@kurdel/auth 0.1.0-beta.2 → 0.1.0-beta.4

package/README.md

@@ -97,7 +97,9 @@ expressed by roles alone. Register them alongside strategies:
 
 ```ts
 const auth = new AuthModule({
-  strategies: [/* ... */],
+  strategies: [
+    /* ... */
+  ],
   policies: [
     {
       name: 'manage-users',
@@ -126,14 +128,43 @@ route({
 ```
 
 A policy receives the complete `AuthContext` and current `HttpContext`, and may
-return a boolean or a promise. When several policies are listed, every policy
-must grant access. Policies and `roles` may be combined; both checks must then
-succeed. A rejected policy returns `403 Forbidden`, while an unknown policy is
-reported as an application configuration error.
+return a boolean, an `AuthorizationDecision`, or a promise. Decisions can carry
+a safe reason code that is included in authorization-denied events. When
+several policies are listed, every policy must grant access. Policies and
+`roles` may be combined; both checks must then succeed. A rejected policy
+returns `403 Forbidden`, while an unknown policy is reported as an application
+configuration error.
 
 Policy providers also support `useFactory`, allowing policies to resolve
 application services from the dependency container.
 
+For role-permission models, strategies may resolve `AuthUser.permissions` and
+policies can use the built-in helpers:
+
+```ts
+import { allOf, anyOf, permissionPolicy } from '@kurdel/auth';
+
+const apiKeyOnly = {
+  authorize: auth => auth.credential?.type === 'api-key'
+    ? { allowed: true }
+    : { allowed: false, reason: 'api-key-required' },
+};
+const ownsRequestedUser = {
+  authorize: (auth, ctx) => String(auth.user.id) === ctx.params.id
+    ? { allowed: true }
+    : { allowed: false, reason: 'self-access-required' },
+};
+
+const manageUsers = allOf(apiKeyOnly, permissionPolicy('users.manage'));
+const viewUser = anyOf(permissionPolicy('users.view.any'), ownsRequestedUser);
+```
+
+Permissions express reusable capabilities, while policies remain executable
+rules that may also inspect the request, credential, or target resource.
+`allOf`, `anyOf`, and `not` compose policies and short-circuit evaluation while
+preserving a nested denial reason for diagnostics. Boolean policies remain
+fully supported.
+
 ## Security events
 
 Configure an event sink to observe sanitized authentication and authorization
@@ -144,14 +175,17 @@ new AuthModule({
   events: {
     useFactory: ioc => ioc.get(APP_TOKENS.AuthEventSink),
   },
-  strategies: [/* ... */],
+  strategies: [
+    /* ... */
+  ],
 });
 ```
 
 The package reports successful and failed authentication plus authorization
 denials. API-key management services may additionally report credential issue
 and revocation events. Events contain timestamps, strategy names, user and
-credential identifiers, safe reason codes, and policy names. Raw API keys,
+credential identifiers, safe reason codes, policy names, and optional policy
+decision reasons. Raw API keys,
 JWTs, credential hashes, headers, and request bodies are never part of the
 event contract.
 
@@ -177,7 +211,8 @@ interface AuthContext {
 }
 ```
 
-- `user` is the current application identity and its current roles.
+- `user` is the current application identity, its current roles, and optional
+  resolved permissions.
 - `strategy` is the registered name selected by route metadata.
 - `credential` identifies the credential kind and, when available, its stable
   identifier. It never contains the raw API key or JWT.
@@ -191,6 +226,19 @@ the repository credential ID when one exists. The JWT strategy exposes
 `credential.type` as `jwt`, uses the `jti` claim as its optional ID, and places
 the verified payload in `claims`.
 
+To make JWTs revocable before their cryptographic expiration, configure a
+`JwtSessionRepository` on the strategy. Session-backed JWTs must contain a
+`jti`; authentication then verifies that the referenced session exists, belongs
+to the token subject, has not been revoked, and has not expired:
+
+```ts
+new JwtStrategy(jwtService, users, {
+  sessions: jwtSessions,
+});
+```
+
+Without `sessions`, JWT verification remains stateless and backward compatible.
+
 ## User and credential repositories
 
 Authentication strategies do not own user data. Both built-in strategies load
@@ -213,6 +261,13 @@ credentials with stable IDs. The strategy records usage only after the key is
 accepted and its current user is resolved; rejected, expired, revoked, and
 orphaned credentials are never recorded.
 
