{"_id":"@codefluid/bob-auth","_rev":"2-0ea4cac3fdc166aceb815138c9ac004e","name":"@codefluid/bob-auth","dist-tags":{"latest":"0.4.0"},"versions":{"0.4.0":{"name":"@codefluid/bob-auth","version":"0.4.0","_id":"@codefluid/bob-auth@0.4.0","maintainers":[{"name":"markcodefluid","email":"mark.classen@gmail.com"},{"name":"knightsit","email":"pnpm@knightsit.co.za"}],"dist":{"shasum":"08b19faf78457ff4dceab522b2297e20e214bac3","tarball":"https://registry.npmjs.org/@codefluid/bob-auth/-/bob-auth-0.4.0.tgz","fileCount":14,"integrity":"sha512-j8hwmhAHJOHw9WM45xaj3sWCYZOxskX/1tDQ9W2AsuBqyWwLEcQBD8F3w85VeRaOVk11FmgK0W/AbRSW6vUfVg==","signatures":[{"sig":"MEUCIQC52AyOrsomwNY3rCPWOpHOeEsT4E3W+78TjqPTh+AZVQIgHFRtLf2p2NUulwJfxr+wqygLFctoPO2DMdj+Eo9hxI0=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":41491},"main":"./dist/index.js","type":"module","_from":"file:codefluid-bob-auth-0.4.0.tgz","types":"./dist/index.d.ts","private":false,"scripts":{"dev":"tsc --watch","test":"vitest run","build":"tsc","compile":"tsc --noEmit"},"_npmUser":{"name":"knightsit","email":"pnpm@knightsit.co.za"},"_resolved":"C:\\Users\\JUSTIN~1\\AppData\\Local\\Temp\\a60e05dbb6056a3b89ad757b53fa72a7\\codefluid-bob-auth-0.4.0.tgz","_integrity":"sha512-j8hwmhAHJOHw9WM45xaj3sWCYZOxskX/1tDQ9W2AsuBqyWwLEcQBD8F3w85VeRaOVk11FmgK0W/AbRSW6vUfVg==","_npmVersion":"10.9.2","description":"A high-performance, stateless authentication SDK. Use this package to integrate user registration, sign-in, and verification into your application.","directories":{},"_nodeVersion":"22.16.0","dependencies":{},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.0.18","ts-node":"^10.9.2","typescript":"^5.0.0","@types/node":"^25.2.2"},"_npmOperationalInternal":{"tmp":"tmp/bob-auth_0.4.0_1771423451846_0.5468957909878049","host":"s3://npm-registry-packages-npm-production"}}},"time":{"created":"2026-02-18T14:04:11.778Z","modified":"2026-02-18T16:48:14.479Z","0.4.0":"2026-02-18T14:04:12.007Z"},"description":"A high-performance, stateless authentication SDK. Use this package to integrate user registration, sign-in, and verification into your application.","maintainers":[{"email":"pnpm@knightsit.co.za","name":"knightsit"}],"readme":"# @bob/auth (BobAuth Public SDK)\r\n\r\nA high-performance, stateless authentication SDK. Use this package to integrate user registration, sign-in, and verification into your application.\r\n\r\n## 🚀 Quick Start for AI Agents & Developers\r\n\r\n### 1. Installation\r\n```bash\r\nnpm install @bob/auth\r\n```\r\n\r\n### 2. Configure Environment\r\nYour app needs three primary variables, which will be issued by the BobAuth team. You will be given a set for development/testing and another set for production.\r\n\r\n**Local Development (`.env.local`)**\r\n```env\r\n# Issued by BobAuth for your specific application\r\nBOB_AUTH_ID=your_dev_app_id\r\nBOB_AUTH_KEY=your_dev_auth_key\r\nBOB_AUTH_URL=https://cool-dove-824.convex.cloud\r\n```\r\n\r\n**Production**\r\n# Issued by BobAuth for your specific application in production\r\nBOB_AUTH_ID=your_prod_app_id\r\nBOB_AUTH_KEY=your_prod_auth_key\r\nBOB_AUTH_URL=https://adventurous-pheasant-246.convex.cloud\r\n*   **SECURITY**: Your `BOB_AUTH_KEY` should never be exposed in a public frontend. For production, perform the `appSignin` step in a backend function or use an ephemeral token approach.\r\n\r\n---\r\n\r\n## 🛠️ Usage Guide\r\n\r\n### Initialize and Authorize\r\nBobAuth uses a **Stateless Token** model. You must first authorize your application to receive an `appToken` before making user requests.\r\n\r\n```typescript\r\nimport { BobAuthClient } from \"@bob/auth\";\r\n\r\nconst bob = new BobAuthClient({\r\n  backendUrl: process.env.BOB_AUTH_URL\r\n});\r\n\r\n// 1. Authorize your App (Call this once on app init or backend side)\r\nawait bob.signin(\r\n  process.env.BOB_AUTH_ID, \r\n  process.env.BOB_AUTH_KEY\r\n);\r\n```\r\n\r\n### User Signup\r\nAllows a new user to register. Returns a `userId` and a `pin` (for simulation; in production, BobAuth sends this via email).\r\n\r\n```typescript\r\nconst { result, error } = await bob.userSignup({\r\n  email: \"user@example.com\",\r\n  password: \"SecurePassword123!\",\r\n  firstName: \"Justin\"\r\n});\r\n\r\nif (result) {\r\n  // Save result.userId and show PIN entry UI\r\n}\r\n```\r\n\r\n### Email Verification\r\nVerify the user's account using the PIN.\r\n\r\n```typescript\r\nawait bob.userVerifyEmail({\r\n  userId: \"user_123\",\r\n  pin: \"123456\"\r\n});\r\n```\r\n\r\n### User Sign-in\r\nObtain a user identity and session.\r\n\r\n```typescript\r\nconst loginResult = await bob.userSignin({\r\n  email: \"user@example.com\",\r\n  password: \"SecurePassword123!\",\r\n  ipAddress: \"127.0.0.1\"\r\n});\r\n\r\nif (loginResult.result) {\r\n  console.log(\"Logged in user:\", loginResult.result.current.user.firstName);\r\n}\r\n```\r\n\r\n---\r\n\r\n## 🛡️ Security Architecture\r\n\r\n### Stateless Performance\r\nUnlike traditional auth, BobAuth user mutations do not require a database lookup to verify the application. The `appToken` is a cryptographically sealed payload that the server verifies instantly, ensuring zero performance penalty for high-traffic apps.\r\n\r\n### Credentials at Rest\r\nApplication `authKeys` are encrypted at rest on the BobAuth server. However, you must protect your `authKey` locally. **Never commit it to git.**\r\n\r\n### Suspensions & IP Blocking\r\nBobAuth automatically handles brute-force protection. If your app receives `error: \"ip-blocked\"`, the client's IP has been temporarily restricted due to too many failed attempts across different users.\r\n","readmeFilename":"README.md"}