@maestro-js/password 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/index.d.ts

@@ -4,38 +4,62 @@ import { Hash } from '@maestro-js/hash';
 
 declare function create<Id, Credentials extends {
     password: string;
-}>(config: Password.Config<Id, Credentials>): Password.Service<Id, Credentials>;
-declare const Password: {
-    create: typeof create;
+}>(config: Password.Internal.Config<Id, Credentials>): Password.Internal.Service<Id, Credentials>;
+declare function provider<Key extends Password.Provider.Key>(key: Key): Password.PasswordService<Key>;
+/**
+ * Password verification and reset with pluggable credential lookups and secure token-based resets.
+ * Call methods directly on the default instance, or use `Password.Provider.create()` for named instances.
+ */
+declare const PasswordBase: {
+    Provider: {
+        create: typeof create;
+        register: (name: Password.Provider.Key, item: Password.AnyPasswordService) => void;
+    };
+    provider: typeof provider;
     errors: {
         ThrottledError: CustomErrors.CustomErrorConstructor<undefined, {}, "tooManyRequests">;
         InvalidTokenError: CustomErrors.CustomErrorConstructor<undefined, {}, "unprocessableContent">;
         ExpiredTokenError: CustomErrors.CustomErrorConstructor<undefined, {}, "unprocessableContent">;
     };
 };
+type KeysWithFallback = keyof Password.Provider.Keys extends never ? {
+    default: {
+        Id: unknown;
+        Credentials: {
+            password: string;
+        } & Record<string, unknown>;
+    };
+} : Password.Provider.Keys;
+declare const Password: Password.PasswordService<'default'> & typeof PasswordBase;
 declare namespace Password {
-    interface Service<Id, Credentials extends {
-        password: string;
-    }> {
-        verifyCredentials(credentials: Credentials): Promise<Password.Authenticatable<Id> | null>;
-        createPasswordResetToken: (authenticatableId: Id) => Promise<string>;
-        resetPassword: (options: {
-            authenticatableId: Id;
-            token: string;
-            newPassword: string;
-        }) => Promise<void>;
-    }
-    interface Config<Id, Credentials extends {
-        password: string;
-    }> {
-        getAuthenticatableByCredentials(credentials: Omit<Credentials, 'password'>): Promise<(Password.Authenticatable<Id> & {
-            passwordHash: string;
-        }) | null>;
-        updatePasswordHash(id: Id, passwordHash: string): Promise<void>;
-        updateCredentialsInvalidBefore(id: Id, date: Iso.Instant): Promise<void>;
-        /** Used for password hashing and verification. `Hash.drivers.bcrypt()` is recommended. */
-        hash: Hash.HashService;
-        passwordResetOptions?: Password.ResetOptions<Id>;
+    type PasswordService<ProviderKey extends Password.Provider.Key = 'default'> = Internal.Service<KeysWithFallback[ProviderKey]['Id'], KeysWithFallback[ProviderKey]['Credentials']>;
+    type AnyPasswordService = Internal.Service<any, any>;
+    type PasswordServiceConfig<ProviderKey extends Password.Provider.Key = 'default'> = Internal.Config<KeysWithFallback[ProviderKey]['Id'], KeysWithFallback[ProviderKey]['Credentials']>;
+    namespace Internal {
+        interface Service<Id, Credentials extends {
+            password: string;
+        }> {
+            verifyCredentials(credentials: Credentials): Promise<Password.Authenticatable<Id> | null>;
+            createPasswordResetToken: (authenticatableId: Id, options: {
+                expirationMinutes: number;
+            }) => Promise<string>;
+            resetPassword: (options: {
+                token: string;
+                newPassword: string;
+            }) => Promise<Id>;
+        }
+        interface Config<Id, Credentials extends {
+            password: string;
+        }> {
+            getAuthenticatableByCredentials(credentials: Omit<Credentials, 'password'>): Promise<(Password.Authenticatable<Id> & {
+                passwordHash: string;
+            }) | null>;
+            updatePasswordHash(id: Id, passwordHash: string): Promise<void>;
+            updateCredentialsInvalidBefore(id: Id, date: Iso.Instant): Promise<void>;
+            /** Used for password hashing and verification. `Hash.drivers.bcrypt()` is recommended. */
+            hash: Hash.HashService;
+            passwordResetOptions?: Password.ResetOptions<Id>;
+        }
     }
     interface Authenticatable<Id> {
         id: Id;
@@ -53,11 +77,14 @@ declare namespace Password {
         getBySelector(selector: string): Promise<Password.ResetTokenRecord<Id> | null>;
         getByAuthenticatableId(authenticatableId: Id): Promise<Password.ResetTokenRecord<Id> | null>;
         deleteByAuthenticatableId(authenticatableId: Id): Promise<void>;
-        /** Token lifetime in minutes. Default: 60 */
-        tokenExpirationMinutes?: number;
         /** Minimum seconds between createToken calls for the same authenticatable. Default: 60 */
         throttleSeconds?: number;
     }
+    namespace Provider {
+        type Key = keyof KeysWithFallback;
+        interface Keys {
+        }
+    }
 }
 
