rst-auth 0.0.0-stage → 0.2.0

package/dist/express/index.js

@@ -0,0 +1,185 @@
+import { AuthError } from "../errors.js";
+const defaultErrorFormatter = (error) => ({
+    status: error.status,
+    body: { error: { code: error.code, message: error.message } },
+});
+function publicError(error) {
+    if (error instanceof AuthError) {
+        return {
+            status: error.status,
+            code: error.code,
+            message: error.publicMessage,
+        };
+    }
+    return {
+        status: 500,
+        code: "INTERNAL_ERROR",
+        message: "Internal server error",
+    };
+}
+function asyncHandler(handler) {
+    return (request, response, next) => {
+        void Promise.resolve()
+            .then(() => handler(request, response, next))
+            .catch(next);
+    };
+}
+export function fromHeader() {
+    return (request) => {
+        const value = request.get("authorization");
+        if (value === undefined)
+            return undefined;
+        const match = /^Bearer[ \t]+([^\s,]+)$/i.exec(value);
+        if (!match?.[1]) {
+            throw new AuthError("TOKEN_INVALID", "Malformed Authorization header");
+        }
+        return match[1];
+    };
+}
+export function fromCookie(name) {
+    if (!name || /[=;\s]/.test(name)) {
+        throw new TypeError("Cookie name must be a non-empty token");
+    }
+    return (request) => {
+        const header = request.get("cookie");
+        if (!header)
+            return undefined;
+        for (const entry of header.split(";")) {
+            const separator = entry.indexOf("=");
+            if (separator < 0 || entry.slice(0, separator).trim() !== name)
+                continue;
+            const value = entry.slice(separator + 1).trim();
+            try {
+                return decodeURIComponent(value);
+            }
+            catch {
+                throw new AuthError("TOKEN_INVALID", "Malformed authentication cookie");
+            }
+        }
+        return undefined;
+    };
+}
+export function fromAny(extractors) {
+    if (!extractors.length)
+        throw new TypeError("At least one extractor is required");
+    return async (request) => {
+        for (const extract of extractors) {
+            const token = await extract(request);
+            if (token !== undefined)
+                return token;
+        }
+        return undefined;
+    };
+}
+export function expressAuth(auth, options = {}) {
+    const extractToken = options.getToken ?? fromHeader();
+    function authenticate(authenticateOptions = {}) {
+        const required = authenticateOptions.required ?? true;
+        return asyncHandler(async (request, _response, next) => {
+            const token = await extractToken(request);
+            if (token === undefined) {
+                if (required) {
+                    throw new AuthError("TOKEN_MISSING", "Access token is required");
+                }
+                delete request.auth;
+                next();
+                return;
+            }
+            const claims = await auth.tokens.verifyAccessToken(token, request);
+            const identity = options.lookupIdentity
+                ? await options.lookupIdentity(claims, request)
+                : claims;
+            if (identity === null) {
+                throw new AuthError("UNAUTHORIZED", "Identity lookup did not find a user");
+            }
+            request.auth = identity;
+            next();
+        });
+    }
+    function authorize(authorizeOptions) {
+        const requiredRoles = new Set(authorizeOptions.roles);
+        return (request, _response, next) => {
+            if (!request.auth) {
+                next(new AuthError("UNAUTHORIZED", "Authentication is required"));
+                return;
+            }
+            const roleData = request.auth;
+            const userRoles = [
+                ...(typeof roleData.role === "string" ? [roleData.role] : []),
+                ...(Array.isArray(roleData.roles)
+                    ? roleData.roles.filter((role) => typeof role === "string")
+                    : []),
+            ];
+            if (!userRoles.some((role) => requiredRoles.has(role))) {
+                next(new AuthError("FORBIDDEN", "User does not have a required role"));
+                return;
+            }
+            next();
+        };
+    }
+    function validate(schemas) {
+        if (!options.validator) {
+            throw new AuthError("INVALID_CONFIGURATION", "A validator adapter must be configured before using validate()");
+        }
+        const targets = ["body", "params", "query"];
+        return asyncHandler(async (request, _response, next) => {
+            const parsed = {};
+            for (const target of targets) {
+                const schema = schemas[target];
+                if (schema === undefined)
