@vonall/auth 0.0.0-stage → 0.1.0

package/dist/schema/index.js

@@ -0,0 +1,265 @@
+/**
+ * The tables of accounts: better-auth's (user, session, account, verification, twoFactor, rate_limit) and the
+ * Einladung; with `admin` the role and ban columns, with `mcp` the OAuth provider's tables (`jwks`, `oauth_*`) the
+ * `@vonall/mcp` package uses. A Product builds them once in its `src/lib/remote/schema/auth.sql.ts`, re-exports them so
+ * drizzle-kit sees them, and generates its own migrations (`schema:` releases of this package say when).
+ */
+import { bigint, boolean, index, integer, jsonb, pgTable, text, timestamp, uniqueIndex } from "drizzle-orm/pg-core";
+const userColumns = () => ({
+    id: text("id").primaryKey(),
+    name: text("name").notNull(),
+    email: text("email").notNull().unique(),
+    emailVerified: boolean("email_verified").notNull(),
+    image: text("image"),
+    createdAt: timestamp("created_at").notNull(),
+    updatedAt: timestamp("updated_at").notNull(),
+    twoFactorEnabled: boolean("two_factor_enabled"),
+});
+const adminColumns = () => ({
+    role: text("role").notNull().default("user"),
+    banned: boolean("banned").notNull().default(false),
+    banReason: text("ban_reason"),
+    banExpires: timestamp("ban_expires", { precision: 6, withTimezone: true }),
+});
+const buildUser = () => pgTable("user", userColumns());
+const buildUserAdmin = () => pgTable("user", { ...userColumns(), ...adminColumns() });
+const sessionColumns = (user) => ({
+    id: text("id").primaryKey(),
+    expiresAt: timestamp("expires_at").notNull(),
+    token: text("token").notNull().unique(),
+    createdAt: timestamp("created_at").notNull(),
+    updatedAt: timestamp("updated_at").notNull(),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+});
+const buildSession = (user) => pgTable("session", sessionColumns(user));
+const buildSessionAdmin = (user) => pgTable("session", { ...sessionColumns(user), impersonatedBy: text("impersonated_by") });
+function buildShared(user) {
+    const account = pgTable("account", {
+        id: text("id").primaryKey(),
+        accountId: text("account_id").notNull(),
+        providerId: text("provider_id").notNull(),
+        userId: text("user_id")
+            .notNull()
+            .references(() => user.id, { onDelete: "cascade" }),
+        accessToken: text("access_token"),
+        refreshToken: text("refresh_token"),
+        idToken: text("id_token"),
+        accessTokenExpiresAt: timestamp("access_token_expires_at"),
+        refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+        scope: text("scope"),
+        password: text("password"),
+        createdAt: timestamp("created_at").notNull(),
+        updatedAt: timestamp("updated_at").notNull(),
+    });
+    const verification = pgTable("verification", {
+        id: text("id").primaryKey(),
+        identifier: text("identifier").notNull(),
+        value: text("value").notNull(),
+        expiresAt: timestamp("expires_at").notNull(),
+        createdAt: timestamp("created_at"),
+        updatedAt: timestamp("updated_at"),
+    });
+    const twoFactor = pgTable("twoFactor", {
+        id: text("id").primaryKey(),
+        userId: text("user_id")
+            .notNull()
+            .references(() => user.id, { onDelete: "cascade" }),
+        secret: text("secret").notNull(),
+        backupCodes: text("backup_codes").notNull(),
+        verified: boolean("verified").notNull().default(true),
+        failedVerificationCount: integer("failed_verification_count").notNull().default(0),
+        lockedUntil: timestamp("locked_until"),
+    });
+    /** better-auth rate limit counters, kept in Postgres so they survive restarts. */
+    const rateLimit = pgTable("rate_limit", {
+        id: text("id").primaryKey(),
+        key: text("key").notNull().unique(),
+        count: integer("count").notNull(),
+        lastRequest: bigint("last_request", { mode: "number" }).notNull(),
+    });
+    /**
+     * An Einladung into the app: signup is invite only once the first account (the admin) exists. A link works once,
+     * until it expires; only the SHA-256 hash of its token is stored, the link is shown once when it is created.
+     */
+    const einladung = pgTable("einladung", {
+        id: text("id").primaryKey(),
+        tokenHash: text("token_hash").notNull().unique(),
+        createdBy: text("created_by")
+            .notNull()
+            .references(() => user.id, { onDelete: "cascade" }),
+        /** Set when the Einladung was sent by email, so the inviter recognises it in the list. */
