@voltro/plugin-auth 0.83.1 → 0.85.0

package/THIRD-PARTY-NOTICES.md

@@ -5,66 +5,10 @@ property of its respective copyright holders and is used under the terms of
 its license. This file is provided for attribution; it grants no rights in
 @voltro/plugin-auth itself, which is proprietary (see LICENSE).
 
-Generated from the resolved runtime dependency closure (7 packages).
+Generated from the resolved runtime dependency closure (5 packages).
 
 ---
 
-## @effect/experimental@0.61.1
-
-License: MIT
-
-```
-MIT License
-
-Copyright (c) 2023-present The Contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
-## @effect/sql@0.52.1
-
-License: MIT
-
-```
-MIT License
-
-Copyright (c) 2023-present The Contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
 ## jose@6.2.12
 
 License: MIT

package/dist/index.d.ts

@@ -5,7 +5,7 @@ import { Effect } from 'effect';
 import { KeyedSecret } from '@voltro/protocol/session';
 import { MembershipsSource } from '@voltro/protocol';
 import { SessionSecrets } from '@voltro/protocol/session';
-import { SqlClient } from '@effect/sql/SqlClient';
+import { SqlClient } from 'effect/sql/SqlClient';
 import { Subject } from '@voltro/protocol';
 import { SubjectIdentity } from '@voltro/protocol';
 import { VerifyOptions } from '@voltro/protocol/session';

package/dist/index.js

@@ -1,7 +1,7 @@
 import { PasswordEmptyError as e, PasswordHashError as t, hashPassword as n, needsRehash as r, parseScryptParams as i, verifyPassword as a, verifyPasswordWithRehash as o } from "./password.js";
 import { SESSION_COOKIE_NAME as ee, clearSessionCookie as te, issueSession as s, readSession as c, readSessionFromHeaders as ne, readSessionKeyed as re, resolveSessionSecret as ie, resolveSessionSecrets as ae, sessionSecretsOf as oe } from "./session.js";
 import { a as l, c as se, i as u, l as d, n as f, o as p, r as m, s as h, t as g } from "./strategy-XaGjSicX.js";
-import { $ as _, A as v, B as y, C as b, D as x, E as S, F as C, G as w, H as T, I as E, J as D, K as O, L as k, M as A, N as j, O as M, P as N, Q as P, R as F, S as I, T as L, U as R, V as z, W as B, X as V, Y as H, Z as U, _ as W, _t as G, a as K, at as ce, b as le, c as ue, ct as de, d as fe, dt as pe, et as me, f as he, ft as ge, g as _e, gt as ve, h as ye, ht as be, i as xe, it as Se, j as Ce, k as we, l as Te, lt as Ee, m as De, mt as Oe, n as ke, nt as Ae, o as je, ot as Me, p as Ne, pt as Pe, q as Fe, r as Ie, rt as Le, s as Re, st as ze, t as Be, tt as Ve, u as He, ut as Ue, v as We, vt as Ge, w as Ke, x as qe, y as Je, z as Ye } from "./plugin-CNW-X70p.js";
+import { $ as _, A as v, B as y, C as b, D as x, E as S, F as C, G as w, H as T, I as E, J as D, K as O, L as k, M as A, N as j, O as M, P as N, Q as P, R as F, S as I, T as L, U as R, V as z, W as B, X as V, Y as H, Z as U, _ as W, _t as G, a as K, at as ce, b as le, c as ue, ct as de, d as fe, dt as pe, et as me, f as he, ft as ge, g as _e, gt as ve, h as ye, ht as be, i as xe, it as Se, j as Ce, k as we, l as Te, lt as Ee, m as De, mt as Oe, n as ke, nt as Ae, o as je, ot as Me, p as Ne, pt as Pe, q as Fe, r as Ie, rt as Le, s as Re, st as ze, t as Be, tt as Ve, u as He, ut as Ue, v as We, vt as Ge, w as Ke, x as qe, y as Je, z as Ye } from "./plugin-CbmcyEJs.js";
 import { EMAIL_VERIFY_TTL_S as Xe, MAGIC_LINK_TTL_S as Ze, MFA_PENDING_TTL_S as Qe, NATIVE_CODE_TTL_S as $e, PASSWORD_RESET_TTL_S as et, hashToken as tt, mintSecret as nt, mintToken as rt } from "./tokens.js";
 import { CSRF_COOKIE_NAME as it, CSRF_HEADER_NAME as at, isCsrfTokenWellFormed as ot, issueCsrfToken as st, verifyCsrf as q } from "./csrf.js";
 import { generateChallenge as ct, verifyAssertion as lt, verifyRegistration as ut } from "./webauthn.js";

