@korajs/auth 0.3.0 → 0.3.2

package/dist/server.js

@@ -1631,6 +1631,383 @@ function generateSecureToken2() {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
+// src/provider/built-in/sqlite-user-store.ts
+import { randomUUID as randomUUID3 } from "crypto";
+var SqliteUserStore = class {
+  db;
+  constructor(db) {
+    this.db = db;
+    this.db.pragma("journal_mode = WAL");
+    this.ensureTables();
+  }
+  ensureTables() {
+    this.db.exec(`
+			CREATE TABLE IF NOT EXISTS auth_users (
+				id TEXT PRIMARY KEY,
+				email TEXT NOT NULL UNIQUE COLLATE NOCASE,
+				name TEXT NOT NULL,
+				email_verified INTEGER NOT NULL DEFAULT 0,
+				created_at INTEGER NOT NULL,
+				password_hash TEXT NOT NULL,
+				salt TEXT NOT NULL
+			);
+
+			CREATE TABLE IF NOT EXISTS auth_devices (
+				id TEXT PRIMARY KEY,
+				user_id TEXT NOT NULL,
+				public_key TEXT NOT NULL,
+				name TEXT NOT NULL,
+				revoked INTEGER NOT NULL DEFAULT 0,
+				created_at INTEGER NOT NULL,
+				last_seen_at INTEGER NOT NULL,
+				FOREIGN KEY (user_id) REFERENCES auth_users(id) ON DELETE CASCADE
+			);
+
+			CREATE INDEX IF NOT EXISTS idx_auth_devices_user_id ON auth_devices(user_id);
+		`);
+  }
+  async createUser(params) {
+    const normalizedEmail = params.email.toLowerCase();
+    const now = Date.now();
+    const id = randomUUID3();
+    try {
+      this.db.prepare(`
+				INSERT INTO auth_users (id, email, name, email_verified, created_at, password_hash, salt)
+				VALUES (?, ?, ?, 0, ?, ?, ?)
+			`).run(id, normalizedEmail, params.name, now, params.passwordHash, params.salt);
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("UNIQUE constraint failed")) {
+        throw new DuplicateEmailError();
+      }
+      throw err;
+    }
+    return { id, email: normalizedEmail, name: params.name, emailVerified: false, createdAt: now };
+  }
+  async findByEmail(email) {
+    const row = this.db.prepare(
+      "SELECT * FROM auth_users WHERE email = ?"
+    ).get(email.toLowerCase());
+    return row ? rowToStoredUser(row) : null;
+  }
+  async findById(id) {
+    const row = this.db.prepare(
+      "SELECT * FROM auth_users WHERE id = ?"
+    ).get(id);
+    return row ? rowToStoredUser(row) : null;
+  }
+  async registerDevice(params) {
+    const existing = this.db.prepare(
+      "SELECT * FROM auth_devices WHERE id = ?"
+    ).get(params.id);
+    if (existing && !existing.revoked) {
+      return rowToDevice(existing);
+    }
+    const now = Date.now();
+    if (existing) {
+      this.db.prepare(`
+				UPDATE auth_devices SET revoked = 0, public_key = ?, name = ?, last_seen_at = ?
+				WHERE id = ?
+			`).run(params.publicKey, params.name, now, params.id);
+    } else {
+      this.db.prepare(`
+				INSERT INTO auth_devices (id, user_id, public_key, name, revoked, created_at, last_seen_at)
+				VALUES (?, ?, ?, ?, 0, ?, ?)
+			`).run(params.id, params.userId, params.publicKey, params.name, now, now);
+    }
+    return {
+      id: params.id,
+      userId: params.userId,
+      publicKey: params.publicKey,
+      name: params.name,
+      revoked: false,
+      createdAt: existing ? existing.created_at : now,
+      lastSeenAt: now
+    };
+  }
+  async findDevice(deviceId) {
+    const row = this.db.prepare(
+      "SELECT * FROM auth_devices WHERE id = ?"
+    ).get(deviceId);
+    return row ? rowToDevice(row) : null;
+  }
+  async listDevices(userId) {
+    const rows = this.db.prepare(
+      "SELECT * FROM auth_devices WHERE user_id = ?"
+    ).all(userId);
+    return rows.map(rowToDevice);
+  }
+  async revokeDevice(deviceId) {
+    this.db.prepare("UPDATE auth_devices SET revoked = 1 WHERE id = ?").run(deviceId);
+  }
+  async setEmailVerified(userId, verified) {
+    this.db.prepare(
+      "UPDATE auth_users SET email_verified = ? WHERE id = ?"
+    ).run(verified ? 1 : 0, userId);
+  }
+  async updatePassword(userId, passwordHash, salt) {
+    this.db.prepare(
+      "UPDATE auth_users SET password_hash = ?, salt = ? WHERE id = ?"