+                    continue;
+                try {
+                    parsed[target] = await options.validator.parse(schema, request[target]);
+                }
+                catch (cause) {
+                    throw (schemas.formatError?.(cause, target) ??
+                        new AuthError("VALIDATION_ERROR", `Invalid request ${target}`, {
+                            cause,
+                        }));
+                }
+            }
+            request.validated = parsed;
+            next();
+        });
+    }
+    function errorHandler(formatter = options.errorFormatter ?? defaultErrorFormatter) {
+        return (error, request, response, next) => {
+            if (response.headersSent) {
+                next(error);
+                return;
+            }
+            const formatted = formatter(publicError(error), request);
+            response.status(formatted.status).json(formatted.body);
+        };
+    }
+    return { authenticate, authorize, validate, errorHandler };
+}
+/** Alias retained for callers who prefer the create* naming convention. */
+export const createExpressAuth = expressAuth;
+function cookieSettings(options = {}) {
+    const secure = options.secure ?? true;
+    const sameSite = options.sameSite ?? "lax";
+    if (sameSite === "none" && !secure) {
+        throw new TypeError("SameSite=None cookies require Secure");
+    }
+    return {
+        httpOnly: true,
+        secure,
+        sameSite,
+        path: options.path ?? "/auth/refresh",
+        ...(options.maxAge === undefined ? {} : { maxAge: options.maxAge }),
+    };
+}
+export function setRefreshTokenCookie(response, token, options = {}) {
+    response.cookie(options.name ?? "refreshToken", token, cookieSettings(options));
+}
+export function clearRefreshTokenCookie(response, options = {}) {
+    const settings = cookieSettings(options);
+    response.clearCookie(options.name ?? "refreshToken", {
+        httpOnly: settings.httpOnly,
+        secure: settings.secure,
+        sameSite: settings.sameSite,
+        path: settings.path,
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/express/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAyEzC,MAAM,qBAAqB,GAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE;CAC9D,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,aAAa;SAC7B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,uBAAuB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,OAIyB;IAEzB,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACjC,KAAK,OAAO,CAAC,OAAO,EAAE;aACnB,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;aAC5C,KAAK,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,SAAS,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;gBAAE,SAAS;YACzE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,iCAAiC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,UAAqC;IAC3D,IAAI,CAAC,UAAU,CAAC,MAAM;QACpB,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,WAAW,CAEzB,IAAU,EAAE,UAAwC,EAAE;IACtD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;IAEtD,SAAS,YAAY,CACnB,sBAA2C,EAAE;QAE7C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,IAAI,IAAI,CAAC;QACtD,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;gBACnE,CAAC;gBACD,OAAO,OAAO,CAAC,IAAI,CAAC;gBACpB,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc;gBACrC,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC;gBAC/C,CAAC,CAAE,MAAmB,CAAC;YACzB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,SAAS,CACjB,cAAc,EACd,qCAAqC,CACtC,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC;YACxB,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,SAAS,CAAC,gBAAkC;QACnD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YAClC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,SAAS,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAGxB,CAAC;YACF,MAAM,SAAS,GAAG;gBAChB,GAAG,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAC/B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CACnB,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CACnD;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACvD,IAAI,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,oCAAoC,CAAC,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,QAAQ,CACf,OAAkC;QAElC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YACrD,MAAM,MAAM,GAA+C,EAAE,CAAC;YAC9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC/B,IAAI,MAAM,KAAK,SAAS;oBAAE,SAAS;gBACnC,IAAI,CAAC;oBACH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,SAAU,CAAC,KAAK,CAC7C,MAAM,EACN,OAAO,CAAC,MAAM,CAAC,CAChB,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CACJ,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;wBACpC,IAAI,SAAS,CAAC,kBAAkB,EAAE,mBAAmB,MAAM,EAAE,EAAE;4BAC7D,KAAK;yBACN,CAAC,CACH,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC;YAC3B,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