@stacksjs/auth 0.70.257 → 0.70.259

package/dist/email-verification.js

@@ -1,111 +1,3 @@
-import { Buffer } from "node:buffer";
-import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
-import { config } from "@stacksjs/config";
-import { db, sqlDateTime, parseSqlDateTime } from "@stacksjs/database";
-import { mail, template } from "@stacksjs/email";
-import { log } from "@stacksjs/logging";
-function getVerificationKey() {
-  const appKey = config.app.key;
-  if (typeof appKey !== "string" || appKey.length === 0)
-    throw Error("[auth] config.app.key is not set \u2014 email-verification HMAC requires a real APP_KEY. " + "Run `./buddy key:generate` to provision one, or set the APP_KEY env var before booting the app.");
-  return appKey;
-}
-function generateVerificationToken(userId) {
-  const nonce = randomBytes(32).toString("hex"), payload = `${userId}:${nonce}`, hash = createHmac("sha256", getVerificationKey()).update(payload).digest("hex");
-  return { token: nonce, hash };
-}
-function verifyToken(userId, token, storedHash) {
-  const payload = `${userId}:${token}`, hash = createHmac("sha256", getVerificationKey()).update(payload).digest("hex"), a = Buffer.from(hash), b = Buffer.from(storedHash);
-  if (a.length !== b.length)
-    return !1;
-  return timingSafeEqual(a, b);
-}
-function getExpiryMinutes() {
-  const emailVerification = (config.auth ?? {}).emailVerification;
-  if (emailVerification != null && typeof emailVerification === "object") {
-    const ev = emailVerification;
-    if (typeof ev.expire === "number")
-      return ev.expire;
-  }
-  return 60;
-}
-function getVerificationUrl(userId, token) {
-  const base = config.app.url ? `https://${config.app.url}` : `http://localhost:${process.env.PORT || "3000"}`, filled = (config.auth.emailVerification?.url ?? "/verify-email/{id}/{token}").replace("{id}", String(userId)).replace("{token}", token);
-  return /^https?:\/\//.test(filled) ? filled : `${base}${filled.startsWith("/") ? "" : "/"}${filled}`;
-}
-export function isEmailVerified(user) {
-  return user.email_verified_at != null;
-}
-export async function sendVerificationEmail(user) {
-  const { token, hash } = generateVerificationToken(user.id), expiryMinutes = getExpiryMinutes(), expiresAt = new Date(Date.now() + expiryMinutes * 60 * 1000);
-  await db.deleteFrom("email_verifications").where("user_id", "=", user.id).execute();
-  await db.insertInto("email_verifications").values({
-    user_id: user.id,
-    token: hash,
-    expires_at: sqlDateTime(expiresAt)
-  }).executeTakeFirst();
-  const verificationUrl = getVerificationUrl(user.id, token), appName = config.app.name || "Stacks";
-  try {
-    const { html, text } = await template("email-verification", {
-      subject: `Verify Your ${appName} Email Address`,
-      variables: {
-        verificationUrl,
-        expiryMinutes,
-        userName: user.name || user.email
-      }
-    });
-    if (!html && !text)
-      throw Error("email-verification template missing or rendered empty");
-    await mail.send({
-      to: user.email,
-      subject: `Verify Your ${appName} Email Address`,
-      text,
-      html
-    });
-  } catch (templateError) {
-    const errorMessage = templateError instanceof Error ? templateError.message : String(templateError);
-    log.warn(`[email] Email verification template failed, using plain text fallback: ${errorMessage}`);
-    await mail.send({
-      to: user.email,
-      subject: `Verify Your ${appName} Email Address`,
-      text: `Please verify your email address by visiting: ${verificationUrl}
+import{Buffer}from"node:buffer";import{createHmac,randomBytes,timingSafeEqual}from"node:crypto";import{config}from"@stacksjs/config";import{db,sqlDateTime,parseSqlDateTime}from"@stacksjs/database";import{mail,template}from"@stacksjs/email";import{log}from"@stacksjs/logging";function getVerificationKey(){const appKey=config.app.key;if(typeof appKey!=="string"||appKey.length===0)throw Error("[auth] config.app.key is not set \u2014 email-verification HMAC requires a real APP_KEY. "+"Run `./buddy key:generate` to provision one, or set the APP_KEY env var before booting the app.");return appKey}function generateVerificationToken(userId){const nonce=randomBytes(32).toString("hex"),payload=`${userId}:${nonce}`,hash=createHmac("sha256",getVerificationKey()).update(payload).digest("hex");return{token:nonce,hash}}function verifyToken(userId,token,storedHash){const payload=`${userId}:${token}`,hash=createHmac("sha256",getVerificationKey()).update(payload).digest("hex"),a=Buffer.from(hash),b=Buffer.from(storedHash);if(a.length!==b.length)return!1;return timingSafeEqual(a,b)}function getExpiryMinutes(){const emailVerification=(config.auth??{}).emailVerification;if(emailVerification!=null&&typeof emailVerification==="object"){const ev=emailVerification;if(typeof ev.expire==="number")return ev.expire}return 60}function getVerificationUrl(userId,token){const base=config.app.url?`https://${config.app.url}`:`http://localhost:${process.env.PORT||"3000"}`,filled=(config.auth.emailVerification?.url??"/verify-email/{id}/{token}").replace("{id}",String(userId)).replace("{token}",token);return/^https?:\/\//.test(filled)?filled:`${base}${filled.startsWith("/")?"":"/"}${filled}`}export function isEmailVerified(user){return user.email_verified_at!=null}export async function sendVerificationEmail(user){const{token,hash}=generateVerificationToken(user.id),expiryMinutes=getExpiryMinutes(),expiresAt=new Date(Date.now()+expiryMinutes*60*1000);await db.deleteFrom("email_verifications").where("user_id","=",user.id).execute();await db.insertInto("email_verifications").values({user_id:user.id,token:hash,expires_at:sqlDateTime(expiresAt)}).executeTakeFirst();const verificationUrl=getVerificationUrl(user.id,token),appName=config.app.name||"Stacks";try{const{html,text}=await template("email-verification",{subject:`Verify Your ${appName} Email Address`,variables:{verificationUrl,expiryMinutes,userName:user.name||user.email}});if(!html&&!text)throw Error("email-verification template missing or rendered empty");await mail.send({to:user.email,subject:`Verify Your ${appName} Email Address`,text,html})}catch(templateError){const errorMessage=templateError instanceof Error?templateError.message:String(templateError);log.warn(`[email] Email verification template failed, using plain text fallback: ${errorMessage}`);await mail.send({to:user.email,subject:`Verify Your ${appName} Email Address`,text:`Please verify your email address by visiting: ${verificationUrl}
 
