@gatwech/auth 1.0.0-beta.18

package/dist/phone-number-rHDIlh-2.mjs

@@ -0,0 +1,485 @@
+import { r as generateRandomString } from "./crypto-Bb42eMrH.mjs";
+import { c as setSessionCookie } from "./cookies-cJObLwn1.mjs";
+import { n as mergeSchema, t as getDate } from "./date-Cx2yCiC4.mjs";
+import { r as getSessionFromCtx } from "./session-Dgp133Yt.mjs";
+import { BASE_ERROR_CODES } from "@gatwech/core/error";
+import { defineErrorCodes } from "@gatwech/core/utils";
+import { APIError } from "better-call";
+import { createAuthEndpoint } from "@gatwech/core/api";
+import * as z$1 from "zod";
+
+//#region src/plugins/phone-number/phone-number-error.ts
+const ERROR_CODES = defineErrorCodes({
+	INVALID_PHONE_NUMBER: "Invalid phone number",
+	PHONE_NUMBER_EXIST: "Phone number already exists",
+	INVALID_PHONE_NUMBER_OR_PASSWORD: "Invalid phone number or password",
+	UNEXPECTED_ERROR: "Unexpected error",
+	OTP_NOT_FOUND: "OTP not found",
+	OTP_EXPIRED: "OTP expired",
+	INVALID_OTP: "Invalid OTP",
+	PHONE_NUMBER_NOT_VERIFIED: "Phone number not verified"
+});
+
+//#endregion
+//#region src/plugins/phone-number/index.ts
+function generateOTP(size) {
+	return generateRandomString(size, "0-9");
+}
+const phoneNumber = (options) => {
+	const opts = {
+		expiresIn: options?.expiresIn || 300,
+		otpLength: options?.otpLength || 6,
+		...options,
+		phoneNumber: "phoneNumber",
+		phoneNumberVerified: "phoneNumberVerified",
+		code: "code",
+		createdAt: "createdAt"
+	};
+	return {
+		id: "phone-number",
+		endpoints: {
+			signInPhoneNumber: createAuthEndpoint("/sign-in/phone-number", {
+				method: "POST",
+				body: z$1.object({
+					phoneNumber: z$1.string().meta({ description: "Phone number to sign in. Eg: \"+1234567890\"" }),
+					password: z$1.string().meta({ description: "Password to use for sign in." }),
+					rememberMe: z$1.boolean().meta({ description: "Remember the session. Eg: true" }).optional()
+				}),
+				metadata: { openapi: {
+					summary: "Sign in with phone number",
+					description: "Use this endpoint to sign in with phone number",
+					responses: {
+						200: {
+							description: "Success",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									user: { $ref: "#/components/schemas/User" },
+									session: { $ref: "#/components/schemas/Session" }
+								}
+							} } }
+						},
+						400: { description: "Invalid phone number or password" }
+					}
+				} }
+			}, async (ctx) => {
+				const { password, phoneNumber: phoneNumber$1 } = ctx.body;
+				if (opts.phoneNumberValidator) {
+					if (!await opts.phoneNumberValidator(ctx.body.phoneNumber)) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_PHONE_NUMBER });
+				}
+				const user = await ctx.context.adapter.findOne({
+					model: "user",
+					where: [{
+						field: "phoneNumber",
+						value: phoneNumber$1
+					}]
+				});
+				if (!user) throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.INVALID_PHONE_NUMBER_OR_PASSWORD });
+				if (opts.requireVerification) {
+					if (!user.phoneNumberVerified) {
+						const otp = generateOTP(opts.otpLength);
+						await ctx.context.internalAdapter.createVerificationValue({
+							value: otp,
+							identifier: phoneNumber$1,
+							expiresAt: getDate(opts.expiresIn, "sec")
+						});
+						await opts.sendOTP?.({
+							phoneNumber: phoneNumber$1,
+							code: otp
+						}, ctx.request);
+						throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.PHONE_NUMBER_NOT_VERIFIED });
+					}
+				}
+				const credentialAccount = (await ctx.context.internalAdapter.findAccountByUserId(user.id)).find((a) => a.providerId === "credential");
+				if (!credentialAccount) {
+					ctx.context.logger.error("Credential account not found", { phoneNumber: phoneNumber$1 });
+					throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.INVALID_PHONE_NUMBER_OR_PASSWORD });
+				}
+				const currentPassword = credentialAccount?.password;
+				if (!currentPassword) {
+					ctx.context.logger.error("Password not found", { phoneNumber: phoneNumber$1 });
+					throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.UNEXPECTED_ERROR });
+				}
+				if (!await ctx.context.password.verify({
+					hash: currentPassword,
+					password
+				})) {
+					ctx.context.logger.error("Invalid password");
+					throw new APIError("UNAUTHORIZED", { message: ERROR_CODES.INVALID_PHONE_NUMBER_OR_PASSWORD });
+				}
+				const session = await ctx.context.internalAdapter.createSession(user.id, ctx.body.rememberMe === false);
+				if (!session) {
+					ctx.context.logger.error("Failed to create session");
