@storyshelf/auth-password 0.1.0 → 0.1.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Siddhant Gupta
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.mjs

@@ -86,7 +86,7 @@ function createPasswordAuth(options) {
 	return {
 		metadata: {
 			name: "Password Auth",
-			version: "0.1.0",
+			version: globalThis.__PKG_VERSION__ ?? "0.0.0",
 			description: "Shared-password auth adapter",
 			kind: "password"
 		},

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import { SESSION_COOKIE, type AuthAdapter, type AuthUser } from \"@storyshelf/core/adapter/auth\";\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\ndeclare const __PKG_VERSION__: string;\n\nconst SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ninterface SessionPayload {\n  userId: string;\n  email: string;\n  name: string;\n  avatarUrl?: string;\n  role: AuthUser[\"role\"];\n  expiresAt: number;\n}\n\n/** Options for configuring a shared-password auth adapter. */\nexport interface PasswordAuthOptions {\n  /** The shared password users must present to log in. */\n  password: string;\n  /** Secret used to sign and verify session cookies. */\n  secret: string;\n}\n\n/** Auth adapter that authenticates with a single shared password. */\nexport interface PasswordAuth extends AuthAdapter {\n  /** Verify `password` and, if correct, create a session for `user`, returning a session token. */\n  login(password: string, user: AuthUser): Promise<string>;\n}\n\nfunction hmacHex(secret: string, value: string): string {\n  return createHmac(\"sha256\", secret).update(value).digest(\"hex\");\n}\n\nfunction equalStrings(left: string, right: string): boolean {\n  const leftBuffer = Buffer.from(left);\n  const rightBuffer = Buffer.from(right);\n  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);\n}\n\nfunction encodePayload(payload: SessionPayload): string {\n  return Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n}\n\nfunction decodePayload(body: string): SessionPayload | null {\n  try {\n    return JSON.parse(Buffer.from(body, \"base64url\").toString(\"utf8\")) as SessionPayload;\n  } catch {\n    return null;\n  }\n}\n\nfunction signPayload(secret: string, payload: SessionPayload): string {\n  const body = encodePayload(payload);\n  return `${body}.${hmacHex(secret, body)}`;\n}\n\nfunction verifyPayload(secret: string, token: string): SessionPayload | null {\n  const dot = token.lastIndexOf(\".\");\n  if (dot === -1) {\n    return null;\n  }\n  const body = token.slice(0, dot);\n  const signature = token.slice(dot + 1);\n  if (!equalStrings(hmacHex(secret, body), signature)) {\n    return null;\n  }\n  return decodePayload(body);\n}\n\nfunction readCookie(request: Request, name: string): string | undefined {\n  const header = request.headers.get(\"cookie\");\n  if (!header) {\n    return undefined;\n  }\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) {\n      continue;\n    }\n    if (part.slice(0, eq).trim() === name) {\n      return part.slice(eq + 1).trim();\n    }\n  }\n  return undefined;\n}\n\nfunction toUser(payload: SessionPayload): AuthUser {\n  return {\n    id: payload.userId,\n    email: payload.email,\n    name: payload.name,\n    avatarUrl: payload.avatarUrl,\n    role: payload.role,\n  };\n}\n\n/**\n * Create a shared-password auth adapter.