@veap/auth 0.0.0-stage → 0.1.1

package/dist/crypto/password.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Hashes the password using bcrypt.
+ * @param password Password to be hashed.
+ * @returns Returns the hashed password.
+ */
+export declare function hashPassword(password: string): Promise<string>;
+/**
+ * Verifies the password hash.
+ * @param hash bcrypt hash.
+ * @param password Password for comparison.
+ * @returns Returns true if the password is correct, false otherwise.
+ */
+export declare function verifyPasswordHash(hash: string, password: string): Promise<boolean>;
+/**
+ * Validates password strength.
+ * @param password Password to validate.
+ * @returns Returns true if the password meets complexity requirements.
+ */
+export declare function verifyPasswordStrength(password: string): Promise<boolean>;

package/dist/crypto/password.js

@@ -0,0 +1,27 @@
+import bcrypt from "bcryptjs";
+/**
+ * Hashes the password using bcrypt.
+ * @param password Password to be hashed.
+ * @returns Returns the hashed password.
+ */
+export async function hashPassword(password) {
+    const saltRounds = 10;
+    return await bcrypt.hash(password, saltRounds);
+}
+/**
+ * Verifies the password hash.
+ * @param hash bcrypt hash.
+ * @param password Password for comparison.
+ * @returns Returns true if the password is correct, false otherwise.
+ */
+export async function verifyPasswordHash(hash, password) {
+    return await bcrypt.compare(password, hash);
+}
+/**
+ * Validates password strength.
+ * @param password Password to validate.
+ * @returns Returns true if the password meets complexity requirements.
+ */
+export async function verifyPasswordStrength(password) {
+    return password.length >= 8 && password.length <= 255;
+}

package/dist/crypto/token-generator.d.ts

@@ -0,0 +1,10 @@
+import type { ITokenGenerator } from "./contracts.js";
+/**
+ * Oslo-based adapter for the ITokenGenerator port.
+ */
+export declare class OsloTokenGenerator implements ITokenGenerator {
+    generateOtp(length?: number): string;
+    generateRecoveryCode(): string;
+    generateSessionToken(): string;
+    hashToken(token: string): string;
+}

package/dist/crypto/token-generator.js

@@ -0,0 +1,25 @@
+import { sha256 } from "@oslojs/crypto/sha2";
+import { encodeBase32LowerCaseNoPadding, encodeBase32UpperCaseNoPadding, encodeHexLowerCase, } from "@oslojs/encoding";
+/**
+ * Oslo-based adapter for the ITokenGenerator port.
+ */
+export class OsloTokenGenerator {
+    generateOtp(length = 6) {
+        const bytes = new Uint8Array(5);
+        crypto.getRandomValues(bytes);
+        return encodeBase32UpperCaseNoPadding(bytes).substring(0, length);
+    }
+    generateRecoveryCode() {
+        const recoveryCodeBytes = new Uint8Array(10);
+        crypto.getRandomValues(recoveryCodeBytes);
+        return encodeBase32UpperCaseNoPadding(recoveryCodeBytes);
+    }
+    generateSessionToken() {
+        const tokenBytes = new Uint8Array(20);
+        crypto.getRandomValues(tokenBytes);
+        return encodeBase32LowerCaseNoPadding(tokenBytes).toLowerCase();
+    }
+    hashToken(token) {
+        return encodeHexLowerCase(sha256(new TextEncoder().encode(token)));
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export * from "./actions/index.js";
+export { AuthProvider, useAuthRoutes, useUser } from "./client/index.js";
+export * from "./common/index.js";
+export * from "./crypto/index.js";
+export * from "./passwords/index.js";
+export * from "./providers/index.js";
+export * from "./rbac/index.js";
+export * from "./session/index.js";
+export * from "./users/index.js";
+export * from "./validation/index.js";
+export * from "./verification/index.js";

package/dist/index.js

@@ -0,0 +1,11 @@
+export * from "./actions/index.js";
+export { AuthProvider, useAuthRoutes, useUser } from "./client/index.js";
+export * from "./common/index.js";
+export * from "./crypto/index.js";
+export * from "./passwords/index.js";
+export * from "./providers/index.js";
+export * from "./rbac/index.js";
+export * from "./session/index.js";
+export * from "./users/index.js";
+export * from "./validation/index.js";
+export * from "./verification/index.js";

