@voltro/plugin-auth 0.81.0 → 0.82.0

package/dist/plugin.d.ts

@@ -1,12 +1,31 @@
 import { AuthStrategy } from '@voltro/protocol';
 import { ConnectionCredential } from '@voltro/protocol';
+import { DataStore } from '@voltro/database';
 import { Effect } from 'effect';
 import { SessionSecrets } from '@voltro/protocol/session';
+import { SqlClient } from '@effect/sql/SqlClient';
 import { Subject } from '@voltro/protocol';
 import { VoidIfEmpty } from 'effect/Types';
 import { VoltroPlugin } from '@voltro/protocol';
 import { YieldableError } from 'effect/Cause';
 
+/** What the decision can read: the app's database the plugin is bound to
+ *  (undefined before the bind, and for a handler called without the plugin). */
+declare interface AdmissionContext {
+    readonly store: DataStore | undefined;
+}
+
+/** Why a join is refused. */
+declare interface AdmissionRefusal {
+    /** A stable code the client can branch on, e.g. `seats`. */
+    readonly reason: string;
+    /** A sentence for the person who was refused. */
+    readonly message: string;
+}
+
+/** Decide whether a person may join a tenant — `null` to let them in. */
+declare type AdmitJoining = (joining: Joining, context: AdmissionContext) => Effect.Effect<AdmissionRefusal | null> | Promise<AdmissionRefusal | null>;
+
 declare interface AuthConfig {
     /**
      * The session-signing key. OMIT IT and the value is read from
@@ -50,6 +69,28 @@ declare interface AuthConfig {
      *  but any concern (unverified email, suspended tenant, …) can hook here.
      *  Absent / empty ⇒ every authenticated user proceeds unchanged. */
     readonly subjectGuards?: ReadonlyArray<SubjectGuard>;
+    /** Admission: asked before anyone JOINS a tenant — a sign-up, an invitation
+     *  accepted with a new account or an existing one — and before anything is
+     *  written (the account, the membership, the redeemed invitation). A refusal
+     *  answers 403 `not_admitted` with its `reason` and `message`. The seam for a
+     *  seat limit, an invite-only tenant, an address allow-list. Absent ⇒ every
+     *  join proceeds. Signing in is not joining: subject guards govern that. */
+    readonly admit?: AdmitJoining;
+    /**
+     * Tenants a public sign-up may name (`tenantId` in the sign-up body) besides
+     * `defaultTenantId` — a readers' tenant beside the staff one. Anything else
+     * named is refused (400 `tenant_not_open`) before an account exists: the
+     * request must not choose the tenant it joins, or anyone could sign up into
+     * a stranger's. Joining a particular organisation goes through an invitation.
+     */
+    readonly signUpTenants?: ReadonlyArray<string>;
+    /** Make sure the user has a row in the app's `actors` table before their
+     *  session exists. The `audit()` mixin stamps `createdBy` / `updatedBy`
+     *  with the user id, and those columns reference `actors`, so a user with no
+     *  row there cannot write to any audited table on an FK-enforcing database.
+     *  `authRoutesPlugin` wires this to the app store it is bound to; called by
+     *  `issueUserSession`, so every session-granting path covers it. */
+    readonly ensureActor?: (user: UserRecord) => Effect.Effect<void>;
     /** Brute-force lockout. After `maxAttempts` failed credential attempts
      *  (wrong password OR wrong MFA code) within `windowSeconds`, the account —
      *  keyed by EMAIL, so an unknown address locks exactly like a real one and
@@ -94,8 +135,12 @@ export declare interface AuthPlugin extends VoltroPlugin {
 export declare const authRoutesPlugin: (options: AuthRoutesPluginOptions) => AuthPlugin;
 
