@gatwech/auth 1.0.0-beta.18 → 1.0.0-beta.20

package/dist/src/plugins/organization/routes/crud-team.d.ts

@@ -15,12 +15,12 @@ export declare const createTeam: <O extends OrganizationOptions>(options: O) =>
             roles: typeof import("..").defaultRoles & {
                 [key: string]: import("../../access").Role<{}>;
             };
-            getSession: (context: import("packages/core/dist/index-65G5U5DB.mjs").f) => Promise<{
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+            getSession: (context: import("packages/core/dist/index-Df0KhQRf.mjs").f) => Promise<{
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             }>;
         }>)[];
         metadata: {
@@ -84,12 +84,12 @@ export declare const createTeam: <O extends OrganizationOptions>(options: O) =>
             roles: typeof import("..").defaultRoles & {
                 [key: string]: import("../../access").Role<{}>;
             };
-            getSession: (context: import("packages/core/dist/index-65G5U5DB.mjs").f) => Promise<{
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+            getSession: (context: import("packages/core/dist/index-Df0KhQRf.mjs").f) => Promise<{
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             }>;
         }>)[];
         metadata: {
@@ -174,12 +174,12 @@ export declare const createTeam: <O extends OrganizationOptions>(options: O) =>
             roles: typeof import("..").defaultRoles & {
                 [key: string]: import("../../access").Role<{}>;
             };
-            getSession: (context: import("packages/core/dist/index-65G5U5DB.mjs").f) => Promise<{
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+            getSession: (context: import("packages/core/dist/index-Df0KhQRf.mjs").f) => Promise<{
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             }>;
         }>)[];
         metadata: {
@@ -280,12 +280,12 @@ export declare const createTeam: <O extends OrganizationOptions>(options: O) =>
             roles: typeof import("..").defaultRoles & {
                 [key: string]: import("../../access").Role<{}>;
             };
-            getSession: (context: import("packages/core/dist/index-65G5U5DB.mjs").f) => Promise<{
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+            getSession: (context: import("packages/core/dist/index-Df0KhQRf.mjs").f) => Promise<{
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             }>;
         }>)[];
         metadata: {
@@ -384,12 +384,12 @@ export declare const removeTeam: <O extends OrganizationOptions>(options: O) =>
             roles: typeof import("..").defaultRoles & {
                 [key: string]: import("../../access").Role<{}>;
             };
-            getSession: (context: import("packages/core/dist/index-65G5U5DB.mjs").f) => Promise<{
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+            getSession: (context: import("packages/core/dist/index-Df0KhQRf.mjs").f) => Promise<{
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             }>;
         }>)[];
         metadata: {
@@ -483,12 +483,12 @@ export declare const updateTeam: <O extends OrganizationOptions>(options: O) =>
             roles: typeof import("..").defaultRoles & {
                 [key: string]: import("../../access").Role<{}>;
             };
-            getSession: (context: import("packages/core/dist/index-65G5U5DB.mjs").f) => Promise<{
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+            getSession: (context: import("packages/core/dist/index-Df0KhQRf.mjs").f) => Promise<{
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             }>;
         }>) | ((inputContext: import("better-call").MiddlewareInputContext<{
             use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -516,11 +516,11 @@ export declare const updateTeam: <O extends OrganizationOptions>(options: O) =>
             }>)[];
         }>) => Promise<{
             session: {
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             };
         }>))[];
         metadata: {
@@ -672,12 +672,12 @@ export declare const listOrganizationTeams: <O extends OrganizationOptions>(opti
             roles: typeof import("..").defaultRoles & {
                 [key: string]: import("../../access").Role<{}>;
             };
-            getSession: (context: import("packages/core/dist/index-65G5U5DB.mjs").f) => Promise<{
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+            getSession: (context: import("packages/core/dist/index-Df0KhQRf.mjs").f) => Promise<{
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             }>;
         }>) | ((inputContext: import("better-call").MiddlewareInputContext<{
             use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -705,11 +705,11 @@ export declare const listOrganizationTeams: <O extends OrganizationOptions>(opti
             }>)[];
         }>) => Promise<{
             session: {
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             };
         }>))[];
     } & {
@@ -766,12 +766,12 @@ export declare const setActiveTeam: <O extends OrganizationOptions>(options: O)
             roles: typeof import("..").defaultRoles & {
                 [key: string]: import("../../access").Role<{}>;
             };
-            getSession: (context: import("packages/core/dist/index-65G5U5DB.mjs").f) => Promise<{
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+            getSession: (context: import("packages/core/dist/index-Df0KhQRf.mjs").f) => Promise<{
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             }>;
         }>) | ((inputContext: import("better-call").MiddlewareInputContext<{
             use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -799,11 +799,11 @@ export declare const setActiveTeam: <O extends OrganizationOptions>(options: O)
             }>)[];
         }>) => Promise<{
             session: {
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             };
         }>))[];
         metadata: {
@@ -897,12 +897,12 @@ export declare const listUserTeams: <O extends OrganizationOptions>(options: O)
             roles: typeof import("..").defaultRoles & {
                 [key: string]: import("../../access").Role<{}>;
             };
-            getSession: (context: import("packages/core/dist/index-65G5U5DB.mjs").f) => Promise<{
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+            getSession: (context: import("packages/core/dist/index-Df0KhQRf.mjs").f) => Promise<{
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             }>;
         }>) | ((inputContext: import("better-call").MiddlewareInputContext<{
             use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -930,11 +930,11 @@ export declare const listUserTeams: <O extends OrganizationOptions>(options: O)
             }>)[];
         }>) => Promise<{
             session: {
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             };
         }>))[];
     } & {
@@ -1031,12 +1031,12 @@ export declare const listTeamMembers: <O extends OrganizationOptions>(options: O
             roles: typeof import("..").defaultRoles & {
                 [key: string]: import("../../access").Role<{}>;
             };
-            getSession: (context: import("packages/core/dist/index-65G5U5DB.mjs").f) => Promise<{
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+            getSession: (context: import("packages/core/dist/index-Df0KhQRf.mjs").f) => Promise<{
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             }>;
         }>) | ((inputContext: import("better-call").MiddlewareInputContext<{
             use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -1064,11 +1064,11 @@ export declare const listTeamMembers: <O extends OrganizationOptions>(options: O
             }>)[];
         }>) => Promise<{
             session: {
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             };
         }>))[];
     } & {
@@ -1163,12 +1163,12 @@ export declare const addTeamMember: <O extends OrganizationOptions>(options: O)
             roles: typeof import("..").defaultRoles & {
                 [key: string]: import("../../access").Role<{}>;
             };
-            getSession: (context: import("packages/core/dist/index-65G5U5DB.mjs").f) => Promise<{
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+            getSession: (context: import("packages/core/dist/index-Df0KhQRf.mjs").f) => Promise<{
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             }>;
         }>) | ((inputContext: import("better-call").MiddlewareInputContext<{
             use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -1196,11 +1196,11 @@ export declare const addTeamMember: <O extends OrganizationOptions>(options: O)
             }>)[];
         }>) => Promise<{
             session: {
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             };
         }>))[];
     } & {
@@ -1276,12 +1276,12 @@ export declare const removeTeamMember: <O extends OrganizationOptions>(options:
             roles: typeof import("..").defaultRoles & {
                 [key: string]: import("../../access").Role<{}>;
             };
-            getSession: (context: import("packages/core/dist/index-65G5U5DB.mjs").f) => Promise<{
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+            getSession: (context: import("packages/core/dist/index-Df0KhQRf.mjs").f) => Promise<{
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             }>;
         }>) | ((inputContext: import("better-call").MiddlewareInputContext<{
             use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -1309,11 +1309,11 @@ export declare const removeTeamMember: <O extends OrganizationOptions>(options:
             }>)[];
         }>) => Promise<{
             session: {
-                session: import("packages/core/dist/index-65G5U5DB.mjs").bt & {
+                session: import("packages/core/dist/index-Df0KhQRf.mjs").bt & {
                     activeTeamId?: string | undefined;
                     activeOrganizationId?: string | undefined;
                 };
-                user: import("packages/core/dist/index-65G5U5DB.mjs")._t;
+                user: import("packages/core/dist/index-Df0KhQRf.mjs")._t;
             };
         }>))[];
     } & {

