@weifuwujs/auth 0.9.0

package/dist/types.d.ts

@@ -0,0 +1,190 @@
+import type { App, Context, Middleware, MountableRoute } from '@weifuwujs/weifuwu';
+export type AuthRole = 'user' | 'admin';
+/** 内部用户记录（含密码哈希）；对外只暴露 {@link PublicUser} */
+export interface AuthUser {
+    id: string;
+    email: string;
+    passwordHash: string;
+    role: AuthRole;
+    disabledAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export type PublicUser = Omit<AuthUser, 'passwordHash'>;
+export interface AuthSession {
+    id: string;
+    userId: string;
+    tokenHash: string;
+    createdAt: Date;
+    expiresAt: Date;
+    lastSeenAt: Date;
+}
+export interface UserStore {
+    createUser(input: {
+        email: string;
+        passwordHash: string;
+        role?: AuthRole;
+    }): Promise<AuthUser>;
+    findUserByEmail(email: string): Promise<AuthUser | null>;
+    findUserById(id: string): Promise<AuthUser | null>;
+    updateUserEmail(id: string, email: string): Promise<void>;
+    updateUserPassword(id: string, passwordHash: string): Promise<void>;
+    setUserRole(id: string, role: AuthRole): Promise<void>;
+    setUserDisabled(id: string, disabledAt: Date | null): Promise<void>;
+    /** 可选：列出用户（CLI `user:list` 等管理场景） */
+    listUsers?(): Promise<AuthUser[]>;
+}
+export interface SessionStore {
+    createSession(input: {
+        userId: string;
+        tokenHash: string;
+        expiresAt: Date;
+    }): Promise<AuthSession>;
+    findSessionByTokenHash(tokenHash: string): Promise<AuthSession | null>;
+    touchSession(id: string, lastSeenAt: Date): Promise<void>;
+    deleteSession(id: string): Promise<void>;
+    /** 删除用户的所有会话；`exceptId` 用于改密时保留当前会话 */
+    deleteUserSessions(userId: string, exceptId?: string): Promise<void>;
+    deleteExpiredSessions(now: Date): Promise<number>;
+}
+export interface ResetTokenStore {
+    createResetToken(input: {
+        userId: string;
+        tokenHash: string;
+        expiresAt: Date;
+    }): Promise<void>;
+    /** 原子消费：有效则标记已用并返回 userId，否则返回 null */
+    consumeResetToken(tokenHash: string, now: Date): Promise<string | null>;
+    deleteExpiredResetTokens(now: Date): Promise<number>;
+}
+export interface AuthStore extends UserStore, SessionStore, ResetTokenStore {
+    /** 可选：建表/迁移（sqlite/postgres 实现；memory 不需要） */
+    migrate?(): Promise<void>;
+}
+export interface PasswordHasher {
+    hash(plain: string): string | Promise<string>;
+    verify(plain: string, stored: string): boolean | Promise<boolean>;
+    /** 返回 true 时，登录成功后会自动用新算法重算（惰性迁移） */
+    needsRehash?(stored: string): boolean;
+}
+export interface RateLimitStore {
+    hit(key: string, now: number, windowMs: number): Promise<{
+        count: number;
+        resetAt: number;
+    }> | {
+        count: number;
+        resetAt: number;
+    };
+}
+export interface SessionOptions {
+    /** cookie 名，默认 `ww_session` */
+    cookieName?: string;
+    /** 绝对过期（秒），默认 30 天 */
+    maxAge?: number;
+    /** 空闲过期（秒），默认关闭 */
+    idleMaxAge?: number;
+    /** 默认：生产环境为 true */
+    secure?: boolean;
+    sameSite?: 'Lax' | 'Strict' | 'None';
+    path?: string;
+}
+export interface RateLimitOptions {
+    /** 窗口内最大请求数，默认 10 */
+    max?: number;
+    /** 窗口毫秒数，默认 60000 */
+    windowMs?: number;
+    store?: RateLimitStore;
+}
+export interface AuthHooks {
+    onRegister?: (user: PublicUser) => void | Promise<void>;
+    onLogin?: (user: PublicUser) => void | Promise<void>;
+    onPasswordChange?: (user: PublicUser) => void | Promise<void>;
+}
+export interface AuthOptions {
+    store: AuthStore;
+    passwordHasher?: PasswordHasher;
+    session?: SessionOptions;
+    /** 默认每 IP 每分钟 10 次；`false` 关闭 */
+    rateLimit?: RateLimitOptions | false;
+    /** 重置密码链接的投递 hook；未配置时 dev 打印、生产静默 */
+    sendResetToken?: (user: PublicUser, url: string) => void | Promise<void>;
+    /** 重置链接的基地址，默认取请求 origin */
+    baseUrl?: string;
+    /** 重置页路径，默认 `/reset-password` */
