@lastshotlabs/bunshot 0.0.27 → 0.1.0

package/dist/packages/bunshot-auth/src/lib/securityEventWiring.js

@@ -0,0 +1,65 @@
+import { SECURITY_EVENT_TYPES } from '../../../bunshot-core/src/index.js';
+// Severity mapping per event type
+const SEVERITY_MAP = {
+    'security.auth.login.success': 'info',
+    'security.auth.login.failure': 'warn',
+    'security.auth.login.blocked': 'critical',
+    'security.auth.register.success': 'info',
+    'security.auth.register.failure': 'warn',
+    'security.auth.register.concealed': 'info',
+    'security.auth.logout': 'info',
+    'security.auth.account.locked': 'critical',
+    'security.auth.account.suspended': 'warn',
+    'security.auth.account.unsuspended': 'info',
+    'security.auth.account.deleted': 'warn',
+    'security.auth.session.created': 'info',
+    'security.auth.session.revoked': 'info',
+    'security.auth.password.reset': 'info',
+    'security.auth.password.change': 'info',
+    'security.auth.mfa.setup': 'info',
+    'security.auth.mfa.verify.success': 'info',
+    'security.auth.mfa.verify.failure': 'warn',
+    'security.auth.step_up.success': 'info',
+    'security.auth.step_up.failure': 'warn',
+    'security.auth.oauth.linked': 'info',
+    'security.auth.oauth.unlinked': 'info',
+    'security.auth.oauth.reauthed': 'info',
+    'security.rate_limit.exceeded': 'warn',
+    'security.credential_stuffing.detected': 'critical',
+    'security.csrf.failed': 'warn',
+    'security.breached_password.detected': 'warn',
+    'security.breached_password.api_failure': 'warn',
+    'security.admin.role.changed': 'warn',
+    'security.admin.user.modified': 'info',
+    'security.admin.user.deleted': 'warn',
+};
+export function wireSecurityEventConfig(bus, cfg) {
+    if (!cfg?.onEvent)
+        return;
+    const { onEvent, onEventError, include = [], exclude = [] } = cfg;
+    for (const eventType of SECURITY_EVENT_TYPES) {
+        if (include.length > 0 && !include.includes(eventType))
+            continue;
+        if (exclude.includes(eventType))
+            continue;
+        bus.on(eventType, payload => {
+            const event = {
+                eventType,
+                severity: SEVERITY_MAP[eventType] ?? 'info',
+                timestamp: new Date().toISOString(),
+                ...payload,
+            };
+            try {
+                onEvent(event);
+            }
+            catch (err) {
+                if (onEventError) {
+                    onEventError(err);
+                }
+                else {
+                    console.error('[bunshot-auth][security-events]', err);
+                }
+            }
+        });
+    }
+}

