@gatwech/auth 1.0.0-beta.18

package/dist/src/plugins/jwt/index.d.ts

@@ -0,0 +1,276 @@
+import type { JSONWebKeySet, JWTPayload } from "jose";
+import * as z from "zod";
+import { getJwtToken } from "./sign";
+import type { JwtOptions } from "./types";
+export type * from "./types";
+export { createJwk, generateExportedKeyPair } from "./utils";
+export declare const jwt: (options?: JwtOptions | undefined) => {
+    id: "jwt";
+    options: JwtOptions | undefined;
+    endpoints: {
+        getJwks: {
+            <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0?: ({
+                body?: undefined;
+            } & {
+                method?: "GET" | undefined;
+            } & {
+                query?: Record<string, any> | undefined;
+            } & {
+                params?: Record<string, any>;
+            } & {
+                request?: Request;
+            } & {
+                headers?: HeadersInit;
+            } & {
+                asResponse?: boolean;
+                returnHeaders?: boolean;
+                use?: import("better-call").Middleware[];
+                path?: string;
+            } & {
+                asResponse?: AsResponse | undefined;
+                returnHeaders?: ReturnHeaders | undefined;
+            }) | undefined): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+                headers: Headers;
+                response: JSONWebKeySet;
+            } : JSONWebKeySet>;
+            options: {
+                method: "GET";
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            "200": {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                keys: {
+                                                    type: string;
+                                                    description: string;
+                                                    items: {
+                                                        type: string;
+                                                        properties: {
+                                                            kid: {
+                                                                type: string;
+                                                                description: string;
+                                                            };
+                                                            kty: {
+                                                                type: string;
+                                                                description: string;
+                                                            };
+                                                            alg: {
+                                                                type: string;
+                                                                description: string;
+                                                            };
+                                                            use: {
+                                                                type: string;
+                                                                description: string;
+                                                                enum: string[];
+                                                                nullable: boolean;
+                                                            };
+                                                            n: {
+                                                                type: string;
+                                                                description: string;
+                                                                nullable: boolean;
+                                                            };
+                                                            e: {
+                                                                type: string;
+                                                                description: string;
+                                                                nullable: boolean;
+                                                            };
+                                                            crv: {
+                                                                type: string;
+                                                                description: string;
+                                                                nullable: boolean;
+                                                            };
+                                                            x: {
+                                                                type: string;
+                                                                description: string;
+                                                                nullable: boolean;
+                                                            };
+                                                            y: {
+                                                                type: string;
+                                                                description: string;
+                                                                nullable: boolean;
+                                                            };
+                                                        };
+                                                        required: string[];
+                                                    };
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            } & {
+                use: any[];
+            };
+            path: "/jwks";
+        };
+        getToken: {
+            <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+                body?: undefined;
+            } & {
+                method?: "GET" | undefined;
+            } & {
+                query?: Record<string, any> | undefined;
+            } & {
+                params?: Record<string, any>;
+            } & {
+                request?: Request;
+            } & {
+                headers: HeadersInit;
+            } & {
+                asResponse?: boolean;
+                returnHeaders?: boolean;
+                use?: import("better-call").Middleware[];
+                path?: string;
+            } & {
+                asResponse?: AsResponse | undefined;
+                returnHeaders?: ReturnHeaders | undefined;
+            }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+                headers: Headers;
+                response: {
+                    token: string;
+                };
+            } : {
+                token: string;
+            }>;
+            options: {
+                method: "GET";
+                requireHeaders: true;
+                use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                    session: {
+                        session: Record<string, any> & {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                        user: Record<string, any> & {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            email: string;
+                            emailVerified: boolean;
+                            name: string;
+                            image?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                token: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            } & {
+                use: any[];
+            };
+            path: "/token";
+        };
+        signJWT: {
+            <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(inputCtx_0: {
+                body: {
+                    payload: JWTPayload;
+                    overrideOptions?: JwtOptions | undefined;
+                };
+            } & {
+                method?: "POST" | undefined;
+            } & {
+                query?: Record<string, any> | undefined;
+            } & {
+                params?: Record<string, any>;
+            } & {
+                request?: Request;
+            } & {
+                headers?: HeadersInit;
+            } & {
+                asResponse?: boolean;
+                returnHeaders?: boolean;
+                use?: import("better-call").Middleware[];
+                path?: string;
+            } & {
+                asResponse?: AsResponse | undefined;
+                returnHeaders?: ReturnHeaders | undefined;
+            }): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+                headers: Headers;
+                response: {
+                    token: string;
+                };
+            } : {
+                token: string;
+            }>;
+            options: {
+                method: "POST";
+                metadata: {
+                    SERVER_ONLY: true;
+                    $Infer: {
+                        body: {
+                            payload: JWTPayload;
+                            overrideOptions?: JwtOptions | undefined;
+                        };
+                    };
+                };
+                body: z.ZodObject<{
+                    payload: z.ZodRecord<z.ZodString, z.ZodAny>;
+                    overrideOptions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+                }, z.core.$strip>;
+            } & {
+                use: any[];
+            };
+            path: "/sign-jwt";
+        };
+    };
+    hooks: {
+        after: {
+            matcher(context: import("@gatwech/core").HookEndpointContext): boolean;
+            handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
+        }[];
+    };
+    schema: {
+        jwks: {
+            fields: {
+                publicKey: {
+                    type: "string";
+                    required: true;
+                };
+                privateKey: {
+                    type: "string";
+                    required: true;
+                };
+                createdAt: {
+                    type: "date";
+                    required: true;
+                };
+            };
+        };
+    };
+};
+export { getJwtToken };

