sentri 1.0.5 → 1.1.0

package/README.md

@@ -1,6 +1,6 @@
 # sentri
 
-Auth and authorization library for Express + PostgreSQL. Provides JWT-based authentication with refresh token rotation, role-based access control, fine-grained permission checks, and a pre-built Express router — all behind a single typed client.
+Auth and authorization library for Express + PostgreSQL. Provides JWT-based authentication with session-bound access tokens, refresh token rotation, role-based access control, fine-grained permission checks, and a pre-built Express router — all behind a single typed client.
 
 ---
 
@@ -10,6 +10,7 @@ Auth and authorization library for Express + PostgreSQL. Provides JWT-based auth
 - [Quick Start](#quick-start)
 - [CLI](#cli)
 - [Configuration](#configuration)
+- [Custom Route Handlers](#custom-route-handlers)
 - [Adapter Interface](#adapter-interface)
 - [Pre-built Router](#pre-built-router)
 - [Middleware](#middleware)
@@ -98,7 +99,7 @@ npx sentri generate drizzle
 import { createAuth } from 'sentri';
 
 export const auth = createAuth({
-  secret: process.env.JWT_SECRET!,        // required — keep in env
+  secret: process.env.JWT_SECRET!,        // required — keep in env, min 32 chars
   validRoles: ['user', 'admin'] as const, // required — use `as const` for type safety
   adapter: myAdapter,                     // required — see Adapter Interface
 
@@ -108,6 +109,10 @@ export const auth = createAuth({
   algorithm: 'HS256',       // default: 'HS256' — also 'HS384' | 'HS512'
   saltRounds: 12,           // default: 12 (bcrypt rounds, min 10)
 