package/dist/migrations/0001_create_auth_tables.d.ts

@@ -0,0 +1,4 @@
+import type { Schema } from "@veap/database";
+export declare const name = "0001_create_auth_tables";
+export declare function up(_db: any, schema: Schema): Promise<void>;
+export declare function down(_db: any, schema: Schema): Promise<void>;

package/dist/migrations/0001_create_auth_tables.js

@@ -0,0 +1,122 @@
+export const name = "0001_create_auth_tables";
+export async function up(_db, schema) {
+    // 1. Users table
+    await schema.createTable("users", (table) => {
+        table.text("id").primaryKey();
+        table.text("email").notNull().unique();
+        table.text("name").notNull();
+        table.text("password");
+        table.text("image");
+        table.bytea("recovery_code").notNull();
+        table.timestamp("email_verified_at");
+        table.timestamp("created_at").notNull().defaultNow();
+        table.timestamp("updated_at");
+    });
+    // 2. Roles table
+    await schema.createTable("roles", (table) => {
+        table.text("id").primaryKey();
+        table.text("name").notNull().unique();
+        table.text("description");
+    });
+    // 3. Permissions table
+    await schema.createTable("permissions", (table) => {
+        table.text("id").primaryKey();
+        table.text("name").notNull().unique();
+        table.text("description");
+    });
+    // 4. Users to Roles (Pivot)
+    await schema.createTable("users_to_roles", (table) => {
+        table
+            .text("user_id")
+            .notNull()
+            .references("users", "id")
+            .onDelete("CASCADE");
+        table
+            .text("role_id")
+            .notNull()
+            .references("roles", "id")
+            .onDelete("CASCADE");
+        table.primary(["user_id", "role_id"]);
+    });
+    // 5. Users to Permissions (Pivot)
+    await schema.createTable("users_to_permissions", (table) => {
+        table
+            .text("user_id")
+            .notNull()
+            .references("users", "id")
+            .onDelete("CASCADE");
+        table
+            .text("permission_id")
+            .notNull()
+            .references("permissions", "id")
+            .onDelete("CASCADE");
+        table.primary(["user_id", "permission_id"]);
+    });
+    // 6. Roles to Permissions (Pivot)
+    await schema.createTable("roles_to_permissions", (table) => {
+        table
+            .text("role_id")
+            .notNull()
+            .references("roles", "id")
+            .onDelete("CASCADE");
+        table
+            .text("permission_id")
+            .notNull()
+            .references("permissions", "id")
+            .onDelete("CASCADE");
+        table.primary(["role_id", "permission_id"]);
+    });
+    // 7. Sessions table
+    await schema.createTable("sessions", (table) => {
+        table.text("id").primaryKey();
+        table
+            .text("user_id")
+            .notNull()
+            .references("users", "id")
+            .onDelete("CASCADE");
+        table.json("metadata");
+        table.timestamp("expires_at").notNull();
+        table.timestamp("created_at").notNull().defaultNow();
+        table.timestamp("updated_at");
+    });
+    // 8. Email Verification Requests
+    await schema.createTable("verification_requests", (table) => {
+        table.text("id").primaryKey();
+        table.text("email").notNull();
+        table.text("code").notNull();
+        table
+            .text("user_id")
+            .notNull()
+            .references("users", "id")
+            .onDelete("CASCADE");
+        table.timestamp("expires_at").notNull();
+        table.timestamp("created_at").notNull().defaultNow();
+        table.timestamp("updated_at");
+    });
+    // 9. Password Reset Sessions
+    await schema.createTable("reset_sessions", (table) => {
+        table.text("id").primaryKey();
+        table.text("email").notNull();
+        table.text("code").notNull();
+        table.boolean("email_verified").default(false);
+        table
+            .text("user_id")
+            .notNull()
+            .references("users", "id")
+            .onDelete("CASCADE");
+        table.timestamp("expires_at").notNull();
+        table.timestamp("created_at").notNull().defaultNow();
+        table.timestamp("updated_at");
+    });
+}
+export async function down(_db, schema) {
+    await schema.dropTable("reset_sessions");
+    await schema.dropTable("verification_requests");
+    await schema.dropTable("sessions");
+    await schema.dropTable("roles_to_permissions");
+    await schema.dropTable("users_to_permissions");
+    await schema.dropTable("users_to_roles");
+    await schema.dropTable("permissions");
+    await schema.dropTable("roles");
+    await schema.dropTable("users");
+}

