@nuraly/lumenjs 0.1.3 → 0.2.0

package/dist/auth/providers/google.js

@@ -0,0 +1,25 @@
+/**
+ * Pre-configured Google OIDC provider.
+ *
+ * Google publishes a standard OIDC discovery document at
+ * https://accounts.google.com/.well-known/openid-configuration
+ * so no manual endpoint config is needed.
+ *
+ * @example
+ * // lumenjs.auth.ts
+ * import { googleProvider } from '@nuraly/lumenjs/dist/auth/providers/google.js';
+ * export default {
+ *   providers: [googleProvider({ clientId: process.env.GOOGLE_CLIENT_ID! })],
+ *   session: { secret: process.env.SESSION_SECRET! },
+ * };
+ */
+export function googleProvider(opts) {
+    return {
+        type: 'oidc',
+        name: 'google',
+        issuer: 'https://accounts.google.com',
+        clientId: opts.clientId,
+        clientSecret: opts.clientSecret,
+        scopes: ['openid', 'profile', 'email', ...(opts.scopes ?? [])],
+    };
+}

package/dist/auth/providers/index.d.ts

@@ -0,0 +1,2 @@
+export { googleProvider } from './google.js';
+export type { GoogleProviderOptions } from './google.js';

package/dist/auth/providers/index.js

@@ -0,0 +1 @@
+export { googleProvider } from './google.js';

package/dist/auth/routes/login.d.ts

@@ -0,0 +1,8 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { ResolvedAuthConfig } from '../types.js';
+/**
+ * Handle OIDC login — redirect to provider's authorization endpoint.
+ * Returns true if handled, false if no OIDC provider found (caller should fall through).
+ */
+export declare function handleOidcLogin(config: ResolvedAuthConfig, res: ServerResponse, url: URL, providerName: string | undefined): Promise<boolean>;
+export declare function handleNativeLogin(config: ResolvedAuthConfig, req: IncomingMessage, res: ServerResponse, url: URL, db?: any): Promise<boolean>;