+Password login is composed from `PasswordAuthenticationService`, a
+`PasswordCredentialRepository`, and a `PasswordHasher`. The built-in
+`ScryptPasswordHasher` stores a random salt and its work parameters in a
+self-describing encoded value. The service returns the current `AuthUser` only
+after both the password and user state have been verified; unknown logins and
+invalid passwords both return `null`.
+
 For database-backed implementations, use `@kurdel/auth-db`. Applications may
 also implement these interfaces for another database, an external identity
 service, or an in-memory test setup.

package/lib/domain/auth-event.d.ts

@@ -16,8 +16,11 @@ export type AuthEvent = (AuthEventBase & {
     strategy?: string;
     reason: 'missing-role' | 'missing-authentication' | 'policy-rejected';
     policy?: string;
+    decisionReason?: string;
 }) | (AuthEventBase & {
     type: 'api-key.issued' | 'api-key.revoked';
+}) | (AuthEventBase & {
+    type: 'jwt-session.created' | 'jwt-session.revoked';
 });
 /** Receives sanitized authentication and authorization lifecycle events. */
 export interface AuthEventSink {

package/lib/domain/auth-event.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-event.js","sourceRoot":"","sources":["../../src/domain/auth-event.ts"],"names":[],"mappings":"AAiCA,gFAAgF;AAChF,MAAM,OAAO,iBAAiB;IAC5B,MAAM,CAAC,MAAiB,IAAS,CAAC;CACnC"}
+{"version":3,"file":"auth-event.js","sourceRoot":"","sources":["../../src/domain/auth-event.ts"],"names":[],"mappings":"AAqCA,gFAAgF;AAChF,MAAM,OAAO,iBAAiB;IAC5B,MAAM,CAAC,MAAiB,IAAS,CAAC;CACnC"}

package/lib/domain/authorization-policy-composition.d.ts

@@ -0,0 +1,7 @@
+import { type AuthorizationPolicy } from './authorization-policy.js';
+/** Grants access only when every nested policy grants access. */
+export declare function allOf(...policies: AuthorizationPolicy[]): AuthorizationPolicy;
+/** Grants access when at least one nested policy grants access. */
+export declare function anyOf(...policies: AuthorizationPolicy[]): AuthorizationPolicy;
+/** Inverts a nested policy and uses the supplied reason when inversion denies access. */
+export declare function not(policy: AuthorizationPolicy, reason?: string): AuthorizationPolicy;

package/lib/domain/authorization-policy-composition.js

@@ -0,0 +1,45 @@
+import { authorizationDecision, } from './authorization-policy.js';
+async function evaluate(policy, auth, ctx) {
+    return authorizationDecision(await policy.authorize(auth, ctx));
+}
+/** Grants access only when every nested policy grants access. */
+export function allOf(...policies) {
+    return {
+        async authorize(auth, ctx) {
+            for (const policy of policies) {
+                const decision = await evaluate(policy, auth, ctx);
+                if (!decision.allowed)
+                    return decision;
+            }
+            return { allowed: true };
+        },
+    };
+}
+/** Grants access when at least one nested policy grants access. */
+export function anyOf(...policies) {
+    return {
+        async authorize(auth, ctx) {
+            let denied = { allowed: false };
+            for (const policy of policies) {
+                const decision = await evaluate(policy, auth, ctx);
+                if (decision.allowed)
+                    return decision;
+                if (decision.reason)
+                    denied = decision;
+            }
+            return denied;
+        },
+    };
+}
+/** Inverts a nested policy and uses the supplied reason when inversion denies access. */
+export function not(policy, reason) {
+    return {
+        async authorize(auth, ctx) {
+            const decision = await evaluate(policy, auth, ctx);
+            return decision.allowed
+                ? { allowed: false, ...(reason ? { reason } : {}) }
+                : { allowed: true };
+        },
+    };
+}
+//# sourceMappingURL=authorization-policy-composition.js.map

package/lib/domain/authorization-policy-composition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-policy-composition.js","sourceRoot":"","sources":["../../src/domain/authorization-policy-composition.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,qBAAqB,GAGtB,MAAM,2BAA2B,CAAC;AAEnC,KAAK,UAAU,QAAQ,CACrB,MAA2B,EAC3B,IAA2B,EAC3B,GAAgB;IAEhB,OAAO,qBAAqB,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,KAAK,CAAC,GAAG,QAA+B;IACtD,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG;YACvB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBACnD,IAAI,CAAC,QAAQ,CAAC,OAAO;oBAAE,OAAO,QAAQ,CAAC;YACzC,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,KAAK,CAAC,GAAG,QAA+B;IACtD,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG;YACvB,IAAI,MAAM,GAA0B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACvD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBACnD,IAAI,QAAQ,CAAC,OAAO;oBAAE,OAAO,QAAQ,CAAC;gBACtC,IAAI,QAAQ,CAAC,MAAM;oBAAE,MAAM,GAAG,QAAQ,CAAC;YACzC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,GAAG,CAAC,MAA2B,EAAE,MAAe;IAC9D,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG;YACvB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACnD,OAAO,QAAQ,CAAC,OAAO;gBACrB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBACnD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/lib/domain/authorization-policy.d.ts

