@revealui/auth 0.0.0-canary-20260409021642

package/dist/react/useSignUp.js

@@ -0,0 +1,106 @@
+/**
+ * useSignUp Hook
+ *
+ * React hook for signing up a new user.
+ */
+'use client';
+import { useState } from 'react';
+import { z } from 'zod/v4';
+// Zod validates the required fields; .passthrough() preserves the rest.
+// The API returns JSON-serialized User objects (Dates as ISO strings).
+// z.infer output has an index signature incompatible with the concrete User
+// interface, so we extract the validated user via the helper below.
+const SignUpUserSchema = z
+    .object({
+    id: z.string(),
+    email: z.string(),
+    name: z.string().nullable().optional(),
+})
+    .passthrough();
+/**
+ * Narrow Zod-validated API response data to User.
+ *
+ * The cast is safe because: (1) Zod verified the required fields (id, email),
+ * (2) .passthrough() preserves all other properties from the API response,
+ * and (3) the API serializes a full User row (Dates become ISO strings in JSON).
+ */
+function toUser(validated) {
+    return validated;
+}
+// Validation schemas for sign-up response
+const SignUpErrorResponseSchema = z.object({
+    message: z.string().optional(),
+    error: z.string().optional(),
+});
+const SignUpSuccessResponseSchema = z.object({
+    user: SignUpUserSchema,
+});
+/**
+ * Hook to sign up a new user
+ *
+ * @returns Sign up function, loading state, and error
+ *
+ * @example
+ * ```tsx
+ * function SignUpForm() {
+ *   const { signUp, isLoading } = useSignUp()
+ *
+ *   const handleSubmit = async (e: FormEvent) => {
+ *     e.preventDefault()
+ *     const result = await signUp({ email, password, name })
+ *     if (result.success) {
+ *       router.push('/dashboard')
+ *     }
+ *   }
+ * }
+ * ```
+ */
+export function useSignUp() {
+    const [isLoading, setIsLoading] = useState(false);
+    const [error, setError] = useState(null);
+    const signUp = async (input) => {
+        try {
+            setIsLoading(true);
+            setError(null);
+            const response = await fetch('/api/auth/sign-up', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                credentials: 'include',
+                body: JSON.stringify(input),
+            });
+            const json = await response.json();
+            if (!response.ok) {
+                const errorData = SignUpErrorResponseSchema.parse(json);
+                return {
+                    success: false,
+                    error: errorData.message || errorData.error || 'Failed to sign up',
+                };
+            }
+            const successData = SignUpSuccessResponseSchema.parse(json);
+            return {
+                success: true,
+                // Type assertion through unknown is safe because Zod validation ensures the shape is correct
+                // The API returns serialized data, so we cast to expected type
+                user: toUser(successData.user),
+            };
+        }
+        catch (err) {
+            const error = err instanceof Error ? err : new Error(String(err));
+            setError(error);
+            return {
+                success: false,
+                error: error.message,
+            };
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
+    return {
+        signUp,
+        isLoading,
+        error,
+    };
+}

