mulguard 1.1.7 → 1.1.9

package/dist/core/auth/oauth/state-store-cookie.d.ts

@@ -1,83 +0,0 @@
-import { OAuthStateStore } from './state-store';
-/**
- * Cookie options interface
- */
-export interface OAuthCookieOptions {
-    httpOnly?: boolean;
-    secure?: boolean;
-    sameSite?: 'strict' | 'lax' | 'none';
-    maxAge?: number;
-    path?: string;
-    domain?: string;
-}
-/**
- * Cookie handler interface for framework-agnostic cookie operations
- */
-export interface CookieHandler {
-    /**
-     * Get cookie value by name
-     */
-    getCookie(name: string): Promise<string | null> | string | null;
-    /**
-     * Set cookie with options
-     */
-    setCookie(name: string, value: string, options: OAuthCookieOptions): Promise<void> | void;
-    /**
-     * Delete cookie
-     */
-    deleteCookie(name: string, options?: {
-        path?: string;
-    }): Promise<void> | void;
-}
-/**
- * Configuration for cookie-based OAuth state store
- */
-export interface CookieOAuthStateStoreConfig {
-    /**
-     * Cookie handler implementation
-     */
-    cookieHandler: CookieHandler;
-    /**
-     * Cookie name (default: '__mulguard_oauth_state')
-     */
-    cookieName?: string;
-    /**
-     * TTL in milliseconds (default: 10 minutes)
-     */
-    ttl?: number;
-    /**
-     * Whether to use secure cookies (default: true in production)
-     */
-    secure?: boolean;
-    /**
-     * SameSite cookie attribute (default: 'strict')
-     */
-    sameSite?: 'strict' | 'lax' | 'none';
-}
-/**
- * Creates a cookie-based OAuth state store.
- *
- * ✅ SECURE: Uses httpOnly cookies to prevent XSS attacks
- * ✅ FRAMEWORK-AGNOSTIC: Works with any framework via cookie handler
- * ⚠️ LIMITATION: Not suitable for production with multiple server instances (use Redis instead)
- *
- * @param config - Cookie store configuration
- * @returns OAuth state store implementation
- */
-export declare function createCookieOAuthStateStore(config: CookieOAuthStateStoreConfig): OAuthStateStore;
-/**
- * Creates a Next.js-specific cookie-based OAuth state store.
- *
- * Convenience function for Next.js applications.
- *
- * @example
- * ```typescript
- * import { createNextJsCookieOAuthStateStore } from 'mulguard/core/auth/oauth/state-store-cookie'
- *
- * export const auth = mulguard({
- *   oauthStateStore: createNextJsCookieOAuthStateStore(),
- *   // ... rest of config
- * })
- * ```
- */
-export declare function createNextJsCookieOAuthStateStore(): OAuthStateStore;

package/dist/core/auth/oauth/state-store-redis.d.ts

@@ -1,25 +0,0 @@
-import { OAuthStateStore } from './state-store';
-/**
- * Redis client interface (compatible with ioredis and node-redis)
- */
-export interface RedisClient {
-    set(key: string, value: string, mode?: string, duration?: number): Promise<string | null>;
-    get(key: string): Promise<string | null>;
-    del(key: string): Promise<number>;
-    keys(pattern: string): Promise<string[]>;
-}
-/**
- * Creates a Redis-based OAuth state store.
- *
- * @param redis - Redis client instance (ioredis or node-redis)
- * @param keyPrefix - Key prefix for state keys (default: 'mulguard:oauth:state:')
- * @returns OAuth state store implementation
- *
- * @example
- * ```typescript
- * import Redis from 'ioredis'
- * const redis = new Redis(process.env.REDIS_URL)
- * const stateStore = createRedisOAuthStateStore(redis)
- * ```
- */
-export declare function createRedisOAuthStateStore(redis: RedisClient, keyPrefix?: string): OAuthStateStore;

