookies first, then falls back to the `Authorization: Bearer` header.
+
+Cookie max ages: access token = 15 minutes, refresh token = 7 days.
+
+## Middleware
+
+Standalone middleware factories for protecting routes in other plugins.
+
+### `authenticate(service, cookieAccessTokenName?)`
+
+Fastify preHandler that authenticates the request via Bearer token or cookie and populates `request.authUser`.
+
+```ts
+import { authenticate } from "@forjakit/auth-fastify";
+
+app.get("/protected", { preHandler: authenticate(service) }, async (req) => {
+  const user = req.authUser;
+  return { message: `Hello ${user.name}` };
+});
+```
+
+### `requireRole(service, ...roles)`
+
+Fastify preHandler that authenticates and checks if the user has one of the required roles.
+
+```ts
+import { requireRole } from "@forjakit/auth-fastify";
+
+app.delete("/admin-only", { preHandler: requireRole(service, "admin") }, async (req) => {
+  return { message: "Admin action performed" };
+});
+```
+
+### `createCookieMiddleware(service, accessTokenName)`
+
+Creates middleware factories pre-configured with cookie support. Use this when cookie mode is enabled to avoid passing the cookie name to every middleware call.
+
+```ts
+import { createCookieMiddleware } from "@forjakit/auth-fastify";
+
+const { authenticate, requireRole } = createCookieMiddleware(service, "access_token");
+
+app.get("/profile", { preHandler: authenticate() }, handler);
+app.delete("/admin", { preHandler: requireRole("admin") }, handler);
+```
+
+### request.authUser
+
+All middleware populates `request.authUser` with the authenticated user object:
+
+```ts
+interface FastifyRequest {
+  authUser?: {
+    id: string;
+    email: string;
+    name: string;
+    role: string;
+    tenantId: string;
+  };
+}
+```
+
+## Tenant Resolution
+
+By default, the plugin resolves the tenant ID using this strategy:
+
+1. Read the `x-tenant-id` header.
+2. Fall back to the first subdomain of the request hostname (e.g., `acme.example.com` -> `"acme"`).
+3. Throw `AuthError` with code `TENANT_REQUIRED` (400) if neither is available.
+
+Provide a custom resolver to extract the tenant ID from any source:
+
+```ts
+app.register(authPlugin, {
+  service,
+  tenantResolver: (req) => {
+    // From JWT claims, database lookup, etc.
+    return (req as any).user.tenantId;
+  },
+});
+```
+
+## Rate Limiting
+
+The plugin accepts a `RateLimiter` interface (defined in `@forjakit/auth`). Rate limiting is applied to `register`, `login`, and `request-password-reset` routes.
+
+```ts
+app.register(authPlugin, {
+  service,
+  rateLimiter: myRedisRateLimiter,
+  rateLimitKeyResolver: (req) => req.ip, // default
+});
+```
+
+When rate limited, the response includes a `Retry-After` header and returns:
+
+```json
+{
+  "error": "RATE_LIMITED",
+  "message": "Too many requests, retry after 60 seconds"
+}
+```
+
+HTTP status: `429`.
+
+## Error Handling
+
+The plugin registers a scoped Fastify error handler that converts known errors into structured JSON responses.
+
+### AuthError Response
+
+```json
+{
+  "error": "INVALID_CREDENTIALS",
+  "message": "Invalid email or password"
+}
+```
+
+HTTP status codes are taken directly from the `AuthError.statusCode` property. See the core package documentation for the full error code table.
+
+### ZodError Response (Validation Failures)
+
+```json
+{
+  "error": "VALIDATION_ERROR",
+  "message": "Invalid input",
+  "details": [
+    { "field": "password", "message": "Password must be at least 8 characters" },
+    { "field": "email", "message": "Invalid email" }
+  ]
+}
+```
+
+HTTP status: `400`.
+
+### Unhandled Errors
+
+Any error that is not an `AuthError` or `ZodError` is re-thrown to Fastify's default error handler.
+
+## Email Callbacks
+
+The plugin does not send emails. Instead, it invokes optional callbacks with the raw token and user info. You provide the email delivery logic.
+
+```ts
+app.register(authPlugin, {
+  service,
+  onPasswordResetToken: async (token, { email, tenantId }) => {
+    const resetUrl = `https://app.example.com/reset-password?token=${token}`;
+    await emailService.send(email, "Reset your password", resetUrl);
+  },
+  onVerificationToken: async (token, { email, tenantId }) => {
+    const verifyUrl = `https://app.example.com/verify-email?token=${token}`;
+    await emailService.send(email, "Verify your email", verifyUrl);
+  },
+});
+```
+
+## Full Integration Example
+
+```ts
+import Fastify from "fastify";
+import { createAuthService } from "@forjakit/auth";
+import {
+  createPrismaAuthStorage,
+  createPrismaTokenBlacklist,
+  createPrismaRefreshTokenStore,
+  createPrismaPasswordResetStorage,
+  createPrismaPasswordUpdateStorage,
+  createPrismaEmailVerificationStorage,
+} from "@forjakit/auth-prisma";
+import { authPlugin, authenticate, requireRole } from "@forjakit/auth-fastify";
+import { PrismaClient } from "@prisma/client";
+import { z } from "zod";
+
+const prisma = new PrismaClient();
+const app = Fastify({ logger: true });
+
+const roles = z.enum(["admin", "professional", "client"]);
+
+const service = createAuthService({
+  storage: createPrismaAuthStorage(prisma.user),
+  tokens: { secret: process.env.JWT_SECRET! },
+  roles,
+  defaultRole: "client",
+  tokenBlacklist: createPrismaTokenBlacklist(prisma.tokenBlacklist),
+  refreshTokenStore: createPrismaRefreshTokenStore(prisma.refreshToken),
+  passwordReset: {
+    storage: createPrismaPasswordResetStorage(prisma.passwordResetToken),
+    passwordStorage: createPrismaPasswordUpdateStorage(prisma.user),
+  },
+  emailVerification: {
+    storage: createPrismaEmailVerificationStorage(prisma.emailVerificationToken, prisma.user),
+  },
+});
+
+app.register(authPlugin, {
+  service,
+  prefix: "/auth",
+  cookie: { enabled: true, secure: true },
+  onPasswordResetToken: async (token, { email }) => {
+    await sendResetEmail(email, token);
+  },
+  onVerificationToken: async (token, { email }) => {
+    await sendVerificationEmail(email, token);
+  },
+});
+
+// Protect other routes
+app.get("/api/profile", { preHandler: authenticate(service) }, async (req) => {
+  return req.authUser;
+});
+
+app.delete("/api/admin/users/:id", { preHandler: requireRole(service, "admin") }, async (req) => {
+  // admin-only logic
+});
+
+app.listen({ port: 3000 });
+```
+
+With this setup, the following routes are available:
+
+```
+POST /auth/register
+POST /auth/login
+POST /auth/refresh
+GET  /auth/me
+POST /auth/logout
+POST /auth/request-password-reset
+POST /auth/reset-password
+POST /auth/verify-email
+POST /auth/resend-verification
+```
+
+## Exports
+
+```ts
+export { authPlugin } from "@forjakit/auth-fastify";
+export type { AuthPluginOptions, AuthCookieOptions } from "@forjakit/auth-fastify";
+export { authenticate, requireRole, createCookieMiddleware } from "@forjakit/auth-fastify";
+```

package/dist/index.d.ts

@@ -0,0 +1,94 @@
+import { FastifyRequest, FastifyInstance, FastifyReply } from 'fastify';
+import { AuthService, RateLimiter } from '@forjakit/auth';
+
+declare module "fastify" {
+    interface FastifyRequest {
+        authUser?: Record<string, unknown>;
+    }
+}
