@jazzmind/busibox-app 3.0.18

package/dist/lib/authz/session-client.d.ts

@@ -0,0 +1,276 @@
+/**
+ * Auth Client for busibox-app
+ *
+ * Zero Trust Authentication Architecture:
+ * All authentication is handled by the authz service. There are NO admin tokens
+ * or client credentials - everything uses JWTs (session or access tokens).
+ *
+ * Authentication Methods:
+ * - User operations: Use session JWT (exchanged for access token)
+ * - Login flows: Authz endpoints are public (they ARE the authentication)
+ * - Service operations: Use service account JWT
+ *
+ * Usage:
+ * ```typescript
+ * import { validateSession, useMagicLink } from '@jazzmind/busibox-app';
+ *
+ * // Validate a session token (returns session with user info)
+ * const session = await validateSession('session-jwt', {
+ *   authzUrl: process.env.AUTHZ_BASE_URL,
+ * });
+ *
+ * // Use magic link for passwordless login (no auth needed - this IS auth)
+ * const result = await useMagicLink(magicLink.token, { authzUrl });
+ * ```
+ */
+export interface AuthClientOptions {
+    /**
+     * Override authz service URL.
+     * Defaults to AUTHZ_BASE_URL or AUTHZ_URL environment variable.
+     */
+    authzUrl?: string;
+    /**
+     * Access token (JWT) for authenticated operations.
+     * For user operations, this is obtained via token exchange with session JWT.
+     * For service operations, this is the service account's access token.
+     */
+    accessToken?: string;
+}
+export interface Session {
+    session_id: string;
+    user_id: string;
+    token: string;
+    /** JWT for Zero Trust token exchange (signed by authz) */
+    session_jwt?: string;
+    expires_at: string;
+    ip_address?: string | null;
+    user_agent?: string | null;
+    created_at: string;
+    user?: {
+        user_id: string;
+        email: string;
+        status: string;
+    };
+}
+export interface CreateSessionParams {
+    userId: string;
+    token: string;
+    expiresAt: string;
+    ipAddress?: string;
+    userAgent?: string;
+}
+export interface MagicLink {
+    magic_link_id: string;
+    token: string;
+    email: string;
+    expires_at: string;
+    created_at: string;
+}
+export interface CreateMagicLinkParams {
+    userId: string;
+    email: string;
+    expiresInSeconds?: number;
+}
+export interface MagicLinkResult {
+    user: {
+        /** User ID (API returns 'id', but some endpoints may still return 'user_id') */
+        id?: string;
+        /** @deprecated Use 'id' instead */
+        user_id?: string;
+        email: string;
+        status: string;
+        email_verified_at?: string | null;
+        roles: Array<{
+            id: string;
+            name: string;
+        }>;
+    };
+    session: {
+        token: string;
+        expires_at: string;
+    };
+}
+export interface TotpCode {
+    code: string;
+    expires_at: string;
+}
+export interface CreateTotpParams {
+    userId: string;
+    email: string;
+    expiresInSeconds?: number;
+}
+export interface TotpResult {
+    user: {
+        /** User ID (API returns 'id', but some endpoints may still return 'user_id') */
+        id?: string;
+        /** @deprecated Use 'id' instead */
+        user_id?: string;
+        email: string;
+        status: string;
+        roles: Array<{
+            id: string;
+            name: string;
+        }>;
+    };
+    session: {
+        token: string;
+        expires_at: string;
+    };
+}
+export interface PasskeyChallenge {
+    challenge: string;
+    expires_at: string;
+}
+export interface Passkey {
+    passkey_id: string;
+    credential_id: string;
+    name: string;
+    device_type: string;
+    backed_up: boolean;
+    transports: string[];
+    last_used_at?: string | null;
+    created_at: string;
+}
+export interface RegisterPasskeyParams {
+    userId: string;
+    credentialId: string;
+    credentialPublicKey: string;
+    counter?: number;
+    deviceType: string;
+    backedUp?: boolean;
+    transports?: string[];
+    aaguid?: string;
+    name: string;
+}
+export interface PasskeyAuthResult {
+    user: {
+        /** User ID (API returns 'id', but some endpoints may still return 'user_id') */
+        id?: string;
+        /** @deprecated Use 'id' instead */
+        user_id?: string;
+        email: string;
+        status: string;
+        roles: Array<{
+            id: string;
+            name: string;
+        }>;
+    };
+    session: {
+        token: string;
+        expires_at: string;
+    };
+}
+/**
+ * Create a session in authz.
+ * Used by applications to create sessions after authentication (e.g., passkey login).