,YAAY,CACnB,YAA4B,OAAO,CAAC,cAAc,IAAI,qBAAqB;QAE3E,OAAO,CAAC,KAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;YACjD,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACzD,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAC7D,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAU7C,SAAS,cAAc,CAAC,UAAgC,EAAE;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC3C,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ;QACR,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,eAAe;QACrC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAkB,EAClB,KAAa,EACb,UAAgC,EAAE;IAElC,QAAQ,CAAC,MAAM,CACb,OAAO,CAAC,IAAI,IAAI,cAAc,EAC9B,KAAK,EACL,cAAc,CAAC,OAAO,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAkB,EAClB,UAAgC,EAAE;IAElC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,IAAI,cAAc,EAAE;QACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;KACpB,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+import type { AuthConfig } from "./config.js";
+import { AuthError, AUTH_ERROR_CODES, getHttpStatus } from "./errors.js";
+import { createPasswordService } from "./password.js";
+import { createAccessTokenService } from "./tokens.js";
+import { type RefreshTokenService } from "./refresh.js";
+import { MemoryRefreshTokenStore } from "./memory-refresh-token-store.js";
+import { type AccountService } from "./accounts.js";
+export interface Auth {
+    password: ReturnType<typeof createPasswordService>;
+    tokens: ReturnType<typeof createAccessTokenService>;
+    refresh?: RefreshTokenService;
+    accounts?: AccountService;
+}
+export declare function createAuth<User = unknown>(config: AuthConfig<User>): Auth;
+export { MemoryRefreshTokenStore };
+export { AuthError, AUTH_ERROR_CODES, getHttpStatus };
+export type { ConsumeResult, RefreshTokenRecord, RefreshTokenStatus, RefreshTokenStore, RevokeTokenResult, } from "./refresh-store.js";
+export type { IssuedRefreshToken, IssueRefreshTokenInput, RefreshTokenService, } from "./refresh.js";
+export type { AuthErrorCode, AuthErrorOptions } from "./errors.js";
+export type { AccountAdapter, AccountModelLike, AccountService, AccountSession, LoginAccountInput, RegisterAccountInput, } from "./accounts.js";
+export type { AuthConfig, KeyResolver, RuntimeMode, SupportedAlgorithm, TokenKey, } from "./config.js";
+export type { AccessTokenClaims, AccessTokenService, VerifiedAccessClaims, } from "./tokens.js";
+export type { ValidationSchemaMap, ValidationTarget, ValidatorAdapter, } from "./validation.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAE1E,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;IACnD,MAAM,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAsBzE;AAED,OAAO,EAAE,uBAAuB,EAAE,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;AACtD,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,27 @@
+import { validateAuthConfig } from "./config.js";
+import { AuthError, AUTH_ERROR_CODES, getHttpStatus } from "./errors.js";
+import { createPasswordService } from "./password.js";
+import { createAccessTokenService } from "./tokens.js";
+import { createRefreshTokenService, } from "./refresh.js";
+import { MemoryRefreshTokenStore } from "./memory-refresh-token-store.js";
+import { createAccountService } from "./accounts.js";
+export function createAuth(config) {
+    const validatedConfig = validateAuthConfig(config);
+    const refresh = validatedConfig.refreshToken
+        ? createRefreshTokenService(validatedConfig.refreshToken)
+        : undefined;
+    const password = createPasswordService(validatedConfig.password.workFactor);
+    const tokens = createAccessTokenService(validatedConfig.accessToken);
+    const accounts = validatedConfig.accounts && refresh
+        ? createAccountService(validatedConfig.accounts, password, tokens, refresh)
+        : undefined;
+    return {
+        password,
+        tokens,
+        ...(refresh === undefined ? {} : { refresh }),
+        ...(accounts === undefined ? {} : { accounts }),
+    };
+}
+export { MemoryRefreshTokenStore };
+export { AuthError, AUTH_ERROR_CODES, getHttpStatus };
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACL,yBAAyB,GAE1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAuB,MAAM,eAAe,CAAC;AAS1E,MAAM,UAAU,UAAU,CAAiB,MAAwB;IACjE,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,eAAe,CAAC,YAAY;QAC1C,CAAC,CAAC,yBAAyB,CAAC,eAAe,CAAC,YAAY,CAAC;QACzD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,qBAAqB,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,wBAAwB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,QAAQ,GACZ,eAAe,CAAC,QAAQ,IAAI,OAAO;QACjC,CAAC,CAAC,oBAAoB,CAClB,eAAe,CAAC,QAAQ,EACxB,QAAQ,EACR,MAAM,EACN,OAAO,CACR;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,QAAQ;QACR,MAAM;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,uBAAuB,EAAE,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC"}

