@korajs/auth 0.3.0 → 0.3.1

package/dist/server.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
@@ -18,12 +20,23 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // ../../node_modules/.pnpm/tsup@8.5.1_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/assets/cjs_shims.js
+var getImportMetaUrl, importMetaUrl;
 var init_cjs_shims = __esm({
   "../../node_modules/.pnpm/tsup@8.5.1_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3/node_modules/tsup/assets/cjs_shims.js"() {
     "use strict";
+    getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
+    importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
   }
 });
 
@@ -143,6 +156,7 @@ __export(server_exports, {
   PasskeyVerificationError: () => PasskeyVerificationError,
   PasswordResetError: () => PasswordResetError,
   PasswordResetManager: () => PasswordResetManager,
+  PostgresUserStore: () => PostgresUserStore,
   ROLE_HIERARCHY: () => ROLE_HIERARCHY,
   RbacEngine: () => RbacEngine,
   RbacError: () => RbacError,
@@ -156,6 +170,7 @@ __export(server_exports, {
   SessionManager: () => SessionManager,
   SessionMfaRequiredError: () => SessionMfaRequiredError,
   SessionNotFoundError: () => SessionNotFoundError,
+  SqliteUserStore: () => SqliteUserStore,
   TokenManager: () => TokenManager,
   TotpAlreadyEnabledError: () => TotpAlreadyEnabledError,
   TotpError: () => TotpError,
@@ -173,6 +188,8 @@ __export(server_exports, {
   base32Encode: () => base32Encode,
   computePublicKeyThumbprint: () => computePublicKeyThumbprint,
   createClerkAdapter: () => createClerkAdapter,
+  createPostgresUserStore: () => createPostgresUserStore,
+  createSqliteUserStore: () => createSqliteUserStore,
   createSupabaseAdapter: () => createSupabaseAdapter,
   decodeJwt: () => decodeJwt,
   defineRoles: () => defineRoles,
@@ -1946,6 +1963,385 @@ function generateSecureToken2() {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
+// src/provider/built-in/sqlite-user-store.ts
+init_cjs_shims();
+var import_node_crypto6 = require("crypto");
+var SqliteUserStore = class {
+  db;
+  constructor(db) {
+    this.db = db;
+    this.db.pragma("journal_mode = WAL");
+    this.ensureTables();
+  }
+  ensureTables() {
+    this.db.exec(`
+			CREATE TABLE IF NOT EXISTS auth_users (
+				id TEXT PRIMARY KEY,
+				email TEXT NOT NULL UNIQUE COLLATE NOCASE,
+				name TEXT NOT NULL,
+				email_verified INTEGER NOT NULL DEFAULT 0,
+				created_at INTEGER NOT NULL,
+				password_hash TEXT NOT NULL,
+				salt TEXT NOT NULL
+			);
+
+			CREATE TABLE IF NOT EXISTS auth_devices (
+				id TEXT PRIMARY KEY,
+				user_id TEXT NOT NULL,
+				public_key TEXT NOT NULL,
+				name TEXT NOT NULL,
+				revoked INTEGER NOT NULL DEFAULT 0,
+				created_at INTEGER NOT NULL,
+				last_seen_at INTEGER NOT NULL,
+				FOREIGN KEY (user_id) REFERENCES auth_users(id) ON DELETE CASCADE
+			);
+
+			CREATE INDEX IF NOT EXISTS idx_auth_devices_user_id ON auth_devices(user_id);
+		`);
+  }
+  async createUser(params) {
+    const normalizedEmail = params.email.toLowerCase();
+    const now = Date.now();
+    const id = (0, import_node_crypto6.randomUUID)();
+    try {
+      this.db.prepare(`
+				INSERT INTO auth_users (id, email, name, email_verified, created_at, password_hash, salt)
+				VALUES (?, ?, ?, 0, ?, ?, ?)
+			`).run(id, normalizedEmail, params.name, now, params.passwordHash, params.salt);
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("UNIQUE constraint failed")) {
+        throw new DuplicateEmailError();
+      }
+      throw err;
+    }
+    return { id, email: normalizedEmail, name: params.name, emailVerified: false, createdAt: now };
+  }
+  async findByEmail(email) {
+    const row = this.db.prepare(
+      "SELECT * FROM auth_users WHERE email = ?"
+    ).get(email.toLowerCase());
+    return row ? rowToStoredUser(row) : null;
+  }
+  async findById(id) {
+    const row = this.db.prepare(
+      "SELECT * FROM auth_users WHERE id = ?"