+ */
+export declare function createSession(params: CreateSessionParams, options?: AuthClientOptions): Promise<Session>;
+/**
+ * Validate a session by token.
+ * Returns the session with user info if valid, null if not found/expired.
+ */
+export declare function validateSession(token: string, options?: AuthClientOptions): Promise<Session | null>;
+/**
+ * Delete a session (logout).
+ */
+export declare function deleteSession(token: string, options?: AuthClientOptions): Promise<boolean>;
+/**
+ * Delete all sessions for a user (logout everywhere).
+ */
+export declare function deleteUserSessions(userId: string, options?: AuthClientOptions): Promise<number>;
+/**
+ * Create a magic link for passwordless login.
+ * The token should be sent to the user's email by the calling application.
+ */
+export declare function createMagicLink(params: CreateMagicLinkParams, options?: AuthClientOptions): Promise<MagicLink>;
+/**
+ * Validate a magic link (without consuming it).
+ * Returns the magic link info if valid, null otherwise.
+ */
+export declare function validateMagicLink(token: string, options?: AuthClientOptions): Promise<MagicLink | null>;
+/**
+ * Use (consume) a magic link.
+ * - Marks the link as used
+ * - Activates the user if pending
+ * - Sets email_verified_at
+ * - Creates a new session
+ *
+ * Returns the user and session, or null if invalid.
+ */
+export declare function useMagicLink(token: string, options?: AuthClientOptions): Promise<MagicLinkResult | null>;
+/**
+ * Create a TOTP code for multi-device login.
+ * Returns the plaintext code to be sent via email.
+ */
+export declare function createTotpCode(params: CreateTotpParams, options?: AuthClientOptions): Promise<TotpCode>;
+/**
+ * Verify a TOTP code and create a session.
+ * Returns user and session if valid, null otherwise.
+ */
+export declare function verifyTotpCode(email: string, code: string, options?: AuthClientOptions): Promise<TotpResult | null>;
+/**
+ * Create a passkey challenge for registration or authentication.
+ */
+export declare function createPasskeyChallenge(type: 'registration' | 'authentication', userId?: string, options?: AuthClientOptions): Promise<PasskeyChallenge>;
+/**
+ * Register a new passkey for a user.
+ */
+export declare function registerPasskey(params: RegisterPasskeyParams, options?: AuthClientOptions): Promise<Passkey>;
+/**
+ * List all passkeys for a user.
+ */
+export declare function listUserPasskeys(userId: string, options?: AuthClientOptions): Promise<Passkey[]>;
+/**
+ * Delete a passkey.
+ */
+export declare function deletePasskey(passkeyId: string, options?: AuthClientOptions): Promise<boolean>;
+/**
+ * Authenticate with a passkey.
+ *
+ * Note: The caller is responsible for:
+ * 1. Getting the challenge from createPasskeyChallenge()
+ * 2. Calling navigator.credentials.get() in the browser
+ * 3. Verifying the signature against the stored public key
+ * 4. Calling this endpoint with the credential_id and new_counter
+ */
+export declare function authenticateWithPasskey(credentialId: string, newCounter: number, options?: AuthClientOptions): Promise<PasskeyAuthResult | null>;
+/**
+ * Response from the login initiation endpoint.
+ *
+ * Authz handles the full flow server-side (generates tokens AND sends the
+ * email via bridge-api) so the response intentionally contains NO secrets.
+ */
+export interface LoginInitiateResult {
+    /** Confirmation message (always "ok") */
+    message: string;
+    /** Seconds until the magic-link / TOTP code expires */
+    expires_in: number;
+}
+/**
+ * Initiate login for an email address.
+ *
+ * This is the ONLY public endpoint for login initiation. It:
+ * 1. Validates email format and domain
+ * 2. Looks up or creates user (PENDING status for new users)
+ * 3. Creates magic link token and TOTP code
+ * 4. Sends the email via bridge-api (server-to-server)
+ * 5. Returns a simple success message — no tokens leave the backend
+ *
+ * NEVER leaks whether an email/user exists - always returns same structure.
+ *
+ * @param email - The email address to login
+ * @param options - Auth client options (only authzUrl is used)
+ * @returns Simple success acknowledgement (no tokens)
+ */
+export declare function initiateLogin(email: string, options?: AuthClientOptions): Promise<LoginInitiateResult>;
+/**
+ * Clean up expired sessions, magic links, TOTP codes, and passkey challenges.
+ * Should be called periodically by a scheduled job.
