@kywi-software/core 0.1.0

package/dist/auth/__tests__/password-reset.test.js

@@ -0,0 +1,48 @@
+import { describe, it, expect } from 'vitest';
+import { generateResetToken, hashResetToken, verifyResetToken, getTokenExpiryDate, } from '../password-reset.js';
+describe('generateResetToken', () => {
+    it('returns a 64-character hex string', () => {
+        const token = generateResetToken();
+        expect(token).toMatch(/^[0-9a-f]{64}$/);
+    });
+    it('produces different tokens on successive calls', () => {
+        const token1 = generateResetToken();
+        const token2 = generateResetToken();
+        expect(token1).not.toBe(token2);
+    });
+});
+describe('hashResetToken', () => {
+    it('returns a 64-character hex string (SHA-256)', () => {
+        const token = generateResetToken();
+        const hash = hashResetToken(token);
+        expect(hash).toMatch(/^[0-9a-f]{64}$/);
+    });
+    it('is deterministic — same input produces same output', () => {
+        const token = generateResetToken();
+        expect(hashResetToken(token)).toBe(hashResetToken(token));
+    });
+});
+describe('verifyResetToken', () => {
+    it('returns true when the raw token matches the stored hash', () => {
+        const token = generateResetToken();
+        const hash = hashResetToken(token);
+        expect(verifyResetToken(token, hash)).toBe(true);
+    });
+    it('returns false when the raw token does not match the stored hash', () => {
+        const token = generateResetToken();
+        const hash = hashResetToken(token);
+        const differentToken = generateResetToken();
+        expect(verifyResetToken(differentToken, hash)).toBe(false);
+    });
+});
+describe('getTokenExpiryDate', () => {
+    it('returns a date approximately 1 hour from now', () => {
+        const before = Date.now();
+        const expiry = getTokenExpiryDate();
+        const after = Date.now();
+        const oneHourMs = 60 * 60 * 1000;
+        expect(expiry.getTime()).toBeGreaterThanOrEqual(before + oneHourMs);
+        expect(expiry.getTime()).toBeLessThanOrEqual(after + oneHourMs);
+    });
+});
+//# sourceMappingURL=password-reset.test.js.map

package/dist/auth/__tests__/password-reset.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/password-reset.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,sBAAsB,CAAA;AAE7B,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAA;QACnC,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAA;QACnC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAA;QAClC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,cAAc,GAAG,kBAAkB,EAAE,CAAA;QAC3C,MAAM,CAAC,gBAAgB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACzB,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAA;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAExB,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QAChC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,sBAAsB,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;QACnE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,mBAAmB,CAAC,KAAK,GAAG,SAAS,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/auth/__tests__/passwords.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=passwords.test.d.ts.map

package/dist/auth/__tests__/passwords.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwords.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/passwords.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/passwords.test.js

@@ -0,0 +1,31 @@
+import { describe, it, expect } from 'vitest';
+import { hashPassword, verifyPassword } from '../passwords.js';
+// bcryptjs is a pure-JS implementation at cost factor 12, so a single hash is
+// CPU-bound and takes hundreds of milliseconds. When the full suite runs with
+// many parallel workers all contending for the CPU, these operations can
+// briefly exceed the default 5s per-test timeout and flake. Give them a
+// generous budget so the timing is never the deciding factor — the assertions
+// themselves are unchanged.
+const BCRYPT_TIMEOUT_MS = 30_000;
+describe('hashPassword', () => {
+    it('returns a bcrypt hash string', async () => {
+        const hash = await hashPassword('mypassword');
+        expect(hash).toMatch(/^\$2[aby]\$/);
+    }, BCRYPT_TIMEOUT_MS);
+    it('produces different hashes for the same input (salted)', async () => {
+        const hash1 = await hashPassword('mypassword');
+        const hash2 = await hashPassword('mypassword');
+        expect(hash1).not.toBe(hash2);
+    }, BCRYPT_TIMEOUT_MS);
+});
+describe('verifyPassword', () => {
+    it('returns true for correct password', async () => {
+        const hash = await hashPassword('correct');
+        expect(await verifyPassword('correct', hash)).toBe(true);
+    }, BCRYPT_TIMEOUT_MS);
+    it('returns false for wrong password', async () => {
+        const hash = await hashPassword('correct');
+        expect(await verifyPassword('wrong', hash)).toBe(false);
+    }, BCRYPT_TIMEOUT_MS);
+});
+//# sourceMappingURL=passwords.test.js.map

