@lastshotlabs/slingshot-auth

npm install @lastshotlabs/slingshot-auth

Functions

`addTenantRole`

Replaces the full set of app-level roles for a user.

Delegates to adapter.setRoles, then emits a security.admin.role.changed event with action: "set" so the role change is auditable.

async function addTenantRole(userId: string, tenantId: string, role: string, changedBy?: string, adapter?: AuthAdapter, eventBus?: SlingshotEventBus,): Promise<void>

Source: packages/slingshot-auth/src/lib/roles.ts

`addUserRole`

Replaces the full set of app-level roles for a user.

Delegates to adapter.setRoles, then emits a security.admin.role.changed event with action: "set" so the role change is auditable.

async function addUserRole(userId: string, role: string, changedBy?: string, adapter?: AuthAdapter, eventBus?: SlingshotEventBus,): Promise<void>

Source: packages/slingshot-auth/src/lib/roles.ts

`authPluginConfigSchema`

Database/store connection configuration for slingshot-auth.

Controls which persistence backends are used for sessions, OAuth state, and the user auth adapter. Each field is optional — defaults are chosen by the bootstrap layer based on what is available (Redis → SQLite → memory).

Remarks: When running under the full framework (createApp / createServer), connection objects are provided automatically via SlingshotFrameworkConfig. These fields are only relevant in standalone mode or when explicitly overriding framework-provided connections.

Config Fields

Field	Description
`auth`	Core authentication feature configuration. Omit to use the plugin defaults.

Source: packages/slingshot-auth/src/types/config.ts

`createAuthPlugin`

Creates the slingshot-auth plugin instance for use with createApp(), createServer(), or as a standalone Hono plugin via plugin.setup().

The plugin bootstraps all auth subsystems (session store, adapters, rate limiting, credential stuffing detection, OAuth providers, MFA, SAML, SCIM, etc.) and mounts the corresponding route handlers on the Hono app.

Remarks: - In standalone mode (no SlingshotFrameworkConfig), config.runtime.password is required. - Production boot requires an explicit security.signing.sessionBinding choice. Without it a stolen JWT+session pair is usable from any IP or browser. Set security.signing.sessionBinding to either a real binding policy or false to acknowledge the risk explicitly. - OAuth routes are provided by @lastshotlabs/slingshot-oauth and mounted by that plugin.

function createAuthPlugin(rawConfig: AuthPluginConfig): StandalonePlugin

Source: packages/slingshot-auth/src/plugin.ts

`createAuthResolvedConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

function createAuthResolvedConfig(overrides: Partial<AuthResolvedConfig>,): AuthResolvedConfig

Source: packages/slingshot-auth/src/config/authConfig.ts

`createAuthUserModel`

Mongoose document shape for the AuthUser collection.

Represents a single user in the slingshot-auth MongoDB-backed auth adapter. The schema enforces uniqueness on email, identifier, externalId, and individual providerIds entries (all sparse so null values don’t collide), which preserves a one-to-one mapping between an external OAuth identity and a local user.

Remarks: This interface is internal to the Mongoose auth adapter. It is not exported from slingshot-auth’s public API surface. Consumer code interacts with users through the AuthAdapter interface, not this model directly.

function createAuthUserModel(conn: Connection, mongooseInstance: Mongoose,): Model<AuthUserDocument>

Source: packages/slingshot-auth/src/models/AuthUser.ts

`createMemoryAuthAdapter`

Primary login identifier — equals email when primaryField=“email”, username or phone otherwise.

function createMemoryAuthAdapter(getConfig?: () => AuthResolvedConfig, passwordRuntime?: RuntimePassword,): AuthAdapter & MemoryAuthStores

Source: packages/slingshot-auth/src/adapters/memoryAuth.ts

`createMemoryProviderConnectionStore`

A user’s stored connection to a third-party provider.

function createMemoryProviderConnectionStore(): ProviderConnectionStore

Source: packages/slingshot-auth/src/lib/providerConnections.ts

`createMongoAuthAdapter`

Shape of a user document returned by Mongoose .lean().

function createMongoAuthAdapter(conn: import('mongoose').Connection, mg: typeof import('mongoose'), passwordRuntime?: RuntimePassword,): AuthAdapter

Source: packages/slingshot-auth/src/adapters/mongoAuth.ts

`createMongoSessionRepository`

Creates a MongoDB-backed session repository using Mongoose.

