@quark-fw/plugin-auth 0.0.0-stage → 0.1.27

package/README.md

@@ -1,3 +1,45 @@
-# Temporary Holding Version
+# @quark-fw/plugin-auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Email + password authentication for Quark apps: passport-local behind a Redis-backed `express-session`, a tRPC router (`register`, `login`, `logout`, `me`, `updateProfile`, `changePassword`), a `useAuth()` hook for the React side and Redis rate limits on login and registration.
+
+## Install
+
+```sh
+npm i @quark-fw/plugin-auth
+```
+
+Peers: `@quark-fw/core`, `@quark-fw/plugin-redis`, `express`, `react`. `@quark-fw/plugin-trpc` is a dependency (the router is built on its `publicProcedure`). At runtime the plugin declares `dependsOn: ["redis", "prisma"]`: sessions live in Redis, users in the database, so `@quark-fw/plugin-prisma` must be registered too, and the app must have a `User` model with `id`, `email`, `name`, `hashedPassword` reachable as `quark.db.orm.public.User`.
+
+## Usage
+
+```ts
+// src/index.ts — redis, prisma and trpc are registered before auth
+import "@quark-fw/plugin-redis";
+import "@quark-fw/plugin-prisma";
+import "@quark-fw/plugin-trpc";
+import "@quark-fw/plugin-auth"; // provides quark.auth, session + passport middleware
+
+// src/router/index.ts — mount the router under `auth`
+import { authRouter } from "@quark-fw/plugin-auth/src/router.js";
+export const appRouter = router({ auth: authRouter, /* ... */ });
+
+// a procedure that requires a logged-in user (ctx.user is typed)
+import { userProcedure } from "@quark-fw/plugin-auth/src/router.js";
+```
+
+```tsx
+// src/frontend/Pages/Main/Page.tsx
+import { useAuth } from "@quark-fw/plugin-auth/src/client.js";
+
+const auth = useAuth(); // { user, isAuthenticated, login, register, logout, updateProfile, changePassword, refresh }
+if (!auth.isAuthenticated) return <AuthForm />;
+await auth.login(email, password);
+```
+
+How it works: the plugin registers `express-session` (store `quark:sess:<sid>` in Redis, 30-day TTL) and passport as pre-middleware, so every later handler (`/api/trpc`, SSR) sees `req.user`. The session cookie is `quark.sid`: `httpOnly`, `sameSite: "lax"`, 30 days, `secure: "auto"` (secure only on https; behind a TLS proxy set `TRUST_PROXY` for `@quark-fw/plugin-react`). Only the user id is stored in the session; the profile is reloaded on each request and `hashedPassword` is stripped before it leaves the server. Passwords are hashed with async bcryptjs (`quark.auth.hashPassword` / `quark.auth.checkPassword`), and `login` compares against a dummy hash when the email is unknown so response time does not reveal whether an account exists. `me` is read through the store (`store.tiny.auth.me`), so on SSR the user arrives together with the HTML.
+
+Rate limits (`src/router.ts`), fixed 15-minute windows counted in Redis and checked before bcrypt and the DB query: `login` — 30 attempts per IP and 10 per email (lowercased); `register` — 10 per IP. Exceeding one answers `TOO_MANY_REQUESTS` with the minutes until reset. If Redis fails, the check is logged and skipped — the limiter protects against brute force but is not a precondition for logging in.
+
+Env: `SESSION_SECRET` — cookie signing secret; required when `NODE_ENV=production` (the plugin throws on start without it), a fixed dev secret is used otherwise. `BCRYPT_ROUNDS` (default 12).
+
+Part of the [Quark framework](https://www.npmjs.com/package/@quark-fw/core).

