@shubh90/app-runtime 0.2.2 → 0.3.0

package/dist/auth/core.d.ts

@@ -0,0 +1,66 @@
+import { getAuthMode } from "./mode.js";
+import { safeNext } from "./next-path.js";
+import { SIGN_IN_PROBLEMS } from "./problems.js";
+import { type MiiUser } from "./lookup.js";
+import { type MiiIdentity } from "./plaza.js";
+import { type UsersConfig } from "./users-config.js";
+export type { MiiUser } from "./lookup.js";
+export type { AuthMode } from "./mode.js";
+export type { MiiIdentity, SignInFailure, SignInResult } from "./plaza.js";
+export type { UsersConfig } from "./users-config.js";
+export { SIGN_IN_PROBLEMS } from "./problems.js";
+export { safeNext } from "./next-path.js";
+export { getAuthMode } from "./mode.js";
+export { SESSION_COOKIE, SESSION_TTL_MS } from "./lookup.js";
+export { miiAuthConfig, type MiiAuthConfig } from "./config.js";
+export { redeemWithPlaza, signInWithPlaza } from "./plaza.js";
+export type CreateMiiAuthCoreOptions = {
+    /** Which table holds this app's people, if not the default `mii_auth_users`. */
+    readonly users?: UsersConfig;
+    /** Where to report failures that are ours, not the person's. Defaults to console.error. */
+    readonly reportError?: (error: unknown, context: Record<string, string>) => void;
+};
+export type MiiAuthCore = {
+    /** The user behind a session token, or null. The app reads its own cookie. */
+    resolveSession(token: string): Promise<MiiUser | null>;
+    /** Start a session; the app sets the cookie itself (see cookie notes below). */
+    issueSession(userId: string): Promise<{
+        token: string;
+        expiresAt: Date;
+    }>;
+    /** End one session by its token. */
+    revokeSession(token: string): Promise<void>;
+    upsertMemberFromIdentity(identity: MiiIdentity): Promise<{
+        id: string;
+        status: string;
+    }>;
+    deactivateUser(userId: string): Promise<void>;
+    /**
+     * The pane's silent sign-in: spend a ?mii_code= for an identity, upsert the
+     * member, start a session. Null when the code is spent/stale or the member
+     * is inactive (send them to /login).
+     */
+    redeemPaneCode(code: string): Promise<{
+        token: string;
+        expiresAt: Date;
+    } | null>;
+    getAuthMode: typeof getAuthMode;
+    readonly SESSION_COOKIE: string;
+    readonly SIGN_IN_PROBLEMS: typeof SIGN_IN_PROBLEMS;
+    readonly safeNext: typeof safeNext;
+};
+/**
+ * Cookie attributes the app must use with issueSession's token, mirrored from
+ * the Next adapter: inside Plaza's App pane the app is a third party, so the
+ * cookie must be SameSite=None + Secure + partitioned or the pane signs in
+ * forever; opened directly it is an ordinary Lax cookie. Decide by the
+ * request's `Sec-Fetch-Dest: iframe` header.
+ */
+export declare function cookieAttributes(embedded: boolean): {
+    httpOnly: true;
+    path: "/";
+    sameSite: "none" | "lax";
+    secure: boolean;
+    partitioned: boolean;
+};
+export declare function createMiiAuthCore(options?: CreateMiiAuthCoreOptions): MiiAuthCore;

package/dist/auth/core.js

@@ -0,0 +1,62 @@
+import { makeAuthSql } from "./db.js";
+import { getAuthMode } from "./mode.js";
+import { safeNext } from "./next-path.js";
+import { SIGN_IN_PROBLEMS } from "./problems.js";
+import { issueSession, resolveSession, SESSION_COOKIE, SESSION_TTL_MS, hashToken } from "./lookup.js";
+import { redeemWithPlaza } from "./plaza.js";
+import { deactivateUser, upsertMemberFromIdentity } from "./users.js";
+import { resolveUsers } from "./users-config.js";
+export { SIGN_IN_PROBLEMS } from "./problems.js";
+export { safeNext } from "./next-path.js";
+export { getAuthMode } from "./mode.js";
+export { SESSION_COOKIE, SESSION_TTL_MS } from "./lookup.js";
+export { miiAuthConfig } from "./config.js";
+export { redeemWithPlaza, signInWithPlaza } from "./plaza.js";
+/**
+ * Cookie attributes the app must use with issueSession's token, mirrored from
+ * the Next adapter: inside Plaza's App pane the app is a third party, so the
+ * cookie must be SameSite=None + Secure + partitioned or the pane signs in
+ * forever; opened directly it is an ordinary Lax cookie. Decide by the
+ * request's `Sec-Fetch-Dest: iframe` header.
+ */
+export function cookieAttributes(embedded) {
+    return {
+        httpOnly: true,
+        path: "/",
+        sameSite: embedded ? "none" : "lax",
+        secure: embedded || process.env.NODE_ENV === "production",
+        partitioned: embedded
+    };
+}
+export function createMiiAuthCore(options = {}) {
+    const users = resolveUsers(options.users);
+    const ctx = {
+        getSql: makeAuthSql(users),
+        users,
+        reportError: options.reportError ??
+            ((error, context) => console.error("mii-auth error", context, error))
+    };
+    return {
+        resolveSession: (token) => resolveSession(ctx, token),
+        issueSession: (userId) => issueSession(ctx, userId),
+        revokeSession: async (token) => {
+            const sql = await ctx.getSql();
+            await sql `delete from mii_auth_sessions where token_hash = ${hashToken(token)}`;
+        },
+        upsertMemberFromIdentity: (identity) => upsertMemberFromIdentity(ctx, identity),
+        deactivateUser: (userId) => deactivateUser(ctx, userId),
+        redeemPaneCode: async (code) => {
+            const identity = await redeemWithPlaza(code);
+            if (identity === null)
+                return null;
+            const user = await upsertMemberFromIdentity(ctx, identity);
+            if (user.status !== "active")
+                return null;
+            return issueSession(ctx, user.id);
+        },
+        getAuthMode,
+        SESSION_COOKIE,
+        SIGN_IN_PROBLEMS,
+        safeNext
+    };
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shubh90/app-runtime",
-  "version": "0.2.2",
-  "description": "The platform contract every mii org app depends on \u2014 sign-in, and the Next.js config an app must not diverge from. A versioned package, not files copied into each repo.",
+  "version": "0.3.0",
+  "description": "The platform contract every mii org app depends on — sign-in, and the Next.js config an app must not diverge from. A versioned package, not files copied into each repo.",
   "license": "UNLICENSED",
   "type": "module",
   "publishConfig": {
@@ -20,6 +20,10 @@
       "types": "./dist/auth/index.d.ts",
       "import": "./dist/auth/index.js"
     },
+    "./auth/core": {
+      "types": "./dist/auth/core.d.ts",
+      "import": "./dist/auth/core.js"
+    },
     "./next": {
       "types": "./dist/next/index.d.ts",
       "import": "./dist/next/index.js"
@@ -35,6 +39,11 @@
     "next": ">=15",
     "postgres": ">=3"
   },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    }
+  },
   "devDependencies": {
     "@types/node": "^22",
     "next": "^15",