+        email: text("email"),
+        expiresAt: timestamp("expires_at", { precision: 6, withTimezone: true }).notNull(),
+        acceptedAt: timestamp("accepted_at", { precision: 6, withTimezone: true }),
+        acceptedBy: text("accepted_by").references(() => user.id, { onDelete: "set null" }),
+        createdAt: timestamp("created_at", { precision: 6, withTimezone: true }).notNull().defaultNow(),
+    });
+    return { account, verification, twoFactor, rateLimit, einladung };
+}
+function buildMcp(user, session) {
+    /** Signing keys of the OAuth provider (better-auth `jwt` plugin); MCP access tokens are JWTs signed with them. */
+    const jwks = pgTable("jwks", {
+        id: text("id").primaryKey(),
+        publicKey: text("public_key").notNull(),
+        privateKey: text("private_key").notNull(),
+        createdAt: timestamp("created_at").notNull(),
+        expiresAt: timestamp("expires_at"),
+        alg: text("alg"),
+        crv: text("crv"),
+    });
+    /** OAuth clients of the MCP endpoint: AI assistants, registered dynamically or through a Client ID Metadata Document. */
+    const oauthClient = pgTable("oauth_client", {
+        id: text("id").primaryKey(),
+        clientId: text("client_id").notNull().unique(),
+        clientSecret: text("client_secret"),
+        clientDiscoveryId: text("client_discovery_id"),
+        disabled: boolean("disabled").default(false),
+        skipConsent: boolean("skip_consent"),
+        enableEndSession: boolean("enable_end_session"),
+        subjectType: text("subject_type"),
+        scopes: text("scopes").array(),
+        clientCredentialsScopes: text("client_credentials_scopes").array().default([]),
+        userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
+        createdAt: timestamp("created_at"),
+        updatedAt: timestamp("updated_at"),
+        name: text("name"),
+        uri: text("uri"),
+        icon: text("icon"),
+        contacts: text("contacts").array(),
+        tos: text("tos"),
+        policy: text("policy"),
+        softwareId: text("software_id"),
+        softwareVersion: text("software_version"),
+        softwareStatement: text("software_statement"),
+        redirectUris: text("redirect_uris").array().notNull(),
+        postLogoutRedirectUris: text("post_logout_redirect_uris").array(),
+        backchannelLogoutUri: text("backchannel_logout_uri"),
+        backchannelLogoutSessionRequired: boolean("backchannel_logout_session_required"),
+        tokenEndpointAuthMethod: text("token_endpoint_auth_method"),
+        applicationType: text("application_type"),
+        jwks: text("jwks"),
+        jwksUri: text("jwks_uri"),
+        grantTypes: text("grant_types").array(),
+        responseTypes: text("response_types").array(),
+        requirePKCE: boolean("require_pkce"),
+        dpopBoundAccessTokens: boolean("dpop_bound_access_tokens").default(false),
+        referenceId: text("reference_id"),
+        metadata: jsonb("metadata"),
+    }, (table) => [index("oauthClient_userId_idx").on(table.userId)]);
+    const oauthResource = pgTable("oauth_resource", {
+        id: text("id").primaryKey(),
+        identifier: text("identifier").notNull().unique(),
+        name: text("name").notNull(),
+        accessTokenTtl: integer("access_token_ttl"),
+        refreshTokenTtl: integer("refresh_token_ttl"),
+        signingAlgorithm: text("signing_algorithm"),
+        signingKeyId: text("signing_key_id"),
+        allowedScopes: text("allowed_scopes").array(),
+        customClaims: jsonb("custom_claims"),
+        dpopBoundAccessTokensRequired: boolean("dpop_bound_access_tokens_required").default(false),
+        disabled: boolean("disabled").default(false),
+        createdAt: timestamp("created_at"),
+        updatedAt: timestamp("updated_at"),
+        policyVersion: integer("policy_version").default(1),
+        metadata: jsonb("metadata"),
+    });
+    const oauthClientResource = pgTable("oauth_client_resource", {
+        id: text("id").primaryKey(),
+        clientId: text("client_id")
+            .notNull()
+            .references(() => oauthClient.clientId, { onDelete: "cascade" }),
+        resourceId: text("resource_id")
+            .notNull()
+            .references(() => oauthResource.identifier, { onDelete: "cascade" }),
+        metadata: jsonb("metadata"),
+        createdAt: timestamp("created_at"),
+    }, (table) => [
+        uniqueIndex("oauthClientResource_clientId_resourceId_uidx").on(table.clientId, table.resourceId),
