@stacksjs/auth 0.70.294 → 0.70.297

package/dist/cookie-auth.d.ts

@@ -1,4 +1,46 @@
 import { Auth } from './authentication';
+/**
+ * The one name the auth cookie has.
+ *
+ * There used to be two. `authCookie()` wrote `stacks_auth` (via
+ * `config.auth.cookie.name`, a key that did not exist on `AuthOptions`, so no
+ * app using `satisfies AuthConfig` could even set it), while the Auth
+ * middleware, `team.ts` and the stx page gate all read
+ * `config.auth.defaultTokenName` — `auth-token`. A cookie the framework wrote
+ * was never one the framework read, which is why apps ended up hand-writing a
+ * token pack into `localStorage` from an inline script instead
+ * (stacksjs/stacks#2236).
+ *
+ * Resolution order:
+ *   1. an explicit `options.name`
+ *   2. `config.auth.cookie.name` — the supported key
+ *   3. `config.auth.defaultTokenName` — DEPRECATED, honoured so an app that
+ *      had renamed it (and thereby renamed the cookie those readers wanted)
+ *      keeps working. Ignored with a warning when it is not a legal cookie
+ *      name, which it very often is not: it is a human-readable token label
+ *      like `Web Session`.
+ *   4. `auth-token`
+ */
+export declare function authCookieName(options?: AuthCookieOptions): string;
+/**
+ * Whether the auth cookie should carry `Secure`, decided from what the app
+ * demonstrably is rather than what its environment is called.
+ *
+ * The old rule was "Secure unless APP_ENV looks development-ish", and it
+ * failed open: `.env.example` ships `APP_ENV=development`, so an HTTPS
+ * deployment that never changed the env name served its session token
+ * without `Secure` (stacksjs/stacks#2275). Now the URL decides:
+ *
+ * - an `https://` app URL is always Secure
+ * - a plain-HTTP or scheme-less URL drops Secure only on a loopback host
+ *   (localhost, `*.localhost`, 127.0.0.1) — the one place plain HTTP is a
+ *   development reality rather than a misconfiguration
+ * - with no URL configured at all, only the unambiguous `local` / `dev`
+ *   environment names opt out; `development` no longer does
+ *
+ * Exported for tests; `authCookie()` feeds it the live config.
+ */
+export declare function shouldSecureAuthCookie(app?: { url?: unknown, env?: unknown }): boolean;
 /**
  * The `Set-Cookie` value that signs a browser in.
  *
@@ -56,7 +98,8 @@ export declare function logoutCookie(request: Request | { headers: Headers }, op
  *
  * The cookie is httpOnly (a page script never needs it), SameSite=Lax (so a
  * link from an email still arrives signed in, while a cross-site POST does
- * not), and Secure everywhere except local HTTP development.
+ * not), and Secure everywhere except a plain-HTTP loopback app URL — see
+ * `shouldSecureAuthCookie` for exactly how that is decided.
  */
 export declare interface AuthCookieOptions {
   name?: string

