@technomoron/api-server-base 2.0.0-beta.19 → 2.0.0-beta.20

package/dist/esm/passkey/sequelize.js

@@ -1,149 +1,10 @@
-import { DataTypes, Model, Op } from 'sequelize';
+import { Op, Transaction } from 'sequelize';
 import { normalizeNumericUserId } from '../auth-api/user-id.js';
-import { DIALECTS_SUPPORTING_UNSIGNED, applyTablePrefix } from '../sequelize-utils.js';
 import { PasskeyStore } from './base.js';
-function integerIdType(sequelize) {
-    return DIALECTS_SUPPORTING_UNSIGNED.has(sequelize.getDialect()) ? DataTypes.INTEGER.UNSIGNED : DataTypes.INTEGER;
-}
+import { initPasskeyChallengeModel, initPasskeyCredentialModel } from './models.js';
 function encodeCredentialId(value) {
     return Buffer.isBuffer(value) ? value.toString('base64') : value;
 }
-function normalizeUserId(identifier) {
-    return normalizeNumericUserId(identifier);
-}
-class PasskeyCredentialModel extends Model {
-}
-class PasskeyChallengeModel extends Model {
-}
-function initPasskeyCredentialModel(sequelize, options = {}) {
-    const idType = integerIdType(sequelize);
-    return PasskeyCredentialModel.init({
-        credentialId: {
-            field: 'credential_id',
-            type: DataTypes.STRING(768),
-            primaryKey: true,
-            allowNull: false,
-            get() {
-                const raw = this.getDataValue('credentialId');
-                if (!raw) {
-                    return raw;
-                }
-                if (Buffer.isBuffer(raw)) {
-                    return raw;
-                }
-                return Buffer.from(raw, 'base64');
-            },
-            set(value) {
-                const encoded = typeof value === 'string' ? value : value.toString('base64');
-                this.setDataValue('credentialId', encoded);
-            }
-        },
-        userId: {
-            field: 'user_id',
-            type: idType,
-            allowNull: false
-        },
-        publicKey: {
-            field: 'public_key',
-            type: DataTypes.BLOB,
-            allowNull: false
-        },
-        counter: {
-            type: DataTypes.INTEGER,
-            allowNull: false,
-            defaultValue: 0
-        },
-        transports: {
-            type: DataTypes.JSON,
-            allowNull: true
-        },
-        backedUp: {
-            field: 'backed_up',
-            type: DataTypes.BOOLEAN,
-            allowNull: false,
-            defaultValue: false
-        },
-        deviceType: {
-            field: 'device_type',
-            type: DataTypes.STRING(32),
-            allowNull: false,
-            defaultValue: 'multiDevice'
-        },
-        label: {
-            type: DataTypes.STRING(120),
-            allowNull: true
-        },
-        createdDomain: {
-            field: 'created_domain',
-            type: DataTypes.STRING(255),
-            allowNull: true
-        },
-        createdUserAgent: {
-            field: 'created_user_agent',
-            type: DataTypes.TEXT,
-            allowNull: true
-        },
-        createdBrowser: {
-            field: 'created_browser',
-            type: DataTypes.STRING(120),
-            allowNull: true
-        },
-        createdOs: {
-            field: 'created_os',
-            type: DataTypes.STRING(120),
-            allowNull: true
-        },
-        createdDevice: {
-            field: 'created_device',
-            type: DataTypes.STRING(120),
-            allowNull: true
-        },
-        createdIp: {
-            field: 'created_ip',
-            type: DataTypes.STRING(45),
-            allowNull: true
-        }
-    }, {
-        sequelize,
-        tableName: applyTablePrefix(options.tablePrefix, 'passkey_credentials'),
-        timestamps: true,
-        underscored: true
-    });
-}
-function initPasskeyChallengeModel(sequelize, options = {}) {
-    const idType = integerIdType(sequelize);
-    return PasskeyChallengeModel.init({
-        challenge: {
-            type: DataTypes.STRING(255),
-            primaryKey: true,
-            allowNull: false
-        },
-        action: {
-            type: DataTypes.STRING(16),
-            allowNull: false
-        },
-        userId: {
-            field: 'user_id',
-            type: idType,
-            allowNull: true
-        },
-        login: {
-            type: DataTypes.STRING(128),
-            allowNull: true
-        },
-        expiresAt: {
-            field: 'expires_at',
-            type: DataTypes.DATE,
-            allowNull: false
-        }
-    }, {
-        sequelize,
-        tableName: applyTablePrefix(options.tablePrefix, 'passkey_challenges'),
-        timestamps: true,
-        underscored: true,
-        indexes: [{ fields: ['expires_at'] }, { fields: ['user_id'] }]
-    });
-}
 export class SequelizePasskeyStore extends PasskeyStore {
     constructor(options) {
         super();
@@ -166,25 +27,8 @@ export class SequelizePasskeyStore extends PasskeyStore {
         return this.resolveUserFn(params);
     }
     async listUserCredentials(userId) {
-        const models = await this.credentials.findAll({ where: { userId: normalizeUserId(userId) } });
-        return models.map((model) => ({
-            userId: model.userId,
-            credentialId: model.credentialId,
-            publicKey: model.publicKey,
-            counter: model.counter,
-            transports: (model.transports ?? undefined),