package/dist/core/auth/oauth/state-store.d.ts

@@ -1,48 +0,0 @@
-/**
- * OAuth State Store Interface
- * Allows pluggable state storage for OAuth CSRF protection
- *
- * Default implementation uses in-memory Map (for development)
- * Production should use Redis, database, or other persistent store
- *
- * @module @mulguard/core/auth/oauth/state-store
- */
-export interface OAuthState {
-    provider: string;
-    expiresAt: number;
-}
-export interface OAuthStateStore {
-    /**
-     * Store OAuth state with TTL
-     */
-    set(state: string, data: OAuthState, ttl: number): Promise<void> | void;
-    /**
-     * Get OAuth state
-     */
-    get(state: string): Promise<OAuthState | null> | OAuthState | null;
-    /**
-     * Delete OAuth state
-     */
-    delete(state: string): Promise<void> | void;
-    /**
-     * Cleanup expired states (optional, for periodic cleanup)
-     */
-    cleanup?(): Promise<void> | void;
-}
-/**
- * In-memory OAuth state store (default, for development)
- * ⚠️ Not suitable for production with multiple server instances
- */
-export declare class MemoryOAuthStateStore implements OAuthStateStore {
-    private states;
-    set(state: string, data: OAuthState, _ttl: number): void;
-    get(state: string): OAuthState | null;
-    delete(state: string): void;
-    cleanup(): void;
-}
-/**
- * Create default in-memory OAuth state store
- */
-export declare function createMemoryOAuthStateStore(): OAuthStateStore;
-export { createCookieOAuthStateStore, createNextJsCookieOAuthStateStore, type CookieHandler, type CookieOAuthStateStoreConfig, } from './state-store-cookie';
-export { createRedisOAuthStateStore, type RedisClient, } from './state-store-redis';

package/dist/core/auth/otp.d.ts

@@ -1,184 +0,0 @@
-import { AuthResult, User, Session } from '../types';
-import { SecurityManager } from '../security/security-manager';
-import { Logger } from '../logger';
-/**
- * OTP provider type.
- */
-export type OTPProvider = 'email' | 'sms';
-/**
- * OTP configuration.
- */
-export interface OTPConfig {
-    readonly length?: number;
-    readonly expiresIn?: number;
-    readonly provider?: OTPProvider;
-    readonly security?: SecurityManager;
-    readonly logger?: Logger;
-}
-/**
- * OTP storage adapter interface.
- */
-export interface OTPStorageAdapter {
-    /**
-     * Stores an OTP code.
-     *
-     * @param email - User email
-     * @param code - OTP code
-     * @param expiresIn - Expiration time in seconds
-     */
-    set(email: string, code: string, expiresIn: number): Promise<void>;
-    /**
-     * Gets an OTP code.
-     *
-     * @param email - User email
-     * @returns OTP code or null if not found/expired
-     */
-    get(email: string): Promise<string | null>;
-    /**
-     * Deletes an OTP code.
-     *
-     * @param email - User email
-     */
-    delete(email: string): Promise<void>;
-}
-/**
- * In-memory OTP storage adapter.
- */
-export declare class MemoryOTPStorage implements OTPStorageAdapter {
-    private readonly storage;
-    set(email: string, code: string, expiresIn: number): Promise<void>;
-    get(email: string): Promise<string | null>;
-    delete(email: string): Promise<void>;
-}
-/**
- * OTP authentication handler.
- *
- * Provides secure OTP generation, validation, and authentication.
- *
- * @example
- * ```typescript
- * const handler = new OTPAuth({
- *   length: 6,
- *   expiresIn: 600, // 10 minutes
- *   provider: 'email',
- * })
- *
- * // Generate OTP
- * const code = await handler.generateOTP('user@example.com')
- *
- * // Verify OTP
- * const result = await handler.verifyOTP('user@example.com', code, userLookup, createSession)
- * ```
- */
-export declare class OTPAuth {
-    private readonly config;
-    private readonly storage;
-    private readonly security;
-    constructor(config?: OTPConfig, storage?: OTPStorageAdapter);
-    /**
-     * Generates an OTP code for a user.
-     *
-     * @param email - User email
-     * @returns Generated OTP code
-     *
-     * @example
-     * ```typescript
-     * const code = await handler.generateOTP('user@example.com')
-     * // Send code via email/SMS
-     * ```
-     */
-    generateOTP(email: string): Promise<string>;
-    /**
-     * Verifies an OTP code and authenticates the user.
-     *
-     * @template TUser - User type
-     * @template TSession - Session type
-     * @param email - User email
-     * @param code - OTP code to verify
-     * @param userLookup - Function to lookup user by email
-     * @param createSession - Function to create session (optional)
-     * @returns Authentication result
-     *
-     * @example
-     * ```typescript
-     * const result = await handler.verifyOTP(
-     *   'user@example.com',
-     *   '123456',
-     *   async (email) => await db.user.findUnique({ where: { email } })
-     * )
-     * ```
-     */
-    verifyOTP<TUser extends User = User, TSession extends Session<TUser> = Session<TUser>>(email: string, code: string, userLookup: (email: string) => Promise<TUser | null>, createSession?: (user: TUser) => Promise<TSession>): Promise<AuthResult<TUser, TSession>>;
-    /**
-     * Generates a numeric OTP code.
-     *
-     * @param length - Code length
-     * @returns Numeric code string
-     */
-    private generateNumericCode;
-    /**
-     * Constant-time string comparison to prevent timing attacks.
-     *
-     * @param a - First string
-     * @param b - Second string
-     * @returns True if strings match
-     */
-    private constantTimeCompare;
-}
-/**
- * Creates an OTP authentication handler.
- *
- * @param config - OTP configuration
- * @param storage - OTP storage adapter (optional)
- * @returns OTP authentication handler
- *
- * @example
- * ```typescript
- * const handler = createOTPAuth({
- *   length: 6,
- *   expiresIn: 600,
- *   provider: 'email',
- * })
- * ```
- */
-export declare function createOTPAuth(config?: OTPConfig, storage?: OTPStorageAdapter): OTPAuth;
-/**
- * TODO: Performance
- * - [ ] Add OTP generation caching
- * - [ ] Optimize storage lookups
- * - [ ] Implement async code generation
- *
- * TODO: Features
- * - [ ] Add SMS provider support
- * - [ ] Implement OTP resend functionality
- * - [ ] Add OTP rate limiting
- * - [ ] Create OTP delivery tracking
- * - [ ] Add OTP code hints (for testing)
- *
- * TODO: Security
- * - [ ] Add OTP brute force protection
- * - [ ] Implement OTP code rotation
- * - [ ] Add OTP delivery verification
- * - [ ] Create security event logging
- *
- * TODO: Type Safety
- * - [ ] Add branded types for OTP codes
- * - [ ] Create type-safe OTP storage
- * - [ ] Implement compile-time validation
- *
- * TODO: Testing
- * - [ ] Add comprehensive unit tests
- * - [ ] Test OTP expiration
- * - [ ] Test constant-time comparison
- * - [ ] Add storage adapter tests
- *
- * TODO: Documentation
- * - [ ] Document OTP flow
- * - [ ] Add provider setup guide
- * - [ ] Create security best practices guide
- *
- * TODO: Limitations
- * - [ ] OTP storage is in-memory (consider Redis for production)
- * - [ ] Code generation uses Math.random (consider crypto.randomInt)
- * - [ ] No SMS provider implementation yet
- */

