@plumix/core 0.1.0

package/dist/auth/flow-routes.js

@@ -0,0 +1,15 @@
+/**
+ * Aggregates every auth-flow route handler (passkey, invite, magic-link,
+ * device-flow, OAuth, email-change) into one chunk the dispatcher loads via a
+ * single memoized dynamic import — see `loadAuthFlowRoutes` for why.
+ *
+ * `parseOAuthPath` is deliberately NOT re-exported here: the dispatcher matches
+ * OAuth paths eagerly from `./oauth/match.js`, and re-exporting it would drag
+ * the heavy handler graph back onto the eager path.
+ */
+export { handleInviteRegisterOptions, handleInviteRegisterVerify, handlePasskeyLoginOptions, handlePasskeyLoginVerify, handlePasskeyRegisterOptions, handlePasskeyRegisterVerify, handleSignout, } from "./passkey/routes.js";
+export { handleMagicLinkRequest, handleMagicLinkVerify, } from "./magic-link/routes.js";
+export { handleDeviceCodeRequest, handleDeviceTokenExchange, } from "./device-flow-routes.js";
+export { handleOAuthCallback, handleOAuthStart } from "./oauth/routes.js";
+export { handleEmailChangeVerify } from "./email-change/routes.js";
+//# sourceMappingURL=flow-routes.js.map

package/dist/auth/flow-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-routes.js","sourceRoot":"","sources":["../../src/auth/flow-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,EAC3B,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/auth/identity.d.ts

@@ -0,0 +1,96 @@
+import type { Db } from "../context/app.js";
+import type { User, UserRole } from "../db/schema/users.js";
+export type ExternalIdentityErrorCode = "email_unverified" | "account_disabled" | "domain_not_allowed" | "registration_closed" | "default_role_required";
+export declare class ExternalIdentityError extends Error {
+    readonly code: ExternalIdentityErrorCode;
+    private constructor();
+    static emailUnverified(): ExternalIdentityError;
+    static accountDisabled(): ExternalIdentityError;
+    static domainNotAllowed(): ExternalIdentityError;
+    static registrationClosed(): ExternalIdentityError;
+    static defaultRoleRequired(): ExternalIdentityError;
+}
+export interface ExternalIdentityInput {
+    /** Lowercased + normalised in advance by the caller. */
+    readonly email: string;
+    /**
+     * Whether the inbound flow has verified the email-inbox ownership.
+     * - OAuth: provider's `emailVerified` claim.
+     * - Magic-link: always true (the link click is the verification).
+     * - SAML / enterprise SSO: typically true (signed assertion).
+     * - Untrusted form input: false.
+     */
+    readonly emailVerified: boolean;
+    readonly name?: string | null;
+    readonly avatarUrl?: string | null;
+    /**
+     * When set, skip the `allowed_domains` lookup and provision new
+     * users with this role directly. Use for enterprise SSO flows where
+     * the IdP/group mapping decides the role; the allowlist isn't
+     * relevant. Required when `allowedDomainsGate: false`.
+     */
+    readonly defaultRole?: UserRole;
+    /**
+     * Default `true` — provision new users only when the email's domain
+     * is in `allowed_domains` with `isEnabled = true`. Set `false` for
+     * enterprise SSO where the IdP is the gate (e.g. CF Access already
+     * filtered who can reach plumix); pair with an explicit
+     * `defaultRole`.
+     */
+    readonly allowedDomainsGate?: boolean;
+    /**
+     * Default `false` — refuse to provision when the system has zero
+     * users (bootstrap rail; passkey is the dedicated first-admin path).
+     * Set `true` for enterprise SSO deployments that want first-admin via
+     * the same mechanism (e.g. CF Access JWT mints the first admin).
+     */
+    readonly bootstrapAllowed?: boolean;
+}
+export interface ResolvedExternalUser {
+    readonly user: User;
+    /** True when this call provisioned a new user row. */
+    readonly created: boolean;
+}
+/**
+ * Map an external auth flow (OAuth callback, magic-link verify, SAML
+ * ACS, custom enterprise SSO) to a local plumix user — provisioning
+ * if the gates allow and the user doesn't yet exist.
+ *
+ * The shared shape across every external flow:
+ *
+ *   1. user already exists by email
+ *      → emailVerified gate (refuse linking when the inbound flow
+ *        can't prove email-inbox ownership; only relevant for
+ *        OAuth-style flows where a third-party provider could lie
+ *        about the email string)
+ *      → disabled-account gate
+ *      → return existing user
+ *
+ *   2. user does not exist
+ *      → emailVerified gate (refuse provisioning without inbox proof)
+ *      → bootstrap rail (refuse when zero users, unless caller opts in)
+ *      → role resolution (allowed_domains lookup OR explicit default)
+ *      → provision via the existing `provisionUser` (which handles the
+ *        atomic CASE-WHEN-COUNT first-admin election)
+ *
+ *   3. race-on-insert
+ *      → if another flow concurrently provisioned the same email
+ *        between the existence check and the insert, fall through to
+ *        branch 1 idempotently
+ *
+ * Errors are typed `ExternalIdentityError`; the caller maps to its
+ * own user-facing code set (OAuthError, MagicLinkError, etc.).
+ */
+export declare function resolveExternalIdentity(db: Db, input: ExternalIdentityInput): Promise<ResolvedExternalUser>;
+/**
+ * Extract the (lowercased) domain part of an email. Returns null when
+ * the value isn't shaped like `local@domain` — empty local part,
+ * empty domain part, or no `@` at all.
+ *
+ * Defensive: callers higher up usually validate via valibot's
+ * `v.email()` before calling, but this is the boundary helper for
+ * `allowed_domains` lookups across every external auth flow, so
+ * tolerate malformed input rather than throw.
+ */
+export declare function extractDomain(email: string): string | null;
+//# sourceMappingURL=identity.d.ts.map