package/dist/auth/__tests__/passwords.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwords.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/passwords.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAE9D,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,wEAAwE;AACxE,8EAA8E;AAC9E,4BAA4B;AAC5B,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAEhC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAA;QAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACrC,CAAC,EAAE,iBAAiB,CAAC,CAAA;IAErB,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAA;QAC9C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAA;QAC9C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC,EAAE,iBAAiB,CAAC,CAAA;AACvB,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAA;QAC1C,MAAM,CAAC,MAAM,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1D,CAAC,EAAE,iBAAiB,CAAC,CAAA;IAErB,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAA;QAC1C,MAAM,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzD,CAAC,EAAE,iBAAiB,CAAC,CAAA;AACvB,CAAC,CAAC,CAAA"}

package/dist/auth/__tests__/roles.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=roles.test.d.ts.map

package/dist/auth/__tests__/roles.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/roles.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/roles.test.js

@@ -0,0 +1,51 @@
+import { describe, it, expect } from 'vitest';
+import { KYWI_ROLES, hasMinRole, canAccessContent } from '../roles.js';
+describe('KYWI_ROLES', () => {
+    it('contains all 6 roles', () => {
+        expect(KYWI_ROLES).toContain('superAdmin');
+        expect(KYWI_ROLES).toContain('siteAdmin');
+        expect(KYWI_ROLES).toContain('editor');
+        expect(KYWI_ROLES).toContain('author');
+        expect(KYWI_ROLES).toContain('reader');
+        expect(KYWI_ROLES).toContain('deny');
+        expect(KYWI_ROLES).toHaveLength(6);
+    });
+});
+describe('hasMinRole', () => {
+    it('superAdmin meets reader requirement', () => {
+        expect(hasMinRole('superAdmin', 'reader')).toBe(true);
+    });
+    it('reader does not meet editor requirement', () => {
+        expect(hasMinRole('reader', 'editor')).toBe(false);
+    });
+    it('deny does not meet reader requirement', () => {
+        expect(hasMinRole('deny', 'reader')).toBe(false);
+    });
+});
+describe('canAccessContent', () => {
+    it('reader can read', () => {
+        expect(canAccessContent('reader', 'read')).toBe(true);
+    });
+    it('reader cannot write', () => {
+        expect(canAccessContent('reader', 'write')).toBe(false);
+    });
+    it('author can write', () => {
+        expect(canAccessContent('author', 'write')).toBe(true);
+    });
+    it('author cannot publish', () => {
+        expect(canAccessContent('author', 'publish')).toBe(false);
+    });
+    it('editor can publish', () => {
+        expect(canAccessContent('editor', 'publish')).toBe(true);
+    });
+    it('editor cannot delete', () => {
+        expect(canAccessContent('editor', 'delete')).toBe(false);
+    });
+    it('siteAdmin can delete', () => {
+        expect(canAccessContent('siteAdmin', 'delete')).toBe(true);
+    });
+    it('deny cannot read', () => {
+        expect(canAccessContent('deny', 'read')).toBe(false);
+    });
+});
+//# sourceMappingURL=roles.test.js.map

package/dist/auth/__tests__/roles.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/roles.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEtE,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QAC1C,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACzC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACpC,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE;QACzB,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC1B,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC1B,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/auth/__tests__/tokens.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tokens.test.d.ts.map

package/dist/auth/__tests__/tokens.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/tokens.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/tokens.test.js

