@spfn/auth 0.2.0-beta.86 → 0.2.0-beta.88

package/dist/nextjs/server.d.ts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode } from 'react';
-import { S as SessionData } from '../session-CGxgH3C9.js';
-import { K as KeyAlgorithmType } from '../types-1BMx0OX1.js';
+import { S as SessionData } from '../session-CFK4BT25.js';
+import { K as KeyAlgorithmType } from '../types-CD95yudz.js';
 import { NextRequest, NextResponse } from 'next/server';
 
 interface RequireAuthProps {

package/dist/server.d.ts

@@ -1,14 +1,14 @@
-import { j as AuthInitOptions, k as OAuthProvider, e as VerificationPurpose, i as PermissionCategory, l as AuthContext } from './authenticate-DTA7W4v2.js';
-export { C as ChangePasswordParams, a5 as EmailSchema, I as IssueOneTimeTokenResult, s as LoginParams, L as LoginResult, t as LogoutParams, ac as NativeVerifyOptions, aa as NormalizedIdentity, _ as OAuthCallbackParams, $ as OAuthCallbackResult, ad as OAuthCodeExchangeOptions, a2 as OAuthNativeParams, c as OAuthNativeResult, Z as OAuthStartParams, O as OAuthStartResult, ab as OAuthTokens, a7 as PasswordSchema, a6 as PhoneSchema, q as RegisterParams, E as RegisterPublicKeyParams, a as RegisterResult, G as RevokeKeyParams, F as RotateKeyParams, b as RotateKeyResult, w as SendVerificationCodeParams, S as SendVerificationCodeResult, a8 as TargetTypeSchema, af as UnlinkNotification, ag as UnlinkNotifyRejection, ae as UnlinkNotifyRequest, a0 as UnlinkNotifyResult, g as VERIFICATION_PURPOSES, f as VERIFICATION_TARGET_TYPES, a9 as VerificationPurposeSchema, V as VerificationTargetType, x as VerifyCodeParams, y as VerifyCodeResult, m as authRouter, a3 as authenticate, N as buildOAuthErrorUrl, p as changePasswordService, W as getEnabledOAuthProviders, X as getGoogleAccessToken, ai as getOAuthProvider, aj as getRegisteredProviders, Q as isOAuthProviderEnabled, H as issueOneTimeTokenService, n as loginService, o as logoutService, M as oauthCallbackService, a1 as oauthNativeService, K as oauthStartService, Y as oauthUnlinkNotifyService, a4 as optionalAuth, ah as registerOAuthProvider, z as registerPublicKeyService, r as registerService, T as requireEnabledProvider, D as revokeKeyService, B as rotateKeyService, u as sendVerificationCodeService, v as verifyCodeService, J as verifyOneTimeTokenService } from './authenticate-DTA7W4v2.js';
+import { k as AuthInitOptions, l as OAuthProvider, f as VerificationPurpose, j as PermissionCategory, n as AuthContext } from './authenticate-ZssfqJ7d.js';
+export { ab as AuthProfileVerifier, C as ChangePasswordParams, ag as DeviceNameSchema, ae as EmailSchema, I as IssueOneTimeTokenResult, H as KEY_FINGERPRINT_PREFIX_LENGTH, K as KeySummary, t as LoginParams, L as LoginResult, u as LogoutParams, an as NativeVerifyOptions, al as NormalizedIdentity, a4 as OAuthCallbackParams, a5 as OAuthCallbackResult, ao as OAuthCodeExchangeOptions, a8 as OAuthNativeParams, d as OAuthNativeResult, a3 as OAuthStartParams, O as OAuthStartResult, am as OAuthTokens, ai as PasswordSchema, af as PhoneSchema, ah as PlatformSchema, s as RegisterParams, J as RegisterPublicKeyParams, a as RegisterResult, Q as RevokeAllKeysParams, c as RevokeAllKeysResult, N as RevokeKeyParams, M as RotateKeyParams, b as RotateKeyResult, x as SendVerificationCodeParams, S as SendVerificationCodeResult, aj as TargetTypeSchema, aq as UnlinkNotification, ar as UnlinkNotifyRejection, ap as UnlinkNotifyRequest, a6 as