package/dist/auth/routes/login.js

@@ -0,0 +1,121 @@
+import crypto from 'node:crypto';
+import { getOidcProvider, hasNativeAuth, getNativeProvider } from '../config.js';
+import { discoverProvider, buildAuthorizationUrl, generateCodeVerifier, } from '../oidc-client.js';
+import { encryptSession, createSessionCookie, } from '../session.js';
+import { sendJson, readBody, isTokenMode, safeReturnTo } from './utils.js';
+/**
+ * Handle OIDC login — redirect to provider's authorization endpoint.
+ * Returns true if handled, false if no OIDC provider found (caller should fall through).
+ */
+export async function handleOidcLogin(config, res, url, providerName) {
+    const oidc = providerName
+        ? config.providers.find(p => p.type === 'oidc' && p.name === providerName)
+        : getOidcProvider(config);
+    if (!oidc) {
+        // No OIDC provider — return available methods as JSON
+        sendJson(res, 200, {
+            providers: config.providers.map(p => ({ type: p.type, name: p.name })),
+            nativeLogin: `${config.routes.login} (POST)`,
+            signup: hasNativeAuth(config) ? config.routes.signup : undefined,
+        });
+        return true;
+    }
+    const metadata = await discoverProvider(oidc.issuer);
+    const state = crypto.randomBytes(16).toString('hex');
+    const codeVerifier = generateCodeVerifier();
+    const returnTo = safeReturnTo(url.searchParams.get('returnTo'), config.routes.postLogin);
+    const redirectUri = `${url.origin}${config.routes.callback}`;
+    // Store PKCE state in short-lived encrypted cookie
+    const stateData = JSON.stringify({ state, codeVerifier, returnTo, provider: oidc.name });
+    const encrypted = await encryptSession({ accessToken: stateData, expiresAt: Math.floor(Date.now() / 1000) + 600, user: { sub: '', roles: [] } }, config.session.secret);
+    const stateCookie = createSessionCookie('nk-auth-state', encrypted, 600, config.session.secure);
+    const authUrl = buildAuthorizationUrl(metadata, oidc.clientId, redirectUri, oidc.scopes || ['openid', 'profile', 'email'], state, codeVerifier);
+    res.writeHead(302, { Location: authUrl, 'Set-Cookie': stateCookie });
+    res.end();
+    return true;
+}
+export async function handleNativeLogin(config, req, res, url, db) {
+    const nativeProvider = getNativeProvider(config);
+    if (!nativeProvider || !db) {
+        sendJson(res, 400, { error: 'Native auth not configured' });
+        return true;
+    }
+    let body;
+    try {
+        body = JSON.parse(await readBody(req));
+    }
+    catch {
+        sendJson(res, 400, { error: 'Invalid JSON body' });
+        return true;
+    }
+    const { email, password } = body;
+    if (!email || !password) {
+        sendJson(res, 400, { error: 'Email and password required' });
+        return true;
+    }
+    const { authenticateUser, isEmailVerified, getTotpState } = await import('../native-auth.js');
+    const user = await authenticateUser(db, email, password);
+    if (!user) {
+        sendJson(res, 401, { error: 'Invalid credentials' });
+        return true;
+    }
+    // Check email verification if required
+    if (nativeProvider.requireEmailVerification && !await isEmailVerified(db, user.sub)) {
+        sendJson(res, 403, { error: 'Please verify your email before signing in', code: 'EMAIL_NOT_VERIFIED' });
+        return true;
+    }
+    // Check TOTP — if enabled, issue a short-lived pending cookie instead of a full session
+    const totpState = await getTotpState(db, user.sub);
+    if (totpState.totpEnabled) {
+        const pendingData = {
+            accessToken: `totp-pending:${user.sub}`,
+            expiresAt: Math.floor(Date.now() / 1000) + 300,
+            user: { sub: user.sub, roles: [] },
+            provider: 'native',
+            createdAt: Math.floor(Date.now() / 1000),
+        };
+        const pendingEncrypted = await encryptSession(pendingData, config.session.secret);
+        const pendingCookie = createSessionCookie('nk-totp-pending', pendingEncrypted, 300, config.session.secure);
+        const returnTo = safeReturnTo(url.searchParams.get('returnTo'), config.routes.postLogin);
+        if (req.headers.accept?.includes('application/json')) {
+            res.writeHead(200, { 'Content-Type': 'application/json', 'Set-Cookie': pendingCookie });
+            res.end(JSON.stringify({ requires2fa: true, returnTo }));
+        }
+        else {
+            res.writeHead(302, { Location: `/auth/totp-challenge?returnTo=${encodeURIComponent(returnTo)}`, 'Set-Cookie': pendingCookie });
+            res.end();
+        }
+        return true;
+    }
+    // Create session — same as OIDC callback
+    const sessionData = {
+        accessToken: `native:${user.sub}`,
+        expiresAt: Math.floor(Date.now() / 1000) + config.session.maxAge,
+        user,
+        provider: 'native',
+        createdAt: Math.floor(Date.now() / 1000),
+    };
+    const encrypted = await encryptSession(sessionData, config.session.secret);
+    const cookie = createSessionCookie(config.session.cookieName, encrypted, config.session.maxAge, config.session.secure);
+    const returnTo = safeReturnTo(url.searchParams.get('returnTo'), config.routes.postLogin);
+    // Token mode: return bearer tokens instead of cookie
+    if (isTokenMode(url, req) && config.token.enabled) {
+        const { issueAccessToken, generateRefreshToken, storeRefreshToken, ensureRefreshTokenTable } = await import('../token.js');
+        await ensureRefreshTokenTable(db);
+        const accessToken = issueAccessToken(user, config.session.secret, config.token.accessTokenTTL);
+        const refreshToken = generateRefreshToken();
+        await storeRefreshToken(db, refreshToken, user.sub, config.token.refreshTokenTTL);
+        sendJson(res, 200, { accessToken, refreshToken, expiresIn: config.token.accessTokenTTL, tokenType: 'Bearer', user });
+        return true;
+    }
+    // Cookie mode: set session cookie
+    if (req.headers.accept?.includes('application/json')) {
+        res.writeHead(200, { 'Content-Type': 'application/json', 'Set-Cookie': cookie });
+        res.end(JSON.stringify({ user, returnTo }));
+    }
+    else {
+        res.writeHead(302, { Location: returnTo, 'Set-Cookie': cookie });
+        res.end();
+    }
+    return true;
+}

package/dist/auth/routes/logout.d.ts

@@ -0,0 +1,4 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { ResolvedAuthConfig } from '../types.js';
+export declare function handleLogout(config: ResolvedAuthConfig, req: IncomingMessage, res: ServerResponse, url: URL, db?: any): Promise<boolean>;
+export declare function handleLogoutAll(config: ResolvedAuthConfig, req: IncomingMessage, res: ServerResponse, db?: any): Promise<boolean>;