+					throw new APIError("UNAUTHORIZED", { message: BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION });
+				}
+				await setSessionCookie(ctx, {
+					session,
+					user
+				}, ctx.body.rememberMe === false);
+				return ctx.json({
+					token: session.token,
+					user: {
+						id: user.id,
+						email: user.email,
+						emailVerified: user.emailVerified,
+						name: user.name,
+						image: user.image,
+						phoneNumber: user.phoneNumber,
+						phoneNumberVerified: user.phoneNumberVerified,
+						createdAt: user.createdAt,
+						updatedAt: user.updatedAt
+					}
+				});
+			}),
+			sendPhoneNumberOTP: createAuthEndpoint("/phone-number/send-otp", {
+				method: "POST",
+				body: z$1.object({ phoneNumber: z$1.string().meta({ description: "Phone number to send OTP. Eg: \"+1234567890\"" }) }),
+				metadata: { openapi: {
+					summary: "Send OTP to phone number",
+					description: "Use this endpoint to send OTP to phone number",
+					responses: { 200: {
+						description: "Success",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { message: { type: "string" } }
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				if (!options?.sendOTP) {
+					ctx.context.logger.warn("sendOTP not implemented");
+					throw new APIError("NOT_IMPLEMENTED", { message: "sendOTP not implemented" });
+				}
+				if (opts.phoneNumberValidator) {
+					if (!await opts.phoneNumberValidator(ctx.body.phoneNumber)) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_PHONE_NUMBER });
+				}
+				const code = generateOTP(opts.otpLength);
+				await ctx.context.internalAdapter.createVerificationValue({
+					value: `${code}:0`,
+					identifier: ctx.body.phoneNumber,
+					expiresAt: getDate(opts.expiresIn, "sec")
+				});
+				await options.sendOTP({
+					phoneNumber: ctx.body.phoneNumber,
+					code
+				}, ctx.request);
+				return ctx.json({ message: "code sent" });
+			}),
+			verifyPhoneNumber: createAuthEndpoint("/phone-number/verify", {
+				method: "POST",
+				body: z$1.object({
+					phoneNumber: z$1.string().meta({ description: "Phone number to verify. Eg: \"+1234567890\"" }),
+					code: z$1.string().meta({ description: "OTP code. Eg: \"123456\"" }),
+					disableSession: z$1.boolean().meta({ description: "Disable session creation after verification. Eg: false" }).optional(),
+					updatePhoneNumber: z$1.boolean().meta({ description: "Check if there is a session and update the phone number. Eg: true" }).optional()
+				}),
+				metadata: { openapi: {
+					summary: "Verify phone number",
+					description: "Use this endpoint to verify phone number",
+					responses: {
+						"200": {
+							description: "Phone number verified successfully",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									status: {
+										type: "boolean",
+										description: "Indicates if the verification was successful",
+										enum: [true]
+									},
+									token: {
+										type: "string",
+										nullable: true,
+										description: "Session token if session is created, null if disableSession is true or no session is created"
+									},
+									user: {
+										type: "object",
+										nullable: true,
+										properties: {
+											id: {
+												type: "string",
+												description: "Unique identifier of the user"
+											},
+											email: {
+												type: "string",
+												format: "email",
+												nullable: true,
+												description: "User's email address"
+											},
+											emailVerified: {
+												type: "boolean",
+												nullable: true,
+												description: "Whether the email is verified"
+											},
+											name: {
+												type: "string",
+												nullable: true,
+												description: "User's name"
+											},
+											image: {
+												type: "string",
+												format: "uri",
+												nullable: true,
+												description: "User's profile image URL"
+											},
+											phoneNumber: {
+												type: "string",
+												description: "User's phone number"
+											},
+											phoneNumberVerified: {
+												type: "boolean",
+												description: "Whether the phone number is verified"
+											},
+											createdAt: {
+												type: "string",
+												format: "date-time",
+												description: "Timestamp when the user was created"
+											},
+											updatedAt: {
+												type: "string",
+												format: "date-time",
+												description: "Timestamp when the user was last updated"