package/dist/memory-refresh-token-store.d.ts

@@ -0,0 +1,15 @@
+import type { ConsumeResult, RefreshTokenRecord, RefreshTokenStore, RevokeTokenResult } from "./refresh-store.js";
+/**
+ * In-memory store for tests and local examples only. It is not safe across
+ * processes, restarts, or multiple application instances.
+ */
+export declare class MemoryRefreshTokenStore implements RefreshTokenStore {
+    private readonly records;
+    private readonly revokedFamilies;
+    create(record: RefreshTokenRecord): Promise<void>;
+    consume(tokenHash: string, now: Date): Promise<ConsumeResult>;
+    revokeToken(tokenHash: string, _now: Date): Promise<RevokeTokenResult>;
+    revokeFamily(familyId: string, _now: Date): Promise<void>;
+    revokeAllForSubject(subject: string, _now: Date): Promise<void>;
+}
+//# sourceMappingURL=memory-refresh-token-store.d.ts.map

package/dist/memory-refresh-token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-refresh-token-store.d.ts","sourceRoot":"","sources":["../src/memory-refresh-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,oBAAoB,CAAC;AAc5B;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,iBAAiB;IAC/D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAE/C,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjD,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC;IAmB7D,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAStE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAStE"}

package/dist/memory-refresh-token-store.js

@@ -0,0 +1,75 @@
+function copyRecord(record) {
+    return {
+        ...record,
+        createdAt: new Date(record.createdAt),
+        expiresAt: new Date(record.expiresAt),
+        absoluteExpiresAt: new Date(record.absoluteExpiresAt),
+        ...(record.consumedAt === undefined
+            ? {}
+            : { consumedAt: new Date(record.consumedAt) }),
+    };
+}
+/**
+ * In-memory store for tests and local examples only. It is not safe across
+ * processes, restarts, or multiple application instances.
+ */
+export class MemoryRefreshTokenStore {
+    records = new Map();
+    revokedFamilies = new Set();
+    async create(record) {
+        if (this.revokedFamilies.has(record.familyId)) {
+            throw new Error("Cannot create a refresh token in a revoked family");
+        }
+        if (this.records.has(record.tokenHash)) {
+            throw new Error("Refresh token hash already exists");
+        }
+        this.records.set(record.tokenHash, copyRecord(record));
+    }
+    async consume(tokenHash, now) {
+        // This mutation happens before the async method yields, giving this
+        // single-process implementation compare-and-swap behavior.
+        const record = this.records.get(tokenHash);
+        if (!record)
+            return { status: "not_found" };
+        if (record.status === "revoked")
+            return { status: "revoked" };
+        if (record.status === "consumed") {
+            await this.revokeFamily(record.familyId, now);
+            return { status: "reused" };
+        }
+        if (now >= record.expiresAt || now >= record.absoluteExpiresAt) {
+            return { status: "expired" };
+        }
+        record.status = "consumed";
+        record.consumedAt = new Date(now);
+        return { status: "ok", record: copyRecord(record) };
+    }
+    async revokeToken(tokenHash, _now) {
+        void _now;
+        const record = this.records.get(tokenHash);
+        if (!record)
+            return { status: "not_found" };
+        if (record.status !== "active")
+            return { status: "inactive" };
+        record.status = "revoked";
+        return { status: "revoked" };
+    }
+    async revokeFamily(familyId, _now) {
+        void _now;
+        this.revokedFamilies.add(familyId);
+        for (const record of this.records.values()) {
+            if (record.familyId === familyId)
+                record.status = "revoked";
+        }
+    }
+    async revokeAllForSubject(subject, _now) {
+        void _now;
+        for (const record of this.records.values()) {
+            if (record.subject === subject) {
+                this.revokedFamilies.add(record.familyId);
+                record.status = "revoked";
+            }
+        }
+    }
+}
+//# sourceMappingURL=memory-refresh-token-store.js.map

package/dist/memory-refresh-token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-refresh-token-store.js","sourceRoot":"","sources":["../src/memory-refresh-token-store.ts"],"names":[],"mappings":"AAOA,SAAS,UAAU,CAAC,MAA0B;IAC5C,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACrC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACrC,iBAAiB,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACrD,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAuB;IACjB,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAChD,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAErD,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,GAAS;QACxC,oEAAoE;QACpE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,GAAG,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QAED,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;QAC3B,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,IAAU;QAC7C,KAAK,IAAI,CAAC;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC9D,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,IAAU;QAC7C,KAAK,IAAI,CAAC;QACV,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAe,EAAE,IAAU;QACnD,KAAK,IAAI,CAAC;QACV,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC/B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/password.d.ts

