own-auth 0.1.0

package/dist/auth-engine.js

@@ -0,0 +1,989 @@
+import { AuthError } from "./errors.js";
+import { createId, hashPassword, hashSecret, randomBase64Url, randomNumericCode, safeEqual, verifyPassword } from "./crypto.js";
+import { InMemoryAuthStorage } from "./memory-storage.js";
+import { normalizeEmail, normalizePhone, slugify, isExpired } from "./normalise.js";
+import { roleHasPermission } from "./permissions.js";
+import { ConsoleEmailProvider, ConsoleSmsProvider } from "./providers.js";
+import { enforceRateLimit, InMemoryRateLimitStore } from "./rate-limit.js";
+const minute = 60 * 1000;
+const hour = 60 * minute;
+const day = 24 * hour;
+const defaultTokenTtls = {
+    email_verification: day,
+    password_reset: hour,
+    magic_link: 15 * minute,
+    organisation_invite: 7 * day,
+    phone_verification: 10 * minute
+};
+export class OwnAuth {
+    storage;
+    rateLimitStore;
+    emailProvider;
+    smsProvider;
+    baseUrl;
+    tokenPepper;
+    exposeRawTokens;
+    allowMagicLinkSignup;
+    allowPhoneSignup;
+    redirectAllowlist;
+    sessionTtlMs;
+    sessionIdleTtlMs;
+    tokenTtls;
+    smsOtpTtlMs;
+    smsMaxAttempts;
+    smsCodeLength;
+    passwordMinLength;
+    constructor(options = {}) {
+        this.storage = options.storage ?? new InMemoryAuthStorage();
+        this.rateLimitStore = options.rateLimitStore ?? new InMemoryRateLimitStore();
+        this.emailProvider = options.emailProvider ?? new ConsoleEmailProvider();
+        this.smsProvider = options.smsProvider ?? new ConsoleSmsProvider();
+        this.baseUrl = options.baseUrl ?? "http://localhost:3000";
+        this.tokenPepper = options.tokenPepper ?? "";
+        this.exposeRawTokens = options.exposeRawTokens ?? false;
+        this.allowMagicLinkSignup = options.allowMagicLinkSignup ?? true;
+        this.allowPhoneSignup = options.allowPhoneSignup ?? true;
+        this.redirectAllowlist = options.redirectAllowlist ?? [this.baseUrl];
+        this.sessionTtlMs = options.session?.ttlMs ?? 30 * day;
+        this.sessionIdleTtlMs = options.session?.idleTtlMs ?? 7 * day;
+        this.tokenTtls = { ...defaultTokenTtls, ...options.tokenTtlMs };
+        this.smsOtpTtlMs = options.sms?.otpTtlMs ?? 10 * minute;
+        this.smsMaxAttempts = options.sms?.maxAttempts ?? 5;
+        this.smsCodeLength = options.sms?.codeLength ?? 6;
+        this.passwordMinLength = options.password?.minLength ?? 8;
+    }
+    async createUser(input) {
+        const email = input.email ? normalizeEmail(input.email) : null;
+        const phone = input.phone ? normalizePhone(input.phone) : null;
+        if (email && (await this.storage.getUserByEmail(email))) {
+            throw new AuthError("email_already_exists", "A user already exists with that email", 409);
+        }
+        if (phone && (await this.storage.getUserByPhone(phone))) {
+            throw new AuthError("phone_already_exists", "A user already exists with that phone", 409);
+        }
+        const now = new Date();
+        const passwordHash = input.password ? await this.hashPasswordInput(input.password) : null;
+        const user = await this.storage.createUser({
+            id: createId("usr"),
+            email,
+            emailVerifiedAt: null,
+            phone,
+            phoneVerifiedAt: null,
+            passwordHash,
+            name: input.name ?? null,
+            imageUrl: input.imageUrl ?? null,
+            disabledAt: null,
+            metadata: cloneMetadata(input.metadata),
+            createdAt: now,
+            updatedAt: now,
+            lastLoginAt: null
+        });
+        if (email && passwordHash) {
+            await this.storage.createAccount(this.accountFor(user.id, "password", email, email, null, now));
+        }
+        if (email && !passwordHash) {
+            await this.storage.createAccount(this.accountFor(user.id, "magic_link", email, email, null, now));
+        }
+        if (phone) {
+            await this.storage.createAccount(this.accountFor(user.id, "phone", phone, null, phone, now));
+        }
+        return user;
+    }
+    async signUpEmailPassword(input) {
+        const email = normalizeEmail(input.email);
+        await this.rateLimit("signup", email, 5, 10 * minute);
+        if (await this.storage.getUserByEmail(email)) {
+            throw new AuthError("email_already_exists", "A user already exists with that email", 409);
+        }
+        const user = await this.createUser({
+            email,
+            password: input.password,
+            name: input.name,
+            metadata: input.metadata
+        });
+        await this.audit({
+            eventType: "user.signed_up",
+            actorUserId: user.id,
+            targetUserId: user.id,
+            context: input.request
+        });
+        const result = await this.createSession(user, input.request);
+        const updatedUser = await this.storage.updateUser(user.id, {
+            lastLoginAt: new Date(),
