@technomoron/api-server-base 2.0.0-beta.2 → 2.0.0-beta.20

package/dist/esm/auth-api/auth-module.d.ts

@@ -1,6 +1,6 @@
 import { type ApiRequest, type ApiRoute, type ApiServer } from '../api-server-base.js';
 import { BaseAuthModule, type AuthProviderModule } from './module.js';
-import type { AuthIdentifier, AuthStorage } from './types.js';
+import type { AuthAdapter, AuthIdentifier } from './types.js';
 import type { OAuthCallbackParams, OAuthCallbackResult, OAuthStartParams, OAuthStartResult } from '../oauth/types.js';
 import type { TokenPair, Token } from '../token/types.js';
 interface CanImpersonateContext<UserEntity> {
@@ -10,10 +10,16 @@ interface CanImpersonateContext<UserEntity> {
     targetUser: UserEntity;
     effectiveUserId: AuthIdentifier;
 }
+type AuthRateLimitEndpoint = 'login' | 'passkey-challenge' | 'oauth-token';
 interface AuthModuleOptions<UserEntity> {
     namespace?: string;
     defaultDomain?: string;
     canImpersonate?: (context: CanImpersonateContext<UserEntity>) => Promise<boolean> | boolean;
+    rateLimit?: (context: {
+        apiReq: ApiRequest;
+        endpoint: AuthRateLimitEndpoint;
+    }) => Promise<void> | void;
+    allowInsecurePkcePlain?: boolean;
 }
 type TokenMetadata = Partial<Token> & {
     sessionCookie?: boolean;
@@ -42,11 +48,14 @@ type AuthCapableServer<PublicUser> = ApiServer & {
 };
 export default class AuthModule<UserEntity, PublicUser> extends BaseAuthModule<UserEntity> implements AuthProviderModule<UserEntity> {
     static defaultNamespace: string;
-    server: AuthCapableServer<PublicUser>;
+    get server(): AuthCapableServer<PublicUser>;
+    set server(value: AuthCapableServer<PublicUser>);
     private readonly defaultDomain?;
     private readonly canImpersonateHook?;
+    private readonly rateLimitHook?;
+    private readonly allowInsecurePkcePlain;
     constructor(options?: AuthModuleOptions<UserEntity>);
-    protected get storage(): AuthStorage<UserEntity, PublicUser>;
+    protected get storage(): AuthAdapter<UserEntity, PublicUser>;
     protected canImpersonate(apiReq: ApiRequest, realUser: UserEntity, targetUser: UserEntity): Promise<boolean>;
     protected ensureImpersonationAllowed(apiReq: ApiRequest, realUser: UserEntity, targetUser: UserEntity): Promise<void>;
     protected buildTokenPayload(user: UserEntity, metadata?: TokenMetadata): TokenClaims;
@@ -57,6 +66,9 @@ export default class AuthModule<UserEntity, PublicUser> extends BaseAuthModule<U
     private resolveSessionPreferences;
     private mergeSessionPreferences;
     private sessionPrefsFromRecord;
+    private validateCredentialId;
+    private normalizeCredentialId;
+    private toIsoDate;
     private cookieOptions;
     private setJwtCookies;
     issueTokens(apiReq: ApiRequest, user: UserEntity, metadata?: TokenIssueOptions): Promise<TokenPair>;
@@ -76,6 +88,8 @@ export default class AuthModule<UserEntity, PublicUser> extends BaseAuthModule<U
     private postWhoAmI;
     private postPasskeyChallenge;
     private postPasskeyVerify;
+    private getPasskeys;
+    private deletePasskey;
     private postImpersonation;
     private deleteImpersonation;
     private getUserFromPasskey;
@@ -91,6 +105,12 @@ export default class AuthModule<UserEntity, PublicUser> extends BaseAuthModule<U
     private resolveClientAuthentication;
     private assertRedirectUriAllowed;
     private resolveUserForOAuth;
+    private hasPasskeyService;
+    private hasOAuthStore;
+    private storageImplements;
+    private storageImplementsAll;
+    private applyRateLimit;
+    private resolvePkceChallengeMethod;
     defineRoutes(): ApiRoute[];
 }
 export {};