@voltro/plugin-auth 0.1.0

package/dist/index.js

@@ -0,0 +1,262 @@
+import { PasswordEmptyError as e, PasswordHashError as t, hashPassword as n, needsRehash as r, parseScryptParams as i, verifyPassword as a, verifyPasswordWithRehash as o } from "./password.js";
+import { SESSION_COOKIE_NAME as s, VOLTRO_DEV_SESSION_SECRET as ee, clearSessionCookie as te, issueSession as c, readSession as l, readSessionKeyed as u, resolveSessionSecret as d, resolveSessionSecrets as f, sessionSecretsOf as p } from "./session.js";
+import { a as m, c as h, i as g, l as _, n as v, o as y, r as b, s as x, t as S } from "./strategy-CQ2YCIcr.js";
+import { A as C, C as w, D as T, E, F as D, I as O, L as k, M as A, N as j, O as M, P as N, S as P, T as F, _ as I, a as L, b as R, c as z, d as B, f as V, g as H, h as U, i as ne, j as W, k as G, l as K, m as q, n as J, o as Y, p as X, r as Z, s as re, t as ie, u as ae, v as oe, w as se, x as ce, y as le } from "./plugin-CRt-kdEA.js";
+import { MAGIC_LINK_TTL_S as ue, PASSWORD_RESET_TTL_S as de, hashToken as fe, mintToken as pe } from "./tokens.js";
+import { CSRF_COOKIE_NAME as me, CSRF_HEADER_NAME as Q, isCsrfTokenWellFormed as he, issueCsrfToken as ge, verifyCsrf as _e } from "./csrf.js";
+import { generateChallenge as ve, verifyAssertion as ye, verifyRegistration as be } from "./webauthn.js";
+import { Effect as $ } from "effect";
+//#region src/postgresUserStore.ts
+var xe = (e) => {
+	let t = e?.code;
+	if (typeof t == "string") return t;
+	let n = e?.cause?.code;
+	return typeof n == "string" ? n : void 0;
+}, Se = (e) => {
+	let t = (t) => $.gen(function* () {
+		return (yield* e`
+        SELECT id, email, "passwordHash", "tenantId", "createdAt", "mfaSecret", "mfaEnrolledAt"
+        FROM users
+        WHERE email = ${t.toLowerCase()}
+        LIMIT 1
+      `)[0] ?? null;
+	}).pipe($.orElseSucceed(() => null)), n = (t) => $.gen(function* () {
+		return (yield* e`
+        SELECT id, email, "passwordHash", "tenantId", "createdAt", "mfaSecret", "mfaEnrolledAt"
+        FROM users
+        WHERE id = ${t}
+        LIMIT 1
+      `)[0] ?? null;
+	}).pipe($.orElseSucceed(() => null)), r = (t) => $.gen(function* () {
+		let n = t.email.toLowerCase(), r = /* @__PURE__ */ new Date();
+		return yield* e`
+        INSERT INTO users (id, email, "passwordHash", "tenantId", "createdAt", "updatedAt")
+        VALUES (${t.id}, ${n}, ${t.passwordHash}, ${t.tenantId}, ${r}, ${r})
+      `.pipe($.map(() => ({
+			...t,
+			email: n,
+			createdAt: r
+		})), $.catchAll((e) => xe(e) === "23505" ? $.fail(new v({ email: n })) : $.die(e)));
+	}), i = (t) => $.gen(function* () {
+		return (yield* e`
+        SELECT id, email, "passwordHash", "tenantId", "createdAt", "mfaSecret", "mfaEnrolledAt"
+        FROM users WHERE id = ${t} LIMIT 1
+      `)[0] || (yield* $.fail(new b({ userId: t })));
+	}).pipe($.catchTag("SqlError", (e) => $.die(e)));
+	return {
+		findByEmail: t,
+		findById: n,
+		insert: r,
+		updatePassword: (t, n) => $.gen(function* () {
+			return yield* e`
+        UPDATE users SET "passwordHash" = ${n}, "updatedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE id = ${t}
+      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
+		}),
+		setMfaSecret: (t, n) => $.gen(function* () {
+			return yield* e`
+        UPDATE users
+           SET "mfaSecret" = ${n}, "mfaEnrolledAt" = ${null}
+         WHERE id = ${t}
+      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
+		}),
+		markMfaEnrolled: (t) => $.gen(function* () {
+			return yield* e`
+        UPDATE users
+           SET "mfaEnrolledAt" = ${/* @__PURE__ */ new Date()}
