@rudderjs/auth 0.2.0

package/dist/gate.js

@@ -0,0 +1,181 @@
+import { currentAuth } from './auth-manager.js';
+// ─── Policy Base Class ────────────────────────────────────
+export class Policy {
+}
+// ─── Gate ─────────────────────────────────────────────────
+export class Gate {
+    static _abilities = new Map();
+    static _policies = new Map();
+    static _beforeCallbacks = [];
+    // ── Define abilities ──────────────────────────────────
+    static define(ability, callback) {
+        this._abilities.set(ability, callback);
+    }
+    static before(callback) {
+        this._beforeCallbacks.push(callback);
+    }
+    static policy(model, policy) {
+        this._policies.set(model, policy);
+    }
+    // ── Check abilities ───────────────────────────────────
+    static async allows(ability, ...args) {
+        const user = await this.resolveUser();
+        if (!user)
+            return false;
+        return this._check(user, ability, ...args);
+    }
+    static async denies(ability, ...args) {
+        return !(await this.allows(ability, ...args));
+    }
+    /**
+     * Check ability — throw 403 if denied.
+     */
+    static async authorize(ability, ...args) {
+        if (await this.denies(ability, ...args)) {
+            throw new AuthorizationError(`This action is unauthorized. [${ability}]`);
+        }
+    }
+    // ── Scoped to a specific user ─────────────────────────
+    static forUser(user) {
+        return new GateForUser(user, this._abilities, this._policies, this._beforeCallbacks);
+    }
+    // ── Internal ──────────────────────────────────────────
+    static async resolveUser() {
+        try {
+            const manager = currentAuth();
+            return await manager.guard().user();
+        }
+        catch {
+            return null;
+        }
+    }
+    static async _check(user, ability, ...args) {
+        // Run before callbacks
+        for (const cb of this._beforeCallbacks) {
+            const result = await cb(user, ability);
+            if (result === true)
+                return true;
+            if (result === false)
+                return false;
+        }
+        // Check if the first arg is a model instance with a registered policy
+        const model = args[0];
+        if (model && typeof model === 'object') {
+            const policyClass = this.findPolicy(model);
+            if (policyClass) {
+                return this.callPolicy(policyClass, user, ability, ...args);
+            }
+        }
+        // Fall back to defined abilities
+        const callback = this._abilities.get(ability);
+        if (!callback)
+            return false;
+        return callback(user, ...args);
+    }
+    static findPolicy(model) {
+        if (!model || typeof model !== 'object')
+            return undefined;
+        const constructor = model.constructor;
+        if (!constructor)
+            return undefined;
+        // Direct match
+        const direct = this._policies.get(constructor);
+        if (direct)
+            return direct;
+        // Check prototype chain
+        for (const [modelClass, policyClass] of this._policies) {
+            if (model instanceof modelClass)
+                return policyClass;
+        }
+        return undefined;
+    }
+    static async callPolicy(PolicyCtor, user, ability, ...args) {
+        const policy = new PolicyCtor();
+        // Policy.before
+        if (policy.before) {
+            const result = await policy.before(user);
+            if (result === true)
+                return true;
+            if (result === false)
+                return false;
+        }
+        // Call the specific method
+        const method = policy[ability];
+        if (typeof method !== 'function')
+            return false;
+        return method.call(policy, user, ...args);
+    }
+    /** @internal — reset all definitions. Used for testing. */
+    static reset() {
+        this._abilities.clear();
+        this._policies.clear();
+        this._beforeCallbacks = [];
+    }
+}
+// ─── GateForUser ──────────────────────────────────────────
+class GateForUser {
+    user;
+    abilities;
+    policies;
+    beforeCallbacks;
+    constructor(user, abilities, policies, beforeCallbacks) {
+        this.user = user;
+        this.abilities = abilities;
+        this.policies = policies;
+        this.beforeCallbacks = beforeCallbacks;
+    }
+    async allows(ability, ...args) {
+        // Before callbacks
+        for (const cb of this.beforeCallbacks) {
+            const result = await cb(this.user, ability);
+            if (result === true)
+                return true;
+            if (result === false)
+                return false;
+        }
+        // Policy check
+        const model = args[0];
+        if (model && typeof model === 'object') {
+            const constructor = model.constructor;
+            if (constructor) {
+                const PolicyCtor = this.policies.get(constructor);
+                if (PolicyCtor) {
+                    const policy = new PolicyCtor();
+                    if (policy.before) {
+                        const result = await policy.before(this.user);
+                        if (result === true)
+                            return true;
+                        if (result === false)
+                            return false;
+                    }
+                    const method = policy[ability];
+                    if (typeof method !== 'function')
+                        return false;
+                    return method.call(policy, this.user, ...args);
+                }
+            }
+        }
+        // Ability check
+        const callback = this.abilities.get(ability);
+        if (!callback)
+            return false;
+        return callback(this.user, ...args);
+    }
+    async denies(ability, ...args) {
+        return !(await this.allows(ability, ...args));
+    }
+    async authorize(ability, ...args) {
+        if (await this.denies(ability, ...args)) {
+            throw new AuthorizationError(`This action is unauthorized. [${ability}]`);
+        }
+    }
+}
+// ─── Authorization Error ──────────────────────────────────
+export class AuthorizationError extends Error {
+    status = 403;
+    constructor(message = 'This action is unauthorized.') {
+        super(message);
+        this.name = 'AuthorizationError';
+    }
+}
+//# sourceMappingURL=gate.js.map

