@stacksjs/auth 0.70.87 → 0.70.90

package/dist/rbac.js

@@ -0,0 +1,324 @@
+class BoundedMap {
+  max;
+  map = new Map;
+  constructor(max) {
+    this.max = max;
+  }
+  get(key) {
+    return this.map.get(key);
+  }
+  has(key) {
+    return this.map.has(key);
+  }
+  set(key, value) {
+    if (this.map.has(key))
+      this.map.delete(key);
+    this.map.set(key, value);
+    if (this.map.size > this.max) {
+      const oldest = this.map.keys().next().value;
+      if (oldest !== void 0)
+        this.map.delete(oldest);
+    }
+    return this;
+  }
+  delete(key) {
+    return this.map.delete(key);
+  }
+  clear() {
+    this.map.clear();
+  }
+}
+const RBAC_USER_CACHE_MAX = 1e4, cache = {
+  userRoles: new BoundedMap(RBAC_USER_CACHE_MAX),
+  userPermissions: new BoundedMap(RBAC_USER_CACHE_MAX),
+  rolePermissions: new BoundedMap(RBAC_USER_CACHE_MAX),
+  roles: new Map,
+  permissions: new Map
+};
+let store = null;
+export function setRbacStore(rbacStore) {
+  store = rbacStore;
+  flushRbacCache();
+}
+function getStore() {
+  if (!store)
+    throw Error("RBAC store not configured. Call setRbacStore() first.");
+  return store;
+}
+export function flushRbacCache() {
+  cache.userRoles.clear();
+  cache.userPermissions.clear();
+  cache.rolePermissions.clear();
+  cache.roles.clear();
+  cache.permissions.clear();
+}
+function getUserId(user) {
+  if (typeof user === "number") {
+    if (!Number.isFinite(user) || user <= 0)
+      throw TypeError("RBAC user id must be a positive number");
+    return user;
+  }
+  const id = user.id;
+  if (typeof id !== "number" || !Number.isFinite(id) || id <= 0)
+    throw TypeError(`RBAC user id must be a positive number, got ${typeof id} (${String(id)})`);
+  return id;
+}
+export async function createRole(name, guardName = "web", description) {
+  const role = await getStore().createRole(name, guardName, description);
+  cache.roles.set(`${name}:${guardName}`, role);
+  return role;
+}
+export async function findRole(name, guardName = "web") {
+  const cacheKey = `${name}:${guardName}`;
+  if (cache.roles.has(cacheKey))
+    return cache.roles.get(cacheKey);
+  const role = await getStore().findRoleByName(name, guardName);
+  if (role)
+    cache.roles.set(cacheKey, role);
+  return role;
+}
+export async function deleteRole(name, guardName = "web") {
+  const role = await findRole(name, guardName);
+  if (role) {
+    await getStore().deleteRole(role.id);
+    cache.roles.delete(`${name}:${guardName}`);
+    flushRbacCache();
+  }
+}
+export async function getAllRoles(guardName) {
+  return getStore().getAllRoles(guardName);
+}
+export async function createPermission(name, guardName = "web", description) {
+  const permission = await getStore().createPermission(name, guardName, description);
+  cache.permissions.set(`${name}:${guardName}`, permission);
+  return permission;
+}
+export async function findPermission(name, guardName = "web") {
+  const cacheKey = `${name}:${guardName}`;
+  if (cache.permissions.has(cacheKey))
+    return cache.permissions.get(cacheKey);
+  const permission = await getStore().findPermissionByName(name, guardName);
+  if (permission)
+    cache.permissions.set(cacheKey, permission);
+  return permission;
+}
+export async function deletePermission(name, guardName = "web") {
+  const permission = await findPermission(name, guardName);
+  if (permission) {
+    await getStore().deletePermission(permission.id);
+    cache.permissions.delete(`${name}:${guardName}`);
+    flushRbacCache();
+  }
+}
+export async function getAllPermissions(guardName) {
+  return getStore().getAllPermissions(guardName);
+}
+export async function getUserRoles(user) {
+  const userId = getUserId(user);
+  if (cache.userRoles.has(userId))
+    return cache.userRoles.get(userId);
+  const roles = await getStore().getUserRoles(userId);
+  cache.userRoles.set(userId, roles);
+  return roles;
+}
+export async function assignRole(user, roleName, guardName = "web") {