package/dist/src/plugins/jwt/schema.d.ts

@@ -0,0 +1,18 @@
+export declare const schema: {
+    jwks: {
+        fields: {
+            publicKey: {
+                type: "string";
+                required: true;
+            };
+            privateKey: {
+                type: "string";
+                required: true;
+            };
+            createdAt: {
+                type: "date";
+                required: true;
+            };
+        };
+    };
+};

package/dist/src/plugins/jwt/sign.d.ts

@@ -0,0 +1,8 @@
+import type { GenericEndpointContext } from "@gatwech/core";
+import { type JWTPayload } from "jose";
+import type { JwtOptions } from "./types";
+export declare function signJWT(ctx: GenericEndpointContext, config: {
+    options?: JwtOptions | undefined;
+    payload: JWTPayload;
+}): Promise<string>;
+export declare function getJwtToken(ctx: GenericEndpointContext, options?: JwtOptions | undefined): Promise<string>;

package/dist/src/plugins/jwt/types.d.ts

@@ -0,0 +1,175 @@
+import type { JWTPayload } from "jose";
+import type { GenericEndpointContext } from "../..";
+import type { InferOptionSchema, Session, User } from "../../types";
+import type { Awaitable } from "../../types/helper";
+import type { schema } from "./schema";
+export interface JwtOptions {
+    jwks?: {
+        /**
+         * Disables the /jwks endpoint and uses this endpoint in discovery.
+         *
+         * Useful if jwks are not managed at /jwks or
+         * if your jwks are signed with a certificate and placed on your CDN.
+         */
+        remoteUrl?: string;
+        /**
+         * Key pair configuration
+         * @description A subset of the options available for the generateKeyPair function
+         *
+         * @see https://github.com/panva/jose/blob/main/src/runtime/node/generate.ts
+         *
+         * @default { alg: 'EdDSA', crv: 'Ed25519' }
+         */
+        keyPairConfig?: JWKOptions;
+        /**
+         * Disable private key encryption
+         * @description Disable the encryption of the private key in the database
+         *
+         * @default false
+         */
+        disablePrivateKeyEncryption?: boolean;
+    } | undefined;
+    jwt?: {
+        /**
+         * The issuer of the JWT
+         */
+        issuer?: string;
+        /**
+         * The audience of the JWT
+         */
+        audience?: string;
+        /**
+         * Set the "exp" (Expiration Time) Claim.
+         *
+         * - If a `number` is passed as an argument it is used as the claim directly.
+         * - If a `Date` instance is passed as an argument it is converted to unix timestamp and used as the
+         *   claim.
+         * - If a `string` is passed as an argument it is resolved to a time span, and then added to the
+         *   current unix timestamp and used as the claim.
+         *
+         * Format used for time span should be a number followed by a unit, such as "5 minutes" or "1
+         * day".
+         *
+         * Valid units are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins",
+         * "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year",
+         * "years", "yr", "yrs", and "y". It is not possible to specify months. 365.25 days is used as an
+         * alias for a year.
+         *
+         * If the string is suffixed with "ago", or prefixed with a "-", the resulting time span gets
+         * subtracted from the current unix timestamp. A "from now" suffix can also be used for
+         * readability when adding to the current unix timestamp.
+         *
+         * @default 15m
+         */
+        expirationTime?: number | string | Date;
+        /**
+         * A function that is called to define the payload of the JWT
+         */
+        definePayload?: (session: {
+            user: User & Record<string, any>;
+            session: Session & Record<string, any>;
+        }) => Promise<Record<string, any>> | Record<string, any>;
+        /**
+         * A function that is called to get the subject of the JWT
+         *
+         * @default session.user.id
+         */
+        getSubject?: (session: {
+            user: User & Record<string, any>;
+            session: Session & Record<string, any>;
+        }) => Promise<string> | string;
+        /**
+         * A custom function to remote sign the jwt payload.
+         *
+         * All headers, such as `alg` and `kid`,
