@rimelight/auth 0.0.1 → 0.0.3

package/dist/plugins/construction-guest/index.mjs

@@ -0,0 +1,51 @@
+import { getCookie, setCookie } from "hono/cookie";
+//#region src/plugins/construction-guest/index.ts
+const CONSTRUCTION_GUEST_COOKIE = "rimelight-construction-guest";
+const getConfig = (env) => {
+	return { passphrase: env?.CONSTRUCTION_PASSPHRASE ?? process.env.CONSTRUCTION_PASSPHRASE };
+};
+const encode = (value) => btoa(String.fromCharCode(...value)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+const decode = (value) => {
+	const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+	return Uint8Array.from(atob(padded), (char) => char.charCodeAt(0));
+};
+const sign = async (payload, secret) => {
+	const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign", "verify"]);
+	return {
+		key,
+		signature: await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload))
+	};
+};
+const isConstructionGuest = async (c) => {
+	const token = getCookie(c, CONSTRUCTION_GUEST_COOKIE);
+	const passphrase = getConfig(c.env).passphrase;
+	if (!token || !passphrase) return false;
+	try {
+		const [encodedPayload, encodedSignature] = token.split(".");
+		if (!encodedPayload || !encodedSignature) return false;
+		const payload = new TextDecoder().decode(decode(encodedPayload));
+		const { key } = await sign(payload, passphrase);
+		return await crypto.subtle.verify("HMAC", key, decode(encodedSignature), new TextEncoder().encode(payload)) && JSON.parse(payload).expiresAt > Date.now();
+	} catch {
+		return false;
+	}
+};
+const signInConstructionGuest = async (c, passphrase, rememberMe = true) => {
+	const config = getConfig(c.env);
+	if (!config.passphrase || !passphrase || passphrase !== config.passphrase) return false;
+	const payload = JSON.stringify({ expiresAt: Date.now() + 6048e5 });
+	const { signature } = await sign(payload, config.passphrase);
+	setCookie(c, CONSTRUCTION_GUEST_COOKIE, encode(new TextEncoder().encode(payload)) + "." + encode(new Uint8Array(signature)), {
+		httpOnly: true,
+		secure: true,
+		sameSite: "Lax",
+		path: "/",
+		...rememberMe ? { maxAge: 604800 } : {}
+	});
+	return true;
+};
+//#endregion
+export { CONSTRUCTION_GUEST_COOKIE, isConstructionGuest, signInConstructionGuest };

package/dist/plugins/reserved-usernames/index.d.mts

@@ -0,0 +1,12 @@
+//#region src/plugins/reserved-usernames/index.d.ts
+declare const normalizeUsername: (input: string) => string;
+declare const STANDARD_RESTRICTED_GROUPS: {
+  STAFF_ROLES: string[];
+  LEGAL_FINANCIAL: string[];
+  TECHNICAL: string[];
+  LEETSPEAK: string[];
+};
+declare const createRestrictedUsernameSet: (customBlacklist?: string[]) => Set<string>;
+declare const RESTRICTED_SET: Set<string>;
+//#endregion
+export { RESTRICTED_SET, STANDARD_RESTRICTED_GROUPS, createRestrictedUsernameSet, normalizeUsername };

