@madauth/server 0.2.0-beta.2 → 0.3.0-beta.1

package/dist/entry/node.js

@@ -1,13 +1,13 @@
 import {
   createApp
-} from "../chunk-YALS7OMV.js";
-import "../chunk-7CTAB3QV.js";
+} from "../chunk-ZSBKNV5W.js";
+import "../chunk-DCDTO5LG.js";
 import {
   loadConfig,
   resolveEnv
-} from "../chunk-5CKEMC6M.js";
+} from "../chunk-ODITZLMM.js";
 import "../chunk-JDQLSL36.js";
-import "../chunk-6EJDVZCD.js";
+import "../chunk-NPNM26J3.js";
 
 // src/entry/node.ts
 import { serve } from "@hono/node-server";

package/dist/index.d.ts

@@ -1,15 +1,21 @@
 import { Hono } from 'hono';
-import { M as MadauthConfig } from './config-BkxADgtp.js';
-export { C as ConfigError, a as ConfigOverrides, E as EntryOptions, e as envVars, l as loadConfig } from './config-BkxADgtp.js';
+import { M as MadauthConfig } from './config-DEBYi8hb.js';
+export { C as ConfigError, a as ConfigOverrides, E as EntryOptions, e as envVars, l as loadConfig } from './config-DEBYi8hb.js';
 import { JWK } from 'jose';
-import { a as Schema } from './schema-BSgYVRpd.js';
-export { F as FieldDef, b as FieldType, R as Row, S as StoreAdapter, V as Value, W as Where, m as madauthSchema } from './schema-BSgYVRpd.js';
-export { M as MadauthUser } from './user-C1A3BfOo.js';
-import './webhook-ltwulgcB.js';
+import { a as Schema } from './schema-3yhCc2jH.js';
+export { F as FieldDef, b as FieldType, R as Row, S as StoreAdapter, V as Value, W as Where, m as madauthSchema } from './schema-3yhCc2jH.js';
+export { M as MadauthUser } from './user-BMWEWREH.js';
+import './webhook-DCDP6SaE.js';
 
 /** Creates a new private ES256 JWK for MADAUTH_SIGNING_KEY. */
 declare function generateSigningKey(): Promise<JWK>;
 
+/** The sign-in methods madAuth has. */
+declare const SIGN_IN_METHODS: readonly ["google", "password"];
+type SignInMethod = (typeof SIGN_IN_METHODS)[number];
+/** Which sign-in methods are on. A method that is not mentioned is on. */
+type MethodSettings = Partial<Record<SignInMethod, boolean>>;
+
 /** Hash parameter that carries a sign-in error back to the app after the code flow. */
 declare const REDIRECT_ERROR_PARAM = "madauth_error";
 
@@ -32,4 +38,21 @@ declare function upgradeTablesSql(dialect: SqlDialect, fromVersion: number): str
 /** The SQL that creates madAuth's tables and indexes in an empty database. */
 declare function createTablesSql(dialect: SqlDialect, schema?: Schema): string;
 
-export { MadauthConfig, REDIRECT_ERROR_PARAM, Schema, type SqlDialect, columnName, createApp, createTablesSql, generateSigningKey, tableName, upgradeTablesSql };
+/** A user's claims: a JSON object. */
+type Claims = Record<string, unknown>;
+/** The role that may manage claims and settings through the HTTP API. */
+declare const ADMIN_ROLE = "admin";
+/**
+ * Checks role names and returns them sorted and without duplicates, or null if `input` is not a list of
+ * valid names: lower-case letters, digits, `-` and `_`, starting with a letter, at most 32 characters.
+ */
+declare function parseRoles(input: unknown): string[] | null;
+/**
+ * Checks a claims object and returns it in canonical form (keys sorted, `roles` sorted and without
+ * duplicates), or null if `input` is not one: a JSON object whose keys are names (letters, digits and `_`,
+ * starting with a letter, at most 64 characters), whose `roles`, if any, is a valid list of role names,
+ * and which is at most {@link MAX_CLAIMS_LENGTH} characters as JSON.
+ */
+declare function parseClaims(input: unknown): Claims | null;
+
+export { ADMIN_ROLE, type Claims, MadauthConfig, type MethodSettings, REDIRECT_ERROR_PARAM, SIGN_IN_METHODS, Schema, type SignInMethod, type SqlDialect, columnName, createApp, createTablesSql, generateSigningKey, parseClaims, parseRoles, tableName, upgradeTablesSql };

