@ttoss/http-server-auth 0.4.0 → 0.5.0

package/README.md

@@ -125,6 +125,51 @@ type AuthenticatedUser = {
 
 Both `apiToken.lookup` and `jwt.mapPayload` receive the Koa `ctx` as a second argument, enabling request-scoped work (e.g. reading a per-request connection off `ctx.db` or updating `lastUsedAt`). The single-argument signatures keep working — `ctx` is purely additive.
 
+## Email and password flows
+
+`emailAuth()` mounts the credential flows — password sign-up and sign-in, magic
+links, mailed numeric codes, address confirmation and password reset — as a Koa
+`Router`. It is a thin adapter over `createEmailAuthHandlers` from
+[`@ttoss/auth-core`](https://ttoss.dev/docs/modules/packages/auth-core), which
+owns the mechanics; this package only maps `ctx` to and from it.
+
+`modes` decides which routes exist, so an app that signs users in with a mailed
+code alone never exposes a password endpoint.
+
+```ts
+import { App, bodyParser } from '@ttoss/http-server';
+import { authMiddleware, emailAuth } from '@ttoss/http-server-auth';
+
+const app = new App();
+app.use(bodyParser());
+
+app.use(
+  emailAuth({
+    modes: ['emailCode'],
+    prefix: '/v1',
+    userStore,
+    oneTimeTokenStore,
+    issueSession: (user) => issueSession(user),
+    sendEmail: async ({ to, token }) => {
+      await ses.send(buildCodeEmail({ to, code: token }));
+    },
+  }).routes()
+);
+
+// Mount after, so the sign-in routes stay reachable without a token.
+app.use(authMiddleware({ strategies: ['jwt'], jwt: { secret } }));
+```
+
+Every route is a `POST`, link redemptions included: the token arrives in the body
+from the page the user landed on, which keeps it out of server logs and out of
+the `Referer` header. The engine also reads a token from the query string, so a
+`GET` redemption is available to an app that wants one.
+
+Mount it before `authMiddleware` (or exempt its paths) — a client calls these
+routes precisely because it has no token yet. `prefix` applies to every mounted
+path when the app versions its API; individual paths are overridable through
+`paths`.
+
 ## OAuth authorization server
 
 The package also ships `oauthServer()` — a Koa `Router` that issues tokens (`/authorize`, `/token`, `/register`, discovery), a thin adapter over `createOAuthHandlers` from [`@ttoss/auth-core`](https://ttoss.dev/docs/modules/packages/auth-core). Pair it with the `oauth` verification strategy above when one deployment both issues and verifies. See the [OAuth Authorization Server](https://ttoss.dev/docs/engineering/guidelines/oauth-authorization-server) guideline.

package/dist/index.cjs

@@ -175,12 +175,17 @@ var authMiddleware = options => {
 };
 