+											}
+										},
+										required: [
+											"id",
+											"phoneNumber",
+											"phoneNumberVerified",
+											"createdAt",
+											"updatedAt"
+										],
+										description: "User object with phone number details, null if no user is created or found"
+									}
+								},
+								required: ["status"]
+							} } }
+						},
+						400: { description: "Invalid OTP" }
+					}
+				} }
+			}, async (ctx) => {
+				const otp = await ctx.context.internalAdapter.findVerificationValue(ctx.body.phoneNumber);
+				if (!otp || otp.expiresAt < /* @__PURE__ */ new Date()) {
+					if (otp && otp.expiresAt < /* @__PURE__ */ new Date()) throw new APIError("BAD_REQUEST", { message: "OTP expired" });
+					throw new APIError("BAD_REQUEST", { message: ERROR_CODES.OTP_NOT_FOUND });
+				}
+				const [otpValue, attempts] = otp.value.split(":");
+				const allowedAttempts = options?.allowedAttempts || 3;
+				if (attempts && parseInt(attempts) >= allowedAttempts) {
+					await ctx.context.internalAdapter.deleteVerificationValue(otp.id);
+					throw new APIError("FORBIDDEN", { message: "Too many attempts" });
+				}
+				if (otpValue !== ctx.body.code) {
+					await ctx.context.internalAdapter.updateVerificationValue(otp.id, { value: `${otpValue}:${parseInt(attempts || "0") + 1}` });
+					throw new APIError("BAD_REQUEST", { message: "Invalid OTP" });
+				}
+				await ctx.context.internalAdapter.deleteVerificationValue(otp.id);
+				if (ctx.body.updatePhoneNumber) {
+					const session = await getSessionFromCtx(ctx);
+					if (!session) throw new APIError("UNAUTHORIZED", { message: BASE_ERROR_CODES.USER_NOT_FOUND });
+					if ((await ctx.context.adapter.findMany({
+						model: "user",
+						where: [{
+							field: "phoneNumber",
+							value: ctx.body.phoneNumber
+						}]
+					})).length) throw ctx.error("BAD_REQUEST", { message: ERROR_CODES.PHONE_NUMBER_EXIST });
+					let user$1 = await ctx.context.internalAdapter.updateUser(session.user.id, {
+						[opts.phoneNumber]: ctx.body.phoneNumber,
+						[opts.phoneNumberVerified]: true
+					});
+					return ctx.json({
+						status: true,
+						token: session.session.token,
+						user: {
+							id: user$1.id,
+							email: user$1.email,
+							emailVerified: user$1.emailVerified,
+							name: user$1.name,
+							image: user$1.image,
+							phoneNumber: user$1.phoneNumber,
+							phoneNumberVerified: user$1.phoneNumberVerified,
+							createdAt: user$1.createdAt,
+							updatedAt: user$1.updatedAt
+						}
+					});
+				}
+				let user = await ctx.context.adapter.findOne({
+					model: "user",
+					where: [{
+						value: ctx.body.phoneNumber,
+						field: opts.phoneNumber
+					}]
+				});
+				if (!user) {
+					if (options?.signUpOnVerification) {
+						user = await ctx.context.internalAdapter.createUser({
+							email: options.signUpOnVerification.getTempEmail(ctx.body.phoneNumber),
+							name: options.signUpOnVerification.getTempName ? options.signUpOnVerification.getTempName(ctx.body.phoneNumber) : ctx.body.phoneNumber,
+							[opts.phoneNumber]: ctx.body.phoneNumber,
+							[opts.phoneNumberVerified]: true
+						});
+						if (!user) throw new APIError("INTERNAL_SERVER_ERROR", { message: BASE_ERROR_CODES.FAILED_TO_CREATE_USER });
+					}
+				} else user = await ctx.context.internalAdapter.updateUser(user.id, { [opts.phoneNumberVerified]: true });
+				if (!user) throw new APIError("INTERNAL_SERVER_ERROR", { message: BASE_ERROR_CODES.FAILED_TO_UPDATE_USER });
+				await options?.callbackOnVerification?.({
+					phoneNumber: ctx.body.phoneNumber,
+					user
+				}, ctx.request);
+				if (!ctx.body.disableSession) {
+					const session = await ctx.context.internalAdapter.createSession(user.id);
+					if (!session) throw new APIError("INTERNAL_SERVER_ERROR", { message: BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION });
+					await setSessionCookie(ctx, {
+						session,
+						user
+					});
+					return ctx.json({
+						status: true,
+						token: session.token,
+						user: {
+							id: user.id,
+							email: user.email,
+							emailVerified: user.emailVerified,
+							name: user.name,
+							image: user.image,
+							phoneNumber: user.phoneNumber,
+							phoneNumberVerified: user.phoneNumberVerified,
+							createdAt: user.createdAt,
+							updatedAt: user.updatedAt
+						}
+					});
+				}
+				return ctx.json({
+					status: true,
+					token: null,
+					user: {
+						id: user.id,
+						email: user.email,
+						emailVerified: user.emailVerified,