package/dist/packages/bunshot-auth/src/lib/session.d.ts

@@ -0,0 +1,45 @@
+import type { RepoFactories } from '../../../bunshot-core/src/index.js';
+import { type AuthResolvedConfig } from '../config/authConfig';
+import type { RedisLike } from '../types/redis';
+import type { RefreshResult, SessionInfo, SessionMetadata } from '../types/session';
+export type { SessionMetadata, SessionInfo, RefreshResult } from '../types/session';
+export type SessionStore = 'redis' | 'mongo' | 'sqlite' | 'memory';
+export interface ISessionRepository {
+    createSession(userId: string, token: string, sessionId: string, metadata?: SessionMetadata, cfg?: AuthResolvedConfig): Promise<void>;
+    atomicCreateSession(userId: string, token: string, sessionId: string, maxSessions: number, metadata?: SessionMetadata, cfg?: AuthResolvedConfig): Promise<void>;
+    getSession(sessionId: string, cfg?: AuthResolvedConfig): Promise<string | null>;
+    deleteSession(sessionId: string, cfg?: AuthResolvedConfig): Promise<void>;
+    getUserSessions(userId: string, cfg?: AuthResolvedConfig): Promise<SessionInfo[]>;
+    getActiveSessionCount(userId: string, cfg?: AuthResolvedConfig): Promise<number>;
+    evictOldestSession(userId: string, cfg?: AuthResolvedConfig): Promise<void>;
+    updateSessionLastActive(sessionId: string, cfg?: AuthResolvedConfig): Promise<void>;
+    setRefreshToken(sessionId: string, refreshToken: string, cfg?: AuthResolvedConfig): Promise<void>;
+    getSessionByRefreshToken(refreshToken: string, cfg?: AuthResolvedConfig): Promise<RefreshResult | null>;
+    rotateRefreshToken(sessionId: string, newRefreshToken: string, newAccessToken: string, cfg?: AuthResolvedConfig): Promise<void>;
+    getSessionFingerprint(sessionId: string): Promise<string | null>;
+    setSessionFingerprint(sessionId: string, fingerprint: string): Promise<void>;
+    setMfaVerifiedAt(sessionId: string): Promise<void>;
+    getMfaVerifiedAt(sessionId: string): Promise<number | null>;
+}
+export declare function createMemorySessionRepository(): ISessionRepository;
+export declare function createSqliteSessionRepository(db: import('bun:sqlite').Database): ISessionRepository;
+export declare function createRedisSessionRepository(getRedis: () => RedisLike, appName: string): ISessionRepository;
+export declare function createMongoSessionRepository(conn: import('mongoose').Connection, mg: typeof import('mongoose')): ISessionRepository;
+export declare const sessionFactories: RepoFactories<ISessionRepository>;
+export declare const createSession: (repo: ISessionRepository, userId: string, token: string, sessionId: string, metadata?: SessionMetadata, config?: AuthResolvedConfig) => Promise<void>;
+export declare const atomicCreateSession: (repo: ISessionRepository, userId: string, token: string, sessionId: string, maxSessions: number, metadata?: SessionMetadata, config?: AuthResolvedConfig) => Promise<void>;
+export declare const getSession: (repo: ISessionRepository, sessionId: string, config?: AuthResolvedConfig) => Promise<string | null>;
+export declare const deleteSession: (repo: ISessionRepository, sessionId: string, config?: AuthResolvedConfig) => Promise<void>;
+export declare const getUserSessions: (repo: ISessionRepository, userId: string, config?: AuthResolvedConfig) => Promise<SessionInfo[]>;
+export declare const getActiveSessionCount: (repo: ISessionRepository, userId: string, config?: AuthResolvedConfig) => Promise<number>;
+export declare const evictOldestSession: (repo: ISessionRepository, userId: string, config?: AuthResolvedConfig) => Promise<void>;
+export declare const deleteUserSessions: (repo: ISessionRepository, userId: string, config?: AuthResolvedConfig) => Promise<void>;
+export declare const deleteOtherSessions: (repo: ISessionRepository, userId: string, currentSessionId: string, config?: AuthResolvedConfig) => Promise<void>;
+export declare const updateSessionLastActive: (repo: ISessionRepository, sessionId: string, config?: AuthResolvedConfig) => Promise<void>;
+export declare const setRefreshToken: (repo: ISessionRepository, sessionId: string, refreshToken: string, config?: AuthResolvedConfig) => Promise<void>;
+export declare const getSessionByRefreshToken: (repo: ISessionRepository, refreshToken: string, config?: AuthResolvedConfig) => Promise<RefreshResult | null>;
+export declare const rotateRefreshToken: (repo: ISessionRepository, sessionId: string, newRefreshToken: string, newAccessToken: string, config?: AuthResolvedConfig) => Promise<void>;
+export declare const getSessionFingerprint: (repo: ISessionRepository, sessionId: string) => Promise<string | null>;
+export declare const setSessionFingerprint: (repo: ISessionRepository, sessionId: string, fingerprint: string) => Promise<void>;
+export declare const setMfaVerifiedAt: (repo: ISessionRepository, sessionId: string) => Promise<void>;
+export declare const getMfaVerifiedAt: (repo: ISessionRepository, sessionId: string) => Promise<number | null>;