package/dist/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAO/C,6DAA6D;AAE7D,MAAM,OAAgB,MAAM;CAM3B;AAMD,6DAA6D;AAE7D,MAAM,OAAO,IAAI;IACP,MAAM,CAAC,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAA;IACtD,MAAM,CAAC,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAA;IACrD,MAAM,CAAC,gBAAgB,GAAqB,EAAE,CAAA;IAEtD,yDAAyD;IAEzD,MAAM,CAAC,MAAM,CAAC,OAAe,EAAE,QAAyB;QACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,QAAwB;QACpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtC,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,KAAiB,EAAE,MAAmB;QAClD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACnC,CAAC;IAED,yDAAyD;IAEzD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAG,IAAe;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAC5C,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAG,IAAe;QACrD,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,GAAG,IAAe;QACxD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,kBAAkB,CAAC,iCAAiC,OAAO,GAAG,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAED,yDAAyD;IAEzD,MAAM,CAAC,OAAO,CAAC,IAAqB;QAClC,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACtF,CAAC;IAED,yDAAyD;IAEjD,MAAM,CAAC,KAAK,CAAC,WAAW;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,EAAE,CAAA;YAC7B,OAAO,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAA;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAqB,EAAE,OAAe,EAAE,GAAG,IAAe;QACpF,uBAAuB;QACvB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACtC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YAChC,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAA;QACpC,CAAC;QAED,sEAAsE;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;YAC1C,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;YAC7D,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC3B,OAAO,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAA;IAChC,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,KAAc;QACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACzD,MAAM,WAAW,GAAI,KAAiD,CAAC,WAAW,CAAA;QAClF,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAA;QAElC,eAAe;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QAEzB,wBAAwB;QACxB,KAAK,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACvD,IAAI,KAAK,YAAY,UAAU;gBAAE,OAAO,WAAW,CAAA;QACrD,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,UAAU,CAC7B,UAAuB,EACvB,IAAqB,EACrB,OAAe,EACf,GAAG,IAAe;QAElB,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAA;QAE/B,gBAAgB;QAChB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACxC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YAChC,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAA;QACpC,CAAC;QAED,2BAA2B;QAC3B,MAAM,MAAM,GAAI,MAAkC,CAAC,OAAO,CAAC,CAAA;QAC3D,IAAI,OAAO,MAAM,KAAK,UAAU;YAAE,OAAO,KAAK,CAAA;QAC9C,OAAQ,MAA0D,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAA;IAChG,CAAC;IAED,2DAA2D;IAC3D,MAAM,CAAC,KAAK;QACV,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QACvB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAA;QACtB,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAA;IAC5B,CAAC;;AAGH,6DAA6D;AAE7D,MAAM,WAAW;IAEI;IACA;IACA;IACA;IAJnB,YACmB,IAAqB,EACrB,SAAuC,EACvC,QAAsC,EACtC,eAAiC;QAHjC,SAAI,GAAJ,IAAI,CAAiB;QACrB,cAAS,GAAT,SAAS,CAA8B;QACvC,aAAQ,GAAR,QAAQ,CAA8B;QACtC,oBAAe,GAAf,eAAe,CAAkB;IACjD,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAG,IAAe;QAC9C,mBAAmB;QACnB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YAC3C,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YAChC,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAA;QACpC,CAAC;QAED,eAAe;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,WAAW,GAAI,KAAiD,CAAC,WAAW,CAAA;YAClF,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBACjD,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAA;oBAC/B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