package/dist/auth/routes/logout.js

@@ -0,0 +1,79 @@
+import { discoverProvider } from '../oidc-client.js';
+import { clearSessionCookie, parseSessionCookie, decryptSession, } from '../session.js';
+import { sendJson } from './utils.js';
+export async function handleLogout(config, req, res, url, db) {
+    const clearCookie = clearSessionCookie(config.session.cookieName);
+    // Check if this was an OIDC session — redirect to provider's end_session_endpoint
+    let idToken;
+    let providerName;
+    const cookieHeader = req.headers.cookie || '';
+    const sessionCookie = parseSessionCookie(cookieHeader, config.session.cookieName);
+    if (sessionCookie) {
+        const session = await decryptSession(sessionCookie, config.session.secret);
+        idToken = session?.idToken || undefined;
+        providerName = session?.provider;
+        // Invalidate refresh tokens for this user if DB is available
+        if (db && session?.user?.sub) {
+            try {
+                const { deleteAllRefreshTokens, ensureRefreshTokenTable } = await import('../token.js');
+                ensureRefreshTokenTable(db);
+                deleteAllRefreshTokens(db, session.user.sub);
+            }
+            catch { }
+        }
+    }
+    let redirectUrl = config.routes.postLogout;
+    // If OIDC session, try provider logout
+    if (providerName && idToken) {
+        const oidc = config.providers.find(p => p.type === 'oidc' && p.name === providerName);
+        if (oidc) {
+            try {
+                const metadata = await discoverProvider(oidc.issuer);
+                if (metadata.end_session_endpoint) {
+                    const params = new URLSearchParams({
+                        id_token_hint: idToken,
+                        post_logout_redirect_uri: `${url.origin}${config.routes.postLogout}`,
+                    });
+                    redirectUrl = `${metadata.end_session_endpoint}?${params}`;
+                }
+            }
+            catch { }
+        }
+    }
+    res.writeHead(302, { Location: redirectUrl, 'Set-Cookie': clearCookie });
+    res.end();
+    return true;
+}
+export async function handleLogoutAll(config, req, res, db) {
+    const user = req.nkAuth?.user;
+    if (!user) {
+        sendJson(res, 401, { error: 'Authentication required' });
+        return true;
+    }
+    if (!db) {
+        sendJson(res, 400, { error: 'Native auth not configured' });
+        return true;
+    }
+    // Set sessions_revoked_at — any session created before this timestamp is invalid
+    const { revokeAllSessions, ensureUsersTable } = await import('../native-auth.js');
+    ensureUsersTable(db);
+    revokeAllSessions(db, user.sub);
+    // Delete all refresh tokens (mobile/API sessions)
+    try {
+        const { deleteAllRefreshTokens, ensureRefreshTokenTable } = await import('../token.js');
+        ensureRefreshTokenTable(db);
+        deleteAllRefreshTokens(db, user.sub);
+    }
+    catch { }
+    // Clear current session cookie
+    const clearCookie = clearSessionCookie(config.session.cookieName);
+    if (req.headers.accept?.includes('application/json')) {
+        res.writeHead(200, { 'Content-Type': 'application/json', 'Set-Cookie': clearCookie });
+        res.end(JSON.stringify({ ok: true, message: 'All sessions have been signed out' }));
+    }
+    else {
+        res.writeHead(302, { Location: config.routes.postLogout, 'Set-Cookie': clearCookie });
+        res.end();
+    }
+    return true;
+}

package/dist/auth/routes/oidc-callback.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { ResolvedAuthConfig } from '../types.js';
+export declare function handleOidcCallback(config: ResolvedAuthConfig, req: IncomingMessage, res: ServerResponse, url: URL, db?: any): Promise<boolean>;