-This link expires in ${expiryMinutes} minutes.`
-    });
-  }
-}
-export async function verifyEmail(userId, token) {
-  const record = await db.selectFrom("email_verifications").where("user_id", "=", userId).selectAll().executeTakeFirst();
-  if (!record)
-    return { success: !1, message: "No verification request found. Please request a new verification email." };
-  const expiresAt = parseSqlDateTime(record.expires_at) ?? new Date(Number.NaN);
-  if (Number.isNaN(expiresAt.getTime()) || new Date > expiresAt) {
-    await db.deleteFrom("email_verifications").where("user_id", "=", userId).execute();
-    return { success: !1, message: "Verification link has expired. Please request a new one." };
-  }
-  if (!verifyToken(userId, token, record.token))
-    return { success: !1, message: "Invalid verification link." };
-  await db.updateTable("users").set({ email_verified_at: sqlDateTime() }).where("id", "=", userId).executeTakeFirst();
-  await db.deleteFrom("email_verifications").where("user_id", "=", userId).execute();
-  return { success: !0, message: "Email verified successfully." };
-}
-export async function resendVerificationEmail(user) {
-  if (isEmailVerified(user))
-    return { success: !1, message: "Email is already verified." };
-  const existing = await db.selectFrom("email_verifications").where("user_id", "=", user.id).selectAll().executeTakeFirst();
-  if (existing) {
-    const createdAt = new Date(existing.created_at), secondsSince = (Date.now() - createdAt.getTime()) / 1000;
-    if (Number.isNaN(secondsSince))
-      return { success: !1, message: "Please wait a moment before requesting another verification email." };
-    if (secondsSince < 60)
-      return { success: !1, message: `Please wait ${Math.ceil(60 - secondsSince)} seconds before requesting another verification email.` };
-  }
-  await sendVerificationEmail(user);
-  return { success: !0, message: "Verification email sent." };
-}
-export const EmailVerification = {
-  isVerified: isEmailVerified,
-  send: sendVerificationEmail,
-  verify: verifyEmail,
-  resend: resendVerificationEmail
-};
+This link expires in ${expiryMinutes} minutes.`})}}export async function verifyEmail(userId,token){const record=await db.selectFrom("email_verifications").where("user_id","=",userId).selectAll().executeTakeFirst();if(!record)return{success:!1,message:"No verification request found. Please request a new verification email."};const expiresAt=parseSqlDateTime(record.expires_at)??new Date(Number.NaN);if(Number.isNaN(expiresAt.getTime())||new Date>expiresAt){await db.deleteFrom("email_verifications").where("user_id","=",userId).execute();return{success:!1,message:"Verification link has expired. Please request a new one."}}if(!verifyToken(userId,token,record.token))return{success:!1,message:"Invalid verification link."};await db.updateTable("users").set({email_verified_at:sqlDateTime()}).where("id","=",userId).executeTakeFirst();await db.deleteFrom("email_verifications").where("user_id","=",userId).execute();return{success:!0,message:"Email verified successfully."}}export async function resendVerificationEmail(user){if(isEmailVerified(user))return{success:!1,message:"Email is already verified."};const existing=await db.selectFrom("email_verifications").where("user_id","=",user.id).selectAll().executeTakeFirst();if(existing){const createdAt=new Date(existing.created_at),secondsSince=(Date.now()-createdAt.getTime())/1000;if(Number.isNaN(secondsSince))return{success:!1,message:"Please wait a moment before requesting another verification email."};if(secondsSince<60)return{success:!1,message:`Please wait ${Math.ceil(60-secondsSince)} seconds before requesting another verification email.`}}await sendVerificationEmail(user);return{success:!0,message:"Verification email sent."}}export const EmailVerification={isVerified:isEmailVerified,send:sendVerificationEmail,verify:verifyEmail,resend:resendVerificationEmail};

