@spfn/auth 0.2.0-beta.9 → 0.2.1

package/dist/config.d.ts

@@ -31,7 +31,7 @@ declare const authEnvSchema: {
         description: string;
         required: boolean;
         fallbackKeys: string[];
-        validator: _spfn_core_env.Parser<string>;
+        validator: _spfn_core_env.Parser<string> & ((value: string) => string);
         sensitive: boolean;
         nextjs: boolean;
         examples: string[];
@@ -46,6 +46,7 @@ declare const authEnvSchema: {
         nextjs: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_SESSION_TTL";
     };
@@ -55,6 +56,7 @@ declare const authEnvSchema: {
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_JWT_SECRET";
     };
@@ -64,9 +66,20 @@ declare const authEnvSchema: {
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_JWT_EXPIRES_IN";
     };
+    SPFN_AUTH_COOKIE_SECURE: {
+        description: string;
+        required: boolean;
+        nextjs: boolean;
+        examples: boolean[];
+        type: "boolean";
+        validator: (value: string) => boolean;
+    } & {
+        key: "SPFN_AUTH_COOKIE_SECURE";
+    };
     SPFN_AUTH_BCRYPT_SALT_ROUNDS: {
         key: string;
         description: string;
@@ -83,6 +96,7 @@ declare const authEnvSchema: {
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_VERIFICATION_TOKEN_SECRET";
     };
@@ -91,6 +105,7 @@ declare const authEnvSchema: {
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_ADMIN_ACCOUNTS";
     };
@@ -99,6 +114,7 @@ declare const authEnvSchema: {
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_ADMIN_EMAILS";
     };
@@ -107,6 +123,7 @@ declare const authEnvSchema: {
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_ADMIN_PASSWORDS";
     };
@@ -115,6 +132,7 @@ declare const authEnvSchema: {
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_ADMIN_ROLES";
     };
@@ -123,96 +141,144 @@ declare const authEnvSchema: {
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_ADMIN_EMAIL";
     };
     SPFN_AUTH_ADMIN_PASSWORD: {
         description: string;
         required: boolean;
-        validator: _spfn_core_env.Parser<string>;
+        validator: _spfn_core_env.Parser<string> & ((value: string) => string);
         sensitive: boolean;
         examples: string[];
         type: "string";
     } & {
         key: "SPFN_AUTH_ADMIN_PASSWORD";
     };
+    SPFN_AUTH_RESERVED_USERNAMES: {
+        description: string;
+        required: boolean;
+        default: string;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_RESERVED_USERNAMES";
+    };
+    SPFN_AUTH_USERNAME_MIN_LENGTH: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_USERNAME_MIN_LENGTH";
+    };
+    SPFN_AUTH_USERNAME_MAX_LENGTH: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_USERNAME_MAX_LENGTH";
+    };
     SPFN_API_URL: {
         description: string;
         default: string;
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_API_URL";
     };
-    SPFN_AUTH_AWS_REGION: {
+    NEXT_PUBLIC_SPFN_API_URL: {
         description: string;
-        default: string;
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_REGION";
+        key: "NEXT_PUBLIC_SPFN_API_URL";
     };
-    SPFN_AUTH_AWS_SNS_ACCESS_KEY_ID: {
+    SPFN_APP_URL: {
         description: string;
+        default: string;
         required: boolean;
-        sensitive: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SNS_ACCESS_KEY_ID";
+        key: "SPFN_APP_URL";
     };
-    SPFN_AUTH_AWS_SNS_SECRET_ACCESS_KEY: {
+    NEXT_PUBLIC_SPFN_APP_URL: {
         description: string;
         required: boolean;
-        sensitive: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SNS_SECRET_ACCESS_KEY";
+        key: "NEXT_PUBLIC_SPFN_APP_URL";
     };
-    SPFN_AUTH_AWS_SNS_SENDER_ID: {
+    SPFN_AUTH_GOOGLE_CLIENT_ID: {
         description: string;
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SNS_SENDER_ID";
+        key: "SPFN_AUTH_GOOGLE_CLIENT_ID";
     };
-    SPFN_AUTH_AWS_SES_ACCESS_KEY_ID: {
+    SPFN_AUTH_GOOGLE_CLIENT_SECRET: {
         description: string;
         required: boolean;
         sensitive: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SES_ACCESS_KEY_ID";
+        key: "SPFN_AUTH_GOOGLE_CLIENT_SECRET";
     };
-    SPFN_AUTH_AWS_SES_SECRET_ACCESS_KEY: {
+    SPFN_AUTH_GOOGLE_SCOPES: {
+        description: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_GOOGLE_SCOPES";
+    };
+    SPFN_AUTH_GOOGLE_REDIRECT_URI: {
         description: string;
         required: boolean;
-        sensitive: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SES_SECRET_ACCESS_KEY";
