@starklabs/forge 1.3.25-cors.0 → 2.0.0

package/dist/config/ForgeOptions.d.ts

@@ -0,0 +1,202 @@
+import type { CorsOptions } from "cors";
+import type { Store } from "express-rate-limit";
+import type { UnifiedField } from "../fields/unified.types.js";
+import type { Collection } from "../types/Collection.js";
+import type { AuthMode } from "../types/Route.js";
+import type { CommonEmailPlaceholders } from "../types/email/static-config.type.js";
+import type { OAuthProfile } from "../oauth/OAuthProvider.js";
+import type { OAuthProviderEntry } from "../oauth/OAuthProviderFactory.js";
+import type { DurationType } from "./Duration.js";
+export type { AuthMode } from "../types/Route.js";
+/** @deprecated Use {@link AuthMode}. */
+export type authMode = AuthMode;
+/** Names of the auth fields in request bodies and in the user schema. */
+export interface AuthFieldNames {
+    email: string;
+    password: string;
+    otp: string;
+    purpose: string;
+}
+export interface OtpOptions {
+    /** How long a one-time code stays valid. @default "5m" */
+    expiresIn?: DurationType;
+    /** Wrong guesses allowed per code. @default 5 */
+    maxAttempts?: number;
+    /** Minimum delay between two e-mails for the same request. @default "60s" */
+    resendCooldown?: DurationType;
+    /** How many times a code may be re-sent. @default 5 */
+    maxResends?: number;
+    /** After a password-reset code is verified, how long the user has to set the new password. @default "10m" */
+    verifiedWindow?: DurationType;
+}
+export interface CookieOptions {
+    /** @default "none" in production (cross-site SPAs), "lax" otherwise */
+    sameSite?: "lax" | "strict" | "none";
+    /** @default true in production */
+    secure?: boolean;
+    /** Cookie `Domain` attribute. Host-only cookies (unset) are the safest default. */
+    domain?: string;
+    /** @default "/" */
+    path?: string;
+}
+/**
+ * How an OAuth sign-in is matched to an existing local account that has the same e-mail.
+ * - `"auto"` (default): link only when every local account's e-mail was verified at sign-up (`signupMode: "otp"`).
+ * - `"always"`: link whenever the *provider* says the e-mail is verified. Only safe if you trust your own sign-up.
+ * - `"never"`: never link; the user must sign in the old way.
+ */
+export type AccountLinking = "auto" | "always" | "never";
+export interface OAuthOptions {
+    /** Enabled providers: `{ provider: "google" | "github", clientId, clientSecret }` or your own `OAuthProvider` instance. */
+    providers: OAuthProviderEntry[];
+    /**
+     * Where to send the browser after a successful sign-in (must be on one of your `frontendURL(s)`).
+     * Omit it to get the session as JSON instead (handy for mobile apps and tests).
+     */
+    successRedirect?: string;
+    /** Where to send the browser when sign-in fails; `?error=<CODE>` is appended. Same origin rule. */
+    failureRedirect?: string;
+    accountLinking?: AccountLinking;
+    /** How long the user has to finish the provider's consent screen. @default "10m" */
+    stateAge?: DurationType;
+    /**
+     * Extra fields for a brand-new user, e.g. when your schema requires more than `name` and `email`.
+     * The e-mail and a random unusable password are always set by Forge.
+     */
+    userFromProfile?: (profile: OAuthProfile) => Record<string, unknown>;
+}
+export interface MagicLinkOptions {
+    /**
+     * The front-end page that receives the link (`<url>?token=...`). It must read the token and `POST` it to
+     * `/auth/magic-link/verify`: opening the link must not sign anyone in by itself, because mail scanners
+     * "click" links to check them. Must be on one of your `frontendURL(s)`.
+     */
+    url: string;
+    /** How long a link stays valid. @default "15m" */
+    expiresIn?: DurationType;
+    /** Minimum time between two links for the same address. @default "60s" */
+    resendCooldown?: DurationType;
+    /** Create an account for an unknown e-mail on first use. @default true */
+    allowSignup?: boolean;
+    /**
+     * Require the link to be opened in the browser that asked for it. Stops an attacker from mailing
+     * *their own* link to a victim to sign them into the attacker's account. Turn off for mobile apps or
+     * if users often switch devices. @default true
+     */
+    sameDevice?: boolean;
+    /** Same meaning as `oauth.accountLinking`: may a verified e-mail sign in to an existing local account? @default "auto" */
+    accountLinking?: AccountLinking;
