@takaro/auth 0.0.0-next.09a7ca1

package/README.md

@@ -0,0 +1 @@
+# @takaro/auth

package/dist/config.d.ts

@@ -0,0 +1,43 @@
+import { Config, IBaseConfig } from '@takaro/config';
+export interface IAuthConfig extends IBaseConfig {
+    kratos: {
+        publicUrl: string;
+        adminUrl: string;
+    };
+    adminClientSecret: string;
+    takaro: {
+        url: string;
+    };
+}
+export declare const configSchema: {
+    kratos: {
+        publicUrl: {
+            doc: string;
+            format: StringConstructor;
+            default: string;
+            env: string;
+        };
+        adminUrl: {
+            doc: string;
+            format: StringConstructor;
+            default: string;
+            env: string;
+        };
+    };
+    adminClientSecret: {
+        doc: string;
+        format: StringConstructor;
+        default: null;
+        env: string;
+    };
+    takaro: {
+        url: {
+            doc: string;
+            format: StringConstructor;
+            default: string;
+            env: string;
+        };
+    };
+};
+export declare const config: Config<IAuthConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AAED,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BxB,CAAC;AAEF,eAAO,MAAM,MAAM,qBAA0C,CAAC"}

package/dist/config.js

@@ -0,0 +1,33 @@
+import { Config } from '@takaro/config';
+export const configSchema = {
+    kratos: {
+        publicUrl: {
+            doc: 'The URL of the Kratos public API',
+            format: String,
+            default: 'http://kratos:4433',
+            env: 'KRATOS_URL',
+        },
+        adminUrl: {
+            doc: 'The URL of the Kratos admin API',
+            format: String,
+            default: 'http://kratos:4434',
+            env: 'KRATOS_ADMIN_URL',
+        },
+    },
+    adminClientSecret: {
+        doc: 'The client secret to use when authenticating with the Takaro server',
+        format: String,
+        default: null,
+        env: 'ADMIN_CLIENT_SECRET',
+    },
+    takaro: {
+        url: {
+            doc: 'The URL of the Takaro server',
+            format: String,
+            default: 'http://localhost:3000',
+            env: 'TAKARO_HOST',
+        },
+    },
+};
+export const config = new Config([configSchema]);
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAe,MAAM,gBAAgB,CAAC;AAarD,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE;QACN,SAAS,EAAE;YACT,GAAG,EAAE,kCAAkC;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oBAAoB;YAC7B,GAAG,EAAE,YAAY;SAClB;QACD,QAAQ,EAAE;YACR,GAAG,EAAE,iCAAiC;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oBAAoB;YAC7B,GAAG,EAAE,kBAAkB;SACxB;KACF;IACD,iBAAiB,EAAE;QACjB,GAAG,EAAE,qEAAqE;QAC1E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,qBAAqB;KAC3B;IACD,MAAM,EAAE;QACN,GAAG,EAAE;YACH,GAAG,EAAE,8BAA8B;YACnC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uBAAuB;YAChC,GAAG,EAAE,aAAa;SACnB;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAc,CAAC,YAAY,CAAC,CAAC,CAAC"}

package/dist/lib/ory.d.ts

@@ -0,0 +1,22 @@
+import { Request } from 'express';
+export interface ITakaroIdentity {
+    id: string;
+    email: string;
+}
+declare class Ory {
+    private log;
+    private identityClient;
+    private frontendClient;
+    constructor();
+    getIdentity(id: string): Promise<ITakaroIdentity>;
+    getIdentityByEmail(email: string): Promise<ITakaroIdentity | null>;
+    createIdentity(email: string, password?: string): Promise<ITakaroIdentity>;
+    deleteIdentity(id: string): Promise<void>;
+    getIdentityFromReq(req: Request): Promise<ITakaroIdentity | null>;
+    submitApiLogin(username: string, password: string): Promise<import("axios").AxiosResponse<import("@ory/client").SuccessfulNativeLogin, any>>;
+    apiLogout(req: Request): Promise<true | import("axios").AxiosResponse<void, any>>;
+    getRecoveryFlow(id: string): Promise<import("@ory/client").RecoveryLinkForIdentity>;
+}
+export declare const ory: Ory;
+export {};
+//# sourceMappingURL=ory.d.ts.map

package/dist/lib/ory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ory.d.ts","sourceRoot":"","sources":["../../src/lib/ory.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAMlC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,cAAM,GAAG;IACP,OAAO,CAAC,GAAG,CAAiB;IAE5B,OAAO,CAAC,cAAc,CAAc;IACpC,OAAO,CAAC,cAAc,CAAc;;IAoB9B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAWjD,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAWlE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAsC1E,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzC,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAmBjE,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAcjD,SAAS,CAAC,GAAG,EAAE,OAAO;IAYtB,eAAe,CAAC,EAAE,EAAE,MAAM;CAUjC;AAED,eAAO,MAAM,GAAG,KAAY,CAAC"}

