@gatwech/core 0.0.11 → 1.0.0-beta.19

package/dist/src/db/schema/user.d.ts

@@ -0,0 +1,16 @@
+import * as z from "zod";
+export declare const userSchema: z.ZodObject<{
+    id: z.ZodString;
+    createdAt: z.ZodDefault<z.ZodDate>;
+    updatedAt: z.ZodDefault<z.ZodDate>;
+    email: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    emailVerified: z.ZodDefault<z.ZodBoolean>;
+    name: z.ZodString;
+    image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * User schema type used by payvo-auth, note that it's possible that user could have additional fields
+ *
+ * todo: we should use generics to extend this type with additional fields from plugins and options in the future
+ */
+export type User = z.infer<typeof userSchema>;

package/{src/db/schema/verification.ts → dist/src/db/schema/verification.d.ts}

@@ -1,12 +1,12 @@
 import * as z from "zod";
-import { coreSchema } from "./shared";
-
-export const verificationSchema = coreSchema.extend({
-  value: z.string(),
-  expiresAt: z.date(),
-  identifier: z.string(),
-});
-
+export declare const verificationSchema: z.ZodObject<{
+    id: z.ZodString;
+    createdAt: z.ZodDefault<z.ZodDate>;
+    updatedAt: z.ZodDefault<z.ZodDate>;
+    value: z.ZodString;
+    expiresAt: z.ZodDate;
+    identifier: z.ZodString;
+}, z.core.$strip>;
 /**
  * Verification schema type used by payvo-auth, note that it's possible that verification could have additional fields
  *