+}
+export interface MfaOptions {
+    /** Shown in the authenticator app next to the account name (usually your product name). */
+    issuer: string;
+    /** How long the user has to enter their code after the first step. @default "5m" */
+    challengeAge?: DurationType;
+    /** Wrong codes allowed before the account's second factor is locked. @default 5 */
+    maxAttempts?: number;
+    /** How long a lock lasts. @default "5m" */
+    lockoutDuration?: DurationType;
+    /** Recovery codes generated on activation. @default 10 */
+    recoveryCodes?: number;
+    /** Clock drift accepted, in 30-second steps either side. @default 1 */
+    window?: number;
+}
+export interface AuthConfig {
+    mode: "builtin" | "manual";
+    returnAccessToken?: boolean;
+    returnRefreshToken?: boolean;
+    rotateRefreshToken?: boolean;
+    refreshTokenRotationInterval?: DurationType;
+    /**
+     * A refresh token that was rotated away may be presented again within this
+     * window (two browser tabs refreshing at once) without revoking the session.
+     * @default "10s"
+     */
+    refreshReuseGracePeriod?: DurationType;
+    verifyAccessUser?: boolean;
+    fieldsObj?: Partial<AuthFieldNames>;
+    mongooseConfig?: {
+        model: string;
+        schema: Record<string, UnifiedField>;
+    };
+    accessTokenName?: string;
+    refreshTokenName?: string;
+    accessTokenAge?: DurationType;
+    refreshTokenAge?: DurationType;
+    signupMode?: AuthMode;
+    loginMode?: AuthMode;
+    otp?: OtpOptions;
+    cookie?: CookieOptions;
+    /** "Sign in with Google / GitHub / ...". */
+    oauth?: OAuthOptions;
+    /** Passwordless sign-in by e-mailed link. */
+    magicLink?: MagicLinkOptions;
+    /** Authenticator-app (TOTP) two-factor authentication with recovery codes. */
+    mfa?: MfaOptions;
+}
+export interface AdminConfig {
+    mode: "builtin" | "manual";
+}
+export interface AccountConfig {
+    mode: "builtin" | "manual";
+}
+export type CorsConfig = CorsOptions;
+export interface BuiltInConfig {
+    auth: AuthConfig;
+    admin: AdminConfig;
+    account: AccountConfig;
+    email?: CommonEmailPlaceholders;
+}
+/** Everything you can pass to `new Forge({...})`. */
+export interface ForgeOptions {
+    builtinConfig?: Partial<BuiltInConfig>;
+    collections?: Collection[];
+    port?: number;
+    apiVersion?: number;
+    ENV?: "development" | "production" | "test" | (string & {});
+    backendURL?: string;
+    frontendURL?: string;
+    frontendURLs?: string[];
+    corsConfig?: CorsConfig;
+    /** Value for Express `trust proxy`. Set it when running behind a load balancer. */
+    trustProxy?: boolean | number | string;
+    /** Print the start-up banner and request logs. @default true (false when ENV is "test") */
+    logRequests?: boolean;
+    /** Include `hint`/`details` in error responses. @default true outside production */
+    exposeErrorDetails?: boolean;
+    /** Largest accepted JSON / form body (anything `bytes` understands). @default "100kb" */
+    bodyLimit?: string;
+    isOffline?: boolean;
+    mongoDBURI?: string;
+    databaseName?: string;
+    jwtSecret?: string;
+    masterKey?: string;
+    /** @deprecated 1.x name. In production it is used as `builtinConfig.auth.cookie.domain` when that is not set. */
+    domain?: string;
+    /** Roles that count as administrators. @default ["admin"] */
+    adminRoles?: string[];
+    /** Fields only administrators may write (they are stripped from other users' payloads). @default ["role"] */
+    protectedFields?: string[];
+    rateLimitDuration?: DurationType;
+    maxReqLimit?: number;
+    rateLimitMsg?: string;
+    /** Stricter limit for sign-up / login / OTP / password-reset endpoints (per IP). @default 20 */
+    authMaxReqLimit?: number;
+    /** Share rate-limit counters between instances (e.g. a Redis store). */
+    rateLimitStore?: Store;
+    systemEmailSender?: string;
+    resendAPIKey?: string;
+    cloudinaryAPIKey?: string;
+    cloudinaryAPISecret?: string;
+    cloudinaryCloudName?: string;
+    cloudinaryFolderName?: string;
+    /** Maximum size of one uploaded file, in bytes. @default 5 MiB */
+    uploadMaxFileSize?: number;
+    /** Maximum files per request. @default 10 */
+    uploadMaxFiles?: number;
+    /** `readAll` page size when `?limit` is omitted. @default 50 */
+    defaultPageSize?: number;
+    /** Largest `?limit` accepted by `readAll`. @default 100 */
+    maxPageSize?: number;
+}
+//# sourceMappingURL=ForgeOptions.d.ts.map

