ExorTek/auth

# @exortek/auth 一个与框架无关的 Node.js 身份验证工具包 —— 设计为在一个 scope 下的 20 个小型 package；其中 **15 个已于今日发布**（详见下方的发布状态），其余为计划中。按需选择您要用的那一个。基于 `node:crypto` 构建。 [](./LICENSE) [](https://nodejs.org) [](https://auth.memet.dev) ## 发布状态 | Package | Version | Docs | |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------------------------------------------------------------------------------------------------------------------------:|------------------------------------------------------------| | [`@exortek/crypto`](./packages/crypto) — hash · hmac · KDFs · cipher · sign · seal · encode · CSPRNG | [](https://www.npmjs.com/package/@exortek/crypto) | [auth.memet.dev/crypto](https://auth.memet.dev/crypto) | | [`@exortek/security`](./packages/security) — CSRF · rate-limit · headers · CORS · safe-redirect · webhook verify (+ Stripe) + adapters for Fastify · Express | [](https://www.npmjs.com/package/@exortek/security) | [auth.memet.dev/security](https://auth.memet.dev/security) | | [`@exortek/otp`](./packages/otp) — RFC 4226 HOTP + RFC 6238 TOTP with backup codes, provisioning URI, replay defense | [](https://www.npmjs.com/package/@exortek/otp) | [auth.memet.dev/otp](https://auth.memet.dev/otp) | | [`@exortek/password`](./packages/password) — Argon2id / scrypt / bcrypt / PBKDF2 + strength / policy / generate / pepper (rotation) / history / HIBP + constant-time verify | [](https://www.npmjs.com/package/@exortek/password) | [auth.memet.dev/password](https://auth.memet.dev/password) | | [`@exortek/session`](./packages/session) — sealed-cookie sessions, rotation, revocation, sudo mode, impersonation, concurrent limits, Redis pub/sub + Fastify/Express | [](https://www.npmjs.com/package/@exortek/session) | [auth.memet.dev/session](https://auth.memet.dev/session) | | [`@exortek/jwk`](./packages/jwk) — generate / import / export JWK ↔ PEM (EC · RSA · OKP · oct), RFC 7638 + 9278 thumbprints, `toPublic()` / `matches()` differentiators | [](https://www.npmjs.com/package/@exortek/jwk) | [auth.memet.dev/jwk](https://auth.memet.dev/jwk) | | [`@exortek/jws`](./packages/jws) — JSON Web Signature (RFC 7515) — compact + JSON serialisation, detached (§F), unencoded payload (RFC 77997), HS / RS / PS / ES / EdDSA | [](https://www.npmjs.com/package/@exortek/jws) | [auth.memet.dev/jws](https://auth.memet.dev/jws) | | [`@exortek/jwt`](./packages/jwt) — JSON Web Token (RFC 7519 + RFC 8725 + RFC 9068) — `sign` / `verify` / `peek`, `tokenPair` with RFC 6749 §10.4 reuse detection, blacklist stores | [](https://www.npmjs.com/package/@exortek/jwt) | [auth.memet.dev/jwt](https://auth.memet.dev/jwt) | | [`@exortek/challenge`](./packages/challenge) — HMAC-signed multi-step flow tokens (userId · method · step · nextStep · metadata), opt-in single-use + IP binding, memory / Redis stores | [](https://www.npmjs.com/package/@exortek/challenge) | [auth.memet.dev/challenge](https://auth.memet.dev/challenge) | | [`@exortek/apikey`](./packages/apikey) — Stripe-style prefixed API keys (`sk_live_id_secret`) with HMAC-SHA256 storage + optional pepper rotation, scope allowlists, memory / Redis stores, Express + Fastify middleware | [](https://www.npmjs.com/package/@exortek/apikey) | [auth.memet.dev/apikey](https://auth.memet.dev/apikey) | | [`@exortek/magic-link`](./packages/magic-link) — passwordless email-link auth — HMAC-signed short-lived tokens, single-use consume, opt-in per-email rate limit, memory / Redis stores; you send the email | [](https://www.npmjs.com/package/@exortek/magic-link) | [auth.memet.dev/magic-link](https://auth.memet.dev/magic-link) | | [`@exortek/jwks`](./packages/jwks) — JWK Set (RFC 7517 §5) — local key set with zero-downtime rotation + remote JWKS URI fetching with kid-miss refetch, `/.well-known/jwks.json` handler | [](https://www.npmjs.com/package/@exortek/jwks) | [auth.memet.dev/jwks](https://auth.memet.dev/jwks) | | [`@exortek/ua`](./packages/ua) — User-Agent parsing, device/browser/bot detection, Client Hints, fingerprinting + Express/Fastify middleware + bot-guard | [](https://www.npmjs.com/package/@exortek/ua) | [auth.memet.dev/ua](https://auth.memet.dev/ua) | | [`@exortek/opaque`](./packages/opaque) — opaque reference tokens, RFC 7662 introspection + RFC 7009 revocation HTTP handlers, memory / Redis stores | [](https://www.npmjs.com/package/@exortek/opaque) | [auth.memet.dev/opaque](https://auth.memet.dev/opaque) | | [`@exortek/passkey`](./packages/passkey) — WebAuthn Level 3 / FIDO2 server verification, all seven attestation formats, MDS3 + AAGUID subpaths, extension I/O | [](https://www.npmjs.com/package/@exortek/passkey) | [auth.memet.dev/passkey](https://auth.memet.dev/passkey) | ## 技术栈 编号反映了依赖顺序 —— 编号较低的 package 绝不会导入编号较高的 package，因此您可以一次只采用一个 package。 