+            updatedAt: new Date()
+        });
+        return { ...result, user: updatedUser ?? user };
+    }
+    async signInEmailPassword(input) {
+        const email = normalizeEmail(input.email);
+        await this.rateLimit("signin", email, 10, 10 * minute);
+        const user = await this.storage.getUserByEmail(email);
+        if (!user?.passwordHash) {
+            throw new AuthError("invalid_credentials", "Invalid email or password", 401);
+        }
+        this.assertUserEnabled(user);
+        if (!(await verifyPassword(input.password, user.passwordHash))) {
+            throw new AuthError("invalid_credentials", "Invalid email or password", 401);
+        }
+        const updatedUser = await this.storage.updateUser(user.id, {
+            lastLoginAt: new Date(),
+            updatedAt: new Date()
+        });
+        const activeUser = updatedUser ?? user;
+        const result = await this.createSession(activeUser, input.request);
+        await this.audit({
+            eventType: "user.signed_in",
+            actorUserId: activeUser.id,
+            targetUserId: activeUser.id,
+            context: input.request
+        });
+        return result;
+    }
+    async getCurrentSession(sessionToken) {
+        const tokenHash = this.hash(sessionToken);
+        const session = await this.storage.getSessionByTokenHash(tokenHash);
+        const now = new Date();
+        if (!session || session.revokedAt || isExpired(session.expiresAt, now) || isExpired(session.idleExpiresAt, now)) {
+            return null;
+        }
+        const user = await this.storage.getUserById(session.userId);
+        if (!user || user.disabledAt) {
+            return null;
+        }
+        const updatedSession = await this.storage.updateSession(session.id, {
+            lastActiveAt: now,
+            idleExpiresAt: new Date(now.getTime() + this.sessionIdleTtlMs)
+        });
+        return {
+            session: updatedSession ?? session,
+            user
+        };
+    }
+    async requireCurrentSession(sessionToken) {
+        const currentSession = await this.getCurrentSession(sessionToken);
+        if (!currentSession) {
+            throw new AuthError("invalid_session", "Invalid or expired session", 401);
+        }
+        return currentSession;
+    }
+    async signOut(sessionToken, context) {
+        const tokenHash = this.hash(sessionToken);
+        const session = await this.storage.getSessionByTokenHash(tokenHash);
+        if (!session || session.revokedAt) {
+            return;
+        }
+        const now = new Date();
+        await this.storage.updateSession(session.id, {
+            revokedAt: now,
+            revokeReason: "user_logout"
+        });
+        await this.audit({
+            eventType: "user.signed_out",
+            actorUserId: session.userId,
+            targetUserId: session.userId,
+            context
+        });
+        await this.audit({
+            eventType: "session.revoked",
+            actorUserId: session.userId,
+            targetUserId: session.userId,
+            context,
+            metadata: { reason: "user_logout" }
+        });
+    }
+    async revokeAllSessions(userId, reason = "all_sessions_revoked") {
+        const sessions = await this.storage.listSessionsByUserId(userId);
+        const now = new Date();
+        let revoked = 0;
+        for (const session of sessions) {
+            if (!session.revokedAt) {
+                await this.storage.updateSession(session.id, {
+                    revokedAt: now,
+                    revokeReason: reason
+                });
+                revoked += 1;
+            }
+        }
+        await this.audit({
+            eventType: "session.revoked_all",
+            actorUserId: userId,
+            targetUserId: userId,
+            metadata: { reason, revoked }
+        });
+        return revoked;
+    }
+    async requestMagicLink(input) {
+        const email = normalizeEmail(input.email);
+        await this.rateLimit("magic-link", email, 5, 10 * minute);
+        this.assertRedirectAllowed(input.redirectUrl);
+        const user = await this.storage.getUserByEmail(email);
+        if (!user && !this.allowMagicLinkSignup) {
+            return { sent: true, expiresAt: null };
+        }
+        const issued = await this.issueToken("magic_link", {
+            userId: user?.id ?? null,
+            email,
+            ttlMs: this.tokenTtls.magic_link
+        });
+        const url = this.buildUrl("/auth/magic-link/verify", {
+            token: issued.rawToken,
+            redirect_url: input.redirectUrl
+        });
+        await this.emailProvider.send({
+            to: email,
+            type: "magic_link",
+            token: issued.rawToken,
+            url,
+            expiresAt: issued.token.expiresAt
+        });
+        await this.audit({
+            eventType: "magic_link.requested",
+            actorUserId: user?.id ?? null,
+            targetUserId: user?.id ?? null,
