@stacksjs/auth 0.70.258 → 0.70.260

package/dist/rbac.js

@@ -1,326 +1 @@
-var {require}=import.meta;class BoundedMap {
-  max;
-  map = new Map;
-  constructor(max) {
-    this.max = max;
-  }
-  get(key) {
-    return this.map.get(key);
-  }
-  has(key) {
-    return this.map.has(key);
-  }
-  set(key, value) {
-    if (this.map.has(key))
-      this.map.delete(key);
-    this.map.set(key, value);
-    if (this.map.size > this.max) {
-      const oldest = this.map.keys().next().value;
-      if (oldest !== void 0)
-        this.map.delete(oldest);
-    }
-    return this;
-  }
-  delete(key) {
-    return this.map.delete(key);
-  }
-  clear() {
-    this.map.clear();
-  }
-}
-const RBAC_USER_CACHE_MAX = 1e4, cache = {
-  userRoles: new BoundedMap(RBAC_USER_CACHE_MAX),
-  userPermissions: new BoundedMap(RBAC_USER_CACHE_MAX),
-  rolePermissions: new BoundedMap(RBAC_USER_CACHE_MAX),
-  roles: new Map,
-  permissions: new Map
-};
-let store = null;
-export function setRbacStore(rbacStore) {
-  store = rbacStore;
-  flushRbacCache();
-}
-function getStore() {
-  if (!store) {
-    const { createBqbRbacStore } = require("./rbac-store-bqb");
-    store = createBqbRbacStore();
-  }
-  return store;
-}
-export function flushRbacCache() {
-  cache.userRoles.clear();
-  cache.userPermissions.clear();
-  cache.rolePermissions.clear();
-  cache.roles.clear();
-  cache.permissions.clear();
-}
-function getUserId(user) {
-  if (typeof user === "number") {
-    if (!Number.isFinite(user) || user <= 0)
-      throw TypeError("RBAC user id must be a positive number");
-    return user;
-  }
-  const id = user.id;
-  if (typeof id !== "number" || !Number.isFinite(id) || id <= 0)
-    throw TypeError(`RBAC user id must be a positive number, got ${typeof id} (${String(id)})`);
-  return id;
-}
-export async function createRole(name, guardName = "web", description) {
-  const role = await getStore().createRole(name, guardName, description);
-  cache.roles.set(`${name}:${guardName}`, role);
-  return role;
-}
-export async function findRole(name, guardName = "web") {
-  const cacheKey = `${name}:${guardName}`;
-  if (cache.roles.has(cacheKey))
-    return cache.roles.get(cacheKey);
-  const role = await getStore().findRoleByName(name, guardName);
-  if (role)
-    cache.roles.set(cacheKey, role);
-  return role;
-}
-export async function deleteRole(name, guardName = "web") {
-  const role = await findRole(name, guardName);
-  if (role) {
-    await getStore().deleteRole(role.id);
-    cache.roles.delete(`${name}:${guardName}`);
-    flushRbacCache();
-  }
-}
-export async function getAllRoles(guardName) {
-  return getStore().getAllRoles(guardName);
-}
-export async function createPermission(name, guardName = "web", description) {
-  const permission = await getStore().createPermission(name, guardName, description);
-  cache.permissions.set(`${name}:${guardName}`, permission);
-  return permission;
-}
-export async function findPermission(name, guardName = "web") {
-  const cacheKey = `${name}:${guardName}`;
-  if (cache.permissions.has(cacheKey))
-    return cache.permissions.get(cacheKey);
-  const permission = await getStore().findPermissionByName(name, guardName);
-  if (permission)
-    cache.permissions.set(cacheKey, permission);
-  return permission;
-}
-export async function deletePermission(name, guardName = "web") {
-  const permission = await findPermission(name, guardName);
-  if (permission) {
-    await getStore().deletePermission(permission.id);
-    cache.permissions.delete(`${name}:${guardName}`);
-    flushRbacCache();
-  }
-}
-export async function getAllPermissions(guardName) {
-  return getStore().getAllPermissions(guardName);
-}
-export async function getUserRoles(user) {
-  const userId = getUserId(user);
-  if (cache.userRoles.has(userId))
-    return cache.userRoles.get(userId);
-  const roles = await getStore().getUserRoles(userId);
-  cache.userRoles.set(userId, roles);
-  return roles;
-}
-export async function assignRole(user, roleName, guardName = "web") {
-  const userId = getUserId(user), role = await findRole(roleName, guardName);
-  if (!role)
-    throw Error(`Role '${roleName}' not found.`);
-  await getStore().assignRoleToUser(userId, role.id);
-  cache.userRoles.delete(userId);
-  cache.userPermissions.delete(userId);
-}
-export async function removeRole(user, roleName, guardName = "web") {
-  const userId = getUserId(user), role = await findRole(roleName, guardName);
-  if (!role)
-    return;
-  await getStore().removeRoleFromUser(userId, role.id);
-  cache.userRoles.delete(userId);
-  cache.userPermissions.delete(userId);
-}
-export async function removeAllRoles(user) {
-  const userId = getUserId(user);
-  await getStore().removeAllRolesFromUser(userId);
-  cache.userRoles.delete(userId);
-  cache.userPermissions.delete(userId);
-}
-export async function syncRoles(user, roleNames, guardName = "web") {
-  const userId = getUserId(user), preservedRoleIds = (await getUserRoles(userId)).filter((role) => role.guard_name !== guardName).map((role) => role.id), roleIds = [];
-  for (const name of new Set(roleNames)) {
-    const role = await findRole(name, guardName);
-    if (!role)
-      throw Error(`Role '${name}' not found.`);
-    roleIds.push(role.id);
-  }
-  await getStore().syncUserRoles(userId, [...preservedRoleIds, ...roleIds]);
-  cache.userRoles.delete(userId);
-  cache.userPermissions.delete(userId);
-}
-export async function hasRole(user, roleName, guardName = "web") {
-  return (await getUserRoles(user)).some((r) => r.name === roleName && r.guard_name === guardName);
-}
-export async function hasAnyRole(user, roleNames, guardName = "web") {
-  const roles = await getUserRoles(user);
-  return roleNames.some((name) => roles.some((r) => r.name === name && r.guard_name === guardName));
-}
-export async function hasAllRoles(user, roleNames, guardName = "web") {
-  const roles = await getUserRoles(user);