;wBAClB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;wBAC7C,IAAI,MAAM,KAAK,IAAI;4BAAE,OAAO,IAAI,CAAA;wBAChC,IAAI,MAAM,KAAK,KAAK;4BAAE,OAAO,KAAK,CAAA;oBACpC,CAAC;oBACD,MAAM,MAAM,GAAI,MAAkC,CAAC,OAAO,CAAC,CAAA;oBAC3D,IAAI,OAAO,MAAM,KAAK,UAAU;wBAAE,OAAO,KAAK,CAAA;oBAC9C,OAAQ,MAA0D,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAA;gBACrG,CAAC;YACH,CAAC;QACH,CAAC;QAED,gBAAgB;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC3B,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAG,IAAe;QAC9C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,GAAG,IAAe;QACjD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,kBAAkB,CAAC,iCAAiC,OAAO,GAAG,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;CACF;AAED,6DAA6D;AAE7D,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,GAAG,GAAG,CAAA;IAErB,YAAY,OAAO,GAAG,8BAA8B;QAClD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,41 @@
+import { ServiceProvider, type Application } from '@rudderjs/core';
+import type { MiddlewareHandler } from '@rudderjs/contracts';
+import { type AuthConfig } from './auth-manager.js';
+import type { AuthUser } from './contracts.js';
+declare module '@rudderjs/contracts' {
+    interface AppRequest {
+        user?: AuthUser;
+    }
+}
+export { Auth } from './auth-manager.js';
+export { AuthManager, runWithAuth } from './auth-manager.js';
+export { SessionGuard } from './session-guard.js';
+export { EloquentUserProvider, toAuthenticatable } from './providers.js';
+export { Gate, Policy, AuthorizationError } from './gate.js';
+export { PasswordBroker, MemoryTokenRepository } from './password-reset.js';
+export { EnsureEmailIsVerified, verificationUrl, handleEmailVerification, mustVerifyEmail } from './verification.js';
+export type { Authenticatable, AuthUser, Guard, UserProvider } from './contracts.js';
+export type { MustVerifyEmail } from './verification.js';
+export type { TokenRepository, PasswordResetStatus, PasswordResetConfig } from './password-reset.js';
+export type { AuthConfig, AuthGuardConfig, AuthProviderConfig } from './auth-manager.js';
+export type { SessionStore } from './session-guard.js';
+/**
+ * Middleware that sets up the Auth context for the current request.
+ * Attaches `req.user` if authenticated (does not block unauthenticated requests).
+ */
+export declare function AuthMiddleware(guardName?: string): MiddlewareHandler;
+/**
+ * Middleware that requires authentication — returns 401 if not authenticated.
+ */
+export declare function RequireAuth(guardName?: string): MiddlewareHandler;
+/**
+ * Returns an AuthServiceProvider configured with guards + providers.
+ *
+ * Requires: @rudderjs/session (session middleware), @rudderjs/hash
+ *
+ * Usage in bootstrap/providers.ts:
+ *   import { auth } from '@rudderjs/auth'
+ *   export default [session(configs.session), hash(configs.hash), auth(configs.auth), ...]
+ */
+export declare function auth(config: AuthConfig): new (app: Application) => ServiceProvider;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,KAAK,WAAW,EAAO,MAAM,gBAAgB,CAAA;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAkC,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAK9C,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,UAAU;QAClB,IAAI,CAAC,EAAE,QAAQ,CAAA;KAChB;CACF;AAID,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEpH,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACpF,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACpG,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACxF,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAsBtD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAiBpE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAoBjE;AAID;;;;;;;;GAQG;AACH,wBAAgB,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,KAAK,GAAG,EAAE,WAAW,KAAK,eAAe,CA2ClF"}