package/dist/index.js

@@ -3,27 +3,33 @@ import {
   createTablesSql,
   tableName,
   upgradeTablesSql
-} from "./chunk-CNL562LZ.js";
+} from "./chunk-56MOVFO4.js";
 import {
   madauthSchema
-} from "./chunk-XNBWZZHT.js";
+} from "./chunk-CD7Y4T66.js";
 import {
   REDIRECT_ERROR_PARAM,
   createApp
-} from "./chunk-YALS7OMV.js";
-import "./chunk-7CTAB3QV.js";
+} from "./chunk-ZSBKNV5W.js";
+import "./chunk-DCDTO5LG.js";
 import {
+  ADMIN_ROLE,
   ConfigError,
+  SIGN_IN_METHODS,
   envVars,
-  loadConfig
-} from "./chunk-5CKEMC6M.js";
+  loadConfig,
+  parseClaims,
+  parseRoles
+} from "./chunk-ODITZLMM.js";
 import {
   generateSigningKey
 } from "./chunk-JDQLSL36.js";
-import "./chunk-6EJDVZCD.js";
+import "./chunk-NPNM26J3.js";
 export {
+  ADMIN_ROLE,
   ConfigError,
   REDIRECT_ERROR_PARAM,
+  SIGN_IN_METHODS,
   columnName,
   createApp,
   createTablesSql,
@@ -31,6 +37,8 @@ export {
   generateSigningKey,
   loadConfig,
   madauthSchema,
+  parseClaims,
+  parseRoles,
   tableName,
   upgradeTablesSql
 };

package/dist/{schema-BSgYVRpd.d.ts → schema-3yhCc2jH.d.ts}

@@ -43,8 +43,9 @@ interface Schema {
 }
 /** The records madAuth stores. Timestamps are milliseconds since 1970. */
 declare const madauthSchema: {
-    readonly version: 3;
+    readonly version: 4;
     readonly models: {
+        /** Someone who signed in, whichever way: the e-mail address is the identity shared by the sign-in methods. */
         readonly user: {
             readonly fields: {
                 readonly id: {
@@ -75,12 +76,17 @@ declare const madauthSchema: {
                 readonly wrongCodes: {
                     readonly type: "number";
                 };
+                /** What admins attached to the user, as JSON, e.g. `{"roles":["admin"]}` (since version 4). */
+                readonly claims: {
+                    readonly type: "string";
+                    readonly nullable: true;
+                };
                 readonly createdAt: {
                     readonly type: "number";
                 };
             };
         };
-        /** How a user signs in. `key` is e.g. `password:<userId>`; later `google:<sub>` or `totp:<userId>`. */
+        /** How a user signs in. `key` is `password:<userId>` or `google:<sub>`; later e.g. `totp:<userId>`. */
         readonly account: {
             readonly fields: {
                 readonly id: {
@@ -105,6 +111,11 @@ declare const madauthSchema: {
                 readonly lockedUntil: {
                     readonly type: "number";
                 };
+                /** The address the provider reported at the last sign-in, e.g. Google's current primary address (since version 4). */
+                readonly email: {
+                    readonly type: "string";
+                    readonly nullable: true;
+                };
                 readonly createdAt: {
                     readonly type: "number";
                 };
@@ -135,23 +146,20 @@ declare const madauthSchema: {
                 };
             };
         };
-        /**
-         * The roles of an e-mail address (since version 3). `id` is the normalized address, so the roles
-         * apply whichever way its owner signs in. `roles` holds the names separated by spaces.
-         */
-        readonly role: {
+        /** A setting admins change at runtime, as JSON (since version 4), e.g. `methods`: which sign-in methods are on. */
+        readonly setting: {
             readonly fields: {
                 readonly id: {
                     readonly type: "string";
                     readonly primaryKey: true;
                 };
-                readonly roles: {
+                readonly value: {
                     readonly type: "string";
                 };
                 readonly updatedAt: {
                     readonly type: "number";
                 };
-                /** The address of the admin who set them; empty when set from the command line. */
+                /** The address of the admin who set it; empty when set from the command line. */
                 readonly updatedBy: {
                     readonly type: "string";
                     readonly nullable: true;

package/dist/sqlite.js

@@ -3,10 +3,10 @@ import {
   createTablesSql,
   tableName,
   upgradeTablesSql
-} from "./chunk-CNL562LZ.js";
+} from "./chunk-56MOVFO4.js";
 import {
   madauthSchema
-} from "./chunk-XNBWZZHT.js";
+} from "./chunk-CD7Y4T66.js";
 
 // src/store/sqlite.ts
 function createSqliteAdapter(path) {