@@ -1,6 +1,14 @@
 import type { AuthContext } from '@kurdel/common';
 import type { HttpContext } from '@kurdel/core/http';
+export type AuthorizationDecision = {
+    allowed: boolean;
+    /** Safe, non-sensitive reason code suitable for authorization audit events. */
+    reason?: string;
+};
+export type AuthorizationPolicyResult = boolean | AuthorizationDecision;
 /** Performs an application-specific authorization check for a request. */
 export interface AuthorizationPolicy {
-    authorize(auth: Readonly<AuthContext>, ctx: HttpContext): boolean | Promise<boolean>;
+    authorize(auth: Readonly<AuthContext>, ctx: HttpContext): AuthorizationPolicyResult | Promise<AuthorizationPolicyResult>;
 }
+/** Converts a boolean-compatible policy result into a diagnostic decision. */
+export declare function authorizationDecision(result: AuthorizationPolicyResult): AuthorizationDecision;

package/lib/domain/authorization-policy.js

@@ -1,2 +1,5 @@
-export {};
+/** Converts a boolean-compatible policy result into a diagnostic decision. */
+export function authorizationDecision(result) {
+    return typeof result === 'boolean' ? { allowed: result } : result;
+}
 //# sourceMappingURL=authorization-policy.js.map

package/lib/domain/authorization-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-policy.js","sourceRoot":"","sources":["../../src/domain/authorization-policy.ts"],"names":[],"mappings":""}
+{"version":3,"file":"authorization-policy.js","sourceRoot":"","sources":["../../src/domain/authorization-policy.ts"],"names":[],"mappings":"AAmBA,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,MAAiC;IACrE,OAAO,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACpE,CAAC"}

package/lib/domain/index.d.ts

@@ -4,4 +4,6 @@ export * from './auth-event-sink-provider.js';
 export * from './auth-strategy-provider.js';
 export * from './auth-strategy.js';
 export * from './authorization-policy.js';
+export * from './authorization-policy-composition.js';
 export * from './authorization-policy-provider.js';
+export * from './permission.js';

package/lib/domain/index.js

@@ -4,5 +4,7 @@ export * from './auth-event-sink-provider.js';
 export * from './auth-strategy-provider.js';
 export * from './auth-strategy.js';
 export * from './authorization-policy.js';
+export * from './authorization-policy-composition.js';
 export * from './authorization-policy-provider.js';
+export * from './permission.js';
 //# sourceMappingURL=index.js.map

package/lib/domain/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/domain/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oCAAoC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/domain/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,iBAAiB,CAAC"}

package/lib/domain/permission.d.ts

@@ -0,0 +1,6 @@
+import type { AuthUser } from '@kurdel/common';
+import type { AuthorizationPolicy } from './authorization-policy.js';
+/** Returns whether an authenticated user has a resolved capability. */
+export declare function hasPermission(user: Readonly<AuthUser>, permission: string): boolean;
+/** Creates a policy that requires one resolved permission. */
+export declare function permissionPolicy(permission: string): AuthorizationPolicy;

package/lib/domain/permission.js

@@ -0,0 +1,13 @@
+/** Returns whether an authenticated user has a resolved capability. */
+export function hasPermission(user, permission) {
+    return user.permissions?.includes(permission) ?? false;
+}
+/** Creates a policy that requires one resolved permission. */
+export function permissionPolicy(permission) {
+    return {
+        authorize: auth => hasPermission(auth.user, permission)
+            ? { allowed: true }
+            : { allowed: false, reason: `missing-permission:${permission}` },
+    };
+}
+//# sourceMappingURL=permission.js.map

package/lib/domain/permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../../src/domain/permission.ts"],"names":[],"mappings":"AAIA,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,IAAwB,EAAE,UAAkB;IACxE,OAAO,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC;AACzD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;YACrD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;YACnB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,UAAU,EAAE,EAAE;KACnE,CAAC;AACJ,CAAC"}

package/lib/index.d.ts

@@ -1,5 +1,6 @@
 export * from './domain/index.js';
 export * from './infra/index.js';
+export * from './password/index.js';
 export * from './repositories/index.js';
 export * from './runtime/index.js';
 export * from './strategies/index.js';

package/lib/index.js

@@ -1,5 +1,6 @@
 export * from './domain/index.js';
 export * from './infra/index.js';
+export * from './password/index.js';
 export * from './repositories/index.js';
 export * from './runtime/index.js';
 export * from './strategies/index.js';