+         WHERE id = ${t}
+      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
+		}),
+		clearMfa: (t) => $.gen(function* () {
+			return yield* e`
+        UPDATE users
+           SET "mfaSecret" = ${null}, "mfaEnrolledAt" = ${null}
+         WHERE id = ${t}
+      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
+		}),
+		listMemberships: (t) => $.gen(function* () {
+			return (yield* e`
+        SELECT "userId", "tenantId", role, "joinedAt"
+          FROM memberships WHERE "userId" = ${t}
+          ORDER BY "joinedAt" ASC
+      `).map((e) => ({ ...e }));
+		}).pipe($.orElseSucceed(() => [])),
+		addMembership: (t) => $.gen(function* () {
+			let n = /* @__PURE__ */ new Date();
+			yield* e`
+        UPDATE memberships SET role = ${t.role}
+         WHERE "userId" = ${t.userId} AND "tenantId" = ${t.tenantId}
+      `;
+			let r = yield* e`
+        SELECT "userId", "tenantId", role, "joinedAt"
+          FROM memberships
+         WHERE "userId" = ${t.userId} AND "tenantId" = ${t.tenantId}
+         LIMIT 1
+      `;
+			return r[0] ? { ...r[0] } : (yield* e`
+        INSERT INTO memberships (id, "userId", "tenantId", role, "joinedAt")
+        VALUES (${m("mem")}, ${t.userId}, ${t.tenantId}, ${t.role}, ${n})
+      `, {
+				...t,
+				joinedAt: n
+			});
+		}).pipe($.catchAll(() => $.succeed({
+			...t,
+			joinedAt: /* @__PURE__ */ new Date()
+		}))),
+		membershipRole: (t, n) => $.gen(function* () {
+			return (yield* e`
+        SELECT role FROM memberships
+         WHERE "userId" = ${t} AND "tenantId" = ${n} LIMIT 1
+      `)[0]?.role ?? null;
+		}).pipe($.orElseSucceed(() => null)),
+		listSessions: (t) => $.gen(function* () {
+			return (yield* e`
+        SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt"
+          FROM sessions WHERE "userId" = ${t}
+          ORDER BY "createdAt" DESC
+      `).map((e) => ({ ...e }));
+		}).pipe($.orElseSucceed(() => [])),
+		insertSession: (t) => $.gen(function* () {
+			let n = /* @__PURE__ */ new Date();
+			return yield* e`
+        INSERT INTO sessions (id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt")
+        VALUES (
+          ${t.id}, ${t.userId}, ${t.tenantId}, ${t.expiresAt},
+          ${t.ipAddress ?? null}, ${t.userAgent ?? null}, ${n}, ${n}
+        )
+      `, {
+				...t,
+				createdAt: n,
+				lastSeenAt: n
+			};
+		}).pipe($.catchAll(() => $.succeed({
+			...t,
+			createdAt: /* @__PURE__ */ new Date(),
+			lastSeenAt: /* @__PURE__ */ new Date()
+		}))),
+		findSession: (t) => $.gen(function* () {
+			let n = yield* e`
+        SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt"
+          FROM sessions WHERE id = ${t} LIMIT 1
+      `;
+			return n[0] ? { ...n[0] } : null;
+		}).pipe($.orElseSucceed(() => null)),
+		touchSession: (t, n) => $.gen(function* () {
+			yield* e`
+        UPDATE sessions SET "expiresAt" = ${n}, "lastSeenAt" = ${/* @__PURE__ */ new Date()}
+         WHERE id = ${t}
+      `;
+		}).pipe($.asVoid, $.orElseSucceed(() => void 0)),
+		revokeSession: (t, n) => $.gen(function* () {
+			return (yield* e`
+        DELETE FROM sessions WHERE id = ${n} AND "userId" = ${t}
+        RETURNING id
+      `).length > 0;
+		}).pipe($.orElseSucceed(() => !1)),
+		revokeAllOtherSessions: (t, n) => $.gen(function* () {
+			return (yield* e`
+        DELETE FROM sessions WHERE "userId" = ${t} AND id <> ${n}
+        RETURNING id
+      `).length;
+		}).pipe($.orElseSucceed(() => 0)),
+		insertToken: (t) => $.gen(function* () {
+			let n = /* @__PURE__ */ new Date();
+			return yield* e`
+        INSERT INTO "authTokens" (id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt")