+ */
+export declare function cleanupExpired(options?: AuthClientOptions): Promise<{
+    sessions: number;
+    magic_links: number;
+    totp_codes: number;
+    passkey_challenges: number;
+}>;
+//# sourceMappingURL=session-client.d.ts.map

package/dist/lib/authz/session-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-client.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/session-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAMD,MAAM,WAAW,OAAO;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QACJ,gFAAgF;QAChF,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,mCAAmC;QACnC,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5C,CAAC;IACF,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAMD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE;QACJ,gFAAgF;QAChF,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,mCAAmC;QACnC,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5C,CAAC;IACF,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAMD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE;QACJ,gFAAgF;QAChF,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,mCAAmC;QACnC,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5C,CAAC;IACF,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAyCD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,EAC3B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAUzB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAMjB;AAMD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,qBAAqB,EAC7B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,SAAS,CAAC,CAUpB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAS3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAUjC;AAMD;;;GAGG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAW5B;AAMD;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,cAAc,GAAG,gBAAgB,EACvC,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,qBAAqB,EAC7B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,EAAE,CAAC,CAMpB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAanC;AAMD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAgB9B;AAMD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC,CAMD"}

package/dist/lib/authz/session-client.js

@@ -0,0 +1,325 @@
+/**
+ * Auth Client for busibox-app
+ *
+ * Zero Trust Authentication Architecture:
+ * All authentication is handled by the authz service. There are NO admin tokens
+ * or client credentials - everything uses JWTs (session or access tokens).
+ *
+ * Authentication Methods:
+ * - User operations: Use session JWT (exchanged for access token)
+ * - Login flows: Authz endpoints are public (they ARE the authentication)
+ * - Service operations: Use service account JWT
+ *
+ * Usage:
+ * ```typescript
+ * import { validateSession, useMagicLink } from '@jazzmind/busibox-app';
+ *
+ * // Validate a session token (returns session with user info)
+ * const session = await validateSession('session-jwt', {
+ *   authzUrl: process.env.AUTHZ_BASE_URL,
+ * });
+ *
+ * // Use magic link for passwordless login (no auth needed - this IS auth)
+ * const result = await useMagicLink(magicLink.token, { authzUrl });
+ * ```
+ */
+const DEFAULT_AUTHZ_URL = process.env.AUTHZ_BASE_URL || process.env.AUTHZ_URL || 'http://authz-api:8010';
+// ============================================================================
+// Helper Functions
+// ============================================================================
+async function authFetch(path, options, init = {}) {
+    const baseUrl = options.authzUrl || DEFAULT_AUTHZ_URL;
+    const url = `${baseUrl}${path}`;
+    const headers = {
+        'Content-Type': 'application/json',
+        ...init.headers,
+    };
+    // Zero Trust: Add access token if provided
+    if (options.accessToken) {
+        headers['Authorization'] = `Bearer ${options.accessToken}`;
+    }
+    const response = await fetch(url, {
+        ...init,
+        headers,
+    });
+    if (!response.ok) {
+        const errorText = await response.text().catch(() => 'Unknown error');
+        throw new Error(`Auth error (${response.status}): ${errorText}`);
+    }
+    return response;
+}
+// ============================================================================
+// Session Management
+// ============================================================================
+/**
+ * Create a session in authz.
+ * Used by applications to create sessions after authentication (e.g., passkey login).
+ */
+export async function createSession(params, options = {}) {
+    const response = await authFetch('/auth/sessions', options, {
+        method: 'POST',
+        body: JSON.stringify({
+            user_id: params.userId,
+            token: params.token,
+            expires_at: params.expiresAt,
+            ip_address: params.ipAddress,
+            user_agent: params.userAgent,
+        }),
+    });
+    return await response.json();
+}
+/**
+ * Validate a session by token.
+ * Returns the session with user info if valid, null if not found/expired.
+ */
+export async function validateSession(token, options = {}) {
+    try {
+        const response = await authFetch(`/auth/sessions/${encodeURIComponent(token)}`, options, {
+            method: 'GET',
+        });
+        return await response.json();
+    }
+    catch (error) {
+        // 404 means session not found or expired
+        return null;
+    }
+}
+/**
+ * Delete a session (logout).
+ */
+export async function deleteSession(token, options = {}) {
+    try {
+        await authFetch(`/auth/sessions/${encodeURIComponent(token)}`, options, {
+            method: 'DELETE',
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Delete all sessions for a user (logout everywhere).
+ */
+export async function deleteUserSessions(userId, options = {}) {
+    const response = await authFetch(`/auth/sessions/user/${userId}`, options, {
+        method: 'DELETE',
+    });
+    const result = await response.json();
+    return result.deleted_count || 0;
+}
+// ============================================================================
+// Magic Links
+// ============================================================================
+/**
+ * Create a magic link for passwordless login.
