@spfn/auth 0.2.0-beta.87 → 0.2.0-beta.88

package/dist/{authenticate-C7w-pLOR.d.ts → authenticate-ZssfqJ7d.d.ts}

@@ -1,5 +1,5 @@
 import * as _spfn_core_route from '@spfn/core/route';
-import { K as KeyAlgorithmType, e as SocialProvider } from './types-1BMx0OX1.js';
+import { K as KeyAlgorithmType, d as KeyPlatformType, h as SocialProvider } from './types-CD95yudz.js';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import { Static } from '@sinclair/typebox';
 import { Context } from 'hono';
@@ -101,6 +101,8 @@ interface RegisterParams {
     keyId: string;
     fingerprint: string;
     algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
     metadata?: Record<string, unknown>;
 }
 interface RegisterResult {
@@ -118,6 +120,8 @@ interface LoginParams {
     fingerprint: string;
     oldKeyId?: string;
     algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
 }
 interface LoginResult {
     userId: string;
@@ -155,6 +159,16 @@ declare function changePasswordService(params: ChangePasswordParams): Promise<vo
 
 declare const EmailSchema: _sinclair_typebox.TString;
 declare const PhoneSchema: _sinclair_typebox.TString;
+/**
+ * Optional device labels a client may send when registering a key.
+ *
+ * Display only: the key list uses them to tell one device from another, and
+ * nothing is authorized or refused by either value, so a client that lies about
+ * them gains nothing. Both are omitted by every key registered before they
+ * existed, hence optional rather than defaulted.
+ */
+declare const DeviceNameSchema: _sinclair_typebox.TString;
+declare const PlatformSchema: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>;
 declare const PasswordSchema: _sinclair_typebox.TString;
 declare const TargetTypeSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">]>;
 type VerificationTargetType = Static<typeof TargetTypeSchema>;
@@ -212,6 +226,9 @@ interface RegisterPublicKeyParams {
     publicKey: string;
     fingerprint: string;
     algorithm?: KeyAlgorithmType;
+    /** Device label for the key list. Display only — nothing is authorized by it. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
 }
 interface RotateKeyParams {
     userId: number;
@@ -220,6 +237,9 @@ interface RotateKeyParams {
     newPublicKey: string;
     fingerprint: string;
     algorithm?: KeyAlgorithmType;
+    /** Omitted: the replaced key's label carries over, so rotation keeps its name. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
 }
 interface RotateKeyResult {
     success: boolean;
@@ -230,8 +250,53 @@ interface RevokeKeyParams {
     keyId: string;
     reason: string;
 }
+interface RevokeAllKeysParams {
+    userId: number;
+    /** The key the request itself is signed with — spared unless includeCurrent. */
+    currentKeyId: string;
+    /** true signs the caller out too. Default false: "my other devices". */
+    includeCurrent?: boolean;
+    reason: string;
+}
+interface RevokeAllKeysResult {
+    revokedCount: number;
+    currentKeyRevoked: boolean;
+}
+/** One registered device as the account surface shows it. */
+interface KeySummary {
+    keyId: string;
+    deviceName?: string;
+    platform?: string;
+    algorithm: KeyAlgorithmType;
+    /** First bytes of the fingerprint — enough to tell two entries apart. */
+    fingerprintPrefix: string;
+    createdAt: string;
+    lastUsedAt?: string;
+    expiresAt?: string;
+    /** The TTL has run out. The key still reads as active; authenticate refuses it. */
+    isExpired: boolean;
+    /** False once revoked. Only ever false when the caller asked for revoked keys. */
+    isActive: boolean;
+    /** When it was revoked, for the "what did I cut off, and when" reading. */
+    revokedAt?: string;
+}
+interface ListKeysParams {
+    userId: number;
+    /** Also return keys already revoked. Default false: only what can still sign. */
+    includeRevoked?: boolean;
+}
+/** How much of the fingerprint the list returns. */
+declare const KEY_FINGERPRINT_PREFIX_LENGTH = 8;
 /**
  * Register a new public key for a user
+ *
+ * `keyId` is UNIQUE across all users, so the lookup must ignore `isActive` —
+ * filtering on it misses a revoked row and the insert then fails on the unique
+ * index, rolling the whole login transaction back into a 500. Reuse is refused
+ * with a domain error instead, telling the client to generate a fresh keyId.
+ *
+ * @throws KeyIdAlreadyRegisteredError keyId가 이미 쓰인 값일 때 (자기 폐기 키 재사용 · 남의 키)
+ * @throws InvalidKeyFingerprintError fingerprint가 publicKey와 맞지 않을 때
  */
 declare function registerPublicKeyService(params: RegisterPublicKeyParams): Promise<void>;
 /**
@@ -239,9 +304,36 @@ declare function registerPublicKeyService(params: RegisterPublicKeyParams): Prom
  */
 declare function rotateKeyService(params: RotateKeyParams): Promise<RotateKeyResult>;
 /**
- * Revoke a user's public key
+ * Revoke a user's public key.
+ *
+ * Returns false when the key does not belong to this user, so a caller acting
+ * on a key id from outside (the device list) can answer "not found" instead of
+ * reporting a revocation that never happened. The repository already scopes the
+ * update by userId, so someone else's key is never touched either way.
+ */
+declare function revokeKeyService(params: RevokeKeyParams): Promise<boolean>;
+/**
+ * List the caller's active keys — one entry per device that can sign for them.
+ *
+ * `isExpired` is computed rather than stored: an expired key keeps `isActive`
+ * true (nothing flips it), and `authenticate` refuses it at request time. A list
+ * that showed it as simply "active" would be telling the user something the
+ * server does not act on.
+ *
+ * The fingerprint is truncated. Its full value is what a native sign-in must
+ * send as its nonce (issue #63), and an account page has no use for it beyond
+ * telling two entries apart.
+ */
+declare function listKeysService(params: ListKeysParams): Promise<KeySummary[]>;
+/**
+ * Revoke every active key the user has, optionally sparing the current one.
+ *
+ * The caller's own key is spared by default, so "sign out my other devices"
+ * does not also end the session making the request. Passing
+ * `includeCurrent: true` is the full sign-out, which until now was reachable
+ * only as a side effect of changing a password.
  */
-declare function revokeKeyService(params: RevokeKeyParams): Promise<void>;
+declare function revokeAllKeysService(params: RevokeAllKeysParams): Promise<RevokeAllKeysResult>;
 
