or3-provider-basic-auth 0.0.7 → 0.0.8

package/README.md

@@ -6,6 +6,7 @@ This package registers:
 
 - `AuthProvider` (`basic-auth`)
 - `ProviderTokenBroker` (`basic-auth`)
+- admin status adapter (`auth-basic-auth`)
 - provider-owned auth UI adapter + components
 
 ## Installation
@@ -35,22 +36,31 @@ export const or3ProviderModules = [
 
 Required:
 
-- `AUTH_PROVIDER=basic-auth`
+- `AUTH_PROVIDER=basic-auth` (alias: `OR3_AUTH_PROVIDER`)
+- `SSR_AUTH_ENABLED=true`
 - `OR3_BASIC_AUTH_JWT_SECRET`
+- `OR3_BASIC_AUTH_REFRESH_SECRET` (use a separate random value; the provider validates it independently)
 
 Optional:
 
-- `OR3_BASIC_AUTH_REFRESH_SECRET` (falls back to `OR3_BASIC_AUTH_JWT_SECRET`)
 - `OR3_BASIC_AUTH_ACCESS_TTL_SECONDS` (default `900`)
 - `OR3_BASIC_AUTH_REFRESH_TTL_SECONDS` (default `2592000`)
+- `OR3_BASIC_AUTH_ROTATION_GRACE_MS` (default `30000`; concurrent-refresh grace window)
 - `OR3_BASIC_AUTH_DB_PATH` (default `./.data/or3-basic-auth.sqlite`)
 - `OR3_BASIC_AUTH_BOOTSTRAP_EMAIL`
 - `OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD`
+- `OR3_BASIC_AUTH_RATE_LIMIT_BACKEND` (`sqlite` default; `memory` is per-process and intended for single-instance development only)
+- `OR3_BASIC_AUTH_ALLOW_INSECURE_DEV` (`true` in non-production to start with missing secrets instead of failing)
+
+Registration mode is a core-auth policy, not a provider setting:
+
+- `OR3_AUTH_REGISTRATION_MODE=open|invite_only|disabled`
+- `OR3_AUTH_INVITE_TOKEN_SECRET` and `OR3_AUTH_INVITE_TOKEN_TTL_SECONDS` (required for `invite_only`)
 
 Strict-mode behavior:
 
-- `NODE_ENV=production` or `OR3_STRICT_CONFIG=true` fails startup if required secrets are missing.
-- non-strict mode logs diagnostics and leaves provider registration disabled.
+- `NODE_ENV=production`, `OR3_STRICT_CONFIG=true`, or runtime config `auth.strict=true` fails startup if required secrets are missing.
+- In non-strict (development) mode, missing secrets also fail startup unless `OR3_BASIC_AUTH_ALLOW_INSECURE_DEV=true` is set — then diagnostics are logged and provider registration is left disabled.
 
 ## Architecture notes
 
@@ -61,16 +71,35 @@ Strict-mode behavior:
 - Basic Auth account and initial refresh-session rows are created in one local SQLite transaction.
 - Access JWTs are short-lived and validated by `basicAuthProvider.getSession(event)`.
 - Refresh tokens are rotated and hashed at rest; replay attempts revoke active sessions.
+- The refresh cookie is scoped to `/api` so `/api/auth/session` can transparently rotate expired access tokens during session resolution.
+- The SQLite DB file and directory are hardened to mode `0600`/`0700`; the DB uses WAL journaling.
+
+## Runtime entrypoints
+
+| File | Purpose |
+|---|---|
+| `src/module.ts` | Nuxt module entry — wires `/api/basic-auth/*` handlers, server plugin, and client plugins |
+| `src/runtime/server/plugins/register.ts` | Registers auth provider + token broker + admin adapter into core registries; bootstraps account |
+| `src/runtime/server/auth/basic-auth-provider.ts` | Auth provider — session resolution from access tokens with refresh-token recovery |
+| `src/runtime/server/token-broker/basic-auth-token-broker.ts` | Token broker for direct-mode providers |
+| `src/runtime/server/admin/adapters/auth-basic-auth.ts` | Admin status adapter (config diagnostics) |
+| `src/runtime/server/api/basic-auth/*.post.ts` | Sign-in / register / sign-out / refresh / change-password endpoints |
+| `src/runtime/server/db/client.ts` | SQLite client + migrations (`basic_auth_accounts`, `basic_auth_sessions`, `basic_auth_rate_limits`) |
+| `src/runtime/server/lib/*.ts` | Config, JWT, cookies, password, rate-limit, session store, refresh rotation |
+| `src/runtime/plugins/basic-auth-ui.client.ts` | Registers auth UI adapter + lock-page adapter |
+| `src/runtime/plugins/auth-status.client.ts` | Client auth-status resolver + silent-refresh recovery |
+| `src/runtime/components/*.client.vue` | Provider-owned auth UI (modals, user menu, sidebar button, lock page) |
 
 ## Troubleshooting
 
 - `Authentication provider is not configured`
   - Ensure `AUTH_PROVIDER=basic-auth` and `SSR_AUTH_ENABLED=true`.
-  - Ensure `OR3_BASIC_AUTH_JWT_SECRET` is set.
+  - Ensure `OR3_BASIC_AUTH_JWT_SECRET` and `OR3_BASIC_AUTH_REFRESH_SECRET` are set.
 
-- `Missing OR3_BASIC_AUTH_JWT_SECRET`
+- `Missing OR3_BASIC_AUTH_JWT_SECRET` / `Missing OR3_BASIC_AUTH_REFRESH_SECRET`
   - In strict mode (`NODE_ENV=production` or `OR3_STRICT_CONFIG=true`), startup fails intentionally.
-  - Add the missing secret and restart.
+  - In development, set `OR3_BASIC_AUTH_ALLOW_INSECURE_DEV=true` to start with registration disabled instead.
+  - Add the missing secret(s) and restart.
 
 - `Invalid credentials` on known user
   - Verify the bootstrap account values.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "or3-provider-basic-auth",
   "configKey": "or3-provider-basic-auth",
-  "version": "0.0.7",
+  "version": "0.0.8",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "or3-provider-basic-auth",
-  "version": "0.0.7",
+  "version": "0.0.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Saluana/or3-provider-basic-auth.git"
@@ -40,6 +40,7 @@
     "build": "nuxt-module-build build",
     "lint": "eslint \"src/**/*.{ts,d.ts,vue}\"",
     "type-check": "tsc -p tsconfig.typecheck.json --noEmit",
+    "type-check:standalone": "tsc -p tsconfig.typecheck.json --noEmit",
     "test": "vitest run"
   },
   "publishConfig": {
@@ -47,7 +48,7 @@
   },
   "dependencies": {
     "bcryptjs": "^3.0.3",
-    "better-sqlite3": "^12.4.1",
+    "better-sqlite3": "^13.0.3",
     "jsonwebtoken": "^9.0.2",
     "zod": "^4.1.12"
   },