covara 0.0.1 → 0.6.0

package/dist/auth/api-keys.js

@@ -0,0 +1,117 @@
+import { randomBytes } from "node:crypto";
+import { hashPassword, verifyPassword } from "./password.js";
+export class InMemoryApiKeyStore {
+    constructor() {
+        this.keys = new Map();
+    }
+    async create(record) {
+        this.keys.set(record.id, record);
+    }
+    async list(filter) {
+        const all = Array.from(this.keys.values());
+        if (filter?.userId !== undefined) {
+            return all.filter((k) => k.userId === filter.userId);
+        }
+        return all;
+    }
+    async findById(id) {
+        return this.keys.get(id) ?? null;
+    }
+    async delete(id) {
+        this.keys.delete(id);
+    }
+    async touch(id, lastUsedAt) {
+        const key = this.keys.get(id);
+        if (key) {
+            key.lastUsedAt = lastUsedAt;
+        }
+    }
+}
+const generateRawKey = (prefix, byteLength) => {
+    const id = randomBytes(8).toString("hex");
+    const secret = randomBytes(byteLength).toString("base64url");
+    const key = prefix ? `${prefix}_${id}.${secret}` : `${id}.${secret}`;
+    return { key, id };
+};
+const toMetadata = (stored) => ({
+    id: stored.id,
+    label: stored.label,
+    userId: stored.userId,
+    createdAt: stored.createdAt,
+    lastUsedAt: stored.lastUsedAt ?? null,
+    expiresAt: stored.expiresAt ?? null,
+    scopes: stored.scopes,
+});
+export const createApiKey = async (options) => {
+    const { key, id } = generateRawKey(options.prefix, options.byteLength ?? 24);
+    const hash = await hashPassword(key);
+    const createdAt = new Date();
+    const expiresAt = options.expiresAt ??
+        (options.ttlMs !== undefined ? new Date(createdAt.getTime() + options.ttlMs) : null);
+    const stored = {
+        id,
+        label: options.label,
+        userId: options.userId,
+        scopes: options.scopes,
+        createdAt,
+        lastUsedAt: null,
+        expiresAt,
+        hash,
+    };
+    await options.store.create(stored);
+    return { key, metadata: toMetadata(stored) };
+};
+const parseKeyId = (key) => {
+    // Format is `[prefix_]id.secret`. Split on the FIRST "." so the base64url
+    // secret (which may itself contain "_" or "-") can't corrupt id extraction,
+    // then strip an optional `prefix_` segment (the id is hex, no underscores).
+    const dot = key.indexOf(".");
+    if (dot <= 0)
+        return null;
+    const idPart = key.slice(0, dot);
+    const underscore = idPart.lastIndexOf("_");
+    const id = underscore >= 0 ? idPart.slice(underscore + 1) : idPart;
+    return id.length > 0 ? id : null;
+};
+export const verifyApiKey = async (key, options) => {
+    const id = parseKeyId(key);
+    if (!id)
+        return { valid: false, reason: "not_found" };
+    const stored = await options.store.findById(id);
+    if (!stored)
+        return { valid: false, reason: "not_found" };
+    const now = options.now ?? new Date();
+    if (stored.expiresAt && stored.expiresAt.getTime() <= now.getTime()) {
+        return { valid: false, reason: "expired" };
+    }
+    const matches = await verifyPassword(key, stored.hash);
+    if (!matches)
+        return { valid: false, reason: "mismatch" };
+    if (options.updateLastUsed !== false) {
+        await options.store.touch(stored.id, now);
+        stored.lastUsedAt = now;
+    }
+    return { valid: true, metadata: toMetadata(stored) };
+};
+export const listApiKeys = async (options) => {
+    const stored = await options.store.list(options.userId !== undefined ? { userId: options.userId } : undefined);
+    return stored.map(toMetadata);
+};
+export const revokeApiKey = async (id, options) => {
+    await options.store.delete(id);
+};
+export const rotateApiKey = async (options) => {
+    const existing = await options.store.findById(options.id);
+    await options.store.delete(options.id);
+    return createApiKey({
+        store: options.store,
+        label: options.label ?? existing?.label,
+        userId: options.userId ?? existing?.userId,
+        scopes: options.scopes ?? existing?.scopes,
+        expiresAt: options.expiresAt ?? existing?.expiresAt ?? null,
+        ttlMs: options.ttlMs,
+        prefix: options.prefix,
+        byteLength: options.byteLength,
+    });
+};
+//# sourceMappingURL=api-keys.js.map