 //#endregion
-//#region src/oauthServer.ts
+//#region src/koaAdapter.ts
+/**
+* Translation between Koa's `ctx` and the framework-agnostic request/response
+* shapes the `@ttoss/auth-core` engines speak. Shared by every adapter in this
+* package so the mapping exists once.
+*/
 /** Normalizes a Koa query/header value (which may be an array) to a string. */
 var firstValue = value => {
   return Array.isArray(value) ? value[0] : value;
 };
-var toOAuthRequest = ctx => {
+var toAuthRequest = ctx => {
   const query = {};
   for (const [key, value] of Object.entries(ctx.query)) query[key] = firstValue(value);
   const headers = {};
@@ -191,6 +196,10 @@ var toOAuthRequest = ctx => {
     headers
   };
 };
+/**
+* Applies an engine response to `ctx`. A response carries either a JSON body
+* with a status or a redirect, never both.
+*/
 var applyResponse = (ctx, res) => {
   if (res.redirect !== void 0) {
     ctx.redirect(res.redirect);
@@ -199,6 +208,67 @@ var applyResponse = (ctx, res) => {
   ctx.status = res.status;
   ctx.body = res.body;
 };
+
+//#endregion
+//#region src/emailAuth.ts
+/**
+* Mounts the email and password credential flows as a Koa `Router`, adapting
+* the runner-agnostic engine from `@ttoss/auth-core`. Which routes appear is
+* decided by `modes`, so an app that only signs users in with a mailed code
+* never exposes a password endpoint.
+*
+* Every route is a `POST`, including the link redemptions: the token arrives in
+* the body from the page the user landed on, which keeps it out of server logs
+* and out of the `Referer` header. The engine also reads a token from the query
+* string, so a `GET` redemption can be added by an application that wants one.
+*
+* Mount it **before** `authMiddleware`, or exempt its paths — the sign-in
+* routes are what a client calls precisely because it has no token yet.
+*
+* @example
+* ```typescript
+* import { App, bodyParser } from '@ttoss/http-server';
+* import { emailAuth } from '@ttoss/http-server-auth';
+*
+* const app = new App();
+* app.use(bodyParser());
+* app.use(
+*   emailAuth({
+*     modes: ['emailCode'],
+*     userStore,
+*     oneTimeTokenStore,
+*     issueSession: (user) => issueSession(user),
+*     sendEmail: async ({ to, token }) => {
+*       await ses.send(buildCodeEmail({ to, code: token }));
+*     },
+*   }).routes()
+* );
+* ```
+*/
+var emailAuth = options => {
+  const handlers = (0, _ttoss_auth_core.createEmailAuthHandlers)(options);
+  const router = new _ttoss_http_server.Router();
+  const prefix = options.prefix ?? "";
+  const mount = (path, handler) => {
+    if (!handler) return;
+    router.post(`${prefix}${path}`, async ctx => {
+      applyResponse(ctx, await handler(toAuthRequest(ctx)));
+    });
+  };
+  mount(handlers.paths.signUp, handlers.signUp);
+  mount(handlers.paths.signIn, handlers.signIn);
+  mount(handlers.paths.sendMagicLink, handlers.sendMagicLink);
+  mount(handlers.paths.verifyMagicLink, handlers.verifyMagicLink);
+  mount(handlers.paths.sendEmailCode, handlers.sendEmailCode);
+  mount(handlers.paths.verifyEmailCode, handlers.verifyEmailCode);
+  mount(handlers.paths.verifyEmail, handlers.verifyEmail);
+  mount(handlers.paths.requestPasswordReset, handlers.requestPasswordReset);
+  mount(handlers.paths.resetPassword, handlers.resetPassword);
+  return router;
+};
+
+//#endregion
+//#region src/oauthServer.ts
 /**
 * Mounts an OAuth 2.1 Authorization Server (issuing tokens) as a Koa `Router`,
 * adapting the runner-agnostic engine from `@ttoss/auth-core`. Exposes the
@@ -229,13 +299,13 @@ var oauthServer = options => {
     applyResponse(ctx, prm);
   });
   router.get(engine.paths.authorize, async ctx => {
-    applyResponse(ctx, await engine.authorize(toOAuthRequest(ctx)));
+    applyResponse(ctx, await engine.authorize(toAuthRequest(ctx)));
   });
   router.post(engine.paths.token, async ctx => {
-    applyResponse(ctx, await engine.token(toOAuthRequest(ctx)));
+    applyResponse(ctx, await engine.token(toAuthRequest(ctx)));
   });
   router.post(engine.paths.register, async ctx => {
-    applyResponse(ctx, await engine.register(toOAuthRequest(ctx)));
+    applyResponse(ctx, await engine.register(toAuthRequest(ctx)));
   });
   return router;
 };
@@ -275,6 +345,12 @@ var requireAuth = options => {
 