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAA;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAA;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,aAAa,CAAA"}

package/lib/password/index.d.ts

@@ -0,0 +1,3 @@
+export * from './password-authentication-service.js';
+export * from './password-hasher.js';
+export * from './scrypt-password-hasher.js';

package/lib/password/index.js

@@ -0,0 +1,4 @@
+export * from './password-authentication-service.js';
+export * from './password-hasher.js';
+export * from './scrypt-password-hasher.js';
+//# sourceMappingURL=index.js.map

package/lib/password/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/password/index.ts"],"names":[],"mappings":"AAAA,cAAc,sCAAsC,CAAC;AACrD,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC"}

package/lib/password/password-authentication-service.d.ts

@@ -0,0 +1,11 @@
+import type { AuthUser } from '@kurdel/common';
+import type { PasswordCredentialRepository } from '../repositories/password/index.js';
+import type { AuthUserRepository } from '../repositories/user/index.js';
+import type { PasswordHasher } from './password-hasher.js';
+export declare class PasswordAuthenticationService {
+    private readonly credentials;
+    private readonly users;
+    private readonly hasher;
+    constructor(credentials: PasswordCredentialRepository, users: AuthUserRepository, hasher: PasswordHasher);
+    authenticate(login: string, password: string): Promise<AuthUser | null>;
+}

package/lib/password/password-authentication-service.js

@@ -0,0 +1,19 @@
+export class PasswordAuthenticationService {
+    constructor(credentials, users, hasher) {
+        this.credentials = credentials;
+        this.users = users;
+        this.hasher = hasher;
+    }
+    async authenticate(login, password) {
+        const credential = await this.credentials.findByLogin(login);
+        if (!credential) {
+            // Keep the expensive password operation on the unknown-login path too.
+            await this.hasher.hash(password);
+            return null;
+        }
+        if (!(await this.hasher.verify(password, credential.passwordHash)))
+            return null;
+        return this.users.findById(credential.userId);
+    }
+}
+//# sourceMappingURL=password-authentication-service.js.map

package/lib/password/password-authentication-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-authentication-service.js","sourceRoot":"","sources":["../../src/password/password-authentication-service.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,6BAA6B;IACxC,YACmB,WAAyC,EACzC,KAAyB,EACzB,MAAsB;QAFtB,gBAAW,GAAX,WAAW,CAA8B;QACzC,UAAK,GAAL,KAAK,CAAoB;QACzB,WAAM,GAAN,MAAM,CAAgB;IACtC,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QAChD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,uEAAuE;YACvE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;CACF"}

package/lib/password/password-hasher.d.ts

@@ -0,0 +1,4 @@
+export interface PasswordHasher {
+    hash(password: string): Promise<string> | string;
+    verify(password: string, encodedHash: string): Promise<boolean> | boolean;
+}

package/lib/password/password-hasher.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=password-hasher.js.map

package/lib/password/password-hasher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hasher.js","sourceRoot":"","sources":["../../src/password/password-hasher.ts"],"names":[],"mappings":""}

package/lib/password/scrypt-password-hasher.d.ts

@@ -0,0 +1,21 @@
+import type { PasswordHasher } from './password-hasher.js';
+export interface ScryptPasswordHasherOptions {
+    cost?: number;
+    blockSize?: number;
+    parallelization?: number;
+    keyLength?: number;
+    saltLength?: number;
+}
+/** Password hasher with a self-describing format that supports future rehashing. */
+export declare class ScryptPasswordHasher implements PasswordHasher {
+    private readonly cost;
+    private readonly blockSize;
+    private readonly parallelization;
+    private readonly keyLength;
+    private readonly saltLength;
+    constructor(options?: ScryptPasswordHasherOptions);
+    hash(password: string): Promise<string>;
+    verify(password: string, encodedHash: string): Promise<boolean>;
+    private derive;
+    private validParameters;
+}