package/package.json

@@ -1,6 +1,50 @@
 {
-  "name": "@quark-fw/plugin-auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+	"name": "@quark-fw/plugin-auth",
+	"version": "0.1.27",
+	"main": "src/index.ts",
+	"types": "src/index.ts",
+	"type": "module",
+	"scripts": {
+		"build": "echo raw-src package, no build",
+		"test": "vitest run"
+	},
+	"files": [
+		"src"
+	],
+	"keywords": [
+		"quark",
+		"auth",
+		"passport",
+		"session"
+	],
+	"author": "",
+	"license": "ISC",
+	"description": "Email/password auth for the Quark framework: passport-local, Redis sessions, tRPC auth router with rate limits (published as raw TS sources; consumers run tsx)",
+	"publishConfig": {
+		"access": "public"
+	},
+	"dependencies": {
+		"@quark-fw/plugin": "0.1.27",
+		"@quark-fw/plugin-trpc": "0.1.27",
+		"@trpc/server": "^11.0.0",
+		"bcryptjs": "^3.0.2",
+		"express-session": "^1.18.1",
+		"ioredis": "^5.9.3",
+		"passport": "^0.7.0",
+		"passport-local": "^1.0.0",
+		"react": "^19.2.4",
+		"zod": "^4.0.0"
+	},
+	"peerDependencies": {
+		"@quark-fw/core": "0.1.27",
+		"@quark-fw/plugin-redis": "0.1.27",
+		"express": "^5.0.0",
+		"react": "^19.2.4"
+	},
+	"devDependencies": {
+		"@types/express-session": "^1.18.1",
+		"@types/passport": "^1.0.17",
+		"@types/passport-local": "^1.0.38",
+		"vitest": "^5.0.0"
+	}
+}

package/src/client.tsx

@@ -0,0 +1,88 @@
+// Клиентская часть auth: хук поверх @quark-fw/store.
+// Не импортировать серверные модули плагина — только типы.
+import { useStore, useTrpc } from "@quark-fw/store";
+import type { AuthUser } from "./types.js";
+
+export type SessionUser = Omit<AuthUser, "hashedPassword">;
+
+/*
+ * Ветка auth-роутера описана структурно (как TinyBranch в entity/client):
+ * AppRouter аугментируется приложением, и без этих типов standalone-тайпчек
+ * плагина не видит процедур.
+ */
+type AuthTinyBranch = {
+	auth: { me: { get(): unknown; clearCache(): void } };
+};
+type AuthTrpcBranch = {
+	auth: {
+		login: {
+			mutate(input: {
+				email: string;
+				password: string;
+			}): Promise<unknown>;
+		};
+		register: {
+			mutate(input: {
+				email: string;
+				password: string;
+				name?: string;
+			}): Promise<unknown>;
+		};
+		logout: { mutate(): Promise<unknown> };
+		updateProfile: {
+			mutate(input: { name?: string; email?: string }): Promise<unknown>;
+		};
+		changePassword: {
+			mutate(input: {
+				currentPassword: string;
+				newPassword: string;
+			}): Promise<unknown>;
+		};
+	};
+};
+
+export function useAuth() {
+	const store = useStore();
+	const trpc = useTrpc() as unknown as AuthTrpcBranch;
+	const tiny = (store.tiny as unknown as AuthTinyBranch).auth;
+
+	// Suspense-чтение: на SSR приходит вместе с HTML
+	const user = tiny.me.get() as SessionUser | null;
+
+	const refresh = () => {
+		tiny.me.clearCache();
+	};
+
+	return {
+		user,
+		isAuthenticated: !!user,
+		login: async (email: string, password: string) => {
+			const logged = await trpc.auth.login.mutate({ email, password });
+			refresh();
+			return logged as SessionUser;
+		},
+		register: async (input: {
+			email: string;
+			password: string;
+			name?: string;
+		}) => {
+			const created = await trpc.auth.register.mutate(input);
+			refresh();
+			return created as SessionUser;
+		},
+		logout: async () => {
+			await trpc.auth.logout.mutate();
+			refresh();
+		},
+		updateProfile: async (input: { name?: string; email?: string }) => {
+			const updated = await trpc.auth.updateProfile.mutate(input);
+			refresh();
+			return updated as SessionUser;
+		},
+		changePassword: (input: {
+			currentPassword: string;
+			newPassword: string;
+		}) => trpc.auth.changePassword.mutate(input),
+		refresh,
+	};
+}

