@vonosan/auth 0.2.1

package/dist/middleware/auth.middleware.js

@@ -0,0 +1,194 @@
+/**
+ * ──────────────────────────────────────────────────────────────────
+ * 🏢 Company Name: Bonifade Technologies
+ * 👨‍💻 Developer: Bowofade Oyerinde
+ * 🐙 GitHub: oyenet1
+ * 📅 Created Date: 2026-04-05
+ * 🔄 Updated Date: 2026-04-05
+ * ──────────────────────────────────────────────────────────────────
+ */
+import { createMiddleware } from 'hono/factory';
+import { HTTPException } from 'hono/http-exception';
+import { Logger } from 'vonosan/server';
+import { verifyToken } from '../lib/jwt.js';
+import { accounts, apiKeys } from '../schema.js';
+import { eq } from 'drizzle-orm';
+// ─── authMiddleware ───────────────────────────────────────────────────────────
+/**
+ * `authMiddleware` — verifies the Bearer JWT, loads the account from DB,
+ * and sets `c.var.account`. Returns 401 on missing/invalid token.
+ */
+export const authMiddleware = createMiddleware(async (c, next) => {
+    const authHeader = c.req.header('Authorization');
+    if (!authHeader?.startsWith('Bearer ')) {
+        throw new HTTPException(401, { message: 'Unauthorized: missing token' });
+    }
+    const token = authHeader.slice(7);
+    const config = c.var.config;
+    const payload = await verifyToken(token, config.JWT_SECRET);
+    if (!payload) {
+        throw new HTTPException(401, { message: 'Unauthorized: invalid or expired token' });
+    }
+    if (!payload.sub) {
+        throw new HTTPException(401, { message: 'Unauthorized: invalid token subject' });
+    }
+    const db = c.var.db;
+    // Load account from DB to get current roles/status
+    const [account] = await db.select().from(accounts).where(eq(accounts.id, payload.sub)).limit(1);
+    if (!account || account.status !== 'active') {
+        throw new HTTPException(401, { message: 'Unauthorized: account not found or inactive' });
+    }
+    c.set('account', {
+        id: account.id,
+        email: account.email,
+        username: account.username,
+        currentRole: account.current_role,
+        roles: [account.current_role],
+        status: account.status,
+        language: account.language,
+    });
+    await next();
+});
+// ─── optionalAuthMiddleware ───────────────────────────────────────────────────
+/**
+ * `optionalAuthMiddleware` — silently continues as guest on invalid/missing token.
+ * Does not set `c.var.account` if authentication fails.
+ */
+export const optionalAuthMiddleware = createMiddleware(async (c, next) => {
+    try {
+        const authHeader = c.req.header('Authorization');
+        if (authHeader?.startsWith('Bearer ')) {
+            const token = authHeader.slice(7);
+            const config = c.var.config;
+            const payload = await verifyToken(token, config.JWT_SECRET);
+            if (payload) {
+                if (!payload.sub) {
+                    await next();
+                    return;
+                }
+                const db = c.var.db;
+                const [account] = await db
+                    .select()
+                    .from(accounts)
+                    .where(eq(accounts.id, payload.sub))
+                    .limit(1);
+                if (account && account.status === 'active') {
+                    c.set('account', {
+                        id: account.id,
+                        email: account.email,
+                        username: account.username,
+                        currentRole: account.current_role,
+                        roles: [account.current_role],
+                        status: account.status,
+                        language: account.language,
+                    });
+                }
+            }
+        }
+    }
+    catch (err) {
+        Logger.debug('[auth] optionalAuthMiddleware: silent failure', { error: String(err) });
+    }
+    await next();
+});
+// ─── Role guards ──────────────────────────────────────────────────────────────
+/**
+ * `isAdmin` — 403 if the authenticated user is not admin or superadmin.