 /**
  * @spfn/auth - RBAC Type Definitions
@@ -392,6 +484,16 @@ interface OAuthTokens {
 interface NativeVerifyOptions {
     /** 클라이언트가 생성한 raw nonce. provider별 규약(raw 또는 SHA-256 해시)으로 대조된다. */
     nonce: string;
+    /**
+     * 같은 로그인에서 SDK가 함께 받은 provider access token (선택).
+     *
+     * id_token만으로는 알 수 없는 claim을 provider API로 보강하려는 provider가 쓴다
+     * (카카오: id_token에 email_verified가 없어 /v2/user/me의 이메일 유효·인증 플래그를 본다).
+     *
+     * ⚠️ 클라이언트가 보낸 검증되지 않은 값이다. 다른 사용자의 토큰일 수 있으므로,
+     * 이 값으로 조회한 신원은 반드시 id_token의 sub와 대조한 뒤에만 신뢰해야 한다.
+     */
+    accessToken?: string;
 }
 interface OAuthCodeExchangeOptions {
     /** Provider가 callback에 돌려준 원본 state. 일부 provider는 token 교환에도 요구한다. */
@@ -621,6 +723,16 @@ interface OAuthNativeParams {
     keyId: string;
     fingerprint: string;
     algorithm: KeyAlgorithmType;
+    /** 키 목록에 보일 기기 라벨 (선택). 표시용이라 권한 판정에 쓰이지 않는다. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    /**
+     * SDK가 id_token과 함께 받은 provider access token (선택).
+     *
+     * provider가 id_token만으로 확인할 수 없는 claim을 보강할 때만 쓴다. 없으면 provider는
+     * id_token이 담은 정보만으로 신원을 정규화한다.
+     */
+    accessToken?: string;
     /** Apple은 첫 로그인에만 이름을 별도로 주므로 클라이언트가 전달할 수 있다. */
     profile?: {
         name?: string;
@@ -635,7 +747,7 @@ interface OAuthNativeResult {
 /**
  * native id_token 로그인 처리
  *
- * @throws ValidationError provider가 native sign-in을 지원하지 않을 때
+ * @throws NativeSignInUnsupportedError provider가 native sign-in을 지원하지 않을 때
  * @throws InvalidSocialTokenError id_token 검증 실패 시
  */
 declare function oauthNativeService(params: OAuthNativeParams): Promise<OAuthNativeResult>;
@@ -690,6 +802,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, RegisterResult>;
     login: _spfn_core_route.RouteDef<{
@@ -705,6 +819,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
             oldKeyId: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, LoginResult>;
     logout: _spfn_core_route.RouteDef<{}, {}, void>;
@@ -714,8 +830,30 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, RotateKeyResult>;
+    listKeys: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            includeRevoked: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, {
+        keys: KeySummary[];
+    }>;
+    revokeKey: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            keyId: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        keyId: string;
+        selfRevoked: boolean;
+    }>;
+    revokeAllKeys: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            includeCurrent: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, RevokeAllKeysResult>;
     changePassword: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
@@ -733,7 +871,7 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             id: number;
             name: string;
             displayName: string;
-            category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
+            category: "custom" | "user" | "auth" | "rbac" | "system" | undefined;
         }[];
         userId: number;
         publicId: string;
@@ -847,10 +985,13 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
         body: _sinclair_typebox.TObject<{
             idToken: _sinclair_typebox.TString;
             nonce: _sinclair_typebox.TString;
+            accessToken: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
             publicKey: _sinclair_typebox.TString;
             keyId: _sinclair_typebox.TString;
             fingerprint: _sinclair_typebox.TString;
             algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
             profile: _sinclair_typebox.TOptional<_sinclair_typebox.TObject<{
                 name: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
             }>>;
@@ -1030,8 +1171,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         roles: {
             description: string | null;
-            name: string;
             id: number;
+            name: string;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -1052,8 +1193,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         role: {
             description: string | null;
-            name: string;
             id: number;
+            name: string;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -1076,8 +1217,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         role: {
             description: string | null;
-            name: string;
             id: number;
+            name: string;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -1231,4 +1372,4 @@ declare const authenticate: _spfn_core_route.NamedMiddleware<"auth">;
  */
 declare const optionalAuth: _spfn_core_route.NamedMiddleware<"optionalAuth">;
 
