@crossfox/elysia-auth

Auth for Elysia on Bun: opaque access/refresh tokens (hashed at rest), login, refresh rotation, password reset, OAuth (Google / Facebook / Instagram via Meta).

Peers: @crossfox/elysia-kit, elysia.

Install

bun add @crossfox/elysia-auth @crossfox/elysia-kit elysia

Quick start

import { createApp } from "@crossfox/elysia-kit";
import {
  createAuth,
  createMemoryAuthStore,
  hashPassword,
} from "@crossfox/elysia-auth";

const store = createMemoryAuthStore();
store.seedUser({
  id: 1,
  email: "[email protected]",
  role: "user",
  passwordHash: await hashPassword("secret-pass"),
});

const auth = createAuth({
  baseUrl: "https://api.example.com",
  users: store.users,
  tokens: store.tokens,
  resets: store.resets,
  mailer: {
    async sendPasswordReset({ to, resetUrl }) {
      console.log("reset", to, resetUrl);
    },
  },
  frontendResetUrl: "https://app.example.com/reset-password",
  providers: {
    google: {
      clientId: Bun.env.GOOGLE_CLIENT_ID!,
      clientSecret: Bun.env.GOOGLE_CLIENT_SECRET!,
    },
    facebook: { clientId: "...", clientSecret: "..." },
    instagram: { clientId: "...", clientSecret: "..." }, // Meta app
  },
  bearer: true,
  cookies: { enabled: true },
});

createApp({ plugins: [auth.plugin] });

Routes

| Method | Path | | |--------|------|--| | POST | /auth/login | { login, password } → tokens | | POST | /auth/refresh | cookie/body refresh + CSRF header | | POST | /auth/logout | revoke refresh | | POST | /auth/password/forgot | { email } | | POST | /auth/password/reset | { token, password } | | GET | /auth/google … | OAuth start | | GET | /auth/*/callback | OAuth finish |

Wire your own UserAdapter / TokenAdapter / PasswordResetAdapter (store hashToken(token) only).

License

PolyForm Noncommercial 1.0.0 — Required Notice: Copyright Oleksii Fursov.

Commercial use: [email protected].