@@ -0,0 +1,25 @@
+import { describe, it, expect } from 'vitest';
+import { jwtVerify } from 'jose';
+import { issueAccessToken, issueRefreshToken } from '../tokens.js';
+const SECRET = 'test-secret-key-that-is-long-enough';
+describe('issueAccessToken', () => {
+    it('returns a valid JWT with correct claims', async () => {
+        const token = await issueAccessToken({ id: 'user-1', role: 'editor', groups: ['editors'] }, SECRET);
+        const key = new TextEncoder().encode(SECRET);
+        const { payload } = await jwtVerify(token, key);
+        expect(payload.sub).toBe('user-1');
+        expect(payload['role']).toBe('editor');
+        expect(payload['groups']).toEqual(['editors']);
+        expect(payload['type']).toBe('access');
+    });
+});
+describe('issueRefreshToken', () => {
+    it('returns a valid JWT with correct claims', async () => {
+        const token = await issueRefreshToken('user-1', SECRET);
+        const key = new TextEncoder().encode(SECRET);
+        const { payload } = await jwtVerify(token, key);
+        expect(payload.sub).toBe('user-1');
+        expect(payload['type']).toBe('refresh');
+    });
+});
+//# sourceMappingURL=tokens.test.js.map

package/dist/auth/__tests__/tokens.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/tokens.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAElE,MAAM,MAAM,GAAG,qCAAqC,CAAA;AAEpD,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,EACrD,MAAM,CACP,CAAA;QAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAE/C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;QAC9C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAEvD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAE/C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/auth/access-control.d.ts

@@ -0,0 +1,43 @@
+import type { AccessControlConfig, FieldDefinition, UserContext } from '../config/types.js';
+import type { KywiDb } from '../db/client.js';
+type ContentAction = 'read' | 'write' | 'publish' | 'delete';
+/**
+ * Evaluate content type access control.
+ * If the access config defines a function for the action, call it.
+ * If no function is defined for the action, return true (fall through to role-based checks).
+ */
+export declare function checkContentAccess(access: AccessControlConfig | undefined, action: ContentAction, user: UserContext | null): boolean;
+/**
+ * Check document-level access for a specific content item.
+ *
+ * 1. SuperAdmin/SiteAdmin always have access
+ * 2. No document-level permissions = open access (allow)
+ * 3. Permissions exist + anonymous user = deny
+ * 4. Permissions exist + authenticated user = check for matching permission
+ */
+export declare function checkDocumentAccess(db: KywiDb, contentId: string, user: UserContext | null, action: ContentAction): Promise<boolean>;
+/**
+ * Document-level gate for a MUTATION (update/publish/delete, and the tree
+ * `move` operation) on a specific content node.
+ *
+ * The read path enforces `checkDocumentAccess(…, 'read')`; the same ACL was
+ * missing on the mutation choke points, so an author who could not read a
+ * restricted node could still modify, publish, or delete it (G-J04b-01). This
+ * closes that hole by requiring BOTH properties before a mutation proceeds:
+ *
+ *   1. the caller can READ the node (you cannot act on what you cannot see), and
+ *   2. the caller holds the action-specific grant on the node.
+ *
+ * SuperAdmin/SiteAdmin bypass both (handled inside `checkDocumentAccess`, per the
+ * existing role-hierarchy semantics). A node with no ACL rows stays open, so this
+ * only ever tightens access on nodes that already carry per-document permissions.
+ */
+export declare function checkDocumentMutationAccess(db: KywiDb, contentId: string, user: UserContext | null, action: 'write' | 'publish' | 'delete'): Promise<boolean>;
+/**
+ * Filter a data record to only include fields the user can access.
+ * Fields without an `access` config are always included.
+ * Built-in fields (not in the field schema) are always included.
+ */
+export declare function filterFieldsForUser(data: Record<string, unknown>, fields: FieldDefinition[], user: UserContext | null, action: 'read' | 'write'): Record<string, unknown>;
+export {};
+//# sourceMappingURL=access-control.d.ts.map

