theauth

<p align="center"> <pre> ████████╗██╗ ██╗███████╗ █████╗ ██╗ ██╗████████╗██╗ ██╗ ╚══██╔══╝██║ ██║██╔════╝██╔══██╗██║ ██║╚══██╔══╝██║ ██║ ██║ ███████║█████╗ ███████║██║ ██║ ██║ ███████║ ██║ ██╔══██║██╔══╝ ██╔══██║██║ ██║ ██║ ██╔══██║ ██║ ██║ ██║███████╗██║ ██║╚██████╔╝ ██║ ██║ ██║ ╚═╝ ╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ╚═╝ </pre> </p> <h2 align="center"><em>用于TypeScript的类型安全身份验证。OAuth 2.1、MCP、通行密钥、代理。</em></h2> <p align="center"> 由 <a href="https://glincker.com"><strong>GLINR STUDIOS</strong></a> &middot; <a href="https://glincker.com">GLINCKER LLC</a> 项目 </p> <p align="center"> <a href="https://www.npmjs.com/package/@glinr/theauth"><img src="https://img.shields.io/npm/v/@glinr/theauth?style=flat&colorA=000000&colorB=000000&label=npm" alt="npm 版本" /></a> <a href="https://www.npmjs.com/package/@glinr/theauth"><img src="https://img.shields.io/npm/dm/@glinr/theauth?style=flat&colorA=000000&colorB=000000&label=下载量" /></a> <a href="https://github.com/glincker/theauth/blob/main/LICENSE"><img src="https://img.shields.io/github/license/glincker/theauth?style=flat&colorA=000000&colorB=000000&label=许可证" alt="许可证" /></a> <a href="https://github.com/glincker/theauth/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/glincker/theauth/ci.yml?branch=main&style=flat&colorA=000000&colorB=000000&label=CI" alt="CI 状态" /></a> <a href="https://bundlephobia.com/package/@glinr/theauth"><img src="https://img.shields.io/bundlephobia/minzip/@glinr/theauth?style=flat&colorA=000000&colorB=000000&label=包大小" alt="包大小" /></a> <a href="https://www.typescriptlang.org/"><img src="https://img.shields.io/badge/TypeScript-strict-blue?style=flat&colorA=000000&colorB=3178c6&logo=typescript&logoColor=white" alt="TypeScript 严格模式" /></a> <a href="https://github.com/glincker/theauth/discussions"><img src="https://img.shields.io/github/discussions/glincker/theauth?style=flat&colorA=000000&colorB=000000&label=讨论" alt="GitHub 讨论" /></a> </p> <p align="center"> <a href="https://docs.theauth.dev/docs/quickstart"><strong>快速开始</strong></a> &middot; <a href="https://docs.theauth.dev/docs"><strong>文档</strong></a> &middot; <a href="https://github.com/glincker/theauth/tree/main/examples"><strong>示例</strong></a> &middot; <a href="https://github.com/glincker/theauth/discussions"><strong>讨论</strong></a> &middot; <a href="https://app.theauth.dev"><strong>TheAuth 云端</strong></a> </p> --- ## 安装 ```bash npm install @glinr/theauth # 或 pnpm add @glinr/theauth # 或 yarn add @glinr/theauth ``` ```typescript import { createKavach } from "@glinr/theauth"; import { emailPassword, passkey } from "@glinr/theauth/auth"; import { createHonoAdapter } from "@glinr/theauth-hono"; const kavach = createKavach({ database: { provider: "postgres", url: process.env.DATABASE_URL }, plugins: [emailPassword(), passkey()], }); const app = new Hono(); app.route("/api/auth", createHonoAdapter(kavach)); // 创建具有作用域 MCP 权限的 AI 代理 const agent = await kavach.agent.create({ ownerId: "user-123", name: "github-reader", type: "autonomous", permissions: [{ resource: "mcp:github:*", actions: ["read"] }], }); const result = await kavach.authorize(agent.id, { action: "read", resource: "mcp:github:repos", }); // { allowed: true, auditId: "aud_..." } ``` --- ## 为什么选择 TheAuth 大多数身份验证库仅限于人类登录。这意味着您需要为 AI 代理的身份、作用域权限、委托和审计跟踪单独构建系统。