@mrgnw/anahtar 0.0.28 → 0.0.29

package/README.md

@@ -1,4 +1,4 @@
-# @mrgnw/anahtar
+# anahtar: incredibly simple & secure auth with passkeys and email+otp fallback
 
 > **Pre-alpha.** API may change between releases.
 
@@ -13,6 +13,12 @@ Auth for SvelteKit. Email+OTP + optional passkeys.
 3. First login -> passkey registration prompt
 4. Future logins -> passkey autofill, OTP fallback
 
+## Roadmap: Proof-of-concept: everything can change
+The goal is simplicity, we will likely stay with passkeys and email+OTP only.
+
+- we may change the implemenation.
+- we will likely split the UI elements from the API, making it easier to run headless, just use the UI, or use both.
+
 ## Quick start
 
 ```sh

package/dist/components/AuthFlow.svelte

@@ -210,6 +210,9 @@ function handlePasskeySkip() {
 					bind:value={email}
 					required
 					autocomplete="username webauthn"
+					autocapitalize="none"
+					autocorrect="off"
+					spellcheck="false"
 					placeholder={m.emailPlaceholder}
 					class="anahtar-input"
 				/>

package/dist/components/AuthPill.svelte

@@ -412,6 +412,9 @@ async function removePasskey(id: string) {
 					placeholder={m.emailPlaceholder}
 					class="anahtar-pill-email-input"
 					autocomplete="username webauthn"
+					autocapitalize="none"
+					autocorrect="off"
+					spellcheck="false"
 					disabled={loading}
 				/>
 			<button type="submit" class="anahtar-pill-go" disabled={loading || !email.includes('@')}>

package/dist/db/d1.js

@@ -1,3 +1,4 @@
+import { normalizeEmail } from '../email.js';
 export function d1Adapter(db, options = {}) {
     const p = options.tablePrefix ?? 'auth_';
     const t = {
@@ -45,8 +46,8 @@ export function d1Adapter(db, options = {}) {
         },
         async getUserByEmail(email) {
             const row = await db
-                .prepare(`SELECT id, email, skip_passkey_prompt, created_at FROM ${t.users} WHERE email = ?`)
-                .bind(email)
+                .prepare(`SELECT id, email, skip_passkey_prompt, created_at FROM ${t.users} WHERE email = ? COLLATE NOCASE`)
+                .bind(normalizeEmail(email))
                 .first();
             if (!row)
                 return null;
@@ -59,10 +60,11 @@ export function d1Adapter(db, options = {}) {
         },
         async createUser(email) {
             const id = crypto.randomUUID();
-            await db.prepare(`INSERT INTO ${t.users} (id, email) VALUES (?, ?)`).bind(id, email).run();
+            const normalized = normalizeEmail(email);
+            await db.prepare(`INSERT INTO ${t.users} (id, email) VALUES (?, ?)`).bind(id, normalized).run();
             return {
                 id,
-                email,
+                email: normalized,
                 skipPasskeyPrompt: false,
                 createdAt: Math.floor(Date.now() / 1000)
             };
@@ -102,13 +104,13 @@ export function d1Adapter(db, options = {}) {
         async storeOTP(email, id, code, expiresAt) {
             await db
                 .prepare(`INSERT INTO ${t.otpCodes} (id, email, code, expires_at) VALUES (?, ?, ?, ?)`)
-                .bind(id, email, code, expiresAt)
+                .bind(id, normalizeEmail(email), code, expiresAt)
                 .run();
         },
         async getLatestOTP(email) {
             const row = await db
-                .prepare(`SELECT id, email, code, attempts, expires_at FROM ${t.otpCodes} WHERE email = ? ORDER BY created_at DESC LIMIT 1`)
-                .bind(email)
+                .prepare(`SELECT id, email, code, attempts, expires_at FROM ${t.otpCodes} WHERE email = ? COLLATE NOCASE ORDER BY created_at DESC LIMIT 1`)
+                .bind(normalizeEmail(email))
                 .first();
             if (!row)
                 return null;
@@ -127,7 +129,7 @@ export function d1Adapter(db, options = {}) {
             await db.prepare(`DELETE FROM ${t.otpCodes} WHERE id = ?`).bind(id).run();
         },
         async deleteOTPsForEmail(email) {
-            await db.prepare(`DELETE FROM ${t.otpCodes} WHERE email = ?`).bind(email).run();
+            await db.prepare(`DELETE FROM ${t.otpCodes} WHERE email = ? COLLATE NOCASE`).bind(normalizeEmail(email)).run();
         },
         async storeChallenge(challenge, userId, expiresAt) {
             await db.prepare(`DELETE FROM ${t.challenges} WHERE expires_at < ?`).bind(Date.now()).run();

package/dist/db/postgres.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { normalizeEmail } from '../email.js';
 export function postgresAdapter(pool, options = {}) {
     const p = options.tablePrefix ?? 'auth_';
     const t = {
@@ -58,7 +59,7 @@ export function postgresAdapter(pool, options = {}) {
 			`);
         },
         async getUserByEmail(email) {
