@gatwech/auth 1.0.0-beta.18

package/dist/parser-DcrIEuXE.mjs

@@ -0,0 +1,73 @@
+//#region src/client/parser.ts
+const PROTO_POLLUTION_PATTERNS = {
+	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
+	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
+	protoShort: /"__proto__"\s*:/,
+	constructorShort: /"constructor"\s*:/
+};
+const JSON_SIGNATURE = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
+const SPECIAL_VALUES = {
+	true: true,
+	false: false,
+	null: null,
+	undefined: void 0,
+	nan: NaN,
+	infinity: Number.POSITIVE_INFINITY,
+	"-infinity": Number.NEGATIVE_INFINITY
+};
+const ISO_DATE_REGEX = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,7}))?(?:Z|([+-])(\d{2}):(\d{2}))$/;
+function isValidDate(date) {
+	return date instanceof Date && !isNaN(date.getTime());
+}
+function parseISODate(value) {
+	const match = ISO_DATE_REGEX.exec(value);
+	if (!match) return null;
+	const [, year, month, day, hour, minute, second, ms, offsetSign, offsetHour, offsetMinute] = match;
+	let date = new Date(Date.UTC(parseInt(year, 10), parseInt(month, 10) - 1, parseInt(day, 10), parseInt(hour, 10), parseInt(minute, 10), parseInt(second, 10), ms ? parseInt(ms.padEnd(3, "0"), 10) : 0));
+	if (offsetSign) {
+		const offset = (parseInt(offsetHour, 10) * 60 + parseInt(offsetMinute, 10)) * (offsetSign === "+" ? -1 : 1);
+		date.setUTCMinutes(date.getUTCMinutes() + offset);
+	}
+	return isValidDate(date) ? date : null;
+}
+function betterJSONParse(value, options = {}) {
+	const { strict = false, warnings = false, reviver, parseDates = true } = options;
+	if (typeof value !== "string") return value;
+	const trimmed = value.trim();
+	if (trimmed.length > 0 && trimmed[0] === "\"" && trimmed.endsWith("\"") && !trimmed.slice(1, -1).includes("\"")) return trimmed.slice(1, -1);
+	const lowerValue = trimmed.toLowerCase();
+	if (lowerValue.length <= 9 && lowerValue in SPECIAL_VALUES) return SPECIAL_VALUES[lowerValue];
+	if (!JSON_SIGNATURE.test(trimmed)) {
+		if (strict) throw new SyntaxError("[better-json] Invalid JSON");
+		return value;
+	}
+	if (Object.entries(PROTO_POLLUTION_PATTERNS).some(([key, pattern]) => {
+		const matches = pattern.test(trimmed);
+		if (matches && warnings) console.warn(`[better-json] Detected potential prototype pollution attempt using ${key} pattern`);
+		return matches;
+	}) && strict) throw new Error("[better-json] Potential prototype pollution attempt detected");
+	try {
+		const secureReviver = (key, value$1) => {
+			if (key === "__proto__" || key === "constructor" && value$1 && typeof value$1 === "object" && "prototype" in value$1) {
+				if (warnings) console.warn(`[better-json] Dropping "${key}" key to prevent prototype pollution`);
+				return;
+			}
+			if (parseDates && typeof value$1 === "string") {
+				const date = parseISODate(value$1);
+				if (date) return date;
+			}
+			return reviver ? reviver(key, value$1) : value$1;
+		};
+		return JSON.parse(trimmed, secureReviver);
+	} catch (error) {
+		if (strict) throw error;
+		return value;
+	}
+}
+function parseJSON(value, options = { strict: true }) {
+	return betterJSONParse(value, options);
+}
+var parser_default = parseJSON;
+
+//#endregion
+export { parser_default as n, parseJSON as t };

package/dist/passkey-CcD4CnhM.mjs

@@ -0,0 +1,558 @@
+import { t as generateId } from "./utils-SOMB4Px5.mjs";
+import { r as generateRandomString } from "./crypto-Bb42eMrH.mjs";