+  // Restrict POST /register to callers that supply X-Api-Key header.
+  // When set, only requests with this exact key can create new accounts.
+  apiKey: process.env.REGISTER_API_KEY,  // optional
+
   cookie: {                 // optional — enables httpOnly cookie for refresh token
     secure: process.env.NODE_ENV === 'production',
     // name: 'refresh_token',  // default: 'refresh_token'
@@ -115,6 +120,15 @@ export const auth = createAuth({
     // sameSite: 'strict',      // default: 'strict'
     // path: '/',               // default: '/'
   },
+
+  // router: {             // optional — replace built-in service logic per route
+  //   login: async (input) => { ... },
+  //   register: async (input) => { ... },
+  //   refresh: async (refreshToken) => { ... },
+  //   logout: async (refreshToken) => { ... },
+  //   logoutAll: async (userId) => { ... },
+  //   assignRoles: async (userId, roles) => { ... },
+  // },
 });
 ```
 
@@ -124,6 +138,111 @@ When `cookie` is configured, the refresh token is stored in an httpOnly cookie a
 
 ---
 
+## apiKey — Restricting Registration
+
+By default `POST /register` is open to the public. This can be a security risk when your application allows role selection at registration time — any caller could register themselves as `admin`.
+
+Set `apiKey` in your config to lock the endpoint:
+
+```typescript
+export const auth = createAuth({
+  // ...
+  apiKey: process.env.REGISTER_API_KEY!,
+});
+```
+
+Requests to `POST /register` must then include the header:
+
+```
+X-Api-Key: <value of REGISTER_API_KEY>
+```
+
+Requests without the header, or with the wrong value, receive HTTP 401 `UNAUTHORIZED`. Keep the API key in an environment variable and share it only with trusted services (your back-office panel, CI scripts, etc.).
+
+---
+
+## Session-Bound Access Tokens
+
+Since version 1.1.0, access tokens embed the `sessionId` of the session that was created at login. The `protect()` middleware validates this session against the database on every request.
+
+**What this means in practice:**
+
+- `POST /logout` deletes the session. Any access token issued during that login is immediately rejected — even if it has not expired yet.
+- `POST /logout-all` deletes **all** sessions for the user. Every access token across all devices is immediately rejected.
+- Tokens issued before 1.1.0 (without the `sessionId` claim) are still accepted but bypass session validation — plan a rolling upgrade if you need strict enforcement for existing tokens.
+
+```
+Login  →  session created  →  access token embeds sessionId
+Request → protect() verifies JWT → checks session exists → ✓ allowed
+Logout  → session deleted
+Request → protect() verifies JWT → session not found → ✗ 401 UNAUTHORIZED
+```
+
+> **Trade-off:** `protect()` now performs one additional database read per request. For most applications this is negligible. If you need to avoid any per-request DB access, keep `accessExpiresIn` short (e.g. `'5m'`) and rely on token expiry instead — but note that tokens will remain valid for up to `accessExpiresIn` after logout.
+
+---
+
+## Custom Route Handlers
+
+The `router` field in config lets you replace the built-in service logic for individual routes while the router still handles request parsing, input validation, and response formatting.
+
+Each key is optional — only override what you need. Any key you omit falls back to the built-in behaviour.
+
+```typescript
+import { createAuth, AuthError } from 'sentri';
+import type { AuthResult } from 'sentri';
+
+export const auth = createAuth({
+  secret: process.env.JWT_SECRET!,
+  validRoles: ['user', 'admin'] as const,
+  adapter: myAdapter,
+
+  router: {
+    // Add an OTP check before issuing tokens
+    login: async (input): Promise<AuthResult> => {
+      const otpVerified = await redis.get(`otp:${input.identifier}`);
+      if (!otpVerified) {
+        return { success: false, error: new AuthError('INVALID_CREDENTIALS', 'OTP required') };
+      }
+      return defaultLogin(input);
+    },
+
+    // Send a welcome email after registration
+    register: async (input) => {
+      const result = await defaultRegister(input);
+      if (result.success) {
+        await emailService.sendWelcome(input.identifier);
+      }
+      return result;
+    },
+
+    // Audit-log every token rotation
+    refresh: async (refreshToken) => {
+      const result = await defaultRefresh(refreshToken);
+      if (result.success) {
+        await auditLog.record('token_rotated', result.user.id);
+      }
+      return result;
+    },
+  },
+});
+```
+
+### Available handler signatures
+
+| Key | Signature | Must return |
+|---|---|---|
+| `register` | `(input: SignupInput) => Promise<SignupResult>` | `SignupResult` |
+| `login` | `(input: LoginInput) => Promise<AuthResult>` | `AuthResult` |
+| `refresh` | `(refreshToken: string) => Promise<RefreshResult>` | `RefreshResult` |
+| `logout` | `(refreshToken: string \| undefined) => Promise<void>` | `void` |
+| `logoutAll` | `(userId: string) => Promise<void>` | `void` |
+| `assignRoles` | `(userId: string, roles: string[]) => Promise<AssignRolesResult>` | `AssignRolesResult` |
+
+The router always validates the request body and URL parameters before calling any handler. Your function receives the already-validated, trimmed input.
+
+---
+
 ## Adapter Interface
 
 The adapter connects sentri to your database. Implement `AuthAdapter` for any ORM or data layer.
@@ -168,7 +287,7 @@ import { createAdapter } from './adapter.js';
 export const adapter = createAdapter(db);
 ```
 
-`createAdapter` throws an `AdapterConfigError` at runtime if called without a `db` argument.
+`createAdapter` throws `AuthError` with code `CONFIGURATION_ERROR` at runtime if called without a `db` argument.
 
 ---
 
@@ -187,11 +306,12 @@ export const adapter = createAdapter(db);
 
 ### Endpoints
 
-#### `POST /signup`
+#### `POST /register`
 
-Register a new user. Does **not** issue tokens — call `/login` after signup.
+Register a new user. Does **not** issue tokens — call `/login` after registration.
 
 ```
+Headers: X-Api-Key: <key>   (required when config.apiKey is set)
 Body:    { identifier, password, roles?: string[] }
 Returns: { user: { id, identifier, roles } }
 Status:  201
@@ -239,7 +359,7 @@ Returns: null
 Status:  200
 ```
 
-Safe to call even if the cookie is missing or the token is already expired.
+After logout, any access token bound to this session is immediately rejected by `protect()`. Safe to call even if the cookie is missing or the token is already expired.
 
