rst-auth 0.0.0-stage → 0.1.0

package/dist/errors.d.ts

@@ -0,0 +1,16 @@
+export declare const AUTH_ERROR_CODES: readonly ["TOKEN_MISSING", "TOKEN_INVALID", "TOKEN_EXPIRED", "REFRESH_TOKEN_INVALID", "REFRESH_TOKEN_REUSED", "SESSION_REVOKED", "UNAUTHORIZED", "FORBIDDEN", "VALIDATION_ERROR", "INVALID_CONFIGURATION"];
+export type AuthErrorCode = (typeof AUTH_ERROR_CODES)[number];
+export interface AuthErrorOptions {
+    publicMessage?: string;
+    status?: number;
+    cause?: unknown;
+}
+export declare class AuthError extends Error {
+    readonly code: AuthErrorCode;
+    readonly developerMessage: string;
+    readonly publicMessage: string;
+    readonly status: number;
+    constructor(code: AuthErrorCode, developerMessage: string, options?: AuthErrorOptions);
+}
+export declare function getHttpStatus(code: AuthErrorCode): number;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,4MAWnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AA4B9D,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAGtB,IAAI,EAAE,aAAa,EACnB,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,gBAAqB;CASjC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAEzD"}

package/dist/errors.js

@@ -0,0 +1,54 @@
+export const AUTH_ERROR_CODES = [
+    "TOKEN_MISSING",
+    "TOKEN_INVALID",
+    "TOKEN_EXPIRED",
+    "REFRESH_TOKEN_INVALID",
+    "REFRESH_TOKEN_REUSED",
+    "SESSION_REVOKED",
+    "UNAUTHORIZED",
+    "FORBIDDEN",
+    "VALIDATION_ERROR",
+    "INVALID_CONFIGURATION",
+];
+const HTTP_STATUS = {
+    TOKEN_MISSING: 401,
+    TOKEN_INVALID: 401,
+    TOKEN_EXPIRED: 401,
+    REFRESH_TOKEN_INVALID: 401,
+    REFRESH_TOKEN_REUSED: 401,
+    SESSION_REVOKED: 401,
+    UNAUTHORIZED: 401,
+    FORBIDDEN: 403,
+    VALIDATION_ERROR: 400,
+    INVALID_CONFIGURATION: 500,
+};
+const PUBLIC_MESSAGES = {
+    TOKEN_MISSING: "Authentication is required",
+    TOKEN_INVALID: "Authentication failed",
+    TOKEN_EXPIRED: "Authentication has expired",
+    REFRESH_TOKEN_INVALID: "Refresh token is invalid",
+    REFRESH_TOKEN_REUSED: "Refresh token is invalid",
+    SESSION_REVOKED: "Authentication has been revoked",
+    UNAUTHORIZED: "Authentication is required",
+    FORBIDDEN: "You are not allowed to perform this action",
+    VALIDATION_ERROR: "The request is invalid",
+    INVALID_CONFIGURATION: "Authentication is unavailable",
+};
+export class AuthError extends Error {
+    code;
+    developerMessage;
+    publicMessage;
+    status;
+    constructor(code, developerMessage, options = {}) {
+        super(developerMessage, { cause: options.cause });
+        this.name = "AuthError";
+        this.code = code;
+        this.developerMessage = developerMessage;
+        this.publicMessage = options.publicMessage ?? PUBLIC_MESSAGES[code];
+        this.status = options.status ?? HTTP_STATUS[code];
+    }
+}
+export function getHttpStatus(code) {
+    return HTTP_STATUS[code];
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,eAAe;IACf,eAAe;IACf,eAAe;IACf,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;IACjB,cAAc;IACd,WAAW;IACX,kBAAkB;IAClB,uBAAuB;CACf,CAAC;AAIX,MAAM,WAAW,GAAkC;IACjD,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,GAAG;IAClB,qBAAqB,EAAE,GAAG;IAC1B,oBAAoB,EAAE,GAAG;IACzB,eAAe,EAAE,GAAG;IACpB,YAAY,EAAE,GAAG;IACjB,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,GAAG;IACrB,qBAAqB,EAAE,GAAG;CAC3B,CAAC;AAEF,MAAM,eAAe,GAAkC;IACrD,aAAa,EAAE,4BAA4B;IAC3C,aAAa,EAAE,uBAAuB;IACtC,aAAa,EAAE,4BAA4B;IAC3C,qBAAqB,EAAE,0BAA0B;IACjD,oBAAoB,EAAE,0BAA0B;IAChD,eAAe,EAAE,iCAAiC;IAClD,YAAY,EAAE,4BAA4B;IAC1C,SAAS,EAAE,4CAA4C;IACvD,gBAAgB,EAAE,wBAAwB;IAC1C,qBAAqB,EAAE,+BAA+B;CACvD,CAAC;AAQF,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,CAAgB;IACpB,gBAAgB,CAAS;IACzB,aAAa,CAAS;IACtB,MAAM,CAAS;IAExB,YACE,IAAmB,EACnB,gBAAwB,EACxB,UAA4B,EAAE;QAE9B,KAAK,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/dist/express/index.d.ts