package/dist/core/auth/passkey.d.ts

@@ -1,35 +0,0 @@
-import { ApiClient, AuthResult } from '../types';
-export interface PassKeyCredential {
-    id: string;
-    name: string;
-    createdAt: Date;
-    lastUsedAt?: Date;
-}
-export interface PassKeyRegisterOptions {
-    name?: string;
-    userId?: string;
-}
-export interface PassKeyAuthOptions {
-    userId?: string;
-}
-export interface PassKeyMethods {
-    register(options?: PassKeyRegisterOptions): Promise<{
-        success: boolean;
-        passkeyId?: string;
-        error?: string;
-    }>;
-    authenticate(options?: PassKeyAuthOptions): Promise<AuthResult>;
-    list(): Promise<PassKeyCredential[]>;
-    remove(passKeyId: string): Promise<{
-        success: boolean;
-        error?: string;
-    }>;
-}
-/**
- * Check if WebAuthn is supported
- */
-export declare function isWebAuthnSupported(): boolean;
-/**
- * Create PassKey methods
- */
-export declare function createPassKeyMethods(client: ApiClient): PassKeyMethods;

package/dist/core/auth/password.d.ts

@@ -1,22 +0,0 @@
-/**
- * Password validation and utilities
- */
-/**
- * Validate password strength
- */
-export interface PasswordValidationResult {
-    valid: boolean;
-    errors: string[];
-    strength: 'weak' | 'medium' | 'strong';
-}
-export interface PasswordPolicy {
-    minLength?: number;
-    requireUppercase?: boolean;
-    requireLowercase?: boolean;
-    requireNumbers?: boolean;
-    requireSpecialChars?: boolean;
-}
-/**
- * Validate password against policy
- */
-export declare function validatePassword(password: string, policy?: PasswordPolicy): PasswordValidationResult;