package/dist/src/plugins/sentinel/actions.d.ts

@@ -0,0 +1,64 @@
+import type { AuthContext } from "@gatwech/core";
+import { SECURITY_EVENT_TYPES } from "../audit-log/events";
+import { type EventContext } from "../audit-log/registry";
+import type { SentinelStore } from "./store";
+import type { SecurityAction } from "./types";
+type SecurityEventType = (typeof SECURITY_EVENT_TYPES)[keyof typeof SECURITY_EVENT_TYPES];
+export type Decision = {
+    outcome: "allow";
+} | {
+    outcome: "block";
+    reason: string;
+} | {
+    outcome: "challenge";
+    reason: string;
+    nonce: string;
+    difficulty: number;
+};
+/**
+ * Applies a security action: records the event and decides whether the
+ * request continues, gets a proof-of-work challenge or is blocked
+ */
+export declare function executeAction(params: {
+    auth: AuthContext;
+    event: EventContext;
+    store: SentinelStore;
+    action: SecurityAction;
+    eventType: SecurityEventType;
+    /** Short machine-readable reason, e.g. `credential_stuffing` */
+    reason: string;
+    ipAddress: string | null;
+    visitorId: string | null;
+    userId?: string | null | undefined;
+    identifier?: string | null | undefined;
+    /** The request carried a valid solution to an earlier challenge */
+    challengePassed: boolean;
+    difficulty: number;
+    metadata?: Record<string, unknown> | undefined;
+}): Promise<Decision>;
+export declare const SENTINEL_ERROR_CODES: {
+    readonly POW_CHALLENGE_REQUIRED: "Challenge required";
+    readonly SECURITY_BLOCKED: "Request blocked for security reasons";
+};
+/** The error for a decision, or null when the request is allowed */
+export declare function errorForDecision(decision: Decision): ({
+    status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | import("better-call").Status;
+    body: ({
+        message?: string;
+        code?: string;
+        cause?: unknown;
+    } & Record<string, any>) | undefined;
+    headers: HeadersInit;
+    statusCode: number;
+    name: string;
+    message: string;
+    stack?: string;
+    cause?: unknown;
+} & {
+    errorStack: string | undefined;
+}) | null;
+/** Throws the error for a decision, for use in endpoint hooks */
+export declare function throwForDecision(decision: Decision): void;
+/** Builds the response for a decision, for use in `onRequest` */
+export declare function responseForDecision(decision: Decision): Response | undefined;
+export {};