@@ -0,0 +1,74 @@
+import type { ErrorRequestHandler, Request, RequestHandler, Response } from "express";
+import { AuthError } from "../errors.js";
+import type { Auth } from "../index.js";
+import type { ValidationSchemaMap, ValidationTarget, ValidatorAdapter } from "../validation.js";
+import type { VerifiedAccessClaims } from "../tokens.js";
+export interface AuthenticatedRequest<Identity extends VerifiedAccessClaims = VerifiedAccessClaims> extends Request {
+    auth?: Identity;
+    validated?: Partial<Record<ValidationTarget, unknown>>;
+}
+type SchemaOutput<TSchema> = TSchema extends {
+    _output: infer TOutput;
+} ? TOutput : unknown;
+export type ValidatedRequest<TSchemas extends ValidationSchemaMap> = Request & {
+    validated?: {
+        [Target in keyof TSchemas]?: SchemaOutput<TSchemas[Target]>;
+    };
+};
+declare module "express-serve-static-core" {
+    interface Request {
+        auth?: VerifiedAccessClaims;
+        validated?: Partial<Record<ValidationTarget, unknown>>;
+    }
+}
+export type TokenExtractor = (request: Request) => string | undefined | Promise<string | undefined>;
+export interface PublicHttpError {
+    status: number;
+    code: string;
+    message: string;
+}
+export interface FormattedHttpError {
+    status: number;
+    body: unknown;
+}
+export type ErrorFormatter = (error: PublicHttpError, request: Request) => FormattedHttpError;
+export type IdentityLookup<Identity extends VerifiedAccessClaims> = (claims: VerifiedAccessClaims, request: Request) => Identity | null | Promise<Identity | null>;
+export interface ExpressAuthOptions<Identity extends VerifiedAccessClaims> {
+    getToken?: TokenExtractor;
+    lookupIdentity?: IdentityLookup<Identity>;
+    validator?: ValidatorAdapter;
+    errorFormatter?: ErrorFormatter;
+}
+export interface AuthenticateOptions {
+    required?: boolean;
+}
+export interface AuthorizeOptions {
+    roles: readonly string[];
+}
+export declare function fromHeader(): TokenExtractor;
+export declare function fromCookie(name: string): TokenExtractor;
+export declare function fromAny(extractors: readonly TokenExtractor[]): TokenExtractor;
+export type ValidateOptions<TSchemas extends ValidationSchemaMap = ValidationSchemaMap> = {
+    [Target in keyof TSchemas]?: TSchemas[Target];
+} & {
+    formatError?: (cause: unknown, target: ValidationTarget) => AuthError;
+};
+export declare function expressAuth<Identity extends VerifiedAccessClaims = VerifiedAccessClaims>(auth: Auth, options?: ExpressAuthOptions<Identity>): {
+    authenticate: (authenticateOptions?: AuthenticateOptions) => RequestHandler;
+    authorize: (authorizeOptions: AuthorizeOptions) => RequestHandler;
+    validate: <TSchemas extends ValidationSchemaMap>(schemas: ValidateOptions<TSchemas>) => RequestHandler;
+    errorHandler: (formatter?: ErrorFormatter) => ErrorRequestHandler;
+};
