@puzzle-ui/auth 0.0.0-stage → 0.5.0

package/dist/auth.step-up.manager.js

@@ -0,0 +1,268 @@
+import { AuthConfigurationError, AuthMfaChallengeError, AuthMfaFactorError, AuthProviderError, AuthSessionError } from "./errors/auth.errors.js";
+import { generateAuthId, hashAuthToken } from "./utils/auth-crypto.utils.js";
+import { StorageConflictError } from "@puzzle-ui/storage";
+// src/auth.step-up.manager.ts
+const AUTH_MFA_STEP_UP_COLLECTION = "auth_mfa_step_up_challenges";
+const stepUpCollection = {
+	name: AUTH_MFA_STEP_UP_COLLECTION,
+	indexes: [
+		{
+			name: "step_up_token_hash_unique",
+			fields: ["tokenHash"],
+			unique: true
+		},
+		{
+			name: "step_up_session_expiration",
+			fields: ["sessionId", "expiresAt"]
+		},
+		{
+			name: "step_up_user_expiration",
+			fields: ["userId", "expiresAt"]
+		}
+	]
+};
+const toPublicSession = (session) => {
+	if (session.kind !== "authenticated" || !session.userId) throw new AuthSessionError("A step-up session must be authenticated.");
+	return {
+		id: session.id,
+		userId: session.userId,
+		kind: "authenticated",
+		createdAt: session.createdAt,
+		lastSeenAt: session.lastSeenAt,
+		expiresAt: session.expiresAt,
+		revokedAt: session.revokedAt
+	};
+};
+var StorageAuthStepUpManager = class {
+	storage;
+	sessions;
+	mfa;
+	collectionName;
+	clock;
+	initialized = false;
+	initializationPromise = null;
+	constructor(dependencies, options = {}) {
+		this.storage = dependencies.storage;
+		this.sessions = dependencies.sessions;
+		this.mfa = dependencies.mfa;
+		this.collectionName = options.collectionName ?? "auth_mfa_step_up_challenges";
+		this.clock = options.clock ?? (() => /* @__PURE__ */ new Date());
+		if (!this.collectionName || this.collectionName.trim().length === 0) throw new AuthConfigurationError("A valid MFA step-up collection name is required.");
+	}
+	async initialize() {
+		if (!this.initializationPromise) {
+			const initialization = (async () => {
+				if (!this.storage.capabilities.uniqueConstraints || !this.storage.capabilities.conditionalWrites || !this.storage.capabilities.atomicBatch) throw new AuthConfigurationError("MFA step-up requires unique constraints, conditional writes and atomic batches.");
+				await this.storage.registerCollection({
+					...stepUpCollection,
+					name: this.collectionName
+				});
+				this.initialized = true;
+			})();
+			this.initializationPromise = initialization.catch((error) => {
+				this.initializationPromise = null;
+				this.initialized = false;
+				throw error;
+			});
+		}
+		return this.initializationPromise;
+	}
+	assertInitialized() {
+		if (!this.initialized) throw new AuthConfigurationError("The MFA step-up manager must be initialized before use.");
+	}
+	now() {
+		const value = this.clock();
+		if (!(value instanceof Date) || !Number.isFinite(value.getTime())) throw new AuthConfigurationError("The configured step-up clock returned an invalid date.");
+		return value;
+	}
+	async getAuthenticatedSession(sessionToken) {
+		if (typeof sessionToken !== "string" || sessionToken.length === 0) throw new AuthSessionError("An authenticated session is required.");
+		let session;
+		try {
+			session = await this.sessions.validate(sessionToken);
+		} catch (error) {
+			throw new AuthSessionError("Could not validate the step-up session.", { cause: error });
+		}
+		if (!session || session.kind !== "authenticated" || !session.userId || session.revokedAt !== null || session.expiresAt.getTime() <= this.now().getTime()) throw new AuthSessionError("An authenticated session is required.");
+		return session;
+	}
+	async findChallenge(challengeToken) {
+		if (typeof challengeToken !== "string" || !/^[a-f0-9]{64}$/i.test(challengeToken)) return null;
+		const tokenHash = await hashAuthToken(challengeToken);
+		return this.storage.findOne(this.collectionName, { where: { tokenHash: {
+			operator: "eq",
+			value: tokenHash
+		} } });
+	}
+	async getPendingContext(challengeToken, sessionToken) {
+		const challenge = await this.findChallenge(challengeToken);
+		if (!challenge || challenge.consumedAt !== null || challenge.expiresAt.getTime() <= this.now().getTime()) throw new AuthMfaChallengeError();
+		const session = await this.getAuthenticatedSession(sessionToken);
+		if (session.id !== challenge.sessionId || session.userId !== challenge.userId) throw new AuthMfaChallengeError();
+		return {
+			challenge,
+			session
+		};
+	}
+	async beginStepUp(input) {
+		this.assertInitialized();
+		const session = await this.getAuthenticatedSession(input.sessionToken);
+		const challenge = await this.mfa.createSignInChallenge({
+			userId: session.userId,
+			ipAddress: input.ipAddress
+		});
+		if (!challenge) throw new AuthMfaFactorError("An active MFA factor is required for step-up authentication.");
+		const now = this.now();
+		const record = {
+			id: generateAuthId("mfa-step-up"),
+			challengeId: challenge.challengeId,
+			tokenHash: await hashAuthToken(challenge.challengeToken),
+			userId: session.userId,
+			sessionId: session.id,
+			expiresAt: challenge.expiresAt,
+			consumedAt: null,
+			createdAt: now,
+			updatedAt: now,
+			revision: 1
+		};
+		try {
+			await this.storage.insert(this.collectionName, record);
+		} catch (error) {
+			throw new AuthProviderError("Could not persist the step-up challenge.", { cause: error });
+		}
+		return challenge;
+	}
+	async getPendingAuthState(challengeToken, sessionToken) {
+		this.assertInitialized();
+		const challenge = await this.findChallenge(challengeToken);
+		if (!challenge || challenge.consumedAt !== null || challenge.expiresAt.getTime() <= this.now().getTime()) return null;
+		let session;
+		try {
+			session = await this.getAuthenticatedSession(sessionToken);
+		} catch {
+			return null;
+		}
+		if (session.id !== challenge.sessionId || session.userId !== challenge.userId) return null;
+		const mfaState = await this.mfa.getPendingAuthState(challengeToken);
+		if (!mfaState || mfaState.status !== "mfa-pending" || mfaState.challengeId !== challenge.challengeId) return null;