-            const row = await queryOne(`SELECT id, email, skip_passkey_prompt, created_at FROM ${t.users} WHERE email = $1`, [email]);
+            const row = await queryOne(`SELECT id, email, skip_passkey_prompt, created_at FROM ${t.users} WHERE LOWER(email) = $1`, [normalizeEmail(email)]);
             if (!row)
                 return null;
             return {
@@ -70,10 +71,11 @@ export function postgresAdapter(pool, options = {}) {
         },
         async createUser(email) {
             const id = randomUUID();
-            await pool.query(`INSERT INTO ${t.users} (id, email) VALUES ($1, $2)`, [id, email]);
+            const normalized = normalizeEmail(email);
+            await pool.query(`INSERT INTO ${t.users} (id, email) VALUES ($1, $2)`, [id, normalized]);
             return {
                 id,
-                email,
+                email: normalized,
                 skipPasskeyPrompt: false,
                 createdAt: Date.now()
             };
@@ -108,13 +110,13 @@ export function postgresAdapter(pool, options = {}) {
         async storeOTP(email, id, code, expiresAt) {
             await pool.query(`INSERT INTO ${t.otpCodes} (id, email, code, expires_at) VALUES ($1, $2, $3, $4)`, [
                 id,
-                email,
+                normalizeEmail(email),
                 code,
                 expiresAt
             ]);
         },
         async getLatestOTP(email) {
-            const row = await queryOne(`SELECT id, email, code, attempts, expires_at FROM ${t.otpCodes} WHERE email = $1 ORDER BY created_at DESC LIMIT 1`, [email]);
+            const row = await queryOne(`SELECT id, email, code, attempts, expires_at FROM ${t.otpCodes} WHERE LOWER(email) = $1 ORDER BY created_at DESC LIMIT 1`, [normalizeEmail(email)]);
             if (!row)
                 return null;
             return {
@@ -132,7 +134,7 @@ export function postgresAdapter(pool, options = {}) {
             await pool.query(`DELETE FROM ${t.otpCodes} WHERE id = $1`, [id]);
         },
         async deleteOTPsForEmail(email) {
-            await pool.query(`DELETE FROM ${t.otpCodes} WHERE email = $1`, [email]);
+            await pool.query(`DELETE FROM ${t.otpCodes} WHERE LOWER(email) = $1`, [normalizeEmail(email)]);
         },
         async storeChallenge(challenge, userId, expiresAt) {
             await pool.query(`DELETE FROM ${t.challenges} WHERE expires_at < $1`, [Date.now()]);

package/dist/db/sqlite.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { normalizeEmail } from '../email.js';
 export function sqliteAdapter(db, options = {}) {
     const p = options.tablePrefix ?? 'auth_';
     const t = {
@@ -53,8 +54,8 @@ export function sqliteAdapter(db, options = {}) {
         },
         getUserByEmail(email) {
             const row = db
-                .prepare(`SELECT id, email, skip_passkey_prompt, created_at FROM ${t.users} WHERE email = ?`)
-                .get(email);
+                .prepare(`SELECT id, email, skip_passkey_prompt, created_at FROM ${t.users} WHERE email = ? COLLATE NOCASE`)
+                .get(normalizeEmail(email));
             if (!row)
                 return null;
             return {
@@ -66,10 +67,11 @@ export function sqliteAdapter(db, options = {}) {
         },
         createUser(email) {
             const id = randomUUID();
-            db.prepare(`INSERT INTO ${t.users} (id, email) VALUES (?, ?)`).run(id, email);
+            const normalized = normalizeEmail(email);
+            db.prepare(`INSERT INTO ${t.users} (id, email) VALUES (?, ?)`).run(id, normalized);
             return {
                 id,
-                email,
+                email: normalized,
                 skipPasskeyPrompt: false,
                 createdAt: Math.floor(Date.now() / 1000)
             };
@@ -100,12 +102,12 @@ export function sqliteAdapter(db, options = {}) {
             db.prepare(`DELETE FROM ${t.sessions} WHERE id = ?`).run(tokenHash);
         },
         storeOTP(email, id, code, expiresAt) {
-            db.prepare(`INSERT INTO ${t.otpCodes} (id, email, code, expires_at) VALUES (?, ?, ?, ?)`).run(id, email, code, expiresAt);
+            db.prepare(`INSERT INTO ${t.otpCodes} (id, email, code, expires_at) VALUES (?, ?, ?, ?)`).run(id, normalizeEmail(email), code, expiresAt);
         },
         getLatestOTP(email) {
             const row = db
-                .prepare(`SELECT id, email, code, attempts, expires_at FROM ${t.otpCodes} WHERE email = ? ORDER BY created_at DESC LIMIT 1`)
-                .get(email);
+                .prepare(`SELECT id, email, code, attempts, expires_at FROM ${t.otpCodes} WHERE email = ? COLLATE NOCASE ORDER BY created_at DESC LIMIT 1`)
+                .get(normalizeEmail(email));
             if (!row)