 ---
 
@@ -253,6 +373,8 @@ Returns: null
 Status:  200
 ```
 
+All access tokens across all devices are immediately rejected by `protect()` after this call.
+
 ---
 
 #### `GET /me`
@@ -284,14 +406,19 @@ Status:  200
 
 ### `auth.protect()`
 
-Verifies the `Authorization: Bearer <token>` header and injects `req.user` into the request.
+Verifies the `Authorization: Bearer <token>` header, confirms the session is still active in the database, and injects `request.user` into the request.
 
 ```typescript
-router.get('/dashboard', auth.protect(), (req, res) => {
-  res.json(req.user); // { id, identifier, roles }
+router.get('/dashboard', auth.protect(), (request, response) => {
+  response.json(request.user); // { id, identifier, roles }
 });
 ```
 
+Returns HTTP 401 if:
+- The `Authorization` header is missing or malformed
+- The token signature is invalid or the token is expired
+- The session embedded in the token has been revoked (logout)
+
 ---
 
 ### `auth.authorize(...roles)`
@@ -341,43 +468,21 @@ router.delete(
 
 ## Programmatic API
 
-All methods are available on the auth client for use outside the built-in router.
+Token and password utilities are available on the auth client for use outside the built-in router.
 
 ```typescript
-// Auth
-const result = await auth.signup({ identifier: 'user@example.com', password: 'secret123' });
-const result = await auth.login({ identifier: 'user@example.com', password: 'secret123' });
-const result = await auth.refresh(refreshToken);
-await auth.logout(refreshToken);
-await auth.logoutAll(userId);
-
-// Roles
-const result = await auth.assignRoles(userId, ['admin']);
-// Merges with existing roles — result.user.roles has the full updated list
-
 // Token utilities
 const accessToken = auth.signAccessToken({ id, identifier, roles });
 const user = auth.verifyAccessToken(accessToken);         // throws AuthError if invalid
 const { sessionId } = auth.verifyRefreshToken(token);    // throws AuthError if invalid
+const refreshToken = auth.signRefreshToken(sessionId);
 
 // Password utilities
 const hash = await auth.hashPassword('secret123');
 const valid = await auth.verifyPassword('secret123', hash);
 ```
 
-All auth methods return a discriminated union — check `result.success` before accessing data:
-
-```typescript
-const result = await auth.login({ identifier, password });
-
-if (!result.success) {
-  console.error(result.error.code);   // 'INVALID_CREDENTIALS'
-  console.error(result.error.message);
-  return;
-}
-
-const { accessToken, refreshToken, user } = result;
-```
+`verifyAccessToken` and `verifyRefreshToken` throw `AuthError` with code `TOKEN_EXPIRED` or `TOKEN_INVALID` — wrap them in a try/catch or use the router which handles this automatically.
 
 ---
 
@@ -396,6 +501,7 @@ import type {
   ApiResponse,
   SignupInput,
   LoginInput,
+  RouterHandlers,
   UserRecord,
   SessionRecord,
   CreateUserData,
@@ -417,11 +523,11 @@ All errors thrown by the library are instances of `AuthError` with a machine-rea
 | Code | HTTP | Meaning |
 |---|---|---|
 | `INVALID_CREDENTIALS` | 401 | Wrong identifier or password |
-| `USER_ALREADY_EXISTS` | 409 | Signup with duplicate identifier |
+| `USER_ALREADY_EXISTS` | 409 | Registration with duplicate identifier |
 | `USER_NOT_FOUND` | 404 | Operation on a non-existent user |
 | `TOKEN_EXPIRED` | 401 | JWT `exp` claim is in the past |
 | `TOKEN_INVALID` | 401 | JWT signature invalid or malformed |
-| `UNAUTHORIZED` | 401 | No valid access token on the request |
+| `UNAUTHORIZED` | 401 | No valid access token, revoked session, or invalid API key |
 | `FORBIDDEN` | 403 | Authenticated but missing required role |
 | `INVALID_ROLE` | 400 | Role name not in `validRoles` |
 | `VALIDATION_ERROR` | 400 | Missing or invalid input field |
@@ -432,17 +538,47 @@ The built-in router converts all `AuthError` instances to the standard envelope
 ```typescript
 import { AuthError } from 'sentri';
 