package/dist/auth/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/auth/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAM5D,MAAM,MAAM,yBAAyB,GACjC,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,qBAAqB,GACrB,uBAAuB,CAAC;AAE5B,qBAAa,qBAAsB,SAAQ,KAAK;IAK9C,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IAEzC,OAAO;IAKP,MAAM,CAAC,eAAe,IAAI,qBAAqB;IAI/C,MAAM,CAAC,eAAe,IAAI,qBAAqB;IAI/C,MAAM,CAAC,gBAAgB,IAAI,qBAAqB;IAOhD,MAAM,CAAC,kBAAkB,IAAI,qBAAqB;IAOlD,MAAM,CAAC,mBAAmB,IAAI,qBAAqB;CAMpD;AAED,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAsED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI1D"}

package/dist/auth/identity.js

@@ -0,0 +1,145 @@
+import { eq, isUniqueConstraintError } from "../db/index.js";
+import { allowedDomains } from "../db/schema/allowed_domains.js";
+import { users } from "../db/schema/users.js";
+import { provisionUser } from "./bootstrap.js";
+export class ExternalIdentityError extends Error {
+    static {
+        ExternalIdentityError.prototype.name = "ExternalIdentityError";
+    }
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+    static emailUnverified() {
+        return new ExternalIdentityError("email_unverified", "email_unverified");
+    }
+    static accountDisabled() {
+        return new ExternalIdentityError("account_disabled", "account_disabled");
+    }
+    static domainNotAllowed() {
+        return new ExternalIdentityError("domain_not_allowed", "domain_not_allowed");
+    }
+    static registrationClosed() {
+        return new ExternalIdentityError("registration_closed", "registration_closed");
+    }
+    static defaultRoleRequired() {
+        return new ExternalIdentityError("default_role_required", "resolveExternalIdentity: allowedDomainsGate=false requires an explicit defaultRole");
+    }
+}
+/**
+ * Map an external auth flow (OAuth callback, magic-link verify, SAML
+ * ACS, custom enterprise SSO) to a local plumix user — provisioning
+ * if the gates allow and the user doesn't yet exist.
+ *
+ * The shared shape across every external flow:
+ *
+ *   1. user already exists by email
+ *      → emailVerified gate (refuse linking when the inbound flow
+ *        can't prove email-inbox ownership; only relevant for
+ *        OAuth-style flows where a third-party provider could lie
+ *        about the email string)
+ *      → disabled-account gate
+ *      → return existing user
+ *
+ *   2. user does not exist
+ *      → emailVerified gate (refuse provisioning without inbox proof)
+ *      → bootstrap rail (refuse when zero users, unless caller opts in)
+ *      → role resolution (allowed_domains lookup OR explicit default)
+ *      → provision via the existing `provisionUser` (which handles the
+ *        atomic CASE-WHEN-COUNT first-admin election)
+ *
+ *   3. race-on-insert
+ *      → if another flow concurrently provisioned the same email
+ *        between the existence check and the insert, fall through to
+ *        branch 1 idempotently
+ *
+ * Errors are typed `ExternalIdentityError`; the caller maps to its
+ * own user-facing code set (OAuthError, MagicLinkError, etc.).
+ */
+export async function resolveExternalIdentity(db, input) {