package/dist/migrations/index.d.ts

@@ -0,0 +1,4 @@
+import * as m0001 from "./0001_create_auth_tables.js";
+export declare const authMigrations: (typeof m0001)[];
+export declare function runAuthMigrations(): Promise<void>;
+export default authMigrations;

package/dist/migrations/index.js

@@ -0,0 +1,7 @@
+import { runMigrations } from "@veap/database";
+import * as m0001 from "./0001_create_auth_tables.js";
+export const authMigrations = [m0001];
+export async function runAuthMigrations() {
+    await runMigrations("auth", authMigrations);
+}
+export default authMigrations;

package/dist/models/EmailVerification.d.ts

@@ -0,0 +1,23 @@
+import { type CastType, Model } from "@veap/database";
+import { User } from "./User.js";
+export interface EmailVerificationAttributes {
+    id: string;
+    email: string;
+    code: string;
+    userId: string;
+    user_id?: string;
+    expiresAt: Date;
+    expires_at?: Date;
+    createdAt?: Date;
+    created_at?: Date;
+    updatedAt?: Date | null;
+    updated_at?: Date | null;
+}
+export declare class EmailVerification extends Model<EmailVerificationAttributes> {
+    static table: string;
+    static casts: Record<string, CastType>;
+    /**
+     * Associated user relation.
+     */
+    user(): import("@veap/database").BelongsTo<this, User>;
+}

package/dist/models/EmailVerification.js

@@ -0,0 +1,19 @@
+import { Model } from "@veap/database";
+import { User } from "./User.js";
+export class EmailVerification extends Model {
+    static table = "verification_requests";
+    static casts = {
+        expiresAt: "datetime",
+        expires_at: "datetime",
+        createdAt: "datetime",
+        created_at: "datetime",
+        updatedAt: "datetime",
+        updated_at: "datetime",
+    };
+    /**
+     * Associated user relation.
+     */
+    user() {
+        return this.belongsTo(User, "user_id");
+    }
+}

package/dist/models/PasswordResetSession.d.ts

@@ -0,0 +1,25 @@
+import { type CastType, Model } from "@veap/database";
+import { User } from "./User.js";
+export interface PasswordResetSessionAttributes {
+    id: string;
+    email: string;
+    code: string;
+    emailVerified?: boolean;
+    email_verified?: boolean;
+    userId: string;
+    user_id?: string;
+    expiresAt: Date;
+    expires_at?: Date;
+    createdAt?: Date;
+    created_at?: Date;
+    updatedAt?: Date | null;
+    updated_at?: Date | null;
+}
+export declare class PasswordResetSession extends Model<PasswordResetSessionAttributes> {
+    static table: string;
+    static casts: Record<string, CastType>;
+    /**
+     * Associated user relation.
+     */
+    user(): import("@veap/database").BelongsTo<this, User>;
+}

package/dist/models/PasswordResetSession.js

@@ -0,0 +1,21 @@
+import { Model } from "@veap/database";
+import { User } from "./User.js";
+export class PasswordResetSession extends Model {
+    static table = "reset_sessions";
+    static casts = {
+        emailVerified: "boolean",
+        email_verified: "boolean",
+        expiresAt: "datetime",
+        expires_at: "datetime",
+        createdAt: "datetime",
+        created_at: "datetime",
+        updatedAt: "datetime",
+        updated_at: "datetime",
+    };
+    /**
+     * Associated user relation.
+     */
+    user() {
+        return this.belongsTo(User, "user_id");
+    }
+}

package/dist/models/Permission.d.ts

@@ -0,0 +1,20 @@
+import { Model } from "@veap/database";
+import { Role } from "./Role.js";
+import { User } from "./User.js";
+export interface PermissionAttributes {
+    id: string;
+    name: string;
+    description?: string | null;
+}
+export declare class Permission extends Model<PermissionAttributes> {
+    static table: string;
+    static timestamps: boolean;
+    /**
+     * Roles that have this permission.
+     */
+    roles(): import("@veap/database").BelongsToMany<this, Role>;
+    /**
+     * Users that have this permission directly.
+     */
+    users(): import("@veap/database").BelongsToMany<this, User>;
+}

package/dist/models/Permission.js

@@ -0,0 +1,19 @@
+import { Model } from "@veap/database";
+import { Role } from "./Role.js";
+import { User } from "./User.js";
+export class Permission extends Model {
+    static table = "permissions";
+    static timestamps = false;
+    /**
+     * Roles that have this permission.
+     */
+    roles() {
+        return this.belongsToMany(Role, "roles_to_permissions", "permission_id", "role_id", "id", "id");
+    }
+    /**
+     * Users that have this permission directly.
+     */
+    users() {
+        return this.belongsToMany(User, "users_to_permissions", "permission_id", "user_id", "id", "id");
+    }
+}