+import { c as setSessionCookie } from "./cookies-cJObLwn1.mjs";
+import { n as mergeSchema } from "./date-Cx2yCiC4.mjs";
+import { r as getSessionFromCtx, t as freshSessionMiddleware, u as sessionMiddleware } from "./session-Dgp133Yt.mjs";
+import { defineErrorCodes } from "@gatwech/core/utils";
+import { APIError } from "better-call";
+import { createAuthEndpoint } from "@gatwech/core/api";
+import * as z$1 from "zod";
+import { base64 } from "@gatwech/utils/base64";
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from "@simplewebauthn/server";
+
+//#region src/plugins/passkey/error-codes.ts
+const PASSKEY_ERROR_CODES = defineErrorCodes({
+	CHALLENGE_NOT_FOUND: "Challenge not found",
+	YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: "You are not allowed to register this passkey",
+	FAILED_TO_VERIFY_REGISTRATION: "Failed to verify registration",
+	PASSKEY_NOT_FOUND: "Passkey not found",
+	AUTHENTICATION_FAILED: "Authentication failed",
+	UNABLE_TO_CREATE_SESSION: "Unable to create session",
+	FAILED_TO_UPDATE_PASSKEY: "Failed to update passkey"
+});
+
+//#endregion
+//#region src/plugins/passkey/schema.ts
+const schema = { passkey: { fields: {
+	name: {
+		type: "string",
+		required: false
+	},
+	publicKey: {
+		type: "string",
+		required: true
+	},
+	userId: {
+		type: "string",
+		references: {
+			model: "user",
+			field: "id"
+		},
+		required: true
+	},
+	credentialID: {
+		type: "string",
+		required: true
+	},
+	counter: {
+		type: "number",
+		required: true
+	},
+	deviceType: {
+		type: "string",
+		required: true
+	},
+	backedUp: {
+		type: "boolean",
+		required: true
+	},
+	transports: {
+		type: "string",
+		required: false
+	},
+	createdAt: {
+		type: "date",
+		required: false
+	},
+	aaguid: {
+		type: "string",
+		required: false
+	}
+} } };
+
+//#endregion
+//#region src/plugins/passkey/utils.ts
+function getRpID(options, baseURL) {
+	return options.rpID || (baseURL ? new URL(baseURL).hostname : "localhost");
+}
+
+//#endregion
+//#region src/plugins/passkey/index.ts
+const passkey = (options) => {
+	const opts = {
+		origin: null,
+		...options,
+		advanced: {
+			webAuthnChallengeCookie: "payvo-auth-passkey",
+			...options?.advanced
+		}
+	};
+	const expirationTime = new Date(Date.now() + 1e3 * 60 * 5);
+	const currentTime = /* @__PURE__ */ new Date();
+	const maxAgeInSeconds = Math.floor((expirationTime.getTime() - currentTime.getTime()) / 1e3);
+	return {
+		id: "passkey",
+		endpoints: {
+			generatePasskeyRegistrationOptions: createAuthEndpoint("/passkey/generate-register-options", {
+				method: "GET",
+				use: [freshSessionMiddleware],
+				query: z$1.object({
+					authenticatorAttachment: z$1.enum(["platform", "cross-platform"]).optional(),
+					name: z$1.string().optional()
+				}).optional(),
+				metadata: {
+					client: false,
+					openapi: {
+						description: "Generate registration options for a new passkey",
+						responses: { 200: {
+							description: "Success",
+							parameters: { query: {
+								authenticatorAttachment: {
+									description: `Type of authenticator to use for registration.
+                          "platform" for device-specific authenticators,
+                          "cross-platform" for authenticators that can be used across devices.`,
+									required: false
+								},
+								name: {
+									description: `Optional custom name for the passkey.