package/src/createRateLimiter.test.ts

@@ -0,0 +1,60 @@
+import { expect, test } from "vitest";
+import {
+	createRateLimiter,
+	type RateLimitClient,
+} from "./createRateLimiter.js";
+
+// Redis в памяти с семантикой INCR/EXPIRE/TTL скрипта лимитера и часами,
+// которые тест двигает сам
+const fakeRedis = () => {
+	let now = 0;
+	const keys = new Map<string, { n: number; expiresAt: number }>();
+	const client: RateLimitClient = {
+		async eval(_script, _numKeys, key, ttlSec) {
+			const live = keys.get(key);
+			const entry =
+				live && live.expiresAt > now
+					? live
+					: { n: 0, expiresAt: now + Number(ttlSec) * 1000 };
+			entry.n += 1;
+			keys.set(key, entry);
+			return [entry.n, Math.ceil((entry.expiresAt - now) / 1000)];
+		},
+	};
+	return { client, advance: (ms: number) => (now += ms) };
+};
+
+test("до max включительно разрешено, дальше — нет, с времени до сброса", async () => {
+	const redis = fakeRedis();
+	const limiter = createRateLimiter({
+		client: () => redis.client,
+		prefix: "t:",
+		max: 3,
+		windowSec: 60,
+	});
+	for (let i = 1; i <= 3; i++) {
+		expect(await limiter.hit("a")).toMatchObject({
+			allowed: true,
+			count: i,
+		});
+	}
+	const blocked = await limiter.hit("a");
+	expect(blocked.allowed).toBe(false);
+	expect(blocked.count).toBe(4);
+	expect(blocked.retryAfterSec).toBe(60);
+});
+
+test("ключи независимы, окно сбрасывается по TTL", async () => {
+	const redis = fakeRedis();
+	const limiter = createRateLimiter({
+		client: () => redis.client,
+		prefix: "t:",
+		max: 1,
+		windowSec: 10,
+	});
+	expect((await limiter.hit("a")).allowed).toBe(true);
+	expect((await limiter.hit("b")).allowed).toBe(true);
+	expect((await limiter.hit("a")).allowed).toBe(false);
+	redis.advance(10_001);
+	expect((await limiter.hit("a")).allowed).toBe(true);
+});

package/src/createRateLimiter.ts

@@ -0,0 +1,62 @@
+export type RateLimitClient = {
+	eval(
+		script: string,
+		numKeys: number,
+		key: string,
+		ttlSec: string,
+	): Promise<unknown>;
+};
+
+export type RateLimiterConfig = {
+	/** клиент берётся лениво: quark.redis.client — атом, его могут заменить */
+	client: () => RateLimitClient;
+	/** префикс ключей в Redis, например "quark:auth:login:ip:" */
+	prefix: string;
+	/** попыток за окно */
+	max: number;
+	windowSec: number;
+};
+
+export type RateLimitResult = {
+	allowed: boolean;
+	count: number;
+	retryAfterSec: number;
+};
+
+// INCR и EXPIRE одним скриптом: раздельные команды при падении между ними
+// оставляли ключ без TTL — вечную блокировку. TTL возвращаем сразу, чтобы
+// не ходить за ним вторым запросом.
+const SCRIPT = `
+local n = redis.call('INCR', KEYS[1])
+if n == 1 then redis.call('EXPIRE', KEYS[1], ARGV[1]) end
+return {n, redis.call('TTL', KEYS[1])}
+`;
+
+/**
+ * Счётчик попыток в фиксированном окне поверх Redis. Один ключ — одна
+ * сущность (IP, email); лимит превышен, когда счётчик за окно больше max.
+ */
+export function createRateLimiter({
+	client,
+	prefix,
+	max,
+	windowSec,
+}: RateLimiterConfig) {
+	return {
+		async hit(key: string): Promise<RateLimitResult> {
+			const [count, ttl] = (await client().eval(
+				SCRIPT,
+				1,
+				prefix + key,
+				String(windowSec),
+			)) as [number, number];
+			return {
+				allowed: count <= max,
+				count,
+				retryAfterSec: ttl > 0 ? ttl : windowSec,
+			};
+		},
+	};
+}
+
+export type RateLimiter = ReturnType<typeof createRateLimiter>;