package/dist/index.js

@@ -0,0 +1,123 @@
+import { ServiceProvider, app } from '@rudderjs/core';
+import { AuthManager, Auth, runWithAuth } from './auth-manager.js';
+// ─── Re-exports ───────────────────────────────────────────
+export { Auth } from './auth-manager.js';
+export { AuthManager, runWithAuth } from './auth-manager.js';
+export { SessionGuard } from './session-guard.js';
+export { EloquentUserProvider, toAuthenticatable } from './providers.js';
+export { Gate, Policy, AuthorizationError } from './gate.js';
+export { PasswordBroker, MemoryTokenRepository } from './password-reset.js';
+export { EnsureEmailIsVerified, verificationUrl, handleEmailVerification, mustVerifyEmail } from './verification.js';
+// ─── Helpers ──────────────────────────────────────────────
+function userToPlain(user) {
+    const u = user;
+    const plain = {};
+    for (const [k, v] of Object.entries(u)) {
+        if (typeof v === 'function')
+            continue;
+        if (k === 'password')
+            continue;
+        plain[k] = v;
+    }
+    return {
+        id: String(plain['id'] ?? ''),
+        name: String(plain['name'] ?? ''),
+        email: String(plain['email'] ?? ''),
+        ...plain,
+    };
+}
+// ─── Auth Middleware ──────────────────────────────────────
+/**
+ * Middleware that sets up the Auth context for the current request.
+ * Attaches `req.user` if authenticated (does not block unauthenticated requests).
+ */
+export function AuthMiddleware(guardName) {
+    return async function AuthMiddleware(req, res, next) {
+        const manager = app().make('auth.manager');
+        await runWithAuth(manager, async () => {
+            const guard = Auth.guard(guardName ?? manager.config.defaults.guard);
+            const user = await guard.user();
+            if (user) {
+                const plain = userToPlain(user);
+                req.raw['__rjs_user'] = plain;
+                try {
+                    req['user'] = plain;
+                }
+                catch { /* read-only */ }
+            }
+            await next();
+        });
+    };
+}
+/**
+ * Middleware that requires authentication — returns 401 if not authenticated.
+ */
+export function RequireAuth(guardName) {
+    return async function RequireAuth(req, res, next) {
+        const manager = app().make('auth.manager');
+        await runWithAuth(manager, async () => {
+            const guard = Auth.guard(guardName ?? manager.config.defaults.guard);
+            const user = await guard.user();
+            if (!user) {
+                res.status(401).json({ message: 'Unauthorized.' });
+                return;
+            }
+            const plain = userToPlain(user);
+            req.raw['__rjs_user'] = plain;
+            try {
+                req['user'] = plain;
+            }
+            catch { /* read-only */ }
+            await next();
+        });
+    };
+}
+// ─── Service Provider Factory ─────────────────────────────
+/**
+ * Returns an AuthServiceProvider configured with guards + providers.
+ *
+ * Requires: @rudderjs/session (session middleware), @rudderjs/hash
+ *
+ * Usage in bootstrap/providers.ts:
+ *   import { auth } from '@rudderjs/auth'
+ *   export default [session(configs.session), hash(configs.hash), auth(configs.auth), ...]
+ */
+export function auth(config) {
+    class AuthServiceProvider extends ServiceProvider {
+        register() {
+            // Auth pages (framework-specific)
+            this.publishes({ from: new URL(/* @vite-ignore */ '../pages/react', import.meta.url).pathname, to: 'pages/(auth)', tag: 'auth-pages' });
+            this.publishes({ from: new URL(/* @vite-ignore */ '../pages/react', import.meta.url).pathname, to: 'pages/(auth)', tag: 'auth-pages-react' });
+            this.publishes({ from: new URL(/* @vite-ignore */ '../pages/vue', import.meta.url).pathname, to: 'pages/(auth)', tag: 'auth-pages-vue' });
+            this.publishes({ from: new URL(/* @vite-ignore */ '../pages/solid', import.meta.url).pathname, to: 'pages/(auth)', tag: 'auth-pages-solid' });
+            // Auth schema (ORM + driver-specific)
+            const schemaDir = new URL(/* @vite-ignore */ '../schema', import.meta.url).pathname;
+            this.publishes([
+                { from: `${schemaDir}/auth.prisma`, to: 'prisma/schema', tag: 'auth-schema', orm: 'prisma' },
+                { from: `${schemaDir}/auth.drizzle.sqlite.ts`, to: 'database/schema', tag: 'auth-schema', orm: 'drizzle', driver: 'sqlite' },
+                { from: `${schemaDir}/auth.drizzle.pg.ts`, to: 'database/schema', tag: 'auth-schema', orm: 'drizzle', driver: 'postgresql' },
+                { from: `${schemaDir}/auth.drizzle.mysql.ts`, to: 'database/schema', tag: 'auth-schema', orm: 'drizzle', driver: 'mysql' },