+  const userId = getUserId(user), role = await findRole(roleName, guardName);
+  if (!role)
+    throw Error(`Role '${roleName}' not found.`);
+  await getStore().assignRoleToUser(userId, role.id);
+  cache.userRoles.delete(userId);
+  cache.userPermissions.delete(userId);
+}
+export async function removeRole(user, roleName, guardName = "web") {
+  const userId = getUserId(user), role = await findRole(roleName, guardName);
+  if (!role)
+    return;
+  await getStore().removeRoleFromUser(userId, role.id);
+  cache.userRoles.delete(userId);
+  cache.userPermissions.delete(userId);
+}
+export async function removeAllRoles(user) {
+  const userId = getUserId(user);
+  await getStore().removeAllRolesFromUser(userId);
+  cache.userRoles.delete(userId);
+  cache.userPermissions.delete(userId);
+}
+export async function syncRoles(user, roleNames, guardName = "web") {
+  const userId = getUserId(user), roleIds = [];
+  for (const name of roleNames) {
+    const role = await findRole(name, guardName);
+    if (!role)
+      throw Error(`Role '${name}' not found.`);
+    roleIds.push(role.id);
+  }
+  await getStore().syncUserRoles(userId, roleIds);
+  cache.userRoles.delete(userId);
+  cache.userPermissions.delete(userId);
+}
+export async function hasRole(user, roleName, guardName = "web") {
+  return (await getUserRoles(user)).some((r) => r.name === roleName && r.guard_name === guardName);
+}
+export async function hasAnyRole(user, roleNames, guardName = "web") {
+  const roles = await getUserRoles(user);
+  return roleNames.some((name) => roles.some((r) => r.name === name && r.guard_name === guardName));
+}
+export async function hasAllRoles(user, roleNames, guardName = "web") {
+  const roles = await getUserRoles(user);
+  return roleNames.every((name) => roles.some((r) => r.name === name && r.guard_name === guardName));
+}
+export async function getUserPermissions(user) {
+  const userId = getUserId(user);
+  if (cache.userPermissions.has(userId))
+    return cache.userPermissions.get(userId);
+  const directPermissions = await getStore().getUserDirectPermissions(userId), roles = await getUserRoles(user), rolePermissions = [];
+  for (const role of roles) {
+    const perms = await getRolePermissions(role.id);
+    rolePermissions.push(...perms);
+  }
+  const seen = new Set, allPermissions = [];
+  for (const perm of [...directPermissions, ...rolePermissions])
+    if (!seen.has(perm.id)) {
+      seen.add(perm.id);
+      allPermissions.push(perm);
+    }
+  cache.userPermissions.set(userId, allPermissions);
+  return allPermissions;
+}
+export async function givePermission(user, permissionName, guardName = "web") {
+  const userId = getUserId(user), permission = await findPermission(permissionName, guardName);
+  if (!permission)
+    throw Error(`Permission '${permissionName}' not found.`);
+  await getStore().assignPermissionToUser(userId, permission.id);
+  cache.userPermissions.delete(userId);
+}
+export async function revokePermission(user, permissionName, guardName = "web") {
+  const userId = getUserId(user), permission = await findPermission(permissionName, guardName);
+  if (!permission)
+    return;
+  await getStore().removePermissionFromUser(userId, permission.id);
+  cache.userPermissions.delete(userId);
+}
+export async function revokeAllPermissions(user) {
+  const userId = getUserId(user);
+  await getStore().removeAllPermissionsFromUser(userId);
+  cache.userPermissions.delete(userId);
+}
+export async function syncPermissions(user, permissionNames, guardName = "web") {
+  const userId = getUserId(user), permissionIds = [];
+  for (const name of permissionNames) {
+    const perm = await findPermission(name, guardName);
+    if (!perm)
+      throw Error(`Permission '${name}' not found.`);
+    permissionIds.push(perm.id);
+  }
+  await getStore().syncUserPermissions(userId, permissionIds);
+  cache.userPermissions.delete(userId);
+}