package/dist/cookie-auth.js

@@ -1 +1 @@
-import{config}from"@stacksjs/config";import{Auth}from"./authentication";function cookieName(options){return options?.name??config.auth?.cookie?.name??"stacks_auth"}function defaultMaxAge(){const milliseconds=Number(config.auth?.tokenExpiry??3600000);if(!Number.isFinite(milliseconds)||milliseconds<=0)return 3600;return Math.max(60,Math.round(milliseconds/1000))}function isLocal(){const environment=String(config.app?.env??process.env.APP_ENV??"");return environment==="local"||environment==="development"||environment==="dev"}export function authCookie(token,options={}){const parts=[`${cookieName(options)}=${encodeURIComponent(token)}`,`Path=${options.path??"/"}`,`Max-Age=${options.maxAge??defaultMaxAge()}`,"HttpOnly",`SameSite=${options.sameSite??"Lax"}`];if(options.domain)parts.push(`Domain=${options.domain}`);if(options.secure??!isLocal())parts.push("Secure");return parts.join("; ")}export function clearAuthCookie(options={}){return authCookie("",{...options,maxAge:0})}export function authCookieToken(request,options={}){const header=request.headers.get("cookie");if(!header)return;const wanted=cookieName(options);for(const pair of header.split(";")){const index=pair.indexOf("=");if(index===-1)continue;if(pair.slice(0,index).trim()!==wanted)continue;const value=decodeURIComponent(pair.slice(index+1).trim());return value.length>0?value:void 0}return}export async function userFromCookie(request,options={}){const token=authCookieToken(request,options);if(!token)return;return Auth.getUserFromToken(token)}export async function cookieCheck(request,options={}){return Boolean(await userFromCookie(request,options))}export async function logoutCookie(request,options={}){const token=authCookieToken(request,options);if(token)try{await Auth.revokeToken(token)}catch{}return clearAuthCookie(options)}
+import{config}from"@stacksjs/config";import{log}from"@stacksjs/logging";import{Auth}from"./authentication";const COOKIE_NAME_RE=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;export function authCookieName(options){if(options?.name)return options.name;const configured=config.auth?.cookie?.name;if(typeof configured==="string"&&configured.length>0)return configured;const legacy=config.auth?.defaultTokenName;if(typeof legacy==="string"&&legacy.length>0&&legacy!=="auth-token"){if(COOKIE_NAME_RE.test(legacy))return legacy;console.warn(`[auth] config.auth.defaultTokenName ("${legacy}") is not a valid cookie name and is being ignored for cookie naming; using "auth-token". defaultTokenName is a personal access token label, not a `+"cookie name \u2014 set config.auth.cookie.name instead (stacksjs/stacks#2236).")}return"auth-token"}function cookieName(options){return authCookieName(options)}function defaultMaxAge(){const milliseconds=Number(config.auth?.tokenExpiry??3600000);if(!Number.isFinite(milliseconds)||milliseconds<=0)return 3600;return Math.max(60,Math.round(milliseconds/1000))}function isLoopbackHost(hostname){const host=hostname.toLowerCase();return host==="localhost"||host.endsWith(".localhost")||host==="127.0.0.1"||host==="0.0.0.0"||host==="::1"||host==="[::1]"}export function shouldSecureAuthCookie(app=config.app??{}){const rawUrl=String(app?.url??process.env.APP_URL??"").trim();if(rawUrl)try{const url=new URL(rawUrl.includes("://")?rawUrl:`http://${rawUrl}`);if(url.protocol==="https:")return!0;return!isLoopbackHost(url.hostname)}catch{}const environment=String(app?.env??process.env.APP_ENV??"");return!(environment==="local"||environment==="dev")}let warnedInsecureOverride=!1;export function authCookie(token,options={}){const parts=[`${cookieName(options)}=${encodeURIComponent(token)}`,`Path=${options.path??"/"}`,`Max-Age=${options.maxAge??defaultMaxAge()}`,"HttpOnly",`SameSite=${options.sameSite??"Lax"}`];if(options.domain)parts.push(`Domain=${options.domain}`);if(options.secure??shouldSecureAuthCookie())parts.push("Secure");else if(options.secure===!1&&shouldSecureAuthCookie()&&!warnedInsecureOverride){warnedInsecureOverride=!0;log.warn("[auth] authCookie() was asked for secure: false while the app URL is HTTPS \u2014 the session cookie will also travel over plain HTTP.")}return parts.join("; ")}export function clearAuthCookie(options={}){return authCookie("",{...options,maxAge:0})}export function authCookieToken(request,options={}){const header=request.headers.get("cookie");if(!header)return;const wanted=cookieName(options);for(const pair of header.split(";")){const index=pair.indexOf("=");if(index===-1)continue;if(pair.slice(0,index).trim()!==wanted)continue;const value=decodeURIComponent(pair.slice(index+1).trim());return value.length>0?value:void 0}return}export async function userFromCookie(request,options={}){const token=authCookieToken(request,options);if(!token)return;return Auth.getUserFromToken(token)}export async function cookieCheck(request,options={}){return Boolean(await userFromCookie(request,options))}export async function logoutCookie(request,options={}){const token=authCookieToken(request,options);if(token)try{await Auth.revokeToken(token)}catch{}return clearAuthCookie(options)}

