@starklabs/forge 1.3.25-builtin-configs.0 → 2.0.0

package/dist/account/AccountModule.js

@@ -0,0 +1,35 @@
+import { FeatureModule } from "../core/FeatureModule.js";
+import { ConfigurationError } from "../errors/index.js";
+import { AccountController } from "./AccountController.js";
+import { RoleController } from "./RoleController.js";
+/** `type: "account"` collections: the signed-in user's own profile (`/me`) and role (`/role`). */
+export class AccountModule extends FeatureModule {
+    type = "account";
+    controller;
+    roles;
+    constructor(services) {
+        super(services);
+        this.controller = new AccountController(services);
+        this.roles = new RoleController(services);
+    }
+    handlers() {
+        return {
+            getMe: this.controller.getMe,
+            updateMe: this.controller.updateMe,
+            deleteMe: this.controller.deleteMe,
+            checkRole: this.roles.checkRole,
+        };
+    }
+    prepare(collection) {
+        if (!this.services.userModel) {
+            throw new ConfigurationError({
+                message: "The account module needs a user model.",
+                hint: "Enable builtinConfig.auth (builtin) or declare a collection of type 'auth'.",
+            });
+        }
+        if (collection.model && collection.schema) {
+            this.services.data.register({ name: collection.model, schema: collection.schema });
+        }
+    }
+}
+//# sourceMappingURL=AccountModule.js.map

package/dist/account/AccountModule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountModule.js","sourceRoot":"","sources":["../../src/account/AccountModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAkB,MAAM,0BAA0B,CAAC;AAEzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,kGAAkG;AAClG,MAAM,OAAO,aAAc,SAAQ,aAAa;IACrC,IAAI,GAAG,SAAS,CAAC;IACT,UAAU,CAAoB;IAC9B,KAAK,CAAiB;IAEvC,YAAY,QAAkB;QAC5B,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChB,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAES,QAAQ;QAChB,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YAC5B,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;YAClC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;YAClC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;SAChC,CAAC;IACJ,CAAC;IAEQ,OAAO,CAAC,UAAsB;QACrC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,OAAO,EAAE,wCAAwC;gBACjD,IAAI,EAAE,6EAA6E;aACpF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;CACF"}

package/dist/account/RoleController.d.ts

@@ -0,0 +1,18 @@
+import type { Request, Response } from "express";
+import type { RouteContext } from "../core/RouteContext.js";
+import type { Services } from "../core/Services.js";
+/**
+ * "What is my role?" for any signed-in user - not just administrators.
+ *
+ * Front-ends use it to decide which screens to show; the server still enforces access on every route
+ * (`auth` / `roles`), so this is information, not authorisation.
+ */
+export declare class RoleController {
+    private readonly services;
+    constructor(services: Services);
+    /** Responds `{ role, isAdmin }`. 404 `ROLE_NOT_FOUND` if the account has no role at all. */
+    checkRole: (req: Request, res: Response, _ctx: RouteContext) => Promise<void>;
+    /** The role the authenticator already loaded, or - when it skipped the user lookup - read it from the database. */
+    private roleOf;
+}
+//# sourceMappingURL=RoleController.d.ts.map

package/dist/account/RoleController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleController.d.ts","sourceRoot":"","sources":["../../src/account/RoleController.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD;;;;;GAKG;AACH,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAArC,YAA6B,QAAQ,EAAE,QAAQ,EAAI;IAEnD,4FAA4F;IAC5F,SAAS,QAAe,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAahF;IAEF,mHAAmH;YACrG,MAAM;CAYrB"}