package/dist/config/ForgeOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ForgeOptions.d.ts","sourceRoot":"","sources":["../../src/config/ForgeOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AACxC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,wCAAwC;AACxC,MAAM,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAEhC,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6GAA6G;IAC7G,cAAc,CAAC,EAAE,YAAY,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,kCAAkC;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,YAAY;IAC3B,2HAA2H;IAC3H,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mGAAmG;IACnG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,oFAAoF;IACpF,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0HAA0H;IAC1H,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,eAAe,CAAC,EAAE,YAAY,CAAC;IAC/B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC3B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,4BAA4B,CAAC,EAAE,YAAY,CAAC;IAC5C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,YAAY,CAAC;IACvC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACpC,cAAc,CAAC,EAAE;QACf,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;KACtC,CAAC;IACF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,eAAe,CAAC,EAAE,YAAY,CAAC;IAC/B,UAAU,CAAC,EAAE,QAAQ,CAAC;IACtB,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,8EAA8E;IAC9E,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC5B;AAED,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC;AAErC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,CAAC,EAAE,uBAAuB,CAAC;CACjC;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACvC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAG3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mFAAmF;IACnF,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IACvC,2FAA2F;IAC3F,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iHAAiH;IACjH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,6GAA6G;IAC7G,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAG3B,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,cAAc,CAAC,EAAE,KAAK,CAAC;IAGvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/config/ForgeOptions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ForgeOptions.js.map

package/dist/config/ForgeOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ForgeOptions.js","sourceRoot":"","sources":["../../src/config/ForgeOptions.ts"],"names":[],"mappings":""}

package/dist/config/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./Duration.js";
+export * from "./ForgeOptions.js";
+export * from "./ForgeConfig.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}

package/dist/config/index.js

@@ -0,0 +1,4 @@
+export * from "./Duration.js";
+export * from "./ForgeOptions.js";
+export * from "./ForgeConfig.js";
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}

package/dist/core/AccessPolicy.d.ts

@@ -0,0 +1,33 @@
+import type { Authenticator } from "../http/Authenticator.js";
+import type { Filter, Doc } from "../data/Repository.js";
+import type { ForgeConfig } from "../config/ForgeConfig.js";
+import type { AuthenticatedUser } from "../types/AuthenticatedUser.js";
+import type { Route } from "../types/Route.js";
+/**
+ * Decides who may touch which document.
+ *
+ * `admin-or-owner` routes used to check ownership against only the *first*
+ * document of a list, which leaked every other user's data. Lists are now
+ * restricted with a database filter, and single documents are checked one by one.
+ */
+export declare class AccessPolicy {
+    private readonly config;
+    private readonly authenticator;
+    constructor(config: ForgeConfig, authenticator: Authenticator);
+    isAdmin(user: AuthenticatedUser | undefined): boolean;
+    /** Id of the user who owns `doc` under the route's ownership rule. */
+    ownerOf(doc: Doc, route: Route): string | undefined;
+    /** Throws unless `user` may access `doc` through `route`. */
+    assertCanAccess(route: Route, user: AuthenticatedUser | undefined, doc: Doc): void;
+    /** Database filter that limits a multi-document operation to what `user` may see. */
+    scopeFilter(route: Route, user: AuthenticatedUser | undefined): Filter;
+    /** The owner value to stamp on a new document. */
+    ownerStamp(user: AuthenticatedUser | undefined): Record<string, unknown>;
+    /**
+     * Strips fields only administrators may write from a payload: the configured `protectedFields` (default
+     * `role`) and `owner`. The owner is stamped from the session when a document is created, so without this a
+     * non-admin could hand a document to another user by sending `owner` in an update.
+     */
+    writableBody<T extends Record<string, unknown>>(body: T, user: AuthenticatedUser | undefined): Partial<T>;
+}
+//# sourceMappingURL=AccessPolicy.d.ts.map