Registers (or reuses) the Session model on the provided connection. Uses MongoDB transactions for atomic session creation when a maxSessions limit is enforced. A TTL index on expiresAt (expireAfterSeconds: 0) handles natural expiration unless persistSessionMetadata is enabled, in which case the TTL index is omitted and expired tokens are nulled out instead of deleted.

Remarks: Requires mongoose 9+. The Session model is registered on the provided connection only — it does not pollute the global mongoose.models registry.

function createMongoSessionRepository(conn: import('mongoose').Connection, mg: typeof import('mongoose'),): SessionRepository

Source: packages/slingshot-auth/src/lib/session/mongoStore.ts

`createRedisSessionRepository`

Creates a Redis-backed session repository.

Sessions are stored as JSON strings keyed by session:{appName}:{sessionId}. User-to-session indexes use a sorted set keyed by score = createdAt (epoch ms), enabling O(log N) oldest-session eviction. Refresh token lookup uses a separate key per token hash.

Atomic session creation and TTL management use Lua scripts to ensure consistency under concurrent requests.

Remarks: Requires ioredis 5+. The appName must be stable across deployments — changing it invalidates all existing session keys.

function createRedisSessionRepository(getRedis: () => RedisLike, appName: string,): SessionRepository

Source: packages/slingshot-auth/src/lib/session/redisStore.ts

`createSession`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function createSession(repo: SessionRepository, userId: string, token: string, sessionId: string, metadata?: SessionMetadata, config?: AuthResolvedConfig,): Promise<void>

Source: packages/slingshot-auth/src/lib/session/index.ts

`createSlingshotAuthAccessProvider`

Creates the slingshot-auth access provider for the built-in admin API.

Implements AdminAccessProvider by resolving the authenticated user’s roles from the auth adapter and building an AdminPrincipal from their profile. Returns null when the request has no authenticated user, causing the admin API to return 401.

Passed to createServer({ admin: { accessProvider: createSlingshotAuthAccessProvider() } }) to gate the built-in admin panel with standard session-based auth + role checks.

Remarks: getUser and getRoles on the adapter are called via optional chaining — adapters that omit these methods will return null (access denied) rather than throwing.

function createSlingshotAuthAccessProvider(): AdminAccessProvider

Source: packages/slingshot-auth/src/admin/slingshotAccess.ts

`createSlingshotManagedUserProvider`

Creates a ManagedUserProvider that exposes slingshot-auth’s user store through the framework’s admin user management interface.

Provides list, get, update, suspend/unsuspend, delete, session management, and role management operations backed by the configured AuthAdapter and SessionRepository.

Registered automatically by bootstrapAuth when the admin API is enabled. Exposed publicly so advanced consumers can register it manually or substitute a custom provider.

Remarks: User listing is cursor-based (base64-encoded offset). The search parameter is passed as an email prefix filter when supported by the adapter’s listUsers implementation. The built-in slingshot-auth adapter does not partition users or sessions by tenant, so tenant-scoped admin requests fail closed: list/get/session/role operations return empty results and mutating operations no-op rather than leaking global auth state.

function createSlingshotManagedUserProvider(adapter: AuthAdapter, config: AuthResolvedConfig, sessionRepo: SessionRepository,): ManagedUserProvider

Source: packages/slingshot-auth/src/admin/slingshotUsers.ts

`createSqliteAuthAdapter`

Return type of createSqliteAuthAdapter.

Bundles the AuthAdapter, the underlying RuntimeSqliteDatabase handle, a periodic cleanup interval, and low-level session helpers used by the bootstrap layer to wire session operations without a separate SessionRepository instance.

Remarks: The session helpers on this type overlap with SessionRepository methods. When used via the full plugin (not standalone), the session operations are handled by the SessionRepository resolved from sessionFactories rather than these helpers.

function createSqliteAuthAdapter(db: RuntimeSqliteDatabase, passwordRuntime?: RuntimePassword,): SqliteAuthResult

Source: packages/slingshot-auth/src/adapters/sqliteAuth.ts

`createSqliteCacheAdapter`

Common interface for auth cache backends.

Used internally by slingshot-auth for short-lived ephemeral data (rate-limit buckets, nonces, etc.) that must survive across requests but not necessarily across process restarts. Three implementations are provided: createMemoryCacheAdapter, createSqliteCacheAdapter, and createRedisCacheAdapter.

