@gatwech/auth 1.0.0-beta.18

package/dist/index-34ONrP8l.d.mts

@@ -0,0 +1,503 @@
+import { t as Awaitable } from "./helper-tmxW3BHj.mjs";
+import { On as index_d_exports, g as User, h as Session } from "./index-Cxi7TbLE.mjs";
+import { t as InferOptionSchema } from "./plugins-hFZT3hmK.mjs";
+import * as _gatwech_core17 from "@gatwech/core";
+import { GenericEndpointContext } from "@gatwech/core";
+import * as better_call169 from "better-call";
+import * as z$1 from "zod";
+import * as jose0 from "jose";
+import { JSONWebKeySet, JWTPayload } from "jose";
+
+//#region src/plugins/jwt/schema.d.ts
+declare const schema: {
+  jwks: {
+    fields: {
+      publicKey: {
+        type: "string";
+        required: true;
+      };
+      privateKey: {
+        type: "string";
+        required: true;
+      };
+      createdAt: {
+        type: "date";
+        required: true;
+      };
+    };
+  };
+};
+//#endregion
+//#region src/plugins/jwt/types.d.ts
+interface JwtOptions {
+  jwks?: {
+    /**
+     * Disables the /jwks endpoint and uses this endpoint in discovery.
+     *
+     * Useful if jwks are not managed at /jwks or
+     * if your jwks are signed with a certificate and placed on your CDN.
+     */
+    remoteUrl?: string;
+    /**
+     * Key pair configuration
+     * @description A subset of the options available for the generateKeyPair function
+     *
+     * @see https://github.com/panva/jose/blob/main/src/runtime/node/generate.ts
+     *
+     * @default { alg: 'EdDSA', crv: 'Ed25519' }
+     */
+    keyPairConfig?: JWKOptions;
+    /**
+     * Disable private key encryption
+     * @description Disable the encryption of the private key in the database
+     *
+     * @default false
+     */
+    disablePrivateKeyEncryption?: boolean;
+  } | undefined;
+  jwt?: {
+    /**
+     * The issuer of the JWT
+     */
+    issuer?: string;
+    /**
+     * The audience of the JWT
+     */
+    audience?: string;
+    /**
+     * Set the "exp" (Expiration Time) Claim.
+     *
+     * - If a `number` is passed as an argument it is used as the claim directly.
+     * - If a `Date` instance is passed as an argument it is converted to unix timestamp and used as the
+     *   claim.
+     * - If a `string` is passed as an argument it is resolved to a time span, and then added to the
+     *   current unix timestamp and used as the claim.
+     *
+     * Format used for time span should be a number followed by a unit, such as "5 minutes" or "1
+     * day".
+     *
+     * Valid units are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins",
+     * "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year",
+     * "years", "yr", "yrs", and "y". It is not possible to specify months. 365.25 days is used as an
+     * alias for a year.
+     *
+     * If the string is suffixed with "ago", or prefixed with a "-", the resulting time span gets
+     * subtracted from the current unix timestamp. A "from now" suffix can also be used for
+     * readability when adding to the current unix timestamp.
+     *
+     * @default 15m
+     */
+    expirationTime?: number | string | Date;
+    /**
+     * A function that is called to define the payload of the JWT
+     */
+    definePayload?: (session: {
+      user: User & Record<string, any>;
+      session: Session & Record<string, any>;
+    }) => Promise<Record<string, any>> | Record<string, any>;
+    /**
+     * A function that is called to get the subject of the JWT
+     *
+     * @default session.user.id
+     */
+    getSubject?: (session: {
+      user: User & Record<string, any>;
+      session: Session & Record<string, any>;
+    }) => Promise<string> | string;
+    /**
+     * A custom function to remote sign the jwt payload.
+     *
+     * All headers, such as `alg` and `kid`,
+     * MUST be defined within this function.
+     * You can safely define the header `typ: 'JWT'`.