+/** Cookie configuration for secure token delivery. */
+interface AuthCookieOptions {
+    /** Enable cookie-based token delivery. When true, tokens are set as HttpOnly cookies instead of returned in the response body. */
+    enabled: boolean;
+    /** Whether to set the Secure flag (HTTPS only). Defaults to `true` in production. */
+    secure?: boolean;
+    /** SameSite attribute for cookies. Defaults to `"lax"`. */
+    sameSite?: "strict" | "lax" | "none";
+    /** Cookie domain. Defaults to the request hostname. */
+    domain?: string;
+    /** Cookie path. Defaults to `"/"`. */
+    path?: string;
+    /** Name for the access token cookie. Defaults to `"access_token"`. */
+    accessTokenName?: string;
+    /** Name for the refresh token cookie. Defaults to `"refresh_token"`. */
+    refreshTokenName?: string;
+}
+/** Options for registering the auth Fastify plugin. */
+interface AuthPluginOptions {
+    /** The auth service instance created via `createAuthService`. */
+    service: AuthService;
+    /** Custom function to extract the tenant ID from a request. Defaults to `x-tenant-id` header or subdomain. */
+    tenantResolver?: (req: FastifyRequest) => string;
+    /** Route prefix (e.g., "/auth"). */
+    prefix?: string;
+    /** Optional rate limiter. Applied to login, register, and password reset routes. */
+    rateLimiter?: RateLimiter;
+    /** Custom function to extract the rate limit key from a request. Defaults to IP address. */
+    rateLimitKeyResolver?: (req: FastifyRequest) => string;
+    /** Optional callback invoked with the raw reset token and user info. Use this to send the reset email. */
+    onPasswordResetToken?: (token: string, user: {
+        email: string;
+        tenantId: string;
+    }) => Promise<void>;
+    /** Optional callback invoked with the raw verification token and user info. Use this to send the verification email. */
+    onVerificationToken?: (token: string, user: {
+        email: string;
+        tenantId: string;
+    }) => Promise<void>;
+    /** Optional cookie configuration. When enabled, tokens are delivered via HttpOnly cookies instead of the response body. */
+    cookie?: AuthCookieOptions;
+}
+/**
+ * Fastify plugin that registers auth routes and handles AuthError/ZodError responses.
+ * Routes: POST /register, /login, /refresh, /logout, /request-password-reset, /reset-password, /verify-email, /resend-verification. GET /me.
+ *
+ * @param fastify - Fastify instance.
+ * @param options - Plugin options including auth service, tenant resolver, and optional cookie configuration.
+ */
+declare function authPlugin(fastify: FastifyInstance, options: AuthPluginOptions): Promise<void>;
+/**
+ * Fastify preHandler that authenticates the request via Bearer token or cookie and populates `request.authUser`.
+ * @param service - The auth service instance.
+ * @param cookieAccessTokenName - Optional cookie name for the access token. When provided, checks cookies before the Authorization header.
+ * @returns Fastify preHandler function.
+ */
+declare function authenticate(service: AuthService, cookieAccessTokenName?: string): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
+/**
+ * Fastify preHandler that authenticates and checks if the user has one of the required roles.
+ * @param service - The auth service instance.
+ * @param roles - Allowed roles for this route. Optionally, the first argument can be a cookie access token name if it's not a valid role.
+ * @returns Fastify preHandler function.
+ */
+declare function requireRole(service: AuthService, ...roles: string[]): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
+/**
+ * Creates middleware factories that are pre-configured with cookie support.
+ * Use this when cookie mode is enabled to avoid passing the cookie name to every middleware call.
+ * @param service - The auth service instance.
+ * @param accessTokenName - Cookie name for the access token.
+ * @returns Object with `authenticate` and `requireRole` middleware factories.
+ */
+declare function createCookieMiddleware(service: AuthService, accessTokenName: string): {
+    /**
+     * Fastify preHandler that authenticates via cookie or Bearer token and populates `request.authUser`.
+     * @returns Fastify preHandler function.
+     */
+    authenticate(): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
+    /**
+     * Fastify preHandler that authenticates via cookie or Bearer token and checks if the user has one of the required roles.
+     * @param roles - Allowed roles for this route.
+     * @returns Fastify preHandler function.
+     */
+    requireRole(...roles: string[]): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
+};
+
+export { type AuthCookieOptions, type AuthPluginOptions, authPlugin, authenticate, createCookieMiddleware, requireRole };

package/dist/index.js

@@ -0,0 +1,295 @@
+// src/plugin.ts
+import { AuthError, Errors } from "@forjakit/auth";
+import { ZodError } from "zod";
+function defaultTenantResolver(req) {
+  const tenantId = req.headers["x-tenant-id"] ?? req.hostname.split(".")[0];
+  if (!tenantId) {
+    throw new AuthError("Tenant ID is required", "TENANT_REQUIRED", 400);
+  }
+  return tenantId;
+}
+function defaultRateLimitKeyResolver(req) {
+  return req.ip;
+}
+function setTokenCookies(reply, tokens, cookieOpts) {
+  const baseOpts = {
+    httpOnly: true,
+    secure: cookieOpts.secure,
+    sameSite: cookieOpts.sameSite,
+    path: cookieOpts.path,
+    ...cookieOpts.domain ? { domain: cookieOpts.domain } : {}
+  };
+  reply.setCookie(cookieOpts.accessTokenName, tokens.accessToken, {
+    ...baseOpts,
+    maxAge: 15 * 60
+    // 15 minutes — matches default access token expiry
+  });
+  reply.setCookie(cookieOpts.refreshTokenName, tokens.refreshToken, {
+    ...baseOpts,
+    maxAge: 7 * 24 * 60 * 60
+    // 7 days — matches default refresh token expiry
+  });
+}
+function clearTokenCookies(reply, cookieOpts) {
+  const clearOpts = {
+    httpOnly: true,
+    path: cookieOpts.path,
+    ...cookieOpts.domain ? { domain: cookieOpts.domain } : {},
+    maxAge: 0
+  };
+  reply.setCookie(cookieOpts.accessTokenName, "", clearOpts);
+  reply.setCookie(cookieOpts.refreshTokenName, "", clearOpts);
+}
+function extractToken(request, accessTokenName) {
+  if (accessTokenName) {
+    const cookieToken = request.cookies?.[accessTokenName];
+    if (cookieToken) return cookieToken;
+  }
+  const header = request.headers.authorization;
+  if (header?.startsWith("Bearer ")) {
+    return header.slice(7);
+  }
+  throw new AuthError("Missing or invalid authorization header", "INVALID_TOKEN", 401);
+}
+function extractRefreshToken(request, refreshTokenName) {
+  if (refreshTokenName) {
+    return request.cookies?.[refreshTokenName];
+  }
+  return void 0;
+}
+async function authPlugin(fastify, options) {
+  const {
+    service,
+    tenantResolver = defaultTenantResolver,
+    rateLimiter,
+    rateLimitKeyResolver = defaultRateLimitKeyResolver,
+    onPasswordResetToken,
+    onVerificationToken,
+    cookie
+  } = options;
+  const { schemas } = service;
+  const cookieEnabled = cookie?.enabled ?? false;
+  const cookieOpts = cookieEnabled ? {