-            backedUp: model.backedUp,
-            deviceType: model.deviceType,
-            label: model.label ?? undefined,
-            createdDomain: model.createdDomain ?? undefined,
-            createdUserAgent: model.createdUserAgent ?? undefined,
-            createdBrowser: model.createdBrowser ?? undefined,
-            createdOs: model.createdOs ?? undefined,
-            createdDevice: model.createdDevice ?? undefined,
-            createdIp: model.createdIp ?? undefined,
-            createdAt: model.createdAt ?? undefined,
-            updatedAt: model.updatedAt ?? undefined
-        }));
+        const models = await this.credentials.findAll({ where: { userId: normalizeNumericUserId(userId) } });
+        return models.map((model) => this.toStoredCredential(model));
     }
     async deleteCredential(credentialId) {
         const encoded = Buffer.isBuffer(credentialId) ? credentialId.toString('base64') : credentialId;
@@ -193,32 +37,12 @@ export class SequelizePasskeyStore extends PasskeyStore {
     }
     async findCredentialById(credentialId) {
         const model = await this.credentials.findByPk(encodeCredentialId(credentialId));
-        if (!model) {
-            return null;
-        }
-        return {
-            userId: model.userId,
-            credentialId: model.credentialId,
-            publicKey: model.publicKey,
-            counter: model.counter,
-            transports: (model.transports ?? undefined),
-            backedUp: model.backedUp,
-            deviceType: model.deviceType,
-            label: model.label ?? undefined,
-            createdDomain: model.createdDomain ?? undefined,
-            createdUserAgent: model.createdUserAgent ?? undefined,
-            createdBrowser: model.createdBrowser ?? undefined,
-            createdOs: model.createdOs ?? undefined,
-            createdDevice: model.createdDevice ?? undefined,
-            createdIp: model.createdIp ?? undefined,
-            createdAt: model.createdAt ?? undefined,
-            updatedAt: model.updatedAt ?? undefined
-        };
+        return model ? this.toStoredCredential(model) : null;
     }
     async saveCredential(record) {
         await this.credentials.upsert({
             credentialId: record.credentialId,
-            userId: normalizeUserId(record.userId),
+            userId: normalizeNumericUserId(record.userId),
             publicKey: record.publicKey,
             counter: record.counter,
             transports: record.transports ?? null,
@@ -240,26 +64,59 @@ export class SequelizePasskeyStore extends PasskeyStore {
         await this.challenges.upsert({
             challenge: record.challenge,
             action: record.action,
-            userId: record.userId !== undefined ? normalizeUserId(record.userId) : null,
+            userId: record.userId !== undefined ? normalizeNumericUserId(record.userId) : null,
             login: record.login ?? null,
             expiresAt: record.expiresAt
         });
     }
-    async consumeChallenge(challenge) {
+    async getChallenge(challenge) {
         const model = await this.challenges.findByPk(challenge);
-        if (!model) {
-            return null;
+        return model ? this.toChallengeRecord(model) : null;
+    }
+    async consumeChallenge(challenge) {
+        const sequelize = this.challenges.sequelize;
+        if (!sequelize) {
+            throw new Error('Challenge model is not bound to a Sequelize instance');
         }
-        await model.destroy();
+        return sequelize.transaction({ isolationLevel: Transaction.ISOLATION_LEVELS.READ_COMMITTED }, async (transaction) => {
+            const model = await this.challenges.findByPk(challenge, { transaction, lock: true });
+            if (!model) {
+                return null;
+            }
+            await model.destroy({ transaction });
+            return this.toChallengeRecord(model);
+        });
+    }
+    async cleanupChallenges(now) {
+        await this.challenges.destroy({ where: { expiresAt: { [Op.lte]: now } } });
+    }
+    toChallengeRecord(model) {
         return {
             challenge: model.challenge,
             action: model.action,
-            userId: model.userId ?? undefined,
+            userId: model.userId !== null ? String(model.userId) : undefined,
             login: model.login ?? undefined,
             expiresAt: model.expiresAt
         };
     }
-    async cleanupChallenges(now) {
-        await this.challenges.destroy({ where: { expiresAt: { [Op.lte]: now } } });
+    toStoredCredential(model) {
+        return {
+            userId: String(model.userId),
+            credentialId: model.credentialId,
+            publicKey: model.publicKey,
+            counter: model.counter,
+            transports: (model.transports ?? undefined),
+            backedUp: model.backedUp,
+            deviceType: model.deviceType,
+            label: model.label ?? undefined,
+            createdDomain: model.createdDomain ?? undefined,
+            createdUserAgent: model.createdUserAgent ?? undefined,
+            createdBrowser: model.createdBrowser ?? undefined,
+            createdOs: model.createdOs ?? undefined,
+            createdDevice: model.createdDevice ?? undefined,
+            createdIp: model.createdIp ?? undefined,
+            createdAt: model.createdAt ?? undefined,
+            updatedAt: model.updatedAt ?? undefined
+        };
     }
 }