package/dist/account/RoleController.js

@@ -0,0 +1,43 @@
+import { ConfigurationError, ErrorCode, NotFoundError } from "../errors/index.js";
+/**
+ * "What is my role?" for any signed-in user - not just administrators.
+ *
+ * Front-ends use it to decide which screens to show; the server still enforces access on every route
+ * (`auth` / `roles`), so this is information, not authorisation.
+ */
+export class RoleController {
+    services;
+    constructor(services) {
+        this.services = services;
+    }
+    /** Responds `{ role, isAdmin }`. 404 `ROLE_NOT_FOUND` if the account has no role at all. */
+    checkRole = async (req, res, _ctx) => {
+        const role = await this.roleOf(req);
+        if (!role) {
+            throw new NotFoundError({
+                message: "No role is set for this account.",
+                code: ErrorCode.ROLE_NOT_FOUND,
+                hint: "Add a 'role' field to the user schema, e.g. role: fields.role.",
+            });
+        }
+        this.services.responses.success(res, {
+            message: "Role found successfully.",
+            data: { role, isAdmin: this.services.access.isAdmin({ _id: req.user._id, role }) },
+        });
+    };
+    /** The role the authenticator already loaded, or - when it skipped the user lookup - read it from the database. */
+    async roleOf(req) {
+        const known = req.user?.role;
+        if (typeof known === "string" && known !== "")
+            return known;
+        // With verifyAccessUser on, the authenticator already looked the user up: no role means no role.
+        if (this.services.config.auth.verifyAccessUser)
+            return undefined;
+        if (!this.services.userModel) {
+            throw new ConfigurationError({ message: "The role check needs a user model.", hint: "Enable builtinConfig.auth or declare a collection of type 'auth'." });
+        }
+        const user = await this.services.data.repository(this.services.userModel).findById(req.user?._id ?? "");
+        return typeof user?.role === "string" && user.role !== "" ? user.role : undefined;
+    }
+}
+//# sourceMappingURL=RoleController.js.map

package/dist/account/RoleController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleController.js","sourceRoot":"","sources":["../../src/account/RoleController.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAIlF;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IACI,QAAQ;IAArC,YAA6B,QAAkB;wBAAlB,QAAQ;IAAa,CAAC;IAEnD,4FAA4F;IAC5F,SAAS,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,aAAa,CAAC;gBACtB,OAAO,EAAE,kCAAkC;gBAC3C,IAAI,EAAE,SAAS,CAAC,cAAc;gBAC9B,IAAI,EAAE,gEAAgE;aACvE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;YACnC,OAAO,EAAE,0BAA0B;YACnC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE;SACpF,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,mHAAmH;IAC3G,KAAK,CAAC,MAAM,CAAC,GAAY;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5D,iGAAiG;QACjG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,SAAS,CAAC;QAEjE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,mEAAmE,EAAE,CAAC,CAAC;QAC7J,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACxG,OAAO,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,CAAC;CACF"}

package/dist/account/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./AccountModule.js";
+export * from "./AccountController.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/account/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/account/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC"}

package/dist/account/index.js

@@ -0,0 +1,3 @@
+export * from "./AccountModule.js";
+export * from "./AccountController.js";
+//# sourceMappingURL=index.js.map

package/dist/account/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/account/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC"}

package/dist/admin/AdminModule.d.ts

@@ -0,0 +1,19 @@
+import { FeatureModule, type HandlerFn } from "../core/FeatureModule.js";
+import type { Services } from "../core/Services.js";
+import type { Collection } from "../types/Collection.js";
+import type { AccessLevel } from "../types/Route.js";
+/**
+ * `type: "admin"` collections. Routes default to administrators only.
+ *
+ * @deprecated Kept so 1.x apps keep working. The role check is not admin-specific: use `type: "account"` with
+ * `handler: "checkRole"` (`GET /account/role`), and protect other routes with `auth: "admin"` or `roles: [...]`.
+ */
+export declare class AdminModule extends FeatureModule {
+    readonly type = "admin";
+    private readonly roles;
+    constructor(services: Services);
+    protected handlers(): Readonly<Record<string, HandlerFn>>;
+    prepare(collection: Collection): void;
+    protected defaultAuth(): AccessLevel;
+}
+//# sourceMappingURL=AdminModule.d.ts.map

package/dist/admin/AdminModule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminModule.d.ts","sourceRoot":"","sources":["../../src/admin/AdminModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;GAKG;AACH,qBAAa,WAAY,SAAQ,aAAa;IAC5C,QAAQ,CAAC,IAAI,WAAW;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IAEvC,YAAY,QAAQ,EAAE,QAAQ,EAG7B;IAED,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAMxD;IAEQ,OAAO,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAM7C;IAED,UAAmB,WAAW,IAAI,WAAW,CAE5C;CACF"}