+                          This can help identify the passkey when managing multiple credentials.`,
+									required: false
+								}
+							} },
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									challenge: { type: "string" },
+									rp: {
+										type: "object",
+										properties: {
+											name: { type: "string" },
+											id: { type: "string" }
+										}
+									},
+									user: {
+										type: "object",
+										properties: {
+											id: { type: "string" },
+											name: { type: "string" },
+											displayName: { type: "string" }
+										}
+									},
+									pubKeyCredParams: {
+										type: "array",
+										items: {
+											type: "object",
+											properties: {
+												type: { type: "string" },
+												alg: { type: "number" }
+											}
+										}
+									},
+									timeout: { type: "number" },
+									excludeCredentials: {
+										type: "array",
+										items: {
+											type: "object",
+											properties: {
+												id: { type: "string" },
+												type: { type: "string" },
+												transports: {
+													type: "array",
+													items: { type: "string" }
+												}
+											}
+										}
+									},
+									authenticatorSelection: {
+										type: "object",
+										properties: {
+											authenticatorAttachment: { type: "string" },
+											requireResidentKey: { type: "boolean" },
+											userVerification: { type: "string" }
+										}
+									},
+									attestation: { type: "string" },
+									extensions: { type: "object" }
+								}
+							} } }
+						} }
+					}
+				}
+			}, async (ctx) => {
+				const { session } = ctx.context;
+				const userPasskeys = await ctx.context.adapter.findMany({
+					model: "passkey",
+					where: [{
+						field: "userId",
+						value: session.user.id
+					}]
+				});
+				const userID = new TextEncoder().encode(generateRandomString(32, "a-z", "0-9"));
+				let options$1;
+				options$1 = await generateRegistrationOptions({
+					rpName: opts.rpName || ctx.context.appName,
+					rpID: getRpID(opts, ctx.context.options.baseURL),
+					userID,
+					userName: ctx.query?.name || session.user.email || session.user.id,
+					userDisplayName: session.user.email || session.user.id,
+					attestationType: "none",
+					excludeCredentials: userPasskeys.map((passkey$1) => ({
+						id: passkey$1.credentialID,
+						transports: passkey$1.transports?.split(",")
+					})),
+					authenticatorSelection: {
+						residentKey: "preferred",
+						userVerification: "preferred",
+						...opts.authenticatorSelection || {},
+						...ctx.query?.authenticatorAttachment ? { authenticatorAttachment: ctx.query.authenticatorAttachment } : {}
+					}
+				});
+				const id = generateId(32);
+				const webAuthnCookie = ctx.context.createAuthCookie(opts.advanced.webAuthnChallengeCookie);
+				await ctx.setSignedCookie(webAuthnCookie.name, id, ctx.context.secret, {
+					...webAuthnCookie.attributes,
+					maxAge: maxAgeInSeconds
+				});
+				await ctx.context.internalAdapter.createVerificationValue({
+					identifier: id,
+					value: JSON.stringify({
+						expectedChallenge: options$1.challenge,
+						userData: { id: session.user.id }
+					}),
+					expiresAt: expirationTime
+				});
+				return ctx.json(options$1, { status: 200 });
+			}),
+			generatePasskeyAuthenticationOptions: createAuthEndpoint("/passkey/generate-authenticate-options", {
+				method: "POST",
+				metadata: { openapi: {
+					description: "Generate authentication options for a passkey",
+					responses: { 200: {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								challenge: { type: "string" },
+								rp: {
+									type: "object",
+									properties: {
+										name: { type: "string" },
+										id: { type: "string" }
+									}
+								},
+								user: {
+									type: "object",
+									properties: {
+										id: { type: "string" },
+										name: { type: "string" },
+										displayName: { type: "string" }
+									}
+								},
+								timeout: { type: "number" },
+								allowCredentials: {
+									type: "array",
+									items: {
+										type: "object",
+										properties: {
+											id: { type: "string" },
+											type: { type: "string" },
+											transports: {
+												type: "array",
