@veloxts/auth 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @veloxts/auth
 
+## 0.7.1
+
+### Patch Changes
+
+- security audit, bumps dependency packages
+- Updated dependencies
+  - @veloxts/core@0.7.1
+  - @veloxts/router@0.7.1
+
 ## 0.7.0
 
 ### Minor Changes

package/dist/hash.js

@@ -4,6 +4,8 @@
  */
 import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
 import { promisify } from 'node:util';
+import { createLogger } from '@veloxts/core';
+const log = createLogger('auth');
 const scryptAsync = promisify(scrypt);
 // ============================================================================
 // Constants
@@ -134,7 +136,7 @@ export class PasswordHasher {
         catch (error) {
             // Fallback to scrypt if bcrypt fails
             if (error.message.includes('not found')) {
-                console.warn('bcrypt not available, falling back to scrypt');
+                log.warn('bcrypt not available, falling back to scrypt');
                 return this.hashWithScrypt(password);
             }
             throw error;
@@ -163,7 +165,7 @@ export class PasswordHasher {
         catch (error) {
             // Fallback to scrypt if argon2 fails
             if (error.message.includes('not found')) {
-                console.warn('argon2 not available, falling back to scrypt');
+                log.warn('argon2 not available, falling back to scrypt');
                 return this.hashWithScrypt(password);
             }
             throw error;

package/dist/jwt.js

@@ -3,6 +3,8 @@
  * @module auth/jwt
  */
 import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createLogger } from '@veloxts/core';
+const log = createLogger('auth');
 import { AuthError } from './types.js';
 // ============================================================================
 // Constants
@@ -161,11 +163,11 @@ export function validateTokenExpiration(accessExpiry, refreshExpiry) {
     }
     // Warn about exceeding recommended limits (non-fatal)
     if (accessSeconds > TOKEN_BOUNDS.access.recommended) {
-        console.warn(`[Security] Access token expiry (${accessExpiry}) exceeds recommended maximum of 15 minutes. ` +
+        log.warn(`[Security] Access token expiry (${accessExpiry}) exceeds recommended maximum of 15 minutes. ` +
             'Consider using shorter-lived access tokens with refresh.');
     }
     if (refreshSeconds > TOKEN_BOUNDS.refresh.recommended) {
-        console.warn(`[Security] Refresh token expiry (${refreshExpiry}) exceeds recommended maximum of 7 days. ` +
+        log.warn(`[Security] Refresh token expiry (${refreshExpiry}) exceeds recommended maximum of 7 days. ` +
             'Long-lived refresh tokens increase the window for token theft attacks.');
     }
     // Ensure refresh tokens outlive access tokens

package/dist/password-policy.js

@@ -7,6 +7,8 @@
  * @module auth/password-policy
  */
 import { createHash } from 'node:crypto';
+import { createLogger } from '@veloxts/core';
+const log = createLogger('auth');
 /**
  * Password strength levels
  */
@@ -253,7 +255,7 @@ export class PasswordPolicy {
             }
             catch (error) {
                 // Breach check failed - log but don't fail validation
-                console.warn('Password breach check failed:', error);
+                log.warn('Password breach check failed:', error);
             }
         }
         return {

package/dist/policies.js

@@ -2,6 +2,8 @@
  * Resource-level authorization policies for @veloxts/auth
  * @module auth/policies
  */
+import { createLogger } from '@veloxts/core';
+const log = createLogger('auth');
 // ============================================================================
 // Policy Registry
 // ============================================================================
@@ -82,7 +84,7 @@ export async function can(user, action, resourceName, resource) {
     const policy = policyRegistry.get(resourceName);
     if (!policy) {
         // No policy registered = deny by default
-        console.warn(`No policy registered for resource: ${resourceName}`);
+        log.warn(`No policy registered for resource: ${resourceName}`);
         return false;
     }
     const actionHandler = policy[action];

package/dist/token-store.js

@@ -8,6 +8,8 @@
  *
  * @module auth/token-store
  */
+import { createLogger } from '@veloxts/core';
+const log = createLogger('auth');
 // ============================================================================
 // Implementation
 // ============================================================================
@@ -89,7 +91,7 @@ export function createEnhancedTokenStore(options) {
         },
         revokeAllUserTokens(userId) {
             // Placeholder - in production, implement proper user->token mapping
-            console.warn(`[Security] Token reuse detected for user ${userId}. ` +
+            log.warn(`[Security] Token reuse detected for user ${userId}. ` +
                 'All tokens should be revoked. Implement proper user->token mapping for production.');
         },
         clear() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@veloxts/auth",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Authentication and authorization system for VeloxTS framework",
   "type": "module",
   "main": "dist/index.js",
@@ -61,8 +61,8 @@
   "dependencies": {
     "@fastify/cookie": "11.0.2",
     "fastify": "5.7.4",
-    "@veloxts/core": "0.7.0",
-    "@veloxts/router": "0.7.0"
+    "@veloxts/core": "0.7.1",
+    "@veloxts/router": "0.7.1"
   },
   "peerDependencies": {
     "argon2": ">=0.30.0",
@@ -85,8 +85,8 @@
     "@vitest/coverage-v8": "4.0.18",
     "typescript": "5.9.3",
     "vitest": "4.0.18",
-    "@veloxts/testing": "0.7.0",
-    "@veloxts/validation": "0.7.0"
+    "@veloxts/testing": "0.7.1",
+    "@veloxts/validation": "0.7.1"
   },
   "keywords": [
     "velox",