package/dist/admin/AdminModule.js

@@ -0,0 +1,32 @@
+import { FeatureModule } from "../core/FeatureModule.js";
+import { RoleController } from "../account/RoleController.js";
+/**
+ * `type: "admin"` collections. Routes default to administrators only.
+ *
+ * @deprecated Kept so 1.x apps keep working. The role check is not admin-specific: use `type: "account"` with
+ * `handler: "checkRole"` (`GET /account/role`), and protect other routes with `auth: "admin"` or `roles: [...]`.
+ */
+export class AdminModule extends FeatureModule {
+    type = "admin";
+    roles;
+    constructor(services) {
+        super(services);
+        this.roles = new RoleController(services);
+    }
+    handlers() {
+        return {
+            checkRole: this.roles.checkRole,
+            /** @deprecated The 1.x name of `checkRole`. It always returned the caller's role, whatever it was. */
+            checkAdmin: this.roles.checkRole,
+        };
+    }
+    prepare(collection) {
+        if (collection.routes.some((r) => r.handler === "checkAdmin")) {
+            this.services.logger.warn(`'${collection.route}': handler 'checkAdmin' is deprecated - it returns the caller's role, whatever it is. Rename it to 'checkRole'.`);
+        }
+    }
+    defaultAuth() {
+        return "admin";
+    }
+}
+//# sourceMappingURL=AdminModule.js.map

package/dist/admin/AdminModule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminModule.js","sourceRoot":"","sources":["../../src/admin/AdminModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAkB,MAAM,0BAA0B,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAI9D;;;;;GAKG;AACH,MAAM,OAAO,WAAY,SAAQ,aAAa;IACnC,IAAI,GAAG,OAAO,CAAC;IACP,KAAK,CAAiB;IAEvC,YAAY,QAAkB;QAC5B,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAES,QAAQ;QAChB,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;YAC/B,sGAAsG;YACtG,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;SACjC,CAAC;IACJ,CAAC;IAEQ,OAAO,CAAC,UAAsB;QACrC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,UAAU,CAAC,KAAK,iHAAiH,CACtI,CAAC;QACJ,CAAC;IACH,CAAC;IAEkB,WAAW;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/admin/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./AdminModule.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/admin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC"}

package/dist/admin/index.js

@@ -0,0 +1,2 @@
+export * from "./AdminModule.js";
+//# sourceMappingURL=index.js.map

package/dist/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC"}

package/dist/auth/AccountLinkPolicy.d.ts

@@ -0,0 +1,17 @@
+import type { ForgeConfig } from "../config/ForgeConfig.js";
+import type { AccountLinking } from "../config/ForgeOptions.js";
+/**
+ * May a sign-in that proves ownership of an e-mail address (an OAuth provider, a magic link) log in to an
+ * account that already exists under that address? One rule, shared by every such method.
+ *
+ * It matters because of *account pre-hijacking*: if the existing account was created by someone else with a
+ * password and no e-mail check, an attacker can register `victim@x.com` first, wait for the victim to sign
+ * in the "safe" way, and keep their own password for the shared account.
+ */
+export declare class AccountLinkPolicy {
+    private readonly config;
+    constructor(config: ForgeConfig);
+    isAllowed(policy: AccountLinking): boolean;
+    assertMayLink(policy: AccountLinking, via: string): void;
+}
+//# sourceMappingURL=AccountLinkPolicy.d.ts.map

package/dist/auth/AccountLinkPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountLinkPolicy.d.ts","sourceRoot":"","sources":["../../src/auth/AccountLinkPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAGhE;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,WAAW,EAAI;IAEpD,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAEzC;IAED,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAUvD;CACF"}

package/dist/auth/AccountLinkPolicy.js

@@ -0,0 +1,30 @@
+import { ConflictError, ErrorCode } from "../errors/index.js";
+/**
+ * May a sign-in that proves ownership of an e-mail address (an OAuth provider, a magic link) log in to an
+ * account that already exists under that address? One rule, shared by every such method.
+ *
+ * It matters because of *account pre-hijacking*: if the existing account was created by someone else with a
+ * password and no e-mail check, an attacker can register `victim@x.com` first, wait for the victim to sign
+ * in the "safe" way, and keep their own password for the shared account.
+ */
+export class AccountLinkPolicy {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    isAllowed(policy) {
+        return policy === "always" || (policy === "auto" && this.config.auth.signupMode === "otp");
+    }
+    assertMayLink(policy, via) {
+        if (this.isAllowed(policy))
+            return;
+        throw new ConflictError({
+            message: "An account with this e-mail already exists. Please sign in with your e-mail and password.",
+            code: ErrorCode.ACCOUNT_LINK_BLOCKED,
+            hint: policy === "never"
+                ? `accountLinking is 'never' for ${via}.`
+                : "Accounts are linked automatically only when sign-up verifies e-mail addresses (auth.signupMode: 'otp'). Set accountLinking: 'always' to link anyway.",
+        });
+    }
+}
+//# sourceMappingURL=AccountLinkPolicy.js.map