package/dist/lib/ory.js

@@ -0,0 +1,125 @@
+import { Configuration, FrontendApi, IdentityApi } from '@ory/client';
+import { config } from '../config.js';
+import { logger } from '@takaro/util';
+import { createAxiosClient } from './oryAxiosClient.js';
+var IDENTITY_SCHEMA;
+(function (IDENTITY_SCHEMA) {
+    IDENTITY_SCHEMA["USER"] = "user_v0";
+})(IDENTITY_SCHEMA || (IDENTITY_SCHEMA = {}));
+class Ory {
+    constructor() {
+        this.log = logger('ory');
+        this.identityClient = new IdentityApi(new Configuration({
+            basePath: config.get('kratos.adminUrl'),
+        }), undefined, createAxiosClient(config.get('kratos.adminUrl')));
+        this.frontendClient = new FrontendApi(new Configuration({
+            basePath: config.get('kratos.publicUrl'),
+        }), undefined, createAxiosClient(config.get('kratos.publicUrl')));
+    }
+    async getIdentity(id) {
+        const res = await this.identityClient.getIdentity({
+            id,
+        });
+        return {
+            id: res.data.id,
+            email: res.data.traits.email,
+        };
+    }
+    async getIdentityByEmail(email) {
+        const identity = await this.identityClient.listIdentities({ credentialsIdentifier: email });
+        if (!identity.data.length)
+            return null;
+        return {
+            id: identity.data[0].id,
+            email: identity.data[0].traits.email,
+        };
+    }
+    async createIdentity(email, password) {
+        const existing = await this.identityClient.listIdentities({ credentialsIdentifier: email });
+        if (existing.data.length) {
+            this.log.warn('Identity already exists, returning existing one.', { email });
+            return {
+                id: existing.data[0].id,
+                email: existing.data[0].traits.email,
+            };
+        }
+        const body = {
+            schema_id: IDENTITY_SCHEMA.USER,
+            traits: {
+                email,
+            },
+        };
+        if (password) {
+            body.credentials = {
+                password: {
+                    config: {
+                        password,
+                    },
+                },
+            };
+        }
+        const res = await this.identityClient.createIdentity({
+            createIdentityBody: body,
+        });
+        return {
+            id: res.data.id,
+            email: res.data.traits.email,
+        };
+    }
+    async deleteIdentity(id) {
+        await this.identityClient.deleteIdentity({
+            id,
+        });
+    }
+    async getIdentityFromReq(req) {
+        const tokenFromAuthHeader = req.headers['authorization']?.replace('Bearer ', '');
+        try {
+            const sessionRes = await this.frontendClient.toSession({
+                cookie: req.headers.cookie,
+                xSessionToken: tokenFromAuthHeader,
+            });
+            return {
+                id: sessionRes.data.identity.id,
+                email: sessionRes.data.identity.traits.email,
+            };
+        }
+        catch (error) {
+            this.log.warn('Could not get identity from request', { error });
+            return null;
+        }
+    }
+    async submitApiLogin(username, password) {
+        const flow = await this.frontendClient.createNativeLoginFlow({
+            refresh: true,
+        });
+        return this.frontendClient.updateLoginFlow({
+            flow: flow.data.id,
+            updateLoginFlowBody: {
+                password,
+                identifier: username,
+                method: 'password',
+            },
+        });
+    }
+    async apiLogout(req) {
+        const tokenFromAuthHeader = req.headers['authorization']?.replace('Bearer ', '');
+        if (!tokenFromAuthHeader)
+            return true;
+        return this.frontendClient.performNativeLogout({
+            performNativeLogoutBody: {
+                session_token: tokenFromAuthHeader,
+            },
+        });
+    }
+    async getRecoveryFlow(id) {
+        const recoveryRes = await this.identityClient.createRecoveryLinkForIdentity({
+            createRecoveryLinkForIdentityBody: {
+                identity_id: id,
+                expires_in: '24h',
+            },
+        });
+        return recoveryRes.data;
+    }
+}
+export const ory = new Ory();
+//# sourceMappingURL=ory.js.map

package/dist/lib/ory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ory.js","sourceRoot":"","sources":["../../src/lib/ory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAsB,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1F,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,IAAK,eAEJ;AAFD,WAAK,eAAe;IAClB,mCAAgB,CAAA;AAClB,CAAC,EAFI,eAAe,KAAf,eAAe,QAEnB;AAOD,MAAM,GAAG;IAMP;QALQ,QAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAM1B,IAAI,CAAC,cAAc,GAAG,IAAI,WAAW,CACnC,IAAI,aAAa,CAAC;YAChB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;SACxC,CAAC,EACF,SAAS,EACT,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CACjD,CAAC;QAEF,IAAI,CAAC,cAAc,GAAG,IAAI,WAAW,CACnC,IAAI,aAAa,CAAC;YAChB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC;SACzC,CAAC,EACF,SAAS,EACT,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAClD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;YAChD,EAAE;SACH,CAAC,CAAC;QAEH,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;SAC7B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAa;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5F,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEvC,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;YACvB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;SACrC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAiB;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5F,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kDAAkD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7E,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;aACrC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAuB;YAC/B,SAAS,EAAE,eAAe,CAAC,IAAI;YAC/B,MAAM,EAAE;gBACN,KAAK;aACN;SACF,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,GAAG;gBACjB,QAAQ,EAAE;oBACR,MAAM,EAAE;wBACN,QAAQ;qBACT;iBACF;aACF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;YACnD,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;SAC7B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;YACvC,EAAE;SACH,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAY;QACnC,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAEjF,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;gBACrD,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;gBAC1B,aAAa,EAAE,mBAAmB;aACnC,CAAC,CAAC;YAEH,OAAO;gBACL,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,QAAS,CAAC,EAAE;gBAChC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,QAAS,CAAC,MAAM,CAAC,KAAK;aAC9C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC;YAC3D,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;YACzC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YAClB,mBAAmB,EAAE;gBACnB,QAAQ;gBACR,UAAU,EAAE,QAAQ;gBACpB,MAAM,EAAE,UAAU;aACnB;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAY;QAC1B,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAEjF,IAAI,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC;QAEtC,OAAO,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC;YAC7C,uBAAuB,EAAE;gBACvB,aAAa,EAAE,mBAAmB;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAU;QAC9B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,6BAA6B,CAAC;YAC1E,iCAAiC,EAAE;gBACjC,WAAW,EAAE,EAAE;gBACf,UAAU,EAAE,KAAK;aAClB;SACF,CAAC,CAAC;QAEH,OAAO,WAAW,CAAC,IAAI,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC"}

package/dist/lib/oryAxiosClient.d.ts

@@ -0,0 +1,2 @@
+export declare function createAxiosClient(baseURL: string): import("axios").AxiosInstance;
+//# sourceMappingURL=oryAxiosClient.d.ts.map

package/dist/lib/oryAxiosClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oryAxiosClient.d.ts","sourceRoot":"","sources":["../../src/lib/oryAxiosClient.ts"],"names":[],"mappings":"AAGA,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,iCAiChD"}

