Registry / auth-security / pico-auth

pico-auth

JSON →
library0.3.0.post0jsnpmunverified

A minimal authentication library (v0.0.43, alpha) providing user/password login, TOTP-based MFA, and impersonation support. Focuses on simplicity and flexibility by letting callers supply custom UserProvider and ImpersonateProvider interfaces. Ships TypeScript types and offers JWT token issuance with refresh tokens. Active development with frequent updates.

npm install pico-auth
INSTALL
IMPORT
SIG · PICO-AUTH
P
pico-auth
auth-securityjavascriptv0.3.0.post0
Install
Import
Disk
Pass rate
0/ 6
Env Coverage0 / 6
glibc
1822
musl
1822
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
node 18226 runs
build_error
glibc
node 18226 runs
build_error
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

authenticate
import { authenticate } from 'pico-auth'
const authenticate = require('pico-auth').authenticate
ESM-only; no default export.
refreshToken
import { refreshToken } from 'pico-auth'
Named export for refreshing JWT tokens.
UserProvider
import { UserProvider } from 'pico-auth'
import { userProvider } from 'pico-auth'
TypeScript type export; case-sensitive.
mfaRegister
import { mfaRegister } from 'pico-auth'
import { mfa_register } from 'pico-auth'
camelCase export name.

Demonstrates basic password authentication with custom UserProvider and JWT spec, outputting access and refresh tokens.

import { authenticate } from 'pico-auth'; const userProvider = { async getUser(login: string) { // mock: return user from DB return { id: 'user1', passwordHash: 'hashed_pw', name: 'Test User' }; }, async putUser(user: any) { return user; }, userPasswordPath: 'passwordHash', }; const jwtSpecs = { secretKey: process.env.JWT_SECRET || 'changeme', expiryTimeMs: 3600000, // 1 hour }; async function main() { const tokens = await authenticate('user1', 'password123', undefined, undefined, userProvider, undefined, jwtSpecs); console.log('Access token:', tokens.token); console.log('Refresh token:', tokens.refreshToken); } main().catch(console.error);
Debug
Known issues
gotchaUserProvider.getUser must return a BaseUser typed object with a 'blocked' field optional; otherwise, blocked users are still authenticated if not checked manually.
fix
Implement getUser to return a user with 'blocked' set to true for blocked users, or use custom logic.
affects: >=0.0.0
gotchaThe 'impersonateEntity' parameter in authenticate is typed as any; passing an invalid entity can crash without clear error.
fix
Ensure impersonateEntity matches your ImpersonateProvider's expectations.
affects: >=0.0.0
gotchaJWTSpecs.expiryTimeMs accepts any type; passing a string instead of number may cause runtime errors.
fix
Always pass a number for expiryTimeMs.
affects: >=0.0.0
Errors
Common errors & fixes
Error: getUser must return a BaseUser object
UserProvider.getUser returned null or undefined instead of a valid user object.
fix
Ensure getUser returns a Promise<BaseUser>; if user not found, throw an error instead of returning null.
TypeError: Cannot destructure property 'token' of undefined
authenticate() returned undefined due to missing userProvider or jwtSpecs fields.
fix
Check that all required arguments are provided: login, password, userProvider, and jwtSpecs.
Cannot read properties of undefined (reading 'secretKey')
jwtSpecs object is missing secretKey property.
fix
Ensure jwtSpecs has both secretKey and expiryTimeMs defined.
Upgrade
Version history
0.3.0.post0latest on npm
Audit
Dependencies

No dependency data recorded yet.

Agent activity
16 hits · last 30 days
node
14
OpenAI (training)
1
Resources
pico-auth — npm install pico-auth · libregistry