package/dist/src/db/type.d.ts

@@ -0,0 +1,159 @@
+import type { StandardSchemaV1 } from "@standard-schema/spec";
+import type { LiteralString, Awaitable } from "../types";
+export type DBPreservedModels = "user" | "account" | "session" | "verification" | "rate-limit" | "organization" | "member" | "invitation" | "jwks" | "passkey" | "two-factor";
+export type DBFieldType = "string" | "number" | "boolean" | "date" | "json" | `${"string" | "number"}[]` | Array<LiteralString>;
+export type DBPrimitive = string | number | boolean | Date | null | undefined | string[] | number[];
+export type DBFieldAttributeConfig = {
+    /**
+     * If the field should be required on a new record.
+     * @default true
+     */
+    required?: boolean | undefined;
+    /**
+     * If the value should be returned on a response body.
+     * @default true
+     */
+    returned?: boolean | undefined;
+    /**
+     * If a value should be provided when creating a new record.
+     * @default true
+     */
+    input?: boolean | undefined;
+    /**
+     * Default value for the field
+     *
+     * Note: This will not create a default value on the database level. It will only
+     * be used when creating a new record.
+     */
+    defaultValue?: (DBPrimitive | (() => DBPrimitive)) | undefined;
+    /**
+     * Update value for the field
+     *
+     * Note: This will create an onUpdate trigger on the database level for supported adapters.
+     * It will be called when updating a record.
+     */
+    onUpdate?: (() => DBPrimitive) | undefined;
+    /**
+     * transform the value before storing it.
+     */
+    transform?: {
+        input?: (value: DBPrimitive) => DBPrimitive | Promise<DBPrimitive>;
+        output?: (value: DBPrimitive) => DBPrimitive | Promise<DBPrimitive>;
+    } | undefined;
+    /**
+     * Reference to another model.
+     */
+    references?: {
+        /**
+         * The model to reference.
+         */
+        model: string;
+        /**
+         * The field on the referenced model.
+         */
+        field: string;
+        /**
+         * The action to perform when the reference is deleted.
+         * @default "cascade"
+         */
+        onDelete?: "no action" | "restrict" | "cascade" | "set null" | "set default";
+    } | undefined;
+    unique?: boolean | undefined;
+    /**
+     * If the field should be a bigint on the database instead of integer.
+     */
+    bigint?: boolean | undefined;
+    /**
+     * A zod schema to validate the value.
+     */
+    validator?: {
+        input?: StandardSchemaV1;
+        output?: StandardSchemaV1;
+    } | undefined;
+    /**
+     * The name of the field on the database.
+     */
+    fieldName?: string | undefined;
+    /**
+     * If the field should be sortable.
+     *
+     * applicable only for `text` type.
+     * It's useful to mark fields varchar instead of text.
+     */
+    sortable?: boolean | undefined;
+};
+export type DBFieldAttribute<T extends DBFieldType = DBFieldType> = {
+    type: T;
+} & DBFieldAttributeConfig;
+export type PayvoAuthDBSchema = Record<string, {
+    /**
+     * The name of the table in the database
+     */
+    modelName: string;
+    /**
+     * The fields of the table
+     */
+    fields: Record<string, DBFieldAttribute>;
+    /**
+     * Whether to disable migrations for this table
+     * @default false
+     */
+    disableMigrations?: boolean | undefined;
+    /**
+     * The order of the table
+     */
+    order?: number | undefined;
+}>;
+export interface SecondaryStorage {
+    /**
+     *
+     * @param key - Key to get
+     * @returns - Value of the key
+     */
+    get: (key: string) => Awaitable<unknown>;
+    /**
+     * Atomically get a value and delete it from storage.
+     *
+     * This is optional for backwards compatibility with existing secondary
+     * storage implementations. Single-use credential consumers use it when
+     * present to avoid a read-then-delete race.
+     *
+     * TODO(secondary-storage-atomic-consume): make this required in the next
+     * breaking release, or require database-backed verification storage for
+     * security-sensitive consume paths.
+     */
+    getAndDelete?: (key: string) => Awaitable<unknown>;
+    /**
+     * Atomically increment the counter at `key` by one, returning the
+     * post-increment value.
+     *
+     * When the key is absent, it is created with a value of `1` and the given
+     * `ttl` (in SECONDS). The TTL is applied only on creation; later increments
+     * never extend it, so the counter expires a fixed window after it was first
+     * created.
+     *
+     * This is optional for backwards compatibility with existing secondary
+     * storage implementations. TODO(secondary-storage-increment-required): make
+     * this required for secondary-storage-backed rate limiting in the next minor
+     * on `next`.
+     */
+    increment?: (key: string, ttl: number) => Awaitable<number>;
+    set: (
+    /**
+     * Key to store
+     */
+    key: string, 
+    /**
+     * Value to store
+     */
+    value: string, 
+    /**
+     * Time to live in seconds
+     */
+    ttl?: number | undefined) => Awaitable<void | null | unknown>;
+    /**
+     *
+     * @param key - Key to delete
+     */
+    delete: (key: string) => Awaitable<void | null | string>;
+}

package/dist/src/env/color-depth.d.ts

@@ -0,0 +1 @@
+export declare function getColorDepth(): number;

package/dist/src/env/env-impl.d.ts

@@ -0,0 +1,29 @@
+export type EnvObject = Record<string, string | undefined>;
+export declare const env: EnvObject;
+export declare const nodeENV: string;
+/** Detect if `NODE_ENV` environment variable is `production` */
+export declare const isProduction: boolean;
+/** Detect if `NODE_ENV` environment variable is `dev` or `development` */
+export declare const isDevelopment: () => boolean;
+/** Detect if `NODE_ENV` environment variable is `test` */
+export declare const isTest: () => boolean;
+/**
+ * Get environment variable with fallback
+ */
+export declare function getEnvVar<Fallback extends string>(key: string, fallback?: Fallback): Fallback extends string ? string : string | undefined;
+/**
+ * Get boolean environment variable
+ */
+export declare function getBooleanEnvVar(key: string, fallback?: boolean): boolean;
+/**
+ * Common environment variables used in Payvo Auth
+ */
+export declare const ENV: Readonly<{
+    readonly PAYVO_AUTH_SECRET: string;
+    readonly AUTH_SECRET: string;
+    readonly PAYVO_AUTH_TELEMETRY: string;
+    readonly PAYVO_AUTH_TELEMETRY_ID: string;
+    readonly NODE_ENV: string;
+    readonly PACKAGE_VERSION: string;
+    readonly PAYVO_AUTH_TELEMETRY_ENDPOINT: string;
+}>;