 export declare interface AuthRoutesPluginOptions extends AuthConfig {
-    /** The user store backing every handler. */
-    readonly store: UserStore;
+    /**
+     * The user store backing every handler — a `UserStore`, or a
+     * `UserStoreResolver` (e.g. `appUserStore()`) that the plugin calls once the
+     * framework has opened the app's database, so users live in that database.
+     */
+    readonly store: UserStore | UserStoreResolver;
     /** Passkey config — when omitted, the four passkey routes return 501. */
     readonly passkey?: PasskeyConfig;
     /** Challenge store for the passkey ceremonies. Defaults to an in-memory
@@ -139,6 +184,13 @@ export declare interface AuthRoutesPluginOptions extends AuthConfig {
      * on while leaving either unanswered. See `ImpersonationConfig`.
      */
     readonly impersonation?: ImpersonationConfig;
+    /**
+     * Native login for cookie-less clients (React Native, desktop shells).
+     * PRESENT mounts `/auth/native/authorize`, `/native/complete` and
+     * `/native/exchange`; ABSENT mounts nothing. `redirectUris` is exact-match —
+     * an app names the custom-scheme or universal-link URL it listens on.
+     */
+    readonly native?: NativeLoginConfig;
     /** Disambiguates multiple instances of this plugin in one app. */
     readonly name?: string;
 }
@@ -418,6 +470,13 @@ declare interface InvitationStore {
     readonly supersedePendingInvitations: (tenantId: string, email: string, revokedByUserId: string, now: Date) => Effect.Effect<number>;
 }
 
+/** Someone about to join a tenant. */
+declare interface Joining {
+    readonly email: string;
+    readonly tenantId: string;
+    readonly via: 'sign-up' | 'invitation';
+}
+
 /**
  * Brute-force lockout policy, resolved from `AuthConfig.lockout` and passed
  * INTO the store on each failure so the store itself stays policy-free.
@@ -508,6 +567,19 @@ declare interface MfaStore {
     readonly countRecoveryCodes: (userId: string) => Effect.Effect<number>;
 }
 
+declare interface NativeLoginConfig {
+    /** Exact redirect URIs the app may name — a custom scheme
+     *  (`acme://auth/callback`) or an https universal link. No wildcards. */
+    readonly redirectUris: ReadonlyArray<string>;
+    /** The web app's sign-in page, relative to the app origin. Default `/login`.
+     *  It must honour `?next=` (the auth template does). */
+    readonly loginPath?: string;
+    /** Lifetime of the pending request cookie. Default 10 minutes. */
+    readonly pendingTtlSeconds?: number;
+    /** Cookie name for the pending request. Default `voltro:native`. */
+    readonly pendingCookieName?: string;
+}
+
 declare interface PasskeyConfig {
     /** Relying-party id — the registrable domain (e.g. `example.com`). */
     readonly rpId: string;
@@ -622,6 +694,10 @@ declare interface SessionStore {
     /** Revoke every session for the user EXCEPT `keepSessionId` — the
      *  "sign out other devices" action. Returns the count removed. */
     readonly revokeAllOtherSessions: (userId: string, keepSessionId: string) => Effect.Effect<number>;
+    /** Revoke every session for the user — "sign out everywhere": a password
+     *  reset, a deactivation, an account deletion, a security event. Returns
+     *  the count removed. */
+    readonly revokeAllSessions: (userId: string) => Effect.Effect<number>;
 }
 
 /**
@@ -642,7 +718,7 @@ declare type SubjectGuardVerdict = {
     readonly message: string;
 };
 
-declare type TokenPurpose = 'magic-link' | 'password-reset' | 'mfa-pending' | 'email-verify';
+declare type TokenPurpose = 'magic-link' | 'password-reset' | 'mfa-pending' | 'email-verify' | 'native-code';
 
 /** A single-use, hashed, expiring token (magic-link / password-reset). */
 declare interface TokenRecord {
@@ -750,4 +826,13 @@ declare interface UserRecord {
 declare interface UserStore extends IdentityStore, MfaStore, MembershipStore, SessionStore, TokenStore, InvitationStore, ImpersonationStore, PasskeyStore, LockoutStore {
 }
 