package/dist/auth/AccountLinkPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountLinkPolicy.js","sourceRoot":"","sources":["../../src/auth/AccountLinkPolicy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACC,MAAM;IAAnC,YAA6B,MAAmB;sBAAnB,MAAM;IAAgB,CAAC;IAEpD,SAAS,CAAC,MAAsB;QAC9B,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;IAC7F,CAAC;IAED,aAAa,CAAC,MAAsB,EAAE,GAAW;QAC/C,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO;QACnC,MAAM,IAAI,aAAa,CAAC;YACtB,OAAO,EAAE,2FAA2F;YACpG,IAAI,EAAE,SAAS,CAAC,oBAAoB;YACpC,IAAI,EACF,MAAM,KAAK,OAAO;gBAChB,CAAC,CAAC,iCAAiC,GAAG,GAAG;gBACzC,CAAC,CAAC,sJAAsJ;SAC7J,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/auth/AuthController.d.ts

@@ -0,0 +1,24 @@
+import type { Request, Response } from "express";
+import type { RouteContext } from "../core/RouteContext.js";
+import type { Services } from "../core/Services.js";
+import type { AuthService } from "./AuthService.js";
+/** HTTP adapter for {@link AuthService}: reads requests, sets cookies, writes responses. */
+export declare class AuthController {
+    private readonly services;
+    private readonly auth;
+    constructor(services: Services, auth: () => AuthService);
+    private get fields();
+    /** `GET /auth/methods`: what the front-end can offer on its sign-in screen. */
+    authMethods: (_req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    signup: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    login: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    verifyOTP: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    resendOTP: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    forgotPassword: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    resetPassword: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    refresh: (req: Request, res: Response, _ctx: RouteContext) => Promise<void>;
+    logout: (req: Request, res: Response, _ctx: RouteContext) => Promise<void>;
+    private respond;
+    private refreshTokenFrom;
+}
+//# sourceMappingURL=AuthController.d.ts.map

package/dist/auth/AuthController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthController.d.ts","sourceRoot":"","sources":["../../src/auth/AuthController.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAe,MAAM,kBAAkB,CAAC;AAGjE,4FAA4F;AAC5F,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFvB,YACmB,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,WAAW,EACtC;IAEJ,OAAO,KAAK,MAAM,GAEjB;IAED,+EAA+E;IAC/E,WAAW,SAAgB,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAYlF;IAEF,MAAM,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAI5E;IAEF,KAAK,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAI3E;IAEF,SAAS,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAS/E;IAEF,SAAS,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAI/E;IAEF,cAAc,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAKpF;IAEF,aAAa,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CASnF;IAEF,OAAO,QAAe,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAO9E;IAEF,MAAM,QAAe,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAI7E;IAEF,OAAO,CAAC,OAAO;IAiBf,OAAO,CAAC,gBAAgB;CAUzB"}

