@spfn/auth 0.2.0-beta.8 → 0.2.0-beta.80

package/dist/session-CGxgH3C9.d.ts

@@ -0,0 +1,53 @@
+import { K as KeyAlgorithmType } from './types-1BMx0OX1.js';
+
+/**
+ * @spfn/auth - Client Session Management
+ *
+ * Uses Jose JWE (JSON Web Encryption) to securely store session data in cookies
+ * More efficient than Iron Session with better Edge Runtime support
+ */
+
+interface SessionData {
+    userId: string;
+    privateKey: string;
+    keyId: string;
+    algorithm: KeyAlgorithmType;
+}
+/**
+ * Seal session data into encrypted JWT (JWE)
+ *
+ * @param data - Session data to encrypt
+ * @param ttl - Time to live in seconds (default: 7 days)
+ * @returns Encrypted JWT string
+ */
+declare function sealSession(data: SessionData, ttl?: number): Promise<string>;
+/**
+ * Unseal encrypted JWT (JWE) to session data
+ *
+ * @param jwt - Encrypted JWT string
+ * @returns Session data
+ * @throws Error if session is invalid or expired
+ */
+declare function unsealSession(jwt: string): Promise<SessionData>;
+/**
+ * Get session metadata without decrypting
+ *
+ * @param jwt - Encrypted JWT string
+ * @returns Session metadata or null if invalid
+ */
+declare function getSessionInfo(jwt: string): Promise<{
+    issuedAt: Date;
+    expiresAt: Date;
+    issuer: string;
+    audience: string;
+} | null>;
+/**
+ * Check if session is about to expire (within threshold)
+ *
+ * @param jwt - Encrypted JWT string
+ * @param thresholdHours - Hours before expiry to trigger refresh (default: 24)
+ * @returns True if session should be refreshed
+ */
+declare function shouldRefreshSession(jwt: string, thresholdHours?: number): Promise<boolean>;
+
+export { type SessionData as S, shouldRefreshSession as a, getSessionInfo as g, sealSession as s, unsealSession as u };

package/dist/types-1BMx0OX1.d.ts

@@ -0,0 +1,84 @@
+/**
+ * @spfn/auth - Shared Types
+ *
+ * Common types and constants used across the auth package
+ */
+/**
+ * Supported JWT signature algorithms
+ *
+ * - ES256: ECDSA with P-256 and SHA-256 (recommended, smaller keys)
+ * - RS256: RSA with SHA-256 (fallback, larger keys)
+ */
+declare const KEY_ALGORITHM: readonly ["ES256", "RS256"];
+/**
+ * Key algorithm type derived from the const array
+ */
+type KeyAlgorithmType = typeof KEY_ALGORITHM[number];
+/**
+ * Invitation status enum values
+ * Single source of truth for all invitation statuses
+ */
+declare const INVITATION_STATUSES: readonly ["pending", "accepted", "expired", "cancelled"];
+/**
+ * Invitation status type derived from the const array
+ */
+type InvitationStatus = typeof INVITATION_STATUSES[number];
+/**
+ * User status enum values
+ * Single source of truth for all user statuses
+ *
+ * - active: Normal operation (default)
+ * - inactive: Deactivated (user request, dormant)
+ * - suspended: Locked (security incident, ToS violation)
+ * - pending_deletion: Deletion requested, within the grace period (recoverable)
+ * - deleted: Grace period elapsed and the account was purged (anonymize mode only —
+ *   hard-delete removes the row instead, so this status never appears for it)
+ */
+declare const USER_STATUSES: readonly ["active", "inactive", "suspended", "pending_deletion", "deleted"];
+/**
+ * User status type derived from the const array
+ */
+type UserStatus = typeof USER_STATUSES[number];
+/**
+ * Social provider enum values
+ * Single source of truth for supported OAuth providers
+ */
+declare const SOCIAL_PROVIDERS: readonly ["google", "apple", "github", "kakao", "naver", "superself"];
+/**
+ * Social provider type derived from the const array
+ */
+type SocialProvider = typeof SOCIAL_PROVIDERS[number];
+/**
+ * Account deletion request status enum values
+ * Single source of truth for `account_deletion_requests.status`
+ *
+ * - pending: Awaiting the grace period (or immediate purge)
+ * - cancelled: User (or admin) recovered the account before purge
+ * - completed: The purge ran (row is kept as an audit record, never deleted)
+ */
+declare const ACCOUNT_DELETION_REQUEST_STATUSES: readonly ["pending", "cancelled", "completed"];
+/**
+ * Account deletion request status type derived from the const array
+ */
+type AccountDeletionRequestStatus = typeof ACCOUNT_DELETION_REQUEST_STATUSES[number];
+/**
+ * Who initiated an account deletion request
+ */
+declare const ACCOUNT_DELETION_REQUESTED_BY: readonly ["self", "admin"];
+/**
+ * Account deletion requester type derived from the const array
+ */
+type AccountDeletionRequestedBy = typeof ACCOUNT_DELETION_REQUESTED_BY[number];
+/**
+ * Purge strategy enum values
+ *
+ * - anonymize: Scrub PII, keep the row (status becomes 'deleted') — default
+ * - hard-delete: Physically remove the `users` row (cascades to child rows)
+ */
+declare const PURGE_STRATEGIES: readonly ["anonymize", "hard-delete"];
+/**
+ * Purge strategy type derived from the const array
+ */
+type PurgeStrategy = typeof PURGE_STRATEGIES[number];
+
+export { ACCOUNT_DELETION_REQUEST_STATUSES as A, INVITATION_STATUSES as I, type KeyAlgorithmType as K, PURGE_STRATEGIES as P, SOCIAL_PROVIDERS as S, USER_STATUSES as U, KEY_ALGORITHM as a, ACCOUNT_DELETION_REQUESTED_BY as b, type InvitationStatus as c, type UserStatus as d, type SocialProvider as e, type AccountDeletionRequestStatus as f, type AccountDeletionRequestedBy as g, type PurgeStrategy as h };

