@revojs/auth 0.2.8 → 0.2.9

package/dist/index.d.ts

@@ -8,6 +8,60 @@ export type PasskeyMethod = InferInput<typeof passkeyMethodSchema>;
 export type ProviderMethod = InferInput<typeof providerMethodSchema>;
 export type Method = InferInput<typeof methodSchema>;
 export type Providers = "apple" | "github" | "google" | "microsoft";
+export type MembershipStatus = "active" | "suspended";
+export type InvitationStatus = "pending" | "accepted" | "revoked";
+export type TraceAction = "organization.create" | "organization.update" | "organization.transferOwnership" | "membership.active" | "membership.suspended" | "membership.remove" | "invitation.create" | "invitation.accept" | "invitation.revoke";
+export type TraceCursor = Pick<Trace, "createdAt" | "id">;
+export type AuthStorage = AccountStorage & OrganizationStorage;
+export interface Account {
+    id: string;
+    email: string;
+    password: string | null;
+    createdAt: Date;
+}
+export interface Identity {
+    id: string;
+    provider: string;
+    credential: string;
+    createdAt: Date;
+    accountId: string;
+}
+export interface Session {
+    id: string;
+    createdAt: Date;
+    accountId: string;
+}
+export interface AccountStorage {
+    getAccountByEmail: (email: string) => Promise<Account | undefined>;
+    getAccountById: (id: string) => Promise<Account | undefined>;
+    createAccount: (account: Account) => Promise<Account | undefined>;
+    deleteAccount: (id: string) => Promise<void>;
+    getIdentity: (provider: string, credential: string) => Promise<Identity | undefined>;
+    createIdentity: (identity: Identity) => Promise<Identity | undefined>;
+    getSession: (id: string, accountId: string) => Promise<Session | undefined>;
+    createSession: (session: Session) => Promise<Session | undefined>;
+    deleteSession: (id: string, accountId: string) => Promise<void>;
+}
+export interface OrganizationStorage {
+    transaction: <T>(run: (storage: AuthStorage) => Promise<T>) => Promise<T>;
+    getOrganization: (id: string) => Promise<Organization | undefined>;
+    listOrganizations: (accountId: string) => Promise<Array<Organization>>;
+    createOrganization: (organization: Organization) => Promise<void>;
+    updateOrganization: (id: string, values: Pick<Organization, "name" | "accountId">) => Promise<void>;
+    getMembership: (organizationId: string, accountId: string) => Promise<Membership | undefined>;
+    getMembershipById: (organizationId: string, id: string) => Promise<Membership | undefined>;
+    listMemberships: (organizationId: string) => Promise<Array<Membership>>;
+    createMembership: (membership: Membership) => Promise<void>;
+    updateMembership: (organizationId: string, id: string, status: MembershipStatus) => Promise<void>;
+    deleteMembership: (organizationId: string, id: string) => Promise<void>;
+    getInvitation: (organizationId: string, id: string) => Promise<Invitation | undefined>;
+    getInvitationByHash: (hash: string) => Promise<Invitation | undefined>;
+    listInvitations: (organizationId: string) => Promise<Array<Invitation>>;
+    createInvitation: (invitation: Invitation) => Promise<void>;
+    updateInvitation: (organizationId: string, id: string, status: InvitationStatus) => Promise<void>;
+    createTrace: (trace: Trace) => Promise<void>;
+    listTraces: (organizationId: string, limit: number, before?: TraceCursor) => Promise<Array<Trace>>;
+}
 export interface Token {
     access_token: string;
     token_type: string;
@@ -50,28 +104,125 @@ export interface AuthProviderOptions {
 export interface AuthProvider {
     setup: (scope: Scope) => AuthProviderOptions;
 }
-export declare function useAuth(scope: Scope): {
+export interface Organization {
+    id: string;
+    name: string;
+    accountId: string;
+    createdAt: Date;
+}
+export interface Membership {
+    id: string;
+    organizationId: string;
+    accountId: string;
+    status: MembershipStatus;
+    createdAt: Date;
+}
+export interface Invitation {
+    id: string;
+    organizationId: string;
+    email: string;
+    tokenHash: string;
