@veap/auth 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Damian Miller
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,168 @@
-# Temporary Holding Version
+[![CI](https://github.com/veapjs/veap-auth/actions/workflows/CI.yml/badge.svg)](https://github.com/veapjs/veap-auth/actions/workflows/CI.yml)
+[![Release](https://github.com/veapjs/veap-auth/actions/workflows/RELEASE.yml/badge.svg)](https://github.com/veapjs/veap-auth/actions/workflows/RELEASE.yml)
+[![Version](https://img.shields.io/npm/v/@veap/auth?style=flat&colorA=000000&colorB=000000)](https://www.npmjs.com/package/@veap/auth)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @veap/auth
+
+Production-ready authentication, session management, RBAC, and cryptographic
+adapters for Veap and Next.js applications.
+
+## Overview
+
+`@veap/auth` provides a modular authentication engine adhering to clean
+architecture principles modeled after `@veap/kernel`. It decouples domain entities (users, sessions, roles,
+permissions) and ports (hasher, token generator, cipher) into dedicated functional modules. It includes ready-to-use Next.js Server
+Actions, automatic database migrations, and Active Record adapters powered by
+`@veap/database`.
+
+## Architecture & Structure
+
+Following the same modular, domain-driven structure as `@veap/kernel`:
+
+```text
+src/
+├── actions/        # Next.js Server Actions (signIn, signUp, signOut, etc.)
+├── client/         # React hooks and context (useUser, AuthProvider)
+├── common/         # Common context, routes, registry, and augmentation
+├── crypto/         # Cryptography ports and adapters (bcrypt, AES, tokens)
+├── migrations/     # Database migration definitions
+├── models/         # ActiveRecord database models (User, Role, Session, etc.)
+├── passwords/      # Password reset repositories, service, and facades
+├── providers/      # AuthServiceProvider and bootstrap setup
+├── rbac/           # Role-based access control repositories, service, and facades
+├── session/        # Session repository, SessionService, and AuthService
+├── users/          # User repository, UserService, and facades
+├── validation/     # Zod input validation schemas
+├── index.ts        # Main barrel entrypoint
+├── server.ts       # Server-only utilities entrypoint
+├── client.tsx      # React client entrypoint
+├── actions.ts      # Server actions entrypoint
+└── models.ts       # ActiveRecord models entrypoint
+```
+
+## Features
+
+- **Multi-layer authentication**: Secure password hashing with bcrypt, session
+  token generation via `@oslojs/crypto`, and AES secret encryption.
+- **Session management**: Database-backed session persistence with automatic
+  token hashing, TTL expiry, and sliding-window extension.
+- **Role-Based Access Control (RBAC)**: Fine-grained roles and permissions
+  associated with users through many-to-many database relations.
+- **Next.js Server Actions**: First-class `signIn`, `signUp`, `signOut`, and
+  `getCurrentSession` actions returning typed `Result` objects.
+- **Automated migrations**: Self-bootstrapping migrations for users, sessions,
+  roles, permissions, password reset requests, and email verification.
+- **Client & React hooks**: Lightweight `useUser()` hook and `AuthProvider`
+  for responsive user sessions.
+
+## Installation
+
+```bash
+# Using bun
+bun add @veap/auth @veap/kernel @veap/database
+
+# Using pnpm
+pnpm add @veap/auth @veap/kernel @veap/database
+
+# Using npm
+npm install @veap/auth @veap/kernel @veap/database
+```
+
+## Usage
+
+### Register in Application Builder
+
+Include `AuthServiceProvider` in your application composition root:
+
+```ts
+import { Application } from "@veap/kernel";
+import { DatabaseServiceProvider } from "@veap/database";
+import { AuthServiceProvider } from "@veap/auth";
+
+export const app = Application.configure()
+  .use(DatabaseServiceProvider)
+  .use(
+    new AuthServiceProvider(undefined, {
+      autoMigrate: true, // Automatically applies auth tables on boot
+    }),
+  )
+  .create();
+```
+
+### Sign In & Sign Out with Server Actions
+
+Authenticate users in server components or server actions:
+
+```ts
+"use server";
+
+import { signIn, signOut, getCurrentSession } from "@veap/auth";
+
+export async function handleLogin(formData: FormData) {
+  const email = formData.get("email") as string;
+  const password = formData.get("password") as string;
+
+  const result = await signIn({ email, password });
+
+  if (!result.success) {
+    return { error: result.error?.message || "Invalid credentials" };
+  }
+
+  return { user: result.data.user };
+}
+
+export async function handleLogout() {
+  await signOut();
+}
+
+export async function getActiveUser() {
+  const session = await getCurrentSession();
+  return session?.user ?? null;
+}
+```
+
+### Querying Auth Models Directly
+
+Interact with Active Record models provided by `@veap/auth/models`:
+
+```ts
+import { User, Role } from "@veap/auth/models";
+import { hashPassword } from "@veap/auth/server";
+
+// Create a new user with hashed credentials
+const user = await User.create({
+  name: "Jane Doe",
+  email: "jane@example.com",
+  password: await hashPassword("securePassword123"),
+  recovery_code: Buffer.from("recovery-key-bytes"),
+});
+
+// Check roles and permissions
+const adminRole = await Role.query().where("name", "admin").first();
+if (adminRole) {
+  await user.roles().attach(adminRole.id);
+}
+```
+
+## Subpath Exports
+
+| Export Path             | Content                                                               |
+| ----------------------- | --------------------------------------------------------------------- |
+| `@veap/auth`            | Core actions (`signIn`, `signOut`), provider, context, and schemas    |
+| `@veap/auth/client`     | React client components, context, and `useUser` hook                  |
+| `@veap/auth/server`     | Server cryptographic utilities (`hashPassword`, `verifyPasswordHash`) |
+| `@veap/auth/actions`    | Next.js Server Actions directly exportable for actions boundaries     |
+| `@veap/auth/models`     | Active Record models (`User`, `Session`, `Role`, `Permission`)        |
+| `@veap/auth/migrations` | Knex migrations for authentication tables                             |
+
+## Documentation
+
+For full guides and authentication customization, visit:
+
+- **Official Website**: [https://veap.pl](https://veap.pl)
+- **Documentation**: [https://veap.pl/docs](https://veap.pl/docs)
+- **GitHub Repository**: [https://github.com/veapjs/veap-auth](https://github.com/veapjs/veap-auth)
+
+## License
+
+MIT