+            ]);
+        }
+        async boot() {
+            // Resolve Hash.check from DI
+            let hashCheck;
+            try {
+                const hashDriver = this.app.make('hash');
+                hashCheck = (plain, hashed) => hashDriver.check(plain, hashed);
+            }
+            catch {
+                throw new Error('[RudderJS Auth] No hash driver found. Register hash() provider before auth().');
+            }
+            // Resolve session facade — bound by @rudderjs/session as 'session.facade'
+            const getSession = () => {
+                return this.app.make('session.facade');
+            };
+            const manager = new AuthManager(config, hashCheck, getSession);
+            this.app.instance('auth.manager', manager);
+            this.app.instance('auth', Auth);
+        }
+    }
+    return AuthServiceProvider;
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAoB,GAAG,EAAE,MAAM,gBAAgB,CAAA;AAEvE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAmB,MAAM,mBAAmB,CAAA;AAYnF,6DAA6D;AAE7D,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAQpH,6DAA6D;AAE7D,SAAS,WAAW,CAAC,IAAa;IAChC,MAAM,CAAC,GAAG,IAA+B,CAAA;IACzC,MAAM,KAAK,GAA4B,EAAE,CAAA;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,KAAK,UAAU;YAAE,SAAQ;QACrC,IAAI,CAAC,KAAK,UAAU;YAAE,SAAQ;QAC9B,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;IACD,OAAO;QACL,EAAE,EAAK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,EAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACnC,GAAG,KAAK;KACT,CAAA;AACH,CAAC;AAED,6DAA6D;AAE7D;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,SAAkB;IAC/C,OAAO,KAAK,UAAU,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;QACjD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAc,cAAc,CAAC,CAAA;QAEvD,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,IAAK,OAA6C,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC3G,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YAE/B,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAC9B;gBAAC,GAAG,CAAC,GAA+B,CAAC,YAAY,CAAC,GAAG,KAAK,CAAA;gBAC3D,IAAI,CAAC;oBAAE,GAA0C,CAAC,MAAM,CAAC,GAAG,KAAK,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;YAC/F,CAAC;YAED,MAAM,IAAI,EAAE,CAAA;QACd,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,SAAkB;IAC5C,OAAO,KAAK,UAAU,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;QAC9C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAc,cAAc,CAAC,CAAA;QAEvD,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,IAAK,OAA6C,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC3G,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YAE/B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAA;gBAClD,OAAM;YACR,CAAC;YAED,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAC9B;YAAC,GAAG,CAAC,GAA+B,CAAC,YAAY,CAAC,GAAG,KAAK,CAAA;YAC3D,IAAI,CAAC;gBAAE,GAA0C,CAAC,MAAM,CAAC,GAAG,KAAK,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;YAE7F,MAAM,IAAI,EAAE,CAAA;QACd,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC;AAED,6DAA6D;AAE7D;;;;;;;;GAQG;AACH,MAAM,UAAU,IAAI,CAAC,MAAkB;IACrC,MAAM,mBAAoB,SAAQ,eAAe;QAC/C,QAAQ;YACN,kCAAkC;YAClC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAA;YACvI,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC7I,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,kBAAkB,CAAC,cAAc,EAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAA;YAC3I,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAE7I,sCAAsC;YACtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;YACnF,IAAI,CAAC,SAAS,CAAC;gBACb,EAAE,IAAI,EAAE,GAAG,SAAS,cAAc,EAAa,EAAE,EAAE,eAAe,EAAI,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,QAAiB,EAAE;gBAClH,EAAE,IAAI,EAAE,GAAG,SAAS,yBAAyB,EAAE,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,SAAkB,EAAE,MAAM,EAAE,QAAiB,EAAE;gBAC9I,EAAE,IAAI,EAAE,GAAG,SAAS,qBAAqB,EAAM,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,SAAkB,EAAE,MAAM,EAAE,YAAqB,EAAE;gBAClJ,EAAE,IAAI,EAAE,GAAG,SAAS,wBAAwB,EAAG,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,SAAkB,EAAE,MAAM,EAAE,OAAgB,EAAE;aAC9I,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,IAAI;YACR,6BAA6B;YAC7B,IAAI,SAA8D,CAAA;YAClE,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAoD,MAAM,CAAC,CAAA;gBAC3F,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAA;YACH,CAAC;YAED,0EAA0E;YAC1E,MAAM,UAAU,GAAG,GAAiB,EAAE;gBACpC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAe,gBAAgB,CAAC,CAAA;YACtD,CAAC,CAAA;YAED,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;YAC9D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;YAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACjC,CAAC;KACF;IAED,OAAO,mBAAmB,CAAA;AAC5B,CAAC"}