+        VALUES (${t.id}, ${t.tokenHash}, ${t.userId}, ${t.purpose}, ${t.expiresAt}, ${null}, ${n})
+      `, {
+				...t,
+				consumedAt: null,
+				createdAt: n
+			};
+		}).pipe($.catchAll(() => $.succeed({
+			...t,
+			consumedAt: null,
+			createdAt: /* @__PURE__ */ new Date()
+		}))),
+		consumeToken: (t, n) => $.gen(function* () {
+			let r = yield* e`
+        UPDATE "authTokens"
+           SET "consumedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE "tokenHash" = ${t}
+           AND purpose = ${n}
+           AND "consumedAt" IS NULL
+           AND "expiresAt" > ${/* @__PURE__ */ new Date()}
+        RETURNING id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
+      `;
+			return r[0] ? { ...r[0] } : null;
+		}).pipe($.orElseSucceed(() => null)),
+		replaceRecoveryCodes: (t, n) => $.gen(function* () {
+			let r = /* @__PURE__ */ new Date();
+			yield* e`DELETE FROM "recoveryCodes" WHERE "userId" = ${t}`;
+			for (let i of n) yield* e`
+          INSERT INTO "recoveryCodes" (id, "userId", "codeHash", "consumedAt", "createdAt")
+          VALUES (${m("rc")}, ${t}, ${i}, ${null}, ${r})
+        `;
+		}).pipe($.asVoid, $.orElseSucceed(() => void 0)),
+		consumeRecoveryCode: (t, n) => $.gen(function* () {
+			return (yield* e`
+        UPDATE "recoveryCodes"
+           SET "consumedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE "userId" = ${t}
+           AND "codeHash" = ${n}
+           AND "consumedAt" IS NULL
+        RETURNING id
+      `).length > 0;
+		}).pipe($.orElseSucceed(() => !1)),
+		countRecoveryCodes: (t) => $.gen(function* () {
+			return (yield* e`
+        SELECT COUNT(*)::int AS n FROM "recoveryCodes"
+         WHERE "userId" = ${t} AND "consumedAt" IS NULL
+      `)[0]?.n ?? 0;
+		}).pipe($.orElseSucceed(() => 0)),
+		listPasskeys: (t) => $.gen(function* () {
+			return (yield* e`
+        SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
+          FROM passkeys WHERE "userId" = ${t}
+      `).map((e) => ({ ...e }));
+		}).pipe($.orElseSucceed(() => [])),
+		findPasskey: (t) => $.gen(function* () {
+			let n = yield* e`
+        SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
+          FROM passkeys WHERE "credentialId" = ${t} LIMIT 1
+      `;
+			return n[0] ? { ...n[0] } : null;
+		}).pipe($.orElseSucceed(() => null)),
+		insertPasskey: (t) => $.gen(function* () {
+			let n = /* @__PURE__ */ new Date();
+			return yield* e`
+        INSERT INTO passkeys (id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt")
+        VALUES (
+          ${t.id}, ${t.credentialId}, ${t.userId}, ${t.publicKey},
+          ${t.counter}, ${t.transports ?? null}, ${n}, ${null}
+        )
+      `, {
+				...t,
+				createdAt: n,
+				lastUsedAt: null
+			};
+		}).pipe($.catchAll(() => $.succeed({
+			...t,
+			createdAt: /* @__PURE__ */ new Date(),
+			lastUsedAt: null
+		}))),
+		advancePasskeyCounter: (t, n) => $.gen(function* () {
+			return (yield* e`
+        UPDATE passkeys
+           SET counter = ${n}, "lastUsedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE "credentialId" = ${t}
+           AND counter < ${n}
+        RETURNING id
+      `).length > 0;
+		}).pipe($.orElseSucceed(() => !1))
+	};
+}, Ce = (e) => (t) => $.runPromise(e.send({
+	to: t.to,
+	subject: t.subject,
+	html: t.html,
+	text: t.text
+}).pipe($.asVoid, $.orElseSucceed(() => void 0)));
+//#endregion