package/dist/actions/auth.actions.d.ts

@@ -0,0 +1,23 @@
+import { type Result } from "@veap/kernel";
+import type { AuthResponse, SessionFlags } from "../common/index.js";
+import type { LoginInput, RegisterInput } from "../validation/index.js";
+export declare function signIn(data: LoginInput): Promise<Result<AuthResponse>>;
+export declare function signUp(data: RegisterInput): Promise<{
+    success: false;
+    error: import("@veap/kernel").AppErrorJson;
+    data?: never;
+} | {
+    success: true;
+    data: AuthResponse;
+    error?: never;
+}>;
+export declare function finalizeLogin(userId: string, flags: SessionFlags): Promise<{
+    success: false;
+    error: import("@veap/kernel").AppErrorJson;
+    data?: never;
+} | {
+    success: true;
+    data: AuthResponse;
+    error?: never;
+}>;
+export declare function signOut(): Promise<Result<void>>;

package/dist/actions/auth.actions.js

@@ -0,0 +1,40 @@
+"use server";
+import { app, handleActionError, ok } from "@veap/kernel";
+import { AuthService } from "../session/auth.service.js";
+export async function signIn(data) {
+    try {
+        const authService = await app(AuthService);
+        return ok(await authService.signIn(data));
+    }
+    catch (e) {
+        return handleActionError(e, "Auth:SignIn");
+    }
+}
+export async function signUp(data) {
+    try {
+        const authService = await app(AuthService);
+        return ok(await authService.signUp(data));
+    }
+    catch (e) {
+        return handleActionError(e, "Auth:SignUp");
+    }
+}
+export async function finalizeLogin(userId, flags) {
+    try {
+        const authService = await app(AuthService);
+        return ok(await authService.finalizeLogin(userId, flags));
+    }
+    catch (e) {
+        return handleActionError(e, "Auth:FinalizeLogin");
+    }
+}
+export async function signOut() {
+    try {
+        const authService = await app(AuthService);
+        await authService.signOut();
+        return ok(undefined);
+    }
+    catch (e) {
+        return handleActionError(e, "Auth:SignOut");
+    }
+}