package/dist/password.js

@@ -1,7 +1,7 @@
 import { randomBytes as e, scrypt as t, timingSafeEqual as n } from "node:crypto";
 import { Data as r, Effect as i } from "effect";
 //#region src/password.ts
-var a = 32768, o = 8, s = 1, c = 32, l = 16, u = (e, t) => 128 * e * t * 2, d = 268435456, f = class extends r.TaggedError("PasswordEmptyError") {}, p = class extends r.TaggedError("PasswordHashError") {}, m = (e, n, r, a) => i.async((o) => {
+var a = 32768, o = 8, s = 1, c = 32, l = 16, u = (e, t) => 128 * e * t * 2, d = 268435456, f = class extends r.TaggedError("PasswordEmptyError") {}, p = class extends r.TaggedError("PasswordHashError") {}, m = (e, n, r, a) => i.callback((o) => {
 	t(e, n, r, {
 		...a,
 		maxmem: u(a.N, a.r)
@@ -35,7 +35,7 @@ var a = 32768, o = 8, s = 1, c = 32, l = 16, u = (e, t) => 128 * e * t * 2, d =
 		p: o
 	});
 	return l.length === c.length && n(l, c);
-}).pipe(i.catchAll(() => i.succeed(!1))), _ = (e) => {
+}).pipe(i.catch(() => i.succeed(!1))), _ = (e) => {
 	let t = e.split("$");
 	if (t.length !== 6) return null;
 	let [n, r, i, a, o, s] = t;

