Skip to content

v0.63.0

Auth: full system — opaque tokens, social OAuth, basic auth (v0.63.0)
@tshafer tshafer tagged this 11 Jul 19:16 
Round out authentication against the AdonisJS auth guides (session + JWT
already existed), all edge-native (Web Crypto + fetch, no native deps):

- Opaque access tokens (tokens.ts): revocable, ability-scoped, DB-backed
  bearer tokens. createToken/verifyToken/revokeToken(s)/listTokens,
  tokenAllows/Denies, setTokensTable + tokenAuth() guard with abilities.
  Split selector/verifier, SHA-256 hash storage, no RETURNING needed.
- Social sign-in (social.ts): fetch-based OAuth2 with GitHub/Google/Discord
  presets + social.driver() for any provider; normalized SocialUser;
  redirect/exchangeCode/userFromToken/user, oauthState, OAuthError.
- basicAuth() guard with WWW-Authenticate challenge.
- hash.dummy for timing-safe credential verification (anti-enumeration).
- gateAfter() to complete authorization parity with gateBefore.

+13 tests (401 total), incl. real node:sqlite backend for the token store
and mocked fetch for OAuth. New docs/social-auth.md guide.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tn7UJG3uSLwPcWaKo9gHgC
Assets 2
Loading