+/** Alias retained for callers who prefer the create* naming convention. */
+export declare const createExpressAuth: typeof expressAuth;
+export interface RefreshCookieOptions {
+    name?: string;
+    path?: string;
+    maxAge?: number;
+    secure?: boolean;
+    sameSite?: "lax" | "strict" | "none";
+}
+export declare function setRefreshTokenCookie(response: Response, token: string, options?: RefreshCookieOptions): void;
+export declare function clearRefreshTokenCookie(response: Response, options?: RefreshCookieOptions): void;
+export type { ValidatorAdapter, ValidationSchemaMap, ValidationTarget, } from "../validation.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/express/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EAEnB,OAAO,EACP,cAAc,EACd,QAAQ,EACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,WAAW,oBAAoB,CACnC,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB,CAC5D,SAAQ,OAAO;IACf,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED,KAAK,YAAY,CAAC,OAAO,IAAI,OAAO,SAAS;IAAE,OAAO,EAAE,MAAM,OAAO,CAAA;CAAE,GACnE,OAAO,GACP,OAAO,CAAC;AAEZ,MAAM,MAAM,gBAAgB,CAAC,QAAQ,SAAS,mBAAmB,IAAI,OAAO,GAAG;IAC7E,SAAS,CAAC,EAAE;SACT,MAAM,IAAI,MAAM,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KAC5D,CAAC;CACH,CAAC;AAEF,OAAO,QAAQ,2BAA2B,CAAC;IACzC,UAAU,OAAO;QACf,IAAI,CAAC,EAAE,oBAAoB,CAAC;QAC5B,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;KACxD;CACF;AAED,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,OAAO,KACb,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,cAAc,GAAG,CAC3B,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,OAAO,KACb,kBAAkB,CAAC;AAExB,MAAM,MAAM,cAAc,CAAC,QAAQ,SAAS,oBAAoB,IAAI,CAClE,MAAM,EAAE,oBAAoB,EAC5B,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,MAAM,WAAW,kBAAkB,CAAC,QAAQ,SAAS,oBAAoB;IACvE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAoCD,wBAAgB,UAAU,IAAI,cAAc,CAU3C;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAmBvD;AAED,wBAAgB,OAAO,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,GAAG,cAAc,CAU7E;AAED,MAAM,MAAM,eAAe,CACzB,QAAQ,SAAS,mBAAmB,GAAG,mBAAmB,IACxD;KACD,MAAM,IAAI,MAAM,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC;CAC9C,GAAG;IACF,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,KAAK,SAAS,CAAC;CACvE,CAAC;AAEF,wBAAgB,WAAW,CACzB,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB,EAC5D,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE,kBAAkB,CAAC,QAAQ,CAAM;yCAI/B,mBAAmB,KACvC,cAAc;kCA2BoB,gBAAgB,KAAG,cAAc;eA2BpD,QAAQ,SAAS,mBAAmB,WAC3C,eAAe,CAAC,QAAQ,CAAC,KACjC,cAAc;+BAiCJ,cAAc,KACxB,mBAAmB;EAYvB;AAED,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,oBAAc,CAAC;AAE7C,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACtC;AAiBD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,oBAAyB,GACjC,IAAI,CAMN;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,oBAAyB,GACjC,IAAI,CAQN;AAED,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}