package/dist/esm/passkey/service.d.ts

@@ -17,4 +17,5 @@ export declare class PasskeyService {
     private verifyAuthentication;
     private requireUser;
     private createExpiry;
+    private requireUserVerification;
 }

package/dist/esm/passkey/service.js

@@ -66,21 +66,51 @@ async function spkiToCosePublicKey(spki) {
             return null;
         }
         const spkiView = new Uint8Array(spki);
-        const key = await subtle.importKey('spki', spkiView, { name: 'ECDSA', namedCurve: 'P-256' }, true, ['verify']);
-        const raw = Buffer.from(await subtle.exportKey('raw', key));
-        if (raw.length !== 65 || raw[0] !== 0x04) {
+        const ecCurves = [
+            { namedCurve: 'P-256', crv: 1, alg: -7, rawLength: 65 },
+            { namedCurve: 'P-384', crv: 2, alg: -35, rawLength: 97 },
+            { namedCurve: 'P-521', crv: 3, alg: -36, rawLength: 133 }
+        ];
+        for (const curve of ecCurves) {
+            try {
+                const key = await subtle.importKey('spki', spkiView, { name: 'ECDSA', namedCurve: curve.namedCurve }, true, ['verify']);
+                const raw = Buffer.from(await subtle.exportKey('raw', key));
+                if (raw.length !== curve.rawLength || raw[0] !== 0x04) {
+                    continue;
+                }
+                const coordLength = (raw.length - 1) / 2;
+                const x = raw.slice(1, 1 + coordLength);
+                const y = raw.slice(1 + coordLength);
+                const coseMap = new Map([
+                    [1, 2], // kty: EC2
+                    [3, curve.alg],
+                    [-1, curve.crv],
+                    [-2, x],
+                    [-3, y]
+                ]);
+                return Buffer.from(isoCBOR.encode(coseMap));
+            }
+            catch {
+                // try next algorithm
+            }
+        }
+        try {
+            const edKey = await subtle.importKey('spki', spkiView, { name: 'Ed25519' }, true, ['verify']);
+            const raw = Buffer.from(await subtle.exportKey('raw', edKey));
+            if (raw.length !== 32) {
+                return null;
+            }
+            const coseMap = new Map([
+                [1, 1], // kty: OKP
+                [3, -8], // alg: EdDSA
+                [-1, 6], // crv: Ed25519
+                [-2, raw]
+            ]);
+            return Buffer.from(isoCBOR.encode(coseMap));
+        }
+        catch {
             return null;
         }
-        const x = raw.slice(1, 33);
-        const y = raw.slice(33, 65);
-        const coseMap = new Map([
-            [1, 2], // kty: EC2
-            [3, -7], // alg: ES256
-            [-1, 1], // crv: P-256
-            [-2, x],
-            [-3, y]
-        ]);
-        return Buffer.from(isoCBOR.encode(coseMap));
     }
     catch {
         return null;
@@ -110,6 +140,10 @@ export class PasskeyService {
     }
     async verifyResponse(params) {
         await this.adapter.cleanupChallenges?.(new Date());
+        const existing = this.adapter.getChallenge ? await this.adapter.getChallenge(params.expectedChallenge) : null;
+        if (existing && existing.expiresAt.getTime() <= Date.now()) {
+            return { verified: false };
+        }
         const record = await this.adapter.consumeChallenge(params.expectedChallenge);
         if (!record) {
             return { verified: false };
@@ -204,7 +238,7 @@ export class PasskeyService {
             expectedChallenge: record.challenge,
             expectedOrigin: this.config.origins,
             expectedRPID: this.config.rpId,
-            requireUserVerification: true
+            requireUserVerification: this.requireUserVerification()
         });
         if (!result.verified || !result.registrationInfo) {
             if (!result.verified) {
@@ -298,7 +332,7 @@ export class PasskeyService {
             expectedOrigin: this.config.origins,
             expectedRPID: this.config.rpId,
             credential: storedAuthData,
-            requireUserVerification: true
+            requireUserVerification: this.requireUserVerification()
         });
         if (!result.verified) {
             const err = result.error ?? result;
@@ -322,4 +356,7 @@ export class PasskeyService {
     createExpiry() {
         return new Date(Date.now() + this.config.timeoutMs);
     }
+    requireUserVerification() {
+        return this.config.userVerification !== 'discouraged';
+    }
 }