package/dist/lib/oryAxiosClient.js

@@ -0,0 +1,27 @@
+import { addCounterToAxios, errors, logger, createAxios } from '@takaro/util';
+export function createAxiosClient(baseURL) {
+    const log = logger('ory:http');
+    const client = createAxios({
+        baseURL,
+        headers: {
+            'Content-Type': 'application/json',
+            'User-Agent': 'Takaro-Agent',
+        },
+    }, {
+        logger: log,
+    });
+    addCounterToAxios(client, {
+        name: 'ory_api_requests_total',
+        help: 'Total number of requests to the Ory API',
+    });
+    client.interceptors.response.use((response) => {
+        return response;
+    }, (error) => {
+        if (error.response?.status === 409) {
+            return Promise.reject(new errors.ConflictError('User with this identifier already exists'));
+        }
+        return Promise.reject(error);
+    });
+    return client;
+}
+//# sourceMappingURL=oryAxiosClient.js.map

package/dist/lib/oryAxiosClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oryAxiosClient.js","sourceRoot":"","sources":["../../src/lib/oryAxiosClient.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE9E,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,WAAW,CACxB;QACE,OAAO;QACP,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,cAAc;SAC7B;KACF,EACD;QACE,MAAM,EAAE,GAAG;KACZ,CACF,CAAC;IAEF,iBAAiB,CAAC,MAAM,EAAE;QACxB,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,yCAAyC;KAChD,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAC9B,CAAC,QAAQ,EAAE,EAAE;QACX,OAAO,QAAQ,CAAC;IAClB,CAAC,EACD,CAAC,KAAiB,EAAE,EAAE;QACpB,IAAI,KAAK,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;YACnC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,0CAA0C,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/permissions.d.ts

@@ -0,0 +1,33 @@
+export declare enum PERMISSIONS {
+    'ROOT' = "ROOT",
+    'MANAGE_USERS' = "MANAGE_USERS",
+    'READ_USERS' = "READ_USERS",
+    'MANAGE_ROLES' = "MANAGE_ROLES",
+    'READ_ROLES' = "READ_ROLES",
+    'MANAGE_GAMESERVERS' = "MANAGE_GAMESERVERS",
+    'READ_MODULES' = "READ_MODULES",
+    'MANAGE_MODULES' = "MANAGE_MODULES",
+    'READ_PLAYERS' = "READ_PLAYERS",
+    'MANAGE_PLAYERS' = "MANAGE_PLAYERS",
+    'MANAGE_SETTINGS' = "MANAGE_SETTINGS",
+    'READ_SETTINGS' = "READ_SETTINGS",
+    'READ_VARIABLES' = "READ_VARIABLES",
+    'MANAGE_VARIABLES' = "MANAGE_VARIABLES",
+    'READ_EVENTS' = "READ_EVENTS",
+    'MANAGE_EVENTS' = "MANAGE_EVENTS",
+    'READ_ITEMS' = "READ_ITEMS",
+    'MANAGE_ITEMS' = "MANAGE_ITEMS",
+    'READ_ENTITIES' = "READ_ENTITIES",
+    'MANAGE_ENTITIES' = "MANAGE_ENTITIES",
+    'MANAGE_SHOP_LISTINGS' = "MANAGE_SHOP_LISTINGS",
+    'MANAGE_SHOP_ORDERS' = "MANAGE_SHOP_ORDERS",
+    'VIEW_DISCORD_INFO' = "VIEW_DISCORD_INFO",
+    'SEND_DISCORD_MESSAGE' = "SEND_DISCORD_MESSAGE"
+}
+export interface IPermissionDetails {
+    permission: string;
+    friendlyName: string;
+    description: string;
+}
+export declare const PERMISSION_DETAILS: Record<PERMISSIONS, IPermissionDetails>;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/lib/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/lib/permissions.ts"],"names":[],"mappings":"AAAA,oBAAY,WAAW;IACrB,MAAM,SAAS;IACf,cAAc,iBAAiB;IAC/B,YAAY,eAAe;IAC3B,cAAc,iBAAiB;IAC/B,YAAY,eAAe;IAC3B,oBAAoB,uBAAuB;IAC3C,cAAc,iBAAiB;IAC/B,gBAAgB,mBAAmB;IACnC,cAAc,iBAAiB;IAC/B,gBAAgB,mBAAmB;IACnC,iBAAiB,oBAAoB;IACrC,eAAe,kBAAkB;IACjC,gBAAgB,mBAAmB;IACnC,kBAAkB,qBAAqB;IACvC,aAAa,gBAAgB;IAC7B,eAAe,kBAAkB;IACjC,YAAY,eAAe;IAC3B,cAAc,iBAAiB;IAC/B,eAAe,kBAAkB;IACjC,iBAAiB,oBAAoB;IACrC,sBAAsB,yBAAyB;IAC/C,oBAAoB,uBAAuB;IAC3C,mBAAmB,sBAAsB;IACzC,sBAAsB,yBAAyB;CAChD;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,WAAW,EAAE,kBAAkB,CAyHtE,CAAC"}

