@veap/auth 0.0.0-stage → 0.1.0

package/dist/validation/index.d.ts

@@ -0,0 +1,95 @@
+import { z } from "zod";
+/**
+ * Validates the email format and length.
+ */
+export declare function verifyEmailInput(email: string): boolean;
+/**
+ * Checks if an email address is already in use.
+ * @returns True if the email is available, false otherwise.
+ */
+export declare function checkEmailAvailability(email: string): Promise<boolean>;
+export declare const loginSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+    remember: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+    password: string;
+    remember?: boolean | undefined;
+}, {
+    email: string;
+    password: string;
+    remember?: boolean | undefined;
+}>;
+export declare const registerSchema: z.ZodObject<{
+    username: z.ZodString;
+    email: z.ZodString;
+    password: z.ZodString;
+    terms: z.ZodEffects<z.ZodBoolean, boolean, boolean>;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+    password: string;
+    username: string;
+    terms: boolean;
+}, {
+    email: string;
+    password: string;
+    username: string;
+    terms: boolean;
+}>;
+export declare const forgotPasswordSchema: z.ZodObject<{
+    email: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+}, {
+    email: string;
+}>;
+export declare const resetPasswordSchema: z.ZodEffects<z.ZodObject<{
+    password: z.ZodString;
+    confirm: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    password: string;
+    confirm: string;
+}, {
+    password: string;
+    confirm: string;
+}>, {
+    password: string;
+    confirm: string;
+}, {
+    password: string;
+    confirm: string;
+}>;
+export declare const verifyEmailSchema: z.ZodObject<{
+    code: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+}, {
+    code: string;
+}>;
+export declare const totpSetupSchema: z.ZodObject<{
+    code: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+}, {
+    code: string;
+}>;
+export declare const totpVerifySchema: z.ZodObject<{
+    code: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+}, {
+    code: string;
+}>;
+export declare const backupCodeSchema: z.ZodObject<{
+    code: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+}, {
+    code: string;
+}>;
+export type LoginInput = z.infer<typeof loginSchema>;
+export type RegisterInput = z.infer<typeof registerSchema>;
+export type ForgotPasswordInput = z.infer<typeof forgotPasswordSchema>;
+export type ResetPasswordInput = z.infer<typeof resetPasswordSchema>;
+export type VerifyEmailInput = z.infer<typeof verifyEmailSchema>;

package/dist/validation/index.js

@@ -0,0 +1,55 @@
+import { z } from "zod";
+import { User } from "../models";
+/**
+ * Validates the email format and length.
+ */
+export function verifyEmailInput(email) {
+    return /^.+@.+\..+$/.test(email) && email.length < 256 && email.length > 0;
+}
+/**
+ * Checks if an email address is already in use.
+ * @returns True if the email is available, false otherwise.
+ */
+export async function checkEmailAvailability(email) {
+    const exists = await User.where("email", email).exists();
+    return !exists;
+}
+// Auth validation schemas - CLEAN (No DB dependencies for client-side)
+export const loginSchema = z.object({
+    email: z.string().email("Invalid email address"),
+    password: z.string().min(8),
+    remember: z.boolean().optional(),
+});
+export const registerSchema = z.object({
+    username: z.string().min(3, "Name must be at least 2 characters"),
+    email: z.string().email("Invalid email address"),
+    password: z.string().min(8, "Password must be at least 8 characters"),
+    terms: z
+        .boolean()
+        .refine((val) => val === true, "You must accept the terms"),
+});
+export const forgotPasswordSchema = z.object({
+    email: z.string().email("Invalid email address"),
+});
+export const resetPasswordSchema = z
+    .object({
+    password: z.string().min(8, "Password must be at least 8 characters"),
+    confirm: z.string(),
+})
+    .refine((data) => data.password === data.confirm, {
+    message: "Passwords do not match",
+    path: ["confirm"],
+});
+export const verifyEmailSchema = z.object({
+    code: z.string().min(6).max(6),
+});
+// mfa validation schemas
+export const totpSetupSchema = z.object({
+    code: z.string().regex(/^\d{6}$/, "Code must be 6 digits"),
+});
+export const totpVerifySchema = z.object({
+    code: z.string().regex(/^\d{6}$/, "Code must be 6 digits"),
+});
+export const backupCodeSchema = z.object({
+    code: z.string().min(8).max(12),
+});

