@gatwech/auth 1.0.0-beta.18

package/dist/src/plugins/admin/client.d.ts

@@ -0,0 +1,62 @@
+import { type AccessControl, type Role } from "../access";
+import type { admin } from "./admin";
+interface AdminClientOptions {
+    ac?: AccessControl | undefined;
+    roles?: {
+        [key in string]: Role;
+    } | undefined;
+}
+export declare const adminClient: <O extends AdminClientOptions>(options?: O | undefined) => {
+    id: "admin-client";
+    $InferServerPlugin: ReturnType<typeof admin<{
+        ac: O["ac"] extends AccessControl ? O["ac"] : AccessControl<{
+            readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+            readonly session: readonly ["list", "revoke", "delete"];
+        }>;
+        roles: O["roles"] extends Record<string, Role> ? O["roles"] : {
+            admin: Role;
+            user: Role;
+        };
+    }>>;
+    getActions: () => {
+        admin: {
+            checkRolePermission: <R extends O extends {
+                roles: any;
+            } ? keyof O["roles"] : "admin" | "user">(data: ({
+                /**
+                 * @deprecated Use `permissions` instead
+                 */
+                permission: { [key in keyof (O["ac"] extends AccessControl<infer S extends import("../access").Statements> ? S : {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                })]?: ((O["ac"] extends AccessControl<infer S extends import("../access").Statements> ? S : {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                })[key] extends readonly unknown[] ? (O["ac"] extends AccessControl<infer S extends import("../access").Statements> ? S : {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                })[key][number] : never)[] | undefined; };
+                permissions?: never | undefined;
+            } | {
+                permissions: { [key in keyof (O["ac"] extends AccessControl<infer S extends import("../access").Statements> ? S : {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                })]?: ((O["ac"] extends AccessControl<infer S extends import("../access").Statements> ? S : {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                })[key] extends readonly unknown[] ? (O["ac"] extends AccessControl<infer S extends import("../access").Statements> ? S : {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                })[key][number] : never)[] | undefined; };
+                permission?: never | undefined;
+            }) & {
+                role: R;
+            }) => boolean;
+        };
+    };
+    pathMethods: {
+        "/admin/list-users": "GET";
+        "/admin/stop-impersonating": "POST";
+    };
+};
+export {};

package/dist/src/plugins/admin/error-codes.d.ts

@@ -0,0 +1,21 @@
+export declare const ADMIN_ERROR_CODES: {
+    readonly FAILED_TO_CREATE_USER: "Failed to create user";
+    readonly USER_ALREADY_EXISTS: "User already exists.";
+    readonly USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "User already exists. Use another email.";
+    readonly YOU_CANNOT_BAN_YOURSELF: "You cannot ban yourself";
+    readonly YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE: "You are not allowed to change users role";
+    readonly YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS: "You are not allowed to create users";
+    readonly YOU_ARE_NOT_ALLOWED_TO_LIST_USERS: "You are not allowed to list users";
+    readonly YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS: "You are not allowed to list users sessions";
+    readonly YOU_ARE_NOT_ALLOWED_TO_BAN_USERS: "You are not allowed to ban users";
+    readonly YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS: "You are not allowed to impersonate users";
+    readonly YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS: "You are not allowed to revoke users sessions";
+    readonly YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS: "You are not allowed to delete users";
+    readonly YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD: "You are not allowed to set users password";
+    readonly BANNED_USER: "You have been banned from this application";
+    readonly YOU_ARE_NOT_ALLOWED_TO_GET_USER: "You are not allowed to get user";
+    readonly NO_DATA_TO_UPDATE: "No data to update";
+    readonly YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS: "You are not allowed to update users";
+    readonly YOU_CANNOT_REMOVE_YOURSELF: "You cannot remove yourself";
+    readonly YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: "You are not allowed to set a non-existent role value";
+};