package/src/db.ts

@@ -0,0 +1,30 @@
+import type { AuthUser } from "./types.js";
+
+// quark.db типизирует ПРИЛОЖЕНИЕ (плагин не знает его схему), поэтому здесь
+// описан минимальный структурный контракт: модель User с полями AuthUser.
+type UserModel = {
+	where(where: Record<string, unknown>): {
+		first(): Promise<AuthUser | null>;
+		update(data: Record<string, unknown>): Promise<AuthUser>;
+	};
+	create(data: Record<string, unknown>): Promise<AuthUser>;
+};
+
+/**
+ * Модель пользователя из контракта приложения.
+ *
+ * Тип quark.db объявляет само приложение, поэтому плагин описывает только ту
+ * форму, на которую опирается.
+ */
+export const userModel = (): UserModel => {
+	const { db } = quark as Quark & {
+		db?: { orm?: { public?: { User?: UserModel } } };
+	};
+	const model = db?.orm?.public?.User;
+	if (!model) {
+		throw new Error(
+			"@quark-fw/plugin-auth: модель User недоступна — не подключён @quark-fw/plugin-prisma?",
+		);
+	}
+	return model;
+};

package/src/enforceRateLimit.test.ts

@@ -0,0 +1,36 @@
+import { expect, test } from "vitest";
+import { TRPCError } from "@trpc/server";
+import type { RateLimiter } from "./createRateLimiter.js";
+import { enforceRateLimit } from "./enforceRateLimit.js";
+
+const limiter = (allowed: boolean, retryAfterSec = 600): RateLimiter => ({
+	hit: async () => ({ allowed, count: 0, retryAfterSec }),
+});
+
+test("все лимиты в норме — проходит", async () => {
+	await expect(
+		enforceRateLimit([
+			[limiter(true), "ip"],
+			[limiter(true), "email"],
+		]),
+	).resolves.toBeUndefined();
+});
+
+test("превышенный лимит — TOO_MANY_REQUESTS с минутами до сброса", async () => {
+	const error = await enforceRateLimit([
+		[limiter(true), "ip"],
+		[limiter(false, 601), "email"],
+	]).catch((e: unknown) => e);
+	expect(error).toBeInstanceOf(TRPCError);
+	expect((error as TRPCError).code).toBe("TOO_MANY_REQUESTS");
+	expect((error as TRPCError).message).toContain("11 мин");
+});
+
+test("сбой Redis не блокирует вход", async () => {
+	const broken: RateLimiter = {
+		hit: async () => {
+			throw new Error("redis down");
+		},
+	};
+	await expect(enforceRateLimit([[broken, "ip"]])).resolves.toBeUndefined();
+});