+export async function hasPermission(user, permissionName, guardName = "web") {
+  return (await getUserPermissions(user)).some((p) => p.name === permissionName && p.guard_name === guardName);
+}
+export async function hasAnyPermission(user, permissionNames, guardName = "web") {
+  const permissions = await getUserPermissions(user);
+  return permissionNames.some((name) => permissions.some((p) => p.name === name && p.guard_name === guardName));
+}
+export async function hasAllPermissions(user, permissionNames, guardName = "web") {
+  const permissions = await getUserPermissions(user);
+  return permissionNames.every((name) => permissions.some((p) => p.name === name && p.guard_name === guardName));
+}
+export async function getRolePermissions(roleId) {
+  if (cache.rolePermissions.has(roleId))
+    return cache.rolePermissions.get(roleId);
+  const permissions = await getStore().getRolePermissions(roleId);
+  cache.rolePermissions.set(roleId, permissions);
+  return permissions;
+}
+export async function givePermissionToRole(roleName, permissionName, guardName = "web") {
+  const role = await findRole(roleName, guardName);
+  if (!role)
+    throw Error(`Role '${roleName}' not found.`);
+  const permission = await findPermission(permissionName, guardName);
+  if (!permission)
+    throw Error(`Permission '${permissionName}' not found.`);
+  await getStore().assignPermissionToRole(role.id, permission.id);
+  cache.rolePermissions.delete(role.id);
+  cache.userPermissions.clear();
+}
+export async function revokePermissionFromRole(roleName, permissionName, guardName = "web") {
+  const role = await findRole(roleName, guardName);
+  if (!role)
+    return;
+  const permission = await findPermission(permissionName, guardName);
+  if (!permission)
+    return;
+  await getStore().removePermissionFromRole(role.id, permission.id);
+  cache.rolePermissions.delete(role.id);
+  cache.userPermissions.clear();
+}
+export async function syncRolePermissions(roleName, permissionNames, guardName = "web") {
+  const role = await findRole(roleName, guardName);
+  if (!role)
+    throw Error(`Role '${roleName}' not found.`);
+  const permissionIds = [];
+  for (const name of permissionNames) {
+    const perm = await findPermission(name, guardName);
+    if (!perm)
+      throw Error(`Permission '${name}' not found.`);
+    permissionIds.push(perm.id);
+  }
+  await getStore().syncRolePermissions(role.id, permissionIds);
+  cache.rolePermissions.delete(role.id);
+  cache.userPermissions.clear();
+}
+export function withRbac(user) {
+  const userId = getUserId(user);
+  return Object.assign(user, {
+    hasRole: (roleName, guardName) => hasRole(userId, roleName, guardName),
+    hasAnyRole: (roleNames, guardName) => hasAnyRole(userId, roleNames, guardName),
+    hasAllRoles: (roleNames, guardName) => hasAllRoles(userId, roleNames, guardName),
+    hasPermission: (permissionName, guardName) => hasPermission(userId, permissionName, guardName),
+    hasAnyPermission: (permissionNames, guardName) => hasAnyPermission(userId, permissionNames, guardName),
+    hasAllPermissions: (permissionNames, guardName) => hasAllPermissions(userId, permissionNames, guardName),
+    getRoles: () => getUserRoles(userId),
+    getPermissions: () => getUserPermissions(userId),
+    assignRole: (roleName, guardName) => assignRole(userId, roleName, guardName),
+    removeRole: (roleName, guardName) => removeRole(userId, roleName, guardName),
+    syncRoles: (roleNames, guardName) => syncRoles(userId, roleNames, guardName),
+    givePermission: (permissionName, guardName) => givePermission(userId, permissionName, guardName),
+    revokePermission: (permissionName, guardName) => revokePermission(userId, permissionName, guardName),
+    syncPermissions: (permissionNames, guardName) => syncPermissions(userId, permissionNames, guardName)
+  });
+}
+export const Rbac = {
+  setStore: setRbacStore,
+  flushCache: flushRbacCache,
+  createRole,
+  findRole,
+  deleteRole,
