@withwiz/toolkit 0.7.1 → 0.8.0

package/dist/chunk-63EKUOJH.js

@@ -0,0 +1,72 @@
+import {
+  setTokenCookies
+} from "./chunk-PRPMEHRE.js";
+import {
+  getAuthConfig
+} from "./chunk-N3TCQ5BF.js";
+import {
+  __spreadValues
+} from "./chunk-N3ETBM74.js";
+
+// src/core/auth/token-delivery.ts
+async function readBodyRefreshToken(source) {
+  if (!source.json) return void 0;
+  try {
+    const body = await source.json();
+    return typeof (body == null ? void 0 : body.refreshToken) === "string" ? body.refreshToken : void 0;
+  } catch (e) {
+    return void 0;
+  }
+}
+var cookieStrategy = {
+  extractAccessToken: (source) => {
+    var _a, _b;
+    return (_b = (_a = source.cookies.get("access_token")) == null ? void 0 : _a.value) != null ? _b : null;
+  },
+  extractRefreshToken: async (source) => {
+    var _a;
+    return (_a = source.cookies.get("refresh_token")) == null ? void 0 : _a.value;
+  },
+  buildTokenResponse: (body) => body,
+  attachCookies: (response, tokens, options) => setTokenCookies(response, tokens, options)
+};
+var headerStrategy = {
+  extractAccessToken: (source, parseHeader) => parseHeader(source.headers.get("authorization")),
+  extractRefreshToken: (source) => readBodyRefreshToken(source),
+  buildTokenResponse: (body, fragment) => __spreadValues(__spreadValues({}, body), fragment),
+  attachCookies: (response) => response
+};
+var hybridStrategy = {
+  extractAccessToken: (source, parseHeader) => {
+    var _a, _b;
+    return (_b = (_a = source.cookies.get("access_token")) == null ? void 0 : _a.value) != null ? _b : parseHeader(source.headers.get("authorization"));
+  },
+  // 쿠키 우선 — 쿠키가 있으면 body 를 소비하지 않는다 (빈 body 요청 보호)
+  extractRefreshToken: async (source) => {
+    var _a, _b;
+    return (_b = (_a = source.cookies.get("refresh_token")) == null ? void 0 : _a.value) != null ? _b : await readBodyRefreshToken(source);
+  },
+  buildTokenResponse: (body, fragment) => __spreadValues(__spreadValues({}, body), fragment),
+  attachCookies: (response, tokens, options) => setTokenCookies(response, tokens, options)
+};
+var strategies = {
+  cookie: cookieStrategy,
+  header: headerStrategy,
+  hybrid: hybridStrategy
+};
+function resolveTokenDelivery(optionValue) {
+  if (optionValue) return optionValue;
+  try {
+    return getAuthConfig().tokenDelivery;
+  } catch (e) {
+    return "hybrid";
+  }
+}
+function getTokenDeliveryStrategy(optionValue) {
+  return strategies[resolveTokenDelivery(optionValue)];
+}
+
+export {
+  resolveTokenDelivery,
+  getTokenDeliveryStrategy
+};

package/dist/{chunk-N5VOFGF3.js → chunk-75UDFONR.js}

@@ -1,6 +1,6 @@
 import {
   TokenGenerator
-} from "./chunk-D73ZJQMX.js";
+} from "./chunk-ZZABL54F.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
@@ -26,12 +26,13 @@ var PasswordResetService = class {
     if (!user) return;
     const token = TokenGenerator.generate();
     const expires = new Date(Date.now() + this.tokenExpiryHours * 60 * 60 * 1e3);
-    await this.tokenRepo.create(email, token, "PASSWORD_RESET" /* PASSWORD_RESET */, expires);
+    await this.tokenRepo.create(email, TokenGenerator.hash(token), "PASSWORD_RESET" /* PASSWORD_RESET */, expires);
     await this.emailSender.sendPasswordResetEmail(email, token);
     this.logger.info("Password reset requested", { email });
   }
   async resetPassword(email, token, newPassword) {
-    const tokenRecord = await this.tokenRepo.findByEmailAndToken(email, token, "PASSWORD_RESET" /* PASSWORD_RESET */);
+    const hashedToken = TokenGenerator.hash(token);
+    const tokenRecord = await this.tokenRepo.findByEmailAndToken(email, hashedToken, "PASSWORD_RESET" /* PASSWORD_RESET */);
     if (!tokenRecord || tokenRecord.expires < /* @__PURE__ */ new Date()) {
       throw new AuthError("Invalid or expired token", "TOKEN_INVALID", 400);
     }
@@ -41,7 +42,7 @@ var PasswordResetService = class {
     }
     const hashedPassword = await hash(newPassword, this.bcryptRounds);
     await this.userRepo.update(user.id, { password: hashedPassword });
-    await this.tokenRepo.delete(email, token, "PASSWORD_RESET" /* PASSWORD_RESET */);
+    await this.tokenRepo.delete(email, hashedToken, "PASSWORD_RESET" /* PASSWORD_RESET */);
     this.logger.info("Password reset completed", { userId: user.id });
   }
 };