package/src/enforceRateLimit.ts

@@ -0,0 +1,32 @@
+import { TRPCError } from "@trpc/server";
+import { log as rootLog } from "@quark-fw/core/src/log.js";
+import type { RateLimiter } from "./createRateLimiter.js";
+
+const log = rootLog.child({ scope: "auth" });
+
+/**
+ * Проверяет лимиты до тяжёлой работы процедуры (bcrypt ~240 мс CPU,
+ * запрос в базу). Первый превышенный — TOO_MANY_REQUESTS.
+ *
+ * Сбой Redis вход не блокирует: лимитер — защита от перебора, а не условие
+ * работы; сам сбой пишется в лог.
+ */
+export async function enforceRateLimit(
+	checks: [limiter: RateLimiter, key: string][],
+): Promise<void> {
+	for (const [limiter, key] of checks) {
+		let result;
+		try {
+			result = await limiter.hit(key);
+		} catch (error) {
+			log.error("rate limit check failed", { err: error });
+			return;
+		}
+		if (!result.allowed) {
+			throw new TRPCError({
+				code: "TOO_MANY_REQUESTS",
+				message: `Слишком много попыток, повторите через ${Math.ceil(result.retryAfterSec / 60)} мин`,
+			});
+		}
+	}
+}

package/src/global.d.ts

@@ -0,0 +1,24 @@
+import "@quark-fw/core/src/global.d.ts";
+import type { AuthUser } from "@quark-fw/plugin-auth/src/types.js";
+
+export {};
+
+// заполняем шов пользователя в tRPC-контексте
+declare module "@quark-fw/plugin-trpc/src/trpc.js" {
+	// шов: интерфейс существует ровно ради этой аугментации
+	// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+	interface TRPCUser extends Omit<AuthUser, "hashedPassword"> {}
+}
+
+declare global {
+	interface Quark {
+		auth: {
+			/** хеширование и проверка пароля (bcrypt, не блокируя event loop) */
+			hashPassword(password: string): Promise<string>;
+			checkPassword(
+				hash: string | null | undefined,
+				password: string,
+			): Promise<boolean>;
+		};
+	}
+}

package/src/helpers.ts

@@ -0,0 +1,42 @@
+// Хелперы auth-плагина: пароли, поиск пользователей, адрес клиента.
+import bcrypt from "bcryptjs";
+import type { Request } from "express";
+import { userModel } from "./db.js";
+
+/** IP клиента с учётом trust proxy (см. TRUST_PROXY в plugin-react) */
+export const clientIp = (req: Request): string =>
+	req.ip ?? req.socket?.remoteAddress ?? "unknown";
+
+const SALT_ROUNDS = Number(process.env.BCRYPT_ROUNDS) || 12;
+
+// Асинхронные версии: bcryptjs дробит 2^rounds итераций на порции через
+// setImmediate. Синхронный хеш занимал event loop целиком (~сотни мс при 12
+// раундах), и каждый логин задерживал все остальные запросы процесса.
+export const hashPassword = (password: string): Promise<string> =>
+	bcrypt.hash(String(password), SALT_ROUNDS);
+
+export const checkPassword = (
+	hash: string | null | undefined,
+	password: string,
+): Promise<boolean> => bcrypt.compare(String(password), hash || "");
+
+export const findUserByEmail = (email: string) =>
+	userModel().where({ email }).first();
+
+export const findUserById = (id: string) => userModel().where({ id }).first();
+
+/**
+ * Секрет подписи сессионной cookie.
+ *
+ * Дефолт допустим только вне прода: с общеизвестным секретом любой
+ * подделывает подпись cookie, поэтому в проде без SESSION_SECRET
+ * плагин падает на старте, а не работает с дырой.
+ */
+export const sessionSecret = (): string => {
+	const secret = process.env.SESSION_SECRET;
+	if (secret) return secret;
+	if (process.env.NODE_ENV === "production") {
+		throw new Error("[auth] SESSION_SECRET обязателен в production");
+	}
+	return "quark-dev-secret";
+};

