@nabhiraj/nab-auth 0.1.0 → 0.1.1

package/README.md

@@ -1,12 +1,23 @@
-# Nab Authentication
+# nab-auth
 
-Configurable authentication for Express applications using MongoDB, Argon2id,
-and RS256 JWTs. It includes registration, password login, refresh tokens,
-roles, optional registration verification, and optional two-factor
-authentication.
+[![license](https://img.shields.io/npm/l/@nabhiraj/nab-auth.svg)](LICENSE)
+
+Configurable authentication for Express and MongoDB. `nab-auth` provides
+Argon2id password hashing, RS256 JWTs, refresh-token rotation, roles,
+registration verification, and optional two-factor authentication.
 
 The library does not load environment variables or send email/SMS itself. The
-application using it owns both configuration and code delivery.
+host application owns configuration and code delivery.
+
+## Features
+
+- Email/password registration and login with Argon2id password hashes
+- Short-lived RS256 access tokens and rotating refresh-token cookies
+- Public-key rotation using JWT `kid` headers
+- Role claims and administrator-protected role management
+- Optional registration-code verification and two-factor authentication
+- MongoDB/Atlas storage with unique and TTL indexes created automatically
+- Verifier-only mode for services that only need to validate access tokens
 
 ## Requirements
 
@@ -21,17 +32,14 @@ unusual platforms may need standard Node.js native build tools.
 ## Installation
 
 ```bash
-npm install @nabhiraj/nab-authentication express
+npm install @nabhiraj/nab-auth express
 ```
 
-Replace `@nabhiraj` if you publish the package under another npm scope.
-
 ## Quick start
 
 ```js
-import "dotenv/config";
 import express from "express";
-import { createAuthenticationLibrary } from "@nabhiraj/nab-authentication";
+import { createAuthenticationLibrary } from "@nabhiraj/nab-auth";
 
 const app = express();
 app.use(express.json());
@@ -78,14 +86,18 @@ await auth.connectToDatabase();
 app.listen(3000);
 ```
 
-## Public API
+`sendEmail` is an application function you provide. Configure a code-delivery
+callback only when registration verification or two-factor authentication is
+enabled.
+
+## Core API
 
 ```js
 import {
   createAuthenticationLibrary,
   createFileJwtKeyProvider,
   defaultAuthConfig
-} from "@nabhiraj/nab-authentication";
+} from "@nabhiraj/nab-auth";
 ```
 
 `createAuthenticationLibrary(config)` creates isolated state: its MongoDB
@@ -268,7 +280,7 @@ const auth = createAuthenticationLibrary({
 
 When `jwt.keyProvider` is supplied, the file paths are not used.
 
-## Routes
+## HTTP API
 
 Assume the router is mounted at `/auth`.
 
@@ -288,7 +300,7 @@ Access tokens include the application payload and access-token metadata.
 Refresh tokens contain only the subject and required token metadata, not the
 complete application payload.
 
-## MongoDB documents
+## Data stored in MongoDB
 
 The users collection contains documents like:
 
@@ -328,7 +340,7 @@ app.get("/api/business-data", auth.requireJwt, (req, res) => {
 app.use(auth.jwtErrorHandler);
 ```
 
-## Security notes
+## Production checklist
 
 - Use HTTPS and `refreshCookie.secure: true` in production.
 - Set `codeDelivery.allowCodeInResponseWithoutSender: false` in production.
@@ -339,65 +351,12 @@ app.use(auth.jwtErrorHandler);
 - Configure CORS and cookie `sameSite` settings for your frontend topology.
 - Retain old public keys until tokens signed by them expire.
 
-## Development and testing
-
-```bash
-npm install
-npm test
-```
-
-The demo servers in `src/server.js` and `src/server2.js` are intentionally not
-published in the npm package. If you run those examples from this repository,
-install and load their example-only dependencies separately.
-
-Run automated tests:
-
-```bash
-npm test
-```
-
-Before publishing, inspect the exact package contents:
-
-```bash
-npm run pack-check
-```
-
-Test the generated archive from a separate consumer project:
-
-```bash
-npm pack
-mkdir ../auth-package-consumer
-cd ../auth-package-consumer
-npm init -y
-npm install ../nab_authenticate/nabhiraj-nab-authentication-0.1.0.tgz express
-```
-
-Create a small Express app there and verify import, database connection,
-router creation, and JWT verification.
-
-## Publishing
-
-1. Create an npm account and check that the package name is available.
-2. Run `npm test` and `npm run pack-check`.
-3. Confirm that `.env`, key files, and demo applications are not in the pack
-   listing.
-4. Authenticate with `npm login`.
-5. Publish:
-
-```bash
-npm publish
-```
-
-For later releases:
-
-```bash
-npm version patch   # 0.1.0 -> 0.1.1
-npm version minor   # 0.1.0 -> 0.2.0
-npm version major   # 0.1.0 -> 1.0.0
-npm publish
-```
+## Support and contributing
 
-The package is pre-1.0.0, so document any breaking public API changes.
+Source code, bug reports, and feature requests are managed in the
+[GitLab project](https://gitlab.com/platforms8851042/nab_authenticate).
+Please use [GitLab Issues](https://gitlab.com/platforms8851042/nab_authenticate/-/issues)
+for reproducible bugs and feature proposals.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nabhiraj/nab-auth",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Configurable Express, MongoDB, JWT, registration verification, and 2FA authentication library",
   "type": "module",
   "main": "./src/authenticationLogic/index.js",