package/dist/core/auth/signin-unified.d.ts

@@ -1,33 +0,0 @@
-import { MulguardInstance } from '../../mulguard';
-import { EmailCredentials, AuthResult } from '../types';
-/**
- * Unified sign in function - delegates to auth.signIn unified logic
- *
- * @example
- * ```typescript
- * // OAuth providers
- * await signIn(auth, 'google')
- * await signIn(auth, 'github')
- *
- * // Credentials
- * await signIn(auth, 'credentials', { email: 'user@example.com', password: 'password' })
- *
- * // OTP
- * await signIn(auth, 'otp', { email: 'user@example.com', code: '123456' })
- *
- * // Passkey
- * await signIn(auth, 'passkey', { userId: 'user-id' })
- * ```
- */
-export declare function signIn(auth: MulguardInstance, provider: 'google' | 'github' | 'apple' | 'facebook' | string): Promise<{
-    url: string;
-    state: string;
-}>;
-export declare function signIn(auth: MulguardInstance, provider: 'credentials', credentials: EmailCredentials): Promise<AuthResult>;
-export declare function signIn(auth: MulguardInstance, provider: 'otp', options: {
-    email: string;
-    code?: string;
-}): Promise<AuthResult>;
-export declare function signIn(auth: MulguardInstance, provider: 'passkey', options?: {
-    userId?: string;
-}): Promise<AuthResult>;

package/dist/core/auth/two-factor.d.ts

@@ -1,28 +0,0 @@
-import { ApiClient } from '../types';
-export interface TwoFactorMethods {
-    enable(): Promise<{
-        success: boolean;
-        qrCode?: string;
-        secret?: string;
-        error?: string;
-    }>;
-    verify(code: string): Promise<{
-        success: boolean;
-        backupCodes?: string[];
-        error?: string;
-    }>;
-    disable(): Promise<{
-        success: boolean;
-        error?: string;
-    }>;
-    generateBackupCodes(): Promise<{
-        success: boolean;
-        backupCodes?: string[];
-        error?: string;
-    }>;
-    isEnabled(): Promise<boolean>;
-}
-/**
- * Create 2FA methods
- */
-export declare function createTwoFactorMethods(client: ApiClient): TwoFactorMethods;

package/dist/core/client/index.d.ts

@@ -1,132 +0,0 @@
-/**
- * HTTP Client for making requests to backend API
- * Enhanced with timeout enforcement, retry logic, and interceptors
- */
-export interface HttpClientConfig {
-    baseURL: string;
-    apiPrefix: string;
-    timeout?: number;
-    headers?: Record<string, string>;
-    retry?: RetryConfig;
-    interceptors?: InterceptorsConfig;
-    /** Token refresh manager for automatic token refresh on 401 errors */
-    tokenRefreshManager?: import('./token-refresh-manager').TokenRefreshManager;
-}
-export interface RetryConfig {
-    /** Maximum number of retry attempts (default: 3) */
-    maxAttempts?: number;
-    /** Delay between retries in milliseconds (default: 1000) */
-    retryDelay?: number;
-    /** Exponential backoff multiplier (default: 2) */
-    backoffMultiplier?: number;
-    /** HTTP status codes that should trigger retry (default: [408, 429, 500, 502, 503, 504]) */
-    retryableStatusCodes?: number[];
-    /** Whether to retry on network errors (default: true) */
-    retryOnNetworkError?: boolean;
-}
-export interface InterceptorsConfig {
-    /** Request interceptor - called before sending request */
-    onRequest?: (config: RequestConfig) => Promise<RequestConfig> | RequestConfig;
-    /** Response interceptor - called after receiving response */
-    onResponse?: <T>(response: HttpResponse<T>) => Promise<HttpResponse<T>> | HttpResponse<T>;
-    /** Error interceptor - called on error */
-    onError?: (error: ApiError) => Promise<ApiError> | ApiError;
-}
-export interface RequestConfig {
-    url: string;
-    method: string;
-    headers: Record<string, string>;
-    body?: unknown;
-    credentials?: 'include' | 'omit' | 'same-origin';
-}
-interface InternalRequestOptions {
-    method?: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
-    headers?: Record<string, string>;
-    body?: unknown;
-    credentials?: 'include' | 'omit' | 'same-origin';
-    skipRetry?: boolean;
-    skipInterceptors?: boolean;
-    skipTokenRefresh?: boolean;
-}
-export interface HttpResponse<T = unknown> {
-    data: T;
-    status: number;
-    statusText: string;
-    headers: Headers;
-}
-export declare class HttpClient {
-    private config;
-    private pendingRequests;
-    constructor(config: HttpClientConfig);
-    /**
-     * Make HTTP request with timeout, retry, and interceptors
-     */
-    request<T = unknown>(path: string, options?: InternalRequestOptions): Promise<HttpResponse<T>>;
-    /**
-     * Execute HTTP request with retry logic
-     */
-    private executeRequest;
-    /**
-     * Check if request should be retried
-     */
-    private shouldRetry;
-    /**
-     * Calculate retry delay with exponential backoff
-     */
-    private calculateRetryDelay;
-    /**
-     * Sleep utility for retry delays
-     */
-    private sleep;
-    /**
-     * Build RequestInit from RequestConfig
-     */
-    private buildRequestInitFromConfig;
-    /**
-     * GET request
-     */
-    get<T = unknown>(path: string, options?: Omit<InternalRequestOptions, 'method' | 'body'>): Promise<HttpResponse<T>>;
-    /**
-     * POST request
-     */
-    post<T = unknown>(path: string, body?: unknown, options?: Omit<InternalRequestOptions, 'method'>): Promise<HttpResponse<T>>;
-    /**
-     * PUT request
-     */
-    put<T = unknown>(path: string, body?: unknown, options?: Omit<InternalRequestOptions, 'method'>): Promise<HttpResponse<T>>;
-    /**
-     * DELETE request
-     */
-    delete<T = unknown>(path: string, options?: Omit<InternalRequestOptions, 'method' | 'body'>): Promise<HttpResponse<T>>;
-    /**
-     * Build full URL
-     */
-    private buildUrl;
-    /**
-     * Parse response
-     */
-    private parseResponse;
-    /**
-     * Handle error response
-     */
-    private handleErrorResponse;
-}
-/**
- * API Error class with enhanced error information
- */
-export declare class ApiError extends Error {
-    code: string;
-    statusCode: number;
-    originalError?: Error;
-    retryable?: boolean;
-    constructor(message: string, code?: string, statusCode?: number, originalError?: Error, retryable?: boolean);
-    /**
-     * Check if error is retryable
-     */
-    isRetryable(): boolean;
-    /**
-     * Get user-friendly error message
-     */
-    getUserMessage(): string;
-}
-export {};