package/dist/actions/index.d.ts

@@ -0,0 +1 @@
+export * from "./auth.actions.js";

package/dist/actions/index.js

@@ -0,0 +1 @@
+export * from "./auth.actions.js";

package/dist/client/auth.context.d.ts

@@ -0,0 +1,29 @@
+import { type ReactNode } from "react";
+import { type AuthRoutesConfig } from "../common/routes.js";
+import type { AuthSession } from "../common/types.js";
+export interface AuthContextValue {
+    user: AuthSession["user"] | null | undefined;
+    session: AuthSession["session"] | null | undefined;
+    prefix: string;
+    isLoading: boolean;
+    refetchUser: () => Promise<void>;
+    routes: AuthRoutesConfig;
+}
+export declare const AuthContext: import("react").Context<AuthContextValue | undefined>;
+export declare const PathPrefixContext: import("react").Context<string>;
+export interface AuthProviderProps {
+    children: ReactNode;
+    initialSession?: AuthSession | null;
+    prefix?: string;
+    routes?: AuthRoutesConfig;
+}
+export declare function AuthProvider({ children, initialSession, prefix, routes, }: AuthProviderProps): import("react").JSX.Element;
+/**
+ * Hook to access configured authentication route URLs on the client.
+ */
+export declare function useAuthRoutes(): AuthRoutesConfig;
+/**
+ * Hook for user management on the client.
+ * @returns Returns an object with user data and functions for managing it.
+ */
+export declare function useUser(): AuthContextValue;

package/dist/client/auth.context.js

@@ -0,0 +1,64 @@
+"use client";
+import { jsx as _jsx } from "react/jsx-runtime";
+import { createContext, useContext, useEffect, useState, } from "react";
+import { DEFAULT_AUTH_ROUTES, } from "../common/routes.js";
+export const AuthContext = createContext(undefined);
+export const PathPrefixContext = createContext("/app");
+export function AuthProvider({ children, initialSession, prefix = "/app", routes = DEFAULT_AUTH_ROUTES, }) {
+    const [user, setUser] = useState(initialSession?.user ?? null);
+    const [session, setSession] = useState(initialSession?.session ?? null);
+    const [isLoading, setIsLoading] = useState(!initialSession);
+    const refetchUser = async () => {
+        try {
+            setIsLoading(true);
+            const res = await fetch("/api/auth/me", { credentials: "same-origin" });
+            if (res.ok) {
+                const data = await res.json();
+                setUser(data.user);
+                setSession(data.session);
+            }
+            else {
+                setUser(null);
+                setSession(null);
+            }
+        }
+        catch {
+            setUser(null);
+            setSession(null);
+        }
+        finally {
+            setIsLoading(false);
+        }
+    };
+    useEffect(() => {
+        if (!initialSession) {
+            refetchUser();
+        }
+    }, [initialSession]);
+    return (_jsx(AuthContext.Provider, { value: {
+            user,
+            session,
+            prefix,
+            isLoading,
+            refetchUser,
+            routes,
+        }, children: _jsx(PathPrefixContext.Provider, { value: prefix, children: children }) }));
+}
+/**
+ * Hook to access configured authentication route URLs on the client.
+ */
+export function useAuthRoutes() {
+    const context = useContext(AuthContext);
+    return context?.routes ?? DEFAULT_AUTH_ROUTES;
+}
+/**
+ * Hook for user management on the client.
+ * @returns Returns an object with user data and functions for managing it.
+ */
+export function useUser() {
+    const context = useContext(AuthContext);
+    if (!context) {
+        throw new Error("useUser must be used within AuthProvider");
+    }
+    return { ...context };
+}

package/dist/client/index.d.ts

@@ -0,0 +1 @@
+export * from "./auth.context.js";