+ * Must be used after `authMiddleware`.
+ */
+export const isAdmin = createMiddleware(async (c, next) => {
+    const account = c.var.account;
+    if (!account) {
+        throw new HTTPException(401, { message: 'Unauthorized' });
+    }
+    if (!['admin', 'superadmin'].includes(account.currentRole)) {
+        throw new HTTPException(403, { message: 'Forbidden: admin access required' });
+    }
+    await next();
+});
+/**
+ * `isSuperAdmin` — 403 if the authenticated user is not superadmin.
+ * Must be used after `authMiddleware`.
+ */
+export const isSuperAdmin = createMiddleware(async (c, next) => {
+    const account = c.var.account;
+    if (!account) {
+        throw new HTTPException(401, { message: 'Unauthorized' });
+    }
+    if (account.currentRole !== 'superadmin') {
+        throw new HTTPException(403, { message: 'Forbidden: superadmin access required' });
+    }
+    await next();
+});
+// ─── apiKeyOrJwtMiddleware ────────────────────────────────────────────────────
+/**
+ * `apiKeyOrJwtMiddleware` — accepts either a Bearer JWT or a `vono_*` API key.
+ * Sets `c.var.account` on success; returns 401 on failure.
+ */
+export const apiKeyOrJwtMiddleware = createMiddleware(async (c, next) => {
+    const authHeader = c.req.header('Authorization');
+    const config = c.var.config;
+    const db = c.var.db;
+    // Try API key first (vono_ prefix)
+    if (authHeader?.startsWith('Bearer vono_')) {
+        const rawKey = authHeader.slice(7);
+        // Hash the key for lookup
+        const { hashOtp } = await import('../lib/otp.js');
+        const keyHash = await hashOtp(rawKey);
+        const [keyRow] = await db.select().from(apiKeys).where(eq(apiKeys.key_hash, keyHash)).limit(1);
+        if (!keyRow) {
+            throw new HTTPException(401, { message: 'Unauthorized: invalid API key' });
+        }
+        const [account] = await db
+            .select()
+            .from(accounts)
+            .where(eq(accounts.id, keyRow.account_id))
+            .limit(1);
+        if (!account || account.status !== 'active') {
+            throw new HTTPException(401, { message: 'Unauthorized: account inactive' });
+        }
+        // Update last_used_at asynchronously (fire-and-forget)
+        db.update(apiKeys)
+            .set({ last_used_at: new Date() })
+            .where(eq(apiKeys.id, keyRow.id))
+            .execute()
+            .catch((err) => Logger.warn('[auth] Failed to update api key last_used_at', { error: String(err) }));
+        c.set('account', {
+            id: account.id,
+            email: account.email,
+            username: account.username,
+            currentRole: account.current_role,
+            roles: [account.current_role],
+            status: account.status,
+            language: account.language,
+        });
+        return next();
+    }
+    // Fall back to JWT
+    if (authHeader?.startsWith('Bearer ')) {
+        const token = authHeader.slice(7);
+        const payload = await verifyToken(token, config.JWT_SECRET);
+        if (!payload) {
+            throw new HTTPException(401, { message: 'Unauthorized: invalid token' });
+        }
+        if (!payload.sub) {
+            throw new HTTPException(401, { message: 'Unauthorized: invalid token subject' });
+        }
+        const [account] = await db.select().from(accounts).where(eq(accounts.id, payload.sub)).limit(1);
+        if (!account || account.status !== 'active') {
+            throw new HTTPException(401, { message: 'Unauthorized: account not found' });
+        }
+        c.set('account', {
+            id: account.id,
+            email: account.email,
+            username: account.username,
+            currentRole: account.current_role,
+            roles: [account.current_role],
+            status: account.status,
+            language: account.language,
+        });
+        return next();
+    }
+    throw new HTTPException(401, { message: 'Unauthorized: no credentials provided' });
+});
+//# sourceMappingURL=auth.middleware.js.map