package/dist/core/AccessPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessPolicy.d.ts","sourceRoot":"","sources":["../../src/core/AccessPolicy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAM/C;;;;;;GAMG;AACH,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAFhC,YACmB,MAAM,EAAE,WAAW,EACnB,aAAa,EAAE,aAAa,EAC3C;IAEJ,OAAO,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,GAAG,OAAO,CAEpD;IAED,sEAAsE;IACtE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAElD;IAED,6DAA6D;IAC7D,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,GAAG,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,CAQjF;IAED,qFAAqF;IACrF,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,GAAG,SAAS,GAAG,MAAM,CAIrE;IAED,kDAAkD;IAClD,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEvE;IAED;;;;OAIG;IACH,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,GAAG,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAExG;CACF"}

package/dist/core/AccessPolicy.js

@@ -0,0 +1,60 @@
+import { ErrorCode, ForbiddenError } from "../errors/index.js";
+import { idToString } from "../utils/ids.js";
+import { omitKeys } from "../utils/sanitizeInput.js";
+const OWNER_FIELD = "owner";
+/**
+ * Decides who may touch which document.
+ *
+ * `admin-or-owner` routes used to check ownership against only the *first*
+ * document of a list, which leaked every other user's data. Lists are now
+ * restricted with a database filter, and single documents are checked one by one.
+ */
+export class AccessPolicy {
+    config;
+    authenticator;
+    constructor(config, authenticator) {
+        this.config = config;
+        this.authenticator = authenticator;
+    }
+    isAdmin(user) {
+        return this.authenticator.isAdmin(user);
+    }
+    /** Id of the user who owns `doc` under the route's ownership rule. */
+    ownerOf(doc, route) {
+        return route.ownership === "self" ? idToString(doc._id) : idToString(doc[OWNER_FIELD]);
+    }
+    /** Throws unless `user` may access `doc` through `route`. */
+    assertCanAccess(route, user, doc) {
+        if (route.auth !== "admin-or-owner")
+            return;
+        if (this.isAdmin(user))
+            return;
+        if (user && this.ownerOf(doc, route) === user._id)
+            return;
+        throw new ForbiddenError({
+            message: "You can only access your own data.",
+            code: ErrorCode.OWNER_REQUIRED,
+        });
+    }
+    /** Database filter that limits a multi-document operation to what `user` may see. */
+    scopeFilter(route, user) {
+        if (route.auth !== "admin-or-owner" || this.isAdmin(user))
+            return {};
+        if (!user)
+            throw new ForbiddenError({ message: "Authentication is required.", code: ErrorCode.FORBIDDEN });
+        return route.ownership === "self" ? { _id: user._id } : { [OWNER_FIELD]: user._id };
+    }
+    /** The owner value to stamp on a new document. */
+    ownerStamp(user) {
+        return user ? { [OWNER_FIELD]: user._id } : {};
+    }
+    /**
+     * Strips fields only administrators may write from a payload: the configured `protectedFields` (default
+     * `role`) and `owner`. The owner is stamped from the session when a document is created, so without this a
+     * non-admin could hand a document to another user by sending `owner` in an update.
+     */
+    writableBody(body, user) {
+        return this.isAdmin(user) ? body : omitKeys(body, [...this.config.protectedFields, OWNER_FIELD]);
+    }
+}
+//# sourceMappingURL=AccessPolicy.js.map

