@portaidentity/server 1.7.0

package/dist/auth/email-transport.js

@@ -0,0 +1,82 @@
+/**
+ * Pluggable email transport abstraction.
+ *
+ * Defines a transport interface and provides a default SMTP implementation
+ * using Nodemailer. The interface allows swapping transports for testing
+ * (mock transport) or future providers (SES, SendGrid, etc.).
+ *
+ * SMTP configuration is read from the app config (`config.smtp.*`).
+ * Auth is only applied when `smtp.user` is provided — MailHog in dev
+ * doesn't need authentication.
+ *
+ * @example
+ *   const transport = createSmtpTransport();
+ *   const result = await transport.send({
+ *     to: 'user@example.com',
+ *     subject: 'Welcome',
+ *     html: '<h1>Hello</h1>',
+ *     text: 'Hello',
+ *   });
+ */
+import nodemailer from 'nodemailer';
+import { config } from '../config/index.js';
+import { logger } from '../lib/logger.js';
+// ---------------------------------------------------------------------------
+// SMTP Transport
+// ---------------------------------------------------------------------------
+/**
+ * Create an SMTP email transport using Nodemailer.
+ *
+ * Reads SMTP configuration from the app config:
+ *   - `config.smtp.host` — SMTP server hostname
+ *   - `config.smtp.port` — SMTP port (465 = TLS, 587 = STARTTLS, 1025 = MailHog)
+ *   - `config.smtp.user` — Username (optional, omit for MailHog)
+ *   - `config.smtp.pass` — Password (optional)
+ *   - `config.smtp.from` — Default sender address
+ *
+ * @returns EmailTransport implementation backed by Nodemailer SMTP
+ */
+export function createSmtpTransport() {
+    // Build Nodemailer transport options from config
+    const transportOptions = {
+        host: config.smtp.host,
+        port: config.smtp.port,
+        // Port 465 uses implicit TLS; other ports use STARTTLS or plain
+        secure: config.smtp.port === 465,
+    };
+    // Only add auth when credentials are provided (MailHog doesn't need auth)
+    if (config.smtp.user) {
+        transportOptions.auth = {
+            user: config.smtp.user,
+            pass: config.smtp.pass ?? '',
+        };
+    }
+    const transporter = nodemailer.createTransport(transportOptions);
+    return {
+        /**
+         * Send an email via SMTP.
+         *
+         * @param options - Email send options
+         * @returns Result with messageId and accepted/rejected addresses
+         */
+        async send(options) {
+            const from = options.from ?? config.smtp.from;
+            logger.debug({ event: 'smtp_send_started' }, 'Sending email via SMTP');
+            const info = await transporter.sendMail({
+                from,
+                to: options.to,
+                subject: options.subject,
+                html: options.html,
+                text: options.text,
+                replyTo: options.replyTo,
+                ...(options.messageId ? { messageId: options.messageId } : {}),
+            });
+            return {
+                messageId: info.messageId,
+                accepted: Array.isArray(info.accepted) ? info.accepted.map(String) : [],
+                rejected: Array.isArray(info.rejected) ? info.rejected.map(String) : [],
+            };
+        },
+    };
+}
+//# sourceMappingURL=email-transport.js.map

package/dist/auth/email-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-transport.js","sourceRoot":"","sources":["../../src/auth/email-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,UAAU,MAAM,YAAY,CAAC;AAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAwC1C,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB;IACjC,iDAAiD;IACjD,MAAM,gBAAgB,GAKlB;QACF,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;QACtB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;QACtB,gEAAgE;QAChE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG;KACjC,CAAC;IAEF,0EAA0E;IAC1E,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,gBAAgB,CAAC,IAAI,GAAG;YACtB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAgB,UAAU,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAE9E,OAAO;QACL;;;;;WAKG;QACH,KAAK,CAAC,IAAI,CAAC,OAAyB;YAClC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAE9C,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,wBAAwB,CAAC,CAAC;YAEvE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;gBACtC,IAAI;gBACJ,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YAEH,OAAO;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;aACxE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/i18n.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Internationalization (i18n) system for auth workflow pages.