package/dist/src/env/index.d.ts

@@ -0,0 +1,3 @@
+export { getColorDepth } from "./color-depth";
+export { ENV, type EnvObject, env, getBooleanEnvVar, getEnvVar, isDevelopment, isProduction, isTest, nodeENV, } from "./env-impl";
+export { createLogger, type InternalLogger, type Logger, type LogHandlerParams, type LogLevel, levels, logger, shouldPublishLog, TTY_COLORS, } from "./logger";

package/dist/src/env/logger.d.ts

@@ -0,0 +1,52 @@
+export declare const TTY_COLORS: {
+    readonly reset: "\u001B[0m";
+    readonly bright: "\u001B[1m";
+    readonly dim: "\u001B[2m";
+    readonly undim: "\u001B[22m";
+    readonly underscore: "\u001B[4m";
+    readonly blink: "\u001B[5m";
+    readonly reverse: "\u001B[7m";
+    readonly hidden: "\u001B[8m";
+    readonly fg: {
+        readonly black: "\u001B[30m";
+        readonly red: "\u001B[31m";
+        readonly green: "\u001B[32m";
+        readonly yellow: "\u001B[33m";
+        readonly blue: "\u001B[34m";
+        readonly magenta: "\u001B[35m";
+        readonly cyan: "\u001B[36m";
+        readonly white: "\u001B[37m";
+    };
+    readonly bg: {
+        readonly black: "\u001B[40m";
+        readonly red: "\u001B[41m";
+        readonly green: "\u001B[42m";
+        readonly yellow: "\u001B[43m";
+        readonly blue: "\u001B[44m";
+        readonly magenta: "\u001B[45m";
+        readonly cyan: "\u001B[46m";
+        readonly white: "\u001B[47m";
+    };
+};
+export type LogLevel = "info" | "success" | "warn" | "error" | "debug";
+export declare const levels: readonly ["info", "success", "warn", "error", "debug"];
+export declare function shouldPublishLog(currentLogLevel: LogLevel, logLevel: LogLevel): boolean;
+export interface Logger {
+    disabled?: boolean | undefined;
+    disableColors?: boolean | undefined;
+    level?: Exclude<LogLevel, "success"> | undefined;
+    tag?: string | undefined;
+    log?: ((level: Exclude<LogLevel, "success">, message: string, ...args: any[]) => void) | undefined;
+}
+export type LogHandlerParams = Parameters<NonNullable<Logger["log"]>> extends [
+    LogLevel,
+    ...infer Rest
+] ? Rest : never;
+export declare const formatMessage: (level: LogLevel, message: string, colorsEnabled: boolean, tag?: string) => string;
+export type InternalLogger = {
+    [K in LogLevel]: (...params: LogHandlerParams) => void;
+} & {
+    get level(): LogLevel;
+};
+export declare const createLogger: (options?: Logger | undefined) => InternalLogger;
+export declare const logger: InternalLogger;

package/dist/src/error/codes.d.ts

@@ -0,0 +1,27 @@
+export declare const BASE_ERROR_CODES: {
+    readonly USER_NOT_FOUND: "User not found";
+    readonly FAILED_TO_CREATE_USER: "Failed to create user";
+    readonly FAILED_TO_CREATE_SESSION: "Failed to create session";
+    readonly FAILED_TO_UPDATE_USER: "Failed to update user";
+    readonly FAILED_TO_GET_SESSION: "Failed to get session";
+    readonly INVALID_PASSWORD: "Invalid password";
+    readonly INVALID_EMAIL: "Invalid email";
+    readonly INVALID_EMAIL_OR_PASSWORD: "Invalid email or password";
+    readonly SOCIAL_ACCOUNT_ALREADY_LINKED: "Social account already linked";
+    readonly PROVIDER_NOT_FOUND: "Provider not found";
+    readonly INVALID_TOKEN: "Invalid token";
+    readonly ID_TOKEN_NOT_SUPPORTED: "id_token not supported";
+    readonly FAILED_TO_GET_USER_INFO: "Failed to get user info";
+    readonly USER_EMAIL_NOT_FOUND: "User email not found";
+    readonly EMAIL_NOT_VERIFIED: "Email not verified";
+    readonly PASSWORD_TOO_SHORT: "Password too short";
+    readonly PASSWORD_TOO_LONG: "Password too long";
+    readonly USER_ALREADY_EXISTS: "User already exists.";
+    readonly USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "User already exists. Use another email.";
+    readonly EMAIL_CAN_NOT_BE_UPDATED: "Email can not be updated";
+    readonly CREDENTIAL_ACCOUNT_NOT_FOUND: "Credential account not found";
+    readonly SESSION_EXPIRED: "Session expired. Re-authenticate to perform this action.";
+    readonly FAILED_TO_UNLINK_LAST_ACCOUNT: "You can't unlink your last account";
+    readonly ACCOUNT_NOT_FOUND: "Account not found";
+    readonly USER_ALREADY_HAS_PASSWORD: "User already has a password. Provide that to delete the account.";
+};