+    try {
+        return await resolveOnce(db, input);
+    }
+    catch (error) {
+        if (!isUniqueConstraintError(error))
+            throw error;
+        return resolveOnce(db, input);
+    }
+}
+async function resolveOnce(db, input) {
+    const allowedDomainsGate = input.allowedDomainsGate ?? true;
+    const bootstrapAllowed = input.bootstrapAllowed ?? false;
+    const existing = await db.query.users.findFirst({
+        where: eq(users.email, input.email),
+    });
+    if (existing) {
+        if (!input.emailVerified) {
+            // Auto-linking an unverified email to an existing local user
+            // would let an attacker who controls a third-party account that
+            // claims `victim@gmail.com` take over the local row. Refuse.
+            throw ExternalIdentityError.emailUnverified();
+        }
+        if (existing.disabledAt) {
+            throw ExternalIdentityError.accountDisabled();
+        }
+        return { user: existing, created: false };
+    }
+    // No existing user — provision via the configured gate.
+    if (!input.emailVerified) {
+        throw ExternalIdentityError.emailUnverified();
+    }
+    if (!bootstrapAllowed) {
+        const userCount = await db.$count(users);
+        if (userCount === 0) {
+            throw ExternalIdentityError.registrationClosed();
+        }
+    }
+    const role = allowedDomainsGate
+        ? await roleFromAllowedDomain(db, input.email)
+        : input.defaultRole;
+    if (role === undefined) {
+        // `allowedDomainsGate: false` requires an explicit defaultRole.
+        // Falling through with `undefined` would silently default the
+        // user to "subscriber" via the schema default — surfacing as a
+        // config bug instead.
+        throw ExternalIdentityError.defaultRoleRequired();
+    }
+    const { user } = await provisionUser(db, {
+        email: input.email,
+        name: input.name,
+        avatarUrl: input.avatarUrl,
+        defaultRole: role,
+        emailVerified: true,
+    });
+    return { user, created: true };
+}
+async function roleFromAllowedDomain(db, email) {
+    const domain = extractDomain(email);
+    if (!domain)
+        throw ExternalIdentityError.domainNotAllowed();
+    const allowed = await db.query.allowedDomains.findFirst({
+        where: eq(allowedDomains.domain, domain),
+    });
+    if (!allowed?.isEnabled) {
+        throw ExternalIdentityError.domainNotAllowed();
+    }
+    return allowed.defaultRole;
+}
+/**
+ * Extract the (lowercased) domain part of an email. Returns null when
+ * the value isn't shaped like `local@domain` — empty local part,
+ * empty domain part, or no `@` at all.
+ *
+ * Defensive: callers higher up usually validate via valibot's
+ * `v.email()` before calling, but this is the boundary helper for
+ * `allowed_domains` lookups across every external auth flow, so
+ * tolerate malformed input rather than throw.
+ */
+export function extractDomain(email) {
+    const at = email.lastIndexOf("@");
+    if (at <= 0 || at === email.length - 1)
+        return null;
+    return email.slice(at + 1).toLowerCase();
+}
+//# sourceMappingURL=identity.js.map