package/dist/core/AccessPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessPolicy.js","sourceRoot":"","sources":["../../src/core/AccessPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAM/D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IAEJ,MAAM;IACN,aAAa;IAFhC,YACmB,MAAmB,EACnB,aAA4B;sBAD5B,MAAM;6BACN,aAAa;IAC7B,CAAC;IAEJ,OAAO,CAAC,IAAmC;QACzC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,sEAAsE;IACtE,OAAO,CAAC,GAAQ,EAAE,KAAY;QAC5B,OAAO,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,6DAA6D;IAC7D,eAAe,CAAC,KAAY,EAAE,IAAmC,EAAE,GAAQ;QACzE,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO;QAC5C,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QAC/B,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG;YAAE,OAAO;QAC1D,MAAM,IAAI,cAAc,CAAC;YACvB,OAAO,EAAE,oCAAoC;YAC7C,IAAI,EAAE,SAAS,CAAC,cAAc;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,WAAW,CAAC,KAAY,EAAE,IAAmC;QAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3G,OAAO,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACtF,CAAC;IAED,kDAAkD;IAClD,UAAU,CAAC,IAAmC;QAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAoC,IAAO,EAAE,IAAmC;QAC1F,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;IACnG,CAAC;CACF"}

package/dist/core/ActionRunner.d.ts

@@ -0,0 +1,30 @@
+import type { EmailService } from "../email/EmailService.js";
+import type { Action, ActionContext } from "../types/ActionHandler.js";
+import type { Logger } from "../utils/Logger.js";
+export declare const isCustomAction: (a: Action) => a is Extract<Action, {
+    customAction: unknown;
+}>;
+export declare const isEmailAction: (a: Action) => a is Extract<Action, {
+    emailAction: unknown;
+}>;
+/**
+ * Runs the `actions.before` / `actions.after` hooks of a route.
+ *
+ * - `before` actions run in order and may abort the request by throwing.
+ * - `after` actions run once the data is already saved, so a failing hook is
+ *   logged instead of reporting a failure for work that actually succeeded.
+ *   A `customAction` that returns a value replaces the response data.
+ * - Every action is awaited (1.x let rejected promises escape and crash the process).
+ */
+export declare class ActionRunner {
+    private readonly emails;
+    private readonly logger;
+    constructor(emails: EmailService, logger: Logger);
+    /** Fail fast at startup if a hook has an unknown shape. */
+    assertValid(actions: readonly Action[] | undefined, where: string): void;
+    runBefore(actions: readonly Action[] | undefined, context: ActionContext): Promise<void>;
+    /** Returns the replacement response data, if any action produced one. */
+    runAfter(actions: readonly Action[] | undefined, context: ActionContext): Promise<unknown>;
+    private execute;
+}
+//# sourceMappingURL=ActionRunner.d.ts.map

package/dist/core/ActionRunner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ActionRunner.d.ts","sourceRoot":"","sources":["../../src/core/ActionRunner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,eAAO,MAAM,cAAc,MAAO,MAAM,KAAG,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE;IAAE,YAAY,EAAE,OAAO,CAAA;CAAE,CAC0C,CAAC;AAEpI,eAAO,MAAM,aAAa,MAAO,MAAM,KAAG,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE,CACuC,CAAC;AAE/H;;;;;;;;GAQG;AACH,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFzB,YACmB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EAC7B;IAEJ,2DAA2D;IAC3D,WAAW,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CASvE;IAEK,SAAS,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F;IAED,yEAAyE;IACnE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAa/F;YAEa,OAAO;CAKtB"}