package/dist/auth/AuthController.js

@@ -0,0 +1,99 @@
+import { ErrorCode, UnauthorizedError } from "../errors/index.js";
+/** HTTP adapter for {@link AuthService}: reads requests, sets cookies, writes responses. */
+export class AuthController {
+    services;
+    auth;
+    constructor(services, auth) {
+        this.services = services;
+        this.auth = auth;
+    }
+    get fields() {
+        return this.services.config.auth.fields;
+    }
+    /** `GET /auth/methods`: what the front-end can offer on its sign-in screen. */
+    authMethods = async (_req, res, ctx) => {
+        const { auth, apiPrefix } = this.services.config;
+        const base = `${apiPrefix}/${ctx.collection.route}`;
+        this.services.responses.success(res, {
+            message: "Sign-in methods fetched successfully.",
+            data: {
+                password: { signup: auth.signupMode, login: auth.loginMode },
+                magicLink: auth.magicLink ? { sameDevice: auth.magicLink.sameDevice, allowSignup: auth.magicLink.allowSignup } : null,
+                oauth: this.services.oauth.list().map((p) => ({ name: p.name, displayName: p.displayName, url: `${base}/oauth/${p.name}` })),
+                mfa: auth.mfa ? { totp: true } : null,
+            },
+        });
+    };
+    signup = async (req, res, ctx) => {
+        const body = ctx.parseBody(req.body);
+        const mode = ctx.route.mode ?? this.services.config.auth.signupMode;
+        this.respond(res, ctx, await this.auth().signup(body, mode, req), "Signed up successfully.");
+    };
+    login = async (req, res, ctx) => {
+        const body = ctx.parseBody(req.body);
+        const mode = ctx.route.mode ?? this.services.config.auth.loginMode;
+        this.respond(res, ctx, await this.auth().login(body, mode, req), "Logged in successfully.");
+    };
+    verifyOTP = async (req, res, ctx) => {
+        const body = ctx.parseBody(req.body);
+        const outcome = await this.auth().verifyOtp(String(body[this.fields.email]), body[this.fields.purpose], String(body[this.fields.otp]), req);
+        this.respond(res, ctx, outcome, "Verified successfully.");
+    };
+    resendOTP = async (req, res, ctx) => {
+        const body = ctx.parseBody(req.body);
+        await this.auth().resendOtp(String(body[this.fields.email]), body[this.fields.purpose]);
+        this.services.responses.success(res, { message: "A new code has been sent." });
+    };
+    forgotPassword = async (req, res, ctx) => {
+        const body = ctx.parseBody(req.body);
+        await this.auth().forgotPassword(String(body[this.fields.email]));
+        // Same answer whether or not the account exists.
+        this.services.responses.success(res, { message: "If an account exists for this e-mail, a code has been sent." });
+    };
+    resetPassword = async (req, res, ctx) => {
+        const body = ctx.parseBody(req.body);
+        await this.auth().resetPassword(String(body[this.fields.email]), String(body.resetToken), String(body[this.fields.password]));
+        this.services.cookies.clear(res);
+        this.services.responses.success(res, { message: "Password reset successfully. Please log in." });
+    };
+    refresh = async (req, res, _ctx) => {
+        const result = await this.services.sessions.refresh(this.refreshTokenFrom(req), req);
+        this.services.cookies.set(res, result);
+        this.services.responses.success(res, {
+            message: "Token refreshed successfully.",
+            extra: this.services.sessionResponder.tokenBody({ accessToken: result.accessToken, ...(result.refreshToken ? { refreshToken: result.refreshToken } : {}) }),
+        });
+    };
+    logout = async (req, res, _ctx) => {
+        await this.services.sessions.revoke(this.refreshTokenFrom(req));
+        this.services.cookies.clear(res);
+        this.services.responses.success(res, { message: "Logged out successfully." });
+    };
+    respond(res, ctx, outcome, message) {
+        switch (outcome.kind) {
+            case "code-sent":
+                this.services.responses.success(res, { message: "A verification code has been sent to your e-mail." });
+                return;
+            case "reset-token":
+                this.services.responses.success(res, {
+                    message: "Code verified. Use the reset token to set a new password.",
+                    extra: { resetToken: outcome.resetToken },
+                });
+                return;
+            case "mfa-required":
+            case "session":
+                this.services.sessionResponder.sendLogin(res, outcome, { message, hiddenFields: ctx.route.config?.hiddenFields });
+        }
+    }
+    refreshTokenFrom(req) {
+        const name = this.services.config.auth.refreshTokenName;
+        const fromCookie = req.cookies?.[name];
+        const fromBody = req.body?.[name];
+        const value = fromCookie ?? fromBody;
+        if (value !== undefined && typeof value !== "string") {
+            throw new UnauthorizedError({ message: "The refresh token is invalid.", code: ErrorCode.REFRESH_TOKEN_INVALID });
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=AuthController.js.map