+    ).get(id);
+    return row ? rowToStoredUser(row) : null;
+  }
+  async registerDevice(params) {
+    const existing = this.db.prepare(
+      "SELECT * FROM auth_devices WHERE id = ?"
+    ).get(params.id);
+    if (existing && !existing.revoked) {
+      return rowToDevice(existing);
+    }
+    const now = Date.now();
+    if (existing) {
+      this.db.prepare(`
+				UPDATE auth_devices SET revoked = 0, public_key = ?, name = ?, last_seen_at = ?
+				WHERE id = ?
+			`).run(params.publicKey, params.name, now, params.id);
+    } else {
+      this.db.prepare(`
+				INSERT INTO auth_devices (id, user_id, public_key, name, revoked, created_at, last_seen_at)
+				VALUES (?, ?, ?, ?, 0, ?, ?)
+			`).run(params.id, params.userId, params.publicKey, params.name, now, now);
+    }
+    return {
+      id: params.id,
+      userId: params.userId,
+      publicKey: params.publicKey,
+      name: params.name,
+      revoked: false,
+      createdAt: existing ? existing.created_at : now,
+      lastSeenAt: now
+    };
+  }
+  async findDevice(deviceId) {
+    const row = this.db.prepare(
+      "SELECT * FROM auth_devices WHERE id = ?"
+    ).get(deviceId);
+    return row ? rowToDevice(row) : null;
+  }
+  async listDevices(userId) {
+    const rows = this.db.prepare(
+      "SELECT * FROM auth_devices WHERE user_id = ?"
+    ).all(userId);
+    return rows.map(rowToDevice);
+  }
+  async revokeDevice(deviceId) {
+    this.db.prepare("UPDATE auth_devices SET revoked = 1 WHERE id = ?").run(deviceId);
+  }
+  async setEmailVerified(userId, verified) {
+    this.db.prepare(
+      "UPDATE auth_users SET email_verified = ? WHERE id = ?"
+    ).run(verified ? 1 : 0, userId);
+  }
+  async updatePassword(userId, passwordHash, salt) {
+    this.db.prepare(
+      "UPDATE auth_users SET password_hash = ?, salt = ? WHERE id = ?"
+    ).run(passwordHash, salt, userId);
+  }
+  async listAll() {
+    const rows = this.db.prepare("SELECT * FROM auth_users").all();
+    return rows.map(rowToStoredUser);
+  }
+  async update(user) {
+    this.db.prepare(`
+			UPDATE auth_users
+			SET email = ?, name = ?, email_verified = ?, password_hash = ?, salt = ?
+			WHERE id = ?
+		`).run(user.email, user.name, user.emailVerified ? 1 : 0, user.passwordHash, user.salt, user.id);
+  }
+  async delete(userId) {
+    const deleteInTransaction = this.db.transaction(() => {
+      this.db.prepare("DELETE FROM auth_devices WHERE user_id = ?").run(userId);
+      this.db.prepare("DELETE FROM auth_users WHERE id = ?").run(userId);
+    });
+    deleteInTransaction();
+  }
+  async touchDevice(deviceId) {
+    this.db.prepare(
+      "UPDATE auth_devices SET last_seen_at = ? WHERE id = ?"
+    ).run(Date.now(), deviceId);
+  }
+};
+async function createSqliteUserStore(options) {
+  const Database = await loadBetterSqlite3();
+  const db = new Database(options.filename);
+  return new SqliteUserStore(db);
+}
+async function loadBetterSqlite3() {
+  try {
+    const { createRequire } = await import("module");
+    const require2 = createRequire(importMetaUrl);
+    return require2("better-sqlite3");
+  } catch {
+    throw new Error(
+      'SQLite backend requires the "better-sqlite3" package. Install it in your project dependencies.'