\n *\n * @param options - Password and session signing configuration.\n * @returns A PasswordAuth instance.\n */\nexport function createPasswordAuth(options: PasswordAuthOptions): PasswordAuth {\n  const { password, secret } = options;\n\n  // Async is required by the AuthAdapter interface, though the logic is synchronous.\n  // eslint-disable-next-line require-await\n  const check = async (request: Request): Promise<AuthUser | null> => {\n    const token = readCookie(request, SESSION_COOKIE);\n    if (!token) {\n      return null;\n    }\n    const payload = verifyPayload(secret, token);\n    if (!payload || payload.expiresAt <= Date.now()) {\n      return null;\n    }\n    return toUser(payload);\n  };\n\n  // eslint-disable-next-line require-await\n  const createSession = async (user: AuthUser): Promise<string> => {\n    const payload: SessionPayload = {\n      userId: user.id,\n      email: user.email,\n      name: user.name,\n      avatarUrl: user.avatarUrl,\n      role: user.role,\n      expiresAt: Date.now() + SESSION_TTL_MS,\n    };\n    return signPayload(secret, payload);\n  };\n\n  const login = async (input: string, user: AuthUser): Promise<string> => {\n    if (!equalStrings(input, password)) {\n      throw new Error(\"Invalid password\");\n    }\n    return await createSession(user);\n  };\n\n  return {\n    metadata: {\n      name: \"Password Auth\",\n      version: typeof __PKG_VERSION__ === \"undefined\" ? \"0.0.0\" : __PKG_VERSION__, // oxlint-disable-line unicorn/no-typeof-undefined\n      description: \"Shared-password auth adapter\",\n      kind: \"password\",\n    },\n    check,\n    createSession,\n    async destroySession() {\n      await Promise.resolve();\n    },\n    login,\n  };\n}\n"],"mappings":";;;;;;AAKA,MAAM,iBAAiB;AAyBvB,SAAS,QAAQ,QAAgB,OAAuB;CACtD,OAAO,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAChE;AAEA,SAAS,aAAa,MAAc,OAAwB;CAC1D,MAAM,aAAa,OAAO,KAAK,IAAI;CACnC,MAAM,cAAc,OAAO,KAAK,KAAK;CACrC,OAAO,WAAW,WAAW,YAAY,UAAU,gBAAgB,YAAY,WAAW;AAC5F;AAEA,SAAS,cAAc,SAAiC;CACtD,OAAO,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,WAAW;AAClE;AAEA,SAAS,cAAc,MAAqC;CAC1D,IAAI;EACF,OAAO,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;CACnE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAY,QAAgB,SAAiC;CACpE,MAAM,OAAO,cAAc,OAAO;CAClC,OAAO,GAAG,KAAK,GAAG,QAAQ,QAAQ,IAAI;AACxC;AAEA,SAAS,cAAc,QAAgB,OAAsC;CAC3E,MAAM,MAAM,MAAM,YAAY,GAAG;CACjC,IAAI,QAAQ,IACV,OAAO;CAET,MAAM,OAAO,MAAM,MAAM,GAAG,GAAG;CAC/B,MAAM,YAAY,MAAM,MAAM,MAAM,CAAC;CACrC,IAAI,CAAC,aAAa,QAAQ,QAAQ,IAAI,GAAG,SAAS,GAChD,OAAO;CAET,OAAO,cAAc,IAAI;AAC3B;AAEA,SAAS,WAAW,SAAkB,MAAkC;CACtE,MAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;CAC3C,IAAI,CAAC,QACH;CAEF,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,OAAO,IACT;EAEF,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,MAAM,MAC/B,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CAEnC;AAEF;AAEA,SAAS,OAAO,SAAmC;CACjD,OAAO;EACL,IAAI,QAAQ;EACZ,OAAO,QAAQ;EACf,MAAM,QAAQ;EACd,WAAW,QAAQ;EACnB,MAAM,QAAQ;CAChB;AACF;;;;;;;AAQA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,EAAE,UAAU,WAAW;CAI7B,MAAM,QAAQ,OAAO,YAA+C;EAClE,MAAM,QAAQ,WAAW,SAAS,cAAc;EAChD,IAAI,CAAC,OACH,OAAO;EAET,MAAM,UAAU,cAAc,QAAQ,KAAK;EAC3C,IAAI,CAAC,WAAW,QAAQ,aAAa,KAAK,IAAI,GAC5C,OAAO;EAET,OAAO,OAAO,OAAO;CACvB;CAGA,MAAM,gBAAgB,OAAO,SAAoC;EAC/D,MAAM,UAA0B;GAC9B,QAAQ,KAAK;GACb,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,WAAW,KAAK;GAChB,MAAM,KAAK;GACX,WAAW,KAAK,IAAI,IAAI;EAC1B;EACA,OAAO,YAAY,QAAQ,OAAO;CACpC;CAEA,MAAM,QAAQ,OAAO,OAAe,SAAoC;EACtE,IAAI,CAAC,aAAa,OAAO,QAAQ,GAC/B,MAAM,IAAI,MAAM,kBAAkB;EAEpC,OAAO,MAAM,cAAc,IAAI;CACjC;CAEA,OAAO;EACL,UAAU;GACR,MAAM;GACN,SAAA;GACA,aAAa;GACb,MAAM;EACR;EACA;EACA;EACA,MAAM,iBAAiB;GACrB,MAAM,QAAQ,QAAQ;EACxB;EACA;CACF;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import { SESSION_COOKIE, type AuthAdapter, type AuthUser } from \"@storyshelf/core/adapter/auth\";\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\ndeclare const __PKG_VERSION__: string | undefined;\n\nconst SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ninterface SessionPayload {\n  userId: string;\n  email: string;\n  name: string;\n  avatarUrl?: string;\n  role: AuthUser[\"role\"];\n  expiresAt: number;\n}\n\n/** Options for configuring a shared-password auth adapter. */\nexport interface PasswordAuthOptions {\n  /** The shared password users must present to log in. */\n  password: string;\n  /** Secret used to sign and verify session cookies. */\n  secret: string;\n}\n\n/** Auth adapter that authenticates with a single shared password. */\nexport interface PasswordAuth extends AuthAdapter {\n  /** Verify `password` and, if correct, create a session for `user`, returning a session token. */\n  login(password: string, user: AuthUser): Promise<string>;\n}\n\nfunction hmacHex(secret: string, value: string): string {\n  return createHmac(\"sha256\", secret).update(value).digest(\"hex\");\n}\n\nfunction equalStrings(left: string, right: string): boolean {\n  const leftBuffer = Buffer.from(left);\n  const rightBuffer = Buffer.from(right);\n  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);\n}\n\nfunction encodePayload(payload: SessionPayload): string {\n  return Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n}\n\nfunction decodePayload(body: string): SessionPayload | null {\n  try {\n    return JSON.parse(Buffer.from(body, \"base64url\").toString(\"utf8\")) as SessionPayload;\n  } catch {\n    return null;\n  }\n}\n\nfunction signPayload(secret: string, payload: SessionPayload): string {\n  const body = encodePayload(payload);\n  return `${body}.${hmacHex(secret, body)}`;\n}\n\nfunction verifyPayload(secret: string, token: string): SessionPayload | null {\n  const dot = token.lastIndexOf(\".