29 lines
1.7 KiB
Markdown
29 lines
1.7 KiB
Markdown
# WRNexusJS authentication system 0.5 alpha
|
|
|
|
`@wrnexus/auth` is a framework-native system built on the WRNexusJS package-runtime architecture.
|
|
|
|
## Architecture
|
|
|
|
- `AuthEngine` owns identity, credentials, tokens, sessions, recovery, MFA, invitations, OAuth, passkeys, risk, and auditing.
|
|
- `AuthStore` isolates persistence. `MemoryAuthStore` is for development and `SqlAuthStore` targets WRNexusJS database drivers.
|
|
- `config.auth` activates package routes, auth-session middleware, components, browser schemas, client runtime, ordered migrations, and DevToolbar checks.
|
|
- Every package endpoint has a route-specific module; path rewriting cannot make an endpoint fall through a shared dispatcher.
|
|
- `createAuthHttpHandlers()` remains available for intentionally custom HTTP surfaces.
|
|
- `createAuthSecretProtector()` protects TOTP and OAuth secrets with a versioned encryption keyring.
|
|
|
|
## Security boundaries
|
|
|
|
- Password, OTP, token, CAPTCHA, passkey, and MFA verification are server-side.
|
|
- Browser schemas improve usability; resolved server schemas remain authoritative.
|
|
- Unsafe package routes verify CSRF by default.
|
|
- CAPTCHA success is accepted only from server-populated request locals.
|
|
- OAuth email linking requires a verified provider email and can be disabled.
|
|
- Impersonation is deny-by-default and requires an application policy.
|
|
- One-time credentials are expiring, purpose-bound, and single-use.
|
|
- Sessions rotate at establishment and support idle and absolute expiration.
|
|
- Multi-process passkey deployments provide a shared `PasskeyChallengeStore`.
|
|
|
|
## Development version
|
|
|
|
The package is `0.5.0`. Run `bun run validate:auth` before publishing and read `packages/auth/SECURITY.md` before production deployment.
|