@technomoron/api-server-base 2.0.0-beta.14 → 2.0.0-beta.16

package/README.txt

@@ -141,6 +141,22 @@ Use your storage adapter's filterUser helper to trim sensitive data before retur
 Provide your own authorize method to enforce role based access control using the ApiAuthClass enum.
 Create feature modules by extending ApiModule. Use the optional checkConfig hook to validate prerequisites before routes mount.
 
+Sequelize Table Prefixes
+------------------------
+Sequelize-backed stores accept `tablePrefix` to prepend to the built-in table names (`users`, `jwttokens`, `passkey_credentials`, `passkey_challenges`, `oauth_clients`, `oauth_codes`).
+
+SqlAuthStore supports both a global prefix (`tablePrefix`) and per-module overrides (`tablePrefixes.user|token|passkey|oauth`). When present, `tokenStoreOptions.tablePrefix` and `oauthStoreOptions.tablePrefix` take precedence.
+
+Example:
+
+	const store = new SqlAuthStore({
+		sequelize,
+		tablePrefix: 'myapp_'
+	});
+	// Creates tables like myapp_users, myapp_jwttokens, myapp_oauth_clients, ...
+
+If you need a different base name (for example `myapp_tokens` instead of `myapp_jwttokens`), pass a custom model or model factory to the store and set the `tableName` yourself.
+
 Custom Express Endpoints
 ------------------------
 ApiModule routes run inside the tuple wrapper (always responding with a standardized JSON envelope). For endpoints that need raw Express control (streaming, webhooks, tus uploads, etc.), mount your own handlers directly.

package/dist/cjs/api-module.d.ts

@@ -1,5 +1,6 @@
 import type { ApiRequest } from './api-server-base.js';
-export type ApiHandler = (apiReq: ApiRequest) => Promise<[number] | [number, any] | [number, any, string]>;
+export type ApiHandlerResult<Data = unknown> = [number] | [number, Data] | [number, Data, string];
+export type ApiHandler<Data = unknown> = (apiReq: ApiRequest) => Promise<ApiHandlerResult<Data>>;
 export type ApiAuthType = 'none' | 'maybe' | 'yes' | 'strict' | 'apikey';
 export type ApiAuthClass = 'any' | 'admin';
 export interface ApiKey {
@@ -14,7 +15,7 @@ export type ApiRoute = {
         req: ApiAuthClass;
     };
 };
-export declare class ApiModule<T> {
+export declare class ApiModule<T = unknown> {
     server: T;
     namespace: string;
     mountpath: string;