+/** What a resolver is handed once the app's database is open. */
+declare interface UserStoreBindContext {
+    /** The framework's open pool — absent when the app runs `store: 'memory'`. */
+    readonly sql?: SqlClient;
+}
+
+/** Builds the `UserStore` once the framework has opened the app's database. */
+declare type UserStoreResolver = (ctx: UserStoreBindContext) => UserStore;
+
 export { }

package/dist/plugin.js

@@ -1,5 +1,5 @@
 import "./password.js";
 import "./session.js";
-import { n as e, t } from "./plugin-DFQ8N52Q.js";
+import { n as e, t } from "./plugin-CNW-X70p.js";
 import "./csrf.js";
 export { t as authRoutesPlugin, e as getAuthSessionStrategy };

package/dist/session.d.ts

@@ -36,6 +36,8 @@ export declare interface IssueSessionOptions {
     readonly ttlSeconds?: number;
     readonly domain?: string;
     readonly secure?: boolean;
+    /** Clock override (epoch ms) — a testing seam for back-dated sessions. */
+    readonly now?: () => number;
 }
 
 export { KeyedSecret }
@@ -53,6 +55,19 @@ export { KeyedSecret }
  */
 export declare const readSession: (cookieHeader: string | undefined, secret: SessionSecretInput) => SubjectIdentity | null;
 
+/**
+ * Keyed read over the WHOLE header bag: the `x-voltro-session` header a
+ * cookie-less client presents (React Native, a desktop shell — the value it
+ * obtained through the native login exchange), or the session cookie a browser
+ * carries. Same verify, same keyed rotation, same renewal signal as
+ * `readSessionKeyed`; only where the value comes from differs.
+ *
+ * `readSessionKeyed` stays for the callers that hold a cookie string (an SSR
+ * layout reading `request.headers.cookie`); this is what the routes and the
+ * rpc strategy use, because they must accept both.
+ */
+export declare const readSessionFromHeaders: (headers: Readonly<Record<string, string | undefined>>, secret: SessionSecretInput, options?: VerifyOptions) => VerifyResult | null;
+
 /**
  * Keyed read: the full `VerifyResult` — subject + the `kid` that
  * verified + the sliding-window `renew` flag + `exp`/`iat`. The auth

package/dist/session.js

@@ -1,20 +1,23 @@
-import { DEFAULT_SESSION_KID as e, buildSetCookie as t, readCookie as n, resolveOptionalSessionSecrets as r, resolveSessionSecret as i, resolveSessionSecrets as a, signSession as o, timingSafeStringEqual as s, verifySessionKeyed as c } from "@voltro/protocol/session";
+import { DEFAULT_SESSION_KID as e, buildSetCookie as t, readCookie as n, readSessionValue as r, resolveOptionalSessionSecrets as i, resolveSessionSecret as a, resolveSessionSecrets as o, signSession as s, timingSafeStringEqual as c, verifySessionKeyed as l } from "@voltro/protocol/session";
 //#region src/session.ts
-var l = "voltro:session", u = 604800, d = i, f = a, p = (e) => typeof e == "string" ? e : e.current, m = (t) => {
+var u = "voltro:session", d = 604800, f = a, p = o, m = (e) => typeof e == "string" ? e : e.current, h = (t) => {
 	if (typeof t != "string") return t;
-	let n = r(), i = {
-		kid: n && s(n.current.secret, t) ? n.current.kid : e,
+	let n = i(), r = {
+		kid: n && c(n.current.secret, t) ? n.current.kid : e,
 		secret: t
 	};
 	return n?.previous ? {
-		current: i,
+		current: r,
 		previous: n.previous
-	} : { current: i };
-}, h = (e, n, r = {}) => {
-	let i = r.ttlSeconds ?? u, a = o(e, p(n), { ttlSeconds: i });
+	} : { current: r };
+}, g = (e, n, r = {}) => {
+	let i = r.ttlSeconds ?? d, a = s(e, m(n), {
+		ttlSeconds: i,
+		...r.now === void 0 ? {} : { now: r.now }
+	});
 	return {
 		value: a,
-		setCookie: t(l, a, {
+		setCookie: t(u, a, {
 			maxAgeSeconds: i,
 			httpOnly: !0,
 			sameSite: "lax",
@@ -23,10 +26,13 @@ var l = "voltro:session", u = 604800, d = i, f = a, p = (e) => typeof e == "stri
 			path: "/"
 		})
 	};
-}, g = (e, t) => _(e, t)?.subject ?? null, _ = (e, t, r = {}) => {
-	let i = n(e, l);
-	return i ? c(i, m(t), r) : null;
-}, v = (e = {}) => t(l, "", {
+}, _ = (e, t) => v(e, t)?.subject ?? null, v = (e, t, r = {}) => {
+	let i = n(e, u);
+	return i ? l(i, h(t), r) : null;
+}, y = (e, t, n = {}) => {
+	let i = r(e, u);
+	return i ? l(i, h(t), n) : null;
+}, b = (e = {}) => t(u, "", {
 	maxAgeSeconds: 0,
 	httpOnly: !0,
 	sameSite: "lax",
@@ -35,4 +41,4 @@ var l = "voltro:session", u = 604800, d = i, f = a, p = (e) => typeof e == "stri
 	path: "/"
 });
 //#endregion
-export { l as SESSION_COOKIE_NAME, v as clearSessionCookie, h as issueSession, g as readSession, _ as readSessionKeyed, d as resolveSessionSecret, f as resolveSessionSecrets, m as sessionSecretsOf };
+export { u as SESSION_COOKIE_NAME, b as clearSessionCookie, g as issueSession, _ as readSession, y as readSessionFromHeaders, v as readSessionKeyed, f as resolveSessionSecret, p as resolveSessionSecrets, h as sessionSecretsOf };