package/dist/lib/permissions.js

@@ -0,0 +1,150 @@
+export var PERMISSIONS;
+(function (PERMISSIONS) {
+    PERMISSIONS["ROOT"] = "ROOT";
+    PERMISSIONS["MANAGE_USERS"] = "MANAGE_USERS";
+    PERMISSIONS["READ_USERS"] = "READ_USERS";
+    PERMISSIONS["MANAGE_ROLES"] = "MANAGE_ROLES";
+    PERMISSIONS["READ_ROLES"] = "READ_ROLES";
+    PERMISSIONS["MANAGE_GAMESERVERS"] = "MANAGE_GAMESERVERS";
+    PERMISSIONS["READ_MODULES"] = "READ_MODULES";
+    PERMISSIONS["MANAGE_MODULES"] = "MANAGE_MODULES";
+    PERMISSIONS["READ_PLAYERS"] = "READ_PLAYERS";
+    PERMISSIONS["MANAGE_PLAYERS"] = "MANAGE_PLAYERS";
+    PERMISSIONS["MANAGE_SETTINGS"] = "MANAGE_SETTINGS";
+    PERMISSIONS["READ_SETTINGS"] = "READ_SETTINGS";
+    PERMISSIONS["READ_VARIABLES"] = "READ_VARIABLES";
+    PERMISSIONS["MANAGE_VARIABLES"] = "MANAGE_VARIABLES";
+    PERMISSIONS["READ_EVENTS"] = "READ_EVENTS";
+    PERMISSIONS["MANAGE_EVENTS"] = "MANAGE_EVENTS";
+    PERMISSIONS["READ_ITEMS"] = "READ_ITEMS";
+    PERMISSIONS["MANAGE_ITEMS"] = "MANAGE_ITEMS";
+    PERMISSIONS["READ_ENTITIES"] = "READ_ENTITIES";
+    PERMISSIONS["MANAGE_ENTITIES"] = "MANAGE_ENTITIES";
+    PERMISSIONS["MANAGE_SHOP_LISTINGS"] = "MANAGE_SHOP_LISTINGS";
+    PERMISSIONS["MANAGE_SHOP_ORDERS"] = "MANAGE_SHOP_ORDERS";
+    PERMISSIONS["VIEW_DISCORD_INFO"] = "VIEW_DISCORD_INFO";
+    PERMISSIONS["SEND_DISCORD_MESSAGE"] = "SEND_DISCORD_MESSAGE";
+})(PERMISSIONS || (PERMISSIONS = {}));
+export const PERMISSION_DETAILS = {
+    [PERMISSIONS.ROOT]: {
+        permission: PERMISSIONS.ROOT,
+        friendlyName: 'Root Access',
+        description: 'Full access to all systems and resources',
+    },
+    [PERMISSIONS.MANAGE_USERS]: {
+        permission: PERMISSIONS.MANAGE_USERS,
+        friendlyName: 'Manage Users',
+        description: 'Can create, update, and delete users',
+    },
+    [PERMISSIONS.READ_USERS]: {
+        permission: PERMISSIONS.READ_USERS,
+        friendlyName: 'Read Users',
+        description: 'Can view user details',
+    },
+    [PERMISSIONS.MANAGE_ROLES]: {
+        permission: PERMISSIONS.MANAGE_ROLES,
+        friendlyName: 'Manage Roles',
+        description: 'Can create, update, and delete roles',
+    },
+    [PERMISSIONS.READ_ROLES]: {
+        permission: PERMISSIONS.READ_ROLES,
+        friendlyName: 'Read Roles',
+        description: 'Can view role details',
+    },
+    [PERMISSIONS.MANAGE_GAMESERVERS]: {
+        permission: PERMISSIONS.MANAGE_GAMESERVERS,
+        friendlyName: 'Manage Game Servers',
+        description: 'Can create, update, and delete game servers',
+    },
+    [PERMISSIONS.READ_MODULES]: {
+        permission: PERMISSIONS.READ_MODULES,
+        friendlyName: 'Read Modules',
+        description: 'Can view module details',
+    },
+    [PERMISSIONS.MANAGE_MODULES]: {
+        permission: PERMISSIONS.MANAGE_MODULES,
+        friendlyName: 'Manage Modules',
+        description: 'Can create, update, and delete modules',
+    },
+    [PERMISSIONS.READ_PLAYERS]: {
+        permission: PERMISSIONS.READ_PLAYERS,
+        friendlyName: 'Read Players',
+        description: 'Can view player details',
+    },
+    [PERMISSIONS.MANAGE_PLAYERS]: {
+        permission: PERMISSIONS.MANAGE_PLAYERS,
+        friendlyName: 'Manage Players',
+        description: 'Can create, update, and delete players',
+    },
+    [PERMISSIONS.MANAGE_SETTINGS]: {
+        permission: PERMISSIONS.MANAGE_SETTINGS,
+        friendlyName: 'Manage Settings',
+        description: 'Can modify settings',
+    },
+    [PERMISSIONS.READ_SETTINGS]: {
+        permission: PERMISSIONS.READ_SETTINGS,
+        friendlyName: 'Read Settings',
+        description: 'Can view settings',
+    },
+    [PERMISSIONS.READ_VARIABLES]: {
+        permission: PERMISSIONS.READ_VARIABLES,
+        friendlyName: 'Read Variables',
+        description: 'Can view variables',
+    },
+    [PERMISSIONS.MANAGE_VARIABLES]: {
+        permission: PERMISSIONS.MANAGE_VARIABLES,
+        friendlyName: 'Manage Variables',
+        description: 'Can create, update, and delete variables',
+    },
+    [PERMISSIONS.READ_EVENTS]: {
+        permission: PERMISSIONS.READ_EVENTS,
+        friendlyName: 'Read Events',
+        description: 'Can view event details',
+    },
+    [PERMISSIONS.MANAGE_EVENTS]: {
+        permission: PERMISSIONS.MANAGE_EVENTS,
+        friendlyName: 'Manage Events',
+        description: 'Can create, update, and delete events',
+    },
+    [PERMISSIONS.READ_ITEMS]: {
+        permission: PERMISSIONS.READ_ITEMS,
+        friendlyName: 'Read Items',
+        description: 'Can view item details',
+    },
+    [PERMISSIONS.MANAGE_ITEMS]: {
+        permission: PERMISSIONS.MANAGE_ITEMS,
+        friendlyName: 'Manage Items',
+        description: 'Can create, update, and delete items',
+    },
+    [PERMISSIONS.READ_ENTITIES]: {
+        permission: PERMISSIONS.READ_ENTITIES,
+        friendlyName: 'Read Entities',
+        description: 'Can view entity details',
+    },
+    [PERMISSIONS.MANAGE_ENTITIES]: {
+        permission: PERMISSIONS.MANAGE_ENTITIES,
+        friendlyName: 'Manage Entities',
+        description: 'Can create, update, and delete entities',
+    },
+    [PERMISSIONS.MANAGE_SHOP_LISTINGS]: {
+        permission: PERMISSIONS.MANAGE_SHOP_LISTINGS,
+        friendlyName: 'Manage Shop Listings',
+        description: 'Can create, update, and delete shop listings',
+    },
+    [PERMISSIONS.MANAGE_SHOP_ORDERS]: {
+        permission: PERMISSIONS.MANAGE_SHOP_ORDERS,
+        friendlyName: 'Manage Shop Orders',
+        description: 'Can view orders not belonging to the themself and perform administrative actions on them',
+    },
+    [PERMISSIONS.VIEW_DISCORD_INFO]: {
+        permission: PERMISSIONS.VIEW_DISCORD_INFO,
+        friendlyName: 'View Discord Info',
+        description: 'Can view Discord guild information including channels and roles',
+    },
+    [PERMISSIONS.SEND_DISCORD_MESSAGE]: {
+        permission: PERMISSIONS.SEND_DISCORD_MESSAGE,
+        friendlyName: 'Send Discord Messages',
+        description: 'Can send messages to Discord channels',
+    },
+};
+//# sourceMappingURL=permissions.js.map