-  return roleNames.every((name) => roles.some((r) => r.name === name && r.guard_name === guardName));
-}
-export async function getUserPermissions(user) {
-  const userId = getUserId(user);
-  if (cache.userPermissions.has(userId))
-    return cache.userPermissions.get(userId);
-  const directPermissions = await getStore().getUserDirectPermissions(userId), roles = await getUserRoles(user), rolePermissions = [];
-  for (const role of roles) {
-    const perms = await getRolePermissions(role.id);
-    rolePermissions.push(...perms);
-  }
-  const seen = new Set, allPermissions = [];
-  for (const perm of [...directPermissions, ...rolePermissions])
-    if (!seen.has(perm.id)) {
-      seen.add(perm.id);
-      allPermissions.push(perm);
-    }
-  cache.userPermissions.set(userId, allPermissions);
-  return allPermissions;
-}
-export async function givePermission(user, permissionName, guardName = "web") {
-  const userId = getUserId(user), permission = await findPermission(permissionName, guardName);
-  if (!permission)
-    throw Error(`Permission '${permissionName}' not found.`);
-  await getStore().assignPermissionToUser(userId, permission.id);
-  cache.userPermissions.delete(userId);
-}
-export async function revokePermission(user, permissionName, guardName = "web") {
-  const userId = getUserId(user), permission = await findPermission(permissionName, guardName);
-  if (!permission)
-    return;
-  await getStore().removePermissionFromUser(userId, permission.id);
-  cache.userPermissions.delete(userId);
-}
-export async function revokeAllPermissions(user) {
-  const userId = getUserId(user);
-  await getStore().removeAllPermissionsFromUser(userId);
-  cache.userPermissions.delete(userId);
-}
-export async function syncPermissions(user, permissionNames, guardName = "web") {
-  const userId = getUserId(user), preservedPermissionIds = (await getStore().getUserDirectPermissions(userId)).filter((permission) => permission.guard_name !== guardName).map((permission) => permission.id), permissionIds = [];
-  for (const name of new Set(permissionNames)) {
-    const perm = await findPermission(name, guardName);
-    if (!perm)
-      throw Error(`Permission '${name}' not found.`);
-    permissionIds.push(perm.id);
-  }
-  await getStore().syncUserPermissions(userId, [...preservedPermissionIds, ...permissionIds]);
-  cache.userPermissions.delete(userId);
-}
-export async function hasPermission(user, permissionName, guardName = "web") {
-  return (await getUserPermissions(user)).some((p) => p.name === permissionName && p.guard_name === guardName);
-}
-export async function hasAnyPermission(user, permissionNames, guardName = "web") {
-  const permissions = await getUserPermissions(user);
-  return permissionNames.some((name) => permissions.some((p) => p.name === name && p.guard_name === guardName));
-}
-export async function hasAllPermissions(user, permissionNames, guardName = "web") {
-  const permissions = await getUserPermissions(user);
-  return permissionNames.every((name) => permissions.some((p) => p.name === name && p.guard_name === guardName));
-}
-export async function getRolePermissions(roleId) {
-  if (cache.rolePermissions.has(roleId))
-    return cache.rolePermissions.get(roleId);
-  const permissions = await getStore().getRolePermissions(roleId);
-  cache.rolePermissions.set(roleId, permissions);
-  return permissions;
-}
-export async function givePermissionToRole(roleName, permissionName, guardName = "web") {
-  const role = await findRole(roleName, guardName);
-  if (!role)
-    throw Error(`Role '${roleName}' not found.`);
-  const permission = await findPermission(permissionName, guardName);
-  if (!permission)
-    throw Error(`Permission '${permissionName}' not found.`);
-  await getStore().assignPermissionToRole(role.id, permission.id);
-  cache.rolePermissions.delete(role.id);
-  cache.userPermissions.clear();
-}
-export async function revokePermissionFromRole(roleName, permissionName, guardName = "web") {
-  const role = await findRole(roleName, guardName);
-  if (!role)
-    return;
-  const permission = await findPermission(permissionName, guardName);
-  if (!permission)
-    return;
-  await getStore().removePermissionFromRole(role.id, permission.id);
-  cache.rolePermissions.delete(role.id);
-  cache.userPermissions.clear();
-}
-export async function syncRolePermissions(roleName, permissionNames, guardName = "web") {
-  const role = await findRole(roleName, guardName);
-  if (!role)
-    throw Error(`Role '${roleName}' not found.`);
-  const permissionIds = [];
-  for (const name of permissionNames) {
-    const perm = await findPermission(name, guardName);
-    if (!perm)
-      throw Error(`Permission '${name}' not found.`);
-    permissionIds.push(perm.id);
-  }
-  await getStore().syncRolePermissions(role.id, permissionIds);
-  cache.rolePermissions.delete(role.id);
-  cache.userPermissions.clear();
-}
-export function withRbac(user) {
-  const userId = getUserId(user);
-  return Object.assign(user, {
-    hasRole: (roleName, guardName) => hasRole(userId, roleName, guardName),
-    hasAnyRole: (roleNames, guardName) => hasAnyRole(userId, roleNames, guardName),
-    hasAllRoles: (roleNames, guardName) => hasAllRoles(userId, roleNames, guardName),
-    hasPermission: (permissionName, guardName) => hasPermission(userId, permissionName, guardName),
-    hasAnyPermission: (permissionNames, guardName) => hasAnyPermission(userId, permissionNames, guardName),
-    hasAllPermissions: (permissionNames, guardName) => hasAllPermissions(userId, permissionNames, guardName),
-    getRoles: () => getUserRoles(userId),
-    getPermissions: () => getUserPermissions(userId),
-    assignRole: (roleName, guardName) => assignRole(userId, roleName, guardName),
-    removeRole: (roleName, guardName) => removeRole(userId, roleName, guardName),
-    syncRoles: (roleNames, guardName) => syncRoles(userId, roleNames, guardName),