package/dist/{strategy-MP_KxNuA.js → strategy-XaGjSicX.js}

@@ -1,6 +1,6 @@
 import { sessionSecretsOf as e } from "./session.js";
 import { Data as t, Effect as n } from "effect";
-import { readCookie as r, resolveSessionSecret as i, verifySessionKeyed as a } from "@voltro/protocol/session";
+import { readSessionValue as r, resolveSessionSecret as i, verifySessionKeyed as a } from "@voltro/protocol/session";
 import { generateId as o } from "@voltro/database";
 //#region src/revocation.ts
 var s = 3e4, c = 1e4, l = (e, t = {}) => {
@@ -124,6 +124,11 @@ var s = 3e4, c = 1e4, l = (e, t = {}) => {
 			}
 			return n;
 		}),
+		revokeAllSessions: (e) => n.sync(() => {
+			let t = 0;
+			for (let n = a.length - 1; n >= 0; n--) a[n].userId === e && (a.splice(n, 1), t++);
+			return t;
+		}),
 		insertToken: (e) => n.sync(() => {
 			let t = {
 				...e,
@@ -288,30 +293,46 @@ var s = 3e4, c = 1e4, l = (e, t = {}) => {
 	let t = e.metadata?.memberships;
 	return Array.isArray(t) ? t.filter((e) => typeof e == "object" && !!e && typeof e.tenantId == "string" && typeof e.role == "string") : [];
 }, _ = (e) => typeof e.isLive == "function", v = (e) => e.revocation && _(e.revocation) ? e.revocation : e.store ? l(e.store, e.revocation ?? {}) : null, y = (t = {}) => {
-	let o = t.cookieName ?? "voltro:session", s = v(t);
+	let o = t.cookieName ?? "voltro:session", s = v(t), c = t.revocation && !_(t.revocation) ? t.revocation : {}, u = /* @__PURE__ */ new WeakMap(), d = (e) => {
+		if (s) return s;
+		let n = t.sessionRegistry;
+		if (n === void 0) return null;
+		if (typeof n != "function") return l(n, c);
+		if (e === void 0) return null;
+		let r = u.get(e);
+		if (r) return r;
+		let i = l(n(e), c);
+		return u.set(e, i), i;
+	};
 	return {
 		id: "voltro-password",
-		resolve: (c) => {
-			let l = r(c.headers.cookie, o);
-			if (!l) return { kind: "skip" };
-			let u = e(t.secret ?? i()), d = a(l, u);
-			if (!d) return {
+		resolve: (s) => {
+			let c = r(s.headers, o);
+			if (!c) return { kind: "skip" };
+			let l = e(t.secret ?? i()), u = a(c, l);
+			if (!u) return {
 				kind: "failed",
 				reason: "voltro session cookie failed verification"
 			};
-			let f = b(d.subject, "voltro-password");
-			if (!s) return {
+			let f = b(u.subject, "voltro-password"), p = h(f);
+			if (!p) return t.requireSessionId === !0 ? {
+				kind: "failed",
+				reason: "voltro session cookie carries no session id"
+			} : {
 				kind: "matched",
 				subject: f
 			};
-			let p = h(f);
-			return p ? n.runPromise(s.isLive(p)).then((e) => e ? {
+			let m = d(s.store);
+			return m ? n.runPromise(m.isLive(p)).then((e) => e ? {
 				kind: "matched",
 				subject: f
 			} : {
 				kind: "failed",
 				reason: "voltro session revoked"
-			}) : {
+			}) : t.requireSessionId === !0 && t.sessionRegistry !== void 0 ? {
+				kind: "failed",
+				reason: "session registry not available yet"
+			} : {
 				kind: "matched",
 				subject: f
 			};