package/dist/gate.js

@@ -1,203 +1 @@
-const RESERVED_POLICY_MEMBERS = new Set([
-  "before",
-  "allow",
-  "deny",
-  "denyIf",
-  "denyUnless",
-  "allowIf",
-  "constructor"
-]);
-
-export class AuthorizationResponse {
-  isAllowed;
-  message;
-  code;
-  constructor(allowed, message, code) {
-    this.isAllowed = allowed;
-    this.message = message;
-    this.code = code;
-  }
-  static allow(message) {
-    return new AuthorizationResponse(!0, message);
-  }
-  static deny(message, code) {
-    return new AuthorizationResponse(!1, message || "This action is unauthorized.", code);
-  }
-  allowed() {
-    return this.isAllowed;
-  }
-  denied() {
-    return !this.isAllowed;
-  }
-  authorize() {
-    if (!this.isAllowed)
-      throw new AuthorizationException(this.message || "This action is unauthorized.", this.code);
-  }
-}
-
-export class AuthorizationException extends Error {
-  code;
-  status;
-  constructor(message = "This action is unauthorized.", code, status = 403) {
-    super(message);
-    this.code = code;
-    this.status = status;
-    this.name = "AuthorizationException";
-  }
-}
-const state = {
-  gates: new Map,
-  policies: new Map,
-  beforeCallbacks: [],
-  afterCallbacks: []
-};
-export function define(ability, callback) {
-  state.gates.set(ability, callback);
-}
-export function policy(model, policyClass) {
-  const modelName = typeof model === "string" ? model : model.name;
-  state.policies.set(modelName, policyClass);
-}
-export function before(callback) {
-  state.beforeCallbacks.push(callback);
-}
-export function after(callback) {
-  state.afterCallbacks.push(callback);
-}
-export async function allows(ability, user, ...args) {
-  return check(ability, user, ...args);
-}
-export async function denies(ability, user, ...args) {
-  return !await check(ability, user, ...args);
-}
-export async function can(ability, user, ...args) {
-  return check(ability, user, ...args);
-}
-export async function cannot(ability, user, ...args) {
-  return !await check(ability, user, ...args);
-}
-export async function any(abilities, user, ...args) {
-  for (const ability of abilities)
-    if (await check(ability, user, ...args))
-      return !0;
-  return !1;
-}
-export async function all(abilities, user, ...args) {
-  for (const ability of abilities)
-    if (!await check(ability, user, ...args))
-      return !1;
-  return !0;
-}
-export async function none(abilities, user, ...args) {
-  return !await any(abilities, user, ...args);
-}
-export async function authorize(ability, user, ...args) {
-  const result = await inspect(ability, user, ...args);
-  if (!result.isAllowed)
-    throw new AuthorizationException(result.message, result.code);
-  return result;
-}
-export async function inspect(ability, user, ...args) {
-  let response = null;
-  for (const callback of state.beforeCallbacks) {
-    const beforeResult = await callback(user, ability, args);
-    if (beforeResult === !0) {
-      response = AuthorizationResponse.allow();
-      break;
-    }
-    if (beforeResult === !1) {
-      response = AuthorizationResponse.deny();
-      break;
-    }
-  }
-  if (!response)
-    response = await resolveAbility(ability, user, args);
-  for (const callback of state.afterCallbacks) {
-    const afterResult = await callback(user, ability, response.isAllowed, args);
-    if (typeof afterResult === "boolean")
-      return afterResult ? AuthorizationResponse.allow() : AuthorizationResponse.deny();
-  }
-  return response;
-}
-async function resolveAbility(ability, user, args) {
-  const model = args[0];
-  if (model && typeof model === "object") {
-    const modelName = model.constructor?.name, policyClass = state.policies.get(modelName);
-    if (policyClass) {
-      const policyInstance = new policyClass;
-      if (policyInstance.before) {
-        const beforeResult = await policyInstance.before(user, ability);
-        if (beforeResult === !0)
-          return AuthorizationResponse.allow();
-        if (beforeResult === !1)
-          return AuthorizationResponse.deny();
-      }
-      const method = RESERVED_POLICY_MEMBERS.has(ability) ? void 0 : policyInstance[ability];
-      if (typeof method === "function") {
-        const result = await method.call(policyInstance, user, ...args);
-        return normalizeResponse(result ?? !1);
-      }
-    }
-  }
-  const gate = state.gates.get(ability);
-  if (gate)
-    return normalizeResponse(await gate(user, ...args));
-  return AuthorizationResponse.deny(`No gate or policy defined for ability: ${ability}`);
-}
-async function check(ability, user, ...args) {
-  return (await inspect(ability, user, ...args)).isAllowed;
-}
-function normalizeResponse(result) {
-  if (result instanceof AuthorizationResponse)
-    return result;
-  if (typeof result !== "boolean")
-    throw TypeError(`[gate] Policy must return boolean or AuthorizationResponse; got ${typeof result}. If you returned a model/value by mistake, return \`true\`/\`false\` instead.`);
-  return result ? AuthorizationResponse.allow() : AuthorizationResponse.deny();
-}
-export function getPolicyFor(model) {
-  if (!model || typeof model !== "object")
-    return null;
-  const modelName = model.constructor?.name, policyClass = state.policies.get(modelName);
-  if (policyClass)
-    return new policyClass;
-  return null;
-}
-export function has(ability) {
-  return state.gates.has(ability);
-}
-export function hasPolicy(model) {
-  const modelName = typeof model === "string" ? model : model.name;
-  return state.policies.has(modelName);
-}
-export function abilities() {
-  return Array.from(state.gates.keys());
-}
-export function flush() {
-  state.gates.clear();
-  state.policies.clear();
-  state.beforeCallbacks = [];
-  state.afterCallbacks = [];
-}
-export const Gate = {
-  define,
-  policy,
-  before,
-  after,
-  allows,
-  denies,
-  can,
-  cannot,
-  any,
-  all,
-  none,
-  authorize,
-  inspect,
-  has,
-  hasPolicy,
-  abilities,
-  getPolicyFor,
-  flush,
-  AuthorizationResponse,
-  AuthorizationException
-};
-export default Gate;
+const RESERVED_POLICY_MEMBERS=new Set(["before","allow","deny","denyIf","denyUnless","allowIf","constructor"]);export class AuthorizationResponse{isAllowed;message;code;constructor(allowed,message,code){this.isAllowed=allowed;this.message=message;this.code=code}static allow(message){return new AuthorizationResponse(!0,message)}static deny(message,code){return new AuthorizationResponse(!1,message||"This action is unauthorized.",code)}allowed(){return this.isAllowed}denied(){return!this.isAllowed}authorize(){if(!this.isAllowed)throw new AuthorizationException(this.message||"This action is unauthorized.",this.code)}}export class AuthorizationException extends Error{code;status;constructor(message="This action is unauthorized.",code,status=403){super(message);this.code=code;this.status=status;this.name="AuthorizationException"}}const state={gates:new Map,policies:new Map,beforeCallbacks:[],afterCallbacks:[]};export function define(ability,callback){state.gates.set(ability,callback)}export function policy(model,policyClass){const modelName=typeof model==="string"?model:model.name;state.policies.set(modelName,policyClass)}export function before(callback){state.beforeCallbacks.push(callback)}export function after(callback){state.afterCallbacks.push(callback)}export async function allows(ability,user,...args){return check(ability,user,...args)}export async function denies(ability,user,...args){return!await check(ability,user,...args)}export async function can(ability,user,...args){return check(ability,user,...args)}export async function cannot(ability,user,...args){return!await check(ability,user,...args)}export async function any(abilities,user,...args){for(const ability of abilities)if(await check(ability,user,...args))return!0;return!1}export async function all(abilities,user,...args){for(const ability of abilities)if(!await check(ability,user,...args))return!1;return!0}export async function none(abilities,user,...args){return!await any(abilities,user,...args)}export async function authorize(ability,user,...args){const result=await inspect(ability,user,...args);if(!result.isAllowed)throw new AuthorizationException(result.message,result.code);return result}export async function inspect(ability,user,...args){let response=null;for(const callback of state.beforeCallbacks){const beforeResult=await callback(user,ability,args);if(beforeResult===!0){response=AuthorizationResponse.allow();break}if(beforeResult===!1){response=AuthorizationResponse.deny();break}}if(!response)response=await resolveAbility(ability,user,args);for(const callback of state.afterCallbacks){const afterResult=await callback(user,ability,response.isAllowed,args);if(typeof afterResult==="boolean")return afterResult?AuthorizationResponse.allow():AuthorizationResponse.deny()}return response}async function resolveAbility(ability,user,args){const model=args[0];if(model&&typeof model==="object"){const modelName=model.constructor?.name,policyClass=state.policies.get(modelName);if(policyClass){const policyInstance=new policyClass;if(policyInstance.before){const beforeResult=await policyInstance.before(user,ability);if(beforeResult===!0)return AuthorizationResponse.allow();if(beforeResult===!1)return AuthorizationResponse.deny()}const method=RESERVED_POLICY_MEMBERS.has(ability)?void 0:policyInstance[ability];if(typeof method==="function"){const result=await method.call(policyInstance,user,...args);return normalizeResponse(result??!1)}}}const gate=state.gates.get(ability);if(gate)return normalizeResponse(await gate(user,...args));return AuthorizationResponse.deny(`No gate or policy defined for ability: ${ability}`)}async function check(ability,user,...args){return(await inspect(ability,user,...args)).isAllowed}function normalizeResponse(result){if(result instanceof AuthorizationResponse)return result;if(typeof result!=="boolean")throw TypeError(`[gate] Policy must return boolean or AuthorizationResponse; got ${typeof result}. If you returned a model/value by mistake, return \`true\`/\`false\` instead.`);return result?AuthorizationResponse.allow():AuthorizationResponse.deny()}export function getPolicyFor(model){if(!model||typeof model!=="object")return null;const modelName=model.constructor?.name,policyClass=state.policies.get(modelName);if(policyClass)return new policyClass;return null}export function has(ability){return state.gates.has(ability)}export function hasPolicy(model){const modelName=typeof model==="string"?model:model.name;return state.policies.has(modelName)}export function abilities(){return Array.from(state.gates.keys())}export function flush(){state.gates.clear();state.policies.clear();state.beforeCallbacks=[];state.afterCallbacks=[]}export const Gate={define,policy,before,after,allows,denies,can,cannot,any,all,none,authorize,inspect,has,hasPolicy,abilities,getPolicyFor,flush,AuthorizationResponse,AuthorizationException};export default Gate;

