@venturekit/auth 0.0.0-dev.20260701100017 → 0.0.0-dev.20260704225856

package/dist/server/token-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-utils.js","sourceRoot":"","sources":["../../src/server/token-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,wDAAwD;AACxD,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,aAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAElD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,gCAAgC,CAAC;IAEtD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,gCAAgC,CAAC;IAE/D,MAAM,SAAS,GAAG,GAAG,GAAG,UAAU,CAAC;IACnC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAEpC,0EAA0E;IAC1E,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,GAAG;QAAE,OAAO,GAAG,GAAG,GAAG,CAAC;IAErD,OAAO,gCAAgC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;QAC3C,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAA8B,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"token-utils.js","sourceRoot":"","sources":["../../src/server/token-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,wDAAwD;AACxD,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,aAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAElD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,gCAAgC,CAAC;IAEtD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,gCAAgC,CAAC;IAE/D,MAAM,SAAS,GAAG,GAAG,GAAG,UAAU,CAAC;IACnC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAEpC,0EAA0E;IAC1E,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,GAAG;QAAE,OAAO,GAAG,GAAG,GAAG,CAAC;IAErD,OAAO,gCAAgC,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW;IAEX,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;QAC3C,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAQ,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,26 +1,30 @@
 {
   "name": "@venturekit/auth",
-  "version": "0.0.0-dev.20260701100017",
+  "version": "0.0.0-dev.20260704225856",
   "description": "Authentication and authorization for VentureKit",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
     "dist",
-    "migrations"
+    "src/migrations/*.sql"
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/venturekit-dev/venturekit.private.git",
+    "url": "https://github.com/venturekit-dev/venturekit.git",
     "directory": "packages/auth"
   },
+  "homepage": "https://venturekit.dev",
+  "bugs": {
+    "url": "https://github.com/venturekit-dev/venturekit/issues"
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "access": "public"
   },
   "license": "Apache-2.0",
   "vk": {
-    "migrations": "migrations"
+    "migrations": "src/migrations"
   },
   "exports": {
     ".": {
@@ -30,30 +34,39 @@
     "./server": {
       "import": "./dist/server/index.js",
       "types": "./dist/server/index.d.ts"
+    },
+    "./server/store/postgres": {
+      "import": "./dist/server/store/postgres.js",
+      "types": "./dist/server/store/postgres.d.ts"
     }
   },
   "dependencies": {
-    "@venturekit/core": "0.0.0-dev.20260701100017",
+    "@venturekit/core": "0.0.0-dev.20260704225856",
     "@aws-sdk/client-cognito-identity-provider": "^3.1068.0",
     "@aws-sdk/client-secrets-manager": "^3.1068.0",
     "aws-jwt-verify": "^4.0.1"
   },
   "peerDependencies": {
-    "@venturekit/runtime": "0.0.0-dev.20260701100017"
+    "@venturekit/data": "0.0.0-dev.20260704225856",
+    "@venturekit/runtime": "0.0.0-dev.20260704225856"
   },
   "peerDependenciesMeta": {
+    "@venturekit/data": {
+      "optional": true
+    },
     "@venturekit/runtime": {
       "optional": true
     }
   },
   "devDependencies": {
-    "@venturekit/runtime": "0.0.0-dev.20260701100017",
+    "@venturekit/data": "0.0.0-dev.20260704225856",
+    "@venturekit/runtime": "0.0.0-dev.20260704225856",
     "@types/aws-lambda": "^8.10.131",
     "@types/node": "^25.6.0",
     "typescript": "^5.3.0"
   },
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && node -e \"require('fs').cpSync('src/migrations','dist/migrations',{recursive:true})\"",
     "dev": "tsc --watch",
     "clean": "rm -rf dist"
   }