package/dist/strategy.d.ts

@@ -1,4 +1,5 @@
 import { AuthStrategy } from '@voltro/protocol';
+import { DataStore } from '@voltro/database';
 import { Effect } from 'effect';
 import { SessionSecrets } from '@voltro/protocol/session';
 import { VoidIfEmpty } from 'effect/Types';
@@ -233,6 +234,10 @@ declare interface SessionRecord {
     readonly lastSeenAt: Date;
 }
 
+/** The session rows an app registers and revokes — the session half of a
+ *  `UserStore`, usable without the rest of it. */
+declare type SessionRegistry = SessionStore;
+
 declare interface SessionRevocationChecker {
     /** Is this session still live? `false` means the row was revoked (or
      *  is past its `expiresAt`) — the caller rejects the cookie. Verdicts
@@ -286,9 +291,13 @@ declare interface SessionStore {
     /** Revoke every session for the user EXCEPT `keepSessionId` — the
      *  "sign out other devices" action. Returns the count removed. */
     readonly revokeAllOtherSessions: (userId: string, keepSessionId: string) => Effect.Effect<number>;
+    /** Revoke every session for the user — "sign out everywhere": a password
+     *  reset, a deactivation, an account deletion, a security event. Returns
+     *  the count removed. */
+    readonly revokeAllSessions: (userId: string) => Effect.Effect<number>;
 }
 
-declare type TokenPurpose = 'magic-link' | 'password-reset' | 'mfa-pending' | 'email-verify';
+declare type TokenPurpose = 'magic-link' | 'password-reset' | 'mfa-pending' | 'email-verify' | 'native-code';
 
 /** A single-use, hashed, expiring token (magic-link / password-reset). */
 declare interface TokenRecord {
@@ -421,6 +430,17 @@ export declare interface VoltroPasswordStrategyOptions {
      *  routes and the rpc auth chain. Ignored without a `store`
      *  (unless a checker is passed directly). */
     readonly revocation?: SessionRevocationOptions | SessionRevocationChecker;
+    /** Session rows to check cookies against when the app mints its own
+     *  sessions (`issueRegisteredSession`): a registry, or a factory over the
+     *  app's store (`dataStoreSessionRegistry`) — built once per store, from
+     *  the `store` the framework hands every strategy. The checker is tuned by
+     *  `revocation` (options) as for `store`. */
+    readonly sessionRegistry?: SessionRegistry | ((store: DataStore) => SessionRegistry);
+    /** Refuse a cookie that carries no `metadata.sessionId` — one minted
+     *  outside the registry. Without this such a cookie is accepted as before
+     *  (stateless); with it, nothing but a registered session authenticates,
+     *  and every session can be revoked. */
+    readonly requireSessionId?: boolean;
 }
 