-    givePermission: (permissionName, guardName) => givePermission(userId, permissionName, guardName),
-    revokePermission: (permissionName, guardName) => revokePermission(userId, permissionName, guardName),
-    syncPermissions: (permissionNames, guardName) => syncPermissions(userId, permissionNames, guardName)
-  });
-}
-export const Rbac = {
-  setStore: setRbacStore,
-  flushCache: flushRbacCache,
-  createRole,
-  findRole,
-  deleteRole,
-  getAllRoles,
-  createPermission,
-  findPermission,
-  deletePermission,
-  getAllPermissions,
-  getUserRoles,
-  assignRole,
-  removeRole,
-  removeAllRoles,
-  syncRoles,
-  hasRole,
-  hasAnyRole,
-  hasAllRoles,
-  getUserPermissions,
-  givePermission,
-  revokePermission,
-  revokeAllPermissions,
-  syncPermissions,
-  hasPermission,
-  hasAnyPermission,
-  hasAllPermissions,
-  getRolePermissions,
-  givePermissionToRole,
-  revokePermissionFromRole,
-  syncRolePermissions,
-  withRbac
-};
-export default Rbac;
+var {require}=import.meta;class BoundedMap{max;map=new Map;constructor(max){this.max=max}get(key){return this.map.get(key)}has(key){return this.map.has(key)}set(key,value){if(this.map.has(key))this.map.delete(key);this.map.set(key,value);if(this.map.size>this.max){const oldest=this.map.keys().next().value;if(oldest!==void 0)this.map.delete(oldest)}return this}delete(key){return this.map.delete(key)}clear(){this.map.clear()}}const RBAC_USER_CACHE_MAX=1e4,cache={userRoles:new BoundedMap(RBAC_USER_CACHE_MAX),userPermissions:new BoundedMap(RBAC_USER_CACHE_MAX),rolePermissions:new BoundedMap(RBAC_USER_CACHE_MAX),roles:new Map,permissions:new Map};let store=null;export function setRbacStore(rbacStore){store=rbacStore;flushRbacCache()}function getStore(){if(!store){const{createBqbRbacStore}=require("./rbac-store-bqb");store=createBqbRbacStore()}return store}export function flushRbacCache(){cache.userRoles.clear();cache.userPermissions.clear();cache.rolePermissions.clear();cache.roles.clear();cache.permissions.clear()}function getUserId(user){if(typeof user==="number"){if(!Number.isFinite(user)||user<=0)throw TypeError("RBAC user id must be a positive number");return user}const id=user.id;if(typeof id!=="number"||!Number.isFinite(id)||id<=0)throw TypeError(`RBAC user id must be a positive number, got ${typeof id} (${String(id)})`);return id}export async function createRole(name,guardName="web",description){const role=await getStore().createRole(name,guardName,description);cache.roles.set(`${name}:${guardName}`,role);return role}export async function findRole(name,guardName="web"){const cacheKey=`${name}:${guardName}`;if(cache.roles.has(cacheKey))return cache.roles.get(cacheKey);const role=await getStore().findRoleByName(name,guardName);if(role)cache.roles.set(cacheKey,role);return role}export async function deleteRole(name,guardName="web"){const role=await findRole(name,guardName);if(role){await getStore().deleteRole(role.id);cache.roles.delete(`${name}:${guardName}`);flushRbacCache()}}export async function getAllRoles(guardName){return getStore().getAllRoles(guardName)}export async function createPermission(name,guardName="web",description){const permission=await getStore().createPermission(name,guardName,description);cache.permissions.set(`${name}:${guardName}`,permission);return permission}export async function findPermission(name,guardName="web"){const cacheKey=`${name}:${guardName}`;if(cache.permissions.has(cacheKey))return cache.permissions.get(cacheKey);const permission=await getStore().findPermissionByName(name,guardName);if(permission)cache.permissions.set(cacheKey,permission);return permission}export async function deletePermission(name,guardName="web"){const permission=await findPermission(name,guardName);if(permission){await getStore().deletePermission(permission.id);cache.permissions.delete(`${name}:${guardName}`);flushRbacCache()}}export async function getAllPermissions(guardName){return getStore().getAllPermissions(guardName)}export async function getUserRoles(user){const userId=getUserId(user);if(cache.userRoles.has(userId))return cache.userRoles.get(userId);const roles=await getStore().getUserRoles(userId);cache.userRoles.set(userId,roles);return roles}export async function assignRole(user,roleName,guardName="web"){const userId=getUserId(user),role=await findRole(roleName,guardName);if(!role)throw Error(`Role '${roleName}' not found.`);await getStore().assignRoleToUser(userId,role.id);cache.userRoles.delete(userId);cache.userPermissions.delete(userId)}export async function removeRole(user,roleName,guardName="web"){const userId=getUserId(user),role=await findRole(roleName,guardName);if(!role)return;await getStore().removeRoleFromUser(userId,role.id);cache.userRoles.delete(userId);cache.userPermissions.delete(userId)}export async function removeAllRoles(user){const userId=getUserId(user);await getStore().removeAllRolesFromUser(userId);cache.userRoles.delete(userId);cache.userPermissions.delete(userId)}export async function syncRoles(user,roleNames,guardName="web"){const userId=getUserId(user),preservedRoleIds=(await getUserRoles(userId)).filter((role)=>role.guard_name!==guardName).map((role)=>role.id),roleIds=[];for(const name of new Set(roleNames)){const role=await findRole(name,guardName);if(!role)throw Error(`Role '${name}' not found.