-export { type OAuthCallbackResult as $, type AuthSession as A, rotateKeyService as B, type ChangePasswordParams as C, revokeKeyService as D, type RegisterPublicKeyParams as E, type RotateKeyParams as F, type RevokeKeyParams as G, issueOneTimeTokenService as H, type IssueOneTimeTokenResult as I, verifyOneTimeTokenService as J, oauthStartService as K, type LoginResult as L, oauthCallbackService as M, buildOAuthErrorUrl as N, type OAuthStartResult as O, type PermissionConfig as P, isOAuthProviderEnabled as Q, type RoleConfig as R, type SendVerificationCodeResult as S, requireEnabledProvider as T, type UserProfile as U, type VerificationTargetType as V, getEnabledOAuthProviders as W, getGoogleAccessToken as X, oauthUnlinkNotifyService as Y, type OAuthStartParams as Z, type OAuthCallbackParams as _, type RegisterResult as a, type UnlinkNotifyResult as a0, oauthNativeService as a1, type OAuthNativeParams as a2, selectAuthProfile as a3, resolveAuthenticatedUser as a4, type AuthProfileVerifier as a5, authenticate as a6, optionalAuth as a7, EmailSchema as a8, PhoneSchema as a9, PasswordSchema as aa, TargetTypeSchema as ab, VerificationPurposeSchema as ac, type NormalizedIdentity as ad, type OAuthTokens as ae, type NativeVerifyOptions as af, type OAuthCodeExchangeOptions as ag, type UnlinkNotifyRequest as ah, type UnlinkNotification as ai, UnlinkNotifyRejection as aj, registerOAuthProvider as ak, getOAuthProvider as al, getRegisteredProviders as am, type RotateKeyResult as b, type OAuthNativeResult as c, type ProfileInfo as d, type VerificationPurpose as e, VERIFICATION_TARGET_TYPES as f, VERIFICATION_PURPOSES as g, PERMISSION_CATEGORIES as h, type PermissionCategory as i, type AuthInitOptions as j, type OAuthProvider as k, type AuthContext as l, mainAuthRouter as m, loginService as n, logoutService as o, changePasswordService as p, type RegisterParams as q, registerService as r, type LoginParams as s, type LogoutParams as t, sendVerificationCodeService as u, verifyCodeService as v, type SendVerificationCodeParams as w, type VerifyCodeParams as x, type VerifyCodeResult as y, registerPublicKeyService as z };
+export { requireEnabledProvider as $, type AuthSession as A, registerPublicKeyService as B, type ChangePasswordParams as C, rotateKeyService as D, revokeKeyService as E, listKeysService as F, revokeAllKeysService as G, KEY_FINGERPRINT_PREFIX_LENGTH as H, type IssueOneTimeTokenResult as I, type RegisterPublicKeyParams as J, type KeySummary as K, type LoginResult as L, type RotateKeyParams as M, type RevokeKeyParams as N, type OAuthStartResult as O, type PermissionConfig as P, type RevokeAllKeysParams as Q, type RoleConfig as R, type SendVerificationCodeResult as S, issueOneTimeTokenService as T, type UserProfile as U, type VerificationTargetType as V, verifyOneTimeTokenService as W, oauthStartService as X, oauthCallbackService as Y, buildOAuthErrorUrl as Z, isOAuthProviderEnabled as _, type RegisterResult as a, getEnabledOAuthProviders as a0, getGoogleAccessToken as a1, oauthUnlinkNotifyService as a2, type OAuthStartParams as a3, type OAuthCallbackParams as a4, type OAuthCallbackResult as a5, type UnlinkNotifyResult as a6, oauthNativeService as a7, type OAuthNativeParams as a8, selectAuthProfile as a9, resolveAuthenticatedUser as aa, type AuthProfileVerifier as ab, authenticate as ac, optionalAuth as ad, EmailSchema as ae, PhoneSchema as af, DeviceNameSchema as ag, PlatformSchema as ah, PasswordSchema as ai, TargetTypeSchema as aj, VerificationPurposeSchema as ak, type NormalizedIdentity as al, type OAuthTokens as am, type NativeVerifyOptions as an, type OAuthCodeExchangeOptions as ao, type UnlinkNotifyRequest as ap, type UnlinkNotification as aq, UnlinkNotifyRejection as ar, registerOAuthProvider as as, getOAuthProvider as at, getRegisteredProviders as au, type RotateKeyResult as b, type RevokeAllKeysResult as c, type OAuthNativeResult as d, type ProfileInfo as e, type VerificationPurpose as f, VERIFICATION_TARGET_TYPES as g, VERIFICATION_PURPOSES as h, PERMISSION_CATEGORIES as i, type PermissionCategory as j, type AuthInitOptions as k, type OAuthProvider as l, mainAuthRouter as m, type AuthContext as n, loginService as o, logoutService as p, changePasswordService as q, registerService as r, type RegisterParams as s, type LoginParams as t, type LogoutParams as u, sendVerificationCodeService as v, verifyCodeService as w, type SendVerificationCodeParams as x, type VerifyCodeParams as y, type VerifyCodeResult as z };