package/dist/verification/contracts.d.ts

@@ -0,0 +1,25 @@
+/** An email verification request as persisted. */
+export interface EmailVerificationRecord {
+    id: string;
+    email: string;
+    code: string;
+    userId?: string;
+    user_id?: string;
+    expiresAt: Date;
+    [key: string]: any;
+}
+export interface CreateEmailVerificationRecord {
+    userId: string;
+    email: string;
+    code: string;
+    expiresAt: Date;
+}
+/** Email verification request persistence port. */
+export interface IEmailVerificationRepository {
+    create(record: CreateEmailVerificationRecord): Promise<EmailVerificationRecord>;
+    /** Finds a single request scoped to its owner. */
+    findForUser(userId: string, id: string): Promise<EmailVerificationRecord | null>;
+    removeByUserId(userId: string): Promise<void>;
+}
+/** Injection token for the email verification repository port. */
+export declare const EMAIL_VERIFICATION_REPOSITORY: unique symbol;

package/dist/verification/contracts.js

@@ -0,0 +1,2 @@
+/** Injection token for the email verification repository port. */
+export const EMAIL_VERIFICATION_REPOSITORY = Symbol.for("veap:auth:email-verification-repository");

package/dist/verification/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./contracts";
+export * from "./verification.facade";
+export * from "./verification.repository";
+export * from "./verification.service";

package/dist/verification/index.js

@@ -0,0 +1,4 @@
+export * from "./contracts";
+export * from "./verification.facade";
+export * from "./verification.repository";
+export * from "./verification.service";

package/dist/verification/verification.facade.d.ts

@@ -0,0 +1,10 @@
+import { type EmailVerificationRequestType } from "./verification.service";
+export type { EmailVerificationRequestType };
+export declare function initEmailVerification(): Promise<void>;
+export declare function getUserEmailVerificationRequest(userId: string, id: string): Promise<import("./contracts").EmailVerificationRecord | null>;
+export declare function createEmailVerificationRequest(userId: string, email: string): Promise<import("./contracts").EmailVerificationRecord>;
+export declare function deleteUserEmailVerificationRequest(userId: string): Promise<void>;
+export declare function sendVerificationEmail(email: string, code: string): Promise<void>;
+export declare function setEmailVerificationRequestCookie(request: EmailVerificationRequestType): Promise<void>;
+export declare function deleteEmailVerificationRequestCookie(): Promise<void>;
+export declare function getUserEmailVerificationRequestFromRequest(): Promise<import("./contracts").EmailVerificationRecord | null>;

package/dist/verification/verification.facade.js

@@ -0,0 +1,42 @@
+"use server";
+import { app } from "@veap/kernel";
+import { authContext, isAuthContextBound } from "../common/context";
+import { EmailVerificationService, } from "./verification.service";
+async function resolveVerificationService() {
+    if (isAuthContextBound()) {
+        return authContext().emailVerification;
+    }
+    return await app(EmailVerificationService);
+}
+export async function initEmailVerification() {
+    const service = await resolveVerificationService();
+    return service.initEmailVerification();
+}
+export async function getUserEmailVerificationRequest(userId, id) {
+    const service = await resolveVerificationService();
+    return service.getUserEmailVerificationRequest(userId, id);
+}
+export async function createEmailVerificationRequest(userId, email) {
+    const service = await resolveVerificationService();
+    return service.createEmailVerificationRequest(userId, email);
+}
+export async function deleteUserEmailVerificationRequest(userId) {
+    const service = await resolveVerificationService();
+    return service.deleteUserEmailVerificationRequest(userId);
+}
+export async function sendVerificationEmail(email, code) {
+    const service = await resolveVerificationService();
+    return service.sendVerificationEmail(email, code);
+}
+export async function setEmailVerificationRequestCookie(request) {
+    const service = await resolveVerificationService();
+    return service.setEmailVerificationRequestCookie(request);
+}
+export async function deleteEmailVerificationRequestCookie() {
+    const service = await resolveVerificationService();
+    return service.deleteEmailVerificationRequestCookie();
+}
+export async function getUserEmailVerificationRequestFromRequest() {
+    const service = await resolveVerificationService();
+    return service.getUserEmailVerificationRequestFromRequest();
+}