package/dist/express/index.js

@@ -0,0 +1,185 @@
+import { AuthError } from "../errors.js";
+const defaultErrorFormatter = (error) => ({
+    status: error.status,
+    body: { error: { code: error.code, message: error.message } },
+});
+function publicError(error) {
+    if (error instanceof AuthError) {
+        return {
+            status: error.status,
+            code: error.code,
+            message: error.publicMessage,
+        };
+    }
+    return {
+        status: 500,
+        code: "INTERNAL_ERROR",
+        message: "Internal server error",
+    };
+}
+function asyncHandler(handler) {
+    return (request, response, next) => {
+        void Promise.resolve()
+            .then(() => handler(request, response, next))
+            .catch(next);
+    };
+}
+export function fromHeader() {
+    return (request) => {
+        const value = request.get("authorization");
+        if (value === undefined)
+            return undefined;
+        const match = /^Bearer[ \t]+([^\s,]+)$/i.exec(value);
+        if (!match?.[1]) {
+            throw new AuthError("TOKEN_INVALID", "Malformed Authorization header");
+        }
+        return match[1];
+    };
+}
+export function fromCookie(name) {
+    if (!name || /[=;\s]/.test(name)) {
+        throw new TypeError("Cookie name must be a non-empty token");
+    }
+    return (request) => {
+        const header = request.get("cookie");
+        if (!header)
+            return undefined;
+        for (const entry of header.split(";")) {
+            const separator = entry.indexOf("=");
+            if (separator < 0 || entry.slice(0, separator).trim() !== name)
+                continue;
+            const value = entry.slice(separator + 1).trim();
+            try {
+                return decodeURIComponent(value);
+            }
+            catch {
+                throw new AuthError("TOKEN_INVALID", "Malformed authentication cookie");
+            }
+        }
+        return undefined;
+    };
+}
+export function fromAny(extractors) {
+    if (!extractors.length)
+        throw new TypeError("At least one extractor is required");
+    return async (request) => {
+        for (const extract of extractors) {
+            const token = await extract(request);
+            if (token !== undefined)
+                return token;
+        }
+        return undefined;
+    };
+}
+export function expressAuth(auth, options = {}) {
+    const extractToken = options.getToken ?? fromHeader();
+    function authenticate(authenticateOptions = {}) {
+        const required = authenticateOptions.required ?? true;
+        return asyncHandler(async (request, _response, next) => {
+            const token = await extractToken(request);
+            if (token === undefined) {
+                if (required) {
+                    throw new AuthError("TOKEN_MISSING", "Access token is required");
+                }
+                delete request.auth;
+                next();
+                return;
+            }
+            const claims = await auth.tokens.verifyAccessToken(token, request);
+            const identity = options.lookupIdentity
+                ? await options.lookupIdentity(claims, request)
+                : claims;
+            if (identity === null) {
+                throw new AuthError("UNAUTHORIZED", "Identity lookup did not find a user");
+            }
+            request.auth = identity;
+            next();
+        });
+    }
+    function authorize(authorizeOptions) {
+        const requiredRoles = new Set(authorizeOptions.roles);
+        return (request, _response, next) => {
+            if (!request.auth) {
+                next(new AuthError("UNAUTHORIZED", "Authentication is required"));
+                return;
+            }
+            const roleData = request.auth;
+            const userRoles = [
+                ...(typeof roleData.role === "string" ? [roleData.role] : []),
+                ...(Array.isArray(roleData.roles)
+                    ? roleData.roles.filter((role) => typeof role === "string")
+                    : []),
+            ];
+            if (!userRoles.some((role) => requiredRoles.has(role))) {
+                next(new AuthError("FORBIDDEN", "User does not have a required role"));
+                return;
+            }
+            next();
+        };
+    }
+    function validate(schemas) {
+        if (!options.validator) {
+            throw new AuthError("INVALID_CONFIGURATION", "A validator adapter must be configured before using validate()");
+        }
+        const targets = ["body", "params", "query"];