package/dist/src/plugins/admin/has-permission.d.ts

@@ -0,0 +1,21 @@
+import type { AdminOptions } from "./types";
+type PermissionExclusive = {
+    /**
+     * @deprecated Use `permissions` instead
+     */
+    permission: {
+        [key: string]: string[];
+    };
+    permissions?: never | undefined;
+} | {
+    permissions: {
+        [key: string]: string[];
+    };
+    permission?: never | undefined;
+};
+export declare const hasPermission: (input: {
+    userId?: string | undefined;
+    role?: string | undefined;
+    options?: AdminOptions | undefined;
+} & PermissionExclusive) => boolean;
+export {};

package/dist/src/plugins/admin/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./admin";
+export type * from "./types";

package/dist/src/plugins/admin/schema.d.ts

@@ -0,0 +1,36 @@
+export declare const schema: {
+    user: {
+        fields: {
+            role: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            banned: {
+                type: "boolean";
+                defaultValue: false;
+                required: false;
+                input: false;
+            };
+            banReason: {
+                type: "string";
+                required: false;
+                input: false;
+            };
+            banExpires: {
+                type: "date";
+                required: false;
+                input: false;
+            };
+        };
+    };
+    session: {
+        fields: {
+            impersonatedBy: {
+                type: "string";
+                required: false;
+            };
+        };
+    };
+};
+export type AdminSchema = typeof schema;

package/dist/src/plugins/admin/types.d.ts

@@ -0,0 +1,77 @@
+import { type InferOptionSchema, type Session, type User } from "../../types";
+import { type AccessControl, type Role } from "../access";
+import { type AdminSchema } from "./schema";
+export interface UserWithRole extends User {
+    role?: string | undefined;
+    banned: boolean | null;
+    banReason?: (string | null) | undefined;
+    banExpires?: (Date | null) | undefined;
+}
+export interface SessionWithImpersonatedBy extends Session {
+    impersonatedBy?: string | undefined;
+}
+export interface AdminOptions {
+    /**
+     * The default role for a user
+     *
+     * @default "user"
+     */
+    defaultRole?: string | undefined;
+    /**
+     * Roles that are considered admin roles.
+     *
+     * Any user role that isn't in this list, even if they have the permission,
+     * will not be considered an admin.
+     *
+     * @default ["admin"]
+     */
+    adminRoles?: (string | string[]) | undefined;
+    /**
+     * A default ban reason
+     *
+     * By default, no reason is provided
+     */
+    defaultBanReason?: string | undefined;
+    /**
+     * Number of seconds until the ban expires
+     *
+     * By default, the ban never expires
+     */
+    defaultBanExpiresIn?: number | undefined;
+    /**
+     * Duration of the impersonation session in seconds
+     *
+     * By default, the impersonation session lasts 1 hour
+     */
+    impersonationSessionDuration?: number | undefined;
+    /**
+     * Custom schema for the admin plugin
+     */
+    schema?: InferOptionSchema<AdminSchema> | undefined;
+    /**
+     * Configure the roles and permissions for the admin
+     * plugin.
+     */
+    ac?: AccessControl | undefined;
+    /**
+     * Custom permissions for roles.
+     */
+    roles?: {
+        [key in string]?: Role;
+    } | undefined;
+    /**
+     * List of user ids that should have admin access
+     *
+     * If this is set, the `adminRole` option is ignored
+     */
+    adminUserIds?: string[] | undefined;
+    /**
+     * Message to show when a user is banned
+     *
+     * By default, the message is "You have been banned from this application"
+     */
+    bannedUserMessage?: string | undefined;
+}
+export type InferAdminRolesFromOption<O extends AdminOptions | undefined> = O extends {
+    roles: Record<string, unknown>;
+} ? keyof O["roles"] : "user" | "admin";

package/dist/src/plugins/anonymous/client.d.ts

@@ -0,0 +1,8 @@
+import type { anonymous } from ".";
+export declare const anonymousClient: () => {
+    id: "anonymous";
+    $InferServerPlugin: ReturnType<typeof anonymous>;
+    pathMethods: {
+        "/sign-in/anonymous": "POST";
+    };
+};