+    ).run(passwordHash, salt, userId);
+  }
+  async listAll() {
+    const rows = this.db.prepare("SELECT * FROM auth_users").all();
+    return rows.map(rowToStoredUser);
+  }
+  async update(user) {
+    this.db.prepare(`
+			UPDATE auth_users
+			SET email = ?, name = ?, email_verified = ?, password_hash = ?, salt = ?
+			WHERE id = ?
+		`).run(user.email, user.name, user.emailVerified ? 1 : 0, user.passwordHash, user.salt, user.id);
+  }
+  async delete(userId) {
+    const deleteInTransaction = this.db.transaction(() => {
+      this.db.prepare("DELETE FROM auth_devices WHERE user_id = ?").run(userId);
+      this.db.prepare("DELETE FROM auth_users WHERE id = ?").run(userId);
+    });
+    deleteInTransaction();
+  }
+  async touchDevice(deviceId) {
+    this.db.prepare(
+      "UPDATE auth_devices SET last_seen_at = ? WHERE id = ?"
+    ).run(Date.now(), deviceId);
+  }
+};
+async function createSqliteUserStore(options) {
+  const Database = await loadBetterSqlite3();
+  const db = new Database(options.filename);
+  return new SqliteUserStore(db);
+}
+async function loadBetterSqlite3() {
+  try {
+    const { createRequire } = await import("module");
+    const require2 = createRequire(import.meta.url);
+    return require2("better-sqlite3");
+  } catch {
+    throw new Error(
+      'SQLite backend requires the "better-sqlite3" package. Install it in your project dependencies.'
+    );
+  }
+}
+function rowToStoredUser(row) {
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name,
+    emailVerified: Boolean(row.email_verified),
+    createdAt: row.created_at,
+    passwordHash: row.password_hash,
+    salt: row.salt
+  };
+}
+function rowToDevice(row) {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    publicKey: row.public_key,
+    name: row.name,
+    revoked: Boolean(row.revoked),
+    createdAt: row.created_at,
+    lastSeenAt: row.last_seen_at
+  };
+}
+
+// src/provider/built-in/postgres-user-store.ts
+import { randomUUID as randomUUID4 } from "crypto";
+var PostgresUserStore = class {
+  sql;
+  ready;
+  constructor(sql) {
+    this.sql = sql;
+    this.ready = this.ensureTables();
+  }
+  async ensureTables() {
+    await this.sql`
+			CREATE TABLE IF NOT EXISTS auth_users (
+				id TEXT PRIMARY KEY,
+				email TEXT NOT NULL UNIQUE,
+				name TEXT NOT NULL,
+				email_verified BOOLEAN NOT NULL DEFAULT FALSE,
+				created_at BIGINT NOT NULL,
+				password_hash TEXT NOT NULL,
+				salt TEXT NOT NULL
+			)
+		`;
+    await this.sql`
+			CREATE TABLE IF NOT EXISTS auth_devices (
+				id TEXT PRIMARY KEY,
+				user_id TEXT NOT NULL REFERENCES auth_users(id) ON DELETE CASCADE,
+				public_key TEXT NOT NULL,
+				name TEXT NOT NULL,
+				revoked BOOLEAN NOT NULL DEFAULT FALSE,
+				created_at BIGINT NOT NULL,
+				last_seen_at BIGINT NOT NULL
+			)
+		`;
+    await this.sql`
+			CREATE INDEX IF NOT EXISTS idx_auth_devices_user_id ON auth_devices(user_id)
+		`;
+    await this.sql`
+			CREATE UNIQUE INDEX IF NOT EXISTS idx_auth_users_email_lower ON auth_users(LOWER(email))
+		`;
+  }
+  async createUser(params) {
+    await this.ready;
+    const normalizedEmail = params.email.toLowerCase();
+    const now = Date.now();
+    const id = randomUUID4();
+    try {
+      await this.sql`
+				INSERT INTO auth_users (id, email, name, email_verified, created_at, password_hash, salt)
+				VALUES (${id}, ${normalizedEmail}, ${params.name}, FALSE, ${now}, ${params.passwordHash}, ${params.salt})
+			`;
+    } catch (err) {
+      if (err instanceof Error && (err.message.includes("unique constraint") || err.message.includes("duplicate key"))) {
+        throw new DuplicateEmailError();
+      }
+      throw err;
+    }
+    return { id, email: normalizedEmail, name: params.name, emailVerified: false, createdAt: now };
+  }
+  async findByEmail(email) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_users WHERE LOWER(email) = ${email.toLowerCase()}
+		`;
+    return rows.length > 0 ? rowToStoredUser2(rows[0]) : null;
+  }
+  async findById(id) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_users WHERE id = ${id}
+		`;
+    return rows.length > 0 ? rowToStoredUser2(rows[0]) : null;
+  }
+  async registerDevice(params) {
+    await this.ready;
+    const existingRows = await this.sql`
+			SELECT * FROM auth_devices WHERE id = ${params.id}
+		`;
