@plyaz/auth 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/pull_request_template.md +71 -0
- package/.github/workflows/deploy.yml +9 -0
- package/.github/workflows/publish.yml +14 -0
- package/.github/workflows/security.yml +20 -0
- package/README.md +89 -0
- package/commits.txt +5 -0
- package/dist/common/index.cjs +48 -0
- package/dist/common/index.cjs.map +1 -0
- package/dist/common/index.mjs +43 -0
- package/dist/common/index.mjs.map +1 -0
- package/dist/index.cjs +20411 -0
- package/dist/index.cjs.map +1 -0
- package/dist/index.mjs +5139 -0
- package/dist/index.mjs.map +1 -0
- package/eslint.config.mjs +13 -0
- package/index.html +13 -0
- package/package.json +141 -0
- package/src/adapters/auth-adapter-factory.ts +26 -0
- package/src/adapters/auth-adapter.mapper.ts +53 -0
- package/src/adapters/base-auth.adapter.ts +119 -0
- package/src/adapters/clerk/clerk.adapter.ts +204 -0
- package/src/adapters/custom/custom.adapter.ts +119 -0
- package/src/adapters/index.ts +4 -0
- package/src/adapters/next-auth/authOptions.ts +81 -0
- package/src/adapters/next-auth/next-auth.adapter.ts +211 -0
- package/src/api/client.ts +37 -0
- package/src/audit/audit.logger.ts +52 -0
- package/src/client/components/ProtectedRoute.tsx +37 -0
- package/src/client/hooks/useAuth.ts +128 -0
- package/src/client/hooks/useConnectedAccounts.ts +108 -0
- package/src/client/hooks/usePermissions.ts +36 -0
- package/src/client/hooks/useRBAC.ts +36 -0
- package/src/client/hooks/useSession.ts +18 -0
- package/src/client/providers/AuthProvider.tsx +104 -0
- package/src/client/store/auth.store.ts +306 -0
- package/src/client/utils/storage.ts +70 -0
- package/src/common/constants/oauth-providers.ts +49 -0
- package/src/common/errors/auth.errors.ts +64 -0
- package/src/common/errors/specific-auth-errors.ts +201 -0
- package/src/common/index.ts +19 -0
- package/src/common/regex/index.ts +27 -0
- package/src/common/types/auth.types.ts +641 -0
- package/src/common/types/index.ts +297 -0
- package/src/common/utils/index.ts +84 -0
- package/src/core/blacklist/token.blacklist.ts +60 -0
- package/src/core/index.ts +2 -0
- package/src/core/jwt/jwt.manager.ts +131 -0
- package/src/core/session/session.manager.ts +56 -0
- package/src/db/repositories/connected-account.repository.ts +415 -0
- package/src/db/repositories/role.repository.ts +519 -0
- package/src/db/repositories/session.repository.ts +308 -0
- package/src/db/repositories/user.repository.ts +320 -0
- package/src/flows/index.ts +2 -0
- package/src/flows/sign-in.flow.ts +106 -0
- package/src/flows/sign-up.flow.ts +121 -0
- package/src/index.ts +54 -0
- package/src/libs/clerk.helper.ts +36 -0
- package/src/libs/supabase.helper.ts +255 -0
- package/src/libs/supabaseClient.ts +6 -0
- package/src/providers/base/auth-provider.interface.ts +42 -0
- package/src/providers/base/index.ts +1 -0
- package/src/providers/index.ts +2 -0
- package/src/providers/oauth/facebook.provider.ts +97 -0
- package/src/providers/oauth/github.provider.ts +148 -0
- package/src/providers/oauth/google.provider.ts +126 -0
- package/src/providers/oauth/index.ts +3 -0
- package/src/rbac/dynamic-roles.ts +552 -0
- package/src/rbac/index.ts +4 -0
- package/src/rbac/permission-checker.ts +464 -0
- package/src/rbac/role-hierarchy.ts +545 -0
- package/src/rbac/role.manager.ts +75 -0
- package/src/security/csrf/csrf.protection.ts +37 -0
- package/src/security/index.ts +3 -0
- package/src/security/rate-limiting/auth/auth.controller.ts +12 -0
- package/src/security/rate-limiting/auth/rate-limiting.interface.ts +67 -0
- package/src/security/rate-limiting/auth.module.ts +32 -0
- package/src/server/auth.module.ts +158 -0
- package/src/server/decorators/auth.decorator.ts +43 -0
- package/src/server/decorators/auth.decorators.ts +31 -0
