@rebasepro/server-core 0.6.0 → 0.7.0

package/dist/auth/auth-hooks.d.ts

@@ -1,225 +0,0 @@
-/**
- * AuthHooks
- *
- * Customize specific behaviors of the built-in Rebase auth system.
- *
- * Each method replaces one piece of the default implementation.
- * Unset methods fall through to the built-in defaults (scrypt passwords,
- * standard validation rules, etc.).
- *
- * This interface is intentionally open for extension — new hooks
- * can be added as optional methods without breaking existing configurations.
- *
- * @example bcrypt password support
- * ```ts
- * import bcrypt from "bcrypt";
- *
- * const hooks: AuthHooks = {
- *     hashPassword: (pw) => bcrypt.hash(pw, 12),
- *     verifyPassword: (pw, hash) => bcrypt.compare(pw, hash),
- *     validatePasswordStrength: (pw) => ({
- *         valid: pw.length >= 6,
- *         errors: pw.length < 6 ? ["Password must be at least 6 characters"] : []
- *     })
- * };
- * ```
- *
- * @example Override the entire login credential check
- * ```ts
- * const hooks: AuthHooks = {
- *     verifyCredentials: async (email, password, repo) => {
- *         const user = await repo.getUserByEmail(email);
- *         if (!user || !user.passwordHash) return null;
- *         const valid = await myCustomVerify(password, user.passwordHash);
- *         return valid ? user : null;
- *     }
- * };
- * ```
- */
-import type { PasswordValidationResult } from "./password";
-import type { AuthRepository, UserData, CreateUserData } from "./interfaces";
-import type { EmailService, EmailConfig } from "../email";
-/**
- * Authentication method identifier for lifecycle hooks.
- */
-export type AuthMethod = "login" | "register" | "oauth" | "refresh" | "password-reset" | "anonymous" | "magic-link" | "mfa";
-/**
- * Hook specific parts of the built-in Rebase auth implementation.
- *
- * Every method is optional. The built-in defaults apply for any method
- * that is not provided.
- */
-export interface AuthHooks {
-    /**
-     * Hash a cleartext password for storage.
-     *
-     * Default: scrypt (Node.js crypto, 64-byte key, random 32-byte salt).
-     *
-     * @param password - The cleartext password.
-     * @returns The hashed password string (format is implementation-defined).
-     */
-    hashPassword?(password: string): Promise<string>;
-    /**
-     * Verify a cleartext password against a stored hash.
-     *
-     * Default: scrypt verification with timing-safe comparison.
-     *
-     * @param password - The cleartext password to check.
-     * @param storedHash - The hash string retrieved from the database.
-     * @returns `true` if the password matches the hash.
-     */
-    verifyPassword?(password: string, storedHash: string): Promise<boolean>;
-    /**
-     * Validate password strength before hashing.
-     *
-     * Default: minimum 8 characters, at least one uppercase, one lowercase, one digit.
-     *
-     * @param password - The cleartext password to validate.
-     * @returns Validation result with `valid` flag and error messages.
-     */
-    validatePasswordStrength?(password: string): PasswordValidationResult;
-    /**
-     * Override the complete credential verification during email/password login.
-     *
-     * When set, this replaces the default flow:
-     *   1. Look up user by email
-     *   2. Verify password hash
-     *
-     * The auth repository is provided for database access. Return the user
-     * data if credentials are valid, or `null` to reject the login.
-     *
-     * Default: `getUserByEmail(email)` + `verifyPassword(password, user.passwordHash)`.
-     */
-    verifyCredentials?(email: string, password: string, repo: AuthRepository): Promise<UserData | null>;
-    /**
-     * Called after any successful authentication event (login, register,
-     * OAuth, token refresh, password reset).
-     *
-     * Use for audit logging, syncing external state, updating
-     * last-login timestamps, etc.
-     *
-     * This is fire-and-forget — errors are logged but do not fail the request.
-     */
-    onAuthenticated?(user: UserData, method: AuthMethod): Promise<void>;
-    /**
-     * Called before a new user is created (registration or admin creation).
-     *
-     * Return modified data to alter what gets stored, or throw an error
-     * to reject the creation entirely.
-     *
-     * Default: passthrough (returns data unchanged).
-     */
-    beforeUserCreate?(data: CreateUserData): Promise<CreateUserData>;
-    /**