UnlinkNotifyResult, h as VERIFICATION_PURPOSES, g as VERIFICATION_TARGET_TYPES, ak as VerificationPurposeSchema, V as VerificationTargetType, y as VerifyCodeParams, z as VerifyCodeResult, m as authRouter, ac as authenticate, Z as buildOAuthErrorUrl, q as changePasswordService, a0 as getEnabledOAuthProviders, a1 as getGoogleAccessToken, at as getOAuthProvider, au as getRegisteredProviders, _ as isOAuthProviderEnabled, T as issueOneTimeTokenService, F as listKeysService, o as loginService, p as logoutService, Y as oauthCallbackService, a7 as oauthNativeService, X as oauthStartService, a2 as oauthUnlinkNotifyService, ad as optionalAuth, as as registerOAuthProvider, B as registerPublicKeyService, r as registerService, $ as requireEnabledProvider, aa as resolveAuthenticatedUser, G as revokeAllKeysService, E as revokeKeyService, D as rotateKeyService, a9 as selectAuthProfile, v as sendVerificationCodeService, w as verifyCodeService, W as verifyOneTimeTokenService } from './authenticate-ZssfqJ7d.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
-import { K as KeyAlgorithmType, c as InvitationStatus, e as SocialProvider, g as AccountDeletionRequestedBy, h as PurgeStrategy } from './types-1BMx0OX1.js';
-export { b as ACCOUNT_DELETION_REQUESTED_BY, A as ACCOUNT_DELETION_REQUEST_STATUSES, f as AccountDeletionRequestStatus, I as INVITATION_STATUSES, a as KEY_ALGORITHM, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, d as UserStatus } from './types-1BMx0OX1.js';
+import { K as KeyAlgorithmType, f as InvitationStatus, h as SocialProvider, j as AccountDeletionRequestedBy, k as PurgeStrategy } from './types-CD95yudz.js';
+export { b as ACCOUNT_DELETION_REQUESTED_BY, A as ACCOUNT_DELETION_REQUEST_STATUSES, i as AccountDeletionRequestStatus, I as INVITATION_STATUSES, a as KEY_ALGORITHM, e as KEY_DEVICE_NAME_MAX_LENGTH, c as KEY_PLATFORM, d as KeyPlatformType, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, g as UserStatus } from './types-CD95yudz.js';
 import { UserProfile as UserProfile$1, ProfileInfo } from '@spfn/auth';
 import { BaseRepository } from '@spfn/core/db';
 import { Context } from 'hono';
 import * as _spfn_core_route from '@spfn/core/route';
 import { Algorithm } from 'jsonwebtoken';
-export { S as SessionData, g as getSessionInfo, s as sealSession, a as shouldRefreshSession, u as unsealSession } from './session-CGxgH3C9.js';
+export { S as SessionData, g as getSessionInfo, s as sealSession, a as shouldRefreshSession, u as unsealSession } from './session-CFK4BT25.js';
 import { JWTPayload } from 'jose';
 import { SSETokenStore, SSETokenManager } from '@spfn/core/event/sse';
 import * as _spfn_core_logger from '@spfn/core/logger';
@@ -1526,7 +1526,7 @@ declare function verifyOAuthState(encryptedState: string): Promise<OAuthState>;
  *
  * 네이티브/웹 SDK가 받은 id_token을 provider의 공개키(JWKS)로 검증한다.
  * authorization code 교환이 없으므로 client secret을 쓰지 않는다.
- * 서명·issuer·audience·만료는 jose가, nonce는 여기서 직접 대조한다.
+ * 서명·issuer·audience·만료·발급 후 경과 시간은 jose가, nonce는 여기서 직접 대조한다.
  */
 
 interface VerifyIdTokenParams {
@@ -1542,7 +1542,7 @@ interface VerifyIdTokenParams {
 /**
  * id_token을 검증하고 claims(payload)를 반환한다.
  *
- * @throws InvalidSocialTokenError 서명/issuer/audience/만료/알고리즘/nonce/sub 검증 실패 시
+ * @throws InvalidSocialTokenError 서명/issuer/audience/만료/토큰 나이/알고리즘/nonce/sub 검증 실패 시
  */
 declare function verifyIdToken(params: VerifyIdTokenParams): Promise<JWTPayload>;
 