package/dist/auth/routes/oidc-callback.js

@@ -0,0 +1,70 @@
+import { getOidcProvider, hasNativeAuth } from '../config.js';
+import { discoverProvider, exchangeCode, extractUser, validateIdTokenClaims, decodeJwtPayload, } from '../oidc-client.js';
+import { encryptSession, createSessionCookie, clearSessionCookie, parseSessionCookie, decryptSession, } from '../session.js';
+import { sendJson, safeReturnTo } from './utils.js';
+export async function handleOidcCallback(config, req, res, url, db) {
+    const code = url.searchParams.get('code');
+    const stateParam = url.searchParams.get('state');
+    if (!code || !stateParam) {
+        sendJson(res, 400, { error: 'Missing code or state' });
+        return true;
+    }
+    const cookieHeader = req.headers.cookie || '';
+    const stateCookie = parseSessionCookie(cookieHeader, 'nk-auth-state');
+    if (!stateCookie) {
+        sendJson(res, 400, { error: 'Missing state cookie' });
+        return true;
+    }
+    const stateSession = await decryptSession(stateCookie, config.session.secret);
+    if (!stateSession) {
+        sendJson(res, 400, { error: 'Invalid state cookie' });
+        return true;
+    }
+    const { state, codeVerifier, returnTo, provider: providerName } = JSON.parse(stateSession.accessToken);
+    if (state !== stateParam) {
+        sendJson(res, 400, { error: 'State mismatch' });
+        return true;
+    }
+    // Find the OIDC provider that initiated this flow
+    const oidc = (providerName
+        ? config.providers.find(p => p.type === 'oidc' && p.name === providerName)
+        : getOidcProvider(config));
+    if (!oidc) {
+        sendJson(res, 400, { error: 'Unknown OIDC provider' });
+        return true;
+    }
+    const metadata = await discoverProvider(oidc.issuer);
+    const redirectUri = `${url.origin}${config.routes.callback}`;
+    const tokens = await exchangeCode(metadata, oidc.clientId, oidc.clientSecret, code, redirectUri, codeVerifier);
+    // Validate ID token claims (iss, aud, exp) before trusting
+    if (tokens.id_token) {
+        const claims = decodeJwtPayload(tokens.id_token);
+        validateIdTokenClaims(claims, oidc.issuer, oidc.clientId);
+    }
+    let user = extractUser(tokens.id_token || tokens.access_token);
+    user.provider = oidc.name;
+    // Account linking: if native auth is also configured, link by email
+    if (db && hasNativeAuth(config) && user.email) {
+        try {
+            const { linkOidcUser, ensureUsersTable } = await import('../native-auth.js');
+            await ensureUsersTable(db);
+            user = await linkOidcUser(db, user);
+        }
+        catch { }
+    }
+    const sessionData = {
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        idToken: tokens.id_token,
+        expiresAt: Math.floor(Date.now() / 1000) + tokens.expires_in,
+        user,
+        provider: oidc.name,
+        createdAt: Math.floor(Date.now() / 1000),
+    };
+    const encrypted = await encryptSession(sessionData, config.session.secret);
+    const sessionCookie = createSessionCookie(config.session.cookieName, encrypted, config.session.maxAge, config.session.secure);
+    const clearState = clearSessionCookie('nk-auth-state');
+    res.writeHead(302, { Location: safeReturnTo(returnTo, '/'), 'Set-Cookie': [sessionCookie, clearState] });
+    res.end();
+    return true;
+}

package/dist/auth/routes/password.d.ts

@@ -0,0 +1,5 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { ResolvedAuthConfig } from '../types.js';
+export declare function handleForgotPassword(config: ResolvedAuthConfig, req: IncomingMessage, res: ServerResponse, db?: any): Promise<boolean>;
+export declare function handleResetPassword(config: ResolvedAuthConfig, req: IncomingMessage, res: ServerResponse, db?: any): Promise<boolean>;
+export declare function handleChangePassword(config: ResolvedAuthConfig, req: IncomingMessage, res: ServerResponse, db?: any): Promise<boolean>;