+        index("oauthClientResource_clientId_idx").on(table.clientId),
+        index("oauthClientResource_resourceId_idx").on(table.resourceId),
+    ]);
+    const oauthRefreshToken = pgTable("oauth_refresh_token", {
+        id: text("id").primaryKey(),
+        token: text("token").notNull().unique(),
+        clientId: text("client_id")
+            .notNull()
+            .references(() => oauthClient.clientId, { onDelete: "cascade" }),
+        sessionId: text("session_id").references(() => session.id, { onDelete: "set null" }),
+        userId: text("user_id")
+            .notNull()
+            .references(() => user.id, { onDelete: "cascade" }),
+        referenceId: text("reference_id"),
+        authorizationCodeId: text("authorization_code_id"),
+        resources: text("resources").array(),
+        requestedUserInfoClaims: text("requested_user_info_claims").array(),
+        expiresAt: timestamp("expires_at").notNull(),
+        createdAt: timestamp("created_at").notNull(),
+        revoked: timestamp("revoked"),
+        rotatedAt: timestamp("rotated_at"),
+        rotationReplayResponse: text("rotation_replay_response"),
+        rotationReplayExpiresAt: timestamp("rotation_replay_expires_at"),
+        authTime: timestamp("auth_time"),
+        confirmation: jsonb("confirmation"),
+        scopes: text("scopes").array().notNull(),
+    }, (table) => [
+        index("oauthRefreshToken_clientId_idx").on(table.clientId),
+        index("oauthRefreshToken_sessionId_idx").on(table.sessionId),
+        index("oauthRefreshToken_userId_idx").on(table.userId),
+        index("oauthRefreshToken_authorizationCodeId_idx").on(table.authorizationCodeId),
+    ]);
+    const oauthAccessToken = pgTable("oauth_access_token", {
+        id: text("id").primaryKey(),
+        token: text("token").notNull().unique(),
+        clientId: text("client_id")
+            .notNull()
+            .references(() => oauthClient.clientId, { onDelete: "cascade" }),
+        sessionId: text("session_id").references(() => session.id, { onDelete: "set null" }),
+        userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
+        referenceId: text("reference_id"),
+        authorizationCodeId: text("authorization_code_id"),
+        resources: text("resources").array(),
+        requestedUserInfoClaims: text("requested_user_info_claims").array(),
+        refreshId: text("refresh_id").references(() => oauthRefreshToken.id, { onDelete: "cascade" }),
+        expiresAt: timestamp("expires_at").notNull(),
+        createdAt: timestamp("created_at").notNull(),
+        revoked: timestamp("revoked"),
+        confirmation: jsonb("confirmation"),
+        scopes: text("scopes").array().notNull(),
+    }, (table) => [
+        index("oauthAccessToken_clientId_idx").on(table.clientId),
+        index("oauthAccessToken_sessionId_idx").on(table.sessionId),
+        index("oauthAccessToken_userId_idx").on(table.userId),
+        index("oauthAccessToken_authorizationCodeId_idx").on(table.authorizationCodeId),
+        index("oauthAccessToken_refreshId_idx").on(table.refreshId),
+    ]);
+    const oauthConsent = pgTable("oauth_consent", {
+        id: text("id").primaryKey(),
+        clientId: text("client_id")
+            .notNull()
+            .references(() => oauthClient.clientId, { onDelete: "cascade" }),
+        userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
+        referenceId: text("reference_id"),
+        resources: text("resources").array(),
+        requestedUserInfoClaims: text("requested_user_info_claims").array(),
+        scopes: text("scopes").array().notNull(),
+        createdAt: timestamp("created_at").notNull(),
+        updatedAt: timestamp("updated_at").notNull(),
+    }, (table) => [index("oauthConsent_clientId_idx").on(table.clientId), index("oauthConsent_userId_idx").on(table.userId)]);
+    const oauthClientAssertion = pgTable("oauth_client_assertion", {
+        id: text("id").primaryKey(),
+        expiresAt: timestamp("expires_at").notNull(),
+    });
+    return { jwks, oauthClient, oauthResource, oauthClientResource, oauthRefreshToken, oauthAccessToken, oauthConsent, oauthClientAssertion };
+}
+export function authSchema(options = {}) {
+    const admin = options.admin ?? false;
+    const mcp = options.mcp ?? false;
+    const user = admin ? buildUserAdmin() : buildUser();
+    const session = admin ? buildSessionAdmin(user) : buildSession(user);
+    const tables = { user, session, ...buildShared(user), ...(mcp ? buildMcp(user, session) : {}) };
+    return tables;
+}