@@ -0,0 +1,7 @@
+export interface PasswordService {
+    hash(password: string): Promise<string>;
+    verify(password: string, hash: string): Promise<boolean>;
+    verifyDummy(password: string): Promise<void>;
+}
+export declare function createPasswordService(workFactor: number): PasswordService;
+//# sourceMappingURL=password.d.ts.map

package/dist/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../src/password.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CA2BzE"}

package/dist/password.js

@@ -0,0 +1,36 @@
+import bcrypt from "bcryptjs";
+import { AuthError } from "./errors.js";
+const MAX_PASSWORD_BYTES = 72;
+function validatePassword(password) {
+    if (typeof password !== "string" || password.length === 0) {
+        throw new AuthError("VALIDATION_ERROR", "Password must be a non-empty string");
+    }
+    if (Buffer.byteLength(password, "utf8") > MAX_PASSWORD_BYTES) {
+        throw new AuthError("VALIDATION_ERROR", "Password must not exceed 72 UTF-8 bytes because bcrypt truncates longer values");
+    }
+}
+export function createPasswordService(workFactor) {
+    const dummyHash = bcrypt.hashSync("rst-auth-dummy-password-value", workFactor);
+    return {
+        async hash(password) {
+            validatePassword(password);
+            return bcrypt.hash(password, workFactor);
+        },
+        async verify(password, hash) {
+            validatePassword(password);
+            if (typeof hash !== "string" || hash.length === 0)
+                return false;
+            try {
+                return await bcrypt.compare(password, hash);
+            }
+            catch {
+                return false;
+            }
+        },
+        async verifyDummy(password) {
+            validatePassword(password);
+            await bcrypt.compare(password, dummyHash);
+        },
+    };
+}
+//# sourceMappingURL=password.js.map

package/dist/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../src/password.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,SAAS,gBAAgB,CAAC,QAAiB;IACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CACjB,kBAAkB,EAClB,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,kBAAkB,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CACjB,kBAAkB,EAClB,gFAAgF,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAC/B,+BAA+B,EAC/B,UAAU,CACX,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,QAAgB;YACzB,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAY;YACzC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChE,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,QAAgB;YAChC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/refresh-store.d.ts

@@ -0,0 +1,48 @@
+export type RefreshTokenStatus = "active" | "consumed" | "revoked";
+export interface RefreshTokenRecord {
+    /** A SHA-256 digest of the opaque token. Raw refresh tokens must never be stored. */
+    tokenHash: string;
+    familyId: string;
+    subject: string;
+    createdAt: Date;
+    expiresAt: Date;
+    absoluteExpiresAt: Date;
+    status: RefreshTokenStatus;
+    consumedAt?: Date;
+}
+export type ConsumeResult = {
+    status: "ok";
+    record: RefreshTokenRecord;
+} | {
+    status: "not_found";
+} | {
+    status: "expired";
+} | {
+    status: "revoked";
+} | {
+    status: "reused";
+};
+export type RevokeTokenResult = {
+    status: "revoked";
+} | {
+    status: "not_found";
+} | {
+    status: "inactive";
+};
+/**
+ * Implementations must make consume a single atomic compare-and-swap operation.
+ * A store that cannot ensure only one concurrent caller gets `ok` cannot claim
+ * refresh-token reuse protection. Re-presenting a consumed token must revoke
+ * its family before returning `reused`. Stores must retain family-revocation
+ * tombstones through the family absolute expiry so a late rotation cannot
+ * recreate a revoked family.
+ */
+export interface RefreshTokenStore {
+    /** Must reject records for a family that has already been revoked. */
+    create(record: RefreshTokenRecord): Promise<void>;
+    consume(tokenHash: string, now: Date): Promise<ConsumeResult>;
+    revokeToken(tokenHash: string, now: Date): Promise<RevokeTokenResult>;
+    revokeFamily(familyId: string, now: Date): Promise<void>;
+    revokeAllForSubject(subject: string, now: Date): Promise<void>;
+}
+//# sourceMappingURL=refresh-store.d.ts.map