`);roleIds.push(role.id)}await getStore().syncUserRoles(userId,[...preservedRoleIds,...roleIds]);cache.userRoles.delete(userId);cache.userPermissions.delete(userId)}export async function hasRole(user,roleName,guardName="web"){return(await getUserRoles(user)).some((r)=>r.name===roleName&&r.guard_name===guardName)}export async function hasAnyRole(user,roleNames,guardName="web"){const roles=await getUserRoles(user);return roleNames.some((name)=>roles.some((r)=>r.name===name&&r.guard_name===guardName))}export async function hasAllRoles(user,roleNames,guardName="web"){const roles=await getUserRoles(user);return roleNames.every((name)=>roles.some((r)=>r.name===name&&r.guard_name===guardName))}export async function getUserPermissions(user){const userId=getUserId(user);if(cache.userPermissions.has(userId))return cache.userPermissions.get(userId);const directPermissions=await getStore().getUserDirectPermissions(userId),roles=await getUserRoles(user),rolePermissions=[];for(const role of roles){const perms=await getRolePermissions(role.id);rolePermissions.push(...perms)}const seen=new Set,allPermissions=[];for(const perm of[...directPermissions,...rolePermissions])if(!seen.has(perm.id)){seen.add(perm.id);allPermissions.push(perm)}cache.userPermissions.set(userId,allPermissions);return allPermissions}export async function givePermission(user,permissionName,guardName="web"){const userId=getUserId(user),permission=await findPermission(permissionName,guardName);if(!permission)throw Error(`Permission '${permissionName}' not found.`);await getStore().assignPermissionToUser(userId,permission.id);cache.userPermissions.delete(userId)}export async function revokePermission(user,permissionName,guardName="web"){const userId=getUserId(user),permission=await findPermission(permissionName,guardName);if(!permission)return;await getStore().removePermissionFromUser(userId,permission.id);cache.userPermissions.delete(userId)}export async function revokeAllPermissions(user){const userId=getUserId(user);await getStore().removeAllPermissionsFromUser(userId);cache.userPermissions.delete(userId)}export async function syncPermissions(user,permissionNames,guardName="web"){const userId=getUserId(user),preservedPermissionIds=(await getStore().getUserDirectPermissions(userId)).filter((permission)=>permission.guard_name!==guardName).map((permission)=>permission.id),permissionIds=[];for(const name of new Set(permissionNames)){const perm=await findPermission(name,guardName);if(!perm)throw Error(`Permission '${name}' not found.`);permissionIds.push(perm.id)}await getStore().syncUserPermissions(userId,[...preservedPermissionIds,...permissionIds]);cache.userPermissions.delete(userId)}export async function hasPermission(user,permissionName,guardName="web"){return(await getUserPermissions(user)).some((p)=>p.name===permissionName&&p.guard_name===guardName)}export async function hasAnyPermission(user,permissionNames,guardName="web"){const permissions=await getUserPermissions(user);return permissionNames.some((name)=>permissions.some((p)=>p.name===name&&p.guard_name===guardName))}export async function hasAllPermissions(user,permissionNames,guardName="web"){const permissions=await getUserPermissions(user);return permissionNames.every((name)=>permissions.some((p)=>p.name===name&&p.guard_name===guardName))}export async function getRolePermissions(roleId){if(cache.rolePermissions.has(roleId))return cache.rolePermissions.get(roleId);const permissions=await getStore().getRolePermissions(roleId);cache.rolePermissions.set(roleId,permissions);return permissions}export async function givePermissionToRole(roleName,permissionName,guardName="web"){const role=await findRole(roleName,guardName);if(!role)throw Error(`Role '${roleName}' not found.`);const permission=await findPermission(permissionName,guardName);if(!permission)throw Error(`Permission '${permissionName}' not found.`);await getStore().assignPermissionToRole(role.id,permission.id);cache.rolePermissions.delete(role.id);cache.userPermissions.clear()}export async function revokePermissionFromRole(roleName,permissionName,guardName="web"){const role=await findRole(roleName,guardName);if(!role)return;const permission=await findPermission(permissionName,guardName);if(!permission)return;await getStore().removePermissionFromRole(role.id,permission.id);cache.rolePermissions.delete(role.id);cache.userPermissions.clear()}export async function syncRolePermissions(roleName,permissionNames,guardName="web"){const role=await findRole(roleName,guardName);if(!role)throw Error(`Role '${roleName}' not found.`);const permissionIds=[];for(const name of permissionNames){const perm=await findPermission(name,guardName);if(!perm)throw Error(`Permission '${name}' not found.`);permissionIds.push(perm.id)}await getStore().syncRolePermissions(role.id,permissionIds);cache.rolePermissions.delete(role.id);cache.userPermissions.clear()}export function withRbac(user){const userId=getUserId(user);return Object.assign(user,{hasRole:(roleName,guardName)=>hasRole(userId,roleName,guardName),hasAnyRole:(roleNames,guardName)=>hasAnyRole(userId,roleNames,guardName),hasAllRoles:(roleNames,guardName)=>hasAllRoles(userId,roleNames,guardName),hasPermission:(permissionName,guardName)=>hasPermission(userId,permissionName,guardName),hasAnyPermission:(permissionNames,guardName)=>hasAnyPermission(userId,permissionNames,guardName),hasAllPermissions:(permissionNames,guardName)=>hasAllPermissions(userId,permissionNames,guardName),getRoles:()=>getUserRoles(userId),getPermissions:()=>getUserPermissions(userId),assignRole:(roleName,guardName)=>assignRole(userId,roleName,guardName),removeRole:(roleName,guardName)=>removeRole(userId,roleName,guardName),syncRoles:(roleNames,guardName)=>syncRoles(userId,roleNames,guardName),givePermission:(permissionName,guardName)=>givePermission(userId,permissionName,guardName),revokePermission:(permissionName,guardName)=>revokePermission(userId,permissionName,guardName),syncPermissions:(permissionNames,guardName)=>syncPermissions(userId,permissionNames,guardName)})}export const Rbac={setStore:setRbacStore,flushCache:flushRbacCache,createRole,findRole,deleteRole,getAllRoles,createPermission,findPermission,deletePermission,getAllPermissions,getUserRoles,assignRole,removeRole,removeAllRoles,syncRoles,hasRole,hasAnyRole,hasAllRoles,getUserPermissions,givePermission,revokePermission,revokeAllPermissions,syncPermissions,hasPermission,hasAnyPermission,hasAllPermissions,getRolePermissions,givePermissionToRole,revokePermissionFromRole,syncRolePermissions,withRbac};export default Rbac;

package/dist/register.js

@@ -1,43 +1 @@
-import { config } from "@stacksjs/config";