+		return {
+			status: "step-up-pending",
+			challengeId: challenge.challengeId,
+			expiresAt: challenge.expiresAt
+		};
+	}
+	async beginPasskey(input) {
+		this.assertInitialized();
+		await this.getPendingContext(input.challengeToken, input.sessionToken);
+		return this.mfa.beginPasskeyMfa(input.challengeToken, input.ipAddress);
+	}
+	async consumeChallenge(challenge) {
+		const now = this.now();
+		try {
+			if (!await this.storage.update(this.collectionName, challenge.id, {
+				consumedAt: now,
+				updatedAt: now
+			}, { expectedRevision: challenge.revision })) throw new StorageConflictError("The step-up challenge was already consumed.");
+		} catch (error) {
+			throw new AuthMfaChallengeError({ cause: error });
+		}
+	}
+	async revokeTemporarySession(sessionId) {
+		try {
+			await this.sessions.revoke(sessionId);
+		} catch (error) {
+			throw new AuthSessionError("Could not revoke the temporary MFA verification session.", { cause: error });
+		}
+	}
+	async completeStepUp(input, verify) {
+		this.assertInitialized();
+		const context = await this.getPendingContext(input.challengeToken, input.sessionToken);
+		const verified = await verify(input.challengeToken);
+		if (verified.user.id !== context.challenge.userId) {
+			await this.revokeTemporarySession(verified.session.id);
+			throw new AuthMfaChallengeError();
+		}
+		try {
+			await this.consumeChallenge(context.challenge);
+		} catch (error) {
+			try {
+				await this.revokeTemporarySession(verified.session.id);
+			} catch (revokeError) {
+				throw new AuthSessionError("The step-up challenge failed and its temporary session could not be revoked.", { cause: revokeError });
+			}
+			throw error;
+		}
+		const now = this.now();
+		let replacement;
+		try {
+			replacement = await this.sessions.rotate({
+				sessionId: context.session.id,
+				metadata: {
+					...context.session.metadata ?? {},
+					authenticationMethod: input.method,
+					mfaVerifiedAt: now.toISOString(),
+					stepUpVerifiedAt: now.toISOString(),
+					stepUpOfSessionId: context.session.id
+				}
+			});
+		} catch (error) {
+			try {
+				await this.revokeTemporarySession(verified.session.id);
+			} catch (revokeError) {
+				throw new AuthSessionError("Session rotation failed and the temporary MFA session could not be revoked.", { cause: revokeError });
+			}
+			throw new AuthSessionError("Could not atomically rotate the session after step-up verification.", { cause: error });
+		}
+		try {
+			await this.revokeTemporarySession(verified.session.id);
+		} catch (error) {
+			try {
+				await this.sessions.revoke(replacement.session.id);
+			} catch (revokeError) {
+				throw new AuthSessionError("Could not revoke the replacement session after temporary-session cleanup failed.", { cause: revokeError });
+			}
+			throw error;
+		}
+		return {
+			user: verified.user,
+			session: toPublicSession(replacement.session),
+			token: replacement.token
+		};
+	}
+	async verifyTotp(input) {
+		return this.completeStepUp({
+			...input,
+			method: "totp"
+		}, (challengeToken) => this.mfa.verifySignInTotp({
+			challengeToken,
+			code: input.code,
+			ipAddress: input.ipAddress
+		}));
+	}
+	async verifyRecoveryCode(input) {
+		return this.completeStepUp({
+			...input,
+			method: "recovery-code"
+		}, (challengeToken) => this.mfa.verifySignInRecoveryCode({
+			challengeToken,
+			code: input.code,
+			ipAddress: input.ipAddress
+		}));
+	}
+	async finishPasskey(input) {
+		await this.getPendingContext(input.challengeToken, input.sessionToken);
+		return this.completeStepUp({
+			challengeToken: input.challengeToken,
+			sessionToken: input.sessionToken,
+			ipAddress: input.ipAddress,
+			method: "passkey"
+		}, (challengeToken) => this.mfa.finishPasskeyMfa({
+			challengeToken,
+			response: input.response,
+			ipAddress: input.ipAddress
+		}));
+	}
+};
+export { AUTH_MFA_STEP_UP_COLLECTION, StorageAuthStepUpManager };
+
+//# sourceMappingURL=auth.step-up.manager.js.map

package/dist/auth.step-up.manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.step-up.manager.js","names":[],"sources":["../src/auth.step-up.manager.ts"],"sourcesContent":["import {\n  StorageConflictError,\n  type StorageAdapter,\n  type StorageCollection,\n  type StorageRecord,\n} from \"@puzzle-ui/storage\";\n\nimport type { SessionManager, SessionRecord } from \"@puzzle-ui/session\";\n\nimport {\n  AuthConfigurationError,\n  AuthMfaChallengeError,\n  AuthMfaFactorError,\n  AuthProviderError,\n  AuthSessionError,\n} from \"./errors/auth.errors\";\n\nimport type { AuthResult, AuthSession } from \"./types/auth-manager.types\";\n\nimport type {\n  AuthMfaPendingResult,\n  PasskeyMfaStarted,\n} from \"./types/mfa.types\";\n\nimport { generateAuthId, hashAuthToken } from \"./utils/auth-crypto.utils\";\n\nimport type { StorageAuthMfaManager } from \"./auth.mfa.manager\";\n\nexport const AUTH_MFA_STEP_UP_COLLECTION = \"auth_mfa_step_up_challenges\";\n\nexport type AuthStepUpChallengeStorageRecord = StorageRecord & {\n  readonly challengeId: string;\n  readonly tokenHash: string;\n  readonly userId: string;\n  readonly sessionId: string;\n  readonly expiresAt: Date;\n  readonly consumedAt: Date | null;\n};\n\nexport type AuthStepUpManagerOptions = {\n  readonly collectionName?: string;\n  readonly clock?: () => Date;\n};\n\nexport type StorageAuthStepUpManagerDependencies = {\n  readonly storage: StorageAdapter;\n  readonly sessions: SessionManager;\n  readonly mfa: StorageAuthMfaManager;\n};\n\nexport type BeginStepUpInput = {\n  readonly sessionToken: string;\n  readonly ipAddress: string;\n};\n\nexport type CompleteStepUpInput = {\n  readonly challengeToken: string;\n  readonly sessionToken: string;\n  readonly code: string;\n  readonly ipAddress: string;\n};\n\nexport type BeginStepUpPasskeyInput = {\n  readonly challengeToken: string;\n  readonly sessionToken: string;\n  readonly ipAddress: string;\n};\n\nexport type FinishStepUpPasskeyInput = {\n  readonly