+    invitedBy: string;
+    status: InvitationStatus;
+    expiresAt: Date;
+    createdAt: Date;
+}
+export interface Trace {
+    id: string;
+    organizationId: string;
+    accountId: string;
+    action: TraceAction;
+    subjectId: string;
+    content: string;
+    createdAt: Date;
+}
+export declare function useClientAuth(scope: Scope): {
     signInWithCredentials(credential: PasswordMethod | PasskeyMethod): Promise<unknown>;
     signInWithProvider(provider: Providers | (string & {}), redirectUrl: string): Promise<void>;
     signOut(): Promise<unknown>;
 };
-export declare function requireSession<T>(scope: Scope, redirectUrl: string): Promise<T>;
+export declare function requireSession(scope: Scope, redirectUrl?: string): Promise<Session>;
 export declare function getCryptoKey(scope: Scope): Promise<CryptoKey>;
-export declare function getSession<T>(scope: Scope): Promise<T | undefined>;
-export declare function setSession<T>(scope: Scope, session: T): Promise<void>;
+export declare function getSession(scope: Scope): Promise<Session | undefined>;
+export declare function setSession(scope: Scope, session: Session): Promise<void>;
 export declare function clearSession(scope: Scope): void;
 export declare function defineAuthProvider(provider: AuthProvider): Route;
-export declare const AUTHORIZE_HOOK: import("revojs").Descriptor<(method: Method) => Awaitable<boolean>>;
-export declare const GET_PRINCIPAL_HOOK: import("revojs").Descriptor<(method: Method) => Awaitable<Principal | undefined>>;
-export declare const CREATE_PRINCIPAL_HOOK: import("revojs").Descriptor<(method: Method) => Awaitable<Principal | undefined>>;
-export declare const CREATE_SESSION_HOOK: import("revojs").Descriptor<(principal: Principal) => Awaitable<unknown>>;
-export declare const DELETE_SESSION_HOOK: import("revojs").Descriptor<(session: any) => Awaitable<unknown>>;
+export declare function useServerAuth(scope: Scope): Promise<{
+    getAccountByEmail: (email: string) => Promise<Account | undefined>;
+    getAccountById: (id: string) => Promise<Account | undefined>;
+    createAccount: (account: Account) => Promise<Account | undefined>;
+    deleteAccount: (id: string) => Promise<void>;
+    getIdentity: (provider: string, credential: string) => Promise<Identity | undefined>;
+    createIdentity: (identity: Identity) => Promise<Identity | undefined>;
+    getSession: (id: string, accountId: string) => Promise<Session | undefined>;
+    createSession: (session: Session) => Promise<Session | undefined>;
+    deleteSession: (id: string, accountId: string) => Promise<void>;
+    transaction: <T>(run: (storage: AuthStorage) => Promise<T>) => Promise<T>;
+    getOrganization: (id: string) => Promise<Organization | undefined>;
+    listOrganizations: (accountId: string) => Promise<Array<Organization>>;
+    createOrganization: (organization: Organization) => Promise<void>;
+    updateOrganization: (id: string, values: Pick<Organization, "name" | "accountId">) => Promise<void>;
+    getMembership: (organizationId: string, accountId: string) => Promise<Membership | undefined>;
+    getMembershipById: (organizationId: string, id: string) => Promise<Membership | undefined>;
+    listMemberships: (organizationId: string) => Promise<Array<Membership>>;
+    createMembership: (membership: Membership) => Promise<void>;
+    updateMembership: (organizationId: string, id: string, status: MembershipStatus) => Promise<void>;
+    deleteMembership: (organizationId: string, id: string) => Promise<void>;
+    getInvitation: (organizationId: string, id: string) => Promise<Invitation | undefined>;
+    getInvitationByHash: (hash: string) => Promise<Invitation | undefined>;
+    listInvitations: (organizationId: string) => Promise<Array<Invitation>>;
+    createInvitation: (invitation: Invitation) => Promise<void>;
+    updateInvitation: (organizationId: string, id: string, status: InvitationStatus) => Promise<void>;
+    createTrace: (trace: Trace) => Promise<void>;
+    listTraces: (organizationId: string, limit: number, before?: TraceCursor) => Promise<Array<Trace>>;