package/dist/lib/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/lib/permissions.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,WAyBX;AAzBD,WAAY,WAAW;IACrB,4BAAe,CAAA;IACf,4CAA+B,CAAA;IAC/B,wCAA2B,CAAA;IAC3B,4CAA+B,CAAA;IAC/B,wCAA2B,CAAA;IAC3B,wDAA2C,CAAA;IAC3C,4CAA+B,CAAA;IAC/B,gDAAmC,CAAA;IACnC,4CAA+B,CAAA;IAC/B,gDAAmC,CAAA;IACnC,kDAAqC,CAAA;IACrC,8CAAiC,CAAA;IACjC,gDAAmC,CAAA;IACnC,oDAAuC,CAAA;IACvC,0CAA6B,CAAA;IAC7B,8CAAiC,CAAA;IACjC,wCAA2B,CAAA;IAC3B,4CAA+B,CAAA;IAC/B,8CAAiC,CAAA;IACjC,kDAAqC,CAAA;IACrC,4DAA+C,CAAA;IAC/C,wDAA2C,CAAA;IAC3C,sDAAyC,CAAA;IACzC,4DAA+C,CAAA;AACjD,CAAC,EAzBW,WAAW,KAAX,WAAW,QAyBtB;AAQD,MAAM,CAAC,MAAM,kBAAkB,GAA4C;IACzE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE;QAClB,UAAU,EAAE,WAAW,CAAC,IAAI;QAC5B,YAAY,EAAE,aAAa;QAC3B,WAAW,EAAE,0CAA0C;KACxD;IACD,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE;QAC1B,UAAU,EAAE,WAAW,CAAC,YAAY;QACpC,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,sCAAsC;KACpD;IACD,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE;QACxB,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,YAAY,EAAE,YAAY;QAC1B,WAAW,EAAE,uBAAuB;KACrC;IACD,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE;QAC1B,UAAU,EAAE,WAAW,CAAC,YAAY;QACpC,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,sCAAsC;KACpD;IACD,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE;QACxB,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,YAAY,EAAE,YAAY;QAC1B,WAAW,EAAE,uBAAuB;KACrC;IACD,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE;QAChC,UAAU,EAAE,WAAW,CAAC,kBAAkB;QAC1C,YAAY,EAAE,qBAAqB;QACnC,WAAW,EAAE,6CAA6C;KAC3D;IACD,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE;QAC1B,UAAU,EAAE,WAAW,CAAC,YAAY;QACpC,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,yBAAyB;KACvC;IACD,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE;QAC5B,UAAU,EAAE,WAAW,CAAC,cAAc;QACtC,YAAY,EAAE,gBAAgB;QAC9B,WAAW,EAAE,wCAAwC;KACtD;IACD,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE;QAC1B,UAAU,EAAE,WAAW,CAAC,YAAY;QACpC,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,yBAAyB;KACvC;IACD,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE;QAC5B,UAAU,EAAE,WAAW,CAAC,cAAc;QACtC,YAAY,EAAE,gBAAgB;QAC9B,WAAW,EAAE,wCAAwC;KACtD;IACD,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE;QAC7B,UAAU,EAAE,WAAW,CAAC,eAAe;QACvC,YAAY,EAAE,iBAAiB;QAC/B,WAAW,EAAE,qBAAqB;KACnC;IACD,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE;QAC3B,UAAU,EAAE,WAAW,CAAC,aAAa;QACrC,YAAY,EAAE,eAAe;QAC7B,WAAW,EAAE,mBAAmB;KACjC;IACD,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE;QAC5B,UAAU,EAAE,WAAW,CAAC,cAAc;QACtC,YAAY,EAAE,gBAAgB;QAC9B,WAAW,EAAE,oBAAoB;KAClC;IACD,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE;QAC9B,UAAU,EAAE,WAAW,CAAC,gBAAgB;QACxC,YAAY,EAAE,kBAAkB;QAChC,WAAW,EAAE,0CAA0C;KACxD;IACD,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE;QACzB,UAAU,EAAE,WAAW,CAAC,WAAW;QACnC,YAAY,EAAE,aAAa;QAC3B,WAAW,EAAE,wBAAwB;KACtC;IACD,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE;QAC3B,UAAU,EAAE,WAAW,CAAC,aAAa;QACrC,YAAY,EAAE,eAAe;QAC7B,WAAW,EAAE,uCAAuC;KACrD;IACD,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE;QACxB,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,YAAY,EAAE,YAAY;QAC1B,WAAW,EAAE,uBAAuB;KACrC;IACD,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE;QAC1B,UAAU,EAAE,WAAW,CAAC,YAAY;QACpC,YAAY,EAAE,cAAc;QAC5B,WAAW,EAAE,sCAAsC;KACpD;IACD,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE;QAC3B,UAAU,EAAE,WAAW,CAAC,aAAa;QACrC,YAAY,EAAE,eAAe;QAC7B,WAAW,EAAE,yBAAyB;KACvC;IACD,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE;QAC7B,UAAU,EAAE,WAAW,CAAC,eAAe;QACvC,YAAY,EAAE,iBAAiB;QAC/B,WAAW,EAAE,yCAAyC;KACvD;IACD,CAAC,WAAW,CAAC,oBAAoB,CAAC,EAAE;QAClC,UAAU,EAAE,WAAW,CAAC,oBAAoB;QAC5C,YAAY,EAAE,sBAAsB;QACpC,WAAW,EAAE,8CAA8C;KAC5D;IACD,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE;QAChC,UAAU,EAAE,WAAW,CAAC,kBAAkB;QAC1C,YAAY,EAAE,oBAAoB;QAClC,WAAW,EAAE,0FAA0F;KACxG;IACD,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE;QAC/B,UAAU,EAAE,WAAW,CAAC,iBAAiB;QACzC,YAAY,EAAE,mBAAmB;QACjC,WAAW,EAAE,iEAAiE;KAC/E;IACD,CAAC,WAAW,CAAC,oBAAoB,CAAC,EAAE;QAClC,UAAU,EAAE,WAAW,CAAC,oBAAoB;QAC5C,YAAY,EAAE,uBAAuB;QACrC,WAAW,EAAE,uCAAuC;KACrD;CACF,CAAC"}