-     * Called after a new user is created.
-     *
-     * Use for provisioning external resources, sending notifications
-     * to third-party systems, etc.
-     *
-     * This is fire-and-forget — errors are logged but do not fail the request.
-     */
-    afterUserCreate?(user: UserData): Promise<void>;
-    /**
-     * Pre-login validation. Called before credential verification.
-     *
-     * Throw an error to reject the login attempt (e.g. for account lockout,
-     * IP-based restrictions, etc.).
-     */
-    beforeLogin?(email: string, method: AuthMethod): Promise<void>;
-    /**
-     * Post-logout cleanup.
-     *
-     * Called after a user's session has been invalidated.
-     * Use for audit logging, cleanup of temporary resources, etc.
-     *
-     * This is fire-and-forget — errors are logged but do not fail the request.
-     */
-    afterLogout?(userId: string): Promise<void>;
-    /**
-     * Called after successful MFA verification.
-     *
-     * Use for audit logging, notifying external systems, etc.
-     *
-     * This is fire-and-forget — errors are logged but do not fail the request.
-     */
-    onMfaVerified?(userId: string, factorId: string): Promise<void>;
-    /**
-     * Customize JWT access token claims before signing.
-     *
-     * Return the modified claims object. The returned claims are merged
-     * into the JWT payload alongside standard claims (userId, roles).
-     *
-     * @param claims - The default claims that would be included.
-     * @param user - The authenticated user data.
-     * @returns Modified claims to include in the JWT.
-     */
-    customizeAccessToken?(claims: Record<string, unknown>, user: UserData): Promise<Record<string, unknown>>;
-    /**
-     * Called after a successful password reset.
-     *
-     * Use for audit logging, sending confirmation notifications, etc.
-     *
-     * This is fire-and-forget — errors are logged but do not fail the request.
-     */
-    onPasswordReset?(userId: string): Promise<void>;
-    /**
-     * Called before a user is deleted.
-     *
-     * Throw an error to prevent deletion (e.g. for users with active
-     * subscriptions, pending transactions, etc.).
-     */
-    beforeUserDelete?(userId: string): Promise<void>;
-    /**
-     * Called after a user is deleted.
-     *
-     * Use for cleaning up external resources, audit logging, etc.
-     *
-     * This is fire-and-forget — errors are logged but do not fail the request.
-     */
-    afterUserDelete?(userId: string): Promise<void>;
-    /**
-     * Optional hook to customize or override the default user creation flow via the admin panel/REST API.
-     * When provided, this replaces the built-in password generation, hashing, and invitation email logic.
-     */
-    onAdminCreateUser?(values: Record<string, unknown>, ctx: {
-        authRepo: AuthRepository;
-        emailService?: EmailService;
-        emailConfig?: EmailConfig;
-        hashPassword: (password: string) => Promise<string>;
-    }): Promise<{
-        values: Record<string, unknown>;
-        temporaryPassword?: string;
-        invitationSent?: boolean;
-    }>;
-    /**
-     * Optional hook to customize or override the default password reset flow via the admin panel.
-     * When provided, this replaces the built-in password reset token generation, hashing, and email logic.
-     */
-    onAdminResetPassword?(userId: string, ctx: {
-        authRepo: AuthRepository;
-        emailService?: EmailService;
-        emailConfig?: EmailConfig;
-    }): Promise<{
-        temporaryPassword?: string;
-        invitationSent?: boolean;
-    }>;
-}
-/**
- * Resolved auth hooks — password operations are guaranteed to exist,
- * all other hooks are passed through as-is (optional).
- *
- * Created by `resolveAuthHooks()` which merges user hooks
- * with built-in defaults.
- *
- * Consumers should use the resolved object exclusively —
- * never access the raw `AuthHooks` directly.
- */
-export type ResolvedAuthHooks = Required<Pick<AuthHooks, "hashPassword" | "verifyPassword" | "validatePasswordStrength">> & Omit<AuthHooks, "hashPassword" | "verifyPassword" | "validatePasswordStrength">;
-/**
- * Merge user-provided hooks with the built-in defaults to produce
- * a complete set of resolved hooks.
- *
- * This is the single point where defaults are applied — all consumers
- * call this once and use the resolved hooks throughout.
- */
-export declare function resolveAuthHooks(hooks?: AuthHooks): ResolvedAuthHooks;