package/dist/auth/AuthController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthController.js","sourceRoot":"","sources":["../../src/auth/AuthController.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAMlE,4FAA4F;AAC5F,MAAM,OAAO,cAAc;IAEN,QAAQ;IACR,IAAI;IAFvB,YACmB,QAAkB,EAClB,IAAuB;wBADvB,QAAQ;oBACR,IAAI;IACpB,CAAC;IAEJ,IAAY,MAAM;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;IAC1C,CAAC;IAED,+EAA+E;IAC/E,WAAW,GAAG,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QACrF,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;YACnC,OAAO,EAAE,uCAAuC;YAChD,IAAI,EAAE;gBACJ,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;gBAC5D,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;gBACrH,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC5H,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;aACtC;SACF,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC/F,CAAC,CAAC;IAEF,KAAK,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QAC9E,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC9F,CAAC,CAAC;IAEF,SAAS,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QAClF,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAe,EACvC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAC7B,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,SAAS,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QAClF,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAe,CAAC,CAAC;QACtG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC;IAEF,cAAc,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QACvF,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClE,iDAAiD;QACjD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,6DAA6D,EAAE,CAAC,CAAC;IACnH,CAAC,CAAC;IAEF,aAAa,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QACtF,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,aAAa,CAC7B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAC/B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EACvB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC;IAEF,OAAO,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;YACnC,OAAO,EAAE,+BAA+B;YACxC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;SAC5J,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAChF,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC;IAEM,OAAO,CAAC,GAAa,EAAE,GAAiB,EAAE,OAAoB,EAAE,OAAe;QACrF,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,WAAW;gBACd,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;gBACvG,OAAO;YACT,KAAK,aAAa;gBAChB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;oBACnC,OAAO,EAAE,2DAA2D;oBACpE,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE;iBAC1C,CAAC,CAAC;gBACH,OAAO;YACT,KAAK,cAAc,CAAC;YACpB,KAAK,SAAS;gBACZ,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,GAAY;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;QACxD,MAAM,UAAU,GAAI,GAAG,CAAC,OAA+C,EAAE,CAAC,IAAI,CAAC,CAAC;QAChF,MAAM,QAAQ,GAAI,GAAG,CAAC,IAA4C,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,UAAU,IAAI,QAAQ,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,SAAS,CAAC,qBAAqB,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/auth/AuthModule.d.ts

@@ -0,0 +1,24 @@
+import { FeatureModule, type HandlerFn } from "../core/FeatureModule.js";
+import type { Services } from "../core/Services.js";
+import type { Collection } from "../types/Collection.js";
+import type { AccessLevel, Route } from "../types/Route.js";
+/**
+ * `type: "auth"` collections: every way of signing in (password, e-mailed code, magic link, social login),
+ * the second factor, password reset, refresh and logout.
+ */
+export declare class AuthModule extends FeatureModule {
+    readonly type = "auth";
+    private userFields;
+    private readonly graph;
+    private readonly controller;
+    private readonly oauthController;
+    private readonly magicController;
+    private readonly mfaController;
+    constructor(services: Services);
+    protected handlers(): Readonly<Record<string, HandlerFn>>;
+    protected defaultAuth(): AccessLevel;
+    /** Everything that can be brute-forced or costs money gets the strict limiter. */
+    protected isSensitive(route: Route): boolean;
+    prepare(collection: Collection): void;
+}
+//# sourceMappingURL=AuthModule.d.ts.map

package/dist/auth/AuthModule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthModule.d.ts","sourceRoot":"","sources":["../../src/auth/AuthModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAOpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAS5D;;;GAGG;AACH,qBAAa,UAAW,SAAQ,aAAa;IAC3C,QAAQ,CAAC,IAAI,UAAU;IACvB,OAAO,CAAC,UAAU,CAAkC;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAC5C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IACtD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAE9C,YAAY,QAAQ,EAAE,QAAQ,EAO7B;IAED,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAyBxD;IAED,UAAmB,WAAW,IAAI,WAAW,CAE5C;IAED,kFAAkF;IAClF,UAAmB,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAEpD;IAEQ,OAAO,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAkB7C;CACF"}

