@madauth/server 0.1.0 → 0.2.0-beta.1

package/dist/store/dynamodb.d.ts

@@ -0,0 +1,19 @@
+import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
+import { S as StoreAdapter } from '../schema-BSgYVRpd.js';
+
+interface DynamoDbAdapterOptions {
+    /** The table, with the partition key `pk` and the sort key `sk` (both strings). */
+    tableName: string;
+    /** Default: a client with the region and credentials of the environment. */
+    client?: Pick<DynamoDBClient, 'send'>;
+}
+/**
+ * Stores madAuth's records in one DynamoDB table. Create the table yourself, with the partition key `pk`
+ * and the sort key `sk`, both of type string (see "DynamoDB" in docs/server.md).
+ *
+ * A filter must contain the record's id, a unique field or an indexed field: the adapter never scans the
+ * table. Unique and indexed fields can't be changed by `update`.
+ */
+declare function createDynamoDbAdapter(options: DynamoDbAdapterOptions): StoreAdapter;
+
+export { type DynamoDbAdapterOptions, createDynamoDbAdapter };

package/dist/store/sqlite.d.ts

@@ -1,4 +1,4 @@
-import { S as StoreAdapter } from '../schema-Dotc6LU7.js';
+import { S as StoreAdapter } from '../schema-BSgYVRpd.js';
 
 /**
  * Stores madAuth's records in a SQLite file using Node's built-in `node:sqlite` (Node 22.13 or newer).

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { S as StoreAdapter } from './schema-Dotc6LU7.js';
+import { S as StoreAdapter } from './schema-BSgYVRpd.js';
 
 /** The parts of a test runner the contract needs; Vitest, Jest and node:test with `expect` all fit. */
 interface ContractRunner {

package/dist/testing.js

@@ -13,12 +13,26 @@ function testUser(overrides = {}) {
     name: null,
     sessionVersion: 0,
     lastMailAt: 0,
+    wrongCodes: 0,
     createdAt: 17e11,
     ...overrides
   };
 }
-function testVerification(userId) {
-  return { id: unique("ver"), userId, purpose: "reset", codeHash: "h", attempts: 0, expiresAt: 17e11 };
+function testAccount(overrides = {}) {
+  const id = unique("acc_contract");
+  return {
+    id,
+    userId: unique("usr_contract"),
+    key: `password:${id}`,
+    secret: "hash",
+    failedAttempts: 0,
+    lockedUntil: 0,
+    createdAt: 17e11,
+    ...overrides
+  };
+}
+function testVerification(userId, purpose = "reset") {
+  return { id: unique("ver"), userId, purpose, codeHash: "h", attempts: 0, expiresAt: 17e11 };
 }
 function storeAdapterContract(t, createAdapter) {
   const { describe, it, expect } = t;
@@ -92,6 +106,55 @@ function storeAdapterContract(t, createAdapter) {
       const counts = await Promise.all(Array.from({ length: 10 }, () => store.delete("verification", { id: record.id })));
       expect(counts.reduce((sum, n) => sum + n, 0)).toBe(1);
     });
+    it("finds a record by a unique field other than its id", async () => {
+      const store = await createAdapter();
+      const account = testAccount();
+      await store.create("account", account);
+      expect(await store.findOne("account", { key: account.key })).toEqual(account);
+      expect(await store.findOne("account", { key: unique("password:missing") })).toBe(null);
+    });
+    it("sets a field to a value and to null", async () => {
+      const store = await createAdapter();
+      const user = testUser({ name: "Ada" });
+      await store.create("user", user);
+      expect(await store.update("user", { id: user.id }, { name: "Grace" })).toBe(1);
+      expect((await store.findOne("user", { id: user.id }))?.name).toBe("Grace");
+      expect(await store.update("user", { id: user.id }, { name: null })).toBe(1);
+      expect(await store.findOne("user", { id: user.id })).toEqual({ ...user, name: null });
+      expect(await store.update("user", { id: user.id, name: null }, { name: "Ada" })).toBe(1);
+      expect(await store.update("user", { id: user.id, name: null }, { name: "Grace" })).toBe(0);
+      expect((await store.findOne("user", { id: user.id }))?.name).toBe("Ada");
+    });
+    it("updates a record only while it still matches every field of the filter", async () => {
+      const store = await createAdapter();
+      const account = testAccount();
+      await store.create("account", account);
+      const unchanged = { id: account.id, failedAttempts: 0 };
+      expect(await store.update("account", unchanged, { failedAttempts: 1, lockedUntil: 5 })).toBe(1);
+      expect(await store.update("account", unchanged, { failedAttempts: 1, lockedUntil: 9 })).toBe(0);
+      expect(await store.findOne("account", { id: account.id })).toEqual({ ...account, failedAttempts: 1, lockedUntil: 5 });
+    });
+    it("applies only one of several concurrent updates with the same filter", async () => {
+      const store = await createAdapter();
+      const account = testAccount();
+      await store.create("account", account);
+      const counts = await Promise.all(
+        Array.from({ length: 10 }, () => store.update("account", { id: account.id, failedAttempts: 0 }, { failedAttempts: 1 }))
+      );
+      expect(counts.reduce((sum, n) => sum + n, 0)).toBe(1);
+    });
+    it("deletes every record that matches an indexed field", async () => {
+      const store = await createAdapter();
+      const userId = unique("usr_contract");
+      const other = testVerification(unique("usr_contract"));
+      for (const purpose of ["verify", "reset", "reset"]) await store.create("verification", testVerification(userId, purpose));
+      await store.create("verification", other);
+      expect(await store.delete("verification", { userId, purpose: "verify" })).toBe(1);
+      expect((await store.findMany("verification", { userId })).length).toBe(2);
+      expect(await store.delete("verification", { userId })).toBe(2);
+      expect(await store.findMany("verification", { userId })).toEqual([]);
+      expect(await store.findOne("verification", { id: other.id })).toEqual(other);
+    });
   });
 }
 export {