+     *
+     * @requires jwks.remoteUrl
+     * @invalidates other jwt.* options
+     */
+    sign?: (payload: JWTPayload) => Awaitable<string>;
+  } | undefined;
+  /**
+   * Disables setting JWTs through middleware.
+   *
+   * Recommended to set `true` when using an oAuth provider plugin
+   * like OIDC or MCP where session payloads should not be signed.
+   *
+   * @default false
+   */
+  disableSettingJwtHeader?: boolean | undefined;
+  /**
+   * Custom schema for the admin plugin
+   */
+  schema?: InferOptionSchema<typeof schema> | undefined;
+  /**
+   * Custom adapter for the jwt plugin
+   *
+   * This will override the default adapter
+   *
+   * @default adapter from the database
+   */
+  adapter?: {
+    /**
+     * A custom function to get the JWKS from the database or
+     * other source
+     *
+     * This will override the default getJwks from the database
+     *
+     * @param ctx - The context of the request
+     * @returns The JWKS
+     */
+    getJwks?: (ctx: index_d_exports.GenericEndpointContext) => Promise<Jwk[] | null | undefined>;
+    /**
+     * A custom function to get the latest key from the database or
+     * other source
+     *
+     * This will override the default getLatestKey from the database
+     *
+     * @param ctx - The context of the request
+     * @returns The latest key
+     */
+    getLatestKey?: (ctx: index_d_exports.GenericEndpointContext) => Promise<Jwk | null | undefined>;
+    /**
+     * A custom function to create a new key in the database or
+     * other source
+     *
+     * This will override the default createJwk from the database
+     *
+     * @param data - The key to create
+     * @returns The created key
+     */
+    createJwk?: (data: Omit<Jwk, "id">, ctx: index_d_exports.GenericEndpointContext) => Promise<Jwk>;
+  };
+}
+/**
+ * Asymmetric (JWS) Supported.
+ *
+ * @see https://github.com/panva/jose/issues/210
+ */
+type JWKOptions = {
+  alg: "EdDSA";
+  crv?: "Ed25519" | undefined;
+} | {
+  alg: "ES256";
+  crv?: never | undefined;
+} | {
+  alg: "ES512";
+  crv?: never | undefined;
+} | {
+  alg: "PS256";
+  modulusLength?: number | undefined;
+} | {
+  alg: "RS256";
+  modulusLength?: number | undefined;
+};
+type JWSAlgorithms = JWKOptions["alg"];
+interface Jwk {
+  id: string;
+  publicKey: string;
+  privateKey: string;
+  createdAt: Date;
+  alg?: JWSAlgorithms | undefined;
+  crv?: ("Ed25519" | "P-256" | "P-521") | undefined;
+}
+//#endregion
+//#region src/plugins/jwt/sign.d.ts
+declare function getJwtToken(ctx: GenericEndpointContext, options?: JwtOptions | undefined): Promise<string>;
+//#endregion
+//#region src/plugins/jwt/utils.d.ts
+declare function generateExportedKeyPair(options?: JwtOptions | undefined): Promise<{
+  publicWebKey: jose0.JWK;
+  privateWebKey: jose0.JWK;
+  alg: "EdDSA" | "ES256" | "ES512" | "PS256" | "RS256";
+  cfg: {
+    crv?: "Ed25519" | undefined;
+  } | {
+    crv?: never | undefined;
+  } | {
+    crv?: never | undefined;
+  } | {
+    modulusLength?: number | undefined;
+  } | {
+    modulusLength?: number | undefined;
+  };
+}>;
+/**
+ * Creates a Jwk on the database
+ *
+ * @param ctx
+ * @param options
+ * @returns
+ */
+declare function createJwk(ctx: GenericEndpointContext, options?: JwtOptions | undefined): Promise<Jwk>;
+//#endregion
+//#region src/plugins/jwt/index.d.ts
+declare const jwt: (options?: JwtOptions | undefined) => {
+  id: "jwt";
+  options: JwtOptions | undefined;
+  endpoints: {
+    getJwks: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0?: ({
+        body?: undefined;
+      } & {
+        method?: "GET" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call169.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }) | undefined): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: JSONWebKeySet;
+      } : JSONWebKeySet>;
+      options: {
+        method: "GET";
+        metadata: {
+          openapi: {
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        keys: {
+                          type: string;
+                          description: string;
+                          items: {
+                            type: string;
+                            properties: {
+                              kid: {
+                                type: string;
+                                description: string;
+                              };
+                              kty: {
+                                type: string;
+                                description: string;
+                              };
+                              alg: {
+                                type: string;
+                                description: string;
+                              };
+                              use: {