package/dist/core/ActionRunner.js

@@ -0,0 +1,59 @@
+import { ConfigurationError, ErrorCode } from "../errors/index.js";
+export const isCustomAction = (a) => typeof a === "object" && a !== null && "customAction" in a && typeof a.customAction === "function";
+export const isEmailAction = (a) => typeof a === "object" && a !== null && "emailAction" in a && typeof a.emailAction === "object";
+/**
+ * Runs the `actions.before` / `actions.after` hooks of a route.
+ *
+ * - `before` actions run in order and may abort the request by throwing.
+ * - `after` actions run once the data is already saved, so a failing hook is
+ *   logged instead of reporting a failure for work that actually succeeded.
+ *   A `customAction` that returns a value replaces the response data.
+ * - Every action is awaited (1.x let rejected promises escape and crash the process).
+ */
+export class ActionRunner {
+    emails;
+    logger;
+    constructor(emails, logger) {
+        this.emails = emails;
+        this.logger = logger;
+    }
+    /** Fail fast at startup if a hook has an unknown shape. */
+    assertValid(actions, where) {
+        for (const action of actions ?? []) {
+            if (!isCustomAction(action) && !isEmailAction(action)) {
+                throw new ConfigurationError({
+                    message: `${where}: an action must be { customAction: fn } or { emailAction: {...} }.`,
+                    code: ErrorCode.CONFIGURATION_ERROR,
+                });
+            }
+        }
+    }
+    async runBefore(actions, context) {
+        for (const action of actions ?? [])
+            await this.execute(action, context);
+    }
+    /** Returns the replacement response data, if any action produced one. */
+    async runAfter(actions, context) {
+        let replacement;
+        for (const action of actions ?? []) {
+            try {
+                const result = await this.execute(action, { ...context, result: replacement ?? context.result });
+                if (result !== undefined)
+                    replacement = result;
+            }
+            catch (error) {
+                this.logger.error(`An 'after' action failed on ${context.model}/${context.operation}.`, {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        return replacement;
+    }
+    async execute(action, context) {
+        if (isCustomAction(action))
+            return action.customAction(context);
+        await this.emails.sendAction(action.emailAction, context);
+        return undefined;
+    }
+}
+//# sourceMappingURL=ActionRunner.js.map

package/dist/core/ActionRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ActionRunner.js","sourceRoot":"","sources":["../../src/core/ActionRunner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAKnE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAS,EAAmD,EAAE,CAC3F,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,cAAc,IAAI,CAAC,IAAI,OAAQ,CAA+B,CAAC,YAAY,KAAK,UAAU,CAAC;AAEpI,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAS,EAAkD,EAAE,CACzF,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,aAAa,IAAI,CAAC,IAAI,OAAQ,CAA8B,CAAC,WAAW,KAAK,QAAQ,CAAC;AAE/H;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IAEJ,MAAM;IACN,MAAM;IAFzB,YACmB,MAAoB,EACpB,MAAc;sBADd,MAAM;sBACN,MAAM;IACtB,CAAC;IAEJ,2DAA2D;IAC3D,WAAW,CAAC,OAAsC,EAAE,KAAa;QAC/D,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,OAAO,EAAE,GAAG,KAAK,qEAAqE;oBACtF,IAAI,EAAE,SAAS,CAAC,mBAAmB;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAsC,EAAE,OAAsB;QAC5E,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,EAAE;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,QAAQ,CAAC,OAAsC,EAAE,OAAsB;QAC3E,IAAI,WAAoB,CAAC;QACzB,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjG,IAAI,MAAM,KAAK,SAAS;oBAAE,WAAW,GAAG,MAAM,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,SAAS,GAAG,EAAE;oBACtF,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,OAAsB;QAC1D,IAAI,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/core/BuiltinCollections.d.ts

@@ -0,0 +1,24 @@
+import type { ForgeConfig } from "../config/ForgeConfig.js";
+import type { SchemaCompiler } from "../data/SchemaCompiler.js";
+import type { Collection } from "../types/Collection.js";
+/**
+ * Generates the collections behind `builtinConfig` (auth, account, admin) and
+ * the default health endpoint, so they run through the exact same pipeline as
+ * collections you write yourself.
+ */
+export declare class BuiltinCollections {
+    private readonly config;
+    private readonly compiler;
+    constructor(config: ForgeConfig, compiler: SchemaCompiler);
+    build(): Collection[];
+    private auth;
+    private magicLinkRoutes;
+    private mfaRoutes;
+    /** "Sign in with ..." routes, present only when `auth.oauth` is configured. `/providers` must precede `/:provider`. */
+    private oauthRoutes;
+    private account;
+    private admin;
+    private health;
+    private ruleOf;
+}
+//# sourceMappingURL=BuiltinCollections.d.ts.map