package/lib/password/scrypt-password-hasher.js

@@ -0,0 +1,66 @@
+import crypto from 'node:crypto';
+/** Password hasher with a self-describing format that supports future rehashing. */
+export class ScryptPasswordHasher {
+    constructor(options = {}) {
+        this.cost = options.cost ?? 16384;
+        this.blockSize = options.blockSize ?? 8;
+        this.parallelization = options.parallelization ?? 1;
+        this.keyLength = options.keyLength ?? 64;
+        this.saltLength = options.saltLength ?? 16;
+    }
+    async hash(password) {
+        const salt = crypto.randomBytes(this.saltLength);
+        const derived = await this.derive(password, salt, this.cost, this.blockSize, this.parallelization, this.keyLength);
+        return [
+            'scrypt',
+            this.cost,
+            this.blockSize,
+            this.parallelization,
+            salt.toString('base64url'),
+            derived.toString('base64url'),
+        ].join('$');
+    }
+    async verify(password, encodedHash) {
+        const parts = encodedHash.split('$');
+        if (parts.length !== 6 || parts[0] !== 'scrypt')
+            return false;
+        const [cost, blockSize, parallelization] = parts.slice(1, 4).map(Number);
+        const salt = Buffer.from(parts[4], 'base64url');
+        const expected = Buffer.from(parts[5], 'base64url');
+        if (!this.validParameters(cost, blockSize, parallelization, salt, expected))
+            return false;
+        try {
+            const actual = await this.derive(password, salt, cost, blockSize, parallelization, expected.length);
+            return crypto.timingSafeEqual(actual, expected);
+        }
+        catch {
+            return false;
+        }
+    }
+    async derive(password, salt, cost, blockSize, parallelization, keyLength) {
+        return new Promise((resolve, reject) => {
+            crypto.scrypt(password, salt, keyLength, {
+                N: cost,
+                r: blockSize,
+                p: parallelization,
+                maxmem: Math.max(32 * 1024 * 1024, 256 * cost * blockSize),
+            }, (error, derivedKey) => (error ? reject(error) : resolve(derivedKey)));
+        });
+    }
+    validParameters(cost, blockSize, parallelization, salt, hash) {
+        return (Number.isInteger(cost) &&
+            cost >= 1024 &&
+            cost <= 1048576 &&
+            Number.isInteger(blockSize) &&
+            blockSize >= 1 &&
+            blockSize <= 32 &&
+            Number.isInteger(parallelization) &&
+            parallelization >= 1 &&
+            parallelization <= 16 &&
+            salt.length >= 8 &&
+            salt.length <= 64 &&
+            hash.length >= 32 &&
+            hash.length <= 128);
+    }
+}
+//# sourceMappingURL=scrypt-password-hasher.js.map

package/lib/password/scrypt-password-hasher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrypt-password-hasher.js","sourceRoot":"","sources":["../../src/password/scrypt-password-hasher.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAYjC,oFAAoF;AACpF,MAAM,OAAO,oBAAoB;IAO/B,YAAY,UAAuC,EAAE;QACnD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAM,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAC/B,QAAQ,EACR,IAAI,EACJ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,SAAS,CACf,CAAC;QACF,OAAO;YACL,QAAQ;YACR,IAAI,CAAC,IAAI;YACT,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,eAAe;YACpB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC9B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,WAAmB;QAChD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,SAAS,EACT,eAAe,EACf,QAAQ,CAAC,MAAM,CAChB,CAAC;YACF,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,QAAgB,EAChB,IAAY,EACZ,IAAY,EACZ,SAAiB,EACjB,eAAuB,EACvB,SAAiB;QAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,CAAC,MAAM,CACX,QAAQ,EACR,IAAI,EACJ,SAAS,EACT;gBACE,CAAC,EAAE,IAAI;gBACP,CAAC,EAAE,SAAS;gBACZ,CAAC,EAAE,eAAe;gBAClB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,GAAG,SAAS,CAAC;aAC3D,EACD,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CACrE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CACrB,IAAY,EACZ,SAAiB,EACjB,eAAuB,EACvB,IAAY,EACZ,IAAY;QAEZ,OAAO,CACL,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;YACtB,IAAI,IAAI,IAAI;YACZ,IAAI,IAAI,OAAS;YACjB,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC;YAC3B,SAAS,IAAI,CAAC;YACd,SAAS,IAAI,EAAE;YACf,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC;YACjC,eAAe,IAAI,CAAC;YACpB,eAAe,IAAI,EAAE;YACrB,IAAI,CAAC,MAAM,IAAI,CAAC;YAChB,IAAI,CAAC,MAAM,IAAI,EAAE;YACjB,IAAI,CAAC,MAAM,IAAI,EAAE;YACjB,IAAI,CAAC,MAAM,IAAI,GAAG,CACnB,CAAC;IACJ,CAAC;CACF"}

package/lib/repositories/index.d.ts

@@ -1,3 +1,4 @@
 export * from './api-key/index.js';
 export * from './jwt/index.js';
+export * from './password/index.js';
 export * from './user/index.js';

package/lib/repositories/index.js

@@ -1,4 +1,5 @@
 export * from './api-key/index.js';
 export * from './jwt/index.js';
+export * from './password/index.js';
 export * from './user/index.js';
 //# sourceMappingURL=index.js.map

package/lib/repositories/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/repositories/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/repositories/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC"}

package/lib/repositories/jwt/index.d.ts

@@ -1 +1,2 @@
 export * from './jwt-repository.js';
+export * from './jwt-session-repository.js';

package/lib/repositories/jwt/index.js

@@ -1,2 +1,3 @@
 export * from './jwt-repository.js';
+export * from './jwt-session-repository.js';
 //# sourceMappingURL=index.js.map

package/lib/repositories/jwt/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/repositories/jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/repositories/jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC"}