+						name: user.name,
+						image: user.image,
+						phoneNumber: user.phoneNumber,
+						phoneNumberVerified: user.phoneNumberVerified,
+						createdAt: user.createdAt,
+						updatedAt: user.updatedAt
+					}
+				});
+			}),
+			requestPasswordResetPhoneNumber: createAuthEndpoint("/phone-number/request-password-reset", {
+				method: "POST",
+				body: z$1.object({ phoneNumber: z$1.string() }),
+				metadata: { openapi: {
+					description: "Request OTP for password reset via phone number",
+					responses: { "200": {
+						description: "OTP sent successfully for password reset",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { status: {
+								type: "boolean",
+								description: "Indicates if the OTP was sent successfully",
+								enum: [true]
+							} },
+							required: ["status"]
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				if (!await ctx.context.adapter.findOne({
+					model: "user",
+					where: [{
+						value: ctx.body.phoneNumber,
+						field: opts.phoneNumber
+					}]
+				})) throw new APIError("BAD_REQUEST", { message: "phone number isn't registered" });
+				const code = generateOTP(opts.otpLength);
+				await ctx.context.internalAdapter.createVerificationValue({
+					value: `${code}:0`,
+					identifier: `${ctx.body.phoneNumber}-request-password-reset`,
+					expiresAt: getDate(opts.expiresIn, "sec")
+				});
+				await options?.sendPasswordResetOTP?.({
+					phoneNumber: ctx.body.phoneNumber,
+					code
+				}, ctx.request);
+				return ctx.json({ status: true });
+			}),
+			resetPasswordPhoneNumber: createAuthEndpoint("/phone-number/reset-password", {
+				method: "POST",
+				body: z$1.object({
+					otp: z$1.string().meta({ description: "The one time password to reset the password. Eg: \"123456\"" }),
+					phoneNumber: z$1.string().meta({ description: "The phone number to the account which intends to reset the password for. Eg: \"+1234567890\"" }),
+					newPassword: z$1.string().meta({ description: `The new password. Eg: "new-and-secure-password"` })
+				}),
+				metadata: { openapi: {
+					description: "Reset password using phone number OTP",
+					responses: { "200": {
+						description: "Password reset successfully",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { status: {
+								type: "boolean",
+								description: "Indicates if the password was reset successfully",
+								enum: [true]
+							} },
+							required: ["status"]
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const verification = await ctx.context.internalAdapter.findVerificationValue(`${ctx.body.phoneNumber}-request-password-reset`);
+				if (!verification) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.OTP_NOT_FOUND });
+				if (verification.expiresAt < /* @__PURE__ */ new Date()) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.OTP_EXPIRED });
+				const [otpValue, attempts] = verification.value.split(":");
+				const allowedAttempts = options?.allowedAttempts || 3;
+				if (attempts && parseInt(attempts) >= allowedAttempts) {
+					await ctx.context.internalAdapter.deleteVerificationValue(verification.id);
+					throw new APIError("FORBIDDEN", { message: "Too many attempts" });
+				}
+				if (ctx.body.otp !== otpValue) {
+					await ctx.context.internalAdapter.updateVerificationValue(verification.id, { value: `${otpValue}:${parseInt(attempts || "0") + 1}` });
+					throw new APIError("BAD_REQUEST", { message: ERROR_CODES.INVALID_OTP });
+				}
+				const user = await ctx.context.adapter.findOne({
+					model: "user",
+					where: [{
+						field: "phoneNumber",
+						value: ctx.body.phoneNumber
+					}]
+				});
+				if (!user) throw new APIError("BAD_REQUEST", { message: ERROR_CODES.UNEXPECTED_ERROR });
+				const hashedPassword = await ctx.context.password.hash(ctx.body.newPassword);
+				await ctx.context.internalAdapter.updatePassword(user.id, hashedPassword);
+				await ctx.context.internalAdapter.deleteVerificationValue(verification.id);
+				return ctx.json({ status: true });
+			})
+		},
+		schema: mergeSchema(schema, options?.schema),
+		rateLimit: [{
+			pathMatcher(path) {
+				return path.startsWith("/phone-number");
+			},
+			window: 60 * 1e3,
+			max: 10
+		}],
+		$ERROR_CODES: ERROR_CODES
+	};
+};
+const schema = { user: { fields: {
+	phoneNumber: {
+		type: "string",
+		required: false,
+		unique: true,
+		sortable: true,
+		returned: true
+	},
+	phoneNumberVerified: {
+		type: "boolean",
+		required: false,
+		returned: true,
+		input: false
+	}
+} } };
+
+//#endregion
+export { phoneNumber as t };