package/dist/{chunk-GORISA3L.js → chunk-7KIM5MHV.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-ERFD6YAW.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/cache/config.ts
 function initializeCache(input) {

package/dist/{chunk-4L6OSSSG.js → chunk-7S2PCYNT.js}

@@ -1,18 +1,18 @@
 import {
   getPlatform
-} from "./chunk-4KJZRI74.js";
+} from "./chunk-KWUOLKDO.js";
 import {
   getGeolocationConfig
 } from "./chunk-CRJUFA73.js";
 import {
   getAuthConfig
-} from "./chunk-KYAHURXN.js";
+} from "./chunk-N3TCQ5BF.js";
 import {
   getCommonConfig
 } from "./chunk-PX535BHW.js";
 import {
   getResolvedCacheConfig
-} from "./chunk-GORISA3L.js";
+} from "./chunk-7KIM5MHV.js";
 
 // src/core/system/environment.ts
 import os from "os";

package/dist/{chunk-2SIBG5BG.js → chunk-7YWUKMZD.js}

@@ -9,6 +9,12 @@ var JWT_DEFAULTS = {
   /** 토큰 타입 */
   TOKEN_TYPE: "Bearer"
 };
+var ROLE_DEFAULTS = {
+  /** role 미지정/누락 시 적용되는 기본 역할. */
+  DEFAULT_ROLE: "USER",
+  /** `adminMiddleware`·`requireAdmin` 의 기본 관리자 역할 이름. */
+  ADMIN_ROLE: "ADMIN"
+};
 var EMAIL_VERIFICATION = {
   /** 토큰 만료 시간 (시간 단위) */
   TOKEN_EXPIRES_HOURS: 24,
@@ -58,6 +64,7 @@ var SECURITY_HEADERS = {
 
 export {
   JWT_DEFAULTS,
+  ROLE_DEFAULTS,
   EMAIL_VERIFICATION,
   PASSWORD_RESET,
   MAGIC_LINK,

package/dist/{chunk-7X2N4VZM.js → chunk-ATBYGPLP.js}

@@ -1,6 +1,6 @@
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/auth/email/sender.ts
 var SmtpEmailSender = class {

package/dist/{chunk-A74POWYY.js → chunk-B7AJJKOY.js}

@@ -1,6 +1,6 @@
 import {
   EmailVerificationService
-} from "./chunk-AQZPGOEZ.js";
+} from "./chunk-VWKZMGPJ.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";

package/dist/{chunk-W7PEL3DX.js → chunk-BRBOGLFT.js}

@@ -1,9 +1,9 @@
 import {
   AUTH_ERROR_CODE_MAP
-} from "./chunk-JJAIVUVD.js";
+} from "./chunk-R7EFDSPZ.js";
 import {
   getErrorMessage
-} from "./chunk-7WG7XPXC.js";
+} from "./chunk-KKZCNF6U.js";
 import {
   AppError
 } from "./chunk-ATAQRXTH.js";
@@ -16,10 +16,10 @@ import {
 } from "./chunk-5GWGARXI.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/next/middleware/error-handler.ts
 import { NextResponse } from "next/server";

package/dist/{chunk-IOUNOHP7.js → chunk-BRFW2LL2.js}

@@ -9,7 +9,7 @@ import {
   logApiRequest,
   logApiResponse,
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/next/utils/error-processor.ts
 import { NextResponse } from "next/server";

package/dist/{chunk-I4NT6G2T.js → chunk-DRTJSTEV.js}

@@ -1,10 +1,10 @@
 import {
   runCommand,
   runMacCommand
-} from "./chunk-4KJZRI74.js";
+} from "./chunk-KWUOLKDO.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/core/system/cpu.ts
 import os from "os";

package/dist/{chunk-JIYLTMVL.js → chunk-DVCGAI5N.js}

@@ -1,9 +1,9 @@
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/next/utils/csv-export.ts
 import { NextResponse } from "next/server";

package/dist/{chunk-AV7ELXHG.js → chunk-E5TDIRBJ.js}

@@ -1,10 +1,10 @@
 import {
   runCommand,
   runMacCommand
-} from "./chunk-4KJZRI74.js";
+} from "./chunk-KWUOLKDO.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/core/system/disk.ts
 async function getDiskInfo() {

package/dist/{chunk-UBASOMP5.js → chunk-HGVPZSWW.js}

@@ -1,17 +1,17 @@
 import {
   TokenRefreshService
-} from "./chunk-ARXUKGZI.js";
-import {
-  setTokenCookies
-} from "./chunk-RJGYONRO.js";
+} from "./chunk-XAGPZLRK.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
+import {
+  getTokenDeliveryStrategy
+} from "./chunk-63EKUOJH.js";
 
