@stacksjs/auth 0.70.87 → 0.70.88

package/dist/rbac.d.ts

@@ -1,265 +0,0 @@
-import type { UserModel as OrmUserModel } from '@stacksjs/orm';
-/**
- * Set the RBAC store implementation
- */
-export declare function setRbacStore(rbacStore: RbacStore): void;
-/**
- * Flush the RBAC cache
- */
-export declare function flushRbacCache(): void;
-/**
- * Create a new role
- */
-export declare function createRole(name: string, guardName?: string, description?: string): Promise<RoleRecord>;
-/**
- * Find a role by name
- */
-export declare function findRole(name: string, guardName?: string): Promise<RoleRecord | null>;
-/**
- * Delete a role
- */
-export declare function deleteRole(name: string, guardName?: string): Promise<void>;
-/**
- * Get all roles
- */
-export declare function getAllRoles(guardName?: string): Promise<RoleRecord[]>;
-/**
- * Create a new permission
- */
-export declare function createPermission(name: string, guardName?: string, description?: string): Promise<PermissionRecord>;
-/**
- * Find a permission by name
- */
-export declare function findPermission(name: string, guardName?: string): Promise<PermissionRecord | null>;
-/**
- * Delete a permission
- */
-export declare function deletePermission(name: string, guardName?: string): Promise<void>;
-/**
- * Get all permissions
- */
-export declare function getAllPermissions(guardName?: string): Promise<PermissionRecord[]>;
-/**
- * Get all roles for a user
- */
-export declare function getUserRoles(user: UserModel | { id: number } | number): Promise<RoleRecord[]>;
-/**
- * Assign a role to a user
- */
-export declare function assignRole(user: UserModel | { id: number } | number, roleName: string, guardName?: string): Promise<void>;
-/**
- * Remove a role from a user
- */
-export declare function removeRole(user: UserModel | { id: number } | number, roleName: string, guardName?: string): Promise<void>;
-/**
- * Remove all roles from a user
- */
-export declare function removeAllRoles(user: UserModel | { id: number } | number): Promise<void>;
-/**
- * Sync roles for a user (replaces all current roles)
- */
-export declare function syncRoles(user: UserModel | { id: number } | number, roleNames: string[], guardName?: string): Promise<void>;
-/**
- * Check if a user has a specific role
- */
-export declare function hasRole(user: UserModel | { id: number } | number, roleName: string, guardName?: string): Promise<boolean>;
-/**
- * Check if a user has any of the given roles
- */
-export declare function hasAnyRole(user: UserModel | { id: number } | number, roleNames: string[], guardName?: string): Promise<boolean>;
-/**
- * Check if a user has all of the given roles
- */
-export declare function hasAllRoles(user: UserModel | { id: number } | number, roleNames: string[], guardName?: string): Promise<boolean>;
-/**
- * Get all permissions for a user (direct + via roles)
- */
-export declare function getUserPermissions(user: UserModel | { id: number } | number): Promise<PermissionRecord[]>;
-/**
- * Give a direct permission to a user
- */
-export declare function givePermission(user: UserModel | { id: number } | number, permissionName: string, guardName?: string): Promise<void>;
-/**
- * Revoke a direct permission from a user
- */
-export declare function revokePermission(user: UserModel | { id: number } | number, permissionName: string, guardName?: string): Promise<void>;
-/**
- * Revoke all direct permissions from a user
- */
-export declare function revokeAllPermissions(user: UserModel | { id: number } | number): Promise<void>;
-/**
- * Sync direct permissions for a user
- */
-export declare function syncPermissions(user: UserModel | { id: number } | number, permissionNames: string[], guardName?: string): Promise<void>;