package/dist/auth/routes/password.js

@@ -0,0 +1,149 @@
+import { getNativeProvider } from '../config.js';
+import { sendJson, readBody } from './utils.js';
+export async function handleForgotPassword(config, req, res, db) {
+    if (!db) {
+        sendJson(res, 400, { error: 'Native auth not configured' });
+        return true;
+    }
+    let body;
+    try {
+        body = JSON.parse(await readBody(req));
+    }
+    catch {
+        sendJson(res, 400, { error: 'Invalid JSON body' });
+        return true;
+    }
+    const { email } = body;
+    if (!email) {
+        sendJson(res, 400, { error: 'Email required' });
+        return true;
+    }
+    const { findUserIdByEmail, generateResetToken } = await import('../native-auth.js');
+    const userId = await findUserIdByEmail(db, email);
+    // Always return success (don't reveal if email exists)
+    if (userId && config.onEvent) {
+        const userRow = await db.get('SELECT password_hash FROM _nk_auth_users WHERE id = ?', userId);
+        const token = generateResetToken(userId, config.session.secret, 3600, userRow?.password_hash);
+        const origin = `${req.headers['x-forwarded-proto'] || 'http'}://${req.headers.host}`;
+        const resetUrl = `${origin}/__nk_auth/reset-password?token=${encodeURIComponent(token)}`;
+        try {
+            await config.onEvent({ type: 'password-reset', email, token, url: resetUrl });
+        }
+        catch { }
+    }
+    sendJson(res, 200, { message: 'If an account with that email exists, a password reset link has been sent.' });
+    return true;
+}
+export async function handleResetPassword(config, req, res, db) {
+    if (!db) {
+        sendJson(res, 400, { error: 'Native auth not configured' });
+        return true;
+    }
+    let body;
+    try {
+        body = JSON.parse(await readBody(req));
+    }
+    catch {
+        sendJson(res, 400, { error: 'Invalid JSON body' });
+        return true;
+    }
+    const { token, password } = body;
+    if (!token || !password) {
+        sendJson(res, 400, { error: 'Token and password required' });
+        return true;
+    }
+    const { verifyResetToken, updatePassword, decodeResetTokenUserId } = await import('../native-auth.js');
+    // First, decode the userId from the token payload (without full verification)
+    // so we can look up the current password hash for single-use validation
+    const candidateUserId = decodeResetTokenUserId(token);
+    let currentHash;
+    if (candidateUserId) {
+        const userRow = await db.get('SELECT password_hash FROM _nk_auth_users WHERE id = ?', candidateUserId);
+        currentHash = userRow?.password_hash;
+    }
+    const userId = verifyResetToken(token, config.session.secret, currentHash);
+    if (!userId) {
+        sendJson(res, 400, { error: 'Invalid or expired reset link' });
+        return true;
+    }
+    const nativeProvider = getNativeProvider(config);
+    const minLength = nativeProvider?.minPasswordLength ?? 8;
+    try {
+        await updatePassword(db, userId, password, minLength);
+    }
+    catch (err) {
+        sendJson(res, 400, { error: err.message });
+        return true;
+    }
+    // Notify via event hook
+    const row = await db.get('SELECT email FROM _nk_auth_users WHERE id = ?', userId);
+    if (row && config.onEvent) {
+        try {
+            await config.onEvent({ type: 'password-changed', email: row.email, userId });
+        }
+        catch { }
+    }
+    sendJson(res, 200, { message: 'Password has been reset. You can now sign in.' });
+    return true;
+}
+export async function handleChangePassword(config, req, res, db) {
+    const user = req.nkAuth?.user;
+    if (!user) {
+        sendJson(res, 401, { error: 'Authentication required' });
+        return true;
+    }
+    if (!db) {
+        sendJson(res, 400, { error: 'Native auth not configured' });
+        return true;
+    }
+    let body;
+    try {
+        body = JSON.parse(await readBody(req));
+    }
+    catch {
+        sendJson(res, 400, { error: 'Invalid JSON body' });
+        return true;
+    }
+    const { currentPassword, newPassword } = body;
+    if (!currentPassword || !newPassword) {
+        sendJson(res, 400, { error: 'Current password and new password required' });
+        return true;
+    }
+    const { verifyPassword, updatePassword } = await import('../native-auth.js');
+    const row = await db.get('SELECT password_hash FROM _nk_auth_users WHERE id = ?', user.sub);
+    if (!row) {
+        sendJson(res, 404, { error: 'User not found' });
+        return true;
+    }
+    const valid = await verifyPassword(currentPassword, row.password_hash);
+    if (!valid) {
+        sendJson(res, 401, { error: 'Current password is incorrect' });
+        return true;
+    }
+    const nativeProvider = getNativeProvider(config);
+    const minLength = nativeProvider?.minPasswordLength ?? 8;
+    try {
+        await updatePassword(db, user.sub, newPassword, minLength);
+    }
+    catch (err) {
+        sendJson(res, 400, { error: err.message });
+        return true;
+    }
+    // Invalidate all other sessions and refresh tokens after password change
+    try {
+        const { revokeAllSessions } = await import('../native-auth.js');
+        await revokeAllSessions(db, user.sub);
+        const { deleteAllRefreshTokens, ensureRefreshTokenTable } = await import('../token.js');
+        await ensureRefreshTokenTable(db);
+        await deleteAllRefreshTokens(db, user.sub);
+    }
+    catch { }
+    if (config.onEvent) {
+        try {
+            await config.onEvent({ type: 'password-changed', email: user.email, userId: user.sub });
+        }
+        catch { }
+    }
+    sendJson(res, 200, { message: 'Password updated successfully' });
+    return true;
+}

