@useoneauth/sdk-server

Phase 8 — the trusted authority SDK. A composition root + facade over all seven OneAuth engines.

OneAuthServer.inMemory(config) wires every in-memory adapter, one shared EventBus, and all engines into a single object exposing the full trusted surface plus the client-facing operations. Its signIn runs the complete runtime flow — credential verification → trust gating → session → tokens — on one auditable event stream.

Install

// package.json
{ "dependencies": { "@useoneauth/sdk-server": "workspace:*" } }

Usage

import { OneAuthServer } from "@useoneauth/sdk-server"

const server = await OneAuthServer.inMemory({ issuer: "https://oneauth.example", audience: "https://api.example" })

// Admin (trusted) surface:
const identity = await server.createIdentity({ type: "human", email: "[email protected]" })
const { credential } = await server.createCredential({ identityId: identity.id, type: "password", secret: { password: "correct horse" } })

// Full runtime sign-in (trust gates it):
const result = await server.signIn({
  identityId: identity.id,
  credentialId: credential.id,
  secret: "correct horse",
  device: { deviceId: "d1" },
  location: { country: "US" },
  expected: { knownDevices: ["d1"], knownCountries: ["US"] },
})
// { status: "ok", session, accessToken, refreshToken, trust }
//   | { status: "step_up", trust }
//   | { status: "denied", reason }

Surfaces

• Trusted (admin): createIdentity, getIdentity, linkIdentity, createCredential, issueToken, refreshToken, verifyToken, createSession, revokeSession, can (policy), evaluateTrust.
• Client-facing: signIn, signOut, me, getSession. (me/getSession return null instead of throwing for invalid tokens / expired-or-revoked sessions.)

signIn flow

verifyCredential → (false/not-found ⇒ denied: invalid_credential) → evaluateTrust → (deny ⇒ denied; step_up ⇒ step_up, no tokens; allow ⇒ continue) → createSession → issueTokenPair. Every step emits its own event through the shared EventBus, so one sign-in produces TRUST_EVALUATED + SESSION_CREATED + TOKEN_ISSUED.

Construction

OneAuthServer.inMemory(config) for the default wiring (async — InMemoryKeyStore.create() is async), or new OneAuthServer(deps) for full dependency injection (e.g. Prisma-backed adapters in a later phase).

See ARCHITECTURE.md. The untrusted counterpart is @useoneauth/sdk-client.