package/dist/auth/access-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../../src/auth/access-control.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAC3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAI7C,KAAK,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE5D;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,mBAAmB,GAAG,SAAS,EACvC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,WAAW,GAAG,IAAI,GACvB,OAAO,CAKT;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,GACrC,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,eAAe,EAAE,EACzB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,GAAG,OAAO,GACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBzB"}

package/dist/auth/access-control.js

@@ -0,0 +1,81 @@
+import { hasMinRole } from './roles.js';
+import { listContentPermissions, checkUserContentPermission } from '../db/content-permission-queries.js';
+/**
+ * Evaluate content type access control.
+ * If the access config defines a function for the action, call it.
+ * If no function is defined for the action, return true (fall through to role-based checks).
+ */
+export function checkContentAccess(access, action, user) {
+    if (!access)
+        return true;
+    const fn = access[action];
+    if (!fn)
+        return true;
+    return fn({ user });
+}
+/**
+ * Check document-level access for a specific content item.
+ *
+ * 1. SuperAdmin/SiteAdmin always have access
+ * 2. No document-level permissions = open access (allow)
+ * 3. Permissions exist + anonymous user = deny
+ * 4. Permissions exist + authenticated user = check for matching permission
+ */
+export async function checkDocumentAccess(db, contentId, user, action) {
+    // SuperAdmin and SiteAdmin bypass document-level checks
+    if (user && hasMinRole(user.role, 'siteAdmin'))
+        return true;
+    // Check if this document has any permissions defined
+    const perms = await listContentPermissions(db, contentId);
+    if (perms.length === 0)
+        return true; // No permissions = open access
+    // Permissions exist but user is anonymous
+    if (!user)
+        return false;
+    // Check if user has the specific permission (direct or via group)
+    return checkUserContentPermission(db, contentId, user.id, user.groups, action);
+}
+/**
+ * Document-level gate for a MUTATION (update/publish/delete, and the tree
+ * `move` operation) on a specific content node.
+ *
+ * The read path enforces `checkDocumentAccess(…, 'read')`; the same ACL was
+ * missing on the mutation choke points, so an author who could not read a
+ * restricted node could still modify, publish, or delete it (G-J04b-01). This
+ * closes that hole by requiring BOTH properties before a mutation proceeds:
+ *
+ *   1. the caller can READ the node (you cannot act on what you cannot see), and
+ *   2. the caller holds the action-specific grant on the node.
+ *
+ * SuperAdmin/SiteAdmin bypass both (handled inside `checkDocumentAccess`, per the
+ * existing role-hierarchy semantics). A node with no ACL rows stays open, so this
+ * only ever tightens access on nodes that already carry per-document permissions.
+ */
+export async function checkDocumentMutationAccess(db, contentId, user, action) {
+    // Must be able to read the node first — no mutating an invisible node.
+    if (!(await checkDocumentAccess(db, contentId, user, 'read')))
+        return false;
+    return checkDocumentAccess(db, contentId, user, action);
+}
+/**
+ * Filter a data record to only include fields the user can access.
+ * Fields without an `access` config are always included.
+ * Built-in fields (not in the field schema) are always included.
+ */
+export function filterFieldsForUser(data, fields, user, action) {
+    const result = {};
+    const fieldMap = new Map(fields.map(f => [f.name, f]));
+    for (const [key, value] of Object.entries(data)) {
+        const field = fieldMap.get(key);
+        if (!field || !field.access) {
+            result[key] = value;
+            continue;
+        }
+        const accessFn = field.access[action];
+        if (!accessFn || accessFn({ user })) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=access-control.js.map

package/dist/auth/access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../../src/auth/access-control.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAA;AAIxG;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAuC,EACvC,MAAqB,EACrB,IAAwB;IAExB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACzB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IACpB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAU,EACV,SAAiB,EACjB,IAAwB,EACxB,MAAqB;IAErB,wDAAwD;IACxD,IAAI,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IAE3D,qDAAqD;IACrD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAE,+BAA+B;IAEpE,0CAA0C;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,kEAAkE;IAClE,OAAO,0BAA0B,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAChF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,EAAU,EACV,SAAiB,EACjB,IAAwB,EACxB,MAAsC;IAEtC,uEAAuE;IACvE,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3E,OAAO,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA6B,EAC7B,MAAyB,EACzB,IAAwB,EACxB,MAAwB;IAExB,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAEtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACnB,SAAQ;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/auth/auth-secret.d.ts