+ * The token should be sent to the user's email by the calling application.
+ */
+export async function createMagicLink(params, options = {}) {
+    const response = await authFetch('/auth/magic-links', options, {
+        method: 'POST',
+        body: JSON.stringify({
+            user_id: params.userId,
+            email: params.email,
+            expires_in_seconds: params.expiresInSeconds || 900,
+        }),
+    });
+    return await response.json();
+}
+/**
+ * Validate a magic link (without consuming it).
+ * Returns the magic link info if valid, null otherwise.
+ */
+export async function validateMagicLink(token, options = {}) {
+    try {
+        const response = await authFetch(`/auth/magic-links/${encodeURIComponent(token)}`, options, {
+            method: 'GET',
+        });
+        return await response.json();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Use (consume) a magic link.
+ * - Marks the link as used
+ * - Activates the user if pending
+ * - Sets email_verified_at
+ * - Creates a new session
+ *
+ * Returns the user and session, or null if invalid.
+ */
+export async function useMagicLink(token, options = {}) {
+    try {
+        const response = await authFetch(`/auth/magic-links/${encodeURIComponent(token)}/use`, options, {
+            method: 'POST',
+        });
+        return await response.json();
+    }
+    catch (error) {
+        console.error('[AUTH] useMagicLink failed:', error);
+        return null;
+    }
+}
+// ============================================================================
+// TOTP Codes
+// ============================================================================
+/**
+ * Create a TOTP code for multi-device login.
+ * Returns the plaintext code to be sent via email.
+ */
+export async function createTotpCode(params, options = {}) {
+    const response = await authFetch('/auth/totp', options, {
+        method: 'POST',
+        body: JSON.stringify({
+            user_id: params.userId,
+            email: params.email,
+            expires_in_seconds: params.expiresInSeconds || 300,
+        }),
+    });
+    return await response.json();
+}
+/**
+ * Verify a TOTP code and create a session.
+ * Returns user and session if valid, null otherwise.
+ */
+export async function verifyTotpCode(email, code, options = {}) {
+    try {
+        const response = await authFetch('/auth/totp/verify', options, {
+            method: 'POST',
+            body: JSON.stringify({ email, code }),
+        });
+        return await response.json();
+    }
+    catch (error) {
+        console.error('[AUTH] verifyTotpCode failed:', error);
+        return null;
+    }
+}
+// ============================================================================
+// Passkeys (WebAuthn)
+// ============================================================================
+/**
+ * Create a passkey challenge for registration or authentication.
+ */
+export async function createPasskeyChallenge(type, userId, options = {}) {
+    const response = await authFetch('/auth/passkeys/challenge', options, {
+        method: 'POST',
+        body: JSON.stringify({ type, user_id: userId }),
+    });
+    return await response.json();
+}
+/**
+ * Register a new passkey for a user.
+ */
+export async function registerPasskey(params, options = {}) {
+    const response = await authFetch('/auth/passkeys', options, {
+        method: 'POST',
+        body: JSON.stringify({
+            user_id: params.userId,
+            credential_id: params.credentialId,
+            credential_public_key: params.credentialPublicKey,
+            counter: params.counter || 0,
+            device_type: params.deviceType,
+            backed_up: params.backedUp || false,
+            transports: params.transports || [],
+            aaguid: params.aaguid,
+            name: params.name,
+        }),
+    });
+    return await response.json();
+}
+/**
+ * List all passkeys for a user.
+ */
+export async function listUserPasskeys(userId, options = {}) {
+    const response = await authFetch(`/auth/passkeys/user/${userId}`, options, {
+        method: 'GET',
+    });
+    const result = await response.json();
+    return result.passkeys || [];
+}
+/**
+ * Delete a passkey.
+ */
+export async function deletePasskey(passkeyId, options = {}) {
+    try {
+        await authFetch(`/auth/passkeys/${passkeyId}`, options, {
+            method: 'DELETE',
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Authenticate with a passkey.
+ *
+ * Note: The caller is responsible for:
+ * 1. Getting the challenge from createPasskeyChallenge()
+ * 2. Calling navigator.credentials.get() in the browser
+ * 3. Verifying the signature against the stored public key
+ * 4. Calling this endpoint with the credential_id and new_counter
+ */
+export async function authenticateWithPasskey(credentialId, newCounter, options = {}) {
+    try {
+        const response = await authFetch('/auth/passkeys/authenticate', options, {
+            method: 'POST',
+            body: JSON.stringify({
+                credential_id: credentialId,
+                new_counter: newCounter,
+            }),
+        });
+        return await response.json();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Initiate login for an email address.