Remarks: All key and pattern arguments are unscoped — callers must include any required prefixes. The Redis adapter automatically namespaces under cache:<appName>:.

function createSqliteCacheAdapter(db: RuntimeSqliteDatabase): ICacheAdapter

Source: packages/slingshot-auth/src/lib/cache.ts

`createSqliteProviderConnectionStore`

A user’s stored connection to a third-party provider.

function createSqliteProviderConnectionStore(db: RuntimeSqliteDatabase,): ProviderConnectionStore

Source: packages/slingshot-auth/src/lib/providerConnections.ts

`createSqliteSessionRepository`

Creates a SQLite-backed session repository.

Creates the sessions table (and supporting indexes) if they do not already exist. Uses a WAL-compatible schema shared with createSqliteAuthAdapter — the table is safe to have created by either party.

Remarks: Initialization is lazy — the table is created on the first operation, not at construction time. This avoids issues when the database file is opened before migrations have run.

function createSqliteSessionRepository(db: RuntimeSqliteDatabase): SessionRepository

Source: packages/slingshot-auth/src/lib/session/sqliteStore.ts

`deleteSession`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function deleteSession(repo: SessionRepository, sessionId: string, config?: AuthResolvedConfig,): Promise<void>

Source: packages/slingshot-auth/src/lib/session/index.ts

`evictOldestSession`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function evictOldestSession(repo: SessionRepository, userId: string, config?: AuthResolvedConfig,): Promise<void>

Source: packages/slingshot-auth/src/lib/session/index.ts

`getActiveSessionCount`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function getActiveSessionCount(repo: SessionRepository, userId: string, config?: AuthResolvedConfig,): Promise<number>

Source: packages/slingshot-auth/src/lib/session/index.ts

`getAuthenticatedUserActor`

Returns the current request’s actor when it is an authenticated user (kind 'user' with a non-null id), otherwise null.

function getAuthenticatedUserActor(c: Parameters<typeof getActor>[0],): AuthenticatedUserActor | null

Source: packages/slingshot-auth/src/middleware/userAuth.ts

`getAuthRuntimeContext`

Per-app auth runtime state, created by bootstrapAuth and stored in pluginState under the AUTH_RUNTIME_KEY symbol.

Access it via getAuthRuntimeContext(ctx.pluginState) from plugin setup code, getAuthRuntimeContext(ctx) from any object that carries pluginState, or getAuthRuntimeFromRequest(c) from a Hono request context inside an auth route.

All properties are readonly. The config object is deep-frozen. The repos map contains the resolved storage adapters for all auth sub-systems.

Remarks: This interface is intentionally wide — it is the single source of truth for all auth runtime state. Plugin-layer code should prefer this over storing state in module-level variables. Every createAuthPlugin() call produces an independent AuthRuntimeContext instance (Rule 3 — no cross-app state pollution).

function getAuthRuntimeContext(input: PluginStateMap | PluginStateCarrier | object | null | undefined,): AuthRuntimeContext

Source: packages/slingshot-auth/src/runtime.ts

`getAuthRuntimeContextOrNull`

Per-app auth runtime state, created by bootstrapAuth and stored in pluginState under the AUTH_RUNTIME_KEY symbol.

All properties are readonly. The config object is deep-frozen. The repos map contains the resolved storage adapters for all auth sub-systems.

function getAuthRuntimeContextOrNull(input: PluginStateMap | PluginStateCarrier | object | null | undefined,): AuthRuntimeContext | null

Source: packages/slingshot-auth/src/runtime.ts

`getAuthRuntimeFromRequest`

Per-app auth runtime state, created by bootstrapAuth and stored in pluginState under the AUTH_RUNTIME_KEY symbol.

All properties are readonly. The config object is deep-frozen. The repos map contains the resolved storage adapters for all auth sub-systems.

function getAuthRuntimeFromRequest(c: { get(key: string): unknown }): AuthRuntimeContext

Source: packages/slingshot-auth/src/runtime.ts

`getAuthRuntimeFromRequestOrNull`

Per-app auth runtime state, created by bootstrapAuth and stored in pluginState under the AUTH_RUNTIME_KEY symbol.

