@storyshelf/auth-password 0.1.3 → 0.3.2

package/dist/index.mjs

@@ -88,8 +88,10 @@ function createPasswordAuth(options) {
 			name: "Password Auth",
 			version: globalThis.__PKG_VERSION__ ?? "0.0.0",
 			description: "Shared-password auth adapter",
-			kind: "password"
+			kind: "password",
+			category: "auth"
 		},
+		lifecycle: buildLifecycle(options),
 		check,
 		createSession,
 		async destroySession() {
@@ -98,6 +100,13 @@ function createPasswordAuth(options) {
 		login
 	};
 }
+/** Lifecycle: fail fast when password or secret is missing. */
+function buildLifecycle(options) {
+	return { init: async () => {
+		if (options.password === "" || options.secret === "") throw new Error("Password auth requires a non-empty password and secret");
+		await Promise.resolve();
+	} };
+}
 //#endregion
 export { createPasswordAuth };
 

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import { SESSION_COOKIE, type AuthAdapter, type AuthUser } from \"@storyshelf/core/adapter/auth\";\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\ndeclare const __PKG_VERSION__: string | undefined;\n\nconst SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ninterface SessionPayload {\n  userId: string;\n  email: string;\n  name: string;\n  avatarUrl?: string;\n  role: AuthUser[\"role\"];\n  expiresAt: number;\n}\n\n/** Options for configuring a shared-password auth adapter. */\nexport interface PasswordAuthOptions {\n  /** The shared password users must present to log in. */\n  password: string;\n  /** Secret used to sign and verify session cookies. */\n  secret: string;\n}\n\n/** Auth adapter that authenticates with a single shared password. */\nexport interface PasswordAuth extends AuthAdapter {\n  /** Verify `password` and, if correct, create a session for `user`, returning a session token. */\n  login(password: string, user: AuthUser): Promise<string>;\n}\n\nfunction hmacHex(secret: string, value: string): string {\n  return createHmac(\"sha256\", secret).update(value).digest(\"hex\");\n}\n\nfunction equalStrings(left: string, right: string): boolean {\n  const leftBuffer = Buffer.from(left);\n  const rightBuffer = Buffer.from(right);\n  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);\n}\n\nfunction encodePayload(payload: SessionPayload): string {\n  return Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n}\n\nfunction decodePayload(body: string): SessionPayload | null {\n  try {\n    return JSON.parse(Buffer.from(body, \"base64url\").toString(\"utf8\")) as SessionPayload;\n  } catch {\n    return null;\n  }\n}\n\nfunction signPayload(secret: string, payload: SessionPayload): string {\n  const body = encodePayload(payload);\n  return `${body}.${hmacHex(secret, body)}`;\n}\n\nfunction verifyPayload(secret: string, token: string): SessionPayload | null {\n  const dot = token.lastIndexOf(\".\");\n  if (dot === -1) {\n    return null;\n  }\n  const body = token.slice(0, dot);\n  const signature = token.slice(dot + 1);\n  if (!equalStrings(hmacHex(secret, body), signature)) {\n    return null;\n  }\n  return decodePayload(body);\n}\n\nfunction readCookie(request: Request, name: string): string | undefined {\n  const header = request.headers.get(\"cookie\");\n  if (!header) {\n    return undefined;\n  }\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) {\n      continue;\n    }\n    if (part.slice(0, eq).trim() === name) {\n      return part.slice(eq + 1).trim();\n    }\n  }\n  return undefined;\n}\n\nfunction toUser(payload: SessionPayload): AuthUser {\n  return {\n    id: payload.userId,\n    email: payload.email,\n    name: payload.name,\n    avatarUrl: payload.avatarUrl,\n    role: payload.role,\n  };\n}\n\n/**\n * Create a shared-password auth adapter.\n *\n * @param options - Password and session signing configuration.