package/dist/main.d.ts

@@ -0,0 +1,4 @@
+export { IAuthConfig, configSchema as authConfigSchema } from './config.js';
+export { ory } from './lib/ory.js';
+export * from './lib/permissions.js';
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,cAAc,sBAAsB,CAAC"}

package/dist/main.js

@@ -0,0 +1,4 @@
+export { configSchema as authConfigSchema } from './config.js';
+export { ory } from './lib/ory.js';
+export * from './lib/permissions.js';
+//# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,YAAY,IAAI,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,cAAc,sBAAsB,CAAC"}

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@takaro/auth",
+  "description": "An opinionated auth handler",
+  "version": "0.0.0-next.09a7ca1",
+  "author": "",
+  "dependencies": {
+    "@ory/client": "1.14.5",
+    "axios": "1.7.7",
+    "express": "4.21.2"
+  },
+  "keywords": [],
+  "license": "ISC",
+  "main": "dist/main.js",
+  "peerDependencies": {
+    "@takaro/config": "*",
+    "@takaro/util": "*"
+  },
+  "scripts": {
+    "build": "tsc -p ./tsconfig.build.json",
+    "start:dev": ":"
+  },
+  "type": "module",
+  "types": "dist/main.d.ts"
+}

package/src/config.ts

@@ -0,0 +1,45 @@
+import { Config, IBaseConfig } from '@takaro/config';
+
+export interface IAuthConfig extends IBaseConfig {
+  kratos: {
+    publicUrl: string;
+    adminUrl: string;
+  };
+  adminClientSecret: string;
+  takaro: {
+    url: string;
+  };
+}
+
+export const configSchema = {
+  kratos: {
+    publicUrl: {
+      doc: 'The URL of the Kratos public API',
+      format: String,
+      default: 'http://kratos:4433',
+      env: 'KRATOS_URL',
+    },
+    adminUrl: {
+      doc: 'The URL of the Kratos admin API',
+      format: String,
+      default: 'http://kratos:4434',
+      env: 'KRATOS_ADMIN_URL',
+    },
+  },
+  adminClientSecret: {
+    doc: 'The client secret to use when authenticating with the Takaro server',
+    format: String,
+    default: null,
+    env: 'ADMIN_CLIENT_SECRET',
+  },
+  takaro: {
+    url: {
+      doc: 'The URL of the Takaro server',
+      format: String,
+      default: 'http://localhost:3000',
+      env: 'TAKARO_HOST',
+    },
+  },
+};
+
+export const config = new Config<IAuthConfig>([configSchema]);

package/src/lib/__tests__/ory.integration.test.ts

@@ -0,0 +1,27 @@
+import { ory } from '../ory.js';
+import { faker } from '@faker-js/faker';
+import { expect } from '@takaro/test';
+import { describe, it } from 'node:test';
+
+describe('Ory', () => {
+  it('Create and delete identities', async () => {
+    // First, create a bunch of identities
+    const totalIdentities = 150;
+    const identities = await Promise.all(
+      Array.from({ length: totalIdentities }).map(() => ory.createIdentity(faker.internet.email(), 'password')),
+    );
+
+    // Fetch the first one by ID
+
+    const firstIdentity = await ory.getIdentity(identities[0].id);
+    expect(firstIdentity.email).to.be.eq(identities[0].email);
+
+    // Delete them all
+    await Promise.all(identities.map((i) => ory.deleteIdentity(i.id)));
+
+    // Make sure they're gone
+    await expect(ory.getIdentity(identities[0].id)).to.eventually.be.rejectedWith(
+      'Request failed with status 404 Not Found',
+    );
+  });
+});