package/dist/core/BuiltinCollections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BuiltinCollections.d.ts","sourceRoot":"","sources":["../../src/core/BuiltinCollections.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,KAAK,EAAE,UAAU,EAAyB,MAAM,wBAAwB,CAAC;AAYhF;;;;GAIG;AACH,qBAAa,kBAAkB;IAE3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAF3B,YACmB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,cAAc,EACvC;IAEJ,KAAK,IAAI,UAAU,EAAE,CAOpB;IAED,OAAO,CAAC,IAAI;IA0DZ,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,SAAS;IAejB,uHAAuH;IACvH,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,OAAO;IA0Bf,OAAO,CAAC,KAAK;IAQb,OAAO,CAAC,MAAM;IAed,OAAO,CAAC,MAAM;CAIf"}

package/dist/core/BuiltinCollections.js

@@ -0,0 +1,167 @@
+import { z } from "zod";
+import { OTP_PURPOSES } from "../auth/OtpService.js";
+const post = (path, handler, validation, extra = {}) => ({
+    method: "post",
+    path,
+    handler,
+    validation,
+    auth: "public",
+    ...extra,
+});
+/**
+ * Generates the collections behind `builtinConfig` (auth, account, admin) and
+ * the default health endpoint, so they run through the exact same pipeline as
+ * collections you write yourself.
+ */
+export class BuiltinCollections {
+    config;
+    compiler;
+    constructor(config, compiler) {
+        this.config = config;
+        this.compiler = compiler;
+    }
+    build() {
+        const collections = [];
+        if (this.config.auth.mode === "builtin")
+            collections.push(this.auth());
+        if (this.config.account.mode === "builtin")
+            collections.push(this.account());
+        if (this.config.admin.mode === "builtin")
+            collections.push(this.admin());
+        if (!this.config.collections.some((c) => c.type === "health"))
+            collections.push(this.health());
+        return collections;
+    }
+    auth() {
+        const { mongooseConfig, fields } = this.config.auth;
+        const schema = mongooseConfig.schema;
+        const emailRule = this.ruleOf(schema, fields.email) ?? z.string().trim().toLowerCase().email();
+        const passwordRule = this.ruleOf(schema, fields.password) ?? z.string().min(8).max(128);
+        const purpose = z.enum(OTP_PURPOSES);
+        const signup = {};
+        for (const key of Object.keys(schema)) {
+            const rule = this.ruleOf(schema, key);
+            if (rule && !this.config.protectedFields.includes(key))
+                signup[key] = rule;
+        }
+        signup[fields.email] = emailRule;
+        signup[fields.password] = passwordRule;
+        const validations = {
+            signup,
+            // Existing users may have older, shorter passwords: login only checks "not empty and not absurdly long".
+            login: { [fields.email]: emailRule, [fields.password]: z.string().min(1).max(128) },
+            verifyOTP: { [fields.email]: emailRule, [fields.otp]: z.string().regex(/^\d{6}$/, "The code has 6 digits"), [fields.purpose]: purpose },
+            resendOTP: { [fields.email]: emailRule, [fields.purpose]: purpose },
+            forgotPassword: { [fields.email]: emailRule },
+            resetPassword: {
+                [fields.email]: emailRule,
+                resetToken: z.string().min(20).max(200),
+                [fields.password]: passwordRule,
+            },
+            magicLinkRequest: { [fields.email]: emailRule, name: z.string().trim().max(100).optional() },
+            magicLinkVerify: { token: z.string().min(20).max(200) },
+            mfaEnable: { code: z.string().min(6).max(12) },
+            // Exactly one of the two is required; the controller enforces it.
+            mfaSecondFactor: { code: z.string().max(12).optional(), recoveryCode: z.string().max(32).optional() },
+            mfaVerify: { mfaToken: z.string().min(20).max(2000), code: z.string().max(12).optional(), recoveryCode: z.string().max(32).optional() },
+        };
+        return {
+            type: "auth",
+            route: "auth",
+            model: mongooseConfig.model,
+            schema,
+            validations,
+            routes: [
+                { method: "get", path: "/methods", handler: "authMethods", auth: "public", validation: false },