                 return null;
             return {
@@ -123,7 +125,7 @@ export function sqliteAdapter(db, options = {}) {
             db.prepare(`DELETE FROM ${t.otpCodes} WHERE id = ?`).run(id);
         },
         deleteOTPsForEmail(email) {
-            db.prepare(`DELETE FROM ${t.otpCodes} WHERE email = ?`).run(email);
+            db.prepare(`DELETE FROM ${t.otpCodes} WHERE email = ? COLLATE NOCASE`).run(normalizeEmail(email));
         },
         storeChallenge(challenge, userId, expiresAt) {
             db.prepare(`DELETE FROM ${t.challenges} WHERE expires_at < ?`).run(Date.now());

package/dist/email.d.ts

@@ -0,0 +1 @@
+export declare function normalizeEmail(email: string): string;

package/dist/email.js

@@ -0,0 +1,6 @@
+// Email is the user's identity key. Normalize it to one canonical form so the
+// same address always maps to a single account regardless of how it was typed
+// (mobile keyboards auto-capitalize, users add stray whitespace, etc.).
+export function normalizeEmail(email) {
+    return email.trim().toLowerCase();
+}

package/dist/passkey.js

@@ -121,13 +121,25 @@ export async function generateAuthenticationChallenge(db, requestUrl, config) {
 }
 export async function verifyAuthenticationResponse(db, response, requestUrl, config) {
     const { rpID, origin } = getWebAuthnConfig(requestUrl, config);
+    const idHint = `${response.id.slice(0, 8)}…`;
     const passkey = await db.getPasskeyByCredentialId(response.id);
-    if (!passkey)
+    if (!passkey) {
+        console.warn(`[anahtar login-finish] no stored passkey for credentialId=${idHint} (rpID=${rpID})`);
         return null;
-    const challenge = JSON.parse(Buffer.from(response.response.clientDataJSON, "base64url").toString()).challenge;
+    }
+    let challenge;
+    try {
+        challenge = JSON.parse(Buffer.from(response.response.clientDataJSON, "base64url").toString()).challenge;
+    }
+    catch (e) {
+        console.warn(`[anahtar login-finish] clientDataJSON parse failed: ${e}`);
+        return null;
+    }
     const stored = await db.consumeChallenge(challenge);
-    if (!stored)
+    if (!stored) {
+        console.warn(`[anahtar login-finish] challenge not found or expired (credentialId=${idHint})`);
         return null;
+    }
     try {
         const verification = await verifyAuthResponse({
             response,
@@ -144,14 +156,17 @@ export async function verifyAuthenticationResponse(db, response, requestUrl, con
                     : undefined,
             },
         });
-        if (!verification.verified)
+        if (!verification.verified) {
+            console.warn(`[anahtar login-finish] not verified (credentialId=${idHint}, expectedRPID=${rpID}, expectedOrigin=${origin})`);
             return null;
+        }
         await db.updatePasskeyCounter(passkey.id, verification.authenticationInfo.newCounter);
         return {
             user: { id: passkey.userId, email: passkey.email },
         };
     }
-    catch {
+    catch (e) {
+        console.warn(`[anahtar login-finish] verification threw (credentialId=${idHint}, expectedRPID=${rpID}, expectedOrigin=${origin}): ${e}`);
         return null;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrgnw/anahtar",
-  "version": "0.0.28",
+  "version": "0.0.29",
   "description": "Opinionated, reusable auth for SvelteKit. Email+OTP + passkeys.",
   "license": "MIT",
   "type": "module",
@@ -12,6 +12,14 @@
     "registry": "https://registry.npmjs.org/",
     "access": "public"
   },
+  "scripts": {
+    "build": "svelte-package",
+    "check": "svelte-check --tsconfig ./tsconfig.json",
+    "test": "vitest run --config vitest.unit.ts && vitest run --config vitest.browser.ts",
+    "test:unit": "vitest run --config vitest.unit.ts",
+    "test:browser": "vitest run --config vitest.browser.ts",
+    "prepublishOnly": "pnpm build"
+  },
   "svelte": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -56,10 +64,16 @@
     }
   },
   "dependencies": {
+    "@mrgnw/anahtar": "0.0.29-diagnostic.0",
     "@oslojs/crypto": "^1.0.1",
     "@oslojs/encoding": "^1.1.0",
     "@simplewebauthn/server": "^13.2.2"
   },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "better-sqlite3"
+    ]
+  },
   "devDependencies": {
     "@simplewebauthn/browser": "^13.2.2",
     "@sveltejs/kit": "^2.31.1",
@@ -75,12 +89,5 @@
     "svelte-check": "^4.3.1",
     "typescript": "^5.9.2",
     "vitest": "^3.2.1"
-  },
-  "scripts": {
-    "build": "svelte-package",
-    "check": "svelte-check --tsconfig ./tsconfig.json",
-    "test": "vitest run --config vitest.unit.ts && vitest run --config vitest.browser.ts",
-    "test:unit": "vitest run --config vitest.unit.ts",
-    "test:browser": "vitest run --config vitest.browser.ts"
   }
-}
+}