+    secure: cookie.secure ?? process.env.NODE_ENV === "production",
+    sameSite: cookie.sameSite ?? "lax",
+    domain: cookie.domain,
+    path: cookie.path ?? "/",
+    accessTokenName: cookie.accessTokenName ?? "access_token",
+    refreshTokenName: cookie.refreshTokenName ?? "refresh_token"
+  } : void 0;
+  if (cookieEnabled) {
+    await fastify.register(import("@fastify/cookie"));
+  }
+  function rateLimit(action) {
+    if (!rateLimiter) return void 0;
+    return async (request, reply) => {
+      const key = rateLimitKeyResolver(request);
+      const result = await rateLimiter.consume(key, action);
+      if (!result.allowed) {
+        if (result.retryAfter) {
+          reply.header("Retry-After", String(result.retryAfter));
+        }
+        throw Errors.rateLimited(result.retryAfter);
+      }
+    };
+  }
+  fastify.setErrorHandler((error, _request, reply) => {
+    if (error instanceof AuthError) {
+      const response = { error: error.code, message: error.message };
+      if (error.statusCode === 429) {
+        reply.header("Retry-After", reply.getHeader("Retry-After") ?? "60");
+      }
+      if (cookieEnabled && error.statusCode === 401) {
+        clearTokenCookies(reply, cookieOpts);
+      }
+      return reply.status(error.statusCode).send(response);
+    }
+    if (error instanceof ZodError) {
+      return reply.status(400).send({
+        error: "VALIDATION_ERROR",
+        message: "Invalid input",
+        details: error.errors.map((e) => ({
+          field: e.path.join("."),
+          message: e.message
+        }))
+      });
+    }
+    throw error;
+  });
+  const registerOpts = rateLimit("register") ? { preHandler: rateLimit("register") } : {};
+  fastify.post("/register", registerOpts, async (request, reply) => {
+    const tenantId = tenantResolver(request);
+    const body = request.body;
+    const result = await service.register({ ...body, tenantId });
+    if (result.verificationToken && onVerificationToken) {
+      await onVerificationToken(result.verificationToken, { email: result.user.email, tenantId });
+    }
+    if (cookieEnabled && cookieOpts) {
+      setTokenCookies(reply, result, cookieOpts);
+      const { accessToken: _, refreshToken: __, ...rest } = result;
+      return reply.status(201).send(rest);
+    }
+    return reply.status(201).send(result);
+  });
+  const loginOpts = rateLimit("login") ? { preHandler: rateLimit("login") } : {};
+  fastify.post("/login", loginOpts, async (request, reply) => {
+    const tenantId = tenantResolver(request);
+    const body = request.body;
+    const result = await service.login({ ...body, tenantId });
+    if (cookieEnabled && cookieOpts) {
+      setTokenCookies(reply, result, cookieOpts);
+      const { accessToken: _, refreshToken: __, ...rest } = result;
+      return reply.status(200).send(rest);
+    }
+    return reply.status(200).send(result);
+  });
+  fastify.post("/refresh", async (request, reply) => {
+    let refreshToken;
+    if (cookieEnabled && cookieOpts) {
+      const cookieRefresh = extractRefreshToken(request, cookieOpts.refreshTokenName);
+      if (cookieRefresh) {
+        refreshToken = cookieRefresh;
+      } else {
+        const parsed = schemas.RefreshInput.parse(request.body);
+        refreshToken = parsed.refreshToken;
+      }
+    } else {
+      const parsed = schemas.RefreshInput.parse(request.body);
+      refreshToken = parsed.refreshToken;
+    }
+    const result = await service.refresh(refreshToken);
+    if (cookieEnabled && cookieOpts) {
+      setTokenCookies(reply, result, cookieOpts);
+      return reply.status(200).send({ message: "Tokens refreshed" });
+    }
+    return reply.status(200).send(result);
+  });
+  fastify.get("/me", async (request, reply) => {
+    const token = extractToken(request, cookieOpts?.accessTokenName);
+    const user = await service.authenticate(token);
+    return reply.status(200).send(user);
+  });
+  fastify.post("/logout", async (request, reply) => {
+    const token = extractToken(request, cookieOpts?.accessTokenName);
+    await service.logout(token);
+    if (cookieEnabled && cookieOpts) {
+      clearTokenCookies(reply, cookieOpts);
+    }
+    return reply.status(204).send();
+  });
+  const resetReqOpts = rateLimit("request-password-reset") ? { preHandler: rateLimit("request-password-reset") } : {};
+  fastify.post("/request-password-reset", resetReqOpts, async (request, reply) => {
+    const tenantId = tenantResolver(request);
+    const body = request.body;
+    const parsed = schemas.RequestPasswordResetInput.parse({ ...body, tenantId });
+    const token = await service.requestPasswordReset(parsed.email, parsed.tenantId);
+    if (token && onPasswordResetToken) {
+      await onPasswordResetToken(token, { email: parsed.email, tenantId });
+    }
+    return reply.status(200).send({ message: "If the email exists, a reset link has been sent" });
+  });
+  fastify.post("/reset-password", async (request, reply) => {
+    const tenantId = tenantResolver(request);
+    const body = request.body;
+    await service.resetPassword(
+      body.token,
+      body.password,
+      tenantId
+    );
+    return reply.status(200).send({ message: "Password has been reset" });
+  });
+  fastify.post("/verify-email", async (request, reply) => {
+    const body = request.body;
+    const parsed = schemas.VerifyEmailInput.parse(body);
+    await service.verifyEmail(parsed.token);
+    return reply.status(200).send({ message: "Email verified" });
+  });
+  fastify.post("/resend-verification", async (request, reply) => {
+    const tenantId = tenantResolver(request);
+    const body = request.body;
+    const email = body.email;
+    const token = await service.resendVerificationEmail(email, tenantId);
+    if (token && onVerificationToken) {
+      await onVerificationToken(token, { email, tenantId });
+    }
+    return reply.status(200).send({ message: "If the email exists, a verification link has been sent" });
+  });
+}
+function authenticate(service, cookieAccessTokenName) {
+  return async (request, reply) => {
+    try {
+      const token = extractToken(request, cookieAccessTokenName);
+      request.authUser = await service.authenticate(token);
+    } catch (error) {
+      if (error instanceof AuthError) {
+        return reply.status(error.statusCode).send({ error: error.code, message: error.message });
+      }
+      throw error;
+    }
+  };
+}
+function requireRole(service, ...roles) {
+  const checkRole = service.authorize(...roles);
+  return async (request, reply) => {
+    try {
+      const token = extractToken(request);
+      const user = await service.authenticate(token);
+      checkRole(user);
+      request.authUser = user;
+    } catch (error) {
+      if (error instanceof AuthError) {
+        return reply.status(error.statusCode).send({ error: error.code, message: error.message });
+      }
+      throw error;
+    }
+  };
+}
+function createCookieMiddleware(service, accessTokenName) {
+  return {
+    /**
+     * Fastify preHandler that authenticates via cookie or Bearer token and populates `request.authUser`.