package/dist/cjs/api-server-base.cjs

@@ -49,11 +49,14 @@ function guess_exception_text(error, defMsg = 'Unknown Error') {
         msg.push(error);
     }
     else if (error && typeof error === 'object') {
-        if (typeof error.message === 'string' && error.message.trim() !== '') {
-            msg.push(error.message);
+        const errorDetails = error;
+        if (typeof errorDetails.message === 'string' && errorDetails.message.trim() !== '') {
+            msg.push(errorDetails.message);
         }
-        if (error.parent && typeof error.parent.message === 'string' && error.parent.message.trim() !== '') {
-            msg.push(error.parent.message);
+        if (errorDetails.parent &&
+            typeof errorDetails.parent.message === 'string' &&
+            errorDetails.parent.message.trim() !== '') {
+            msg.push(errorDetails.parent.message);
         }
     }
     return msg.length > 0 ? msg.join(' / ') : defMsg;
@@ -367,6 +370,7 @@ function fillConfig(config) {
 class ApiServer {
     constructor(config = {}) {
         this.currReq = null;
+        this.serverAuthAdapter = null;
         this.apiNotFoundHandler = null;
         this.tokenStoreAdapter = null;
         this.userStoreAdapter = null;
@@ -387,7 +391,7 @@ class ApiServer {
             this.passkeyServiceAdapter = passkeyService ?? null;
             this.oauthStoreAdapter = oauthStore ?? null;
             this.canImpersonateAdapter = canImpersonate ?? null;
-            this.storageAdapter = this;
+            this.storageAdapter = this.getServerAuthAdapter();
         }
         this.app = (0, express_1.default)();
         if (config.uploadPath) {
@@ -428,9 +432,9 @@ class ApiServer {
     }
     setTokenStore(store) {
         this.tokenStoreAdapter = store;
-        // If using direct stores, expose self as the auth storage.
+        // If using direct stores, expose the server-backed auth adapter.
         if (this.userStoreAdapter) {
-            this.storageAdapter = this;
+            this.storageAdapter = this.getServerAuthAdapter();
         }
         return this;
     }
@@ -467,6 +471,33 @@ class ApiServer {
         }
         return this.oauthStoreAdapter;
     }
+    getServerAuthAdapter() {
+        if (this.serverAuthAdapter) {
+            return this.serverAuthAdapter;
+        }
+        const server = this;
+        this.serverAuthAdapter = {
+            getUser: (identifier) => server.getUser(identifier),
+            getUserPasswordHash: (user) => server.getUserPasswordHash(user),
+            getUserId: (user) => server.getUserId(user),
+            filterUser: (user) => server.filterUser(user),
+            verifyPassword: (password, hash) => server.verifyPassword(password, hash),
+            storeToken: (data) => server.storeToken(data),
+            getToken: (query, opts) => server.getToken(query, opts),
+            deleteToken: (query) => server.deleteToken(query),
+            updateToken: (updates) => server.updateToken(updates),
+            createPasskeyChallenge: (params) => server.createPasskeyChallenge(params),
+            verifyPasskeyResponse: (params) => server.verifyPasskeyResponse(params),
+            listUserCredentials: (userId) => server.listUserCredentials(userId),
+            deletePasskeyCredential: (credentialId) => server.deletePasskeyCredential(credentialId),
+            getClient: (clientId) => server.getClient(clientId),
+            verifyClientSecret: (client, clientSecret) => server.verifyClientSecret(client, clientSecret),
+            createAuthCode: (request) => server.createAuthCode(request),
+            consumeAuthCode: (code, clientId) => server.consumeAuthCode(code, clientId),