+ *
+ * Uses i18next with filesystem backend to load translations from disk.
+ * Supports per-organization translation overrides:
+ *   1. Default translations: locales/default/{locale}/{namespace}.json
+ *   2. Org overrides: locales/{orgSlug}/{locale}/{namespace}.json
+ *
+ * The locale resolution chain prioritizes:
+ *   1. ui_locales from OIDC authorization request
+ *   2. Accept-Language header
+ *   3. Organization defaultLocale
+ *   4. Global default_locale from system_config
+ *   5. Hardcoded fallback: 'en'
+ *
+ * Also registers a Handlebars {{t}} helper for template translations.
+ *
+ * @example
+ *   await initI18n();
+ *   registerHandlebarsI18nHelper();
+ *   const t = getTranslationFunction('en');
+ *   t('login.title'); // => "Sign in to your account"
+ */
+/**
+ * Initialize i18next with the filesystem backend.
+ *
+ * Loads translations from locales/default/{locale}/{namespace}.json.
+ * Must be called once at application startup before any translation
+ * functions are used.
+ *
+ * @throws Error if i18next initialization fails (fatal startup error)
+ */
+export declare function initI18n(): Promise<void>;
+/**
+ * Resolve the best locale for a request.
+ *
+ * Resolution chain (first non-empty match wins):
+ *   1. ui_locales from OIDC authorization request (space-separated list)
+ *   2. Accept-Language header (first language tag)
+ *   3. Organization defaultLocale
+ *   4. Global default_locale from system_config table
+ *   5. Hardcoded fallback: 'en'
+ *
+ * Only returns locales that i18next has loaded (verified via hasResourceBundle).
+ *
+ * @param uiLocales - Space-separated locale list from OIDC params (e.g., 'nl en')
+ * @param acceptLanguage - Accept-Language header value (e.g., 'en-US,en;q=0.9')
+ * @param orgDefaultLocale - Organization's default locale setting
+ * @returns Resolved locale string (e.g., 'en')
+ */
+export declare function resolveLocale(uiLocales: string | undefined, acceptLanguage: string | undefined, orgDefaultLocale: string): Promise<string>;
+/**
+ * Get a translation function for a specific locale with optional org overrides.
+ *
+ * Returns a function that looks up translation keys across all namespaces.
+ * If an orgSlug is provided, org-specific translations are merged on top
+ * of the defaults (overriding matching keys).
+ *
+ * The returned function uses namespace:key syntax internally but accepts
+ * plain keys that auto-resolve by checking each namespace.
+ *
+ * @param locale - Target locale (e.g., 'en')
+ * @param orgSlug - Optional org slug for translation overrides
+ * @returns Translation function: (key, options?) => translated string
+ */
+export declare function getTranslationFunction(locale: string, orgSlug?: string): (key: string, options?: Record<string, unknown>) => string;
+/**
+ * Register the {{t}} Handlebars helper for template translations.
+ *
+ * Must be called after i18next is initialized. The helper reads the
+ * translation function from the template context's `t` property.
+ *
+ * Usage in templates:
+ *   {{t "login.title"}}
+ *   {{t "common.welcome" name="Alice"}}
+ *
+ * The helper extracts the `t` function from the current Handlebars context
+ * and passes hash arguments as interpolation options.
+ */
+export declare function registerHandlebarsI18nHelper(): void;
+//# sourceMappingURL=i18n.d.ts.map

package/dist/auth/i18n.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.d.ts","sourceRoot":"","sources":["../../src/auth/i18n.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AA2CH;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAyB9C;AA8DD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAwCjB;AAmDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,GACf,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAmG5D;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,IAAI,IAAI,CA+BnD"}

package/dist/auth/i18n.js

@@ -0,0 +1,395 @@
+/**
+ * Internationalization (i18n) system for auth workflow pages.
+ *
+ * Uses i18next with filesystem backend to load translations from disk.
