@plyaz/auth 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (113) hide show
  1. package/.github/pull_request_template.md +71 -0
  2. package/.github/workflows/deploy.yml +9 -0
  3. package/.github/workflows/publish.yml +14 -0
  4. package/.github/workflows/security.yml +20 -0
  5. package/README.md +89 -0
  6. package/commits.txt +5 -0
  7. package/dist/common/index.cjs +48 -0
  8. package/dist/common/index.cjs.map +1 -0
  9. package/dist/common/index.mjs +43 -0
  10. package/dist/common/index.mjs.map +1 -0
  11. package/dist/index.cjs +20411 -0
  12. package/dist/index.cjs.map +1 -0
  13. package/dist/index.mjs +5139 -0
  14. package/dist/index.mjs.map +1 -0
  15. package/eslint.config.mjs +13 -0
  16. package/index.html +13 -0
  17. package/package.json +141 -0
  18. package/src/adapters/auth-adapter-factory.ts +26 -0
  19. package/src/adapters/auth-adapter.mapper.ts +53 -0
  20. package/src/adapters/base-auth.adapter.ts +119 -0
  21. package/src/adapters/clerk/clerk.adapter.ts +204 -0
  22. package/src/adapters/custom/custom.adapter.ts +119 -0
  23. package/src/adapters/index.ts +4 -0
  24. package/src/adapters/next-auth/authOptions.ts +81 -0
  25. package/src/adapters/next-auth/next-auth.adapter.ts +211 -0
  26. package/src/api/client.ts +37 -0
  27. package/src/audit/audit.logger.ts +52 -0
  28. package/src/client/components/ProtectedRoute.tsx +37 -0
  29. package/src/client/hooks/useAuth.ts +128 -0
  30. package/src/client/hooks/useConnectedAccounts.ts +108 -0
  31. package/src/client/hooks/usePermissions.ts +36 -0
  32. package/src/client/hooks/useRBAC.ts +36 -0
  33. package/src/client/hooks/useSession.ts +18 -0
  34. package/src/client/providers/AuthProvider.tsx +104 -0
  35. package/src/client/store/auth.store.ts +306 -0
  36. package/src/client/utils/storage.ts +70 -0
  37. package/src/common/constants/oauth-providers.ts +49 -0
  38. package/src/common/errors/auth.errors.ts +64 -0
  39. package/src/common/errors/specific-auth-errors.ts +201 -0
  40. package/src/common/index.ts +19 -0
  41. package/src/common/regex/index.ts +27 -0
  42. package/src/common/types/auth.types.ts +641 -0
  43. package/src/common/types/index.ts +297 -0
  44. package/src/common/utils/index.ts +84 -0
  45. package/src/core/blacklist/token.blacklist.ts +60 -0
  46. package/src/core/index.ts +2 -0
  47. package/src/core/jwt/jwt.manager.ts +131 -0
  48. package/src/core/session/session.manager.ts +56 -0
  49. package/src/db/repositories/connected-account.repository.ts +415 -0
  50. package/src/db/repositories/role.repository.ts +519 -0
  51. package/src/db/repositories/session.repository.ts +308 -0
  52. package/src/db/repositories/user.repository.ts +320 -0
  53. package/src/flows/index.ts +2 -0
  54. package/src/flows/sign-in.flow.ts +106 -0
  55. package/src/flows/sign-up.flow.ts +121 -0
  56. package/src/index.ts +54 -0
  57. package/src/libs/clerk.helper.ts +36 -0
  58. package/src/libs/supabase.helper.ts +255 -0
  59. package/src/libs/supabaseClient.ts +6 -0
  60. package/src/providers/base/auth-provider.interface.ts +42 -0
  61. package/src/providers/base/index.ts +1 -0
  62. package/src/providers/index.ts +2 -0
  63. package/src/providers/oauth/facebook.provider.ts +97 -0