package/dist/index.d.ts

@@ -26,6 +26,10 @@ export * from './email-verification';
 export * from './session-auth';
 // Cookie-carried access tokens, for server-rendered pages.
 export * from './cookie-auth';
+// The stx page gate (`middleware: ['auth' | 'guest']`), token-validating.
+export * from './page-gate';
+// Social sign-in: which local user a provider identity resolves to.
+export * from './socials';
 // TOTP (Two-Factor Authentication) - re-export from ts-auth
 export {
   generateTOTP,

package/dist/index.js

@@ -1 +1 @@
-export*from"./authentication";export*from"./authenticator";export*from"./client";export*from"./middleware";export*from"./rate-limiter";export*from"./passkey";export*from"./password/reset";export*from"./register";export*from"./user";export*from"./tokens";export*from"./gate";export*from"./policy";export*from"./authorizable";export*from"./permissions";export*from"./rbac";export{createBqbRbacStore}from"./rbac-store-bqb";export{DEFAULT_ROLE_PACKS,seedDefaultRoles}from"./rbac-seed";export*from"./email-verification";export*from"./session-auth";export*from"./cookie-auth";export{generateTOTP,verifyTOTP,generateTOTPSecret,totpKeyUri}from"@stacksjs/ts-auth";export*from"./two-factor";export*from"./team";
+export*from"./authentication";export*from"./authenticator";export*from"./client";export*from"./middleware";export*from"./rate-limiter";export*from"./passkey";export*from"./password/reset";export*from"./register";export*from"./user";export*from"./tokens";export*from"./gate";export*from"./policy";export*from"./authorizable";export*from"./permissions";export*from"./rbac";export{createBqbRbacStore}from"./rbac-store-bqb";export{DEFAULT_ROLE_PACKS,seedDefaultRoles}from"./rbac-seed";export*from"./email-verification";export*from"./session-auth";export*from"./cookie-auth";export*from"./page-gate";export*from"./socials";export{generateTOTP,verifyTOTP,generateTOTPSecret,totpKeyUri}from"@stacksjs/ts-auth";export*from"./two-factor";export*from"./team";

package/dist/page-gate.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The `middleware` map to pass to stx-serve, overriding its existence-only
+ * built-ins with token-validating equivalents.
+ */
+export declare function stxPageAuthMiddleware(options?: PageGateOptions): Record<'auth' | 'guest', StxPageMiddleware>;
+/**
+ * The stx page gate, with the token actually validated.
+ *
+ * bun-plugin-stx's built-in `auth` / `guest` middleware — the pair behind
+ * `definePageMeta({ middleware: ['auth'] })` — checks only that the auth
+ * cookie EXISTS. `document.cookie = 'auth-token=x'` in a console satisfied it
+ * on every protected page, and a stale cookie trapped a signed-out visitor on
+ * `guest` pages (stacksjs/stacks#2274).
+ *
+ * stx-serve builds its registry as `{ ...builtInMiddleware, ...options.middleware }`,
+ * so entries supplied here win over the built-ins by construction. These
+ * validate the cookie's token exactly as a bearer token would be — through
+ * `Auth.getUserFromToken()`, so a forged, revoked or expired token redirects
+ * the same as no token at all.
+ *
+ * This gates SSR page rendering; API requests validate their own credentials.
+ * Both the dev views server and `buddy serve` register it.
+ */
+declare interface StxPageContext {
+  cookies: Record<string, string>
+  redirect: (to: string, status?: number) => Response
+}
+export declare interface PageGateOptions {
+  cookieName?: string
+  redirectTo?: string
+  home?: string
+  validate?: (token: string) => Promise<unknown>
+}
+declare type StxPageMiddleware = (req: Request, ctx: StxPageContext) => Promise<Response | null>;