package/dist/auth/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/auth/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAwB1D,MAAM,OAAO,mBAAmB;IAAhC;QACU,SAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IA4BjD,CAAC;IA1BC,KAAK,CAAC,MAAM,CAAC,MAAoB;QAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAA4B;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3C,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,UAAgB;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9B,CAAC;IACH,CAAC;CACF;AAkBD,MAAM,cAAc,GAAG,CAAC,MAA0B,EAAE,UAAkB,EAA+B,EAAE;IACrG,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;IACrE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,MAAoB,EAAkB,EAAE,CAAC,CAAC;IAC5D,EAAE,EAAE,MAAM,CAAC,EAAE;IACb,KAAK,EAAE,MAAM,CAAC,KAAK;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,SAAS,EAAE,MAAM,CAAC,SAAS;IAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;IACrC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;IACnC,MAAM,EAAE,MAAM,CAAC,MAAM;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,OAA4B,EAA0B,EAAE;IACzF,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,SAAS,GACb,OAAO,CAAC,SAAS;QACjB,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEvF,MAAM,MAAM,GAAiB;QAC3B,EAAE;QACF,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS;QACT,UAAU,EAAE,IAAI;QAChB,SAAS;QACT,IAAI;KACL,CAAC;IAEF,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,GAAW,EAAiB,EAAE;IAChD,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAW,EACX,OAAqE,EACxC,EAAE;IAC/B,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEtD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACpE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAE1D,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,OAAgD,EACrB,EAAE;IAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CACrC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CACtE,CAAC;IACF,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,EAAU,EACV,OAA+B,EAChB,EAAE;IACjB,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACjC,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,OAA4B,EAA0B,EAAE;IACzF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1D,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvC,OAAO,YAAY,CAAC;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE,KAAK;QACvC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM;QAC1C,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM;QAC1C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,EAAE,SAAS,IAAI,IAAI;QAC3D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/auth/config.d.ts

@@ -0,0 +1,36 @@
+import { AuthAdapter, SessionStore } from "./types.js";
+import { JWTConfig } from "./adapters/jwt.js";
+import { RedisSessionStoreOptions } from "./stores/redis.js";
+import { DrizzleSessionStoreOptions } from "./stores/drizzle.js";
+import { KVAdapter } from "../kv/types.js";
+export type AuthMode = "session" | "jwt";
+export interface SessionStoreConfig {
+    type: "memory" | "redis" | "drizzle";
+    redis?: Omit<RedisSessionStoreOptions, "kv"> & {
+        kv: KVAdapter;
+    };
+    drizzle?: DrizzleSessionStoreOptions;
+}
+export interface AuthConfigUser {
+    id: string;
+    email?: string | null;
+    name?: string | null;
+    image?: string | null;
+    emailVerified?: Date | null;
+    metadata?: Record<string, unknown>;
+}
+export interface AuthConfig {
+    mode: AuthMode;
+    jwt?: JWTConfig;
+    sessionStore?: SessionStoreConfig;
+    sessionTtlMs?: number;
+    getUserById: (id: string) => Promise<AuthConfigUser | null>;
+    validatePassword?: (email: string, password: string) => Promise<AuthConfigUser | null>;
+    validateApiKey?: (apiKey: string) => Promise<{
+        userId: string;
+        scopes?: string[];
+    } | null>;
+}
+export declare const createSessionStore: (config?: SessionStoreConfig) => SessionStore;
+export declare const createAuthAdapter: (config: AuthConfig) => AuthAdapter;
+//# sourceMappingURL=config.d.ts.map

package/dist/auth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAwB,MAAM,SAAS,CAAC;AAE1E,OAAO,EAAc,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAqB,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAEL,0BAA0B,EAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;AAEzC,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IACrC,KAAK,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,GAAG;QAAE,EAAE,EAAE,SAAS,CAAA;KAAE,CAAC;IACjE,OAAO,CAAC,EAAE,0BAA0B,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC5D,gBAAgB,CAAC,EAAE,CACjB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACpC,cAAc,CAAC,EAAE,CACf,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC5D;AAED,eAAO,MAAM,kBAAkB,GAAI,SAAS,kBAAkB,KAAG,YAsBhE,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,QAAQ,UAAU,KAAG,WAyBtD,CAAC"}