package/dist/auth/bitbucket-oauth.d.ts

@@ -1,11 +0,0 @@
-import type { OAuthProvider } from "./interfaces";
-/**
- * Creates a Bitbucket OAuth Provider integration (OAuth 2.0 consumer).
- */
-export declare function createBitbucketProvider(config: {
-    clientId: string;
-    clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;

package/dist/auth/builtin-auth-adapter.d.ts

@@ -1,49 +0,0 @@
-/**
- * RebaseBuiltinAuthAdapter
- *
- * Wraps Rebase's existing built-in JWT auth system (routes, middleware, user/role
- * management) into the `AuthAdapter` interface. This is the default adapter used
- * when the user passes a plain `RebaseAuthConfig` object.
- *
- * This is NOT a rewrite — it delegates to the existing `createAuthRoutes()`,
- * `createResetPasswordRoute()`, and `verifyAccessToken()` functions. The goal is to
- * present the same functionality through the pluggable `AuthAdapter` contract.
- */
-import type { AuthAdapter } from "@rebasepro/types";
-import type { AuthRepository, OAuthProvider } from "./interfaces";
-import type { AuthHooks } from "./auth-hooks";
-import type { EmailService, EmailConfig } from "../email";
-/**
- * Configuration for the built-in Rebase auth adapter.
- *
- * This mirrors the existing `RebaseAuthConfig` — users pass this and
- * server-core auto-wraps it in a `RebaseBuiltinAuthAdapter`.
- */
-export interface BuiltinAuthAdapterConfig {
-    /** The bootstrapper-provided auth repository (users, roles, tokens). */
-    authRepository: AuthRepository;
-    /** Email service for password resets, verification, etc. */
-    emailService?: EmailService;
-    /** Email configuration. */
-    emailConfig?: EmailConfig;
-    /** Whether to allow new user registration. */
-    allowRegistration?: boolean;
-    /** Default role to assign to new users. */
-    defaultRole?: string;
-    /** OAuth providers to register. */
-    oauthProviders?: OAuthProvider<any>[];
-    /** Static service key for server-to-server auth. */
-    serviceKey?: string;
-    /** Auth hooks for customizing password, credentials, lifecycle, etc. */
-    authHooks?: AuthHooks;
-    /** The parsed auth config from the collection (if `auth` is an object, not just `true`). */
-    collectionAuthConfig?: import("@rebasepro/types").AuthCollectionConfig;
-}
-/**
- * Create the built-in Rebase auth adapter.
- *
- * This wraps the existing auth infrastructure (JWT, OAuth, user/role management)
- * into the `AuthAdapter` interface. It's used internally by `initializeRebaseBackend()`
- * when the user passes a plain `RebaseAuthConfig` object.
- */
-export declare function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): AuthAdapter;