challengeToken: string;\n  readonly sessionToken: string;\n  readonly response: unknown;\n  readonly ipAddress: string;\n};\n\nexport type AuthStepUpPendingState = {\n  readonly status: \"step-up-pending\";\n  readonly challengeId: string;\n  readonly expiresAt: Date;\n};\n\ntype PendingContext = {\n  readonly challenge: AuthStepUpChallengeStorageRecord;\n  readonly session: SessionRecord;\n};\n\ntype MfaVerification = (challengeToken: string) => Promise<AuthResult>;\n\nconst stepUpCollection: StorageCollection<AuthStepUpChallengeStorageRecord> = {\n  name: AUTH_MFA_STEP_UP_COLLECTION,\n  indexes: [\n    {\n      name: \"step_up_token_hash_unique\",\n      fields: [\"tokenHash\"],\n      unique: true,\n    },\n    {\n      name: \"step_up_session_expiration\",\n      fields: [\"sessionId\", \"expiresAt\"],\n    },\n    {\n      name: \"step_up_user_expiration\",\n      fields: [\"userId\", \"expiresAt\"],\n    },\n  ],\n};\n\nconst toPublicSession = (session: SessionRecord): AuthSession => {\n  if (session.kind !== \"authenticated\" || !session.userId) {\n    throw new AuthSessionError(\"A step-up session must be authenticated.\");\n  }\n\n  return {\n    id: session.id,\n    userId: session.userId,\n    kind: \"authenticated\",\n    createdAt: session.createdAt,\n    lastSeenAt: session.lastSeenAt,\n    expiresAt: session.expiresAt,\n    revokedAt: session.revokedAt,\n  };\n};\n\nexport class StorageAuthStepUpManager {\n  private readonly storage: StorageAdapter;\n  private readonly sessions: SessionManager;\n  private readonly mfa: StorageAuthMfaManager;\n\n  private readonly collectionName: string;\n  private readonly clock: () => Date;\n\n  private initialized = false;\n  private initializationPromise: Promise<void> | null = null;\n\n  constructor(\n    dependencies: StorageAuthStepUpManagerDependencies,\n    options: AuthStepUpManagerOptions = {},\n  ) {\n    this.storage = dependencies.storage;\n    this.sessions = dependencies.sessions;\n    this.mfa = dependencies.mfa;\n\n    this.collectionName = options.collectionName ?? AUTH_MFA_STEP_UP_COLLECTION;\n\n    this.clock = options.clock ?? (() => new Date());\n\n    if (!this.collectionName || this.collectionName.trim().length === 0) {\n      throw new AuthConfigurationError(\n        \"A valid MFA step-up collection name is required.\",\n      );\n    }\n  }\n\n  async initialize(): Promise<void> {\n    if (!this.initializationPromise) {\n      const initialization = (async () => {\n        if (\n          !this.storage.capabilities.uniqueConstraints ||\n          !this.storage.capabilities.conditionalWrites ||\n          !this.storage.capabilities.atomicBatch\n        ) {\n          throw new AuthConfigurationError(\n            \"MFA step-up requires unique constraints, conditional writes and atomic batches.\",\n          );\n        }\n\n        await this.storage.registerCollection({\n          ...stepUpCollection,\n          name: this.collectionName,\n        });\n\n        this.initialized = true;\n      })();\n\n      this.initializationPromise = initialization.catch((error) => {\n        this.initializationPromise = null;\n        this.initialized = false;\n        throw error;\n      });\n    }\n\n    return this.initializationPromise;\n  }\n\n  private assertInitialized(): void {\n    if (!this.initialized) {\n      throw new AuthConfigurationError(\n        \"The MFA step-up manager must be initialized before use.\",\n      );\n    }\n  }\n\n  private now(): Date {\n    const value = this.clock();\n\n    if (!(value instanceof Date) || !Number.isFinite(value.getTime())) {\n      throw new AuthConfigurationError(\n        \"The configured step-up clock returned an invalid date.\",\n      );\n    }\n\n    return value;\n  }\n\n  private async getAuthenticatedSession(\n    sessionToken: string,\n  ): Promise<SessionRecord> {\n    if (typeof sessionToken !== \"string\" || sessionToken.length === 0) {\n      throw new AuthSessionError(\"An authenticated session is required.\");\n    }\n\n    let session: SessionRecord | null;\n\n    try {\n      session = await this.sessions.validate(sessionToken);\n    } catch (error) {\n      throw new AuthSessionError(\"Could not validate the step-up session.\", {\n        cause: error,\n      });\n    }\n\n    if (\n      !session ||\n      session.kind !== \"authenticated\" ||\n      !session.userId ||\n      session.revokedAt !== null ||\n      session.expiresAt.getTime() <= this.now().getTime()\n    ) {\n      throw new AuthSessionError(\"An authenticated session is required.\");\n    }\n\n    return session;\n  }\n\n  private async findChallenge(\n    challengeToken: string,\n  ): Promise<AuthStepUpChallengeStorageRecord | null> {\n    if (\n      typeof challengeToken !== \"string\" ||\n      !/^[a-f0-9]{64}$/i.test(challengeToken)\n    ) {\n      return null;\n    }\n\n    const tokenHash = await hashAuthToken(challengeToken);\n\n    return this.storage.findOne<AuthStepUpChallengeStorageRecord>(\n      this.collectionName,\n      {\n        where: {\n          tokenHash: {\n            operator: \"eq\",\n            value: tokenHash,\n          },\n        },\n      },\n    );\n  }\n\n  private async getPendingContext(\n    challengeToken: string,\n    sessionToken: string,\n  ): Promise<PendingContext> {\n    const challenge = await this.findChallenge(challengeToken);\n\n    if (\n      !challenge ||\n      challenge.consumedAt !== null ||\n      challenge.expiresAt.getTime() <= this.now().getTime()\n    ) {\n      throw new AuthMfaChallengeError();\n    }\n\n    const session = await this.getAuthenticatedSession(sessionToken);\n\n    if (\n      session.id !== challenge.sessionId ||\n      session.userId !