+    if (existingRows.length > 0 && !existingRows[0].revoked) {
+      return rowToDevice2(existingRows[0]);
+    }
+    const now = Date.now();
+    if (existingRows.length > 0) {
+      await this.sql`
+				UPDATE auth_devices SET revoked = FALSE, public_key = ${params.publicKey}, name = ${params.name}, last_seen_at = ${now}
+				WHERE id = ${params.id}
+			`;
+    } else {
+      await this.sql`
+				INSERT INTO auth_devices (id, user_id, public_key, name, revoked, created_at, last_seen_at)
+				VALUES (${params.id}, ${params.userId}, ${params.publicKey}, ${params.name}, FALSE, ${now}, ${now})
+			`;
+    }
+    return {
+      id: params.id,
+      userId: params.userId,
+      publicKey: params.publicKey,
+      name: params.name,
+      revoked: false,
+      createdAt: existingRows.length > 0 ? Number(existingRows[0].created_at) : now,
+      lastSeenAt: now
+    };
+  }
+  async findDevice(deviceId) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_devices WHERE id = ${deviceId}
+		`;
+    return rows.length > 0 ? rowToDevice2(rows[0]) : null;
+  }
+  async listDevices(userId) {
+    await this.ready;
+    const rows = await this.sql`
+			SELECT * FROM auth_devices WHERE user_id = ${userId}
+		`;
+    return rows.map(rowToDevice2);
+  }
+  async revokeDevice(deviceId) {
+    await this.ready;
+    await this.sql`UPDATE auth_devices SET revoked = TRUE WHERE id = ${deviceId}`;
+  }
+  async setEmailVerified(userId, verified) {
+    await this.ready;
+    await this.sql`UPDATE auth_users SET email_verified = ${verified} WHERE id = ${userId}`;
+  }
+  async updatePassword(userId, passwordHash, salt) {
+    await this.ready;
+    await this.sql`
+			UPDATE auth_users SET password_hash = ${passwordHash}, salt = ${salt}
+			WHERE id = ${userId}
+		`;
+  }
+  async listAll() {
+    await this.ready;
+    const rows = await this.sql`SELECT * FROM auth_users`;
+    return rows.map(rowToStoredUser2);
+  }
+  async update(user) {
+    await this.ready;
+    await this.sql`
+			UPDATE auth_users
+			SET email = ${user.email}, name = ${user.name}, email_verified = ${user.emailVerified},
+				password_hash = ${user.passwordHash}, salt = ${user.salt}
+			WHERE id = ${user.id}
+		`;
+  }
+  async delete(userId) {
+    await this.ready;
+    await this.sql.begin(async (tx) => {
+      await tx`DELETE FROM auth_devices WHERE user_id = ${userId}`;
+      await tx`DELETE FROM auth_users WHERE id = ${userId}`;
+    });
+  }
+  async touchDevice(deviceId) {
+    await this.ready;
+    const now = Date.now();
+    await this.sql`UPDATE auth_devices SET last_seen_at = ${now} WHERE id = ${deviceId}`;
+  }
+};
+async function createPostgresUserStore(options) {
+  const postgresClient = await loadPostgresDeps();
+  const sql = postgresClient(options.connectionString);
+  return new PostgresUserStore(sql);
+}
+async function loadPostgresDeps() {
+  try {
+    const dynamicImport = new Function("specifier", "return import(specifier)");
+    const postgresMod = await dynamicImport("postgres");
+    return postgresMod.default;
+  } catch {
+    throw new Error(
+      'PostgreSQL backend requires the "postgres" package. Install it in your project dependencies.'
+    );
+  }
+}
+function rowToStoredUser2(row) {
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name,
+    emailVerified: Boolean(row.email_verified),
+    createdAt: Number(row.created_at),
+    passwordHash: row.password_hash,
+    salt: row.salt
+  };
+}
+function rowToDevice2(row) {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    publicKey: row.public_key,
+    name: row.name,
+    revoked: Boolean(row.revoked),
+    createdAt: Number(row.created_at),
+    lastSeenAt: Number(row.last_seen_at)
+  };
+}
+
 // src/provider/adapter.ts
 var AuthProviderError = class extends Error {
   /** HTTP-style status code */
@@ -5015,6 +5392,7 @@ export {
   PasskeyVerificationError,
   PasswordResetError,
   PasswordResetManager,
+  PostgresUserStore,
   ROLE_HIERARCHY,
   RbacEngine,
   RbacError,
@@ -5028,6 +5406,7 @@ export {
   SessionManager,
   SessionMfaRequiredError,
   SessionNotFoundError,
+  SqliteUserStore,
   TokenManager,
   TotpAlreadyEnabledError,
   TotpError,
@@ -5045,6 +5424,8 @@ export {
   base32Encode,
   computePublicKeyThumbprint,
   createClerkAdapter,
+  createPostgresUserStore,
+  createSqliteUserStore,
   createSupabaseAdapter,
   decodeJwt,
   defineRoles,