package/dist/client-proof.d.ts

@@ -430,7 +430,7 @@ declare function getClientProofReplayStore(): ClientProofReplayStore;
  */
 
 interface ContractOperation {
-    id: 'auth.clientProof.handshake' | 'echo.send' | 'items.list' | 'auth.enroll.register' | 'auth.enroll.login' | 'auth.enroll.oauthNative' | 'auth.keys.rotate';
+    id: 'auth.clientProof.handshake' | 'echo.send' | 'items.list' | 'auth.enroll.register' | 'auth.enroll.login' | 'auth.enroll.oauthNative' | 'auth.keys.rotate' | 'auth.keys.list' | 'auth.keys.revoke' | 'auth.keys.revokeAll';
     method: 'POST';
     path: string;
     /**

package/dist/client-proof.js

@@ -983,6 +983,36 @@ var AUTH_SURFACE_OPERATIONS = [
     requestType: "RotateKeyRequest",
     responseType: "RotateKeyResponse",
     summary: "Replaces the authenticated key with a new client-generated public key before its TTL runs out."
+  },
+  {
+    id: "auth.keys.list",
+    method: "POST",
+    path: "/_auth/keys/list",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "ListKeysRequest",
+    responseType: "ListKeysResponse",
+    summary: "Lists the keys registered to the caller, one per device that can sign for them."
+  },
+  {
+    id: "auth.keys.revoke",
+    method: "POST",
+    path: "/_auth/keys/revoke",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "RevokeKeyRequest",
+    responseType: "RevokeKeyResponse",
+    summary: "Revokes one of the caller's keys, signing that device out."
+  },
+  {
+    id: "auth.keys.revokeAll",
+    method: "POST",
+    path: "/_auth/keys/revoke-all",
+    authProfile: "clientProofV1",
+    requiresSession: false,
+    requestType: "RevokeAllKeysRequest",
+    responseType: "RevokeAllKeysResponse",
+    summary: "Revokes every key the caller has, sparing the calling device unless asked otherwise."
   }
 ];
 var ContractTypeError = class extends Error {