== challenge.userId\n    ) {\n      throw new AuthMfaChallengeError();\n    }\n\n    return {\n      challenge,\n      session,\n    };\n  }\n\n  async beginStepUp(input: BeginStepUpInput): Promise<AuthMfaPendingResult> {\n    this.assertInitialized();\n\n    const session = await this.getAuthenticatedSession(input.sessionToken);\n\n    const challenge = await this.mfa.createSignInChallenge({\n      userId: session.userId!,\n      ipAddress: input.ipAddress,\n    });\n\n    if (!challenge) {\n      throw new AuthMfaFactorError(\n        \"An active MFA factor is required for step-up authentication.\",\n      );\n    }\n\n    const now = this.now();\n\n    const record: AuthStepUpChallengeStorageRecord = {\n      id: generateAuthId(\"mfa-step-up\"),\n      challengeId: challenge.challengeId,\n      tokenHash: await hashAuthToken(challenge.challengeToken),\n      userId: session.userId!,\n      sessionId: session.id,\n      expiresAt: challenge.expiresAt,\n      consumedAt: null,\n      createdAt: now,\n      updatedAt: now,\n      revision: 1,\n    };\n\n    try {\n      await this.storage.insert<AuthStepUpChallengeStorageRecord>(\n        this.collectionName,\n        record,\n      );\n    } catch (error) {\n      throw new AuthProviderError(\"Could not persist the step-up challenge.\", {\n        cause: error,\n      });\n    }\n\n    return challenge;\n  }\n\n  async getPendingAuthState(\n    challengeToken: string,\n    sessionToken: string,\n  ): Promise<AuthStepUpPendingState | null> {\n    this.assertInitialized();\n\n    const challenge = await this.findChallenge(challengeToken);\n\n    if (\n      !challenge ||\n      challenge.consumedAt !== null ||\n      challenge.expiresAt.getTime() <= this.now().getTime()\n    ) {\n      return null;\n    }\n\n    let session: SessionRecord;\n\n    try {\n      session = await this.getAuthenticatedSession(sessionToken);\n    } catch {\n      return null;\n    }\n\n    if (\n      session.id !== challenge.sessionId ||\n      session.userId !== challenge.userId\n    ) {\n      return null;\n    }\n\n    const mfaState = await this.mfa.getPendingAuthState(challengeToken);\n\n    if (\n      !mfaState ||\n      mfaState.status !== \"mfa-pending\" ||\n      mfaState.challengeId !== challenge.challengeId\n    ) {\n      return null;\n    }\n\n    return {\n      status: \"step-up-pending\",\n      challengeId: challenge.challengeId,\n      expiresAt: challenge.expiresAt,\n    };\n  }\n\n  async beginPasskey(\n    input: BeginStepUpPasskeyInput,\n  ): Promise<PasskeyMfaStarted> {\n    this.assertInitialized();\n\n    await this.getPendingContext(input.challengeToken, input.sessionToken);\n\n    return this.mfa.beginPasskeyMfa(input.challengeToken, input.ipAddress);\n  }\n\n  private async consumeChallenge(\n    challenge: AuthStepUpChallengeStorageRecord,\n  ): Promise<void> {\n    const now = this.now();\n\n    try {\n      const consumed =\n        await this.storage.update<AuthStepUpChallengeStorageRecord>(\n          this.collectionName,\n          challenge.id,\n          {\n            consumedAt: now,\n            updatedAt: now,\n          },\n          {\n            expectedRevision: challenge.revision,\n          },\n        );\n\n      if (!consumed) {\n        throw new StorageConflictError(\n          \"The step-up challenge was already consumed.\",\n        );\n      }\n    } catch (error) {\n      throw new AuthMfaChallengeError({ cause: error });\n    }\n  }\n\n  private async revokeTemporarySession(sessionId: string): Promise<void> {\n    try {\n      await this.sessions.revoke(sessionId);\n    } catch (error) {\n      throw new AuthSessionError(\n        \"Could not revoke the temporary MFA verification session.\",\n        { cause: error },\n      );\n    }\n  }\n\n  private async completeStepUp(\n    input: {\n      readonly challengeToken: string;\n      readonly sessionToken: string;\n      readonly method: string;\n      readonly ipAddress: string;\n    },\n    verify: MfaVerification,\n  ): Promise<AuthResult> {\n    this.assertInitialized();\n\n    const context = await this.getPendingContext(\n      input.challengeToken,\n      input.sessionToken,\n    );\n\n    // The MFA manager consumes its own challenge and creates a short-lived\n    // internal session after successful factor verification. That token is\n    // never returned to the caller.\n    const verified = await verify(input.challengeToken);\n\n    if (verified.user.id !== context.challenge.userId) {\n      await this.revokeTemporarySession(verified.session.id);\n      throw new AuthMfaChallengeError();\n    }\n\n    // Consume the step-up wrapper challenge before rotating the original\n    // session. Conditional revision checking ensures that concurrent\n    // requests cannot both proceed to session rotation.\n    try {\n      await this.consumeChallenge(context.challenge);\n    } catch (error) {\n      try {\n        await this.revokeTemporarySession(verified.session.id);\n      } catch (revokeError) {\n        throw new AuthSessionError(\n          \"The step-up challenge failed and its temporary session could not be revoked.\",\n          { cause: revokeError },\n        );\n      }\n\n      throw error;\n    }\n\n    const now = this.now();\n\n    let replacement: Awaited<ReturnType<SessionManager[\"rotate\"]>>;\n\n    try {\n      // SessionManager.rotate() atomically inserts the replacement session\n      // and revokes the original session in a single storage batch.\n      replacement = await this.sessions.rotate({\n        sessionId: context.session.id,\n        metadata: {\n          ...(context.session.metadata ?? {}),\n          authenticationMethod: input.method,\n          mfaVerifiedAt: now.toISOString(),\n          stepUpVerifiedAt: now.toISOString(),\n          stepUpOfSessionId: context.session.id,\n        },\n      });\n    } catch (error) {\n      try {\n        await this.revokeTemporarySession(verified.session.id);\n      } catch (revokeError) {\n        throw new AuthSessionError(\n          \"Session rotation failed and the temporary MFA session could not be revoked.\",\n          { cause: revokeError },\n        );\n      }\n\n      throw new AuthSessionError(\n        \"Could not atomically rotate the session after step-up verification.