+        return asyncHandler(async (request, _response, next) => {
+            const parsed = {};
+            for (const target of targets) {
+                const schema = schemas[target];
+                if (schema === undefined)
+                    continue;
+                try {
+                    parsed[target] = await options.validator.parse(schema, request[target]);
+                }
+                catch (cause) {
+                    throw (schemas.formatError?.(cause, target) ??
+                        new AuthError("VALIDATION_ERROR", `Invalid request ${target}`, {
+                            cause,
+                        }));
+                }
+            }
+            request.validated = parsed;
+            next();
+        });
+    }
+    function errorHandler(formatter = options.errorFormatter ?? defaultErrorFormatter) {
+        return (error, request, response, next) => {
+            if (response.headersSent) {
+                next(error);
+                return;
+            }
+            const formatted = formatter(publicError(error), request);
+            response.status(formatted.status).json(formatted.body);
+        };
+    }
+    return { authenticate, authorize, validate, errorHandler };
+}
+/** Alias retained for callers who prefer the create* naming convention. */
+export const createExpressAuth = expressAuth;
+function cookieSettings(options = {}) {
+    const secure = options.secure ?? true;
+    const sameSite = options.sameSite ?? "lax";
+    if (sameSite === "none" && !secure) {
+        throw new TypeError("SameSite=None cookies require Secure");
+    }
+    return {
+        httpOnly: true,
+        secure,
+        sameSite,
+        path: options.path ?? "/auth/refresh",
+        ...(options.maxAge === undefined ? {} : { maxAge: options.maxAge }),
+    };
+}
+export function setRefreshTokenCookie(response, token, options = {}) {
+    response.cookie(options.name ?? "refreshToken", token, cookieSettings(options));
+}
+export function clearRefreshTokenCookie(response, options = {}) {
+    const settings = cookieSettings(options);
+    response.clearCookie(options.name ?? "refreshToken", {
+        httpOnly: settings.httpOnly,
+        secure: settings.secure,
+        sameSite: settings.sameSite,
+        path: settings.path,
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/express/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAyEzC,MAAM,qBAAqB,GAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE;CAC9D,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,aAAa;SAC7B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,uBAAuB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,OAIyB;IAEzB,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACjC,KAAK,OAAO,CAAC,OAAO,EAAE;aACnB,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;aAC5C,KAAK,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,SAAS,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;gBAAE,SAAS;YACzE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,iCAAiC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,UAAqC;IAC3D,IAAI,CAAC,UAAU,CAAC,MAAM;QACpB,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,WAAW,CAEzB,IAAU,EAAE,UAAwC,EAAE;IACtD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;IAEtD,SAAS,YAAY,CACnB,sBAA2C,EAAE;QAE7C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,IAAI,IAAI,CAAC;QACtD,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;gBACnE,CAAC;gBACD,OAAO,OAAO,CAAC,IAAI,CAAC;gBACpB,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc;gBACrC,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC;gBAC/C,CAAC,CAAE,MAAmB,CAAC;YACzB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,SAAS,CACjB,cAAc,EACd,qCAAqC,CACtC,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC;YACxB,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,SAAS,CAAC,gBAAkC;QACnD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YAClC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,SAAS,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAGxB,CAAC;YACF,MAAM,SAAS,GAAG;gBAChB,GAAG,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAC/B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CACnB,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CACnD;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACvD,IAAI,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,oCAAoC,CAAC,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,QAAQ,CACf,OAAkC;QAElC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YACrD,MAAM,MAAM,GAA+C,EAAE,CAAC;YAC9