+export { me as CSRF_COOKIE_NAME, Q as CSRF_HEADER_NAME, ue as MAGIC_LINK_TTL_S, K as MFA_PENDING_TTL_S, de as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, s as SESSION_COOKIE_NAME, W as TotpVerifyError, v as UserAlreadyExistsError, b as UserNotFoundError, ee as VOLTRO_DEV_SESSION_SECRET, ie as authRoutesPlugin, te as clearSessionCookie, ae as configSessionSecrets, Z as dataStoreChallengeStore, ve as generateChallenge, A as generateRecoveryCodes, j as generateTotpCode, N as generateTotpSecret, J as getAuthSessionStrategy, B as guardSubject, V as handleCsrf, X as handleListMemberships, q as handleListSessions, U as handleMagicLinkConsume, H as handleMagicLinkRequest, I as handleMfaEnrollStart, oe as handleMfaEnrollVerify, le as handleMfaRegenerateRecoveryCodes, R as handleMfaUnenroll, ce as handleMfaVerify, ne as handlePasskeyAssertOptions, L as handlePasskeyAssertVerify, Y as handlePasskeyRegisterOptions, re as handlePasskeyRegisterVerify, P as handlePasswordResetConfirm, w as handlePasswordResetRequest, se as handleRevokeAllOtherSessions, F as handleRevokeSession, E as handleSignIn, T as handleSignOut, M as handleSignUp, G as handleSwitchTenant, n as hashPassword, fe as hashToken, he as isCsrfTokenWellFormed, ge as issueCsrfToken, c as issueSession, C as issueUserSession, Ce as mailSender, _ as makeSessionRevocationChecker, z as memoryChallengeStore, g as memoryUserStore, pe as mintToken, r as needsRehash, m as newAuthId, D as otpauthUrl, i as parseScryptParams, Se as postgresUserStore, l as readSession, u as readSessionKeyed, d as resolveSessionSecret, f as resolveSessionSecrets, k as runSubjectGuards, y as sessionIdOfSubject, p as sessionSecretsOf, x as subjectFromUser, h as subjectMemberships, ye as verifyAssertion, _e as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, be as verifyRegistration, O as verifyTotpCode, S as voltroPasswordStrategy };

package/dist/password.d.ts

@@ -0,0 +1,78 @@
+import { Effect } from 'effect';
+import { VoidIfEmpty } from 'effect/Types';
+import { YieldableError } from 'effect/Cause';
+
+/**
+ * Hash a password. Returns a self-describing string that
+ * `verifyPassword` can re-parse without external config. Don't
+ * truncate this string — the parameters are encoded inline.
+ */
+export declare const hashPassword: (plaintext: string) => Effect.Effect<string, PasswordEmptyError | PasswordHashError>;
+
+/**
+ * Does this stored hash use parameters weaker than the framework's
+ * current cost? `true` means "re-hash on next successful verify". A
+ * malformed hash also returns `true` (it should be replaced).
+ */
+export declare const needsRehash: (stored: string) => boolean;
+
+declare interface ParsedHash {
+    readonly N: number;
+    readonly r: number;
+    readonly p: number;
+    readonly keyLen: number;
+}
+
+/** Parse the scrypt parameters out of a stored hash. Returns null when the
+ *  string isn't a well-formed `scrypt$N$r$p$salt$derived`. */
+export declare const parseScryptParams: (stored: string) => ParsedHash | null;
+
+export declare class PasswordEmptyError extends PasswordEmptyError_base<{
+    readonly message: string;
+}> {
+}
+
+declare const PasswordEmptyError_base: new <A extends Record<string, any> = {}>(args: VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => YieldableError & {
+    readonly _tag: "PasswordEmptyError";
+} & Readonly<A>;
+
+export declare class PasswordHashError extends PasswordHashError_base<{
+    readonly message: string;
+    readonly cause: unknown;
+}> {
+}
+
+declare const PasswordHashError_base: new <A extends Record<string, any> = {}>(args: VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => YieldableError & {
+    readonly _tag: "PasswordHashError";
+} & Readonly<A>;
+
+/**
+ * Verify a plaintext password against a stored hash.
