@furystack/rest-service 12.0.0 → 12.1.1

package/esm/login-response-strategy.spec.js

@@ -0,0 +1,78 @@
+import { InMemoryStore, User, addStore } from '@furystack/core';
+import { Injector } from '@furystack/inject';
+import { getRepository } from '@furystack/repository';
+import { PasswordCredential, PasswordResetToken, usePasswordPolicy } from '@furystack/security';
+import { usingAsync } from '@furystack/utils';
+import { describe, expect, it } from 'vitest';
+import { useHttpAuthentication } from './helpers.js';
+import { createCookieLoginStrategy } from './login-response-strategy.js';
+import { DefaultSession } from './models/default-session.js';
+const setupInjector = (i) => {
+    addStore(i, new InMemoryStore({ model: User, primaryKey: 'username' }))
+        .addStore(new InMemoryStore({ model: DefaultSession, primaryKey: 'sessionId' }))
+        .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+        .addStore(new InMemoryStore({ model: PasswordResetToken, primaryKey: 'token' }));
+    const repo = getRepository(i);
+    repo.createDataSet(User, 'username');
+    repo.createDataSet(DefaultSession, 'sessionId');
+    repo.createDataSet(PasswordCredential, 'userName');
+    repo.createDataSet(PasswordResetToken, 'token');
+    usePasswordPolicy(i);
+    useHttpAuthentication(i);
+};
+describe('createCookieLoginStrategy', () => {
+    const testUser = { username: 'testuser', roles: ['admin'] };
+    it('Should return the user as the response body', async () => {
+        await usingAsync(new Injector(), async (i) => {
+            setupInjector(i);
+            const strategy = createCookieLoginStrategy(i);
+            const result = await strategy.createLoginResponse(testUser, i);
+            expect(result.chunk).toEqual(testUser);
+        });
+    });
+    it('Should return status code 200', async () => {
+        await usingAsync(new Injector(), async (i) => {
+            setupInjector(i);
+            const strategy = createCookieLoginStrategy(i);
+            const result = await strategy.createLoginResponse(testUser, i);
+            expect(result.statusCode).toBe(200);
+        });
+    });
+    it('Should include a Set-Cookie header with the session ID', async () => {
+        await usingAsync(new Injector(), async (i) => {
+            setupInjector(i);
+            const strategy = createCookieLoginStrategy(i);
+            const result = await strategy.createLoginResponse(testUser, i);
+            const setCookie = result.headers['Set-Cookie'];
+            expect(setCookie).toBeDefined();
+            expect(setCookie).toContain('fss=');
+            expect(setCookie).toContain('Path=/');
+            expect(setCookie).toContain('HttpOnly');
+        });
+    });
+    it('Should persist the session in the DataSet', async () => {
+        await usingAsync(new Injector(), async (i) => {
+            setupInjector(i);
+            const strategy = createCookieLoginStrategy(i);
+            await strategy.createLoginResponse(testUser, i);
+            const repo = getRepository(i);
+            const sessionDataSet = repo.getDataSetFor(DefaultSession, 'sessionId');
+            const sessions = await sessionDataSet.find(i, { filter: { username: { $eq: 'testuser' } } });
+            expect(sessions).toHaveLength(1);
+            expect(sessions[0].username).toBe('testuser');
+            expect(sessions[0].sessionId).toBeTruthy();
+        });
+    });
+    it('Should create unique session IDs for each call', async () => {
+        await usingAsync(new Injector(), async (i) => {
+            setupInjector(i);
+            const strategy = createCookieLoginStrategy(i);
+            const result1 = await strategy.createLoginResponse(testUser, i);
+            const result2 = await strategy.createLoginResponse(testUser, i);
+            const sessionId1 = result1.headers['Set-Cookie']?.split('=')[1]?.split(';')[0];
+            const sessionId2 = result2.headers['Set-Cookie']?.split('=')[1]?.split(';')[0];
+            expect(sessionId1).not.toBe(sessionId2);
+        });
+    });
+});
+//# sourceMappingURL=login-response-strategy.spec.js.map

