@stacksjs/auth 0.72.5 → 0.72.7

package/dist/middleware.d.ts

@@ -10,6 +10,26 @@
  * protected route (#2306).
  */
 export declare function authMiddleware(request: any): Promise<void>;
+/**
+ * The authenticated user, for a middleware or action that needs to reason
+ * about one.
+ *
+ * Every authorization middleware in the scaffold used to open with the same
+ * line:
+ *
+ *     const user = request.user || request._user || request._authenticatedUser
+ *
+ * Two things were wrong with it. `_user` is assigned nowhere in the framework,
+ * so it was a dead term. And `user` is a lazily-resolving MACRO - a function -
+ * so on any request carrying it, `user` WAS the function: truthy enough to
+ * pass the "is anyone signed in" check, then missing every field the caller
+ * went on to read, which surfaces as a confusing 403 rather than an honest
+ * 401.
+ *
+ * Resolving it here means every caller agrees on what "the user" is, and the
+ * answer is a user rather than a callable.
+ */
+export declare function authenticatedUser(request: any): Promise<any | undefined>;
 /**
  * Auth middleware object with handle method (for compatibility with middleware loader)
  * @defaultValue `{ name: 'auth' }`

package/dist/middleware.js

@@ -1 +1 @@
-import{Auth}from"./authentication";import{requestToken}from"./request-token";export async function authMiddleware(request){const bearerToken=requestToken(request);if(!bearerToken){const error=Error("No authentication token provided.");error.statusCode=401;throw error}const user=await Auth.getUserFromToken(bearerToken);if(!user){const error=Error("Invalid or expired authentication token.");error.statusCode=401;throw error}Auth.setUser(user);request._authenticatedUser=user;const accessToken=await Auth.currentAccessToken();request._currentAccessToken=accessToken}export const authMiddlewareHandler={name:"auth",handle:authMiddleware};
+import{Auth}from"./authentication";import{requestToken}from"./request-token";export async function authMiddleware(request){const bearerToken=requestToken(request);if(!bearerToken){const error=Error("No authentication token provided.");error.statusCode=401;throw error}const user=await Auth.getUserFromToken(bearerToken);if(!user){const error=Error("Invalid or expired authentication token.");error.statusCode=401;throw error}Auth.setUser(user);request._authenticatedUser=user;const accessToken=await Auth.currentAccessToken();request._currentAccessToken=accessToken}export const authMiddlewareHandler={name:"auth",handle:authMiddleware};export async function authenticatedUser(request){const cached=request?._authenticatedUser;if(cached&&typeof cached==="object")return cached;const macro=request?.user;if(typeof macro==="function"){const resolved=await macro();return resolved&&typeof resolved==="object"?resolved:void 0}if(macro&&typeof macro==="object")return macro;return}

package/dist/passkey.d.ts

@@ -12,6 +12,17 @@ export type {
   RegistrationOptions,
   AuthenticationOptions,
 } from '@stacksjs/ts-auth';
+/**
+ * Turn a user's stored passkeys into credential descriptors for the options a
+ * server hands the browser.
+ *
+ * Both `GenerateRegistrationAction` (as `excludeCredentials`) and
+ * `GenerateAuthenticationAction` (as `allowCredentials`) need the same three
+ * facts: the stored base64url id, the `type: 'public-key'` the spec requires,
+ * and the transports. Building it in one place is also where the
+ * ArrayBuffer-vs-JSON boundary gets explained once rather than at each call.
+ */
+export declare function passkeyDescriptors(passkeys: readonly PasskeyAttribute[]): PublicKeyCredentialDescriptorJSON[];
 export declare function getUserPasskeys(userId: number): Promise<PasskeyAttribute[]>;
 export declare function getUserPasskey(userId: number, passkeyId: string): Promise<PasskeyAttribute | undefined>;
 /**
@@ -51,6 +62,45 @@ export declare function storeWebAuthnChallenge(userId: number, challenge: string
  * failure.
  */
 export declare function consumeWebAuthnChallenge(userId: number, purpose: WebAuthnChallengePurpose): Promise<Uint8Array | null>;
+/**
+ * A credential descriptor as it crosses the wire.
+ *
+ * `ts-auth`'s `PublicKeyCredentialRequestOptions` describes the shape the
+ * BROWSER wants: `id` as an ArrayBuffer. A server handing those options to a
+ * client has to send JSON, and an ArrayBuffer serializes to `{}` - so ids
+ * travel as the base64url strings the passkey rows already store, and the
+ * client turns them back into buffers before calling `navigator.credentials`.
+ *
+ * The passkey actions were already written against these names; they simply
+ * had nowhere to import them from, so the whole file typechecked as `any`.
+ */
+export declare interface PublicKeyCredentialDescriptorJSON {
+  id: string
+  type: 'public-key'
+  transports?: Array<'ble' | 'internal' | 'nfc' | 'usb' | 'hybrid'>
+}
+export declare interface PublicKeyCredentialRequestOptionsJSON {
+  challenge: Uint8Array
+  rpId?: string
+  allowCredentials?: PublicKeyCredentialDescriptorJSON[]
+  userVerification?: 'required' | 'preferred' | 'discouraged'
+  timeout?: number
+}
+export declare interface PublicKeyCredentialCreationOptionsJSON {
+  challenge: Uint8Array
+  rp: { name: string, id?: string }
+  user: { id: Uint8Array | string, name: string, displayName: string }
+  pubKeyCredParams: Array<{ alg: number, type: 'public-key' }>
+  timeout?: number
+  attestation?: string
+  authenticatorSelection?: {
+    authenticatorAttachment?: 'platform' | 'cross-platform'
+    requireResidentKey?: boolean
+    residentKey?: 'discouraged' | 'preferred' | 'required'
+    userVerification?: 'required' | 'preferred' | 'discouraged'
+  }
+  excludeCredentials?: PublicKeyCredentialDescriptorJSON[]
+}
 export declare interface PasskeyAttribute {
   id: string
   cred_public_key: string