 //#endregion
 exports.authMiddleware = authMiddleware;
+Object.defineProperty(exports, 'createEmailAuthHandlers', {
+  enumerable: true,
+  get: function () {
+    return _ttoss_auth_core.createEmailAuthHandlers;
+  }
+});
 Object.defineProperty(exports, 'createOAuthHandlers', {
   enumerable: true,
   get: function () {
@@ -282,6 +358,13 @@ Object.defineProperty(exports, 'createOAuthHandlers', {
   }
 });
 exports.createProtectedResourceMetadataMiddleware = createProtectedResourceMetadataMiddleware;
+exports.emailAuth = emailAuth;
+Object.defineProperty(exports, 'emailAuthErrorCodes', {
+  enumerable: true,
+  get: function () {
+    return _ttoss_auth_core.emailAuthErrorCodes;
+  }
+});
 Object.defineProperty(exports, 'getWwwAuthenticateHeader', {
   enumerable: true,
   get: function () {
@@ -289,5 +372,11 @@ Object.defineProperty(exports, 'getWwwAuthenticateHeader', {
   }
 });
 exports.isOriginAllowed = isOriginAllowed;
+Object.defineProperty(exports, 'normalizeEmail', {
+  enumerable: true,
+  get: function () {
+    return _ttoss_auth_core.normalizeEmail;
+  }
+});
 exports.oauthServer = oauthServer;
 exports.requireAuth = requireAuth;

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 
 import { Context, Middleware, Next, Router } from "@ttoss/http-server";
-import { AuthCodeStore, AuthorizeRequest, ClientStore, IssueTokensArgs, IssuedTokens, OAuthClient, OAuthClientMetadata, OAuthHandlers, OAuthServerOptions, OAuthServerOptions as OAuthServerOptions$1, OnAuthorizeArgs, OnAuthorizeResult, OnRefreshTokenArgs, OnRefreshTokenResult, StoredAuthorizationCode, createOAuthHandlers, getWwwAuthenticateHeader } from "@ttoss/auth-core";
+import { AuthCodeStore, AuthorizeRequest, ClientStore, EmailAuthDelivery, EmailAuthErrorCode, EmailAuthHandler, EmailAuthHandlers, EmailAuthHooks, EmailAuthMode, EmailAuthOptions, EmailAuthOptions as EmailAuthOptions$1, EmailAuthPaths, EmailAuthSession, EmailAuthTtl, EmailAuthUser, EmailAuthUserStore, EmailCodeOptions, IssueTokensArgs, IssuedTokens, OAuthClient, OAuthClientMetadata, OAuthHandlers, OAuthServerOptions, OAuthServerOptions as OAuthServerOptions$1, OnAuthorizeArgs, OnAuthorizeResult, OnRefreshTokenArgs, OnRefreshTokenResult, OneTimeTokenPurpose, OneTimeTokenStore, PasswordOptions, StoredAuthorizationCode, StoredOneTimeToken, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail } from "@ttoss/auth-core";
 
 //#region src/types.d.ts
 type AuthenticatedUser = {
@@ -93,6 +93,49 @@ type AuthMiddlewareOptions = {
  */
 declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context, next: Next) => Promise<void>;
 //#endregion
+//#region src/emailAuth.d.ts
+/**
+ * Mounts the email and password credential flows as a Koa `Router`, adapting
+ * the runner-agnostic engine from `@ttoss/auth-core`. Which routes appear is
+ * decided by `modes`, so an app that only signs users in with a mailed code
+ * never exposes a password endpoint.
+ *
+ * Every route is a `POST`, including the link redemptions: the token arrives in
+ * the body from the page the user landed on, which keeps it out of server logs
+ * and out of the `Referer` header. The engine also reads a token from the query
+ * string, so a `GET` redemption can be added by an application that wants one.
+ *
+ * Mount it **before** `authMiddleware`, or exempt its paths — the sign-in
+ * routes are what a client calls precisely because it has no token yet.
+ *
+ * @example
+ * ```typescript
+ * import { App, bodyParser } from '@ttoss/http-server';
+ * import { emailAuth } from '@ttoss/http-server-auth';
+ *
+ * const app = new App();
+ * app.use(bodyParser());
+ * app.use(
+ *   emailAuth({
+ *     modes: ['emailCode'],
+ *     userStore,
+ *     oneTimeTokenStore,
+ *     issueSession: (user) => issueSession(user),
+ *     sendEmail: async ({ to, token }) => {
+ *       await ses.send(buildCodeEmail({ to, code: token }));
+ *     },
+ *   }).routes()
+ * );
+ * ```
+ */
+declare const emailAuth: (options: EmailAuthOptions$1 & {
+  /**
+   * Prefix applied to every mounted path, e.g. `/v1`. Useful when the app
+   * versions its API and the engine's default paths are otherwise fine.
+   */
+  prefix?: string;
+}) => Router;
+//#endregion
 //#region src/oauthServer.d.ts
 /**
  * Mounts an OAuth 2.1 Authorization Server (issuing tokens) as a Koa `Router`,
@@ -141,4 +184,4 @@ declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | R
  */
 declare const requireAuth: (options: AuthMiddlewareOptions) => ((ctx: Context, next: Next) => Promise<void>);
 //#endregion
-export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type StoredAuthorizationCode, type SystemOptions, authMiddleware, createOAuthHandlers, createProtectedResourceMetadataMiddleware, getWwwAuthenticateHeader, isOriginAllowed, oauthServer, requireAuth };
+export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, authMiddleware, createEmailAuthHandlers, createOAuthHandlers, createProtectedResourceMetadataMiddleware, emailAuth, emailAuthErrorCodes, getWwwAuthenticateHeader, isOriginAllowed, normalizeEmail, oauthServer, requireAuth };