package/dist/auth/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/auth/identity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAS/C,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C;QACE,qBAAqB,CAAC,SAAS,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACjE,CAAC;IAEQ,IAAI,CAA4B;IAEzC,YAAoB,IAA+B,EAAE,OAAe;QAClE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,eAAe;QACpB,OAAO,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,CAAC,eAAe;QACpB,OAAO,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,CAAC,gBAAgB;QACrB,OAAO,IAAI,qBAAqB,CAC9B,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,kBAAkB;QACvB,OAAO,IAAI,qBAAqB,CAC9B,qBAAqB,EACrB,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,mBAAmB;QACxB,OAAO,IAAI,qBAAqB,CAC9B,uBAAuB,EACvB,oFAAoF,CACrF,CAAC;IACJ,CAAC;CACF;AA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAM,EACN,KAA4B;IAE5B,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACjD,OAAO,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,EAAM,EACN,KAA4B;IAE5B,MAAM,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAC5D,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAEzD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QAC9C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACzB,6DAA6D;YAC7D,gEAAgE;YAChE,6DAA6D;YAC7D,MAAM,qBAAqB,CAAC,eAAe,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,qBAAqB,CAAC,eAAe,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IAED,wDAAwD;IACxD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,qBAAqB,CAAC,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,qBAAqB,CAAC,kBAAkB,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,kBAAkB;QAC7B,CAAC,CAAC,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;QAC9C,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IACtB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,gEAAgE;QAChE,8DAA8D;QAC9D,+DAA+D;QAC/D,sBAAsB;QACtB,MAAM,qBAAqB,CAAC,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE;QACvC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,EAAM,EAAE,KAAa;IACxD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,MAAM,qBAAqB,CAAC,gBAAgB,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC;QACtD,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;QACxB,MAAM,qBAAqB,CAAC,gBAAgB,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,OAAO,CAAC,WAAW,CAAC;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3C,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,16 @@
+export * from "./authenticator.js";
+export * from "./bootstrap.js";
+export * from "./config.js";
+export * from "./cookies.js";
+export * from "./csrf.js";
+export * from "./email-change/index.js";
+export * from "./identity.js";
+export * from "./magic-link/index.js";
+export * from "./mailer/index.js";
+export * from "./oauth/index.js";
+export * from "./passkey/index.js";
+export * from "./rbac.js";
+export * from "./sessions.js";
+export * from "./sign-in.js";
+export * from "./tokens.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,16 @@
+export * from "./authenticator.js";
+export * from "./bootstrap.js";
+export * from "./config.js";
+export * from "./cookies.js";
+export * from "./csrf.js";
+export * from "./email-change/index.js";
+export * from "./identity.js";
+export * from "./magic-link/index.js";
+export * from "./mailer/index.js";
+export * from "./oauth/index.js";
+export * from "./passkey/index.js";
+export * from "./rbac.js";
+export * from "./sessions.js";
+export * from "./sign-in.js";
+export * from "./tokens.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/auth/invite.d.ts

@@ -0,0 +1,25 @@
+import type { Db } from "../context/app.js";
+import type { AuthToken } from "../db/schema/auth_tokens.js";
+export declare class InviteError extends Error {
+    readonly code: "invalid_token" | "token_expired";
+    private constructor();
+    static invalidToken(): InviteError;
+    static tokenExpired(): InviteError;
+}
+export interface ValidInvite {
+    /** SHA-256 hash of the raw token; the row's primary key. */
+    readonly tokenHash: string;
+    readonly userId: number;
+    readonly email: string;
+    readonly role: NonNullable<AuthToken["role"]>;
+    readonly expiresAt: Date;
+}
+/**
+ * Look up an invite token by hash, validate type + expiry + required fields.
+ * Idempotent — does not consume the token. Call consumeInviteToken on a
+ * successful acceptance so the token is single-use.
+ */
+export declare function validateInviteToken(db: Db, rawToken: string): Promise<ValidInvite>;
+/** Delete an invite token by its hash (single-use semantics). */
+export declare function consumeInviteToken(db: Db, tokenHash: string): Promise<void>;
+//# sourceMappingURL=invite.d.ts.map

package/dist/auth/invite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.d.ts","sourceRoot":"","sources":["../../src/auth/invite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAK7D,qBAAa,WAAY,SAAQ,KAAK;IAKpC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,CAAC;IAEjD,OAAO;IAKP,MAAM,CAAC,YAAY,IAAI,WAAW;IAIlC,MAAM,CAAC,YAAY,IAAI,WAAW;CAGnC;AAED,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,CAAC,CAuBtB;AAED,iEAAiE;AACjE,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/auth/invite.js