package/dist/passkey.js

@@ -1 +1 @@
-import{Buffer}from"node:buffer";import{db,sqlDateTime,parseSqlDateTime}from"@stacksjs/database";import{User}from"@stacksjs/orm";export{generateRegistrationOptions,generateAuthenticationOptions,verifyRegistrationResponse,verifyAuthenticationResponse,startRegistration,startAuthentication,browserSupportsWebAuthn,browserSupportsWebAuthnAutofill,platformAuthenticatorIsAvailable}from"@stacksjs/ts-auth";export async function getUserPasskeys(userId){return await db.selectFrom("passkeys").selectAll().where("user_id","=",userId).execute()}export async function getUserPasskey(userId,passkeyId){return await db.selectFrom("passkeys").selectAll().where("id","=",passkeyId).where("user_id","=",userId).executeTakeFirst()}export async function updatePasskeyCounter(userId,passkeyId,newCounter){const passkey=await getUserPasskey(userId,passkeyId);if(!passkey)return!1;const stored=Number(passkey.counter??0);if(newCounter<=stored&&!(newCounter===0&&stored===0))return!1;await db.updateTable("passkeys").set({counter:newCounter,last_used_at:formatDateTime()}).where("id","=",passkeyId).where("user_id","=",userId).execute();return!0}export async function setCurrentRegistrationOptions(user,verified){const credentialId=verified.registrationInfo?.credential.id,credentialPublicKey=verified.registrationInfo?.credential.publicKey;if(!credentialId)throw Error("[auth/passkey] WebAuthn registration response is missing credential.id");if(!credentialPublicKey)throw Error("[auth/passkey] WebAuthn registration response is missing credential.publicKey");const passkeyData={id:credentialId,cred_public_key:JSON.stringify(credentialPublicKey),user_id:user.id,webauthn_user_id:user.email||"",counter:verified.registrationInfo?.credential.counter||0,credential_type:verified.registrationInfo?.credentialType||"",device_type:verified.registrationInfo?.credentialDeviceType||"",backup_eligible:!1,backup_status:verified.registrationInfo?.credentialBackedUp||!1,transports:JSON.stringify(["internal"]),last_used_at:formatDateTime()};await db.insertInto("passkeys").values(passkeyData).executeTakeFirstOrThrow()}function formatDateTime(){const date=new Date,pad=(num)=>String(num).padStart(2,"0"),year=date.getFullYear(),month=pad(date.getMonth()+1),day=pad(date.getDate()),hours=pad(date.getHours()),minutes=pad(date.getMinutes()),seconds=pad(date.getSeconds());return`${year}-${month}-${day} ${hours}:${minutes}:${seconds}`}const DEFAULT_CHALLENGE_TTL_SECONDS=300;export async function storeWebAuthnChallenge(userId,challenge,purpose,ttlSeconds=DEFAULT_CHALLENGE_TTL_SECONDS){const expiresAt=sqlDateTime(new Date(Date.now()+ttlSeconds*1000)),encodedChallenge=typeof challenge==="string"?challenge:Buffer.from(challenge).toString("base64url");await db.deleteFrom("webauthn_challenges").where("user_id","=",userId).where("purpose","=",purpose).execute();await db.insertInto("webauthn_challenges").values({user_id:userId,challenge:encodedChallenge,purpose,expires_at:expiresAt}).execute()}export async function consumeWebAuthnChallenge(userId,purpose){const row=await db.selectFrom("webauthn_challenges").where("user_id","=",userId).where("purpose","=",purpose).selectAll().executeTakeFirst();if(!row)return null;await db.deleteFrom("webauthn_challenges").where("user_id","=",userId).where("purpose","=",purpose).execute();const expiresAt=parseSqlDateTime(row.expires_at)?.getTime()??0;if(Date.now()>expiresAt)return null;return Buffer.from(String(row.challenge),"base64url")}