+ *
+ * This is the ONLY public endpoint for login initiation. It:
+ * 1. Validates email format and domain
+ * 2. Looks up or creates user (PENDING status for new users)
+ * 3. Creates magic link token and TOTP code
+ * 4. Sends the email via bridge-api (server-to-server)
+ * 5. Returns a simple success message — no tokens leave the backend
+ *
+ * NEVER leaks whether an email/user exists - always returns same structure.
+ *
+ * @param email - The email address to login
+ * @param options - Auth client options (only authzUrl is used)
+ * @returns Simple success acknowledgement (no tokens)
+ */
+export async function initiateLogin(email, options = {}) {
+    const baseUrl = options.authzUrl || DEFAULT_AUTHZ_URL;
+    const url = `${baseUrl}/auth/login/initiate`;
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: email.toLowerCase().trim() }),
+    });
+    if (!response.ok) {
+        const errorText = await response.text().catch(() => 'Unknown error');
+        throw new Error(`Login initiation failed (${response.status}): ${errorText}`);
+    }
+    return await response.json();
+}
+// ============================================================================
+// Cleanup
+// ============================================================================
+/**
+ * Clean up expired sessions, magic links, TOTP codes, and passkey challenges.
+ * Should be called periodically by a scheduled job.
+ */
+export async function cleanupExpired(options = {}) {
+    const response = await authFetch('/auth/cleanup', options, {
+        method: 'POST',
+    });
+    const result = await response.json();
+    return result.cleaned || { sessions: 0, magic_links: 0, totp_codes: 0, passkey_challenges: 0 };
+}
+//# sourceMappingURL=session-client.js.map

package/dist/lib/authz/session-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-client.js","sourceRoot":"","sources":["../../../src/lib/authz/session-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,uBAAuB,CAAC;AAgKzG,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,OAA0B,EAC1B,OAAoB,EAAE;IAEtB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACtD,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;IAEhC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,GAAI,IAAI,CAAC,OAAkC;KAC5C,CAAC;IAEF,2CAA2C;IAC3C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,OAAO,CAAC,WAAW,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,GAAG,IAAI;QACP,OAAO;KACR,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B,EAC3B,UAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,EAAE,OAAO,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC;KACH,CAAC,CAAC;IACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,UAA6B,EAAE;IAE/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE;YACvF,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yCAAyC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,UAA6B,EAAE;IAE/B,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE;YACtE,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,UAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,uBAAuB,MAAM,EAAE,EAAE,OAAO,EAAE;QACzE,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAA6B,EAC7B,UAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,mBAAmB,EAAE,OAAO,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,IAAI,GAAG;SACnD,CAAC;KACH,CAAC,CAAC;IACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,UAA6B,EAAE;IAE/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,qBAAqB,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE;YAC1F,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAa,EACb,UAA6B,EAAE;IAE/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,qBAAqB,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE;YAC9F,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAwB,EACxB,UAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE;QACtD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,IAAI,GAAG;SACnD,CAAC;KACH,CAAC,CAAC;IACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,IAAY,EACZ,UAA6B,EAAE;IAE/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,mBAAmB,EAAE,OAAO,EAAE;YAC7D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SACtC,CAAC,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAuC,EACvC,MAAe,EACf,UAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,0BAA0B,EAAE,OAAO,EAAE;QACpE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAA6B,EAC7B,UAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,EAAE,OAAO,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,qBAAqB,EAAE,MAAM,CAAC,mBAAmB;YACjD,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC;YAC5B,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,SAAS,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK;YACnC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;YACnC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;KACH,CAAC,CAAC;IACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,UAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,uBAAuB,MAAM,EAAE,EAAE,OAAO,EAAE;QACzE,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,UAA6B,EAAE;IAE/B,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,kBAAkB,SAAS,EAAE,EAAE,OAAO,EAAE;YACtD,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,UAAkB,EAClB,UAA6B,EAAE;IAE/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,6BAA6B,EAAE,OAAO,EAAE;YACvE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,aAAa,EAAE,YAAY;gBAC3B,WAAW,EAAE,UAAU;aACxB,CAAC;SACH,CAAC,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAmBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,UAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACtD,MAAM,GAAG,GAAG,GAAG,OAAO,sBAAsB,CAAC;IAE7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;KAC5D,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAA6B,EAAE;IAMlE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE,OAAO,EAAE;QACzD,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC"}