package/dist/{user-3DDyggFV.d.ts → user-C1A3BfOo.d.ts}

@@ -5,6 +5,8 @@ interface MadauthUser {
     email?: string;
     name?: string;
     picture?: string;
+    /** The roles of the user's e-mail address, e.g. `['admin']`. Absent without roles. */
+    roles?: string[];
 }
 
 export type { MadauthUser as M };

package/dist/verify.d.ts

@@ -1,5 +1,5 @@
 import { JWTVerifyGetKey } from 'jose';
-import { M as MadauthUser } from './user-3DDyggFV.js';
+import { M as MadauthUser } from './user-C1A3BfOo.js';
 
 interface SessionVerifierOptions {
     /** The madAuth server's public base URL (its MADAUTH_ISSUER). */

package/dist/verify.js

@@ -2,7 +2,7 @@ import {
   SESSION_COOKIE,
   SESSION_TYP,
   userFromClaims
-} from "./chunk-PRRKLEW7.js";
+} from "./chunk-7CTAB3QV.js";
 import {
   SIGNING_ALG
 } from "./chunk-JDQLSL36.js";

package/dist/{webhook-CT80emTQ.d.ts → webhook-ltwulgcB.d.ts}

@@ -1,5 +1,5 @@
 /** Every `type` madAuth sends. */
-declare const WEBHOOK_TYPES: readonly ["email.verify", "email.reset", "email.already_registered", "signup.before", "user.created", "email.verified", "password.reset", "user.signed_in"];
+declare const WEBHOOK_TYPES: readonly ["email.verify", "email.reset", "email.already_registered", "signup.before", "user.created", "email.verified", "password.reset", "user.signed_in", "user.deleted", "roles.changed"];
 type WebhookType = (typeof WEBHOOK_TYPES)[number];
 /** How old a call may be before receivers reject it, so a captured call can't be replayed. */
 declare const WEBHOOK_TOLERANCE_SECONDS: number;
@@ -24,8 +24,8 @@ declare function verifyWebhook(secret: string, headers: HeaderSource, body: stri
 interface WebhookSettings {
     url: string;
     secret: string;
-    /** Types to send besides the e-mails (WEBHOOK_EVENTS); null sends every type. */
-    events: ReadonlySet<string> | null;
+    /** The types that are sent (WEBHOOK_EVENTS); all others are skipped. */
+    events: ReadonlySet<string>;
 }
 
 export { type WebhookSettings as W, WEBHOOK_TOLERANCE_SECONDS as a, WEBHOOK_TYPES as b, type WebhookType as c, generateWebhookSecret as g, signWebhook as s, verifyWebhook as v };

package/dist/webhook.d.ts

@@ -1 +1 @@
-export { a as WEBHOOK_TOLERANCE_SECONDS, b as WEBHOOK_TYPES, c as WebhookType, g as generateWebhookSecret, s as signWebhook, v as verifyWebhook } from './webhook-CT80emTQ.js';
+export { a as WEBHOOK_TOLERANCE_SECONDS, b as WEBHOOK_TYPES, c as WebhookType, g as generateWebhookSecret, s as signWebhook, v as verifyWebhook } from './webhook-ltwulgcB.js';

package/dist/webhook.js

@@ -4,7 +4,7 @@ import {
   generateWebhookSecret,
   signWebhook,
   verifyWebhook
-} from "./chunk-AVZE6FFR.js";
+} from "./chunk-6EJDVZCD.js";
 export {
   WEBHOOK_TOLERANCE_SECONDS,
   WEBHOOK_TYPES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@madauth/server",
-  "version": "0.1.0",
+  "version": "0.2.0-beta.1",
   "description": "madAuth server: Google and e-mail & password sign-in with madAuth sessions, for Docker, AWS Lambda and Azure Functions.",
   "license": "MIT",
   "author": "David Neuy",
@@ -23,7 +23,8 @@
     "jwt",
     "hono",
     "aws-lambda",
-    "azure-functions"
+    "azure-functions",
+    "dynamodb"
   ],
   "type": "module",
   "engines": {
@@ -44,6 +45,10 @@
       "types": "./dist/store/sqlite.d.ts",
       "import": "./dist/sqlite.js"
     },
+    "./dynamodb": {
+      "types": "./dist/store/dynamodb.d.ts",
+      "import": "./dist/dynamodb.js"
+    },
     "./testing": {
       "types": "./dist/testing.d.ts",
       "import": "./dist/testing.js"
@@ -87,14 +92,19 @@
     "jose": "^6.2.12"
   },
   "peerDependencies": {
+    "@aws-sdk/client-dynamodb": "^3.0.0",
     "@azure/functions": "^4.0.0"
   },
   "peerDependenciesMeta": {
+    "@aws-sdk/client-dynamodb": {
+      "optional": true
+    },
     "@azure/functions": {
       "optional": true
     }
   },
   "devDependencies": {
+    "@aws-sdk/client-dynamodb": "^3.1146.0",
     "@azure/functions": "^4.16.5",
     "@types/aws-lambda": "^8.10.164",
     "@types/node": "^26.6.4",