package/dist/{plugin-CNW-X70p.js → plugin-CbmcyEJs.js}

@@ -11,10 +11,13 @@ import { registerRetention as ce, retentionTtlMsFromEnv as le, writeTenantSelect
 import { IMPERSONATION_METADATA_KEY as k, definePlugin as de, rawImpersonationMark as fe, selectSubjectTenant as pe } from "@voltro/protocol";
 //#region src/postgresUserStore.ts
 var me = (e) => {
-	let t = e?.code;
-	if (typeof t == "string") return t;
-	let n = e?.cause?.code;
-	return typeof n == "string" ? n : void 0;
+	let t = e;
+	for (let e = 0; typeof t == "object" && t && e < 6; e++) {
+		let e = t.code;
+		if (typeof e == "string") return e;
+		let n = t;
+		t = n.reason ?? n.cause;
+	}
 }, he = (e) => {
 	let t = e?.columns ?? {};
 	return {
@@ -89,7 +92,7 @@ var me = (e) => {
 			...t,
 			email: n,
 			createdAt: a
-		})), D.catchAll((e) => me(e) === "23505" ? D.fail(new p({ email: n })) : D.die(e)));
+		})), D.catch((e) => me(e) === "23505" ? D.fail(new p({ email: n })) : D.die(e)));
 	}), _ = (t) => D.gen(function* () {
 		let n = (yield* e`
         SELECT ${s().selectList} FROM ${s().usersTable} WHERE ${i("id")} = ${t} LIMIT 1
@@ -149,7 +152,7 @@ var me = (e) => {
 			...t,
 			joinedAt: n
 		});
-	}).pipe(D.catchAll(() => D.succeed({
+	}).pipe(D.catch(() => D.succeed({
 		...t,
 		joinedAt: /* @__PURE__ */ new Date()
 	}))), S = (t, n) => D.gen(function* () {
@@ -176,7 +179,7 @@ var me = (e) => {
 			createdAt: n,
 			lastSeenAt: n
 		};
-	}).pipe(D.catchAll(() => D.succeed({
+	}).pipe(D.catch(() => D.succeed({
 		...t,
 		createdAt: /* @__PURE__ */ new Date(),
 		lastSeenAt: /* @__PURE__ */ new Date()
@@ -216,7 +219,7 @@ var me = (e) => {
 			consumedAt: null,
 			createdAt: n
 		};
-	}).pipe(D.catchAll(() => D.succeed({
+	}).pipe(D.catch(() => D.succeed({
 		...t,
 		consumedAt: null,
 		createdAt: /* @__PURE__ */ new Date()
@@ -260,7 +263,7 @@ var me = (e) => {
 			revokedByUserId: null,
 			createdAt: n
 		};
-	}).pipe(D.catchAll((e) => D.die(e))), le = (t) => D.gen(function* () {
+	}).pipe(D.catch((e) => D.die(e))), le = (t) => D.gen(function* () {
 		let n = yield* e`
         SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
                "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
@@ -279,7 +282,7 @@ var me = (e) => {
                   "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
       `;
 		return i[0] ? { ...i[0] } : null;
-	}).pipe(D.catchAll((e) => D.die(e))), k = (t, n, r, i) => D.gen(function* () {
+	}).pipe(D.catch((e) => D.die(e))), k = (t, n, r, i) => D.gen(function* () {
 		return (yield* e`
         UPDATE invitations
            SET "revokedAt" = ${i}, "revokedByUserId" = ${r}
@@ -289,7 +292,7 @@ var me = (e) => {
            AND "revokedAt" IS NULL
         RETURNING id
       `).length > 0;
-	}).pipe(D.catchAll((e) => D.die(e))), de = (t) => D.gen(function* () {
+	}).pipe(D.catch((e) => D.die(e))), de = (t) => D.gen(function* () {
 		return (yield* e`
         SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
                "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
@@ -302,7 +305,7 @@ var me = (e) => {
          WHERE "tenantId" = ${t}
            AND "acceptedAt" IS NULL AND "revokedAt" IS NULL AND "expiresAt" > ${n}
       `)[0]?.n ?? 0;
-	}).pipe(D.catchAll((e) => D.die(e))), pe = (t, n, r, i) => D.gen(function* () {
+	}).pipe(D.catch((e) => D.die(e))), pe = (t, n, r, i) => D.gen(function* () {
 		return (yield* e`
         UPDATE invitations
            SET "revokedAt" = ${i}, "revokedByUserId" = ${r}
@@ -312,7 +315,7 @@ var me = (e) => {
            AND "revokedAt" IS NULL
         RETURNING id
       `).length;
-	}).pipe(D.catchAll((e) => D.die(e))), ge = (t) => D.gen(function* () {
+	}).pipe(D.catch((e) => D.die(e))), ge = (t) => D.gen(function* () {
 		let n = /* @__PURE__ */ new Date();
 		return yield* e`
         INSERT INTO "impersonationGrants" (
@@ -329,7 +332,7 @@ var me = (e) => {
 			endedAt: null,
 			endedReason: null
 		};
-	}).pipe(D.catchAll((e) => D.die(e))), _e = (t) => D.gen(function* () {
+	}).pipe(D.catch((e) => D.die(e))), _e = (t) => D.gen(function* () {
 		let n = yield* e`
         SELECT id, "sessionId", "actorUserId", "actorSessionId", "targetUserId", "tenantId",
                reason, "startedAt", "expiresAt", "endedAt", "endedReason", "ipAddress", "userAgent"
@@ -343,7 +346,7 @@ var me = (e) => {
          WHERE "sessionId" = ${t} AND "endedAt" IS NULL
         RETURNING id
       `).length > 0;
-	}).pipe(D.catchAll((e) => D.die(e))), ye = (t) => D.gen(function* () {
+	}).pipe(D.catch((e) => D.die(e))), ye = (t) => D.gen(function* () {
 		return (yield* e`
         SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
           FROM passkeys WHERE "userId" = ${t}
@@ -367,7 +370,7 @@ var me = (e) => {
 			createdAt: n,
 			lastUsedAt: null
 		};
-	}).pipe(D.catchAll(() => D.succeed({
+	}).pipe(D.catch(() => D.succeed({
 		...t,
 		createdAt: /* @__PURE__ */ new Date(),
 		lastUsedAt: null
@@ -400,7 +403,7 @@ var me = (e) => {
         SELECT COUNT(*)::int AS n FROM "recoveryCodes"
          WHERE "userId" = ${t} AND "consumedAt" IS NULL
       `)[0]?.n ?? 0;
-	}).pipe(D.orElseSucceed(() => 0)), M = (e, t) => D.catchAll((n) => D.logWarning(`[auth] lockout ${e} failed — brute-force protection is not counting`).pipe(D.annotateLogs("cause", String(n)), D.as(t)));
+	}).pipe(D.orElseSucceed(() => 0)), M = (e, t) => D.catch((n) => D.logWarning(`[auth] lockout ${e} failed — brute-force protection is not counting`).pipe(D.annotateLogs("cause", String(n)), D.as(t)));
 	return {
 		findByEmail: f,
 		findById: m,
@@ -748,7 +751,7 @@ var me = (e) => {
 		ok: !0,
 		subject: l
 	}, { setCookie: c });
-}).pipe(D.catchAll((e) => D.succeed(B(500, {
+}).pipe(D.catch((e) => D.succeed(B(500, {
 	error: "signup_failed",
 	cause: String(e)
 })))), Qe = (e) => ({
@@ -763,7 +766,7 @@ var me = (e) => {
 	let n = yield* t.findById(e.userId);
 	if (!n) return B(404, { error: "user_not_found" });
 	let r = ke();
-	return yield* t.setMfaSecret(n.id, r).pipe(D.catchAll(() => D.succeed(n))), B(200, {
+	return yield* t.setMfaSecret(n.id, r).pipe(D.catch(() => D.succeed(n))), B(200, {
 		ok: !0,
 		secret: r,
 		otpauthUrl: Ae({
@@ -778,7 +781,7 @@ var me = (e) => {
 	if (!n.mfaSecret) return B(400, { error: "no_enrollment_in_progress" });
 	if (n.mfaEnrolledAt) return B(409, { error: "already_enrolled" });
 	if (!(yield* N(n.mfaSecret, e.code).pipe(D.map(() => !0), D.catchTag("TotpVerifyError", () => D.succeed(!1))))) return B(401, { error: "invalid_code" });
-	yield* t.markMfaEnrolled(n.id).pipe(D.catchAll(() => D.succeed(n)));
+	yield* t.markMfaEnrolled(n.id).pipe(D.catch(() => D.succeed(n)));
 	let r = Me();
 	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => v(e))).pipe(D.ignore), B(200, {
 		ok: !0,
@@ -796,7 +799,7 @@ var me = (e) => {
 	});
 }), nt = (e, t) => D.gen(function* () {
 	let n = yield* t.findById(e.userId);
-	return n ? (yield* t.clearMfa(n.id).pipe(D.catchAll(() => D.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(D.ignore), B(200, {
+	return n ? (yield* t.clearMfa(n.id).pipe(D.catch(() => D.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(D.ignore), B(200, {
 		ok: !0,
 		enrolled: !1
 	})) : B(404, { error: "user_not_found" });
@@ -1296,7 +1299,7 @@ var me = (e) => {
 		try: () => Promise.resolve(n),
 		catch: (e) => e
 	});
-}).pipe(D.catchAllCause(() => D.void)), Gt = (e, t, n) => D.gen(function* () {
+}).pipe(D.catchCause(() => D.void)), Gt = (e, t, n) => D.gen(function* () {
 	let r = n.impersonation, i = (n.now ?? Date.now)(), a = new Date(i), o = e.actorSubject, s = (t, n, i = {}) => Wt(r, {
 		kind: "refused",
 		at: a,
@@ -1335,7 +1338,7 @@ var me = (e) => {
 		actor: o,
 		actorUser: c,
 		target: l
-	}).pipe(D.catchAllCause(() => D.succeed(!1))))) return yield* s(403, "not_permitted", {
+	}).pipe(D.catchCause(() => D.succeed(!1))))) return yield* s(403, "not_permitted", {
 		actorUser: c,
 		target: l
 	});
@@ -1343,7 +1346,7 @@ var me = (e) => {
 		actor: g(l),
 		actorUser: l,
 		target: c
-	}).pipe(D.catchAllCause(() => D.succeed(!0)))) return yield* s(403, "target_may_impersonate", {
+	}).pipe(D.catchCause(() => D.succeed(!0)))) return yield* s(403, "target_may_impersonate", {
 		actorUser: c,
 		target: l,
 		message: "This user may themselves impersonate others and cannot be impersonated."