All properties are readonly. The config object is deep-frozen. The repos map contains the resolved storage adapters for all auth sub-systems.

function getAuthRuntimeFromRequestOrNull(c: { get(key: string): unknown; }): AuthRuntimeContext | null

Source: packages/slingshot-auth/src/runtime.ts

`getMfaVerifiedAt`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function getMfaVerifiedAt(repo: SessionRepository, sessionId: string,): Promise<number | null>

Source: packages/slingshot-auth/src/lib/session/index.ts

`getSession`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function getSession(repo: SessionRepository, sessionId: string, config?: AuthResolvedConfig,): Promise<string | null>

Source: packages/slingshot-auth/src/lib/session/index.ts

`getSessionByRefreshToken`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function getSessionByRefreshToken(repo: SessionRepository, refreshToken: string, config?: AuthResolvedConfig,): Promise<RefreshResult | null>

Source: packages/slingshot-auth/src/lib/session/index.ts

`getSessionFingerprint`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function getSessionFingerprint(repo: SessionRepository, sessionId: string,): Promise<string | null>

Source: packages/slingshot-auth/src/lib/session/index.ts

`getTenantRoles`

Replaces the full set of app-level roles for a user.

Delegates to adapter.setRoles, then emits a security.admin.role.changed event with action: "set" so the role change is auditable.

async function getTenantRoles(userId: string, tenantId: string, adapter?: AuthAdapter,): Promise<string[]>

Source: packages/slingshot-auth/src/lib/roles.ts

`getUserSessions`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function getUserSessions(repo: SessionRepository, userId: string, config?: AuthResolvedConfig,): Promise<SessionInfo[]>

Source: packages/slingshot-auth/src/lib/session/index.ts

`providerConnectionFactories`

A user’s stored connection to a third-party provider.

Source: packages/slingshot-auth/src/lib/providerConnections.ts

`publishAuthEvent`

Registers the auth package’s managed event definitions on the given event publisher, skipping any already registered.

function publishAuthEvent<K extends AuthManagedEventKey>(events: SlingshotEvents, key: K, payload: SlingshotEventMap[K], ctx?: Partial<EventPublishContext>,): void

Source: packages/slingshot-auth/src/eventGovernance.ts

`registerAuthEventDefinitions`

Registers the auth package’s managed event definitions on the given event publisher, skipping any already registered.

function registerAuthEventDefinitions(events: SlingshotEvents): void

Source: packages/slingshot-auth/src/eventGovernance.ts

`removeTenantRole`

Replaces the full set of app-level roles for a user.

Delegates to adapter.setRoles, then emits a security.admin.role.changed event with action: "set" so the role change is auditable.

async function removeTenantRole(userId: string, tenantId: string, role: string, changedBy?: string, adapter?: AuthAdapter, eventBus?: SlingshotEventBus,): Promise<void>

Source: packages/slingshot-auth/src/lib/roles.ts

`removeUserRole`

Replaces the full set of app-level roles for a user.

Delegates to adapter.setRoles, then emits a security.admin.role.changed event with action: "set" so the role change is auditable.

async function removeUserRole(userId: string, role: string, changedBy?: string, adapter?: AuthAdapter, eventBus?: SlingshotEventBus,): Promise<void>

Source: packages/slingshot-auth/src/lib/roles.ts

`renderTemplate`

Built-in email templates with variable substitution.

Templates use {{variableName}} placeholders. Unknown variables are left as-is. All templates use inline CSS only — no external CDN dependencies.

function renderTemplate(template: EmailTemplate, vars: TemplateVariables): EmailTemplate

Source: packages/slingshot-auth/src/lib/emailTemplates.ts

`requireRole`

Middleware factory that enforces role-based access control (RBAC).

Must be used after userAuth (requires an authenticated actor). Resolves the user’s effective role set for the authenticated user actor and returns 403 Forbidden when none of the required roles are present.

Effective roles are written to the actor via c.set('actor', ...) for downstream handlers.

When a tenant context is active (actor has a tenantId), role resolution is scoped to that tenant. Use requireRole.global() to bypass tenant scoping and enforce app-wide roles only.

Source: packages/slingshot-auth/src/middleware/requireRole.ts

`rotateRefreshToken`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function rotateRefreshToken(repo: SessionRepository, sessionId: string, oldRefreshToken: string | undefined, newRefreshToken: string, newAccessToken: string, config?: AuthResolvedConfig,): Promise<boolean>

Source: packages/slingshot-auth/src/lib/session/index.ts

`sessionFactories`

RepoFactories dispatch map for SessionRepository.