+ * Supports per-organization translation overrides:
+ *   1. Default translations: locales/default/{locale}/{namespace}.json
+ *   2. Org overrides: locales/{orgSlug}/{locale}/{namespace}.json
+ *
+ * The locale resolution chain prioritizes:
+ *   1. ui_locales from OIDC authorization request
+ *   2. Accept-Language header
+ *   3. Organization defaultLocale
+ *   4. Global default_locale from system_config
+ *   5. Hardcoded fallback: 'en'
+ *
+ * Also registers a Handlebars {{t}} helper for template translations.
+ *
+ * @example
+ *   await initI18n();
+ *   registerHandlebarsI18nHelper();
+ *   const t = getTranslationFunction('en');
+ *   t('login.title'); // => "Sign in to your account"
+ */
+import i18next from 'i18next';
+import FsBackend from 'i18next-fs-backend';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import Handlebars from 'handlebars';
+import { getSystemConfigString } from '../lib/system-config.js';
+import { logger } from '../lib/logger.js';
+import { getLocalesDirectory } from '../lib/runtime-paths.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Absolute directory containing locale files shipped with the server package. */
+const LOCALES_DIR = getLocalesDirectory();
+/**
+ * All translation namespaces loaded by default.
+ * Each maps to a JSON file: locales/{locale}/{namespace}.json
+ */
+const NAMESPACES = [
+    'common',
+    'login',
+    'consent',
+    'forgot-password',
+    'reset-password',
+    'magic-link',
+    'invitation',
+    'logout',
+    'errors',
+    'emails',
+    'two-factor',
+];
+/** Hardcoded fallback locale when all resolution steps fail */
+const FALLBACK_LOCALE = 'en';
+// ---------------------------------------------------------------------------
+// i18next initialization
+// ---------------------------------------------------------------------------
+/**
+ * Initialize i18next with the filesystem backend.
+ *
+ * Loads translations from locales/default/{locale}/{namespace}.json.
+ * Must be called once at application startup before any translation
+ * functions are used.
+ *
+ * @throws Error if i18next initialization fails (fatal startup error)
+ */
+export async function initI18n() {
+    await i18next.use(FsBackend).init({
+        // Default fallback language
+        fallbackLng: FALLBACK_LOCALE,
+        // Namespaces to load
+        ns: [...NAMESPACES],
+        defaultNS: 'common',
+        // Filesystem backend configuration
+        backend: {
+            loadPath: path.join(LOCALES_DIR, 'default', '{{lng}}', '{{ns}}.json'),
+        },
+        // Disable key-based fallback (return key as-is if missing)
+        returnNull: false,
+        // Interpolation uses {{variable}} by default — same as Handlebars,
+        // but i18next escapes by default which is safe for HTML contexts
+        interpolation: {
+            escapeValue: false,
+        },
+        // Don't try to detect language from environment
+        detection: undefined,
+        // Preload English locale at startup
+        preload: [FALLBACK_LOCALE],
+    });
+    logger.info({ localesDir: LOCALES_DIR }, 'i18n initialized');
+}
+// ---------------------------------------------------------------------------
+// Org-specific override loading
+// ---------------------------------------------------------------------------
+/**
+ * Load org-specific translation overrides for a namespace.
+ *
+ * Checks for locales/{orgSlug}/{locale}/{namespace}.json and returns
+ * the parsed JSON if found, or null if no override exists.
+ *
+ * @param orgSlug - Organization slug for override lookup
+ * @param locale - Target locale (e.g., 'en')
+ * @param namespace - Translation namespace (e.g., 'login')
+ * @returns Parsed override translations, or null if none exist
+ */
+async function loadOrgOverrides(orgSlug, locale, namespace) {
+    const overridePath = path.join(LOCALES_DIR, orgSlug, locale, `${namespace}.json`);
+    try {
+        const content = await fs.readFile(overridePath, 'utf-8');
+        return JSON.parse(content);
+    }
+    catch {
+        // No override file — this is normal, not an error
+        return null;
+    }
+}
+/**
+ * Deep-merge org overrides into a flat key-value map.
+ *
+ * Flattens nested objects into dot-notation keys for i18next lookup.