-import { db } from "@stacksjs/database";
-import { HttpError } from "@stacksjs/error-handling";
-import { User } from "@stacksjs/orm";
-import { makeHash } from "@stacksjs/security";
-import { Auth } from "./authentication";
-import { isUniqueViolation } from "./rbac-store-bqb";
-function duplicateEmailError() {
-  if (config.auth?.registration?.preventEnumeration)
-    return new HttpError(422, "Registration could not be completed. Please check your details and try again.");
-  return new HttpError(409, "Email already exists");
-}
-const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-export async function register(credentials) {
-  const { email, password, name } = credentials;
-  if (typeof email !== "string" || email.length > 254 || !EMAIL_RE.test(email))
-    throw new HttpError(422, "Email address is invalid");
-  if (typeof password !== "string" || password.length < 8)
-    throw new HttpError(422, "Password must be at least 8 characters");
-  const hashedPassword = await makeHash(password, { algorithm: "bcrypt" }), userId = await db.transaction(async (rawTrx) => {
-    const trx = rawTrx;
-    if (await trx.selectFrom("users").where("email", "=", email).selectAll().executeTakeFirst())
-      throw duplicateEmailError();
-    try {
-      await trx.insertInto("users").values({
-        email,
-        password: hashedPassword,
-        name
-      }).execute();
-    } catch (err) {
-      if (isUniqueViolation(err))
-        throw duplicateEmailError();
-      throw err;
-    }
-    const created = await trx.selectFrom("users").where("email", "=", email).selectAll().executeTakeFirst();
-    if (!created)
-      throw Error("Failed to retrieve created user");
-    return Number(created.id);
-  }), user = await User.find(userId);
-  if (!user)
-    throw Error("Failed to retrieve created user");
-  return { token: await Auth.createToken(user, "user-auth-token") };
-}
+import{config}from"@stacksjs/config";import{db}from"@stacksjs/database";import{HttpError}from"@stacksjs/error-handling";import{User}from"@stacksjs/orm";import{makeHash}from"@stacksjs/security";import{Auth}from"./authentication";import{isUniqueViolation}from"./rbac-store-bqb";function duplicateEmailError(){if(config.auth?.registration?.preventEnumeration)return new HttpError(422,"Registration could not be completed. Please check your details and try again.");return new HttpError(409,"Email already exists")}const EMAIL_RE=/^[^\s@]+@[^\s@]+\.[^\s@]+$/;export async function register(credentials){const{email,password,name}=credentials;if(typeof email!=="string"||email.length>254||!EMAIL_RE.test(email))throw new HttpError(422,"Email address is invalid");if(typeof password!=="string"||password.length<8)throw new HttpError(422,"Password must be at least 8 characters");const hashedPassword=await makeHash(password,{algorithm:"bcrypt"}),userId=await db.transaction(async(rawTrx)=>{const trx=rawTrx;if(await trx.selectFrom("users").where("email","=",email).selectAll().executeTakeFirst())throw duplicateEmailError();try{await trx.insertInto("users").values({email,password:hashedPassword,name}).execute()}catch(err){if(isUniqueViolation(err))throw duplicateEmailError();throw err}const created=await trx.selectFrom("users").where("email","=",email).selectAll().executeTakeFirst();if(!created)throw Error("Failed to retrieve created user");return Number(created.id)}),user=await User.find(userId);if(!user)throw Error("Failed to retrieve created user");return{token:await Auth.createToken(user,"user-auth-token")}}

package/dist/session-auth.js

@@ -1,151 +1 @@
-import { HttpError } from "@stacksjs/error-handling";
-import { log } from "@stacksjs/logging";
-import { User } from "@stacksjs/orm";
-import { verifyHash } from "@stacksjs/security";
-import { config } from "@stacksjs/config";
-import { db, sqlDateTime, parseSqlDateTime } from "@stacksjs/database";
-import { getCurrentRequest } from "@stacksjs/router";
-import { DUMMY_BCRYPT_HASH } from "./internal-constants";
-import { RateLimiter } from "./rate-limiter";
-function generateSessionId() {
-  const bytes = crypto.getRandomValues(new Uint8Array(32));
-  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-}
-function readRequestFingerprint(override) {
-  if (override)
-    return {
-      ip: override.ip ?? null,
-      userAgent: override.userAgent ?? null
-    };
-  const req = getCurrentRequest();
-  if (!req)
-    return { ip: null, userAgent: null };
-  const headers = req.headers, fwd = headers?.get?.("x-forwarded-for") || headers?.get?.("X-Forwarded-For") || "", realIp = headers?.get?.("x-real-ip") || headers?.get?.("X-Real-IP") || "", ip = (fwd ? fwd.split(",")[0].trim() : "") || realIp || null, userAgent = headers?.get?.("user-agent") || headers?.get?.("User-Agent") || null;
-  return { ip, userAgent };
-}
-export function fingerprintMismatch(enforce, stored, current) {
-  if (!enforce)
-    return !1;
-  const enforceIp = enforce === !0 || !!enforce.ip, enforceUa = enforce === !0 || !!enforce.userAgent;
-  if (!enforceIp && !enforceUa)
-    return !1;
-  if (enforceIp && current.ip != null && stored.ip != null && String(stored.ip) !== current.ip)
-    return !0;
-  if (enforceUa && current.userAgent != null && stored.userAgent != null && String(stored.userAgent) !== current.userAgent)
-    return !0;
-  return !1;
-}
-function sessionFingerprintRejected(session) {
-  return fingerprintMismatch(config.auth?.session?.enforceFingerprint, { ip: session.ip_address, userAgent: session.user_agent }, readRequestFingerprint());
-}
-export async function sessionLogin(email, password, fingerprint) {
-  const normalizedEmail = (email || "").toLowerCase(), isRateLimited = await RateLimiter.isRateLimited(normalizedEmail), user = await User.where("email", email).first(), hashToVerify = user?.password || DUMMY_BCRYPT_HASH, isValid = await verifyHash(password, hashToVerify);
-  if (isRateLimited)
-    throw new HttpError(429, "Too many login attempts. Please try again later.");