package/dist/page-gate.js

@@ -0,0 +1 @@
+import{Auth}from"./authentication";import{authCookieName}from"./cookie-auth";export function stxPageAuthMiddleware(options={}){const redirectTo=options.redirectTo??"/login",home=options.home??"/",validate=options.validate??((token)=>Auth.getUserFromToken(token));async function signedInUser(ctx){const token=ctx.cookies[authCookieName({name:options.cookieName})];if(!token)return;try{return await validate(token)}catch{return}}return{auth:async(_req,ctx)=>{if(await signedInUser(ctx))return null;return ctx.redirect(redirectTo)},guest:async(_req,ctx)=>{if(await signedInUser(ctx))return Response.redirect(home,302);return null}}}

package/dist/socials.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Resolve a provider identity to a local user id, creating the user and/or
+ * the link row according to the configured matching policy.
+ *
+ * Throws {@link SocialSignInRefusedError} when the policy says no; every
+ * other failure mode (db down, etc.) throws its own error untouched.
+ */
+export declare function resolveSocialSignIn(provider: string, identity: SocialIdentity, store?: SocialSignInStore): Promise<SocialSignInResult>;
+/**
+ * The social sign-in policy: which local user a provider identity resolves to
+ * (stacksjs/stacks#2276).
+ *
+ * `@stacksjs/socials` covers the OAuth exchange and stops at a normalized
+ * provider user; `Auth.loginUsingId()` covers session issuance. This is the
+ * piece between them — the find-or-create decision every app previously
+ * hand-rolled, and the one they usually got wrong in the same way: linking an
+ * unverified provider email onto an existing local account, which lets an
+ * attacker register a victim's address at any provider that skips email
+ * verification and inherit the local account.
+ *
+ * That takeover guard is therefore NOT configurable: a provider identity only
+ * links to an existing user by email when the provider explicitly vouches for
+ * the address (`emailVerified === true`). What IS configurable is what happens
+ * when no link row exists — `config.auth.socials.matching`:
+ *
+ * - `'link'` (default): a verified-email match links to the existing user;
+ *   no match creates a new user; an unverified match refuses.
+ * - `'create'`: never match by email — a first-time provider identity always
+ *   becomes a new user. No linking means no takeover surface at all, at the
+ *   cost of duplicate accounts for people who registered with a password
+ *   first.
+ * - `'refuse'`: only identities linked beforehand (from a signed-in session)
+ *   may sign in. The strictest posture; social becomes a second factor for
+ *   existing accounts rather than an acquisition channel.
+ */
+/** What the policy needs from a provider profile — @stacksjs/socials' `SocialUser` satisfies this. */
+export declare interface SocialIdentity {
+  id: string
+  name?: string | null
+  nickname?: string | null
+  email?: string | null
+  emailVerified?: boolean | null
+  avatar?: string | null
+}
+export declare interface SocialSignInResult {
+  userId: number
+  createdUser: boolean
+  linked: boolean
+}
+/**
+ * Storage the policy runs against. The default store reads and writes the
+ * `social_accounts` and `users` tables; tests inject their own.
+ */
+export declare interface SocialSignInStore {
+  findLink: (provider: string, providerUserId: string) => Promise<{ userId: number } | undefined>
+  createLink: (link: { userId: number, provider: string, providerUserId: string, providerEmail: string | null }) => Promise<void>
+  findUserIdByEmail: (email: string) => Promise<number | undefined>
+  createUser: (attrs: { name: string, email: string }) => Promise<number>
+}
+export type SocialMatchingPolicy = 'link' | 'create' | 'refuse';
+export type SocialRefusalReason = | 'no-linked-account'
+  | 'unverified-provider-email'
+  | 'no-email-to-create-with'
+  | 'email-already-registered';
+/** A sign-in the policy declines. `reason` is safe to show a visitor. */
+export declare class SocialSignInRefusedError extends Error {
+  readonly reason: SocialRefusalReason;
+  constructor(reason: SocialRefusalReason, message: string);
+}