+ * For example: { login: { title: "Custom" } } => { "login.title": "Custom" }
+ *
+ * @param obj - Nested object to flatten
+ * @param prefix - Current key prefix (for recursion)
+ * @returns Flat key-value map
+ */
+function flattenOverrides(obj, prefix = '') {
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+        const fullKey = prefix ? `${prefix}.${key}` : key;
+        if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+            Object.assign(result, flattenOverrides(value, fullKey));
+        }
+        else {
+            result[fullKey] = String(value);
+        }
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Locale resolution
+// ---------------------------------------------------------------------------
+/**
+ * Resolve the best locale for a request.
+ *
+ * Resolution chain (first non-empty match wins):
+ *   1. ui_locales from OIDC authorization request (space-separated list)
+ *   2. Accept-Language header (first language tag)
+ *   3. Organization defaultLocale
+ *   4. Global default_locale from system_config table
+ *   5. Hardcoded fallback: 'en'
+ *
+ * Only returns locales that i18next has loaded (verified via hasResourceBundle).
+ *
+ * @param uiLocales - Space-separated locale list from OIDC params (e.g., 'nl en')
+ * @param acceptLanguage - Accept-Language header value (e.g., 'en-US,en;q=0.9')
+ * @param orgDefaultLocale - Organization's default locale setting
+ * @returns Resolved locale string (e.g., 'en')
+ */
+export async function resolveLocale(uiLocales, acceptLanguage, orgDefaultLocale) {
+    // Step 1: Try ui_locales from OIDC authorization request
+    if (uiLocales) {
+        const candidates = uiLocales.split(/\s+/).filter(Boolean);
+        for (const candidate of candidates) {
+            const normalized = normalizeLocale(candidate);
+            if (isLocaleAvailable(normalized)) {
+                return normalized;
+            }
+        }
+    }
+    // Step 2: Try Accept-Language header
+    if (acceptLanguage) {
+        const parsed = parseAcceptLanguage(acceptLanguage);
+        for (const candidate of parsed) {
+            const normalized = normalizeLocale(candidate);
+            if (isLocaleAvailable(normalized)) {
+                return normalized;
+            }
+        }
+    }
+    // Step 3: Try organization default locale
+    if (orgDefaultLocale) {
+        const normalized = normalizeLocale(orgDefaultLocale);
+        if (isLocaleAvailable(normalized)) {
+            return normalized;
+        }
+    }
+    // Step 4: Try global default_locale from system_config
+    const globalDefault = await getSystemConfigString('default_locale', FALLBACK_LOCALE);
+    const normalized = normalizeLocale(globalDefault);
+    if (isLocaleAvailable(normalized)) {
+        return normalized;
+    }
+    // Step 5: Hardcoded fallback
+    return FALLBACK_LOCALE;
+}
+/**
+ * Normalize a locale string to its base language code.
+ * Strips region/variant suffixes: 'en-US' → 'en', 'nl-NL' → 'nl'.
+ *
+ * @param locale - Raw locale string
+ * @returns Lowercase base language code
+ */
+function normalizeLocale(locale) {
+    return locale.toLowerCase().split(/[-_]/)[0];
+}
+/**
+ * Check if a locale has loaded translations in i18next.
+ *
+ * @param locale - Locale to check
+ * @returns true if translations exist for this locale
+ */
+function isLocaleAvailable(locale) {
+    // Check if at least the 'common' namespace has been loaded
+    return i18next.hasResourceBundle(locale, 'common');
+}
+/**
+ * Parse an Accept-Language header into ordered language codes.
+ *
+ * Handles quality values (q=) and returns languages sorted by preference.