package/dist/plugins/reserved-usernames/index.mjs

@@ -0,0 +1,192 @@
+//#region src/plugins/reserved-usernames/index.ts
+const HOMOGLYPH_MAP = {
+	"0": "o",
+	"1": "i",
+	"3": "e",
+	"4": "a",
+	"5": "s",
+	"7": "t",
+	"8": "b",
+	"9": "g",
+	"@": "a",
+	"!": "i",
+	"$": "s",
+	"|": "i"
+};
+const normalizeUsername = (input) => {
+	return input.toLowerCase().split("").map((char) => HOMOGLYPH_MAP[char] || char).join("").replace(/[^a-z0-9]/g, "");
+};
+const STANDARD_RESTRICTED_GROUPS = {
+	STAFF_ROLES: [
+		"admin",
+		"administrator",
+		"moderator",
+		"mod",
+		"staff",
+		"support",
+		"help",
+		"official",
+		"verified",
+		"system",
+		"root",
+		"bot",
+		"security",
+		"community",
+		"manager",
+		"dev",
+		"developer",
+		"designer",
+		"gamemaster",
+		"gm",
+		"assistant",
+		"coordinator",
+		"representative",
+		"agent",
+		"supervisor",
+		"executive",
+		"ambassador",
+		"expert",
+		"specialist",
+		"advocate",
+		"internal",
+		"employee",
+		"associate",
+		"webmaster",
+		"sysop",
+		"operator",
+		"host",
+		"referee",
+		"council",
+		"ceo",
+		"founder",
+		"owner"
+	],
+	LEGAL_FINANCIAL: [
+		"checkout",
+		"subscribe",
+		"subscription",
+		"premium",
+		"vip",
+		"store",
+		"shop",
+		"marketplace",
+		"wallet",
+		"refund",
+		"invoice",
+		"payout",
+		"rewards",
+		"prize",
+		"giveaway",
+		"claims",
+		"verification",
+		"billing",
+		"payment",
+		"sales",
+		"marketing",
+		"legal",
+		"compliance",
+		"privacy",
+		"tos",
+		"terms",
+		"copyright",
+		"trademark",
+		"dmca",
+		"abuse",
+		"report"
+	],
+	TECHNICAL: [
+		"null",
+		"undefined",
+		"nan",
+		"none",
+		"everyone",
+		"all",
+		"guest",
+		"user",
+		"test",
+		"tester",
+		"account",
+		"api",
+		"webhook",
+		"index",
+		"config",
+		"settings",
+		"profile",
+		"auth",
+		"login",
+		"signup",
+		"signin",
+		"logout",
+		"signout",
+		"localhost",
+		"ftp",
+		"smtp",
+		"pop3",
+		"imap",
+		"dns",
+		"proxy",
+		"cdn",
+		"static",
+		"assets",
+		"media",
+		"upload",
+		"download",
+		"docs",
+		"manual",
+		"guide",
+		"tutorial",
+		"error",
+		"404",
+		"500",
+		"maintenance",
+		"update",
+		"patch",
+		"changelog",
+		"status",
+		"db",
+		"database",
+		"sql",
+		"query",
+		"health",
+		"ping",
+		"metrics",
+		"logs",
+		"no-reply",
+		"noreply",
+		"donotreply",
+		"security-alert",
+		"mail",
+		"email",
+		"postmaster"
+	],
+	LEETSPEAK: [
+		"4dmin",
+		"@dmin",
+		"st4ff",
+		"m0d",
+		"m0derator",
+		"4dm1n",
+		"4dmin1strator",
+		"m0d3rator",
+		"st4f",
+		"5upport",
+		"0fficial",
+		"v3rified",
+		"5ystem",
+		"r00t",
+		"b0t",
+		"s3curity",
+		"d3v",
+		"d3veloper",
+		"@dministrator",
+		"adm1n",
+		"adm1nistrator"
+	]
+};
+const createRestrictedUsernameSet = (customBlacklist = []) => {
+	const base = Object.values(STANDARD_RESTRICTED_GROUPS).flat().concat(customBlacklist);
+	return new Set(base.map((name) => normalizeUsername(name)));
+};
+const RESTRICTED_SET = createRestrictedUsernameSet();
+//#endregion
+export { RESTRICTED_SET, STANDARD_RESTRICTED_GROUPS, createRestrictedUsernameSet, normalizeUsername };

