@stacksjs/auth 0.75.461 → 0.75.464

package/dist/admins.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The configured addresses, normalized. Throws on a malformed or repeated
+ * address so a typo fails the deploy rather than granting nothing.
+ */
+export declare function adminEmails(list?: unknown): string[];
+/** "ada.lovelace@…" → "Ada Lovelace": a name until the person (or their identity provider) sets one. */
+export declare function nameFromEmail(email: string): string;
+/** Make every configured address an administrator. Idempotent: a second run reports each one `unchanged`. */
+export declare function provisionAdmins(options?: ProvisionAdminsOptions): Promise<ProvisionedAdmin[]>;
+export declare const databaseAdminAccounts: AdminAccountStore;
+export declare interface AdminRole { name: string, guard?: string }
+/** The accounts side, swappable for tests and for applications whose users carry more than a row. */
+export declare interface AdminAccountStore {
+  findUserId: (email: string) => Promise<number | null>
+  createUser: (account: { email: string, name: string }) => Promise<number>
+}
+export declare interface ProvisionAdminsOptions {
+  emails?: readonly string[]
+  role?: AdminRole | false
+  accounts?: Partial<AdminAccountStore>
+  afterEach?: (admin: { userId: number, email: string, created: boolean }) => Promise<boolean | void>
+}
+export declare interface ProvisionedAdmin {
+  email: string
+  userId: number
+  outcome: 'created' | 'granted' | 'unchanged'
+}

package/dist/admins.js

@@ -0,0 +1 @@
+import{randomBytes}from"node:crypto";import{config}from"@stacksjs/config";import{db,sqlDateTime}from"@stacksjs/database/runtime";import{makeHash}from"@stacksjs/security";import{findAuthUserRowByEmail,normalizeAuthEmail}from"./credential-user";import{assignRole,createRole,findRole,hasFreshRole}from"./rbac";const EMAIL=/^[^\s@]{1,64}@[^\s@]{1,190}\.[^\s@]{2,63}$/;export function adminEmails(list=config.auth?.admins){if(list===void 0||list===null)return[];if(!Array.isArray(list))throw TypeError("auth.admins must be a list of email addresses");const emails=list.map((value)=>normalizeAuthEmail(String(value??""))),invalid=emails.find((email)=>email.length>254||!EMAIL.test(email));if(invalid!==void 0)throw TypeError(`auth.admins lists an invalid email address: "${invalid}"`);const repeated=emails.find((email,index)=>emails.indexOf(email)!==index);if(repeated)throw TypeError(`auth.admins lists ${repeated} twice`);return emails}export function nameFromEmail(email){const words=email.split("@")[0].replace(/\+.*$/,"").split(/[._-]+/).filter(Boolean);return words.length?words.map((word)=>word[0].toUpperCase()+word.slice(1)).join(" "):email}export const databaseAdminAccounts={async findUserId(email){const row=await findAuthUserRowByEmail(email);return row?Number(row.id):null},async createUser({email,name}){const now=sqlDateTime();await db.insertInto("users").values({email,name,email_verified_at:now,created_at:now,updated_at:now,password:await makeHash(randomBytes(32).toString("hex"),{algorithm:"bcrypt"})}).execute();const row=await findAuthUserRowByEmail(email);if(!row)throw Error(`Could not read back the account created for ${email}`);return Number(row.id)}};export async function provisionAdmins(options={}){const emails=adminEmails(options.emails??config.auth?.admins),configured=options.role??config.auth?.adminRole??{name:"admin",guard:"web"},role=configured===!1?null:{name:configured.name,guard:configured.guard??"web"},accounts={...databaseAdminAccounts,...options.accounts};if(role&&emails.length&&!await findRole(role.name,role.guard))await createRole(role.name,role.guard,"Administrators named in config.auth.admins");const results=[];for(const email of emails){const existing=await accounts.findUserId(email),userId=existing??await accounts.createUser({email,name:nameFromEmail(email)});let changed=!1;if(role&&!await hasFreshRole(userId,role.name,role.guard)){await assignRole(userId,role.name,role.guard);changed=!0}if(options.afterEach&&await options.afterEach({userId,email,created:existing===null})===!0)changed=!0;results.push({email,userId,outcome:existing===null?"created":changed?"granted":"unchanged"})}return results}

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+export type { AdminAccountStore, AdminRole, ProvisionAdminsOptions, ProvisionedAdmin } from './admins';
 export type { SeedDefaultRolesResult } from './rbac-seed';
 export * from './authentication';
 export * from './impersonation';
@@ -47,6 +48,7 @@ export * from './permissions';
 export * from './rbac';
 export { createBqbRbacStore } from './rbac-store-bqb';
 export { DEFAULT_ROLE_PACKS, seedDefaultRoles } from './rbac-seed';
+export { adminEmails, databaseAdminAccounts, nameFromEmail, provisionAdmins } from './admins';
 // Email Verification
 export * from './email-verification';
 // Session-based Authentication (SPA Cookie Auth)