package/lib/repositories/jwt/jwt-session-repository.d.ts

@@ -0,0 +1,10 @@
+export type JwtSession = {
+    id: string;
+    userId: string | number;
+    revoked: boolean;
+    expiresAt?: Date;
+};
+/** Resolves server-side JWT session state used for token revocation. */
+export interface JwtSessionRepository {
+    findById(id: string): Promise<JwtSession | null>;
+}

package/lib/repositories/jwt/jwt-session-repository.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jwt-session-repository.js.map

package/lib/repositories/jwt/jwt-session-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-session-repository.js","sourceRoot":"","sources":["../../../src/repositories/jwt/jwt-session-repository.ts"],"names":[],"mappings":""}

package/lib/repositories/password/index.d.ts

@@ -0,0 +1 @@
+export * from './password-credential-repository.js';

package/lib/repositories/password/index.js

@@ -0,0 +1,2 @@
+export * from './password-credential-repository.js';
+//# sourceMappingURL=index.js.map

package/lib/repositories/password/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/repositories/password/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAC"}

package/lib/repositories/password/password-credential-repository.d.ts

@@ -0,0 +1,8 @@
+export interface PasswordCredential {
+    userId: string | number;
+    passwordHash: string;
+}
+/** Resolves a password credential by an application-defined login. */
+export interface PasswordCredentialRepository {
+    findByLogin(login: string): Promise<PasswordCredential | null> | PasswordCredential | null;
+}

package/lib/repositories/password/password-credential-repository.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=password-credential-repository.js.map

package/lib/repositories/password/password-credential-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-credential-repository.js","sourceRoot":"","sources":["../../../src/repositories/password/password-credential-repository.ts"],"names":[],"mappings":""}

package/lib/runtime/create-auth-middleware.js

@@ -1,4 +1,4 @@
-import { NoopAuthEventSink } from '../domain/index.js';
+import { authorizationDecision, NoopAuthEventSink, } from '../domain/index.js';
 import { AuthorizationPolicyRegistry } from './authorization-policy-registry.js';
 export function createAuthMiddleware(registry, policies = new AuthorizationPolicyRegistry(), events = new NoopAuthEventSink(), now = () => new Date()) {
     return async (ctx, next) => {
@@ -69,7 +69,8 @@ export function createAuthMiddleware(registry, policies = new AuthorizationPolic
                 if (!policy) {
                     return ctx.json(500, { error: `Unknown authorization policy '${name}'` });
                 }
-                if (!(await policy.authorize(auth, ctx))) {
+                const decision = authorizationDecision(await policy.authorize(auth, ctx));
+                if (!decision.allowed) {
                     await events.report({
                         type: 'authorization.denied',
                         occurredAt: now(),
@@ -78,6 +79,7 @@ export function createAuthMiddleware(registry, policies = new AuthorizationPolic
                         ...(auth.credential ? { credential: auth.credential } : {}),
                         reason: 'policy-rejected',
                         policy: name,
+                        ...(decision.reason ? { decisionReason: decision.reason } : {}),
                     });
                     return ctx.json(403, { error: 'Forbidden' });
                 }

