sentri 2.0.0 → 2.1.0

package/dist/cli.js

@@ -1,19 +1,118 @@
 #!/usr/bin/env node
-import {existsSync,mkdirSync,copyFileSync,writeFileSync,readFileSync}from'fs';import {dirname,join}from'path';import {fileURLToPath}from'url';var x=dirname(fileURLToPath(import.meta.url)),C=["generate"],y=["prisma","drizzle"];function g(){console.log(`
+import {mkdir,writeFile}from'fs/promises';import {existsSync}from'fs';import {join}from'path';var u=`import { createAuthServer } from 'sentri';
+
+type Role = 'admin' | 'user';
+
+export const sentriAuth = createAuthServer<Role>({
+  // -- Roles ------------------------------------------------------------------
+  validRoles: ['admin', 'user'],
+
+  // -- Database ---------------------------------------------------------------
+  db: { connectionString: process.env.DATABASE_URL! },
+
+  // -- Token ------------------------------------------------------------------
+  accessExpiresIn: process.env.JWT_ACCESS_EXPIRES_IN ?? '15m',
+  refreshExpiresIn: process.env.JWT_REFRESH_EXPIRES_IN ?? '7d',
+
+  // -- Security ---------------------------------------------------------------
+  saltRounds: parseInt(process.env.SALT_ROUNDS ?? '12', 10),
+  // apiKey: process.env.API_KEY,  // uncomment to restrict POST /register
+
+  // -- Redis (optional) -------------------------------------------------------
+  // redisUrl: process.env.REDIS_URL,  // uncomment to enable distributed idempotency cache
+
+  // -- Cookie (optional) ------------------------------------------------------
+  // cookie: { secure: true, sameSite: 'strict' },        // refresh token cookie
+  // accessCookie: { secure: true, sameSite: 'strict' },  // access token cookie (SPA)
+
+  // -- Hooks (optional) -------------------------------------------------------
+  // hooks: {
+  //   onLogin: (user) => console.log(\`[\${new Date().toISOString()}] login: \${user.identifier}\`),
+  //   onFailedLogin: (identifier) => console.warn(\`failed login attempt: \${identifier}\`),
+  //   onLogout: (userId) => console.log(\`logout: \${userId}\`),
+  // },
+
+  // -- Token revocation (optional) --------------------------------------------
+  // isTokenRevoked: async (sessionId) => false,
+});
+`,d=`# -- Server -------------------------------------------------------------------
+PORT=3000
+
+# -- Database -----------------------------------------------------------------
+DATABASE_URL=postgresql://user:password@localhost:5432/mydb
+
+# -- Token --------------------------------------------------------------------
+JWT_ACCESS_EXPIRES_IN=15m
+JWT_REFRESH_EXPIRES_IN=7d
+
+# -- Security -----------------------------------------------------------------
+SALT_ROUNDS=12
+# API_KEY=your-register-api-key
+
+# -- Redis (optional) ---------------------------------------------------------
+# REDIS_URL=redis://localhost:6379
+`,m=`import { createAuth } from 'sentri';
+
+type Role = 'admin' | 'user';
+
+export const sentriAuth = createAuth<Role>({
+  mode: 'client',
+
+  // -- Auth server ------------------------------------------------------------
+  // URL of the auth server's GET /auth/keys endpoint (JWKS).
+  // The server must use RS256/RS384/RS512 to expose this endpoint.
+  keyUri: process.env.AUTH_KEY_URI!,
+
+  // -- Roles (optional) -------------------------------------------------------
+  // Only used for TypeScript type safety on authorize() \u2014 not validated at runtime.
+  validRoles: ['admin', 'user'],
+});
+`,v=`# -- Server -------------------------------------------------------------------
+PORT=3000
+
+# -- Auth Server --------------------------------------------------------------
+# URL of the auth server's GET /auth/keys endpoint (JWKS).
+AUTH_KEY_URI=http://localhost:3000/auth/keys
+`;function c(){console.log(`
 sentri \u2014 auth/authorization library for Express
 