package/dist/auth/AuthModule.js

@@ -0,0 +1,84 @@
+import { FeatureModule } from "../core/FeatureModule.js";
+import { magicLinkModel, mfaFactorModel, oauthIdentityModel, otpRequestModel, refreshTokenModel, MAGIC_LINK_MODEL, MFA_FACTOR_MODEL, OAUTH_IDENTITY_MODEL, OTP_REQUEST_MODEL, REFRESH_TOKEN_MODEL, } from "../data/internalModels.js";
+import { OAuthController } from "../oauth/OAuthController.js";
+import { ConfigurationError } from "../errors/index.js";
+import { AuthController } from "./AuthController.js";
+import { AuthServices } from "./AuthServices.js";
+import { MagicLinkController } from "./MagicLinkController.js";
+import { MfaController } from "./MfaController.js";
+/** Handlers that are cheap, read-only or already protected, so they use the global rate limit only. */
+const LIGHT_HANDLERS = new Set(["refresh", "logout", "oauthProviders", "authMethods", "mfaStatus"]);
+/**
+ * `type: "auth"` collections: every way of signing in (password, e-mailed code, magic link, social login),
+ * the second factor, password reset, refresh and logout.
+ */
+export class AuthModule extends FeatureModule {
+    type = "auth";
+    userFields = new Set();
+    graph;
+    controller;
+    oauthController;
+    magicController;
+    mfaController;
+    constructor(services) {
+        super(services);
+        this.graph = new AuthServices(services, () => this.userFields);
+        this.controller = new AuthController(services, () => this.graph.auth);
+        this.oauthController = new OAuthController(services, () => this.graph.oauth);
+        this.magicController = new MagicLinkController(services, () => this.graph.magicLink);
+        this.mfaController = new MfaController(services, () => this.graph.requireMfa(), () => this.graph.completer);
+    }
+    handlers() {
+        const c = this.controller;
+        const m = this.mfaController;
+        return {
+            authMethods: c.authMethods,
+            signup: c.signup,
+            login: c.login,
+            verifyOTP: c.verifyOTP,
+            resendOTP: c.resendOTP,
+            forgotPassword: c.forgotPassword,
+            resetPassword: c.resetPassword,
+            refresh: c.refresh,
+            logout: c.logout,
+            oauthProviders: this.oauthController.oauthProviders,
+            oauthStart: this.oauthController.oauthStart,
+            oauthCallback: this.oauthController.oauthCallback,
+            magicLinkRequest: this.magicController.magicLinkRequest,
+            magicLinkVerify: this.magicController.magicLinkVerify,
+            mfaStatus: m.mfaStatus,
+            mfaSetup: m.mfaSetup,
+            mfaEnable: m.mfaEnable,
+            mfaVerify: m.mfaVerify,
+            mfaDisable: m.mfaDisable,
+            mfaRecoveryCodes: m.mfaRecoveryCodes,
+        };
+    }
+    defaultAuth() {
+        return "public";
+    }
+    /** Everything that can be brute-forced or costs money gets the strict limiter. */
+    isSensitive(route) {
+        return !LIGHT_HANDLERS.has(route.handler);
+    }
+    prepare(collection) {
+        if (!collection.model || !collection.schema) {
+            throw new ConfigurationError({ message: `The '${collection.route}' auth collection needs 'model' and 'schema'.` });
+        }
+        const { data, sanitizer, compiler, config } = this.services;
+        data.register({ name: collection.model, schema: collection.schema });
+        sanitizer.addSecrets(compiler.secretFieldsOf(collection.schema));
+        const internal = [
+            [REFRESH_TOKEN_MODEL, () => refreshTokenModel(collection.model)],
+            [OTP_REQUEST_MODEL, () => otpRequestModel()],
+            ...(this.services.oauth.size > 0 ? [[OAUTH_IDENTITY_MODEL, () => oauthIdentityModel(collection.model)]] : []),
+            ...(config.auth.magicLink ? [[MAGIC_LINK_MODEL, () => magicLinkModel()]] : []),
+            ...(config.auth.mfa ? [[MFA_FACTOR_MODEL, () => mfaFactorModel(collection.model)]] : []),
+        ];
+        for (const [name, definition] of internal)
+            if (!data.has(name))
+                data.register(definition());
+        this.userFields = new Set(Object.keys(collection.schema));
+    }
+}
+//# sourceMappingURL=AuthModule.js.map