+  getAllRoles,
+  createPermission,
+  findPermission,
+  deletePermission,
+  getAllPermissions,
+  getUserRoles,
+  assignRole,
+  removeRole,
+  removeAllRoles,
+  syncRoles,
+  hasRole,
+  hasAnyRole,
+  hasAllRoles,
+  getUserPermissions,
+  givePermission,
+  revokePermission,
+  revokeAllPermissions,
+  syncPermissions,
+  hasPermission,
+  hasAnyPermission,
+  hasAllPermissions,
+  getRolePermissions,
+  givePermissionToRole,
+  revokePermissionFromRole,
+  syncRolePermissions,
+  withRbac
+};
+export default Rbac;

package/dist/register.js

@@ -0,0 +1,43 @@
+import { config } from "@stacksjs/config";
+import { db } from "@stacksjs/database";
+import { HttpError } from "@stacksjs/error-handling";
+import { User } from "@stacksjs/orm";
+import { makeHash } from "@stacksjs/security";
+import { Auth } from "./authentication";
+import { isUniqueViolation } from "./rbac-store-bqb";
+function duplicateEmailError() {
+  if (config.auth?.registration?.preventEnumeration)
+    return new HttpError(422, "Registration could not be completed. Please check your details and try again.");
+  return new HttpError(409, "Email already exists");
+}
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+export async function register(credentials) {
+  const { email, password, name } = credentials;
+  if (typeof email !== "string" || email.length > 254 || !EMAIL_RE.test(email))
+    throw new HttpError(422, "Email address is invalid");
+  if (typeof password !== "string" || password.length < 8)
+    throw new HttpError(422, "Password must be at least 8 characters");
+  const hashedPassword = await makeHash(password, { algorithm: "bcrypt" }), userId = await db.transaction(async (rawTrx) => {
+    const trx = rawTrx;
+    if (await trx.selectFrom("users").where("email", "=", email).selectAll().executeTakeFirst())
+      throw duplicateEmailError();
+    try {
+      await trx.insertInto("users").values({
+        email,
+        password: hashedPassword,
+        name
+      }).execute();
+    } catch (err) {
+      if (isUniqueViolation(err))
+        throw duplicateEmailError();
+      throw err;
+    }
+    const created = await trx.selectFrom("users").where("email", "=", email).selectAll().executeTakeFirst();
+    if (!created)
+      throw Error("Failed to retrieve created user");
+    return Number(created.id);
+  }), user = await User.find(userId);
+  if (!user)
+    throw Error("Failed to retrieve created user");
+  return { token: await Auth.createToken(user, "user-auth-token") };
+}

package/dist/session-auth.d.ts

@@ -1,4 +1,22 @@
 import { User } from '@stacksjs/orm';
+/**
+ * Decide whether a stored session must be rejected because its captured
+ * fingerprint no longer matches the current request (basic hijack detection,
+ * stacksjs/stacks#1985 — H-6 stored these fields but never compared them).
+ *
+ * OFF by default: a legitimately changing client IP (mobile/VPN) would
+ * otherwise lock the real user out. Opt in via
+ * `config.auth.session.enforceFingerprint` — `true` enforces both fields, or
+ * `{ ip, userAgent }` enforces each independently (userAgent-only is the
+ * safest, since it rarely changes for a real user).
+ *
+ * A field is compared ONLY when both the stored value and a current-request
+ * value are present, so a check outside request scope, or a session logged in
+ * without headers, is never a false "mismatch". On mismatch we reject THIS
+ * request but leave the session row intact — the real owner (original
+ * fingerprint) keeps working; we don't punish them for an attacker's attempt.
+ */
+export declare function fingerprintMismatch(enforce: boolean | { ip?: boolean, userAgent?: boolean } | undefined | null, stored: { ip?: unknown, userAgent?: unknown }, current: { ip: string | null, userAgent: string | null }): boolean;
 /**
  * Authenticate a user via email and password, creating a session.
  * Sessions are persisted to the database so they survive server restarts.