-/**
- * Check if a user has a specific permission (direct or via role)
- */
-export declare function hasPermission(user: UserModel | { id: number } | number, permissionName: string, guardName?: string): Promise<boolean>;
-/**
- * Check if a user has any of the given permissions
- */
-export declare function hasAnyPermission(user: UserModel | { id: number } | number, permissionNames: string[], guardName?: string): Promise<boolean>;
-/**
- * Check if a user has all of the given permissions
- */
-export declare function hasAllPermissions(user: UserModel | { id: number } | number, permissionNames: string[], guardName?: string): Promise<boolean>;
-/**
- * Get all permissions for a role
- */
-export declare function getRolePermissions(roleId: number): Promise<PermissionRecord[]>;
-/**
- * Assign a permission to a role
- */
-export declare function givePermissionToRole(roleName: string, permissionName: string, guardName?: string): Promise<void>;
-/**
- * Remove a permission from a role
- */
-export declare function revokePermissionFromRole(roleName: string, permissionName: string, guardName?: string): Promise<void>;
-/**
- * Sync permissions for a role
- */
-export declare function syncRolePermissions(roleName: string, permissionNames: string[], guardName?: string): Promise<void>;
-/**
- * Add RBAC methods to a user object
- *
- * @example
- * const user = withRbac(authenticatedUser)
- * if (await user.hasRole('admin')) { ... }
- * await user.assignRole('editor')
- */
-export declare function withRbac<T extends UserModel | { id: number }>(user: T): T & RbacMethods;
-/**
- * RBAC facade for convenient access
- */
-export declare const Rbac: {
-  setStore: unknown;
-  flushCache: unknown;
-  createRole: typeof createRole;
-  findRole: typeof findRole;
-  deleteRole: typeof deleteRole;
-  getAllRoles: typeof getAllRoles;
-  createPermission: typeof createPermission;
-  findPermission: typeof findPermission;
-  deletePermission: typeof deletePermission;
-  getAllPermissions: typeof getAllPermissions;
-  getUserRoles: typeof getUserRoles;
-  assignRole: typeof assignRole;
-  removeRole: typeof removeRole;
-  removeAllRoles: typeof removeAllRoles;
-  syncRoles: typeof syncRoles;
-  hasRole: typeof hasRole;
-  hasAnyRole: typeof hasAnyRole;
-  hasAllRoles: typeof hasAllRoles;
-  getUserPermissions: typeof getUserPermissions;
-  givePermission: typeof givePermission;
-  revokePermission: typeof revokePermission;
-  revokeAllPermissions: typeof revokeAllPermissions;
-  syncPermissions: typeof syncPermissions;
-  hasPermission: typeof hasPermission;
-  hasAnyPermission: typeof hasAnyPermission;
-  hasAllPermissions: typeof hasAllPermissions;
-  getRolePermissions: typeof getRolePermissions;
-  givePermissionToRole: typeof givePermissionToRole;
-  revokePermissionFromRole: typeof revokePermissionFromRole;
-  syncRolePermissions: typeof syncRolePermissions;
-  withRbac: typeof withRbac
-};
-export declare interface RoleRecord {
-  id: number
-  name: string
-  guard_name: string
-  description?: string
-  created_at?: string
-  updated_at?: string
-}
-export declare interface PermissionRecord {
-  id: number
-  name: string
-  guard_name: string
-  description?: string
-  created_at?: string
-  updated_at?: string
-}
-export declare interface RolePermissionPivot {
-  role_id: number
-  permission_id: number
-  created_at?: string
-}
-export declare interface UserRolePivot {
-  user_id: number
-  role_id: number
-  created_at?: string
-}
-export declare interface UserPermissionPivot {
-  user_id: number
-  permission_id: number
-  created_at?: string
-}
-/**
- * RBAC database adapter interface.
- * Implement this to connect RBAC to your database layer.