@@ -0,0 +1,53 @@
+import { eq } from "../db/index.js";
+import { authTokens } from "../db/schema/auth_tokens.js";
+import { hashToken } from "./tokens.js";
+export class InviteError extends Error {
+    static {
+        InviteError.prototype.name = "InviteError";
+    }
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+    static invalidToken() {
+        return new InviteError("invalid_token", "invalid_token");
+    }
+    static tokenExpired() {
+        return new InviteError("token_expired", "token_expired");
+    }
+}
+/**
+ * Look up an invite token by hash, validate type + expiry + required fields.
+ * Idempotent — does not consume the token. Call consumeInviteToken on a
+ * successful acceptance so the token is single-use.
+ */
+export async function validateInviteToken(db, rawToken) {
+    const tokenHash = await hashToken(rawToken);
+    const row = await db.query.authTokens.findFirst({
+        where: eq(authTokens.hash, tokenHash),
+    });
+    // Treat a non-invite token, a token with missing fields, and a missing
+    // token as the same "invalid" outcome — don't leak which rows exist.
+    if (row?.type !== "invite") {
+        throw InviteError.invalidToken();
+    }
+    if (row.userId === null || row.email === null || row.role === null) {
+        throw InviteError.invalidToken();
+    }
+    if (row.expiresAt.getTime() < Date.now()) {
+        throw InviteError.tokenExpired();
+    }
+    return {
+        tokenHash,
+        userId: row.userId,
+        email: row.email,
+        role: row.role,
+        expiresAt: row.expiresAt,
+    };
+}
+/** Delete an invite token by its hash (single-use semantics). */
+export async function consumeInviteToken(db, tokenHash) {
+    await db.delete(authTokens).where(eq(authTokens.hash, tokenHash));
+}
+//# sourceMappingURL=invite.js.map

package/dist/auth/invite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.js","sourceRoot":"","sources":["../../src/auth/invite.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC;QACE,WAAW,CAAC,SAAS,CAAC,IAAI,GAAG,aAAa,CAAC;IAC7C,CAAC;IAEQ,IAAI,CAAoC;IAEjD,YAAoB,IAAyB,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,WAAW,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,WAAW,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC3D,CAAC;CACF;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,QAAgB;IAEhB,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9C,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC;KACtC,CAAC,CAAC;IACH,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACnE,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACzC,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC;IACnC,CAAC;IACD,OAAO;QACL,SAAS;QACT,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,SAAiB;IAEjB,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/auth/magic-link/errors.d.ts

@@ -0,0 +1,13 @@
+export declare const MAGIC_LINK_ERROR_CODES: readonly ["missing_token", "token_invalid", "token_expired", "account_disabled", "domain_not_allowed", "registration_closed"];
+export type MagicLinkErrorCode = (typeof MAGIC_LINK_ERROR_CODES)[number];
+export declare class MagicLinkError extends Error {
+    readonly code: MagicLinkErrorCode;
+    private constructor();
+    static missingToken(): MagicLinkError;
+    static tokenInvalid(): MagicLinkError;
+    static tokenExpired(): MagicLinkError;
+    static accountDisabled(): MagicLinkError;
+    static domainNotAllowed(): MagicLinkError;
+    static registrationClosed(): MagicLinkError;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/magic-link/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/auth/magic-link/errors.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,+HAUzB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,qBAAa,cAAe,SAAQ,KAAK;IAKvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAElC,OAAO;IAKP,MAAM,CAAC,YAAY,IAAI,cAAc;IAIrC,MAAM,CAAC,YAAY,IAAI,cAAc;IAIrC,MAAM,CAAC,YAAY,IAAI,cAAc;IAIrC,MAAM,CAAC,eAAe,IAAI,cAAc;IAIxC,MAAM,CAAC,gBAAgB,IAAI,cAAc;IAIzC,MAAM,CAAC,kBAAkB,IAAI,cAAc;CAG5C"}

package/dist/auth/magic-link/errors.js

@@ -0,0 +1,40 @@
+export const MAGIC_LINK_ERROR_CODES = [
+    "missing_token",
+    "token_invalid",
+    "token_expired",
+    "account_disabled",
+    // Signup-only — the click-the-link path provisioned a user, but the
+    // domain's allowlist row is no longer enabled at verify time, or the
+    // system is in zero-user state (bootstrap is passkey-only).
+    "domain_not_allowed",
+    "registration_closed",
+];
+export class MagicLinkError extends Error {
+    static {
+        MagicLinkError.prototype.name = "MagicLinkError";
+    }
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+    static missingToken() {
+        return new MagicLinkError("missing_token", "missing_token");
+    }
+    static tokenInvalid() {
+        return new MagicLinkError("token_invalid", "token_invalid");
+    }
+    static tokenExpired() {
+        return new MagicLinkError("token_expired", "token_expired");
+    }
+    static accountDisabled() {
+        return new MagicLinkError("account_disabled", "account_disabled");
+    }
+    static domainNotAllowed() {
+        return new MagicLinkError("domain_not_allowed", "domain_not_allowed");
+    }
+    static registrationClosed() {
+        return new MagicLinkError("registration_closed", "registration_closed");
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/magic-link/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/auth/magic-link/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,eAAe;IACf,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,oEAAoE;IACpE,qEAAqE;IACrE,4DAA4D;IAC5D,oBAAoB;IACpB,qBAAqB;CACb,CAAC;AAIX,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC;QACE,cAAc,CAAC,SAAS,CAAC,IAAI,GAAG,gBAAgB,CAAC;IACnD,CAAC;IAEQ,IAAI,CAAqB;IAElC,YAAoB,IAAwB,EAAE,OAAe;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,eAAe;QACpB,OAAO,IAAI,cAAc,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,CAAC,gBAAgB;QACrB,OAAO,IAAI,cAAc,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,CAAC,kBAAkB;QACvB,OAAO,IAAI,cAAc,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;IAC1E,CAAC;CACF"}