+        key: "SPFN_AUTH_GOOGLE_REDIRECT_URI";
     };
-    SPFN_AUTH_AWS_SES_FROM_EMAIL: {
+    SPFN_AUTH_OAUTH_SUCCESS_URL: {
         description: string;
         required: boolean;
+        default: string;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SES_FROM_EMAIL";
+        key: "SPFN_AUTH_OAUTH_SUCCESS_URL";
     };
-    SPFN_AUTH_AWS_SES_FROM_NAME: {
+    SPFN_AUTH_OAUTH_ERROR_URL: {
         description: string;
         required: boolean;
+        default: string;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SES_FROM_NAME";
+        key: "SPFN_AUTH_OAUTH_ERROR_URL";
     };
 };
 
@@ -221,7 +287,7 @@ declare const env: _spfn_core_env.InferEnvType<{
         description: string;
         required: boolean;
         fallbackKeys: string[];
-        validator: _spfn_core_env.Parser<string>;
+        validator: _spfn_core_env.Parser<string> & ((value: string) => string);
         sensitive: boolean;
         nextjs: boolean;
         examples: string[];
@@ -236,6 +302,7 @@ declare const env: _spfn_core_env.InferEnvType<{
         nextjs: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_SESSION_TTL";
     };
@@ -245,6 +312,7 @@ declare const env: _spfn_core_env.InferEnvType<{
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_JWT_SECRET";
     };
@@ -254,9 +322,20 @@ declare const env: _spfn_core_env.InferEnvType<{
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_JWT_EXPIRES_IN";
     };
+    SPFN_AUTH_COOKIE_SECURE: {
+        description: string;
+        required: boolean;
+        nextjs: boolean;
+        examples: boolean[];
+        type: "boolean";
+        validator: (value: string) => boolean;
+    } & {
+        key: "SPFN_AUTH_COOKIE_SECURE";
+    };
     SPFN_AUTH_BCRYPT_SALT_ROUNDS: {
         key: string;
         description: string;
@@ -273,6 +352,7 @@ declare const env: _spfn_core_env.InferEnvType<{
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_VERIFICATION_TOKEN_SECRET";
     };
@@ -281,6 +361,7 @@ declare const env: _spfn_core_env.InferEnvType<{
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_ADMIN_ACCOUNTS";
     };
@@ -289,6 +370,7 @@ declare const env: _spfn_core_env.InferEnvType<{
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_ADMIN_EMAILS";
     };
@@ -297,6 +379,7 @@ declare const env: _spfn_core_env.InferEnvType<{
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_ADMIN_PASSWORDS";
     };
@@ -305,6 +388,7 @@ declare const env: _spfn_core_env.InferEnvType<{
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_ADMIN_ROLES";
     };
@@ -313,96 +397,144 @@ declare const env: _spfn_core_env.InferEnvType<{
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_AUTH_ADMIN_EMAIL";
     };
     SPFN_AUTH_ADMIN_PASSWORD: {
         description: string;
         required: boolean;
-        validator: _spfn_core_env.Parser<string>;
+        validator: _spfn_core_env.Parser<string> & ((value: string) => string);
         sensitive: boolean;
         examples: string[];
         type: "string";
     } & {
         key: "SPFN_AUTH_ADMIN_PASSWORD";
     };
+    SPFN_AUTH_RESERVED_USERNAMES: {
+        description: string;
+        required: boolean;
+        default: string;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_RESERVED_USERNAMES";
+    };
+    SPFN_AUTH_USERNAME_MIN_LENGTH: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_USERNAME_MIN_LENGTH";
+    };
+    SPFN_AUTH_USERNAME_MAX_LENGTH: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_USERNAME_MAX_LENGTH";
+    };
     SPFN_API_URL: {
         description: string;
         default: string;
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
         key: "SPFN_API_URL";
     };
-    SPFN_AUTH_AWS_REGION: {
+    NEXT_PUBLIC_SPFN_API_URL: {
         description: string;
-        default: string;
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_REGION";
+        key: "NEXT_PUBLIC_SPFN_API_URL";
     };
-    SPFN_AUTH_AWS_SNS_ACCESS_KEY_ID: {
+    SPFN_APP_URL: {
         description: string;
+        default: string;
         required: boolean;
-        sensitive: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SNS_ACCESS_KEY_ID";
+        key: "SPFN_APP_URL";
     };
-    SPFN_AUTH_AWS_SNS_SECRET_ACCESS_KEY: {
+    NEXT_PUBLIC_SPFN_APP_URL: {
         description: string;
         required: boolean;
-        sensitive: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SNS_SECRET_ACCESS_KEY";
+        key: "NEXT_PUBLIC_SPFN_APP_URL";
     };
-    SPFN_AUTH_AWS_SNS_SENDER_ID: {
+    SPFN_AUTH_GOOGLE_CLIENT_ID: {