package/src/index.ts

@@ -0,0 +1,87 @@
+import { QuarkPlugin } from "@quark-fw/plugin";
+import session from "express-session";
+import { RedisSessionStore } from "./sessionStore.js";
+import passport from "passport";
+import { Strategy as LocalStrategy } from "passport-local";
+import { registerHttpPreMiddleware } from "@quark-fw/plugin/http.js";
+import { sanitizeUser } from "./types.js";
+import {
+	checkPassword,
+	findUserByEmail,
+	findUserById,
+	hashPassword,
+	sessionSecret,
+} from "./helpers.js";
+import {} from "@quark-fw/plugin-auth/src/global.js";
+import {} from "@quark-fw/plugin-redis/src/global.js";
+
+await quark.registerPlugin({
+	name: "auth",
+	// сессии живут в redis, пользователи — в базе
+	dependsOn: ["redis", "prisma"],
+	extend(quark) {
+		quark.auth = { hashPassword, checkPassword };
+	},
+	onInit(quark) {
+		passport.use(
+			new LocalStrategy(
+				{ usernameField: "email", passwordField: "password" },
+				async (email, password, done) => {
+					try {
+						const user = await findUserByEmail(email);
+						if (
+							!user ||
+							!(await checkPassword(
+								user.hashedPassword,
+								password,
+							))
+						) {
+							done(null, false);
+							return;
+						}
+						done(null, sanitizeUser(user));
+					} catch (e) {
+						done(e as Error);
+					}
+				},
+			),
+		);
+
+		// в сессии храним только id — профиль подтягиваем на каждый запрос
+		passport.serializeUser((user, done) => {
+			done(null, (user as { id: string }).id);
+		});
+		passport.deserializeUser(async (id: string, done) => {
+			try {
+				const user = await findUserById(id);
+				done(null, user ? sanitizeUser(user) : false);
+			} catch (e) {
+				done(e as Error);
+			}
+		});
+
+		const sessionMiddleware = session({
+			store: new RedisSessionStore({
+				client: quark.redis.client.value,
+			}),
+			secret: sessionSecret(),
+			resave: false,
+			saveUninitialized: false,
+			name: "quark.sid",
+			cookie: {
+				httpOnly: true,
+				sameSite: "lax",
+				maxAge: 30 * 24 * 60 * 60 * 1000,
+				// "auto" = secure только на https-соединении. Жёсткое true
+				// ломает прод по http (браузер не вернёт такую cookie);
+				// за TLS-прокси нужен ещё TRUST_PROXY (см. react-плагин).
+				secure: "auto",
+			},
+		});
+
+		// порядок важен: сессия → passport → всё остальное (/api/trpc)
+		registerHttpPreMiddleware(sessionMiddleware);
+		registerHttpPreMiddleware(passport.initialize());
+		registerHttpPreMiddleware(passport.session());
+	},
+} satisfies QuarkPlugin);

