@korajs/auth 1.0.0-beta.11 → 1.0.0-beta.13

package/src/react/org-hooks.ts

@@ -0,0 +1,214 @@
+import {
+	createContext,
+	useCallback,
+	useContext,
+	useEffect,
+	useRef,
+	useState,
+	useSyncExternalStore,
+} from 'react'
+import {
+	type OrgSession,
+	type OrgSnapshot,
+	checkOrgPermission,
+	createOrgMembersActions,
+	createOrgSession,
+	loadOrgMembers,
+} from '../bindings/create-org-session'
+import type {
+	ClientInvitation,
+	ClientMembership,
+	ClientOrganization,
+	OrgClient,
+} from '../client/org-client'
+
+export interface OrgContextValue {
+	client: OrgClient
+	session: OrgSession
+}
+
+export const OrgContext = createContext<OrgContextValue | null>(null)
+
+function useOrgContext(): OrgContextValue {
+	const ctx = useContext(OrgContext)
+	if (ctx === null) {
+		throw new Error(
+			'useOrg / useOrgMembers / usePermission must be used within an <OrgProvider>. ' +
+				'Wrap your component tree with <OrgProvider client={orgClient}>.',
+		)
+	}
+	return ctx
+}
+
+function useOrgSnapshot(session: OrgSession): OrgSnapshot {
+	const snapshotRef = useRef(session.getSnapshot())
+
+	const subscribe = useCallback(
+		(onStoreChange: () => void): (() => void) => {
+			return session.subscribe(() => {
+				snapshotRef.current = session.getSnapshot()
+				onStoreChange()
+			})
+		},
+		[session],
+	)
+
+	const getSnapshot = useCallback(() => snapshotRef.current, [])
+
+	return useSyncExternalStore(subscribe, getSnapshot)
+}
+
+export interface UseOrgResult {
+	org: ClientOrganization | null
+	role: string | null
+	orgId: string | null
+	switchOrg: (orgId: string) => Promise<void>
+	createOrg: (params: { name: string; slug?: string }) => Promise<ClientOrganization>
+	leaveOrg: () => Promise<void>
+	clearOrg: () => void
+	listOrgs: () => Promise<ClientOrganization[]>
+	error: string | null
+}
+
+export function useOrg(): UseOrgResult {
+	const { client, session } = useOrgContext()
+	const { orgId, org, role } = useOrgSnapshot(session)
+	const [error, setError] = useState<string | null>(null)
+
+	const switchOrg = useCallback(
+		async (newOrgId: string): Promise<void> => {
+			setError(null)
+			try {
+				await client.switchOrg(newOrgId)
+			} catch (err) {
+				setError(err instanceof Error ? err.message : String(err))
+			}
+		},
+		[client],
+	)
+
+	const createOrg = useCallback(
+		async (params: { name: string; slug?: string }): Promise<ClientOrganization> => {
+			setError(null)
+			try {
+				return await client.createOrg(params)
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err)
+				setError(msg)
+				throw err
+			}
+		},
+		[client],
+	)
+
+	const leaveOrg = useCallback(async (): Promise<void> => {
+		if (!orgId) return
+		setError(null)
+		try {
+			await client.leaveOrg(orgId)
+		} catch (err) {
+			setError(err instanceof Error ? err.message : String(err))
+		}
+	}, [client, orgId])
+
+	const clearOrg = useCallback((): void => {
+		client.clearActiveOrg()
+	}, [client])
+
+	const listOrgs = useCallback(async (): Promise<ClientOrganization[]> => {
+		try {
+			return await client.listOrgs()
+		} catch (err) {
+			setError(err instanceof Error ? err.message : String(err))
+			return []
+		}
+	}, [client])
+
+	return { org, role, orgId, switchOrg, createOrg, leaveOrg, clearOrg, listOrgs, error }
+}
+
+export interface UseOrgMembersResult {
+	members: ClientMembership[]
+	isLoading: boolean
+	refresh: () => Promise<void>
+	invite: (email: string, role: string) => Promise<ClientInvitation>
+	removeMember: (userId: string) => Promise<void>
+	updateRole: (userId: string, role: string) => Promise<void>
+	error: string | null
+}
+
+export function useOrgMembers(orgId: string): UseOrgMembersResult {
+	const { client } = useOrgContext()
+	const [members, setMembers] = useState<ClientMembership[]>([])
+	const [isLoading, setIsLoading] = useState(true)
+	const [error, setError] = useState<string | null>(null)