+}>;
+export declare function useAccountStorage(scope: Scope): Promise<AccountStorage>;
+export declare function useOrganizationStorage(scope: Scope): Promise<OrganizationStorage>;
+export declare function getPrincipal(scope: Scope, method: Method): Promise<Principal | false | undefined>;
+export declare function createPrincipal(scope: Scope, method: Method): Promise<Principal | undefined>;
+export declare function createSession(scope: Scope, principal: Principal): Promise<Session | undefined>;
+export declare const authIdSchema: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>]>;
+export declare const organizationNameSchema: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MaxLengthAction<string, 200, undefined>, import("valibot").TrimAction, import("valibot").MinLengthAction<string, 1, undefined>]>;
+export declare const organizationParametersSchema: import("valibot").ObjectSchema<{
+    readonly organizationId: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>]>;
+}, undefined>;
+export declare const membershipParametersSchema: import("valibot").ObjectSchema<{
+    readonly organizationId: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>]>;
+    readonly membershipId: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>]>;
+}, undefined>;
+export declare const BEFORE_PRINCIPAL_GET_HOOK: import("revojs").Descriptor<(method: Readonly<Method>) => Awaitable<void | boolean>>;
+export declare const AFTER_PRINCIPAL_GET_HOOK: import("revojs").Descriptor<(principal: Readonly<Principal>, method: Readonly<Method>) => Awaitable<void>>;
+export declare const BEFORE_PRINCIPAL_CREATE_HOOK: import("revojs").Descriptor<(method: Readonly<Method>) => Awaitable<void | boolean>>;
+export declare const AFTER_PRINCIPAL_CREATE_HOOK: import("revojs").Descriptor<(principal: Readonly<Principal>, method: Readonly<Method>) => Awaitable<void>>;
+export declare const BEFORE_ACCOUNT_GET_HOOK: import("revojs").Descriptor<(field: "id" | "email", value: string) => Awaitable<void | boolean>>;
+export declare const AFTER_ACCOUNT_GET_HOOK: import("revojs").Descriptor<(account: Readonly<Account>) => Awaitable<void>>;
+export declare const BEFORE_IDENTITY_GET_HOOK: import("revojs").Descriptor<(provider: string, credential: string) => Awaitable<void | boolean>>;
+export declare const AFTER_IDENTITY_GET_HOOK: import("revojs").Descriptor<(identity: Readonly<Identity>) => Awaitable<void>>;
+export declare const BEFORE_SESSION_GET_HOOK: import("revojs").Descriptor<(id: string, accountId: string) => Awaitable<void | boolean>>;
+export declare const AFTER_SESSION_GET_HOOK: import("revojs").Descriptor<(session: Readonly<Session>) => Awaitable<void>>;
+export declare const BEFORE_ACCOUNT_CREATE_HOOK: import("revojs").Descriptor<(account: Readonly<Account>, method: Readonly<Method>) => Awaitable<void | boolean | Record<string, unknown>>>;
+export declare const AFTER_ACCOUNT_CREATE_HOOK: import("revojs").Descriptor<(account: Readonly<Account>) => Awaitable<void>>;
+export declare const BEFORE_IDENTITY_CREATE_HOOK: import("revojs").Descriptor<(identity: Readonly<Identity>, method: Readonly<Method>) => Awaitable<void | boolean | Record<string, unknown>>>;
+export declare const AFTER_IDENTITY_CREATE_HOOK: import("revojs").Descriptor<(identity: Readonly<Identity>) => Awaitable<void>>;
+export declare const BEFORE_SESSION_CREATE_HOOK: import("revojs").Descriptor<(session: Readonly<Session>, principal: Readonly<Principal>) => Awaitable<void | boolean | Record<string, unknown>>>;
+export declare const AFTER_SESSION_CREATE_HOOK: import("revojs").Descriptor<(session: Readonly<Session>) => Awaitable<void>>;
 export declare const registerAuthHooks: (scope: Scope, hooks: Partial<import("revojs").Hooks<{
-    authorize: import("revojs").Descriptor<(method: Method) => Awaitable<boolean>>;
-    getPrincipal: import("revojs").Descriptor<(method: Method) => Awaitable<Principal | undefined>>;
-    createPrincipal: import("revojs").Descriptor<(method: Method) => Awaitable<Principal | undefined>>;