package/dist/socials.js

@@ -0,0 +1 @@
+import{config}from"@stacksjs/config";import{db}from"@stacksjs/database";export class SocialSignInRefusedError extends Error{reason;constructor(reason,message){super(message);this.name="SocialSignInRefusedError";this.reason=reason}}function defaultStore(){return{async findLink(provider,providerUserId){const row=await db.selectFrom("social_accounts").select(["user_id"]).where("provider","=",provider).where("provider_user_id","=",providerUserId).executeTakeFirst();return row?{userId:Number(row.user_id)}:void 0},async createLink(link){await db.insertInto("social_accounts").values({user_id:link.userId,provider:link.provider,provider_user_id:link.providerUserId,provider_email:link.providerEmail,created_at:new Date().toISOString().slice(0,19).replace("T"," ")}).execute()},async findUserIdByEmail(email){const row=await db.selectFrom("users").select(["id"]).where("email","=",email).executeTakeFirst();return row?Number(row.id):void 0},async createUser(attrs){const{makeHash}=await import("@stacksjs/security"),password=await makeHash(crypto.randomUUID(),{algorithm:"bcrypt"}),created=await globalThis.User?.create?.({name:attrs.name,email:attrs.email,password});if(created?.id)return Number(created.id);const row=await db.insertInto("users").values({name:attrs.name,email:attrs.email,password,created_at:new Date().toISOString().slice(0,19).replace("T"," ")}).executeTakeFirst();return Number(row?.insertId??0)}}}function configuredMatching(){const raw=config.auth?.socials?.matching;return raw==="create"||raw==="refuse"?raw:"link"}export async function resolveSocialSignIn(provider,identity,store=defaultStore()){const providerUserId=String(identity.id??"").trim();if(!provider||!providerUserId)throw TypeError("[auth/socials] a provider name and provider user id are required.");const existing=await store.findLink(provider,providerUserId);if(existing)return{userId:existing.userId,createdUser:!1,linked:!1};const matching=configuredMatching();if(matching==="refuse")throw new SocialSignInRefusedError("no-linked-account",`No ${provider} account is linked here. Sign in with your password, then connect ${provider} from your account settings.`);const email=identity.email?.trim().toLowerCase()||null,displayName=identity.name?.trim()||identity.nickname?.trim()||(email??`${provider} user`);if(matching==="link"&&email){const matchedUserId=await store.findUserIdByEmail(email);if(matchedUserId!==void 0){if(identity.emailVerified!==!0)throw new SocialSignInRefusedError("unverified-provider-email",`${provider} did not verify ${email}, and an account with that address already exists. Sign in with your password, then connect ${provider} from your account settings.`);await store.createLink({userId:matchedUserId,provider,providerUserId,providerEmail:email});return{userId:matchedUserId,createdUser:!1,linked:!0}}}if(!email)throw new SocialSignInRefusedError("no-email-to-create-with",`${provider} shared no email address, so an account cannot be created. Grant the email permission at ${provider}, or register with an email first.`);if(matching==="create"&&await store.findUserIdByEmail(email)!==void 0)throw new SocialSignInRefusedError("email-already-registered",`An account with ${email} already exists. Sign in with your password, then connect ${provider} from your account settings.`);const userId=await store.createUser({name:displayName,email});await store.createLink({userId,provider,providerUserId,providerEmail:email});return{userId,createdUser:!0,linked:!0}}