-app.use((err, req, res, next) => {
-  if (err instanceof AuthError) {
-    const status =
-      err.code === 'UNAUTHORIZED' || err.code === 'TOKEN_EXPIRED' || err.code === 'TOKEN_INVALID' || err.code === 'INVALID_CREDENTIALS' ? 401
-      : err.code === 'FORBIDDEN' ? 403
-      : err.code === 'USER_NOT_FOUND' ? 404
-      : err.code === 'USER_ALREADY_EXISTS' ? 409
-      : 400;
+const AUTH_ERROR_STATUS: Record<string, number> = {
+  UNAUTHORIZED: 401,
+  TOKEN_EXPIRED: 401,
+  TOKEN_INVALID: 401,
+  INVALID_CREDENTIALS: 401,
+  FORBIDDEN: 403,
+  USER_NOT_FOUND: 404,
+  USER_ALREADY_EXISTS: 409,
+  INVALID_ROLE: 400,
+  VALIDATION_ERROR: 400,
+  CONFIGURATION_ERROR: 500,
+};
 
-    return res.status(status).json({ error: true, statusCode: status, message: err.message, data: null });
+app.use((error, _request, response, next) => {
+  if (error instanceof AuthError) {
+    const statusCode = AUTH_ERROR_STATUS[error.code] ?? 500;
+    return response.status(statusCode).json({
+      error: true,
+      statusCode,
+      code: error.code,
+      message: error.message,
+      data: null,
+    });
   }
-  next(err);
+  next(error);
 });
 ```
+
+---
+
+## Migration from 1.0.x
+
+### Breaking changes
+
+| What changed | Action required |
+|---|---|
+| `POST /signup` renamed to `POST /register` | Update all client-side calls |
+| `RouterHandlers.signup` renamed to `RouterHandlers.register` | Update config if you used a custom signup handler |
+| `protect()` now performs one DB read per request | Ensure your adapter's `session.findById` is indexed on session ID |
+
+### New features
+
+- **Session-bound tokens** — access tokens are immediately invalidated after logout without waiting for expiry.
+- **`apiKey` config** — lock `POST /register` to trusted callers via `X-Api-Key` header.

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import type { PermitCheck, PermitOptions } from './middleware/permit.js';
-import type { AssignRolesResult, AuthConfig, AuthResult, AuthUser, LoginInput, RefreshResult, SignupInput, SignupResult } from './types/auth.js';
+import type { AuthConfig, AuthUser } from './types/auth.js';
 import type { RequestHandler, Router } from 'express';
 /**
  * The bound auth client returned by {@link createAuth}.
@@ -8,61 +8,18 @@ import type { RequestHandler, Router } from 'express';
  * you never need to pass config around yourself.
  *
  * `TRole` is inferred from `validRoles` and narrows role strings to your
- * application's exact union type everywhere (signup, authorize, req.user, etc.).
+ * application's exact union type everywhere (authorize, req.user, etc.).
  */
 export interface AuthClient<TRole extends string = string> {
-    /**
-     * Register a new user.
-     *
-     * Validates that every requested role is in `validRoles`, rejects duplicate
-     * identifiers, hashes the password, creates the user record, and returns the
-     * created user. No tokens are issued — call `login` after signup.
-     */
-    signup(input: SignupInput<TRole>): Promise<SignupResult<TRole>>;
-    /**
-     * Authenticate an existing user by email and password.
-     *
-     * On success, creates a new session and returns an access + refresh token pair.
-     * Returns `{ success: false, error }` with code `INVALID_CREDENTIALS` on any
-     * mismatch (intentionally vague to prevent user enumeration).
-     */
-    login(input: LoginInput): Promise<AuthResult<TRole>>;
-    /**
-     * Exchange a valid refresh token for a new access + refresh token pair.
-     *
-     * Verifies the JWT, looks up the session in the database, checks expiry,
-     * then **rotates** the session: the old session is deleted and a new one is
-     * created. Old refresh tokens are immediately invalidated.
-     */
-    refresh(refreshToken: string): Promise<RefreshResult<TRole>>;
-    /**
-     * Invalidate a single session identified by the refresh token.
-     *
-     * Safe to call even if the token is already expired — it will simply
-     * attempt a DB delete and resolve.
-     */
-    logout(refreshToken: string): Promise<void>;
-    /**
-     * Delete all sessions for a user, effectively logging them out of every device.