+ * Example: 'en-US,en;q=0.9,nl;q=0.8' → ['en-US', 'en', 'nl']
+ *
+ * @param header - Accept-Language header value
+ * @returns Array of language codes, highest quality first
+ */
+function parseAcceptLanguage(header) {
+    return header
+        .split(',')
+        .map((part) => {
+        const [lang, ...params] = part.trim().split(';');
+        const qParam = params.find((p) => p.trim().startsWith('q='));
+        const q = qParam ? parseFloat(qParam.trim().slice(2)) : 1.0;
+        return { lang: lang.trim(), q };
+    })
+        .sort((a, b) => b.q - a.q)
+        .map((entry) => entry.lang)
+        .filter(Boolean);
+}
+// ---------------------------------------------------------------------------
+// Translation function
+// ---------------------------------------------------------------------------
+/**
+ * Get a translation function for a specific locale with optional org overrides.
+ *
+ * Returns a function that looks up translation keys across all namespaces.
+ * If an orgSlug is provided, org-specific translations are merged on top
+ * of the defaults (overriding matching keys).
+ *
+ * The returned function uses namespace:key syntax internally but accepts
+ * plain keys that auto-resolve by checking each namespace.
+ *
+ * @param locale - Target locale (e.g., 'en')
+ * @param orgSlug - Optional org slug for translation overrides
+ * @returns Translation function: (key, options?) => translated string
+ */
+export function getTranslationFunction(locale, orgSlug) {
+    // Cache for org overrides loaded during this function's lifetime
+    const orgOverrideCache = new Map();
+    let orgOverridesLoaded = false;
+    /**
+     * Lazily load all org overrides for the given locale.
+     * Only runs once per translation function instance.
+     */
+    async function ensureOrgOverrides() {
+        if (orgOverridesLoaded || !orgSlug)
+            return;
+        orgOverridesLoaded = true;
+        for (const ns of NAMESPACES) {
+            const overrides = await loadOrgOverrides(orgSlug, locale, ns);
+            if (overrides) {
+                orgOverrideCache.set(ns, flattenOverrides(overrides));
+            }
+        }
+    }
+    // Pre-load org overrides eagerly (fire-and-forget — they'll be ready by first use)
+    if (orgSlug) {
+        ensureOrgOverrides().catch((error) => {
+            logger.warn({ error, orgSlug, locale }, 'Failed to load org translation overrides');
+        });
+    }
+    /**
+     * Translation function that resolves keys across namespaces.
+     *
+     * Key resolution:
+     *   1. Check org overrides (if loaded)
+     *   2. Use i18next standard lookup with namespace detection
+     *   3. Fall back to key itself if no translation found
+     */
+    return (key, options) => {
+        // Determine namespace and key parts
+        const colonIndex = key.indexOf(':');
+        let ns;
+        let lookupKey;
+        if (colonIndex > -1) {
+            // Explicit namespace: "login:title"
+            ns = key.substring(0, colonIndex);
+            lookupKey = key.substring(colonIndex + 1);
+        }
+        else {
+            // Dot-notation: "login.title" — first segment is the namespace
+            const dotIndex = key.indexOf('.');
+            if (dotIndex > -1) {
+                const possibleNs = key.substring(0, dotIndex);
+                if (NAMESPACES.includes(possibleNs)) {
+                    ns = possibleNs;
+                    lookupKey = key.substring(dotIndex + 1);
+                }
+                else {
+                    lookupKey = key;
+                }
+            }
+            else {
+                lookupKey = key;
+            }
+        }
+        // Check org overrides first
+        if (ns && orgOverrideCache.has(ns)) {
+            const overrides = orgOverrideCache.get(ns);
+            if (lookupKey in overrides) {
+                let result = overrides[lookupKey];
+                // Apply simple interpolation for org overrides
+                if (options) {
+                    for (const [varKey, varValue] of Object.entries(options)) {
+                        result = result.replace(new RegExp(`\\{\\{${varKey}\\}\\}`, 'g'), String(varValue));
+                    }
+                }
+                return result;
+            }
+        }
+        // Use i18next for standard lookup
+        const i18nKey = ns ? `${ns}:${lookupKey}` : lookupKey;
+        const translated = i18next.t(i18nKey, {
+            lng: locale,
+            ...(options ?? {}),
+        });
+        let result = typeof translated === 'string' ? translated : key;
+        // Fallback interpolation: if i18next did not replace {{variable}} placeholders
+        // (e.g., due to version-specific behavior or caching), perform manual replacement.