package/dist/auth/config.js

@@ -0,0 +1,50 @@
+import { InMemorySessionStore } from "./types.js";
+import { PassportAdapter } from "./adapters/passport.js";
+import { JWTAdapter } from "./adapters/jwt.js";
+import { RedisSessionStore } from "./stores/redis.js";
+import { DrizzleSessionStore, } from "./stores/drizzle.js";
+export const createSessionStore = (config) => {
+    if (!config) {
+        return new InMemorySessionStore();
+    }
+    switch (config.type) {
+        case "redis":
+            if (!config.redis?.kv) {
+                throw new Error("Redis KV adapter required for redis session store");
+            }
+            return new RedisSessionStore(config.redis);
+        case "drizzle":
+            if (!config.drizzle) {
+                throw new Error("Drizzle config required for drizzle session store");
+            }
+            return new DrizzleSessionStore(config.drizzle);
+        case "memory":
+        default:
+            return new InMemorySessionStore();
+    }
+};
+export const createAuthAdapter = (config) => {
+    const sessionStore = createSessionStore(config.sessionStore);
+    switch (config.mode) {
+        case "jwt":
+            if (!config.jwt) {
+                throw new Error("JWT config required for jwt mode");
+            }
+            return new JWTAdapter({
+                jwt: config.jwt,
+                getUserById: config.getUserById,
+                validatePassword: config.validatePassword,
+                refreshTokenStore: sessionStore,
+            });
+        case "session":
+        default:
+            return new PassportAdapter({
+                getUserById: config.getUserById,
+                validatePassword: config.validatePassword,
+                validateApiKey: config.validateApiKey,
+                sessionStore,
+                sessionTtlMs: config.sessionTtlMs,
+            });
+    }
+};
+//# sourceMappingURL=config.js.map

package/dist/auth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAa,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAA4B,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EACL,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAmC1B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA2B,EAAgB,EAAE;IAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,oBAAoB,EAAE,CAAC;IACpC,CAAC;IAED,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,OAAO;YACV,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE7C,KAAK,SAAS;YACZ,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEjD,KAAK,QAAQ,CAAC;QACd;YACE,OAAO,IAAI,oBAAoB,EAAE,CAAC;IACtC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAkB,EAAe,EAAE;IACnE,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAE7D,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK;YACR,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,IAAI,UAAU,CAAC;gBACpB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,iBAAiB,EAAE,YAAY;aAChC,CAAC,CAAC;QAEL,KAAK,SAAS,CAAC;QACf;YACE,OAAO,IAAI,eAAe,CAAC;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,YAAY;gBACZ,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC"}

package/dist/auth/csrf.d.ts

@@ -0,0 +1,18 @@
+import type { Context, MiddlewareHandler } from "hono";
+export interface CsrfOptions {
+    cookieName?: string;
+    headerName?: string;
+    tokenLength?: number;
+    cookieOptions?: {
+        secure?: boolean;
+        sameSite?: "strict" | "lax" | "none";
+        path?: string;
+        maxAge?: number;
+    };
+    skip?: (c: Context) => boolean;
+    message?: string;
+}
+export declare const generateCsrfToken: (length?: number) => string;
+export declare const issueCsrfToken: (c: Context, options?: CsrfOptions) => string;
+export declare const createCsrfMiddleware: (options?: CsrfOptions) => MiddlewareHandler;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/auth/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/auth/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAWvD,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE;QACd,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;QACrC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,iBAAiB,GAAI,eAAW,KAAG,MACL,CAAC;AAc5C,eAAO,MAAM,cAAc,GAAI,GAAG,OAAO,EAAE,UAAS,WAAgB,KAAG,MAYtE,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAI,UAAS,WAAgB,KAAG,iBAgChE,CAAC"}

