Authtagon

A comprehensive, security-first authentication package built for SvelteKit with framework-agnostic adapters. The octagon of authentication security - eight sides of protection for your applications.

🎉 Latest Achievement: Complete TypeScript cleanup finished! Zero type errors across the entire codebase with 100% type safety for all enterprise features including audit logging, GDPR compliance, and regulatory frameworks.

🛡️ Features

• 🔐 Security First: OWASP-compliant with advanced threat detection
• 🎯 SvelteKit Native: Built specifically for SvelteKit with perfect integration
• 🔄 Framework Agnostic: Adapters for Next.js, Express, and more
• 🛡️ Enterprise Grade: MFA, audit logging, breach detection, risk assessment
• ⚡ Performance Optimized: Minimal overhead with intelligent caching
• 🎨 Developer Experience: TypeScript-first with excellent DX

📊 Development Status

Current Version: 1.0.0 (Pre-release)
Type Safety: 100% ✅
Build Status: All modules compile successfully ✅

📋 View detailed progress tracking
🧹 TypeScript cleanup achievements

📦 Installation

```bash npm install authtagon ```

🏃 Quick Start

SvelteKit Setup

1. Configure your database adapter:

```ts // src/lib/auth.ts import { createAuthtagon } from 'authtagon/sveltekit'; import { DrizzleAdapter } from 'authtagon/adapters/database';

export const auth = createAuthtagon({ adapter: new DrizzleAdapter(db), secret: process.env.AUTH_SECRET, session: { strategy: 'jwt', maxAge: 30 _ 24 _ 60 * 60, // 30 days }, security: { rateLimit: true, mfa: true, breachDetection: true, } }); ```

2. Add server hooks:

```ts // src/hooks.server.ts import { auth } from '$lib/auth';

export const handle = auth.handle; ```

3. Use in your routes:

```svelte

{#if user}

Welcome, {user.email}!

🔧 Framework Adapters

Next.js

```ts // middleware.ts import { NextAuth } from 'authtagon/nextjs';

export const auth = new NextAuth({ // ... configuration });

export default auth.middleware; ```

Express

```ts // server.js import express from 'express'; import { ExpressAuthAdapter } from 'authtagon/express';

const app = express(); const auth = new ExpressAuthAdapter({ // ... configuration });

app.use('/auth', auth.createRouter()); ```

🛡️ Security Features

Multi-Factor Authentication

```ts // Enable MFA for a user await auth.mfa.enable(userId, { method: 'totp', // 'totp' | 'sms' | 'email' | 'webauthn' phoneNumber: '+1234567890' // for SMS });

// Verify MFA token const isValid = await auth.mfa.verify(userId, token); ```

Risk Assessment

```ts // Automatic risk scoring const riskScore = await auth.risk.assess({ userId, ip: request.ip, userAgent: request.headers['user-agent'], action: 'login' });

if (riskScore > 0.8) { // Require additional verification await auth.mfa.challenge(userId); } ```

Breach Detection

```ts // Check password against known breaches const isBreached = await auth.security.checkPasswordBreach(password); if (isBreached) { throw new Error('Password found in known data breaches'); } ```

📚 API Reference

Core Methods

auth.signIn(credentials)

Authenticate a user with email/password.

```ts const auth = createAuthtagon({ database: "..." }); const result = await auth.signIn({ email: 'user@example.com', password: 'securePassword123', mfaToken?: '123456' // if MFA enabled }); ```

auth.signUp(userData)

Register a new user account.

```ts const user = await auth.signUp({ email: 'user@example.com', password: 'securePassword123', name: 'John Doe' }); ```

auth.signOut(sessionId?)

Sign out user and invalidate session.

```ts await auth.signOut(); // Current session await auth.signOut('session_id'); // Specific session ```

Session Management

auth.session.get(sessionId)

Retrieve session information.

```ts const session = await auth.session.get(sessionId); ```

auth.session.refresh(sessionId)

Refresh session and rotate tokens.

```ts const newSession = await auth.session.refresh(sessionId); ```

🔒 Security Configuration

```ts export const auth = createAuthtagon({ security: { // Rate limiting rateLimit: { enabled: true, maxAttempts: 5, windowMs: 15 _ 60 _ 1000, // 15 minutes blockDuration: 60 _ 60 _ 1000 // 1 hour },

// Password requirements
password: {
  minLength: 12,
  requireUppercase: false, // OWASP recommends against composition rules
  requireNumbers: false,
  requireSpecialChars: false,
  checkBreaches: true
},

// Session security
session: {
  rotateOnAuth: true,
  sameSite: 'strict',
  secure: true,
  httpOnly: true
},

// CSRF protection
csrf: {
  enabled: true,
  secret: process.env.CSRF_SECRET
}

} }); ```

🗄️ Database Adapters

Drizzle ORM

```ts import { DrizzleAdapter } from 'authtagon/adapters/drizzle'; import { db } from './db';

const adapter = new DrizzleAdapter(db); ```

Prisma

```ts import { PrismaAdapter } from 'authtagon/adapters/prisma'; import { prisma } from './prisma';

const adapter = new PrismaAdapter(prisma); ```

Custom Adapter

```ts import { DatabaseAdapter } from 'authtagon/types';

class CustomAdapter implements DatabaseAdapter { async createUser(userData) { // Implementation }

async getUserByEmail(email) { // Implementation }

// ... other required methods } ```

🚀 Deployment

Environment Variables

```env

Required

AUTH_SECRET=your-super-secret-key-here DATABASE_URL=your-database-connection-string

Optional

CSRF_SECRET=your-csrf-secret SMTP_HOST=smtp.example.com SMTP_USER=your-smtp-user SMTP_PASS=your-smtp-password HIBP_API_KEY=your-haveibeenpwned-api-key ```

Vercel

```json // vercel.json { "env": { "AUTH_SECRET": "@auth-secret", "DATABASE_URL": "@database-url" } } ```

🔄 Migration Guides

From Lucia Auth

```ts // Before (Lucia) import { lucia } from 'lucia';

// After (Authtagon) import { createAuthtagon } from 'authtagon/sveltekit'; ```

From Better Auth

```ts // Migration helper import { migrateBetterAuth } from 'authtagon/migrate';

await migrateBetterAuth({ from: betterAuthConfig, to: authtagronConfig }); ```

🤝 Contributing

We welcome contributions! Please see our Contributing Guide for details.

📄 License

MIT License - see LICENSE file for details.

🆚 Comparison

📞 Support

• 📖 Documentation
• 💬 Discord Community
• 🐛 Issue Tracker
• 📧 Email Support

Authtagon - Authentication that doesn't suck.