package/dist/client/index.js

@@ -0,0 +1 @@
+export * from "./auth.context.js";

package/dist/common/augment.d.ts

@@ -0,0 +1,26 @@
+import { AuthCallbackRegistry } from "./registry.js";
+import type { FullUser, PasswordResetSession, Session, User } from "./types.js";
+/**
+ * REGISTRIES FOR MODULAR EXTENSIONS
+ */
+export type IdentityAugmenter = (user: User) => Promise<Partial<FullUser>>;
+export type SessionAugmenter = (session: Session) => Promise<Partial<Session>>;
+export type PasswordResetSessionAugmenter = (session: PasswordResetSession) => Promise<Partial<PasswordResetSession>>;
+export declare const identityAugmenters: AuthCallbackRegistry<IdentityAugmenter>;
+export declare const sessionAugmenters: AuthCallbackRegistry<SessionAugmenter>;
+export declare const passwordResetSessionAugmenters: AuthCallbackRegistry<PasswordResetSessionAugmenter>;
+export declare function registerIdentityAugmenter(augmenter: IdentityAugmenter): void;
+export declare function registerIdentityAugmenter(id: string, augmenter: IdentityAugmenter): void;
+export declare function unregisterIdentityAugmenter(idOrAugmenter: string | IdentityAugmenter): boolean;
+export declare function registerSessionAugmenter(augmenter: SessionAugmenter): void;
+export declare function registerSessionAugmenter(id: string, augmenter: SessionAugmenter): void;
+export declare function unregisterSessionAugmenter(idOrAugmenter: string | SessionAugmenter): boolean;
+export declare function registerPasswordResetSessionAugmenter(augmenter: PasswordResetSessionAugmenter): void;
+export declare function registerPasswordResetSessionAugmenter(id: string, augmenter: PasswordResetSessionAugmenter): void;
+export declare function unregisterPasswordResetSessionAugmenter(idOrAugmenter: string | PasswordResetSessionAugmenter): boolean;
+/**
+ * EXECUTION FUNCTIONS
+ */
+export declare function augmentUser(user: User, coreRbacData?: Record<string, any>): Promise<FullUser>;
+export declare function augmentSession(session: Session): Promise<Session>;
+export declare function augmentPasswordResetSession(session: PasswordResetSession): Promise<PasswordResetSession>;

package/dist/common/augment.js

@@ -0,0 +1,63 @@
+import { AuthCallbackRegistry } from "./registry.js";
+const globalForAugment = globalThis;
+export const identityAugmenters = globalForAugment.__VEAP_IDENTITY_AUGMENTERS__ ??
+    new AuthCallbackRegistry();
+export const sessionAugmenters = globalForAugment.__VEAP_SESSION_AUGMENTERS__ ??
+    new AuthCallbackRegistry();
+export const passwordResetSessionAugmenters = globalForAugment.__VEAP_PASSWORD_RESET_SESSION_AUGMENTERS__ ??
+    new AuthCallbackRegistry();
+globalForAugment.__VEAP_IDENTITY_AUGMENTERS__ = identityAugmenters;
+globalForAugment.__VEAP_SESSION_AUGMENTERS__ = sessionAugmenters;
+globalForAugment.__VEAP_PASSWORD_RESET_SESSION_AUGMENTERS__ =
+    passwordResetSessionAugmenters;
+export function registerIdentityAugmenter(idOrAugmenter, augmenter) {
+    identityAugmenters.register(idOrAugmenter, augmenter);
+}
+export function unregisterIdentityAugmenter(idOrAugmenter) {
+    return identityAugmenters.unregister(idOrAugmenter);
+}
+export function registerSessionAugmenter(idOrAugmenter, augmenter) {
+    sessionAugmenters.register(idOrAugmenter, augmenter);
+}
+export function unregisterSessionAugmenter(idOrAugmenter) {
+    return sessionAugmenters.unregister(idOrAugmenter);
+}
+export function registerPasswordResetSessionAugmenter(idOrAugmenter, augmenter) {
+    passwordResetSessionAugmenters.register(idOrAugmenter, augmenter);
+}
+export function unregisterPasswordResetSessionAugmenter(idOrAugmenter) {
+    return passwordResetSessionAugmenters.unregister(idOrAugmenter);
+}
+/**
+ * EXECUTION FUNCTIONS
+ */
+export async function augmentUser(user, coreRbacData) {
+    let currentUser = { ...user, ...(coreRbacData || {}) };
+    for (const augmenter of identityAugmenters) {
+        const data = await augmenter(currentUser);
+        currentUser = { ...currentUser, ...data };
+    }
+    return currentUser;
+}
+export async function augmentSession(session) {
+    let currentSession = { ...session };
+    for (const augmenter of sessionAugmenters) {
+        const data = await augmenter(currentSession);
+        const existingFlags = currentSession.flags || {};
+        const newFlags = data?.flags || {};
+        currentSession = {
+            ...currentSession,
+            ...data,
+            flags: { ...existingFlags, ...newFlags },
+        };
+    }
+    return currentSession;
+}
+export async function augmentPasswordResetSession(session) {
+    let currentSession = { ...session };
+    for (const augmenter of passwordResetSessionAugmenters) {
+        const data = await augmenter(currentSession);
+        currentSession = { ...currentSession, ...data };
+    }
+    return currentSession;
+}