+            context: input.request
+        });
+        return this.delivery(issued.rawToken, url, issued.token.expiresAt);
+    }
+    async verifyMagicLink(input) {
+        const token = await this.consumeToken(input.token, "magic_link");
+        let user = token.userId ? await this.storage.getUserById(token.userId) : null;
+        if (!user && token.email) {
+            user = await this.storage.getUserByEmail(token.email);
+        }
+        if (!user && token.email && this.allowMagicLinkSignup) {
+            user = await this.createUser({ email: token.email });
+        }
+        if (!user) {
+            throw new AuthError("invalid_token", "Invalid token", 401);
+        }
+        this.assertUserEnabled(user);
+        if (!user.emailVerifiedAt && token.email) {
+            user = (await this.storage.updateUser(user.id, {
+                emailVerifiedAt: new Date(),
+                updatedAt: new Date()
+            })) ?? user;
+        }
+        const result = await this.createSession(user, input.request);
+        await this.audit({
+            eventType: "magic_link.used",
+            actorUserId: user.id,
+            targetUserId: user.id,
+            context: input.request
+        });
+        await this.audit({
+            eventType: "user.signed_in",
+            actorUserId: user.id,
+            targetUserId: user.id,
+            context: input.request,
+            metadata: { method: "magic_link" }
+        });
+        return result;
+    }
+    async requestEmailVerification(input) {
+        const email = normalizeEmail(input.email);
+        await this.rateLimit("email-verification", email, 5, 10 * minute);
+        const user = await this.storage.getUserByEmail(email);
+        if (!user) {
+            return { sent: true, expiresAt: null };
+        }
+        const issued = await this.issueToken("email_verification", {
+            userId: user.id,
+            email,
+            ttlMs: this.tokenTtls.email_verification
+        });
+        const url = this.buildUrl("/auth/email/verify", { token: issued.rawToken });
+        await this.emailProvider.send({
+            to: email,
+            type: "email_verification",
+            token: issued.rawToken,
+            url,
+            expiresAt: issued.token.expiresAt
+        });
+        await this.audit({
+            eventType: "email_verification.requested",
+            actorUserId: user.id,
+            targetUserId: user.id,
+            context: input.request
+        });
+        return this.delivery(issued.rawToken, url, issued.token.expiresAt);
+    }
+    async verifyEmail(input) {
+        const token = await this.consumeToken(input.token, "email_verification");
+        const user = token.userId ? await this.storage.getUserById(token.userId) : null;
+        if (!user) {
+            throw new AuthError("invalid_token", "Invalid token", 401);
+        }
+        const updatedUser = await this.storage.updateUser(user.id, {
+            emailVerifiedAt: new Date(),
+            updatedAt: new Date()
+        });
+        await this.audit({
+            eventType: "email.verified",
+            actorUserId: user.id,
+            targetUserId: user.id,
+            context: input.request
+        });
+        return updatedUser ?? user;
+    }
+    async requestPasswordReset(input) {
+        const email = normalizeEmail(input.email);
+        await this.rateLimit("password-reset", email, 5, 15 * minute);
+        const user = await this.storage.getUserByEmail(email);
+        if (!user) {
+            return { sent: true, expiresAt: null };
+        }
+        const issued = await this.issueToken("password_reset", {
+            userId: user.id,
+            email,
+            ttlMs: this.tokenTtls.password_reset
+        });
+        const url = this.buildUrl("/auth/password/reset", { token: issued.rawToken });
+        await this.emailProvider.send({
+            to: email,
+            type: "password_reset",
+            token: issued.rawToken,
+            url,
+            expiresAt: issued.token.expiresAt
+        });
+        await this.audit({
+            eventType: "password_reset.requested",
+            actorUserId: user.id,
+            targetUserId: user.id,
+            context: input.request
+        });
+        return this.delivery(issued.rawToken, url, issued.token.expiresAt);
+    }
+    async resetPassword(input) {
+        const token = await this.consumeToken(input.token, "password_reset");
+        const user = token.userId ? await this.storage.getUserById(token.userId) : null;
+        if (!user) {
+            throw new AuthError("invalid_token", "Invalid token", 401);
+        }
+        const passwordHash = await this.hashPasswordInput(input.newPassword);
+        const updatedUser = await this.storage.updateUser(user.id, {
+            passwordHash,
+            updatedAt: new Date()
+        });
+        await this.revokeAllSessions(user.id, "password_reset");
+        await this.audit({