package/dist/models/Role.d.ts

@@ -0,0 +1,20 @@
+import { Model } from "@veap/database";
+import { Permission } from "./Permission.js";
+import { User } from "./User.js";
+export interface RoleAttributes {
+    id: string;
+    name: string;
+    description?: string | null;
+}
+export declare class Role extends Model<RoleAttributes> {
+    static table: string;
+    static timestamps: boolean;
+    /**
+     * Users assigned to this role.
+     */
+    users(): import("@veap/database").BelongsToMany<this, User>;
+    /**
+     * Permissions granted to this role.
+     */
+    permissions(): import("@veap/database").BelongsToMany<this, Permission>;
+}

package/dist/models/Role.js

@@ -0,0 +1,19 @@
+import { Model } from "@veap/database";
+import { Permission } from "./Permission.js";
+import { User } from "./User.js";
+export class Role extends Model {
+    static table = "roles";
+    static timestamps = false;
+    /**
+     * Users assigned to this role.
+     */
+    users() {
+        return this.belongsToMany(User, "users_to_roles", "role_id", "user_id", "id", "id");
+    }
+    /**
+     * Permissions granted to this role.
+     */
+    permissions() {
+        return this.belongsToMany(Permission, "roles_to_permissions", "role_id", "permission_id", "id", "id");
+    }
+}

package/dist/models/Session.d.ts

@@ -0,0 +1,22 @@
+import { type CastType, Model } from "@veap/database";
+import { User } from "./User.js";
+export interface SessionAttributes {
+    id: string;
+    userId?: string;
+    user_id?: string;
+    metadata?: Record<string, any> | null;
+    expiresAt: Date;
+    expires_at?: Date;
+    createdAt?: Date;
+    created_at?: Date;
+    updatedAt?: Date | null;
+    updated_at?: Date | null;
+}
+export declare class Session extends Model<SessionAttributes> {
+    static table: string;
+    static casts: Record<string, CastType>;
+    /**
+     * Session owner user relation.
+     */
+    user(): import("@veap/database").BelongsTo<this, User>;
+}

package/dist/models/Session.js

@@ -0,0 +1,21 @@
+import { Model } from "@veap/database";
+import { User } from "./User.js";
+export class Session extends Model {
+    static table = "sessions";
+    static casts = {
+        metadata: "json",
+        expiresAt: "datetime",
+        expires_at: "datetime",
+        createdAt: "datetime",
+        created_at: "datetime",
+        updatedAt: "datetime",
+        updated_at: "datetime",
+    };
+    /**
+     * Session owner user relation.
+     */
+    user() {
+        const fk = this.getAttribute("user_id") !== undefined ? "user_id" : "userId";
+        return this.belongsTo(User, fk);
+    }
+}

package/dist/models/User.d.ts

@@ -0,0 +1,32 @@
+import { type CastType, Model } from "@veap/database";
+import { Permission } from "./Permission.js";
+import { Role } from "./Role.js";
+import { Session } from "./Session.js";
+export interface UserAttributes {
+    id: string;
+    email: string;
+    name: string;
+    password?: string | null;
+    image?: string | null;
+    recovery_code?: any;
+    emailVerifiedAt?: Date | null;
+    createdAt?: Date;
+    updatedAt?: Date | null;
+}
+export declare class User extends Model<UserAttributes> {
+    static table: string;
+    static hidden: string[];
+    static casts: Record<string, CastType>;
+    /**
+     * User sessions relation.
+     */
+    sessions(): import("@veap/database").HasMany<this, Session>;
+    /**
+     * User roles relation via users_to_roles pivot table.
+     */
+    roles(): import("@veap/database").BelongsToMany<this, Role>;
+    /**
+     * User direct permissions relation via users_to_permissions pivot table.
+     */
+    permissions(): import("@veap/database").BelongsToMany<this, Permission>;
+}