package/dist/auth/csrf.js

@@ -0,0 +1,59 @@
+import { getCookie, setCookie } from "hono/cookie";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { ForbiddenError } from "../resource/error.js";
+import { isProduction } from "../server/env.js";
+const UNSAFE_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+const DEFAULT_COOKIE_NAME = "csrf_token";
+const DEFAULT_HEADER_NAME = "X-CSRF-Token";
+export const generateCsrfToken = (length = 32) => randomBytes(length).toString("base64url");
+const isBearerRequest = (c) => {
+    const authHeader = c.req.header("authorization");
+    return typeof authHeader === "string" && authHeader.length > 0;
+};
+const constantTimeEquals = (a, b) => {
+    const aBuf = Buffer.from(a);
+    const bBuf = Buffer.from(b);
+    if (aBuf.length !== bBuf.length)
+        return false;
+    return timingSafeEqual(aBuf, bBuf);
+};
+export const issueCsrfToken = (c, options = {}) => {
+    const cookieName = options.cookieName ?? DEFAULT_COOKIE_NAME;
+    const token = generateCsrfToken(options.tokenLength ?? 32);
+    const cookieOptions = {
+        httpOnly: false,
+        secure: options.cookieOptions?.secure ?? isProduction(),
+        sameSite: options.cookieOptions?.sameSite ?? "lax",
+        path: options.cookieOptions?.path ?? "/",
+        maxAge: options.cookieOptions?.maxAge,
+    };
+    setCookie(c, cookieName, token, cookieOptions);
+    return token;
+};
+export const createCsrfMiddleware = (options = {}) => {
+    const cookieName = options.cookieName ?? DEFAULT_COOKIE_NAME;
+    const headerName = options.headerName ?? DEFAULT_HEADER_NAME;
+    const message = options.message ?? "CSRF token validation failed";
+    return async (c, next) => {
+        if (options.skip?.(c)) {
+            return next();
+        }
+        const method = c.req.method.toUpperCase();
+        if (!UNSAFE_METHODS.has(method)) {
+            if (!getCookie(c, cookieName)) {
+                issueCsrfToken(c, options);
+            }
+            return next();
+        }
+        if (isBearerRequest(c)) {
+            return next();
+        }
+        const cookieToken = getCookie(c, cookieName);
+        const headerToken = c.req.header(headerName.toLowerCase());
+        if (!cookieToken || !headerToken || !constantTimeEquals(cookieToken, headerToken)) {
+            throw new ForbiddenError(message);
+        }
+        return next();
+    };
+};
+//# sourceMappingURL=csrf.js.map