-     *
-     * @param userId - The user's primary key as stored in the database.
-     */
-    logoutAll(userId: string): Promise<void>;
-    /**
-     * Add roles to another user. Merges the given roles with the user's existing
-     * roles (no duplicates). The built-in router exposes this as
-     * `POST /users/:userId/roles` and restricts it to users with the `admin` role.
-     */
-    assignRoles(userId: string, roles: string[]): Promise<AssignRolesResult<TRole>>;
     /**
      * Express middleware factory that enforces authentication.
      *
      * Reads the `Authorization: Bearer <token>` header, verifies the access token,
-     * and injects the decoded payload as `req.user`. Calls `next(AuthError)` on failure.
+     * and injects the decoded payload as `request.user`. Calls `next(AuthError)` on failure.
      *
      * @example
-     * router.get('/me', auth.protect(), (req, res) => {
-     *   res.json(req.user);
+     * router.get('/me', auth.protect(), (request, response) => {
+     *   response.json(request.user);
      * });
      */
     protect(): RequestHandler;
@@ -77,36 +34,6 @@ export interface AuthClient<TRole extends string = string> {
      * router.delete('/posts/:id', auth.protect(), auth.authorize('admin'), handler);
      */
     authorize(...roles: TRole[]): RequestHandler;
-    /** Hash a plain-text password using the configured `saltRounds`. */
-    hashPassword(plain: string): Promise<string>;
-    /** Compare a plain-text password against a stored bcrypt hash. */
-    verifyPassword(plain: string, hash: string): Promise<boolean>;
-    /** Sign an access token for the given user payload. */
-    signAccessToken(payload: AuthUser<TRole>): string;
-    /** Sign a refresh token bound to a session ID. */
-    signRefreshToken(sessionId: string): string;
-    /** Verify and decode an access token. Throws `AuthError` if invalid or expired. */
-    verifyAccessToken(token: string): AuthUser<TRole>;
-    /** Verify and decode a refresh token. Throws `AuthError` if invalid or expired. */
-    verifyRefreshToken(token: string): {
-        sessionId: string;
-    };
-    /**
-     * Returns a pre-built Express Router with all standard auth endpoints mounted:
-     *
-     * - `POST /signup` — register, returns `{ user }`
-     * - `POST /login` — authenticate, sets refresh token cookie, returns `{ accessToken, user }`
-     * - `POST /refresh` — reads refresh token from cookie, returns `{ accessToken }`
-     * - `POST /logout` — invalidate current session
-     * - `POST /logout-all` — invalidate all sessions (requires valid access token)
-     *
-     * Requires `express.json()` to be applied before the router.
-     *
-     * @example
-     * app.use(express.json());
-     * app.use('/auth', auth.router());
-     */
-    router(): Router;
     /**
      * Express middleware factory for resource-level permission checks.
      *
@@ -120,7 +47,7 @@ export interface AuthClient<TRole extends string = string> {
      * // User can only update their own profile
      * router.put('/users/:id',
      *   auth.protect(),
-     *   auth.permit((req) => req.user!.id === req.params['id']),
+     *   auth.permit((request) => request.user!.id === request.params['id']),
      *   handler,
      * );
      *
@@ -130,9 +57,9 @@ export interface AuthClient<TRole extends string = string> {
      *   auth.protect(),
      *   auth.permit({
      *     roles: ['admin'],
-     *     check: async (req) => {
-     *       const post = await db.post.findUnique({ where: { id: req.params['id'] } });
-     *       return post?.authorId === req.user!.id;
+     *     check: async (request) => {
+     *       const post = await db.post.findUnique({ where: { id: request.params['id'] } });
+     *       return post?.authorId === request.user!.id;
      *     },
      *   }),
      *   handler,
@@ -140,6 +67,40 @@ export interface AuthClient<TRole extends string = string> {
      */
     permit(check: PermitCheck): RequestHandler;
     permit(options: PermitOptions<TRole>): RequestHandler;
+    /** Hash a plain-text password using the configured `saltRounds`. */
+    hashPassword(plain: string): Promise<string>;