- package/src/server/decorators/current-user.decorator.ts +49 -0
- package/src/server/decorators/permission.decorator.ts +49 -0
- package/src/server/guards/auth.guard.ts +56 -0
- package/src/server/guards/custom-throttler.guard.ts +46 -0
- package/src/server/guards/permissions.guard.ts +115 -0
- package/src/server/guards/roles.guard.ts +31 -0
- package/src/server/middleware/auth.middleware.ts +46 -0
- package/src/server/middleware/index.ts +2 -0
- package/src/server/middleware/middleware.ts +11 -0
- package/src/server/middleware/session.middleware.ts +255 -0
- package/src/server/services/account.service.ts +269 -0
- package/src/server/services/auth.service.ts +79 -0
- package/src/server/services/brute-force.service.ts +98 -0
- package/src/server/services/index.ts +15 -0
- package/src/server/services/rate-limiter.service.ts +60 -0
- package/src/server/services/session.service.ts +287 -0
- package/src/server/services/token.service.ts +262 -0
- package/src/session/cookie-store.ts +255 -0
- package/src/session/enhanced-session-manager.ts +406 -0
- package/src/session/index.ts +14 -0
- package/src/session/memory-store.ts +320 -0
- package/src/session/redis-store.ts +443 -0
- package/src/strategies/oauth.strategy.ts +128 -0
- package/src/strategies/traditional-auth.strategy.ts +116 -0
- package/src/tokens/index.ts +4 -0
- package/src/tokens/refresh-token-manager.ts +448 -0
- package/src/tokens/token-validator.ts +311 -0
- package/tsconfig.build.json +28 -0
- package/tsconfig.json +38 -0
- package/tsup.config.mjs +28 -0
- package/vitest.config.mjs +16 -0
- package/vitest.setup.d.ts +2 -0
- package/vitest.setup.d.ts.map +1 -0
- package/vitest.setup.ts +1 -0
|
@@ -0,0 +1,201 @@
|
|
|
1
|
+
// /**
|
|
2
|
+
// * @fileoverview Specific authentication error classes for @plyaz/auth
|
|
3
|
+
// * @module @plyaz/auth/errors/specific-auth-errors
|
|
4
|
+
// *
|
|
5
|
+
// * @description
|
|
6
|
+
// * Defines specific error classes for different authentication failure scenarios.
|
|
7
|
+
// * Each error class provides structured error information including error codes,
|
|
8
|
+
// * HTTP status codes, and localized messages. Used throughout the auth system
|
|
9
|
+
// * for consistent error handling and user feedback.
|
|
10
|
+
// *
|
|
11
|
+
// * @example
|
|
12
|
+
// * ```typescript
|
|
13
|
+
// * import { InvalidCredentialsError, TokenExpiredError } from '@plyaz/auth';
|
|
14
|
+
// *
|
|
15
|
+
// * // Throw specific error
|
|
16
|
+
// * throw new InvalidCredentialsError('Invalid email or password');
|
|
17
|
+
// *
|
|
18
|
+
// * // Handle specific error
|
|
19
|
+
// * if (error instanceof TokenExpiredError) {
|
|
20
|
+
// * // Refresh token logic
|
|
21
|
+
// * }
|
|
22
|
+
// * ```
|
|
23
|
+
// */
|
|
24
|
+
|
|
25
|
+
// import { AUTH_ERROR_CODES, ERROR_CODE_TO_HTTP_STATUS } from "@plyaz/types";
|
|
26
|
+
|
|
27
|
+
|
|
28
|
+
|
|
29
|
+
// /**
|
|
30
|
+
// * Base authentication error class
|
|
31
|
+
// * Provides common error structure for all auth-related errors
|
|
32
|
+
// */
|
|
33
|
+
// export abstract class BaseAuthError extends Error {
|
|
34
|
+
// /** Error code for programmatic handling */
|
|
35
|
+
// public readonly code: string;
|
|
36
|
+
// /** HTTP status code for API responses */
|
|
37
|
+
// public readonly statusCode: number;
|
|
38
|
+
// /** Additional error context */
|
|
39
|
+
// public readonly context?: Record<string, styr>;
|
|
40
|
+
|
|
41
|
+
// constructor(
|
|
42
|
+
// message: string,
|
|
43
|
+
// code: string,
|
|
44
|
+
// statusCode: number,
|
|
45
|
+
// context?: Record<string, any>
|
|
46
|
+
// ) {
|
|
47
|
+
// super(message);
|
|
48
|
+
// this.name = this.constructor.name;
|
|
49
|
+
// this.code = code;