package/dist/types.d.mts

@@ -0,0 +1,58 @@
+//#region src/types.d.ts
+type UserType = "user" | "employee" | "guest" | (string & {});
+interface UserSessionContext {
+  /**
+   * Unique user identifier (e.g. Auth0 sub claim, user UUID, or email)
+   */
+  userId: string;
+  /**
+   * Roles assigned to the authenticated user (e.g. ["admin"], ["editor"], ["user"])
+   */
+  roles: string[];
+  /**
+   * Specific permissions assigned (e.g. ["page:create", "draft:edit", "*"])
+   */
+  permissions: string[];
+  /**
+   * User's primary email address
+   */
+  email?: string | undefined;
+  /**
+   * User's display or full name
+   */
+  name?: string | undefined;
+  /**
+   * User's avatar URL or profile picture
+   */
+  avatar?: string | undefined;
+  /**
+   * Discriminator or classification: "user" (customer/public) vs "employee" (staff/enterprise) vs
+   * "guest"
+   */
+  userType?: UserType | undefined;
+  /**
+   * Custom identity metadata or raw token claims
+   */
+  metadata?: Record<string, any> | undefined;
+}
+interface AuthAdapter {
+  /**
+   * Unique name of the auth adapter
+   */
+  name: string;
+  /**
+   * Optional configuration options used to initialize the adapter
+   */
+  options?: any;
+  /**
+   * Resolves the authenticated session from an incoming Request. Returns `null` if unauthenticated
+   * or invalid.
+   */
+  getSession(request: Request): Promise<UserSessionContext | null>;
+  /**
+   * Optional hook for handling unauthorized page loads / redirects
+   */
+  handleUnauthorized?: ((request: Request) => Response | Promise<Response>) | undefined;
+}
+//#endregion
+export { AuthAdapter, UserSessionContext, UserType };

package/dist/types.mjs

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@rimelight/auth",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "private": false,
-  "description": "Rimelight Entertainment's Authentication Package",
+  "description": "Rimelight Entertainment's Universal Authentication & Identity Package",
   "homepage": "https://rimelight.com/docs",
   "bugs": {
     "url": "https://github.com/Rimelight-Entertainment/rimelight/issues"
@@ -16,40 +16,62 @@
     "url": "git+https://github.com/Rimelight-Entertainment/rimelight.git"
   },
   "files": [
-    "src"
+    "dist"
   ],
   "type": "module",
   "exports": {
-    ".": "./src/index.ts",
-    "./server": "./src/server/index.ts",
-    "./client": "./src/client/index.ts",
-    "./permissions": "./src/permissions/index.ts",
-    "./schema/drizzle": "./src/schema/drizzle/index.ts",
-    "./plugins/reserved-usernames": "./src/plugins/reserved-usernames/index.ts",
-    "./plugins/discriminator-tag": "./src/plugins/discriminator-tag/index.ts",
-    "./plugins/synthetic-user": "./src/plugins/synthetic-user/index.ts",
-    "./plugins/construction-guest": "./src/plugins/construction-guest/index.ts"
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
+    },
+    "./types": {
+      "types": "./dist/types.d.mts",
+      "import": "./dist/types.mjs"
+    },
+    "./cf-access": {
+      "types": "./dist/adapters/cf-access.d.mts",
+      "import": "./dist/adapters/cf-access.mjs"
+    },
+    "./auth0": {
+      "types": "./dist/adapters/auth0.d.mts",
+      "import": "./dist/adapters/auth0.mjs"
+    },
+    "./mock": {
+      "types": "./dist/adapters/mock.d.mts",
+      "import": "./dist/adapters/mock.mjs"
+    },
+    "./permissions": {
+      "types": "./dist/permissions/index.d.mts",
+      "import": "./dist/permissions/index.mjs"
+    },
+    "./plugins/reserved-usernames": {
+      "types": "./dist/plugins/reserved-usernames/index.d.mts",
+      "import": "./dist/plugins/reserved-usernames/index.mjs"
+    },
+    "./plugins/construction-guest": {
+      "types": "./dist/plugins/construction-guest/index.d.mts",
+      "import": "./dist/plugins/construction-guest/index.mjs"
+    }
   },
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "check": "pnpm audit --audit-level=moderate && vp check --fix"
-  },
   "dependencies": {
-    "@better-auth/drizzle-adapter": "1.6.30",
-    "better-auth": "1.6.30",
-    "drizzle-orm": "0.45.2"
+    "drizzle-orm": "0.45.2",
+    "jose": "6.2.11"
   },
   "devDependencies": {
-    "@rimelight/config": "workspace:*"
+    "@rimelight/config": "0.0.4",
+    "@types/node": "26.4.1"
   },
   "peerDependencies": {
-    "better-auth": ">=1.0.0",
     "drizzle-orm": ">=0.30.0",
     "hono": ">=4.12.34"
   },
   "peerDependenciesMeta": {
+    "drizzle-orm": {
+      "optional": true
+    },
     "hono": {
       "optional": true
     }
@@ -57,5 +79,8 @@
   "engines": {
     "node": ">=26.7.0"
   },
-  "packageManager": "pnpm@11.22.0"
-}
+  "scripts": {
+    "build": "vp pack",
+    "check": "vp check --fix"
+  }
+}