package/dist/index.js

@@ -1 +1 @@
-export*from"./authentication";export*from"./impersonation";export{requestImpersonation}from"./impersonation-auth";export*from"./impersonation-store";export*from"./authenticator";export*from"./client";export*from"./credential-user";export*from"./middleware";export*from"./oauth-authorization";export*from"./oauth-authorization-endpoint";export*from"./oauth-authorization-requests";export*from"./oauth-authorization-response";export*from"./oauth-authorization-codes";export*from"./oauth-browser-session";export*from"./oauth-client-registration";export*from"./oauth-consent";export*from"./oauth-delegated-access";export*from"./oauth-grants";export*from"./oauth-introspection";export*from"./oauth-metadata";export*from"./oauth-provider";export*from"./oauth-pruning";export*from"./oauth-pkce";export*from"./oauth-revocation";export*from"./oauth-token-exchange";export*from"./oauth-token-endpoint";export*from"./oauth-token-request";export*from"./oauth-token-response";export*from"./rate-limiter";export*from"./magic-link";export*from"./passkey";export*from"./passkeys";export*from"./password/reset";export*from"./password/reset-token";export*from"./register";export*from"./user";export*from"./tokens";export*from"./gate";export*from"./policy";export*from"./authorizable";export*from"./permissions";export*from"./rbac";export{createBqbRbacStore}from"./rbac-store-bqb";export{DEFAULT_ROLE_PACKS,seedDefaultRoles}from"./rbac-seed";export*from"./email-verification";export*from"./session-auth";export*from"./cookie-auth";export*from"./browser-session";export*from"./request-token";export*from"./page-gate";export*from"./socials";export*from"./session-handoff";export{generateTOTP,verifyTOTP,generateTOTPSecret,totpKeyUri}from"@stacksjs/ts-auth";export*from"./two-factor";export*from"./team";export*from"./referrals";export*from"./oauth-dynamic-registration";export*from"./oauth-protected-resource";export*from"./oauth-userinfo";export*from"./oauth-server";
+export*from"./authentication";export*from"./impersonation";export{requestImpersonation}from"./impersonation-auth";export*from"./impersonation-store";export*from"./authenticator";export*from"./client";export*from"./credential-user";export*from"./middleware";export*from"./oauth-authorization";export*from"./oauth-authorization-endpoint";export*from"./oauth-authorization-requests";export*from"./oauth-authorization-response";export*from"./oauth-authorization-codes";export*from"./oauth-browser-session";export*from"./oauth-client-registration";export*from"./oauth-consent";export*from"./oauth-delegated-access";export*from"./oauth-grants";export*from"./oauth-introspection";export*from"./oauth-metadata";export*from"./oauth-provider";export*from"./oauth-pruning";export*from"./oauth-pkce";export*from"./oauth-revocation";export*from"./oauth-token-exchange";export*from"./oauth-token-endpoint";export*from"./oauth-token-request";export*from"./oauth-token-response";export*from"./rate-limiter";export*from"./magic-link";export*from"./passkey";export*from"./passkeys";export*from"./password/reset";export*from"./password/reset-token";export*from"./register";export*from"./user";export*from"./tokens";export*from"./gate";export*from"./policy";export*from"./authorizable";export*from"./permissions";export*from"./rbac";export{createBqbRbacStore}from"./rbac-store-bqb";export{DEFAULT_ROLE_PACKS,seedDefaultRoles}from"./rbac-seed";export{adminEmails,databaseAdminAccounts,nameFromEmail,provisionAdmins}from"./admins";export*from"./email-verification";export*from"./session-auth";export*from"./cookie-auth";export*from"./browser-session";export*from"./request-token";export*from"./page-gate";export*from"./socials";export*from"./session-handoff";export{generateTOTP,verifyTOTP,generateTOTPSecret,totpKeyUri}from"@stacksjs/ts-auth";export*from"./two-factor";export*from"./team";export*from"./referrals";export*from"./oauth-dynamic-registration";export*from"./oauth-protected-resource";export*from"./oauth-userinfo";export*from"./oauth-server";

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/auth",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.461",
+  "version": "0.75.464",
   "description": "A more simplistic way to authenticate.",
   "author": "Chris Breuer",
   "contributors": [
@@ -59,19 +59,19 @@
   },
   "dependencies": {
     "@stacksjs/bun-router": "^0.1.24",
-    "@stacksjs/cache": "0.75.461",
-    "@stacksjs/config": "0.75.461",
-    "@stacksjs/database": "0.75.461",
-    "@stacksjs/email": "0.75.461",
-    "@stacksjs/env": "0.75.461",
-    "@stacksjs/error-handling": "0.75.461",
-    "@stacksjs/logging": "0.75.461",
-    "@stacksjs/orm": "0.75.461",
-    "@stacksjs/path": "0.75.461",
-    "@stacksjs/router": "0.75.461",
-    "@stacksjs/security": "0.75.461",
-    "@stacksjs/socials": "0.75.461",
-    "@stacksjs/storage": "0.75.461",
+    "@stacksjs/cache": "0.75.464",
+    "@stacksjs/config": "0.75.464",
+    "@stacksjs/database": "0.75.464",
+    "@stacksjs/email": "0.75.464",
+    "@stacksjs/env": "0.75.464",
+    "@stacksjs/error-handling": "0.75.464",
+    "@stacksjs/logging": "0.75.464",
+    "@stacksjs/orm": "0.75.464",
+    "@stacksjs/path": "0.75.464",
+    "@stacksjs/router": "0.75.464",
+    "@stacksjs/security": "0.75.464",
+    "@stacksjs/socials": "0.75.464",
+    "@stacksjs/storage": "0.75.464",
     "@stacksjs/ts-auth": "^0.4.7",
     "ts-qr-codes": "^0.1.8"
   },