@revealui/auth 0.4.1 → 0.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -98,7 +98,7 @@ pnpm test
|
|
|
98
98
|
- **Not** for OAuth-only flows - use a dedicated OAuth provider and wire tokens through this package
|
|
99
99
|
- **Not** for stateless JWT auth - this package uses database sessions by design
|
|
100
100
|
|
|
101
|
-
##
|
|
101
|
+
## Design Principles
|
|
102
102
|
|
|
103
103
|
- **Sovereign**: Sessions live in your PostgreSQL database, not a third-party auth service
|
|
104
104
|
- **Hermetic**: HTTP-only, SameSite cookies and SHA-256 token hashing prevent cross-boundary leaks
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
* Security Event Bridge - Connects auth events to the audit trail.
|
|
3
3
|
*
|
|
4
4
|
* Each function wraps an auth operation with structured audit logging
|
|
5
|
-
* via the AuditSystem from @revealui/security. Uses lazy import to
|
|
5
|
+
* via the AuditSystem from @revealui/security/server. Uses lazy import to
|
|
6
6
|
* avoid circular dependency issues at module load time.
|
|
7
7
|
*/
|
|
8
8
|
/**
|
|
@@ -2,17 +2,17 @@
|
|
|
2
2
|
* Security Event Bridge - Connects auth events to the audit trail.
|
|
3
3
|
*
|
|
4
4
|
* Each function wraps an auth operation with structured audit logging
|
|
5
|
-
* via the AuditSystem from @revealui/security. Uses lazy import to
|
|
5
|
+
* via the AuditSystem from @revealui/security/server. Uses lazy import to
|
|
6
6
|
* avoid circular dependency issues at module load time.
|
|
7
7
|
*/
|
|
8
8
|
/**
|
|
9
|
-
* Lazily resolve the global audit system from @revealui/security.
|
|
9
|
+
* Lazily resolve the global audit system from @revealui/security/server.
|
|
10
10
|
* Returns null if the module cannot be loaded (e.g. in test environments
|
|
11
|
-
* where @revealui/security is not available).
|
|
11
|
+
* where @revealui/security/server is not available).
|
|
12
12
|
*/
|
|
13
13
|
async function getAudit() {
|
|
14
14
|
try {
|
|
15
|
-
const { audit } = await import('@revealui/security');
|
|
15
|
+
const { audit } = await import('@revealui/security/server');
|
|
16
16
|
return audit;
|
|
17
17
|
}
|
|
18
18
|
catch {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@revealui/auth",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.2",
|
|
4
4
|
"description": "Database-backed session auth for Hono and Next.js — bcrypt, OAuth, brute-force protection, rate limiting, password reset. Ships with RevealUI.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"auth",
|
|
@@ -15,10 +15,10 @@
|
|
|
15
15
|
"drizzle-orm": "^0.45.2",
|
|
16
16
|
"zod": "^4.4.3",
|
|
17
17
|
"@revealui/config": "0.4.1",
|
|
18
|
-
"@revealui/contracts": "0.
|
|
19
|
-
"@revealui/
|
|
20
|
-
"@revealui/
|
|
21
|
-
"@revealui/security": "0.
|
|
18
|
+
"@revealui/contracts": "0.6.0",
|
|
19
|
+
"@revealui/db": "0.6.0",
|
|
20
|
+
"@revealui/core": "0.8.0",
|
|
21
|
+
"@revealui/security": "0.4.0"
|
|
22
22
|
},
|
|
23
23
|
"devDependencies": {
|
|
24
24
|
"@simplewebauthn/browser": "^13.3.0",
|