package/dist/common/context.d.ts

@@ -0,0 +1,30 @@
+import { type AuthRoutesConfig } from "./routes.js";
+export interface AuthContext {
+    user: any;
+    session: any;
+    rbac: any;
+    passwordReset: any;
+    emailVerification: any;
+    auth: any;
+    routes?: AuthRoutesConfig;
+}
+/**
+ * Binds the resolved auth services. Called once by the composition root.
+ */
+export declare function bindAuthContext(context: AuthContext): void;
+/**
+ * Check whether auth context is currently bound.
+ */
+export declare function isAuthContextBound(): boolean;
+/**
+ * Returns the bound auth services.
+ *
+ * @throws If the auth service provider has not booted yet.
+ */
+export declare function authContext(): AuthContext & {
+    routes: AuthRoutesConfig;
+};
+/**
+ * Resolves currently configured auth routes, falling back to defaults.
+ */
+export declare function getAuthRoutes(): AuthRoutesConfig;

package/dist/common/context.js

@@ -0,0 +1,36 @@
+import { DEFAULT_AUTH_ROUTES } from "./routes.js";
+const globalForAuthContext = globalThis;
+/**
+ * Binds the resolved auth services. Called once by the composition root.
+ */
+export function bindAuthContext(context) {
+    globalForAuthContext.__VEAP_AUTH_CONTEXT__ = {
+        ...context,
+        routes: context.routes || DEFAULT_AUTH_ROUTES,
+    };
+}
+/**
+ * Check whether auth context is currently bound.
+ */
+export function isAuthContextBound() {
+    return globalForAuthContext.__VEAP_AUTH_CONTEXT__ !== undefined;
+}
+/**
+ * Returns the bound auth services.
+ *
+ * @throws If the auth service provider has not booted yet.
+ */
+export function authContext() {
+    const context = globalForAuthContext.__VEAP_AUTH_CONTEXT__;
+    if (!context) {
+        throw new Error("[Auth] Context is not bound. AuthServiceProvider must boot before the auth facades are used.");
+    }
+    return context;
+}
+/**
+ * Resolves currently configured auth routes, falling back to defaults.
+ */
+export function getAuthRoutes() {
+    const context = globalForAuthContext.__VEAP_AUTH_CONTEXT__;
+    return context?.routes || DEFAULT_AUTH_ROUTES;
+}

package/dist/common/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./augment.js";
+export * from "./context.js";
+export * from "./logic.js";
+export * from "./registry.js";
+export * from "./routes.js";
+export * from "./tokens.js";
+export * from "./types.js";

package/dist/common/index.js

@@ -0,0 +1,7 @@
+export * from "./augment.js";
+export * from "./context.js";
+export * from "./logic.js";
+export * from "./registry.js";
+export * from "./routes.js";
+export * from "./tokens.js";
+export * from "./types.js";