package/dist/middleware/auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.middleware.js","sourceRoot":"","sources":["../../src/middleware/auth.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAQhC,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAC5C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAChD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;IAC3B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;IAE3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,EAAY,CAAA;IAE7B,mDAAmD;IACnD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAE/F,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAA;IAC1F,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;QACf,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,YAA0C;QAC/D,KAAK,EAAE,CAAC,OAAO,CAAC,YAA0C,CAAC;QAC3D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAA;IAEF,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,CACF,CAAA;AAED,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CACpD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;QAChD,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;YAC3B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;YAE3D,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;oBACjB,MAAM,IAAI,EAAE,CAAA;oBACZ,OAAM;gBACR,CAAC;gBAED,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,EAAY,CAAA;gBAC7B,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;qBACvB,MAAM,EAAE;qBACR,IAAI,CAAC,QAAQ,CAAC;qBACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;qBACnC,KAAK,CAAC,CAAC,CAAC,CAAA;gBAEX,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC3C,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;wBACf,EAAE,EAAE,OAAO,CAAC,EAAE;wBACd,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,WAAW,EAAE,OAAO,CAAC,YAA0C;wBAC/D,KAAK,EAAE,CAAC,OAAO,CAAC,YAA0C,CAAC;wBAC3D,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;qBAC3B,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,CACF,CAAA;AAED,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAA+B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACtF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAA;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAC1C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAA;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QACzC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,CACF,CAAA;AAED,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CACnD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;IAC3B,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,EAAY,CAAA;IAE7B,mCAAmC;IACnC,IAAI,UAAU,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAElC,0BAA0B;QAC1B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;QAErC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAE9F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;QAC5E,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;aACzC,KAAK,CAAC,CAAC,CAAC,CAAA;QAEX,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAA;QAC7E,CAAC;QAED,uDAAuD;QACvD,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACjC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;aAChC,OAAO,EAAE;aACT,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAE/G,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;YACf,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,YAA0C;YAC/D,KAAK,EAAE,CAAC,OAAO,CAAC,YAA0C,CAAC;YAC3D,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAA;QAEF,OAAO,IAAI,EAAE,CAAA;IACf,CAAC;IAED,mBAAmB;IACnB,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;QAE3D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAA;QAClF,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAE/F,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAA;QAC9E,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;YACf,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,YAA0C;YAC/D,KAAK,EAAE,CAAC,OAAO,CAAC,YAA0C,CAAC;YAC3D,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAA;QAEF,OAAO,IAAI,EAAE,CAAA;IACf,CAAC;IAED,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAA;AACpF,CAAC,CACF,CAAA"}