@@ -0,0 +1,33 @@
+/**
+ * AUTH_SECRET production policy — the single definition of "what counts as an
+ * insecure secret" and how hard to fail on it.
+ *
+ * Shared by two callers so the rule lives once:
+ *   - the CLI/app env-guard (`db/env-guard.ts` → resolveAuthSecret), which
+ *     resolves and RETURNS the effective secret for the API handler, and
+ *   - the host adapter (`@kywi-software/core/host` → assertProductionAuthSecret),
+ *     which the generated middleware.ts / kywi.config.ts call at module scope so
+ *     `next build`/`next start` in production fail loudly.
+ *
+ * Dependency-free (only `process.env`), so the edge-safe host bundle can import
+ * it without dragging in any db/server code.
+ */
+/** Placeholder secrets that ship in scaffolds/docs and must never sign real tokens. */
+export declare const DEV_FALLBACK_SECRETS: ReadonlySet<string>;
+/** True when no usable secret is configured — missing, empty, or a known dev fallback. */
+export declare function isDevFallbackSecret(secret: string | undefined): boolean;
+/** The actionable message shown when a production secret is missing/insecure. */
+export declare function insecureAuthSecretMessage(): string;
+/**
+ * Assert that a usable AUTH_SECRET is configured in production. Throws a clear,
+ * actionable error when NODE_ENV=production and the secret is missing or is a
+ * known dev fallback (JWTs signed with a public default are forgeable). A no-op
+ * in development, so the dev fallback keeps `pnpm dev` frictionless.
+ *
+ * @param secret the RAW configured secret (e.g. `process.env.AUTH_SECRET`) — do
+ *   NOT pass the already-defaulted value, or a missing secret can't be detected.
+ */
+export declare function assertProductionAuthSecret(secret: string | undefined, opts?: {
+    isProduction?: boolean;
+}): void;
+//# sourceMappingURL=auth-secret.d.ts.map

package/dist/auth/auth-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-secret.d.ts","sourceRoot":"","sources":["../../src/auth/auth-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,uFAAuF;AACvF,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAGnD,CAAA;AAEF,0FAA0F;AAC1F,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEvE;AAED,iFAAiF;AACjF,wBAAgB,yBAAyB,IAAI,MAAM,CASlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAChC,IAAI,CAON"}

package/dist/auth/auth-secret.js

@@ -0,0 +1,54 @@
+/**
+ * AUTH_SECRET production policy — the single definition of "what counts as an
+ * insecure secret" and how hard to fail on it.
+ *
+ * Shared by two callers so the rule lives once:
+ *   - the CLI/app env-guard (`db/env-guard.ts` → resolveAuthSecret), which
+ *     resolves and RETURNS the effective secret for the API handler, and
+ *   - the host adapter (`@kywi-software/core/host` → assertProductionAuthSecret),
+ *     which the generated middleware.ts / kywi.config.ts call at module scope so
+ *     `next build`/`next start` in production fail loudly.
+ *
+ * Dependency-free (only `process.env`), so the edge-safe host bundle can import
+ * it without dragging in any db/server code.
+ */
+/** Placeholder secrets that ship in scaffolds/docs and must never sign real tokens. */
+export const DEV_FALLBACK_SECRETS = new Set([
+    'dev-secret',
+    'dev-secret-change-in-production',
+]);
+/** True when no usable secret is configured — missing, empty, or a known dev fallback. */
+export function isDevFallbackSecret(secret) {
+    return !secret || DEV_FALLBACK_SECRETS.has(secret);
+}
+/** The actionable message shown when a production secret is missing/insecure. */
+export function insecureAuthSecretMessage() {
+    return [
+        `AUTH_SECRET is not set (or is the insecure dev fallback) in production.`,
+        ``,
+        `  Set a strong random secret before deploying:`,
+        `    export AUTH_SECRET=$(openssl rand -base64 32)`,
+        ``,
+        `  Refusing to start: tokens signed with a known secret can be forged.`,
+    ].join('\n');
+}
+/**
+ * Assert that a usable AUTH_SECRET is configured in production. Throws a clear,
+ * actionable error when NODE_ENV=production and the secret is missing or is a
+ * known dev fallback (JWTs signed with a public default are forgeable). A no-op
+ * in development, so the dev fallback keeps `pnpm dev` frictionless.
+ *
+ * @param secret the RAW configured secret (e.g. `process.env.AUTH_SECRET`) — do
+ *   NOT pass the already-defaulted value, or a missing secret can't be detected.
+ */
+export function assertProductionAuthSecret(secret, opts) {
+    const isProduction = opts?.isProduction ?? process.env['NODE_ENV'] === 'production';
+    if (!isProduction)
+        return;
+    if (!isDevFallbackSecret(secret))
+        return;
+    const err = new Error(insecureAuthSecretMessage());
+    err.userFacing = true;
+    throw err;
+}
+//# sourceMappingURL=auth-secret.js.map