带有链接的条目**已在 npm 上发布**；其余为**计划中**，尚不可安装。 | # | Package | Status | 功能描述 | |:--:|--------------------------------------------|-----------|------------------------------------------------------------------------------------------| | 01 | [`@exortek/crypto`](./packages/crypto) | shipped | crypto primitives — 其余 package 构建的基础 | | 02 | [`@exortek/password`](./packages/password) | shipped | Argon2id / scrypt / bcrypt / PBKDF2，强度评分，HIBP 泄露检查，peppering | | 03 | [`@exortek/otp`](./packages/otp) | shipped | TOTP / HOTP，备用代码，QR 配置 URI | | 04 | [`@exortek/challenge`](./packages/challenge) | shipped | HMAC 签名的多步骤流程 token，带有可选的 single-use + IP 绑定 | | 05 | [`@exortek/jwk`](./packages/jwk) | shipped | 生成 / 导入 / 导出 JWK ↔ PEM (EC · RSA · OKP · oct)，RFC 7638 + 9278 thumbprints | | 06 | [`@exortek/jws`](./packages/jws) | shipped | JWS compact + JSON，detached，`b64:false`，HS / RS / PS / ES / EdDSA + secp256k1 | | 07 | [`@exortek/jwt`](./packages/jwt) | shipped | JWT sign / verify / peek，带有 RFC 6749 §10.4 reuse detection 的 tokenPair，blacklist stores | | 08 | `@exortek/jwe` | _planned_ | JWE encrypted payloads (RSA-OAEP, A256KW, dir) | | 09 | [`@exortek/jwks`](./packages/jwks) | shipped | JWKS 本地 key set + 远程 URI fetching，缓存，零停机 `kid` 轮换 | | 10 | [`@exortek/session`](./packages/session) | shipped | sealed cookies，轮换，撤销，sudo mode，impersonation，Redis pub/sub | | 11 | [`@exortek/security`](./packages/security) | shipped | CSRF，rate-limit，helmet 风格的 headers，CORS，safe-redirect + 防御性 HTTP helpers | | 12 | [`@exortek/ua`](./packages/ua) | shipped | User-Agent 解析，设备/浏览器/机器人检测，Client Hints，fingerprinting | | 13 | [`@exortek/apikey`](./packages/apikey) | shipped | Stripe 风格的带前缀 API keys，HMAC 哈希存储，scopes，middleware | | 14 | [`@exortek/magic-link`](./packages/magic-link) | shipped | 无密码 email-link 身份验证 —— 带有 single-use consume 的 HMAC 签名短期 token | | 15 | [`@exortek/passkey`](./packages/passkey) | shipped | WebAuthn Level 3 / FIDO2 服务器验证 —— 支持全部七种 attestation formats + MDS3 + AAGUID | | 16 | [`@exortek/opaque`](./packages/opaque) | shipped | opaque reference tokens —— RFC 7662 introspection + RFC 7009 revocation HTTP handlers | | 17 | `@exortek/paseto` | _planned_ | PASETO v4 (`local` / `public`) | | 18 | `@exortek/oauth2` | _planned_ | OAuth 2.1 client (PKCE) + provider presets | | 19 | `@exortek/oidc` | _planned_ | 构建于 `oauth2` 之上的 OpenID Connect | | 20 | `@exortek/auth` | _planned_ | umbrella package —— 重新导出上述所有 package | ## 安装 每个已发布的 package 均可独立安装： ``` npm install @exortek/crypto npm install @exortek/security npm install @exortek/otp npm install @exortek/password npm install @exortek/session npm install @exortek/jwk npm install @exortek/jws npm install @exortek/jwt npm install @exortek/challenge npm install @exortek/apikey # + optional: ioredis or redis, express or fastify npm install @exortek/magic-link # + optional: ioredis or redis npm install @exortek/jwks npm install @exortek/ua # + optional: express or fastify npm install @exortek/opaque # + optional: ioredis or redis, express or fastify npm install @exortek/passkey # + optional: ioredis or redis, express or fastify ``` Node.js **22 或更新版本**。 ## 代码库 - **文档：** [auth.memet.dev](https://auth.memet.dev) - **架构：** [ARCHITECTURE.md](./ARCHITECTURE.md) - **AI agents：** [AGENTS.md](./AGENTS.md) - **贡献：** [CONTRIBUTING.md](./CONTRIBUTING.md) - **问题：** [github.com/ExorTek/auth/issues](https://github.com/ExorTek/auth/issues) - **安全：** 发送邮件至 `memet@memet.dev` [MIT](/LICENSE) © ExorTek.

标签：GNU通用公共许可证, JWT, MITM代理, Node.js, WebAuthn, 加密库, 开发组件, 搜索引擎查询, 自定义脚本