package/src/router.ts

@@ -0,0 +1,206 @@
+import { TRPCError } from "@trpc/server";
+import { z } from "zod";
+import {
+	publicProcedure,
+	router,
+	type TRPCUser,
+} from "@quark-fw/plugin-trpc/src/trpc.js";
+import bcrypt from "bcryptjs";
+import { sanitizeUser } from "./types.js";
+import { userModel } from "./db.js";
+import {} from "@quark-fw/plugin-auth/src/global.js";
+import {} from "@quark-fw/plugin-redis/src/global.js";
+import { createRateLimiter } from "./createRateLimiter.js";
+import { enforceRateLimit } from "./enforceRateLimit.js";
+import { clientIp } from "./helpers.js";
+
+// Лимиты перебора: по IP — пароли и email с одного адреса, по email —
+// распределённый перебор одного аккаунта. Окно 15 минут. Проверяются до
+// bcrypt (~240 мс CPU на попытку) и запроса в базу.
+const WINDOW_SEC = 15 * 60;
+const redis = () => quark.redis.client.value;
+const loginByIp = createRateLimiter({
+	client: redis,
+	prefix: "quark:auth:login:ip:",
+	max: 30,
+	windowSec: WINDOW_SEC,
+});
+const loginByEmail = createRateLimiter({
+	client: redis,
+	prefix: "quark:auth:login:email:",
+	max: 10,
+	windowSec: WINDOW_SEC,
+});
+const registerByIp = createRateLimiter({
+	client: redis,
+	prefix: "quark:auth:register:ip:",
+	max: 10,
+	windowSec: WINDOW_SEC,
+});
+
+/** Процедура, требующая залогиненного пользователя. */
+export const userProcedure = publicProcedure.use(async ({ ctx, next }) => {
+	if (!ctx.user) {
+		throw new TRPCError({
+			code: "UNAUTHORIZED",
+			message: "Требуется вход",
+		});
+	}
+	return next({ ctx: { ...ctx, user: ctx.user as TRPCUser } });
+});
+
+const credentials = z.object({
+	email: z.email(),
+	password: z.string().min(6, "Пароль минимум 6 символов"),
+});
+
+/** методы, которые passport дописывает в express-запрос */
+type PassportRequest = {
+	login(user: unknown, done: (err: unknown) => void): void;
+	logout(done: (err: unknown) => void): void;
+};
+
+// passport кладёт пользователя в сессию через req.login
+const login = (req: unknown, user: unknown) =>
+	new Promise<void>((resolve, reject) => {
+		(req as PassportRequest).login(user, (err: unknown) =>
+			err ? reject(err) : resolve(),
+		);
+	});
+
+export const authRouter = router({
+	me: publicProcedure.query(({ ctx }) => ctx.user ?? null),
+
+	register: publicProcedure
+		.input(credentials.extend({ name: z.string().optional() }))
+		.mutation(async ({ ctx, input }) => {
+			await enforceRateLimit([[registerByIp, clientIp(ctx.req)]]);
+			const exists = await userModel()
+				.where({ email: input.email })
+				.first();
+			if (exists) {
+				throw new TRPCError({
+					code: "BAD_REQUEST",
+					message: "Email уже зарегистрирован",
+				});
+			}
+
+			const created = await userModel().create({
+				email: input.email,
+				name: input.name ?? null,
+				hashedPassword: await quark.auth.hashPassword(input.password),
+			});
+
+			const user = sanitizeUser(created);
+			await login(ctx.req, user);
+			return user;
+		}),
+
+	login: publicProcedure
+		.input(credentials)
+		.mutation(async ({ ctx, input }) => {
+			await enforceRateLimit([
+				[loginByIp, clientIp(ctx.req)],
+				[loginByEmail, input.email.toLowerCase()],
+			]);
+			const found = await userModel()
+				.where({ email: input.email })
+				.first();
+
+			// сравниваем всегда, чтобы время ответа не выдавало наличие email
+			const ok = await bcrypt.compare(
+				input.password,
+				found?.hashedPassword ||
+					"$2a$12$0000000000000000000000000000000000000000000000000000",
+			);
+			if (!found || !ok) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "Неправильный email или пароль",
+				});
+			}
+
+			const user = sanitizeUser(found);
+			await login(ctx.req, user);
+			return user;
+		}),
+
+	updateProfile: userProcedure
+		.input(
+			z.object({
+				name: z.string().optional(),
+				email: z.email().optional(),
+			}),
+		)
+		.mutation(async ({ ctx, input }) => {
+			const me = ctx.user as { id: string };
+
+			if (input.email) {
+				const taken = await userModel()
+					.where({ email: input.email })
+					.first();
+				if (taken && taken.id !== me.id) {
+					throw new TRPCError({
+						code: "BAD_REQUEST",
+						message: "Email уже занят",
+					});
+				}
+			}
+
+			const updated = await userModel()
+				.where({ id: me.id })
+				.update({
+					...(input.name !== undefined ? { name: input.name } : {}),
+					...(input.email ? { email: input.email } : {}),
+				});
+
+			const user = sanitizeUser(updated);
+			// обновляем данные в сессии
+			await login(ctx.req, user);
+			return user;
+		}),
+
+	changePassword: userProcedure
+		.input(
+			z.object({
+				currentPassword: z.string(),
+				newPassword: z.string().min(6, "Пароль минимум 6 символов"),
+			}),
+		)
+		.mutation(async ({ ctx, input }) => {
+			const me = ctx.user as { id: string };
+			const current = await userModel().where({ id: me.id }).first();
+
+			if (
+				!current ||
+				!(await quark.auth.checkPassword(
+					current.hashedPassword,
+					input.currentPassword,
+				))
+			) {
+				throw new TRPCError({
+					code: "BAD_REQUEST",
+					message: "Текущий пароль неверен",
+				});
+			}
+
+			await userModel()
+				.where({ id: me.id })
+				.update({
+					hashedPassword: await quark.auth.hashPassword(
+						input.newPassword,
+					),
+				});
+
+			return true;
+		}),
+
+	logout: publicProcedure.mutation(async ({ ctx }) => {
+		await new Promise<void>((resolve, reject) => {
+			(ctx.req as unknown as PassportRequest).logout((err: unknown) =>
+				err ? reject(err) : resolve(),
+			);
+		});
+		return true;
+	}),
+});