+            eventType: "password.changed",
+            actorUserId: user.id,
+            targetUserId: user.id,
+            context: input.request
+        });
+        return updatedUser ?? user;
+    }
+    async requestSmsOtp(input) {
+        const purpose = input.purpose ?? "phone_login";
+        const phone = normalizePhone(input.phone);
+        await this.rateLimit(`sms-${purpose}`, phone, 5, 15 * minute);
+        const user = input.userId
+            ? await this.storage.getUserById(input.userId)
+            : await this.storage.getUserByPhone(phone);
+        const code = randomNumericCode(this.smsCodeLength);
+        const now = new Date();
+        const expiresAt = new Date(now.getTime() + this.smsOtpTtlMs);
+        const otp = await this.storage.createSmsOtp({
+            id: createId("otp"),
+            phone,
+            userId: user?.id ?? null,
+            codeHash: this.hash(code),
+            purpose,
+            expiresAt,
+            attempts: 0,
+            maxAttempts: this.smsMaxAttempts,
+            consumedAt: null,
+            createdAt: now,
+            lastSentAt: now
+        });
+        await this.smsProvider.send({
+            to: phone,
+            purpose,
+            code,
+            expiresAt
+        });
+        await this.audit({
+            eventType: "sms_otp.sent",
+            actorUserId: user?.id ?? null,
+            targetUserId: user?.id ?? null,
+            context: input.request,
+            metadata: { purpose, otpId: otp.id }
+        });
+        const delivery = { sent: true, expiresAt };
+        if (this.exposeRawTokens) {
+            delivery.code = code;
+        }
+        return delivery;
+    }
+    async verifySmsOtp(input) {
+        const purpose = input.purpose ?? "phone_login";
+        const phone = normalizePhone(input.phone);
+        await this.rateLimit(`sms-verify-${purpose}`, phone, 10, 15 * minute);
+        const otp = await this.storage.getLatestSmsOtp(phone, purpose);
+        const now = new Date();
+        if (!otp || otp.consumedAt || isExpired(otp.expiresAt, now)) {
+            throw new AuthError("invalid_otp", "Invalid or expired code", 401);
+        }
+        if (otp.attempts >= otp.maxAttempts) {
+            throw new AuthError("otp_attempts_exceeded", "Too many code attempts", 429);
+        }
+        const codeHash = this.hash(input.code);
+        if (!safeEqual(codeHash, otp.codeHash)) {
+            await this.storage.updateSmsOtp(otp.id, { attempts: otp.attempts + 1 });
+            throw new AuthError("invalid_otp", "Invalid or expired code", 401);
+        }
+        await this.storage.updateSmsOtp(otp.id, {
+            consumedAt: now,
+            attempts: otp.attempts + 1
+        });
+        let user = otp.userId ? await this.storage.getUserById(otp.userId) : null;
+        if (!user) {
+            user = await this.storage.getUserByPhone(phone);
+        }
+        if (!user && purpose === "phone_login" && this.allowPhoneSignup) {
+            user = await this.createUser({ phone });
+        }
+        if (!user) {
+            throw new AuthError("user_not_found", "User not found", 404);
+        }
+        this.assertUserEnabled(user);
+        user = (await this.storage.updateUser(user.id, {
+            phone,
+            phoneVerifiedAt: new Date(),
+            updatedAt: new Date()
+        })) ?? user;
+        await this.audit({
+            eventType: "sms_otp.verified",
+            actorUserId: user.id,
+            targetUserId: user.id,
+            context: input.request,
+            metadata: { purpose }
+        });
+        await this.audit({
+            eventType: "phone.verified",
+            actorUserId: user.id,
+            targetUserId: user.id,
+            context: input.request
+        });
+        if (purpose !== "phone_login") {
+            return { user, session: null, sessionToken: null };
+        }
+        const sessionResult = await this.createSession(user, input.request);
+        await this.audit({
+            eventType: "user.signed_in",
+            actorUserId: user.id,
+            targetUserId: user.id,
+            context: input.request,
+            metadata: { method: "phone_otp" }
+        });
+        return {
+            user: sessionResult.user,
+            session: sessionResult.session,
+            sessionToken: sessionResult.sessionToken
+        };
+    }
+    async createApiKey(input) {
+        if (!input.userId && !input.organisationId) {
+            throw new AuthError("permission_denied", "API keys need a user or organisation owner", 400);
+        }
+        if (input.organisationId && input.actorUserId) {
+            await this.requirePermission(input.organisationId, input.actorUserId, "manage_api_keys");
+        }
+        await this.rateLimit("api-key-create", input.organisationId ?? input.userId ?? input.actorUserId ?? "anonymous", 20, hour);
+        const prefix = randomBase64Url(6).replace(/[-_]/g, "").slice(0, 8);
