@marmeon/auth

Authentication and authorization for Marmeon apps: the session guard, "remember me", password hashing and resets, the confirmation of an address, API tokens, policies and the make:auth generator.

Installation

Part of every new Marmeon app: pnpm create marmeon installs it and writes the starter kit's auth module — the sign-in, registration and password pages, the app's own code from then on. An app made with --minimal adds the module later:

pnpm marmeon make:auth
pnpm marmeon migrate

Passkeys are the one extra: @simplewebauthn/server is a dependency of this package, loaded only by @marmeon/auth/passkeys — an app that never imports that subpath never loads it.

Protecting a route

import { authenticate, verified } from '@marmeon/auth';
import { defineRoutes } from '@marmeon/http';
import { ListNotesController } from './controllers/ListNotesController.ts';

export default defineRoutes((Route) => {
  Route.middleware(authenticate()).middleware(verified()).get('/notes', ListNotesController).name('notes.index');
});

authenticate() lets only signed-in users through, and the controller finds the user in ctx.user. verified() lets in only accounts whose address is confirmed.

Documentation

• Authentication
• Authorization
• Email Verification
• Password Reset
• API Tokens
• Hashing
• Starter Kit
• HTTP Tests: sessions and signing in

MIT · part of Marmeon