package/dist/session-auth.js

@@ -0,0 +1,151 @@
+import { HttpError } from "@stacksjs/error-handling";
+import { log } from "@stacksjs/logging";
+import { User } from "@stacksjs/orm";
+import { verifyHash } from "@stacksjs/security";
+import { config } from "@stacksjs/config";
+import { db } from "@stacksjs/database";
+import { getCurrentRequest } from "@stacksjs/router";
+import { DUMMY_BCRYPT_HASH } from "./internal-constants";
+import { RateLimiter } from "./rate-limiter";
+function generateSessionId() {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function readRequestFingerprint(override) {
+  if (override)
+    return {
+      ip: override.ip ?? null,
+      userAgent: override.userAgent ?? null
+    };
+  const req = getCurrentRequest();
+  if (!req)
+    return { ip: null, userAgent: null };
+  const headers = req.headers, fwd = headers?.get?.("x-forwarded-for") || headers?.get?.("X-Forwarded-For") || "", realIp = headers?.get?.("x-real-ip") || headers?.get?.("X-Real-IP") || "", ip = (fwd ? fwd.split(",")[0].trim() : "") || realIp || null, userAgent = headers?.get?.("user-agent") || headers?.get?.("User-Agent") || null;
+  return { ip, userAgent };
+}
+export function fingerprintMismatch(enforce, stored, current) {
+  if (!enforce)
+    return !1;
+  const enforceIp = enforce === !0 || !!enforce.ip, enforceUa = enforce === !0 || !!enforce.userAgent;
+  if (!enforceIp && !enforceUa)
+    return !1;
+  if (enforceIp && current.ip != null && stored.ip != null && String(stored.ip) !== current.ip)
+    return !0;
+  if (enforceUa && current.userAgent != null && stored.userAgent != null && String(stored.userAgent) !== current.userAgent)
+    return !0;
+  return !1;
+}
+function sessionFingerprintRejected(session) {
+  return fingerprintMismatch(config.auth?.session?.enforceFingerprint, { ip: session.ip_address, userAgent: session.user_agent }, readRequestFingerprint());
+}
+export async function sessionLogin(email, password, fingerprint) {
+  const normalizedEmail = (email || "").toLowerCase(), isRateLimited = await RateLimiter.isRateLimited(normalizedEmail), user = await User.where("email", email).first(), hashToVerify = user?.password || DUMMY_BCRYPT_HASH, isValid = await verifyHash(password, hashToVerify);
+  if (isRateLimited)
+    throw new HttpError(429, "Too many login attempts. Please try again later.");
+  if (!isValid || !user) {
+    await RateLimiter.recordFailedAttempt(normalizedEmail);
+    throw new HttpError(401, "Invalid credentials");
+  }
+  await RateLimiter.resetAttempts(normalizedEmail);
+  const sessionId = generateSessionId(), expiresAt = new Date(Date.now() + 86400000), { ip, userAgent } = readRequestFingerprint(fingerprint);
+  log.debug(`[auth] Session created for user#${user.id}`);
+  try {
+    await db.insertInto("sessions").values({
+      id: sessionId,
+      user_id: user.id,
+      ip_address: ip,
+      user_agent: userAgent,
+      payload: "{}",
+      last_activity: Math.floor(Date.now() / 1000),
+      expires_at: expiresAt.toISOString()
+    }).execute();
+  } catch (err) {
+    log.error(`[auth] Session persistence failed for user#${user.id}: ${err.message}`);
+    throw new HttpError(500, "Session could not be created. Ensure the `sessions` table exists (run `./buddy migrate`).");
+  }
+  return { user, sessionId };
+}
+export async function sessionLogout(sessionId) {
+  log.debug("[auth] Session destroyed");
+  try {
+    await db.deleteFrom("sessions").where("id", "=", sessionId).execute();
+  } catch (err) {
+    log.debug(`[auth] Session destroy failed: ${err.message}`);
+  }
+}
+export async function sessionDestroyAll(userId) {
+  try {
+    await db.deleteFrom("sessions").where("user_id", "=", userId).execute();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (message.includes("sessions") && /no such table|does not exist|doesn't exist/i.test(message))
+      return;
+    throw err;
+  }
+}
+export async function sessionUser(sessionId) {
+  try {