package/dist/team.js

@@ -1 +1 @@
-import{config}from"@stacksjs/config";import{db}from"@stacksjs/database";import{Auth}from"./authentication";import{sessionUser}from"./session-auth";export const ACTIVE_TEAM_COOKIE="active_team";export function selectActiveTeam(opts){const priority=opts.rolePriority??{owner:0,admin:1},sorted=[...opts.memberships??[]].sort((a,b)=>(priority[a.role??""]??2)-(priority[b.role??""]??2)),active=opts.activeTeamId==null?null:Number(opts.activeTeamId);if(active!=null&&Number.isFinite(active)){const member=sorted.find((x)=>Number(x.team_id)===active);if(member)return{teamId:active,role:member.role??null};if(opts.allowAnyTeam)return{teamId:active,role:"admin"}}const first=sorted[0];return first?{teamId:Number(first.team_id),role:first.role??null}:{teamId:null,role:null}}export function getActiveTeamPreference(request){const raw=request.cookies?.get(ACTIVE_TEAM_COOKIE);if(!raw)return null;const n=Number(raw);return Number.isFinite(n)&&n>0?n:null}export function buildActiveTeamCookie(teamId,opts={}){const maxAge=Math.max(0,Math.floor(opts.maxAgeSeconds??31536000)),parts=[`${ACTIVE_TEAM_COOKIE}=${encodeURIComponent(String(teamId))}`,"Path=/","HttpOnly","SameSite=Lax",`Max-Age=${maxAge}`];if(opts.secure)parts.push("Secure");return parts.join("; ")}export function clearActiveTeamCookie(){return`${ACTIVE_TEAM_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`}export async function resolveAuthenticatedMembership(request){const user=await resolveAuthenticatedUser(request);if(!user?.id)return null;const memberships=await db.selectFrom("team_members").where("user_id","=",user.id).where("status","=","active").select(["team_id","role"]).execute();if(memberships.length===0)return null;const picked=selectActiveTeam({memberships:memberships.map((m)=>({team_id:Number(m.team_id),role:m.role==null?null:String(m.role)})),activeTeamId:getActiveTeamPreference(request)});return picked.teamId!=null?{teamId:picked.teamId,role:picked.role??""}:null}export async function resolveTeamContext(request,opts={}){const empty={user:null,teamId:null,role:null,teams:[],activeTeamId:null},guardName=config.auth?.default||"api",user=(config.auth?.guards?.[guardName]?.driver||"token")==="session"?await resolveSessionUser(request):await resolveTokenUser(request);if(!user?.id)return empty;const memberships=await db.selectFrom("team_members").where("user_id","=",user.id).where("status","=","active").select(["team_id","role"]).execute(),allowAny=opts.allowAnyTeam?!!opts.allowAnyTeam(user):!1,activeTeamId=getActiveTeamPreference(request),picked=selectActiveTeam({memberships:memberships.map((m)=>({team_id:Number(m.team_id),role:String(m.role)})),activeTeamId,allowAnyTeam:allowAny}),roleByTeam=new Map(memberships.map((m)=>[Number(m.team_id),String(m.role)]));let teamRows=[];if(allowAny)teamRows=await db.selectFrom("teams").select(["id","name"]).execute();else{const ids=[...roleByTeam.keys()];teamRows=ids.length?await db.selectFrom("teams").whereIn("id",ids).select(["id","name"]).execute():[]}const teams=teamRows.map((t)=>({id:Number(t.id),name:String(t.name),role:roleByTeam.get(Number(t.id))||"viewer"})).sort((a,b)=>a.name.localeCompare(b.name));return{user,teamId:picked.teamId,role:picked.role,teams,activeTeamId}}export async function resolveAuthenticatedTeamId(request){const membership=await resolveAuthenticatedMembership(request);return membership?membership.teamId:null}export async function resolveAuthenticatedUser(request){const guardName=config.auth?.default||"api",user=((config.auth?.guards?.[guardName]||{driver:"token"}).driver||"token")==="session"?await resolveSessionUser(request):await resolveTokenUser(request);return user?.id?user:void 0}async function resolveSessionUser(request){const sessionId=request.cookies?.get("session_id");if(!sessionId)return;return sessionUser(sessionId)}async function resolveTokenUser(request){const cookieName=config.auth?.defaultTokenName||"auth-token",bearer=(typeof request.bearerToken==="function"?request.bearerToken():void 0)??request.cookies?.get(cookieName);if(!bearer)return;return Auth.getUserFromToken(bearer)}