package/dist/src/plugins/sentinel/client.d.ts

@@ -0,0 +1,67 @@
+import type { sentinel } from ".";
+export declare const sentinelClient: (options?: {
+    /**
+     * Base URL of the hosted identify service. Without it, the fingerprint is
+     * sent as the visitor id.
+     */
+    identifyUrl?: string | undefined;
+    /**
+     * Identify request options
+     */
+    identifyOptions?: {
+        /**
+         * Request timeout in milliseconds
+         *
+         * @default 1000
+         */
+        timeout?: number | undefined;
+        /**
+         * Retries after a failed request, with exponential backoff
+         *
+         * @default { attempts: 2, baseDelay: 400, maxDelay: 600 }
+         */
+        retry?: {
+            attempts?: number | undefined;
+            baseDelay?: number | undefined;
+            maxDelay?: number | undefined;
+        } | undefined;
+        /**
+         * Additional headers, e.g. the publishable key
+         */
+        headers?: Record<string, string> | undefined;
+    } | undefined;
+    /**
+     * Return a browser fingerprint, e.g. from FingerprintJS. By default a
+     * random id is created and kept in `localStorage`.
+     */
+    getFingerprint?: (() => string | Promise<string>) | undefined;
+    /**
+     * Solve proof-of-work challenges and retry the request once
+     *
+     * @default true
+     */
+    autoSolveChallenge?: boolean | undefined;
+    /**
+     * Called when a proof-of-work challenge is received
+     */
+    onChallengeReceived?: ((reason: string) => void) | undefined;
+    /**
+     * Called after a challenge is solved
+     */
+    onChallengeSolved?: ((solveTimeMs: number) => void) | undefined;
+    /**
+     * Called when solving a challenge fails or its solution is rejected
+     */
+    onChallengeFailed?: ((error: Error) => void) | undefined;
+} | undefined) => {
+    id: "sentinel";
+    $InferServerPlugin: ReturnType<typeof sentinel>;
+    fetchPlugins: {
+        id: string;
+        name: string;
+        hooks: {
+            onRequest<T extends Record<string, any>>(context: import("@better-fetch/fetch").RequestContext<T>): Promise<import("@better-fetch/fetch").RequestContext<T>>;
+            onResponse({ response, request }: import("@better-fetch/fetch").ResponseContext): Promise<Response | undefined>;
+        };
+    }[];
+};

package/dist/src/plugins/sentinel/email.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Normalizes an email address so aliases of the same mailbox match:
+ * lowercases it, maps `googlemail.com` to `gmail.com`, removes dots in Gmail
+ * addresses and strips plus-address tags on providers that support them
+ */
+export declare function normalizeEmail(email: string): string;
+export declare function getEmailDomain(email: string): string;
+/**
+ * Whether a domain, or any parent domain, is a known disposable email
+ * provider. The list is loaded on first use.
+ */
+export declare function isDisposableDomain(domain: string): Promise<boolean>;
+/**
+ * Whether a domain can receive mail: it has an MX record, or an address
+ * record to fall back to when it has none. A null MX record, which marks a
+ * domain that accepts no mail, doesn't count.
+ *
+ * Returns null when that can't be told: runtimes without DNS access, lookup
+ * failures, or a lookup that takes longer than `timeoutMs`.
+ */
+export declare function hasMxRecords(domain: string, options?: {
+    timeoutMs?: number | undefined;
+}): Promise<boolean | null>;
+/**
+ * Heuristics for addresses that look generated rather than chosen by a
+ * person
+ */
+export declare function looksGenerated(email: string): boolean;

package/dist/src/plugins/sentinel/geo.d.ts

@@ -0,0 +1,22 @@
+/** Great-circle distance between two coordinates, in kilometres */
+export declare function haversineDistanceKm(from: {
+    latitude: number;
+    longitude: number;
+}, to: {
+    latitude: number;
+    longitude: number;
+}): number;
+/**
+ * Speed needed to travel between two sign-ins, in km/h. Distances under
+ * 50 km are treated as the same place, since IP geolocation isn't precise
+ * enough to tell them apart.
+ */
+export declare function travelSpeedKmh(from: {
+    latitude: number;
+    longitude: number;
+    at: Date;
+}, to: {
+    latitude: number;
+    longitude: number;
+    at: Date;
+}): number;