package/dist/auth/crypto-utils.d.ts

@@ -1,16 +0,0 @@
-/**
- * Cryptographic utility functions for auth.
- *
- * @module
- */
-/**
- * Constant-time string comparison to prevent timing attacks.
- *
- * Used for comparing service keys, tokens, and other secrets where
- * timing side-channels could leak information about the expected value.
- *
- * @param a - First string to compare.
- * @param b - Second string to compare.
- * @returns `true` if the strings are identical, `false` otherwise.
- */
-export declare function safeCompare(a: string, b: string): boolean;

package/dist/auth/custom-auth-adapter.d.ts

@@ -1,39 +0,0 @@
-/**
- * Custom Auth Adapter Factory
- *
- * Provides a minimal-config way for users with existing auth systems
- * to plug into Rebase. Only `verifyRequest` is required — everything
- * else is optional.
- *
- * @example
- * ```ts
- * import { createCustomAuthAdapter } from "@rebasepro/server-core";
- *
- * const auth = createCustomAuthAdapter({
- *   verifyRequest: async (request) => {
- *     const token = request.headers.get("Authorization")?.replace("Bearer ", "");
- *     if (!token) return null;
- *     const decoded = jwt.verify(token, MY_SECRET);
- *     return {
- *       uid: decoded.sub,
- *       email: decoded.email,
- *       displayName: decoded.name,
- *       roles: decoded.roles || [],
- *       isAdmin: decoded.roles?.includes("admin") ?? false,
- *     };
- *   },
- * });
- * ```
- */
-import type { AuthAdapter, CustomAuthAdapterOptions } from "@rebasepro/types";
-/**
- * Create a custom auth adapter from minimal options.
- *
- * This is the recommended entry point for users who already have their own
- * auth system and just need to tell Rebase how to extract the user from
- * incoming requests.
- *
- * @param options - Configuration options. Only `verifyRequest` is required.
- * @returns A fully-formed `AuthAdapter` ready for `initializeRebaseBackend()`.
- */
-export declare function createCustomAuthAdapter(options: CustomAuthAdapterOptions): AuthAdapter;

package/dist/auth/discord-oauth.d.ts

@@ -1,14 +0,0 @@
-import type { OAuthProvider } from "./interfaces";
-/**
- * Creates a Discord OAuth2 Provider integration.
- *
- * Uses the authorization code flow. Requires the "identify" and "email"
- * scopes to retrieve the user's email and profile information.
- */
-export declare function createDiscordProvider(config: {
-    clientId: string;
-    clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;

package/dist/auth/facebook-oauth.d.ts

@@ -1,14 +0,0 @@
-import type { OAuthProvider } from "./interfaces";
-/**
- * Creates a Facebook / Meta OAuth Provider integration.
- *
- * Uses the authorization code flow to exchange a code for an access token,
- * then fetches user profile from the Facebook Graph API.
- */
-export declare function createFacebookProvider(config: {
-    clientId: string;
-    clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;

package/dist/auth/github-oauth.d.ts

@@ -1,15 +0,0 @@
-import type { OAuthProvider } from "./interfaces";
-/**
- * Creates a GitHub OAuth Provider integration.
- *
- * Flow: Frontend receives an authorization `code` via the GitHub OAuth redirect.
- * This provider exchanges the code for an access token, then fetches the user's
- * profile and primary email from the GitHub API.
- */
-export declare function createGitHubProvider(config: {
-    clientId: string;
-    clientSecret: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;

package/dist/auth/gitlab-oauth.d.ts

@@ -1,13 +0,0 @@
-import type { OAuthProvider } from "./interfaces";
-/**
- * Creates a GitLab OAuth Provider integration.
- * Works with both GitLab.com and self-hosted instances.
- */
-export declare function createGitLabProvider(config: {
-    clientId: string;
-    clientSecret: string;
-    baseUrl?: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-}>;

