rst-auth 0.0.0-stage → 0.2.0

package/dist/accounts.js

@@ -0,0 +1,169 @@
+import { AuthError } from "./errors.js";
+const PRIVILEGED_PROFILE_FIELDS = new Set([
+    "role",
+    "roles",
+    "permissions",
+    "scopes",
+    "isAdmin",
+    "admin",
+]);
+function invalidInput(message) {
+    throw new AuthError("VALIDATION_ERROR", message);
+}
+function normalizedEmail(email) {
+    if (typeof email !== "string" || email.trim().length === 0) {
+        invalidInput("Email must be a non-empty string");
+    }
+    return email.trim();
+}
+function readField(user, field) {
+    if (typeof user !== "object" || user === null)
+        return undefined;
+    return user[field];
+}
+function plainUser(user) {
+    if (typeof user !== "object" || user === null) {
+        throw new AuthError("UNAUTHORIZED", "Account lookup returned no user");
+    }
+    const toObject = user.toObject;
+    const value = typeof toObject === "function" ? toObject.call(user) : user;
+    if (typeof value !== "object" || value === null) {
+        throw new AuthError("UNAUTHORIZED", "Account lookup returned no user");
+    }
+    return { ...value };
+}
+function publicUser(user, passwordHashField) {
+    const copy = plainUser(user);
+    delete copy[passwordHashField];
+    // Never expose legacy/raw session fields if a user schema still has them.
+    delete copy.refreshToken;
+    delete copy.refreshTokens;
+    delete copy.authRefreshTokens;
+    return copy;
+}
+function subjectFor(adapter, user) {
+    const value = adapter.getSubject?.(user) ??
+        readField(user, "_id") ??
+        readField(user, "id");
+    const subject = typeof value === "string"
+        ? value
+        : typeof value === "number" || typeof value === "bigint"
+            ? String(value)
+            : typeof value === "object" && value !== null
+                ? String(value)
+                : undefined;
+    if (typeof subject !== "string" || subject.length === 0) {
+        throw new AuthError("INVALID_CONFIGURATION", "Account adapter must provide a stable user subject");
+    }
+    return subject;
+}
+function accessClaimsFor(adapter, user) {
+    if (adapter.getAccessClaims)
+        return adapter.getAccessClaims(user);
+    const role = readField(user, "role");
+    return typeof role === "string" ? { role } : {};
+}
+export function validateAccountAdapter(adapter) {
+    if (!adapter || typeof adapter !== "object") {
+        throw new AuthError("INVALID_CONFIGURATION", "accounts must be an object");
+    }
+    const value = adapter;
+    if (!value.model || typeof value.model.create !== "function") {
+        throw new AuthError("INVALID_CONFIGURATION", "accounts.model must provide create()");
+    }
+    if (typeof value.findByEmail !== "function") {
+        throw new AuthError("INVALID_CONFIGURATION", "accounts.findByEmail must be a function");
+    }
+    if (value.getSubject !== undefined &&
+        typeof value.getSubject !== "function") {
+        throw new AuthError("INVALID_CONFIGURATION", "accounts.getSubject must be a function");
+    }
+    if (value.getAccessClaims !== undefined &&
+        typeof value.getAccessClaims !== "function") {
+        throw new AuthError("INVALID_CONFIGURATION", "accounts.getAccessClaims must be a function");
+    }
+    if (value.passwordHashField !== undefined &&
+        (typeof value.passwordHashField !== "string" ||
+            value.passwordHashField.length === 0)) {
+        throw new AuthError("INVALID_CONFIGURATION", "accounts.passwordHashField must be a non-empty string");
+    }
+}
+export function createAccountService(adapter, password, tokens, refresh) {
+    const passwordHashField = adapter.passwordHashField ?? "passwordHash";
+    const revokePreviousSessionsOnLogin = adapter.revokePreviousSessionsOnLogin ?? true;
+    async function createSession(user) {
+        const subject = subjectFor(adapter, user);
+        const accessToken = await tokens.generateAccessToken({
+            ...accessClaimsFor(adapter, user),
+            sub: subject,
+        });
+        const issuedRefresh = await refresh.issue({ subject });
+        return {
+            user: publicUser(user, passwordHashField),
+            accessToken,
+            refreshToken: issuedRefresh.refreshToken,
+        };
+    }
+    return {
+        async register({ email: rawEmail, password: rawPassword, profile = {} }) {
+            const email = normalizedEmail(rawEmail);
+            if (!profile || typeof profile !== "object" || Array.isArray(profile)) {
+                invalidInput("profile must be an object when provided");
+            }
+            const unsafeField = Object.keys(profile).find((key) => PRIVILEGED_PROFILE_FIELDS.has(key));
+            if (unsafeField) {
+                invalidInput(`Signup cannot set privileged field: ${unsafeField}`);
+            }
+            const existing = await adapter.findByEmail(email);
+            if (existing) {
+                throw new AuthError("ACCOUNT_EXISTS", "An account already exists for this email");
+            }
+            const passwordHash = await password.hash(rawPassword);
+            let user;
+            try {
+                user = await adapter.model.create({
+                    ...profile,
+                    email,
+                    [passwordHashField]: passwordHash,
+                });
+            }
+            catch (cause) {
+                // A unique email index may win a concurrent signup race.