+        // This mirrors the org-override interpolation logic above.
+        if (options && result.includes('{{')) {
+            for (const [varKey, varValue] of Object.entries(options)) {
+                if (varValue !== undefined) {
+                    result = result.replace(new RegExp(`\\{\\{${varKey}\\}\\}`, 'g'), String(varValue));
+                }
+            }
+        }
+        return result;
+    };
+}
+// ---------------------------------------------------------------------------
+// Handlebars i18n helper
+// ---------------------------------------------------------------------------
+/**
+ * Register the {{t}} Handlebars helper for template translations.
+ *
+ * Must be called after i18next is initialized. The helper reads the
+ * translation function from the template context's `t` property.
+ *
+ * Usage in templates:
+ *   {{t "login.title"}}
+ *   {{t "common.welcome" name="Alice"}}
+ *
+ * The helper extracts the `t` function from the current Handlebars context
+ * and passes hash arguments as interpolation options.
+ */
+export function registerHandlebarsI18nHelper() {
+    Handlebars.registerHelper('t', function (key, options) {
+        // The translation function is passed in the template context.
+        // Inside {{#each}} blocks, `this` is the current item (e.g., a string),
+        // so we fall back to the root context to find the `t` function.
+        const t = (this.t ?? options?.data?.root?.t);
+        if (!t) {
+            // No translation function available — return the key as fallback
+            logger.warn({ key }, 'Handlebars {{t}} helper called without translation function in context');
+            return key;
+        }
+        // Pass Handlebars hash arguments as interpolation options
+        // e.g., {{t "common.welcome" name="Alice"}} → t("common.welcome", { name: "Alice" })
+        const hashOptions = options?.hash ?? {};
+        // Resolve undefined hash values from the root context.
+        // Handlebars may pass `undefined` for hash values like `maskedEmail=maskedEmail`
+        // if the identifier resolution fails in certain scope contexts. Fall back to
+        // the root data context to ensure interpolation variables are available.
+        const root = (options?.data?.root ?? this);
+        for (const [hashKey, hashValue] of Object.entries(hashOptions)) {
+            if (hashValue === undefined && root[hashKey] !== undefined) {
+                hashOptions[hashKey] = root[hashKey];
+            }
+        }
+        return t(key, hashOptions);
+    });
+    logger.debug('Handlebars {{t}} i18n helper registered');
+}
+//# sourceMappingURL=i18n.js.map

package/dist/auth/i18n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../../src/auth/i18n.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,UAAU,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,kFAAkF;AAClF,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,GAAG;IACjB,QAAQ;IACR,OAAO;IACP,SAAS;IACT,iBAAiB;IACjB,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,YAAY;CACJ,CAAC;AAEX,+DAA+D;AAC/D,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;QAChC,4BAA4B;QAC5B,WAAW,EAAE,eAAe;QAC5B,qBAAqB;QACrB,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC;QACnB,SAAS,EAAE,QAAQ;QACnB,mCAAmC;QACnC,OAAO,EAAE;YACP,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC;SACtE;QACD,2DAA2D;QAC3D,UAAU,EAAE,KAAK;QACjB,mEAAmE;QACnE,iEAAiE;QACjE,aAAa,EAAE;YACb,WAAW,EAAE,KAAK;SACnB;QACD,gDAAgD;QAChD,SAAS,EAAE,SAAS;QACpB,oCAAoC;QACpC,OAAO,EAAE,CAAC,eAAe,CAAC;KAC3B,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,KAAK,UAAU,gBAAgB,CAC7B,OAAe,EACf,MAAc,EACd,SAAiB;IAEjB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IAClF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,GAA4B,EAC5B,MAAM,GAAG,EAAE;IAEX,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAgC,EAAE,OAAO,CAAC,CAAC,CAAC;QACrF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAA6B,EAC7B,cAAkC,EAClC,gBAAwB;IAExB,yDAAyD;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClC,OAAO,UAAU,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;QACnD,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClC,OAAO,UAAU,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACrD,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,6BAA6B;IAC7B,