+                                type: string;
+                                description: string;
+                                enum: string[];
+                                nullable: boolean;
+                              };
+                              n: {
+                                type: string;
+                                description: string;
+                                nullable: boolean;
+                              };
+                              e: {
+                                type: string;
+                                description: string;
+                                nullable: boolean;
+                              };
+                              crv: {
+                                type: string;
+                                description: string;
+                                nullable: boolean;
+                              };
+                              x: {
+                                type: string;
+                                description: string;
+                                nullable: boolean;
+                              };
+                              y: {
+                                type: string;
+                                description: string;
+                                nullable: boolean;
+                              };
+                            };
+                            required: string[];
+                          };
+                        };
+                      };
+                      required: string[];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/jwks";
+    };
+    getToken: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+        body?: undefined;
+      } & {
+        method?: "GET" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call169.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          token: string;
+        };
+      } : {
+        token: string;
+      }>;
+      options: {
+        method: "GET";
+        requireHeaders: true;
+        use: ((inputContext: better_call169.MiddlewareInputContext<better_call169.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        metadata: {
+          openapi: {
+            description: string;
+            responses: {
+              200: {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        token: {
+                          type: string;
+                        };
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      } & {
+        use: any[];
+      };
+      path: "/token";
+    };
+    signJWT: {
+      <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+        body: {
+          payload: JWTPayload;
+          overrideOptions?: JwtOptions | undefined;
+        };
+      } & {
+        method?: "POST" | undefined;
+      } & {
+        query?: Record<string, any> | undefined;
+      } & {
+        params?: Record<string, any>;
+      } & {
+        request?: Request;
+      } & {
+        headers?: HeadersInit;
+      } & {
+        asResponse?: boolean;
+        returnHeaders?: boolean;
+        use?: better_call169.Middleware[];
+        path?: string;
+      } & {
+        asResponse?: AsResponse | undefined;
+        returnHeaders?: ReturnHeaders | undefined;
+      }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+        headers: Headers;
+        response: {
+          token: string;
+        };
+      } : {
+        token: string;
+      }>;
+      options: {
+        method: "POST";
+        metadata: {
+          SERVER_ONLY: true;
+          $Infer: {
+            body: {
+              payload: JWTPayload;
+              overrideOptions?: JwtOptions | undefined;
+            };
+          };
+        };
+        body: z$1.ZodObject<{
+          payload: z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>;
+          overrideOptions: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
+        }, z$1.core.$strip>;
+      } & {
+        use: any[];
+      };
+      path: "/sign-jwt";
+    };
+  };
+  hooks: {
+    after: {
+      matcher(context: _gatwech_core17.HookEndpointContext): boolean;
+      handler: (inputContext: better_call169.MiddlewareInputContext<better_call169.MiddlewareOptions>) => Promise<void>;
+    }[];
+  };
+  schema: {
+    jwks: {
+      fields: {
+        publicKey: {
+          type: "string";
+          required: true;
+        };
+        privateKey: {
+          type: "string";
+          required: true;
+        };
+        createdAt: {
+          type: "date";
+          required: true;
+        };
+      };
+    };
+  };
+};
+//#endregion
+export { JWKOptions as a, JwtOptions as c, getJwtToken as i, createJwk as n, JWSAlgorithms as o, generateExportedKeyPair as r, Jwk as s, jwt as t };