package/dist/password-reset.d.ts

@@ -0,0 +1,56 @@
+import type { Authenticatable, UserProvider } from './contracts.js';
+export interface TokenRepository {
+    create(email: string, token: string, expiresAt: Date): Promise<void>;
+    find(email: string): Promise<{
+        token: string;
+        createdAt: Date;
+    } | null>;
+    delete(email: string): Promise<void>;
+    deleteExpired(): Promise<void>;
+}
+export type PasswordResetStatus = 'RESET_LINK_SENT' | 'PASSWORD_RESET' | 'INVALID_USER' | 'INVALID_TOKEN' | 'TOKEN_EXPIRED' | 'THROTTLED';
+export interface PasswordResetConfig {
+    /** Minutes before a reset token expires (default: 60) */
+    expire?: number;
+    /** Seconds between reset requests for the same email (default: 60) */
+    throttle?: number;
+}
+export declare class PasswordBroker {
+    private readonly tokens;
+    private readonly users;
+    private readonly config;
+    private readonly expire;
+    private readonly throttle;
+    constructor(tokens: TokenRepository, users: UserProvider, config?: PasswordResetConfig);
+    /**
+     * Send a password reset link.
+     * @param credentials - must include `email`
+     * @param sendLink - callback to actually send the email/notification
+     */
+    sendResetLink(credentials: {
+        email: string;
+    }, sendLink: (user: Authenticatable, token: string) => Promise<void>): Promise<PasswordResetStatus>;
+    /**
+     * Reset the user's password.
+     * @param credentials - must include `email`, `token`, `password`
+     * @param callback - receives the user and new password to perform the actual update
+     */
+    reset(credentials: {
+        email: string;
+        token: string;
+        password: string;
+    }, callback: (user: Authenticatable, password: string) => Promise<void>): Promise<PasswordResetStatus>;
+    private hashToken;
+    private verifyToken;
+}
+export declare class MemoryTokenRepository implements TokenRepository {
+    private store;
+    create(email: string, token: string, expiresAt: Date): Promise<void>;
+    find(email: string): Promise<{
+        token: string;
+        createdAt: Date;
+    } | null>;
+    delete(email: string): Promise<void>;
+    deleteExpired(): Promise<void>;
+}
+//# sourceMappingURL=password-reset.d.ts.map

package/dist/password-reset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.d.ts","sourceRoot":"","sources":["../src/password-reset.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAInE,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IACvE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpC,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/B;AAID,MAAM,MAAM,mBAAmB,GAC3B,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,eAAe,GACf,eAAe,GACf,WAAW,CAAA;AAIf,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAID,qBAAa,cAAc;IAKvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;gBAGd,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,YAAY,EACnB,MAAM,GAAE,mBAAwB;IAMnD;;;;OAIG;IACG,aAAa,CACjB,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAC9B,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAChE,OAAO,CAAC,mBAAmB,CAAC;IA0B/B;;;;OAIG;IACG,KAAK,CACT,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAC/D,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACnE,OAAO,CAAC,mBAAmB,CAAC;IAwB/B,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;CAMpB;AAID,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,KAAK,CAAyE;IAEhF,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAKvE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;CAMrC"}

package/dist/password-reset.js

@@ -0,0 +1,101 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+// ─── Password Broker ──────────────────────────────────────
+export class PasswordBroker {
+    tokens;
+    users;
+    config;
+    expire;
+    throttle;
+    constructor(tokens, users, config = {}) {
+        this.tokens = tokens;
+        this.users = users;
+        this.config = config;
+        this.expire = config.expire ?? 60;
+        this.throttle = config.throttle ?? 60;
+    }
+    /**
+     * Send a password reset link.
+     * @param credentials - must include `email`
+     * @param sendLink - callback to actually send the email/notification
+     */
+    async sendResetLink(credentials, sendLink) {
+        const user = await this.users.retrieveByCredentials({ email: credentials.email });
+        if (!user)
+            return 'INVALID_USER';
+        // Throttle check
+        const existing = await this.tokens.find(credentials.email);
+        if (existing) {
+            const elapsed = (Date.now() - existing.createdAt.getTime()) / 1000;
+            if (elapsed < this.throttle)
+                return 'THROTTLED';
+        }
+        // Generate token
+        const plainToken = randomBytes(32).toString('hex');
+        const hashedToken = this.hashToken(plainToken);
+        const expiresAt = new Date(Date.now() + this.expire * 60_000);
+        // Delete old token, create new one
+        await this.tokens.delete(credentials.email);
+        await this.tokens.create(credentials.email, hashedToken, expiresAt);
+        // Send the link with the plain token
+        await sendLink(user, plainToken);
+        return 'RESET_LINK_SENT';
+    }
+    /**
+     * Reset the user's password.
+     * @param credentials - must include `email`, `token`, `password`
+     * @param callback - receives the user and new password to perform the actual update
+     */
+    async reset(credentials, callback) {
+        const user = await this.users.retrieveByCredentials({ email: credentials.email });
+        if (!user)
+            return 'INVALID_USER';
+        const record = await this.tokens.find(credentials.email);
+        if (!record)
+            return 'INVALID_TOKEN';
+        // Verify token
+        if (!this.verifyToken(credentials.token, record.token))
+            return 'INVALID_TOKEN';
+        // Check expiry
+        const age = (Date.now() - record.createdAt.getTime()) / 60_000;
+        if (age > this.expire) {
+            await this.tokens.delete(credentials.email);
+            return 'TOKEN_EXPIRED';
+        }
+        // Reset
+        await callback(user, credentials.password);
+        await this.tokens.delete(credentials.email);
+        return 'PASSWORD_RESET';
+    }
+    hashToken(token) {
+        return createHmac('sha256', 'password-reset').update(token).digest('hex');
+    }
+    verifyToken(plain, hashed) {
+        const computed = Buffer.from(this.hashToken(plain), 'hex');
+        const stored = Buffer.from(hashed, 'hex');
+        if (computed.length !== stored.length)
+            return false;
+        return timingSafeEqual(computed, stored);
+    }
+}
+// ─── In-Memory Token Repository (for testing / dev) ───────
+export class MemoryTokenRepository {
+    store = new Map();
+    async create(email, token, expiresAt) {
+        this.store.set(email, { token, createdAt: new Date(), expiresAt });
+    }
+    async find(email) {
+        const entry = this.store.get(email);
+        return entry ? { token: entry.token, createdAt: entry.createdAt } : null;
+    }
+    async delete(email) {
+        this.store.delete(email);
+    }
+    async deleteExpired() {
+        const now = Date.now();
+        for (const [email, entry] of this.store) {
+            if (entry.expiresAt.getTime() < now)
+                this.store.delete(email);
+        }
+    }
+}
+//# sourceMappingURL=password-reset.js.map