+                post("/signup", "signup", "signup"),
+                post("/verify-otp", "verifyOTP", "verifyOTP"),
+                post("/login", "login", "login"),
+                post("/resend-otp", "resendOTP", "resendOTP"),
+                post("/forgot-password", "forgotPassword", "forgotPassword"),
+                post("/reset-password", "resetPassword", "resetPassword"),
+                { method: "post", path: "/logout", handler: "logout", auth: "public" },
+                { method: "post", path: "/refresh-token", handler: "refresh", auth: "public" },
+                ...this.oauthRoutes(),
+                ...this.magicLinkRoutes(),
+                ...this.mfaRoutes(),
+            ],
+        };
+    }
+    magicLinkRoutes() {
+        if (!this.config.auth.magicLink)
+            return [];
+        return [post("/magic-link", "magicLinkRequest", "magicLinkRequest"), post("/magic-link/verify", "magicLinkVerify", "magicLinkVerify")];
+    }
+    mfaRoutes() {
+        if (!this.config.auth.mfa)
+            return [];
+        const authed = (method, path, handler, validation = false) => ({
+            method, path, handler, validation, auth: "authenticated",
+        });
+        return [
+            authed("get", "/mfa", "mfaStatus"),
+            authed("post", "/mfa/totp/setup", "mfaSetup"),
+            authed("post", "/mfa/totp/enable", "mfaEnable", "mfaEnable"),
+            post("/mfa/verify", "mfaVerify", "mfaVerify"),
+            authed("post", "/mfa/disable", "mfaDisable", "mfaSecondFactor"),
+            authed("post", "/mfa/recovery-codes", "mfaRecoveryCodes", "mfaSecondFactor"),
+        ];
+    }
+    /** "Sign in with ..." routes, present only when `auth.oauth` is configured. `/providers` must precede `/:provider`. */
+    oauthRoutes() {
+        if (!this.config.auth.oauth)
+            return [];
+        const get = (path, handler) => ({ method: "get", path, handler, auth: "public", validation: false });
+        return [get("/oauth/providers", "oauthProviders"), get("/oauth/:provider", "oauthStart"), get("/oauth/:provider/callback", "oauthCallback")];
+    }
+    account() {
+        const { mongooseConfig } = this.config.auth;
+        const schema = mongooseConfig.schema;
+        const updateProfile = {};
+        for (const key of Object.keys(schema)) {
+            const rule = this.ruleOf(schema, key);
+            if (rule && !this.config.protectedFields.includes(key))
+                updateProfile[key] = rule.optional();
+        }
+        return {
+            type: "account",
+            route: "account",
+            model: mongooseConfig.model,
+            schema,
+            validations: { updateProfile },
+            routes: [
+                { auth: "authenticated", handler: "getMe", method: "get", path: "/me" },
+                // Any signed-in user, any role: `{ role, isAdmin }`.
+                { auth: "authenticated", handler: "checkRole", method: "get", path: "/role" },
+                { auth: "authenticated", handler: "updateMe", method: "patch", path: "/me", validation: "updateProfile" },
+                { auth: "authenticated", handler: "deleteMe", method: "delete", path: "/me" },
+            ],
+        };
+    }
+    admin() {
+        return {
+            type: "admin",
+            route: "admin",
+            routes: [{ auth: "admin", handler: "checkRole", method: "get", path: "/check" }],
+        };
+    }
+    health() {
+        const method = (m, handler) => ({ method: m, handler, path: "/", auth: "public", validation: false });
+        return {
+            type: "health",
+            route: "health",
+            routes: [
+                method("get", "healthGet"),
+                method("post", "healthPost"),
+                method("put", "healthPut"),
+                method("patch", "healthPatch"),
+                method("delete", "healthDelete"),
+            ],
+        };
+    }
+    ruleOf(schema, key) {
+        const field = schema[key];
+        return field ? this.compiler.zodOf(field) : undefined;
+    }
+}
+//# sourceMappingURL=BuiltinCollections.js.map