package/dist/index.js

@@ -1,28 +1 @@
-export * from "./authentication";
-export * from "./authenticator";
-export * from "./client";
-export * from "./middleware";
-export * from "./rate-limiter";
-export * from "./passkey";
-export * from "./password/reset";
-export * from "./register";
-export * from "./user";
-export * from "./tokens";
-export * from "./gate";
-export * from "./policy";
-export * from "./authorizable";
-export * from "./permissions";
-export * from "./rbac";
-export { createBqbRbacStore } from "./rbac-store-bqb";
-export { DEFAULT_ROLE_PACKS, seedDefaultRoles } from "./rbac-seed";
-export * from "./email-verification";
-export * from "./session-auth";
-export * from "./cookie-auth";
-export {
-  generateTOTP,
-  verifyTOTP,
-  generateTOTPSecret,
-  totpKeyUri
-} from "@stacksjs/ts-auth";
-export * from "./two-factor";
-export * from "./team";
+export*from"./authentication";export*from"./authenticator";export*from"./client";export*from"./middleware";export*from"./rate-limiter";export*from"./passkey";export*from"./password/reset";export*from"./register";export*from"./user";export*from"./tokens";export*from"./gate";export*from"./policy";export*from"./authorizable";export*from"./permissions";export*from"./rbac";export{createBqbRbacStore}from"./rbac-store-bqb";export{DEFAULT_ROLE_PACKS,seedDefaultRoles}from"./rbac-seed";export*from"./email-verification";export*from"./session-auth";export*from"./cookie-auth";export{generateTOTP,verifyTOTP,generateTOTPSecret,totpKeyUri}from"@stacksjs/ts-auth";export*from"./two-factor";export*from"./team";