package/dist/auth/auth-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-secret.js","sourceRoot":"","sources":["../../src/auth/auth-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,uFAAuF;AACvF,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,YAAY;IACZ,iCAAiC;CAClC,CAAC,CAAA;AAEF,0FAA0F;AAC1F,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,OAAO,CAAC,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;AACpD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,yEAAyE;QACzE,EAAE;QACF,gDAAgD;QAChD,mDAAmD;QACnD,EAAE;QACF,uEAAuE;KACxE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA0B,EAC1B,IAAiC;IAEjC,MAAM,YAAY,GAAG,IAAI,EAAE,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,CAAA;IACnF,IAAI,CAAC,YAAY;QAAE,OAAM;IACzB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAM;IACxC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC,CACjD;IAAC,GAAgC,CAAC,UAAU,GAAG,IAAI,CAAA;IACpD,MAAM,GAAG,CAAA;AACX,CAAC"}

package/dist/auth/authjs.d.ts

@@ -0,0 +1,13 @@
+import type { AuthConfig } from '@auth/core';
+import type { KywiConfig } from '../config/types.js';
+import type { KywiDb } from '../db/client.js';
+/**
+ * Build an Auth.js v5 config from the Kywi config.
+ *
+ * Currently supports the "credentials" provider, which delegates
+ * to the existing password-based auth flow (bcrypt verification
+ * against kywi_users). OAuth providers (google, github) will be
+ * added via dynamic import when their env vars are present.
+ */
+export declare function createKywiAuthConfig(config: KywiConfig, db: KywiDb): AuthConfig;
+//# sourceMappingURL=authjs.d.ts.map

package/dist/auth/authjs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authjs.d.ts","sourceRoot":"","sources":["../../src/auth/authjs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAI7C;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU,CAgE/E"}