package/dist/src/error/index.d.ts

@@ -0,0 +1,4 @@
+export declare class PayvoAuthError extends Error {
+    constructor(message: string, cause?: string | undefined);
+}
+export { BASE_ERROR_CODES } from "./codes";

package/dist/src/oauth2/client-credentials-token.d.ts

@@ -0,0 +1,21 @@
+import type { OAuth2Tokens, ProviderOptions } from "./oauth-provider";
+export declare function createClientCredentialsTokenRequest({ options, scope, authentication, resource, }: {
+    options: ProviderOptions & {
+        clientSecret: string;
+    };
+    scope?: string | undefined;
+    authentication?: ("basic" | "post") | undefined;
+    resource?: (string | string[]) | undefined;
+}): {
+    body: URLSearchParams;
+    headers: Record<string, any>;
+};
+export declare function clientCredentialsToken({ options, tokenEndpoint, scope, authentication, resource, }: {
+    options: ProviderOptions & {
+        clientSecret: string;
+    };
+    tokenEndpoint: string;
+    scope: string;
+    authentication?: ("basic" | "post") | undefined;
+    resource?: (string | string[]) | undefined;
+}): Promise<OAuth2Tokens>;

package/dist/src/oauth2/create-authorization-url.d.ts

@@ -0,0 +1,21 @@
+import type { ProviderOptions } from "./index";
+export declare function createAuthorizationURL({ id, options, authorizationEndpoint, state, codeVerifier, scopes, claims, redirectURI, duration, prompt, accessType, responseType, display, loginHint, hd, responseMode, additionalParams, scopeJoiner, }: {
+    id: string;
+    options: ProviderOptions;
+    redirectURI: string;
+    authorizationEndpoint: string;
+    state: string;
+    codeVerifier?: string | undefined;
+    scopes: string[];
+    claims?: string[] | undefined;
+    duration?: string | undefined;
+    prompt?: string | undefined;
+    accessType?: string | undefined;
+    responseType?: string | undefined;
+    display?: string | undefined;
+    loginHint?: string | undefined;
+    hd?: string | undefined;
+    responseMode?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
+    scopeJoiner?: string | undefined;
+}): Promise<URL>;

package/dist/src/oauth2/index.d.ts

@@ -0,0 +1,6 @@
+export { clientCredentialsToken, createClientCredentialsTokenRequest, } from "./client-credentials-token";
+export { createAuthorizationURL } from "./create-authorization-url";
+export type { OAuth2Tokens, OAuth2UserInfo, OAuthProvider, ProviderOptions, } from "./oauth-provider";
+export { createRefreshAccessTokenRequest, refreshAccessToken, } from "./refresh-access-token";
+export { generateCodeChallenge, getOAuth2Tokens } from "./utils";
+export { createAuthorizationCodeRequest, validateAuthorizationCode, validateToken, } from "./validate-authorization-code";