+    resetPath?: string;
+    /** 允许的跨站 Origin；默认仅同源。`false` 关闭校验 */
+    origin?: string[] | false;
+    /** 重置 token 有效期（毫秒），默认 15 分钟 */
+    resetTokenTtlMs?: number;
+    /** 密码最小长度，默认 8 */
+    minPasswordLength?: number;
+    /** 登录页路径（require 的 302 目标与表单回跳），默认 `/login` */
+    loginPath?: string;
+    /** 注册页路径（表单失败回跳），默认 `/register` */
+    registerPath?: string;
+    /** 账户页路径（表单成功/失败回跳），默认 `/account` */
+    accountPath?: string;
+    /** 端点前缀，默认 `/auth` */
+    routePrefix?: string;
+    hooks?: AuthHooks;
+    /** 可注入时钟（测试用） */
+    now?: () => Date;
+}
+export interface AuthContext {
+    user: PublicUser | null;
+    /** 建立会话并把 cookie 写回当前响应（自定义 OAuth/魔术链接流程用） */
+    login(user: PublicUser): Promise<void>;
+    logout(): Promise<void>;
+    verifyPassword(plain: string): Promise<boolean>;
+}
+/** require 的检查：角色枚举或谓词 */
+export type AuthCheck = AuthRole | ((user: PublicUser) => boolean);
+export type AuthErrorCode = 'invalid_credentials' | 'invalid_email' | 'weak_password' | 'email_taken' | 'invalid_token' | 'unauthorized' | 'forbidden' | 'rate_limited';
+export type AuthResult = {
+    ok: true;
+    user: PublicUser;
+} | {
+    ok: false;
+    error: AuthErrorCode;
+};
+export interface Auth {
+    readonly store: AuthStore;
+    middleware: Middleware<Context, Context & {
+        auth: AuthContext;
+    }, Response | void>;
+    require(check?: AuthCheck): Middleware<Context, Context & {
+        auth: AuthContext;
+    }, Response | void>;
+    /** 一次性接线：`app.use(auth.middleware)` + `app.wsUse(auth.middleware)` */
+    install(app: App<any>): void;
+    /** 挂到 `app.mount(auth)` 的 REST 路由 */
+    routes(): MountableRoute[];
+    migrate(): Promise<void>;
+    createSession(userId: string): Promise<{
+        token: string;
+        expiresAt: Date;
+    }>;
+    register(input: {
+        email: string;
+        password: string;
+    }): Promise<AuthResult>;
+    authenticate(input: {
+        email: string;
+        password: string;
+    }): Promise<AuthResult>;
+    changePassword(input: {
+        userId: string;
+        currentPassword: string;
+        newPassword: string;
+        exceptSessionId?: string;
+    }): Promise<AuthResult>;
+    requestPasswordReset(email: string, baseUrl?: string): Promise<void>;
+    resetPassword(input: {
+        token: string;
+        password: string;
+    }): Promise<AuthResult>;
+    /** session cookie 的 Set-Cookie 值（自定义流程/测试用） */
+    sessionCookie(token: string): string;
+    clearSessionCookie(): string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAElF,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAA;AAEvC,6CAA6C;AAC7C,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,QAAQ,CAAA;IACd,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IACvB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;AAEvD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;IACf,UAAU,EAAE,IAAI,CAAA;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,KAAK,EAAE;QAChB,KAAK,EAAE,MAAM,CAAA;QACb,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,CAAC,EAAE,QAAQ,CAAA;KAChB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACrB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;IACxD,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;IAClD,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtD,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,qCAAqC;IACrC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAC,KAAK,EAAE;QACnB,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,SAAS,EAAE,IAAI,CAAA;KAChB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACxB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IACtE,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,uCAAuC;IACvC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,qBAAqB,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,eAAe;IAC9B,gBAAgB,CAAC,KAAK,EAAE;QACtB,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