package/dist/refresh-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-store.d.ts","sourceRoot":"","sources":["../src/refresh-store.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB,EAAE,IAAI,CAAC;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEzB,MAAM,MAAM,iBAAiB,GAC3B;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE"}

package/dist/refresh-store.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=refresh-store.js.map

package/dist/refresh-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-store.js","sourceRoot":"","sources":["../src/refresh-store.ts"],"names":[],"mappings":""}

package/dist/refresh.d.ts

@@ -0,0 +1,27 @@
+import type { RefreshTokenStore } from "./refresh-store.js";
+export interface IssueRefreshTokenInput {
+    subject: string;
+}
+export interface IssuedRefreshToken {
+    refreshToken: string;
+    familyId: string;
+    subject: string;
+    expiresAt: Date;
+    absoluteExpiresAt: Date;
+}
+export interface RefreshTokenService {
+    issue(input: IssueRefreshTokenInput): Promise<IssuedRefreshToken>;
+    rotate(refreshToken: string): Promise<IssuedRefreshToken>;
+    /** Revoke one active token. Repeated calls and unknown tokens are harmless. */
+    revoke(refreshToken: string): Promise<void>;
+    revokeFamily(familyId: string): Promise<void>;
+    revokeAllForSubject(subject: string): Promise<void>;
+}
+export interface RefreshTokenServiceConfig {
+    store: RefreshTokenStore;
+    refreshTokenTtl: number;
+    absoluteLifetime: number;
+}
+export declare function hashRefreshToken(token: string): string;
+export declare function createRefreshTokenService(config: RefreshTokenServiceConfig): RefreshTokenService;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../src/refresh.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAI5D,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClE,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1D,+EAA+E;IAC/E,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,iBAAiB,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAsBD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,yBAAyB,GAChC,mBAAmB,CAyGrB"}

package/dist/refresh.js

@@ -0,0 +1,93 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { AuthError } from "./errors.js";
+const TOKEN_BYTES = 32;
+export function hashRefreshToken(token) {
+    return createHash("sha256").update(token, "utf8").digest("hex");
+}
+function opaqueToken() {
+    return randomBytes(TOKEN_BYTES).toString("base64url");
+}
+function tokenExpiry(now, ttlSeconds, absoluteExpiresAt) {
+    const idleExpiry = new Date(now.getTime() + ttlSeconds * 1000);
+    return idleExpiry < absoluteExpiresAt
+        ? idleExpiry
+        : new Date(absoluteExpiresAt);
+}
+function invalidRefreshToken(status) {
+    throw new AuthError("REFRESH_TOKEN_INVALID", `Refresh token cannot be used: ${status}`);
+}
+export function createRefreshTokenService(config) {
+    return {
+        async issue({ subject }) {
+            if (typeof subject !== "string" || subject.length === 0) {
+                throw new AuthError("VALIDATION_ERROR", "Refresh-token subject must be a non-empty string");
+            }
+            const now = new Date();
+            const familyId = randomUUID();
+            const absoluteExpiresAt = new Date(now.getTime() + config.absoluteLifetime * 1000);
+            const refreshToken = opaqueToken();
+            const expiresAt = tokenExpiry(now, config.refreshTokenTtl, absoluteExpiresAt);
+            await config.store.create({
+                tokenHash: hashRefreshToken(refreshToken),
+                familyId,
+                subject,
+                createdAt: now,
+                expiresAt,
+                absoluteExpiresAt,
+                status: "active",
+            });
+            return { refreshToken, familyId, subject, expiresAt, absoluteExpiresAt };
+        },
+        async rotate(refreshToken) {
+            if (typeof refreshToken !== "string" || refreshToken.length === 0) {
+                invalidRefreshToken("not_found");
+            }
+            const now = new Date();
+            const result = await config.store.consume(hashRefreshToken(refreshToken), now);
+            if (result.status === "reused") {
+                throw new AuthError("REFRESH_TOKEN_REUSED", "A consumed refresh token was presented again; its family was revoked");
+            }
+            if (result.status !== "ok")
+                invalidRefreshToken(result.status);
+            const { record } = result;
+            const expiresAt = tokenExpiry(now, config.refreshTokenTtl, record.absoluteExpiresAt);
+            if (expiresAt <= now)
+                invalidRefreshToken("expired");
+            const nextRefreshToken = opaqueToken();
+            await config.store.create({
+                tokenHash: hashRefreshToken(nextRefreshToken),
+                familyId: record.familyId,
+                subject: record.subject,
+                createdAt: now,
+                expiresAt,
+                absoluteExpiresAt: record.absoluteExpiresAt,
+                status: "active",
+            });
+            return {
+                refreshToken: nextRefreshToken,
+                familyId: record.familyId,
+                subject: record.subject,
+                expiresAt,
+                absoluteExpiresAt: new Date(record.absoluteExpiresAt),
+            };
+        },
+        async revoke(refreshToken) {
+            if (typeof refreshToken !== "string" || refreshToken.length === 0)
+                return;
+            await config.store.revokeToken(hashRefreshToken(refreshToken), new Date());
+        },
+        async revokeFamily(familyId) {
+            if (typeof familyId !== "string" || familyId.length === 0) {
+                throw new AuthError("VALIDATION_ERROR", "Refresh-token family ID must be a non-empty string");
+            }
+            await config.store.revokeFamily(familyId, new Date());
+        },
+        async revokeAllForSubject(subject) {
+            if (typeof subject !== "string" || subject.length === 0) {
+                throw new AuthError("VALIDATION_ERROR", "Refresh-token subject must be a non-empty string");
+            }
+            await config.store.revokeAllForSubject(subject, new Date());
+        },
+    };
+}
+//# sourceMappingURL=refresh.js.map