+            canImpersonate: (params) => server.canImpersonate(params)
+        };
+        return this.serverAuthAdapter;
+    }
     // AuthAdapter-compatible helpers (used by AuthModule)
     async getUser(identifier) {
         return this.userStoreAdapter ? this.userStoreAdapter.findUser(identifier) : null;
@@ -487,8 +518,9 @@ class ApiServer {
         if (this.tokenStoreAdapter) {
             return this.tokenStoreAdapter.save(data);
         }
-        if (typeof this.storageAdapter.storeToken === 'function') {
-            return this.storageAdapter.storeToken(data);
+        const storage = this.storageAdapter;
+        if (typeof storage.storeToken === 'function') {
+            return storage.storeToken(data);
         }
         throw new Error('Token store is not configured');
     }
@@ -501,8 +533,9 @@ class ApiServer {
         if (this.tokenStoreAdapter) {
             return this.tokenStoreAdapter.get(normalized, opts);
         }
-        if (typeof this.storageAdapter.getToken === 'function') {
-            return this.storageAdapter.getToken(normalized, opts);
+        const storage = this.storageAdapter;
+        if (typeof storage.getToken === 'function') {
+            return storage.getToken(normalized, opts);
         }
         return null;
     }
@@ -515,8 +548,9 @@ class ApiServer {
         if (this.tokenStoreAdapter) {
             return this.tokenStoreAdapter.delete(normalized);
         }
-        if (typeof this.storageAdapter.deleteToken === 'function') {
-            return this.storageAdapter.deleteToken(normalized);
+        const storage = this.storageAdapter;
+        if (typeof storage.deleteToken === 'function') {
+            return storage.deleteToken(normalized);
         }
         return 0;
     }
@@ -589,8 +623,9 @@ class ApiServer {
         if (this.tokenStoreAdapter) {
             return this.tokenStoreAdapter.update(updates);
         }
-        if (typeof this.storageAdapter.updateToken === 'function') {
-            return this.storageAdapter.updateToken(updates);
+        const storage = this.storageAdapter;
+        if (typeof storage.updateToken === 'function') {
+            return storage.updateToken(updates);
         }
         return false;
     }
@@ -723,7 +758,7 @@ class ApiServer {
         if (!this.apiNotFoundHandler) {
             return;
         }
-        const stack = this.app?._router?.stack;
+        const stack = this.app._router?.stack;
         if (!stack) {
             return;
         }
@@ -1216,7 +1251,8 @@ class ApiServer {
     api(module) {
         const router = express_1.default.Router();
         module.server = this;
-        if (module?.moduleType === 'auth') {
+        const moduleType = module.moduleType;
+        if (moduleType === 'auth') {
             this.authModule(module);
         }
         module.checkConfig();
@@ -1226,7 +1262,20 @@ class ApiServer {
         module.mountpath = mountPath;
         module.defineRoutes().forEach((r) => {
             const handler = this.handle_request(r.handler, r.auth);
-            router[r.method](r.path, handler);
+            switch (r.method) {
+                case 'get':
+                    router.get(r.path, handler);
+                    break;
+                case 'post':
+                    router.post(r.path, handler);
+                    break;
+                case 'put':
+                    router.put(r.path, handler);
+                    break;
+                case 'delete':
+                    router.delete(r.path, handler);
+                    break;
+            }
             if (this.config.debug) {
                 console.log(`Adding ${mountPath}${r.path} (${r.method.toUpperCase()})`);
             }