+                if (typeof cause === "object" &&
+                    cause !== null &&
+                    "code" in cause &&
+                    cause.code === 11000) {
+                    throw new AuthError("ACCOUNT_EXISTS", "An account already exists for this email", { cause });
+                }
+                throw cause;
+            }
+            return createSession(user);
+        },
+        async login({ email: rawEmail, password: rawPassword }) {
+            const email = normalizedEmail(rawEmail);
+            if (typeof rawPassword !== "string" || rawPassword.length === 0) {
+                invalidInput("Password must be a non-empty string");
+            }
+            const user = await adapter.findByEmail(email);
+            if (!user) {
+                await password.verifyDummy(rawPassword);
+                throw new AuthError("UNAUTHORIZED", "Invalid email or password", {
+                    publicMessage: "Invalid email or password",
+                });
+            }
+            const storedHash = readField(user, passwordHashField);
+            const matches = await password.verify(rawPassword, typeof storedHash === "string" ? storedHash : "");
+            if (!matches) {
+                throw new AuthError("UNAUTHORIZED", "Invalid email or password", {
+                    publicMessage: "Invalid email or password",
+                });
+            }
+            const subject = subjectFor(adapter, user);
+            if (revokePreviousSessionsOnLogin) {
+                await refresh.revokeAllForSubject(subject);
+            }
+            return createSession(user);
+        },
+    };
+}
+//# sourceMappingURL=accounts.js.map

package/dist/accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../src/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AA8CxC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,MAAM;IACN,OAAO;IACP,aAAa;IACb,QAAQ;IACR,SAAS;IACT,OAAO;CACR,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,YAAY,CAAC,kCAAkC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,KAAa;IAC7C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChE,OAAQ,IAAgC,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAI,IAAqC,CAAC,QAAQ,CAAC;IACjE,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAI,KAAiC,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,iBAAyB;IAC1D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/B,0EAA0E;IAC1E,OAAO,IAAI,CAAC,YAAY,CAAC;IACzB,OAAO,IAAI,CAAC,aAAa,CAAC;IAC1B,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAO,OAA6B,EAAE,IAAU;IACjE,MAAM,KAAK,GACT,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC;QAC1B,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC;QACtB,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxB,MAAM,OAAO,GACX,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;YACtD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACf,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;gBAC3C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACf,CAAC,CAAC,SAAS,CAAC;IACpB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CACtB,OAA6B,EAC7B,IAAU;IAEV,IAAI,OAAO,CAAC,eAAe;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAgB;IAEhB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,uBAAuB,EAAE,4BAA4B,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,KAAK,GAAG,OAAkC,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,UAAU,KAAK,SAAS;QAC9B,OAAO,KAAK,CAAC,UAAU,KAAK,UAAU,EACtC,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,wCAAwC,CACzC,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,eAAe,KAAK,SAAS;QACnC,OAAO,KAAK,CAAC,eAAe,KAAK,UAAU,EAC3C,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,CAAC,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ;YAC1C,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,EACvC,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,uDAAuD,CACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAA6B,EAC7B,QAAyB,EACzB,MAA0B,EAC1B,OAA4B;IAE5B,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,cAAc,CAAC;IACtE,MAAM,6BAA6B,GACjC,OAAO,CAAC,6BAA6B,IAAI,IAAI,CAAC;IAEhD,KAAK,UAAU,aAAa,CAAC,IAAU;QACrC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC;YACnD,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC;YACjC,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,OAAO;YACL,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,iBAAiB,CAAC;YACzC,WAAW;YACX,YAAY,EAAE,aAAa,CAAC,YAAY;SACzC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtE,YAAY,CAAC,yCAAyC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACpD,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CACnC,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,YAAY,CAAC,uCAAuC,WAAW