- */
-export declare interface RbacStore {
-  findRoleByName(name: string, guardName?: string): Promise<RoleRecord | null>
-  findRoleById(id: number): Promise<RoleRecord | null>
-  createRole(name: string, guardName?: string, description?: string): Promise<RoleRecord>
-  deleteRole(id: number): Promise<void>
-  getAllRoles(guardName?: string): Promise<RoleRecord[]>
-  findPermissionByName(name: string, guardName?: string): Promise<PermissionRecord | null>
-  findPermissionById(id: number): Promise<PermissionRecord | null>
-  createPermission(name: string, guardName?: string, description?: string): Promise<PermissionRecord>
-  deletePermission(id: number): Promise<void>
-  getAllPermissions(guardName?: string): Promise<PermissionRecord[]>
-  getUserRoles(userId: number): Promise<RoleRecord[]>
-  assignRoleToUser(userId: number, roleId: number): Promise<void>
-  removeRoleFromUser(userId: number, roleId: number): Promise<void>
-  removeAllRolesFromUser(userId: number): Promise<void>
-  syncUserRoles(userId: number, roleIds: number[]): Promise<void>
-  getUserDirectPermissions(userId: number): Promise<PermissionRecord[]>
-  assignPermissionToUser(userId: number, permissionId: number): Promise<void>
-  removePermissionFromUser(userId: number, permissionId: number): Promise<void>
-  removeAllPermissionsFromUser(userId: number): Promise<void>
-  syncUserPermissions(userId: number, permissionIds: number[]): Promise<void>
-  getRolePermissions(roleId: number): Promise<PermissionRecord[]>
-  assignPermissionToRole(roleId: number, permissionId: number): Promise<void>
-  removePermissionFromRole(roleId: number, permissionId: number): Promise<void>
-  syncRolePermissions(roleId: number, permissionIds: number[]): Promise<void>
-}
-// ─── Authorizable Mixin (add to user objects) ───────────────────
-export declare interface RbacMethods {
-  hasRole(roleName: string, guardName?: string): Promise<boolean>
-  hasAnyRole(roleNames: string[], guardName?: string): Promise<boolean>
-  hasAllRoles(roleNames: string[], guardName?: string): Promise<boolean>
-  hasPermission(permissionName: string, guardName?: string): Promise<boolean>
-  hasAnyPermission(permissionNames: string[], guardName?: string): Promise<boolean>
-  hasAllPermissions(permissionNames: string[], guardName?: string): Promise<boolean>
-  getRoles(): Promise<RoleRecord[]>
-  getPermissions(): Promise<PermissionRecord[]>
-  assignRole(roleName: string, guardName?: string): Promise<void>
-  removeRole(roleName: string, guardName?: string): Promise<void>
-  syncRoles(roleNames: string[], guardName?: string): Promise<void>
-  givePermission(permissionName: string, guardName?: string): Promise<void>
-  revokePermission(permissionName: string, guardName?: string): Promise<void>
-  syncPermissions(permissionNames: string[], guardName?: string): Promise<void>
-}
-// Use the row/instance shape from orm so role helpers operate on the
-// authenticated user object, not the User class constructor.
-declare type UserModel = OrmUserModel;
-/**
- * FIFO-bounded Map. Wraps Map with a hard size cap; on overflow, the
- * oldest entry (Map insertion order) is evicted. Used for the RBAC
- * per-user caches because the previous unbounded `Map<number, ...>`
- * grew without limit across the process lifetime — a long-running
- * server serving many distinct users would OOM eventually
- * (stacksjs/stacks#1860 M-5). Same shape as `BoundedMap` in
- * `@stacksjs/router/stacks-router.ts`.
- */
-declare class BoundedMap<K, V> {
-  constructor(max: number);
-  get(key: K): V | undefined;
-  has(key: K): boolean;
-  set(key: K, value: V): this;
-  delete(key: K): boolean;
-  clear(): void;
-}
-export default Rbac;