package/dist/auth/AuthModule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthModule.js","sourceRoot":"","sources":["../../src/auth/AuthModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAkB,MAAM,0BAA0B,CAAC;AAEzE,OAAO,EACL,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EACtF,gBAAgB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,mBAAmB,GACjG,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,uGAAuG;AACvG,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAEpG;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,aAAa;IAClC,IAAI,GAAG,MAAM,CAAC;IACf,UAAU,GAAwB,IAAI,GAAG,EAAE,CAAC;IACnC,KAAK,CAAe;IACpB,UAAU,CAAiB;IAC3B,eAAe,CAAkB;IACjC,eAAe,CAAsB;IACrC,aAAa,CAAgB;IAE9C,YAAY,QAAkB;QAC5B,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7E,IAAI,CAAC,eAAe,GAAG,IAAI,mBAAmB,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9G,CAAC;IAES,QAAQ;QAChB,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;QAC7B,OAAO;YACL,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,cAAc;YACnD,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,UAAU;YAC3C,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,aAAa;YACjD,gBAAgB,EAAE,IAAI,CAAC,eAAe,CAAC,gBAAgB;YACvD,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,eAAe;YACrD,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;SACrC,CAAC;IACJ,CAAC;IAEkB,WAAW;QAC5B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kFAAkF;IAC/D,WAAW,CAAC,KAAY;QACzC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAEQ,OAAO,CAAC,UAAsB;QACrC,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,QAAQ,UAAU,CAAC,KAAK,+CAA+C,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAEjE,MAAM,QAAQ,GAAG;YACf,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,KAAM,CAAC,CAAC;YACjE,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC,KAAM,CAAC,CAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,KAAM,CAAC,CAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1F,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAE5F,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;CACF"}

package/dist/auth/AuthService.d.ts

@@ -0,0 +1,40 @@
+import type { Request } from "express";
+import type { ForgeConfig } from "../config/ForgeConfig.js";
+import type { DataSource, Doc } from "../data/Repository.js";
+import type { PasswordHasher } from "../security/PasswordHasher.js";
+import type { OtpPurpose, OtpService } from "./OtpService.js";
+import type { LoginCompleter, LoginResult } from "./LoginCompleter.js";
+import type { SessionService } from "./SessionService.js";
+export type AuthOutcome = LoginResult | {
+    kind: "code-sent";
+} | {
+    kind: "reset-token";
+    resetToken: string;
+};
+/** The authentication use cases. Knows nothing about HTTP responses. */
+export declare class AuthService {
+    private readonly config;
+    private readonly data;
+    private readonly userModel;
+    private readonly hasher;
+    private readonly sessions;
+    private readonly otp;
+    private readonly completer;
+    constructor(config: ForgeConfig, data: DataSource, userModel: string, hasher: PasswordHasher, sessions: SessionService, otp: OtpService, completer: LoginCompleter);
+    private get users();
+    private get fields();
+    signup(body: Record<string, unknown>, mode: "credentials" | "otp", req: Request): Promise<AuthOutcome>;
+    login(body: Record<string, unknown>, mode: "credentials" | "otp", req: Request): Promise<AuthOutcome>;
+    verifyOtp(email: string, purpose: OtpPurpose, code: string, req: Request): Promise<AuthOutcome>;
+    resendOtp(email: string, purpose: OtpPurpose): Promise<void>;
+    /** Always succeeds from the caller's point of view, so it cannot be used to discover registered e-mails. */
+    forgotPassword(email: string): Promise<void>;
+    resetPassword(email: string, resetToken: string, newPassword: string): Promise<void>;
+    /** Verifies e-mail + password with the same error and timing for "no such user" and "wrong password". */
+    checkCredentials(email: string, password: string): Promise<Doc>;
+    private prepareNewUser;
+    private emailOf;
+    private nameOf;
+    private invalidCredentials;
+}
+//# sourceMappingURL=AuthService.d.ts.map

package/dist/auth/AuthService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthService.d.ts","sourceRoot":"","sources":["../../src/auth/AuthService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,KAAK,EAAE,UAAU,EAAE,GAAG,EAAc,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAGpE,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5G,wEAAwE;AACxE,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAP5B,YACmB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,cAAc,EACxC;IAEJ,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,KAAK,MAAM,GAEjB;IAEK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAc3G;IAEK,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAM1G;IAEK,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAcpG;IAEK,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjE;IAED,4GAA4G;IACtG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASjD;IAEK,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQzF;IAED,yGAAyG;IACnG,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAcpE;YAEa,cAAc;IAM5B,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,MAAM;IAKd,OAAO,CAAC,kBAAkB;CAG3B"}