package/dist/cjs/api-server-base.d.ts

@@ -6,7 +6,7 @@
  */
 import { Application, Request, Response, type ErrorRequestHandler, type RequestHandler } from 'express';
 import { ApiModule } from './api-module.js';
-import { TokenStore, type JwtDecodeResult, type JwtSignResult, type JwtVerifyResult } from './token/base.js';
+import { TokenStore, type JwtDecodeResult, type JwtSignPayload, type JwtSignResult, type JwtVerifyResult } from './token/base.js';
 import type { ApiAuthClass, ApiAuthType, ApiKey } from './api-module.js';
 import type { AuthProviderModule } from './auth-api/module.js';
 import type { AuthAdapter, AuthIdentifier } from './auth-api/types.js';
@@ -32,7 +32,7 @@ export interface ApiTokenData extends JwtPayload, Partial<Token> {
     exp?: number;
 }
 export interface ApiRequest {
-    server: any;
+    server: ApiServer;
     req: ExtendedReq;
     res: Response;
     tokenData?: ApiTokenData | null;
@@ -64,7 +64,7 @@ export interface ClientInfo extends ClientAgentProfile {
     ipchain: string[];
 }
 export interface ApiServerAuthStores {
-    userStore: UserStore<any, any>;
+    userStore: UserStore<unknown, unknown>;
     tokenStore: TokenStore;
     passkeyService?: PasskeyService;
     oauthStore?: OAuthStore;
@@ -77,13 +77,13 @@ export { ApiModule } from './api-module.js';
 export type { ApiHandler, ApiAuthType, ApiAuthClass, ApiRoute, ApiKey } from './api-module.js';
 export interface ApiErrorParams {
     code?: number;
-    message?: any;
-    data?: any;
+    message?: unknown;
+    data?: unknown;
     errors?: Record<string, string>;
 }
 export declare class ApiError extends Error {
     code: number;
-    data: any;
+    data: unknown;
     errors: Record<string, string>;
     constructor({ code, message, data, errors }: ApiErrorParams);
 }
@@ -123,6 +123,7 @@ export declare class ApiServer {
     private readonly apiBasePath;
     private storageAdapter;
     private moduleAdapter;
+    private serverAuthAdapter;
     private apiNotFoundHandler;
     private tokenStoreAdapter;
     private userStoreAdapter;
@@ -141,8 +142,8 @@ export declare class ApiServer {
      * @deprecated Use {@link ApiServer.authModule} instead.
      */
     useAuthModule<UserRow>(module: AuthProviderModule<UserRow>): this;
-    getAuthStorage(): AuthAdapter<any, any>;
-    getAuthModule(): AuthProviderModule<any>;
+    getAuthStorage<UserRow = unknown, SafeUser = unknown>(): AuthAdapter<UserRow, SafeUser>;
+    getAuthModule<UserRow = unknown>(): AuthProviderModule<UserRow>;
     setTokenStore(store: TokenStore): this;
     getTokenStore(): TokenStore | null;
     private ensureUserStore;
@@ -151,10 +152,11 @@ export declare class ApiServer {
     listUserCredentials(userId: AuthIdentifier): Promise<StoredPasskeyCredential[]>;
     deletePasskeyCredential(credentialId: Buffer | string): Promise<boolean>;
     private ensureOAuthStore;
-    getUser(identifier: AuthIdentifier): Promise<any | null>;
-    getUserPasswordHash(user: any): string;
-    getUserId(user: any): AuthIdentifier;
-    filterUser(user: any): any;
+    private getServerAuthAdapter;
+    getUser(identifier: AuthIdentifier): Promise<unknown | null>;
+    getUserPasswordHash(user: unknown): string;
+    getUserId(user: unknown): AuthIdentifier;