TheAuth 在一个地方处理两者。 | 功能 | Auth0 | Clerk | Better-Auth | NextAuth | Lucia | **TheAuth** | |---|---|---|---|---|---|---| | 许可证 | 专有 | 专有 | MIT | ISC | MIT | **MIT** | | 自托管 | 部分 | 否 | 是 | 是 | 是 | **是** | | OAuth 2.1 服务器 | 是 | 是 | 部分 | 否 | 否 | **是** | | MCP OAuth 2.1 | 否 | 否 | 否 | 否 | 否 | **是** | | 通行密钥 / WebAuthn | 是 | 是 | 插件 | 插件 | 否 | **是** | | 多租户 / 组织 | 是 | 是 | 插件 | 否 | 否 | **是** | | 审计日志 | 是（付费） | 是（付费） | 否 | 否 | 否 | **是** | | AI 代理身份 | 否 | 否 | 否 | 否 | 否 | **是** | | 边缘运行时 | 部分 | 否 | 是 | 部分 | 是 | **是** | --- ## 功能 <details> <summary><strong>完整的功能清单（点击展开）</strong></summary> ### 身份验证 - 带有 HIBP 泄露检查的电子邮件和密码 - 魔法链接 - 电子邮件 OTP - 手机短信 OTP - 通行密钥 / WebAuthn - TOTP 2FA（身份验证器应用程序） - SAML 2.0 和 OIDC SSO - 匿名会话 - Google One Tap - 使用以太坊登录 - 设备授权（TV / CLI 流） - 用户名和密码 - 验证码集成 - 会话新鲜度强制执行 ### OAuth 2.1 - 授权代码 + PKCE - 客户端凭证 - 设备授权授予 - 刷新令牌轮换 - 令牌自省 - 动态客户端注册（RFC 7591） - 服务器元数据（RFC 8414） - 资源指示符（RFC 8707） - 授权服务器发行商识别（RFC 9728） ### MCP 支持 - 适用于模型上下文协议的完整 OAuth 2.1 授权服务器 - PKCE S256 强制 - 符合 RFC 9728 / 8707 / 8414 / 7591 - 代理令牌发行和验证 ### AI 代理身份 - 加密的承载令牌（`kv_...`） - 通配符权限匹配 - 可配置深度限制的委托链 - 每个代理的预算策略 - 异常检测 - 敏感工具调用的 CIBA 样式批准流程 - 每个代理操作完整的审计跟踪 ### 框架适配器 - Next.js 15（应用路由器，路由处理程序，中间件） - SvelteKit - Nuxt / Vue - Hono（Cloudflare Workers，Bun，Deno） - Express - Fastify - Astro - NestJS - SolidStart - TanStack Start - React Native / Expo - Electron ### 数据库适配器 内置：SQLite，PostgreSQL，MySQL，Cloudflare D1 插件：Prisma（共享现有的 PrismaClient） ### 企业 - 具有 RBAC 的组织 - SCIM 目录同步 - 管理控制（禁止，模拟） - API 密钥管理 - 多租户隔离 - GDPR：导出，删除，匿名化 - 合规报告：欧盟 AI 法案，NIST，SOC 2，ISO 42001 ### 边缘运行时 - Cloudflare Workers（D1，KV） - Vercel Edge Functions - Deno Deploy - Bun - 三个运行时依赖项：`drizzle-orm`，`jose`，`zod` </details> --- ## 快速入门（按框架） <details> <summary><strong>Next.js（应用路由器）</strong></summary> ```bash npm install @glinr/theauth @glinr/theauth-nextjs ``` ```typescript // app/api/auth/[...theauth]/route.ts import { createKavach } from "@glinr/theauth"; import { emailPassword } from "@glinr/theauth/auth"; import { createNextAuthHandler } from "@glinr/theauth-nextjs"; const kavach = createKavach({ database: { provider: "postgres", url: process.env.DATABASE_URL }, plugins: [emailPassword()], }); const handler = createNextAuthHandler(kavach); export { handler as GET, handler as POST }; ``` ```typescript // app/dashboard/page.tsx（服务器组件） import { getServerSession } from "@glinr/theauth-nextjs"; export default async function Dashboard() { const session = await getServerSession(); if (!session) redirect("/sign-in"); return <h1>Hello, {session.user.email}</h1>; } ``` 参见 [`examples/nextjs-app`](https://github.com/glincker/theauth/tree/main/examples/nextjs-app) 以获取完整的工作示例。 </details> <details> <summary><strong>SvelteKit</strong></summary> ```bash npm install @glinr/theauth @glinr/theauth-sveltekit ``` ```typescript // src/hooks.server.ts import { createKavach } from "@glinr/theauth"; import { emailPassword } from "@glinr/theauth/auth"; import { createSvelteKitHandler } from "@glinr/theauth-sveltekit"; const kavach = createKavach({ database: { provider: "sqlite", url: "kavach.db" }, plugins: [emailPassword()], }); export const handle = createSvelteKitHandler(kavach); ``` ```typescript // src/routes/+layout.server.ts import { getSession } from "@glinr/theauth-sveltekit"; export async function load(event) { const session = await getSession(event); return { session }; } </details> <details> <summary><strong>Vue / Nuxt</strong></summary> ```bash npm install @glinr/theauth @glinr/theauth-nuxt ``` ```typescript // server/plugins/theauth.ts import { createKavach } from "@glinr/theauth"; import { emailPassword } from "@glinr/theauth/auth"; export const kavach = createKavach({ database: { provider: "postgres", url: process.env.DATABASE_URL }, plugins: [emailPassword()], }); ``` ```typescript // nuxt.config.ts export default defineNuxtConfig({ modules: ["@glinr/theauth-nuxt"], }); ``` </details> <details> <summary><strong>Hono（Cloudflare Workers / Express / Bun）</strong></summary> ```bash npm install @glinr/theauth @glinr/theauth-hono ``` ```typescript import { Hono } from "hono"; import { createKavach } from "@glinr/theauth"; import { emailPassword } from "@glinr/theauth/auth"; import { createHonoAdapter } from "@glinr/theauth-hono"; type Env = { DATABASE_URL: string }; const app = new Hono<{ Bindings: Env }>(); app.use("/api/auth/*", async (c, next) => { const kavach = createKavach({ database: { provider: "postgres", url: c.env.DATABASE_URL }, plugins: [emailPassword()], }); return createHonoAdapter(kavach)(c, next); }); export default app; ``` 参见 [`examples/hono-server`](https://github.com/glincker/theauth/tree/main/examples/hono-server) 和 [`examples/cloudflare-workers`](https://github.com/glincker/theauth/tree/main/examples/cloudflare-workers)。 </details> --- ## 文档 **主要文档：[docs.theauth.dev](https://docs.theauth.dev/docs) | 章节 | 链接 | 您将找到的内容 | |---|---|---| | 快速入门 | [docs.theauth.dev/docs/quickstart](https://docs.theauth.dev/docs/quickstart) | 安装，第一个身份验证流程 | | 身份验证 | [docs.theauth.dev/docs/auth](https://docs.theauth.dev/docs/auth) | 所有身份验证方法和插件 | | 代理身份 | [docs.theauth.dev/docs/agents](https://docs.theauth.dev/docs/agents) | 代理令牌，委托，策略 | | 权限 | [docs.theauth.dev/docs/permissions](https://docs.theauth.dev/docs/permissions) | RBAC，通配符匹配，ReBAC | | MCP OAuth 2.1 | [docs.theauth.dev/docs/mcp](https://docs.theauth.dev/docs/mcp) | MCP 身份验证服务器设置 | | 框架适配器 | [docs.theauth.dev/docs/adapters](https://docs.theauth.dev/docs/adapters) | Next.js，Hono，SvelteKit 等。 | | API 参考 | [docs.theauth.dev/docs/api](https://docs.theauth.dev/docs/api) | 配置，类型，错误 | | 安全 | [SECURITY.md](SECURITY.md) | 威胁模型，披露政策 | --- ## 框架适配器 | 包 | 框架 | 目录 | |---|---|---| | `@glinr/theauth-nextjs` | Next.js 15（应用路由器） | [`packages/adapters/nextjs`](https://github.com/glincker/theauth/tree/main/packages/adapters/nextjs) | | `@glinr/theauth-nextjs-auth` | Next.js（外部身份验证后端） | [`packages/adapters/nextjs-auth`](https://github.com/glincker/theauth/tree/main/packages/adapters/nextjs-auth) | | `@glinr/theauth-hono` | Hono（Workers，Bun，Deno） | [`packages/adapters/hono`](https://github.com/glincker/theauth/tree/main/packages/adapters/hono) | | `@glinr/theauth-express` | Express | [`packages/adapters/express`](https://github.com/glincker/theauth/tree/main/packages/adapters/express) | | `@glinr/theauth-fastify` | Fastify | [`packages/adapters/fastify`](https://github.com/glincker/theauth/tree/main/packages/adapters/fastify) | | `@glinr/theauth-sveltekit` | SvelteKit | [`packages/adapters/sveltekit`](https://github.com/glincker/theauth/tree/main/packages/adapters/sveltekit) | | `@glinr/theauth-nuxt` | Nuxt / Vue 3 | [`packages/adapters/nuxt`](https://github.com/glincker/theauth/tree/main/packages/adapters/nuxt) | | `@glinr/theauth-astro` | Astro | [`packages/adapters/astro`](https://github.com/glincker/theauth/tree/main/packages/adapters/astro) | | `@glinr/theauth-nestjs` | NestJS | [`packages/adapters/nestjs`](https://github.com/glincker/theauth/tree/main/packages/adapters/nestjs) | | `@glinr/theauth-solidstart` | SolidStart | [`packages/adapters/solidstart`](https://github.com/glincker/theauth/tree/main/packages/adapters/solidstart) | | `@glincker/theauth/tree/main/packages/adapters/tanstack) | [`packages/adapters/tanstack`](https://github.com/glincker/theauth/tree/main/packages/adapters/tanstack) | | `@glinr/theauth-expo` | React Native / Expo | [`packages/adapters/expo`](https://github.com/glincker/theauth/tree/main/packages/adapters/expo) | | `@glinr/theauth-electron` | Electron | [`packages/adapters/electron`](https://github.com/glincker/theauth/tree/main/packages/adapters/electron) | --- ## 数据库适配器 SQLite，PostgreSQL，MySQL 和 Cloudflare D1 内置于核心包中。使用 Prisma 适配器共享现有的 PrismaClient。 | 包 | 连接到 | 目录 | |---|---|---| | 内置 SQLite | `better-sqlite3`，`bun:sqlite`，D1 | core | | 内置 PostgreSQL | `pg`，`postgres`，Neon，Supabase | core | | 内置 MySQL | `mysql2` | core | | `@glinr/theauth-prisma` | Prisma（共享您的 PrismaClient） | [`packages/prisma`](https://github.com/glincker/theauth/tree/main/packages/prisma) | --- ## 示例应用 | 示例 | 展示内容 | 目录 | |---|---|---| | `nextjs-app` | 完整的 Next.js 15 应用路由器集成 | [`examples/nextjs-app`](https://github.com/glincker/theauth/tree/main/examples/nextjs-app) | | `nextjs-demo` | UI 组件 + 登录流程 | [`examples/nextjs-demo`](https://github.com/glincker/theauth/tree/main/examples/nextjs-demo) | | `hono-server` | 独立 Hono API，带有身份验证 | [`examples/hono-server`](https://github.com/glincker/theauth/tree/main/examples/hono-server) | | `cloudflare-workers` | Workers + D1 数据库 | [`examples/cloudflare-workers`](https://github.com/glincker/theauth/tree/main/examples/cloudflare-workers) | | `mcp-server` | MCP OAuth 2.1 授权服务器 | [`examples/mcp-server`](https://github.com/glincker/theauth/tree/main/examples/mcp-server) | | `basic-agent` | AI 代理令牌发行和策略 | [`examples/basic-agent`](https://github.com/glincker/theauth/tree/main/examples/basic-agent) | | `migrate-from-auth0` | 逐步 Auth0 迁移 | [`examples/migrate-from-auth0`](https://github.com/glincker/theauth/tree/main/examples/migrate-from-auth0) | | `migrate-from-better-auth-agent-plugin` | 从 better-auth 代理插件迁移 | [`examples/migrate-from-better-auth-agent-plugin`](https://github.com/glincker/theauth/tree/main/examples/migrate-from-better-auth-agent-plugin) | --- ## TheAuth 云端 具有仪表盘，计费和零基础设施的主机版本。[app.theauth.dev](https://app.theauth.dev) | 计划 | 每月活跃用户 | 价格 | |---|---|---| | 免费 | 1,000 | $0 | | 入门 | 10,000 | $29/月 | | 增长 | 50,000 | $79/月 | | 缩放 | 200,000 | $199/月 | | 企业 | 自定义 | 自定义 | --- ## 安全 负责任的披露：请参阅 [SECURITY.md](SECURITY.md)。不要为漏洞打开公共问题。 --- ## 路线图 在 [GitHub Discussions](https://github.com/glincker/theauth/discussions) 和 [changelog](CHANGELOG.md) 上关注开发进度。 --- ## 贡献 参见 [CONTRIBUTING.md](CONTRIBUTING.md)。第一次贡献？查找标有 `good first issue` 的问题。 通过贡献，您同意 [Code of Conduct](CODE_OF_CONDUCT.md)。 --- ## 许可证 [MIT](LICENSE) (c) GLINCKER LLC --- <p align="center"> <em>由 <a href="https://thesvg.org">theSVG.org</a> 创始人构建。</em> <br /> <em><strong>GLINR STUDIOS</strong> 的产品 | <strong>GLINCKER 公司</strong></em> </p>