package/dist/server/create.d.ts

@@ -0,0 +1,87 @@
+/**
+ * `createAuth()`: better-auth for a Product, from explicit options. The Product's `src/lib/auth.ts` calls it once with
+ * its database, its tables (`authSchema`), its env and config; everything else in this package reads the result.
+ */
+import type { RequestHandler } from "@sveltejs/kit";
+import type { Handle } from "@sveltejs/kit/hooks";
+import { betterAuth, type BetterAuthPlugin } from "better-auth";
+import { admin as adminPlugin } from "better-auth/plugins";
+import { twoFactor } from "better-auth/plugins/two-factor";
+import { sveltekitCookies } from "better-auth/svelte-kit";
+import type { Mailer } from "@vonall/mail";
+import { roles, ac } from "../permissions.js";
+import type { AuthSchema } from "../schema/index.js";
+import { type AuthLog, type Db } from "./registry.js";
+import { type SignupMode } from "../types.js";
+export type SocialProvider = {
+    clientId: string;
+    clientSecret: string;
+};
+export type CreateAuthOptions = {
+    /** The Product's Drizzle database. */
+    db: Db;
+    /** The Product's tables from `authSchema()`, the same objects its `schema/` re-exports. */
+    schema: AuthSchema;
+    /** BETTER_AUTH_SECRET. */
+    secret: string;
+    /** The app's own address (ORIGIN), e.g. https://blueprint.vonall.ch. */
+    origin: string;
+    appName: string;
+    /** LOCALE, e.g. "en-GB" or "de-CH": dates in mails. */
+    locale: string;
+    signupMode: SignupMode;
+    /** The Product's mailer (`@vonall/mail`); off without SMTP, which the signup mode `open` and the reset respect. */
+    mailer: Mailer;
+    /** The Admin option: the admin plugin and roles, the first account becomes admin. Matches `authSchema({ admin })`. */
+    admin?: boolean;
+    /** Social logins with keys; a provider without keys is left out (its button never shows). */
+    social?: {
+        github?: SocialProvider | null;
+        google?: SocialProvider | null;
+    };
+    /** More better-auth plugins, e.g. the MCP endpoint's (`@vonall/mcp`). */
+    plugins?: BetterAuthPlugin[];
+    /** More rate limit rules, by path (`@vonall/mcp` adds `/oauth2/register`). */
+    rateLimitRules?: Record<string, {
+        window: number;
+        max: number;
+    }>;
+    log?: AuthLog;
+};
+/**
+ * The instance's type, with every plugin of this package: what `App.Locals` and the Products' code infer from. The admin
+ * plugin is in it whether or not the option is on, so `user.role` exists; without the option it is left out at runtime
+ * and nobody has a role.
+ */
+type FullPlugins = [ReturnType<typeof twoFactor>, ReturnType<typeof adminPlugin<{
+    ac: typeof ac;
+    roles: typeof roles;
+}>>, ReturnType<typeof sveltekitCookies>];
+export type Auth = ReturnType<typeof betterAuth<{
+    plugins: FullPlugins;
+}>>;
+/** The admin plugin's columns, named here because the plugin's type doesn't carry them into the session's user. */
+export type AdminFields = {
+    role?: string | null;
+    banned?: boolean | null;
+    banReason?: string | null;
+    banExpires?: Date | null;
+};
+/** The user and the session as the hooks put them into `locals` (a Product's `app.d.ts` uses these). */
+export type AuthUser = Auth["$Infer"]["Session"]["user"] & AdminFields;
+export type AuthSession = Auth["$Infer"]["Session"]["session"];
+export type CreatedAuth = {
+    /** The better-auth instance: `auth.api`, `auth.handler`, `auth.$context`. */
+    auth: Auth;
+    /** The hooks handle: the session into `locals.user`/`locals.session`, and better-auth's own routes (/api/auth/*). */
+    handle: Handle;
+    /** For `src/routes/api/auth/[...auth]/+server.ts`: `export const GET = apiHandler, POST = apiHandler`. */
+    apiHandler: RequestHandler;
+    /** The social logins that have keys; the login, signup and settings pages show only these. */
+    providers: {
+        github: boolean;
+        google: boolean;
+    };
+};
+export declare function createAuth(options: CreateAuthOptions): CreatedAuth;
+export {};