\");\n  if (dot === -1) {\n    return null;\n  }\n  const body = token.slice(0, dot);\n  const signature = token.slice(dot + 1);\n  if (!equalStrings(hmacHex(secret, body), signature)) {\n    return null;\n  }\n  return decodePayload(body);\n}\n\nfunction readCookie(request: Request, name: string): string | undefined {\n  const header = request.headers.get(\"cookie\");\n  if (!header) {\n    return undefined;\n  }\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) {\n      continue;\n    }\n    if (part.slice(0, eq).trim() === name) {\n      return part.slice(eq + 1).trim();\n    }\n  }\n  return undefined;\n}\n\nfunction toUser(payload: SessionPayload): AuthUser {\n  return {\n    id: payload.userId,\n    email: payload.email,\n    name: payload.name,\n    avatarUrl: payload.avatarUrl,\n    role: payload.role,\n  };\n}\n\n/**\n * Create a shared-password auth adapter.\n *\n * @param options - Password and session signing configuration.\n * @returns A PasswordAuth instance.\n */\nexport function createPasswordAuth(options: PasswordAuthOptions): PasswordAuth {\n  const { password, secret } = options;\n\n  // Async is required by the AuthAdapter interface, though the logic is synchronous.\n  // eslint-disable-next-line require-await\n  const check = async (request: Request): Promise<AuthUser | null> => {\n    const token = readCookie(request, SESSION_COOKIE);\n    if (!token) {\n      return null;\n    }\n    const payload = verifyPayload(secret, token);\n    if (!payload || payload.expiresAt <= Date.now()) {\n      return null;\n    }\n    return toUser(payload);\n  };\n\n  // eslint-disable-next-line require-await\n  const createSession = async (user: AuthUser): Promise<string> => {\n    const payload: SessionPayload = {\n      userId: user.id,\n      email: user.email,\n      name: user.name,\n      avatarUrl: user.avatarUrl,\n      role: user.role,\n      expiresAt: Date.now() + SESSION_TTL_MS,\n    };\n    return signPayload(secret, payload);\n  };\n\n  const login = async (input: string, user: AuthUser): Promise<string> => {\n    if (!equalStrings(input, password)) {\n      throw new Error(\"Invalid password\");\n    }\n    return await createSession(user);\n  };\n\n  return {\n    metadata: {\n      name: \"Password Auth\",\n      version: (globalThis as unknown as { __PKG_VERSION__?: string }).__PKG_VERSION__ ?? \"0.0.0\",\n      description: \"Shared-password auth adapter\",\n      kind: \"password\",\n    },\n    check,\n    createSession,\n    async destroySession() {\n      await Promise.resolve();\n    },\n    login,\n  };\n}\n"],"mappings":";;;;;;AAKA,MAAM,iBAAiB;AAyBvB,SAAS,QAAQ,QAAgB,OAAuB;CACtD,OAAO,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAChE;AAEA,SAAS,aAAa,MAAc,OAAwB;CAC1D,MAAM,aAAa,OAAO,KAAK,IAAI;CACnC,MAAM,cAAc,OAAO,KAAK,KAAK;CACrC,OAAO,WAAW,WAAW,YAAY,UAAU,gBAAgB,YAAY,WAAW;AAC5F;AAEA,SAAS,cAAc,SAAiC;CACtD,OAAO,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,WAAW;AAClE;AAEA,SAAS,cAAc,MAAqC;CAC1D,IAAI;EACF,OAAO,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;CACnE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAY,QAAgB,SAAiC;CACpE,MAAM,OAAO,cAAc,OAAO;CAClC,OAAO,GAAG,KAAK,GAAG,QAAQ,QAAQ,IAAI;AACxC;AAEA,SAAS,cAAc,QAAgB,OAAsC;CAC3E,MAAM,MAAM,MAAM,YAAY,GAAG;CACjC,IAAI,QAAQ,IACV,OAAO;CAET,MAAM,OAAO,MAAM,MAAM,GAAG,GAAG;CAC/B,MAAM,YAAY,MAAM,MAAM,MAAM,CAAC;CACrC,IAAI,CAAC,aAAa,QAAQ,QAAQ,IAAI,GAAG,SAAS,GAChD,OAAO;CAET,OAAO,cAAc,IAAI;AAC3B;AAEA,SAAS,WAAW,SAAkB,MAAkC;CACtE,MAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;CAC3C,IAAI,CAAC,QACH;CAEF,