Passed to resolveRepo(sessionFactories, storeType, infra) in the bootstrap layer to instantiate the correct backend based on the configured db.sessions store type.

Supported store types: 'memory' | 'sqlite' | 'redis' | 'mongo' | 'postgres'.

Source: packages/slingshot-auth/src/lib/session/factories.ts

`setMfaVerifiedAt`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function setMfaVerifiedAt(repo: SessionRepository, sessionId: string,): Promise<void>

Source: packages/slingshot-auth/src/lib/session/index.ts

`setRefreshToken`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function setRefreshToken(repo: SessionRepository, sessionId: string, refreshToken: string, config?: AuthResolvedConfig,): Promise<void>

Source: packages/slingshot-auth/src/lib/session/index.ts

`setSessionFingerprint`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function setSessionFingerprint(repo: SessionRepository, sessionId: string, fingerprint: string,): Promise<void>

Source: packages/slingshot-auth/src/lib/session/index.ts

`setTenantRoles`

Replaces the full set of app-level roles for a user.

Delegates to adapter.setRoles, then emits a security.admin.role.changed event with action: "set" so the role change is auditable.

async function setTenantRoles(userId: string, tenantId: string, roles: string[], changedBy?: string, adapter?: AuthAdapter, eventBus?: SlingshotEventBus,): Promise<void>

Source: packages/slingshot-auth/src/lib/roles.ts

`setUserRoles`

Replaces the full set of app-level roles for a user.

Delegates to adapter.setRoles, then emits a security.admin.role.changed event with action: "set" so the role change is auditable.

async function setUserRoles(userId: string, roles: string[], changedBy?: string, adapter?: AuthAdapter, eventBus?: SlingshotEventBus,): Promise<void>

Source: packages/slingshot-auth/src/lib/roles.ts

`signToken`

Returns the active (first) signing secret as a Uint8Array.

async function signToken(claims: TokenClaims, expirySeconds: number | undefined, config: AuthResolvedConfig, signing?: SigningConfig | null,): Promise<string>

Source: packages/slingshot-auth/src/lib/jwt.ts

`updateSessionLastActive`

Stores a new session for a user. No capacity enforcement — use atomicCreateSession (via createSessionForUser) when you want oldest-session eviction.

async function updateSessionLastActive(repo: SessionRepository, sessionId: string, config?: AuthResolvedConfig,): Promise<void>

Source: packages/slingshot-auth/src/lib/session/index.ts

`userAuth`

Returns the current request’s actor when it is an authenticated user (kind 'user' with a non-null id), otherwise null.

Source: packages/slingshot-auth/src/middleware/userAuth.ts

`validateAdapterCapabilities`

Feature-flag snapshot used to drive validateAdapterCapabilities.

Each boolean corresponds to one or more enabled features that require specific methods on the AuthAdapter. This snapshot is computed once during bootstrap from the resolved AuthPluginConfig and passed to validateAdapterCapabilities at startup.

Remarks: Exposed publicly so consumers who build custom bootstrap flows (outside createAuthPlugin) can construct and pass this config directly to validateAdapterCapabilities.

function validateAdapterCapabilities(adapter: AuthAdapter, cfg: AdapterValidationConfig,): void

Source: packages/slingshot-auth/src/lib/validateAdapter.ts

`verifyToken`

Returns the active (first) signing secret as a Uint8Array.

async function verifyToken(token: string, config: AuthResolvedConfig, signing?: SigningConfig | null,): Promise<JWTPayload>

Source: packages/slingshot-auth/src/lib/jwt.ts

Constants

`ErrorResponse`

Canonical error response schema shared across all standard auth routes.

Exported for use in OpenAPI/Zod-based API documentation and custom route handlers that want to return errors in the same shape as the built-in auth endpoints.

M2M routes use RFC 6749 error shapes and SCIM routes use RFC 7644 shapes — neither uses this schema.

Config Fields

Field	Description
`error`	Human-readable error message.

Source: packages/slingshot-auth/src/schemas/error.ts

`templates`

Built-in email templates with variable substitution.

Templates use {{variableName}} placeholders. Unknown variables are left as-is. All templates use inline CSS only — no external CDN dependencies.

Source: packages/slingshot-auth/src/lib/emailTemplates.ts

Interfaces

`AccountDeletionConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`AdapterValidationConfig`

Feature-flag snapshot used to drive validateAdapterCapabilities.