-    createSession: import("revojs").Descriptor<(principal: Principal) => Awaitable<unknown>>;
-    deleteSession: import("revojs").Descriptor<(session: any) => Awaitable<unknown>>;
+    beforePrincipalGet: import("revojs").Descriptor<(method: Readonly<Method>) => Awaitable<void | boolean>>;
+    afterPrincipalGet: import("revojs").Descriptor<(principal: Readonly<Principal>, method: Readonly<Method>) => Awaitable<void>>;
+    beforePrincipalCreate: import("revojs").Descriptor<(method: Readonly<Method>) => Awaitable<void | boolean>>;
+    afterPrincipalCreate: import("revojs").Descriptor<(principal: Readonly<Principal>, method: Readonly<Method>) => Awaitable<void>>;
+    beforeAccountGet: import("revojs").Descriptor<(field: "id" | "email", value: string) => Awaitable<void | boolean>>;
+    afterAccountGet: import("revojs").Descriptor<(account: Readonly<Account>) => Awaitable<void>>;
+    beforeIdentityGet: import("revojs").Descriptor<(provider: string, credential: string) => Awaitable<void | boolean>>;
+    afterIdentityGet: import("revojs").Descriptor<(identity: Readonly<Identity>) => Awaitable<void>>;
+    beforeSessionGet: import("revojs").Descriptor<(id: string, accountId: string) => Awaitable<void | boolean>>;
+    afterSessionGet: import("revojs").Descriptor<(session: Readonly<Session>) => Awaitable<void>>;
+    beforeAccountCreate: import("revojs").Descriptor<(account: Readonly<Account>, method: Readonly<Method>) => Awaitable<void | boolean | Record<string, unknown>>>;
+    afterAccountCreate: import("revojs").Descriptor<(account: Readonly<Account>) => Awaitable<void>>;
+    beforeIdentityCreate: import("revojs").Descriptor<(identity: Readonly<Identity>, method: Readonly<Method>) => Awaitable<void | boolean | Record<string, unknown>>>;
+    afterIdentityCreate: import("revojs").Descriptor<(identity: Readonly<Identity>) => Awaitable<void>>;
+    beforeSessionCreate: import("revojs").Descriptor<(session: Readonly<Session>, principal: Readonly<Principal>) => Awaitable<void | boolean | Record<string, unknown>>>;
+    afterSessionCreate: import("revojs").Descriptor<(session: Readonly<Session>) => Awaitable<void>>;
 }>>) => void;
 export declare const principalSchema: import("valibot").ObjectSchema<{
     readonly sub: import("valibot").StringSchema<undefined>;
@@ -86,7 +237,7 @@ export declare const passwordMethodSchema: import("valibot").ObjectSchema<{
     readonly type: import("valibot").LiteralSchema<"PASSWORD", undefined>;
     readonly email: import("valibot").StringSchema<undefined>;
     readonly password: import("valibot").StringSchema<undefined>;
-    readonly register: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, true>;
+    readonly register: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, false>;
 }, undefined>;
 export declare const passkeyMethodSchema: import("valibot").ObjectSchema<{
     readonly type: import("valibot").LiteralSchema<"PASSKEY", undefined>;
@@ -109,7 +260,7 @@ export declare const methodSchema: import("valibot").UnionSchema<[import("valibo
     readonly type: import("valibot").LiteralSchema<"PASSWORD", undefined>;
     readonly email: import("valibot").StringSchema<undefined>;
     readonly password: import("valibot").StringSchema<undefined>;
-    readonly register: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, true>;
+    readonly register: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, false>;
 }, undefined>, import("valibot").ObjectSchema<{
     readonly type: import("valibot").LiteralSchema<"PASSKEY", undefined>;
 }, undefined>, import("valibot").ObjectSchema<{

package/dist/index.js

@@ -1,11 +1,12 @@
 import config from "#config/auth";
 import { isClient, isServer } from "#variables";
-import { deleteCookie, fetch, sendForbidden, sendRedirect, setCookie, useCookies, useHeaders, useQuery, useUrl, withQuery } from "@revojs/server";
-import { createRegisterHooks, defineHook, dispatchHook, dispatchHookSingle, useVariables } from "revojs";
+import { deleteCookie, fetch, sendForbidden, sendRedirect, sendUnauthorized, setCookie, useCookies, useHeaders, useQuery, useUrl, withQuery } from "@revojs/server";