+    filterUser(user: unknown): unknown;
     verifyPassword(password: string, hash: string): Promise<boolean>;
     storeToken(data: Token): Promise<void>;
     getToken(query: Partial<Token> & {
@@ -177,7 +179,7 @@ export declare class ApiServer {
         realUserId: AuthIdentifier;
         effectiveUserId: AuthIdentifier;
     }): Promise<boolean>;
-    jwtSign(payload: any, secret: string, expiresInSeconds: number, options?: SignOptions): JwtSignResult;
+    jwtSign(payload: JwtSignPayload, secret: string, expiresInSeconds: number, options?: SignOptions): JwtSignResult;
     jwtVerify<T>(token: string, secret: string, options?: VerifyOptions): JwtVerifyResult<T>;
     jwtDecode<T>(token: string, options?: import('jsonwebtoken').DecodeOptions): JwtDecodeResult<T>;
     getApiKey<T = ApiKey>(token: string): Promise<T | null>;
@@ -188,7 +190,7 @@ export declare class ApiServer {
     updateToken(updates: Partial<Token> & {
         refreshToken: string;
     }): Promise<boolean>;
-    guessExceptionText(error: any, defMsg?: string): string;
+    guessExceptionText(error: unknown, defMsg?: string): string;
     protected authorize(apiReq: ApiRequest, requiredClass: ApiAuthClass): Promise<void>;
     private middlewares;
     private installPingHandler;
@@ -220,7 +222,7 @@ export declare class ApiServer {
     }): RequestHandler;
     expressErrorHandler(): ErrorRequestHandler;
     private handle_request;
-    api<T extends ApiModule<any>>(module: T): this;
+    api<T extends ApiModule<unknown>>(module: T): this;
     dumpRequest(apiReq: ApiRequest): void;
     private formatDebugValue;
     dumpResponse(apiReq: ApiRequest, payload: unknown, status: number): void;

package/dist/cjs/auth-api/auth-module.js

@@ -1052,26 +1052,26 @@ class AuthModule extends module_js_1.BaseAuthModule {
         throw new api_server_base_js_1.ApiError({ code: 401, message: 'Authorization requires user authentication' });
     }
     hasPasskeyService() {
-        const storageAny = this.storage;
-        if (storageAny.passkeyService || storageAny.passkeyStore) {
+        const storageHints = this.storage;
+        if (storageHints.passkeyService || storageHints.passkeyStore) {
             return true;
         }
-        if (storageAny.adapter?.passkeyService || storageAny.adapter?.passkeyStore) {
+        if (storageHints.adapter?.passkeyService || storageHints.adapter?.passkeyStore) {
             return true;
         }
-        const serverAny = this.server;
-        return !!serverAny.passkeyServiceAdapter;
+        const serverHints = this.server;
+        return !!serverHints.passkeyServiceAdapter;
     }
     hasOAuthStore() {
-        const storageAny = this.storage;
-        if (storageAny.oauthStore) {
+        const storageHints = this.storage;
+        if (storageHints.oauthStore) {
             return true;
         }
-        if (storageAny.adapter?.oauthStore) {
+        if (storageHints.adapter?.oauthStore) {
             return true;
         }
-        const serverAny = this.server;
-        return !!serverAny.oauthStoreAdapter;
+        const serverHints = this.server;
+        return !!serverHints.oauthStoreAdapter;
     }
     storageImplements(key) {
         const candidate = this.storage[key];