package/dist/esm/passkey/types.d.ts

@@ -55,6 +55,7 @@ export interface PasskeyStorageAdapter {
     saveCredential(record: StoredPasskeyCredential): Promise<void>;
     updateCredentialCounter(credentialId: Buffer, counter: number): Promise<void>;
     saveChallenge(record: PasskeyChallengeRecord): Promise<void>;
+    getChallenge?(challenge: string): Promise<PasskeyChallengeRecord | null>;
     consumeChallenge(challenge: string): Promise<PasskeyChallengeRecord | null>;
     cleanupChallenges?(now: Date): Promise<void>;
 }

package/dist/esm/sequelize-utils.d.ts

@@ -1,3 +1,8 @@
+import { DataTypes, type InitOptions, type Model, type Sequelize } from 'sequelize';
 export declare const DIALECTS_SUPPORTING_UNSIGNED: Set<string>;
+export declare function integerIdType(sequelize: Sequelize): DataTypes.IntegerDataTypeConstructor;
+export declare function tableOptions<ModelType extends Model>(sequelize: Sequelize, tableName: string, tablePrefix?: string, extra?: Partial<InitOptions<ModelType>>): InitOptions<ModelType>;
 export declare function normalizeTablePrefix(prefix?: string): string | undefined;
 export declare function applyTablePrefix(prefix: string | undefined, tableName: string): string;
+export declare function encodeStringArray(values: string[] | undefined): string;
+export declare function decodeStringArray(raw: string | null | undefined): string[];

package/dist/esm/sequelize-utils.js

@@ -1,4 +1,19 @@
+import { DataTypes } from 'sequelize';
 export const DIALECTS_SUPPORTING_UNSIGNED = new Set(['mysql', 'mariadb']);
+export function integerIdType(sequelize) {
+    return DIALECTS_SUPPORTING_UNSIGNED.has(sequelize.getDialect()) ? DataTypes.INTEGER.UNSIGNED : DataTypes.INTEGER;
+}
+export function tableOptions(sequelize, tableName, tablePrefix, extra) {
+    const opts = { sequelize, tableName: applyTablePrefix(tablePrefix, tableName) };
+    if (extra) {
+        Object.assign(opts, extra);
+    }
+    if (DIALECTS_SUPPORTING_UNSIGNED.has(sequelize.getDialect())) {
+        opts.charset = 'utf8mb4';
+        opts.collate = 'utf8mb4_unicode_ci';
+    }
+    return opts;
+}
 export function normalizeTablePrefix(prefix) {
     if (!prefix) {
         return undefined;
@@ -10,3 +25,24 @@ export function applyTablePrefix(prefix, tableName) {
     const normalized = normalizeTablePrefix(prefix);
     return normalized ? `${normalized}${tableName}` : tableName;
 }
+export function encodeStringArray(values) {
+    return JSON.stringify(values ?? []);
+}
+export function decodeStringArray(raw) {
+    if (!raw) {
+        return [];
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed)) {
+            return parsed.filter((entry) => typeof entry === 'string' && entry.length > 0);
+        }
+    }
+    catch {
+        // ignore malformed values
+    }
+    return raw
+        .split(/\s+/)
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+}

package/dist/esm/token/base.js

@@ -43,10 +43,10 @@ function normalizeTokenInternal(input) {
     const status = input.status === 'revoked' ? 'revoked' : expires.getTime() < Date.now() ? 'expired' : 'active';
     const sessionCookie = typeof input.sessionCookie === 'boolean' ? input.sessionCookie : false;
     return {
-        ...input,
         accessToken: input.accessToken,
         refreshToken: input.refreshToken,
         userId,
+        clientId: typeof input.clientId === 'string' && input.clientId.length > 0 ? input.clientId : undefined,
         domain: typeof input.domain === 'string' ? input.domain : '',
         fingerprint: typeof input.fingerprint === 'string' ? input.fingerprint : '',
         label: typeof input.label === 'string' ? input.label : '',
@@ -70,6 +70,8 @@ export class TokenStore {
     normalizeToken(token) {
         return normalizeTokenInternal(token);
     }
+    // JWT helpers live on TokenStore so every adapter automatically exposes
+    // signing/verification without additional wiring.
     jwtSign(payload, secret, expiresInSeconds, options) {
         const opts = { ...(options ?? {}), expiresIn: expiresInSeconds };
         try {