+ *
+ * Uses `timingSafeEqual` for the comparison so attackers can't
+ * fingerprint correct prefixes via response-time analysis.
+ *
+ * Returns `Effect<boolean, never>` — parse errors or scrypt errors
+ * collapse to `false` because surfacing them lets attackers
+ * fingerprint malformed-vs-mismatched, which leaks structural info.
+ */
+export declare const verifyPassword: (plaintext: string, stored: string) => Effect.Effect<boolean>;
+
+/**
+ * Verify a password and, when it matches an under-cost hash, return a
+ * freshly-minted replacement. The caller wires `rehash` into
+ * `UserStore.updatePassword(userId, rehash)`. Never throws — parse /
+ * scrypt failures collapse to `{ valid: false }`.
+ */
+export declare const verifyPasswordWithRehash: (plaintext: string, stored: string) => Effect.Effect<VerifyWithRehashResult>;
+
+export declare interface VerifyWithRehashResult {
+    /** Whether the password matched the stored hash. */
+    readonly valid: boolean;
+    /** A freshly-minted hash under the current cost, present ONLY when the
+     *  password was valid AND the stored hash was below current cost. The
+     *  caller persists it via `UserStore.updatePassword`. */
+    readonly rehash?: string;
+}
+
+export { }

package/dist/password.js

@@ -0,0 +1,66 @@
+import { randomBytes as e, scrypt as t, timingSafeEqual as n } from "node:crypto";
+import { Data as r, Effect as i } from "effect";
+//#region src/password.ts
+var a = 16384, o = 8, s = 1, c = 32, l = 16, u = class extends r.TaggedError("PasswordEmptyError") {}, d = class extends r.TaggedError("PasswordHashError") {}, f = (e, n, r, a) => i.async((o) => {
+	t(e, n, r, a, (e, t) => {
+		o(e ? i.fail(new d({
+			message: e.message,
+			cause: e
+		})) : i.succeed(t));
+	});
+}), p = (t) => i.gen(function* () {
+	if (t.length === 0) return yield* i.fail(new u({ message: "password must be non-empty" }));
+	let n = e(l), r = yield* f(t, n, c, {
+		N: a,
+		r: o,
+		p: s
+	});
+	return [
+		"scrypt",
+		a.toString(),
+		o.toString(),
+		s.toString(),
+		n.toString("base64"),
+		r.toString("base64")
+	].join("$");
+}), m = (e, t) => i.gen(function* () {
+	let r = t.split("$");
+	if (r.length !== 6) return !1;
+	let [i, a, o, s, c, l] = r;
+	if (i !== "scrypt") return !1;
+	let u = Number(a), d = Number(o), p = Number(s);
+	if (!Number.isFinite(u) || !Number.isFinite(d) || !Number.isFinite(p)) return !1;
+	let m = Buffer.from(c, "base64"), h = Buffer.from(l, "base64"), g = yield* f(e, m, h.length, {
+		N: u,
+		r: d,
+		p
+	});
+	return g.length === h.length && n(g, h);
+}).pipe(i.catchAll(() => i.succeed(!1))), h = (e) => {
+	let t = e.split("$");
+	if (t.length !== 6) return null;
+	let [n, r, i, a, , o] = t;
+	if (n !== "scrypt") return null;
+	let s = Number(r), c = Number(i), l = Number(a);
+	if (!Number.isFinite(s) || !Number.isFinite(c) || !Number.isFinite(l)) return null;
+	let u = Buffer.from(o, "base64").length;
+	return u === 0 ? null : {
+		N: s,
+		r: c,
+		p: l,
+		keyLen: u
+	};
+}, g = (e) => {
+	let t = h(e);
+	return !t || t.N !== a || t.r !== o || t.p !== s || t.keyLen !== c;
+}, _ = (e, t) => i.gen(function* () {
+	if (!(yield* m(e, t))) return { valid: !1 };
+	if (!g(t)) return { valid: !0 };
+	let n = yield* p(e).pipe(i.orElseSucceed(() => ""));
+	return n ? {
+		valid: !0,
+		rehash: n
+	} : { valid: !0 };
+});
+//#endregion
+export { u as PasswordEmptyError, d as PasswordHashError, p as hashPassword, g as needsRehash, h as parseScryptParams, m as verifyPassword, _ as verifyPasswordWithRehash };