package/dist/internal-constants.js

@@ -1 +1 @@
-export const DUMMY_BCRYPT_HASH = "$2b$12$000000000000000000000uGByljkdFkOJRCRiYZGFOAstyLlSgTSW";
+export const DUMMY_BCRYPT_HASH="$2b$12$000000000000000000000uGByljkdFkOJRCRiYZGFOAstyLlSgTSW";

package/dist/middleware.js

@@ -1,28 +1 @@
-import { Auth } from "./authentication";
-export async function authMiddleware(request) {
-  let bearerToken = request.bearerToken?.();
-  if (!bearerToken) {
-    const authHeader = request.headers?.get?.("authorization") || request.headers?.get?.("Authorization");
-    if (authHeader && authHeader.startsWith("Bearer "))
-      bearerToken = authHeader.substring(7);
-  }
-  if (!bearerToken) {
-    const error = Error("No authentication token provided.");
-    error.statusCode = 401;
-    throw error;
-  }
-  const user = await Auth.getUserFromToken(bearerToken);
-  if (!user) {
-    const error = Error("Invalid or expired authentication token.");
-    error.statusCode = 401;
-    throw error;
-  }
-  Auth.setUser(user);
-  request._authenticatedUser = user;
-  const accessToken = await Auth.currentAccessToken();
-  request._currentAccessToken = accessToken;
-}
-export const authMiddlewareHandler = {
-  name: "auth",
-  handle: authMiddleware
-};
+import{Auth}from"./authentication";export async function authMiddleware(request){let bearerToken=request.bearerToken?.();if(!bearerToken){const authHeader=request.headers?.get?.("authorization")||request.headers?.get?.("Authorization");if(authHeader&&authHeader.startsWith("Bearer "))bearerToken=authHeader.substring(7)}if(!bearerToken){const error=Error("No authentication token provided.");error.statusCode=401;throw error}const user=await Auth.getUserFromToken(bearerToken);if(!user){const error=Error("Invalid or expired authentication token.");error.statusCode=401;throw error}Auth.setUser(user);request._authenticatedUser=user;const accessToken=await Auth.currentAccessToken();request._currentAccessToken=accessToken}export const authMiddlewareHandler={name:"auth",handle:authMiddleware};