+        const rawKey = `oa_${prefix}_${randomBase64Url(32)}`;
+        const now = new Date();
+        const apiKey = await this.storage.createApiKey({
+            id: createId("key"),
+            keyPrefix: prefix,
+            keyHash: this.hash(rawKey),
+            name: input.name,
+            userId: input.userId ?? null,
+            organisationId: input.organisationId ?? null,
+            scopes: input.scopes ?? [],
+            status: "active",
+            expiresAt: input.expiresAt ?? null,
+            lastUsedAt: null,
+            createdAt: now,
+            revokedAt: null,
+            revokedBy: null,
+            metadata: cloneMetadata(input.metadata)
+        });
+        await this.audit({
+            eventType: "api_key.created",
+            actorUserId: input.actorUserId ?? input.userId ?? null,
+            targetUserId: input.userId ?? null,
+            organisationId: input.organisationId ?? null,
+            apiKeyId: apiKey.id,
+            context: input.request,
+            metadata: { name: input.name, scopes: apiKey.scopes }
+        });
+        return { apiKey, rawKey };
+    }
+    async verifyApiKey(rawKey, requiredScopes = []) {
+        const prefix = this.extractApiKeyPrefix(rawKey);
+        if (!prefix) {
+            throw new AuthError("api_key_invalid", "Invalid API key", 401);
+        }
+        const apiKey = await this.storage.getApiKeyByPrefix(prefix);
+        if (!apiKey || !safeEqual(this.hash(rawKey), apiKey.keyHash)) {
+            throw new AuthError("api_key_invalid", "Invalid API key", 401);
+        }
+        if (apiKey.status === "revoked" || apiKey.revokedAt) {
+            throw new AuthError("api_key_revoked", "API key has been revoked", 401);
+        }
+        if (apiKey.expiresAt && isExpired(apiKey.expiresAt)) {
+            throw new AuthError("api_key_expired", "API key has expired", 401);
+        }
+        const hasAllScopes = requiredScopes.every((scope) => apiKey.scopes.includes("*") || apiKey.scopes.includes(scope));
+        if (!hasAllScopes) {
+            throw new AuthError("insufficient_scope", "API key does not have the required scope", 403);
+        }
+        const updatedApiKey = await this.storage.updateApiKey(apiKey.id, {
+            lastUsedAt: new Date()
+        });
+        const activeApiKey = updatedApiKey ?? apiKey;
+        await this.audit({
+            eventType: "api_key.used",
+            actorUserId: activeApiKey.userId,
+            targetUserId: activeApiKey.userId,
+            organisationId: activeApiKey.organisationId,
+            apiKeyId: activeApiKey.id,
+            metadata: { requiredScopes }
+        });
+        const user = activeApiKey.userId ? await this.storage.getUserById(activeApiKey.userId) : null;
+        const organisation = activeApiKey.organisationId
+            ? await this.storage.getOrganisationById(activeApiKey.organisationId)
+            : null;
+        return {
+            apiKey: activeApiKey,
+            user,
+            organisation
+        };
+    }
+    async revokeApiKey(keyPrefixOrId, revokedBy, context) {
+        let apiKey = await this.storage.getApiKeyByPrefix(keyPrefixOrId);
+        if (!apiKey) {
+            throw new AuthError("api_key_invalid", "Invalid API key", 404);
+        }
+        const updatedApiKey = await this.storage.updateApiKey(apiKey.id, {
+            status: "revoked",
+            revokedAt: new Date(),
+            revokedBy: revokedBy ?? null
+        });
+        apiKey = updatedApiKey ?? apiKey;
+        await this.audit({
+            eventType: "api_key.revoked",
+            actorUserId: revokedBy ?? apiKey.userId,
+            targetUserId: apiKey.userId,
+            organisationId: apiKey.organisationId,
+            apiKeyId: apiKey.id,
+            context
+        });
+        return apiKey;
+    }
+    async createOrganisation(input) {
+        const owner = await this.storage.getUserById(input.ownerUserId);
+        if (!owner) {
+            throw new AuthError("user_not_found", "Owner user not found", 404);
+        }
+        const now = new Date();
+        const baseSlug = slugify(input.slug ?? input.name);
+        const slug = await this.uniqueOrganisationSlug(baseSlug);
+        const organisation = await this.storage.createOrganisation({
+            id: createId("org"),
+            name: input.name,
+            slug,
+            ownerUserId: input.ownerUserId,
+            metadata: cloneMetadata(input.metadata),
+            createdAt: now,
+            updatedAt: now,
+            disabledAt: null
+        });
+        const ownerMembership = await this.storage.createOrganisationMember({
+            id: createId("mem"),
+            organisationId: organisation.id,
+            userId: input.ownerUserId,
+            role: "owner",
+            status: "active",
+            joinedAt: now,
+            removedAt: null,
+            createdAt: now,
+            updatedAt: now
+        });
+        await this.audit({