+    const session = await db.selectFrom("sessions").where("id", "=", sessionId).selectAll().executeTakeFirst();
+    if (!session)
+      return;
+    const expiresAt = session.expires_at ? new Date(String(session.expires_at)).getTime() : 0;
+    if (Date.now() > expiresAt) {
+      await db.deleteFrom("sessions").where("id", "=", sessionId).execute();
+      return;
+    }
+    if (sessionFingerprintRejected(session)) {
+      log.warn("[auth] Session fingerprint mismatch \u2014 rejecting request (possible hijack, session left intact)");
+      return;
+    }
+    return await User.find(session.user_id);
+  } catch {
+    return;
+  }
+}
+export async function sessionCheck(sessionId) {
+  try {
+    const session = await db.selectFrom("sessions").where("id", "=", sessionId).selectAll().executeTakeFirst();
+    if (!session)
+      return !1;
+    const expiresAt = session.expires_at ? new Date(String(session.expires_at)).getTime() : 0;
+    if (Date.now() > expiresAt) {
+      await db.deleteFrom("sessions").where("id", "=", sessionId).execute();
+      return !1;
+    }
+    if (sessionFingerprintRejected(session))
+      return !1;
+    return !0;
+  } catch {
+    return !1;
+  }
+}
+export async function sessionRefresh(sessionId, ttlMs = 86400000) {
+  try {
+    const session = await db.selectFrom("sessions").where("id", "=", sessionId).selectAll().executeTakeFirst();
+    if (!session)
+      return !1;
+    const expiresAt = session.expires_at ? new Date(String(session.expires_at)).getTime() : 0;
+    if (Date.now() > expiresAt) {
+      await db.deleteFrom("sessions").where("id", "=", sessionId).execute();
+      return !1;
+    }
+    if (sessionFingerprintRejected(session))
+      return !1;
+    const newExpiry = new Date(Date.now() + ttlMs);
+    await db.updateTable("sessions").set({
+      expires_at: newExpiry.toISOString(),
+      last_activity: Math.floor(Date.now() / 1000)
+    }).where("id", "=", sessionId).execute();
+    return !0;
+  } catch {
+    return !1;
+  }
+}
+export const SessionAuth = {
+  login: sessionLogin,
+  logout: sessionLogout,
+  destroyAll: sessionDestroyAll,
+  user: sessionUser,
+  check: sessionCheck,
+  refresh: sessionRefresh
+};

package/dist/team.js

@@ -0,0 +1,88 @@
+import { config } from "@stacksjs/config";
+import { db } from "@stacksjs/database";
+import { Auth } from "./authentication";
+import { sessionUser } from "./session-auth";
+export const ACTIVE_TEAM_COOKIE = "active_team";
+export function selectActiveTeam(opts) {
+  const priority = opts.rolePriority ?? { owner: 0, admin: 1 }, sorted = [...opts.memberships ?? []].sort((a, b) => (priority[a.role ?? ""] ?? 2) - (priority[b.role ?? ""] ?? 2)), active = opts.activeTeamId == null ? null : Number(opts.activeTeamId);
+  if (active != null && Number.isFinite(active)) {
+    const member = sorted.find((x) => Number(x.team_id) === active);
+    if (member)
+      return { teamId: active, role: member.role ?? null };
+    if (opts.allowAnyTeam)
+      return { teamId: active, role: "admin" };
+  }
+  const first = sorted[0];
+  return first ? { teamId: Number(first.team_id), role: first.role ?? null } : { teamId: null, role: null };
+}
+export function getActiveTeamPreference(request) {
+  const raw = request.cookies?.get(ACTIVE_TEAM_COOKIE);
+  if (!raw)
+    return null;
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : null;
+}
+export function buildActiveTeamCookie(teamId, opts = {}) {
+  const maxAge = Math.max(0, Math.floor(opts.maxAgeSeconds ?? 31536000)), parts = [`${ACTIVE_TEAM_COOKIE}=${encodeURIComponent(String(teamId))}`, "Path=/", "HttpOnly", "SameSite=Lax", `Max-Age=${maxAge}`];
+  if (opts.secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+export function clearActiveTeamCookie() {
+  return `${ACTIVE_TEAM_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+export async function resolveAuthenticatedMembership(request) {
+  const user = await resolveAuthenticatedUser(request);
+  if (!user?.id)
+    return null;