package/esm/login-response-strategy.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-response-strategy.spec.js","sourceRoot":"","sources":["../src/login-response-strategy.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAA;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAE5D,MAAM,aAAa,GAAG,CAAC,CAAW,EAAE,EAAE;IACpC,QAAQ,CAAC,CAAC,EAAE,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;SACpE,QAAQ,CAAC,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;SAC/E,QAAQ,CAAC,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;SAClF,QAAQ,CAAC,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IAElF,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACpC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;IAC/C,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAA;IAClD,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAA;IAE/C,iBAAiB,CAAC,CAAC,CAAC,CAAA;IACpB,qBAAqB,CAAC,CAAC,CAAC,CAAA;AAC1B,CAAC,CAAA;AAED,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,MAAM,QAAQ,GAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAA;IAEjE,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,UAAU,CAAC,IAAI,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3C,aAAa,CAAC,CAAC,CAAC,CAAA;YAChB,MAAM,QAAQ,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC9D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QACxC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,UAAU,CAAC,IAAI,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3C,aAAa,CAAC,CAAC,CAAC,CAAA;YAChB,MAAM,QAAQ,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC9D,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,UAAU,CAAC,IAAI,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3C,aAAa,CAAC,CAAC,CAAC,CAAA;YAChB,MAAM,QAAQ,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YAC9C,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;YAC/B,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACnC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACrC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,UAAU,CAAC,IAAI,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3C,aAAa,CAAC,CAAC,CAAC,CAAA;YAChB,MAAM,QAAQ,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAA;YAC7C,MAAM,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAE/C,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;YAC7B,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;YACtE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;YAC5F,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;YAChC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAC7C,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAA;QAC5C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,UAAU,CAAC,IAAI,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3C,aAAa,CAAC,CAAC,CAAC,CAAA;YAChB,MAAM,QAAQ,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAA;YAE7C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC/D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAE/D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAC9E,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@furystack/rest-service",
-  "version": "12.0.0",
+  "version": "12.1.1",
   "description": "REST API service implementation for FuryStack",
   "type": "module",
   "scripts": {
@@ -39,19 +39,19 @@
   },
   "homepage": "https://github.com/furystack/furystack",
   "dependencies": {
-    "@furystack/core": "^15.2.1",
+    "@furystack/core": "^15.2.2",
     "@furystack/inject": "^12.0.30",
-    "@furystack/repository": "^10.1.2",
-    "@furystack/rest": "^8.0.39",
-    "@furystack/security": "^7.0.0",
+    "@furystack/repository": "^10.1.3",
+    "@furystack/rest": "^8.0.40",
+    "@furystack/security": "^7.0.1",
     "@furystack/utils": "^8.1.10",
     "ajv": "^8.18.0",
     "ajv-formats": "^3.0.1",
     "path-to-regexp": "^8.3.0"
   },
   "devDependencies": {
-    "@furystack/rest-client-fetch": "^8.0.39",
-    "@types/node": "^25.3.0",
+    "@furystack/rest-client-fetch": "^8.0.40",
+    "@types/node": "^25.3.1",
     "@types/ws": "^8.18.1",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18",

package/src/actions/index.ts

@@ -4,3 +4,4 @@ export * from './is-authenticated.js'
 export * from './login.js'
 export * from './logout.js'
 export * from './not-found-action.js'
+export * from './password-login-action.js'

package/src/actions/login.ts

@@ -1,15 +1,20 @@
-import { HttpUserContext } from '../http-user-context.js'
 import type { User } from '@furystack/core'
 import { RequestError } from '@furystack/rest'
+import { sleepAsync } from '@furystack/utils'
+
+import { HttpUserContext } from '../http-user-context.js'
 import type { RequestAction } from '../request-action-implementation.js'
 import { JsonResult } from '../request-action-implementation.js'
 