+            eventType: "organisation.created",
+            actorUserId: input.ownerUserId,
+            targetUserId: input.ownerUserId,
+            organisationId: organisation.id,
+            context: input.request,
+            metadata: { name: input.name, slug }
+        });
+        return { organisation, ownerMembership };
+    }
+    async updateOrganisation(organisationId, input) {
+        await this.requirePermission(organisationId, input.actorUserId, "manage_organisation");
+        const patch = {
+            updatedAt: new Date()
+        };
+        if (input.name !== undefined)
+            patch.name = input.name;
+        if (input.slug !== undefined)
+            patch.slug = await this.uniqueOrganisationSlug(slugify(input.slug));
+        if (input.metadata !== undefined)
+            patch.metadata = cloneMetadata(input.metadata);
+        const organisation = await this.storage.updateOrganisation(organisationId, patch);
+        if (!organisation) {
+            throw new AuthError("organisation_not_found", "Organisation not found", 404);
+        }
+        await this.audit({
+            eventType: "organisation.updated",
+            actorUserId: input.actorUserId,
+            organisationId,
+            context: input.request,
+            metadata: patch
+        });
+        return organisation;
+    }
+    async inviteMember(input) {
+        await this.requirePermission(input.organisationId, input.invitedByUserId, "invite_members");
+        const email = normalizeEmail(input.email);
+        const now = new Date();
+        const invitation = await this.storage.createInvitation({
+            id: createId("inv"),
+            organisationId: input.organisationId,
+            email,
+            phone: null,
+            role: input.role ?? "member",
+            invitedByUserId: input.invitedByUserId,
+            status: "pending",
+            expiresAt: new Date(now.getTime() + this.tokenTtls.organisation_invite),
+            acceptedAt: null,
+            revokedAt: null,
+            createdAt: now
+        });
+        const issued = await this.issueToken("organisation_invite", {
+            userId: null,
+            email,
+            organisationId: input.organisationId,
+            ttlMs: this.tokenTtls.organisation_invite
+        });
+        const url = this.buildUrl("/auth/invitations/accept", { token: issued.rawToken });
+        await this.emailProvider.send({
+            to: email,
+            type: "organisation_invite",
+            token: issued.rawToken,
+            url,
+            expiresAt: issued.token.expiresAt
+        });
+        await this.audit({
+            eventType: "member.invited",
+            actorUserId: input.invitedByUserId,
+            organisationId: input.organisationId,
+            context: input.request,
+            metadata: { email, role: invitation.role, invitationId: invitation.id }
+        });
+        const result = { invitation };
+        if (this.exposeRawTokens) {
+            result.token = issued.rawToken;
+            result.url = url;
+        }
+        return result;
+    }
+    async acceptInvitation(input) {
+        const token = await this.consumeToken(input.token, "organisation_invite");
+        const organisationId = token.organisationId;
+        if (!organisationId) {
+            throw new AuthError("invalid_token", "Invalid token", 401);
+        }
+        const allPending = token.email
+            ? await this.storage.getPendingInvitationByOrganisationAndEmail(organisationId, token.email)
+            : null;
+        if (!allPending) {
+            throw new AuthError("invitation_not_found", "Invitation not found", 404);
+        }
+        if (allPending.status !== "pending") {
+            throw new AuthError("invitation_not_pending", "Invitation is not pending", 409);
+        }
+        if (isExpired(allPending.expiresAt)) {
+            await this.storage.updateInvitation(allPending.id, { status: "expired" });
+            throw new AuthError("expired_token", "Invitation has expired", 401);
+        }
+        let user = input.userId ? await this.storage.getUserById(input.userId) : null;
+        if (!user && token.email) {
+            user = await this.storage.getUserByEmail(token.email);
+        }
+        if (!user && token.email) {
+            user = await this.createUser({ email: token.email });
+            user = (await this.storage.updateUser(user.id, {
+                emailVerifiedAt: new Date(),
+                updatedAt: new Date()
+            })) ?? user;
+        }
+        if (!user) {
+            throw new AuthError("user_not_found", "User not found", 404);
+        }
+        const now = new Date();
+        let member = await this.storage.getOrganisationMember(organisationId, user.id);
+        if (member) {
+            member = (await this.storage.updateOrganisationMember(member.id, {
+                role: allPending.role,
+                status: "active",
