@spfn/auth 0.2.0-beta.9 → 0.2.0-beta.91

package/dist/index.js

@@ -15,7 +15,8 @@ import {
   ValidationError,
   UnauthorizedError,
   ForbiddenError,
-  ConflictError
+  ConflictError,
+  NotFoundError
 } from "@spfn/core/errors";
 var InvalidCredentialsError = class extends UnauthorizedError {
   constructor(data = {}) {
@@ -29,6 +30,12 @@ var InvalidTokenError = class extends UnauthorizedError {
     this.name = "InvalidTokenError";
   }
 };
+var InvalidSocialTokenError = class extends UnauthorizedError {
+  constructor(data = {}) {
+    super({ message: data.message || "Invalid social id_token", details: data.details });
+    this.name = "InvalidSocialTokenError";
+  }
+};
 var TokenExpiredError = class extends UnauthorizedError {
   constructor(data = {}) {
     super({ message: data.message || "Authentication token has expired", details: data.details });
@@ -51,6 +58,33 @@ var AccountDisabledError = class extends ForbiddenError {
     this.name = "AccountDisabledError";
   }
 };
+var AccountPendingDeletionError = class extends ForbiddenError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Account is scheduled for deletion",
+      details: { status: "pending_deletion", purgeScheduledAt: data.purgeScheduledAt, ...data.details }
+    });
+    this.name = "AccountPendingDeletionError";
+  }
+};
+var DeletionAlreadyRequestedError = class extends ConflictError {
+  constructor(data = {}) {
+    super({ message: data.message || "Account deletion has already been requested", details: data.details });
+    this.name = "DeletionAlreadyRequestedError";
+  }
+};
+var DeletionNotRequestedError = class extends NotFoundError {
+  constructor(data = {}) {
+    super({ message: data.message || "No pending account deletion request found", details: data.details });
+    this.name = "DeletionNotRequestedError";
+  }
+};
+var ImmediateDeletionNotAllowedError = class extends ForbiddenError {
+  constructor(data = {}) {
+    super({ message: data.message || "Immediate self-service deletion is not enabled", details: data.details });
+    this.name = "ImmediateDeletionNotAllowedError";
+  }
+};
 var AccountAlreadyExistsError = class extends ConflictError {
   constructor(data = {}) {
     super({
@@ -64,6 +98,12 @@ var AccountAlreadyExistsError = class extends ConflictError {
     this.name = "AccountAlreadyExistsError";
   }
 };
+var RegistrationRejectedError = class extends ForbiddenError {
+  constructor(data = {}) {
+    super({ message: data.message || "Registration rejected", details: data.details });
+    this.name = "RegistrationRejectedError";
+  }
+};
 var InvalidVerificationCodeError = class extends ValidationError {
   constructor(data = {}) {
     super({ message: data.message || "Invalid verification code", details: data.details });
@@ -76,12 +116,54 @@ var InvalidVerificationTokenError = class extends ValidationError {
     this.name = "InvalidVerificationTokenError";
   }
 };
+var KeyIdAlreadyRegisteredError = class extends ConflictError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This keyId is already registered. Generate a new keyId and retry.",
+      details: data.details
+    });
+    this.name = "KeyIdAlreadyRegisteredError";
+  }
+};
 var InvalidKeyFingerprintError = class extends ValidationError {
   constructor(data = {}) {
     super({ message: data.message || "Invalid key fingerprint", details: data.details });
     this.name = "InvalidKeyFingerprintError";
   }
 };
+var KeyNotFoundError = class extends NotFoundError {
+  constructor(data = {}) {
+    super({ message: data.message || "Key not found", details: data.details });
+    this.name = "KeyNotFoundError";
+  }
+};
+var NonceKeyBindingError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "nonce must be the fingerprint of the submitted public key",
+      details: data.details
+    });
+    this.name = "NonceKeyBindingError";
+  }
+};
+var NativeSignInUnsupportedError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This provider does not support native id_token sign-in.",
+      details: data.details
+    });
+    this.name = "NativeSignInUnsupportedError";
+  }
+};
+var UnverifiedEmailLinkError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Cannot link to existing account with unverified email. Please verify your email with the provider first.",
+      details: data.details
+    });
+    this.name = "UnverifiedEmailLinkError";
+  }
+};
 var VerificationTokenPurposeMismatchError = class extends ValidationError {
   constructor(data = {}) {
     const expected = data.expected || "unknown";
@@ -102,6 +184,24 @@ var VerificationTokenTargetMismatchError = class extends ValidationError {
     this.name = "VerificationTokenTargetMismatchError";
   }
 };
+var ReservedUsernameError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "This username is reserved",
+      details: { username: data.username, ...data.details }
+    });
+    this.name = "ReservedUsernameError";
+  }
+};
+var UsernameAlreadyTakenError = class extends ConflictError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Username is already taken",
+      details: { username: data.username, ...data.details }
+    });
+    this.name = "UsernameAlreadyTakenError";
+  }
+};
 var InsufficientPermissionsError = class extends ForbiddenError {
   constructor(data = {}) {
     const requiredPermissions = data.requiredPermissions || [];
@@ -128,19 +228,79 @@ var authErrorRegistry = new ErrorRegistry();
 authErrorRegistry.append([
   InvalidCredentialsError,
   InvalidTokenError,
+  InvalidSocialTokenError,
   TokenExpiredError,
   KeyExpiredError,
   AccountDisabledError,
+  AccountPendingDeletionError,
+  DeletionAlreadyRequestedError,
+  DeletionNotRequestedError,
+  ImmediateDeletionNotAllowedError,
   AccountAlreadyExistsError,
+  RegistrationRejectedError,
+  ReservedUsernameError,
+  UsernameAlreadyTakenError,
   InvalidVerificationCodeError,
   InvalidVerificationTokenError,
   InvalidKeyFingerprintError,
+  NonceKeyBindingError,
+  NativeSignInUnsupportedError,
+  UnverifiedEmailLinkError,
+  KeyNotFoundError,
+  KeyIdAlreadyRegisteredError,
   VerificationTokenPurposeMismatchError,
   VerificationTokenTargetMismatchError,
   InsufficientPermissionsError,
   InsufficientRoleError
 ]);
 