package/lib/runtime/create-auth-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-auth-middleware.js","sourceRoot":"","sources":["../../src/runtime/create-auth-middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAwC,MAAM,qBAAqB,CAAC;AAG9F,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,UAAU,oBAAoB,CAClC,QAA8B,EAC9B,WAAwC,IAAI,2BAA2B,EAAE,EACzE,SAAwB,IAAI,iBAAiB,EAAE,EAC/C,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAElC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACzB,eAAe;YACf,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;QAE7D,2BAA2B;QAC3B,IAAI,IAA6B,CAAC;QAElC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,QAAQ,GAAG,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,MAAM,CAAC,MAAM,CAAC;oBAClB,IAAI,EAAE,uBAAuB;oBAC7B,UAAU,EAAE,GAAG,EAAE;oBACjB,QAAQ;oBACR,MAAM,EAAE,oBAAoB;iBAC7B,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAClD,CAAC;YAED,IAAI,GAAG;gBACL,GAAG,MAAM;gBACT,QAAQ;aACT,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACvB,MAAM,MAAM,CAAC,MAAM,CAAC;gBAClB,IAAI,EAAE,0BAA0B;gBAChC,UAAU,EAAE,GAAG,EAAE;gBACjB,QAAQ;gBACR,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBACpB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,wBAAwB;QACxB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC/C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC9C,CAAC,CAAC,KAAK,CAAC;YAEV,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,MAAM,CAAC,MAAM,CAAC;oBAClB,IAAI,EAAE,sBAAsB;oBAC5B,UAAU,EAAE,GAAG,EAAE;oBACjB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,MAAM,EAAE,cAAc;iBACvB,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,MAAM,CAAC,MAAM,CAAC;oBAClB,IAAI,EAAE,sBAAsB;oBAC5B,UAAU,EAAE,GAAG,EAAE;oBACjB,MAAM,EAAE,wBAAwB;iBACjC,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/C,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC5E,CAAC;gBAED,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;oBACzC,MAAM,MAAM,CAAC,MAAM,CAAC;wBAClB,IAAI,EAAE,sBAAsB;wBAC5B,UAAU,EAAE,GAAG,EAAE;wBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;wBACpB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC3D,MAAM,EAAE,iBAAiB;wBACzB,MAAM,EAAE,IAAI;qBACb,CAAC,CAAC;oBACH,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"create-auth-middleware.js","sourceRoot":"","sources":["../../src/runtime/create-auth-middleware.ts"],"names":[],"mappings":"AACA,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,UAAU,oBAAoB,CAClC,QAA8B,EAC9B,WAAwC,IAAI,2BAA2B,EAAE,EACzE,SAAwB,IAAI,iBAAiB,EAAE,EAC/C,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAElC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACzB,eAAe;YACf,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;QAE7D,2BAA2B;QAC3B,IAAI,IAA6B,CAAC;QAElC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,QAAQ,GAAG,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,MAAM,CAAC,MAAM,CAAC;oBAClB,IAAI,EAAE,uBAAuB;oBAC7B,UAAU,EAAE,GAAG,EAAE;oBACjB,QAAQ;oBACR,MAAM,EAAE,oBAAoB;iBAC7B,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAClD,CAAC;YAED,IAAI,GAAG;gBACL,GAAG,MAAM;gBACT,QAAQ;aACT,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACvB,MAAM,MAAM,CAAC,MAAM,CAAC;gBAClB,IAAI,EAAE,0BAA0B;gBAChC,UAAU,EAAE,GAAG,EAAE;gBACjB,QAAQ;gBACR,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBACpB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,wBAAwB;QACxB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC/C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC9C,CAAC,CAAC,KAAK,CAAC;YAEV,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,MAAM,CAAC,MAAM,CAAC;oBAClB,IAAI,EAAE,sBAAsB;oBAC5B,UAAU,EAAE,GAAG,EAAE;oBACjB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,MAAM,EAAE,cAAc;iBACvB,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,MAAM,CAAC,MAAM,CAAC;oBAClB,IAAI,EAAE,sBAAsB;oBAC5B,UAAU,EAAE,GAAG,EAAE;oBACjB,MAAM,EAAE,wBAAwB;iBACjC,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/C,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC5E,CAAC;gBAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC1E,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,MAAM,MAAM,CAAC,MAAM,CAAC;wBAClB,IAAI,EAAE,sBAAsB;wBAC5B,UAAU,EAAE,GAAG,EAAE;wBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;wBACpB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC3D,MAAM,EAAE,iBAAiB;wBACzB,MAAM,EAAE,IAAI;wBACZ,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChE,CAAC,CAAC;oBACH,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/lib/strategies/jwt/jwt-strategy.d.ts

@@ -1,6 +1,6 @@
 import type { HttpRequest } from '@kurdel/common';
 import type { AuthenticationResult, AuthStrategy } from '../../domain/index.js';
-import type { AuthUserRepository } from '../../repositories/index.js';
+import type { AuthUserRepository, JwtSessionRepository } from '../../repositories/index.js';
 import type { JwtService } from '../../strategies/index.js';
 /**
  * ## JwtStrategyOptions
@@ -10,6 +10,8 @@ import type { JwtService } from '../../strategies/index.js';
 export interface JwtStrategyOptions {
     header?: string;
     prefix?: string;
+    /** When configured, every token must reference an active session through `jti`. */
+    sessions?: JwtSessionRepository;
 }
 /**
  * ## JwtStrategy
@@ -22,6 +24,7 @@ export declare class JwtStrategy implements AuthStrategy {
     private readonly users;
     private readonly header;
     private readonly prefix;
+    private readonly sessions?;
     constructor(service: JwtService, users: AuthUserRepository, opts?: JwtStrategyOptions);
     authenticate(req: HttpRequest): Promise<AuthenticationResult | null>;
 }

package/lib/strategies/jwt/jwt-strategy.js

@@ -10,6 +10,7 @@ export class JwtStrategy {
         this.users = users;
         this.header = (opts.header ?? 'authorization').toLowerCase();
         this.prefix = (opts.prefix ?? 'Bearer').toLowerCase();
+        this.sessions = opts.sessions;
     }
     async authenticate(req) {
         const raw = req.headers?.[this.header];
@@ -25,6 +26,19 @@ export class JwtStrategy {
             const payload = this.service.verify(token);
             if (!payload.sub)
                 return null;
+            if (this.sessions) {
+                if (typeof payload.jti !== 'string')
+                    return null;
+                const session = await this.sessions.findById(payload.jti);
+                if (!session || session.revoked || String(session.userId) !== String(payload.sub)) {
+                    return null;
+                }
+                if (session.expiresAt) {
+                    const expiresAt = session.expiresAt.getTime();
+                    if (!Number.isFinite(expiresAt) || expiresAt <= Date.now())
+                        return null;
+                }
+            }
             const user = await this.users.findById(payload.sub);
             if (!user)
                 return null;

