guardo

import { createAuth } from "guardo";

const auth = createAuth({
  jwt: { secret: process.env.JWT_SECRET! },
});

// ─── Step 1: Send OTP ─────────────────────────────────────
await auth.otp.send({ identifier: "user@example.com" });
// → OTP delivered to inbox (or console in dev)

// ─── Step 2: Verify OTP + login ───────────────────────────
const { user, accessToken, refreshToken, sessionId } =
  await auth.auth.loginWithOtp({
    identifier: "user@example.com",
    otp: "123456",
    meta: { device: "chrome-mac", ip: req.ip },
  });

// ─── Step 3: Protect routes ──────────────────────────────
app.get("/me", auth.middleware.express(), (req, res) => {
  res.json(req.user); // req.user is automatically populated
});

import { createAuth, RedisStore } from "guardo";

const auth = createAuth({
  // ─── Required ─────────────────────────────────────────
  jwt: {
    secret: "at-least-16-chars",
    accessTokenTTL:  "15m",  // default
    refreshTokenTTL: "7d",   // default
    extraClaims: { iss: "my-app" }, // embedded in every token
  },

  // ─── OTP ──────────────────────────────────────────────
  otp: {
    length: 6,    // default
    expiry: 300, // seconds - default 5 minutes
  },

  // ─── Storage ──────────────────────────────────────────
  store: new RedisStore(redisClient), // default: MemoryStore

  // ─── Notifications ────────────────────────────────────
  notifier: myEmailNotifier,    // default: ConsoleNotifier

  // ─── Rate limits ──────────────────────────────────────
  rateLimit: {
    otpSend:   { max: 5,  windowSeconds: 60 }, // default
    otpVerify: { max: 10, windowSeconds: 60 }, // default
  },

  // ─── User resolution ──────────────────────────────────
  // Called after OTP verification and on every auth'd request.
  // Attach your DB call here so req.user is always full.
  resolveUser: async (identifier) => {
    return db.users.findByEmail(identifier);
  },
});

const result = await auth.otp.send({
  identifier: "user@example.com",
  channel: "email", // or "sms" - default "email"
});
// → { expiresInSeconds: 300 }

const result = await auth.otp.verify({
  identifier: "user@example.com",
  otp: "123456",
});

// Success:
// { success: true, verified: true }

// Failure:
// { success: false, verified: false, error: "Invalid OTP. 4 attempt(s) remaining." }
// { success: false, verified: false, error: "OTP expired or not found." }

const pending = await auth.otp.exists("user@example.com");
// → true or false

const result = await auth.auth.loginWithOtp({
  identifier: "user@example.com",
  otp: "123456",
  meta: {         // optional session metadata
    device: "iPhone 15",
    ip: "1.2.3.4",
    userAgent: req.headers["user-agent"],
  },
});

// result: {
//   user:         { id: "123", email: "user@example.com" },
//   accessToken:  "eyJ...",
//   refreshToken: "eyJ...",
//   sessionId:    "sess_abc123",
// }

const { accessToken, refreshToken, sessionId } =
  await auth.auth.refreshTokens(oldRefreshToken);

await auth.auth.logout("sess_abc123");       // single device
const count = await auth.auth.logoutAll("user-123"); // → 3 sessions revoked

// Issue tokens manually
const accessToken  = auth.jwt.issueAccessToken(user, sessionId);
const refreshToken = auth.jwt.issueRefreshToken(user, sessionId);
const { accessToken, refreshToken } = auth.jwt.issueTokenPair(user, sessionId);

// Verify (throws on invalid or expired)
const payload = auth.jwt.verifyAccessToken(token);
const payload = auth.jwt.verifyRefreshToken(token);

// Decode without verifying (read sub from expired token)
const payload = auth.jwt.decode(token); // returns null if unparseable

// Create a session (sessionId is auto-generated)
const session = await auth.session.create(userId, {
  device: "Safari on iPad",
  ip: "1.2.3.4",
  userAgent: "Mozilla/5.0...",
});

// Get one session by ID
const session = await auth.session.get("sess_abc123");

// List all sessions for a user (newest first)
const sessions = await auth.session.list(userId);

// Touch: update lastActiveAt (call on each auth'd request)
await auth.session.touch("sess_abc123");

// Revoke one session
await auth.session.revoke("sess_abc123");

// Revoke all sessions for a user → returns count
const n = await auth.session.revokeAll(userId);

app.get("/profile", auth.middleware.express(), (req, res) => {
  res.json(req.user);
});

app.delete(
  "/admin/users/:id",
  auth.middleware.express(),
  auth.middleware.role(["admin", "superadmin"]),
  handler,
);

import { createAuth } from "guardo";

const auth = createAuth({ jwt: { secret: process.env.JWT_SECRET! } });

export const middleware = auth.middleware.nextjs();

export const config = {
  matcher: ["/api/:path*", "/dashboard/:path*"],
};

export const GET = auth.middleware.nextjsRoute(async (req, user) => {
  return Response.json({ user });
});

import { MemoryStore } from "guardo";

const store = new MemoryStore();
store.clear(); // useful in tests - wipe everything

import { RedisStore, createAuth } from "guardo";
import Redis from "ioredis";

const redis = new Redis(process.env.REDIS_URL);
const store = new RedisStore(redis);

const auth = createAuth({ jwt: { secret: "..." }, store });

import type { StorageAdapter } from "guardo";

class MongoStore implements StorageAdapter {
  async set(key: string, value: string, ttlSeconds?: number) { /* ... */ }
  async get(key: string): Promise<string | null> { /* ... */ }
  async delete(key: string) { /* ... */ }
  async keys(prefix: string): Promise<string[]> { /* ... */ }
}

import { ConsoleNotifier, createAuth } from "guardo";

const auth = createAuth({
  jwt: { secret: "..." },
  notifier: new ConsoleNotifier(),
});
// Console: [guardo] OTP for user@example.com via email: 483920 (expires in 300s)

import type { Notifier, NotifyPayload } from "guardo";

class TwilioNotifier implements Notifier {
  async sendOTP({ to, code, expiresInSeconds }: NotifyPayload) {
    await twilio.messages.create({
      to,
      from: process.env.TWILIO_NUMBER,
      body: `Your code is ${code}. Expires in ${expiresInSeconds}s.`,
    });
  }
}

// Functional shorthand
import { createNotifier } from "guardo";
const notifier = createNotifier(async ({ to, code }) => {
  console.log(`Send ${code} to ${to}`);
});

import { MultiChannelNotifier } from "guardo";

const auth = createAuth({
  jwt: { secret: "..." },
  notifier: new MultiChannelNotifier({
    email: new SendGridNotifier(),
    sms:   new TwilioNotifier(),
  }),
});

import { AuthError, RateLimitError } from "guardo";

try {
  await auth.auth.loginWithOtp({ identifier, otp });
} catch (err) {
  if (err instanceof RateLimitError) {
    res.status(429).json({ error: `Retry in ${err.retryAfterSeconds}s` });
  } else if (err instanceof AuthError) {
    res.status(401).json({ error: err.message });
  }
}