package/dist/passkey-schema.d.ts

@@ -0,0 +1,375 @@
+/**
+ * ──────────────────────────────────────────────────────────────────
+ * 🏢 Company Name: Bonifade Technologies
+ * 👨‍💻 Developer: Bowofade Oyerinde
+ * 🐙 GitHub: oyenet1
+ * 📅 Created Date: 2026-04-05
+ * 🔄 Updated Date: 2026-04-05
+ * ──────────────────────────────────────────────────────────────────
+ */
+/**
+ * passkey_credentials — stores WebAuthn/Passkey credentials per account.
+ *
+ * One account can have multiple passkeys (e.g. phone + laptop + YubiKey).
+ * Each credential is identified by its credentialId (from the authenticator).
+ */
+export declare const passkeyCredentials: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "passkey_credentials";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "passkey_credentials";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        account_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "account_id";
+            tableName: "passkey_credentials";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        credential_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "credential_id";
+            tableName: "passkey_credentials";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 512;
+        }>;
+        public_key: import("drizzle-orm/pg-core").PgColumn<{
+            name: "public_key";
+            tableName: "passkey_credentials";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        sign_count: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sign_count";
+            tableName: "passkey_credentials";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        device_type: import("drizzle-orm/pg-core").PgColumn<{
+            name: "device_type";
+            tableName: "passkey_credentials";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 20;
+        }>;
+        backed_up: import("drizzle-orm/pg-core").PgColumn<{
+            name: "backed_up";
+            tableName: "passkey_credentials";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        aaguid: import("drizzle-orm/pg-core").PgColumn<{
+            name: "aaguid";
+            tableName: "passkey_credentials";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 36;
+        }>;
+        transports: import("drizzle-orm/pg-core").PgColumn<{
+            name: "transports";
+            tableName: "passkey_credentials";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "passkey_credentials";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 100;
+        }>;
+        last_used_at: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_used_at";
+            tableName: "passkey_credentials";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        created_at: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "passkey_credentials";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updated_at: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "passkey_credentials";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+/**
+ * passkey_challenges — temporary challenge storage for WebAuthn ceremonies.
+ *
+ * Challenges expire after 5 minutes and are deleted after use.
+ */
+export declare const passkeyChallenges: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "passkey_challenges";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "passkey_challenges";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        challenge: import("drizzle-orm/pg-core").PgColumn<{
+            name: "challenge";
+            tableName: "passkey_challenges";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 512;
+        }>;
+        type: import("drizzle-orm/pg-core").PgColumn<{
+            name: "type";
+            tableName: "passkey_challenges";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 20;
+        }>;
+        account_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "account_id";
+            tableName: "passkey_challenges";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expires_at: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "passkey_challenges";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        created_at: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "passkey_challenges";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export type PasskeyCredential = typeof passkeyCredentials.$inferSelect;
+export type NewPasskeyCredential = typeof passkeyCredentials.$inferInsert;
+export type PasskeyChallenge = typeof passkeyChallenges.$inferSelect;
+//# sourceMappingURL=passkey-schema.d.ts.map

package/dist/passkey-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-schema.d.ts","sourceRoot":"","sources":["../src/passkey-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwC9B,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqB7B,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAA;AACtE,MAAM,MAAM,oBAAoB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAA;AACzE,MAAM,MAAM,gBAAgB,GAAG,OAAO,iBAAiB,CAAC,YAAY,CAAA"}

package/dist/passkey-schema.js

@@ -0,0 +1,63 @@
+/**
+ * ──────────────────────────────────────────────────────────────────
+ * 🏢 Company Name: Bonifade Technologies
+ * 👨‍💻 Developer: Bowofade Oyerinde
+ * 🐙 GitHub: oyenet1
+ * 📅 Created Date: 2026-04-05
+ * 🔄 Updated Date: 2026-04-05
+ * ──────────────────────────────────────────────────────────────────
+ */
+import { pgTable, uuid, varchar, text, integer, boolean, timestamp, index } from 'drizzle-orm/pg-core';
+/**
+ * passkey_credentials — stores WebAuthn/Passkey credentials per account.
+ *
+ * One account can have multiple passkeys (e.g. phone + laptop + YubiKey).
+ * Each credential is identified by its credentialId (from the authenticator).
+ */
+export const passkeyCredentials = pgTable('passkey_credentials', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    /** FK → accounts.id */
+    account_id: uuid('account_id').notNull(),
+    /** base64url-encoded credential ID from the authenticator */
+    credential_id: varchar('credential_id', { length: 512 }).notNull().unique(),
+    /** base64url-encoded COSE public key */
+    public_key: text('public_key').notNull(),
+    /** Replay-attack counter — must increase on every authentication */
+    sign_count: integer('sign_count').notNull().default(0),
+    /** 'platform' (device biometrics) or 'cross-platform' (security key) */
+    device_type: varchar('device_type', { length: 20 }).notNull().default('platform'),
+    /** Whether the credential is backed up to the cloud (e.g. iCloud Keychain) */
+    backed_up: boolean('backed_up').notNull().default(false),
+    /** Authenticator AAGUID — identifies the authenticator model */
+    aaguid: varchar('aaguid', { length: 36 }).notNull().default('00000000-0000-0000-0000-000000000000'),
+    /** Comma-separated transport hints: internal, usb, nfc, ble, hybrid */
+    transports: varchar('transports', { length: 255 }),
+    /** Human-readable name set by the user (e.g. "iPhone 15", "YubiKey 5") */
+    name: varchar('name', { length: 100 }),
+    last_used_at: timestamp('last_used_at'),
+    created_at: timestamp('created_at').defaultNow().notNull(),
+    updated_at: timestamp('updated_at').defaultNow().notNull(),
+}, (table) => ({
+    accountIdx: index('passkey_credentials_account_id_idx').on(table.account_id),
+    credentialIdx: index('passkey_credentials_credential_id_idx').on(table.credential_id),
+}));
+/**
+ * passkey_challenges — temporary challenge storage for WebAuthn ceremonies.
+ *
+ * Challenges expire after 5 minutes and are deleted after use.
+ */
+export const passkeyChallenges = pgTable('passkey_challenges', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    /** base64url-encoded random challenge */
+    challenge: varchar('challenge', { length: 512 }).notNull().unique(),
+    /** 'registration' or 'authentication' */
+    type: varchar('type', { length: 20 }).notNull(),
+    /** FK → accounts.id (null for registration before account exists) */
+    account_id: uuid('account_id'),
+    expires_at: timestamp('expires_at').notNull(),
+    created_at: timestamp('created_at').defaultNow().notNull(),
+}, (table) => ({
+    challengeIdx: index('passkey_challenges_challenge_idx').on(table.challenge),
+    expiresIdx: index('passkey_challenges_expires_at_idx').on(table.expires_at),
+}));
+//# sourceMappingURL=passkey-schema.js.map