+     * @returns Fastify preHandler function.
+     */
+    authenticate() {
+      return async (request, reply) => {
+        try {
+          const token = extractToken(request, accessTokenName);
+          request.authUser = await service.authenticate(token);
+        } catch (error) {
+          if (error instanceof AuthError) {
+            return reply.status(error.statusCode).send({ error: error.code, message: error.message });
+          }
+          throw error;
+        }
+      };
+    },
+    /**
+     * Fastify preHandler that authenticates via cookie or Bearer token and checks if the user has one of the required roles.
+     * @param roles - Allowed roles for this route.
+     * @returns Fastify preHandler function.
+     */
+    requireRole(...roles) {
+      const checkRole = service.authorize(...roles);
+      return async (request, reply) => {
+        try {
+          const token = extractToken(request, accessTokenName);
+          const user = await service.authenticate(token);
+          checkRole(user);
+          request.authUser = user;
+        } catch (error) {
+          if (error instanceof AuthError) {
+            return reply.status(error.statusCode).send({ error: error.code, message: error.message });
+          }
+          throw error;
+        }
+      };
+    }
+  };
+}
+export {
+  authPlugin,
+  authenticate,
+  createCookieMiddleware,
+  requireRole
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/plugin.ts"],"sourcesContent":["import type { FastifyInstance, FastifyRequest, FastifyReply } from \"fastify\";\nimport { type AuthService, type RateLimiter, AuthError, Errors } from \"@forjakit/auth\";\nimport { ZodError } from \"zod\";\n\ndeclare module \"fastify\" {\n  interface FastifyRequest {\n    authUser?: Record<string, unknown>;\n  }\n}\n\n/** Cookie configuration for secure token delivery. */\nexport interface AuthCookieOptions {\n  /** Enable cookie-based token delivery. When true, tokens are set as HttpOnly cookies instead of returned in the response body. */\n  enabled: boolean;\n  /** Whether to set the Secure flag (HTTPS only). Defaults to `true` in production. */\n  secure?: boolean;\n  /** SameSite attribute for cookies. Defaults to `\"lax\"`. */\n  sameSite?: \"strict\" | \"lax\" | \"none\";\n  /** Cookie domain. Defaults to the request hostname. */\n  domain?: string;\n  /** Cookie path. Defaults to `\"/\"`. */\n  path?: string;\n  /** Name for the access token cookie. Defaults to `\"access_token\"`. */\n  accessTokenName?: string;\n  /** Name for the refresh token cookie. Defaults to `\"refresh_token\"`. */\n  refreshTokenName?: string;\n}\n\n/** Options for registering the auth Fastify plugin. */\nexport interface AuthPluginOptions {\n  /** The auth service instance created via `createAuthService`. */\n  service: AuthService;\n  /** Custom function to extract the tenant ID from a request. Defaults to `x-tenant-id` header or subdomain. */\n  tenantResolver?: (req: FastifyRequest) => string;\n  /** Route prefix (e.g., \"/auth\"). */\n  prefix?: string;\n  /** Optional rate limiter. Applied to login, register, and password reset routes. */\n  rateLimiter?: RateLimiter;\n  /** Custom function to extract the rate limit key from a request. Defaults to IP address. */\n  rateLimitKeyResolver?: (req: FastifyRequest) => string;\n  /** Optional callback invoked with the raw reset token and user info. Use this to send the reset email. */\n  onPasswordResetToken?: (token: string, user: { email: string; tenantId: string }) => Promise<void>;\n  /** Optional callback invoked with the raw verification token and user info. Use this to send the verification email. */\n  onVerificationToken?: (token: string, user: { email: string; tenantId: string }) => Promise<void>;\n  /** Optional cookie configuration. When enabled, tokens are delivered via HttpOnly cookies instead of the response body. */\n  cookie?: AuthCookieOptions;\n}\n\nfunction defaultTenantResolver(req: FastifyRequest): string {\n  const tenantId =\n    (req.headers[\"x-tenant-id\"] as string) ??\n    req.hostname.split(\".\")[0];\n\n  if (!tenantId) {\n    throw new AuthError(\"Tenant ID is required\", \"TENANT_REQUIRED\", 400);\n  }\n\n  return tenantId;\n}\n\nfunction defaultRateLimitKeyResolver(req: FastifyRequest): string {\n  return req.ip;\n}\n\n/**\n * Sets access and refresh token cookies on the reply.\n * @param reply - Fastify reply object.\n * @param tokens - Object containing accessToken and refreshToken strings.\n * @param cookieOpts - Resolved cookie options.\n */\nfunction setTokenCookies(\n  reply: FastifyReply,\n  tokens: { accessToken: string; refreshToken: string },\n  cookieOpts: Required<Pick<AuthCookieOptions, \"secure\" | \"sameSite\" | \"path\" | \"accessTokenName\" | \"refreshTokenName\">> & Pick<AuthCookieOptions, \"domain\">\n) {\n  const baseOpts = {\n    httpOnly: true,\n    secure: cookieOpts.secure,\n    sameSite: cookieOpts.sameSite,\n    path: cookieOpts.path,\n    ...(cookieOpts.domain ? { domain: cookieOpts.domain } : {}),\n  };\n\n  reply.setCookie(cookieOpts.accessTokenName, tokens.accessToken, {\n    ...baseOpts,\n    maxAge: 15 * 60, // 15 minutes — matches default access token expiry\n  });\n\n  reply.setCookie(cookieOpts.refreshTokenName, tokens.refreshToken, {\n    ...baseOpts,\n    maxAge: 7 * 24 * 60 * 60, // 7 days — matches default refresh token expiry\n  });\n}\n\n/**\n * Clears token cookies from the reply.\n * @param reply - Fastify reply object.\n * @param cookieOpts - Resolved cookie options.