package/dist/auth/routes/signup.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { ResolvedAuthConfig } from '../types.js';
+export declare function handleNativeSignup(config: ResolvedAuthConfig, req: IncomingMessage, res: ServerResponse, db?: any): Promise<boolean>;

package/dist/auth/routes/signup.js

@@ -0,0 +1,81 @@
+import { getNativeProvider } from '../config.js';
+import { encryptSession, createSessionCookie, } from '../session.js';
+import { sendJson, readBody, isTokenMode } from './utils.js';
+export async function handleNativeSignup(config, req, res, db) {
+    const nativeProvider = getNativeProvider(config);
+    if (!nativeProvider || !db) {
+        sendJson(res, 400, { error: 'Native auth not configured' });
+        return true;
+    }
+    if (nativeProvider.allowRegistration === false) {
+        sendJson(res, 403, { error: 'Registration is disabled' });
+        return true;
+    }
+    let body;
+    try {
+        body = JSON.parse(await readBody(req));
+    }
+    catch {
+        sendJson(res, 400, { error: 'Invalid JSON body' });
+        return true;
+    }
+    const { email, password, name } = body;
+    if (!email || !password) {
+        sendJson(res, 400, { error: 'Email and password required' });
+        return true;
+    }
+    try {
+        const { registerUser, ensureUsersTable, generateVerificationToken } = await import('../native-auth.js');
+        await ensureUsersTable(db);
+        const user = await registerUser(db, email, password, name, nativeProvider);
+        // Send verification email if required
+        if (nativeProvider.requireEmailVerification && config.onEvent) {
+            const token = generateVerificationToken(user.sub, config.session.secret);
+            const origin = `${req.headers['x-forwarded-proto'] || 'http'}://${req.headers.host}`;
+            const verifyUrl = `${origin}/__nk_auth/verify-email?token=${encodeURIComponent(token)}`;
+            try {
+                await config.onEvent({ type: 'verification-email', email, token, url: verifyUrl });
+            }
+            catch { }
+        }
+        // If email verification required, don't auto-login
+        if (nativeProvider.requireEmailVerification) {
+            sendJson(res, 201, { user, message: 'Account created. Please check your email to verify.' });
+            return true;
+        }
+        // Auto-login after signup
+        const sessionData = {
+            accessToken: `native:${user.sub}`,
+            expiresAt: Math.floor(Date.now() / 1000) + config.session.maxAge,
+            user,
+            provider: 'native',
+            createdAt: Math.floor(Date.now() / 1000),
+        };
+        const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+        // Token mode: return bearer tokens
+        if (isTokenMode(url, req) && config.token.enabled) {
+            const { issueAccessToken, generateRefreshToken, storeRefreshToken, ensureRefreshTokenTable } = await import('../token.js');
+            await ensureRefreshTokenTable(db);
+            const accessToken = issueAccessToken(user, config.session.secret, config.token.accessTokenTTL);
+            const refreshToken = generateRefreshToken();
+            await storeRefreshToken(db, refreshToken, user.sub, config.token.refreshTokenTTL);
+            sendJson(res, 201, { accessToken, refreshToken, expiresIn: config.token.accessTokenTTL, tokenType: 'Bearer', user });
+            return true;
+        }
+        // Cookie mode
+        const encrypted = await encryptSession(sessionData, config.session.secret);
+        const cookie = createSessionCookie(config.session.cookieName, encrypted, config.session.maxAge, config.session.secure);
+        if (req.headers.accept?.includes('application/json')) {
+            res.writeHead(201, { 'Content-Type': 'application/json', 'Set-Cookie': cookie });
+            res.end(JSON.stringify({ user }));
+        }
+        else {
+            res.writeHead(302, { Location: config.routes.postLogin, 'Set-Cookie': cookie });
+            res.end();
+        }
+    }
+    catch (err) {
+        sendJson(res, 400, { error: err.message });
+    }
+    return true;
+}