\",\n        { cause: error },\n      );\n    }\n\n    // The temporary session created by the MFA manager is not the session\n    // returned to the application. Revoke it after the original session has\n    // been atomically rotated.\n    try {\n      await this.revokeTemporarySession(verified.session.id);\n    } catch (error) {\n      try {\n        await this.sessions.revoke(replacement.session.id);\n      } catch (revokeError) {\n        throw new AuthSessionError(\n          \"Could not revoke the replacement session after temporary-session cleanup failed.\",\n          { cause: revokeError },\n        );\n      }\n\n      throw error;\n    }\n\n    return {\n      user: verified.user,\n      session: toPublicSession(replacement.session),\n      token: replacement.token,\n    };\n  }\n\n  async verifyTotp(input: CompleteStepUpInput): Promise<AuthResult> {\n    return this.completeStepUp(\n      {\n        ...input,\n        method: \"totp\",\n      },\n      (challengeToken) =>\n        this.mfa.verifySignInTotp({\n          challengeToken,\n          code: input.code,\n          ipAddress: input.ipAddress,\n        }),\n    );\n  }\n\n  async verifyRecoveryCode(input: CompleteStepUpInput): Promise<AuthResult> {\n    return this.completeStepUp(\n      {\n        ...input,\n        method: \"recovery-code\",\n      },\n      (challengeToken) =>\n        this.mfa.verifySignInRecoveryCode({\n          challengeToken,\n          code: input.code,\n          ipAddress: input.ipAddress,\n        }),\n    );\n  }\n\n  async finishPasskey(input: FinishStepUpPasskeyInput): Promise<AuthResult> {\n    await this.getPendingContext(input.challengeToken, input.sessionToken);\n\n    return this.completeStepUp(\n      {\n        challengeToken: input.challengeToken,\n        sessionToken: input.sessionToken,\n        ipAddress: input.ipAddress,\n        method: \"passkey\",\n      },\n      (challengeToken) =>\n        this.mfa.finishPasskeyMfa({\n          challengeToken,\n          response: input.response,\n          ipAddress: input.ipAddress,\n        }),\n    );\n  }\n}\n"],"mappings":";;;;AA4BA,MAAa,8BAA8B;AA4D3C,MAAM,mBAAwE;CAC5E,MAAM;CACN,SAAS;EACP;GACE,MAAM;GACN,QAAQ,CAAC,WAAW;GACpB,QAAQ;EACV;EACA;GACE,MAAM;GACN,QAAQ,CAAC,aAAa,WAAW;EACnC;EACA;GACE,MAAM;GACN,QAAQ,CAAC,UAAU,WAAW;EAChC;CACF;AACF;AAEA,MAAM,mBAAmB,YAAwC;CAC/D,IAAI,QAAQ,SAAS,mBAAmB,CAAC,QAAQ,QAC/C,MAAM,IAAI,iBAAiB,0CAA0C;CAGvE,OAAO;EACL,IAAI,QAAQ;EACZ,QAAQ,QAAQ;EAChB,MAAM;EACN,WAAW,QAAQ;EACnB,YAAY,QAAQ;EACpB,WAAW,QAAQ;EACnB,WAAW,QAAQ;CACrB;AACF;AAEA,IAAa,2BAAb,MAAsC;CACpC;CACA;CACA;CAEA;CACA;CAEA,cAAsB;CACtB,wBAAsD;CAEtD,YACE,cACA,UAAoC,CAAC,GACrC;EACA,KAAK,UAAU,aAAa;EAC5B,KAAK,WAAW,aAAa;EAC7B,KAAK,MAAM,aAAa;EAExB,KAAK,iBAAiB,QAAQ,kBAAA;EAE9B,KAAK,QAAQ,QAAQ,gCAAgB,IAAI,KAAK;EAE9C,IAAI,CAAC,KAAK,kBAAkB,KAAK,eAAe,KAAK,CAAC,CAAC,WAAW,GAChE,MAAM,IAAI,uBACR,kDACF;CAEJ;CAEA,MAAM,aAA4B;EAChC,IAAI,CAAC,KAAK,uBAAuB;GAC/B,MAAM,kBAAkB,YAAY;IAClC,IACE,CAAC,KAAK,QAAQ,aAAa,qBAC3B,CAAC,KAAK,QAAQ,aAAa,qBAC3B,CAAC,KAAK,QAAQ,aAAa,aAE3B,MAAM,IAAI,uBACR,iFACF;IAGF,MAAM,KAAK,QAAQ,mBAAmB;KACpC,GAAG;KACH,MAAM,KAAK;IACb,CAAC;IAED,KAAK,cAAc;GACrB,EAAA,CAAG;GAEH,KAAK,wBAAwB,eAAe,OAAO,UAAU;IAC3D,KAAK,wBAAwB;IAC7B,KAAK,cAAc;IACnB,MAAM;GACR,CAAC;EACH;EAEA,OAAO,KAAK;CACd;CAEA,oBAAkC;EAChC,IAAI,CAAC,KAAK,aACR,MAAM,IAAI,uBACR,yDACF;CAEJ;CAEA,MAAoB;EAClB,MAAM,QAAQ,KAAK,MAAM;EAEzB,IAAI,EAAE,iBAAiB,SAAS,CAAC,OAAO,SAAS,MAAM,QAAQ,CAAC,GAC9D,MAAM,IAAI,uBACR,wDACF;EAGF,OAAO;CACT;CAEA,MAAc,wBACZ,cACwB;EACxB,IAAI,OAAO,iBAAiB,YAAY,aAAa,WAAW,GAC9D,MAAM,IAAI,iBAAiB,uCAAuC;EAGpE,IAAI;EAEJ,IAAI;GACF,UAAU,MAAM,KAAK,SAAS,SAAS,YAAY;EACrD,SAAS,OAAO;GACd,MAAM,IAAI,iBAAiB,2CAA2C,EACpE,OAAO,MACT,CAAC;EACH;EAEA,IACE,CAAC,WACD,QAAQ,SAAS,mBACjB,CAAC,QAAQ,UACT,QAAQ,cAAc,QACtB,QAAQ,UAAU,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,GAElD,MAAM,IAAI,iBAAiB,uCAAuC;EAGpE,OAAO;CACT;CAEA,MAAc,cACZ,gBACkD;EAClD,IACE,OAAO,mBAAmB,YAC1B,CAAC,kBAAkB,KAAK,cAAc,GAEtC,OAAO;EAGT,MAAM,YAAY,MAAM,cAAc,cAAc;EAEpD,OAAO,KAAK,QAAQ,QAClB,KAAK,gBACL,EACE,OAAO,EACL,WAAW;GACT,UAAU;GACV,OAAO;EACT,EACF,EACF,CACF;CACF;CAEA,MAAc,kBACZ,gBACA,cACyB;EACzB,MAAM,YAAY,MAAM,KAAK,cAAc,cAAc;EAEzD,IACE,CAAC,aACD,UAAU,eAAe,QACzB,UAAU,UAAU,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,GAEpD,MAAM,IAAI,sBAAsB;EAGlC,MAAM,UAAU,MAAM,KAAK,wBAAwB,YAAY;EAE/D,IACE,QAAQ,OAAO,UAAU,aACzB,QAAQ,WAAW,UAAU,QAE7B,MAAM,IAAI,sBAAsB;EAGlC,OAAO;GACL;GACA;EACF;CACF;CAEA,MAAM,YAAY,OAAwD;EACxE,KAAK,kBAAkB;EAEvB,MAAM,UAAU,MAAM,KAAK,wBAAwB,MAAM,YAAY;EAErE,MAAM,YAAY,MAAM,KAAK,IAAI,sBAAsB;GACrD,QAAQ,QAAQ;GAChB,WAAW,MAAM;EACnB,CAAC;EAED,IAAI,CAAC,WACH,MAAM,IAAI,mBACR,8DACF;EAGF,MAAM,MAAM,KAAK,IAAI;EAErB,MAAM,SAA2C;GAC/C,IAAI,eAAe,aAAa;GAChC,aAAa,UAAU;GACvB,WAAW,MAAM,cAAc,UAAU,cAAc;GACvD,QAAQ,QAAQ;GAChB,WAAW,QAAQ;GACnB,WAAW,UAAU;GACrB,YAAY;GACZ,WAAW;GACX,WAAW;GACX,UAAU;EACZ;EAEA,IAAI;GACF,MAAM,KAAK,QAAQ,OACjB,KAAK,gBACL,MACF;EACF,SAAS,OAAO;GACd,MAAM,IAAI,kBAAkB,4CAA4C,EACtE,OAAO,MACT,CAAC;EACH;EAEA,OAAO;CACT;CAEA,MAAM,oBACJ,gBACA,cACwC;EACxC,KAAK,kBAAkB;EAEvB,MAAM,YAAY,MAAM,KAAK,cAAc,cAAc;EAEzD,IACE,CAAC,aACD,UAAU,eAAe,QACzB,UAAU,UAAU,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,GAEpD,OAAO;EAGT,IAAI;EAEJ,IAAI;GACF,UAAU,MAAM,KAAK,wBAAwB,YAAY;EAC3D,QAAQ;GACN,OAAO;EACT;EAEA,IACE,QAAQ,OAAO,UAAU,aACzB,QAAQ,WAAW,UAAU,QAE7B,OAAO;EAGT,MAAM,WAAW,MAAM,KAAK,IAAI,oBAAoB,cAAc;EAElE,IACE,CAAC,YACD,SAAS,WAAW,iBACpB,SAAS,gBAAgB,UAAU,aAEnC,OAAO;EAGT,OAAO;GACL,QAAQ;GACR,aAAa,UAAU;GACvB,WAAW,UAAU;EACvB;CACF;CAEA,MAAM,aACJ,OAC4B;EAC5B,KAAK,kBAAkB;EAEvB,MAAM,KAAK,kBAAkB,MAAM,gBAAgB,MAAM,YAAY;EAErE,OAAO,KAAK,IAAI,gBAAgB,MAAM,gBAAgB,MAAM,SAAS;CACvE;CAEA,MAAc,iBACZ,WACe;EACf,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI;GAcF,IAAI,CAAC,MAZG,KAAK,QAAQ,OACjB,KAAK,gBACL,UAAU,IACV;IACE,YAAY;IACZ,WAAW;GACb,GACA,EACE,kBAAkB,UAAU,SAC9B,CACF,GAGA,MAAM,IAAI,qBACR,6CACF;EAEJ,SAAS,OAAO;GACd,MAAM,IAAI,sBAAsB,EAAE,OAAO,MAAM,CAAC;EAClD;CACF;CAEA,MAAc,uBAAuB,WAAkC;EACrE,IAAI;GACF,MAAM,KAAK,SAAS,OAAO,SAAS;EACtC,SAAS,OAAO;GACd,MAAM,IAAI,iBACR,4DACA,EAAE,OAAO,MAAM,CACjB;EACF;CACF;CAEA,MAAc,eACZ,OAMA,QACqB;EACrB,KAAK,kBAAkB;EAEvB,MAAM,UAAU,MAAM,KAAK,kBACzB,MAAM,gBACN,MAAM,YACR;EAKA,MAAM,WAAW,MAAM,OAAO,MAAM,cAAc;EAElD,IAAI,SAAS,KAAK,OAAO,QAAQ,UAAU,QAAQ;GACjD,MAAM,KAAK,uBAAuB,SAAS,QAAQ,EAAE;GACrD,MAAM,IAAI,sBAAsB;EAClC;EAKA,IAAI;GACF,MAAM,KAAK,iBAAiB,QAAQ,SAAS;EAC/C,SAAS,OAAO;GACd,IAAI;IACF,MAAM,KAAK,uBAAuB,SAAS,QAAQ,EAAE;GACvD,SAAS,aAAa;IACpB,MAAM,IAAI,iBACR,gFACA,EAAE,OAAO,YAAY,CACvB;GACF;GAEA,MAAM;EACR;EAEA,MAAM,MAAM,KAAK,IAAI;EAErB,IAAI;EAEJ,IAAI;GAGF,cAAc,MAAM,KAAK,SAAS,OAAO;IACvC,WAAW,QAAQ,QAAQ;IAC3B,UAAU;KACR,GAAI,QAAQ,QAAQ,YAAY,CAAC;KACjC,sBAAsB,MAAM;KAC5B,eAAe,IAAI,YAAY;KAC/B,kBAAkB,IAAI,YAAY;KAClC,mBAAmB,QAAQ,QAAQ;IACrC;GACF,CAAC;EACH,SAAS,OAAO;GACd,IAAI;IACF,MAAM,KAAK,uBAAuB,SAAS,QAAQ,EAAE;GACvD,SAAS,aAAa;IACpB,MAAM,IAAI,iBACR,+EACA,EAAE,OAAO,YAAY,CACvB;GACF;GAEA,MAAM,IAAI,iBACR,uEACA,EAAE,OAAO,MAAM,CACjB;EACF;EAKA,IAAI;GACF,MAAM,KAAK,uBAAuB,SAAS,QAAQ,EAAE;EACvD,SAAS,OAAO;GACd,IAAI;IACF,MAAM,KAAK,SAAS,OAAO,YAAY,QAAQ,EAAE;GACnD,SAAS,aAAa;IACpB,MAAM,IAAI,iBACR,oFACA,EAAE,OAAO,YAAY,CACvB;GACF;GAEA,MAAM;EACR;EAEA,OAAO;GACL,MAAM,SAAS;GACf,SAAS,gBAAgB,YAAY,OAAO;GAC5C,OAAO,YAAY;EACrB;CACF;CAEA,MAAM,WAAW,OAAiD;EAChE,OAAO,KAAK,eACV;GACE,GAAG;GACH,QAAQ;EACV,IACC,mBACC,KAAK,IAAI,iBAAiB;GACxB;GACA,MAAM,MAAM;GACZ,WAAW,MAAM;EACnB,CAAC,CACL;CACF;CAEA,MAAM,mBAAmB,OAAiD;EACxE,OAAO,KAAK,eACV;GACE,GAAG;GACH,QAAQ;EACV,IACC,mBACC,KAAK,IAAI,yBAAyB;GAChC;GACA,MAAM,MAAM;GACZ,WAAW,MAAM;EACnB,CAAC,CACL;CACF;CAEA,MAAM,cAAc,OAAsD;EACxE,MAAM,KAAK,kBAAkB,MAAM,gBAAgB,MAAM,YAAY;EAErE,OAAO,KAAK,eACV;GACE,gBAAgB,MAAM;GACtB,cAAc,MAAM;GACpB,WAAW,MAAM;GACjB,QAAQ;EACV,IACC,mBACC,KAAK,IAAI,iBAAiB;GACxB;GACA,UAAU,MAAM;GAChB,WAAW,MAAM;EACnB,CAAC,CACL;CACF;AACF"}

package/dist/auth.storage.cjs

@@ -0,0 +1,164 @@
+// src/auth.storage.ts
+const AUTH_USER_COLLECTION = "auth_users";
+const AUTH_CREDENTIAL_COLLECTION = "auth_credentials";
+const AUTH_ACTION_TOKEN_COLLECTION = "auth_action_tokens";
+const AUTH_AUDIT_COLLECTION = "auth_audit_events";
+const AUTH_RATE_LIMIT_COLLECTION = "auth_rate_limits";
+const AUTH_MFA_FACTOR_COLLECTION = "auth_mfa_factors";
+const AUTH_MFA_CHALLENGE_COLLECTION = "auth_mfa_challenges";
+const AUTH_RECOVERY_CODE_COLLECTION = "auth_recovery_codes";
+const authUserCollection = {
+	name: AUTH_USER_COLLECTION,
+	indexes: [{
+		name: "normalized_email_unique",
+		fields: ["normalizedEmail"],
+		unique: true
+	}]
+};
+const authCredentialCollection = {
+	name: AUTH_CREDENTIAL_COLLECTION,
+	indexes: [{
+		name: "user_kind_unique",
+		fields: ["userId", "kind"],
+		unique: true
+	}, {
+		name: "user_id",
+		fields: ["userId"]
+	}]
+};
+const authActionTokenCollection = {
+	name: AUTH_ACTION_TOKEN_COLLECTION,
+	indexes: [
+		{
+			name: "token_hash_unique",
+			fields: ["tokenHash"],
+			unique: true
+		},
+		{
+			name: "user_purpose",
+			fields: ["userId", "purpose"]
+		},
+		{
+			name: "token_expiration",
+			fields: ["expiresAt"]
+		}
+	]
+};
+const authAuditCollection = {
+	name: AUTH_AUDIT_COLLECTION,
+	indexes: [{
+		name: "user_created",
+		fields: ["userId", "createdAt"]
+	}, {
+		name: "action_created",
+		fields: ["action", "createdAt"]
+	}]
+};
+const authRateLimitCollection = {
+	name: AUTH_RATE_LIMIT_COLLECTION,
+	indexes: [{
+		name: "rate_limit_reset",
+		fields: ["resetAt"]
+	}]
+};
+const authMfaFactorCollection = {
+	name: AUTH_MFA_FACTOR_COLLECTION,
+	indexes: [
+		{
+			name: "factor_key_unique",
+			fields: ["factorKey"],
+			unique: true
+		},
+		{
+			name: "factor_user_status",
+			fields: ["userId", "status"]
+		},
+		{
+			name: "factor_credential_id",
+			fields: ["credentialId"]
+		}
+	]
+};
+const authMfaChallengeCollection = {
+	name: AUTH_MFA_CHALLENGE_COLLECTION,
+	indexes: [
+		{
+			name: "mfa_challenge_token_unique",
+			fields: ["tokenHash"],
+			unique: true
+		},
+		{
+			name: "mfa_challenge_user",
+			fields: ["userId", "purpose"]
+		},
+		{
+			name: "mfa_challenge_expiration",
+			fields: ["expiresAt"]
+		}
+	]
+};
+const authRecoveryCodeCollection = {
+	name: AUTH_RECOVERY_CODE_COLLECTION,
+	indexes: [{
+		name: "recovery_code_hash_unique",
+		fields: ["codeHash"],
+		unique: true
+	}, {
+		name: "recovery_code_user",
+		fields: ["userId", "consumedAt"]
+	}]
+};
+const initializeAuthStorage = async (storage, options = {}) => {
+	if (!storage.capabilities.uniqueConstraints || !storage.capabilities.atomicBatch) throw new Error("Authentication storage requires unique constraints and atomic batches.");
+	await storage.registerCollection({
+		...authUserCollection,
+		name: options.usersCollection ?? "auth_users"
+	});
+	await storage.registerCollection({
+		...authCredentialCollection,
+		name: options.credentialsCollection ?? "auth_credentials"
+	});
+	await storage.registerCollection({
+		...authActionTokenCollection,
+		name: options.actionTokensCollection ?? "auth_action_tokens"
+	});
+	await storage.registerCollection({
+		...authAuditCollection,
+		name: options.auditCollection ?? "auth_audit_events"
+	});
+	await storage.registerCollection({
+		...authRateLimitCollection,
+		name: options.rateLimitsCollection ?? "auth_rate_limits"
+	});
+	await storage.registerCollection({
+		...authMfaFactorCollection,
+		name: options.factorsCollection ?? "auth_mfa_factors"
+	});
+	await storage.registerCollection({
+		...authMfaChallengeCollection,
+		name: options.challengesCollection ?? "auth_mfa_challenges"
+	});
+	await storage.registerCollection({
+		...authRecoveryCodeCollection,
+		name: options.recoveryCodesCollection ?? "auth_recovery_codes"
+	});
+};
+exports.AUTH_ACTION_TOKEN_COLLECTION = AUTH_ACTION_TOKEN_COLLECTION;
+exports.AUTH_AUDIT_COLLECTION = AUTH_AUDIT_COLLECTION;
+exports.AUTH_CREDENTIAL_COLLECTION = AUTH_CREDENTIAL_COLLECTION;
+exports.AUTH_MFA_CHALLENGE_COLLECTION = AUTH_MFA_CHALLENGE_COLLECTION;
+exports.AUTH_MFA_FACTOR_COLLECTION = AUTH_MFA_FACTOR_COLLECTION;
+exports.AUTH_RATE_LIMIT_COLLECTION = AUTH_RATE_LIMIT_COLLECTION;
+exports.AUTH_RECOVERY_CODE_COLLECTION = AUTH_RECOVERY_CODE_COLLECTION;