,SAAS,EAAE,IAAI,CAAA;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB,uCAAuC;IACvC,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACvE,wBAAwB,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACrD;AAED,MAAM,WAAW,SACf,SAAQ,SAAS,EACf,YAAY,EACZ,eAAe;IACjB,8CAA8C;IAC9C,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjE,qCAAqC;IACrC,WAAW,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CACD,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CACpF;AAED,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,sBAAsB;IACtB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,mBAAmB;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,oBAAoB;IACpB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IACpC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,qBAAqB;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,cAAc,CAAA;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,SAAS,CAAA;IAChB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,iCAAiC;IACjC,SAAS,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAA;IACpC,sCAAsC;IACtC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxE,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IACzB,gCAAgC;IAChC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,kBAAkB;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mCAAmC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,iBAAiB;IACjB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,8CAA8C;IAC9C,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACvB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChD;AAED,0BAA0B;AAC1B,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,CAAA;AAElE,MAAM,MAAM,aAAa,GACrB,qBAAqB,GACrB,eAAe,GACf,eAAe,GACf,aAAa,GACb,eAAe,GACf,cAAc,GACd,WAAW,GACX,cAAc,CAAA;AAElB,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAA;AAEvC,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EAAE,QAAQ,GAAG,IAAI,CAAC,CAAA;IACjF,OAAO,CACL,KAAK,CAAC,EAAE,SAAS,GAChB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EAAE,QAAQ,GAAG,IAAI,CAAC,CAAA;IACxE,sEAAsE;IACtE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;IAC5B,qCAAqC;IACrC,MAAM,IAAI,cAAc,EAAE,CAAA;IAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACxB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IAC1E,QAAQ,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACzE,YAAY,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC7E,cAAc,CAAC,KAAK,EAAE;QACpB,MAAM,EAAE,MAAM,CAAA;QACd,eAAe,EAAE,MAAM,CAAA;QACvB,WAAW,EAAE,MAAM,CAAA;QACnB,eAAe,CAAC,EAAE,MAAM,CAAA;KACzB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACvB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC9E,+CAA+C;IAC/C,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAA;IACpC,kBAAkB,IAAI,MAAM,CAAA;CAC7B"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@weifuwujs/auth",
+  "version": "0.9.0",
+  "description": "weifuwu 用户系统：scrypt、会话轮换、防枚举、限流、无 JS 表单页（memory/sqlite/postgres store + 契约套件）",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./sqlite": {
+      "types": "./dist/sqlite.d.ts",
+      "import": "./dist/sqlite.js",
+      "default": "./dist/sqlite.js"
+    },
+    "./postgres": {
+      "types": "./dist/postgres.d.ts",
+      "import": "./dist/postgres.js",
+      "default": "./dist/postgres.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "import": "./dist/testing.js",
+      "default": "./dist/testing.js"
+    }
+  },
+  "files": [
+    "dist",
+    "templates"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "node --test --test-force-exit \"test/**/*.test.ts\"",
+    "prepublishOnly": "npm run typecheck && npm run build && npm test"
+  },
+  "peerDependencies": {
+    "@weifuwujs/weifuwu": ">=0.8 <1",
+    "postgres": ">=3.4.0"
+  },
+  "peerDependenciesMeta": {
+    "postgres": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@weifuwujs/weifuwu": "file:../.."
+  },
+  "bin": {
+    "weifuwu-auth": "./dist/cli.js"
+  }
+}