-  if (!isValid || !user) {
-    await RateLimiter.recordFailedAttempt(normalizedEmail);
-    throw new HttpError(401, "Invalid credentials");
-  }
-  await RateLimiter.resetAttempts(normalizedEmail);
-  const sessionId = generateSessionId(), expiresAt = new Date(Date.now() + 86400000), { ip, userAgent } = readRequestFingerprint(fingerprint);
-  log.debug(`[auth] Session created for user#${user.id}`);
-  try {
-    await db.insertInto("sessions").values({
-      id: sessionId,
-      user_id: user.id,
-      ip_address: ip,
-      user_agent: userAgent,
-      payload: "{}",
-      last_activity: Math.floor(Date.now() / 1000),
-      expires_at: sqlDateTime(expiresAt)
-    }).execute();
-  } catch (err) {
-    log.error(`[auth] Session persistence failed for user#${user.id}: ${err.message}`);
-    throw new HttpError(500, "Session could not be created. Ensure the `sessions` table exists (run `./buddy migrate`).");
-  }
-  return { user, sessionId };
-}
-export async function sessionLogout(sessionId) {
-  log.debug("[auth] Session destroyed");
-  try {
-    await db.deleteFrom("sessions").where("id", "=", sessionId).execute();
-  } catch (err) {
-    log.debug(`[auth] Session destroy failed: ${err.message}`);
-  }
-}
-export async function sessionDestroyAll(userId) {
-  try {
-    await db.deleteFrom("sessions").where("user_id", "=", userId).execute();
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    if (message.includes("sessions") && /no such table|does not exist|doesn't exist/i.test(message))
-      return;
-    throw err;
-  }
-}
-export async function sessionUser(sessionId) {
-  try {
-    const session = await db.selectFrom("sessions").where("id", "=", sessionId).selectAll().executeTakeFirst();
-    if (!session)
-      return;
-    const expiresAt = parseSqlDateTime(session.expires_at)?.getTime() ?? 0;
-    if (Date.now() > expiresAt) {
-      await db.deleteFrom("sessions").where("id", "=", sessionId).execute();
-      return;
-    }
-    if (sessionFingerprintRejected(session)) {
-      log.warn("[auth] Session fingerprint mismatch \u2014 rejecting request (possible hijack, session left intact)");
-      return;
-    }
-    return await User.find(session.user_id);
-  } catch {
-    return;
-  }
-}
-export async function sessionCheck(sessionId) {
-  try {
-    const session = await db.selectFrom("sessions").where("id", "=", sessionId).selectAll().executeTakeFirst();
-    if (!session)
-      return !1;
-    const expiresAt = parseSqlDateTime(session.expires_at)?.getTime() ?? 0;
-    if (Date.now() > expiresAt) {
-      await db.deleteFrom("sessions").where("id", "=", sessionId).execute();
-      return !1;
-    }
-    if (sessionFingerprintRejected(session))
-      return !1;
-    return !0;
-  } catch {
-    return !1;
-  }
-}
-export async function sessionRefresh(sessionId, ttlMs = 86400000) {
-  try {
-    const session = await db.selectFrom("sessions").where("id", "=", sessionId).selectAll().executeTakeFirst();
-    if (!session)
-      return !1;
-    const expiresAt = parseSqlDateTime(session.expires_at)?.getTime() ?? 0;
-    if (Date.now() > expiresAt) {
-      await db.deleteFrom("sessions").where("id", "=", sessionId).execute();
-      return !1;
-    }
-    if (sessionFingerprintRejected(session))
-      return !1;
-    const newExpiry = new Date(Date.now() + ttlMs);
-    await db.updateTable("sessions").set({
-      expires_at: sqlDateTime(newExpiry),
-      last_activity: Math.floor(Date.now() / 1000)
-    }).where("id", "=", sessionId).execute();
-    return !0;
-  } catch {
-    return !1;
-  }
-}
-export const SessionAuth = {
-  login: sessionLogin,
-  logout: sessionLogout,
-  destroyAll: sessionDestroyAll,
-  user: sessionUser,
-  check: sessionCheck,
-  refresh: sessionRefresh
-};
+import{HttpError}from"@stacksjs/error-handling";import{log}from"@stacksjs/logging";import{User}from"@stacksjs/orm";import{verifyHash}from"@stacksjs/security";import{config}from"@stacksjs/config";import{db,sqlDateTime,parseSqlDateTime}from"@stacksjs/database";import{getCurrentRequest}from"@stacksjs/router";import{DUMMY_BCRYPT_HASH}from"./internal-constants";import{RateLimiter}from"./rate-limiter";function generateSessionId(){const bytes=crypto.getRandomValues(new Uint8Array(32));return Array.from(bytes,(b)=>b.toString(16).padStart(2,"0")).join("")}function readRequestFingerprint(override){if(override)return{ip:override.ip??null,userAgent:override.userAgent??null};const req=getCurrentRequest();if(!req)return{ip:null,userAgent:null};const headers=req.headers,fwd=headers?.get?.("x-forwarded-for")||headers?.get?.("X-Forwarded-For")||"",realIp=headers?.get?.("x-real-ip")||headers?.get?.("X-Real-IP")||"",ip=(fwd?fwd.split(",")[0].trim():"")||realIp||null,userAgent=headers?.get?.("user-agent")||headers?.get?.("User-Agent")||null;return{ip,userAgent}}export function fingerprintMismatch(enforce,stored,current){if(!enforce)return!1;const enforceIp=enforce===!0||!!enforce.ip,enforceUa=enforce===!0||!!enforce.userAgent;if(!enforceIp&&!enforceUa)return!1;if(enforceIp&&current.ip!=null&&stored.ip!=null&&String(stored.ip)!==current.ip)return!0;if(enforceUa&&current.userAgent!=null&&stored.userAgent!=null&&String(stored.userAgent)!