package/dist/passkey-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-schema.js","sourceRoot":"","sources":["../src/passkey-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAEtG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CACvC,qBAAqB,EACrB;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IAE3C,uBAAuB;IACvB,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAExC,6DAA6D;IAC7D,aAAa,EAAE,OAAO,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAE3E,wCAAwC;IACxC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAExC,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEtD,wEAAwE;IACxE,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAEjF,8EAA8E;IAC9E,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAExD,gEAAgE;IAChE,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC;IAEnG,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAElD,0EAA0E;IAC1E,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAEtC,YAAY,EAAE,SAAS,CAAC,cAAc,CAAC;IACvC,UAAU,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IAC1D,UAAU,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC3D,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,UAAU,EAAE,KAAK,CAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;IAC5E,aAAa,EAAE,KAAK,CAAC,uCAAuC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;CACtF,CAAC,CACH,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CACtC,oBAAoB,EACpB;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IAE3C,yCAAyC;IACzC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAEnE,yCAAyC;IACzC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IAE/C,qEAAqE;IACrE,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC;IAE9B,UAAU,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC7C,UAAU,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC3D,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,YAAY,EAAE,KAAK,CAAC,kCAAkC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC3E,UAAU,EAAE,KAAK,CAAC,mCAAmC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;CAC5E,CAAC,CACH,CAAA"}

package/dist/routes/auth.routes.d.ts

@@ -0,0 +1,16 @@
+/**
+ * ──────────────────────────────────────────────────────────────────
+ * 🏢 Company Name: Bonifade Technologies
+ * 👨‍💻 Developer: Bowofade Oyerinde
+ * 🐙 GitHub: oyenet1
+ * 📅 Created Date: 2026-04-05
+ * 🔄 Updated Date: 2026-04-05
+ * ──────────────────────────────────────────────────────────────────
+ */
+import { Hono } from 'hono';
+import type { AppVariables } from 'vonosan/types';
+declare const authRouter: Hono<{
+    Variables: AppVariables;
+}, import("hono/types").BlankSchema, "/">;
+export default authRouter;
+//# sourceMappingURL=auth.routes.d.ts.map

package/dist/routes/auth.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.routes.d.ts","sourceRoot":"","sources":["../../src/routes/auth.routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAoCjD,QAAA,MAAM,UAAU;eAAyB,YAAY;yCAAK,CAAA;AAmD1D,eAAe,UAAU,CAAA"}