package/dist/passkey.js

@@ -1,76 +1 @@
-import { Buffer } from "node:buffer";
-import { db, sqlDateTime, parseSqlDateTime } from "@stacksjs/database";
-import { User } from "@stacksjs/orm";
-export {
-  generateRegistrationOptions,
-  generateAuthenticationOptions,
-  verifyRegistrationResponse,
-  verifyAuthenticationResponse,
-  startRegistration,
-  startAuthentication,
-  browserSupportsWebAuthn,
-  browserSupportsWebAuthnAutofill,
-  platformAuthenticatorIsAvailable
-} from "@stacksjs/ts-auth";
-export async function getUserPasskeys(userId) {
-  return await db.selectFrom("passkeys").selectAll().where("user_id", "=", userId).execute();
-}
-export async function getUserPasskey(userId, passkeyId) {
-  return await db.selectFrom("passkeys").selectAll().where("id", "=", passkeyId).where("user_id", "=", userId).executeTakeFirst();
-}
-export async function updatePasskeyCounter(userId, passkeyId, newCounter) {
-  const passkey = await getUserPasskey(userId, passkeyId);
-  if (!passkey)
-    return !1;
-  const stored = Number(passkey.counter ?? 0);
-  if (newCounter <= stored && !(newCounter === 0 && stored === 0))
-    return !1;
-  await db.updateTable("passkeys").set({ counter: newCounter, last_used_at: formatDateTime() }).where("id", "=", passkeyId).where("user_id", "=", userId).execute();
-  return !0;
-}
-export async function setCurrentRegistrationOptions(user, verified) {
-  const credentialId = verified.registrationInfo?.credential.id, credentialPublicKey = verified.registrationInfo?.credential.publicKey;
-  if (!credentialId)
-    throw Error("[auth/passkey] WebAuthn registration response is missing credential.id");
-  if (!credentialPublicKey)
-    throw Error("[auth/passkey] WebAuthn registration response is missing credential.publicKey");
-  const passkeyData = {
-    id: credentialId,
-    cred_public_key: JSON.stringify(credentialPublicKey),
-    user_id: user.id,
-    webauthn_user_id: user.email || "",
-    counter: verified.registrationInfo?.credential.counter || 0,
-    credential_type: verified.registrationInfo?.credentialType || "",
-    device_type: verified.registrationInfo?.credentialDeviceType || "",
-    backup_eligible: !1,
-    backup_status: verified.registrationInfo?.credentialBackedUp || !1,
-    transports: JSON.stringify(["internal"]),
-    last_used_at: formatDateTime()
-  };
-  await db.insertInto("passkeys").values(passkeyData).executeTakeFirstOrThrow();
-}
-function formatDateTime() {
-  const date = new Date, pad = (num) => String(num).padStart(2, "0"), year = date.getFullYear(), month = pad(date.getMonth() + 1), day = pad(date.getDate()), hours = pad(date.getHours()), minutes = pad(date.getMinutes()), seconds = pad(date.getSeconds());
-  return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}`;
-}
-const DEFAULT_CHALLENGE_TTL_SECONDS = 300;
-export async function storeWebAuthnChallenge(userId, challenge, purpose, ttlSeconds = DEFAULT_CHALLENGE_TTL_SECONDS) {
-  const expiresAt = sqlDateTime(new Date(Date.now() + ttlSeconds * 1000)), encodedChallenge = typeof challenge === "string" ? challenge : Buffer.from(challenge).toString("base64url");
-  await db.deleteFrom("webauthn_challenges").where("user_id", "=", userId).where("purpose", "=", purpose).execute();
-  await db.insertInto("webauthn_challenges").values({
-    user_id: userId,
-    challenge: encodedChallenge,
-    purpose,
-    expires_at: expiresAt
-  }).execute();
-}
-export async function consumeWebAuthnChallenge(userId, purpose) {
-  const row = await db.selectFrom("webauthn_challenges").where("user_id", "=", userId).where("purpose", "=", purpose).selectAll().executeTakeFirst();
-  if (!row)
-    return null;
-  await db.deleteFrom("webauthn_challenges").where("user_id", "=", userId).where("purpose", "=", purpose).execute();
-  const expiresAt = parseSqlDateTime(row.expires_at)?.getTime() ?? 0;
-  if (Date.now() > expiresAt)
-    return null;
-  return Buffer.from(String(row.challenge), "base64url");
-}
+import{Buffer}from"node:buffer";import{db,sqlDateTime,parseSqlDateTime}from"@stacksjs/database";import{User}from"@stacksjs/orm";export{generateRegistrationOptions,generateAuthenticationOptions,verifyRegistrationResponse,verifyAuthenticationResponse,startRegistration,startAuthentication,browserSupportsWebAuthn,browserSupportsWebAuthnAutofill,platformAuthenticatorIsAvailable}from"@stacksjs/ts-auth";export async function getUserPasskeys(userId){return await db.selectFrom("passkeys").selectAll().where("user_id","=",userId).execute()}export async function getUserPasskey(userId,passkeyId){return await db.selectFrom("passkeys").selectAll().where("id","=",passkeyId).where("user_id","=",userId).executeTakeFirst()}export async function updatePasskeyCounter(userId,passkeyId,newCounter){const passkey=await getUserPasskey(userId,passkeyId);if(!passkey)return!1;const stored=Number(passkey.counter??0);if(newCounter<=stored&&!(newCounter===0&&stored===0))return!1;await db.updateTable("passkeys").set({counter:newCounter,last_used_at:formatDateTime()}).where("id","=",passkeyId).where("user_id","=",userId).execute();return!0}export async function setCurrentRegistrationOptions(user,verified){const credentialId=verified.registrationInfo?.credential.id,credentialPublicKey=verified.registrationInfo?.credential.publicKey;if(!credentialId)throw Error("[auth/passkey] WebAuthn registration response is missing credential.id");if(!credentialPublicKey)throw Error("[auth/passkey] WebAuthn registration response is missing credential.publicKey");const passkeyData={id:credentialId,cred_public_key:JSON.stringify(credentialPublicKey),user_id:user.id,webauthn_user_id:user.email||"",counter:verified.registrationInfo?.credential.counter||0,credential_type:verified.registrationInfo?.credentialType||"",device_type:verified.registrationInfo?.credentialDeviceType||"",backup_eligible:!1,backup_status:verified.registrationInfo?.credentialBackedUp||!1,transports:JSON.stringify(["internal"]),last_used_at:formatDateTime()};await db.insertInto("passkeys").values(passkeyData).executeTakeFirstOrThrow()}function formatDateTime(){const date=new Date,pad=(num)=>String(num).padStart(2,"0"),year=date.getFullYear(),month=pad(date.getMonth()+1),day=pad(date.getDate()),hours=pad(date.getHours()),minutes=pad(date.getMinutes()),seconds=pad(date.getSeconds());return`${year}-${month}-${day} ${hours}:${minutes}:${seconds}`}const DEFAULT_CHALLENGE_TTL_SECONDS=300;export async function storeWebAuthnChallenge(userId,challenge,purpose,ttlSeconds=DEFAULT_CHALLENGE_TTL_SECONDS){const expiresAt=sqlDateTime(new Date(Date.now()+ttlSeconds*1000)),encodedChallenge=typeof challenge==="string"?challenge:Buffer.from(challenge).toString("base64url");await db.deleteFrom("webauthn_challenges").where("user_id","=",userId).where("purpose","=",purpose).execute();await db.insertInto("webauthn_challenges").values({user_id:userId,challenge:encodedChallenge,purpose,expires_at:expiresAt}).execute()}export async function consumeWebAuthnChallenge(userId,purpose){const row=await db.selectFrom("webauthn_challenges").where("user_id","=",userId).where("purpose","=",purpose).selectAll().executeTakeFirst();if(!row)return null;await db.deleteFrom("webauthn_challenges").where("user_id","=",userId).where("purpose","=",purpose).execute();const expiresAt=parseSqlDateTime(row.expires_at)?.getTime()??0;if(Date.now()>expiresAt)return null;return Buffer.from(String(row.challenge),"base64url")}

