@evcraddock/slug-auth
v0.1.0
Published
Reusable Slugkit authentication primitives and interfaces.
Readme
@evcraddock/slug-auth
Reusable Slugkit authentication primitives and storage interfaces.
Exports
- Token helpers:
generateToken,hashToken,generateRawApiKey,hashApiKey, andreadApiKeyPrefix. - API key helpers:
VIEWER_API_KEY_SCOPES,normalizeApiKeyScopes,isApiKeyAuthorizedForOperation, andoperationToScope. - Magic-link helpers:
normalizeEmail,normalizeRedirectPath,createLoginUrl,createMagicLinkDelivery,readSmtpConfig, andcreateMagicLinkMessage. - Passkey helpers:
resolveWebAuthnOrigin,createRelyingPartyFromOrigins,normalizePasskeyName,normalizeTransports,encodeBase64Url,decodeBase64Url, andparseStringArrayJson. - Logging helpers:
consoleAuthLogger,consoleApiLogger,silentAuthLogger, andlogCaughtError. - Storage interfaces:
ApiKeyRepository,SiteUserRepository,SessionRepository,MagicLinkRepository, andPasskeyRepository.
Site-owned storage
This package intentionally does not own generated-site databases. Generated sites keep local wrapper modules and migrations, then use package helpers for the security-sensitive primitives that should receive patch updates.
Security patch guidance
Generated sites should apply patch releases of @evcraddock/slug-auth promptly. Patch releases may include token handling, API-key verification, SMTP delivery, passkey/WebAuthn, and logging hardening fixes without requiring a template rewrite.
