@spfn/auth 0.2.0-beta.86 → 0.2.0-beta.88

package/dist/{authenticate-DTA7W4v2.d.ts → authenticate-ZssfqJ7d.d.ts}

@@ -1,7 +1,8 @@
 import * as _spfn_core_route from '@spfn/core/route';
-import { K as KeyAlgorithmType, e as SocialProvider } from './types-1BMx0OX1.js';
+import { K as KeyAlgorithmType, d as KeyPlatformType, h as SocialProvider } from './types-CD95yudz.js';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import { Static } from '@sinclair/typebox';
+import { Context } from 'hono';
 import { User } from '@spfn/auth/server';
 
 /**
@@ -100,6 +101,8 @@ interface RegisterParams {
     keyId: string;
     fingerprint: string;
     algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
     metadata?: Record<string, unknown>;
 }
 interface RegisterResult {
@@ -117,6 +120,8 @@ interface LoginParams {
     fingerprint: string;
     oldKeyId?: string;
     algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
 }
 interface LoginResult {
     userId: string;
@@ -154,6 +159,16 @@ declare function changePasswordService(params: ChangePasswordParams): Promise<vo
 
 declare const EmailSchema: _sinclair_typebox.TString;
 declare const PhoneSchema: _sinclair_typebox.TString;
+/**
+ * Optional device labels a client may send when registering a key.
+ *
+ * Display only: the key list uses them to tell one device from another, and
+ * nothing is authorized or refused by either value, so a client that lies about
+ * them gains nothing. Both are omitted by every key registered before they
+ * existed, hence optional rather than defaulted.
+ */
+declare const DeviceNameSchema: _sinclair_typebox.TString;
+declare const PlatformSchema: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>;
 declare const PasswordSchema: _sinclair_typebox.TString;
 declare const TargetTypeSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">]>;
 type VerificationTargetType = Static<typeof TargetTypeSchema>;
@@ -211,6 +226,9 @@ interface RegisterPublicKeyParams {
     publicKey: string;
     fingerprint: string;
     algorithm?: KeyAlgorithmType;
+    /** Device label for the key list. Display only — nothing is authorized by it. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
 }
 interface RotateKeyParams {
     userId: number;
@@ -219,6 +237,9 @@ interface RotateKeyParams {
     newPublicKey: string;
     fingerprint: string;
     algorithm?: KeyAlgorithmType;
+    /** Omitted: the replaced key's label carries over, so rotation keeps its name. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
 }
 interface RotateKeyResult {
     success: boolean;
@@ -229,8 +250,53 @@ interface RevokeKeyParams {
     keyId: string;
     reason: string;
 }
+interface RevokeAllKeysParams {
+    userId: number;
+    /** The key the request itself is signed with — spared unless includeCurrent. */
+    currentKeyId: string;
+    /** true signs the caller out too. Default false: "my other devices". */
+    includeCurrent?: boolean;
+    reason: string;
+}
+interface RevokeAllKeysResult {
+    revokedCount: number;
+    currentKeyRevoked: boolean;
+}
+/** One registered device as the account surface shows it. */
+interface KeySummary {
+    keyId: string;
+    deviceName?: string;
+    platform?: string;
+    algorithm: KeyAlgorithmType;
+    /** First bytes of the fingerprint — enough to tell two entries apart. */
+    fingerprintPrefix: string;
+    createdAt: string;
+    lastUsedAt?: string;
+    expiresAt?: string;
+    /** The TTL has run out. The key still reads as active; authenticate refuses it. */
+    isExpired: boolean;
+    /** False once revoked. Only ever false when the caller asked for revoked keys. */
+    isActive: boolean;
+    /** When it was revoked, for the "what did I cut off, and when" reading. */
+    revokedAt?: string;
+}
+interface ListKeysParams {
+    userId: number;
+    /** Also return keys already revoked. Default false: only what can still sign. */
+    includeRevoked?: boolean;
+}
+/** How much of the fingerprint the list returns. */
+declare const KEY_FINGERPRINT_PREFIX_LENGTH = 8;
 /**
  * Register a new public key for a user
+ *
+ * `keyId` is UNIQUE across all users, so the lookup must ignore `isActive` —
+ * filtering on it misses a revoked row and the insert then fails on the unique
+ * index, rolling the whole login transaction back into a 500. Reuse is refused
+ * with a domain error instead, telling the client to generate a fresh keyId.
+ *
+ * @throws KeyIdAlreadyRegisteredError keyId가 이미 쓰인 값일 때 (자기 폐기 키 재사용 · 남의 키)
+ * @throws InvalidKeyFingerprintError fingerprint가 publicKey와 맞지 않을 때
  */
 declare function registerPublicKeyService(params: RegisterPublicKeyParams): Promise<void>;
 /**
@@ -238,9 +304,36 @@ declare function registerPublicKeyService(params: RegisterPublicKeyParams): Prom
  */
 declare function rotateKeyService(params: RotateKeyParams): Promise<RotateKeyResult>;
 /**
- * Revoke a user's public key
+ * Revoke a user's public key.
+ *
+ * Returns false when the key does not belong to this user, so a caller acting
+ * on a key id from outside (the device list) can answer "not found" instead of
+ * reporting a revocation that never happened. The repository already scopes the
+ * update by userId, so someone else's key is never touched either way.
  */
-declare function revokeKeyService(params: RevokeKeyParams): Promise<void>;
+declare function revokeKeyService(params: RevokeKeyParams): Promise<boolean>;
+/**
+ * List the caller's active keys — one entry per device that can sign for them.
+ *
+ * `isExpired` is computed rather than stored: an expired key keeps `isActive`
+ * true (nothing flips it), and `authenticate` refuses it at request time. A list
+ * that showed it as simply "active" would be telling the user something the
+ * server does not act on.
+ *
+ * The fingerprint is truncated. Its full value is what a native sign-in must
+ * send as its nonce (issue #63), and an account page has no use for it beyond
+ * telling two entries apart.
+ */
+declare function listKeysService(params: ListKeysParams): Promise<KeySummary[]>;
+/**
+ * Revoke every active key the user has, optionally sparing the current one.
+ *
+ * The caller's own key is spared by default, so "sign out my other devices"
+ * does not also end the session making the request. Passing
+ * `includeCurrent: true` is the full sign-out, which until now was reachable
+ * only as a side effect of changing a password.
+ */
+declare function revokeAllKeysService(params: RevokeAllKeysParams): Promise<RevokeAllKeysResult>;
 