package/dist/esm/token/memory.d.ts

@@ -1,8 +1,13 @@
 import { TokenStore } from './base.js';
 import type { Token } from './types.js';
+export interface MemoryTokenStoreOptions {
+    maxTokens?: number;
+}
 export declare class MemoryTokenStore extends TokenStore {
     private readonly tokens;
     private readonly tokensByUser;
+    private readonly maxTokens?;
+    constructor(options?: MemoryTokenStoreOptions);
     private indexToken;
     private unindexToken;
     private removeByRefreshToken;
@@ -20,4 +25,5 @@ export declare class MemoryTokenStore extends TokenStore {
         includeExpired?: boolean;
     }): Promise<Token[]>;
     close(): Promise<void>;
+    private enforceCapacity;
 }

package/dist/esm/token/memory.js

@@ -1,6 +1,6 @@
 import { TokenStore } from './base.js';
 function comparableUserId(value) {
-    if (value === undefined || value === null) {
+    if (value === undefined) {
         return undefined;
     }
     return String(value);
@@ -45,10 +45,14 @@ function matchesQuery(record, query, includeExpired) {
     return true;
 }
 export class MemoryTokenStore extends TokenStore {
-    constructor() {
-        super(...arguments);
+    constructor(options = {}) {
+        super();
         this.tokens = new Map();
         this.tokensByUser = new Map();
+        this.maxTokens =
+            typeof options.maxTokens === 'number' && Number.isFinite(options.maxTokens) && options.maxTokens > 0
+                ? Math.floor(options.maxTokens)
+                : undefined;
     }
     indexToken(token) {
         const userId = comparableUserId(token.userId);
@@ -115,6 +119,7 @@ export class MemoryTokenStore extends TokenStore {
         this.removeByRefreshToken(stored.refreshToken);
         this.tokens.set(stored.refreshToken, stored);
         this.indexToken(stored);
+        this.enforceCapacity();
     }
     async get(query, opts) {
         if (!query.refreshToken && !query.accessToken && query.userId === undefined) {
@@ -162,8 +167,12 @@ export class MemoryTokenStore extends TokenStore {
                 merged[key] = value;
             }
         };
-        maybeAssign('accessToken');
-        maybeAssign('expires');
+        if (params.accessToken !== undefined && params.accessToken !== null) {
+            merged.accessToken = params.accessToken;
+        }
+        if (params.expires !== undefined && params.expires !== null) {
+            merged.expires = params.expires;
+        }
         maybeAssign('scope');
         maybeAssign('label');
         maybeAssign('domain');
@@ -174,8 +183,12 @@ export class MemoryTokenStore extends TokenStore {
         maybeAssign('os');
         maybeAssign('refreshTtlSeconds');
         maybeAssign('loginType');
-        maybeAssign('issuedAt');
-        maybeAssign('lastSeenAt');
+        if (params.issuedAt !== undefined && params.issuedAt !== null) {
+            merged.issuedAt = params.issuedAt;
+        }
+        if (params.lastSeenAt !== undefined && params.lastSeenAt !== null) {
+            merged.lastSeenAt = params.lastSeenAt;
+        }
         maybeAssign('sessionCookie');
         const normalized = this.normalizeToken(merged);
         const previousUserId = token.userId;
@@ -207,4 +220,16 @@ export class MemoryTokenStore extends TokenStore {
     async close() {
         return;
     }
+    enforceCapacity() {
+        if (!this.maxTokens) {
+            return;
+        }
+        while (this.tokens.size > this.maxTokens) {
+            const oldestRefresh = this.tokens.keys().next().value;
+            if (!oldestRefresh) {
+                return;
+            }
+            this.removeByRefreshToken(oldestRefresh);
+        }
+    }
 }

package/dist/esm/token/sequelize.d.ts

@@ -52,10 +52,7 @@ export declare class SequelizeTokenStore extends TokenStore {
     close(): Promise<void>;
     private normalizeUserId;
     private resolveRealUserId;
-    private encodeStringArray;
-    private decodeStringArray;
     private encodeScope;
-    private decodeScope;
     private toTokenRecord;
 }
 export {};