+         * MUST be defined within this function.
+         * You can safely define the header `typ: 'JWT'`.
+         *
+         * @requires jwks.remoteUrl
+         * @invalidates other jwt.* options
+         */
+        sign?: (payload: JWTPayload) => Awaitable<string>;
+    } | undefined;
+    /**
+     * Disables setting JWTs through middleware.
+     *
+     * Recommended to set `true` when using an oAuth provider plugin
+     * like OIDC or MCP where session payloads should not be signed.
+     *
+     * @default false
+     */
+    disableSettingJwtHeader?: boolean | undefined;
+    /**
+     * Custom schema for the admin plugin
+     */
+    schema?: InferOptionSchema<typeof schema> | undefined;
+    /**
+     * Custom adapter for the jwt plugin
+     *
+     * This will override the default adapter
+     *
+     * @default adapter from the database
+     */
+    adapter?: {
+        /**
+         * A custom function to get the JWKS from the database or
+         * other source
+         *
+         * This will override the default getJwks from the database
+         *
+         * @param ctx - The context of the request
+         * @returns The JWKS
+         */
+        getJwks?: (ctx: GenericEndpointContext) => Promise<Jwk[] | null | undefined>;
+        /**
+         * A custom function to get the latest key from the database or
+         * other source
+         *
+         * This will override the default getLatestKey from the database
+         *
+         * @param ctx - The context of the request
+         * @returns The latest key
+         */
+        getLatestKey?: (ctx: GenericEndpointContext) => Promise<Jwk | null | undefined>;
+        /**
+         * A custom function to create a new key in the database or
+         * other source
+         *
+         * This will override the default createJwk from the database
+         *
+         * @param data - The key to create
+         * @returns The created key
+         */
+        createJwk?: (data: Omit<Jwk, "id">, ctx: GenericEndpointContext) => Promise<Jwk>;
+    };
+}
+/**
+ * Asymmetric (JWS) Supported.
+ *
+ * @see https://github.com/panva/jose/issues/210
+ */
+export type JWKOptions = {
+    alg: "EdDSA";
+    crv?: "Ed25519" | undefined;
+} | {
+    alg: "ES256";
+    crv?: never | undefined;
+} | {
+    alg: "ES512";
+    crv?: never | undefined;
+} | {
+    alg: "PS256";
+    modulusLength?: number | undefined;
+} | {
+    alg: "RS256";
+    modulusLength?: number | undefined;
+};
+export type JWSAlgorithms = JWKOptions["alg"];
+export interface Jwk {
+    id: string;
+    publicKey: string;
+    privateKey: string;
+    createdAt: Date;
+    alg?: JWSAlgorithms | undefined;
+    crv?: ("Ed25519" | "P-256" | "P-521") | undefined;
+}

package/dist/src/plugins/jwt/utils.d.ts

@@ -0,0 +1,46 @@
+import type { GenericEndpointContext } from "@gatwech/core";
+import type { Jwk, JwtOptions } from "./types";
+/**
+ * Converts an expirationTime to ISO seconds expiration time (the format of JWT exp)
+ *
+ * See https://github.com/panva/jose/blob/main/src/lib/jwt_claims_set.ts#L245
+ *
+ * @param expirationTime - see options.jwt.expirationTime
+ * @param iat - the iat time to consolidate on
+ * @returns
+ */
+export declare function toExpJWT(expirationTime: number | Date | string, iat: number): number;
+export declare function encryptPrivateKey(privateKey: string, secretKey: string): Promise<{
+    encryptedPrivateKey: string;
+    iv: string;
+    authTag: string;
+}>;
+export declare function decryptPrivateKey(encryptedPrivate: {
+    encryptedPrivateKey: string;
+    iv: string;
+    authTag: string;
+}, secretKey: string): Promise<string>;
+export declare function generateExportedKeyPair(options?: JwtOptions | undefined): Promise<{
+    publicWebKey: import("jose").JWK;
+    privateWebKey: import("jose").JWK;
+    alg: "EdDSA" | "ES256" | "ES512" | "PS256" | "RS256";
+    cfg: {
+        crv?: "Ed25519" | undefined;
+    } | {
+        crv?: never | undefined;
+    } | {
+        crv?: never | undefined;
+    } | {
+        modulusLength?: number | undefined;
+    } | {
+        modulusLength?: number | undefined;
+    };
+}>;
+/**
+ * Creates a Jwk on the database
+ *
+ * @param ctx
+ * @param options
+ * @returns
+ */
+export declare function createJwk(ctx: GenericEndpointContext, options?: JwtOptions | undefined): Promise<Jwk>;