package/dist/src/plugins/anonymous/index.d.ts

@@ -0,0 +1,159 @@
+import type { AuthContext, GenericEndpointContext } from "@gatwech/core";
+import type { EndpointContext } from "better-call";
+import type { InferOptionSchema, Session, User } from "../../types";
+export interface UserWithAnonymous extends User {
+    isAnonymous: boolean;
+}
+export interface AnonymousOptions {
+    /**
+     * Configure the domain name of the temporary email
+     * address for anonymous users in the database.
+     * @default "baseURL"
+     */
+    emailDomainName?: string | undefined;
+    /**
+     * A useful hook to run after an anonymous user
+     * is about to link their account.
+     */
+    onLinkAccount?: ((data: {
+        anonymousUser: {
+            user: UserWithAnonymous & Record<string, any>;
+            session: Session & Record<string, any>;
+        };
+        newUser: {
+            user: User & Record<string, any>;
+            session: Session & Record<string, any>;
+        };
+        ctx: GenericEndpointContext;
+    }) => Promise<void> | void) | undefined;
+    /**
+     * Disable deleting the anonymous user after linking
+     */
+    disableDeleteAnonymousUser?: boolean | undefined;
+    /**
+     * A hook to generate a name for the anonymous user.
+     * Useful if you want to have random names for anonymous users, or if `name` is unique in your database.
+     * @returns The name for the anonymous user.
+     */
+    generateName?: ((ctx: EndpointContext<"/sign-in/anonymous", {
+        method: "POST";
+    }, AuthContext>) => Promise<string> | string) | undefined;
+    /**
+     * Custom schema for the anonymous plugin
+     */
+    schema?: InferOptionSchema<typeof schema> | undefined;
+}
+declare const schema: {
+    user: {
+        fields: {
+            isAnonymous: {
+                type: "boolean";
+                required: false;
+            };
+        };
+    };
+};
+export declare const anonymous: (options?: AnonymousOptions | undefined) => {
+    id: "anonymous";
+    endpoints: {
+        signInAnonymous: {
+            <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0?: ({
+                body?: undefined;
+            } & {
+                method?: "POST" | undefined;
+            } & {
+                query?: Record<string, any> | undefined;
+            } & {
+                params?: Record<string, any>;
+            } & {
+                request?: Request;
+            } & {
+                headers?: HeadersInit;
+            } & {
+                asResponse?: boolean;
+                returnHeaders?: boolean;
+                use?: import("better-call").Middleware[];
+                path?: string;
+            } & {
+                asResponse?: AsResponse | undefined;
+                returnHeaders?: ReturnHeaders | undefined;
+            }) | undefined): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+                headers: Headers;
+                response: {
+                    token: string;
+                    user: {
+                        id: string;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                    };
+                } | null;
+            } : {
+                token: string;
+                user: {
+                    id: string;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                };
+            } | null>;
+            options: {
+                method: "POST";
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                                session: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            } & {
+                use: any[];
+            };
+            path: "/sign-in/anonymous";
+        };
+    };
+    hooks: {
+        after: {
+            matcher(ctx: import("@gatwech/core").HookEndpointContext): boolean;
+            handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
+        }[];
+    };
+    schema: {
+        user: {
+            fields: {
+                isAnonymous: {
+                    type: "boolean";
+                    required: false;
+                };
+            };
+        };
+    };
+    $ERROR_CODES: {
+        readonly FAILED_TO_CREATE_USER: "Failed to create user";
+        readonly COULD_NOT_CREATE_SESSION: "Could not create session";
+        readonly ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY: "Anonymous users cannot sign in again anonymously";
+    };
+};
+export {};

package/dist/src/plugins/api-key/client.d.ts

@@ -0,0 +1,11 @@
+import type { apiKey } from ".";
+export declare const apiKeyClient: () => {
+    id: "api-key";
+    $InferServerPlugin: ReturnType<typeof apiKey>;
+    pathMethods: {
+        "/api-key/create": "POST";
+        "/api-key/delete": "POST";
+        "/api-key/delete-all-expired-api-keys": "POST";
+    };
+};
+export type ApiKeyClientPlugin = ReturnType<typeof apiKeyClient>;