+												items: { type: "string" }
+											}
+										}
+									}
+								},
+								userVerification: { type: "string" },
+								authenticatorSelection: {
+									type: "object",
+									properties: {
+										authenticatorAttachment: { type: "string" },
+										requireResidentKey: { type: "boolean" },
+										userVerification: { type: "string" }
+									}
+								},
+								extensions: { type: "object" }
+							}
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const session = await getSessionFromCtx(ctx);
+				let userPasskeys = [];
+				if (session) userPasskeys = await ctx.context.adapter.findMany({
+					model: "passkey",
+					where: [{
+						field: "userId",
+						value: session.user.id
+					}]
+				});
+				const options$1 = await generateAuthenticationOptions({
+					rpID: getRpID(opts, ctx.context.options.baseURL),
+					userVerification: "preferred",
+					...userPasskeys.length ? { allowCredentials: userPasskeys.map((passkey$1) => ({
+						id: passkey$1.credentialID,
+						transports: passkey$1.transports?.split(",")
+					})) } : {}
+				});
+				const data = {
+					expectedChallenge: options$1.challenge,
+					userData: { id: session?.user.id || "" }
+				};
+				const id = generateId(32);
+				const webAuthnCookie = ctx.context.createAuthCookie(opts.advanced.webAuthnChallengeCookie);
+				await ctx.setSignedCookie(webAuthnCookie.name, id, ctx.context.secret, {
+					...webAuthnCookie.attributes,
+					maxAge: maxAgeInSeconds
+				});
+				await ctx.context.internalAdapter.createVerificationValue({
+					identifier: id,
+					value: JSON.stringify(data),
+					expiresAt: expirationTime
+				});
+				return ctx.json(options$1, { status: 200 });
+			}),
+			verifyPasskeyRegistration: createAuthEndpoint("/passkey/verify-registration", {
+				method: "POST",
+				body: z$1.object({
+					response: z$1.any(),
+					name: z$1.string().meta({ description: "Name of the passkey" }).optional()
+				}),
+				use: [freshSessionMiddleware],
+				metadata: { openapi: {
+					description: "Verify registration of a new passkey",
+					responses: {
+						200: {
+							description: "Success",
+							content: { "application/json": { schema: { $ref: "#/components/schemas/Passkey" } } }
+						},
+						400: { description: "Bad request" }
+					}
+				} }
+			}, async (ctx) => {
+				const origin = options?.origin || ctx.headers?.get("origin") || "";
+				if (!origin) return ctx.json(null, { status: 400 });
+				const resp = ctx.body.response;
+				const webAuthnCookie = ctx.context.createAuthCookie(opts.advanced.webAuthnChallengeCookie);
+				const challengeId = await ctx.getSignedCookie(webAuthnCookie.name, ctx.context.secret);
+				if (!challengeId) throw new APIError("BAD_REQUEST", { message: PASSKEY_ERROR_CODES.CHALLENGE_NOT_FOUND });
+				const data = await ctx.context.internalAdapter.findVerificationValue(challengeId);
+				if (!data) return ctx.json(null, { status: 400 });
+				const { expectedChallenge, userData } = JSON.parse(data.value);
+				if (userData.id !== ctx.context.session.user.id) throw new APIError("UNAUTHORIZED", { message: PASSKEY_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY });
+				try {
+					const { verified, registrationInfo } = await verifyRegistrationResponse({
+						response: resp,
+						expectedChallenge,
+						expectedOrigin: origin,
+						expectedRPID: getRpID(opts, ctx.context.options.baseURL),
+						requireUserVerification: false
+					});
+					if (!verified || !registrationInfo) return ctx.json(null, { status: 400 });
+					const { aaguid, credentialDeviceType, credentialBackedUp, credential, credentialType } = registrationInfo;
+					const pubKey = base64.encode(credential.publicKey);
+					const newPasskey = {
+						name: ctx.body.name,
+						userId: userData.id,
+						credentialID: credential.id,
+						publicKey: pubKey,
+						counter: credential.counter,
+						deviceType: credentialDeviceType,
+						transports: resp.response.transports.join(","),
+						backedUp: credentialBackedUp,
+						createdAt: /* @__PURE__ */ new Date(),
+						aaguid
+					};
+					const newPasskeyRes = await ctx.context.adapter.create({
+						model: "passkey",
+						data: newPasskey
+					});
+					return ctx.json(newPasskeyRes, { status: 200 });
+				} catch (e) {
+					console.log(e);