Remarks: Exposed publicly so consumers who build custom bootstrap flows (outside createAuthPlugin) can construct and pass this config directly to validateAdapterCapabilities.

Source: packages/slingshot-auth/src/lib/validateAdapter.ts

`AuthConfig`

Database/store connection configuration for slingshot-auth.

Source: packages/slingshot-auth/src/types/config.ts

`AuthCookieConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`AuthDbConfig`

Database/store connection configuration for slingshot-auth.

Source: packages/slingshot-auth/src/types/config.ts

`AuthRateLimitConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`AuthResolvedConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`AuthRuntimeContext`

Per-app auth runtime state, created by bootstrapAuth and stored in pluginState under the AUTH_RUNTIME_KEY symbol.

All properties are readonly. The config object is deep-frozen. The repos map contains the resolved storage adapters for all auth sub-systems.

Source: packages/slingshot-auth/src/runtime.ts

`AuthSecurityConfig`

Database/store connection configuration for slingshot-auth.

Source: packages/slingshot-auth/src/types/config.ts

`AuthSessionPolicyConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`BreachedPasswordConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`ConcealRegistrationConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`CsrfCookieConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`EmailVerificationConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`HookContext`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`JwtConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`MagicLinkConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`MemoryAuthStores`

Primary login identifier — equals email when primaryField=“email”, username or phone otherwise.

Source: packages/slingshot-auth/src/adapters/memoryAuth.ts

`MfaConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`MfaEmailOtpConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`MfaWebAuthnConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`OAuthConfig`

Database/store connection configuration for slingshot-auth.

Source: packages/slingshot-auth/src/types/config.ts

`OidcConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`PasswordResetConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`ProviderConnection`

A user’s stored connection to a third-party provider.

Source: packages/slingshot-auth/src/lib/providerConnections.ts

`ProviderConnectionStore`

A user’s stored connection to a third-party provider.

Source: packages/slingshot-auth/src/lib/providerConnections.ts

`RefreshTokenConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`SamlConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`ScimConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`SecurityEvent`

Configuration for the security event tap.

When provided via AuthPluginConfig.securityEvents, every security event emitted by the auth plugin is forwarded to onEvent after being enriched with severity, timestamp, and contextual fields. Use this to ship events to a SIEM, audit log, or alerting system.

Source: packages/slingshot-auth/src/lib/securityEventWiring.ts

`SecurityEventsConfig`

Configuration for the security event tap.

Source: packages/slingshot-auth/src/lib/securityEventWiring.ts

`StepUpConfig`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`TemplateVariables`

Built-in email templates with variable substitution.

Templates use {{variableName}} placeholders. Unknown variables are left as-is. All templates use inline CSS only — no external CDN dependencies.

Source: packages/slingshot-auth/src/lib/emailTemplates.ts

Types

`AuthPluginConfig`

Database/store connection configuration for slingshot-auth.

Source: packages/slingshot-auth/src/types/config.ts

`EmailTemplate`

A static email template (subject/html/text) registered by a plugin and consumed by the mail plugin.

Source: packages/slingshot-core/src/emailTemplates.ts

`PrimaryField`

The primary identifier field for user accounts.

Controls which field is used as the login identifier — email address, username, or phone number. Defaults to 'email'. Set via AuthConfig.primaryField.

Source: packages/slingshot-auth/src/config/authConfig.ts

`ProviderConnectionUpsert`

A user’s stored connection to a third-party provider.

Source: packages/slingshot-auth/src/lib/providerConnections.ts

Exports

`generateCodeVerifier`

OAuth provider credential configuration map.

Each key corresponds to a supported OAuth provider. Provide credentials for any providers you want to enable. Passed to OAuthConfig.providers inside AuthConfig.

Remarks: Requires the @lastshotlabs/slingshot-oauth package. Startup throws if providers are configured but the package is not installed.

Source: packages/slingshot-auth/src/lib/oauth.ts

`generateState`

OAuth provider credential configuration map.

Each key corresponds to a supported OAuth provider. Provide credentials for any providers you want to enable. Passed to OAuthConfig.providers inside AuthConfig.

Remarks: Requires the @lastshotlabs/slingshot-oauth package. Startup throws if providers are configured but the package is not installed.

Source: packages/slingshot-auth/src/lib/oauth.ts