package/templates/react-router-auth/app/auth.ts

@@ -0,0 +1,13 @@
+import { createAuth } from '@weifuwujs/weifuwu/auth'
+import { sqliteAuthStore } from '@weifuwujs/weifuwu/auth/sqlite'
+
+/**
+ * 用户系统：默认 sqlite 文件（`weifuwu auth migrate` 建表）。
+ * 换 postgres：`import { postgresAuthStore } from '@weifuwujs/weifuwu/auth/postgres'`，
+ * `store: postgresAuthStore(process.env.DATABASE_URL!)`。
+ */
+export const auth = createAuth({
+  store: sqliteAuthStore('data/auth.db'),
+})
+
+export type { AuthContext, PublicUser } from '@weifuwujs/weifuwu/auth'

package/templates/react-router-auth/app/context.ts

@@ -0,0 +1,6 @@
+import { createContext } from 'react-router'
+import type { PublicUser } from '@weifuwujs/weifuwu/auth'
+
+/** 由 weifuwu 中间件注入、在 RR loader 中读取的上下文 */
+export const greetingContext = createContext<string>()
+export const authUserContext = createContext<PublicUser | null>()

package/templates/react-router-auth/app/routes/account.tsx

@@ -0,0 +1,47 @@
+import { Form } from 'react-router'
+import type { Route } from './+types/account'
+import { authUserContext } from '~/context.ts'
+
+export function meta() {
+  return [{ title: '账户' }]
+}
+
+export function loader({ context }: Route.LoaderArgs) {
+  const user = context.get(authUserContext)
+  if (!user) throw new Response('Unauthorized', { status: 401 })
+  return { user }
+}
+
+export default function Account({ loaderData }: Route.ComponentProps) {
+  const { user } = loaderData
+  return (
+    <main className="mx-auto max-w-sm p-8">
+      <h1 className="text-2xl font-bold">账户</h1>
+      <p className="mt-2 text-gray-600">{user.email}</p>
+
+      <h2 className="mt-6 font-semibold">修改密码</h2>
+      <Form method="post" action="/auth/password/change" className="mt-2 space-y-3">
+        <input
+          name="currentPassword"
+          type="password"
+          required
+          placeholder="当前密码"
+          className="w-full border p-2"
+        />
+        <input
+          name="newPassword"
+          type="password"
+          required
+          minLength={8}
+          placeholder="新密码（至少 8 位）"
+          className="w-full border p-2"
+        />
+        <button className="w-full bg-blue-600 p-2 text-white">更新密码</button>
+      </Form>
+
+      <Form method="post" action="/auth/logout" className="mt-6">
+        <button className="w-full border p-2">退出登录</button>
+      </Form>
+    </main>
+  )
+}

package/templates/react-router-auth/app/routes/login.tsx

@@ -0,0 +1,59 @@
+import { Form, Link, useSearchParams } from 'react-router'
+
+const ERRORS: Record<string, string> = {
+  invalid_credentials: '邮箱或密码不正确',
+  invalid_email: '邮箱格式不正确',
+  rate_limited: '尝试过于频繁，请稍后再试',
+  forbidden: '请求被拒绝，请刷新后重试',
+}
+
+export function meta() {
+  return [{ title: '登录' }]
+}
+
+export default function Login() {
+  const [params] = useSearchParams()
+  const error = params.get('error')
+  return (
+    <main className="mx-auto max-w-sm p-8">
+      <h1 className="text-2xl font-bold">登录</h1>
+      {params.has('sent') && (
+        <p className="mt-2 text-sm text-green-700">
+          如果邮箱存在，重置链接已发送
+        </p>
+      )}
+      {params.has('reset') && (
+        <p className="mt-2 text-sm text-green-700">密码已重置，请登录</p>
+      )}
+      {error && (
+        <p className="mt-2 text-sm text-red-600">{ERRORS[error] ?? '请求失败'}</p>
+      )}
+      <Form method="post" action="/auth/login" className="mt-4 space-y-3">
+        <input
+          type="hidden"
+          name="next"
+          value={params.get('next') ?? '/account'}
+        />
+        <input
+          name="email"
+          type="email"
+          required
+          placeholder="邮箱"
+          className="w-full border p-2"
+        />
+        <input
+          name="password"
+          type="password"
+          required
+          placeholder="密码"
+          className="w-full border p-2"
+        />
+        <button className="w-full bg-blue-600 p-2 text-white">登录</button>
+      </Form>
+      <p className="mt-4 space-x-4 text-sm">
+        <Link to="/register">注册</Link>
+        <Link to="/reset-password">忘记密码</Link>
+      </p>
+    </main>
+  )
+}

package/templates/react-router-auth/app/routes/register.tsx

@@ -0,0 +1,47 @@
+import { Form, Link, useSearchParams } from 'react-router'
+
+const ERRORS: Record<string, string> = {
+  email_taken: '该邮箱已注册',
+  invalid_email: '邮箱格式不正确',
+  weak_password: '密码至少 8 位',
+  rate_limited: '尝试过于频繁，请稍后再试',
+  forbidden: '请求被拒绝，请刷新后重试',
+}
+
+export function meta() {
+  return [{ title: '注册' }]
+}
+
+export default function Register() {
+  const [params] = useSearchParams()
+  const error = params.get('error')
+  return (
+    <main className="mx-auto max-w-sm p-8">
+      <h1 className="text-2xl font-bold">注册</h1>
+      {error && (
+        <p className="mt-2 text-sm text-red-600">{ERRORS[error] ?? '请求失败'}</p>
+      )}
+      <Form method="post" action="/auth/register" className="mt-4 space-y-3">
+        <input
+          name="email"
+          type="email"
+          required
+          placeholder="邮箱"
+          className="w-full border p-2"
+        />
+        <input
+          name="password"
+          type="password"
+          required
+          minLength={8}
+          placeholder="密码（至少 8 位）"
+          className="w-full border p-2"
+        />
+        <button className="w-full bg-blue-600 p-2 text-white">注册</button>
+      </Form>
+      <p className="mt-4 text-sm">
+        <Link to="/login">已有账号，去登录</Link>
+      </p>
+    </main>
+  )
+}