+					throw new APIError("INTERNAL_SERVER_ERROR", { message: PASSKEY_ERROR_CODES.FAILED_TO_VERIFY_REGISTRATION });
+				}
+			}),
+			verifyPasskeyAuthentication: createAuthEndpoint("/passkey/verify-authentication", {
+				method: "POST",
+				body: z$1.object({ response: z$1.record(z$1.any(), z$1.any()) }),
+				metadata: {
+					openapi: {
+						description: "Verify authentication of a passkey",
+						responses: { 200: {
+							description: "Success",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									session: { $ref: "#/components/schemas/Session" },
+									user: { $ref: "#/components/schemas/User" }
+								}
+							} } }
+						} }
+					},
+					$Infer: { body: {} }
+				}
+			}, async (ctx) => {
+				const origin = options?.origin || ctx.headers?.get("origin") || "";
+				if (!origin) throw new APIError("BAD_REQUEST", { message: "origin missing" });
+				const resp = ctx.body.response;
+				const webAuthnCookie = ctx.context.createAuthCookie(opts.advanced.webAuthnChallengeCookie);
+				const challengeId = await ctx.getSignedCookie(webAuthnCookie.name, ctx.context.secret);
+				if (!challengeId) throw new APIError("BAD_REQUEST", { message: PASSKEY_ERROR_CODES.CHALLENGE_NOT_FOUND });
+				const data = await ctx.context.internalAdapter.findVerificationValue(challengeId);
+				if (!data) throw new APIError("BAD_REQUEST", { message: PASSKEY_ERROR_CODES.CHALLENGE_NOT_FOUND });
+				const { expectedChallenge } = JSON.parse(data.value);
+				const passkey$1 = await ctx.context.adapter.findOne({
+					model: "passkey",
+					where: [{
+						field: "credentialID",
+						value: resp.id
+					}]
+				});
+				if (!passkey$1) throw new APIError("UNAUTHORIZED", { message: PASSKEY_ERROR_CODES.PASSKEY_NOT_FOUND });
+				try {
+					const verification = await verifyAuthenticationResponse({
+						response: resp,
+						expectedChallenge,
+						expectedOrigin: origin,
+						expectedRPID: getRpID(opts, ctx.context.options.baseURL),
+						credential: {
+							id: passkey$1.credentialID,
+							publicKey: base64.decode(passkey$1.publicKey).slice(),
+							counter: passkey$1.counter,
+							transports: passkey$1.transports?.split(",")
+						},
+						requireUserVerification: false
+					});
+					const { verified } = verification;
+					if (!verified) throw new APIError("UNAUTHORIZED", { message: PASSKEY_ERROR_CODES.AUTHENTICATION_FAILED });
+					await ctx.context.adapter.update({
+						model: "passkey",
+						where: [{
+							field: "id",
+							value: passkey$1.id
+						}],
+						update: { counter: verification.authenticationInfo.newCounter }
+					});
+					const s = await ctx.context.internalAdapter.createSession(passkey$1.userId);
+					if (!s) throw new APIError("INTERNAL_SERVER_ERROR", { message: PASSKEY_ERROR_CODES.UNABLE_TO_CREATE_SESSION });
+					const user = await ctx.context.internalAdapter.findUserById(passkey$1.userId);
+					if (!user) throw new APIError("INTERNAL_SERVER_ERROR", { message: "User not found" });
+					await setSessionCookie(ctx, {
+						session: s,
+						user
+					});
+					return ctx.json({ session: s }, { status: 200 });
+				} catch (e) {
+					ctx.context.logger.error("Failed to verify authentication", e);
+					throw new APIError("BAD_REQUEST", { message: PASSKEY_ERROR_CODES.AUTHENTICATION_FAILED });
+				}
+			}),
+			listPasskeys: createAuthEndpoint("/passkey/list-user-passkeys", {
+				method: "GET",
+				use: [sessionMiddleware],
+				metadata: { openapi: {
+					description: "List all passkeys for the authenticated user",
+					responses: { "200": {
+						description: "Passkeys retrieved successfully",
+						content: { "application/json": { schema: {
+							type: "array",
+							items: {
+								$ref: "#/components/schemas/Passkey",
+								required: [
+									"id",
+									"userId",
+									"publicKey",
+									"createdAt",
+									"updatedAt"
+								]
+							},
+							description: "Array of passkey objects associated with the user"
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const passkeys = await ctx.context.adapter.findMany({
+					model: "passkey",
+					where: [{
+						field: "userId",
+						value: ctx.context.session.user.id
+					}]
+				});
+				return ctx.json(passkeys, { status: 200 });
+			}),
+			deletePasskey: createAuthEndpoint("/passkey/delete-passkey", {
+				method: "POST",