package/dist/plugin-helper-4L-lzsjZ.mjs

@@ -0,0 +1,16 @@
+import { APIError } from "better-call";
+
+//#region src/utils/plugin-helper.ts
+const getEndpointResponse = async (ctx) => {
+	const returned = ctx.context.returned;
+	if (!returned) return null;
+	if (returned instanceof Response) {
+		if (returned.status !== 200) return null;
+		return await returned.clone().json();
+	}
+	if (returned instanceof APIError) return null;
+	return returned;
+};
+
+//#endregion
+export { getEndpointResponse as t };

package/dist/plugins/access/index.d.mts

@@ -0,0 +1,3 @@
+import "../../helper-tmxW3BHj.mjs";
+import { a as Role, c as Subset, i as AccessControl, n as createAccessControl, o as Statements, r as role, s as SubArray, t as AuthorizeResponse } from "../../index-C7fQuk-V.mjs";
+export { AccessControl, AuthorizeResponse, Role, Statements, SubArray, Subset, createAccessControl, role };

package/dist/plugins/access/index.mjs

@@ -0,0 +1,3 @@
+import { n as role, t as createAccessControl } from "../../access-BO2g7QVe.mjs";
+
+export { createAccessControl, role };

package/dist/plugins/admin/access/index.d.mts

@@ -0,0 +1,116 @@
+import "../../../helper-tmxW3BHj.mjs";
+import { c as Subset, t as AuthorizeResponse } from "../../../index-C7fQuk-V.mjs";
+
+//#region src/plugins/admin/access/statement.d.ts
+declare const defaultStatements: {
+  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+  readonly session: readonly ["list", "revoke", "delete"];
+};
+declare const defaultAc: {
+  newRole<K extends "session" | "user">(statements: Subset<K, {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  }>): {
+    authorize<K_1 extends K>(request: K_1 extends infer T extends keyof Subset<K, {
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+      readonly session: readonly ["list", "revoke", "delete"];
+    }> ? { [key in T]?: Subset<K, {
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+      readonly session: readonly ["list", "revoke", "delete"];
+    }>[key] | {
+      actions: Subset<K, {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+      }>[key];
+      connector: "OR" | "AND";
+    } | undefined } : never, connector?: "OR" | "AND"): AuthorizeResponse;
+    statements: Subset<K, {
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+      readonly session: readonly ["list", "revoke", "delete"];
+    }>;
+  };
+  statements: {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  };
+};
+declare const adminAc: {
+  authorize<K extends "session" | "user">(request: K extends infer T extends keyof Subset<"session" | "user", {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  }> ? { [key in T]?: Subset<"session" | "user", {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  }>[key] | {
+    actions: Subset<"session" | "user", {
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+      readonly session: readonly ["list", "revoke", "delete"];
+    }>[key];
+    connector: "OR" | "AND";
+  } | undefined } : never, connector?: "OR" | "AND"): AuthorizeResponse;
+  statements: Subset<"session" | "user", {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  }>;
+};
+declare const userAc: {
+  authorize<K extends "session" | "user">(request: K extends infer T extends keyof Subset<"session" | "user", {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  }> ? { [key in T]?: Subset<"session" | "user", {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  }>[key] | {
+    actions: Subset<"session" | "user", {
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+      readonly session: readonly ["list", "revoke", "delete"];
+    }>[key];
+    connector: "OR" | "AND";
+  } | undefined } : never, connector?: "OR" | "AND"): AuthorizeResponse;
+  statements: Subset<"session" | "user", {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  }>;
+};
+declare const defaultRoles: {
+  admin: {
+    authorize<K extends "session" | "user">(request: K extends infer T extends keyof Subset<"session" | "user", {
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+      readonly session: readonly ["list", "revoke", "delete"];
+    }> ? { [key in T]?: Subset<"session" | "user", {
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+      readonly session: readonly ["list", "revoke", "delete"];
+    }>[key] | {
+      actions: Subset<"session" | "user", {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+      }>[key];
+      connector: "OR" | "AND";
+    } | undefined } : never, connector?: "OR" | "AND"): AuthorizeResponse;
+    statements: Subset<"session" | "user", {
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+      readonly session: readonly ["list", "revoke", "delete"];
+    }>;
+  };
+  user: {
+    authorize<K extends "session" | "user">(request: K extends infer T extends keyof Subset<"session" | "user", {
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+      readonly session: readonly ["list", "revoke", "delete"];
+    }> ? { [key in T]?: Subset<"session" | "user", {
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+      readonly session: readonly ["list", "revoke", "delete"];
+    }>[key] | {
+      actions: Subset<"session" | "user", {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+      }>[key];
+      connector: "OR" | "AND";
+    } | undefined } : never, connector?: "OR" | "AND"): AuthorizeResponse;
+    statements: Subset<"session" | "user", {
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+      readonly session: readonly ["list", "revoke", "delete"];
+    }>;
+  };
+};
+//#endregion
+export { adminAc, defaultAc, defaultRoles, defaultStatements, userAc };