package/src/lib/ory.ts

@@ -0,0 +1,163 @@
+import { Configuration, CreateIdentityBody, FrontendApi, IdentityApi } from '@ory/client';
+import { config } from '../config.js';
+import { logger } from '@takaro/util';
+import { createAxiosClient } from './oryAxiosClient.js';
+import { Request } from 'express';
+
+enum IDENTITY_SCHEMA {
+  USER = 'user_v0',
+}
+
+export interface ITakaroIdentity {
+  id: string;
+  email: string;
+}
+
+class Ory {
+  private log = logger('ory');
+
+  private identityClient: IdentityApi;
+  private frontendClient: FrontendApi;
+
+  constructor() {
+    this.identityClient = new IdentityApi(
+      new Configuration({
+        basePath: config.get('kratos.adminUrl'),
+      }),
+      undefined,
+      createAxiosClient(config.get('kratos.adminUrl')),
+    );
+
+    this.frontendClient = new FrontendApi(
+      new Configuration({
+        basePath: config.get('kratos.publicUrl'),
+      }),
+      undefined,
+      createAxiosClient(config.get('kratos.publicUrl')),
+    );
+  }
+
+  async getIdentity(id: string): Promise<ITakaroIdentity> {
+    const res = await this.identityClient.getIdentity({
+      id,
+    });
+
+    return {
+      id: res.data.id,
+      email: res.data.traits.email,
+    };
+  }
+
+  async getIdentityByEmail(email: string): Promise<ITakaroIdentity | null> {
+    const identity = await this.identityClient.listIdentities({ credentialsIdentifier: email });
+
+    if (!identity.data.length) return null;
+
+    return {
+      id: identity.data[0].id,
+      email: identity.data[0].traits.email,
+    };
+  }
+
+  async createIdentity(email: string, password?: string): Promise<ITakaroIdentity> {
+    const existing = await this.identityClient.listIdentities({ credentialsIdentifier: email });
+
+    if (existing.data.length) {
+      this.log.warn('Identity already exists, returning existing one.', { email });
+      return {
+        id: existing.data[0].id,
+        email: existing.data[0].traits.email,
+      };
+    }
+
+    const body: CreateIdentityBody = {
+      schema_id: IDENTITY_SCHEMA.USER,
+      traits: {
+        email,
+      },
+    };
+
+    if (password) {
+      body.credentials = {
+        password: {
+          config: {
+            password,
+          },
+        },
+      };
+    }
+
+    const res = await this.identityClient.createIdentity({
+      createIdentityBody: body,
+    });
+
+    return {
+      id: res.data.id,
+      email: res.data.traits.email,
+    };
+  }
+
+  async deleteIdentity(id: string): Promise<void> {
+    await this.identityClient.deleteIdentity({
+      id,
+    });
+  }
+
+  async getIdentityFromReq(req: Request): Promise<ITakaroIdentity | null> {
+    const tokenFromAuthHeader = req.headers['authorization']?.replace('Bearer ', '');
+
+    try {
+      const sessionRes = await this.frontendClient.toSession({
+        cookie: req.headers.cookie,
+        xSessionToken: tokenFromAuthHeader,
+      });
+
+      return {
+        id: sessionRes.data.identity!.id,
+        email: sessionRes.data.identity!.traits.email,
+      };
+    } catch (error) {
+      this.log.warn('Could not get identity from request', { error });
+      return null;
+    }
+  }
+
+  async submitApiLogin(username: string, password: string) {
+    const flow = await this.frontendClient.createNativeLoginFlow({
+      refresh: true,
+    });
+    return this.frontendClient.updateLoginFlow({
+      flow: flow.data.id,
+      updateLoginFlowBody: {
+        password,
+        identifier: username,
+        method: 'password',
+      },
+    });
+  }
+
+  async apiLogout(req: Request) {
+    const tokenFromAuthHeader = req.headers['authorization']?.replace('Bearer ', '');
+
+    if (!tokenFromAuthHeader) return true;
+
+    return this.frontendClient.performNativeLogout({
+      performNativeLogoutBody: {
+        session_token: tokenFromAuthHeader,
+      },
+    });
+  }
+
+  async getRecoveryFlow(id: string) {
+    const recoveryRes = await this.identityClient.createRecoveryLinkForIdentity({
+      createRecoveryLinkForIdentityBody: {
+        identity_id: id,
+        expires_in: '24h',
+      },
+    });
+
+    return recoveryRes.data;
+  }
+}
+
+export const ory = new Ory();

package/src/lib/oryAxiosClient.ts

@@ -0,0 +1,37 @@
+import { AxiosError } from 'axios';
+import { addCounterToAxios, errors, logger, createAxios } from '@takaro/util';
+
+export function createAxiosClient(baseURL: string) {
+  const log = logger('ory:http');
+  const client = createAxios(
+    {
+      baseURL,
+      headers: {
+        'Content-Type': 'application/json',
+        'User-Agent': 'Takaro-Agent',
+      },
+    },
+    {
+      logger: log,
+    },
+  );
+
+  addCounterToAxios(client, {
+    name: 'ory_api_requests_total',
+    help: 'Total number of requests to the Ory API',
+  });
+
+  client.interceptors.response.use(
+    (response) => {
+      return response;
+    },
+    (error: AxiosError) => {
+      if (error.response?.status === 409) {
+        return Promise.reject(new errors.ConflictError('User with this identifier already exists'));
+      }
+      return Promise.reject(error);
+    },
+  );
+
+  return client;
+}