\n */\nfunction clearTokenCookies(\n  reply: FastifyReply,\n  cookieOpts: Required<Pick<AuthCookieOptions, \"path\" | \"accessTokenName\" | \"refreshTokenName\">> & Pick<AuthCookieOptions, \"domain\">\n) {\n  const clearOpts = {\n    httpOnly: true,\n    path: cookieOpts.path,\n    ...(cookieOpts.domain ? { domain: cookieOpts.domain } : {}),\n    maxAge: 0,\n  };\n\n  reply.setCookie(cookieOpts.accessTokenName, \"\", clearOpts);\n  reply.setCookie(cookieOpts.refreshTokenName, \"\", clearOpts);\n}\n\n/**\n * Extracts the access token from the request. Checks cookies first (if cookie mode is enabled), then falls back to the Authorization header.\n * @param request - Fastify request object.\n * @param accessTokenName - Cookie name for the access token (undefined if cookie mode is disabled).\n * @returns The raw JWT access token string.\n * @throws AuthError if no token is found.\n */\nfunction extractToken(request: FastifyRequest, accessTokenName?: string): string {\n  // Try cookie first\n  if (accessTokenName) {\n    const cookieToken = (request.cookies as Record<string, string | undefined>)?.[accessTokenName];\n    if (cookieToken) return cookieToken;\n  }\n\n  // Fallback to Authorization header\n  const header = request.headers.authorization;\n  if (header?.startsWith(\"Bearer \")) {\n    return header.slice(7);\n  }\n\n  throw new AuthError(\"Missing or invalid authorization header\", \"INVALID_TOKEN\", 401);\n}\n\n/**\n * Extracts the refresh token from the request. Checks cookies first (if cookie mode is enabled), then falls back to the request body.\n * @param request - Fastify request object.\n * @param refreshTokenName - Cookie name for the refresh token (undefined if cookie mode is disabled).\n * @returns The raw JWT refresh token string, or undefined if not found in cookies.\n */\nfunction extractRefreshToken(request: FastifyRequest, refreshTokenName?: string): string | undefined {\n  if (refreshTokenName) {\n    return (request.cookies as Record<string, string | undefined>)?.[refreshTokenName];\n  }\n  return undefined;\n}\n\n/**\n * Fastify plugin that registers auth routes and handles AuthError/ZodError responses.\n * Routes: POST /register, /login, /refresh, /logout, /request-password-reset, /reset-password, /verify-email, /resend-verification. GET /me.\n *\n * @param fastify - Fastify instance.\n * @param options - Plugin options including auth service, tenant resolver, and optional cookie configuration.\n */\nexport async function authPlugin(\n  fastify: FastifyInstance,\n  options: AuthPluginOptions\n) {\n  const {\n    service,\n    tenantResolver = defaultTenantResolver,\n    rateLimiter,\n    rateLimitKeyResolver = defaultRateLimitKeyResolver,\n    onPasswordResetToken,\n    onVerificationToken,\n    cookie,\n  } = options;\n  const { schemas } = service;\n\n  // Resolve cookie options\n  const cookieEnabled = cookie?.enabled ?? false;\n  const cookieOpts = cookieEnabled\n    ? {\n        secure: cookie!.secure ?? process.env.NODE_ENV === \"production\",\n        sameSite: cookie!.sameSite ?? (\"lax\" as const),\n        domain: cookie!.domain,\n        path: cookie!.path ?? \"/\",\n        accessTokenName: cookie!.accessTokenName ?? \"access_token\",\n        refreshTokenName: cookie!.refreshTokenName ?? \"refresh_token\",\n      }\n    : undefined;\n\n  // Register @fastify/cookie if cookie mode is enabled\n  if (cookieEnabled) {\n    await fastify.register(import(\"@fastify/cookie\"));\n  }\n\n  // Rate limit preHandler factory\n  function rateLimit(action: string) {\n    if (!rateLimiter) return undefined;\n    return async (request: FastifyRequest, reply: FastifyReply) => {\n      const key = rateLimitKeyResolver(request);\n      const result = await rateLimiter.consume(key, action);\n      if (!result.allowed) {\n        if (result.retryAfter) {\n          reply.header(\"Retry-After\", String(result.retryAfter));\n        }\n        throw Errors.rateLimited(result.retryAfter);\n      }\n    };\n  }\n\n  // Error handler for AuthError and ZodError\n  fastify.setErrorHandler((error, _request, reply) => {\n    if (error instanceof AuthError) {\n      const response: Record<string, unknown> = { error: error.code, message: error.message };\n      if (error.statusCode === 429) {\n        reply.header(\"Retry-After\", reply.getHeader(\"Retry-After\") ?? \"60\");\n      }\n      if (cookieEnabled && error.statusCode === 401) {\n        clearTokenCookies(reply, cookieOpts!);\n      }\n      return reply.status(error.statusCode).send(response);\n    }\n    if (error instanceof ZodError) {\n      return reply.status(400).send({\n        error: \"VALIDATION_ERROR\",\n        message: \"Invalid input\",\n        details: error.errors.map((e) => ({\n          field: e.path.join(\".