+exports.AUTH_USER_COLLECTION = AUTH_USER_COLLECTION;
+exports.authActionTokenCollection = authActionTokenCollection;
+exports.authAuditCollection = authAuditCollection;
+exports.authCredentialCollection = authCredentialCollection;
+exports.authMfaChallengeCollection = authMfaChallengeCollection;
+exports.authMfaFactorCollection = authMfaFactorCollection;
+exports.authRateLimitCollection = authRateLimitCollection;
+exports.authRecoveryCodeCollection = authRecoveryCodeCollection;
+exports.authUserCollection = authUserCollection;
+exports.initializeAuthStorage = initializeAuthStorage;
+
+//# sourceMappingURL=auth.storage.cjs.map

package/dist/auth.storage.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.storage.cjs","names":[],"sources":["../src/auth.storage.ts"],"sourcesContent":["import type {\n  StorageAdapter,\n  StorageCollection,\n  StorageRecord,\n} from \"@puzzle-ui/storage\";\n\nimport type { AuthUser } from \"./types/user.types\";\nimport type { PasswordCredentialStorageRecord } from \"./types/credential.types\";\n\nimport type {\n  AuthActionTokenStorageRecord,\n  AuthAuditEventStorageRecord,\n  AuthRateLimitStorageRecord,\n} from \"./types/auth-lifecycle.types\";\n\nimport type {\n  AuthMfaChallengeStorageRecord,\n  AuthMfaFactorStorageRecord,\n  AuthRecoveryCodeStorageRecord,\n} from \"./types/mfa.types\";\n\nexport const AUTH_USER_COLLECTION = \"auth_users\";\nexport const AUTH_CREDENTIAL_COLLECTION = \"auth_credentials\";\nexport const AUTH_ACTION_TOKEN_COLLECTION = \"auth_action_tokens\";\nexport const AUTH_AUDIT_COLLECTION = \"auth_audit_events\";\nexport const AUTH_RATE_LIMIT_COLLECTION = \"auth_rate_limits\";\n\nexport const AUTH_MFA_FACTOR_COLLECTION = \"auth_mfa_factors\";\nexport const AUTH_MFA_CHALLENGE_COLLECTION = \"auth_mfa_challenges\";\nexport const AUTH_RECOVERY_CODE_COLLECTION = \"auth_recovery_codes\";\n\nexport type AuthUserStorageRecord = AuthUser &\n  StorageRecord & {\n    readonly normalizedEmail: string;\n    readonly deactivatedAt: Date | null;\n    readonly sessionsInvalidatedAt: Date | null;\n  };\n\nexport const authUserCollection: StorageCollection<AuthUserStorageRecord> = {\n  name: AUTH_USER_COLLECTION,\n  indexes: [\n    {\n      name: \"normalized_email_unique\",\n      fields: [\"normalizedEmail\"],\n      unique: true,\n    },\n  ],\n};\n\nexport const authCredentialCollection: StorageCollection<PasswordCredentialStorageRecord> =\n  {\n    name: AUTH_CREDENTIAL_COLLECTION,\n    indexes: [\n      {\n        name: \"user_kind_unique\",\n        fields: [\"userId\", \"kind\"],\n        unique: true,\n      },\n      {\n        name: \"user_id\",\n        fields: [\"userId\"],\n      },\n    ],\n  };\n\nexport const authActionTokenCollection: StorageCollection<AuthActionTokenStorageRecord> =\n  {\n    name: AUTH_ACTION_TOKEN_COLLECTION,\n    indexes: [\n      {\n        name: \"token_hash_unique\",\n        fields: [\"tokenHash\"],\n        unique: true,\n      },\n      {\n        name: \"user_purpose\",\n        fields: [\"userId\", \"purpose\"],\n      },\n      {\n        name: \"token_expiration\",\n        fields: [\"expiresAt\"],\n      },\n    ],\n  };\n\nexport const authAuditCollection: StorageCollection<AuthAuditEventStorageRecord> =\n  {\n    name: AUTH_AUDIT_COLLECTION,\n    indexes: [\n      {\n        name: \"user_created\",\n        fields: [\"userId\", \"createdAt\"],\n      },\n      {\n        name: \"action_created\",\n        fields: [\"action\", \"createdAt\"],\n      },\n    ],\n  };\n\nexport const authRateLimitCollection: StorageCollection<AuthRateLimitStorageRecord> =\n  {\n    name: AUTH_RATE_LIMIT_COLLECTION,\n    indexes: [\n      {\n        name: \"rate_limit_reset\",\n        fields: [\"resetAt\"],\n      },\n    ],\n  };\n\nexport const authMfaFactorCollection: StorageCollection<AuthMfaFactorStorageRecord> =\n  {\n    name: AUTH_MFA_FACTOR_COLLECTION,\n    indexes: [\n      {\n        name: \"factor_key_unique\",\n        fields: [\"factorKey\"],\n        unique: true,\n      },\n      {\n        name: \"factor_user_status\",\n        fields: [\"userId\", \"status\"],\n      },\n      {\n        name: \"factor_credential_id\",\n        fields: [\"credentialId\"],\n      },\n    ],\n  };\n\nexport const authMfaChallengeCollection: StorageCollection<AuthMfaChallengeStorageRecord> =\n  {\n    name: AUTH_MFA_CHALLENGE_COLLECTION,\n    indexes: [\n      {\n        name: \"mfa_challenge_token_unique\",\n        fields: [\"tokenHash\"],\n        unique: true,\n      },\n      {\n        name: \"mfa_challenge_user\",\n        fields: [\"userId\", \"purpose\"],\n      },\n      {\n        name: \"mfa_challenge_expiration\",\n        fields: [\"expiresAt\"],\n      },\n    ],\n  };\n\nexport const authRecoveryCodeCollection: StorageCollection<AuthRecoveryCodeStorageRecord> =\n  {\n    name: AUTH_RECOVERY_CODE_COLLECTION,\n    indexes: [\n      {\n        name: \"recovery_code_hash_unique\",\n        fields: [\"codeHash\"],\n        unique: true,\n      },\n      {\n        name: \"recovery_code_user\",\n        fields: [\"userId\", \"consumedAt\"],\n      },\n    ],\n  };\n\nexport type InitializeAuthStorageOptions = {\n  readonly usersCollection?: string;\n  readonly credentialsCollection?: string;\n  readonly actionTokensCollection?: string;\n  readonly auditCollection?: string;\n  readonly rateLimitsCollection?: string;\n\n  readonly factorsCollection?: string;\n  readonly challengesCollection?: string;\n  readonly recoveryCodesCollection?: string;\n};\n\nexport const initializeAuthStorage = async (\n  storage: StorageAdapter,\n  options: InitializeAuthStorageOptions = {},\n): Promise<void> => {\n  if (\n    !storage.capabilities.uniqueConstraints ||\n    !storage.capabilities.atomicBatch\n  ) {\n    throw new Error(\n      \"Authentication storage requires unique constraints and atomic batches.