         description: string;
         required: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SNS_SENDER_ID";
+        key: "SPFN_AUTH_GOOGLE_CLIENT_ID";
     };
-    SPFN_AUTH_AWS_SES_ACCESS_KEY_ID: {
+    SPFN_AUTH_GOOGLE_CLIENT_SECRET: {
         description: string;
         required: boolean;
         sensitive: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SES_ACCESS_KEY_ID";
+        key: "SPFN_AUTH_GOOGLE_CLIENT_SECRET";
     };
-    SPFN_AUTH_AWS_SES_SECRET_ACCESS_KEY: {
+    SPFN_AUTH_GOOGLE_SCOPES: {
+        description: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_GOOGLE_SCOPES";
+    };
+    SPFN_AUTH_GOOGLE_REDIRECT_URI: {
         description: string;
         required: boolean;
-        sensitive: boolean;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SES_SECRET_ACCESS_KEY";
+        key: "SPFN_AUTH_GOOGLE_REDIRECT_URI";
     };
-    SPFN_AUTH_AWS_SES_FROM_EMAIL: {
+    SPFN_AUTH_OAUTH_SUCCESS_URL: {
         description: string;
         required: boolean;
+        default: string;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SES_FROM_EMAIL";
+        key: "SPFN_AUTH_OAUTH_SUCCESS_URL";
     };
-    SPFN_AUTH_AWS_SES_FROM_NAME: {
+    SPFN_AUTH_OAUTH_ERROR_URL: {
         description: string;
         required: boolean;
+        default: string;
         examples: string[];
         type: "string";
+        validator: (value: string) => string;
     } & {
-        key: "SPFN_AUTH_AWS_SES_FROM_NAME";
+        key: "SPFN_AUTH_OAUTH_ERROR_URL";
     };
 }>;
 

package/dist/config.js

@@ -6,6 +6,7 @@ import {
   defineEnvSchema,
   envString,
   envNumber,
+  envBoolean,
   createSecureSecretParser,
   createPasswordParser
 } from "@spfn/core/env";
@@ -67,6 +68,14 @@ var authEnvSchema = defineEnvSchema({
   // ============================================================================
   // Security Configuration
   // ============================================================================
+  SPFN_AUTH_COOKIE_SECURE: {
+    ...envBoolean({
+      description: 'Override cookie Secure flag. Defaults to NODE_ENV === "production". Set to false for HTTP-only environments (e.g. bastion over plain HTTP).',
+      required: false,
+      nextjs: true,
+      examples: [true, false]
+    })
+  },
   SPFN_AUTH_BCRYPT_SALT_ROUNDS: {
     ...envNumber({
       description: "Bcrypt salt rounds (cost factor, higher = more secure but slower)",
@@ -152,11 +161,41 @@ var authEnvSchema = defineEnvSchema({
     })
   },
   // ============================================================================
+  // Username Configuration
+  // ============================================================================
+  SPFN_AUTH_RESERVED_USERNAMES: {
+    ...envString({
+      description: "Comma-separated list of reserved usernames that cannot be registered",
+      required: false,
+      default: "admin,root,system,support,help,moderator,superadmin",
+      examples: [
+        "admin,root,system,support,help",
+        "admin,root,system,support,help,moderator,superadmin,operator"
+      ]
+    })
+  },
+  SPFN_AUTH_USERNAME_MIN_LENGTH: {
+    ...envNumber({
+      description: "Minimum username length",
+      default: 3,
+      required: false,
+      examples: [2, 3, 4]
+    })
+  },
+  SPFN_AUTH_USERNAME_MAX_LENGTH: {
+    ...envNumber({
+      description: "Maximum username length",
+      default: 30,
+      required: false,
+      examples: [20, 30, 50]
+    })
+  },
+  // ============================================================================
   // API Configuration
   // ============================================================================
   SPFN_API_URL: {
     ...envString({
-      description: "Base API URL for invitation links and other external-facing URLs",
+      description: "Internal API URL for server-to-server communication",
       default: "http://localhost:8790",
       required: false,
       examples: [
@@ -165,71 +204,96 @@ var authEnvSchema = defineEnvSchema({
       ]
     })
   },
-  // ============================================================================
-  // AWS SNS Configuration (SMS)
-  // ============================================================================
-  SPFN_AUTH_AWS_REGION: {
+  NEXT_PUBLIC_SPFN_API_URL: {
     ...envString({
-      description: "AWS region for SNS service",
-      default: "ap-northeast-2",
+      description: "Public-facing API URL used for browser-facing redirects (e.g. OAuth callback). Falls back to SPFN_API_URL if not set.",
       required: false,