,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,0CAA0C,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtD,IAAI,IAAU,CAAC;YACf,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;oBAChC,GAAG,OAAO;oBACV,KAAK;oBACL,CAAC,iBAAiB,CAAC,EAAE,YAAY;iBAClC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,yDAAyD;gBACzD,IACE,OAAO,KAAK,KAAK,QAAQ;oBACzB,KAAK,KAAK,IAAI;oBACd,MAAM,IAAI,KAAK;oBACf,KAAK,CAAC,IAAI,KAAK,KAAK,EACpB,CAAC;oBACD,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,0CAA0C,EAC1C,EAAE,KAAK,EAAE,CACV,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE;YACpD,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChE,YAAY,CAAC,qCAAqC,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;gBACxC,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,2BAA2B,EAAE;oBAC/D,aAAa,EAAE,2BAA2B;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CACnC,WAAW,EACX,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,2BAA2B,EAAE;oBAC/D,aAAa,EAAE,2BAA2B;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1C,IAAI,6BAA6B,EAAE,CAAC;gBAClC,MAAM,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,63 @@
+import type { CompactJWSHeaderParameters, KeyInput } from "jose";
+import type { RefreshTokenStore } from "./refresh-store.js";
+import { type AccountAdapter } from "./accounts.js";
+export declare const DEFAULT_BCRYPT_ROUNDS = 12;
+export declare const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 900;
+export declare const SUPPORTED_ALGORITHMS: readonly ["HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512", "EdDSA"];
+export type SupportedAlgorithm = (typeof SUPPORTED_ALGORITHMS)[number];
+export type RuntimeMode = "development" | "production";
+export type TokenKey = KeyInput;
+export type KeyResolver = (header: CompactJWSHeaderParameters) => TokenKey | Promise<TokenKey>;
+export interface AuthConfig<User = unknown> {
+    mode?: RuntimeMode;
+    password?: {
+        workFactor?: number;
+    };
+    accessToken: {
+        algorithm?: SupportedAlgorithm;
+        algorithms?: readonly SupportedAlgorithm[];
+        key: TokenKey;
+        keyId?: string;
+        keyResolver?: KeyResolver;
+        issuer?: string;
+        audience?: string | readonly string[];
+        expiresInSeconds?: number;
+        requiredClaims?: readonly string[];
+        isRevoked?: (claims: Readonly<Record<string, unknown>>, context?: unknown) => boolean | Promise<boolean>;
+    };
+    /** Omit to disable refresh-token support. A configured refresh store is mandatory. */
+    refreshToken?: {
+        store: RefreshTokenStore;
+        refreshTokenTtl: number;
+        absoluteLifetime: number;
+    };
+    /** Optional high-level register/login helpers using the app's model/query. */
+    accounts?: AccountAdapter<User>;
+}
+export interface ValidatedAuthConfig<User = unknown> {
+    mode: RuntimeMode;
+    password: {
+        workFactor: number;
+    };
+    accessToken: {
+        algorithm: SupportedAlgorithm;
+        algorithms: readonly SupportedAlgorithm[];
+        key: TokenKey;
+        keyId?: string;
+        keyResolver?: KeyResolver;
+        issuer?: string;
+        audience?: string | readonly string[];
+        expiresInSeconds: number;
+        requiredClaims: readonly string[];
+        isRevoked?: AuthConfig["accessToken"]["isRevoked"];
+    };
+    refreshToken?: {
+        store: RefreshTokenStore;
+        refreshTokenTtl: number;
+        absoluteLifetime: number;
+    };
+    accounts?: AccountAdapter<User>;
+}
+export declare function isReservedClaim(name: string): boolean;
+export declare function validateAuthConfig<User = unknown>(config: AuthConfig<User>): ValidatedAuthConfig<User>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAE5E,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,eAAO,MAAM,gCAAgC,MAAM,CAAC;AAEpD,eAAO,MAAM,oBAAoB,gIAcvB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AACvE,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AACvD,MAAM,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAChC,MAAM,MAAM,WAAW,GAAG,CACxB,MAAM,EAAE,0BAA0B,KAC/B,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,MAAM,WAAW,UAAU,CAAC,IAAI,GAAG,OAAO;IACxC,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,QAAQ,CAAC,EAAE;QACT,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,WAAW,EAAE;QACX,SAAS,CAAC,EAAE,kBAAkB,CAAC;QAC/B,UAAU,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;QAC3C,GAAG,EAAE,QAAQ,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;QACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC,SAAS,CAAC,EAAE,CACV,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,OAAO,CAAC,EAAE,OAAO,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACjC,CAAC;IACF,sFAAsF;IACtF,YAAY,CAAC,EAAE;QACb,KAAK,EAAE,iBAAiB,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB,CAAC,IAAI,GAAG,OAAO;IACjD,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,WAAW,EAAE;QACX,SAAS,EAAE,kBAAkB,CAAC;QAC9B,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;QAC1C,GAAG,EAAE,QAAQ,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;QACtC,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,SAAS,CAAC,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,CAAC;KACpD,CAAC;IACF,YAAY,CAAC,EAAE;QACb,KAAK,EAAE,iBAAiB,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC;CACjC;AAYD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAqBD,wBAAgB,kBAAkB,CAAC,IAAI,GAAG,OAAO,EAC/C,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,GACvB,mBAAmB,CAAC,IAAI,CAAC,CA8L3B"}

package/dist/config.js

@@ -0,0 +1,196 @@
+import { AuthError } from "./errors.js";
+import { validateAccountAdapter } from "./accounts.js";
+export const DEFAULT_BCRYPT_ROUNDS = 12;
+export const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 900;
+const MAX_REFRESH_LIFETIME_SECONDS = 8_000_000_000_000;
+export const SUPPORTED_ALGORITHMS = [
+    "HS256",
+    "HS384",
+    "HS512",
+    "RS256",
+    "RS384",
+    "RS512",
+    "PS256",
+    "PS384",
+    "PS512",
+    "ES256",
+    "ES384",
+    "ES512",
+    "EdDSA",
+];
+const RESERVED_CLAIMS = new Set([
+    "iss",
+    "aud",
+    "exp",
+    "iat",
+    "nbf",
+    "jti",
+    "token_use",
+]);
+export function isReservedClaim(name) {
+    return RESERVED_CLAIMS.has(name);
+}
+function invalid(message) {
+    throw new AuthError("INVALID_CONFIGURATION", message);
+}
+function validateKey(key, algorithm) {
+    if (algorithm.startsWith("HS")) {
+        if (!(key instanceof Uint8Array) || key.byteLength < 32) {
+            invalid("HMAC access-token keys must be Uint8Array values of at least 32 bytes");
+        }
+        return;
+    }
+    if (key instanceof Uint8Array) {
+        invalid(`${algorithm} requires a CryptoKey or KeyObject, not a byte array`);
+    }
+}
+export function validateAuthConfig(config) {
+    if (!config || typeof config !== "object") {
+        invalid("Configuration must be an object");
+    }
+    const mode = config.mode ?? "development";
+    if (mode !== "development" && mode !== "production") {
+        invalid('mode must be "development" or "production"');
+    }
+    if (config.password !== undefined &&
+        (typeof config.password !== "object" || config.password === null)) {
+        invalid("password must be an object when provided");
+    }
+    const workFactor = config.password?.workFactor ?? DEFAULT_BCRYPT_ROUNDS;
+    if (!Number.isInteger(workFactor) || workFactor < 4 || workFactor > 31) {
+        invalid("password.workFactor must be an integer between 4 and 31");
+    }
+    const tokenConfig = config.accessToken;
+    if (!tokenConfig || typeof tokenConfig !== "object" || !tokenConfig.key) {
+        invalid("accessToken.key is required");
+    }
+    const algorithm = tokenConfig.algorithm ?? "HS256";
+    if (!SUPPORTED_ALGORITHMS.includes(algorithm)) {
+        invalid("accessToken.algorithm is not supported");
+    }
+    const algorithms = [...new Set(tokenConfig.algorithms ?? [algorithm])];
+    if (algorithms.length === 0 ||
+        !algorithms.includes(algorithm) ||
+        algorithms.some((entry) => !SUPPORTED_ALGORITHMS.includes(entry))) {
+        invalid("accessToken.algorithms must be a non-empty allowlist containing the signing algorithm");
+    }
+    validateKey(tokenConfig.key, algorithm);
+    const expiresInSeconds = tokenConfig.expiresInSeconds ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS;
+    if (!Number.isSafeInteger(expiresInSeconds) || expiresInSeconds <= 0) {
+        invalid("accessToken.expiresInSeconds must be a positive safe integer");
+    }
+    if (tokenConfig.issuer !== undefined &&
+        (typeof tokenConfig.issuer !== "string" || tokenConfig.issuer.length === 0)) {
+        invalid("accessToken.issuer must be a non-empty string when provided");
+    }
+    if (tokenConfig.audience !== undefined) {
+        const audience = tokenConfig.audience;
+        if (!((typeof audience === "string" && audience.length > 0) ||
+            (Array.isArray(audience) &&
+                audience.length > 0 &&
+                audience.every((item) => typeof item === "string" && item.length > 0)))) {
+            invalid("accessToken.audience must contain non-empty string values");
+        }
+    }
+    if (mode === "production") {
+        if (!tokenConfig.issuer || !tokenConfig.audience) {
+            invalid("Production mode requires accessToken.issuer and accessToken.audience");