 /**
  * @spfn/auth - RBAC Type Definitions
@@ -391,6 +484,16 @@ interface OAuthTokens {
 interface NativeVerifyOptions {
     /** 클라이언트가 생성한 raw nonce. provider별 규약(raw 또는 SHA-256 해시)으로 대조된다. */
     nonce: string;
+    /**
+     * 같은 로그인에서 SDK가 함께 받은 provider access token (선택).
+     *
+     * id_token만으로는 알 수 없는 claim을 provider API로 보강하려는 provider가 쓴다
+     * (카카오: id_token에 email_verified가 없어 /v2/user/me의 이메일 유효·인증 플래그를 본다).
+     *
+     * ⚠️ 클라이언트가 보낸 검증되지 않은 값이다. 다른 사용자의 토큰일 수 있으므로,
+     * 이 값으로 조회한 신원은 반드시 id_token의 sub와 대조한 뒤에만 신뢰해야 한다.
+     */
+    accessToken?: string;
 }
 interface OAuthCodeExchangeOptions {
     /** Provider가 callback에 돌려준 원본 state. 일부 provider는 token 교환에도 요구한다. */
@@ -620,6 +723,16 @@ interface OAuthNativeParams {
     keyId: string;
     fingerprint: string;
     algorithm: KeyAlgorithmType;
+    /** 키 목록에 보일 기기 라벨 (선택). 표시용이라 권한 판정에 쓰이지 않는다. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    /**
+     * SDK가 id_token과 함께 받은 provider access token (선택).
+     *
+     * provider가 id_token만으로 확인할 수 없는 claim을 보강할 때만 쓴다. 없으면 provider는
+     * id_token이 담은 정보만으로 신원을 정규화한다.
+     */
+    accessToken?: string;
     /** Apple은 첫 로그인에만 이름을 별도로 주므로 클라이언트가 전달할 수 있다. */
     profile?: {
         name?: string;
@@ -634,7 +747,7 @@ interface OAuthNativeResult {
 /**
  * native id_token 로그인 처리
  *
- * @throws ValidationError provider가 native sign-in을 지원하지 않을 때
+ * @throws NativeSignInUnsupportedError provider가 native sign-in을 지원하지 않을 때
  * @throws InvalidSocialTokenError id_token 검증 실패 시
  */
 declare function oauthNativeService(params: OAuthNativeParams): Promise<OAuthNativeResult>;
@@ -689,6 +802,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, RegisterResult>;
     login: _spfn_core_route.RouteDef<{
@@ -704,6 +819,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
             oldKeyId: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, LoginResult>;
     logout: _spfn_core_route.RouteDef<{}, {}, void>;
@@ -713,8 +830,30 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, RotateKeyResult>;
+    listKeys: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            includeRevoked: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, {
+        keys: KeySummary[];
+    }>;
+    revokeKey: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            keyId: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        keyId: string;
+        selfRevoked: boolean;
+    }>;
+    revokeAllKeys: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            includeCurrent: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, RevokeAllKeysResult>;
     changePassword: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
@@ -846,10 +985,13 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
         body: _sinclair_typebox.TObject<{
             idToken: _sinclair_typebox.TString;
             nonce: _sinclair_typebox.TString;
+            accessToken: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
             publicKey: _sinclair_typebox.TString;
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
             profile: _sinclair_typebox.TOptional<_sinclair_typebox.TObject<{
                 name: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
             }>>;
@@ -1104,13 +1246,67 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }>;
 }>;
 