+  const memberships = await db.selectFrom("team_members").where("user_id", "=", user.id).where("status", "=", "active").select(["team_id", "role"]).execute();
+  if (memberships.length === 0)
+    return null;
+  const picked = selectActiveTeam({
+    memberships: memberships.map((m) => ({
+      team_id: Number(m.team_id),
+      role: m.role == null ? null : String(m.role)
+    })),
+    activeTeamId: getActiveTeamPreference(request)
+  });
+  return picked.teamId != null ? { teamId: picked.teamId, role: picked.role ?? "" } : null;
+}
+export async function resolveTeamContext(request, opts = {}) {
+  const empty = { user: null, teamId: null, role: null, teams: [], activeTeamId: null }, guardName = config.auth?.default || "api", user = (config.auth?.guards?.[guardName]?.driver || "token") === "session" ? await resolveSessionUser(request) : await resolveTokenUser(request);
+  if (!user?.id)
+    return empty;
+  const memberships = await db.selectFrom("team_members").where("user_id", "=", user.id).where("status", "=", "active").select(["team_id", "role"]).execute(), allowAny = opts.allowAnyTeam ? !!opts.allowAnyTeam(user) : !1, activeTeamId = getActiveTeamPreference(request), picked = selectActiveTeam({
+    memberships: memberships.map((m) => ({ team_id: Number(m.team_id), role: String(m.role) })),
+    activeTeamId,
+    allowAnyTeam: allowAny
+  }), roleByTeam = new Map(memberships.map((m) => [Number(m.team_id), String(m.role)]));
+  let teamRows = [];
+  if (allowAny)
+    teamRows = await db.selectFrom("teams").select(["id", "name"]).execute();
+  else {
+    const ids = [...roleByTeam.keys()];
+    teamRows = ids.length ? await db.selectFrom("teams").whereIn("id", ids).select(["id", "name"]).execute() : [];
+  }
+  const teams = teamRows.map((t) => ({ id: Number(t.id), name: String(t.name), role: roleByTeam.get(Number(t.id)) || "viewer" })).sort((a, b) => a.name.localeCompare(b.name));
+  return { user, teamId: picked.teamId, role: picked.role, teams, activeTeamId };
+}
+export async function resolveAuthenticatedTeamId(request) {
+  const membership = await resolveAuthenticatedMembership(request);
+  return membership ? membership.teamId : null;
+}
+export async function resolveAuthenticatedUser(request) {
+  const guardName = config.auth?.default || "api", user = ((config.auth?.guards?.[guardName] || { driver: "token" }).driver || "token") === "session" ? await resolveSessionUser(request) : await resolveTokenUser(request);
+  return user?.id ? user : void 0;
+}
+async function resolveSessionUser(request) {
+  const sessionId = request.cookies?.get("session_id");
+  if (!sessionId)
+    return;
+  return sessionUser(sessionId);
+}
+async function resolveTokenUser(request) {
+  const cookieName = config.auth?.defaultTokenName || "auth-token", bearer = (typeof request.bearerToken === "function" ? request.bearerToken() : void 0) ?? request.cookies?.get(cookieName);
+  if (!bearer)
+    return;
+  return Auth.getUserFromToken(bearer);
+}

package/dist/token.js

@@ -0,0 +1,21 @@
+import { Buffer } from "node:buffer";
+import { createHmac, randomBytes } from "node:crypto";
+import process from "node:process";
+
+export class TokenManager {
+  static generateJWT(userId, expiresInSeconds = 3600) {
+    const appKey = process.env.APP_KEY;
+    if (!appKey)
+      throw Error("APP_KEY is not set. JWT tokens cannot be generated without a secure application key.");
+    const header = {
+      alg: "HS256",
+      typ: "JWT"
+    }, nowSeconds = Math.floor(Date.now() / 1000), payload = {
+      sub: userId,
+      iat: nowSeconds,
+      exp: nowSeconds + expiresInSeconds,
+      jti: randomBytes(16).toString("hex")
+    }, encodedHeader = Buffer.from(JSON.stringify(header)).toString("base64url"), encodedPayload = Buffer.from(JSON.stringify(payload)).toString("base64url"), signature = createHmac("sha256", appKey).update(`${encodedHeader}.${encodedPayload}`).digest("base64url");
+    return `${encodedHeader}.${encodedPayload}.${signature}`;
+  }
+}