package/dist/plugin.d.ts

@@ -3,7 +3,7 @@ import { ConnectionCredential } from '@voltro/protocol';
 import { DataStore } from '@voltro/database';
 import { Effect } from 'effect';
 import { SessionSecrets } from '@voltro/protocol/session';
-import { SqlClient } from '@effect/sql/SqlClient';
+import { SqlClient } from 'effect/sql/SqlClient';
 import { Subject } from '@voltro/protocol';
 import { VoidIfEmpty } from 'effect/Types';
 import { VoltroPlugin } from '@voltro/protocol';

package/dist/plugin.js

@@ -1,5 +1,5 @@
 import "./password.js";
 import "./session.js";
-import { n as e, t } from "./plugin-CNW-X70p.js";
+import { n as e, t } from "./plugin-CbmcyEJs.js";
 import "./csrf.js";
 export { t as authRoutesPlugin, e as getAuthSessionStrategy };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth",
-  "version": "0.83.1",
+  "version": "0.85.0",
   "description": "Authentication primitives: password hashing, session creation, schema mixin + tables. Pairs with the `auth` app template for the UI; both independently usable. Server-side only (uses node:crypto).",
   "keywords": [
     "voltro",
@@ -83,12 +83,11 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@effect/sql": "^0.52.1",
-    "@voltro/database": "0.83.1",
-    "@voltro/protocol": "0.83.1"
+    "@voltro/database": "0.85.0",
+    "@voltro/protocol": "0.85.0"
   },
   "peerDependencies": {
-    "effect": "^3.22.2",
+    "effect": "4.0.1",
     "react": "^19.0.0"
   },
   "peerDependenciesMeta": {