@@ -1617,13 +1617,13 @@ declare const appleProvider: OAuthProvider;
 declare const githubProvider: OAuthProvider;
 
 /**
- * Kakao Login OAuthProvider (web authorization-code flow).
+ * Kakao Login OAuthProvider (web authorization-code flow + native id_token verification).
  */
 
 declare const kakaoProvider: OAuthProvider;
 
 /**
- * Naver Login OAuthProvider (web authorization-code flow).
+ * Naver Login OAuthProvider (web authorization-code flow + native id_token verification).
  */
 
 declare const naverProvider: OAuthProvider;
@@ -2341,6 +2341,36 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
+        deviceName: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        platform: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["ios", "android", "web", "desktop"] & [string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string enum";
+            data: "ios" | "android" | "web" | "desktop";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["ios", "android", "web", "desktop"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
         isActive: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
             name: string;
             tableName: "user_public_keys";
@@ -3681,6 +3711,8 @@ declare class KeysRepository extends BaseRepository {
         publicKey: string;
         algorithm: "ES256" | "RS256";
         fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
         isActive: boolean;
         createdAt: Date;
         lastUsedAt: Date | null;
@@ -3699,6 +3731,8 @@ declare class KeysRepository extends BaseRepository {
         publicKey: string;
         algorithm: "ES256" | "RS256";
         fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
         isActive: boolean;
         createdAt: Date;
         lastUsedAt: Date | null;
@@ -3717,6 +3751,8 @@ declare class KeysRepository extends BaseRepository {
         publicKey: string;
         algorithm: "ES256" | "RS256";
         fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
         isActive: boolean;
         createdAt: Date;
         lastUsedAt: Date | null;
@@ -3724,6 +3760,28 @@ declare class KeysRepository extends BaseRepository {
         revokedAt: Date | null;
         revokedReason: string | null;
     }[]>;
+    /**
+     * 키 목록 화면이 쓰는 공개키 조회 — 최근 등록순
+     *
+     * publicKey 원문은 고르지 않는다. 목록의 용도는 기기를 알아보고 지목하는 것이고,
+     * 공개키는 그 어느 쪽에도 필요 없다. fingerprint는 호출자가 잘라서 내보낸다.
+     *
+     * `includeRevoked`는 이미 끊은 기기까지 보여준다 — "내가 언제 무엇을 끊었나"를
+     * 확인하는 용도라, 폐기 시각과 사유를 함께 고른다.
+     * Read replica 사용
+     */
+    listForUser(userId: number, includeRevoked?: boolean): Promise<{
+        keyId: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
+        algorithm: "ES256" | "RS256";
+        fingerprint: string;
+        isActive: boolean;
+        createdAt: Date;
+        lastUsedAt: Date | null;
+        expiresAt: Date | null;
+        revokedAt: Date | null;
+    }[]>;
     /**
      * 공개키 생성
      * Write primary 사용
@@ -3737,6 +3795,8 @@ declare class KeysRepository extends BaseRepository {
         publicKey: string;
         algorithm: "ES256" | "RS256";
         fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
         revokedAt: Date | null;
@@ -3753,6 +3813,8 @@ declare class KeysRepository extends BaseRepository {
         publicKey: string;
         algorithm: "ES256" | "RS256";
         fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
         isActive: boolean;
         createdAt: Date;
         lastUsedAt: Date | null;
@@ -3774,6 +3836,31 @@ declare class KeysRepository extends BaseRepository {
         publicKey: string;
         algorithm: "ES256" | "RS256";
         fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
+        isActive: boolean;
+        createdAt: Date;
+        lastUsedAt: Date | null;
+        expiresAt: Date | null;