 /**
- * Action that logs in the current user
- * Should be called with a JSON Post body with ``username`` and ``password`` fields.
- * Returns the current user instance
+ * Action that logs in the current user.
+ * Should be called with a JSON POST body with `username` and `password` fields.
+ * Returns the current user instance.
+ *
+ * @deprecated Use `createPasswordLoginAction(createCookieLoginStrategy(injector))` instead.
+ * This static action resolves services from the request-scoped injector on
+ * every call; the factory approach captures them once at setup time.
  */
-
 export const LoginAction: RequestAction<{
   result: User
   body: { username: string; password: string }
@@ -20,7 +25,8 @@ export const LoginAction: RequestAction<{
     const user = await userContext.authenticateUser(body.username, body.password)
     await userContext.cookieLogin(user, response)
     return JsonResult(user, 200)
-  } catch (error) {
+  } catch {
+    await sleepAsync(Math.random() * 1000)
     throw new RequestError('Login Failed', 400)
   }
 }

package/src/actions/password-login-action.spec.ts

@@ -0,0 +1,122 @@
+import { InMemoryStore, StoreManager, User, addStore } from '@furystack/core'
+import { Injector } from '@furystack/inject'
+import { getRepository } from '@furystack/repository'
+import { PasswordAuthenticator, PasswordCredential, PasswordResetToken, usePasswordPolicy } from '@furystack/security'
+import { usingAsync } from '@furystack/utils'
+import type { IncomingMessage, ServerResponse } from 'http'
+import { describe, expect, it, vi } from 'vitest'
+
+import { useHttpAuthentication } from '../helpers.js'
+import type { LoginResponseStrategy } from '../login-response-strategy.js'
+import { DefaultSession } from '../models/default-session.js'
+import { JsonResult } from '../request-action-implementation.js'
+import { createPasswordLoginAction } from './password-login-action.js'
+
+const setupInjector = async (i: Injector, username: string, password: string) => {
+  addStore(i, new InMemoryStore({ model: User, primaryKey: 'username' }))
+    .addStore(new InMemoryStore({ model: DefaultSession, primaryKey: 'sessionId' }))
+    .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+    .addStore(new InMemoryStore({ model: PasswordResetToken, primaryKey: 'token' }))
+
+  const repo = getRepository(i)
+  repo.createDataSet(User, 'username')
+  repo.createDataSet(DefaultSession, 'sessionId')
+  repo.createDataSet(PasswordCredential, 'userName')
+  repo.createDataSet(PasswordResetToken, 'token')
+
+  usePasswordPolicy(i)
+  useHttpAuthentication(i)
+
+  const sm = i.getInstance(StoreManager)
+  const pw = i.getInstance(PasswordAuthenticator)
+  const cred = await pw.hasher.createCredential(username, password)
+  await sm.getStoreFor(PasswordCredential, 'userName').add(cred)
+  await sm.getStoreFor(User, 'username').add({ username, roles: ['admin'] })
+}
+
+const mockStrategy: LoginResponseStrategy<User> = {
+  createLoginResponse: vi.fn(async (user: User) => JsonResult(user, 200)),
+}
+
+describe('createPasswordLoginAction', () => {
+  const request = {} as IncomingMessage
+  const response = {} as ServerResponse
+
+  it('Should delegate to the strategy on successful authentication', async () => {
+    await usingAsync(new Injector(), async (i) => {
+      await setupInjector(i, 'testuser', 'testpass')
+      const action = createPasswordLoginAction(mockStrategy)
+      const result = await action({
+        injector: i,
+        request,
+        response,
+        getBody: () => Promise.resolve({ username: 'testuser', password: 'testpass' }),
+      })
+      expect(mockStrategy.createLoginResponse).toHaveBeenCalled()
+      expect(result.chunk.username).toBe('testuser')
+    })
+  })
+
+  it('Should pass the correct user to the strategy', async () => {
+    await usingAsync(new Injector(), async (i) => {
+      await setupInjector(i, 'testuser', 'testpass')
+      const strategyFn = vi.fn(async (user: User) => JsonResult(user, 200))
+      const strategy: LoginResponseStrategy<User> = { createLoginResponse: strategyFn }
+      const action = createPasswordLoginAction(strategy)
+      await action({
+        injector: i,
+        request,
+        response,
+        getBody: () => Promise.resolve({ username: 'testuser', password: 'testpass' }),
+      })
+      expect(strategyFn).toHaveBeenCalledWith(expect.objectContaining({ username: 'testuser', roles: ['admin'] }), i)
+    })
+  })
+
+  it('Should throw RequestError on invalid credentials', async () => {
+    await usingAsync(new Injector(), async (i) => {
+      await setupInjector(i, 'testuser', 'testpass')
+      const action = createPasswordLoginAction(mockStrategy)
+      await expect(
+        action({
+          injector: i,
+          request,
+          response,
+          getBody: () => Promise.resolve({ username: 'testuser', password: 'wrongpass' }),
+        }),
+      ).rejects.toThrow('Login Failed')
+    })
+  })
+
+  it('Should throw RequestError for nonexistent user', async () => {
+    await usingAsync(new Injector(), async (i) => {
+      await setupInjector(i, 'testuser', 'testpass')
+      const action = createPasswordLoginAction(mockStrategy)
+      await expect(
+        action({
+          injector: i,
+          request,
+          response,
+          getBody: () => Promise.resolve({ username: 'nobody', password: 'nopass' }),
+        }),
+      ).rejects.toThrow('Login Failed')
+    })
+  })
+
+  it('Should work with a custom result type from strategy', async () => {
+    await usingAsync(new Injector(), async (i) => {
+      await setupInjector(i, 'testuser', 'testpass')
+      const tokenStrategy: LoginResponseStrategy<{ accessToken: string }> = {
+        createLoginResponse: async () => JsonResult({ accessToken: 'tok123' }, 200),
+      }
+      const action = createPasswordLoginAction(tokenStrategy)
+      const result = await action({
+        injector: i,
+        request,
+        response,
+        getBody: () => Promise.resolve({ username: 'testuser', password: 'testpass' }),
+      })
+      expect(result.chunk.accessToken).toBe('tok123')
+    })
+  })
+})