package/migrations/0001_smooth_the_fury.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "spfn_auth"."users" ADD COLUMN "username" text;--> statement-breakpoint
+CREATE INDEX "users_username_idx" ON "spfn_auth"."users" USING btree ("username");--> statement-breakpoint
+ALTER TABLE "spfn_auth"."users" ADD CONSTRAINT "users_username_unique" UNIQUE("username");

package/migrations/0002_deep_iceman.sql

@@ -0,0 +1,11 @@
+ALTER TABLE "spfn_auth"."users" ALTER COLUMN "role_id" SET DATA TYPE bigint;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_profiles" ALTER COLUMN "user_id" SET DATA TYPE bigint;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_profiles" ALTER COLUMN "display_name" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_public_keys" ALTER COLUMN "user_id" SET DATA TYPE bigint;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_social_accounts" ALTER COLUMN "user_id" SET DATA TYPE bigint;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_invitations" ALTER COLUMN "role_id" SET DATA TYPE bigint;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_invitations" ALTER COLUMN "invited_by_id" SET DATA TYPE bigint;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."role_permissions" ALTER COLUMN "role_id" SET DATA TYPE bigint;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."role_permissions" ALTER COLUMN "permission_id" SET DATA TYPE bigint;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_permissions" ALTER COLUMN "user_id" SET DATA TYPE bigint;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_permissions" ALTER COLUMN "permission_id" SET DATA TYPE bigint;

package/migrations/0003_perfect_deathbird.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "spfn_auth"."users" ADD COLUMN "public_id" uuid DEFAULT gen_random_uuid() NOT NULL;--> statement-breakpoint
+CREATE INDEX "users_public_id_idx" ON "spfn_auth"."users" USING btree ("public_id");--> statement-breakpoint
+ALTER TABLE "spfn_auth"."users" ADD CONSTRAINT "users_public_id_unique" UNIQUE("public_id");

package/migrations/0004_concerned_rawhide_kid.sql

@@ -0,0 +1,5 @@
+CREATE TABLE "spfn_auth"."auth_metadata" (
+	"key" text PRIMARY KEY NOT NULL,
+	"value" text NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);