+        }
+        if (expiresInSeconds > 3600) {
+            invalid("Production access tokens must expire within one hour");
+        }
+    }
+    if (tokenConfig.keyId !== undefined && tokenConfig.keyId.length === 0) {
+        invalid("accessToken.keyId must be non-empty when provided");
+    }
+    if (tokenConfig.keyResolver !== undefined &&
+        typeof tokenConfig.keyResolver !== "function") {
+        invalid("accessToken.keyResolver must be a function");
+    }
+    if (tokenConfig.requiredClaims !== undefined &&
+        !Array.isArray(tokenConfig.requiredClaims)) {
+        invalid("accessToken.requiredClaims must be an array");
+    }
+    if (tokenConfig.isRevoked !== undefined &&
+        typeof tokenConfig.isRevoked !== "function") {
+        invalid("accessToken.isRevoked must be a function");
+    }
+    let refreshToken;
+    if (config.refreshToken !== undefined) {
+        const refreshConfig = config.refreshToken;
+        if (!refreshConfig || typeof refreshConfig !== "object") {
+            invalid("refreshToken must be an object when provided");
+        }
+        const store = refreshConfig.store;
+        if (!store ||
+            typeof store.create !== "function" ||
+            typeof store.consume !== "function" ||
+            typeof store.revokeToken !== "function" ||
+            typeof store.revokeFamily !== "function" ||
+            typeof store.revokeAllForSubject !== "function") {
+            invalid("refreshToken.store must implement the complete RefreshTokenStore interface");
+        }
+        if (!Number.isSafeInteger(refreshConfig.refreshTokenTtl) ||
+            refreshConfig.refreshTokenTtl <= 0 ||
+            refreshConfig.refreshTokenTtl > MAX_REFRESH_LIFETIME_SECONDS) {
+            invalid("refreshToken.refreshTokenTtl must be a positive safe integer in seconds");
+        }
+        if (!Number.isSafeInteger(refreshConfig.absoluteLifetime) ||
+            refreshConfig.absoluteLifetime <= 0 ||
+            refreshConfig.absoluteLifetime > MAX_REFRESH_LIFETIME_SECONDS) {
+            invalid("refreshToken.absoluteLifetime must be a positive safe integer in seconds");
+        }
+        refreshToken = {
+            store,
+            refreshTokenTtl: refreshConfig.refreshTokenTtl,
+            absoluteLifetime: refreshConfig.absoluteLifetime,
+        };
+    }
+    if (config.accounts !== undefined) {
+        // Account helpers issue both tokens, so they require a configured store.
+        if (!refreshToken) {
+            invalid("accounts requires refreshToken.store to be configured");
+        }
+        validateAccountAdapter(config.accounts);
+    }
+    const requiredClaims = [
+        ...new Set([
+            "sub",
+            "iat",
+            "exp",
+            ...(tokenConfig.issuer ? ["iss"] : []),
+            ...(tokenConfig.audience ? ["aud"] : []),
+            ...(tokenConfig.requiredClaims ?? []),
+        ]),
+    ];
+    if (requiredClaims.some((claim) => typeof claim !== "string" || !claim)) {
+        invalid("accessToken.requiredClaims must contain non-empty claim names");
+    }
+    return {
+        mode,
+        password: { workFactor },
+        accessToken: {
+            algorithm,
+            algorithms,
+            key: tokenConfig.key,
+            ...(tokenConfig.keyId === undefined ? {} : { keyId: tokenConfig.keyId }),
+            ...(tokenConfig.keyResolver === undefined
+                ? {}
+                : { keyResolver: tokenConfig.keyResolver }),
+            ...(tokenConfig.issuer === undefined
+                ? {}
+                : { issuer: tokenConfig.issuer }),
+            ...(tokenConfig.audience === undefined
+                ? {}
+                : { audience: tokenConfig.audience }),
+            expiresInSeconds,
+            requiredClaims,
+            ...(tokenConfig.isRevoked === undefined
+                ? {}
+                : { isRevoked: tokenConfig.isRevoked }),
+        },
+        ...(refreshToken === undefined ? {} : { refreshToken }),