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,2DAA2D;IAC3D,OAAO,OAAO,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,OAAO,MAAM;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;IAClC,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,OAAgB;IAEhB,iEAAiE;IACjE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkC,CAAC;IACnE,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B;;;OAGG;IACH,KAAK,UAAU,kBAAkB;QAC/B,IAAI,kBAAkB,IAAI,CAAC,OAAO;YAAE,OAAO;QAC3C,kBAAkB,GAAG,IAAI,CAAC;QAE1B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9D,IAAI,SAAS,EAAE,CAAC;gBACd,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,IAAI,OAAO,EAAE,CAAC;QACZ,kBAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACnC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,GAAW,EAAE,OAAiC,EAAU,EAAE;QAChE,oCAAoC;QACpC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,EAAsB,CAAC;QAC3B,IAAI,SAAiB,CAAC;QAEtB,IAAI,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC;YACpB,oCAAoC;YACpC,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAClC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClB,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAC9C,IAAK,UAAgC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC3D,EAAE,GAAG,UAAU,CAAC;oBAChB,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACN,SAAS,GAAG,GAAG,CAAC;gBAClB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,EAAE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;YAC5C,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;gBAC3B,IAAI,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;gBAClC,+CAA+C;gBAC/C,IAAI,OAAO,EAAE,CAAC;oBACZ,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;wBACzD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,MAAM,QAAQ,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACtF,CAAC;gBACH,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACtD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE;YACpC,GAAG,EAAE,MAAM;YACX,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;SACnB,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;QAE/D,+EAA+E;QAC/E,mFAAmF;QACnF,2DAA2D;QAC3D,IAAI,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,MAAM,QAAQ,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,4BAA4B;IAC1C,UAAU,CAAC,cAAc,CAAC,GAAG,EAAE,UAAyC,GAAW,EAAE,OAAiC;QACpH,8DAA8D;QAC9D,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAK,OAAO,EAAE,IAAI,EAAE,IAA4C,EAAE,CAAC,CAAwE,CAAC;QAC7J,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,iEAAiE;YACjE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,wEAAwE,CAAC,CAAC;YAC/F,OAAO,GAAG,CAAC;QACb,CAAC;QAED,0DAA0D;QAC1D,qFAAqF;QACrF,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;QAExC,uDAAuD;QACvD,iFAAiF;QACjF,6EAA6E;QAC7E,yEAAyE;QACzE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,CAA4B,CAAC;QACtE,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC3D,WAAW,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Auth module barrel export.
+ *
+ * Re-exports all public APIs from the auth module for convenient importing.
+ * Consumers should import from this barrel rather than reaching into
+ * individual files (respects module boundary convention).
+ *
+ * @example
+ *   import { generateToken, hashToken, generateCsrfToken } from './auth/index.js';
+ */
+export { generateToken, hashToken } from './tokens.js';
+export type { GeneratedToken } from './tokens.js';
+export { insertToken, insertInvitationToken, findValidToken, findValidInvitationToken, markTokenUsed, deleteExpiredTokens, invalidateUserTokens, } from './token-repository.js';
+export type { TokenTable, GenericInsertTokenTable, TokenRecord, InvitationTokenRecord, } from './token-repository.js';
+export { generateCsrfToken, verifyCsrfToken, setCsrfCookie, getCsrfFromCookie } from './csrf.js';
+export { checkRateLimit, checkRateLimitStrict, resetRateLimit, buildLoginRateLimitKey, buildMagicLinkRateLimitKey, buildMagicLinkCallbackRateLimitKey, buildPasswordResetRateLimitKey, loadLoginRateLimitConfig, loadMagicLinkRateLimitConfig, loadPasswordResetRateLimitConfig, } from './rate-limiter.js';
+export type { RateLimitResult, RateLimitConfig } from './rate-limiter.js';
+export { createSmtpTransport } from './email-transport.js';
+export type { EmailTransport, SendEmailOptions, EmailResult } from './email-transport.js';