package/dist/password-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.js","sourceRoot":"","sources":["../src/password-reset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AA+BtE,6DAA6D;AAE7D,MAAM,OAAO,cAAc;IAKN;IACA;IACA;IANF,MAAM,CAAQ;IACd,QAAQ,CAAQ;IAEjC,YACmB,MAAuB,EACvB,KAAmB,EACnB,SAA8B,EAAE;QAFhC,WAAM,GAAN,MAAM,CAAiB;QACvB,UAAK,GAAL,KAAK,CAAc;QACnB,WAAM,GAAN,MAAM,CAA0B;QAEjD,IAAI,CAAC,MAAM,GAAK,MAAM,CAAC,MAAM,IAAM,EAAE,CAAA;QACrC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;IACvC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,WAA8B,EAC9B,QAAiE;QAEjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,IAAI;YAAE,OAAO,cAAc,CAAA;QAEhC,iBAAiB;QACjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAA;YAClE,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ;gBAAE,OAAO,WAAW,CAAA;QACjD,CAAC;QAED,iBAAiB;QACjB,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;QAE7D,mCAAmC;QACnC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;QAEnE,qCAAqC;QACrC,MAAM,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAEhC,OAAO,iBAAiB,CAAA;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CACT,WAA+D,EAC/D,QAAoE;QAEpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,IAAI;YAAE,OAAO,cAAc,CAAA;QAEhC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM;YAAE,OAAO,eAAe,CAAA;QAEnC,eAAe;QACf,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,eAAe,CAAA;QAE9E,eAAe;QACf,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,MAAM,CAAA;QAC9D,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAC3C,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,QAAQ;QACR,MAAM,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;QAC1C,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QAE3C,OAAO,gBAAgB,CAAA;IACzB,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,OAAO,UAAU,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3E,CAAC;IAEO,WAAW,CAAC,KAAa,EAAE,MAAc;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;QAC1D,MAAM,MAAM,GAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QACnD,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC1C,CAAC;CACF;AAED,6DAA6D;AAE7D,MAAM,OAAO,qBAAqB;IACxB,KAAK,GAAG,IAAI,GAAG,EAA+D,CAAA;IAEtF,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAa,EAAE,SAAe;QACxD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACnC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;CACF"}

package/dist/providers.d.ts

@@ -0,0 +1,20 @@
+import type { Authenticatable, UserProvider } from './contracts.js';
+type ModelClass = {
+    query(): {
+        where(col: string, val: unknown): {
+            first(): Promise<Record<string, unknown> | null>;
+        };
+    };
+    find(id: string | number): Promise<Record<string, unknown> | null>;
+};
+export declare class EloquentUserProvider implements UserProvider {
+    private readonly model;
+    private readonly hashCheck;
+    constructor(model: ModelClass, hashCheck: (plain: string, hashed: string) => Promise<boolean>);
+    retrieveById(id: string): Promise<Authenticatable | null>;
+    retrieveByCredentials(credentials: Record<string, unknown>): Promise<Authenticatable | null>;
+    validateCredentials(user: Authenticatable, credentials: Record<string, unknown>): Promise<boolean>;
+}
+export declare function toAuthenticatable(record: Record<string, unknown>): Authenticatable & Record<string, unknown>;
+export {};
+//# sourceMappingURL=providers.d.ts.map