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 
-import { AuthCodeStore, AuthorizeRequest, ClientStore, IssueTokensArgs, IssuedTokens, OAuthClient, OAuthClientMetadata, OAuthHandlers, OAuthServerOptions, OAuthServerOptions as OAuthServerOptions$1, OnAuthorizeArgs, OnAuthorizeResult, OnRefreshTokenArgs, OnRefreshTokenResult, StoredAuthorizationCode, createOAuthHandlers, getWwwAuthenticateHeader } from "@ttoss/auth-core";
+import { AuthCodeStore, AuthorizeRequest, ClientStore, EmailAuthDelivery, EmailAuthErrorCode, EmailAuthHandler, EmailAuthHandlers, EmailAuthHooks, EmailAuthMode, EmailAuthOptions, EmailAuthOptions as EmailAuthOptions$1, EmailAuthPaths, EmailAuthSession, EmailAuthTtl, EmailAuthUser, EmailAuthUserStore, EmailCodeOptions, IssueTokensArgs, IssuedTokens, OAuthClient, OAuthClientMetadata, OAuthHandlers, OAuthServerOptions, OAuthServerOptions as OAuthServerOptions$1, OnAuthorizeArgs, OnAuthorizeResult, OnRefreshTokenArgs, OnRefreshTokenResult, OneTimeTokenPurpose, OneTimeTokenStore, PasswordOptions, StoredAuthorizationCode, StoredOneTimeToken, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail } from "@ttoss/auth-core";
 import { Context, Middleware, Next, Router } from "@ttoss/http-server";
 
 //#region src/types.d.ts
@@ -93,6 +93,49 @@ type AuthMiddlewareOptions = {
  */
 declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context, next: Next) => Promise<void>;
 //#endregion
+//#region src/emailAuth.d.ts
+/**
+ * Mounts the email and password credential flows as a Koa `Router`, adapting
+ * the runner-agnostic engine from `@ttoss/auth-core`. Which routes appear is
+ * decided by `modes`, so an app that only signs users in with a mailed code
+ * never exposes a password endpoint.
+ *
+ * Every route is a `POST`, including the link redemptions: the token arrives in
+ * the body from the page the user landed on, which keeps it out of server logs
+ * and out of the `Referer` header. The engine also reads a token from the query
+ * string, so a `GET` redemption can be added by an application that wants one.
+ *
+ * Mount it **before** `authMiddleware`, or exempt its paths — the sign-in
+ * routes are what a client calls precisely because it has no token yet.
+ *
+ * @example
+ * ```typescript
+ * import { App, bodyParser } from '@ttoss/http-server';
+ * import { emailAuth } from '@ttoss/http-server-auth';
+ *
+ * const app = new App();
+ * app.use(bodyParser());
+ * app.use(
+ *   emailAuth({
+ *     modes: ['emailCode'],
+ *     userStore,
+ *     oneTimeTokenStore,
+ *     issueSession: (user) => issueSession(user),
+ *     sendEmail: async ({ to, token }) => {
+ *       await ses.send(buildCodeEmail({ to, code: token }));
+ *     },
+ *   }).routes()
+ * );
+ * ```
+ */
+declare const emailAuth: (options: EmailAuthOptions$1 & {
+  /**
+   * Prefix applied to every mounted path, e.g. `/v1`. Useful when the app
+   * versions its API and the engine's default paths are otherwise fine.
+   */
+  prefix?: string;
+}) => Router;
+//#endregion
 //#region src/oauthServer.d.ts
 /**
  * Mounts an OAuth 2.1 Authorization Server (issuing tokens) as a Koa `Router`,
@@ -141,4 +184,4 @@ declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | R
  */
 declare const requireAuth: (options: AuthMiddlewareOptions) => ((ctx: Context, next: Next) => Promise<void>);
 //#endregion
-export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type StoredAuthorizationCode, type SystemOptions, authMiddleware, createOAuthHandlers, createProtectedResourceMetadataMiddleware, getWwwAuthenticateHeader, isOriginAllowed, oauthServer, requireAuth };
+export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, authMiddleware, createEmailAuthHandlers, createOAuthHandlers, createProtectedResourceMetadataMiddleware, emailAuth, emailAuthErrorCodes, getWwwAuthenticateHeader, isOriginAllowed, normalizeEmail, oauthServer, requireAuth };