package/dist/src/oauth2/oauth-provider.d.ts

@@ -0,0 +1,178 @@
+import type { LiteralString } from "../types";
+export interface OAuth2Tokens {
+    tokenType?: string | undefined;
+    accessToken?: string | undefined;
+    refreshToken?: string | undefined;
+    accessTokenExpiresAt?: Date | undefined;
+    refreshTokenExpiresAt?: Date | undefined;
+    scopes?: string[] | undefined;
+    idToken?: string | undefined;
+}
+export type OAuth2UserInfo = {
+    id: string | number;
+    name?: string | undefined;
+    email?: (string | null) | undefined;
+    image?: string | undefined;
+    emailVerified: boolean;
+};
+export interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O extends Record<string, any> = Partial<ProviderOptions>> {
+    id: LiteralString;
+    createAuthorizationURL: (data: {
+        state: string;
+        codeVerifier: string;
+        scopes?: string[] | undefined;
+        redirectURI: string;
+        display?: string | undefined;
+        loginHint?: string | undefined;
+    }) => Promise<URL> | URL;
+    name: string;
+    validateAuthorizationCode: (data: {
+        code: string;
+        redirectURI: string;
+        codeVerifier?: string | undefined;
+        deviceId?: string | undefined;
+    }) => Promise<OAuth2Tokens>;
+    getUserInfo: (token: OAuth2Tokens & {
+        /**
+         * The user object from the provider
+         * This is only available for some providers like Apple
+         */
+        user?: {
+            name?: {
+                firstName?: string;
+                lastName?: string;
+            };
+            email?: string;
+        } | undefined;
+    }) => Promise<{
+        user: OAuth2UserInfo;
+        data: T;
+    } | null>;
+    /**
+     * Custom function to refresh a token
+     */
+    refreshAccessToken?: ((refreshToken: string) => Promise<OAuth2Tokens>) | undefined;
+    revokeToken?: ((token: string) => Promise<void>) | undefined;
+    /**
+     * Verify the id token
+     * @param token - The id token
+     * @param nonce - The nonce
+     * @returns True if the id token is valid, false otherwise
+     */
+    verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+    /**
+     * Disable implicit sign up for new users. When set to true for the provider,
+     * sign-in need to be called with with requestSignUp as true to create new users.
+     */
+    disableImplicitSignUp?: boolean | undefined;
+    /**
+     * Disable sign up for new users.
+     */
+    disableSignUp?: boolean | undefined;
+    /**
+     * Options for the provider
+     */
+    options?: O | undefined;
+}
+export type ProviderOptions<Profile extends Record<string, any> = any> = {
+    /**
+     * The client ID of your application.
+     *
+     * This is usually a string but can be any type depending on the provider.
+     */
+    clientId?: unknown | undefined;
+    /**
+     * The client secret of your application
+     */
+    clientSecret?: string | undefined;
+    /**
+     * The scopes you want to request from the provider
+     */
+    scope?: string[] | undefined;
+    /**
+     * Remove default scopes of the provider
+     */
+    disableDefaultScope?: boolean | undefined;
+    /**
+     * The redirect URL for your application. This is where the provider will
+     * redirect the user after the sign in process. Make sure this URL is
+     * whitelisted in the provider's dashboard.
+     */
+    redirectURI?: string | undefined;
+    /**
+     * The client key of your application
+     * Tiktok Social Provider uses this field instead of clientId
+     */
+    clientKey?: string | undefined;
+    /**
+     * Disable provider from allowing users to sign in
+     * with this provider with an id token sent from the
+     * client.
+     */
+    disableIdTokenSignIn?: boolean | undefined;
+    /**
+     * verifyIdToken function to verify the id token
+     */
+    verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+    /**
+     * Custom function to get user info from the provider
+     */
+    getUserInfo?: ((token: OAuth2Tokens) => Promise<{
+        user: {
+            id: string;
+            name?: string;
+            email?: string | null;
+            image?: string;
+            emailVerified: boolean;
+            [key: string]: any;
+        };
+        data: any;
+    }>) | undefined;
+    /**
+     * Custom function to refresh a token
+     */
+    refreshAccessToken?: ((refreshToken: string) => Promise<OAuth2Tokens>) | undefined;
+    /**
+     * Custom function to map the provider profile to a
+     * user.
+     */
+    mapProfileToUser?: ((profile: Profile) => {
+        id?: string;
+        name?: string;
+        email?: string | null;
+        image?: string;
+        emailVerified?: boolean;
+        [key: string]: any;
+    } | Promise<{
+        id?: string;
+        name?: string;
+        email?: string | null;
+        image?: string;
+        emailVerified?: boolean;
+        [key: string]: any;
+    }>) | undefined;
+    /**
+     * Disable implicit sign up for new users. When set to true for the provider,
+     * sign-in need to be called with with requestSignUp as true to create new users.
+     */
+    disableImplicitSignUp?: boolean | undefined;
+    /**
+     * Disable sign up for new users.
+     */
+    disableSignUp?: boolean | undefined;
+    /**
+     * The prompt to use for the authorization code request
+     */
+    prompt?: ("select_account" | "consent" | "login" | "none" | "select_account consent") | undefined;
+    /**
+     * The response mode to use for the authorization code request
+     */
+    responseMode?: ("query" | "form_post") | undefined;
+    /**
+     * If enabled, the user info will be overridden with the provider user info
+     * This is useful if you want to use the provider user info to update the user info
+     *
+     * @default false
+     */
+    overrideUserInfoOnSignIn?: boolean | undefined;
+};