package/dist/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../src/providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAInE,KAAK,UAAU,GAAG;IAChB,KAAK,IAAI;QAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG;YAAE,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;SAAE,CAAA;KAAE,CAAA;IACnG,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;CACnE,CAAA;AAED,qBAAa,oBAAqB,YAAW,YAAY;IAErD,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC;IAG3E,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAKzD,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAa5F,mBAAmB,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAKzG;AAID,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ5G"}

package/dist/providers.js

@@ -0,0 +1,41 @@
+export class EloquentUserProvider {
+    model;
+    hashCheck;
+    constructor(model, hashCheck) {
+        this.model = model;
+        this.hashCheck = hashCheck;
+    }
+    async retrieveById(id) {
+        const record = await this.model.find(id);
+        return record ? toAuthenticatable(record) : null;
+    }
+    async retrieveByCredentials(credentials) {
+        const query = { ...credentials };
+        delete query['password'];
+        if (Object.keys(query).length === 0)
+            return null;
+        let q = this.model.query();
+        for (const [col, val] of Object.entries(query)) {
+            q = q.where(col, val);
+        }
+        const record = await q.first();
+        return record ? toAuthenticatable(record) : null;
+    }
+    async validateCredentials(user, credentials) {
+        const plain = credentials['password'];
+        if (typeof plain !== 'string')
+            return false;
+        return this.hashCheck(plain, user.getAuthPassword());
+    }
+}
+// ─── Helpers ──────────────────────────────────────────────
+export function toAuthenticatable(record) {
+    return {
+        ...record,
+        getAuthIdentifier: () => String(record['id'] ?? ''),
+        getAuthPassword: () => String(record['password'] ?? ''),
+        getRememberToken: () => record['rememberToken'] ?? null,
+        setRememberToken: (token) => { record['rememberToken'] = token; },
+    };
+}
+//# sourceMappingURL=providers.js.map

package/dist/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../src/providers.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,oBAAoB;IAEZ;IACA;IAFnB,YACmB,KAAiB,EACjB,SAA8D;QAD9D,UAAK,GAAL,KAAK,CAAY;QACjB,cAAS,GAAT,SAAS,CAAqD;IAC9E,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,EAAU;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACxC,OAAO,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,WAAoC;QAC9D,MAAM,KAAK,GAAG,EAAE,GAAG,WAAW,EAAE,CAAA;QAChC,OAAO,KAAK,CAAC,UAAU,CAAC,CAAA;QACxB,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAEhD,IAAI,CAAC,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QACnC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,CAAC,GAAI,CAA+C,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACtE,CAAC;QACD,MAAM,MAAM,GAAG,MAAO,CAA0D,CAAC,KAAK,EAAE,CAAA;QACxF,OAAO,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,IAAqB,EAAE,WAAoC;QACnF,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;IACtD,CAAC;CACF;AAED,6DAA6D;AAE7D,MAAM,UAAU,iBAAiB,CAAC,MAA+B;IAC/D,OAAO;QACL,GAAG,MAAM;QACT,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnD,eAAe,EAAI,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACzD,gBAAgB,EAAG,GAAG,EAAE,CAAE,MAAM,CAAC,eAAe,CAAmB,IAAI,IAAI;QAC3E,gBAAgB,EAAG,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,KAAK,CAAA,CAAC,CAAC;KAC1E,CAAA;AACH,CAAC"}

package/dist/session-guard.d.ts

@@ -0,0 +1,21 @@
+import type { Authenticatable, Guard, UserProvider } from './contracts.js';
+export interface SessionStore {
+    get<T>(key: string, fallback?: T): T | undefined;
+    put(key: string, value: unknown): void;
+    forget(key: string): void;
+    regenerate(): Promise<void>;
+}
+export declare class SessionGuard implements Guard {
+    private readonly provider;
+    private readonly session;
+    private _user;
+    constructor(provider: UserProvider, session: SessionStore);
+    user(): Promise<Authenticatable | null>;
+    id(): Promise<string | null>;
+    check(): Promise<boolean>;
+    guest(): Promise<boolean>;
+    attempt(credentials: Record<string, unknown>, _remember?: boolean): Promise<boolean>;
+    login(user: Authenticatable, _remember?: boolean): Promise<void>;
+    logout(): Promise<void>;
+}
+//# sourceMappingURL=session-guard.d.ts.map

package/dist/session-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-guard.d.ts","sourceRoot":"","sources":["../src/session-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAK1E,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,SAAS,CAAA;IAChD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;IACtC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5B;AAED,qBAAa,YAAa,YAAW,KAAK;IAItC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,OAAO,CAAC,KAAK,CAAgD;gBAG1C,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,YAAY;IAGlC,IAAI,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAYvC,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAK5B,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAIzB,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAIzB,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAWpF,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAMhE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAK9B"}