|
|
50
|
+
// this.statusCode = statusCode;
|
|
51
|
+
// this.context = context;
|
|
52
|
+
|
|
53
|
+
// // Maintain proper stack trace
|
|
54
|
+
// if (Error.captureStackTrace) {
|
|
55
|
+
// Error.captureStackTrace(this, this.constructor);
|
|
56
|
+
// }
|
|
57
|
+
// }
|
|
58
|
+
// }
|
|
59
|
+
|
|
60
|
+
// /**
|
|
61
|
+
// * Invalid credentials error
|
|
62
|
+
// * Thrown when email/password combination is incorrect
|
|
63
|
+
// */
|
|
64
|
+
// export class InvalidCredentialsError extends BaseAuthError {
|
|
65
|
+
// constructor(message = 'Invalid email or password', context?: Record<string, any>) {
|
|
66
|
+
// super(
|
|
67
|
+
// message,
|
|
68
|
+
// AUTH_ERROR_CODES.INVALID_CREDENTIALS,
|
|
69
|
+
// ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.INVALID_CREDENTIALS],
|
|
70
|
+
// context
|
|
71
|
+
// );
|
|
72
|
+
// }
|
|
73
|
+
// }
|
|
74
|
+
|
|
75
|
+
// /**
|
|
76
|
+
// * Token expired error
|
|
77
|
+
// * Thrown when access or refresh token has expired
|
|
78
|
+
// */
|
|
79
|
+
// export class TokenExpiredError extends BaseAuthError {
|
|
80
|
+
// constructor(message = 'Authentication token has expired', context?: Record<string, any>) {
|
|
81
|
+
// super(
|
|
82
|
+
// message,
|
|
83
|
+
// AUTH_ERROR_CODES.TOKEN_EXPIRED,
|
|
84
|
+
// ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.TOKEN_EXPIRED],
|
|
85
|
+
// context
|
|
86
|
+
// );
|
|
87
|
+
// }
|
|
88
|
+
// }
|
|
89
|
+
|
|
90
|
+
// /**
|
|
91
|
+
// * Token invalid error
|
|
92
|
+
// * Thrown when token signature is invalid or malformed
|
|
93
|
+
// */
|
|
94
|
+
// export class TokenInvalidError extends BaseAuthError {
|
|
95
|
+
// constructor(message = 'Authentication token is invalid', context?: Record<string, any>) {
|
|
96
|
+
// super(
|
|
97
|
+
// message,
|
|
98
|
+
// AUTH_ERROR_CODES.TOKEN_INVALID,
|
|
99
|
+
// ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.TOKEN_INVALID],
|
|
100
|
+
// context
|
|
101
|
+
// );
|
|
102
|
+
// }
|
|
103
|
+
// }
|
|
104
|
+
|
|
105
|
+
// /**
|
|
106
|
+
// * Token revoked error
|
|
107
|
+
// * Thrown when token has been blacklisted/revoked
|
|
108
|
+
// */
|
|
109
|
+
// export class TokenRevokedError extends BaseAuthError {
|
|
110
|
+
// constructor(message = 'Authentication token has been revoked', context?: Record<string, any>) {
|
|
111
|
+
// super(
|
|
112
|
+
// message,
|
|
113
|
+
// AUTH_ERROR_CODES.TOKEN_REVOKED,
|
|
114
|
+
// ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.TOKEN_REVOKED],
|
|
115
|
+
// context
|
|
116
|
+
// );
|
|
117
|
+
// }
|
|
118
|
+
// }
|
|
119
|
+
|
|
120
|
+
// /**
|
|
121
|
+
// * Session expired error
|
|
122
|
+
// * Thrown when user session is no longer valid
|
|
123
|
+
// */
|
|
124
|
+
// export class SessionExpiredError extends BaseAuthError {
|
|
125
|
+
// constructor(message = 'User session has expired', context?: Record<string, any>) {
|
|
126
|
+
// super(
|
|
127
|
+
// message,
|
|
128
|
+
// AUTH_ERROR_CODES.SESSION_EXPIRED,
|
|
129
|
+
// ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.SESSION_EXPIRED],
|
|
130
|
+
// context
|
|
131
|
+
// );
|
|
132
|
+
// }
|
|
133
|
+
// }
|
|
134
|
+
|
|
135
|
+
// /**
|
|
136
|
+
// * Insufficient permissions error
|
|
137
|
+
// * Thrown when user lacks required permissions for action
|
|
138
|
+
// */
|
|
139
|
+
// export class InsufficientPermissionsError extends BaseAuthError {
|
|
140
|
+
// constructor(
|
|
141
|
+
// resource?: string,
|
|
142
|
+
// action?: string,
|
|
143
|
+
// message = 'Insufficient permissions for this action'
|
|
144
|
+
// ) {
|
|
145
|
+
// const context = resource && action ? { resource, action } : undefined;
|
|
146
|
+
// super(
|
|
147
|
+
// message,
|
|
148
|
+