+    /** Compare a plain-text password against a stored bcrypt hash. */
+    verifyPassword(plain: string, hash: string): Promise<boolean>;
+    /** Sign an access token for the given user payload. */
+    signAccessToken(payload: AuthUser<TRole>): string;
+    /** Sign a refresh token bound to a session ID. */
+    signRefreshToken(sessionId: string): string;
+    /** Verify and decode an access token. Throws `AuthError` if invalid or expired. */
+    verifyAccessToken(token: string): AuthUser<TRole>;
+    /** Verify and decode a refresh token. Throws `AuthError` if invalid or expired. */
+    verifyRefreshToken(token: string): {
+        sessionId: string;
+    };
+    /**
+     * Returns a pre-built Express Router with all standard auth endpoints mounted:
+     *
+     * - `POST /register` — register a new user, returns `{ user }`.
+     *   Requires `X-Api-Key` header when `config.apiKey` is set.
+     * - `POST /login` — authenticate, sets refresh token cookie, returns `{ accessToken, user }`
+     * - `POST /refresh` — reads refresh token from cookie, returns `{ accessToken }`
+     * - `POST /logout` — invalidate the current session; any access token bound to
+     *   this session is immediately rejected by `protect()`.
+     * - `POST /logout-all` — invalidate all sessions for the user (requires valid access token)
+     * - `GET  /me` — return the authenticated user
+     * - `POST /users/:userId/roles` — assign roles (requires admin)
+     *
+     * Requires `express.json()` to be applied before the router.
+     *
+     * @example
+     * app.use(express.json());
+     * app.use('/auth', auth.router());
+     */
+    router(): Router;
 }
 /**
  * Create a fully configured auth client for your application.

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,KAAK,EACV,iBAAiB,EACjB,UAAU,EACV,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,EACb,WAAW,EACX,YAAY,EACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM;IACvD;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAEhE;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAErD;;;;;;OAMG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAE7D;;;;;OAKG;IACH,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5C;;;;OAIG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC;;;;OAIG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;IAEhF;;;;;;;;;;OAUG;IACH,OAAO,IAAI,cAAc,CAAC;IAE1B;;;;;;;;;OASG;IACH,SAAS,CAAC,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC;IAE7C,oEAAoE;IACpE,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7C,kEAAkE;IAClE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D,uDAAuD;IACvD,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;IAElD,kDAAkD;IAClD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAE5C,mFAAmF;IACnF,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElD,mFAAmF;IACnF,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzD;;;;;;;;;;;;;;OAcG;IACH,MAAM,IAAI,MAAM,CAAC;IAEjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CAAC;IAC3C,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC;CACvD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,UAAU,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,EACtD,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,GACxB,UAAU,CAAC,KAAK,CAAC,CAsBnB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM;IACvD;;;;;;;;;;OAUG;IACH,OAAO,IAAI,cAAc,CAAC;IAE1B;;;;;;;;;OASG;IACH,SAAS,CAAC,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CAAC;IAC3C,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC;IAEtD,oEAAoE;IACpE,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7C,kEAAkE;IAClE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D,uDAAuD;IACvD,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;IAElD,kDAAkD;IAClD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAE5C,mFAAmF;IACnF,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElD,mFAAmF;IACnF,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzD;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,IAAI,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,UAAU,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,EACtD,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,GACxB,UAAU,CAAC,KAAK,CAAC,CAgBnB"}