+/**
+ * The auth-profile registry the authenticate middleware dispatches on.
+ *
+ * A request that names `x-spfn-auth-profile` is answered by the verifier
+ * registered for that profile — an O(1) map lookup, never a per-profile if
+ * chain in the middleware body. A request that names no profile falls through
+ * to the existing Bearer path untouched.
+ *
+ * Every verifier converges on the same `AuthContext` the Bearer path sets, so
+ * downstream permission/tenant code consumes one principal shape and never
+ * branches on how it was authenticated.
+ *
+ * The clientProofV1 verifier reuses the phase-1 admission pieces (header
+ * shape, canonical body, proof-input assembly, ECDSA verification) with two
+ * production substitutions: the key directory is `user_public_keys` via
+ * `keysRepository`, and the replay ledger is the pluggable store from
+ * `client-proof/replay-store` (memory default, Redis opt-in). The admission
+ * order is the contract's — revocation → session → expiry → replay → proof —
+ * and the non-disclosure rule holds: an unregistered keyId shares
+ * PROOF_INVALID with a failed signature, while a revoked or expired key
+ * answers SESSION_REVOKED before the proof is ever examined.
+ *
+ * @module server/middleware/auth-profiles
+ */
+
+/** What a verified request leaves in the context — one shape for every scheme. */
 interface AuthContext {
     user: User;
     userId: string;
     keyId: string;
     role: string | null;
     locale: string;
+    /** How the principal was authenticated. Informational — downstream code never branches on it. */
+    scheme: 'bearer' | 'clientProofV1' | 'oneTimeToken';
+}
+/** A profile's verifier: admits the request and returns the principal, or throws. */
+interface AuthProfileVerifier {
+    verify(c: Context): Promise<AuthContext>;
 }
+/**
+ * Routes a request to its profile verifier.
+ *
+ * - no profile header → null: the caller continues on the Bearer path;
+ * - profile header + Authorization header → rejected (mixing prohibited);
+ * - unknown profile value → rejected (unknownProfilePolicy: reject).
+ *
+ * Shared by authenticate and optionalAuth so "presented but invalid" refuses
+ * identically on both — only the "presented nothing" outcome differs.
+ */
+declare function selectAuthProfile(c: Context): AuthProfileVerifier | null;
+/**
+ * Loads the user for an authenticated key and applies the account-status
+ * rules. One implementation for every scheme: the Bearer path and the profile
+ * verifiers call this, so a status added here gates both identically.
+ */
+declare function resolveAuthenticatedUser(userId: number): Promise<{
+    user: User;
+    role: string | null;
+    locale: string;
+}>;
+
 declare module 'hono' {
     interface ContextVariableMap {
         auth: AuthContext;
@@ -1176,4 +1372,4 @@ declare const authenticate: _spfn_core_route.NamedMiddleware<"auth">;
  */
 declare const optionalAuth: _spfn_core_route.NamedMiddleware<"optionalAuth">;
 