package/src/client/index.ts

@@ -1,3 +0,0 @@
-import { createAuthClient } from "better-auth/client"
-
-export const createRimelightAuthClient = createAuthClient

package/src/index.ts

@@ -1,6 +0,0 @@
-export * from "./server/index"
-export * from "./permissions/index"
-export * from "./plugins/reserved-usernames/index"
-export * from "./plugins/synthetic-user/index"
-export * from "./plugins/construction-guest/index"
-export * from "./plugins/discriminator-tag/index"

package/src/permissions/index.ts

@@ -1,27 +0,0 @@
-import { createAccessControl } from "better-auth/plugins/access"
-import {
-  defaultStatements,
-  ownerAc,
-  adminAc,
-  memberAc
-} from "better-auth/plugins/organization/access"
-
-export { createAccessControl, defaultStatements, ownerAc, adminAc, memberAc }
-
-export interface CreatePermissionsOptions<TStatements extends Record<string, readonly string[]>> {
-  statements: TStatements
-}
-
-export function createPermissions<const TStatements extends Record<string, readonly string[]>>(
-  statements: TStatements
-) {
-  const mergedStatements = {
-    ...defaultStatements,
-    ...statements
-  }
-  const ac = createAccessControl(mergedStatements)
-  return {
-    ac,
-    statements: mergedStatements
-  }
-}