package/dist/auth/routes/token.d.ts

@@ -0,0 +1,4 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { ResolvedAuthConfig } from '../types.js';
+export declare function handleTokenRefresh(config: ResolvedAuthConfig, req: IncomingMessage, res: ServerResponse, db?: any): Promise<boolean>;
+export declare function handleTokenRevoke(req: IncomingMessage, res: ServerResponse, db?: any): Promise<boolean>;

package/dist/auth/routes/token.js

@@ -0,0 +1,70 @@
+import { sendJson, readBody } from './utils.js';
+export async function handleTokenRefresh(config, req, res, db) {
+    if (!config.token.enabled || !db) {
+        sendJson(res, 400, { error: 'Token auth not configured' });
+        return true;
+    }
+    let body;
+    try {
+        body = JSON.parse(await readBody(req));
+    }
+    catch {
+        sendJson(res, 400, { error: 'Invalid JSON body' });
+        return true;
+    }
+    const { refreshToken } = body;
+    if (!refreshToken) {
+        sendJson(res, 400, { error: 'refreshToken required' });
+        return true;
+    }
+    const { validateRefreshToken, deleteRefreshToken, storeRefreshToken, generateRefreshToken, issueAccessToken, ensureRefreshTokenTable } = await import('../token.js');
+    await ensureRefreshTokenTable(db);
+    const userId = await validateRefreshToken(db, refreshToken);
+    if (!userId) {
+        sendJson(res, 401, { error: 'Invalid or expired refresh token' });
+        return true;
+    }
+    // Rotate: delete old, issue new
+    await deleteRefreshToken(db, refreshToken);
+    // Look up user from DB
+    const { findUserByEmail } = await import('../native-auth.js');
+    const row = await db.get('SELECT * FROM _nk_auth_users WHERE id = ?', userId);
+    if (!row) {
+        sendJson(res, 401, { error: 'User not found' });
+        return true;
+    }
+    let roles = [];
+    try {
+        roles = JSON.parse(row.roles);
+    }
+    catch { }
+    const user = { sub: row.id, email: row.email, name: row.name, roles, provider: 'native' };
+    const newAccessToken = issueAccessToken(user, config.session.secret, config.token.accessTokenTTL);
+    const newRefreshToken = generateRefreshToken();
+    await storeRefreshToken(db, newRefreshToken, userId, config.token.refreshTokenTTL);
+    sendJson(res, 200, { accessToken: newAccessToken, refreshToken: newRefreshToken, expiresIn: config.token.accessTokenTTL });
+    return true;
+}
+export async function handleTokenRevoke(req, res, db) {
+    if (!db) {
+        sendJson(res, 400, { error: 'Token auth not configured' });
+        return true;
+    }
+    let body;
+    try {
+        body = JSON.parse(await readBody(req));
+    }
+    catch {
+        sendJson(res, 400, { error: 'Invalid JSON body' });
+        return true;
+    }
+    const { refreshToken } = body;
+    if (!refreshToken) {
+        sendJson(res, 400, { error: 'refreshToken required' });
+        return true;
+    }
+    const { deleteRefreshToken } = await import('../token.js');
+    await deleteRefreshToken(db, refreshToken);
+    sendJson(res, 200, { ok: true });
+    return true;
+}

package/dist/auth/routes/totp.d.ts

@@ -0,0 +1,22 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { ResolvedAuthConfig } from '../types.js';
+/**
+ * POST /__nk_auth/totp/setup
+ * Generates a new TOTP secret for the authenticated user and returns a QR code.
+ */
+export declare function handleTotpSetup(config: ResolvedAuthConfig, req: IncomingMessage, res: ServerResponse, db?: any): Promise<boolean>;
+/**
+ * POST /__nk_auth/totp/verify-setup
+ * Confirms setup by verifying the first 6-digit code and enables TOTP.
+ */
+export declare function handleTotpVerifySetup(config: ResolvedAuthConfig, req: IncomingMessage, res: ServerResponse, db?: any): Promise<boolean>;
+/**
+ * POST /__nk_auth/totp/disable
+ * Disables TOTP after verifying a valid code.
+ */
+export declare function handleTotpDisable(config: ResolvedAuthConfig, req: IncomingMessage, res: ServerResponse, db?: any): Promise<boolean>;
+/**
+ * POST /__nk_auth/totp/challenge
+ * Exchanges a pending-2FA cookie + valid TOTP code for a full session cookie.
+ */
+export declare function handleTotpChallenge(config: ResolvedAuthConfig, req: IncomingMessage, res: ServerResponse, db?: any): Promise<boolean>;