+
+	const refresh = useCallback(async () => {
+		setIsLoading(true)
+		setError(null)
+		try {
+			setMembers(await loadOrgMembers(client, orgId))
+		} catch (err) {
+			setError(err instanceof Error ? err.message : String(err))
+		} finally {
+			setIsLoading(false)
+		}
+	}, [client, orgId])
+
+	useEffect(() => {
+		void refresh()
+	}, [refresh])
+
+	const actions = createOrgMembersActions(client, orgId, setError)
+
+	const invite = useCallback(
+		async (email: string, role: string): Promise<ClientInvitation> => {
+			const result = await actions.invite(email, role)
+			await refresh()
+			return result
+		},
+		[actions, refresh],
+	)
+
+	const removeMember = useCallback(
+		async (userId: string): Promise<void> => {
+			await actions.removeMember(userId)
+			await refresh()
+		},
+		[actions, refresh],
+	)
+
+	const updateRole = useCallback(
+		async (userId: string, role: string): Promise<void> => {
+			await actions.updateRole(userId, role)
+			await refresh()
+		},
+		[actions, refresh],
+	)
+
+	return { members, isLoading, refresh, invite, removeMember, updateRole, error }
+}
+
+export function usePermission(requiredRole: string): boolean {
+	const { session } = useOrgContext()
+	const snapshotRef = useRef(session.checkPermission(requiredRole))
+
+	const subscribe = useCallback(
+		(onStoreChange: () => void): (() => void) => {
+			return session.subscribe(() => {
+				const next = session.checkPermission(requiredRole)
+				if (next !== snapshotRef.current) {
+					snapshotRef.current = next
+					onStoreChange()
+				}
+			})
+		},
+		[session, requiredRole],
+	)
+
+	const getSnapshot = useCallback(() => snapshotRef.current, [])
+
+	return useSyncExternalStore(subscribe, getSnapshot)
+}
+
+export { checkOrgPermission }

package/src/react.ts

@@ -0,0 +1,26 @@
+// @korajs/auth/react — React-specific public API
+// Every export here is a public API commitment. Be explicit.
+
+// === Provider ===
+export { AuthProvider } from './react/AuthProvider'
+export type { AuthProviderProps } from './react/AuthProvider'
+
+// === Hooks ===
+export { useAuth, useCurrentUser, useAuthStatus } from './react/hooks'
+export type { UseAuthResult, AuthStatus } from './react/hooks'
+
+// === Context (for advanced use cases) ===
+export { AuthContext } from './react/auth-context'
+export type { AuthContextValue } from './react/auth-context'
+
+// === Organization Hooks ===
+export { OrgProvider } from './react/OrgProvider'
+export type { OrgProviderProps } from './react/OrgProvider'
+export {
+	OrgContext,
+	useOrg,
+	useOrgMembers,
+	usePermission,
+	checkOrgPermission,
+} from './react/org-hooks'
+export type { OrgContextValue, UseOrgResult, UseOrgMembersResult } from './react/org-hooks'

package/src/server.ts

@@ -0,0 +1,334 @@
+// @korajs/auth/server — Server-side public API
+// Every export here is a public API commitment. Be explicit.
+
+// === Auth Routes (built-in email/password provider) ===
+export {
+	BuiltInAuthRoutes,
+	InMemoryChallengeStore,
+	InMemoryRateLimiter,
+} from './provider/built-in/auth-routes'
+export type {
+	AuthenticatedAccess,
+	AuthRevocationEvent,
+	MfaChallenge,
+	MfaVerifier,
+	SignInResult,
+	AuthRoutesConfig,
+	AuthRouteResponse,
+	ChallengeStore,
+	RateLimiter,
+} from './provider/built-in/auth-routes'
+export {
+	createKoraAuthServer,
+	InMemoryAuthStoreError,
+} from './provider/built-in/quickstart-server'
+export type {
+	CreateKoraAuthServerOptions,
+	KoraAuthHttpRequest,
+	KoraAuthServer,
+	OAuthServerConfig,
+	SyncSessionTerminator,
+} from './provider/built-in/quickstart-server'
+export type {
+	SyncAuthContext,
+	SyncAuthProvider,
+	SyncScopeOptions,
+	VerifiedSyncClaims,
+} from './provider/built-in/sync-scopes'
+
+// === Token Manager ===
+export {
+	DEFAULT_REFRESH_REUSE_GRACE_MS,
+	InMemoryTokenRevocationStore,
+	TokenManager,
+} from './tokens/token-manager'