+        ...(config.accounts === undefined ? {} : { accounts: config.accounts }),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,sBAAsB,EAAuB,MAAM,eAAe,CAAC;AAE5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AACpD,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACC,CAAC;AA8DX,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,IAAI,SAAS,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,GAAa,EAAE,SAA6B;IAC/D,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;YACxD,OAAO,CACL,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,SAAS,sDAAsD,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAwB;IAExB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,aAAa,CAAC;IAC1C,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QACpD,OAAO,CAAC,4CAA4C,CAAC,CAAC;IACxD,CAAC;IAED,IACE,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC7B,CAAC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,EACjE,CAAC;QACD,OAAO,CAAC,0CAA0C,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,UAAU,IAAI,qBAAqB,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;QACvE,OAAO,CAAC,yDAAyD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACvC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;QACxE,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,IAAI,OAAO,CAAC;IACnD,IAAI,CAAE,oBAA0C,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,wCAAwC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvE,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/B,UAAU,CAAC,IAAI,CACb,CAAC,KAAK,EAAE,EAAE,CAAC,CAAE,oBAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC,CACxE,EACD,CAAC;QACD,OAAO,CACL,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAExC,MAAM,gBAAgB,GACpB,WAAW,CAAC,gBAAgB,IAAI,gCAAgC,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,8DAA8D,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,WAAW,CAAC,MAAM,KAAK,SAAS;QAChC,CAAC,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,EAC3E,CAAC;QACD,OAAO,CAAC,6DAA6D,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;QACtC,IAAI,CAAC,CACH,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACrD,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACtB,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACnB,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CACzE,EAAE,CAAC;YACF,OAAO,CAAC,2DAA2D,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YACjD,OAAO,CACL,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,GAAG,IAAI,EAAE,CAAC;YAC5B,OAAO,CAAC,sDAAsD,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,mDAAmD,CAAC,CAAC;IAC/D,CAAC;IACD,IACE,WAAW,CAAC,WAAW,KAAK,SAAS;QACrC,OAAO,WAAW,CAAC,WAAW,KAAK,UAAU,EAC7C,CAAC;QACD,OAAO,CAAC,4CAA4C,CAAC,CAAC;IACxD,CAAC;IACD,IACE,WAAW,CAAC,cAAc,KAAK,SAAS;QACxC,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,EAC1C,CAAC;QACD,OAAO,CAAC,6CAA6C,CAAC,CAAC;IACzD,CAAC;IACD,IACE,WAAW,CAAC,SAAS,KAAK,SAAS;QACnC,OAAO,WAAW,CAAC,SAAS,KAAK,UAAU,EAC3C,CAAC;QACD,OAAO,CAAC,0CAA0C,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,YAAiD,CAAC;IACtD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO,CAAC,8CAA8C,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,KAC+B,CAAC;QAC5D,IACE,CAAC,KAAK;YACN,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU;YAClC,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU;YACnC,OAAO,KAAK,CAAC,WAAW,KAAK,UAAU;YACvC,OAAO,KAAK,CAAC,YAAY,KAAK,UAAU;YACxC,OAAO,KAAK,CAAC,mBAAmB,KAAK,UAAU,EAC/C,CAAC;YACD,OAAO,CACL,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,eAAe,CAAC;YACpD,aAAa,CAAC,eAAe,IAAI,CAAC;YAClC,aAAa,CAAC,eAAe,GAAG,4BAA4B,EAC5D,CAAC;YACD,OAAO,CACL,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QACD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,gBAAgB,CAAC;YACrD,aAAa,CAAC,gBAAgB,IAAI,CAAC;YACnC,aAAa,CAAC,gBAAgB,GAAG,4BAA4B,EAC7D,CAAC;YACD,OAAO,CACL,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QACD,YAAY,GAAG;YACb,KAAK;YACL,eAAe,EAAE,aAAa,CAAC,eAAe;YAC9C,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;SACjD,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,yEAAyE;QACzE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,uDAAuD,CAAC,CAAC;QACnE,CAAC;QACD,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,cAAc,GAAG;QACrB,GAAG,IAAI,GAAG,CAAC;YACT,KAAK;YACL,KAAK;YACL,KAAK;YACL,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC;SACtC,CAAC;KACH,CAAC;IACF,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,+DAA+D,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,EAAE,UAAU,EAAE;QACxB,WAAW,EAAE;YACX,SAAS;YACT,UAAU;YACV,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;YACxE,GAAG,CAAC,WAAW,CAAC,WAAW,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC;YAC7C,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;YACnC,GAAG,CAAC,WAAW,CAAC,QAAQ,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;YACvC,gBAAgB;YAChB,cAAc;YACd,GAAG,CAAC,WAAW,CAAC,SAAS,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;SAC1C;QACD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,16 @@
+export declare const AUTH_ERROR_CODES: readonly ["TOKEN_MISSING", "TOKEN_INVALID", "TOKEN_EXPIRED", "REFRESH_TOKEN_INVALID", "REFRESH_TOKEN_REUSED", "SESSION_REVOKED", "ACCOUNT_EXISTS", "UNAUTHORIZED", "FORBIDDEN", "VALIDATION_ERROR", "INVALID_CONFIGURATION"];
+export type AuthErrorCode = (typeof AUTH_ERROR_CODES)[number];
+export interface AuthErrorOptions {