+				body: z$1.object({ id: z$1.string().meta({ description: "The ID of the passkey to delete. Eg: \"some-passkey-id\"" }) }),
+				use: [sessionMiddleware],
+				metadata: { openapi: {
+					description: "Delete a specific passkey",
+					responses: { "200": {
+						description: "Passkey deleted successfully",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { status: {
+								type: "boolean",
+								description: "Indicates whether the deletion was successful"
+							} },
+							required: ["status"]
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				await ctx.context.adapter.delete({
+					model: "passkey",
+					where: [{
+						field: "id",
+						value: ctx.body.id
+					}]
+				});
+				return ctx.json(null, { status: 200 });
+			}),
+			updatePasskey: createAuthEndpoint("/passkey/update-passkey", {
+				method: "POST",
+				body: z$1.object({
+					id: z$1.string().meta({ description: `The ID of the passkey which will be updated. Eg: \"passkey-id\"` }),
+					name: z$1.string().meta({ description: `The new name which the passkey will be updated to. Eg: \"my-new-passkey-name\"` })
+				}),
+				use: [sessionMiddleware],
+				metadata: { openapi: {
+					description: "Update a specific passkey's name",
+					responses: { "200": {
+						description: "Passkey updated successfully",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { passkey: { $ref: "#/components/schemas/Passkey" } },
+							required: ["passkey"]
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const passkey$1 = await ctx.context.adapter.findOne({
+					model: "passkey",
+					where: [{
+						field: "id",
+						value: ctx.body.id
+					}]
+				});
+				if (!passkey$1) throw new APIError("NOT_FOUND", { message: PASSKEY_ERROR_CODES.PASSKEY_NOT_FOUND });
+				if (passkey$1.userId !== ctx.context.session.user.id) throw new APIError("UNAUTHORIZED", { message: PASSKEY_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY });
+				const updatedPasskey = await ctx.context.adapter.update({
+					model: "passkey",
+					where: [{
+						field: "id",
+						value: ctx.body.id
+					}],
+					update: { name: ctx.body.name }
+				});
+				if (!updatedPasskey) throw new APIError("INTERNAL_SERVER_ERROR", { message: PASSKEY_ERROR_CODES.FAILED_TO_UPDATE_PASSKEY });
+				return ctx.json({ passkey: updatedPasskey }, { status: 200 });
+			})
+		},
+		schema: mergeSchema(schema, options?.schema),
+		$ERROR_CODES: PASSKEY_ERROR_CODES
+	};
+};
+
+//#endregion
+export { passkey as t };

package/dist/password-sVC4nePO.mjs

@@ -0,0 +1,25 @@
+import { APIError } from "better-call";
+
+//#region src/utils/password.ts
+async function validatePassword(ctx, data) {
+	const credentialAccount = (await ctx.context.internalAdapter.findAccounts(data.userId))?.find((account) => account.providerId === "credential");
+	const currentPassword = credentialAccount?.password;
+	if (!credentialAccount || !currentPassword) return false;
+	return await ctx.context.password.verify({
+		hash: currentPassword,
+		password: data.password
+	});
+}
+async function checkPassword(userId, c) {
+	const credentialAccount = (await c.context.internalAdapter.findAccounts(userId))?.find((account) => account.providerId === "credential");
+	const currentPassword = credentialAccount?.password;
+	if (!credentialAccount || !currentPassword || !c.body.password) throw new APIError("BAD_REQUEST", { message: "No password credential found" });
+	if (!await c.context.password.verify({
+		hash: currentPassword,
+		password: c.body.password
+	})) throw new APIError("BAD_REQUEST", { message: "Invalid password" });
+	return true;
+}
+
+//#endregion
+export { validatePassword as n, checkPassword as t };

package/dist/permission-DLYUF3cW.mjs

@@ -0,0 +1,15 @@
+//#region src/plugins/organization/permission.ts
+const hasPermissionFn = (input, acRoles) => {
+	if (!input.permissions && !input.permission) return false;
+	const roles = input.role.split(",");
+	const creatorRole = input.options.creatorRole || "owner";
+	const isCreator = roles.includes(creatorRole);
+	const allowCreatorsAllPermissions = input.allowCreatorAllPermissions || false;
+	if (isCreator && allowCreatorsAllPermissions) return true;
+	for (const role of roles) if ((acRoles[role]?.authorize(input.permissions ?? input.permission))?.success) return true;
+	return false;
+};
+let cacheAllRoles = /* @__PURE__ */ new Map();
+
+//#endregion
+export { hasPermissionFn as n, cacheAllRoles as t };