+import{Buffer}from"node:buffer";import{db,sqlDateTime,parseSqlDateTime}from"@stacksjs/database";import{User}from"@stacksjs/orm";export{generateRegistrationOptions,generateAuthenticationOptions,verifyRegistrationResponse,verifyAuthenticationResponse,startRegistration,startAuthentication,browserSupportsWebAuthn,browserSupportsWebAuthnAutofill,platformAuthenticatorIsAvailable}from"@stacksjs/ts-auth";export function passkeyDescriptors(passkeys){return passkeys.map((passkey)=>({id:passkey.id,type:"public-key",transports:parseTransports(passkey.transports)}))}function parseTransports(stored){if(!stored)return["internal"];try{const parsed=JSON.parse(stored);return Array.isArray(parsed)&&parsed.length?parsed:["internal"]}catch{return["internal"]}}export async function getUserPasskeys(userId){return await db.selectFrom("passkeys").selectAll().where("user_id","=",userId).execute()}export async function getUserPasskey(userId,passkeyId){return await db.selectFrom("passkeys").selectAll().where("id","=",passkeyId).where("user_id","=",userId).executeTakeFirst()}export async function updatePasskeyCounter(userId,passkeyId,newCounter){const passkey=await getUserPasskey(userId,passkeyId);if(!passkey)return!1;const stored=Number(passkey.counter??0);if(newCounter<=stored&&!(newCounter===0&&stored===0))return!1;await db.updateTable("passkeys").set({counter:newCounter,last_used_at:formatDateTime()}).where("id","=",passkeyId).where("user_id","=",userId).execute();return!0}export async function setCurrentRegistrationOptions(user,verified){const credentialId=verified.registrationInfo?.credential.id,credentialPublicKey=verified.registrationInfo?.credential.publicKey;if(!credentialId)throw Error("[auth/passkey] WebAuthn registration response is missing credential.id");if(!credentialPublicKey)throw Error("[auth/passkey] WebAuthn registration response is missing credential.publicKey");const passkeyData={id:credentialId,cred_public_key:JSON.stringify(credentialPublicKey),user_id:user.id,webauthn_user_id:user.email||"",counter:verified.registrationInfo?.credential.counter||0,credential_type:verified.registrationInfo?.credentialType||"",device_type:verified.registrationInfo?.credentialDeviceType||"",backup_eligible:!1,backup_status:verified.registrationInfo?.credentialBackedUp||!1,transports:JSON.stringify(["internal"]),last_used_at:formatDateTime()};await db.insertInto("passkeys").values(passkeyData).executeTakeFirstOrThrow()}function formatDateTime(){const date=new Date,pad=(num)=>String(num).padStart(2,"0"),year=date.getFullYear(),month=pad(date.getMonth()+1),day=pad(date.getDate()),hours=pad(date.getHours()),minutes=pad(date.getMinutes()),seconds=pad(date.getSeconds());return`${year}-${month}-${day} ${hours}:${minutes}:${seconds}`}const DEFAULT_CHALLENGE_TTL_SECONDS=300;export async function storeWebAuthnChallenge(userId,challenge,purpose,ttlSeconds=DEFAULT_CHALLENGE_TTL_SECONDS){const expiresAt=sqlDateTime(new Date(Date.now()+ttlSeconds*1000)),encodedChallenge=typeof challenge==="string"?challenge:Buffer.from(challenge).toString("base64url");await db.deleteFrom("webauthn_challenges").where("user_id","=",userId).where("purpose","=",purpose).execute();await db.insertInto("webauthn_challenges").values({user_id:userId,challenge:encodedChallenge,purpose,expires_at:expiresAt}).execute()}export async function consumeWebAuthnChallenge(userId,purpose){const row=await db.selectFrom("webauthn_challenges").where("user_id","=",userId).where("purpose","=",purpose).selectAll().executeTakeFirst();if(!row)return null;await db.deleteFrom("webauthn_challenges").where("user_id","=",userId).where("purpose","=",purpose).execute();const expiresAt=parseSqlDateTime(row.expires_at)?.getTime()??0;if(Date.now()>expiresAt)return null;return Buffer.from(String(row.challenge),"base64url")}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/auth",
   "type": "module",
   "sideEffects": false,
-  "version": "0.72.5",
+  "version": "0.72.7",
   "description": "A more simplistic way to authenticate.",
   "author": "Chris Breuer",
   "contributors": [
@@ -61,7 +61,7 @@
   },
   "devDependencies": {
     "better-dx": "^0.2.23",
-    "@stacksjs/error-handling": "0.72.5",
-    "@stacksjs/router": "0.72.5"
+    "@stacksjs/error-handling": "0.72.7",
+    "@stacksjs/router": "0.72.7"
   }
 }