@aiquants/auth-core

Transport- and provider-agnostic authentication core: shared session/profile types, an email/domain allowlist policy, and localizable auth error messages. No framework or Google SDK dependency — pair it with a framework adapter (@aiquants/auth-react-router).

Install

Inside this monorepo it is already wired as a pnpm workspace package:

"dependencies": { "@aiquants/auth-core": "workspace:*" }

API

• AuthenticationPayload, GoogleProfileBase, SessionProfile, MyGoogleProfile — the session/profile types re-homed from the app's @coji/remix-auth-google module augmentation so non-auth code can import them without pulling in remix-auth.
• emailDomainAllowlist(allowedEmails, allowedDomains) → (email) => boolean — trim+lowercase normalized, logical OR of exact-email and domain match, fail-closed (throws when both lists empty). parseAllowlistCsv(raw) parses a comma-separated env value. Domain patterns accept both example.com and @example.com (a leading @ is stripped), because env values are usually written bare while admin UIs tend to teach the @-prefixed form. Matching is exact on the host — example.com never grants evil-example.com or sub.example.com.
• AuthUser / AuthGroup / AuthGroupMember / AuthAllowlistEntry — entity types for a user/group administration surface (see @aiquants/auth-react-router/admin). AuthAllowlistEntry.readOnly marks rows sourced from an immutable provider (e.g. an env var) so the UI can render them as non-deletable.
• defaultAuthMessages / AuthMessages / resolveAuthMessages(over?) — the Japanese login-page error strings, overridable per app.

Session profile shape (byte-compatible contract)

SessionProfile is the exact value persisted in the "__session" cookie under key "user":

{ id, displayName, name: { familyName, givenName }, emails: [{ value }],
  accessToken, refreshToken?, expirationDateMs?, provider, role? }

photo / _json / photos are intentionally excluded. Changing this shape invalidates live 30-day session cookies.

MIT