package/dist/client.js

@@ -1,7 +1,6 @@
 import { hashPassword, verifyPassword } from './libs/hash.js';
 import { signAccessToken, signRefreshToken, verifyAccessToken, verifyRefreshToken } from './libs/token.js';
 import { resolveConfig, validateConfig } from './libs/config.js';
-import { signup, login, refresh, logout, logoutAll, assignRoles } from './services/auth.js';
 import { protect } from './middleware/protect.js';
 import { authorize } from './middleware/authorize.js';
 import { permit } from './middleware/permit.js';
@@ -29,12 +28,6 @@ export function createAuth(config) {
     validateConfig(config);
     const resolved = resolveConfig(config);
     return {
-        signup: (input) => signup(input, config),
-        login: (input) => login(input, config),
-        refresh: (refreshToken) => refresh(refreshToken, config),
-        logout: (refreshToken) => logout(refreshToken, config),
-        logoutAll: (userId) => logoutAll(userId, config),
-        assignRoles: (userId, roles) => assignRoles(userId, roles, config),
         protect: () => protect(config),
         authorize: (...roles) => authorize(...roles),
         hashPassword: (plain) => hashPassword(plain, resolved.saltRounds),

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC3G,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAwK1D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,UAAU,CACxB,MAAyB;IAEzB,cAAc,CAAC,MAAoB,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAoB,CAAC,CAAC;IAErD,OAAO;QACL,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAoB,EAAE,MAAoB,CAAiC;QACrG,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,MAAoB,CAA+B;QAClF,OAAO,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,MAAoB,CAAkC;QACvG,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,MAAoB,CAAC;QACpE,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAoB,CAAC;QAC9D,WAAW,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,MAAoB,CAAsC;QACrH,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAoB,CAAC;QAC5C,SAAS,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;QAC5C,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC;QACjE,cAAc,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC;QAC5D,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAmB,EAAE,MAAoB,CAAC;QACxF,gBAAgB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAoB,CAAC;QAClF,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAoB,CAAoB;QAC/F,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAoB,CAAC;QAC9E,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACtC,MAAM,EAAE,CAAC,cAAkD,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;KACvF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC3G,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAkH1D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,UAAU,CACxB,MAAyB;IAEzB,cAAc,CAAC,MAAoB,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAoB,CAAC,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAoB,CAAC;QAC5C,SAAS,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;QAC5C,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC;QACjE,cAAc,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC;QAC5D,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAmB,EAAE,MAAoB,CAAC;QACxF,gBAAgB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAoB,CAAC;QAClF,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAoB,CAAoB;QAC/F,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAoB,CAAC;QAC9E,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACtC,MAAM,EAAE,CAAC,cAAkD,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;KACvF,CAAC;AACJ,CAAC"}

package/dist/errors/AuthError.d.ts

@@ -17,19 +17,20 @@ export type AuthErrorCode = 'INVALID_CREDENTIALS' | 'USER_NOT_FOUND' | 'USER_ALR
  * Error class thrown by the library for all authentication and authorization failures.
  *
  * Carries a machine-readable `code` that lets you distinguish error types without
- * string-matching on the message:
+ * string-matching on the message.
  *
  * @example
- * import { AuthError } from 'rizzzdev-auth';
+ * import { AuthError } from 'sentri';
  *