+// src/generated/route-map.ts
+var routeMap = {
+  sendVerificationCode: { method: "POST", path: "/_auth/codes" },
+  verifyCode: { method: "POST", path: "/_auth/codes/verify" },
+  register: { method: "POST", path: "/_auth/register" },
+  login: { method: "POST", path: "/_auth/login" },
+  logout: { method: "POST", path: "/_auth/logout" },
+  rotateKey: { method: "POST", path: "/_auth/keys/rotate" },
+  listKeys: { method: "POST", path: "/_auth/keys/list" },
+  revokeKey: { method: "POST", path: "/_auth/keys/revoke" },
+  revokeAllKeys: { method: "POST", path: "/_auth/keys/revoke-all" },
+  changePassword: { method: "PUT", path: "/_auth/password" },
+  getAuthSession: { method: "GET", path: "/_auth/session" },
+  issueOneTimeToken: { method: "POST", path: "/_auth/tokens" },
+  getInvitation: { method: "GET", path: "/_auth/invitations/:token" },
+  acceptInvitation: { method: "POST", path: "/_auth/invitations/accept" },
+  createInvitation: { method: "POST", path: "/_auth/invitations" },
+  listInvitations: { method: "GET", path: "/_auth/invitations" },
+  cancelInvitation: { method: "POST", path: "/_auth/invitations/cancel" },
+  resendInvitation: { method: "POST", path: "/_auth/invitations/resend" },
+  deleteInvitation: { method: "POST", path: "/_auth/invitations/delete" },
+  getUserProfile: { method: "GET", path: "/_auth/users/profile" },
+  updateUserProfile: { method: "PATCH", path: "/_auth/users/profile" },
+  checkUsername: { method: "GET", path: "/_auth/users/username/check" },
+  updateUsername: { method: "PATCH", path: "/_auth/users/username" },
+  updateLocale: { method: "PATCH", path: "/_auth/users/locale" },
+  oauthGoogleStart: { method: "GET", path: "/_auth/oauth/google" },
+  oauthGoogleCallback: { method: "GET", path: "/_auth/oauth/google/callback" },
+  oauthStart: { method: "POST", path: "/_auth/oauth/start" },
+  oauthProviders: { method: "GET", path: "/_auth/oauth/providers" },
+  getGoogleOAuthUrl: { method: "POST", path: "/_auth/oauth/google/url" },
+  oauthFinalize: { method: "POST", path: "/_auth/oauth/finalize" },
+  oauthProviderStart: { method: "GET", path: "/_auth/oauth/:provider" },
+  oauthProviderCallback: { method: "GET", path: "/_auth/oauth/:provider/callback" },
+  getProviderOAuthUrl: { method: "POST", path: "/_auth/oauth/:provider/url" },
+  oauthNative: { method: "POST", path: "/_auth/oauth/:provider/native" },
+  oauthUnlinkNotify: { method: "POST", path: "/_auth/oauth/:provider/unlink-notify" },
+  oauthUnlinkNotifyGet: { method: "GET", path: "/_auth/oauth/:provider/unlink-notify" },
+  listRoles: { method: "GET", path: "/_auth/admin/roles" },
+  createAdminRole: { method: "POST", path: "/_auth/admin/roles" },
+  updateAdminRole: { method: "PATCH", path: "/_auth/admin/roles/:id" },
+  deleteAdminRole: { method: "DELETE", path: "/_auth/admin/roles/:id" },
+  updateUserRole: { method: "PATCH", path: "/_auth/admin/users/:userId/role" },
+  requestAccountDeletion: { method: "POST", path: "/_auth/deletion/request" },
+  cancelAccountDeletion: { method: "POST", path: "/_auth/deletion/cancel" }
+};
+
 // src/lib/types.ts
 var EMAIL_PATTERN = "^[a-zA-Z0-9._-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$";
 var PHONE_PATTERN = "^\\+[1-9]\\d{1,14}$";
@@ -274,9 +434,14 @@ var BUILTIN_ROLE_PERMISSIONS = {
 