package/dist/verification/verification.repository.d.ts

@@ -0,0 +1,7 @@
+import type { CreateEmailVerificationRecord, EmailVerificationRecord, IEmailVerificationRepository } from "./contracts";
+/** `IEmailVerificationRepository` adapter backed by `EmailVerification`. */
+export declare class ActiveRecordEmailVerificationRepository implements IEmailVerificationRepository {
+    create(record: CreateEmailVerificationRecord): Promise<EmailVerificationRecord>;
+    findForUser(userId: string, id: string): Promise<EmailVerificationRecord | null>;
+    removeByUserId(userId: string): Promise<void>;
+}

package/dist/verification/verification.repository.js

@@ -0,0 +1,23 @@
+import { EmailVerification } from "../models/EmailVerification";
+/** `IEmailVerificationRepository` adapter backed by `EmailVerification`. */
+export class ActiveRecordEmailVerificationRepository {
+    async create(record) {
+        const request = await EmailVerification.create({
+            userId: record.userId,
+            code: record.code,
+            email: record.email,
+            expiresAt: record.expiresAt,
+        });
+        return request.toJSON();
+    }
+    async findForUser(userId, id) {
+        const request = await EmailVerification.where({
+            id,
+            user_id: userId,
+        }).first();
+        return request ? request.toJSON() : null;
+    }
+    async removeByUserId(userId) {
+        await EmailVerification.where("user_id", userId).delete();
+    }
+}

package/dist/verification/verification.service.d.ts

@@ -0,0 +1,44 @@
+import { type ICookieStore } from "@veap/kernel";
+import { type ITokenGenerator } from "../crypto/contracts";
+import { SessionService } from "../session/session.service";
+import { type EmailVerificationRecord, type IEmailVerificationRepository } from "./contracts";
+export type EmailVerificationRequestType = EmailVerificationRecord;
+export declare class EmailVerificationService {
+    private readonly verifications;
+    private readonly tokens;
+    private readonly cookieStore;
+    private readonly sessions;
+    constructor(verifications: IEmailVerificationRepository, tokens: ITokenGenerator, cookieStore: ICookieStore, sessions: SessionService);
+    /**
+     * Register Email Verification as a Core Security Requirement.
+     */
+    initEmailVerification(): Promise<void>;
+    /**
+     * Retrieves a specific email verification request for a user.
+     */
+    getUserEmailVerificationRequest(userId: string, id: string): Promise<EmailVerificationRequestType | null>;
+    /**
+     * Creates a new email verification request, deleting any existing one for the user.
+     */
+    createEmailVerificationRequest(userId: string, email: string): Promise<EmailVerificationRequestType>;
+    /**
+     * Deletes all email verification requests for a user.
+     */
+    deleteUserEmailVerificationRequest(userId: string): Promise<void>;
+    /**
+     * Sends a verification email with the OTP code.
+     */
+    sendVerificationEmail(email: string, code: string): Promise<void>;
+    /**
+     * Sets the email verification request ID in a cookie.
+     */
+    setEmailVerificationRequestCookie(request: EmailVerificationRequestType): Promise<void>;
+    /**
+     * Removes the email verification request cookie.
+     */
+    deleteEmailVerificationRequestCookie(): Promise<void>;
+    /**
+     * Retrieves the current email verification request based on session and cookie.
+     */
+    getUserEmailVerificationRequestFromRequest(): Promise<EmailVerificationRequestType | null>;
+}