+import { useStorageProvider } from "@revojs/storage";
+import { createRegisterHooks, defineHook, dispatchHook, useVariables } from "revojs";
 import { mergeObjects } from "revojs/shared";
-import { boolean, literal, nullish, number, object, optional, parse, pipe, string, transform, union } from "valibot";
+import { boolean, literal, maxLength, minLength, nullish, number, object, optional, parse, pipe, string, transform, trim, union } from "valibot";
 //#region src/index.ts
-function useAuth(scope) {
+function useClientAuth(scope) {
 	return {
 		async signInWithCredentials(credential) {
 			return await fetch(scope, `/auth/sessions`, {
@@ -23,21 +24,20 @@ function useAuth(scope) {
 	};
 }
 async function requireSession(scope, redirectUrl) {
-	if (isClient) {
+	if (isClient) try {
+		return await fetch(scope, "/auth/sessions", {
+			method: "GET",
+			headers: useHeaders(scope)
+		});
+	} catch (error) {
+		if (!redirectUrl) throw error;
 		const { pathname } = useUrl(scope);
-		try {
-			return await fetch(scope, "/auth/sessions", {
-				method: "GET",
-				headers: useHeaders(scope)
-			});
-		} catch {
-			if (redirectUrl !== pathname) globalThis.location.href = redirectUrl;
-		}
+		if (redirectUrl !== pathname) globalThis.location.href = redirectUrl;
 	}
 	if (isServer) {
 		const session = await getSession(scope);
 		if (session) return session;
-		throw sendRedirect(scope, redirectUrl);
+		throw redirectUrl ? sendRedirect(scope, redirectUrl) : sendUnauthorized(scope);
 	}
 	throw new Error("Session is unavailable");
 }
@@ -52,10 +52,21 @@ async function getSession(scope) {
 	const session = useCookies(scope)[config.session.name];
 	if (session) {
 		const index = session.lastIndexOf(".");
-		if (index > 0) try {
-			const payload = session.slice(0, index);
-			if (await crypto.subtle.verify("HMAC", await getCryptoKey(scope), Uint8Array.fromBase64(session.slice(index + 1), BASE64_VERIFY), Uint8Array.fromBase64(payload, BASE64_VERIFY))) return JSON.parse(decoder.decode(Uint8Array.fromBase64(payload, BASE64_VERIFY)));
-		} catch {}
+		if (index > 0) {
+			let value;
+			try {
+				const payload = session.slice(0, index);
+				if (await crypto.subtle.verify("HMAC", await getCryptoKey(scope), Uint8Array.fromBase64(session.slice(index + 1), BASE64_VERIFY), Uint8Array.fromBase64(payload, BASE64_VERIFY))) value = JSON.parse(decoder.decode(Uint8Array.fromBase64(payload, BASE64_VERIFY)));
+			} catch {}
+			if (value) {
+				if ((await dispatchHook(scope, BEFORE_SESSION_GET_HOOK, value.id, value.accountId)).includes(false)) return;
+				const session = await (await useAccountStorage(scope)).getSession(value.id, value.accountId);
+				if (session && Number.isFinite(session.createdAt.getTime()) && (config.session.cookie.maxAge === void 0 || Date.now() < session.createdAt.getTime() + config.session.cookie.maxAge * 1e3)) {
+					await dispatchHook(scope, AFTER_SESSION_GET_HOOK, session);
+					return session;
+				}
+			}
+		}
 	}
 }
 async function setSession(scope, session) {
@@ -114,10 +125,9 @@ function defineAuthProvider(provider) {
 					...options.userInfo.headers
 				} }))
 			};
-			if ((await dispatchHook(scope, AUTHORIZE_HOOK, method)).includes(false)) return sendForbidden(scope);
-			const principal = await dispatchHookSingle(scope, GET_PRINCIPAL_HOOK, method) ?? await dispatchHookSingle(scope, CREATE_PRINCIPAL_HOOK, method);
+			const principal = await getPrincipal(scope, method) ?? await createPrincipal(scope, method);
 			if (principal) {
-				const session = await dispatchHookSingle(scope, CREATE_SESSION_HOOK, principal);
+				const session = await createSession(scope, principal);
 				if (session) {
 					await setSession(scope, session);
 					return sendRedirect(scope, flow.redirect);
@@ -155,17 +165,206 @@ function defineAuthProvider(provider) {
 		return sendRedirect(scope, withQuery(scope, options.authorize.url, parameters));
 	} };
 }
-var AUTHORIZE_HOOK = defineHook("AUTHORIZE_HOOK");
-var GET_PRINCIPAL_HOOK = defineHook("GET_PRINCIPAL_HOOK");
-var CREATE_PRINCIPAL_HOOK = defineHook("CREATE_PRINCIPAL_HOOK");