==current.userAgent)return!0;return!1}function sessionFingerprintRejected(session){return fingerprintMismatch(config.auth?.session?.enforceFingerprint,{ip:session.ip_address,userAgent:session.user_agent},readRequestFingerprint())}export async function sessionLogin(email,password,fingerprint){const normalizedEmail=(email||"").toLowerCase(),isRateLimited=await RateLimiter.isRateLimited(normalizedEmail),user=await User.where("email",email).first(),hashToVerify=user?.password||DUMMY_BCRYPT_HASH,isValid=await verifyHash(password,hashToVerify);if(isRateLimited)throw new HttpError(429,"Too many login attempts. Please try again later.");if(!isValid||!user){await RateLimiter.recordFailedAttempt(normalizedEmail);throw new HttpError(401,"Invalid credentials")}await RateLimiter.resetAttempts(normalizedEmail);const sessionId=generateSessionId(),expiresAt=new Date(Date.now()+86400000),{ip,userAgent}=readRequestFingerprint(fingerprint);log.debug(`[auth] Session created for user#${user.id}`);try{await db.insertInto("sessions").values({id:sessionId,user_id:user.id,ip_address:ip,user_agent:userAgent,payload:"{}",last_activity:Math.floor(Date.now()/1000),expires_at:sqlDateTime(expiresAt)}).execute()}catch(err){log.error(`[auth] Session persistence failed for user#${user.id}: ${err.message}`);throw new HttpError(500,"Session could not be created. Ensure the `sessions` table exists (run `./buddy migrate`).")}return{user,sessionId}}export async function sessionLogout(sessionId){log.debug("[auth] Session destroyed");try{await db.deleteFrom("sessions").where("id","=",sessionId).execute()}catch(err){log.debug(`[auth] Session destroy failed: ${err.message}`)}}export async function sessionDestroyAll(userId){try{await db.deleteFrom("sessions").where("user_id","=",userId).execute()}catch(err){const message=err instanceof Error?err.message:String(err);if(message.includes("sessions")&&/no such table|does not exist|doesn't exist/i.test(message))return;throw err}}export async function sessionUser(sessionId){try{const session=await db.selectFrom("sessions").where("id","=",sessionId).selectAll().executeTakeFirst();if(!session)return;const expiresAt=parseSqlDateTime(session.expires_at)?.getTime()??0;if(Date.now()>expiresAt){await db.deleteFrom("sessions").where("id","=",sessionId).execute();return}if(sessionFingerprintRejected(session)){log.warn("[auth] Session fingerprint mismatch \u2014 rejecting request (possible hijack, session left intact)");return}return await User.find(session.user_id)}catch{return}}export async function sessionCheck(sessionId){try{const session=await db.selectFrom("sessions").where("id","=",sessionId).selectAll().executeTakeFirst();if(!session)return!1;const expiresAt=parseSqlDateTime(session.expires_at)?.getTime()??0;if(Date.now()>expiresAt){await db.deleteFrom("sessions").where("id","=",sessionId).execute();return!1}if(sessionFingerprintRejected(session))return!1;return!0}catch{return!1}}export async function sessionRefresh(sessionId,ttlMs=86400000){try{const session=await db.selectFrom("sessions").where("id","=",sessionId).selectAll().executeTakeFirst();if(!session)return!1;const expiresAt=parseSqlDateTime(session.expires_at)?.getTime()??0;if(Date.now()>expiresAt){await db.deleteFrom("sessions").where("id","=",sessionId).execute();return!1}if(sessionFingerprintRejected(session))return!1;const newExpiry=new Date(Date.now()+ttlMs);await db.updateTable("sessions").set({expires_at:sqlDateTime(newExpiry),last_activity:Math.floor(Date.now()/1000)}).where("id","=",sessionId).execute();return!0}catch{return!1}}export const SessionAuth={login:sessionLogin,logout:sessionLogout,destroyAll:sessionDestroyAll,user:sessionUser,check:sessionCheck,refresh:sessionRefresh};

package/dist/team.js

@@ -1,88 +1 @@
-import { config } from "@stacksjs/config";
-import { db } from "@stacksjs/database";
-import { Auth } from "./authentication";
-import { sessionUser } from "./session-auth";
-export const ACTIVE_TEAM_COOKIE = "active_team";
-export function selectActiveTeam(opts) {
-  const priority = opts.rolePriority ?? { owner: 0, admin: 1 }, sorted = [...opts.memberships ?? []].sort((a, b) => (priority[a.role ?? ""] ?? 2) - (priority[b.role ?? ""] ?? 2)), active = opts.activeTeamId == null ? null : Number(opts.activeTeamId);
-  if (active != null && Number.isFinite(active)) {
-    const member = sorted.find((x) => Number(x.team_id) === active);
-    if (member)
-      return { teamId: active, role: member.role ?? null };
-    if (opts.allowAnyTeam)
-      return { teamId: active, role: "admin" };
-  }
-  const first = sorted[0];
-  return first ? { teamId: Number(first.team_id), role: first.role ?? null } : { teamId: null, role: null };
-}
-export function getActiveTeamPreference(request) {
-  const raw = request.cookies?.get(ACTIVE_TEAM_COOKIE);
-  if (!raw)
-    return null;
-  const n = Number(raw);
-  return Number.isFinite(n) && n > 0 ? n : null;
-}
-export function buildActiveTeamCookie(teamId, opts = {}) {
-  const maxAge = Math.max(0, Math.floor(opts.maxAgeSeconds ?? 31536000)), parts = [`${ACTIVE_TEAM_COOKIE}=${encodeURIComponent(String(teamId))}`, "Path=/", "HttpOnly", "SameSite=Lax", `Max-Age=${maxAge}`];
-  if (opts.secure)
-    parts.push("Secure");
-  return parts.join("; ");
-}
-export function clearActiveTeamCookie() {
-  return `${ACTIVE_TEAM_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
-}
-export async function resolveAuthenticatedMembership(request) {
-  const user = await resolveAuthenticatedUser(request);
-  if (!user?.id)
-    return null;
-  const memberships = await db.selectFrom("team_members").where("user_id", "=", user.id).where("status", "=", "active").select(["team_id", "role"]).execute();
-  if (memberships.length === 0)
-    return null;
-  const picked = selectActiveTeam({
-    memberships: memberships.map((m) => ({
-      team_id: Number(m.team_id),
-      role: m.role == null ? null : String(m.role)
-    })),
-    activeTeamId: getActiveTeamPreference(request)
-  });
-  return picked.teamId != null ? { teamId: picked.teamId, role: picked.role ?? "" } : null;
-}
-export async function resolveTeamContext(request, opts = {}) {
-  const empty = { user: null, teamId: null, role: null, teams: [], activeTeamId: null }, guardName = config.auth?.default || "api", user = (config.auth?.guards?.[guardName]?.driver || "token") === "session" ? await resolveSessionUser(request) : await resolveTokenUser(request);
-  if (!user?.id)
-    return empty;
-  const memberships = await db.selectFrom("team_members").where("user_id", "=", user.id).where("status", "=", "active").select(["team_id", "role"]).execute(), allowAny = opts.allowAnyTeam ? !!opts.allowAnyTeam(user) : !1, activeTeamId = getActiveTeamPreference(request), picked = selectActiveTeam({