-      examples: ["ap-northeast-2", "us-east-1", "eu-west-1"]
+      examples: [
+        "https://api.example.com",
+        "http://localhost:8790"
+      ]
     })
   },
-  SPFN_AUTH_AWS_SNS_ACCESS_KEY_ID: {
+  SPFN_APP_URL: {
     ...envString({
-      description: "AWS SNS access key ID (optional, uses default credentials chain if not provided)",
+      description: "Next.js application URL (internal). Used for server-to-server communication.",
+      default: "http://localhost:3000",
       required: false,
-      sensitive: true,
-      examples: ["AKIAIOSFODNN7EXAMPLE"]
+      examples: [
+        "https://app.example.com",
+        "http://localhost:3000"
+      ]
     })
   },
-  SPFN_AUTH_AWS_SNS_SECRET_ACCESS_KEY: {
+  NEXT_PUBLIC_SPFN_APP_URL: {
     ...envString({
-      description: "AWS SNS secret access key (optional, uses default credentials chain if not provided)",
+      description: "Public-facing Next.js app URL for browser redirects (e.g. OAuth redirect). Falls back to SPFN_APP_URL if not set.",
       required: false,
-      sensitive: true,
-      examples: ["wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"]
+      examples: [
+        "https://app.example.com",
+        "http://localhost:3000"
+      ]
     })
   },
-  SPFN_AUTH_AWS_SNS_SENDER_ID: {
+  // ============================================================================
+  // OAuth Configuration - Google
+  // ============================================================================
+  SPFN_AUTH_GOOGLE_CLIENT_ID: {
     ...envString({
-      description: "SMS sender ID displayed to recipients (max 11 characters, alphanumeric)",
+      description: "Google OAuth 2.0 Client ID. When set, Google OAuth routes are automatically enabled.",
       required: false,
-      examples: ["MyApp", "YourBrand"]
+      examples: ["123456789-abc123.apps.googleusercontent.com"]
     })
   },
-  // ============================================================================
-  // AWS SES Configuration (Email)
-  // ============================================================================
-  SPFN_AUTH_AWS_SES_ACCESS_KEY_ID: {
+  SPFN_AUTH_GOOGLE_CLIENT_SECRET: {
     ...envString({
-      description: "AWS SES access key ID (optional, uses default credentials chain if not provided)",
+      description: "Google OAuth 2.0 Client Secret",
       required: false,
       sensitive: true,
-      examples: ["AKIAIOSFODNN7EXAMPLE"]
+      examples: ["GOCSPX-abcdefghijklmnop"]
     })
   },
-  SPFN_AUTH_AWS_SES_SECRET_ACCESS_KEY: {
+  SPFN_AUTH_GOOGLE_SCOPES: {
     ...envString({
-      description: "AWS SES secret access key (optional, uses default credentials chain if not provided)",
+      description: 'Comma-separated Google OAuth scopes. Defaults to "email,profile" if not set.',
       required: false,
-      sensitive: true,
-      examples: ["wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"]
+      examples: [
+        "email,profile",
+        "email,profile,https://www.googleapis.com/auth/gmail.readonly",
+        "email,profile,https://www.googleapis.com/auth/calendar.readonly"
+      ]
+    })
+  },
+  SPFN_AUTH_GOOGLE_REDIRECT_URI: {
+    ...envString({
+      description: "Google OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_API_URL || SPFN_API_URL}/_auth/oauth/google/callback",
+      required: false,
+      examples: [
+        "https://api.example.com/_auth/oauth/google/callback",
+        "http://localhost:8790/_auth/oauth/google/callback"
+      ]
     })
   },
-  SPFN_AUTH_AWS_SES_FROM_EMAIL: {
+  SPFN_AUTH_OAUTH_SUCCESS_URL: {
     ...envString({
-      description: "Sender email address (must be verified in AWS SES)",
+      description: "OAuth callback page URL. This page should use OAuthCallback component to finalize session.",
       required: false,
-      examples: ["noreply@example.com", "auth@yourdomain.com"]
+      default: "/auth/callback",
+      examples: [
+        "/auth/callback",
+        "https://app.example.com/auth/callback"
+      ]
     })
   },
-  SPFN_AUTH_AWS_SES_FROM_NAME: {
+  SPFN_AUTH_OAUTH_ERROR_URL: {
     ...envString({
-      description: "Sender display name",
+      description: "URL to redirect after OAuth error. Use {error} placeholder for error message.",
       required: false,
-      examples: ["MyApp", "Your Company"]
+      default: "/auth/error?error={error}",
+      examples: [
+        "https://app.example.com/auth/error?error={error}",
+        "http://localhost:3000/auth/error?error={error}"
+      ]
     })
   }
 });