package/dist/common/logic.d.ts

@@ -0,0 +1,64 @@
+import { augmentSession, augmentUser, registerIdentityAugmenter, registerPasswordResetSessionAugmenter, registerSessionAugmenter, unregisterIdentityAugmenter, unregisterPasswordResetSessionAugmenter, unregisterSessionAugmenter } from "./augment.js";
+import { AuthCallbackRegistry } from "./registry.js";
+import type { AuthResponse, FullUser, Session, User, UserPermission, UserRole } from "./types.js";
+/**
+ * Registry for login validators (e.g. 2FA module)
+ */
+export type AuthValidator = (userId: string) => Promise<AuthResponse | null>;
+/**
+ * Registry for Security Requirements (e.g. checking if 2FA is needed for a session)
+ */
+export type SecurityRequirement = (session: Session, user: FullUser, 
+/**
+ * Request path the security check is running for ("/app/jobs", "/", ...).
+ * Lets a requirement exempt the route that resolves its own gate (e.g. an
+ * onboarding wizard) and prevents redirect loops.
+ */
+path?: string) => Promise<{
+    satisfied: boolean;
+    redirect?: string;
+} | null>;
+/**
+ * Registry for password reset validators (e.g. 2FA module requiring check during reset)
+ */
+export type PasswordResetValidator = (userId: string) => Promise<AuthResponse | null>;
+/**
+ * Registry for email verification validators
+ */
+export type EmailVerificationValidator = (userId: string) => Promise<AuthResponse | null>;
+export declare const authValidators: AuthCallbackRegistry<AuthValidator>;
+export declare const securityRequirements: AuthCallbackRegistry<SecurityRequirement>;
+export declare const passwordResetValidators: AuthCallbackRegistry<PasswordResetValidator>;
+export declare const emailVerificationValidators: AuthCallbackRegistry<EmailVerificationValidator>;
+export declare function registerAuthValidator(validator: AuthValidator): void;
+export declare function registerAuthValidator(id: string, validator: AuthValidator): void;
+export declare function unregisterAuthValidator(idOrValidator: string | AuthValidator): boolean;
+export declare function registerPasswordResetValidator(validator: PasswordResetValidator): void;
+export declare function registerPasswordResetValidator(id: string, validator: PasswordResetValidator): void;
+export declare function unregisterPasswordResetValidator(idOrValidator: string | PasswordResetValidator): boolean;
+export declare function registerEmailVerificationValidator(validator: EmailVerificationValidator): void;
+export declare function registerEmailVerificationValidator(id: string, validator: EmailVerificationValidator): void;
+export declare function unregisterEmailVerificationValidator(idOrValidator: string | EmailVerificationValidator): boolean;
+export { augmentSession, augmentUser, registerIdentityAugmenter, registerPasswordResetSessionAugmenter, registerSessionAugmenter, unregisterIdentityAugmenter, unregisterPasswordResetSessionAugmenter, unregisterSessionAugmenter, };
+export declare function registerSecurityRequirement(requirement: SecurityRequirement): void;
+export declare function registerSecurityRequirement(id: string, requirement: SecurityRequirement): void;
+export declare function unregisterSecurityRequirement(idOrRequirement: string | SecurityRequirement): boolean;
+export declare function runPasswordResetValidators(userId: string): Promise<AuthResponse | null>;
+export declare function runEmailVerificationValidators(userId: string): Promise<AuthResponse | null>;
+/**
+ * Checks if the current session satisfies all registered security requirements.
+ */
+export declare function checkSecurity(session: Session, user: FullUser, requiredRoles?: UserRole[], requiredPermissions?: UserPermission[], fallbackRedirect?: string, 
+/** Request path this check runs for; forwarded to modular requirements. */
+path?: string): Promise<{
+    satisfied: boolean;
+    redirect: string | undefined;
+} | {
+    satisfied: boolean;
+    redirect?: undefined;
+}>;
+/**
+ * Performs full augmentation on a user by merging core RBAC roles/permissions
+ * and running all registered modular identity augmenters.
+ */
+export declare function performFullUserAugmentation(user: User, session?: Session): Promise<FullUser>;