package/dist/auth/magic-link/index.d.ts

@@ -0,0 +1,4 @@
+export { MAGIC_LINK_ERROR_CODES, MagicLinkError } from "./errors.js";
+export type { MagicLinkErrorCode } from "./errors.js";
+export { handleMagicLinkRequest, handleMagicLinkVerify } from "./routes.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/magic-link/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/magic-link/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC"}

package/dist/auth/magic-link/index.js

@@ -0,0 +1,6 @@
+// Public magic-link surface. Mirrors the OAuth barrel: errors + route
+// handlers leave the package; the request/verify implementations are
+// internal (the dispatcher imports them by file path).
+export { MAGIC_LINK_ERROR_CODES, MagicLinkError } from "./errors.js";
+export { handleMagicLinkRequest, handleMagicLinkVerify } from "./routes.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/magic-link/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/magic-link/index.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,qEAAqE;AACrE,uDAAuD;AAEvD,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGrE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC"}

package/dist/auth/magic-link/request.d.ts

@@ -0,0 +1,57 @@
+import type { Db, Logger } from "../../context/app.js";
+import type { Mailer } from "../mailer/types.js";
+interface RequestMagicLinkInput {
+    readonly email: string;
+    /** `${origin}/_plumix/admin/magic-link?token=…` will be sent to the user. */
+    readonly origin: string;
+    /** Subdirectory prefix the verify link must carry (`""` at the root). */
+    readonly basePath: string;
+    readonly mailer: Mailer;
+    readonly siteName: string;
+    readonly ttlSeconds?: number;
+    /**
+     * Locale for the email body. Pre-auth flow: caller supplies the
+     * resolved admin-shell locale (Accept-Language fallback chain) since
+     * the recipient has no stored preference yet. Falls back to English
+     * when omitted or unknown. See `auth/email/messages.ts`.
+     */
+    readonly locale?: string;
+    /**
+     * Optional logger for swallowed mailer errors. The function never
+     * throws (so the response can stay shape-identical on every code
+     * path), but a transport failure is still operator-visible signal —
+     * route this through the request logger when one is available.
+     */
+    readonly logger?: Pick<Logger, "warn">;
+    /**
+     * When true, allow this magic-link request to issue a signup token
+     * even when zero users exist. The route reads this from
+     * `ctx.bootstrapAllowed` (derived from `auth.bootstrapVia`); default
+     * false keeps the bootstrap rail passkey-only.
+     */
+    readonly bootstrapAllowed?: boolean;
+}
+/**
+ * Issue a magic-link for sign-in or domain-gated signup.
+ *
+ *   sign-in (existing user)        → token row carries `userId = user.id`.
+ *   signup (allowed-domain match)  → token row carries `userId = null`,
+ *                                    role omitted (resolved at verify).
+ *   neither                        → silent no-op + timing delay.
+ *
+ * Always behaves identically from the caller's perspective regardless of
+ * which branch fired — the route layer turns this into an "If an
+ * account exists or self-signup is open, we sent you a link" response.
+ * Per Copenhagen Book / emdash: don't reveal email existence via
+ * response timing or shape; honour that here at the function boundary.
+ *
+ * Bootstrap rail: signup is refused when the system has zero users
+ * (matches OAuth — first-admin must enrol via passkey).
+ *
+ * Errors from the mailer are swallowed (logged via input.logger when
+ * present). The function never throws; it returns normally regardless
+ * of outcome.
+ */
+export declare function requestMagicLink(db: Db, input: RequestMagicLinkInput): Promise<void>;
+export {};
+//# sourceMappingURL=request.d.ts.map

package/dist/auth/magic-link/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../src/auth/magic-link/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAuBjD,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,IAAI,CAAC,CA8Cf"}