+                joinedAt: member.joinedAt ?? now,
+                removedAt: null,
+                updatedAt: now
+            })) ?? member;
+        }
+        else {
+            member = await this.storage.createOrganisationMember({
+                id: createId("mem"),
+                organisationId,
+                userId: user.id,
+                role: allPending.role,
+                status: "active",
+                joinedAt: now,
+                removedAt: null,
+                createdAt: now,
+                updatedAt: now
+            });
+        }
+        const invitation = (await this.storage.updateInvitation(allPending.id, {
+            status: "accepted",
+            acceptedAt: now
+        })) ?? allPending;
+        await this.audit({
+            eventType: "invite.accepted",
+            actorUserId: user.id,
+            targetUserId: user.id,
+            organisationId,
+            context: input.request,
+            metadata: { invitationId: invitation.id }
+        });
+        return { invitation, user, member };
+    }
+    async changeMemberRole(input) {
+        await this.requirePermission(input.organisationId, input.actorUserId, "change_member_roles");
+        const organisation = await this.storage.getOrganisationById(input.organisationId);
+        const member = await this.storage.getOrganisationMemberById(input.memberId);
+        if (!organisation || !member || member.organisationId !== input.organisationId) {
+            throw new AuthError("member_not_found", "Member not found", 404);
+        }
+        if (member.userId === organisation.ownerUserId && input.role !== "owner") {
+            throw new AuthError("unsafe_owner_removal", "Transfer ownership before changing owner role", 409);
+        }
+        const updatedMember = await this.storage.updateOrganisationMember(member.id, {
+            role: input.role,
+            updatedAt: new Date()
+        });
+        await this.audit({
+            eventType: "member.role_changed",
+            actorUserId: input.actorUserId,
+            targetUserId: member.userId,
+            organisationId: input.organisationId,
+            context: input.request,
+            metadata: { role: input.role }
+        });
+        return updatedMember ?? member;
+    }
+    async removeMember(input) {
+        await this.requirePermission(input.organisationId, input.actorUserId, "remove_members");
+        const organisation = await this.storage.getOrganisationById(input.organisationId);
+        const member = await this.storage.getOrganisationMemberById(input.memberId);
+        if (!organisation || !member || member.organisationId !== input.organisationId) {
+            throw new AuthError("member_not_found", "Member not found", 404);
+        }
+        if (member.userId === organisation.ownerUserId) {
+            throw new AuthError("unsafe_owner_removal", "Transfer ownership before removing owner", 409);
+        }
+        const now = new Date();
+        const updatedMember = await this.storage.updateOrganisationMember(member.id, {
+            status: "removed",
+            removedAt: now,
+            updatedAt: now
+        });
+        await this.audit({
+            eventType: "member.removed",
+            actorUserId: input.actorUserId,
+            targetUserId: member.userId,
+            organisationId: input.organisationId,
+            context: input.request
+        });
+        return updatedMember ?? member;
+    }
+    async checkPermission(organisationId, userId, permission) {
+        const member = await this.storage.getOrganisationMember(organisationId, userId);
+        return Boolean(member && member.status === "active" && roleHasPermission(member.role, permission));
+    }
+    async requirePermission(organisationId, userId, permission) {
+        const member = await this.storage.getOrganisationMember(organisationId, userId);
+        if (!member || member.status !== "active" || !roleHasPermission(member.role, permission)) {
+            throw new AuthError("permission_denied", "You do not have permission for this action", 403);
+        }
+        return member;
+    }
+    async listAuditEvents(filter) {
+        return this.storage.listAuditEvents(filter);
+    }
+    async createSession(user, context) {
+        this.assertUserEnabled(user);
+        const sessionToken = randomBase64Url(32);
+        const now = new Date();
+        const session = await this.storage.createSession({
+            id: createId("ses"),
+            userId: user.id,
+            tokenHash: this.hash(sessionToken),
+            createdAt: now,
+            lastActiveAt: now,
+            expiresAt: new Date(now.getTime() + this.sessionTtlMs),
+            idleExpiresAt: new Date(now.getTime() + this.sessionIdleTtlMs),
+            ipAddress: context?.ipAddress ?? null,
+            userAgent: context?.userAgent ?? null,
+            revokedAt: null,
+            revokeReason: null
+        });
+        await this.audit({