-export { type OAuthCallbackResult as $, type AuthSession as A, rotateKeyService as B, type ChangePasswordParams as C, revokeKeyService as D, type RegisterPublicKeyParams as E, type RotateKeyParams as F, type RevokeKeyParams as G, issueOneTimeTokenService as H, type IssueOneTimeTokenResult as I, verifyOneTimeTokenService as J, oauthStartService as K, type LoginResult as L, oauthCallbackService as M, buildOAuthErrorUrl as N, type OAuthStartResult as O, type PermissionConfig as P, isOAuthProviderEnabled as Q, type RoleConfig as R, type SendVerificationCodeResult as S, requireEnabledProvider as T, type UserProfile as U, type VerificationTargetType as V, getEnabledOAuthProviders as W, getGoogleAccessToken as X, oauthUnlinkNotifyService as Y, type OAuthStartParams as Z, type OAuthCallbackParams as _, type RegisterResult as a, type UnlinkNotifyResult as a0, oauthNativeService as a1, type OAuthNativeParams as a2, authenticate as a3, optionalAuth as a4, EmailSchema as a5, PhoneSchema as a6, PasswordSchema as a7, TargetTypeSchema as a8, VerificationPurposeSchema as a9, type NormalizedIdentity as aa, type OAuthTokens as ab, type NativeVerifyOptions as ac, type OAuthCodeExchangeOptions as ad, type UnlinkNotifyRequest as ae, type UnlinkNotification as af, UnlinkNotifyRejection as ag, registerOAuthProvider as ah, getOAuthProvider as ai, getRegisteredProviders as aj, type RotateKeyResult as b, type OAuthNativeResult as c, type ProfileInfo as d, type VerificationPurpose as e, VERIFICATION_TARGET_TYPES as f, VERIFICATION_PURPOSES as g, PERMISSION_CATEGORIES as h, type PermissionCategory as i, type AuthInitOptions as j, type OAuthProvider as k, type AuthContext as l, mainAuthRouter as m, loginService as n, logoutService as o, changePasswordService as p, type RegisterParams as q, registerService as r, type LoginParams as s, type LogoutParams as t, sendVerificationCodeService as u, verifyCodeService as v, type SendVerificationCodeParams as w, type VerifyCodeParams as x, type VerifyCodeResult as y, registerPublicKeyService as z };
+export { requireEnabledProvider as $, type AuthSession as A, registerPublicKeyService as B, type ChangePasswordParams as C, rotateKeyService as D, revokeKeyService as E, listKeysService as F, revokeAllKeysService as G, KEY_FINGERPRINT_PREFIX_LENGTH as H, type IssueOneTimeTokenResult as I, type RegisterPublicKeyParams as J, type KeySummary as K, type LoginResult as L, type RotateKeyParams as M, type RevokeKeyParams as N, type OAuthStartResult as O, type PermissionConfig as P, type RevokeAllKeysParams as Q, type RoleConfig as R, type SendVerificationCodeResult as S, issueOneTimeTokenService as T, type UserProfile as U, type VerificationTargetType as V, verifyOneTimeTokenService as W, oauthStartService as X, oauthCallbackService as Y, buildOAuthErrorUrl as Z, isOAuthProviderEnabled as _, type RegisterResult as a, getEnabledOAuthProviders as a0, getGoogleAccessToken as a1, oauthUnlinkNotifyService as a2, type OAuthStartParams as a3, type OAuthCallbackParams as a4, type OAuthCallbackResult as a5, type UnlinkNotifyResult as a6, oauthNativeService as a7, type OAuthNativeParams as a8, selectAuthProfile as a9, resolveAuthenticatedUser as aa, type AuthProfileVerifier as ab, authenticate as ac, optionalAuth as ad, EmailSchema as ae, PhoneSchema as af, DeviceNameSchema as ag, PlatformSchema as ah, PasswordSchema as ai, TargetTypeSchema as aj, VerificationPurposeSchema as ak, type NormalizedIdentity as al, type OAuthTokens as am, type NativeVerifyOptions as an, type OAuthCodeExchangeOptions as ao, type UnlinkNotifyRequest as ap, type UnlinkNotification as aq, UnlinkNotifyRejection as ar, registerOAuthProvider as as, getOAuthProvider as at, getRegisteredProviders as au, type RotateKeyResult as b, type RevokeAllKeysResult as c, type OAuthNativeResult as d, type ProfileInfo as e, type VerificationPurpose as f, VERIFICATION_TARGET_TYPES as g, VERIFICATION_PURPOSES as h, PERMISSION_CATEGORIES as i, type PermissionCategory as j, type AuthInitOptions as k, type OAuthProvider as l, mainAuthRouter as m, type AuthContext as n, loginService as o, logoutService as p, changePasswordService as q, registerService as r, type RegisterParams as s, type LoginParams as t, type LogoutParams as u, sendVerificationCodeService as v, verifyCodeService as w, type SendVerificationCodeParams as x, type VerifyCodeParams as y, type VerifyCodeResult as z };