+        revokedAt: Date | null;
+        revokedReason: string | null;
+    }[]>;
+    /**
+     * 지정한 키 하나만 남기고 사용자의 활성 공개키를 전부 revoke
+     *
+     * "다른 기기 전부 로그아웃" — 요청을 보낸 기기는 살려 둔다. 남길 키를 별도 조회로
+     * 확인하지 않고 조건에 담아, 그 사이에 다른 요청이 키를 바꾸는 경쟁을 만들지 않는다.
+     * Write primary 사용
+     */
+    revokeAllActiveByUserIdExcept(userId: number, keepKeyId: string, reason: string): Promise<{
+        id: number;
+        userId: number;
+        keyId: string;
+        publicKey: string;
+        algorithm: "ES256" | "RS256";
+        fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
         isActive: boolean;
         createdAt: Date;
         lastUsedAt: Date | null;
@@ -3794,6 +3881,8 @@ declare class KeysRepository extends BaseRepository {
         publicKey: string;
         algorithm: "ES256" | "RS256";
         fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
         revokedAt: Date | null;
@@ -3818,6 +3907,51 @@ declare class KeysRepository extends BaseRepository {
         publicKey: string;
         algorithm: "ES256" | "RS256";
         fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
+        isActive: boolean;
+        createdAt: Date;
+        lastUsedAt: Date | null;
+        expiresAt: Date | null;
+        revokedAt: Date | null;
+        revokedReason: string | null;
+    }>;
+    /**
+     * 만료 시각 연장 — 같은 사용자가 로그인으로 신원을 다시 증명했을 때 쓴다.
+     * Write primary 사용
+     */
+    extendExpiry(keyId: string, userId: number, expiresAt: Date): Promise<{
+        id: number;
+        userId: number;
+        keyId: string;
+        publicKey: string;
+        algorithm: "ES256" | "RS256";
+        fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
+        isActive: boolean;
+        createdAt: Date;
+        lastUsedAt: Date | null;
+        expiresAt: Date | null;
+        revokedAt: Date | null;
+        revokedReason: string | null;
+    }>;
+    /**
+     * Key ID로 공개키 조회 — 활성 여부 무관 (clientProofV1 admission의 revocation 판정용)
+     *
+     * 폐기(isActive=false)·만료(expiresAt 경과)를 SESSION_REVOKED로, 미등록을
+     * PROOF_INVALID로 구분해야 하므로 활성 필터 없이 조회한다. keyId는 UNIQUE.
+     * Read replica 사용
+     */
+    findByKeyId(keyId: string): Promise<{
+        id: number;
+        userId: number;
+        keyId: string;
+        publicKey: string;
+        algorithm: "ES256" | "RS256";
+        fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
         isActive: boolean;
         createdAt: Date;
         lastUsedAt: Date | null;
@@ -3836,6 +3970,8 @@ declare class KeysRepository extends BaseRepository {
         publicKey: string;
         algorithm: "ES256" | "RS256";
         fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
         isActive: boolean;
         createdAt: Date;
         lastUsedAt: Date | null;
@@ -6312,7 +6448,7 @@ declare const authLoginEvent: _spfn_core_event.EventDef<{
     email?: string | undefined;
     phone?: string | undefined;
     userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+    provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "email" | "phone";
 }>;
 /**
  * auth.register - 회원가입 성공 이벤트
@@ -6335,7 +6471,7 @@ declare const authRegisterEvent: _spfn_core_event.EventDef<{
         [x: string]: unknown;
     } | undefined;
     userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+    provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "email" | "phone";
 }>;
 /**
  * auth.invitation.created - 초대 생성 이벤트
@@ -6454,7 +6590,7 @@ declare const authDeletionCompletedEvent: _spfn_core_event.EventDef<{
 declare const oauthUnlinkedEvent: _spfn_core_event.EventDef<{
     reason?: string | undefined;
     userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+    provider: "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "email" | "phone";
     providerUserId: string;
 }>;
 /**