package/src/actions/password-login-action.ts

@@ -0,0 +1,35 @@
+import { RequestError } from '@furystack/rest'
+import { sleepAsync } from '@furystack/utils'
+
+import { HttpUserContext } from '../http-user-context.js'
+import type { LoginResponseStrategy } from '../login-response-strategy.js'
+import type { RequestAction } from '../request-action-implementation.js'
+
+/**
+ * Creates a login {@link RequestAction} that authenticates a user by
+ * username + password, then delegates session/token creation to the
+ * provided {@link LoginResponseStrategy}.
+ *
+ * The return type is inferred from the strategy:
+ * - Cookie strategy -> `ActionResult<User>`
+ * - JWT strategy   -> `ActionResult<{ accessToken: string; refreshToken: string }>`
+ *
+ * A random delay (0-1 s) is added on failure to mitigate timing attacks.
+ *
+ * @param strategy The login response strategy that produces the session/token result
+ * @returns A `RequestAction` that can be wired into a REST API route
+ */
+export const createPasswordLoginAction = <TResult>(
+  strategy: LoginResponseStrategy<TResult>,
+): RequestAction<{ result: TResult; body: { username: string; password: string } }> => {
+  return async ({ injector, getBody }) => {
+    const body = await getBody()
+    try {
+      const user = await injector.getInstance(HttpUserContext).authenticateUser(body.username, body.password)
+      return strategy.createLoginResponse(user, injector)
+    } catch {
+      await sleepAsync(Math.random() * 1000)
+      throw new RequestError('Login Failed', 400)
+    }
+  }
+}