\"),\n          message: e.message,\n        })),\n      });\n    }\n    throw error;\n  });\n\n  // POST /register\n  const registerOpts = rateLimit(\"register\") ? { preHandler: rateLimit(\"register\") } : {};\n  fastify.post(\"/register\", registerOpts, async (request: FastifyRequest, reply: FastifyReply) => {\n    const tenantId = tenantResolver(request);\n    const body = request.body as Record<string, unknown>;\n    const result = await service.register({ ...body, tenantId } as Parameters<typeof service.register>[0]);\n\n    if (result.verificationToken && onVerificationToken) {\n      await onVerificationToken(result.verificationToken, { email: result.user.email, tenantId });\n    }\n\n    if (cookieEnabled && cookieOpts) {\n      setTokenCookies(reply, result, cookieOpts);\n      const { accessToken: _, refreshToken: __, ...rest } = result;\n      return reply.status(201).send(rest);\n    }\n\n    return reply.status(201).send(result);\n  });\n\n  // POST /login\n  const loginOpts = rateLimit(\"login\") ? { preHandler: rateLimit(\"login\") } : {};\n  fastify.post(\"/login\", loginOpts, async (request: FastifyRequest, reply: FastifyReply) => {\n    const tenantId = tenantResolver(request);\n    const body = request.body as Record<string, unknown>;\n    const result = await service.login({ ...body, tenantId } as { email: string; password: string; tenantId: string });\n\n    if (cookieEnabled && cookieOpts) {\n      setTokenCookies(reply, result, cookieOpts);\n      const { accessToken: _, refreshToken: __, ...rest } = result;\n      return reply.status(200).send(rest);\n    }\n\n    return reply.status(200).send(result);\n  });\n\n  // POST /refresh\n  fastify.post(\"/refresh\", async (request: FastifyRequest, reply: FastifyReply) => {\n    let refreshToken: string;\n\n    if (cookieEnabled && cookieOpts) {\n      const cookieRefresh = extractRefreshToken(request, cookieOpts.refreshTokenName);\n      if (cookieRefresh) {\n        refreshToken = cookieRefresh;\n      } else {\n        const parsed = schemas.RefreshInput.parse(request.body);\n        refreshToken = parsed.refreshToken;\n      }\n    } else {\n      const parsed = schemas.RefreshInput.parse(request.body);\n      refreshToken = parsed.refreshToken;\n    }\n\n    const result = await service.refresh(refreshToken);\n\n    if (cookieEnabled && cookieOpts) {\n      setTokenCookies(reply, result, cookieOpts);\n      return reply.status(200).send({ message: \"Tokens refreshed\" });\n    }\n\n    return reply.status(200).send(result);\n  });\n\n  // GET /me\n  fastify.get(\"/me\", async (request: FastifyRequest, reply: FastifyReply) => {\n    const token = extractToken(request, cookieOpts?.accessTokenName);\n    const user = await service.authenticate(token);\n\n    return reply.status(200).send(user);\n  });\n\n  // POST /logout\n  fastify.post(\"/logout\", async (request: FastifyRequest, reply: FastifyReply) => {\n    const token = extractToken(request, cookieOpts?.accessTokenName);\n    await service.logout(token);\n\n    if (cookieEnabled && cookieOpts) {\n      clearTokenCookies(reply, cookieOpts);\n    }\n\n    return reply.status(204).send();\n  });\n\n  // POST /request-password-reset\n  const resetReqOpts = rateLimit(\"request-password-reset\") ? { preHandler: rateLimit(\"request-password-reset\") } : {};\n  fastify.post(\"/request-password-reset\", resetReqOpts, async (request: FastifyRequest, reply: FastifyReply) => {\n    const tenantId = tenantResolver(request);\n    const body = request.body as Record<string, unknown>;\n    const parsed = schemas.RequestPasswordResetInput.parse({ ...body, tenantId });\n\n    const token = await service.requestPasswordReset(parsed.email, parsed.tenantId);\n\n    if (token && onPasswordResetToken) {\n      await onPasswordResetToken(token, { email: parsed.email, tenantId });\n    }\n\n    // Always return success to avoid leaking whether the email exists\n    return reply.status(200).send({ message: \"If the email exists, a reset link has been sent\" });\n  });\n\n  // POST /reset-password\n  fastify.post(\"/reset-password\", async (request: FastifyRequest, reply: FastifyReply) => {\n    const tenantId = tenantResolver(request);\n    const body = request.body as Record<string, unknown>;\n    await service.resetPassword(\n      (body as { token: string }).token,\n      (body as { password: string }).password,\n      tenantId\n    );\n\n    return reply.status(200).send({ message: \"Password has been reset\" });\n  });\n\n  // POST /verify-email\n  fastify.post(\"/verify-email\", async (request: FastifyRequest, reply: FastifyReply) => {\n    const body = request.body as Record<string, unknown>;\n    const parsed = schemas.VerifyEmailInput.parse(body);\n    await service.verifyEmail(parsed.token);\n\n    return reply.status(200).send({ message: \"Email verified\" });\n  });\n\n  // POST /resend-verification\n  fastify.post(\"/resend-verification\", async (request: FastifyRequest, reply: FastifyReply) => {\n    const tenantId = tenantResolver(request);\n    const body = request.body as Record<string, unknown>;\n    const email = (body as { email: string }).email;\n\n    const token = await service.resendVerificationEmail(email, tenantId);\n\n    if (token && onVerificationToken) {\n      await onVerificationToken(token, { email, tenantId });\n    }\n\n    return reply.status(200).send({ message: \"If the email exists, a verification link has been sent\" });\n  });\n}\n\n// -- Middleware factories --\n\n/**\n * Fastify preHandler that authenticates the request via Bearer token or cookie and populates `request.authUser`.\n * @param service - The auth service instance.\n * @param cookieAccessTokenName - Optional cookie name for the access token. When provided, checks cookies before the Authorization header.\n * @returns Fastify preHandler function.\n */\nexport function authenticate(service: AuthService, cookieAccessTokenName?: string) {\n  return async (request: FastifyRequest, reply: FastifyReply) => {\n    try {\n      const token = extractToken(request, cookieAccessTokenName);\n      request.authUser = await service.authenticate(token);\n    } catch (error) {\n      if (error instanceof AuthError) {\n        return reply\n          .status(error.statusCode)\n          .send({ error: error.code, message: error.message });\n      }\n      throw error;\n    }\n  };\n}\n\n/**\n * Fastify preHandler that authenticates and checks if the user has one of the required roles.