 // src/next/auth-handlers/refresh.handler.ts
 import { NextResponse } from "next/server";
 function createRefreshHandler(options) {
-  const { dependencies, jwt, hooks, cookie } = options;
+  const { dependencies, jwt, hooks, cookie, tokenDelivery } = options;
   const refreshService = new TokenRefreshService({
     userRepository: dependencies.userRepository,
     jwtSecret: jwt.secret,
@@ -21,9 +21,9 @@ function createRefreshHandler(options) {
     logger: dependencies.logger
   });
   return async (request) => {
-    var _a;
     try {
-      const refreshToken = (_a = request.cookies.get("refresh_token")) == null ? void 0 : _a.value;
+      const strategy = getTokenDeliveryStrategy(tokenDelivery);
+      const refreshToken = await strategy.extractRefreshToken(request);
       if (!refreshToken) {
         return NextResponse.json({ success: false, error: "No refresh token" }, { status: 401 });
       }
@@ -32,12 +32,17 @@ function createRefreshHandler(options) {
         if (hookResult instanceof Response) return hookResult;
       }
       const result = await refreshService.refresh(refreshToken);
-      const response = NextResponse.json({
-        success: true,
-        accessToken: result.accessToken,
-        user: result.user
-      });
-      setTokenCookies(response, { accessToken: result.accessToken, refreshToken }, { secure: cookie == null ? void 0 : cookie.secure });
+      const response = NextResponse.json(
+        strategy.buildTokenResponse(
+          { success: true, user: result.user },
+          { accessToken: result.accessToken }
+        )
+      );
+      strategy.attachCookies(
+        response,
+        { accessToken: result.accessToken, refreshToken },
+        { secure: cookie == null ? void 0 : cookie.secure }
+      );
       return response;
     } catch (error) {
       if (error instanceof AuthError) {

package/dist/{chunk-7F5X6F7X.js → chunk-HV6A6Z5R.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-PX535BHW.js";
 import {
   getResolvedCacheConfig
-} from "./chunk-GORISA3L.js";
+} from "./chunk-7KIM5MHV.js";
 