package/dist/src/oauth2/refresh-access-token.d.ts

@@ -0,0 +1,20 @@
+import type { OAuth2Tokens, ProviderOptions } from "./oauth-provider";
+export declare function createRefreshAccessTokenRequest({ refreshToken, options, authentication, extraParams, resource, }: {
+    refreshToken: string;
+    options: Partial<ProviderOptions>;
+    authentication?: ("basic" | "post") | undefined;
+    extraParams?: Record<string, string> | undefined;
+    resource?: (string | string[]) | undefined;
+}): {
+    body: URLSearchParams;
+    headers: Record<string, any>;
+};
+export declare function refreshAccessToken({ refreshToken, options, tokenEndpoint, authentication, extraParams, }: {
+    refreshToken: string;
+    options: Partial<ProviderOptions>;
+    tokenEndpoint: string;
+    authentication?: ("basic" | "post") | undefined;
+    extraParams?: Record<string, string> | undefined;
+    /** @deprecated always "refresh_token" */
+    grantType?: string | undefined;
+}): Promise<OAuth2Tokens>;

package/dist/src/oauth2/utils.d.ts

@@ -0,0 +1,3 @@
+import type { OAuth2Tokens } from "./oauth-provider";
+export declare function getOAuth2Tokens(data: Record<string, any>): OAuth2Tokens;
+export declare function generateCodeChallenge(codeVerifier: string): Promise<string>;

package/dist/src/oauth2/validate-authorization-code.d.ts

@@ -0,0 +1,28 @@
+import type { ProviderOptions } from "./index";
+export declare function createAuthorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, deviceId, headers, additionalParams, resource, }: {
+    code: string;
+    redirectURI: string;
+    options: Partial<ProviderOptions>;
+    codeVerifier?: string | undefined;
+    deviceId?: string | undefined;
+    authentication?: ("basic" | "post") | undefined;
+    headers?: Record<string, string> | undefined;
+    additionalParams?: Record<string, string> | undefined;
+    resource?: (string | string[]) | undefined;
+}): {
+    body: URLSearchParams;
+    headers: Record<string, any>;
+};
+export declare function validateAuthorizationCode({ code, codeVerifier, redirectURI, options, tokenEndpoint, authentication, deviceId, headers, additionalParams, resource, }: {
+    code: string;
+    redirectURI: string;
+    options: Partial<ProviderOptions>;
+    codeVerifier?: string | undefined;
+    deviceId?: string | undefined;
+    tokenEndpoint: string;
+    authentication?: ("basic" | "post") | undefined;
+    headers?: Record<string, string> | undefined;
+    additionalParams?: Record<string, string> | undefined;
+    resource?: (string | string[]) | undefined;
+}): Promise<import("./oauth-provider").OAuth2Tokens>;
+export declare function validateToken(token: string, jwksEndpoint: string): Promise<import("jose").JWTVerifyResult<import("jose").JWTPayload>>;