package/dist/server/create.js

@@ -0,0 +1,158 @@
+import { getRequestEvent } from "$app/server";
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { APIError } from "better-auth/api";
+import { admin as adminPlugin } from "better-auth/plugins";
+import { twoFactor } from "better-auth/plugins/two-factor";
+import { sveltekitCookies, svelteKitHandler } from "better-auth/svelte-kit";
+import { m } from "../messages.js";
+import { roles, ac } from "../permissions.js";
+import { hashPassword, verifyPassword } from "./crypto.js";
+import { consoleLog, setRegistry } from "./registry.js";
+import { UserRepo } from "./repositories/UserRepo.js";
+import { EINLADUNG_COOKIE, EinladungService } from "./service/einladung.service.js";
+import { sendPasswordResetEmail, sendVerifyEmail } from "./service/mail.js";
+import { MIN_PASSWORD_LENGTH } from "../types.js";
+import { nameFromEmail } from "../util/names.js";
+/** The Einladung token the browser carries from its link (`/einladung/[token]`), if any. */
+function einladungAusCookie() {
+    try {
+        return getRequestEvent().cookies.get(EINLADUNG_COOKIE);
+    }
+    catch {
+        return undefined; // outside a request, e.g. in scripts
+    }
+}
+const hasKeys = (p) => Boolean(p?.clientId && p.clientSecret && p.clientId !== "dummy");
+function build(options) {
+    const { secret, origin, appName, signupMode, admin = false, social = {}, plugins = [], rateLimitRules = {}, log = consoleLog } = options;
+    const baseURL = origin || "http://localhost";
+    return betterAuth({
+        appName,
+        baseURL,
+        secret: secret || "dummy-secret-for-build-purposes-only",
+        database: drizzleAdapter(options.db, { provider: "pg", schema: options.schema }),
+        account: {
+            // A GitHub or Google login joins the account with the same email, when the provider confirms that email
+            accountLinking: { enabled: true },
+        },
+        advanced: {
+            // Behind Coolify's Traefik: it sets X-Real-Ip to the client address itself, so clients can't fake it (the app's
+            // port is never published, Traefik is the only way in)
+            ipAddress: { ipAddressHeaders: ["x-real-ip"] },
+        },
+        rateLimit: {
+            enabled: true,
+            storage: "database",
+            window: 60,
+            max: 100,
+            customRules: {
+                "/sign-in/*": { window: 60, max: 10 },
+                "/sign-up/*": { window: 60, max: 10 },
+                "/two-factor/*": { window: 60, max: 10 },
+                "/request-password-reset": { window: 300, max: 3 },
+                ...rateLimitRules,
+            },
+        },
+        databaseHooks: {
+            user: {
+                create: {
+                    before: async (user) => {
+                        // The signup mode decides: an Einladung, or (open) mail for the confirmation link. The very first account
+                        // (the admin) needs neither and counts as confirmed.
+                        const { state, firstAccount } = await EinladungService.signup(einladungAusCookie());
+                        if (state === "needs_einladung")
+                            throw new APIError("FORBIDDEN", { message: m().needsEinladung });
+                        if (state === "no_mail")
+                            throw new APIError("FORBIDDEN", { message: m().noMail });
+                        if (firstAccount)
+                            user.emailVerified = true;
+                        // Signup with email and password sends the email's local part as the name; make it readable
+                        if (user.email && (!user.name || user.name === user.email.split("@")[0]))
+                            user.name = nameFromEmail(user.email);
+                        return { data: user };
+                    },