package/migrations/0005_lethal_lifeguard.sql

@@ -0,0 +1,32 @@
+-- Corrective migration: drop leftover bigserial sequence defaults on FK columns.
+--
+-- These columns were originally declared `bigserial` in 0000 and converted to
+-- `bigint` in 0002. Postgres `ALTER COLUMN ... SET DATA TYPE bigint` does NOT drop
+-- the serial-created `DEFAULT nextval(...)`, so every DB that ran those migrations
+-- still has a dangling sequence default on each FK column. That default is wrong:
+-- an FK with no explicit value would silently receive a sequence number instead of
+-- pointing at a real parent row. The entities define these columns with no default
+-- (foreignKey() -> bigint, not null, no default) and all writers set them explicitly,
+-- so the live DB is simply diverged. Drizzle cannot detect this — its snapshot already
+-- shows bigint/no-default — so this corrective migration is written by hand.
+
+ALTER TABLE "spfn_auth"."users" ALTER COLUMN "role_id" DROP DEFAULT;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_profiles" ALTER COLUMN "user_id" DROP DEFAULT;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_public_keys" ALTER COLUMN "user_id" DROP DEFAULT;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_social_accounts" ALTER COLUMN "user_id" DROP DEFAULT;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_invitations" ALTER COLUMN "role_id" DROP DEFAULT;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_invitations" ALTER COLUMN "invited_by_id" DROP DEFAULT;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."role_permissions" ALTER COLUMN "role_id" DROP DEFAULT;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."role_permissions" ALTER COLUMN "permission_id" DROP DEFAULT;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_permissions" ALTER COLUMN "user_id" DROP DEFAULT;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_permissions" ALTER COLUMN "permission_id" DROP DEFAULT;--> statement-breakpoint
+DROP SEQUENCE IF EXISTS "spfn_auth"."users_role_id_seq";--> statement-breakpoint
+DROP SEQUENCE IF EXISTS "spfn_auth"."user_profiles_user_id_seq";--> statement-breakpoint
+DROP SEQUENCE IF EXISTS "spfn_auth"."user_public_keys_user_id_seq";--> statement-breakpoint
+DROP SEQUENCE IF EXISTS "spfn_auth"."user_social_accounts_user_id_seq";--> statement-breakpoint
+DROP SEQUENCE IF EXISTS "spfn_auth"."user_invitations_role_id_seq";--> statement-breakpoint
+DROP SEQUENCE IF EXISTS "spfn_auth"."user_invitations_invited_by_id_seq";--> statement-breakpoint
+DROP SEQUENCE IF EXISTS "spfn_auth"."role_permissions_role_id_seq";--> statement-breakpoint
+DROP SEQUENCE IF EXISTS "spfn_auth"."role_permissions_permission_id_seq";--> statement-breakpoint
+DROP SEQUENCE IF EXISTS "spfn_auth"."user_permissions_user_id_seq";--> statement-breakpoint
+DROP SEQUENCE IF EXISTS "spfn_auth"."user_permissions_permission_id_seq";

package/migrations/0006_easy_hardball.sql

@@ -0,0 +1,24 @@
+CREATE TABLE "spfn_auth"."account_deletion_requests" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"user_id" bigint,
+	"user_public_id" text NOT NULL,
+	"requested_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"purge_scheduled_at" timestamp with time zone NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"requested_by" text DEFAULT 'self' NOT NULL,
+	"reason" text,
+	"cancelled_at" timestamp with time zone,
+	"completed_at" timestamp with time zone,
+	"purge_strategy" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "spfn_auth"."users" ADD COLUMN "deleted_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."users" ADD COLUMN "deleted_by" text;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."account_deletion_requests" ADD CONSTRAINT "account_deletion_requests_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "spfn_auth"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "account_deletion_requests_user_id_idx" ON "spfn_auth"."account_deletion_requests" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "account_deletion_requests_status_idx" ON "spfn_auth"."account_deletion_requests" USING btree ("status");--> statement-breakpoint
+CREATE INDEX "account_deletion_requests_purge_scheduled_at_idx" ON "spfn_auth"."account_deletion_requests" USING btree ("purge_scheduled_at");--> statement-breakpoint
+CREATE INDEX "account_deletion_requests_user_public_id_idx" ON "spfn_auth"."account_deletion_requests" USING btree ("user_public_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "account_deletion_requests_user_pending_unique_idx" ON "spfn_auth"."account_deletion_requests" USING btree ("user_id") WHERE "spfn_auth"."account_deletion_requests"."status" = 'pending';

package/migrations/0007_glossy_major_mapleleaf.sql

@@ -0,0 +1 @@
+ALTER TABLE "spfn_auth"."users" DROP CONSTRAINT "email_or_phone_check";