\n * @returns A PasswordAuth instance.\n */\nexport function createPasswordAuth(options: PasswordAuthOptions): PasswordAuth {\n  const { password, secret } = options;\n\n  // Async is required by the AuthAdapter interface, though the logic is synchronous.\n  // eslint-disable-next-line require-await\n  const check = async (request: Request): Promise<AuthUser | null> => {\n    const token = readCookie(request, SESSION_COOKIE);\n    if (!token) {\n      return null;\n    }\n    const payload = verifyPayload(secret, token);\n    if (!payload || payload.expiresAt <= Date.now()) {\n      return null;\n    }\n    return toUser(payload);\n  };\n\n  // eslint-disable-next-line require-await\n  const createSession = async (user: AuthUser): Promise<string> => {\n    const payload: SessionPayload = {\n      userId: user.id,\n      email: user.email,\n      name: user.name,\n      avatarUrl: user.avatarUrl,\n      role: user.role,\n      expiresAt: Date.now() + SESSION_TTL_MS,\n    };\n    return signPayload(secret, payload);\n  };\n\n  const login = async (input: string, user: AuthUser): Promise<string> => {\n    if (!equalStrings(input, password)) {\n      throw new Error(\"Invalid password\");\n    }\n    return await createSession(user);\n  };\n\n  return {\n    metadata: {\n      name: \"Password Auth\",\n      version: (globalThis as unknown as { __PKG_VERSION__?: string }).__PKG_VERSION__ ?? \"0.0.0\",\n      description: \"Shared-password auth adapter\",\n      kind: \"password\",\n    },\n    check,\n    createSession,\n    async destroySession() {\n      await Promise.resolve();\n    },\n    login,\n  };\n}\n"],"mappings":";;;;;;AAKA,MAAM,iBAAiB;AAyBvB,SAAS,QAAQ,QAAgB,OAAuB;CACtD,OAAO,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAChE;AAEA,SAAS,aAAa,MAAc,OAAwB;CAC1D,MAAM,aAAa,OAAO,KAAK,IAAI;CACnC,MAAM,cAAc,OAAO,KAAK,KAAK;CACrC,OAAO,WAAW,WAAW,YAAY,UAAU,gBAAgB,YAAY,WAAW;AAC5F;AAEA,SAAS,cAAc,SAAiC;CACtD,OAAO,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,WAAW;AAClE;AAEA,SAAS,cAAc,MAAqC;CAC1D,IAAI;EACF,OAAO,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;CACnE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAY,QAAgB,SAAiC;CACpE,MAAM,OAAO,cAAc,OAAO;CAClC,OAAO,GAAG,KAAK,GAAG,QAAQ,QAAQ,IAAI;AACxC;AAEA,SAAS,cAAc,QAAgB,OAAsC;CAC3E,MAAM,MAAM,MAAM,YAAY,GAAG;CACjC,IAAI,QAAQ,IACV,OAAO;CAET,MAAM,OAAO,MAAM,MAAM,GAAG,GAAG;CAC/B,MAAM,YAAY,MAAM,MAAM,MAAM,CAAC;CACrC,IAAI,CAAC,aAAa,QAAQ,QAAQ,IAAI,GAAG,SAAS,GAChD,OAAO;CAET,OAAO,cAAc,IAAI;AAC3B;AAEA,SAAS,WAAW,SAAkB,MAAkC;CACtE,MAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;CAC3C,IAAI,CAAC,QACH;CAEF,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,OAAO,IACT;EAEF,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,MAAM,MAC/B,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CAEnC;AAEF;AAEA,SAAS,OAAO,SAAmC;CACjD,OAAO;EACL,IAAI,QAAQ;EACZ,OAAO,QAAQ;EACf,MAAM,QAAQ;EACd,WAAW,QAAQ;EACnB,MAAM,QAAQ;CAChB;AACF;;;;;;;AAQA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,EAAE,UAAU,WAAW;CAI7B,MAAM,QAAQ,OAAO,YAA+C;EAClE,MAAM,QAAQ,WAAW,SAAS,cAAc;EAChD,IAAI,CAAC,OACH,OAAO;EAET,MAAM,UAAU,cAAc,QAAQ,KAAK;EAC3C,IAAI,CAAC,WAAW,QAAQ,aAAa,KAAK,IAAI,GAC5C,OAAO;EAET,OAAO,OAAO,OAAO;CACvB;CAGA,MAAM,gBAAgB,OAAO,SAAoC;EAC/D,MAAM,UAA0B;GAC9B,QAAQ,KAAK;GACb,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,WAAW,KAAK;GAChB,MAAM,KAAK;GACX,WAAW,KAAK,IAAI,IAAI;EAC1B;EACA,OAAO,YAAY,QAAQ,OAAO;CACpC;CAEA,MAAM,QAAQ,OAAO,OAAe,SAAoC;EACtE,IAAI,CAAC,aAAa,OAAO,QAAQ,GAC/B,MAAM,IAAI,MAAM,kBAAkB;EAEpC,OAAO,MAAM,cAAc,IAAI;CACjC;CAEA,OAAO;EACL,UAAU;GACR,MAAM;GACN,SAAU,WAAuD,mBAAmB;GACpF,aAAa;GACb,MAAM;EACR;EACA;EACA;EACA,MAAM,iBAAiB;GACrB,MAAM,QAAQ,QAAQ;EACxB;EACA;CACF;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import { SESSION_COOKIE, type AuthAdapter, type AuthUser } from \"@storyshelf/core/adapter/auth\";\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\ndeclare const __PKG_VERSION__: string | undefined;\n\nconst SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ninterface SessionPayload {\n  userId: string;\n  email: string;\n  name: string;\n  avatarUrl?: string;\n  role: AuthUser[\"role\"];\n  expiresAt: number;\n}\n\n/** Options for configuring a shared-password auth adapter. */\nexport interface PasswordAuthOptions {\n  /** The shared password users must present to log in. */\n  password: string;\n  /** Secret used to sign and verify session cookies. */\n  secret: string;\n}\n\n/** Auth adapter that authenticates with a single shared password. */\nexport interface PasswordAuth extends AuthAdapter {\n  /** Verify `password` and, if correct, create a session for `user`, returning a session token. */\n  login(password: string, user: AuthUser): Promise<string>;\n}\n\nfunction hmacHex(secret: string, value: string): string {\n  return createHmac(\"sha256\", secret).update(value).digest(\"hex\");\n}\n\nfunction equalStrings(left: string, right: string): boolean {\n  const leftBuffer = Buffer.from(left);\n  const rightBuffer = Buffer.from(right);\n  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);\n}\n\nfunction encodePayload(payload: SessionPayload): string {\n  return Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n}\n\nfunction decodePayload(body: string): SessionPayload | null {\n  try {\n    return JSON.parse(Buffer.from(body, \"base64url\").toString(\"utf8\")) as SessionPayload;\n  } catch {\n    return null;\n  }\n}\n\nfunction signPayload(secret: string, payload: SessionPayload): string {\n  const body = encodePayload(payload);\n  return `${body}.${hmacHex(secret, body)}`;\n}\n\nfunction verifyPayload(secret: string, token: string): SessionPayload | null {\n  const dot = token.lastIndexOf(\".\");\n  if (dot === -1) {\n    return null;\n  }\n  const body = token.slice(0, dot);\n  const signature = token.slice(dot + 1);\n  if (!equalStrings(hmacHex(secret, body), signature)) {\n    return null;\n  }\n  return decodePayload(body);\n}\n\nfunction readCookie(request: Request, name: string): string | undefined {\n  const header = request.headers.get(\"cookie\");\n  if (!header) {\n    return undefined;\n  }\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) {\n      continue;\n    }\n    if (part.slice(0, eq).trim() === name) {\n      return part.slice(eq + 1).trim();\n    }\n  }\n  return undefined;\n}\n\nfunction toUser(payload: SessionPayload): AuthUser {\n  return {\n    id: payload.userId,\n    email: payload.email,\n    name: payload.name,\n    avatarUrl: payload.avatarUrl,\n    role: payload.role,\n  };\n}\n\n/**\n * Create a shared-password auth adapter.\n *\n * @param options - Password and session signing configuration.\n * @returns A PasswordAuth instance.\n */\nexport function createPasswordAuth(options: PasswordAuthOptions): PasswordAuth {\n  const { password, secret } = options;\n\n  // Async is required by the AuthAdapter interface, though the logic is synchronous.\n  // eslint-disable-next-line require-await\n  const check = async (request: Request): Promise<AuthUser | null> => {\n    const token = readCookie(request, SESSION_COOKIE);\n    if (!token) {\n      return null;\n    }\n    const payload = verifyPayload(secret, token);\n    if (!payload || payload.expiresAt <= Date.now()) {\n      return null;\n    }\n    return toUser(payload);\n  };\n\n  // eslint-disable-next-line require-await\n  const createSession = async (user: AuthUser): Promise<string> => {\n    const payload: SessionPayload = {\n      userId: user.id,\n      email: user.email,\n      name: user.name,\n      avatarUrl: user.avatarUrl,\n      role: user.role,\n      expiresAt: Date.now() + SESSION_TTL_MS,\n    };\n    return signPayload(secret, payload);\n  };\n\n  const login = async (input: string, user: AuthUser): Promise<string> => {\n    if (!equalStrings(input, password)) {\n      throw new Error(\"Invalid password\");\n    }\n    return await createSession(user);\n  };\n\n  return {\n    metadata: {\n      name: \"Password Auth\",\n      version: (globalThis as unknown as { __PKG_VERSION__?: string }).