+                    after: async (user) => {
+                        // The first user becomes admin
+                        if (admin && (await UserRepo.countUsers()) === 1) {
+                            log.info("First user created, bootstrapping global role to admin");
+                            await UserRepo.setRole(user.id, "admin");
+                        }
+                        const token = einladungAusCookie();
+                        if (!token)
+                            return;
+                        const angenommen = await EinladungService.annehmen(user.id, token);
+                        if (angenommen.isErr())
+                            log.warn("Einladung could not be accepted after signup", { userId: user.id, kind: angenommen.error.kind });
+                        getRequestEvent().cookies.delete(EINLADUNG_COOKIE, { path: "/" });
+                    },
+                },
+            },
+        },
+        emailAndPassword: {
+            enabled: true,
+            password: { hash: hashPassword, verify: verifyPassword },
+            minPasswordLength: MIN_PASSWORD_LENGTH,
+            // Signup mode open: anyone may sign up, so the email address is confirmed before the account can be used
+            requireEmailVerification: signupMode === "open",
+            sendResetPassword: async ({ user, url }) => {
+                await sendPasswordResetEmail(user, url);
+            },
+        },
+        emailVerification: {
+            sendOnSignUp: signupMode === "open",
+            sendOnSignIn: signupMode === "open",
+            autoSignInAfterVerification: true,
+            sendVerificationEmail: async ({ user, url }) => {
+                if (!user.emailVerified)
+                    await sendVerifyEmail(user, url);
+            },
+        },
+        socialProviders: {
+            ...(hasKeys(social.github) ? { github: social.github } : {}),
+            ...(hasKeys(social.google) ? { google: social.google } : {}),
+        },
+        user: {
+            changeEmail: { enabled: true, updateEmailWithoutVerification: true },
+        },
+        session: {
+            // No cookie cache: every request reads the session and the user, so a new role (the first account's, one set by
+            // an admin) and a ban count at once instead of after up to 5 minutes; for a small app that one query is nothing
+            cookieCache: { enabled: false },
+        },
+        plugins: [
+            twoFactor(),
+            ...(admin ? [adminPlugin({ ac, roles })] : []),
+            ...plugins,
+            sveltekitCookies(getRequestEvent), // Ensure cookies are populated in SvelteKit
+        ],
+    });
+}
+export function createAuth(options) {
+    const auth = build(options);
+    const { social = {} } = options;
+    setRegistry({
+        db: options.db,
+        schema: options.schema,
+        appName: options.appName,
+        origin: options.origin,
+        locale: options.locale,
+        signupMode: options.signupMode,
+        mailer: options.mailer,
+        admin: options.admin ?? false,
+        log: options.log ?? consoleLog,
+        auth,
+        providers: { github: hasKeys(social.github), google: hasKeys(social.google) },
+    });
+    const handle = async ({ event, resolve }) => {
+        const current = await auth.api.getSession({ headers: event.request.headers });
+        if (current) {
+            event.locals.session = current.session;
+            event.locals.user = current.user;
+        }
+        const { building } = await import("$app/env");
+        return svelteKitHandler({ event, resolve, auth, building });
+    };
+    const apiHandler = ({ request }) => auth.handler(request);
+    return { auth, handle, apiHandler, providers: { github: hasKeys(social.github), google: hasKeys(social.google) } };
+}