package/src/helpers.ts

@@ -42,9 +42,7 @@ export const useHttpAuthentication = <TUser extends User, TSession extends Defau
   const mergedSettings = Object.assign(new HttpAuthenticationSettings<TUser, TSession>(), settings)
   const systemInjector = useSystemIdentityContext({ injector, username: 'useHttpAuthentication' })
   const passwordAuthenticator = injector.getInstance(PasswordAuthenticator)
-  const userDataSet = mergedSettings.getUserDataSet(systemInjector)
-  // Narrow from DataSet<TSession, keyof TSession> to DataSet<DefaultSession, 'sessionId'>
-  // because the built-in providers operate on DefaultSession with the concrete 'sessionId' key
+  const userDataSet = mergedSettings.getUserDataSet(systemInjector) as unknown as DataSet<User, 'username'>
   const sessionDataSet = mergedSettings.getSessionDataSet(systemInjector) as unknown as DataSet<
     DefaultSession,
     'sessionId'

package/src/http-authentication-settings.ts

@@ -1,30 +1,32 @@
-import { User } from '@furystack/core'
-import type { Constructable, Injector } from '@furystack/inject'
-import { Injectable } from '@furystack/inject'
-import type { DataSet } from '@furystack/repository'
-import { getDataSetFor } from '@furystack/repository'
-import type { AuthenticationProvider } from './authentication-providers/authentication-provider.js'
-import { DefaultSession } from './models/default-session.js'
-
-/**
- * Authentication settings object for FuryStack HTTP Api
- */
-@Injectable({ lifetime: 'singleton' })
-export class HttpAuthenticationSettings<TUser extends User, TSession extends DefaultSession> {
-  public model: Constructable<TUser> = User as Constructable<TUser>
-
-  public getUserDataSet = (injector: Injector) => getDataSetFor(injector, User, 'username')
-
-  public getSessionDataSet: (injector: Injector) => DataSet<TSession, keyof TSession> = (injector) =>
-    getDataSetFor(injector, DefaultSession, 'sessionId') as unknown as DataSet<TSession, keyof TSession>
-
-  public cookieName = 'fss'
-  public enableBasicAuth = true
-
-  /**
-   * Ordered list of authentication providers. Populated by {@link useHttpAuthentication}
-   * and extended by `useJwtAuthentication()` or other auth plugins.
-   * Safe to mutate only during setup, before the first request is served.
-   */
-  public authenticationProviders: AuthenticationProvider[] = []
-}
+import { User } from '@furystack/core'
+import type { Constructable, Injector } from '@furystack/inject'
+import { Injectable } from '@furystack/inject'
+import { getDataSetFor } from '@furystack/repository'
+import type { AuthenticationProvider } from './authentication-providers/authentication-provider.js'
+import { DefaultSession } from './models/default-session.js'
+
+/**
+ * Authentication settings object for FuryStack HTTP Api
+ */
+@Injectable({ lifetime: 'singleton' })
+export class HttpAuthenticationSettings<TUser extends User, TSession extends DefaultSession> {
+  public model: Constructable<TUser> = User as Constructable<TUser>
+
+  public getUserDataSet = (injector: Injector) =>
+    getDataSetFor(injector, this.model, 'username' as 'username' & keyof TUser)
+
+  public sessionModel: Constructable<TSession> = DefaultSession as Constructable<TSession>
+
+  public getSessionDataSet = (injector: Injector) =>
+    getDataSetFor(injector, this.sessionModel, 'sessionId' as 'sessionId' & keyof TSession)
+
+  public cookieName = 'fss'
+  public enableBasicAuth = true
+
+  /**
+   * Ordered list of authentication providers. Populated by {@link useHttpAuthentication}
+   * and extended by `useJwtAuthentication()` or other auth plugins.
+   * Safe to mutate only during setup, before the first request is served.
+   */
+  public authenticationProviders: AuthenticationProvider[] = []
+}