package/dist/password/reset.js

@@ -1,156 +1,3 @@
-import { randomBytes } from "node:crypto";
-import { config } from "@stacksjs/config";
-import { db, sqlDateTime } from "@stacksjs/database";
-import { mail, template } from "@stacksjs/email";
-import { log } from "@stacksjs/logging";
-import { formatDate } from "@stacksjs/orm";
-import { makeHash, verifyHash } from "@stacksjs/security";
-import { sessionDestroyAll } from "../session-auth";
-import { revokeAllTokens } from "../tokens";
-function getTokenExpireMinutes() {
-  return config.auth.passwordReset?.expire ?? 60;
-}
-function isWithinExpiry(row) {
-  const explicit = row.expires_at;
-  if (typeof explicit === "string" || explicit instanceof Date)
-    return new Date(explicit).getTime() > Date.now();
-  const created = row.created_at;
-  if (typeof created === "string" || created instanceof Date) {
-    const expireMinutes = getTokenExpireMinutes();
-    return new Date(created).getTime() + expireMinutes * 60000 > Date.now();
-  }
-  return !1;
-}
-async function sendPasswordChangedNotification(userEmail) {
-  const appName = config.app.name || "Stacks", supportEmail = config.app.supportEmail || config.email?.from?.address || "", changedAt = new Date().toLocaleString("en-US", {
-    dateStyle: "full",
-    timeStyle: "short"
-  });
-  try {
-    const { html, text } = await template("password-changed", {
-      subject: `Your ${appName} password has been changed`,
-      variables: {
-        changedAt,
-        supportEmail
-      }
-    });
-    if (!html && !text) {
-      await mail.send({
-        to: userEmail,
-        subject: `Your ${appName} password has been changed`,
-        text: `Your ${appName} password was changed on ${changedAt}.${supportEmail ? ` If this wasn't you, contact ${supportEmail}.` : ""}`
-      });
-      return;
-    }
-    await mail.send({
-      to: userEmail,
-      subject: `Your ${appName} password has been changed`,
-      text,
-      html
-    });
-  } catch (error) {
-    console.error("[PasswordReset] Failed to send password changed notification:", error);
-  }
-}
-export function passwordResets(email) {
-  function generateResetToken() {
-    return randomBytes(32).toString("hex");
-  }
-  async function createResetToken() {
-    const token = generateResetToken(), hashedToken = await makeHash(token, { algorithm: "bcrypt" }), expireMinutes = getTokenExpireMinutes(), expiresAt = sqlDateTime(new Date(Date.now() + expireMinutes * 60000));
-    await db.deleteFrom("password_resets").where("email", "=", email).execute();
-    await db.insertInto("password_resets").values({
-      email,
-      token: hashedToken,
-      expires_at: expiresAt
-    }).executeTakeFirst();
-    return token;
-  }
-  async function sendEmail() {
-    if (!await db.selectFrom("users").where("email", "=", email).selectAll().executeTakeFirst())
-      return;
-    const token = await createResetToken(), expireMinutes = getTokenExpireMinutes(), appName = config.app.name || "Stacks", base = config.app.url ? `https://${config.app.url}` : `http://localhost:${process.env.PORT || "3000"}`, filled = (config.auth.passwordReset?.url ?? "/password/reset/{token}?email={email}").replace("{token}", token).replace("{email}", encodeURIComponent(email)), resetUrl = /^https?:\/\//.test(filled) ? filled : `${base}${filled.startsWith("/") ? "" : "/"}${filled}`;
-    try {
-      const { html, text } = await template("password-reset", {
-        subject: `Reset Your ${appName} Password`,
-        variables: {
-          resetUrl,
-          expireMinutes
-        }
-      });
-      if (!html && !text)
-        throw Error("password-reset template missing or rendered empty");
-      await mail.send({
-        to: email,
-        subject: `Reset Your ${appName} Password`,
-        text,
-        html
-      });
-    } catch (templateError) {
-      const msg = templateError instanceof Error ? templateError.message : String(templateError);
-      console.warn(`[PasswordReset] template render failed, sending plain-text fallback: ${msg}`);
-      await mail.send({
-        to: email,
-        subject: `Reset Your ${appName} Password`,
-        text: `Reset your password by visiting: ${resetUrl}
+import{randomBytes}from"node:crypto";import{config}from"@stacksjs/config";import{db,sqlDateTime}from"@stacksjs/database";import{mail,template}from"@stacksjs/email";import{log}from"@stacksjs/logging";import{formatDate}from"@stacksjs/orm";import{makeHash,verifyHash}from"@stacksjs/security";import{sessionDestroyAll}from"../session-auth";import{revokeAllTokens}from"../tokens";function getTokenExpireMinutes(){return config.auth.passwordReset?.expire??60}function isWithinExpiry(row){const explicit=row.expires_at;if(typeof explicit==="string"||explicit instanceof Date)return new Date(explicit).getTime()>Date.now();const created=row.created_at;if(typeof created==="string"||created instanceof Date){const expireMinutes=getTokenExpireMinutes();return new Date(created).getTime()+expireMinutes*60000>Date.now()}return!1}async function sendPasswordChangedNotification(userEmail){const appName=config.app.name||"Stacks",supportEmail=config.app.supportEmail||config.email?.from?.address||"",changedAt=new Date().toLocaleString("en-US",{dateStyle:"full",timeStyle:"short"});try{const{html,text}=await template("password-changed",{subject:`Your ${appName} password has been changed`,variables:{changedAt,supportEmail}});if(!html&&!text){await mail.send({to:userEmail,subject:`Your ${appName} password has been changed`,text:`Your ${appName} password was changed on ${changedAt}.${supportEmail?` If this wasn't you, contact ${supportEmail}.`:""}`});return}await mail.send({to:userEmail,subject:`Your ${appName} password has been changed`,text,html})}catch(error){console.error("[PasswordReset] Failed to send password changed notification:",error)}}export function passwordResets(email){function generateResetToken(){return randomBytes(32).toString("hex")}async function createResetToken(){const token=generateResetToken(),hashedToken=await makeHash(token,{algorithm:"bcrypt"}),expireMinutes=getTokenExpireMinutes(),expiresAt=sqlDateTime(new Date(Date.now()+expireMinutes*60000));await db.deleteFrom("password_resets").where("email","=",email).execute();await db.insertInto("password_resets").values({email,token:hashedToken,expires_at:expiresAt}).executeTakeFirst();return token}async function sendEmail(){if(!await db.selectFrom("users").where("email","=",email).selectAll().executeTakeFirst())return;const token=await createResetToken(),expireMinutes=getTokenExpireMinutes(),appName=config.app.name||"Stacks",base=config.app.url?`https://${config.app.url}`:`http://localhost:${process.env.PORT||"3000"}`,filled=(config.auth.passwordReset?.url??"/password/reset/{token}?email={email}").replace("{token}",token).replace("{email}",encodeURIComponent(email)),resetUrl=/^https?:\/\//.test(filled)?filled:`${base}${filled.startsWith("/")?"":"/"}${filled}`;try{const{html,text}=await template("password-reset",{subject:`Reset Your ${appName} Password`,variables:{resetUrl,expireMinutes}});if(!html&&!text)throw Error("password-reset template missing or rendered empty");await mail.send({to:email,subject:`Reset Your ${appName} Password`,text,html})}catch(templateError){const msg=templateError instanceof Error?templateError.message:String(templateError);console.warn(`[PasswordReset] template render failed, sending plain-text fallback: ${msg}`);await mail.send({to:email,subject:`Reset Your ${appName} Password`,text:`Reset your password by visiting: ${resetUrl}
 