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,OAAO,IACT;EAEF,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,MAAM,MAC/B,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CAEnC;AAEF;AAEA,SAAS,OAAO,SAAmC;CACjD,OAAO;EACL,IAAI,QAAQ;EACZ,OAAO,QAAQ;EACf,MAAM,QAAQ;EACd,WAAW,QAAQ;EACnB,MAAM,QAAQ;CAChB;AACF;;;;;;;AAQA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,EAAE,UAAU,WAAW;CAI7B,MAAM,QAAQ,OAAO,YAA+C;EAClE,MAAM,QAAQ,WAAW,SAAS,cAAc;EAChD,IAAI,CAAC,OACH,OAAO;EAET,MAAM,UAAU,cAAc,QAAQ,KAAK;EAC3C,IAAI,CAAC,WAAW,QAAQ,aAAa,KAAK,IAAI,GAC5C,OAAO;EAET,OAAO,OAAO,OAAO;CACvB;CAGA,MAAM,gBAAgB,OAAO,SAAoC;EAC/D,MAAM,UAA0B;GAC9B,QAAQ,KAAK;GACb,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,WAAW,KAAK;GAChB,MAAM,KAAK;GACX,WAAW,KAAK,IAAI,IAAI;EAC1B;EACA,OAAO,YAAY,QAAQ,OAAO;CACpC;CAEA,MAAM,QAAQ,OAAO,OAAe,SAAoC;EACtE,IAAI,CAAC,aAAa,OAAO,QAAQ,GAC/B,MAAM,IAAI,MAAM,kBAAkB;EAEpC,OAAO,MAAM,cAAc,IAAI;CACjC;CAEA,OAAO;EACL,UAAU;GACR,MAAM;GACN,SAAU,WAAuD,mBAAmB;GACpF,aAAa;GACb,MAAM;EACR;EACA;EACA;EACA,MAAM,iBAAiB;GACrB,MAAM,QAAQ,QAAQ;EACxB;EACA;CACF;AACF"}

package/package.json

@@ -1,43 +1,51 @@
 {
   "name": "@storyshelf/auth-password",
-  "version": "0.1.0",
-  "type": "module",
+  "version": "0.1.2",
   "description": "Shared-password auth adapter for StoryShelf.",
+  "homepage": "https://github.com/GuptaSiddhant/StoryShelf#readme",
+  "bugs": {
+    "url": "https://github.com/GuptaSiddhant/StoryShelf/issues"
+  },
+  "license": "MIT",
   "author": {
     "name": "Siddhant Gupta",
     "url": "https://guptasiddhant.com"
   },
-  "license": "MIT",
-  "sideEffects": false,
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/GuptaSiddhant/storyshelf.git",
+    "url": "git+https://github.com/GuptaSiddhant/StoryShelf.git",
     "directory": "packages/auth-password"
   },
-  "homepage": "https://github.com/GuptaSiddhant/storyshelf#readme",
-  "bugs": {
-    "url": "https://github.com/GuptaSiddhant/storyshelf/issues"
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "source": "./src/index.ts",
+      "default": "./dist/index.mjs"
+    },
+    "./package.json": "./package.json"
   },
   "publishConfig": {
-    "access": "public",
     "exports": {
       ".": "./dist/index.mjs",
       "./package.json": "./package.json"
-    }
+    },
+    "access": "public"
   },
-  "files": [
-    "dist"
-  ],
   "scripts": {
     "build": "tsdown",
     "dev": "tsdown -w",
-    "fmt": "oxfmt -c ../../.oxfmtrc.json ./src",
+    "fmt": "oxfmt ./src",
     "lint": "oxlint --type-aware --type-check ./src",
     "test": "vitest run",
     "prepublishOnly": "nub run build"
   },
   "dependencies": {
-    "@storyshelf/core": "workspace:*",
+    "@storyshelf/core": "^0.1.2",
     "hono": "^4.11.0"
   },
   "devDependencies": {
@@ -50,12 +58,13 @@
     "typescript": "catalog:",
     "vitest": "catalog:"
   },
-  "types": "./dist/index.d.mts",
-  "exports": {
-    ".": {
-      "source": "./src/index.ts",
-      "default": "./dist/index.mjs"
-    },
-    "./package.json": "./package.json"
+  "jsr": {
+    "runtimeCompat": {
+      "node": true,
+      "deno": true,
+      "browser": false,
+      "workerd": false,
+      "bun": true
+    }
   }
 }