 // src/server/types.ts
 var KEY_ALGORITHM = ["ES256", "RS256"];
+var KEY_PLATFORM = ["ios", "android", "web", "desktop"];
+var KEY_DEVICE_NAME_MAX_LENGTH = 64;
 var INVITATION_STATUSES = ["pending", "accepted", "expired", "cancelled"];
-var USER_STATUSES = ["active", "inactive", "suspended"];
-var SOCIAL_PROVIDERS = ["google", "github", "kakao", "naver"];
+var USER_STATUSES = ["active", "inactive", "suspended", "pending_deletion", "deleted"];
+var SOCIAL_PROVIDERS = ["google", "apple", "github", "kakao", "naver", "superself"];
+var ACCOUNT_DELETION_REQUEST_STATUSES = ["pending", "cancelled", "completed"];
+var ACCOUNT_DELETION_REQUESTED_BY = ["self", "admin"];
+var PURGE_STRATEGIES = ["anonymize", "hard-delete"];
 
 // ../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/guard/value.mjs
 var value_exports = {};
@@ -2899,9 +3064,18 @@ var PhoneSchema = Type.String({
   pattern: PHONE_PATTERN2,
   description: "Phone number in E.164 format (e.g., +821012345678)"
 });
+var DeviceNameSchema = Type.String({
+  maxLength: KEY_DEVICE_NAME_MAX_LENGTH,
+  description: `Device label shown in the key list (max ${KEY_DEVICE_NAME_MAX_LENGTH} chars)`
+});
+var PlatformSchema = Type.Union(
+  KEY_PLATFORM.map((platform) => Type.Literal(platform)),
+  { description: "Platform the key lives on" }
+);
 var PasswordSchema = Type.String({
   minLength: 8,
-  description: "User password (minimum 8 characters)"
+  maxLength: 72,
+  description: "User password (8\u201372 characters). bcrypt silently ignores bytes past 72, so longer inputs are rejected rather than truncated."
 });
 var TargetTypeSchema = Type.Union([
   Type.Literal("email"),
@@ -2915,17 +3089,20 @@ var VerificationPurposeSchema = Type.Union([
   Type.Literal("login"),
   Type.Literal("password_reset"),
   Type.Literal("email_change"),
-  Type.Literal("phone_change")
+  Type.Literal("phone_change"),
+  Type.Literal("account_deletion")
 ], {
   description: "Purpose of verification"
 });
-var VERIFICATION_PURPOSES = ["registration", "login", "password_reset", "email_change", "phone_change"];
+var VERIFICATION_PURPOSES = ["registration", "login", "password_reset", "email_change", "phone_change", "account_deletion"];
 
 // src/index.ts
 var authApi = createApi({
   errorRegistry: [authErrorRegistry]
 });
 export {
+  ACCOUNT_DELETION_REQUESTED_BY,
+  ACCOUNT_DELETION_REQUEST_STATUSES,
   BASE64_PATTERN,
   BUILTIN_PERMISSIONS,
   BUILTIN_ROLES,
@@ -2936,11 +3113,13 @@ export {
   KEY_ALGORITHM,
   PERMISSION_CATEGORIES,
   PHONE_PATTERN,
+  PURGE_STRATEGIES,
   SOCIAL_PROVIDERS,
   USER_STATUSES,
   UUID_PATTERN,
   VERIFICATION_PURPOSES,
   VERIFICATION_TARGET_TYPES,
-  authApi
+  authApi,
+  routeMap as authRouteMap
 };
 //# sourceMappingURL=index.js.map