package/dist/cjs/auth-api/module.d.ts

@@ -8,7 +8,7 @@ export interface AuthProviderModule<UserRow = unknown> {
         expires?: Date;
     }): Promise<TokenPair>;
 }
-export declare abstract class BaseAuthModule<UserRow = unknown> extends ApiModule<any> implements AuthProviderModule<UserRow> {
+export declare abstract class BaseAuthModule<UserRow = unknown> extends ApiModule implements AuthProviderModule<UserRow> {
     readonly moduleType: "auth";
     protected constructor(opts: {
         namespace: string;

package/dist/cjs/auth-api/sql-auth-store.d.ts

@@ -11,13 +11,23 @@ import type { Token } from '../token/types.js';
 interface PasskeyOptions extends Partial<PasskeyServiceConfig> {
     enabled?: boolean;
 }
+export interface SqlAuthStoreTablePrefixes {
+    user?: string;
+    token?: string;
+    passkey?: string;
+    oauth?: string;
+}
 export interface SqlAuthStoreParams<UserAttributes extends AuthUserAttributes = AuthUserAttributes, PublicUserShape extends Omit<UserAttributes, 'password'> = Omit<UserAttributes, 'password'>> {
     sequelize: Sequelize;
     syncOptions?: SyncOptions;
     bcryptRounds?: number;
     passwordPepper?: string;
+    tablePrefix?: string;
+    tablePrefixes?: SqlAuthStoreTablePrefixes;
     userModel?: GenericUserModelStatic;
-    userModelFactory?: (sequelize: Sequelize) => GenericUserModelStatic;
+    userModelFactory?: (sequelize: Sequelize, options?: {
+        tablePrefix?: string;
+    }) => GenericUserModelStatic;
     userRecordMapper?: (model: GenericUserModel) => UserAttributes;
     publicUserMapper?: (user: UserAttributes) => PublicUserShape;
     passkeyUserMapper?: (user: UserAttributes) => PasskeyUserDescriptor;

package/dist/cjs/auth-api/sql-auth-store.js

@@ -13,6 +13,22 @@ const DEFAULT_PASSKEY_CONFIG = {
     timeoutMs: 5 * 60 * 1000,
     userVerification: 'preferred'
 };
+function normalizeTablePrefix(prefix) {
+    if (!prefix) {
+        return undefined;
+    }
+    const trimmed = prefix.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function resolveTablePrefix(...prefixes) {
+    for (const prefix of prefixes) {
+        const normalized = normalizeTablePrefix(prefix);
+        if (normalized) {
+            return normalized;
+        }
+    }
+    return undefined;
+}
 function isOriginString(origin) {
     return typeof origin === 'string' && origin.trim().length > 0;
 }
@@ -36,6 +52,8 @@ class SqlAuthStore {
         }
         this.sequelize = params.sequelize;
         this.syncOptions = params.syncOptions;
+        const moduleTablePrefixes = params.tablePrefixes ?? {};
+        const userTablePrefix = resolveTablePrefix(moduleTablePrefixes.user, params.tablePrefix);
         this.userStore = new sequelize_js_4.SequelizeUserStore({
             sequelize: this.sequelize,
             userModel: params.userModel,
@@ -43,18 +61,28 @@ class SqlAuthStore {
             recordMapper: params.userRecordMapper,
             toPublic: params.publicUserMapper,
             bcryptRounds: params.bcryptRounds,
-            bcryptPepper: params.passwordPepper
+            bcryptPepper: params.passwordPepper,
+            tablePrefix: userTablePrefix
         });
+        const tokenTablePrefix = resolveTablePrefix(params.tokenStoreOptions?.tablePrefix, moduleTablePrefixes.token, params.tablePrefix);
         this.tokenStore =
-            params.tokenStore ?? new sequelize_js_3.SequelizeTokenStore({ sequelize: this.sequelize, ...params.tokenStoreOptions });
+            params.tokenStore ??
+                new sequelize_js_3.SequelizeTokenStore({
+                    sequelize: this.sequelize,
+                    ...params.tokenStoreOptions,
+                    tablePrefix: tokenTablePrefix
+                });
+        const oauthTablePrefix = resolveTablePrefix(params.oauthStoreOptions?.tablePrefix, moduleTablePrefixes.oauth, params.tablePrefix);
         this.oauthStore = new sequelize_js_1.SequelizeOAuthStore({
             sequelize: this.sequelize,
             ...params.oauthStoreOptions,
+            tablePrefix: oauthTablePrefix,
             bcryptRounds: params.bcryptRounds
         });
         let passkeyStore;
         let passkeyConfig;
         if (params.passkeys !== false) {
+            const passkeyTablePrefix = resolveTablePrefix(moduleTablePrefixes.passkey, params.tablePrefix);
             passkeyConfig = normalizePasskeyConfig(params.passkeys ?? {});
             const resolveUser = async (lookup) => {
                 const found = await this.userStore.findUser(lookup.userId ?? lookup.login ?? '');
@@ -69,7 +97,11 @@ class SqlAuthStore {
                     }));
                 return mapper(found);
             };
-            passkeyStore = new sequelize_js_2.SequelizePasskeyStore({ sequelize: this.sequelize, resolveUser });
+            passkeyStore = new sequelize_js_2.SequelizePasskeyStore({
+                sequelize: this.sequelize,
+                resolveUser,
+                tablePrefix: passkeyTablePrefix
+            });
             this.passkeyStore = passkeyStore;
         }
         this.adapter = new compat_auth_storage_js_1.CompositeAuthAdapter({