package/templates/react-router-auth/app/routes/reset-password.tsx

@@ -0,0 +1,54 @@
+import { Form, Link, useSearchParams } from 'react-router'
+
+const ERRORS: Record<string, string> = {
+  invalid_token: '链接无效或已过期，请重新申请',
+  weak_password: '密码至少 8 位',
+  rate_limited: '尝试过于频繁，请稍后再试',
+  forbidden: '请求被拒绝，请刷新后重试',
+}
+
+export function meta() {
+  return [{ title: '重置密码' }]
+}
+
+export default function ResetPassword() {
+  const [params] = useSearchParams()
+  const token = params.get('token') ?? ''
+  const error = params.get('error')
+  return (
+    <main className="mx-auto max-w-sm p-8">
+      <h1 className="text-2xl font-bold">重置密码</h1>
+      {error && (
+        <p className="mt-2 text-sm text-red-600">{ERRORS[error] ?? '请求失败'}</p>
+      )}
+      {!error && (
+        <Form method="post" action="/auth/password/reset" className="mt-4 space-y-3">
+          <input type="hidden" name="token" value={token} />
+          <input
+            name="password"
+            type="password"
+            required
+            minLength={8}
+            placeholder="新密码（至少 8 位）"
+            className="w-full border p-2"
+          />
+          <button className="w-full bg-blue-600 p-2 text-white">重置</button>
+        </Form>
+      )}
+      <form method="post" action="/auth/password/forgot" className="mt-4 space-y-3">
+        <p className="text-sm text-gray-600">没有链接？输入邮箱重新申请：</p>
+        <input
+          name="email"
+          type="email"
+          required
+          placeholder="邮箱"
+          className="w-full border p-2"
+        />
+        <button className="w-full border p-2">发送重置链接</button>
+      </form>
+      <p className="mt-4 text-sm">
+        <Link to="/login">返回登录</Link>
+      </p>
+    </main>
+  )
+}

package/templates/react-router-auth/app/routes.ts

@@ -0,0 +1,9 @@
+import { index, route, type RouteConfig } from '@react-router/dev/routes'
+
+export default [
+  index('routes/home.tsx'),
+  route('login', 'routes/login.tsx'),
+  route('register', 'routes/register.tsx'),
+  route('reset-password', 'routes/reset-password.tsx'),
+  route('account', 'routes/account.tsx'),
+] satisfies RouteConfig

package/templates/react-router-auth/app/server.ts

@@ -0,0 +1,31 @@
+import { createApp, json } from '@weifuwujs/weifuwu'
+import { reactRouter } from '@weifuwujs/weifuwu/react-router'
+import type { Context, Middleware } from '@weifuwujs/weifuwu'
+import { RouterContextProvider } from 'react-router'
+import { authUserContext, greetingContext } from './context.ts'
+import { auth } from './auth.ts'
+
+type AppContext = Context & { greeting: string; auth?: import('@weifuwujs/weifuwu/auth').AuthContext }
+
+const withGreeting: Middleware<Context, AppContext> = async (
+  request,
+  context,
+  next,
+) => next(request, { ...context, greeting: 'hello-from-weifuwu' })
+
+export default createApp()
+  .use(withGreeting)
+  .use(auth.middleware)
+  .mount(auth)
+  .use('/account', auth.require())
+  .get('/api/health', () => json({ ok: true }))
+  .notFound(
+    reactRouter<AppContext>({
+      getLoadContext(_request, context) {
+        const loadContext = new RouterContextProvider()
+        loadContext.set(greetingContext, context.greeting)
+        loadContext.set(authUserContext, context.auth?.user ?? null)
+        return loadContext
+      },
+    }),
+  )