package/dist/register.d.ts

@@ -1,3 +0,0 @@
-import type { AuthToken } from './token';
-import type { NewUser } from '@stacksjs/orm';
-export declare function register(credentials: NewUser): Promise<{ token: AuthToken }>;

package/dist/session-auth.d.ts

@@ -1,49 +0,0 @@
-import { User } from '@stacksjs/orm';
-/**
- * Authenticate a user via email and password, creating a session.
- * Sessions are persisted to the database so they survive server restarts.
- *
- * The `fingerprint` override is mainly for tests; in normal HTTP
- * handling the active request's IP + UA are captured automatically.
- */
-export declare function sessionLogin(email: string, password: string, fingerprint?: { ip?: string | null, userAgent?: string | null }): Promise<{ user: UserModel, sessionId: string }>;
-/**
- * Destroy the session for the given session ID.
- */
-export declare function sessionLogout(sessionId: string): Promise<void>;
-/**
- * Destroy every session for a user — the credential-change sweep.
- * Sessions are validated purely on row existence + `expires_at`, never
- * re-checked against the password hash, so without this a stolen
- * session cookie survives a password reset for up to 24h
- * (stacksjs/stacks#1947).
- *
- * Unlike `sessionLogout`, real failures propagate (fail loud): a reset
- * that reports success while the attacker's session lives would be a
- * lie. A missing `sessions` table alone is a benign no-op — no
- * framework migration creates it (only userland adopting session-auth
- * does), and without the table `sessionCheck` can never validate a
- * session, so there is no credential left to revoke.
- */
-export declare function sessionDestroyAll(userId: number): Promise<void>;
-/**
- * Get the authenticated user from a session ID.
- */
-export declare function sessionUser(sessionId: string): Promise<UserModel | undefined>;
-/**
- * Check if a session is authenticated.
- */
-export declare function sessionCheck(sessionId: string): Promise<boolean>;
-/**
- * Refresh a session's expiry time.
- */
-export declare function sessionRefresh(sessionId: string, ttlMs?: unknown): Promise<boolean>;
-export declare const SessionAuth: {
-  login: unknown;
-  logout: unknown;
-  destroyAll: unknown;
-  user: unknown;
-  check: unknown;
-  refresh: unknown
-};
-declare type UserModel = NonNullable<Awaited<ReturnType<typeof User.find>>>;