 Usage:
-  npx sentri <command> [options]
+  npx sentri <command>
 
 Commands:
-  generate <prisma|drizzle>
-                        Generate adapter, auth config, and schema templates
-                        in src/lib/sentri/ and create a barrel at src/lib/index.ts
-`);}function b(s,t,r,a){if(existsSync(s))if(mkdirSync(dirname(t),{recursive:true}),!existsSync(t))copyFileSync(s,t),console.log(`Created ${a}`);else {let o=readFileSync(s,"utf-8").split(`
-`),f=o.findIndex(l=>l.startsWith(r));if(f!==-1){let l=o.slice(f).join(`
-`).trimEnd(),S=readFileSync(t,"utf-8");writeFileSync(t,S.trimEnd()+`
-
-`+l+`
-`),console.log(`Updated ${a} (tables appended)`);}}}function R(s){(!s||!y.includes(s))&&(console.error(`Error: specify an ORM \u2014 usage: sentri generate <${y.join("|")}>`),process.exit(1));let t=join(x,"..","templates",s),r=join(process.cwd(),"src","lib","sentri"),a=join(r,"adapter.ts"),c=join(r,"auth.ts"),o=join(process.cwd(),"src","lib","index.ts");existsSync(t)||(console.error(`Error: templates for "${s}" not found. Try reinstalling sentri.`),process.exit(1)),(existsSync(a)||existsSync(c))&&(console.error("Error: files already exist in src/lib/sentri/. Remove them first if you want to regenerate."),process.exit(1)),mkdirSync(r,{recursive:true}),copyFileSync(join(t,"adapter.ts"),a),copyFileSync(join(t,"auth.ts"),c),console.log("Created src/lib/sentri/adapter.ts"),console.log("Created src/lib/sentri/auth.ts"),s==="prisma"?b(join(x,"..","templates","prisma","schema.prisma"),join(process.cwd(),"prisma","schema.prisma"),"model ","prisma/schema.prisma"):b(join(t,"schema.ts"),join(r,"schema.ts"),"export ","src/lib/sentri/schema.ts"),existsSync(o)?console.log("Skipped src/lib/index.ts (already exists)"):(mkdirSync(dirname(o),{recursive:true}),writeFileSync(o,`export { createAdapter } from './sentri/adapter.js';
-export { auth } from './sentri/auth.js';
-`),console.log("Created src/lib/index.ts")),console.log(""),console.log("Next steps:"),s==="prisma"?(console.log('  1. Edit prisma/schema.prisma \u2014 change @map("email") to match your column name'),console.log("  2. Set DATABASE_URL and JWT_SECRET in your .env file"),console.log("  3. Run: npx prisma migrate dev && npx prisma generate"),console.log("  4. Edit src/lib/sentri/auth.ts \u2014 update validRoles to match your app")):(console.log("  1. Edit src/lib/sentri/schema.ts \u2014 change text('email') to match your column name"),console.log("  2. Edit src/lib/sentri/auth.ts \u2014 update validRoles to match your app"),console.log("  3. Set JWT_SECRET in your .env file")),console.log("  Mount the router in your Express app:"),console.log("    import { auth } from './lib/sentri/auth.js';"),console.log("    app.use('/auth', auth.router());"),console.log("");}var[,,i,...d]=process.argv;(!i||i==="--help"||i==="-h")&&(g(),process.exit(0));C.includes(i)||(console.error(`Unknown command: ${i}`),g(),process.exit(1));(d.includes("--help")||d.includes("-h"))&&(g(),process.exit(0));i==="generate"&&R(d[0]);
+  init server   Generate src/lib/sentri.ts for server mode (PostgreSQL + JWT signing)
+  init client   Generate src/lib/sentri.ts for client mode (JWT verification via JWKS)
+
+Examples:
+  npx sentri init server
+  npx sentri init client
+`);}async function o(e,t,n){if(existsSync(e)){console.log(`  skip   ${n} (already exists)`);return}await writeFile(e,t,"utf8"),console.log(`  create ${n}`);}async function E(){let e=process.cwd(),t=join(e,"src","lib");await mkdir(t,{recursive:true}),console.log(`
+Generating sentri server mode files...
+`),await o(join(t,"sentri.ts"),u,"src/lib/sentri.ts"),await o(join(e,".env.example"),d,".env.example"),console.log(`
+Done. Next steps:
+
+  1. Copy .env.example to .env and fill in your values
+  2. Add to your app entry point:
+
+       import { sentriAuth } from './lib/sentri.js';
+
+       await sentriAuth.migrate();
+       app.use('/auth', sentriAuth.router());
+       app.use(sentriAuth.errorHandler());
+
+  3. Protect routes:
+
+       app.get('/me', sentriAuth.protect(), (req, res) => res.json(req.user));
+`);}async function S(){let e=process.cwd(),t=join(e,"src","lib");await mkdir(t,{recursive:true}),console.log(`
+Generating sentri client mode files...
+`),await o(join(t,"sentri.ts"),m,"src/lib/sentri.ts"),await o(join(e,".env.example"),v,".env.example"),console.log(`
+Done. Next steps:
+
+  1. Copy .env.example to .env and set AUTH_KEY_URI to your auth server's /auth/keys endpoint
+  2. Add to your app entry point:
+
+       import { sentriAuth } from './lib/sentri.js';
+
+       app.get('/protected', sentriAuth.protect(), (req, res) => res.json(req.user));
+       app.use(sentriAuth.errorHandler());
+`);}var h=process.argv.slice(2),[s,i]=h;(!s||s==="--help"||s==="-h")&&(c(),process.exit(0));s==="init"?i==="server"?E().catch(e=>{console.error(e),process.exit(1);}):i==="client"?S().catch(e=>{console.error(e),process.exit(1);}):(console.error("Usage: npx sentri init <server|client>"),process.exit(1)):(console.error(`Unknown command: ${s}`),c(),process.exit(1));