-    memberships: memberships.map((m) => ({ team_id: Number(m.team_id), role: String(m.role) })),
-    activeTeamId,
-    allowAnyTeam: allowAny
-  }), roleByTeam = new Map(memberships.map((m) => [Number(m.team_id), String(m.role)]));
-  let teamRows = [];
-  if (allowAny)
-    teamRows = await db.selectFrom("teams").select(["id", "name"]).execute();
-  else {
-    const ids = [...roleByTeam.keys()];
-    teamRows = ids.length ? await db.selectFrom("teams").whereIn("id", ids).select(["id", "name"]).execute() : [];
-  }
-  const teams = teamRows.map((t) => ({ id: Number(t.id), name: String(t.name), role: roleByTeam.get(Number(t.id)) || "viewer" })).sort((a, b) => a.name.localeCompare(b.name));
-  return { user, teamId: picked.teamId, role: picked.role, teams, activeTeamId };
-}
-export async function resolveAuthenticatedTeamId(request) {
-  const membership = await resolveAuthenticatedMembership(request);
-  return membership ? membership.teamId : null;
-}
-export async function resolveAuthenticatedUser(request) {
-  const guardName = config.auth?.default || "api", user = ((config.auth?.guards?.[guardName] || { driver: "token" }).driver || "token") === "session" ? await resolveSessionUser(request) : await resolveTokenUser(request);
-  return user?.id ? user : void 0;
-}
-async function resolveSessionUser(request) {
-  const sessionId = request.cookies?.get("session_id");
-  if (!sessionId)
-    return;
-  return sessionUser(sessionId);
-}
-async function resolveTokenUser(request) {
-  const cookieName = config.auth?.defaultTokenName || "auth-token", bearer = (typeof request.bearerToken === "function" ? request.bearerToken() : void 0) ?? request.cookies?.get(cookieName);
-  if (!bearer)
-    return;
-  return Auth.getUserFromToken(bearer);
-}
+import{config}from"@stacksjs/config";import{db}from"@stacksjs/database";import{Auth}from"./authentication";import{sessionUser}from"./session-auth";export const ACTIVE_TEAM_COOKIE="active_team";export function selectActiveTeam(opts){const priority=opts.rolePriority??{owner:0,admin:1},sorted=[...opts.memberships??[]].sort((a,b)=>(priority[a.role??""]??2)-(priority[b.role??""]??2)),active=opts.activeTeamId==null?null:Number(opts.activeTeamId);if(active!=null&&Number.isFinite(active)){const member=sorted.find((x)=>Number(x.team_id)===active);if(member)return{teamId:active,role:member.role??null};if(opts.allowAnyTeam)return{teamId:active,role:"admin"}}const first=sorted[0];return first?{teamId:Number(first.team_id),role:first.role??null}:{teamId:null,role:null}}export function getActiveTeamPreference(request){const raw=request.cookies?.get(ACTIVE_TEAM_COOKIE);if(!raw)return null;const n=Number(raw);return Number.isFinite(n)&&n>0?n:null}export function buildActiveTeamCookie(teamId,opts={}){const maxAge=Math.max(0,Math.floor(opts.maxAgeSeconds??31536000)),parts=[`${ACTIVE_TEAM_COOKIE}=${encodeURIComponent(String(teamId))}`,"Path=/","HttpOnly","SameSite=Lax",`Max-Age=${maxAge}`];if(opts.secure)parts.push("Secure");return parts.join("; ")}export function clearActiveTeamCookie(){return`${ACTIVE_TEAM_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`}export async function resolveAuthenticatedMembership(request){const user=await resolveAuthenticatedUser(request);if(!user?.id)return null;const memberships=await db.selectFrom("team_members").where("user_id","=",user.id).where("status","=","active").select(["team_id","role"]).execute();if(memberships.length===0)return null;const picked=selectActiveTeam({memberships:memberships.map((m)=>({team_id:Number(m.team_id),role:m.role==null?null:String(m.role)})),activeTeamId:getActiveTeamPreference(request)});return picked.teamId!=null?{teamId:picked.teamId,role:picked.role??""}:null}export async function resolveTeamContext(request,opts={}){const empty={user:null,teamId:null,role:null,teams:[],activeTeamId:null},guardName=config.auth?.default||"api",user=(config.auth?.guards?.[guardName]?.driver||"token")==="session"?await resolveSessionUser(request):await resolveTokenUser(request);if(!user?.id)return empty;const memberships=await db.selectFrom("team_members").where("user_id","=",user.id).where("status","=","active").select(["team_id","role"]).execute(),allowAny=opts.allowAnyTeam?!!opts.allowAnyTeam(user):!1,activeTeamId=getActiveTeamPreference(request),picked=selectActiveTeam({memberships:memberships.map((m)=>({team_id:Number(m.team_id),role:String(m.role)})),activeTeamId,allowAnyTeam:allowAny}),roleByTeam=new Map(memberships.map((m)=>[Number(m.team_id),String(m.role)]));let teamRows=[];if(allowAny)teamRows=await db.selectFrom("teams").select(["id","name"]).execute();else{const ids=[...roleByTeam.keys()];teamRows=ids.length?await db.selectFrom("teams").whereIn("id",ids).select(["id","name"]).execute():[]}const teams=teamRows.map((t)=>({id:Number(t.id),name:String(t.name),role:roleByTeam.get(Number(t.id))||"viewer"})).sort((a,b)=>a.name.localeCompare(b.name));return{user,teamId:picked.teamId,role:picked.role,teams,activeTeamId}}export async function resolveAuthenticatedTeamId(request){const membership=await resolveAuthenticatedMembership(request);return membership?membership.teamId:null}export async function resolveAuthenticatedUser(request){const guardName=config.auth?.default||"api",user=((config.auth?.guards?.[guardName]||{driver:"token"}).driver||"token")==="session"?await resolveSessionUser(request):await resolveTokenUser(request);return user?.id?user:void 0}async function resolveSessionUser(request){const sessionId=request.cookies?.get("session_id");if(!sessionId)return;return sessionUser(sessionId)}async function resolveTokenUser(request){const cookieName=config.auth?.defaultTokenName||"auth-token",bearer=(typeof request.bearerToken==="function"?request.bearerToken():void 0)??request.cookies?.get(cookieName);if(!bearer)return;return Auth.getUserFromToken(bearer)}