package/src/lib/permissions.ts

@@ -0,0 +1,155 @@
+export enum PERMISSIONS {
+  'ROOT' = 'ROOT',
+  'MANAGE_USERS' = 'MANAGE_USERS',
+  'READ_USERS' = 'READ_USERS',
+  'MANAGE_ROLES' = 'MANAGE_ROLES',
+  'READ_ROLES' = 'READ_ROLES',
+  'MANAGE_GAMESERVERS' = 'MANAGE_GAMESERVERS',
+  'READ_MODULES' = 'READ_MODULES',
+  'MANAGE_MODULES' = 'MANAGE_MODULES',
+  'READ_PLAYERS' = 'READ_PLAYERS',
+  'MANAGE_PLAYERS' = 'MANAGE_PLAYERS',
+  'MANAGE_SETTINGS' = 'MANAGE_SETTINGS',
+  'READ_SETTINGS' = 'READ_SETTINGS',
+  'READ_VARIABLES' = 'READ_VARIABLES',
+  'MANAGE_VARIABLES' = 'MANAGE_VARIABLES',
+  'READ_EVENTS' = 'READ_EVENTS',
+  'MANAGE_EVENTS' = 'MANAGE_EVENTS',
+  'READ_ITEMS' = 'READ_ITEMS',
+  'MANAGE_ITEMS' = 'MANAGE_ITEMS',
+  'READ_ENTITIES' = 'READ_ENTITIES',
+  'MANAGE_ENTITIES' = 'MANAGE_ENTITIES',
+  'MANAGE_SHOP_LISTINGS' = 'MANAGE_SHOP_LISTINGS',
+  'MANAGE_SHOP_ORDERS' = 'MANAGE_SHOP_ORDERS',
+  'VIEW_DISCORD_INFO' = 'VIEW_DISCORD_INFO',
+  'SEND_DISCORD_MESSAGE' = 'SEND_DISCORD_MESSAGE',
+}
+
+export interface IPermissionDetails {
+  permission: string;
+  friendlyName: string;
+  description: string;
+}
+
+export const PERMISSION_DETAILS: Record<PERMISSIONS, IPermissionDetails> = {
+  [PERMISSIONS.ROOT]: {
+    permission: PERMISSIONS.ROOT,
+    friendlyName: 'Root Access',
+    description: 'Full access to all systems and resources',
+  },
+  [PERMISSIONS.MANAGE_USERS]: {
+    permission: PERMISSIONS.MANAGE_USERS,
+    friendlyName: 'Manage Users',
+    description: 'Can create, update, and delete users',
+  },
+  [PERMISSIONS.READ_USERS]: {
+    permission: PERMISSIONS.READ_USERS,
+    friendlyName: 'Read Users',
+    description: 'Can view user details',
+  },
+  [PERMISSIONS.MANAGE_ROLES]: {
+    permission: PERMISSIONS.MANAGE_ROLES,
+    friendlyName: 'Manage Roles',
+    description: 'Can create, update, and delete roles',
+  },
+  [PERMISSIONS.READ_ROLES]: {
+    permission: PERMISSIONS.READ_ROLES,
+    friendlyName: 'Read Roles',
+    description: 'Can view role details',
+  },
+  [PERMISSIONS.MANAGE_GAMESERVERS]: {
+    permission: PERMISSIONS.MANAGE_GAMESERVERS,
+    friendlyName: 'Manage Game Servers',
+    description: 'Can create, update, and delete game servers',
+  },
+  [PERMISSIONS.READ_MODULES]: {
+    permission: PERMISSIONS.READ_MODULES,
+    friendlyName: 'Read Modules',
+    description: 'Can view module details',
+  },
+  [PERMISSIONS.MANAGE_MODULES]: {
+    permission: PERMISSIONS.MANAGE_MODULES,
+    friendlyName: 'Manage Modules',
+    description: 'Can create, update, and delete modules',
+  },
+  [PERMISSIONS.READ_PLAYERS]: {
+    permission: PERMISSIONS.READ_PLAYERS,
+    friendlyName: 'Read Players',
+    description: 'Can view player details',
+  },
+  [PERMISSIONS.MANAGE_PLAYERS]: {
+    permission: PERMISSIONS.MANAGE_PLAYERS,
+    friendlyName: 'Manage Players',
+    description: 'Can create, update, and delete players',
+  },
+  [PERMISSIONS.MANAGE_SETTINGS]: {
+    permission: PERMISSIONS.MANAGE_SETTINGS,
+    friendlyName: 'Manage Settings',
+    description: 'Can modify settings',
+  },
+  [PERMISSIONS.READ_SETTINGS]: {
+    permission: PERMISSIONS.READ_SETTINGS,
+    friendlyName: 'Read Settings',
+    description: 'Can view settings',
+  },
+  [PERMISSIONS.READ_VARIABLES]: {
+    permission: PERMISSIONS.READ_VARIABLES,
+    friendlyName: 'Read Variables',
+    description: 'Can view variables',
+  },
+  [PERMISSIONS.MANAGE_VARIABLES]: {
+    permission: PERMISSIONS.MANAGE_VARIABLES,
+    friendlyName: 'Manage Variables',
+    description: 'Can create, update, and delete variables',
+  },
+  [PERMISSIONS.READ_EVENTS]: {
+    permission: PERMISSIONS.READ_EVENTS,
+    friendlyName: 'Read Events',
+    description: 'Can view event details',
+  },
+  [PERMISSIONS.MANAGE_EVENTS]: {
+    permission: PERMISSIONS.MANAGE_EVENTS,
+    friendlyName: 'Manage Events',
+    description: 'Can create, update, and delete events',
+  },
+  [PERMISSIONS.READ_ITEMS]: {
+    permission: PERMISSIONS.READ_ITEMS,
+    friendlyName: 'Read Items',
+    description: 'Can view item details',
+  },
+  [PERMISSIONS.MANAGE_ITEMS]: {
+    permission: PERMISSIONS.MANAGE_ITEMS,
+    friendlyName: 'Manage Items',
+    description: 'Can create, update, and delete items',
+  },
+  [PERMISSIONS.READ_ENTITIES]: {
+    permission: PERMISSIONS.READ_ENTITIES,
+    friendlyName: 'Read Entities',
+    description: 'Can view entity details',
+  },
+  [PERMISSIONS.MANAGE_ENTITIES]: {
+    permission: PERMISSIONS.MANAGE_ENTITIES,
+    friendlyName: 'Manage Entities',
+    description: 'Can create, update, and delete entities',
+  },
+  [PERMISSIONS.MANAGE_SHOP_LISTINGS]: {
+    permission: PERMISSIONS.MANAGE_SHOP_LISTINGS,
+    friendlyName: 'Manage Shop Listings',
+    description: 'Can create, update, and delete shop listings',
+  },
+  [PERMISSIONS.MANAGE_SHOP_ORDERS]: {
+    permission: PERMISSIONS.MANAGE_SHOP_ORDERS,
+    friendlyName: 'Manage Shop Orders',
+    description: 'Can view orders not belonging to the themself and perform administrative actions on them',
+  },
+  [PERMISSIONS.VIEW_DISCORD_INFO]: {
+    permission: PERMISSIONS.VIEW_DISCORD_INFO,
+    friendlyName: 'View Discord Info',
+    description: 'Can view Discord guild information including channels and roles',
+  },
+  [PERMISSIONS.SEND_DISCORD_MESSAGE]: {
+    permission: PERMISSIONS.SEND_DISCORD_MESSAGE,
+    friendlyName: 'Send Discord Messages',
+    description: 'Can send messages to Discord channels',
+  },
+};

package/src/main.ts

@@ -0,0 +1,4 @@
+export { IAuthConfig, configSchema as authConfigSchema } from './config.js';
+
+export { ory } from './lib/ory.js';
+export * from './lib/permissions.js';

package/tsconfig.build.json

@@ -0,0 +1,14 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "./src",
+    "outDir": "./dist"
+  },
+  "include": ["./src/**/*.ts"],
+  "exclude": ["./src/**/*.test.ts"],
+  "references": [
+    { "path": "../lib-config/tsconfig.build.json" },
+    { "path": "../lib-util/tsconfig.build.json" }
+  ]
+}

package/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "dist"
+  },
+  "include": ["src/**/*"]
+}

package/typedoc.json

@@ -0,0 +1,3 @@
+{
+  "entryPoints": ["src/main.ts"]
+}