-var CREATE_SESSION_HOOK = defineHook("CREATE_SESSION_HOOK");
-var DELETE_SESSION_HOOK = defineHook("DELETE_SESSION_HOOK");
+async function useServerAuth(scope) {
+	return {
+		...await useAccountStorage(scope),
+		...await useOrganizationStorage(scope)
+	};
+}
+async function useAccountStorage(scope) {
+	return useStorageProvider(scope, await Promise.all([
+		import("./storage/sqlite.js"),
+		import("./storage/postgresql.js"),
+		import("./storage/mysql.js")
+	]), (provider) => provider.accountSchema).useAccountStorage(scope);
+}
+async function useOrganizationStorage(scope) {
+	if (!config.organizations) throw new Error("Organizations is disabled. Set auth.organizations to true to use Organizations storage.");
+	return useStorageProvider(scope, await Promise.all([
+		import("./storage/sqlite.js"),
+		import("./storage/postgresql.js"),
+		import("./storage/mysql.js")
+	]), (provider) => provider.accountSchema).useOrganizationStorage(scope);
+}
+async function getPrincipal(scope, method) {
+	if (method.type === "PASSWORD") {
+		if ((await dispatchHook(scope, BEFORE_PRINCIPAL_GET_HOOK, method)).includes(false)) return false;
+		if ((await dispatchHook(scope, BEFORE_ACCOUNT_GET_HOOK, "email", method.email)).includes(false)) return false;
+		const account = await (await useAccountStorage(scope)).getAccountByEmail(method.email);
+		if (!account) return;
+		await dispatchHook(scope, AFTER_ACCOUNT_GET_HOOK, account);
+		if (account.password !== method.password) return;
+		const principal = {
+			sub: account.id,
+			email: account.email
+		};
+		await dispatchHook(scope, AFTER_PRINCIPAL_GET_HOOK, principal, method);
+		return principal;
+	} else if (method.type === "PROVIDER") {
+		if ((await dispatchHook(scope, BEFORE_PRINCIPAL_GET_HOOK, method)).includes(false)) return false;
+		if ((await dispatchHook(scope, BEFORE_IDENTITY_GET_HOOK, method.issuer, method.principal.sub)).includes(false)) return false;
+		const storage = await useAccountStorage(scope);
+		const identity = await storage.getIdentity(method.issuer, method.principal.sub);
+		if (!identity) return;
+		await dispatchHook(scope, AFTER_IDENTITY_GET_HOOK, identity);
+		if ((await dispatchHook(scope, BEFORE_ACCOUNT_GET_HOOK, "id", identity.accountId)).includes(false)) return false;
+		const account = await storage.getAccountById(identity.accountId);
+		if (!account) return;
+		await dispatchHook(scope, AFTER_ACCOUNT_GET_HOOK, account);
+		const principal = {
+			sub: account.id,
+			email: account.email
+		};
+		await dispatchHook(scope, AFTER_PRINCIPAL_GET_HOOK, principal, method);
+		return principal;
+	} else if (method.type === "PASSKEY") throw new Error("Passkey authentication is not implemented.");
+}
+async function createPrincipal(scope, method) {
+	if (method.type === "PASSWORD") {
+		if (!method.register) return;
+		if ((await dispatchHook(scope, BEFORE_PRINCIPAL_CREATE_HOOK, method)).includes(false)) return;
+		const storage = await useAccountStorage(scope);
+		if ((await dispatchHook(scope, BEFORE_ACCOUNT_GET_HOOK, "email", method.email)).includes(false)) return;
+		const existing = await storage.getAccountByEmail(method.email);
+		if (existing) {
+			await dispatchHook(scope, AFTER_ACCOUNT_GET_HOOK, existing);
+			return;
+		}
+		const account = {
+			id: crypto.randomUUID(),
+			email: method.email,
+			password: method.password,
+			createdAt: /* @__PURE__ */ new Date()
+		};
+		const beforeAccountCreate = await dispatchHook(scope, BEFORE_ACCOUNT_CREATE_HOOK, account, method);
+		if (beforeAccountCreate.includes(false)) return;
+		const accountFields = Object.keys(account);
+		for (const values of beforeAccountCreate) {
+			if (!values || typeof values !== "object") continue;
+			for (const key of Object.keys(values)) if (accountFields.includes(key)) throw new Error(`Auth account create values cannot replace field "${key}".`);
+			Object.assign(account, values);
+		}
+		const createdAccount = await storage.createAccount(account);
+		if (!createdAccount) throw new Error("Unable to read the created Auth account.");