+import{config}from"@stacksjs/config";import{db}from"@stacksjs/database";import{Auth}from"./authentication";import{sessionUser}from"./session-auth";import{authCookieName}from"./cookie-auth";export const ACTIVE_TEAM_COOKIE="active_team";export function selectActiveTeam(opts){const priority=opts.rolePriority??{owner:0,admin:1},sorted=[...opts.memberships??[]].sort((a,b)=>(priority[a.role??""]??2)-(priority[b.role??""]??2)),active=opts.activeTeamId==null?null:Number(opts.activeTeamId);if(active!=null&&Number.isFinite(active)){const member=sorted.find((x)=>Number(x.team_id)===active);if(member)return{teamId:active,role:member.role??null};if(opts.allowAnyTeam)return{teamId:active,role:"admin"}}const first=sorted[0];return first?{teamId:Number(first.team_id),role:first.role??null}:{teamId:null,role:null}}export function getActiveTeamPreference(request){const raw=request.cookies?.get(ACTIVE_TEAM_COOKIE);if(!raw)return null;const n=Number(raw);return Number.isFinite(n)&&n>0?n:null}export function buildActiveTeamCookie(teamId,opts={}){const maxAge=Math.max(0,Math.floor(opts.maxAgeSeconds??31536000)),parts=[`${ACTIVE_TEAM_COOKIE}=${encodeURIComponent(String(teamId))}`,"Path=/","HttpOnly","SameSite=Lax",`Max-Age=${maxAge}`];if(opts.secure)parts.push("Secure");return parts.join("; ")}export function clearActiveTeamCookie(){return`${ACTIVE_TEAM_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`}export async function resolveAuthenticatedMembership(request){const user=await resolveAuthenticatedUser(request);if(!user?.id)return null;const memberships=await db.selectFrom("team_members").where("user_id","=",user.id).where("status","=","active").select(["team_id","role"]).execute();if(memberships.length===0)return null;const picked=selectActiveTeam({memberships:memberships.map((m)=>({team_id:Number(m.team_id),role:m.role==null?null:String(m.role)})),activeTeamId:getActiveTeamPreference(request)});return picked.teamId!=null?{teamId:picked.teamId,role:picked.role??""}:null}export async function resolveTeamContext(request,opts={}){const empty={user:null,teamId:null,role:null,teams:[],activeTeamId:null},guardName=config.auth?.default||"api",user=(config.auth?.guards?.[guardName]?.driver||"token")==="session"?await resolveSessionUser(request):await resolveTokenUser(request);if(!user?.id)return empty;const memberships=await db.selectFrom("team_members").where("user_id","=",user.id).where("status","=","active").select(["team_id","role"]).execute(),allowAny=opts.allowAnyTeam?!!opts.allowAnyTeam(user):!1,activeTeamId=getActiveTeamPreference(request),picked=selectActiveTeam({memberships:memberships.map((m)=>({team_id:Number(m.team_id),role:String(m.role)})),activeTeamId,allowAnyTeam:allowAny}),roleByTeam=new Map(memberships.map((m)=>[Number(m.team_id),String(m.role)]));let teamRows=[];if(allowAny)teamRows=await db.selectFrom("teams").select(["id","name"]).execute();else{const ids=[...roleByTeam.keys()];teamRows=ids.length?await db.selectFrom("teams").whereIn("id",ids).select(["id","name"]).execute():[]}const teams=teamRows.map((t)=>({id:Number(t.id),name:String(t.name),role:roleByTeam.get(Number(t.id))||"viewer"})).sort((a,b)=>a.name.localeCompare(b.name));return{user,teamId:picked.teamId,role:picked.role,teams,activeTeamId}}export async function resolveAuthenticatedTeamId(request){const membership=await resolveAuthenticatedMembership(request);return membership?membership.teamId:null}export async function resolveAuthenticatedUser(request){const guardName=config.auth?.default||"api",user=((config.auth?.guards?.[guardName]||{driver:"token"}).driver||"token")==="session"?await resolveSessionUser(request):await resolveTokenUser(request);return user?.id?user:void 0}async function resolveSessionUser(request){const sessionId=request.cookies?.get("session_id");if(!sessionId)return;return sessionUser(sessionId)}async function resolveTokenUser(request){const cookieName=authCookieName(),bearer=(typeof request.bearerToken==="function"?request.bearerToken():void 0)??request.cookies?.get(cookieName);if(!bearer)return;return Auth.getUserFromToken(bearer)}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/auth",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.294",
+  "version": "0.70.297",
   "description": "A more simplistic way to authenticate.",
   "author": "Chris Breuer",
   "contributors": [
@@ -61,7 +61,7 @@
   },
   "devDependencies": {
     "better-dx": "^0.2.17",
-    "@stacksjs/error-handling": "0.70.294",
-    "@stacksjs/router": "0.70.294"
+    "@stacksjs/error-handling": "0.70.297",
+    "@stacksjs/router": "0.70.297"
   }
 }