 export { Password };

package/dist/index.js

@@ -1,6 +1,7 @@
 // src/index.ts
 import crypto from "crypto";
 import { CustomErrors } from "@maestro-js/custom-errors";
+import { ServiceRegistry } from "@maestro-js/service-registry";
 import { instantFns } from "iso-fns2";
 function create(config) {
   const hashService = config.hash;
@@ -23,7 +24,7 @@ function create(config) {
     }
     return { id: authenticatable.id, credentialsInvalidBefore: authenticatable.credentialsInvalidBefore };
   }
-  async function createPasswordResetToken(authenticatableId) {
+  async function createPasswordResetToken(authenticatableId, options) {
     if (!passwordResetOptions) {
       throw new Error("Password reset is not configured. Provide `passwordResetOptions` when creating the password service.");
     }
@@ -38,7 +39,7 @@ function create(config) {
     const verifier = crypto.randomBytes(32).toString("base64url");
     const verifierHash = await config.hash.hash(verifier);
     const now = instantFns.now();
-    const expirationDate = instantFns.add(now, { minutes: passwordResetOptions.tokenExpirationMinutes ?? 60 });
+    const expirationDate = instantFns.add(now, { minutes: options.expirationMinutes });
     await passwordResetOptions.create({
       authenticatableId,
       selector,
@@ -48,11 +49,7 @@ function create(config) {
     });
     return `${selector}|${verifier}`;
   }
-  async function resetPassword({
-    authenticatableId,
-    token,
-    newPassword
-  }) {
+  async function resetPassword({ token, newPassword }) {
     if (!passwordResetOptions) {
       throw new Error("Password reset is not configured. Provide `passwordResetOptions` when creating the password service.");
     }
@@ -71,13 +68,11 @@ function create(config) {
     if (record.expirationDate < instantFns.now()) {
       throw new PasswordResetExpiredTokenError();
     }
-    if (record.authenticatableId !== authenticatableId) {
-      throw new PasswordResetInvalidTokenError();
-    }
     const passwordHash = await config.hash.hash(newPassword);
-    await config.updatePasswordHash(authenticatableId, passwordHash);
-    await config.updateCredentialsInvalidBefore(authenticatableId, instantFns.now());
-    await passwordResetOptions.deleteByAuthenticatableId(authenticatableId);
+    await config.updatePasswordHash(record.authenticatableId, passwordHash);
+    await config.updateCredentialsInvalidBefore(record.authenticatableId, instantFns.now());
+    await passwordResetOptions.deleteByAuthenticatableId(record.authenticatableId);
+    return record.authenticatableId;
   }
   return {
     verifyCredentials,
@@ -85,6 +80,21 @@ function create(config) {
     resetPassword
   };
 }
+var registry = ServiceRegistry.createRegistry(
+  ServiceRegistry.proxyFunctionsForObject
+);
+var Provider = {
+  create,
+  register: registry.register
+};
+function provider(key) {
+  const service = registry.resolve(key);
+  return {
+    verifyCredentials: service.verifyCredentials,
+    createPasswordResetToken: service.createPasswordResetToken,
+    resetPassword: service.resetPassword
+  };
+}
 var PasswordResetThrottledError = CustomErrors.create({
   name: "PasswordResetThrottledError",
   message: "Password reset requests are being throttled. Please try again later.",
@@ -100,14 +110,19 @@ var PasswordResetExpiredTokenError = CustomErrors.create({
   message: "The password reset token has expired.",
   httpStatusCode: "unprocessableContent"
 });
-var Password = {
-  create,
+var PasswordBase = {
+  Provider,
+  provider,
   errors: {
     ThrottledError: PasswordResetThrottledError,
     InvalidTokenError: PasswordResetInvalidTokenError,
     ExpiredTokenError: PasswordResetExpiredTokenError
   }
 };
+var Password = {
+  ...PasswordBase,
+  ...provider("default")
+};
 function decodePasswordResetToken(token) {
   const [selector, verifier] = token.split("|");
   if (!selector || !verifier) return null;

package/package.json

@@ -7,7 +7,7 @@
       "default": "./dist/index.js"
     }
   },
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-alpha.21",
   "publishConfig": {
     "access": "restricted"
   },
@@ -16,11 +16,15 @@
   ],
   "dependencies": {
     "iso-fns2": "npm:iso-fns@2.0.0-alpha.26",
-    "@maestro-js/custom-errors": "1.0.0-alpha.2",
-    "@maestro-js/hash": "1.0.0-alpha.2"
+    "@maestro-js/custom-errors": "1.0.0-alpha.21",
+    "@maestro-js/service-registry": "1.0.0-alpha.21"
+  },
+  "peerDependencies": {
+    "@maestro-js/hash": "1.0.0-alpha.21"
   },
   "devDependencies": {
-    "@types/node": "^22.19.11"
+    "@types/node": "^22.19.11",
+    "@maestro-js/hash": "1.0.0-alpha.21"
   },
   "license": "UNLICENSED",
   "engines": {