+		await dispatchHook(scope, AFTER_ACCOUNT_CREATE_HOOK, createdAccount);
+		const principal = {
+			sub: createdAccount.id,
+			email: createdAccount.email
+		};
+		await dispatchHook(scope, AFTER_PRINCIPAL_CREATE_HOOK, principal, method);
+		return principal;
+	} else if (method.type === "PROVIDER") {
+		if ((await dispatchHook(scope, BEFORE_PRINCIPAL_CREATE_HOOK, method)).includes(false)) return;
+		const storage = await useAccountStorage(scope);
+		const account = {
+			id: crypto.randomUUID(),
+			email: method.principal.email ?? "",
+			password: null,
+			createdAt: /* @__PURE__ */ new Date()
+		};
+		const beforeAccountCreate = await dispatchHook(scope, BEFORE_ACCOUNT_CREATE_HOOK, account, method);
+		if (beforeAccountCreate.includes(false)) return;
+		const accountFields = Object.keys(account);
+		for (const values of beforeAccountCreate) {
+			if (!values || typeof values !== "object") continue;
+			for (const key of Object.keys(values)) if (accountFields.includes(key)) throw new Error(`Auth account create values cannot replace field "${key}".`);
+			Object.assign(account, values);
+		}
+		const identity = {
+			id: crypto.randomUUID(),
+			provider: method.issuer,
+			credential: method.principal.sub,
+			createdAt: /* @__PURE__ */ new Date(),
+			accountId: account.id
+		};
+		const beforeIdentityCreate = await dispatchHook(scope, BEFORE_IDENTITY_CREATE_HOOK, identity, method);
+		if (beforeIdentityCreate.includes(false)) return;
+		const identityFields = Object.keys(identity);
+		for (const values of beforeIdentityCreate) {
+			if (!values || typeof values !== "object") continue;
+			for (const key of Object.keys(values)) if (identityFields.includes(key)) throw new Error(`Auth identity create values cannot replace field "${key}".`);
+			Object.assign(identity, values);
+		}
+		const createdAccount = await storage.createAccount(account);
+		if (!createdAccount) throw new Error("Unable to read the created Auth account.");
+		let createdIdentity;
+		try {
+			createdIdentity = await storage.createIdentity(identity);
+			if (!createdIdentity) throw new Error("Unable to read the created Auth identity.");
+		} catch (error) {
+			await storage.deleteAccount(createdAccount.id);
+			throw error;
+		}
+		await dispatchHook(scope, AFTER_ACCOUNT_CREATE_HOOK, createdAccount);
+		await dispatchHook(scope, AFTER_IDENTITY_CREATE_HOOK, createdIdentity);
+		const principal = {
+			sub: createdAccount.id,
+			email: createdAccount.email
+		};
+		await dispatchHook(scope, AFTER_PRINCIPAL_CREATE_HOOK, principal, method);
+		return principal;
+	} else if (method.type === "PASSKEY") throw new Error("Passkey authentication is not implemented.");
+}
+async function createSession(scope, principal) {
+	const storage = await useAccountStorage(scope);
+	const session = {
+		id: crypto.randomUUID(),
+		createdAt: /* @__PURE__ */ new Date(),
+		accountId: principal.sub
+	};
+	const beforeSessionCreate = await dispatchHook(scope, BEFORE_SESSION_CREATE_HOOK, session, principal);
+	if (beforeSessionCreate.includes(false)) return;
+	const sessionFields = Object.keys(session);
+	for (const values of beforeSessionCreate) {
+		if (!values || typeof values !== "object") continue;
+		for (const key of Object.keys(values)) if (sessionFields.includes(key)) throw new Error(`Auth session create values cannot replace field "${key}".`);
+		Object.assign(session, values);
+	}
+	const created = await storage.createSession(session);
+	if (!created) throw new Error("Unable to read the created Auth session.");
+	await dispatchHook(scope, AFTER_SESSION_CREATE_HOOK, created);
+	return created;
+}
+var authIdSchema = pipe(string(), minLength(1), maxLength(128));
+var organizationNameSchema = pipe(string(), maxLength(200), trim(), minLength(1));
+var organizationParametersSchema = object({ organizationId: authIdSchema });
+var membershipParametersSchema = object({
+	organizationId: authIdSchema,
+	membershipId: authIdSchema
+});
+var BEFORE_PRINCIPAL_GET_HOOK = defineHook("BEFORE_PRINCIPAL_GET_HOOK");
+var AFTER_PRINCIPAL_GET_HOOK = defineHook("AFTER_PRINCIPAL_GET_HOOK");