package/dist/cjs/oauth/models.d.ts

@@ -18,7 +18,9 @@ export declare class OAuthClientModel extends Model<OAuthClientAttributes, OAuth
     metadata: string | null;
     first_party: boolean;
 }
-export declare function initOAuthClientModel(sequelize: Sequelize): typeof OAuthClientModel;
+export declare function initOAuthClientModel(sequelize: Sequelize, options?: {
+    tablePrefix?: string;
+}): typeof OAuthClientModel;
 export interface OAuthCodeAttributes {
     code: string;
     client_id: string;
@@ -42,4 +44,6 @@ export declare class OAuthCodeModel extends Model<OAuthCodeAttributes, OAuthCode
     expires: Date;
     metadata: string | null;
 }
-export declare function initOAuthCodeModel(sequelize: Sequelize): typeof OAuthCodeModel;
+export declare function initOAuthCodeModel(sequelize: Sequelize, options?: {
+    tablePrefix?: string;
+}): typeof OAuthCodeModel;

package/dist/cjs/oauth/models.js

@@ -5,11 +5,22 @@ exports.initOAuthClientModel = initOAuthClientModel;
 exports.initOAuthCodeModel = initOAuthCodeModel;
 const sequelize_1 = require("sequelize");
 const DIALECTS_SUPPORTING_UNSIGNED = new Set(['mysql', 'mariadb']);
+function normalizeTablePrefix(prefix) {
+    if (!prefix) {
+        return undefined;
+    }
+    const trimmed = prefix.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function applyTablePrefix(prefix, tableName) {
+    const normalized = normalizeTablePrefix(prefix);
+    return normalized ? `${normalized}${tableName}` : tableName;
+}
 function integerIdType(sequelize) {
     return DIALECTS_SUPPORTING_UNSIGNED.has(sequelize.getDialect()) ? sequelize_1.DataTypes.INTEGER.UNSIGNED : sequelize_1.DataTypes.INTEGER;
 }
-function tableOptions(sequelize, tableName, extra) {
-    const opts = { sequelize, tableName };
+function tableOptions(sequelize, tableName, tablePrefix, extra) {
+    const opts = { sequelize, tableName: applyTablePrefix(tablePrefix, tableName) };
     if (extra) {
         Object.assign(opts, extra);
     }
@@ -22,7 +33,7 @@ function tableOptions(sequelize, tableName, extra) {
 class OAuthClientModel extends sequelize_1.Model {
 }
 exports.OAuthClientModel = OAuthClientModel;
-function initOAuthClientModel(sequelize) {
+function initOAuthClientModel(sequelize, options = {}) {
     OAuthClientModel.init({
         client_id: { type: sequelize_1.DataTypes.STRING(128), allowNull: false, primaryKey: true },
         client_secret: { type: sequelize_1.DataTypes.STRING(255), allowNull: false, defaultValue: '' },
@@ -32,14 +43,14 @@ function initOAuthClientModel(sequelize) {
         metadata: { type: sequelize_1.DataTypes.TEXT, allowNull: true, defaultValue: null },
         first_party: { type: sequelize_1.DataTypes.BOOLEAN, allowNull: false, defaultValue: false }
     }, {
-        ...tableOptions(sequelize, 'oauth_clients', { timestamps: false })
+        ...tableOptions(sequelize, 'oauth_clients', options.tablePrefix, { timestamps: false })
     });
     return OAuthClientModel;
 }
 class OAuthCodeModel extends sequelize_1.Model {
 }
 exports.OAuthCodeModel = OAuthCodeModel;
-function initOAuthCodeModel(sequelize) {
+function initOAuthCodeModel(sequelize, options = {}) {
     const idType = integerIdType(sequelize);
     OAuthCodeModel.init({
         code: { type: sequelize_1.DataTypes.STRING(128), allowNull: false, primaryKey: true },
@@ -52,7 +63,7 @@ function initOAuthCodeModel(sequelize) {
         expires: { type: sequelize_1.DataTypes.DATE, allowNull: false },
         metadata: { type: sequelize_1.DataTypes.TEXT, allowNull: true, defaultValue: null }
     }, {
-        ...tableOptions(sequelize, 'oauth_codes', { timestamps: false })
+        ...tableOptions(sequelize, 'oauth_codes', options.tablePrefix, { timestamps: false })
     });
     return OAuthCodeModel;
 }

package/dist/cjs/oauth/sequelize.d.ts

@@ -19,7 +19,9 @@ export declare class OAuthClientModel extends Model<OAuthClientAttributes, OAuth
     metadata: string | null;
     first_party: boolean;
 }
-export declare function initOAuthClientModel(sequelize: Sequelize): typeof OAuthClientModel;
+export declare function initOAuthClientModel(sequelize: Sequelize, options?: {
+    tablePrefix?: string;
+}): typeof OAuthClientModel;
 export interface OAuthCodeAttributes {
     code: string;
     client_id: string;
@@ -43,13 +45,20 @@ export declare class OAuthCodeModel extends Model<OAuthCodeAttributes, OAuthCode
     expires: Date;
     metadata: string | null;
 }
-export declare function initOAuthCodeModel(sequelize: Sequelize): typeof OAuthCodeModel;
+export declare function initOAuthCodeModel(sequelize: Sequelize, options?: {
+    tablePrefix?: string;
+}): typeof OAuthCodeModel;
 export interface SequelizeOAuthStoreOptions {
     sequelize: Sequelize;
+    tablePrefix?: string;
     clientModel?: typeof OAuthClientModel;
     codeModel?: typeof OAuthCodeModel;
-    clientModelFactory?: (sequelize: Sequelize) => typeof OAuthClientModel;
-    codeModelFactory?: (sequelize: Sequelize) => typeof OAuthCodeModel;
+    clientModelFactory?: (sequelize: Sequelize, options?: {
+        tablePrefix?: string;
+    }) => typeof OAuthClientModel;
+    codeModelFactory?: (sequelize: Sequelize, options?: {
+        tablePrefix?: string;
+    }) => typeof OAuthCodeModel;
     bcryptRounds?: number;
 }
 export declare class SequelizeOAuthStore extends OAuthStore {