package/dist/core/client/token-refresh-manager.d.ts

@@ -1,48 +0,0 @@
-import { Session } from '../types';
-export interface TokenRefreshConfig {
-    /** Enable/disable automatic token refresh */
-    enabled?: boolean;
-    /** Time before token expiration to refresh (in seconds) */
-    refreshThreshold?: number;
-    /** Maximum number of refresh retries on failure */
-    maxRetries?: number;
-    /** Delay between retries (milliseconds) */
-    retryDelay?: number;
-    /** Maximum refresh requests per minute */
-    rateLimit?: number;
-    /** Enable/disable auto sign-out on refresh failure */
-    autoSignOutOnFailure?: boolean;
-    /** Login page URL for redirect on failure */
-    redirectToLogin?: string;
-    /** Enable/disable auto redirect on failure */
-    autoRedirectOnFailure?: boolean;
-    /** Callback on successful token refresh */
-    onTokenRefreshed?: (session: Session) => void | Promise<void>;
-    /** Callback on token refresh failure (before sign-out) */
-    onTokenRefreshFailed?: (error: Error) => void | Promise<void>;
-    /** Callback before redirect (can return false to cancel redirect) */
-    onBeforeRedirect?: (error: Error) => boolean | Promise<boolean>;
-}
-export interface TokenRefreshManager {
-    /** Refresh token with single refresh queue */
-    refreshToken(): Promise<Session | null>;
-    /** Check if refresh is in progress */
-    isRefreshing(): boolean;
-    /** Wait for current refresh to complete */
-    waitForRefresh(): Promise<Session | null>;
-    /** Clear state (on sign-out) */
-    clear(): void;
-    /** Handle token refresh failure */
-    handleRefreshFailure(error: Error): Promise<void>;
-}
-type RefreshFunction = () => Promise<Session | null>;
-type SignOutFunction = () => Promise<{
-    success: boolean;
-    error?: string;
-}>;
-type ClearSessionFunction = () => Promise<void>;
-/**
- * Create Token Refresh Manager
- */
-export declare function createTokenRefreshManager(refreshFn: RefreshFunction, signOutFn: SignOutFunction, clearSessionFn: ClearSessionFunction, config?: TokenRefreshConfig): TokenRefreshManager;
-export {};