+export type {
+	ConsumeResult,
+	MfaPendingPayload,
+	IssueTokenOptions,
+	RefreshFailureReason,
+	RefreshResult,
+	TokenManagerConfig,
+	TokenRevocationStore,
+} from './tokens/token-manager'
+export { SqliteTokenRevocationStore } from './tokens/sqlite-token-revocation-store'
+export type { SqliteRevocationDatabase } from './tokens/sqlite-token-revocation-store'
+export { PostgresTokenRevocationStore } from './tokens/postgres-token-revocation-store'
+export type { PostgresRevocationClient } from './tokens/postgres-token-revocation-store'
+
+// === JWT Utilities ===
+export { encodeJwt, decodeJwt, verifyJwt, isExpired } from './tokens/jwt'
+
+// === Password Hashing ===
+export { hashPassword, verifyPassword } from './provider/built-in/password-hash'
+
+// === Password Reset ===
+export {
+	PasswordResetManager,
+	InMemoryPasswordResetStore,
+	PasswordResetError,
+	ResetTokenExpiredError,
+	ResetTokenNotFoundError,
+	ResetRateLimitedError,
+} from './provider/built-in/password-reset'
+export type {
+	PasswordResetToken,
+	PasswordResetStore,
+	PasswordResetConfig,
+} from './provider/built-in/password-reset'
+
+// === Email Verification ===
+export {
+	EmailVerificationManager,
+	InMemoryEmailVerificationStore,
+	EmailVerificationError,
+	VerificationTokenExpiredError,
+	VerificationTokenNotFoundError,
+} from './provider/built-in/email-verification'
+export type {
+	EmailVerificationToken,
+	EmailVerificationStore,
+	EmailVerificationConfig,
+} from './provider/built-in/email-verification'
+
+// === User Store ===
+export {
+	InMemoryUserStore,
+	DeviceOwnershipError,
+	DuplicateEmailError,
+} from './provider/built-in/user-store'
+export type { UserStore, AuthUser, StoredUser, AuthDevice } from './provider/built-in/user-store'
+
+// === SQLite User Store ===
+export { SqliteUserStore, createSqliteUserStore } from './provider/built-in/sqlite-user-store'
+
+// === PostgreSQL User Store ===
+export { PostgresUserStore, createPostgresUserStore } from './provider/built-in/postgres-user-store'
+
+// === Provider Adapter ===
+export { BuiltInProvider, AuthProviderError } from './provider/adapter'
+export type { AuthProviderAdapter, SignUpParams, SignInParams } from './provider/adapter'
+
+// === External Auth Provider Adapters ===
+export {
+	ExternalJwtProvider,
+	ExternalAuthOperationNotSupportedError,
+	ExternalTokenValidationError,
+} from './provider/external/external-jwt-provider'
+export type {
+	ExternalJwtProviderConfig,
+	ExternalUserInfo,
+} from './provider/external/external-jwt-provider'
+
+export { createClerkAdapter } from './provider/external/clerk-adapter'
+export type { ClerkAdapterConfig } from './provider/external/clerk-adapter'
+
+export { createSupabaseAdapter } from './provider/external/supabase-adapter'
+export type { SupabaseAdapterConfig } from './provider/external/supabase-adapter'
+
+// === Passkey / WebAuthn (server-side verification) ===
+export {
+	generateRegistrationOptions,
+	verifyRegistrationResponse,
+	generateAuthenticationOptions,
+	verifyAuthenticationResponse,
+	PasskeyVerificationError,
+} from './passkey/passkey-server'
+export type {
+	RegistrationOptions,
+	RegistrationVerificationResult,
+	AuthenticationOptions,
+	AuthenticationVerificationResult,
+} from './passkey/passkey-server'
+
+// === E2E Operation Encryption (server-side: detect encrypted fields) ===
+export {
+	OperationEncryptor,
+	OperationEncryptionError,
+	isEncryptedField,
+} from './encryption/operation-encryptor'
+export type { OperationEncryptorConfig } from './encryption/operation-encryptor'
+
+// === Organizations & Memberships ===
+export { OrgRoutes } from './org/org-routes'
+export type { OrgRouteResponse, OrgRoutesConfig } from './org/org-routes'
+export { InMemoryOrgStore } from './org/org-store'
+export type { OrgStore } from './org/org-store'
+export {
+	OrgError,
+	OrgNotFoundError,
+	OrgSlugTakenError,