+    publicMessage?: string;
+    status?: number;
+    cause?: unknown;
+}
+export declare class AuthError extends Error {
+    readonly code: AuthErrorCode;
+    readonly developerMessage: string;
+    readonly publicMessage: string;
+    readonly status: number;
+    constructor(code: AuthErrorCode, developerMessage: string, options?: AuthErrorOptions);
+}
+export declare function getHttpStatus(code: AuthErrorCode): number;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,8NAYnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AA8B9D,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAGtB,IAAI,EAAE,aAAa,EACnB,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,gBAAqB;CASjC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAEzD"}

package/dist/errors.js

@@ -0,0 +1,57 @@
+export const AUTH_ERROR_CODES = [
+    "TOKEN_MISSING",
+    "TOKEN_INVALID",
+    "TOKEN_EXPIRED",
+    "REFRESH_TOKEN_INVALID",
+    "REFRESH_TOKEN_REUSED",
+    "SESSION_REVOKED",
+    "ACCOUNT_EXISTS",
+    "UNAUTHORIZED",
+    "FORBIDDEN",
+    "VALIDATION_ERROR",
+    "INVALID_CONFIGURATION",
+];
+const HTTP_STATUS = {
+    TOKEN_MISSING: 401,
+    TOKEN_INVALID: 401,
+    TOKEN_EXPIRED: 401,
+    REFRESH_TOKEN_INVALID: 401,
+    REFRESH_TOKEN_REUSED: 401,
+    SESSION_REVOKED: 401,
+    ACCOUNT_EXISTS: 409,
+    UNAUTHORIZED: 401,
+    FORBIDDEN: 403,
+    VALIDATION_ERROR: 400,
+    INVALID_CONFIGURATION: 500,
+};
+const PUBLIC_MESSAGES = {
+    TOKEN_MISSING: "Authentication is required",
+    TOKEN_INVALID: "Authentication failed",
+    TOKEN_EXPIRED: "Authentication has expired",
+    REFRESH_TOKEN_INVALID: "Refresh token is invalid",
+    REFRESH_TOKEN_REUSED: "Refresh token is invalid",
+    SESSION_REVOKED: "Authentication has been revoked",
+    ACCOUNT_EXISTS: "An account already exists",
+    UNAUTHORIZED: "Authentication is required",
+    FORBIDDEN: "You are not allowed to perform this action",
+    VALIDATION_ERROR: "The request is invalid",
+    INVALID_CONFIGURATION: "Authentication is unavailable",
+};
+export class AuthError extends Error {
+    code;
+    developerMessage;
+    publicMessage;
+    status;
+    constructor(code, developerMessage, options = {}) {
+        super(developerMessage, { cause: options.cause });
+        this.name = "AuthError";
+        this.code = code;
+        this.developerMessage = developerMessage;
+        this.publicMessage = options.publicMessage ?? PUBLIC_MESSAGES[code];
+        this.status = options.status ?? HTTP_STATUS[code];
+    }
+}
+export function getHttpStatus(code) {
+    return HTTP_STATUS[code];
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,eAAe;IACf,eAAe;IACf,eAAe;IACf,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,WAAW;IACX,kBAAkB;IAClB,uBAAuB;CACf,CAAC;AAIX,MAAM,WAAW,GAAkC;IACjD,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,GAAG;IAClB,qBAAqB,EAAE,GAAG;IAC1B,oBAAoB,EAAE,GAAG;IACzB,eAAe,EAAE,GAAG;IACpB,cAAc,EAAE,GAAG;IACnB,YAAY,EAAE,GAAG;IACjB,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,GAAG;IACrB,qBAAqB,EAAE,GAAG;CAC3B,CAAC;AAEF,MAAM,eAAe,GAAkC;IACrD,aAAa,EAAE,4BAA4B;IAC3C,aAAa,EAAE,uBAAuB;IACtC,aAAa,EAAE,4BAA4B;IAC3C,qBAAqB,EAAE,0BAA0B;IACjD,oBAAoB,EAAE,0BAA0B;IAChD,eAAe,EAAE,iCAAiC;IAClD,cAAc,EAAE,2BAA2B;IAC3C,YAAY,EAAE,4BAA4B;IAC1C,SAAS,EAAE,4CAA4C;IACvD,gBAAgB,EAAE,wBAAwB;IAC1C,qBAAqB,EAAE,+BAA+B;CACvD,CAAC;AAQF,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,CAAgB;IACpB,gBAAgB,CAAS;IACzB,aAAa,CAAS;IACtB,MAAM,CAAS;IAExB,YACE,IAAmB,EACnB,gBAAwB,EACxB,UAA4B,EAAE;QAE9B,KAAK,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/dist/express/index.d.ts

@@ -0,0 +1,74 @@
+import type { ErrorRequestHandler, Request, RequestHandler, Response } from "express";
+import { AuthError } from "../errors.js";
+import type { Auth } from "../index.js";
+import type { ValidationSchemaMap, ValidationTarget, ValidatorAdapter } from "../validation.js";
+import type { VerifiedAccessClaims } from "../tokens.js";
+export interface AuthenticatedRequest<Identity extends VerifiedAccessClaims = VerifiedAccessClaims> extends Request {
+    auth?: Identity;
+    validated?: Partial<Record<ValidationTarget, unknown>>;
+}
+type SchemaOutput<TSchema> = TSchema extends {
+    _output: infer TOutput;
+} ? TOutput : unknown;
+export type ValidatedRequest<TSchemas extends ValidationSchemaMap> = Request & {
+    validated?: {
+        [Target in keyof TSchemas]?: SchemaOutput<TSchemas[Target]>;
+    };
+};
+declare module "express-serve-static-core" {
+    interface Request {
+        auth?: VerifiedAccessClaims;
+        validated?: Partial<Record<ValidationTarget, unknown>>;
+    }
+}
+export type TokenExtractor = (request: Request) => string | undefined | Promise<string | undefined>;