package/dist/index.mjs

@@ -1,6 +1,6 @@
 /** Powered by @ttoss/config. https://ttoss.dev/docs/modules/packages/config/ */
 import crypto from "node:crypto";
-import { createOAuthHandlers, createOAuthHandlers as createOAuthHandlers$1, getWwwAuthenticateHeader, hashApiToken, verifyJwt } from "@ttoss/auth-core";
+import { createEmailAuthHandlers, createEmailAuthHandlers as createEmailAuthHandlers$1, createOAuthHandlers, createOAuthHandlers as createOAuthHandlers$1, emailAuthErrorCodes, getWwwAuthenticateHeader, hashApiToken, normalizeEmail, verifyJwt } from "@ttoss/auth-core";
 import { Router } from "@ttoss/http-server";
 
 //#region src/origin.ts
@@ -144,12 +144,17 @@ var authMiddleware = options => {
 };
 
 //#endregion
-//#region src/oauthServer.ts
+//#region src/koaAdapter.ts
+/**
+* Translation between Koa's `ctx` and the framework-agnostic request/response
+* shapes the `@ttoss/auth-core` engines speak. Shared by every adapter in this
+* package so the mapping exists once.
+*/
 /** Normalizes a Koa query/header value (which may be an array) to a string. */
 var firstValue = value => {
   return Array.isArray(value) ? value[0] : value;
 };
-var toOAuthRequest = ctx => {
+var toAuthRequest = ctx => {
   const query = {};
   for (const [key, value] of Object.entries(ctx.query)) query[key] = firstValue(value);
   const headers = {};
@@ -160,6 +165,10 @@ var toOAuthRequest = ctx => {
     headers
   };
 };
+/**
+* Applies an engine response to `ctx`. A response carries either a JSON body
+* with a status or a redirect, never both.
+*/
 var applyResponse = (ctx, res) => {
   if (res.redirect !== void 0) {
     ctx.redirect(res.redirect);
@@ -168,6 +177,67 @@ var applyResponse = (ctx, res) => {
   ctx.status = res.status;
   ctx.body = res.body;
 };
+
+//#endregion
+//#region src/emailAuth.ts
+/**
+* Mounts the email and password credential flows as a Koa `Router`, adapting
+* the runner-agnostic engine from `@ttoss/auth-core`. Which routes appear is
+* decided by `modes`, so an app that only signs users in with a mailed code
+* never exposes a password endpoint.
+*
+* Every route is a `POST`, including the link redemptions: the token arrives in
+* the body from the page the user landed on, which keeps it out of server logs
+* and out of the `Referer` header. The engine also reads a token from the query
+* string, so a `GET` redemption can be added by an application that wants one.
+*
+* Mount it **before** `authMiddleware`, or exempt its paths — the sign-in
+* routes are what a client calls precisely because it has no token yet.
+*
+* @example
+* ```typescript
+* import { App, bodyParser } from '@ttoss/http-server';
+* import { emailAuth } from '@ttoss/http-server-auth';
+*
+* const app = new App();
+* app.use(bodyParser());
+* app.use(
+*   emailAuth({
+*     modes: ['emailCode'],
+*     userStore,
+*     oneTimeTokenStore,
+*     issueSession: (user) => issueSession(user),
+*     sendEmail: async ({ to, token }) => {
+*       await ses.send(buildCodeEmail({ to, code: token }));