+	MembershipNotFoundError,
+	MemberAlreadyExistsError,
+	InsufficientRoleError,
+	CannotRemoveOwnerError,
+	InvitationNotFoundError,
+	InvitationExpiredError,
+	hasRoleLevel,
+	ROLE_HIERARCHY,
+	ORG_ROLES,
+	INVITATION_STATUSES,
+} from './org/org-types'
+export type {
+	Organization,
+	CreateOrgParams,
+	UpdateOrgParams,
+	Membership,
+	OrgRole,
+	OrgInvitation,
+	CreateInvitationParams,
+	InvitationStatus,
+} from './org/org-types'
+
+// === RBAC (Role-Based Access Control) ===
+export { RbacEngine, defineRoles } from './rbac/rbac-engine'
+export {
+	BUILT_IN_ROLES,
+	parsePermission,
+	permissionCovers,
+	RbacError,
+	InvalidPermissionError,
+	RoleNotFoundError,
+	CircularInheritanceError,
+} from './rbac/rbac-types'
+export type {
+	Permission,
+	RoleDefinition,
+	RbacConfig,
+	SyncScopes,
+	ScopeFilter,
+	ScopeContext,
+	CollectionScopeResolver,
+} from './rbac/rbac-types'
+
+// === Org Scope Resolver ===
+export { OrgScopeResolver } from './rbac/scope-resolver'
+
+// === OAuth / Social Login ===
+export {
+	OAuthManager,
+	InMemoryOAuthStateStore,
+	googleProvider,
+	githubProvider,
+	microsoftProvider,
+} from './provider/oauth/oauth-flow'
+export type { OAuthManagerConfig } from './provider/oauth/oauth-flow'
+export {
+	DuplicateLinkedIdentityError,
+	InMemoryLinkedIdentityStore,
+} from './provider/oauth/linked-identity-store'
+export type { LinkedIdentityStore } from './provider/oauth/linked-identity-store'
+export {
+	SqliteLinkedIdentityStore,
+	SqliteOAuthStateStore,
+	createSqliteLinkedIdentityStore,
+	createSqliteOAuthStateStore,
+	createSqliteOAuthStores,
+} from './provider/oauth/sqlite-oauth-store'
+export {
+	PostgresLinkedIdentityStore,
+	PostgresOAuthStateStore,
+	createPostgresLinkedIdentityStore,
+	createPostgresOAuthStateStore,
+	createPostgresOAuthStores,
+} from './provider/oauth/postgres-oauth-store'
+export {
+	OAuthError,
+	OAuthStateMismatchError,
+	OAuthCodeExchangeError,
+	OAuthUserInfoError,
+	OAuthProviderNotFoundError,
+} from './provider/oauth/oauth-types'
+export type {
+	OAuthProviderConfig,
+	OAuthTokens,
+	OAuthUserInfo,
+	OAuthState,
+	OAuthStateStore,
+	LinkedIdentity,
+} from './provider/oauth/oauth-types'
+
+// === Session Management ===
+export {
+	SessionManager,
+	InMemorySessionStore,
+	SessionError,
+	SessionNotFoundError,
+	SessionExpiredError,
+	SessionLimitExceededError,
+	SessionMfaRequiredError,
+} from './session/session'
+export type {
+	Session,
+	SessionManagerConfig,
+	CreateSessionParams,
+	SessionStore,
+} from './session/session'
+
+// === TOTP MFA ===
+export {
+	TotpManager,
+	InMemoryTotpStore,
+	base32Encode,
+	base32Decode,
+	TotpError,
+	TotpInvalidCodeError,
+	TotpLockedError,
+	TotpNotEnabledError,
+	TotpAlreadyEnabledError,
+	TotpNotVerifiedError,
+	TotpRecoveryExhaustedError,
+} from './mfa/totp'
+export type {
+	TotpConfig,
+	TotpSecret,
+	TotpSetupResult,
+	TotpStore,
+} from './mfa/totp'
+
+// === Admin API ===
+export {
+	AdminApi,
+	AdminApiError,
+	AdminUserNotFoundError,
+	AdminUnauthorizedError,
+} from './admin/admin-api'
+export type {
+	AdminApiConfig,
+	PaginatedResult,
+	UserListQuery,
+	AdminUserUpdate,
+} from './admin/admin-api'
+
+// === Audit Logging ===
+export {
+	AuditLogger,
+	InMemoryAuditLogStore,
+	AuditLogError,
+} from './admin/audit-log'
+export type {
+	AuditAction,
+	AuditEntry,
+	AuditLogQuery,
+	AuditLogStore,
+} from './admin/audit-log'
+
+// === Webhooks ===
+export {
+	WebhookManager,
+	InMemoryWebhookStore,
+	verifyWebhookSignature,
+	WebhookError,
+	WebhookEndpointNotFoundError,
+	WebhookTargetError,
+} from './admin/webhooks'
+export type {
+	WebhookEvent,
+	WebhookEndpoint,
+	WebhookDelivery,
+	WebhookPayload,
+	WebhookStore,
+} from './admin/webhooks'
+
+// === Device Identity (verification on server) ===
+export { verifyChallenge, computePublicKeyThumbprint } from './device/device-identity'