package/dist/models/User.js

@@ -0,0 +1,31 @@
+import { Model } from "@veap/database";
+import { Permission } from "./Permission.js";
+import { Role } from "./Role.js";
+import { Session } from "./Session.js";
+export class User extends Model {
+    static table = "users";
+    static hidden = ["password", "recovery_code"];
+    static casts = {
+        emailVerifiedAt: "datetime",
+        createdAt: "datetime",
+        updatedAt: "datetime",
+    };
+    /**
+     * User sessions relation.
+     */
+    sessions() {
+        return this.hasMany(Session, "user_id");
+    }
+    /**
+     * User roles relation via users_to_roles pivot table.
+     */
+    roles() {
+        return this.belongsToMany(Role, "users_to_roles", "user_id", "role_id", "id", "id");
+    }
+    /**
+     * User direct permissions relation via users_to_permissions pivot table.
+     */
+    permissions() {
+        return this.belongsToMany(Permission, "users_to_permissions", "user_id", "permission_id", "id", "id");
+    }
+}

package/dist/models/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./EmailVerification.js";
+export * from "./PasswordResetSession.js";
+export * from "./Permission.js";
+export * from "./Role.js";
+export * from "./Session.js";
+export * from "./User.js";

package/dist/models/index.js

@@ -0,0 +1,6 @@
+export * from "./EmailVerification.js";
+export * from "./PasswordResetSession.js";
+export * from "./Permission.js";
+export * from "./Role.js";
+export * from "./Session.js";
+export * from "./User.js";

package/dist/models.d.ts

@@ -0,0 +1 @@
+export * from "./models/index.js";

package/dist/models.js

@@ -0,0 +1 @@
+export * from "./models/index.js";

package/dist/passwords/contracts.d.ts

@@ -0,0 +1,28 @@
+import type { PasswordResetAuthSession, PasswordResetSession } from "../common/index.js";
+export type { PasswordResetAuthSession, PasswordResetSession };
+/** A password reset session together with its owner. */
+export interface PasswordResetWithUser {
+    session: PasswordResetSession;
+    user: Record<string, any>;
+}
+export interface CreatePasswordResetRecord {
+    id: string;
+    userId: string;
+    email: string;
+    code: string;
+    expiresAt: Date;
+}
+/** Password reset session persistence port. */
+export interface IPasswordResetRepository {
+    create(record: CreatePasswordResetRecord): Promise<PasswordResetSession>;
+    /**
+     * Returns the reset session with its owner eager-loaded, or `null` when
+     * either of them is missing.
+     */
+    findWithUser(id: string): Promise<PasswordResetWithUser | null>;
+    setEmailVerified(id: string): Promise<void>;
+    remove(id: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
+}
+/** Injection token for the password reset repository port. */
+export declare const PASSWORD_RESET_REPOSITORY: unique symbol;

package/dist/passwords/contracts.js

@@ -0,0 +1,2 @@
+/** Injection token for the password reset repository port. */
+export const PASSWORD_RESET_REPOSITORY = Symbol.for("veap:auth:password-reset-repository");

package/dist/passwords/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./contracts.js";
+export * from "./password-reset.facade.js";
+export * from "./password-reset.repository.js";
+export * from "./password-reset.service.js";

package/dist/passwords/index.js

@@ -0,0 +1,4 @@
+export * from "./contracts.js";
+export * from "./password-reset.facade.js";
+export * from "./password-reset.repository.js";
+export * from "./password-reset.service.js";

package/dist/passwords/password-reset.facade.d.ts

@@ -0,0 +1,14 @@
+import type { PasswordResetAuthSession, PasswordResetSession as PasswordResetSessionType } from "../common/index.js";
+export declare function createPasswordResetSession(token: string, userId: string, email: string): Promise<PasswordResetSessionType>;
+export declare function validatePasswordResetSessionToken(token: string): Promise<PasswordResetAuthSession>;
+export declare function setPasswordResetSessionAsEmailVerified(sessionId: string): Promise<void>;
+export declare function invalidateUserPasswordResetSessions(userId: string): Promise<void>;
+export declare function getCurrentPasswordResetSession(): Promise<PasswordResetAuthSession>;
+export declare function setPasswordResetSessionTokenCookie(token: string, expiresAt: Date): Promise<void>;
+export declare function deletePasswordResetSessionTokenCookie(): Promise<void>;
+export declare function sendPasswordResetEmail(email: string, code: string): Promise<void>;
+export declare function createDummyPasswordResetSession(token: string, email: string): Promise<PasswordResetSessionType>;
+export declare function verifyResetCode(sessionId: string, code: string): Promise<{
+    valid: boolean;
+    error?: string;
+}>;