+    );
+  }
+}
+function rowToStoredUser(row) {
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name,
+    emailVerified: Boolean(row.email_verified),
+    createdAt: row.created_at,
+    passwordHash: row.password_hash,
+    salt: row.salt
+  };
+}
+function rowToDevice(row) {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    publicKey: row.public_key,
+    name: row.name,
+    revoked: Boolean(row.revoked),
+    createdAt: row.created_at,
+    lastSeenAt: row.last_seen_at
+  };
+}
+
+// src/provider/built-in/postgres-user-store.ts
+init_cjs_shims();
+var import_node_crypto7 = require("crypto");
+var PostgresUserStore = class {
+  sql;
+  ready;
+  constructor(sql) {
+    this.sql = sql;
+    this.ready = this.ensureTables();
+  }
+  async ensureTables() {
+    await this.sql`
+			CREATE TABLE IF NOT EXISTS auth_users (
+				id TEXT PRIMARY KEY,
+				email TEXT NOT NULL UNIQUE,
+				name TEXT NOT NULL,
+				email_verified BOOLEAN NOT NULL DEFAULT FALSE,
+				created_at BIGINT NOT NULL,
+				password_hash TEXT NOT NULL,
+				salt TEXT NOT NULL
+			)
+		`;
+    await this.sql`
+			CREATE TABLE IF NOT EXISTS auth_devices (
+				id TEXT PRIMARY KEY,
+				user_id TEXT NOT NULL REFERENCES auth_users(id) ON DELETE CASCADE,
+				public_key TEXT NOT NULL,
+				name TEXT NOT NULL,
+				revoked BOOLEAN NOT NULL DEFAULT FALSE,
+				created_at BIGINT NOT NULL,
+				last_seen_at BIGINT NOT NULL
+			)
+		`;
+    await this.sql`
+			CREATE INDEX IF NOT EXISTS idx_auth_devices_user_id ON auth_devices(user_id)
+		`;
+    await this.sql`
+			CREATE UNIQUE INDEX IF NOT EXISTS idx_auth_users_email_lower ON auth_users(LOWER(email))
+		`;
+  }
+  async createUser(params) {
+    await this.ready;
+    const normalizedEmail = params.email.toLowerCase();
+    const now = Date.now();
+    const id = (0, import_node_crypto7.randomUUID)();
+    try {
+      await this.sql`
+				INSERT INTO auth_users (id, email, name, email_verified, created_at, password_hash, salt)
+				VALUES (${id}, ${normalizedEmail}, ${params.name}, FALSE, ${now}, ${params.passwordHash}, ${params.salt})
+			`;
+    } catch (err) {
+      if (err instanceof Error && (err.message.includes("unique constraint") || err.message.includes("duplicate key"))) {
+        throw new DuplicateEmailError();
+      }
+      throw err;
+    }
+    return { id, email: normalizedEmail, name: params.name, emailVerified: false, createdAt: now };
+  }
+  async findByEmail(email) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_users WHERE LOWER(email) = ${email.toLowerCase()}
+		`;
+    return rows.length > 0 ? rowToStoredUser2(rows[0]) : null;
+  }
+  async findById(id) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_users WHERE id = ${id}
+		`;
+    return rows.length > 0 ? rowToStoredUser2(rows[0]) : null;
+  }
+  async registerDevice(params) {
+    await this.ready;
+    const existingRows = await this.sql`
+			SELECT * FROM auth_devices WHERE id = ${params.id}
+		`;
+    if (existingRows.length > 0 && !existingRows[0].revoked) {
+      return rowToDevice2(existingRows[0]);
+    }
+    const now = Date.now();
+    if (existingRows.length > 0) {
+      await this.sql`
+				UPDATE auth_devices SET revoked = FALSE, public_key = ${params.publicKey}, name = ${params.name}, last_seen_at = ${now}
+				WHERE id = ${params.id}
+			`;
+    } else {
+      await this.sql`
+				INSERT INTO auth_devices (id, user_id, public_key, name, revoked, created_at, last_seen_at)
+				VALUES (${params.id}, ${params.userId}, ${params.publicKey}, ${params.name}, FALSE, ${now}, ${now})
+			`;
+    }
+    return {
+      id: params.id,
+      userId: params.userId,
+      publicKey: params.publicKey,
+      name: params.name,
+      revoked: false,
+      createdAt: existingRows.length > 0 ? Number(existingRows[0].created_at) : now,
+      lastSeenAt: now
+    };
+  }
+  async findDevice(deviceId) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_devices WHERE id = ${deviceId}
+		`;
+    return rows.length > 0 ? rowToDevice2(rows[0]) : null;
+  }
+  async listDevices(userId) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_devices WHERE user_id = ${userId}
+		`;
+    return rows.map(rowToDevice2);
+  }
+  async revokeDevice(deviceId) {
+    await this.ready;