package/dist/server/crypto.d.ts

@@ -0,0 +1,5 @@
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(data: {
+    password: string;
+    hash: string;
+}): Promise<boolean>;

package/dist/server/crypto.js

@@ -0,0 +1,15 @@
+import { hash, verify } from "@node-rs/argon2";
+const opts = {
+    memoryCost: 65536, // 64 MiB
+    timeCost: 3, // 3 iterations
+    parallelism: 4, // 4 lanes
+    outputLen: 32, // 32 bytes
+    algorithm: 2, // Argon2id
+};
+export async function hashPassword(password) {
+    return await hash(password, opts);
+}
+export async function verifyPassword(data) {
+    const { password, hash: passwordHash } = data;
+    return await verify(passwordHash, password, opts);
+}

package/dist/server/helpers.d.ts

@@ -0,0 +1,18 @@
+import { type RemoteFormInput, type RemoteFormInvalidField } from "$app/server";
+import type { z } from "zod";
+import type { SessionUser } from "../types.js";
+type User = SessionUser;
+/** The logged-in user of the current request, else a 401. */
+export declare function requireUser(): User;
+/** The logged-in admin of the current request, else a 401 or 403. */
+export declare function requireAdmin(): User;
+export declare function protectedQuery<Result>(callback: (user: User) => Result | Promise<Result>): import("$app/server").RemoteQueryFunction<void, Result, void>;
+export declare function protectedSchemaQuery<Schema extends z.ZodType, Result>(schema: Schema, callback: (data: z.output<Schema>, user: User) => Result | Promise<Result>): import("$app/server").RemoteQueryFunction<import("better-auth").StandardSchemaV1.InferInput<Schema>, Result, import("better-auth").StandardSchemaV1.InferOutput<Schema>>;
+export declare function protectedCommand<Result>(callback: (user: User) => Result | Promise<Result>): import("$app/server").RemoteCommand<void, Result>;
+export declare function protectedSchemaCommand<Schema extends z.ZodType, Result>(schema: Schema, callback: (data: z.output<Schema>, user: User) => Result | Promise<Result>): import("$app/server").RemoteCommand<import("better-auth").StandardSchemaV1.InferInput<Schema>, Result>;
+export declare function protectedForm<Schema extends z.ZodType<RemoteFormInput, RemoteFormInput>, Result>(schema: Schema, callback: (data: z.output<Schema>, issue: RemoteFormInvalidField<z.input<Schema>>, user: User) => Result | Promise<Result>): import("$app/server").RemoteForm<RemoteFormInput, Result>;
+export declare function adminQuery<Result>(callback: (user: User) => Result | Promise<Result>): import("$app/server").RemoteQueryFunction<void, Result, void>;
+export declare function adminSchemaQuery<Schema extends z.ZodType, Result>(schema: Schema, callback: (data: z.output<Schema>, user: User) => Result | Promise<Result>): import("$app/server").RemoteQueryFunction<import("better-auth").StandardSchemaV1.InferInput<Schema>, Result, import("better-auth").StandardSchemaV1.InferOutput<Schema>>;
+export declare function adminCommand<Result>(callback: (user: User) => Result | Promise<Result>): import("$app/server").RemoteCommand<void, Result>;
+export declare function adminSchemaCommand<Schema extends z.ZodType, Result>(schema: Schema, callback: (data: z.output<Schema>, user: User) => Result | Promise<Result>): import("$app/server").RemoteCommand<import("better-auth").StandardSchemaV1.InferInput<Schema>, Result>;
+export {};