package/dist/auth/authjs.js

@@ -0,0 +1,71 @@
+import Credentials from '@auth/core/providers/credentials';
+import { getUserByEmail, getUserGroups } from '../db/user-queries.js';
+import { verifyPassword } from './passwords.js';
+/**
+ * Build an Auth.js v5 config from the Kywi config.
+ *
+ * Currently supports the "credentials" provider, which delegates
+ * to the existing password-based auth flow (bcrypt verification
+ * against kywi_users). OAuth providers (google, github) will be
+ * added via dynamic import when their env vars are present.
+ */
+export function createKywiAuthConfig(config, db) {
+    const providers = [];
+    if (config.auth.providers.includes('credentials')) {
+        providers.push(Credentials({
+            name: 'credentials',
+            credentials: {
+                email: { label: 'Email', type: 'email' },
+                password: { label: 'Password', type: 'password' },
+            },
+            async authorize(credentials) {
+                if (!credentials?.email || !credentials?.password)
+                    return null;
+                const email = String(credentials.email);
+                const password = String(credentials.password);
+                const user = await getUserByEmail(db, email);
+                if (!user || !user.isActive)
+                    return null;
+                const valid = await verifyPassword(password, user.passwordHash);
+                if (!valid)
+                    return null;
+                const groups = await getUserGroups(db, user.id);
+                return {
+                    id: user.id,
+                    email: user.email,
+                    name: `${user.firstName} ${user.lastName}`.trim(),
+                    role: user.role,
+                    groups,
+                };
+            },
+        }));
+    }
+    // TODO: OAuth providers (google, github) — dynamic import when env vars present
+    return {
+        providers,
+        secret: config.auth.secret,
+        session: { strategy: 'jwt' },
+        callbacks: {
+            async jwt({ token, user }) {
+                if (user) {
+                    token.id = user.id;
+                    token.role = user.role ?? 'reader';
+                    token.groups = user.groups ?? [];
+                }
+                return token;
+            },
+            async session({ session, token }) {
+                if (session.user) {
+                    ;
+                    session.user.id = token.id;
+                    session.user.role = token.role;
+                    session.user.groups = token.groups;
+                }
+                return session;
+            },
+        },
+        pages: { signIn: '/admin/login' },
+        trustHost: true,
+    };
+}
+//# sourceMappingURL=authjs.js.map

package/dist/auth/authjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authjs.js","sourceRoot":"","sources":["../../src/auth/authjs.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,MAAM,kCAAkC,CAAA;AAI1D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkB,EAAE,EAAU;IACjE,MAAM,SAAS,GAA4B,EAAE,CAAA;IAE7C,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,SAAS,CAAC,IAAI,CACZ,WAAW,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE;gBACX,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;gBACxC,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE;aAClD;YACD,KAAK,CAAC,SAAS,CAAC,WAAW;gBACzB,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,QAAQ;oBAAE,OAAO,IAAI,CAAA;gBAE9D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;gBACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;gBAE7C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;gBAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;oBAAE,OAAO,IAAI,CAAA;gBAExC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;gBAC/D,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAA;gBAEvB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;gBAE/C,OAAO;oBACL,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE;oBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM;iBACA,CAAA;YACV,CAAC;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,gFAAgF;IAEhF,OAAO;QACL,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;QAC1B,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAc,EAAE;QACrC,SAAS,EAAE;YACT,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;gBACvB,IAAI,IAAI,EAAE,CAAC;oBACT,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAA;oBAClB,KAAK,CAAC,IAAI,GAAI,IAAY,CAAC,IAAI,IAAI,QAAQ,CAAA;oBAC3C,KAAK,CAAC,MAAM,GAAI,IAAY,CAAC,MAAM,IAAI,EAAE,CAAA;gBAC3C,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC9B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;oBACjB,CAAC;oBAAC,OAAO,CAAC,IAAY,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CACnC;oBAAC,OAAO,CAAC,IAAY,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CACvC;oBAAC,OAAO,CAAC,IAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;gBAC9C,CAAC;gBACD,OAAO,OAAO,CAAA;YAChB,CAAC;SACF;QACD,KAAK,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;QACjC,SAAS,EAAE,IAAI;KAChB,CAAA;AACH,CAAC"}