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC/B,IAAI,MAAM,KAAK,SAAS;oBAAE,SAAS;gBACnC,IAAI,CAAC;oBACH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,SAAU,CAAC,KAAK,CAC7C,MAAM,EACN,OAAO,CAAC,MAAM,CAAC,CAChB,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CACJ,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;wBACpC,IAAI,SAAS,CAAC,kBAAkB,EAAE,mBAAmB,MAAM,EAAE,EAAE;4BAC7D,KAAK;yBACN,CAAC,CACH,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC;YAC3B,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,YAAY,CACnB,YAA4B,OAAO,CAAC,cAAc,IAAI,qBAAqB;QAE3E,OAAO,CAAC,KAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;YACjD,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACzD,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAC7D,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAU7C,SAAS,cAAc,CAAC,UAAgC,EAAE;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC3C,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ;QACR,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,eAAe;QACrC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAkB,EAClB,KAAa,EACb,UAAgC,EAAE;IAElC,QAAQ,CAAC,MAAM,CACb,OAAO,CAAC,IAAI,IAAI,cAAc,EAC9B,KAAK,EACL,cAAc,CAAC,OAAO,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAkB,EAClB,UAAgC,EAAE;IAElC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,IAAI,cAAc,EAAE;QACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;KACpB,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+import type { AuthConfig } from "./config.js";
+import { AuthError, AUTH_ERROR_CODES, getHttpStatus } from "./errors.js";
+import { createPasswordService } from "./password.js";
+import { createAccessTokenService } from "./tokens.js";
+import { type RefreshTokenService } from "./refresh.js";
+import { MemoryRefreshTokenStore } from "./memory-refresh-token-store.js";
+export interface Auth {
+    password: ReturnType<typeof createPasswordService>;
+    tokens: ReturnType<typeof createAccessTokenService>;
+    refresh?: RefreshTokenService;
+}
+export declare function createAuth(config: AuthConfig): Auth;
+export { MemoryRefreshTokenStore };
+export { AuthError, AUTH_ERROR_CODES, getHttpStatus };
+export type { ConsumeResult, RefreshTokenRecord, RefreshTokenStatus, RefreshTokenStore, RevokeTokenResult, } from "./refresh-store.js";
+export type { IssuedRefreshToken, IssueRefreshTokenInput, RefreshTokenService, } from "./refresh.js";
+export type { AuthErrorCode, AuthErrorOptions } from "./errors.js";
+export type { AuthConfig, KeyResolver, RuntimeMode, SupportedAlgorithm, TokenKey, } from "./config.js";
+export type { AccessTokenClaims, AccessTokenService, VerifiedAccessClaims, } from "./tokens.js";
+export type { ValidationSchemaMap, ValidationTarget, ValidatorAdapter, } from "./validation.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;IACnD,MAAM,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAUnD;AAED,OAAO,EAAE,uBAAuB,EAAE,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;AACtD,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,YAAY,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,20 @@
+import { validateAuthConfig } from "./config.js";
+import { AuthError, AUTH_ERROR_CODES, getHttpStatus } from "./errors.js";
+import { createPasswordService } from "./password.js";
+import { createAccessTokenService } from "./tokens.js";
+import { createRefreshTokenService, } from "./refresh.js";
+import { MemoryRefreshTokenStore } from "./memory-refresh-token-store.js";
+export function createAuth(config) {
+    const validatedConfig = validateAuthConfig(config);
+    const refresh = validatedConfig.refreshToken
+        ? createRefreshTokenService(validatedConfig.refreshToken)
+        : undefined;
+    return {
+        password: createPasswordService(validatedConfig.password.workFactor),
+        tokens: createAccessTokenService(validatedConfig.accessToken),
+        ...(refresh === undefined ? {} : { refresh }),
+    };
+}
+export { MemoryRefreshTokenStore };
+export { AuthError, AUTH_ERROR_CODES, getHttpStatus };
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACL,yBAAyB,GAE1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAQ1E,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,eAAe,CAAC,YAAY;QAC1C,CAAC,CAAC,yBAAyB,CAAC,eAAe,CAAC,YAAY,CAAC;QACzD,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,QAAQ,EAAE,qBAAqB,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC;QACpE,MAAM,EAAE,wBAAwB,CAAC,eAAe,CAAC,WAAW,CAAC;QAC7D,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,uBAAuB,EAAE,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC"}