package/dist/src/plugins/last-login-method/client.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Configuration for the client-side last login method plugin
+ */
+export interface LastLoginMethodClientConfig {
+    /**
+     * Name of the cookie to read the last login method from
+     * @default "payvo-auth.last_used_login_method"
+     */
+    cookieName?: string | undefined;
+}
+/**
+ * Client-side plugin to retrieve the last used login method
+ */
+export declare const lastLoginMethodClient: (config?: LastLoginMethodClientConfig) => {
+    id: "last-login-method-client";
+    getActions(): {
+        /**
+         * Get the last used login method from cookies
+         * @returns The last used login method or null if not found
+         */
+        getLastUsedLoginMethod: () => string | null;
+        /**
+         * Clear the last used login method cookie
+         * This sets the cookie with an expiration date in the past
+         */
+        clearLastUsedLoginMethod: () => void;
+        /**
+         * Check if a specific login method was the last used
+         * @param method The method to check
+         * @returns True if the method was the last used, false otherwise
+         */
+        isLastUsedLoginMethod: (method: string) => boolean;
+    };
+};

package/dist/src/plugins/last-login-method/index.d.ts

@@ -0,0 +1,103 @@
+import type { GenericEndpointContext } from "@gatwech/core";
+/**
+ * Configuration for tracking different authentication methods
+ */
+export interface LastLoginMethodOptions {
+    /**
+     * Name of the cookie to store the last login method
+     * @default "payvo-auth.last_used_login_method"
+     */
+    cookieName?: string | undefined;
+    /**
+     * Cookie expiration time in seconds
+     * @default 2592000 (30 days)
+     */
+    maxAge?: number | undefined;
+    /**
+     * Custom method to resolve the last login method
+     * @param ctx - The context from the hook
+     * @returns The last login method
+     */
+    customResolveMethod?: ((ctx: GenericEndpointContext) => string | null) | undefined;
+    /**
+     * Store the last login method in the database. This will create a new field in the user table.
+     * @default false
+     */
+    storeInDatabase?: boolean | undefined;
+    /**
+     * Custom schema for the plugin
+     * @default undefined
+     */
+    schema?: {
+        user?: {
+            lastLoginMethod?: string;
+        };
+    } | undefined;
+}
+/**
+ * Plugin to track the last used login method
+ */
+export declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O | undefined) => {
+    id: "last-login-method";
+    init(ctx: import("@gatwech/core").AuthContext<import("@gatwech/core").PayvoAuthOptions>): {
+        options: {
+            databaseHooks: {
+                user: {
+                    create: {
+                        before(user: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            email: string;
+                            emailVerified: boolean;
+                            name: string;
+                            image?: string | null | undefined;
+                        } & Record<string, unknown>, context: GenericEndpointContext<import("@gatwech/core").PayvoAuthOptions> | undefined): Promise<{
+                            data: {
+                                lastLoginMethod: any;
+                                id: string;
+                                createdAt: Date;
+                                updatedAt: Date;
+                                email: string;
+                                emailVerified: boolean;
+                                name: string;
+                                image?: string | null | undefined;
+                            };
+                        } | undefined>;
+                    };
+                };
+                session: {
+                    create: {
+                        after(session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        } & Record<string, unknown>, context: GenericEndpointContext<import("@gatwech/core").PayvoAuthOptions> | undefined): Promise<void>;
+                    };
+                };
+            };
+        };
+    };
+    hooks: {
+        after: {
+            matcher(): true;
+            handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
+        }[];
+    };
+    schema: O["storeInDatabase"] extends true ? {
+        user: {
+            fields: {
+                lastLoginMethod: {
+                    type: "string";
+                    required: false;
+                    input: false;
+                };
+            };
+        };
+    } : undefined;
+};

package/dist/src/plugins/magic-link/client.d.ts

@@ -0,0 +1,5 @@
+import type { magicLink } from ".";
+export declare const magicLinkClient: () => {
+    id: "magic-link";
+    $InferServerPlugin: ReturnType<typeof magicLink>;
+};