package/dist/cjs/oauth/sequelize.js

@@ -10,11 +10,22 @@ const bcryptjs_1 = __importDefault(require("bcryptjs"));
 const sequelize_1 = require("sequelize");
 const base_js_1 = require("./base.js");
 const DIALECTS_SUPPORTING_UNSIGNED = new Set(['mysql', 'mariadb']);
+function normalizeTablePrefix(prefix) {
+    if (!prefix) {
+        return undefined;
+    }
+    const trimmed = prefix.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function applyTablePrefix(prefix, tableName) {
+    const normalized = normalizeTablePrefix(prefix);
+    return normalized ? `${normalized}${tableName}` : tableName;
+}
 function integerIdType(sequelize) {
     return DIALECTS_SUPPORTING_UNSIGNED.has(sequelize.getDialect()) ? sequelize_1.DataTypes.INTEGER.UNSIGNED : sequelize_1.DataTypes.INTEGER;
 }
-function tableOptions(sequelize, tableName, extra) {
-    const opts = { sequelize, tableName };
+function tableOptions(sequelize, tableName, tablePrefix, extra) {
+    const opts = { sequelize, tableName: applyTablePrefix(tablePrefix, tableName) };
     if (extra) {
         Object.assign(opts, extra);
     }
@@ -27,7 +38,7 @@ function tableOptions(sequelize, tableName, extra) {
 class OAuthClientModel extends sequelize_1.Model {
 }
 exports.OAuthClientModel = OAuthClientModel;
-function initOAuthClientModel(sequelize) {
+function initOAuthClientModel(sequelize, options = {}) {
     OAuthClientModel.init({
         client_id: { type: sequelize_1.DataTypes.STRING(128), allowNull: false, primaryKey: true },
         client_secret: { type: sequelize_1.DataTypes.STRING(255), allowNull: false, defaultValue: '' },
@@ -36,13 +47,13 @@ function initOAuthClientModel(sequelize) {
         scope: { type: sequelize_1.DataTypes.TEXT, allowNull: false, defaultValue: '[]' },
         metadata: { type: sequelize_1.DataTypes.TEXT, allowNull: true, defaultValue: null },
         first_party: { type: sequelize_1.DataTypes.BOOLEAN, allowNull: false, defaultValue: false }
-    }, tableOptions(sequelize, 'oauth_clients', { timestamps: false }));
+    }, tableOptions(sequelize, 'oauth_clients', options.tablePrefix, { timestamps: false }));
     return OAuthClientModel;
 }
 class OAuthCodeModel extends sequelize_1.Model {
 }
 exports.OAuthCodeModel = OAuthCodeModel;
-function initOAuthCodeModel(sequelize) {
+function initOAuthCodeModel(sequelize, options = {}) {
     const idType = integerIdType(sequelize);
     OAuthCodeModel.init({
         code: { type: sequelize_1.DataTypes.STRING(128), allowNull: false, primaryKey: true },
@@ -54,7 +65,7 @@ function initOAuthCodeModel(sequelize) {
         code_challenge_method: { type: sequelize_1.DataTypes.STRING(10), allowNull: true, defaultValue: null },
         expires: { type: sequelize_1.DataTypes.DATE, allowNull: false },
         metadata: { type: sequelize_1.DataTypes.TEXT, allowNull: true, defaultValue: null }
-    }, tableOptions(sequelize, 'oauth_codes', { timestamps: false }));
+    }, tableOptions(sequelize, 'oauth_codes', options.tablePrefix, { timestamps: false }));
     return OAuthCodeModel;
 }
 function encodeStringArray(values) {
@@ -114,8 +125,16 @@ class SequelizeOAuthStore extends base_js_1.OAuthStore {
         if (!options?.sequelize) {
             throw new Error('SequelizeOAuthStore requires an initialised Sequelize instance');
         }
-        this.clients = options.clientModel ?? (options.clientModelFactory ?? initOAuthClientModel)(options.sequelize);
-        this.codes = options.codeModel ?? (options.codeModelFactory ?? initOAuthCodeModel)(options.sequelize);
+        this.clients =
+            options.clientModel ??
+                (options.clientModelFactory ?? initOAuthClientModel)(options.sequelize, {
+                    tablePrefix: options.tablePrefix
+                });
+        this.codes =
+            options.codeModel ??
+                (options.codeModelFactory ?? initOAuthCodeModel)(options.sequelize, {
+                    tablePrefix: options.tablePrefix
+                });
         this.bcryptRounds = options.bcryptRounds ?? 12;
     }
     async getClient(clientId) {