package/src/sessionStore.ts

@@ -0,0 +1,69 @@
+import session from "express-session";
+import type { Redis } from "ioredis";
+
+// Своя реализация store вместо connect-redis: тот говорит на диалекте
+// node-redis (`set(key, val, {EX})`), а quark.redis — ioredis, который
+// принимает `set(key, val, "EX", ttl)` и отвечает "ERR syntax error".
+export class RedisSessionStore extends session.Store {
+	private client: Redis;
+	private prefix: string;
+	private ttl: number;
+
+	constructor({
+		client,
+		prefix = "quark:sess:",
+		ttlSeconds = 30 * 24 * 60 * 60,
+	}: {
+		client: Redis;
+		prefix?: string;
+		ttlSeconds?: number;
+	}) {
+		super();
+		this.client = client;
+		this.prefix = prefix;
+		this.ttl = ttlSeconds;
+	}
+
+	private key(sid: string) {
+		return `${this.prefix}${sid}`;
+	}
+
+	get(
+		sid: string,
+		callback: (err?: unknown, session?: session.SessionData | null) => void,
+	) {
+		this.client
+			.get(this.key(sid))
+			.then((data) => callback(null, data ? JSON.parse(data) : null))
+			.catch((e) => callback(e));
+	}
+
+	set(
+		sid: string,
+		sess: session.SessionData,
+		callback?: (err?: unknown) => void,
+	) {
+		this.client
+			.set(this.key(sid), JSON.stringify(sess), "EX", this.ttl)
+			.then(() => callback?.(null))
+			.catch((e) => callback?.(e));
+	}
+
+	destroy(sid: string, callback?: (err?: unknown) => void) {
+		this.client
+			.del(this.key(sid))
+			.then(() => callback?.(null))
+			.catch((e) => callback?.(e));
+	}
+
+	touch(
+		sid: string,
+		_sess: session.SessionData,
+		callback?: (err?: unknown) => void,
+	) {
+		this.client
+			.expire(this.key(sid), this.ttl)
+			.then(() => callback?.(null))
+			.catch((e) => callback?.(e));
+	}
+}

package/src/types.ts

@@ -0,0 +1,16 @@
+// Пользователь, каким его видит auth-плагин. Конвенция: приложение имеет
+// модель User с полями id/email/name/hashedPassword.
+export type AuthUser = {
+	id: string;
+	email: string;
+	name?: string | null;
+	hashedPassword: string;
+};
+
+/** Убирает хеш пароля перед отдачей пользователя наружу. */
+export function sanitizeUser<T extends { hashedPassword?: string | null }>(
+	user: T,
+): Omit<T, "hashedPassword"> {
+	const { hashedPassword: _drop, ...safe } = user;
+	return safe;
+}