package/dist/auth/google-oauth.d.ts

@@ -1,47 +0,0 @@
-import type { OAuthProvider } from "./interfaces";
-export interface GoogleUserInfo {
-    googleId: string;
-    email: string;
-    displayName: string | null;
-    photoUrl: string | null;
-    emailVerified: boolean;
-}
-export interface GoogleProviderConfig {
-    clientId: string;
-    /**
-     * The OAuth 2.0 client secret from Google Cloud Console.
-     *
-     * Required for the **authorization code flow** (Path 3), where the
-     * frontend sends an authorization `code` and the backend exchanges it
-     * server-side for tokens. This is the most secure flow because tokens
-     * never touch the browser.
-     *
-     * When omitted, only ID-token and access-token verification are available
-     * (Paths 1 & 2), which rely on the frontend obtaining tokens directly.
-     */
-    clientSecret?: string;
-}
-/**
- * Creates a Google OAuth Provider integration.
- *
- * Supports three verification paths:
- *
- * **Path 1 – ID Token** (One Tap / Sign In With Google button):
- *   Frontend sends `idToken`. Backend verifies cryptographically using
- *   Google's public keys. No secret required.
- *
- * **Path 2 – Access Token** (popup via `initTokenClient`):
- *   Frontend sends `accessToken`. Backend validates by calling Google's
- *   userinfo endpoint. No secret required.
- *
- * **Path 3 – Authorization Code** (most secure, requires `clientSecret`):
- *   Frontend sends `code` + `redirectUri`. Backend exchanges the code
- *   server-side for an ID token using `clientId` + `clientSecret`, then
- *   verifies the ID token. Tokens never touch the browser.
- */
-export declare function createGoogleProvider(config: GoogleProviderConfig | string): OAuthProvider<{
-    idToken?: string;
-    accessToken?: string;
-    code?: string;
-    redirectUri?: string;
-}>;

package/dist/auth/index.d.ts

@@ -1,36 +0,0 @@
-export * from "./interfaces";
-export { configureJwt, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry } from "./jwt";
-export type { JwtConfig, AccessTokenPayload } from "./jwt";
-export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
-export type { PasswordValidationResult } from "./password";
-export type { AuthHooks, AuthMethod, ResolvedAuthHooks } from "./auth-hooks";
-export { resolveAuthHooks } from "./auth-hooks";
-export { generateSecurePassword, generateSecureToken, hashToken, prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops";
-export type { AdminUserContext, AdminUserPrepareResult } from "./admin-user-ops";
-export { createGoogleProvider } from "./google-oauth";
-export type { GoogleProviderConfig } from "./google-oauth";
-export { createLinkedinProvider } from "./linkedin-oauth";
-export { createGitHubProvider } from "./github-oauth";
-export { createMicrosoftProvider } from "./microsoft-oauth";
-export { createAppleProvider } from "./apple-oauth";
-export { createFacebookProvider } from "./facebook-oauth";
-export { createTwitterProvider } from "./twitter-oauth";
-export { createDiscordProvider } from "./discord-oauth";
-export { createGitLabProvider } from "./gitlab-oauth";
-export { createBitbucketProvider } from "./bitbucket-oauth";
-export { createSlackProvider } from "./slack-oauth";
-export { createSpotifyProvider } from "./spotify-oauth";
-export { requireAuth, requireAdmin, optionalAuth, extractUserFromToken, createAuthMiddleware } from "./middleware";
-export type { AuthMiddlewareOptions, AuthResult } from "./middleware";
-export { createAuthRoutes } from "./routes";
-export type { AuthModuleConfig } from "./routes";
-export { createResetPasswordRoute } from "./reset-password-admin";
-export type { ResetPasswordRouteConfig } from "./reset-password-admin";
-export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createApiKeyRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
-export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys";
-export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys";
-export { createBuiltinAuthAdapter } from "./builtin-auth-adapter";
-export type { BuiltinAuthAdapterConfig } from "./builtin-auth-adapter";
-export { createCustomAuthAdapter } from "./custom-auth-adapter";
-export { createAdapterAuthMiddleware } from "./adapter-middleware";
-export type { AdapterAuthMiddlewareOptions } from "./adapter-middleware";