package/dist/auth/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/auth/csrf.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACnE,MAAM,mBAAmB,GAAG,YAAY,CAAC;AACzC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAgB3C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAM,GAAG,EAAE,EAAU,EAAE,CACvD,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE5C,MAAM,eAAe,GAAG,CAAC,CAAU,EAAW,EAAE;IAC9C,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;AACjE,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAU,EAAE,UAAuB,EAAE,EAAU,EAAE;IAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAkB;QACnC,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,IAAI,YAAY,EAAE;QACvD,QAAQ,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,IAAI,KAAK;QAClD,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,IAAI,IAAI,GAAG;QACxC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM;KACtC,CAAC;IACF,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAuB,EAAE,EAAqB,EAAE;IACnF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,8BAA8B,CAAC;IAElE,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAE1C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC9B,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAE3D,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,25 @@
+export * from "./types.js";
+export * from "./adapter.js";
+export * from "./password.js";
+export * from "./rsql.js";
+export * from "./scope.js";
+export * from "./middleware.js";
+export * from "./routes.js";
+export { createCsrfMiddleware, issueCsrfToken, generateCsrfToken, type CsrfOptions, } from "./csrf.js";
+export { LoginThrottle, type LoginThrottleOptions, type ThrottleCheck, } from "./login-throttle.js";
+export { InMemoryVerificationTokenStore, issueToken, verifyToken, hashToken, generateToken, type VerificationTokenStore, type VerificationTokenRecord, } from "./verification.js";
+export { issuePasswordResetToken, verifyPasswordResetToken, hashNewPassword, type PasswordResetOptions, } from "./password-reset.js";
+export { base32Encode, base32Decode, generateTotpSecret, generateTotp, verifyTotp, getTotpUri, generateBackupCodes, verifyBackupCode, type TotpOptions, type TotpUriParams, type BackupCodesResult, } from "./totp.js";
+export { issueMagicLinkToken, consumeMagicLinkToken, type MagicLinkOptions, } from "./magic-link.js";
+export { createApiKey, verifyApiKey, rotateApiKey, revokeApiKey, listApiKeys, InMemoryApiKeyStore, type ApiKeyStore, type StoredApiKey, type ApiKeyMetadata, type CreatedApiKey, type CreateApiKeyOptions, type RotateApiKeyOptions, type VerifyApiKeyResult, } from "./api-keys.js";
+export { validatePasswordStrength, enforcePasswordStrength, builtInPasswordDenylist, type PasswordPolicyOptions, type PasswordStrengthResult, } from "./password-policy.js";
+export { createAuthAdapter, createSessionStore, type AuthMode, type AuthConfig, type AuthConfigUser, type SessionStoreConfig, } from "./config.js";
+export { AuthJsAdapter, createAuthJsAdapter } from "./adapters/authjs.js";
+export { PassportAdapter, createPassportAdapter, fromPassportUser } from "./adapters/passport.js";
+export { JWTAdapter, createJWTAdapter } from "./adapters/jwt.js";
+export type { JWTConfig, JWTAdapterOptions, JWTPayload, JWTUser } from "./adapters/jwt.js";
+export { OIDCAdapter, createOIDCAdapter, oidcProviders } from "./adapters/oidc.js";
+export type { OIDCProviderConfig, OIDCAdapterOptions, OIDCUserInfo, OIDCAccount, OIDCUser, } from "./adapters/oidc.js";
+export { RedisSessionStore, createRedisSessionStore, DrizzleSessionStore, createDrizzleSessionStore, } from "./stores/index.js";
+export type { RedisSessionStoreOptions, DrizzleSessionStoreOptions, SessionsTableColumns, } from "./stores/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,KAAK,WAAW,GACjB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,aAAa,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,8BAA8B,EAC9B,UAAU,EACV,WAAW,EACX,SAAS,EACT,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChF,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,wBAAwB,EACxB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,UAAU,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,22 @@
+export * from "./types.js";
+export * from "./adapter.js";
+export * from "./password.js";
+export * from "./rsql.js";
+export * from "./scope.js";
+export * from "./middleware.js";
+export * from "./routes.js";
+export { createCsrfMiddleware, issueCsrfToken, generateCsrfToken, } from "./csrf.js";
+export { LoginThrottle, } from "./login-throttle.js";
+export { InMemoryVerificationTokenStore, issueToken, verifyToken, hashToken, generateToken, } from "./verification.js";
+export { issuePasswordResetToken, verifyPasswordResetToken, hashNewPassword, } from "./password-reset.js";
+export { base32Encode, base32Decode, generateTotpSecret, generateTotp, verifyTotp, getTotpUri, generateBackupCodes, verifyBackupCode, } from "./totp.js";
+export { issueMagicLinkToken, consumeMagicLinkToken, } from "./magic-link.js";
+export { createApiKey, verifyApiKey, rotateApiKey, revokeApiKey, listApiKeys, InMemoryApiKeyStore, } from "./api-keys.js";
+export { validatePasswordStrength, enforcePasswordStrength, builtInPasswordDenylist, } from "./password-policy.js";
+export { createAuthAdapter, createSessionStore, } from "./config.js";
+export { AuthJsAdapter, createAuthJsAdapter } from "./adapters/authjs.js";
+export { PassportAdapter, createPassportAdapter, fromPassportUser } from "./adapters/passport.js";
+export { JWTAdapter, createJWTAdapter } from "./adapters/jwt.js";
+export { OIDCAdapter, createOIDCAdapter, oidcProviders } from "./adapters/oidc.js";
+export { RedisSessionStore, createRedisSessionStore, DrizzleSessionStore, createDrizzleSessionStore, } from "./stores/index.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,iBAAiB,GAElB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,8BAA8B,EAC9B,UAAU,EACV,WAAW,EACX,SAAS,EACT,aAAa,GAGd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,GAEhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,gBAAgB,GAIjB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,mBAAmB,GAQpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,GAKnB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAShF,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,UAAU,CAAC"}

package/dist/auth/login-throttle.d.ts

@@ -0,0 +1,21 @@
+import type { RateLimitStore } from "../middleware/rateLimit.js";
+export interface LoginThrottleOptions {
+    maxAttempts?: number;
+    windowMs?: number;
+    store?: RateLimitStore;
+}
+export interface ThrottleCheck {
+    locked: boolean;
+    retryAfterSeconds: number;
+}
+export declare class LoginThrottle {
+    private store;
+    private maxAttempts;
+    private windowMs;
+    constructor(options?: LoginThrottleOptions);
+    private keys;
+    recordFailure(identifier: string, ip: string): Promise<ThrottleCheck>;
+    check(identifier: string, ip: string): Promise<ThrottleCheck>;
+    reset(identifier: string, ip: string): Promise<void>;
+}
+//# sourceMappingURL=login-throttle.d.ts.map