package/dist/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../src/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,MAAM,WAAW,GAAG,EAAE,CAAC;AA6BvB,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,GAAS,EAAE,UAAkB,EAAE,iBAAuB;IACzE,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;IAC/D,OAAO,UAAU,GAAG,iBAAiB;QACnC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAA2C;IAE3C,MAAM,IAAI,SAAS,CACjB,uBAAuB,EACvB,iCAAiC,MAAM,EAAE,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAiC;IAEjC,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE;YACrB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,SAAS,CACjB,kBAAkB,EAClB,kDAAkD,CACnD,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,iBAAiB,GAAG,IAAI,IAAI,CAChC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAC/C,CAAC;YACF,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,WAAW,CAC3B,GAAG,EACH,MAAM,CAAC,eAAe,EACtB,iBAAiB,CAClB,CAAC;YACF,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,gBAAgB,CAAC,YAAY,CAAC;gBACzC,QAAQ;gBACR,OAAO;gBACP,SAAS,EAAE,GAAG;gBACd,SAAS;gBACT,iBAAiB;gBACjB,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;YACH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;QAC3E,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,YAAY;YACvB,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,mBAAmB,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CACvC,gBAAgB,CAAC,YAAY,CAAC,EAC9B,GAAG,CACJ,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,sEAAsE,CACvE,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;gBAAE,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAE/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;YAC1B,MAAM,SAAS,GAAG,WAAW,CAC3B,GAAG,EACH,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,iBAAiB,CACzB,CAAC;YACF,IAAI,SAAS,IAAI,GAAG;gBAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAErD,MAAM,gBAAgB,GAAG,WAAW,EAAE,CAAC;YACvC,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,gBAAgB,CAAC,gBAAgB,CAAC;gBAC7C,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,GAAG;gBACd,SAAS;gBACT,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;YACH,OAAO;gBACL,YAAY,EAAE,gBAAgB;gBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS;gBACT,iBAAiB,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;aACtD,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,YAAY;YACvB,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAC1E,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,CAC5B,gBAAgB,CAAC,YAAY,CAAC,EAC9B,IAAI,IAAI,EAAE,CACX,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,QAAQ;YACzB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,SAAS,CACjB,kBAAkB,EAClB,oDAAoD,CACrD,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,OAAO;YAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,SAAS,CACjB,kBAAkB,EAClB,kDAAkD,CACnD,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/testing/index.d.ts

@@ -0,0 +1,3 @@
+export { registerRefreshTokenStoreConformanceTests } from "./refresh-store-conformance.js";
+export type { ConformanceTestRegistrar, RefreshTokenStoreFactory, } from "./refresh-store-conformance.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC;AAC3F,YAAY,EACV,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,gCAAgC,CAAC"}

package/dist/testing/index.js

@@ -0,0 +1,2 @@
+export { registerRefreshTokenStoreConformanceTests } from "./refresh-store-conformance.js";
+//# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC"}