package/dist/server/helpers.js

@@ -0,0 +1,62 @@
+/**
+ * The login and permission wrappers for a Product's remote functions: `protected…` needs a logged-in user, `admin…`
+ * an admin (the Admin option). Each returns a query, command or form, so a `.remote.ts` file may export it.
+ */
+import { error } from "@sveltejs/kit";
+import { command, form, getRequestEvent, query } from "$app/server";
+import { m } from "../messages.js";
+function throwUnauthorized() {
+    throw error(401, { message: m().unauthorized, id: "unauthorized", timestamp: new Date().toISOString() });
+}
+function throwForbidden() {
+    throw error(403, { message: m().forbidden, id: "forbidden", timestamp: new Date().toISOString() });
+}
+/** The logged-in user of the current request, else a 401. */
+export function requireUser() {
+    const user = getRequestEvent()?.locals.user;
+    if (!user)
+        throwUnauthorized();
+    return user;
+}
+/** The logged-in admin of the current request, else a 401 or 403. */
+export function requireAdmin() {
+    const user = requireUser();
+    if (user.role !== "admin")
+        throwForbidden();
+    return user;
+}
+/**
+ * SvelteKit types validated input as the schema's Standard Schema output; for a Zod schema that is
+ * its `z.output`, which TypeScript can't prove for a generic schema.
+ */
+function parsed(data) {
+    return data;
+}
+export function protectedQuery(callback) {
+    return query(async () => callback(requireUser()));
+}
+export function protectedSchemaQuery(schema, callback) {
+    return query(schema, async (data) => callback(parsed(data), requireUser()));
+}
+export function protectedCommand(callback) {
+    return command(async () => callback(requireUser()));
+}
+export function protectedSchemaCommand(schema, callback) {
+    return command(schema, async (data) => callback(parsed(data), requireUser()));
+}
+export function protectedForm(schema, callback) {
+    // form() checks the schema's booleans with a conditional type that a generic Schema can't resolve
+    return form(schema, async (data, issue) => callback(parsed(data), issue, requireUser()));
+}
+export function adminQuery(callback) {
+    return query(async () => callback(requireAdmin()));
+}
+export function adminSchemaQuery(schema, callback) {
+    return query(schema, async (data) => callback(parsed(data), requireAdmin()));
+}
+export function adminCommand(callback) {
+    return command(async () => callback(requireAdmin()));
+}
+export function adminSchemaCommand(schema, callback) {
+    return command(schema, async (data) => callback(parsed(data), requireAdmin()));
+}

package/dist/server/index.d.ts

@@ -0,0 +1,9 @@
+export { createAuth, type AdminFields, type Auth, type AuthSession, type AuthUser, type CreateAuthOptions, type CreatedAuth, type SocialProvider } from "./create.js";
+export { adminCommand, adminQuery, adminSchemaCommand, adminSchemaQuery, protectedCommand, protectedForm, protectedQuery, protectedSchemaCommand, protectedSchemaQuery, requireAdmin, requireUser, } from "./helpers.js";
+export { authLayoutLoad, einladungLoad, homeLayoutLoad, loginLoad, manageUserLoad, signupLoad } from "./loads.js";
+export { registry as authRegistry, type AuthLog, type Db } from "./registry.js";
+export { EinladungRepo } from "./repositories/EinladungRepo.js";
+export { UserRepo } from "./repositories/UserRepo.js";
+export { EINLADUNG_COOKIE, EINLADUNG_GUELTIG_TAGE, EinladungService, type EinladungError } from "./service/einladung.service.js";
+export { KontoService } from "./service/konto.service.js";
+export { sendEinladungEmail, sendPasswordResetEmail, sendVerifyEmail } from "./service/mail.js";

package/dist/server/index.js

@@ -0,0 +1,9 @@
+export { createAuth } from "./create.js";
+export { adminCommand, adminQuery, adminSchemaCommand, adminSchemaQuery, protectedCommand, protectedForm, protectedQuery, protectedSchemaCommand, protectedSchemaQuery, requireAdmin, requireUser, } from "./helpers.js";
+export { authLayoutLoad, einladungLoad, homeLayoutLoad, loginLoad, manageUserLoad, signupLoad } from "./loads.js";
+export { registry as authRegistry } from "./registry.js";
+export { EinladungRepo } from "./repositories/EinladungRepo.js";
+export { UserRepo } from "./repositories/UserRepo.js";
+export { EINLADUNG_COOKIE, EINLADUNG_GUELTIG_TAGE, EinladungService } from "./service/einladung.service.js";
+export { KontoService } from "./service/konto.service.js";
+export { sendEinladungEmail, sendPasswordResetEmail, sendVerifyEmail } from "./service/mail.js";