 export { }

package/dist/strategy.js

@@ -1,3 +1,3 @@
 import "./session.js";
-import { t as e } from "./strategy-MP_KxNuA.js";
+import { t as e } from "./strategy-XaGjSicX.js";
 export { e as voltroPasswordStrategy };

package/dist/tokens.d.ts

@@ -58,9 +58,13 @@ export declare const mintSecret: (ttlSeconds: number) => Omit<MintedToken, "purp
  */
 export declare const mintToken: (purpose: TokenPurpose, ttlSeconds?: number) => MintedToken;
 
+/** Lifetime of a native-login one-time code: the app redeems it within
+ *  seconds of the browser redirect; five minutes covers a slow hand-off. */
+export declare const NATIVE_CODE_TTL_S: number;
+
 /** Default password-reset lifetime — a bit longer. */
 export declare const PASSWORD_RESET_TTL_S: number;
 
-declare type TokenPurpose = 'magic-link' | 'password-reset' | 'mfa-pending' | 'email-verify';
+declare type TokenPurpose = 'magic-link' | 'password-reset' | 'mfa-pending' | 'email-verify' | 'native-code';
 
 export { }

package/dist/tokens.js

@@ -1,20 +1,21 @@
 import { createHash as e, randomBytes as t } from "node:crypto";
 //#region src/tokens.ts
-var n = 900, r = 3600, i = 86400, a = 300, o = {
+var n = 900, r = 3600, i = 86400, a = 300, o = 300, s = {
 	"magic-link": 900,
 	"password-reset": r,
 	"mfa-pending": 300,
-	"email-verify": i
-}, s = (e) => e.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), c = (t) => e("sha256").update(t).digest("hex"), l = (e) => {
-	let n = s(t(32));
+	"email-verify": i,
+	"native-code": 300
+}, c = (e) => e.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), l = (t) => e("sha256").update(t).digest("hex"), u = (e) => {
+	let n = c(t(32));
 	return {
 		token: n,
-		tokenHash: c(n),
+		tokenHash: l(n),
 		expiresAt: new Date(Date.now() + e * 1e3)
 	};
-}, u = (e, t) => ({
-	...l(t ?? o[e]),
+}, d = (e, t) => ({
+	...u(t ?? s[e]),
 	purpose: e
 });
 //#endregion
-export { i as EMAIL_VERIFY_TTL_S, n as MAGIC_LINK_TTL_S, a as MFA_PENDING_TTL_S, r as PASSWORD_RESET_TTL_S, c as hashToken, l as mintSecret, u as mintToken };
+export { i as EMAIL_VERIFY_TTL_S, n as MAGIC_LINK_TTL_S, a as MFA_PENDING_TTL_S, o as NATIVE_CODE_TTL_S, r as PASSWORD_RESET_TTL_S, l as hashToken, u as mintSecret, d as mintToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth",
-  "version": "0.81.0",
+  "version": "0.82.0",
   "description": "Authentication primitives: password hashing, session creation, schema mixin + tables. Pairs with the `auth` app template for the UI; both independently usable. Server-side only (uses node:crypto).",
   "keywords": [
     "voltro",
@@ -68,6 +68,11 @@
       "import": "./dist/web.js",
       "default": "./dist/web.js"
     },
+    "./native": {
+      "types": "./dist/native.d.ts",
+      "import": "./dist/native.js",
+      "default": "./dist/native.js"
+    },
     "./package.json": "./package.json"
   },
   "main": "./dist/index.js",
@@ -79,8 +84,8 @@
   },
   "dependencies": {
     "@effect/sql": "^0.52.1",
-    "@voltro/database": "0.81.0",
-    "@voltro/protocol": "0.81.0"
+    "@voltro/database": "0.82.0",
+    "@voltro/protocol": "0.82.0"
   },
   "peerDependencies": {
     "effect": "^3.22.2",