package/dist/auth/login-throttle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-throttle.d.ts","sourceRoot":"","sources":["../../src/auth/login-throttle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAOD,qBAAa,aAAa;IACxB,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAS;gBAEb,OAAO,GAAE,oBAAyB;IAM9C,OAAO,CAAC,IAAI;IAIN,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAgBrE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAmB7D,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAK3D"}

package/dist/auth/login-throttle.js

@@ -0,0 +1,50 @@
+import { InMemoryRateLimitStore } from "../middleware/rateLimit.js";
+const DEFAULTS = {
+    maxAttempts: 5,
+    windowMs: 15 * 60 * 1000,
+};
+export class LoginThrottle {
+    constructor(options = {}) {
+        this.store = options.store ?? new InMemoryRateLimitStore();
+        this.maxAttempts = options.maxAttempts ?? DEFAULTS.maxAttempts;
+        this.windowMs = options.windowMs ?? DEFAULTS.windowMs;
+    }
+    keys(identifier, ip) {
+        return [`login:id:${identifier.toLowerCase()}`, `login:ip:${ip}`];
+    }
+    async recordFailure(identifier, ip) {
+        let locked = false;
+        let retryAfterSeconds = 0;
+        for (const key of this.keys(identifier, ip)) {
+            const info = await this.store.increment(key, this.windowMs);
+            if (info.count >= this.maxAttempts) {
+                locked = true;
+                const remaining = Math.ceil((info.resetAt - Date.now()) / 1000);
+                retryAfterSeconds = Math.max(retryAfterSeconds, remaining, 1);
+            }
+        }
+        return { locked, retryAfterSeconds };
+    }
+    async check(identifier, ip) {
+        let locked = false;
+        let retryAfterSeconds = 0;
+        for (const key of this.keys(identifier, ip)) {
+            const info = await this.store.increment(key, this.windowMs);
+            const count = info.count;
+            const resetAt = info.resetAt;
+            await this.store.decrement(key);
+            if (count > this.maxAttempts) {
+                locked = true;
+                const remaining = Math.ceil((resetAt - Date.now()) / 1000);
+                retryAfterSeconds = Math.max(retryAfterSeconds, remaining, 1);
+            }
+        }
+        return { locked, retryAfterSeconds };
+    }
+    async reset(identifier, ip) {
+        for (const key of this.keys(identifier, ip)) {
+            await this.store.reset(key);
+        }
+    }
+}
+//# sourceMappingURL=login-throttle.js.map

package/dist/auth/login-throttle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-throttle.js","sourceRoot":"","sources":["../../src/auth/login-throttle.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAahE,MAAM,QAAQ,GAAG;IACf,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CACzB,CAAC;AAEF,MAAM,OAAO,aAAa;IAKxB,YAAY,UAAgC,EAAE;QAC5C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,sBAAsB,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC;QAC/D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;IACxD,CAAC;IAEO,IAAI,CAAC,UAAkB,EAAE,EAAU;QACzC,OAAO,CAAC,YAAY,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,EAAU;QAChD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAE1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnC,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChE,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,EAAU;QACxC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAE1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7B,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC3D,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,EAAU;QACxC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;CACF"}

package/dist/auth/magic-link.d.ts

@@ -0,0 +1,13 @@
+import { VerificationTokenStore } from "./verification.js";
+export interface MagicLinkOptions {
+    store: VerificationTokenStore;
+    ttlMs?: number;
+    hashTokens?: boolean;
+    tokenLength?: number;
+}
+export declare const issueMagicLinkToken: (identifier: string, options: MagicLinkOptions) => Promise<{
+    token: string;
+    expiresAt: Date;
+}>;
+export declare const consumeMagicLinkToken: (identifier: string, token: string, options: MagicLinkOptions) => Promise<boolean>;
+//# sourceMappingURL=magic-link.d.ts.map