package/src/migrations/vk_auth_001_verification_codes.sql

@@ -0,0 +1,55 @@
+-- vk_auth_001_verification_codes.sql
+--
+-- Owned by `@venturekit/auth`. Creates the `vk_verification_codes`
+-- table backing `VerificationCodeStore` (used by the OTP gating on
+-- self-service sign-up + sign-in / passwordless). The table is
+-- `vk_`-prefixed per VentureKit's "package-owned tables are prefixed"
+-- convention; consumer-side stores must query `vk_verification_codes`.
+--
+-- Rows are pre-Cognito state — created BEFORE a user exists in either
+-- Cognito or any consumer-side `users` mirror. The `identifier` is the
+-- email or E.164 phone number the code was sent to; `channel` is the
+-- delivery surface.
+--
+-- Storage shape:
+--   - `code_hash` is SHA-256 of the plaintext code (hex). Plaintext
+--     never lands in the DB so a future leak still requires brute
+--     force against the (short) TTL.
+--   - `expires_at` is the wall-clock cutoff after which the
+--     `verifyVerificationCode` helper deletes the row and surfaces
+--     `verification_failed`.
+--   - `attempts` is incremented on every wrong-code submission;
+--     once it reaches `max_attempts` the row is deleted (forces the
+--     user to request a fresh code).
+--
+-- Channel typing: stored as TEXT + CHECK rather than a Postgres enum
+-- so this migration does not depend on `@venturekit/notify`'s
+-- `notify_channel` enum (auth must be usable without notify — e.g. a
+-- project that ships its own delivery layer). Add new values here when
+-- the auth package learns to dispatch over them.
+--
+-- Idempotent: uses `CREATE TABLE IF NOT EXISTS` so projects that
+-- previously created the table from their own migration (with a
+-- compatible shape) can adopt this one without dropping data. The
+-- expectation is that those projects will then leave their old
+-- migration file in place but stop hand-maintaining the schema here.
+
+CREATE TABLE IF NOT EXISTS vk_verification_codes (
+  channel       TEXT        NOT NULL,
+  identifier    TEXT        NOT NULL,
+  code_hash     TEXT        NOT NULL,
+  expires_at    TIMESTAMPTZ NOT NULL,
+  attempts      INT         NOT NULL DEFAULT 0,
+  max_attempts  INT         NOT NULL DEFAULT 5,
+  created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  PRIMARY KEY (channel, identifier),
+  CONSTRAINT verification_codes_channel_chk
+    CHECK (channel IN ('email', 'whatsapp', 'sms')),
+  CONSTRAINT verification_codes_attempts_chk
+    CHECK (attempts >= 0),
+  CONSTRAINT verification_codes_max_attempts_chk
+    CHECK (max_attempts >= 1)
+);
+
+CREATE INDEX IF NOT EXISTS idx_verification_codes_expires_at
+  ON vk_verification_codes (expires_at);

package/src/migrations/vk_auth_003_role_scopes.sql

@@ -0,0 +1,43 @@
+-- @venturekit/auth — role → scopes mapping.
+--
+-- The DB is the SOURCE OF TRUTH for which scopes each role grants.
+-- VentureKit ships the STRUCTURE (this migration, applied automatically
+-- with every other package migration); the consuming app ships DATA
+-- migrations to seed its own taxonomy, e.g.:
+--
+--   INSERT INTO vk_role_scopes (role, scope) VALUES
+--     ('member',    'member.verified'),
+--     ('moderator', 'member.verified'),
+--     ('moderator', 'moderation.reports.read')
+--   ON CONFLICT DO NOTHING;
+--
+-- Lives in @venturekit/auth — NOT in a pro package — because a role →
+-- scopes matrix is baseline authorization for ANY app: single-tenant
+-- apps key it by their global user role; multi-tenant apps feed it to
+-- `@venturekit-pro/tenancy`'s scopes middleware
+-- (`createTenantUserScopesMiddleware({ scopesByRole: resolver.lookup })`).
+--
+-- At runtime the mapping is read through `createRoleScopesResolver()`
+-- (cached, TTL-refreshed). Mutations go through `setRoleScopes` /
+-- `grantScopeToRole` / `revokeScopeFromRole`, so apps can build
+-- management UIs on top — changes propagate to warm instances within
+-- the resolver's TTL.
+--
+-- Deliberately GLOBAL (no tenant column): the mapping is the app's
+-- authorization POLICY, not tenant data. Per-tenant overrides, if ever
+-- needed, belong in a separate overlay table so the hot path stays a
+-- single cached full-table read.
+
+CREATE TABLE IF NOT EXISTS vk_role_scopes (
+  role        text        NOT NULL,
+  scope       text        NOT NULL,
+  created_at  timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (role, scope)
+);
+
+COMMENT ON TABLE vk_role_scopes IS
+  'Role → scope grants. Structure owned by @venturekit/auth; rows owned by the consuming app (seed via app migrations, manage via the role-scopes helpers).';
+
+-- Scope grants are read by role on every request that misses the
+-- resolver cache; the PK already serves (role, scope) lookups and
+-- role-prefix scans.