package/dist/server/audit-bridge.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Security Event Bridge — Connects auth events to the audit trail.
+ *
+ * Each function wraps an auth operation with structured audit logging
+ * via the AuditSystem from @revealui/security. Uses lazy import to
+ * avoid circular dependency issues at module load time.
+ */
+/**
+ * Record a successful login to the audit trail.
+ *
+ * @param userId - The authenticated user's ID
+ * @param ip - Client IP address
+ * @param userAgent - Client User-Agent header
+ */
+export declare function auditLoginSuccess(userId: string, ip: string, userAgent: string): Promise<void>;
+/**
+ * Record a failed login attempt to the audit trail.
+ *
+ * @param email - The email used in the failed attempt
+ * @param ip - Client IP address
+ * @param userAgent - Client User-Agent header
+ * @param reason - Why the login failed (e.g. 'invalid_password', 'account_locked')
+ */
+export declare function auditLoginFailure(email: string, ip: string, userAgent: string, reason: string): Promise<void>;
+/**
+ * Record a password change to the audit trail.
+ *
+ * @param userId - The user who changed their password
+ * @param ip - Client IP address
+ */
+export declare function auditPasswordChange(userId: string, ip: string): Promise<void>;
+/**
+ * Record a password reset request to the audit trail.
+ *
+ * @param email - The email for which a reset was requested
+ * @param ip - Client IP address
+ */
+export declare function auditPasswordReset(email: string, ip: string): Promise<void>;
+/**
+ * Record MFA being enabled on an account to the audit trail.
+ *
+ * @param userId - The user who enabled MFA
+ * @param ip - Client IP address
+ */
+export declare function auditMfaEnabled(userId: string, ip: string): Promise<void>;
+/**
+ * Record MFA being disabled on an account to the audit trail.
+ *
+ * @param userId - The user who disabled MFA
+ * @param ip - Client IP address
+ */
+export declare function auditMfaDisabled(userId: string, ip: string): Promise<void>;
+/**
+ * Record a session revocation to the audit trail.
+ *
+ * @param userId - The user whose session was revoked
+ * @param sessionId - The revoked session's ID
+ * @param ip - Client IP address
+ */
+export declare function auditSessionRevoked(userId: string, sessionId: string, ip: string): Promise<void>;
+/**
+ * Record an account lockout to the audit trail.
+ *
+ * @param email - The locked account's email
+ * @param ip - Client IP address
+ * @param failedAttempts - Number of failed attempts that triggered the lockout
+ */
+export declare function auditAccountLocked(email: string, ip: string, failedAttempts: number): Promise<void>;
+//# sourceMappingURL=audit-bridge.d.ts.map

package/dist/server/audit-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-bridge.d.ts","sourceRoot":"","sources":["../../src/server/audit-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgCH;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASnF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjF;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/E;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/server/audit-bridge.js

@@ -0,0 +1,169 @@
+/**
+ * Security Event Bridge — Connects auth events to the audit trail.
+ *
+ * Each function wraps an auth operation with structured audit logging
+ * via the AuditSystem from @revealui/security. Uses lazy import to
+ * avoid circular dependency issues at module load time.
+ */
+/**
+ * Lazily resolve the global audit system from @revealui/security.
+ * Returns null if the module cannot be loaded (e.g. in test environments
+ * where @revealui/security is not available).
+ */
+async function getAudit() {
+    try {
+        const { audit } = await import('@revealui/security');
+        return audit;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Internal helper — logs an audit event, silently skipping if the
+ * audit system is unavailable.
+ */
+async function logAuditEvent(event) {
+    const auditSystem = await getAudit();
+    if (!auditSystem) {
+        return;
+    }
+    await auditSystem.log(event);
+}
+/**
+ * Record a successful login to the audit trail.
+ *
+ * @param userId - The authenticated user's ID
+ * @param ip - Client IP address
+ * @param userAgent - Client User-Agent header
+ */
+export async function auditLoginSuccess(userId, ip, userAgent) {
+    await logAuditEvent({
+        type: 'auth.login',
+        severity: 'low',
+        actor: { id: userId, type: 'user', ip, userAgent },
+        action: 'login',
+        result: 'success',
+        message: 'User logged in successfully',
+    });
+}
+/**
+ * Record a failed login attempt to the audit trail.
+ *
+ * @param email - The email used in the failed attempt
+ * @param ip - Client IP address
+ * @param userAgent - Client User-Agent header
+ * @param reason - Why the login failed (e.g. 'invalid_password', 'account_locked')
+ */
+export async function auditLoginFailure(email, ip, userAgent, reason) {
+    await logAuditEvent({
+        type: 'auth.failed_login',
+        severity: 'medium',
+        actor: { id: email, type: 'user', ip, userAgent },
+        action: 'login',
+        result: 'failure',
+        message: `Login failed: ${reason}`,
+        metadata: { email, reason },
+    });
+}
+/**
+ * Record a password change to the audit trail.
+ *
+ * @param userId - The user who changed their password
+ * @param ip - Client IP address
+ */
+export async function auditPasswordChange(userId, ip) {
+    await logAuditEvent({
+        type: 'auth.password_change',
+        severity: 'medium',
+        actor: { id: userId, type: 'user', ip },
+        action: 'password_change',
+        result: 'success',
+        message: 'Password changed',
+    });
+}
+/**
+ * Record a password reset request to the audit trail.
+ *
+ * @param email - The email for which a reset was requested
+ * @param ip - Client IP address
+ */
+export async function auditPasswordReset(email, ip) {
+    await logAuditEvent({
+        type: 'auth.password_reset',
+        severity: 'medium',
+        actor: { id: email, type: 'user', ip },
+        action: 'password_reset',
+        result: 'success',
+        message: 'Password reset requested',
+        metadata: { email },
+    });
+}
+/**
+ * Record MFA being enabled on an account to the audit trail.
+ *
+ * @param userId - The user who enabled MFA
+ * @param ip - Client IP address
+ */
+export async function auditMfaEnabled(userId, ip) {
+    await logAuditEvent({
+        type: 'auth.mfa_enabled',
+        severity: 'medium',
+        actor: { id: userId, type: 'user', ip },
+        action: 'mfa_enabled',
+        result: 'success',
+        message: 'MFA enabled',
+    });
+}
+/**
+ * Record MFA being disabled on an account to the audit trail.
+ *
+ * @param userId - The user who disabled MFA
+ * @param ip - Client IP address
+ */
+export async function auditMfaDisabled(userId, ip) {
+    await logAuditEvent({
+        type: 'auth.mfa_disabled',
+        severity: 'high',
+        actor: { id: userId, type: 'user', ip },
+        action: 'mfa_disabled',
+        result: 'success',
+        message: 'MFA disabled',
+    });
+}
+/**
+ * Record a session revocation to the audit trail.
+ *
+ * @param userId - The user whose session was revoked
+ * @param sessionId - The revoked session's ID
+ * @param ip - Client IP address
+ */
+export async function auditSessionRevoked(userId, sessionId, ip) {
+    await logAuditEvent({
+        type: 'security.alert',
+        severity: 'medium',
+        actor: { id: userId, type: 'user', ip },
+        action: 'session_revoked',
+        result: 'success',
+        message: 'Session revoked',
+        metadata: { sessionId },
+    });
+}
+/**
+ * Record an account lockout to the audit trail.
+ *
+ * @param email - The locked account's email
+ * @param ip - Client IP address
+ * @param failedAttempts - Number of failed attempts that triggered the lockout
+ */
+export async function auditAccountLocked(email, ip, failedAttempts) {
+    await logAuditEvent({
+        type: 'security.alert',
+        severity: 'high',
+        actor: { id: email, type: 'user', ip },
+        action: 'account_locked',
+        result: 'failure',
+        message: `Account locked after ${String(failedAttempts)} failed attempts`,
+        metadata: { email, failedAttempts },
+    });
+}