\",\n    );\n  }\n\n  await storage.registerCollection({\n    ...authUserCollection,\n    name: options.usersCollection ?? AUTH_USER_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authCredentialCollection,\n    name: options.credentialsCollection ?? AUTH_CREDENTIAL_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authActionTokenCollection,\n    name: options.actionTokensCollection ?? AUTH_ACTION_TOKEN_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authAuditCollection,\n    name: options.auditCollection ?? AUTH_AUDIT_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authRateLimitCollection,\n    name: options.rateLimitsCollection ?? AUTH_RATE_LIMIT_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authMfaFactorCollection,\n    name: options.factorsCollection ?? AUTH_MFA_FACTOR_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authMfaChallengeCollection,\n    name: options.challengesCollection ?? AUTH_MFA_CHALLENGE_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authRecoveryCodeCollection,\n    name: options.recoveryCodesCollection ?? AUTH_RECOVERY_CODE_COLLECTION,\n  });\n};\n"],"mappings":";AAqBA,MAAa,uBAAuB;AACpC,MAAa,6BAA6B;AAC1C,MAAa,+BAA+B;AAC5C,MAAa,wBAAwB;AACrC,MAAa,6BAA6B;AAE1C,MAAa,6BAA6B;AAC1C,MAAa,gCAAgC;AAC7C,MAAa,gCAAgC;AAS7C,MAAa,qBAA+D;CAC1E,MAAM;CACN,SAAS,CACP;EACE,MAAM;EACN,QAAQ,CAAC,iBAAiB;EAC1B,QAAQ;CACV,CACF;AACF;AAEA,MAAa,2BACX;CACE,MAAM;CACN,SAAS,CACP;EACE,MAAM;EACN,QAAQ,CAAC,UAAU,MAAM;EACzB,QAAQ;CACV,GACA;EACE,MAAM;EACN,QAAQ,CAAC,QAAQ;CACnB,CACF;AACF;AAEF,MAAa,4BACX;CACE,MAAM;CACN,SAAS;EACP;GACE,MAAM;GACN,QAAQ,CAAC,WAAW;GACpB,QAAQ;EACV;EACA;GACE,MAAM;GACN,QAAQ,CAAC,UAAU,SAAS;EAC9B;EACA;GACE,MAAM;GACN,QAAQ,CAAC,WAAW;EACtB;CACF;AACF;AAEF,MAAa,sBACX;CACE,MAAM;CACN,SAAS,CACP;EACE,MAAM;EACN,QAAQ,CAAC,UAAU,WAAW;CAChC,GACA;EACE,MAAM;EACN,QAAQ,CAAC,UAAU,WAAW;CAChC,CACF;AACF;AAEF,MAAa,0BACX;CACE,MAAM;CACN,SAAS,CACP;EACE,MAAM;EACN,QAAQ,CAAC,SAAS;CACpB,CACF;AACF;AAEF,MAAa,0BACX;CACE,MAAM;CACN,SAAS;EACP;GACE,MAAM;GACN,QAAQ,CAAC,WAAW;GACpB,QAAQ;EACV;EACA;GACE,MAAM;GACN,QAAQ,CAAC,UAAU,QAAQ;EAC7B;EACA;GACE,MAAM;GACN,QAAQ,CAAC,cAAc;EACzB;CACF;AACF;AAEF,MAAa,6BACX;CACE,MAAM;CACN,SAAS;EACP;GACE,MAAM;GACN,QAAQ,CAAC,WAAW;GACpB,QAAQ;EACV;EACA;GACE,MAAM;GACN,QAAQ,CAAC,UAAU,SAAS;EAC9B;EACA;GACE,MAAM;GACN,QAAQ,CAAC,WAAW;EACtB;CACF;AACF;AAEF,MAAa,6BACX;CACE,MAAM;CACN,SAAS,CACP;EACE,MAAM;EACN,QAAQ,CAAC,UAAU;EACnB,QAAQ;CACV,GACA;EACE,MAAM;EACN,QAAQ,CAAC,UAAU,YAAY;CACjC,CACF;AACF;AAcF,MAAa,wBAAwB,OACnC,SACA,UAAwC,CAAC,MACvB;CAClB,IACE,CAAC,QAAQ,aAAa,qBACtB,CAAC,QAAQ,aAAa,aAEtB,MAAM,IAAI,MACR,wEACF;CAGF,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,mBAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,yBAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,0BAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,mBAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,wBAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,qBAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,wBAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,2BAAA;CAChB,CAAC;AACH"}

package/dist/auth.storage.d.cts

@@ -0,0 +1,29 @@
+import { AuthUser } from "./types/user.types.cjs";
+import "./types/credential.types.cjs";
+import "./types/auth-lifecycle.types.cjs";
+import "./types/mfa.types.cjs";
+import { StorageAdapter, StorageRecord } from "@puzzle-ui/storage";
+export declare const AUTH_USER_COLLECTION = "auth_users";
+export declare const AUTH_CREDENTIAL_COLLECTION = "auth_credentials";
+export declare const AUTH_ACTION_TOKEN_COLLECTION = "auth_action_tokens";
+export declare const AUTH_AUDIT_COLLECTION = "auth_audit_events";
+export declare const AUTH_RATE_LIMIT_COLLECTION = "auth_rate_limits";
+export declare const AUTH_MFA_FACTOR_COLLECTION = "auth_mfa_factors";
+export declare const AUTH_MFA_CHALLENGE_COLLECTION = "auth_mfa_challenges";
+export declare const AUTH_RECOVERY_CODE_COLLECTION = "auth_recovery_codes";
+export type AuthUserStorageRecord = AuthUser & StorageRecord & {
+  readonly normalizedEmail: string;
+  readonly deactivatedAt: Date | null;
+  readonly sessionsInvalidatedAt: Date | null;
+};
+export type InitializeAuthStorageOptions = {
+  readonly usersCollection?: string;
+  readonly credentialsCollection?: string;
+  readonly actionTokensCollection?: string;
+  readonly auditCollection?: string;
+  readonly rateLimitsCollection?: string;
+  readonly factorsCollection?: string;
+  readonly challengesCollection?: string;
+  readonly recoveryCodesCollection?: string;
+};
+export declare const initializeAuthStorage: (storage: StorageAdapter, options?: InitializeAuthStorageOptions) => Promise<void>;

package/dist/auth.storage.d.ts

@@ -0,0 +1,29 @@
+import { AuthUser } from "./types/user.types.js";
+import "./types/credential.types.js";
+import "./types/auth-lifecycle.types.js";
+import "./types/mfa.types.js";
+import { StorageAdapter, StorageRecord } from "@puzzle-ui/storage";
+export declare const AUTH_USER_COLLECTION = "auth_users";
+export declare const AUTH_CREDENTIAL_COLLECTION = "auth_credentials";
+export declare const AUTH_ACTION_TOKEN_COLLECTION = "auth_action_tokens";
+export declare const AUTH_AUDIT_COLLECTION = "auth_audit_events";
+export declare const AUTH_RATE_LIMIT_COLLECTION = "auth_rate_limits";
+export declare const AUTH_MFA_FACTOR_COLLECTION = "auth_mfa_factors";
+export declare const AUTH_MFA_CHALLENGE_COLLECTION = "auth_mfa_challenges";
+export declare const AUTH_RECOVERY_CODE_COLLECTION = "auth_recovery_codes";
+export type AuthUserStorageRecord = AuthUser & StorageRecord & {
+  readonly normalizedEmail: string;
+  readonly deactivatedAt: Date | null;
+  readonly sessionsInvalidatedAt: Date | null;
+};
+export type InitializeAuthStorageOptions = {
+  readonly usersCollection?: string;
+  readonly credentialsCollection?: string;
+  readonly actionTokensCollection?: string;
+  readonly auditCollection?: string;
+  readonly rateLimitsCollection?: string;
+  readonly factorsCollection?: string;
+  readonly challengesCollection?: string;
+  readonly recoveryCodesCollection?: string;
+};
+export declare const initializeAuthStorage: (storage: StorageAdapter, options?: InitializeAuthStorageOptions) => Promise<void>;