__PKG_VERSION__ ?? \"0.0.0\",\n      description: \"Shared-password auth adapter\",\n      kind: \"password\",\n      category: \"auth\",\n    },\n    lifecycle: buildLifecycle(options),\n    check,\n    createSession,\n    async destroySession() {\n      await Promise.resolve();\n    },\n    login,\n  };\n}\n\n/** Lifecycle: fail fast when password or secret is missing. */\nfunction buildLifecycle(options: PasswordAuthOptions): PasswordAuth[\"lifecycle\"] {\n  return {\n    init: async () => {\n      if (options.password === \"\" || options.secret === \"\") {\n        throw new Error(\"Password auth requires a non-empty password and secret\");\n      }\n      await Promise.resolve();\n    },\n  };\n}\n"],"mappings":";;;;;;AAKA,MAAM,iBAAiB;AAyBvB,SAAS,QAAQ,QAAgB,OAAuB;CACtD,OAAO,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAChE;AAEA,SAAS,aAAa,MAAc,OAAwB;CAC1D,MAAM,aAAa,OAAO,KAAK,IAAI;CACnC,MAAM,cAAc,OAAO,KAAK,KAAK;CACrC,OAAO,WAAW,WAAW,YAAY,UAAU,gBAAgB,YAAY,WAAW;AAC5F;AAEA,SAAS,cAAc,SAAiC;CACtD,OAAO,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,WAAW;AAClE;AAEA,SAAS,cAAc,MAAqC;CAC1D,IAAI;EACF,OAAO,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;CACnE,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAY,QAAgB,SAAiC;CACpE,MAAM,OAAO,cAAc,OAAO;CAClC,OAAO,GAAG,KAAK,GAAG,QAAQ,QAAQ,IAAI;AACxC;AAEA,SAAS,cAAc,QAAgB,OAAsC;CAC3E,MAAM,MAAM,MAAM,YAAY,GAAG;CACjC,IAAI,QAAQ,IACV,OAAO;CAET,MAAM,OAAO,MAAM,MAAM,GAAG,GAAG;CAC/B,MAAM,YAAY,MAAM,MAAM,MAAM,CAAC;CACrC,IAAI,CAAC,aAAa,QAAQ,QAAQ,IAAI,GAAG,SAAS,GAChD,OAAO;CAET,OAAO,cAAc,IAAI;AAC3B;AAEA,SAAS,WAAW,SAAkB,MAAkC;CACtE,MAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;CAC3C,IAAI,CAAC,QACH;CAEF,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,OAAO,IACT;EAEF,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,MAAM,MAC/B,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CAEnC;AAEF;AAEA,SAAS,OAAO,SAAmC;CACjD,OAAO;EACL,IAAI,QAAQ;EACZ,OAAO,QAAQ;EACf,MAAM,QAAQ;EACd,WAAW,QAAQ;EACnB,MAAM,QAAQ;CAChB;AACF;;;;;;;AAQA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,EAAE,UAAU,WAAW;CAI7B,MAAM,QAAQ,OAAO,YAA+C;EAClE,MAAM,QAAQ,WAAW,SAAS,cAAc;EAChD,IAAI,CAAC,OACH,OAAO;EAET,MAAM,UAAU,cAAc,QAAQ,KAAK;EAC3C,IAAI,CAAC,WAAW,QAAQ,aAAa,KAAK,IAAI,GAC5C,OAAO;EAET,OAAO,OAAO,OAAO;CACvB;CAGA,MAAM,gBAAgB,OAAO,SAAoC;EAC/D,MAAM,UAA0B;GAC9B,QAAQ,KAAK;GACb,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,WAAW,KAAK;GAChB,MAAM,KAAK;GACX,WAAW,KAAK,IAAI,IAAI;EAC1B;EACA,OAAO,YAAY,QAAQ,OAAO;CACpC;CAEA,MAAM,QAAQ,OAAO,OAAe,SAAoC;EACtE,IAAI,CAAC,aAAa,OAAO,QAAQ,GAC/B,MAAM,IAAI,MAAM,kBAAkB;EAEpC,OAAO,MAAM,cAAc,IAAI;CACjC;CAEA,OAAO;EACL,UAAU;GACR,MAAM;GACN,SAAU,WAAuD,mBAAmB;GACpF,aAAa;GACb,MAAM;GACN,UAAU;EACZ;EACA,WAAW,eAAe,OAAO;EACjC;EACA;EACA,MAAM,iBAAiB;GACrB,MAAM,QAAQ,QAAQ;EACxB;EACA;CACF;AACF;;AAGA,SAAS,eAAe,SAAyD;CAC/E,OAAO,EACL,MAAM,YAAY;EAChB,IAAI,QAAQ,aAAa,MAAM,QAAQ,WAAW,IAChD,MAAM,IAAI,MAAM,wDAAwD;EAE1E,MAAM,QAAQ,QAAQ;CACxB,EACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@storyshelf/auth-password",
-  "version": "0.1.3",
+  "version": "0.3.2",
   "description": "Shared-password auth adapter for StoryShelf.",
   "homepage": "https://github.com/GuptaSiddhant/StoryShelf#readme",
   "bugs": {
@@ -45,7 +45,7 @@
     "prepublishOnly": "nub run build"
   },
   "dependencies": {
-    "@storyshelf/core": "^0.1.3",
+    "@storyshelf/core": "^0.3.2",
     "hono": "^4.11.0"
   },
   "devDependencies": {