package/dist/server/auth.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Authentication Functions (Server-side)
+ *
+ * Sign in and sign up functionality with password hashing.
+ */
+import type { SignInResult, SignUpResult } from '../types.js';
+/**
+ * Sign in with email and password
+ *
+ * @param email - User email
+ * @param password - User password
+ * @param options - Additional options (userAgent, ipAddress)
+ * @returns Sign in result with user and session token
+ */
+export declare function signIn(email: string, password: string, options?: {
+    userAgent?: string;
+    ipAddress?: string;
+}): Promise<SignInResult>;
+/**
+ * Check if a given email is allowed to sign up.
+ *
+ * Behavior:
+ * - If REVEALUI_SIGNUP_OPEN is 'true', all emails are allowed.
+ * - If REVEALUI_SIGNUP_WHITELIST is set (comma-separated emails), only listed emails pass.
+ * - If neither env var is set, signups are open (backwards compatible).
+ *
+ * @param email - Lowercase, trimmed email to check
+ * @returns true if signup is allowed
+ */
+export declare function isSignupAllowed(email: string): boolean;
+/**
+ * Sign up a new user
+ *
+ * @param email - User email
+ * @param password - User password
+ * @param name - User name
+ * @param options - Additional options
+ * @returns Sign up result with user and session token
+ */
+export declare function signUp(email: string, password: string, name: string, options?: {
+    userAgent?: string;
+    ipAddress?: string;
+    tosAcceptedAt?: Date;
+    tosVersion?: string;
+}): Promise<SignUpResult>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/server/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAQ,MAAM,aAAa,CAAC;AASpE;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,YAAY,CAAC,CAuKvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAiBtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,YAAY,CAAC,CAsLvB"}