package/dist/memory-refresh-token-store.d.ts

@@ -0,0 +1,15 @@
+import type { ConsumeResult, RefreshTokenRecord, RefreshTokenStore, RevokeTokenResult } from "./refresh-store.js";
+/**
+ * In-memory store for tests and local examples only. It is not safe across
+ * processes, restarts, or multiple application instances.
+ */
+export declare class MemoryRefreshTokenStore implements RefreshTokenStore {
+    private readonly records;
+    private readonly revokedFamilies;
+    create(record: RefreshTokenRecord): Promise<void>;
+    consume(tokenHash: string, now: Date): Promise<ConsumeResult>;
+    revokeToken(tokenHash: string, _now: Date): Promise<RevokeTokenResult>;
+    revokeFamily(familyId: string, _now: Date): Promise<void>;
+    revokeAllForSubject(subject: string, _now: Date): Promise<void>;
+}
+//# sourceMappingURL=memory-refresh-token-store.d.ts.map

package/dist/memory-refresh-token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-refresh-token-store.d.ts","sourceRoot":"","sources":["../src/memory-refresh-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,oBAAoB,CAAC;AAc5B;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,iBAAiB;IAC/D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAE/C,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjD,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC;IAmB7D,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAStE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAStE"}

package/dist/memory-refresh-token-store.js

@@ -0,0 +1,75 @@
+function copyRecord(record) {
+    return {
+        ...record,
+        createdAt: new Date(record.createdAt),
+        expiresAt: new Date(record.expiresAt),
+        absoluteExpiresAt: new Date(record.absoluteExpiresAt),
+        ...(record.consumedAt === undefined
+            ? {}
+            : { consumedAt: new Date(record.consumedAt) }),
+    };
+}
+/**
+ * In-memory store for tests and local examples only. It is not safe across
+ * processes, restarts, or multiple application instances.
+ */
+export class MemoryRefreshTokenStore {
+    records = new Map();
+    revokedFamilies = new Set();
+    async create(record) {
+        if (this.revokedFamilies.has(record.familyId)) {
+            throw new Error("Cannot create a refresh token in a revoked family");
+        }
+        if (this.records.has(record.tokenHash)) {
+            throw new Error("Refresh token hash already exists");
+        }
+        this.records.set(record.tokenHash, copyRecord(record));
+    }
+    async consume(tokenHash, now) {
+        // This mutation happens before the async method yields, giving this
+        // single-process implementation compare-and-swap behavior.
+        const record = this.records.get(tokenHash);
+        if (!record)
+            return { status: "not_found" };
+        if (record.status === "revoked")
+            return { status: "revoked" };
+        if (record.status === "consumed") {
+            await this.revokeFamily(record.familyId, now);
+            return { status: "reused" };
+        }
+        if (now >= record.expiresAt || now >= record.absoluteExpiresAt) {
+            return { status: "expired" };
+        }
+        record.status = "consumed";
+        record.consumedAt = new Date(now);
+        return { status: "ok", record: copyRecord(record) };
+    }
+    async revokeToken(tokenHash, _now) {
+        void _now;
+        const record = this.records.get(tokenHash);
+        if (!record)
+            return { status: "not_found" };
+        if (record.status !== "active")
+            return { status: "inactive" };
+        record.status = "revoked";
+        return { status: "revoked" };
+    }
+    async revokeFamily(familyId, _now) {
+        void _now;
+        this.revokedFamilies.add(familyId);
+        for (const record of this.records.values()) {
+            if (record.familyId === familyId)
+                record.status = "revoked";
+        }
+    }
+    async revokeAllForSubject(subject, _now) {
+        void _now;
+        for (const record of this.records.values()) {
+            if (record.subject === subject) {
+                this.revokedFamilies.add(record.familyId);
+                record.status = "revoked";
+            }
+        }
+    }
+}
+//# sourceMappingURL=memory-refresh-token-store.js.map

package/dist/memory-refresh-token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-refresh-token-store.js","sourceRoot":"","sources":["../src/memory-refresh-token-store.ts"],"names":[],"mappings":"AAOA,SAAS,UAAU,CAAC,MAA0B;IAC5C,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACrC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACrC,iBAAiB,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACrD,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAuB;IACjB,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAChD,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAErD,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,GAAS;QACxC,oEAAoE;QACpE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,GAAG,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QAED,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;QAC3B,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,IAAU;QAC7C,KAAK,IAAI,CAAC;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC9D,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,IAAU;QAC7C,KAAK,IAAI,CAAC;QACV,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAe,EAAE,IAAU;QACnD,KAAK,IAAI,CAAC;QACV,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC/B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/password.d.ts