package/dist/auth/brute-force.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Brute-force protection: track failed login attempts (strikes) per
+ * user/IP pair and lock out after a configurable threshold.
+ */
+export interface BruteForceConfig {
+    /** Maximum number of failed attempts before lockout */
+    maxStrikes: number;
+    /** Time window in which strikes are counted (minutes) */
+    windowMinutes: number;
+    /** How long the lockout lasts (minutes) */
+    lockoutMinutes: number;
+}
+export interface LockoutResult {
+    locked: boolean;
+    retryAfter?: number;
+}
+export interface Strike {
+    id: string;
+    userId: string;
+    ip: string;
+    attemptedAt: Date;
+}
+/**
+ * Minimal database interface for brute-force operations.
+ * This abstraction keeps the module testable without a real DB connection.
+ */
+export interface BruteForceDb {
+    insertStrike(userId: string, ip: string): Promise<void>;
+    getStrikes(userId: string, ip: string, since: Date): Promise<Strike[]>;
+    deleteStrikes(userId: string, ip: string): Promise<void>;
+}
+/**
+ * Record a failed login attempt (strike) for the given user/IP pair.
+ */
+export declare function recordStrike(db: BruteForceDb, userId: string, ip: string): Promise<void>;
+/**
+ * Check whether the user/IP pair is currently locked out.
+ *
+ * Lockout is triggered when the number of strikes within the configured
+ * time window meets or exceeds `maxStrikes`.  The lockout duration is
+ * measured from the *most recent* strike.
+ */
+export declare function isLockedOut(db: BruteForceDb, userId: string, ip: string, config: BruteForceConfig): Promise<LockoutResult>;
+/**
+ * Clear all strikes for a user/IP pair (e.g. after a successful login).
+ */
+export declare function clearStrikes(db: BruteForceDb, userId: string, ip: string): Promise<void>;
+//# sourceMappingURL=brute-force.d.ts.map

package/dist/auth/brute-force.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brute-force.d.ts","sourceRoot":"","sources":["../../src/auth/brute-force.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAA;IACrB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,OAAO,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,IAAI,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACtE,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzD;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,YAAY,EAChB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,YAAY,EAChB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,aAAa,CAAC,CAqBxB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,YAAY,EAChB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/auth/brute-force.js

@@ -0,0 +1,39 @@
+/**
+ * Brute-force protection: track failed login attempts (strikes) per
+ * user/IP pair and lock out after a configurable threshold.
+ */
+/**
+ * Record a failed login attempt (strike) for the given user/IP pair.
+ */
+export async function recordStrike(db, userId, ip) {
+    await db.insertStrike(userId, ip);
+}
+/**
+ * Check whether the user/IP pair is currently locked out.
+ *
+ * Lockout is triggered when the number of strikes within the configured
+ * time window meets or exceeds `maxStrikes`.  The lockout duration is
+ * measured from the *most recent* strike.
+ */
+export async function isLockedOut(db, userId, ip, config) {
+    const windowStart = new Date(Date.now() - config.windowMinutes * 60 * 1000);
+    const strikes = await db.getStrikes(userId, ip, windowStart);
+    if (strikes.length < config.maxStrikes) {
+        return { locked: false };
+    }
+    // Find the most recent strike to compute when the lockout expires
+    const latestStrike = strikes.reduce((latest, s) => s.attemptedAt.getTime() > latest.attemptedAt.getTime() ? s : latest);
+    const lockoutEnd = latestStrike.attemptedAt.getTime() + config.lockoutMinutes * 60 * 1000;
+    const remaining = lockoutEnd - Date.now();
+    if (remaining <= 0) {
+        return { locked: false };
+    }
+    return { locked: true, retryAfter: Math.ceil(remaining / 1000) };
+}
+/**
+ * Clear all strikes for a user/IP pair (e.g. after a successful login).
+ */
+export async function clearStrikes(db, userId, ip) {
+    await db.deleteStrikes(userId, ip);
+}
+//# sourceMappingURL=brute-force.js.map

package/dist/auth/brute-force.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brute-force.js","sourceRoot":"","sources":["../../src/auth/brute-force.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiCH;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAgB,EAChB,MAAc,EACd,EAAU;IAEV,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAgB,EAChB,MAAc,EACd,EAAU,EACV,MAAwB;IAExB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,WAAW,CAAC,CAAA;IAE5D,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC1B,CAAC;IAED,kEAAkE;IAClE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAChD,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CACpE,CAAA;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,cAAc,GAAG,EAAE,GAAG,IAAI,CAAA;IACzF,MAAM,SAAS,GAAG,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAEzC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC1B,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAA;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAgB,EAChB,MAAc,EACd,EAAU;IAEV,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACpC,CAAC"}