  64. package/src/providers/oauth/github.provider.ts +148 -0
  65. package/src/providers/oauth/google.provider.ts +126 -0
  66. package/src/providers/oauth/index.ts +3 -0
  67. package/src/rbac/dynamic-roles.ts +552 -0
  68. package/src/rbac/index.ts +4 -0
  69. package/src/rbac/permission-checker.ts +464 -0
  70. package/src/rbac/role-hierarchy.ts +545 -0
  71. package/src/rbac/role.manager.ts +75 -0
  72. package/src/security/csrf/csrf.protection.ts +37 -0
  73. package/src/security/index.ts +3 -0
  74. package/src/security/rate-limiting/auth/auth.controller.ts +12 -0
  75. package/src/security/rate-limiting/auth/rate-limiting.interface.ts +67 -0
  76. package/src/security/rate-limiting/auth.module.ts +32 -0
  77. package/src/server/auth.module.ts +158 -0
  78. package/src/server/decorators/auth.decorator.ts +43 -0
  79. package/src/server/decorators/auth.decorators.ts +31 -0
  80. package/src/server/decorators/current-user.decorator.ts +49 -0
  81. package/src/server/decorators/permission.decorator.ts +49 -0
  82. package/src/server/guards/auth.guard.ts +56 -0
  83. package/src/server/guards/custom-throttler.guard.ts +46 -0
  84. package/src/server/guards/permissions.guard.ts +115 -0
  85. package/src/server/guards/roles.guard.ts +31 -0
  86. package/src/server/middleware/auth.middleware.ts +46 -0
  87. package/src/server/middleware/index.ts +2 -0
  88. package/src/server/middleware/middleware.ts +11 -0
  89. package/src/server/middleware/session.middleware.ts +255 -0
  90. package/src/server/services/account.service.ts +269 -0
  91. package/src/server/services/auth.service.ts +79 -0
  92. package/src/server/services/brute-force.service.ts +98 -0
  93. package/src/server/services/index.ts +15 -0
  94. package/src/server/services/rate-limiter.service.ts +60 -0
  95. package/src/server/services/session.service.ts +287 -0
  96. package/src/server/services/token.service.ts +262 -0
  97. package/src/session/cookie-store.ts +255 -0
  98. package/src/session/enhanced-session-manager.ts +406 -0
  99. package/src/session/index.ts +14 -0
  100. package/src/session/memory-store.ts +320 -0
  101. package/src/session/redis-store.ts +443 -0
  102. package/src/strategies/oauth.strategy.ts +128 -0
  103. package/src/strategies/traditional-auth.strategy.ts +116 -0
  104. package/src/tokens/index.ts +4 -0
  105. package/src/tokens/refresh-token-manager.ts +448 -0
  106. package/src/tokens/token-validator.ts +311 -0
  107. package/tsconfig.build.json +28 -0
  108. package/tsconfig.json +38 -0
  109. package/tsup.config.mjs +28 -0
  110. package/vitest.config.mjs +16 -0
  111. package/vitest.setup.d.ts +2 -0
  112. package/vitest.setup.d.ts.map +1 -0
  113. package/vitest.setup.ts +1 -0
@@ -0,0 +1,201 @@
1
+ // /**
2
+ // * @fileoverview Specific authentication error classes for @plyaz/auth
3
+ // * @module @plyaz/auth/errors/specific-auth-errors
4
+ // *
5
+ // * @description
6
+ // * Defines specific error classes for different authentication failure scenarios.
7
+ // * Each error class provides structured error information including error codes,
8
+ // * HTTP status codes, and localized messages. Used throughout the auth system
9
+ // * for consistent error handling and user feedback.