package/dist/plugins/admin/access/index.mjs

@@ -0,0 +1,4 @@
+import "../../../access-BO2g7QVe.mjs";
+import { a as userAc, i as defaultStatements, n as defaultAc, r as defaultRoles, t as adminAc } from "../../../access-DT1f6l5k.mjs";
+
+export { adminAc, defaultAc, defaultRoles, defaultStatements, userAc };

package/dist/plugins/admin/index.d.mts

@@ -0,0 +1,9 @@
+import "../../helper-tmxW3BHj.mjs";
+import "../../index-Cxi7TbLE.mjs";
+import "../../types-B1OL7hyf.mjs";
+import "../../index-65G5U5DB-DSdjzreF.mjs";
+import "../../plugins-hFZT3hmK.mjs";
+import "../../index-C7fQuk-V.mjs";
+import { a as UserWithRole, i as SessionWithImpersonatedBy, n as AdminOptions, r as InferAdminRolesFromOption, t as admin } from "../../admin-DtfO1PLg.mjs";
+import "../../index-DB7t8whN.mjs";
+export { AdminOptions, InferAdminRolesFromOption, SessionWithImpersonatedBy, UserWithRole, admin };

package/dist/plugins/admin/index.mjs

@@ -0,0 +1,22 @@
+import "../../utils-SOMB4Px5.mjs";
+import "../../url-VB2gAbTI.mjs";
+import "../../api-0pR_I-Nx.mjs";
+import "../../get-request-ip-DSjrEpGo.mjs";
+import "../../json-D0TBLy4q.mjs";
+import "../../crypto-Bb42eMrH.mjs";
+import "../../jwt-CmxZAGe2.mjs";
+import "../../cookies-cJObLwn1.mjs";
+import "../../date-Cx2yCiC4.mjs";
+import "../../db-BrstmDhc.mjs";
+import "../../dialect-CeddeGHf.mjs";
+import "../../get-tables-BQP7YW9c.mjs";
+import "../../types-Bjn15Uy6.mjs";
+import "../../misc-beA1w3XV.mjs";
+import "../../session-Dgp133Yt.mjs";
+import "../../plugin-helper-4L-lzsjZ.mjs";
+import "../../access-BO2g7QVe.mjs";
+import "../../access-DT1f6l5k.mjs";
+import { t as admin } from "../../admin-Bcq53Nwj.mjs";
+import "../../has-permission-BpAr7uCn.mjs";
+
+export { admin };

package/dist/plugins/anonymous/index.d.mts

@@ -0,0 +1,7 @@
+import "../../helper-tmxW3BHj.mjs";
+import "../../index-Cxi7TbLE.mjs";
+import "../../types-B1OL7hyf.mjs";
+import "../../index-65G5U5DB-DSdjzreF.mjs";
+import "../../plugins-hFZT3hmK.mjs";
+import { n as UserWithAnonymous, r as anonymous, t as AnonymousOptions } from "../../index-B3n8e37d.mjs";
+export { AnonymousOptions, UserWithAnonymous, anonymous };