\n * @param service - The auth service instance.\n * @param roles - Allowed roles for this route. Optionally, the first argument can be a cookie access token name if it's not a valid role.\n * @returns Fastify preHandler function.\n */\nexport function requireRole(service: AuthService, ...roles: string[]) {\n  const checkRole = service.authorize(...roles);\n\n  return async (request: FastifyRequest, reply: FastifyReply) => {\n    try {\n      const token = extractToken(request);\n      const user = await service.authenticate(token);\n      checkRole(user);\n      request.authUser = user;\n    } catch (error) {\n      if (error instanceof AuthError) {\n        return reply\n          .status(error.statusCode)\n          .send({ error: error.code, message: error.message });\n      }\n      throw error;\n    }\n  };\n}\n\n/**\n * Creates middleware factories that are pre-configured with cookie support.\n * Use this when cookie mode is enabled to avoid passing the cookie name to every middleware call.\n * @param service - The auth service instance.\n * @param accessTokenName - Cookie name for the access token.\n * @returns Object with `authenticate` and `requireRole` middleware factories.\n */\nexport function createCookieMiddleware(service: AuthService, accessTokenName: string) {\n  return {\n    /**\n     * Fastify preHandler that authenticates via cookie or Bearer token and populates `request.authUser`.\n     * @returns Fastify preHandler function.\n     */\n    authenticate() {\n      return async (request: FastifyRequest, reply: FastifyReply) => {\n        try {\n          const token = extractToken(request, accessTokenName);\n          request.authUser = await service.authenticate(token);\n        } catch (error) {\n          if (error instanceof AuthError) {\n            return reply\n              .status(error.statusCode)\n              .send({ error: error.code, message: error.message });\n          }\n          throw error;\n        }\n      };\n    },\n    /**\n     * Fastify preHandler that authenticates via cookie or Bearer token and checks if the user has one of the required roles.\n     * @param roles - Allowed roles for this route.\n     * @returns Fastify preHandler function.\n     */\n    requireRole(...roles: string[]) {\n      const checkRole = service.authorize(...roles);\n\n      return async (request: FastifyRequest, reply: FastifyReply) => {\n        try {\n          const token = extractToken(request, accessTokenName);\n          const user = await service.authenticate(token);\n          checkRole(user);\n          request.authUser = user;\n        } catch (error) {\n          if (error instanceof AuthError) {\n            return reply\n              .status(error.statusCode)\n              .send({ error: error.code, message: error.message });\n          }\n          throw error;\n        }\n      };\n    },\n  };\n}\n"],"mappings":";AACA,SAA6C,WAAW,cAAc;AACtE,SAAS,gBAAgB;AA8CzB,SAAS,sBAAsB,KAA6B;AAC1D,QAAM,WACH,IAAI,QAAQ,aAAa,KAC1B,IAAI,SAAS,MAAM,GAAG,EAAE,CAAC;AAE3B,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,UAAU,yBAAyB,mBAAmB,GAAG;AAAA,EACrE;AAEA,SAAO;AACT;AAEA,SAAS,4BAA4B,KAA6B;AAChE,SAAO,IAAI;AACb;AAQA,SAAS,gBACP,OACA,QACA,YACA;AACA,QAAM,WAAW;AAAA,IACf,UAAU;AAAA,IACV,QAAQ,WAAW;AAAA,IACnB,UAAU,WAAW;AAAA,IACrB,MAAM,WAAW;AAAA,IACjB,GAAI,WAAW,SAAS,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,EAC3D;AAEA,QAAM,UAAU,WAAW,iBAAiB,OAAO,aAAa;AAAA,IAC9D,GAAG;AAAA,IACH,QAAQ,KAAK;AAAA;AAAA,EACf,CAAC;AAED,QAAM,UAAU,WAAW,kBAAkB,OAAO,cAAc;AAAA,IAChE,GAAG;AAAA,IACH,QAAQ,IAAI,KAAK,KAAK;AAAA;AAAA,EACxB,CAAC;AACH;AAOA,SAAS,kBACP,OACA,YACA;AACA,QAAM,YAAY;AAAA,IAChB,UAAU;AAAA,IACV,MAAM,WAAW;AAAA,IACjB,GAAI,WAAW,SAAS,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,IACzD,QAAQ;AAAA,EACV;AAEA,QAAM,UAAU,WAAW,iBAAiB,IAAI,SAAS;AACzD,QAAM,UAAU,WAAW,kBAAkB,IAAI,SAAS;AAC5D;AASA,SAAS,aAAa,SAAyB,iBAAkC;AAE/E,MAAI,iBAAiB;AACnB,UAAM,cAAe,QAAQ,UAAiD,eAAe;AAC7F,QAAI,YAAa,QAAO;AAAA,EAC1B;AAGA,QAAM,SAAS,QAAQ,QAAQ;AAC/B,MAAI,QAAQ,WAAW,SAAS,GAAG;AACjC,WAAO,OAAO,MAAM,CAAC;AAAA,EACvB;AAEA,QAAM,IAAI,UAAU,2CAA2C,iBAAiB,GAAG;AACrF;AAQA,SAAS,oBAAoB,SAAyB,kBAA+C;AACnG,MAAI,kBAAkB;AACpB,WAAQ,QAAQ,UAAiD,gBAAgB;AAAA,EACnF;AACA,SAAO;AACT;AASA,eAAsB,WACpB,SACA,SACA;AACA,QAAM;AAAA,IACJ;AAAA,IACA,iBAAiB;AAAA,IACjB;AAAA,IACA,uBAAuB;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AACJ,QAAM,EAAE,QAAQ,IAAI;AAGpB,QAAM,gBAAgB,QAAQ,WAAW;AACzC,QAAM,aAAa,gBACf;AAAA,IACE,QAAQ,OAAQ,UAAU,QAAQ,IAAI,aAAa;AAAA,IACnD,UAAU,OAAQ,YAAa;AAAA,IAC/B,QAAQ,OAAQ;AAAA,IAChB,MAAM,OAAQ,QAAQ;AAAA,IACtB,iBAAiB,OAAQ,mBAAmB;AAAA,IAC5C,kBAAkB,OAAQ,oBAAoB;AAAA,EAChD,IACA;AAGJ,MAAI,eAAe;AACjB,UAAM,QAAQ,SAAS,OAAO,iBAAiB,CAAC;AAAA,EAClD;AAGA,WAAS,UAAU,QAAgB;AACjC,QAAI,CAAC,YAAa,QAAO;AACzB,WAAO,OAAO,SAAyB,UAAwB;AAC7D,YAAM,MAAM,qBAAqB,OAAO;AACxC,YAAM,SAAS,MAAM,YAAY,QAAQ,KAAK,MAAM;AACpD,UAAI,CAAC,OAAO,SAAS;AACnB,YAAI,OAAO,YAAY;AACrB,gBAAM,OAAO,eAAe,OAAO,OAAO,UAAU,CAAC;AAAA,QACvD;AACA,cAAM,OAAO,YAAY,OAAO,UAAU;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAGA,UAAQ,gBAAgB,CAAC,OAAO,UAAU,UAAU;AAClD,QAAI,iBAAiB,WAAW;AAC9B,YAAM,WAAoC,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,QAAQ;AACtF,UAAI,MAAM,eAAe,KAAK;AAC5B,cAAM,OAAO,eAAe,MAAM,UAAU,aAAa,KAAK,IAAI;AAAA,MACpE;AACA,UAAI,iBAAiB,MAAM,eAAe,KAAK;AAC7C,0BAAkB,OAAO,UAAW;AAAA,MACtC;AACA,aAAO,MAAM,OAAO,MAAM,UAAU,EAAE,KAAK,QAAQ;AAAA,IACrD;AACA,QAAI,iBAAiB