- * app.use((err, req, res, next) => {
- *   if (err instanceof AuthError) {
- *     const status = err.code === 'UNAUTHORIZED' ? 401
- *       : err.code === 'FORBIDDEN' ? 403
+ * app.use((error, _request, response, next) => {
+ *   if (error instanceof AuthError) {
+ *     const status =
+ *       error.code === 'UNAUTHORIZED' ? 401
+ *       : error.code === 'FORBIDDEN' ? 403
  *       : 400;
- *     res.status(status).json({ error: err.code, message: err.message });
+ *     response.status(status).json({ error: error.code, message: error.message });
  *   } else {
- *     next(err);
+ *     next(error);
  *   }
  * });
  */

package/dist/errors/AuthError.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthError.d.ts","sourceRoot":"","sources":["../../src/errors/AuthError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GACrB,qBAAqB,GACrB,gBAAgB,GAChB,qBAAqB,GACrB,eAAe,GACf,eAAe,GACf,WAAW,GACX,cAAc,GACd,cAAc,GACd,kBAAkB,GAClB,qBAAqB,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAgB,IAAI,EAAE,aAAa,CAAC;gBAExB,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM;CAKjD"}
+{"version":3,"file":"AuthError.d.ts","sourceRoot":"","sources":["../../src/errors/AuthError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GACrB,qBAAqB,GACrB,gBAAgB,GAChB,qBAAqB,GACrB,eAAe,GACf,eAAe,GACf,WAAW,GACX,cAAc,GACd,cAAc,GACd,kBAAkB,GAClB,qBAAqB,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAgB,IAAI,EAAE,aAAa,CAAC;gBAExB,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM;CAKjD"}

package/dist/errors/AuthError.js

@@ -2,19 +2,20 @@
  * Error class thrown by the library for all authentication and authorization failures.
  *
  * Carries a machine-readable `code` that lets you distinguish error types without
- * string-matching on the message:
+ * string-matching on the message.
  *
  * @example
- * import { AuthError } from 'rizzzdev-auth';
+ * import { AuthError } from 'sentri';
  *
- * app.use((err, req, res, next) => {
- *   if (err instanceof AuthError) {
- *     const status = err.code === 'UNAUTHORIZED' ? 401
- *       : err.code === 'FORBIDDEN' ? 403
+ * app.use((error, _request, response, next) => {
+ *   if (error instanceof AuthError) {
+ *     const status =
+ *       error.code === 'UNAUTHORIZED' ? 401
+ *       : error.code === 'FORBIDDEN' ? 403
  *       : 400;
- *     res.status(status).json({ error: err.code, message: err.message });
+ *     response.status(status).json({ error: error.code, message: error.message });
  *   } else {
- *     next(err);
+ *     next(error);
  *   }
  * });
  */

package/dist/errors/AuthError.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthError.js","sourceRoot":"","sources":["../../src/errors/AuthError.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClB,IAAI,CAAgB;IAEpC,YAAY,IAAmB,EAAE,OAAe;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"AuthError.js","sourceRoot":"","sources":["../../src/errors/AuthError.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClB,IAAI,CAAgB;IAEpC,YAAY,IAAmB,EAAE,OAAe;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/index.d.ts

@@ -6,7 +6,7 @@ declare global {
         }
     }
 }
-export type { AuthConfig, CookieConfig, AuthUser, AuthResult, SignupResult, AssignRolesResult, RefreshResult, ApiResponse, SignupInput, LoginInput, AuthAdapter, UserRecord, SessionRecord, CreateUserData, } from './types/auth.js';
+export type { AuthConfig, CookieConfig, AuthUser, ApiResponse, AuthAdapter, UserRecord, SessionRecord, CreateUserData, RouterHandlers, SignupInput, LoginInput, SignupResult, AuthResult, RefreshResult, AssignRolesResult, } from './types/auth.js';
 export type { AuthErrorCode } from './errors/AuthError.js';
 export type { AuthClient } from './client.js';
 export { AuthError } from './errors/AuthError.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,QAAQ,CAAC;SACjB;KACF;CACF;AAED,YAAY,EACV,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,WAAW,EACX,UAAU,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,QAAQ,CAAC;SACjB;KACF;CACF;AAED,YAAY,EACV,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,WAAW,EACX,UAAU,EACV,YAAY,EACZ,UAAU,EACV,aAAa,EACb,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}