10
+ // *
11
+ // * @example
12
+ // * ```typescript
13
+ // * import { InvalidCredentialsError, TokenExpiredError } from '@plyaz/auth';
14
+ // *
15
+ // * // Throw specific error
16
+ // * throw new InvalidCredentialsError('Invalid email or password');
17
+ // *
18
+ // * // Handle specific error
19
+ // * if (error instanceof TokenExpiredError) {
20
+ // * // Refresh token logic
21
+ // * }
22
+ // * ```
23
+ // */
24
+
25
+ // import { AUTH_ERROR_CODES, ERROR_CODE_TO_HTTP_STATUS } from "@plyaz/types";
26
+
27
+
28
+
29
+ // /**
30
+ // * Base authentication error class
31
+ // * Provides common error structure for all auth-related errors
32
+ // */
33
+ // export abstract class BaseAuthError extends Error {
34
+ // /** Error code for programmatic handling */
35
+ // public readonly code: string;
36
+ // /** HTTP status code for API responses */
37
+ // public readonly statusCode: number;
38
+ // /** Additional error context */
39
+ // public readonly context?: Record<string, styr>;
40
+
41
+ // constructor(
42
+ // message: string,
43
+ // code: string,
44
+ // statusCode: number,
45
+ // context?: Record<string, any>
46
+ // ) {
47
+ // super(message);
48
+ // this.name = this.constructor.name;
49
+ // this.code = code;
50
+ // this.statusCode = statusCode;
51
+ // this.context = context;
52
+
53
+ // // Maintain proper stack trace
54
+ // if (Error.captureStackTrace) {
55
+ // Error.captureStackTrace(this, this.constructor);
56
+ // }
57
+ // }
58
+ // }
59
+
60
+ // /**
61
+ // * Invalid credentials error
62
+ // * Thrown when email/password combination is incorrect
63
+ // */
64
+ // export class InvalidCredentialsError extends BaseAuthError {
65
+ // constructor(message = 'Invalid email or password', context?: Record<string, any>) {
66
+ // super(
67
+ // message,
68
+ // AUTH_ERROR_CODES.INVALID_CREDENTIALS,
69
+ // ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.INVALID_CREDENTIALS],
70
+ // context
71
+ // );
72
+ // }
73
+ // }
74
+
75
+ // /**
76
+ // * Token expired error
77
+ // * Thrown when access or refresh token has expired
78
+ // */
79
+ // export class TokenExpiredError extends BaseAuthError {
80
+ // constructor(message = 'Authentication token has expired', context?: Record<string, any>) {
81
+ // super(
82
+ // message,
83
+ // AUTH_ERROR_CODES.TOKEN_EXPIRED,
84
+ // ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.TOKEN_EXPIRED],
85
+ // context
86
+ // );
87
+ // }
88
+ // }
89
+
90
+ // /**
91
+ // * Token invalid error
92
+ // * Thrown when token signature is invalid or malformed
93
+ // */
94
+ // export class TokenInvalidError extends BaseAuthError {
95
+ // constructor(message = 'Authentication token is invalid', context?: Record<string, any>) {
96
+ // super(
97
+ // message,
98
+ // AUTH_ERROR_CODES.TOKEN_INVALID,
99
+ // ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.TOKEN_INVALID],
100
+ // context
101
+ // );
102
+ // }
103
+ // }
104
+
105
+ // /**
106
+ // * Token revoked error
107
+ // * Thrown when token has been blacklisted/revoked
108
+ // */
109
+ // export class TokenRevokedError extends BaseAuthError {
110
+ // constructor(message = 'Authentication token has been revoked', context?: Record<string, any>) {
111
+ // super(
112
+ // message,
113
+ // AUTH_ERROR_CODES.TOKEN_REVOKED,
114
+ // ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.TOKEN_REVOKED],
115
+ // context
116
+ // );
117
+ // }
118
+ // }
119
+
120
+ // /**
121
+ // * Session expired error
122
+ // * Thrown when user session is no longer valid
123
+ // */
124
+ // export class SessionExpiredError extends BaseAuthError {
125
+ // constructor(message = 'User session has expired', context?: Record<string, any>) {
126
+ // super(
127
+ // message,
128
+ // AUTH_ERROR_CODES.SESSION_EXPIRED,