+export interface PublicHttpError {
+    status: number;
+    code: string;
+    message: string;
+}
+export interface FormattedHttpError {
+    status: number;
+    body: unknown;
+}
+export type ErrorFormatter = (error: PublicHttpError, request: Request) => FormattedHttpError;
+export type IdentityLookup<Identity extends VerifiedAccessClaims> = (claims: VerifiedAccessClaims, request: Request) => Identity | null | Promise<Identity | null>;
+export interface ExpressAuthOptions<Identity extends VerifiedAccessClaims> {
+    getToken?: TokenExtractor;
+    lookupIdentity?: IdentityLookup<Identity>;
+    validator?: ValidatorAdapter;
+    errorFormatter?: ErrorFormatter;
+}
+export interface AuthenticateOptions {
+    required?: boolean;
+}
+export interface AuthorizeOptions {
+    roles: readonly string[];
+}
+export declare function fromHeader(): TokenExtractor;
+export declare function fromCookie(name: string): TokenExtractor;
+export declare function fromAny(extractors: readonly TokenExtractor[]): TokenExtractor;
+export type ValidateOptions<TSchemas extends ValidationSchemaMap = ValidationSchemaMap> = {
+    [Target in keyof TSchemas]?: TSchemas[Target];
+} & {
+    formatError?: (cause: unknown, target: ValidationTarget) => AuthError;
+};
+export declare function expressAuth<Identity extends VerifiedAccessClaims = VerifiedAccessClaims>(auth: Auth, options?: ExpressAuthOptions<Identity>): {
+    authenticate: (authenticateOptions?: AuthenticateOptions) => RequestHandler;
+    authorize: (authorizeOptions: AuthorizeOptions) => RequestHandler;
+    validate: <TSchemas extends ValidationSchemaMap>(schemas: ValidateOptions<TSchemas>) => RequestHandler;
+    errorHandler: (formatter?: ErrorFormatter) => ErrorRequestHandler;
+};
+/** Alias retained for callers who prefer the create* naming convention. */
+export declare const createExpressAuth: typeof expressAuth;
+export interface RefreshCookieOptions {
+    name?: string;
+    path?: string;
+    maxAge?: number;
+    secure?: boolean;
+    sameSite?: "lax" | "strict" | "none";
+}
+export declare function setRefreshTokenCookie(response: Response, token: string, options?: RefreshCookieOptions): void;
+export declare function clearRefreshTokenCookie(response: Response, options?: RefreshCookieOptions): void;
+export type { ValidatorAdapter, ValidationSchemaMap, ValidationTarget, } from "../validation.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/express/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EAEnB,OAAO,EACP,cAAc,EACd,QAAQ,EACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,WAAW,oBAAoB,CACnC,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB,CAC5D,SAAQ,OAAO;IACf,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED,KAAK,YAAY,CAAC,OAAO,IAAI,OAAO,SAAS;IAAE,OAAO,EAAE,MAAM,OAAO,CAAA;CAAE,GACnE,OAAO,GACP,OAAO,CAAC;AAEZ,MAAM,MAAM,gBAAgB,CAAC,QAAQ,SAAS,mBAAmB,IAAI,OAAO,GAAG;IAC7E,SAAS,CAAC,EAAE;SACT,MAAM,IAAI,MAAM,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KAC5D,CAAC;CACH,CAAC;AAEF,OAAO,QAAQ,2BAA2B,CAAC;IACzC,UAAU,OAAO;QACf,IAAI,CAAC,EAAE,oBAAoB,CAAC;QAC5B,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;KACxD;CACF;AAED,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,OAAO,KACb,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,cAAc,GAAG,CAC3B,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,OAAO,KACb,kBAAkB,CAAC;AAExB,MAAM,MAAM,cAAc,CAAC,QAAQ,SAAS,oBAAoB,IAAI,CAClE,MAAM,EAAE,oBAAoB,EAC5B,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,MAAM,WAAW,kBAAkB,CAAC,QAAQ,SAAS,oBAAoB;IACvE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAoCD,wBAAgB,UAAU,IAAI,cAAc,CAU3C;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAmBvD;AAED,wBAAgB,OAAO,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,GAAG,cAAc,CAU7E;AAED,MAAM,MAAM,eAAe,CACzB,QAAQ,SAAS,mBAAmB,GAAG,mBAAmB,IACxD;KACD,MAAM,IAAI,MAAM,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC;CAC9C,GAAG;IACF,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,KAAK,SAAS,CAAC;CACvE,CAAC;AAEF,wBAAgB,WAAW,CACzB,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB,EAC5D,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE,kBAAkB,CAAC,QAAQ,CAAM;yCAI/B,mBAAmB,KACvC,cAAc;kCA2BoB,gBAAgB,KAAG,cAAc;eA2BpD,QAAQ,SAAS,mBAAmB,WAC3C,eAAe,CAAC,QAAQ,CAAC,KACjC,cAAc;+BAiCJ,cAAc,KACxB,mBAAmB;EAYvB;AAED,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,oBAAc,CAAC;AAE7C,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACtC;AAiBD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,oBAAyB,GACjC,IAAI,CAMN;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,oBAAyB,GACjC,IAAI,CAQN;AAED,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}