+            eventType: "session.created",
+            actorUserId: user.id,
+            targetUserId: user.id,
+            context,
+            metadata: { sessionId: session.id }
+        });
+        return { user, session, sessionToken };
+    }
+    accountFor(userId, provider, providerAccountId, providerEmail, providerPhone, now) {
+        return {
+            id: createId("acct"),
+            userId,
+            provider,
+            providerAccountId,
+            providerEmail,
+            providerPhone,
+            createdAt: now,
+            updatedAt: now
+        };
+    }
+    async issueToken(type, input) {
+        const rawToken = randomBase64Url(32);
+        const now = new Date();
+        const token = await this.storage.createToken({
+            id: createId("tok"),
+            tokenHash: this.hash(rawToken),
+            type,
+            userId: input.userId,
+            email: input.email ?? null,
+            phone: input.phone ?? null,
+            organisationId: input.organisationId ?? null,
+            expiresAt: new Date(now.getTime() + input.ttlMs),
+            usedAt: null,
+            createdAt: now
+        });
+        return { rawToken, token };
+    }
+    async consumeToken(rawToken, type) {
+        const token = await this.storage.getTokenByHash(this.hash(rawToken), type);
+        if (!token) {
+            throw new AuthError("invalid_token", "Invalid token", 401);
+        }
+        if (token.usedAt) {
+            throw new AuthError("token_already_used", "Token has already been used", 401);
+        }
+        if (isExpired(token.expiresAt)) {
+            throw new AuthError("expired_token", "Token has expired", 401);
+        }
+        const updatedToken = await this.storage.updateToken(token.id, {
+            usedAt: new Date()
+        });
+        return updatedToken ?? token;
+    }
+    async hashPasswordInput(password) {
+        if (password.length < this.passwordMinLength) {
+            throw new AuthError("weak_password", `Password must be at least ${this.passwordMinLength} characters`, 400);
+        }
+        return hashPassword(password);
+    }
+    hash(value) {
+        return hashSecret(value, this.tokenPepper);
+    }
+    delivery(token, url, expiresAt) {
+        const result = { sent: true, expiresAt };
+        if (this.exposeRawTokens) {
+            result.token = token;
+            result.url = url;
+        }
+        return result;
+    }
+    buildUrl(pathname, params) {
+        const url = new URL(pathname, this.baseUrl);
+        for (const [key, value] of Object.entries(params)) {
+            if (value) {
+                url.searchParams.set(key, value);
+            }
+        }
+        return url.toString();
+    }
+    assertRedirectAllowed(redirectUrl) {
+        if (!redirectUrl) {
+            return;
+        }
+        if (redirectUrl.startsWith("/")) {
+            return;
+        }
+        const parsed = new URL(redirectUrl);
+        const allowed = this.redirectAllowlist.some((allowedUrl) => {
+            const allowedParsed = new URL(allowedUrl);
+            return parsed.origin === allowedParsed.origin;
+        });
+        if (!allowed) {
+            throw new AuthError("redirect_not_allowed", "Redirect URL is not allowed", 400);
+        }
+    }
+    extractApiKeyPrefix(rawKey) {
+        const [namespace, prefix] = rawKey.split("_");
+        if (namespace !== "oa" || !prefix) {
+            return null;
+        }
+        return prefix;
+    }
+    async rateLimit(action, identifier, limit, windowMs) {
+        await enforceRateLimit(this.rateLimitStore, {
+            key: `${action}:${identifier}`,
+            limit,
+            windowMs
+        });
+    }
+    assertUserEnabled(user) {
+        if (user.disabledAt) {
+            throw new AuthError("disabled_user", "User is disabled", 403);
+        }
+    }
+    async audit(input) {
+        await this.storage.createAuditEvent({
+            id: createId("evt"),
+            eventType: input.eventType,
+            actorUserId: input.actorUserId ?? null,
+            targetUserId: input.targetUserId ?? null,
+            organisationId: input.organisationId ?? null,
+            apiKeyId: input.apiKeyId ?? null,
+            ipAddress: input.context?.ipAddress ?? null,
+            userAgent: input.context?.userAgent ?? null,
+            metadata: cloneMetadata(input.metadata),
+            createdAt: new Date()
+        });
+    }
+    async uniqueOrganisationSlug(baseSlug) {
+        let candidate = baseSlug;
+        let attempt = 1;
+        while (await this.storage.getOrganisationBySlug(candidate)) {
+            attempt += 1;
+            candidate = `${baseSlug}-${attempt}`;
+        }
+        return candidate;
+    }
+}
+export function createOwnAuth(options) {
+    return new OwnAuth(options);
+}
+function cloneMetadata(metadata) {
+    return metadata ? structuredClone(metadata) : {};
+}
+//# sourceMappingURL=auth-engine.js.map