-This link expires in ${expireMinutes} minutes. If you didn't request this, you can safely ignore this email.`
-      });
-    }
-  }
-  async function verifyToken(token) {
-    const result = await db.selectFrom("password_resets").where("email", "=", email).selectAll().executeTakeFirst();
-    if (!result)
-      return !1;
-    if (!isWithinExpiry(result)) {
-      await db.deleteFrom("password_resets").where("email", "=", email).execute();
-      return !1;
-    }
-    const hashedToken = result.token;
-    return await verifyHash(token, hashedToken);
-  }
-  async function resetPassword(token, newPassword) {
-    const result = await db.transaction(async (rawTrx) => {
-      const trx = rawTrx, resetRecord = await trx.selectFrom("password_resets").where("email", "=", email).selectAll().executeTakeFirst();
-      if (!resetRecord)
-        return { success: !1, message: "Invalid or expired reset token" };
-      if (!isWithinExpiry(resetRecord)) {
-        await trx.deleteFrom("password_resets").where("email", "=", email).execute();
-        return { success: !1, message: "This password reset link has expired. Please request a new one." };
-      }
-      const hashedToken = resetRecord.token;
-      if (!await verifyHash(token, hashedToken))
-        return { success: !1, message: "Invalid or expired reset token" };
-      const user = await trx.selectFrom("users").where("email", "=", email).selectAll().executeTakeFirst();
-      if (!user)
-        return { success: !1, message: "Invalid or expired reset token" };
-      const hashedPassword = await makeHash(newPassword, { algorithm: "bcrypt" });
-      try {
-        await trx.updateTable("users").set({ password: hashedPassword, password_changed_at: formatDate(new Date) }).where("email", "=", email).executeTakeFirst();
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (/password_changed_at|no such column|unknown column/i.test(message)) {
-          log.warn("[PasswordReset] password_changed_at column missing \u2014 run `buddy migrate`; resetting without the credential-version stamp");
-          await trx.updateTable("users").set({ password: hashedPassword }).where("email", "=", email).executeTakeFirst();
-        } else
-          throw err;
-      }
-      await trx.deleteFrom("password_resets").where("email", "=", email).execute();
-      return { success: !0, userId: Number(user.id) };
-    });
-    if (result.success) {
-      await revokeAllTokens(result.userId);
-      await sessionDestroyAll(result.userId);
-      sendPasswordChangedNotification(email).catch((err) => {
-        console.error("[PasswordReset] Failed to send notification:", err);
-      });
-      return { success: !0 };
-    }
-    return result;
-  }
-  return {
-    sendEmail,
-    verifyToken,
-    resetPassword
-  };
-}
+This link expires in ${expireMinutes} minutes. If you didn't request this, you can safely ignore this email.`})}}async function verifyToken(token){const result=await db.selectFrom("password_resets").where("email","=",email).selectAll().executeTakeFirst();if(!result)return!1;if(!isWithinExpiry(result)){await db.deleteFrom("password_resets").where("email","=",email).execute();return!1}const hashedToken=result.token;return await verifyHash(token,hashedToken)}async function resetPassword(token,newPassword){const result=await db.transaction(async(rawTrx)=>{const trx=rawTrx,resetRecord=await trx.selectFrom("password_resets").where("email","=",email).selectAll().executeTakeFirst();if(!resetRecord)return{success:!1,message:"Invalid or expired reset token"};if(!isWithinExpiry(resetRecord)){await trx.deleteFrom("password_resets").where("email","=",email).execute();return{success:!1,message:"This password reset link has expired. Please request a new one."}}const hashedToken=resetRecord.token;if(!await verifyHash(token,hashedToken))return{success:!1,message:"Invalid or expired reset token"};const user=await trx.selectFrom("users").where("email","=",email).selectAll().executeTakeFirst();if(!user)return{success:!1,message:"Invalid or expired reset token"};const hashedPassword=await makeHash(newPassword,{algorithm:"bcrypt"});try{await trx.updateTable("users").set({password:hashedPassword,password_changed_at:formatDate(new Date)}).where("email","=",email).executeTakeFirst()}catch(err){const message=err instanceof Error?err.message:String(err);if(/password_changed_at|no such column|unknown column/i.test(message)){log.warn("[PasswordReset] password_changed_at column missing \u2014 run `buddy migrate`; resetting without the credential-version stamp");await trx.updateTable("users").set({password:hashedPassword}).where("email","=",email).executeTakeFirst()}else throw err}await trx.deleteFrom("password_resets").where("email","=",email).execute();return{success:!0,userId:Number(user.id)}});if(result.success){await revokeAllTokens(result.userId);await sessionDestroyAll(result.userId);sendPasswordChangedNotification(email).catch((err)=>{console.error("[PasswordReset] Failed to send notification:",err)});return{success:!0}}return result}return{sendEmail,verifyToken,resetPassword}}