@@ -0,0 +1,7 @@
+export interface PasswordService {
+    hash(password: string): Promise<string>;
+    verify(password: string, hash: string): Promise<boolean>;
+    verifyDummy(password: string): Promise<void>;
+}
+export declare function createPasswordService(workFactor: number): PasswordService;
+//# sourceMappingURL=password.d.ts.map

package/dist/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../src/password.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CA2BzE"}

package/dist/password.js

@@ -0,0 +1,36 @@
+import bcrypt from "bcryptjs";
+import { AuthError } from "./errors.js";
+const MAX_PASSWORD_BYTES = 72;
+function validatePassword(password) {
+    if (typeof password !== "string" || password.length === 0) {
+        throw new AuthError("VALIDATION_ERROR", "Password must be a non-empty string");
+    }
+    if (Buffer.byteLength(password, "utf8") > MAX_PASSWORD_BYTES) {
+        throw new AuthError("VALIDATION_ERROR", "Password must not exceed 72 UTF-8 bytes because bcrypt truncates longer values");
+    }
+}
+export function createPasswordService(workFactor) {
+    const dummyHash = bcrypt.hashSync("rst-auth-dummy-password-value", workFactor);
+    return {
+        async hash(password) {
+            validatePassword(password);
+            return bcrypt.hash(password, workFactor);
+        },
+        async verify(password, hash) {
+            validatePassword(password);
+            if (typeof hash !== "string" || hash.length === 0)
+                return false;
+            try {
+                return await bcrypt.compare(password, hash);
+            }
+            catch {
+                return false;
+            }
+        },
+        async verifyDummy(password) {
+            validatePassword(password);
+            await bcrypt.compare(password, dummyHash);
+        },
+    };
+}
+//# sourceMappingURL=password.js.map

package/dist/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../src/password.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,SAAS,gBAAgB,CAAC,QAAiB;IACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CACjB,kBAAkB,EAClB,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,kBAAkB,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CACjB,kBAAkB,EAClB,gFAAgF,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAC/B,+BAA+B,EAC/B,UAAU,CACX,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,QAAgB;YACzB,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAY;YACzC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChE,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,QAAgB;YAChC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/refresh-store.d.ts

@@ -0,0 +1,48 @@
+export type RefreshTokenStatus = "active" | "consumed" | "revoked";
+export interface RefreshTokenRecord {
+    /** A SHA-256 digest of the opaque token. Raw refresh tokens must never be stored. */
+    tokenHash: string;
+    familyId: string;
+    subject: string;
+    createdAt: Date;
+    expiresAt: Date;
+    absoluteExpiresAt: Date;
+    status: RefreshTokenStatus;
+    consumedAt?: Date;
+}
+export type ConsumeResult = {
+    status: "ok";
+    record: RefreshTokenRecord;
+} | {
+    status: "not_found";
+} | {
+    status: "expired";
+} | {
+    status: "revoked";
+} | {
+    status: "reused";
+};
+export type RevokeTokenResult = {
+    status: "revoked";
+} | {
+    status: "not_found";
+} | {
+    status: "inactive";
+};
+/**
+ * Implementations must make consume a single atomic compare-and-swap operation.
+ * A store that cannot ensure only one concurrent caller gets `ok` cannot claim
+ * refresh-token reuse protection. Re-presenting a consumed token must revoke
+ * its family before returning `reused`. Stores must retain family-revocation
+ * tombstones through the family absolute expiry so a late rotation cannot
+ * recreate a revoked family.
+ */
+export interface RefreshTokenStore {
+    /** Must reject records for a family that has already been revoked. */
+    create(record: RefreshTokenRecord): Promise<void>;
+    consume(tokenHash: string, now: Date): Promise<ConsumeResult>;
+    revokeToken(tokenHash: string, now: Date): Promise<RevokeTokenResult>;
+    revokeFamily(familyId: string, now: Date): Promise<void>;
+    revokeAllForSubject(subject: string, now: Date): Promise<void>;
+}
+//# sourceMappingURL=refresh-store.d.ts.map

package/dist/refresh-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-store.d.ts","sourceRoot":"","sources":["../src/refresh-store.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB,EAAE,IAAI,CAAC;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEzB,MAAM,MAAM,iBAAiB,GAC3B;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE"}

package/dist/refresh-store.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=refresh-store.js.map

package/dist/refresh-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-store.js","sourceRoot":"","sources":["../src/refresh-store.ts"],"names":[],"mappings":""}