@askrjs/server/auth
Exports from the declarations published in @askrjs/server. Signatures reflect the published artifact.
Exports
This entrypoint publishes 7 exports. Use the anchored symbol rows for direct links. Type-only exports are labeled separately from runtime values.
AuthCredentialstype
AuthCredentials: anyEmail/password credentials submitted to the register or authenticate endpoints.
email- email: string;
password- password: string;
AuthRouteErrortype
AuthRouteError: typeof AuthRouteErrorError thrown from `register`/`authenticate`/etc. callbacks to short-circuit an auth route with a specific status.
status- readonly status: 401 | 409 | 429;
AuthRouteOptionstype
AuthRouteOptions: anyConfiguration for {@link registerAuthRoutes}.
issuer- issuer: TokenIssuer<P>;
cookie- cookie: CookieOptions & { name: string; };
principalSchema- principalSchema: Schema;
register- register(context: ServerContext, credentials: AuthCredentials): P | Promise<P>;
authenticate- authenticate(context: ServerContext, credentials: AuthCredentials): P | null | Promise<P | null>;
allowAttempt- allowAttempt(context: ServerContext, operation: "register" | "authenticate", normalizedEmail: string): boolean | Promise<boolean>;
revoke- revoke?(context: ServerContext): void | Promise<void>;
redirect- redirect?: (context: ServerContext, operation: "register" | "authenticate", principal: P) => string | undefined;
registerAuthRoutestype
registerAuthRoutes: <Dependencies, P extends Principal>(api: Pick<ApiDefinition<Dependencies>, "group">, options: AuthRouteOptions<P>) => voidRegisters a standard set of authentication routes (`POST /auth/v1/accounts`, `GET/POST /auth/v1/session`, `DELETE /auth/v1/session`) on an OpenAPI-style API/group, handling registration, login, session lookup, and logout with CSRF protection via a same-origin `Origin` header check, per-attempt rate limiting, and cookie-based token storage.
safeRedirecttype
safeRedirect: (fallback: string, options?: SafeRedirectOptions) => (value: unknown) => stringCreates a validator that resolves an untrusted redirect target to a safe, same-origin, relative path — or to `fallback` if the value is unsafe (absolute, protocol-relative, contains a scheme, control characters, `..` traversal, backslashes, or an unwanted hash).
SafeRedirectOptionstype
SafeRedirectOptions: anyOptions for {@link safeRedirect}.
allowHash- Allow redirect targets that include a URL fragment (`#...`). Defaults to disallowed.
TokenIssuertype
TokenIssuer: anyIssues auth tokens for a principal, used by {@link registerAuthRoutes} to mint session tokens.
issue- issue(principal: Omit<P, "id"> & { subject: string; }): Promise<string>;