// AUTH_ERROR_CODES.INSUFFICIENT_PERMISSIONS,
|
|
149
|
+
// ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.INSUFFICIENT_PERMISSIONS],
|
|
150
|
+
// context
|
|
151
|
+
// );
|
|
152
|
+
// }
|
|
153
|
+
// }
|
|
154
|
+
|
|
155
|
+
// /**
|
|
156
|
+
// * Role required error
|
|
157
|
+
// * Thrown when user lacks required role for action
|
|
158
|
+
// */
|
|
159
|
+
// export class RoleRequiredError extends BaseAuthError {
|
|
160
|
+
// constructor(requiredRole?: string, message = 'Required role not found') {
|
|
161
|
+
// const context = requiredRole ? { requiredRole } : undefined;
|
|
162
|
+
// super(
|
|
163
|
+
// message,
|
|
164
|
+
// AUTH_ERROR_CODES.ROLE_REQUIRED,
|
|
165
|
+
// ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.ROLE_REQUIRED],
|
|
166
|
+
// context
|
|
167
|
+
// );
|
|
168
|
+
// }
|
|
169
|
+
// }
|
|
170
|
+
|
|
171
|
+
// /**
|
|
172
|
+
// * Account locked error
|
|
173
|
+
// * Thrown when account is locked due to failed attempts
|
|
174
|
+
// */
|
|
175
|
+
// export class AccountLockedError extends BaseAuthError {
|
|
176
|
+
// constructor(message = 'Account is locked due to failed attempts', context?: Record<string, any>) {
|
|
177
|
+
// super(
|
|
178
|
+
// message,
|
|
179
|
+
// AUTH_ERROR_CODES.ACCOUNT_LOCKED,
|
|
180
|
+
// ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.ACCOUNT_LOCKED],
|
|
181
|
+
// context
|
|
182
|
+
// );
|
|
183
|
+
// }
|
|
184
|
+
// }
|
|
185
|
+
|
|
186
|
+
// /**
|
|
187
|
+
// * Account suspended error
|
|
188
|
+
// * Thrown when account has been suspended by admin
|
|
189
|
+
// */
|
|
190
|
+
// export class AccountSuspendedError extends BaseAuthError {
|
|
191
|
+
// constructor(message = 'Account has been suspended', context?: Record<string, any>) {
|
|
192
|
+
// super(
|
|
193
|
+
// message,
|
|
194
|
+
// AUTH_ERROR_CODES.ACCOUNT_SUSPENDED,
|
|
195
|
+
// ERROR_CODE_TO_HTTP_STATUS[AUTH_ERROR_CODES.ACCOUNT_SUSPENDED],
|
|
196
|
+
// context
|
|
197
|
+
// );
|
|
198
|
+
// }
|
|
199
|
+
// }
|
|
200
|
+
|
|
201
|
+
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* @fileoverview Common utilities, types, and constants for @plyaz/auth
|
|
3
|
+
* @module @plyaz/auth/common
|
|
4
|
+
*/
|
|
5
|
+
|
|
6
|
+
// // Types
|
|
7
|
+
// export * from "./types";
|
|
8
|
+
|
|
9
|
+
// // Constants
|
|
10
|
+
// export * from "./constants";
|
|
11
|
+
|
|
12
|
+
// // Errors
|
|
13
|
+
// export * from "./errors";
|
|
14
|
+
|
|
15
|
+
// // Regex patterns
|
|
16
|
+
// export * from "./regex";
|
|
17
|
+
|
|
18
|
+
// Utilities
|
|
19
|
+
export * from "./utils";
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* @fileoverview Regular expressions for @plyaz/auth
|
|
3
|
+
* @module @plyaz/auth/regex
|
|
4
|
+
*/
|
|
5
|
+
|
|
6
|
+
export const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
|
|
7
|
+
|
|
8
|
+
export const PASSWORD_REGEX = {
|
|
9
|
+
MIN_LENGTH: /.{8,}/,
|
|
10
|
+
HAS_UPPERCASE: /[A-Z]/,
|
|
11
|
+
HAS_LOWERCASE: /[a-z]/,
|
|
12
|
+
HAS_NUMBER: /\d/,
|
|
13
|
+
HAS_SPECIAL: /[!@#$%^&*(),.?":{}|<>]/,
|
|
14
|
+
STRONG: /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*(),.?":{}|<>]).{8,}$/
|
|
15
|
+
};
|
|
16
|
+
|
|
17
|
+
export const PHONE_REGEX = /^\+?[1-9]\d{1,14}$/;
|
|
18
|
+
|
|
19
|
+
export const USERNAME_REGEX = /^[a-zA-Z0-9_]{3,20}$/;
|
|
20
|
+
|
|
21
|
+
export const URL_REGEX = /^https?:\/\/(www\.)?[-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_+.~#?&//=]*)$/;
|
|
22
|
+
|
|
23
|
+
export const JWT_REGEX = /^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/;
|
|
24
|
+
|
|
25
|
+
export const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
|
|
26
|
+
|
|
27
|
+
export const WALLET_ADDRESS_REGEX = /^0x[a-fA-F0-9]{40}$/;
|