package/dist/auth/magic-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-link.d.ts","sourceRoot":"","sources":["../../src/auth/magic-link.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EAGvB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,sBAAsB,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAID,eAAO,MAAM,mBAAmB,GAC9B,YAAY,MAAM,EAClB,SAAS,gBAAgB,KACxB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAK5C,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,YAAY,MAAM,EAClB,OAAO,MAAM,EACb,SAAS,gBAAgB,KACxB,OAAO,CAAC,OAAO,CAIjB,CAAC"}

package/dist/auth/magic-link.js

@@ -0,0 +1,14 @@
+import { issueToken, verifyToken, } from "./verification.js";
+const DEFAULT_TTL_MS = 15 * 60 * 1000;
+export const issueMagicLinkToken = async (identifier, options) => {
+    return issueToken(options.store, identifier, options.ttlMs ?? DEFAULT_TTL_MS, {
+        hash: options.hashTokens,
+        tokenLength: options.tokenLength,
+    });
+};
+export const consumeMagicLinkToken = async (identifier, token, options) => {
+    return verifyToken(options.store, identifier, token, {
+        hash: options.hashTokens,
+    });
+};
+//# sourceMappingURL=magic-link.js.map

package/dist/auth/magic-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-link.js","sourceRoot":"","sources":["../../src/auth/magic-link.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,UAAU,EACV,WAAW,GACZ,MAAM,gBAAgB,CAAC;AASxB,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,UAAkB,EAClB,OAAyB,EACoB,EAAE;IAC/C,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,IAAI,cAAc,EAAE;QAC5E,IAAI,EAAE,OAAO,CAAC,UAAU;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,UAAkB,EAClB,KAAa,EACb,OAAyB,EACP,EAAE;IACpB,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;QACnD,IAAI,EAAE,OAAO,CAAC,UAAU;KACzB,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/auth/middleware.d.ts

@@ -0,0 +1,20 @@
+import type { Context, MiddlewareHandler } from "hono";
+import { AuthAdapter, AuthMiddlewareOptions } from "./types.js";
+import { UserContext } from "../resource/types.js";
+export declare const createAuthMiddleware: (adapter: AuthAdapter, options?: AuthMiddlewareOptions) => MiddlewareHandler;
+export declare const requireAuth: (options?: {
+    message?: string;
+}) => MiddlewareHandler;
+export declare const optionalAuth: () => MiddlewareHandler;
+export declare const requirePermission: (permission: string) => MiddlewareHandler;
+export declare const requireRole: (...roles: string[]) => MiddlewareHandler;
+export declare const requireOwnership: (getResourceOwnerId: (c: Context) => string | Promise<string>, options?: {
+    allowAdmin?: boolean;
+    adminCheck?: (c: Context) => boolean;
+}) => MiddlewareHandler;
+export declare const refreshSession: (adapter: AuthAdapter) => MiddlewareHandler;
+export declare const createLogoutHandler: (adapter: AuthAdapter) => (c: Context) => Promise<Response>;
+export declare const getUser: (c: Context) => UserContext | undefined;
+export declare const getSession: (c: Context) => import("./types.js").SessionData | undefined;
+export declare const rateByUser: (c: Context) => string;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,EACL,WAAW,EACX,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,eAAO,MAAM,oBAAoB,GAC/B,SAAS,WAAW,EACpB,UAAS,qBAA0B,KAClC,iBAmCF,CAAC;AAEF,eAAO,MAAM,WAAW,GACtB,UAAS;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,KACjC,iBAOF,CAAC;AAEF,eAAO,MAAM,YAAY,QAAO,iBAE/B,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,YAAY,MAAM,KAAG,iBActD,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,GAAG,OAAO,MAAM,EAAE,KAAG,iBAchD,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAC3B,oBAAoB,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,EAC5D,UAAS;IAAE,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAA;CAAO,KAC3E,iBAkBF,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,SAAS,WAAW,KAAG,iBAWrD,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAAI,SAAS,WAAW,MACxC,GAAG,OAAO,KAAG,OAAO,CAAC,QAAQ,CAU5C,CAAC;AAEF,eAAO,MAAM,OAAO,GAAI,GAAG,OAAO,KAAG,WAAW,GAAG,SAElD,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,GAAG,OAAO,8CAEpC,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,GAAG,OAAO,KAAG,MAEvC,CAAC"}