+*     },
+*   }).routes()
+* );
+* ```
+*/
+var emailAuth = options => {
+  const handlers = createEmailAuthHandlers$1(options);
+  const router = new Router();
+  const prefix = options.prefix ?? "";
+  const mount = (path, handler) => {
+    if (!handler) return;
+    router.post(`${prefix}${path}`, async ctx => {
+      applyResponse(ctx, await handler(toAuthRequest(ctx)));
+    });
+  };
+  mount(handlers.paths.signUp, handlers.signUp);
+  mount(handlers.paths.signIn, handlers.signIn);
+  mount(handlers.paths.sendMagicLink, handlers.sendMagicLink);
+  mount(handlers.paths.verifyMagicLink, handlers.verifyMagicLink);
+  mount(handlers.paths.sendEmailCode, handlers.sendEmailCode);
+  mount(handlers.paths.verifyEmailCode, handlers.verifyEmailCode);
+  mount(handlers.paths.verifyEmail, handlers.verifyEmail);
+  mount(handlers.paths.requestPasswordReset, handlers.requestPasswordReset);
+  mount(handlers.paths.resetPassword, handlers.resetPassword);
+  return router;
+};
+
+//#endregion
+//#region src/oauthServer.ts
 /**
 * Mounts an OAuth 2.1 Authorization Server (issuing tokens) as a Koa `Router`,
 * adapting the runner-agnostic engine from `@ttoss/auth-core`. Exposes the
@@ -198,13 +268,13 @@ var oauthServer = options => {
     applyResponse(ctx, prm);
   });
   router.get(engine.paths.authorize, async ctx => {
-    applyResponse(ctx, await engine.authorize(toOAuthRequest(ctx)));
+    applyResponse(ctx, await engine.authorize(toAuthRequest(ctx)));
   });
   router.post(engine.paths.token, async ctx => {
-    applyResponse(ctx, await engine.token(toOAuthRequest(ctx)));
+    applyResponse(ctx, await engine.token(toAuthRequest(ctx)));
   });
   router.post(engine.paths.register, async ctx => {
-    applyResponse(ctx, await engine.register(toOAuthRequest(ctx)));
+    applyResponse(ctx, await engine.register(toAuthRequest(ctx)));
   });
   return router;
 };
@@ -243,4 +313,4 @@ var requireAuth = options => {
 };
 
 //#endregion
-export { authMiddleware, createOAuthHandlers, createProtectedResourceMetadataMiddleware, getWwwAuthenticateHeader, isOriginAllowed, oauthServer, requireAuth };
+export { authMiddleware, createEmailAuthHandlers, createOAuthHandlers, createProtectedResourceMetadataMiddleware, emailAuth, emailAuthErrorCodes, getWwwAuthenticateHeader, isOriginAllowed, normalizeEmail, oauthServer, requireAuth };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/http-server-auth",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Authentication middleware for @ttoss/http-server",
   "keywords": [
     "auth",
@@ -32,15 +32,15 @@
     "dist"
   ],
   "dependencies": {
-    "@ttoss/auth-core": "^0.11.0"
+    "@ttoss/auth-core": "^0.12.0"
   },
   "devDependencies": {
     "@types/koa": "^3.0.3",
     "jest": "^30.4.2",
     "supertest": "^7.2.2",
     "tsdown": "^0.22.2",
-    "@ttoss/config": "^1.37.17",
-    "@ttoss/http-server": "^0.7.1"
+    "@ttoss/http-server": "^0.7.1",
+    "@ttoss/config": "^1.37.17"
   },
   "peerDependencies": {
     "@ttoss/http-server": "^0.7.1"