129
+ // ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.SESSION_EXPIRED],
130
+ // context
131
+ // );
132
+ // }
133
+ // }
134
+
135
+ // /**
136
+ // * Insufficient permissions error
137
+ // * Thrown when user lacks required permissions for action
138
+ // */
139
+ // export class InsufficientPermissionsError extends BaseAuthError {
140
+ // constructor(
141
+ // resource?: string,
142
+ // action?: string,
143
+ // message = 'Insufficient permissions for this action'
144
+ // ) {
145
+ // const context = resource && action ? { resource, action } : undefined;
146
+ // super(
147
+ // message,
148
+ // AUTH_ERROR_CODES.INSUFFICIENT_PERMISSIONS,
149
+ // ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.INSUFFICIENT_PERMISSIONS],
150
+ // context
151
+ // );
152
+ // }
153
+ // }
154
+
155
+ // /**
156
+ // * Role required error
157
+ // * Thrown when user lacks required role for action
158
+ // */
159
+ // export class RoleRequiredError extends BaseAuthError {
160
+ // constructor(requiredRole?: string, message = 'Required role not found') {
161
+ // const context = requiredRole ? { requiredRole } : undefined;
162
+ // super(
163
+ // message,
164
+ // AUTH_ERROR_CODES.ROLE_REQUIRED,
165
+ // ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.ROLE_REQUIRED],
166
+ // context
167
+ // );
168
+ // }
169
+ // }
170
+
171
+ // /**
172
+ // * Account locked error
173
+ // * Thrown when account is locked due to failed attempts
174
+ // */
175
+ // export class AccountLockedError extends BaseAuthError {
176
+ // constructor(message = 'Account is locked due to failed attempts', context?: Record<string, any>) {
177
+ // super(
178
+ // message,
179
+ // AUTH_ERROR_CODES.ACCOUNT_LOCKED,
180
+ // ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.ACCOUNT_LOCKED],
181
+ // context
182
+ // );
183
+ // }
184
+ // }
185
+
186
+ // /**
187
+ // * Account suspended error
188
+ // * Thrown when account has been suspended by admin
189
+ // */
190
+ // export class AccountSuspendedError extends BaseAuthError {
191
+ // constructor(message = 'Account has been suspended', context?: Record<string, any>) {
192
+ // super(
193
+ // message,
194
+ // AUTH_ERROR_CODES.ACCOUNT_SUSPENDED,
195
+ // ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.ACCOUNT_SUSPENDED],
196
+ // context
197
+ // );
198
+ // }
199
+ // }
200
+
201
+
@@ -0,0 +1,19 @@
1
+ /**
2
+ * @fileoverview Common utilities, types, and constants for @plyaz/auth
3
+ * @module @plyaz/auth/common
4
+ */
5
+
6
+ // // Types
7
+ // export * from "./types";
8
+
9
+ // // Constants
10
+ // export * from "./constants";
11
+
12
+ // // Errors
13
+ // export * from "./errors";
14
+
15
+ // // Regex patterns
16
+ // export * from "./regex";
17
+
18
+ // Utilities
19
+ export * from "./utils";
@@ -0,0 +1,27 @@
1
+ /**
2
+ * @fileoverview Regular expressions for @plyaz/auth
3
+ * @module @plyaz/auth/regex
4
+ */
5
+
6
+ export const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
7
+
8
+ export const PASSWORD_REGEX = {
9
+ MIN_LENGTH: /.{8,}/,
10
+ HAS_UPPERCASE: /[A-Z]/,
11
+ HAS_LOWERCASE: /[a-z]/,
12
+ HAS_NUMBER: /\d/,
13
+ HAS_SPECIAL: /[!@#$%^&*(),.?":{}|<>]/,
14
+ STRONG: /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*(),.?":{}|<>]).{8,}$/
15
+ };
16
+
17
+ export const PHONE_REGEX = /^\+?[1-9]\d{1,14}$/;
18
+
19
+ export const USERNAME_REGEX = /^[a-zA-Z0-9_]{3,20}$/;
20
+
21
+ export const URL_REGEX = /^https?:\/\/(www\.)?[-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_+.~#?&//=]*)$/;
22
+
23
+ export const JWT_REGEX = /^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/;
24
+
25
+ export const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
26
+
27
+ export const WALLET_ADDRESS_REGEX = /^0x[a-fA-F0-9]{40}$/;