+    await this.sql`UPDATE auth_devices SET revoked = TRUE WHERE id = ${deviceId}`;
+  }
+  async setEmailVerified(userId, verified) {
+    await this.ready;
+    await this.sql`UPDATE auth_users SET email_verified = ${verified} WHERE id = ${userId}`;
+  }
+  async updatePassword(userId, passwordHash, salt) {
+    await this.ready;
+    await this.sql`
+			UPDATE auth_users SET password_hash = ${passwordHash}, salt = ${salt}
+			WHERE id = ${userId}
+		`;
+  }
+  async listAll() {
+    await this.ready;
+    const rows = await this.sql`SELECT * FROM auth_users`;
+    return rows.map(rowToStoredUser2);
+  }
+  async update(user) {
+    await this.ready;
+    await this.sql`
+			UPDATE auth_users
+			SET email = ${user.email}, name = ${user.name}, email_verified = ${user.emailVerified},
+				password_hash = ${user.passwordHash}, salt = ${user.salt}
+			WHERE id = ${user.id}
+		`;
+  }
+  async delete(userId) {
+    await this.ready;
+    await this.sql.begin(async (tx) => {
+      await tx`DELETE FROM auth_devices WHERE user_id = ${userId}`;
+      await tx`DELETE FROM auth_users WHERE id = ${userId}`;
+    });
+  }
+  async touchDevice(deviceId) {
+    await this.ready;
+    const now = Date.now();
+    await this.sql`UPDATE auth_devices SET last_seen_at = ${now} WHERE id = ${deviceId}`;
+  }
+};
+async function createPostgresUserStore(options) {
+  const postgresClient = await loadPostgresDeps();
+  const sql = postgresClient(options.connectionString);
+  return new PostgresUserStore(sql);
+}
+async function loadPostgresDeps() {
+  try {
+    const dynamicImport = new Function("specifier", "return import(specifier)");
+    const postgresMod = await dynamicImport("postgres");
+    return postgresMod.default;
+  } catch {
+    throw new Error(
+      'PostgreSQL backend requires the "postgres" package. Install it in your project dependencies.'
+    );
+  }
+}
+function rowToStoredUser2(row) {
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name,
+    emailVerified: Boolean(row.email_verified),
+    createdAt: Number(row.created_at),
+    passwordHash: row.password_hash,
+    salt: row.salt
+  };
+}
+function rowToDevice2(row) {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    publicKey: row.public_key,
+    name: row.name,
+    revoked: Boolean(row.revoked),
+    createdAt: Number(row.created_at),
+    lastSeenAt: Number(row.last_seen_at)
+  };
+}
+
 // src/provider/adapter.ts
 init_cjs_shims();
 var AuthProviderError = class extends Error {
@@ -2341,7 +2737,7 @@ function createSupabaseAdapter(config) {
 
 // src/passkey/passkey-server.ts
 init_cjs_shims();
-var import_node_crypto6 = require("crypto");
+var import_node_crypto8 = require("crypto");
 var import_core8 = require("@korajs/core");
 
 // src/passkey/passkey-client.ts
@@ -2435,7 +2831,7 @@ var PasskeyVerificationError = class extends import_core8.KoraError {
   }
 };
 function generateRegistrationOptions(params) {
-  const challengeBytes = (0, import_node_crypto6.randomBytes)(32);
+  const challengeBytes = (0, import_node_crypto8.randomBytes)(32);
   const challenge = toBase64Url(challengeBytes.buffer.slice(
     challengeBytes.byteOffset,
     challengeBytes.byteOffset + challengeBytes.byteLength
@@ -2548,7 +2944,7 @@ async function verifyRegistrationResponse(params) {
   };
 }
 function generateAuthenticationOptions(params) {
-  const challengeBytes = (0, import_node_crypto6.randomBytes)(32);
+  const challengeBytes = (0, import_node_crypto8.randomBytes)(32);
   const challenge = toBase64Url(challengeBytes.buffer.slice(
     challengeBytes.byteOffset,
     challengeBytes.byteOffset + challengeBytes.byteLength
@@ -5706,6 +6102,7 @@ function delay(ms) {
   PasskeyVerificationError,
   PasswordResetError,
   PasswordResetManager,
+  PostgresUserStore,
   ROLE_HIERARCHY,
   RbacEngine,
   RbacError,
@@ -5719,6 +6116,7 @@ function delay(ms) {
   SessionManager,
   SessionMfaRequiredError,
   SessionNotFoundError,
+  SqliteUserStore,
   TokenManager,
   TotpAlreadyEnabledError,
   TotpError,
@@ -5736,6 +6134,8 @@ function delay(ms) {
   base32Encode,
   computePublicKeyThumbprint,
   createClerkAdapter,
+  createPostgresUserStore,
+  createSqliteUserStore,
   createSupabaseAdapter,
   decodeJwt,
   defineRoles,