Skip to main content
zerotal

Documentation

Documentation / @zerotal/auth

@zerotal/auth

Authentication and authorization for Zerotal.

Covers the whole surface: session login via the Auth facade (Auth.attempt, Auth.user, Auth.logout), bearer API tokens (PersonalAccessToken) and JWTs, Gate/Policy authorization, relational roles & permissions (RBAC), password reset and magic-link brokers, TOTP two-factor auth, WebAuthn Passkeys, and social/OAuth login (Social — GitHub, Google, Apple, and more). Password hashing (Hash) defaults to argon2id and every token is stored hashed.

Builds on @zerotal/session — register SessionProvider then AuthProvider.

Examples

Log a user in

import { Auth } from "@zerotal/auth";

if (await Auth.attempt({ email, password }, remember)) {
  return redirect("/dashboard");
}
return redirect().back().withErrors({ email: "These credentials do not match our records." });

Authorize an action

import { Gate } from "@zerotal/auth";

Gate.define("update-post", (user, post) => post.authorId === user.id);

if (await Gate.allows("update-post", post)) {
  // …
}

Remarks

Discovers the authenticatable model from the registry, so ctx.user and Auth.user work with no extra wiring. Requires Bun ≥ 1.1.

Auth

Creating

Other

Providers

Verifying