package/dist/verification/verification.service.js

@@ -0,0 +1,120 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { COOKIE_STORE, Inject, Injectable, } from "@veap/kernel";
+import { sendVerifyEmail } from "@veap/mail";
+import { addMinutes } from "date-fns";
+import { registerSecurityRequirement } from "../common/logic";
+import { TOKEN_GENERATOR } from "../crypto/contracts";
+import { SessionService } from "../session/session.service";
+import { EMAIL_VERIFICATION_REPOSITORY, } from "./contracts";
+let EmailVerificationService = class EmailVerificationService {
+    verifications;
+    tokens;
+    cookieStore;
+    sessions;
+    constructor(verifications, tokens, cookieStore, sessions) {
+        this.verifications = verifications;
+        this.tokens = tokens;
+        this.cookieStore = cookieStore;
+        this.sessions = sessions;
+    }
+    /**
+     * Register Email Verification as a Core Security Requirement.
+     */
+    async initEmailVerification() {
+        registerSecurityRequirement(async (_session, user) => {
+            if (!user.emailVerifiedAt) {
+                return {
+                    satisfied: false,
+                    redirect: "/verify-email?unverified",
+                };
+            }
+            return { satisfied: true };
+        });
+    }
+    /**
+     * Retrieves a specific email verification request for a user.
+     */
+    async getUserEmailVerificationRequest(userId, id) {
+        return await this.verifications.findForUser(userId, id);
+    }
+    /**
+     * Creates a new email verification request, deleting any existing one for the user.
+     */
+    async createEmailVerificationRequest(userId, email) {
+        await this.deleteUserEmailVerificationRequest(userId);
+        return await this.verifications.create({
+            userId,
+            code: this.tokens.generateOtp(),
+            email,
+            expiresAt: new Date(addMinutes(new Date(), 15)),
+        });
+    }
+    /**
+     * Deletes all email verification requests for a user.
+     */
+    async deleteUserEmailVerificationRequest(userId) {
+        await this.verifications.removeByUserId(userId);
+    }
+    /**
+     * Sends a verification email with the OTP code.
+     */
+    async sendVerificationEmail(email, code) {
+        await sendVerifyEmail(email, code);
+    }
+    /**
+     * Sets the email verification request ID in a cookie.
+     */
+    async setEmailVerificationRequestCookie(request) {
+        await this.cookieStore.set("email_verification", request.id, {
+            httpOnly: true,
+            path: "/",
+            secure: process.env.NODE_ENV === "production",
+            sameSite: "lax",
+            expires: request.expiresAt,
+        });
+    }
+    /**
+     * Removes the email verification request cookie.
+     */
+    async deleteEmailVerificationRequestCookie() {
+        await this.cookieStore.delete("email_verification");
+    }
+    /**
+     * Retrieves the current email verification request based on session and cookie.
+     */
+    async getUserEmailVerificationRequestFromRequest() {
+        const { user } = await this.sessions.getCurrentSession();
+        if (!user) {
+            return null;
+        }
+        const id = await this.cookieStore.get("email_verification");
+        if (!id) {
+            return null;
+        }
+        const request = await this.getUserEmailVerificationRequest(user.id, id);
+        if (!request) {
+            await this.deleteEmailVerificationRequestCookie();
+        }
+        return request;
+    }
+};
+EmailVerificationService = __decorate([
+    Injectable(),
+    __param(0, Inject(EMAIL_VERIFICATION_REPOSITORY)),
+    __param(1, Inject(TOKEN_GENERATOR)),
+    __param(2, Inject(COOKIE_STORE)),
+    __param(3, Inject(SessionService)),
+    __metadata("design:paramtypes", [Object, Object, Object, SessionService])
+], EmailVerificationService);
+export { EmailVerificationService };

package/package.json

@@ -1,6 +1,90 @@
 {
   "name": "@veap/auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Authentication, session management, RBAC, and crypto adapters for Veap",
+  "bugs": "https://github.com/veapjs/veap-auth/issues",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/veapjs/veap-auth.git"
+  },
+  "type": "module",
+  "license": "MIT",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "default": "./dist/client/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    },
+    "./actions": {
+      "types": "./dist/actions/index.d.ts",
+      "default": "./dist/actions/index.js"
+    },
+    "./models": {
+      "types": "./dist/models.d.ts",
+      "default": "./dist/models.js"
+    },
+    "./migrations": {
+      "types": "./dist/migrations/index.d.ts",
+      "default": "./dist/migrations/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "clean": "rimraf dist",
+    "build": "rimraf dist && tsc",
+    "dev": "tsc --watch",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@oslojs/binary": "^1.0.0",
+    "@oslojs/crypto": "^1.0.1",
+    "@oslojs/encoding": "^1.1.0",
+    "@veap/database": "^0.1.0",
+    "@veap/kernel": "^0.1.0",
+    "@veap/mail": "^0.1.0",
+    "bcryptjs": "^3.0.3",
+    "date-fns": "^4.4.0",
+    "zod": "^3.24.2"
+  },
+  "peerDependencies": {
+    "react": "^19",
+    "react-dom": "^19",
+    "swr": "^2.2.5"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    },
+    "react-dom": {
+      "optional": true
+    },
+    "swr": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/bcryptjs": "^2.4.6",
+    "@types/node": "^22.20.2",
+    "@types/react": "^19.1.9",
+    "@types/react-dom": "^19.1.7",
+    "better-sqlite3": "^13.0.3",
+    "knex": "^3.1.0",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
+    "rimraf": "^6.1.3",
+    "typescript": "6.0.3",
+    "vitest": "^5.0.0"
+  }
+}