package/src/plugins/construction-guest/index.ts

@@ -1,107 +0,0 @@
-import { getCookie, setCookie } from "hono/cookie"
-
-export const CONSTRUCTION_GUEST_COOKIE = "rimelight-construction-guest"
-
-export type GuestEnv = {
-  CONSTRUCTION_GUEST_EMAIL?: string
-  CONSTRUCTION_GUEST_PASSWORD?: string
-  CONSTRUCTION_GUEST_SECRET?: string
-  BETTER_AUTH_SECRET?: string
-}
-
-const getConfig = (env?: GuestEnv) => ({
-  email: env?.CONSTRUCTION_GUEST_EMAIL ?? process.env.CONSTRUCTION_GUEST_EMAIL,
-  password: env?.CONSTRUCTION_GUEST_PASSWORD ?? process.env.CONSTRUCTION_GUEST_PASSWORD,
-  secret:
-    env?.CONSTRUCTION_GUEST_SECRET ??
-    process.env.CONSTRUCTION_GUEST_SECRET ??
-    env?.BETTER_AUTH_SECRET ??
-    process.env.BETTER_AUTH_SECRET
-})
-
-const encode = (value: Uint8Array) =>
-  btoa(String.fromCharCode(...value))
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_")
-    .replace(/=+$/, "")
-
-const decode = (value: string) => {
-  const padded = value
-    .replace(/-/g, "+")
-    .replace(/_/g, "/")
-    .padEnd(Math.ceil(value.length / 4) * 4, "=")
-  return Uint8Array.from(atob(padded), (char) => char.charCodeAt(0))
-}
-
-const sign = async (payload: string, secret: string) => {
-  const key = await crypto.subtle.importKey(
-    "raw",
-    new TextEncoder().encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign", "verify"]
-  )
-  return {
-    key,
-    signature: await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload))
-  }
-}
-
-export const isConstructionGuest = async (c: any) => {
-  const token = getCookie(c, CONSTRUCTION_GUEST_COOKIE)
-  const secret = getConfig(c.env).secret
-  if (!token || !secret) return false
-
-  try {
-    const [encodedPayload, encodedSignature] = token.split(".")
-    if (!encodedPayload || !encodedSignature) return false
-    const payload = new TextDecoder().decode(decode(encodedPayload))
-    const { key } = await sign(payload, secret)
-    const valid = await crypto.subtle.verify(
-      "HMAC",
-      key,
-      decode(encodedSignature),
-      new TextEncoder().encode(payload)
-    )
-    return valid && JSON.parse(payload).expiresAt > Date.now()
-  } catch {
-    return false
-  }
-}
-
-export const signInConstructionGuest = async (
-  c: any,
-  email: string,
-  password: string,
-  rememberMe = true
-) => {
-  const config = getConfig(c.env)
-  if (
-    !config.email ||
-    !config.password ||
-    !config.secret ||
-    email !== config.email ||
-    password !== config.password
-  ) {
-    return false
-  }
-
-  const payload = JSON.stringify({
-    email: config.email,
-    expiresAt: Date.now() + 1000 * 60 * 60 * 24 * 7
-  })
-  const { signature } = await sign(payload, config.secret)
-  setCookie(
-    c,
-    CONSTRUCTION_GUEST_COOKIE,
-    encode(new TextEncoder().encode(payload)) + "." + encode(new Uint8Array(signature)),
-    {
-      httpOnly: true,
-      secure: true,
-      sameSite: "Lax",
-      path: "/",
-      ...(rememberMe ? { maxAge: 60 * 60 * 24 * 7 } : {})
-    }
-  )
-  return true
-}

package/src/plugins/discriminator-tag/index.ts

@@ -1,55 +0,0 @@
-import { APIError } from "better-auth/api"
-import { normalizeUsername, RESTRICTED_SET } from "../reserved-usernames"
-import { eq, and, count } from "drizzle-orm"
-
-export interface TagHookOptions {
-  userTable?: any
-  restrictedSet?: Set<string>
-}
-
-export function createTagAndUsernameHook(db: any, userTable: any, options?: TagHookOptions) {
-  const restricted = options?.restrictedSet ?? RESTRICTED_SET
-
-  return async (userData: any, _ctx: any) => {
-    // 1. Normalize the username and check against the restricted set
-    const normalizedInput = normalizeUsername(userData.name)
-    if (restricted.has(normalizedInput)) {
-      throw new APIError("BAD_REQUEST", {
-        message: "This username is reserved for official use."
-      })
-    }
-
-    // 2. Generate a unique 4-digit discriminator tag
-    let uniqueTag = "0000"
-    const tryFindTag = async (attemptsLeft: number): Promise<string> => {
-      if (attemptsLeft <= 0) return "0000"
-      const newTag = Math.floor(Math.random() * 10000)
-        .toString()
-        .padStart(4, "0")
-
-      const result = await db
-        .select({ count: count() })
-        .from(userTable)
-        .where(and(eq(userTable.name, userData.name), eq(userTable.tag, newTag)))
-
-      const tagCount = result[0]?.count ?? 0
-      if (tagCount === 0) return newTag
-      return tryFindTag(attemptsLeft - 1)
-    }
-
-    uniqueTag = await tryFindTag(50)
-
-    if (uniqueTag === "0000") {
-      throw new APIError("INTERNAL_SERVER_ERROR", {
-        message: "Failed to generate a unique tag for this username. Please try again."
-      })
-    }
-
-    return {
-      data: {
-        ...userData,
-        tag: uniqueTag
-      }
-    }
-  }
-}