,UAAU;AAC7B,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK;AAAA,QAC5B,OAAO;AAAA,QACP,SAAS;AAAA,QACT,SAAS,MAAM,OAAO,IAAI,CAAC,OAAO;AAAA,UAChC,OAAO,EAAE,KAAK,KAAK,GAAG;AAAA,UACtB,SAAS,EAAE;AAAA,QACb,EAAE;AAAA,MACJ,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR,CAAC;AAGD,QAAM,eAAe,UAAU,UAAU,IAAI,EAAE,YAAY,UAAU,UAAU,EAAE,IAAI,CAAC;AACtF,UAAQ,KAAK,aAAa,cAAc,OAAO,SAAyB,UAAwB;AAC9F,UAAM,WAAW,eAAe,OAAO;AACvC,UAAM,OAAO,QAAQ;AACrB,UAAM,SAAS,MAAM,QAAQ,SAAS,EAAE,GAAG,MAAM,SAAS,CAA2C;AAErG,QAAI,OAAO,qBAAqB,qBAAqB;AACnD,YAAM,oBAAoB,OAAO,mBAAmB,EAAE,OAAO,OAAO,KAAK,OAAO,SAAS,CAAC;AAAA,IAC5F;AAEA,QAAI,iBAAiB,YAAY;AAC/B,sBAAgB,OAAO,QAAQ,UAAU;AACzC,YAAM,EAAE,aAAa,GAAG,cAAc,IAAI,GAAG,KAAK,IAAI;AACtD,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,IAAI;AAAA,IACpC;AAEA,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,EACtC,CAAC;AAGD,QAAM,YAAY,UAAU,OAAO,IAAI,EAAE,YAAY,UAAU,OAAO,EAAE,IAAI,CAAC;AAC7E,UAAQ,KAAK,UAAU,WAAW,OAAO,SAAyB,UAAwB;AACxF,UAAM,WAAW,eAAe,OAAO;AACvC,UAAM,OAAO,QAAQ;AACrB,UAAM,SAAS,MAAM,QAAQ,MAAM,EAAE,GAAG,MAAM,SAAS,CAA0D;AAEjH,QAAI,iBAAiB,YAAY;AAC/B,sBAAgB,OAAO,QAAQ,UAAU;AACzC,YAAM,EAAE,aAAa,GAAG,cAAc,IAAI,GAAG,KAAK,IAAI;AACtD,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,IAAI;AAAA,IACpC;AAEA,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,EACtC,CAAC;AAGD,UAAQ,KAAK,YAAY,OAAO,SAAyB,UAAwB;AAC/E,QAAI;AAEJ,QAAI,iBAAiB,YAAY;AAC/B,YAAM,gBAAgB,oBAAoB,SAAS,WAAW,gBAAgB;AAC9E,UAAI,eAAe;AACjB,uBAAe;AAAA,MACjB,OAAO;AACL,cAAM,SAAS,QAAQ,aAAa,MAAM,QAAQ,IAAI;AACtD,uBAAe,OAAO;AAAA,MACxB;AAAA,IACF,OAAO;AACL,YAAM,SAAS,QAAQ,aAAa,MAAM,QAAQ,IAAI;AACtD,qBAAe,OAAO;AAAA,IACxB;AAEA,UAAM,SAAS,MAAM,QAAQ,QAAQ,YAAY;AAEjD,QAAI,iBAAiB,YAAY;AAC/B,sBAAgB,OAAO,QAAQ,UAAU;AACzC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,mBAAmB,CAAC;AAAA,IAC/D;AAEA,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,EACtC,CAAC;AAGD,UAAQ,IAAI,OAAO,OAAO,SAAyB,UAAwB;AACzE,UAAM,QAAQ,aAAa,SAAS,YAAY,eAAe;AAC/D,UAAM,OAAO,MAAM,QAAQ,aAAa,KAAK;AAE7C,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,IAAI;AAAA,EACpC,CAAC;AAGD,UAAQ,KAAK,WAAW,OAAO,SAAyB,UAAwB;AAC9E,UAAM,QAAQ,aAAa,SAAS,YAAY,eAAe;AAC/D,UAAM,QAAQ,OAAO,KAAK;AAE1B,QAAI,iBAAiB,YAAY;AAC/B,wBAAkB,OAAO,UAAU;AAAA,IACrC;AAEA,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK;AAAA,EAChC,CAAC;AAGD,QAAM,eAAe,UAAU,wBAAwB,IAAI,EAAE,YAAY,UAAU,wBAAwB,EAAE,IAAI,CAAC;AAClH,UAAQ,KAAK,2BAA2B,cAAc,OAAO,SAAyB,UAAwB;AAC5G,UAAM,WAAW,eAAe,OAAO;AACvC,UAAM,OAAO,QAAQ;AACrB,UAAM,SAAS,QAAQ,0BAA0B,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC;AAE5E,UAAM,QAAQ,MAAM,QAAQ,qBAAqB,OAAO,OAAO,OAAO,QAAQ;AAE9E,QAAI,SAAS,sBAAsB;AACjC,YAAM,qBAAqB,OAAO,EAAE,OAAO,OAAO,OAAO,SAAS,CAAC;AAAA,IACrE;AAGA,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,kDAAkD,CAAC;AAAA,EAC9F,CAAC;AAGD,UAAQ,KAAK,mBAAmB,OAAO,SAAyB,UAAwB;AACtF,UAAM,WAAW,eAAe,OAAO;AACvC,UAAM,OAAO,QAAQ;AACrB,UAAM,QAAQ;AAAA,MACX,KAA2B;AAAA,MAC3B,KAA8B;AAAA,MAC/B;AAAA,IACF;AAEA,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,0BAA0B,CAAC;AAAA,EACtE,CAAC;AAGD,UAAQ,KAAK,iBAAiB,OAAO,SAAyB,UAAwB;AACpF,UAAM,OAAO,QAAQ;AACrB,UAAM,SAAS,QAAQ,iBAAiB,MAAM,IAAI;AAClD,UAAM,QAAQ,YAAY,OAAO,KAAK;AAEtC,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,iBAAiB,CAAC;AAAA,EAC7D,CAAC;AAGD,UAAQ,KAAK,wBAAwB,OAAO,SAAyB,UAAwB;AAC3F,UAAM,WAAW,eAAe,OAAO;AACvC,UAAM,OAAO,QAAQ;AACrB,UAAM,QAAS,KAA2B;AAE1C,UAAM,QAAQ,MAAM,QAAQ,wBAAwB,OAAO,QAAQ;AAEnE,QAAI,SAAS,qBAAqB;AAChC,YAAM,oBAAoB,OAAO,EAAE,OAAO,SAAS,CAAC;AAAA,IACtD;AAEA,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,yDAAyD,CAAC;AAAA,EACrG,CAAC;AACH;AAUO,SAAS,aAAa,SAAsB,uBAAgC;AACjF,SAAO,OAAO,SAAyB,UAAwB;AAC7D,QAAI;AACF,YAAM,QAAQ,aAAa,SAAS,qBAAqB;AACzD,cAAQ,WAAW,MAAM,QAAQ,aAAa,KAAK;AAAA,IACrD,SAAS,OAAO;AACd,UAAI,iBAAiB,WAAW;AAC9B,eAAO,MACJ,OAAO,MAAM,UAAU,EACvB,KAAK,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,QAAQ,CAAC;AAAA,MACvD;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAQO,SAAS,YAAY,YAAyB,OAAiB;AACpE,QAAM,YAAY,QAAQ,UAAU,GAAG,KAAK;AAE5C,SAAO,OAAO,SAAyB,UAAwB;AAC7D,QAAI;AACF,YAAM,QAAQ,aAAa,OAAO;AAClC,YAAM,OAAO,MAAM,QAAQ,aAAa,KAAK;AAC7C,gBAAU,IAAI;AACd,cAAQ,WAAW;AAAA,IACrB,SAAS,OAAO;AACd,UAAI,iBAAiB,WAAW;AAC9B,eAAO,MACJ,OAAO,MAAM,UAAU,EACvB,KAAK,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,QAAQ,CAAC;AAAA,MACvD;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AASO,SAAS,uBAAuB,SAAsB,iBAAyB;AACpF,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKL,eAAe;AACb,aAAO,OAAO,SAAyB,UAAwB;AAC7D,YAAI;AACF,gBAAM,QAAQ,aAAa,SAAS,eAAe;AACnD,kBAAQ,WAAW,MAAM,QAAQ,aAAa,KAAK;AAAA,QACrD,SAAS,OAAO;AACd,cAAI,iBAAiB,WAAW;AAC9B,mBAAO,MACJ,OAAO,MAAM,UAAU,EACvB,KAAK,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,QAAQ,CAAC;AAAA,UACvD;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,eAAe,OAAiB;AAC9B,YAAM,YAAY,QAAQ,UAAU,GAAG,KAAK;AAE5C,aAAO,OAAO,SAAyB,UAAwB;AAC7D,YAAI;AACF,gBAAM,QAAQ,aAAa,SAAS,eAAe;AACnD,gBAAM,OAAO,MAAM,QAAQ,aAAa,KAAK;AAC7C,oBAAU,IAAI;AACd,kBAAQ,WAAW;AAAA,QACrB,SAAS,OAAO;AACd,cAAI,iBAAiB,WAAW;AAC9B,mBAAO,MACJ,OAAO,MAAM,UAAU,EACvB,KAAK,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,QAAQ,CAAC;AAAA,UACvD;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@forjakit/auth-fastify",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "scripts": {
+    "build": "tsup",
+    "clean": "rm -rf dist",
+    "dev": "tsup --watch"
+  },
+  "dependencies": {
+    "@forjakit/auth": "workspace:*",
+    "@fastify/cookie": "^11.0.0",
+    "fastify": "^5.2.2",
+    "zod": "^3.24.2"
+  },
+  "devDependencies": {
+    "tsup": "^8.4.0",
+    "typescript": "^5.7.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ]
+}