package/lib/strategies/jwt/jwt-strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-strategy.js","sourceRoot":"","sources":["../../../src/strategies/jwt/jwt-strategy.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAItB,YACmB,OAAmB,EACnB,KAAyB,EAC1C,OAA2B,EAAE;QAFZ,YAAO,GAAP,OAAO,CAAY;QACnB,UAAK,GAAL,KAAK,CAAoB;QAG1C,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAgB;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAExD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAErD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE3C,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAE9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,OAAO;gBACL,IAAI;gBACJ,UAAU,EAAE;oBACV,IAAI,EAAE,KAAK;oBACX,GAAG,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;gBACD,MAAM,EAAE,OAAO;aAChB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"jwt-strategy.js","sourceRoot":"","sources":["../../../src/strategies/jwt/jwt-strategy.ts"],"names":[],"mappings":"AAkBA;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAKtB,YACmB,OAAmB,EACnB,KAAyB,EAC1C,OAA2B,EAAE;QAFZ,YAAO,GAAP,OAAO,CAAY;QACnB,UAAK,GAAL,KAAK,CAAoB;QAG1C,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAgB;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAExD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAErD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE3C,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAE9B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC1D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClF,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;oBACtB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;oBAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;wBAAE,OAAO,IAAI,CAAC;gBAC1E,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,OAAO;gBACL,IAAI;gBACJ,UAAU,EAAE;oBACV,IAAI,EAAE,KAAK;oBACX,GAAG,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;gBACD,MAAM,EAAE,OAAO;aAChB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/lib/tokens.d.ts

@@ -7,5 +7,8 @@ export declare const AUTH_TOKENS: {
     JwtRepository: symbol;
     ApiKeyRepository: symbol;
     ApiKeyUsageRecorder: symbol;
+    JwtSessionRepository: symbol;
+    PasswordCredentialRepository: symbol;
+    PasswordAuthenticationService: symbol;
     JwtService: symbol;
 };

package/lib/tokens.js

@@ -8,6 +8,9 @@ export const AUTH_TOKENS = {
     JwtRepository: UserRepository,
     ApiKeyRepository: Symbol('ApiKeyRepository'),
     ApiKeyUsageRecorder: Symbol('ApiKeyUsageRecorder'),
+    JwtSessionRepository: Symbol('JwtSessionRepository'),
+    PasswordCredentialRepository: Symbol('PasswordCredentialRepository'),
+    PasswordAuthenticationService: Symbol('PasswordAuthenticationService'),
     JwtService: Symbol('JwtService'),
 };
 //# sourceMappingURL=tokens.js.map

package/lib/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAEpD,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,gBAAgB,EAAE,MAAM,CAAC,sBAAsB,CAAC;IAChD,cAAc,EAAE,MAAM,CAAC,6BAA6B,CAAC;IACrD,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC;IAClC,cAAc;IACd,sCAAsC;IACtC,aAAa,EAAE,cAAc;IAC7B,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAC5C,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC;CACjC,CAAC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAEpD,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,gBAAgB,EAAE,MAAM,CAAC,sBAAsB,CAAC;IAChD,cAAc,EAAE,MAAM,CAAC,6BAA6B,CAAC;IACrD,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC;IAClC,cAAc;IACd,sCAAsC;IACtC,aAAa,EAAE,cAAc;IAC7B,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAC5C,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAClD,oBAAoB,EAAE,MAAM,CAAC,sBAAsB,CAAC;IACpD,4BAA4B,EAAE,MAAM,CAAC,8BAA8B,CAAC;IACpE,6BAA6B,EAAE,MAAM,CAAC,+BAA+B,CAAC;IACtE,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC;CACjC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kurdel/auth",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.0-beta.4",
   "description": "Authentication and authorization primitives for Kurdel applications",
   "type": "module",
   "exports": {
@@ -49,8 +49,8 @@
     "tsc-alias": "^1.8.16"
   },
   "dependencies": {
-    "@kurdel/common": "0.1.0-beta.2",
-    "@kurdel/core": "0.1.0-beta.2",
-    "@kurdel/ioc": "0.1.0-beta.2"
+    "@kurdel/common": "0.1.0-beta.4",
+    "@kurdel/core": "0.1.0-beta.4",
+    "@kurdel/ioc": "0.1.0-beta.4"
   }
 }