+var BEFORE_PRINCIPAL_CREATE_HOOK = defineHook("BEFORE_PRINCIPAL_CREATE_HOOK");
+var AFTER_PRINCIPAL_CREATE_HOOK = defineHook("AFTER_PRINCIPAL_CREATE_HOOK");
+var BEFORE_ACCOUNT_GET_HOOK = defineHook("BEFORE_ACCOUNT_GET_HOOK");
+var AFTER_ACCOUNT_GET_HOOK = defineHook("AFTER_ACCOUNT_GET_HOOK");
+var BEFORE_IDENTITY_GET_HOOK = defineHook("BEFORE_IDENTITY_GET_HOOK");
+var AFTER_IDENTITY_GET_HOOK = defineHook("AFTER_IDENTITY_GET_HOOK");
+var BEFORE_SESSION_GET_HOOK = defineHook("BEFORE_SESSION_GET_HOOK");
+var AFTER_SESSION_GET_HOOK = defineHook("AFTER_SESSION_GET_HOOK");
+var BEFORE_ACCOUNT_CREATE_HOOK = defineHook("BEFORE_ACCOUNT_CREATE_HOOK");
+var AFTER_ACCOUNT_CREATE_HOOK = defineHook("AFTER_ACCOUNT_CREATE_HOOK");
+var BEFORE_IDENTITY_CREATE_HOOK = defineHook("BEFORE_IDENTITY_CREATE_HOOK");
+var AFTER_IDENTITY_CREATE_HOOK = defineHook("AFTER_IDENTITY_CREATE_HOOK");
+var BEFORE_SESSION_CREATE_HOOK = defineHook("BEFORE_SESSION_CREATE_HOOK");
+var AFTER_SESSION_CREATE_HOOK = defineHook("AFTER_SESSION_CREATE_HOOK");
 var registerAuthHooks = createRegisterHooks({
-	authorize: AUTHORIZE_HOOK,
-	getPrincipal: GET_PRINCIPAL_HOOK,
-	createPrincipal: CREATE_PRINCIPAL_HOOK,
-	createSession: CREATE_SESSION_HOOK,
-	deleteSession: DELETE_SESSION_HOOK
+	beforePrincipalGet: BEFORE_PRINCIPAL_GET_HOOK,
+	afterPrincipalGet: AFTER_PRINCIPAL_GET_HOOK,
+	beforePrincipalCreate: BEFORE_PRINCIPAL_CREATE_HOOK,
+	afterPrincipalCreate: AFTER_PRINCIPAL_CREATE_HOOK,
+	beforeAccountGet: BEFORE_ACCOUNT_GET_HOOK,
+	afterAccountGet: AFTER_ACCOUNT_GET_HOOK,
+	beforeIdentityGet: BEFORE_IDENTITY_GET_HOOK,
+	afterIdentityGet: AFTER_IDENTITY_GET_HOOK,
+	beforeSessionGet: BEFORE_SESSION_GET_HOOK,
+	afterSessionGet: AFTER_SESSION_GET_HOOK,
+	beforeAccountCreate: BEFORE_ACCOUNT_CREATE_HOOK,
+	afterAccountCreate: AFTER_ACCOUNT_CREATE_HOOK,
+	beforeIdentityCreate: BEFORE_IDENTITY_CREATE_HOOK,
+	afterIdentityCreate: AFTER_IDENTITY_CREATE_HOOK,
+	beforeSessionCreate: BEFORE_SESSION_CREATE_HOOK,
+	afterSessionCreate: AFTER_SESSION_CREATE_HOOK
 });
 var principalSchema = object({
 	sub: string(),
@@ -180,7 +379,7 @@ var passwordMethodSchema = object({
 	type: literal("PASSWORD"),
 	email: string(),
 	password: string(),
-	register: optional(boolean(), true)
+	register: optional(boolean(), false)
 });
 var passkeyMethodSchema = object({ type: literal("PASSKEY") });
 var providerMethodSchema = object({
@@ -234,4 +433,4 @@ var BASE64_VERIFY = { alphabet: "base64url" };
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
 //#endregion
-export { AUTHORIZE_HOOK, CREATE_PRINCIPAL_HOOK, CREATE_SESSION_HOOK, DELETE_SESSION_HOOK, GET_PRINCIPAL_HOOK, clearSession, defineAuthProvider, getCryptoKey, getSession, methodSchema, passkeyMethodSchema, passwordMethodSchema, principalSchema, providerMethodSchema, registerAuthHooks, requireSession, setSession, useAuth };
+export { AFTER_ACCOUNT_CREATE_HOOK, AFTER_ACCOUNT_GET_HOOK, AFTER_IDENTITY_CREATE_HOOK, AFTER_IDENTITY_GET_HOOK, AFTER_PRINCIPAL_CREATE_HOOK, AFTER_PRINCIPAL_GET_HOOK, AFTER_SESSION_CREATE_HOOK, AFTER_SESSION_GET_HOOK, BEFORE_ACCOUNT_CREATE_HOOK, BEFORE_ACCOUNT_GET_HOOK, BEFORE_IDENTITY_CREATE_HOOK, BEFORE_IDENTITY_GET_HOOK, BEFORE_PRINCIPAL_CREATE_HOOK, BEFORE_PRINCIPAL_GET_HOOK, BEFORE_SESSION_CREATE_HOOK, BEFORE_SESSION_GET_HOOK, authIdSchema, clearSession, createPrincipal, createSession, defineAuthProvider, getCryptoKey, getPrincipal, getSession, membershipParametersSchema, methodSchema, organizationNameSchema, organizationParametersSchema, passkeyMethodSchema, passwordMethodSchema, principalSchema, providerMethodSchema, registerAuthHooks, requireSession, setSession, useAccountStorage, useClientAuth, useOrganizationStorage, useServerAuth };

package/dist/module/index.d.ts

@@ -6,6 +6,7 @@ export interface SessionOptions {
     cookie: CookieOptions;
 }
 export interface AuthConfig {
+    organizations: boolean;
     session: SessionOptions;
     providers?: Partial<Record<Providers | (string & {}), Mergeable<Pick<AuthProviderOptions, "scope" | "pkce" | "authorize" | "token" | "userInfo">>>>;
 }