 // src/core/cache/cache-env.ts
 function _getNodeEnv() {

package/dist/chunk-ILMPKSWS.js

@@ -0,0 +1,125 @@
+import {
+  AuthError
+} from "./chunk-5GWGARXI.js";
+
+// src/core/auth/password/hasher.ts
+import bcrypt from "bcryptjs";
+var BCRYPT_PREFIX = /^\$2[aby]\$/;
+var BcryptPasswordHasher = class {
+  constructor(options = {}) {
+    this.id = "bcrypt";
+    var _a;
+    this.rounds = (_a = options.rounds) != null ? _a : 12;
+  }
+  identifies(hash) {
+    return BCRYPT_PREFIX.test(hash);
+  }
+  async hash(password) {
+    return bcrypt.hash(password, this.rounds);
+  }
+  async verify(password, hash) {
+    return bcrypt.compare(password, hash);
+  }
+  needsRehash(hash) {
+    var _a;
+    if (!this.identifies(hash)) return true;
+    const cost = Number.parseInt((_a = hash.split("$")[2]) != null ? _a : "", 10);
+    if (Number.isNaN(cost)) return true;
+    return cost < this.rounds;
+  }
+};
+var ARGON2_PREFIX = /^\$argon2(id|i|d)\$/;
+var argon2Cache;
+async function loadArgon2() {
+  var _a;
+  if (argon2Cache) return argon2Cache;
+  try {
+    const mod = await import("argon2");
+    argon2Cache = (_a = mod.default) != null ? _a : mod;
+    return argon2Cache;
+  } catch (e) {
+    throw new AuthError(
+      "argon2 package is not installed. Run `npm install argon2` to use Argon2idPasswordHasher.",
+      "ARGON2_NOT_INSTALLED",
+      500
+    );
+  }
+}
+function __resetArgon2Cache() {
+  argon2Cache = void 0;
+}
+function parseArgon2Params(hash) {
+  const paramSegment = hash.split("$").find((s) => s.startsWith("m="));
+  if (!paramSegment) return null;
+  const params = {};
+  for (const kv of paramSegment.split(",")) {
+    const [k, v] = kv.split("=");
+    const n = Number.parseInt(v != null ? v : "", 10);
+    if (!Number.isNaN(n)) params[k] = n;
+  }
+  if (params.m === void 0 || params.t === void 0 || params.p === void 0) return null;
+  return { m: params.m, t: params.t, p: params.p };
+}
+var Argon2idPasswordHasher = class {
+  constructor(options = {}) {
+    this.id = "argon2id";
+    var _a, _b, _c;
+    this.memoryCost = (_a = options.memoryCost) != null ? _a : 19456;
+    this.timeCost = (_b = options.timeCost) != null ? _b : 2;
+    this.parallelism = (_c = options.parallelism) != null ? _c : 1;
+  }
+  identifies(hash) {
+    return ARGON2_PREFIX.test(hash);
+  }
+  async hash(password) {
+    const argon2 = await loadArgon2();
+    return argon2.hash(password, {
+      type: argon2.argon2id,
+      memoryCost: this.memoryCost,
+      timeCost: this.timeCost,
+      parallelism: this.parallelism
+    });
+  }
+  async verify(password, hash) {
+    const argon2 = await loadArgon2();
+    return argon2.verify(hash, password);
+  }
+  needsRehash(hash) {
+    if (!this.identifies(hash)) return true;
+    const params = parseArgon2Params(hash);
+    if (!params) return true;
+    return params.m < this.memoryCost || params.t < this.timeCost || params.p < this.parallelism;
+  }
+};
+var MigratingPasswordHasher = class {
+  constructor(options) {
+    var _a;
+    this.preferred = options.preferred;
+    this.legacy = (_a = options.legacy) != null ? _a : [];
+  }
+  get id() {
+    return this.preferred.id;
+  }
+  identifies(hash) {
+    return [this.preferred, ...this.legacy].some((h) => h.identifies(hash));
+  }
+  async hash(password) {
+    return this.preferred.hash(password);
+  }
+  async verify(password, hash) {
+    const hasher = [this.preferred, ...this.legacy].find((h) => h.identifies(hash));
+    if (!hasher) return false;
+    return hasher.verify(password, hash);
+  }
+  needsRehash(hash) {
+    if (!this.preferred.identifies(hash)) return true;
+    return this.preferred.needsRehash(hash);
+  }
+};
+
+export {
+  BcryptPasswordHasher,
+  __resetArgon2Cache,
+  Argon2idPasswordHasher,
+  MigratingPasswordHasher
+};

package/dist/{chunk-J5NLAZV2.js → chunk-JHUWZ6YW.js}

@@ -1,13 +1,13 @@
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   DEFAULT_INMEMORY_CONFIG
 } from "./chunk-O4L6RI5S.js";
 import {
   __spreadProps,
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/cache/inmemory-cache-manager.ts
 var InMemoryCacheManager = class _InMemoryCacheManager {

package/dist/{chunk-LON5THYQ.js → chunk-KLMKCYIN.js}

@@ -1,6 +1,6 @@
 import {
   PasswordResetService
-} from "./chunk-N5VOFGF3.js";
+} from "./chunk-75UDFONR.js";
 
 // src/next/auth-handlers/forgot-password.handler.ts
 import { NextResponse } from "next/server";

package/dist/{chunk-4KJZRI74.js → chunk-KWUOLKDO.js}

@@ -1,6 +1,6 @@
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/core/system/utils.ts
 import { exec } from "child_process";

package/dist/{chunk-GJO2MPC3.js → chunk-LCYDMYZS.js}

@@ -2,7 +2,7 @@ import {
   logApiRequest,
   logApiResponse,
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/next/middleware/response-logger.ts
 var responseLoggerMiddleware = async (context, next) => {

package/dist/{chunk-WIQAPWTY.js → chunk-LL3VWKY4.js}

@@ -1,6 +1,6 @@
 import {
   clearTokenCookies
-} from "./chunk-RJGYONRO.js";
+} from "./chunk-PRPMEHRE.js";
 
 // src/next/auth-handlers/logout.handler.ts
 import { NextResponse } from "next/server";

package/dist/{chunk-IMAFMUZ7.js → chunk-LSS3GJUE.js}

@@ -1,6 +1,6 @@
 import {
   PasswordResetService
-} from "./chunk-N5VOFGF3.js";
+} from "./chunk-75UDFONR.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
@@ -8,10 +8,11 @@ import {
 // src/next/auth-handlers/reset-password.handler.ts
 import { NextResponse } from "next/server";
 import { z } from "zod";
+var withinBcryptByteLimit = (value) => new TextEncoder().encode(value).length <= 72;
 var schema = z.object({
   email: z.string().email(),
   token: z.string().min(1),
-  password: z.string().min(8)
+  password: z.string().min(8).refine(withinBcryptByteLimit, { message: "Password cannot exceed 72 bytes" })
 });
 function createResetPasswordHandler(options) {
   const { dependencies } = options;