+export { renderEmail } from './email-renderer.js';
+export { sendMagicLinkEmail, sendPasswordResetEmail, sendInvitationEmail, renderInvitationEmail, sendWelcomeEmail, sendPasswordChangedEmail, setEmailTransport, } from './email-service.js';
+export type { EmailUser, EmailOrganization, InvitationEmailOptions } from './email-service.js';
+export { initI18n, resolveLocale, getTranslationFunction, registerHandlebarsI18nHelper, } from './i18n.js';
+export { initTemplateEngine, renderPage } from './template-engine.js';
+export type { TemplateContext } from './template-engine.js';
+export { createMagicLinkSession, consumeMagicLinkSession, hasMagicLinkSession, clearMagicLinkSessionCookie, } from './magic-link-session.js';
+export type { MagicLinkSessionData } from './magic-link-session.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,wBAAwB,EACxB,aAAa,EACb,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,UAAU,EACV,uBAAuB,EACvB,WAAW,EACX,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAGjG,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,0BAA0B,EAC1B,kCAAkC,EAClC,8BAA8B,EAC9B,wBAAwB,EACxB,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAG1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAG1F,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAG/F,OAAO,EACL,QAAQ,EACR,aAAa,EACb,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACtE,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,31 @@
+/**
+ * Auth module barrel export.
+ *
+ * Re-exports all public APIs from the auth module for convenient importing.
+ * Consumers should import from this barrel rather than reaching into
+ * individual files (respects module boundary convention).
+ *
+ * @example
+ *   import { generateToken, hashToken, generateCsrfToken } from './auth/index.js';
+ */
+// Token generation and hashing
+export { generateToken, hashToken } from './tokens.js';
+// Token repository (PostgreSQL CRUD for all 3 token tables)
+export { insertToken, insertInvitationToken, findValidToken, findValidInvitationToken, markTokenUsed, deleteExpiredTokens, invalidateUserTokens, } from './token-repository.js';
+// CSRF protection
+export { generateCsrfToken, verifyCsrfToken, setCsrfCookie, getCsrfFromCookie } from './csrf.js';
+// Rate limiting
+export { checkRateLimit, checkRateLimitStrict, resetRateLimit, buildLoginRateLimitKey, buildMagicLinkRateLimitKey, buildMagicLinkCallbackRateLimitKey, buildPasswordResetRateLimitKey, loadLoginRateLimitConfig, loadMagicLinkRateLimitConfig, loadPasswordResetRateLimitConfig, } from './rate-limiter.js';
+// Email transport
+export { createSmtpTransport } from './email-transport.js';
+// Email renderer
+export { renderEmail } from './email-renderer.js';
+// Email service
+export { sendMagicLinkEmail, sendPasswordResetEmail, sendInvitationEmail, renderInvitationEmail, sendWelcomeEmail, sendPasswordChangedEmail, setEmailTransport, } from './email-service.js';
+// i18n
+export { initI18n, resolveLocale, getTranslationFunction, registerHandlebarsI18nHelper, } from './i18n.js';
+// Template engine
+export { initTemplateEngine, renderPage } from './template-engine.js';
+// Magic link session (cross-browser flow)
+export { createMagicLinkSession, consumeMagicLinkSession, hasMagicLinkSession, clearMagicLinkSessionCookie, } from './magic-link-session.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+BAA+B;AAC/B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGvD,4DAA4D;AAC5D,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,wBAAwB,EACxB,aAAa,EACb,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAQ/B,kBAAkB;AAClB,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEjG,gBAAgB;AAChB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,0BAA0B,EAC1B,kCAAkC,EAClC,8BAA8B,EAC9B,wBAAwB,EACxB,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,mBAAmB,CAAC;AAG3B,kBAAkB;AAClB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,iBAAiB;AACjB,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,gBAAgB;AAChB,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAG5B,OAAO;AACP,OAAO,EACL,QAAQ,EACR,aAAa,EACb,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,WAAW,CAAC;AAEnB,kBAAkB;AAClB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGtE,0CAA0C;AAC1C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC"}