package/dist/team.d.ts

@@ -1,121 +0,0 @@
-/**
- * Pure resolver — no I/O — that decides which team is "active" for a user
- * given their memberships and an optional switch preference. Reusable across
- * apps: it encodes the whole workspace-switching precedence in one place.
- *
- * - Honors `activeTeamId` only when the user may access it: a member always
- *   may; a privileged operator may access any team when `allowAnyTeam` is set
- *   (the app decides who is privileged — e.g. a super-admin flag).
- * - Otherwise falls back to the highest-priority membership (owner > admin >
- *   anything else), matching what dashboard pages have always shown, so the
- *   "current team" never differs between a rendered form and the action it
- *   posts to.
- */
-export declare function selectActiveTeam(opts: {
-  memberships: Array<{ team_id: number | string, role?: string | null }>
-  activeTeamId?: number | null
-  allowAnyTeam?: boolean
-  rolePriority?: Record<string, number>
-}): { teamId: number | null, role: string | null };
-/** Read the active-team switch preference from a request's cookie. */
-export declare function getActiveTeamPreference(request: TeamAuthRequest): number | null;
-/**
- * Build the `Set-Cookie` that pins the active team (workspace switcher). A
- * year-long HttpOnly cookie: only the server needs it (SSR reads it, the
- * switch action writes it), and it carries no privilege of its own.
- */
-export declare function buildActiveTeamCookie(teamId: number, opts?: { maxAgeSeconds?: number, secure?: boolean }): string;
-/** Clear the active-team cookie {@link buildActiveTeamCookie} sets. */
-export declare function clearActiveTeamCookie(): string;
-/**
- * Resolve the requesting user's active team membership (team id + role)
- * from their auth credential. Driver-aware: reads config/auth.ts's
- * configured guard driver rather than hardcoding a validation scheme.
- *
- * Dashboard forms are plain HTML POSTs (no client JS, no Authorization
- * header) — the browser only ever sends the auth cookie set on login,
- * so that's checked for the 'token' driver alongside a bearer-header
- * fallback for JS/API callers.
- *
- * Owner membership wins over admin, which wins over any other active
- * membership, when a user belongs to more than one team — the same
- * precedence server-rendered dashboard pages use, so a user never sees
- * a different "current team" between the page that rendered a form and
- * the action that form posts to.
- *
- * Returns `null` when unauthenticated or without an active team
- * membership — callers must treat that as "reject the request," not
- * "fall back to a default team."
- */
-export declare function resolveAuthenticatedMembership(request: TeamAuthRequest): Promise<TeamMembershipResult | null>;
-/**
- * Full team context for a server-rendered dashboard: the authenticated user,
- * the resolved active team (honoring the workspace switcher), and the list of
- * teams the user can switch between. One call replaces the per-page auth+team
- * boilerplate every dashboard view used to copy, and centralizes the
- * switch-aware scoping so pages and the actions they post to never disagree.
- *
- * `opts.allowAnyTeam(user)` lets an app grant an operator (e.g. a super-admin)
- * access to every team — they can switch to, and see, teams they aren't a
- * member of. The full user row is returned so the app can read its own
- * columns (like a super-admin flag) without a second query.
- */
-export declare function resolveTeamContext(request: TeamAuthRequest, opts?: { allowAnyTeam?: (user: any) => boolean }): Promise<TeamContext>;
-/**
- * Team id only — the common case for actions that just need to scope a
- * write to the requester's team. See {@link resolveAuthenticatedMembership}
- * when the caller also needs the role (e.g. owner/admin-only settings).
- */
-export declare function resolveAuthenticatedTeamId(request: TeamAuthRequest): Promise<number | null>;
-/**
- * The authenticated USER (not team) from a request's real auth
- * credential — bearer header first, then the login cookie, driver-aware
- * like {@link resolveAuthenticatedMembership} (which builds on this).
- * For dashboard form actions that operate on the requester themselves
- * (security settings, profile) rather than on team-scoped rows: plain
- * HTML POSTs carry no Authorization header, so `request.user()` (stamped
- * by the auth middleware from a bearer/session) is undefined there and
- * the login cookie is the only credential available.
- */
-export declare function resolveAuthenticatedUser(request: TeamAuthRequest): Promise<{ id: number, email?: string } | undefined>;
-/**
- * Name of the cookie that remembers which team the user last switched the
- * dashboard to (a workspace switcher). It is NOT a security credential: the
- * server re-validates membership against `selectActiveTeam` on every request,
- * so a tampered value can only ever resolve to a team the user already
- * belongs to (or, for operators, any team when `allowAnyTeam` is set).
- */
-export declare const ACTIVE_TEAM_COOKIE: 'active_team';
-/**
- * Team resolution from a request's real auth credential (bearer token or
- * session cookie) — never from a client-supplied form field. Extracted
- * from app-land (stacksjs/status config/auth-team.ts) because every app
- * with team-scoped dashboard forms needs exactly this, and `config/` is
- * for autoloaded config files, not shared helpers.
- *
- * Structural request type on purpose: callers pass whatever request
- * object their action received. Partial objects (tests, non-HTTP
- * callers) resolve to "unauthenticated" rather than crashing.
- */
-export declare interface TeamAuthRequest {
-  bearerToken?: () => string | null | undefined
-  cookies?: { get: (name: string) => string | null | undefined }
-}
-export declare interface TeamMembershipResult {
-  teamId: number
-  role: string
-}
-/** A team the authenticated user may switch the dashboard to. */
-export declare interface SwitchableTeam {
-  id: number
-  name: string
-  role: string
-}
-/** Full dashboard team context — see {@link resolveTeamContext}. */
-export declare interface TeamContext {
-  user: any | null
-  teamId: number | null
-  role: string | null
-  teams: SwitchableTeam[]
-  activeTeamId: number | null
-}

package/dist/token.d.ts

@@ -1,16 +0,0 @@
-export type { AuthToken } from '@stacksjs/types';
-/**
- * `TokenManager` used to expose `createAccessToken` / `validateToken` /
- * `rotateToken` / `revokeToken` static methods that hardcoded a 30-day
- * `expires_at`, bypassed `config.auth.tokenExpiry`, and compared raw
- * tokens against DB-stored hashes (i.e. broken). They had no callers —
- * the real path lives on `Auth` (see authentication.ts) and respects
- * the configured 1-hour expiry plus the refresh-token rotation
- * landed for #1839. Removed entirely so the trap can't fire.
- *
- * `generateJWT` is the one piece worth keeping — `Auth.createTokenForUser`
- * and `Auth.rotateToken` both use it to mint the JWT body.
- */
-export declare class TokenManager {
-  static generateJWT(userId: number, expiresInSeconds?: number): string;
-}