Package Exports

@authtagon/authtagon
@authtagon/authtagon/components
@authtagon/authtagon/express
@authtagon/authtagon/nextjs
@authtagon/authtagon/react
@authtagon/authtagon/sveltekit

Readme

Authtagon

A comprehensive, security-first authentication package built for SvelteKit with framework-agnostic adapters. Enterprise-grade authentication with zero-trust principles, OWASP compliance, and excellent developer experience.

🎉 Latest Achievement: Complete TypeScript cleanup finished! Zero type errors across the entire codebase with 100% type safety for all enterprise features including audit logging, GDPR compliance, and regulatory frameworks.

🛡️ Features

🔐 Security First: OWASP-compliant with advanced threat detection
🎯 SvelteKit Native: Built specifically for SvelteKit with perfect integration
🔄 Framework Agnostic: Adapters for Next.js, Express, and more
🛡️ Enterprise Grade: MFA, audit logging, breach detection, risk assessment
⚡ Performance Optimized: Minimal overhead with intelligent caching
🎨 Developer Experience: TypeScript-first with excellent DX

📊 Development Status

Current Version: 1.0.2
Type Safety: 100% ✅
Build Status: All modules compile successfully ✅

📋 View detailed progress tracking
🧹 TypeScript cleanup achievements

📦 Installation

npm install @authtagon/authtagon

🏃 Quick Start

SvelteKit Setup

Configure your database adapter:

// src/lib/auth.ts
import { createAuthtagon } from '@authtagon/authtagon/sveltekit';
import { DrizzleAdapter } from '@authtagon/authtagon/adapters/database';

export const auth = createAuthtagon({
  adapter: new DrizzleAdapter(db),
  secret: process.env.AUTH_SECRET,
  session: {
    strategy: 'jwt',
    maxAge: 30 * 24 * 60 * 60, // 30 days
  },
  security: {
    rateLimit: true,
    mfa: true,
    breachDetection: true,
  }
});

Add server hooks:

// src/hooks.server.ts
import { auth } from '$lib/auth';

export const handle = auth.handle;

Use in your routes:

<!-- src/routes/+layout.svelte -->
<script>
  import { page } from '$app/stores';
  import { authStore } from '@authtagon/authtagon/stores';
  
  $: user = $authStore.user;
</script>

{#if user}
  <p>Welcome, {user.email}!</p>
  <button on:click={() => authStore.signOut()}>Sign Out</button>
{:else}
  <a href="/auth/signin">Sign In</a>
{/if}

🔧 Framework Adapters

Next.js

// middleware.ts
import { NextAuth } from '@authtagon/authtagon/nextjs';

export const auth = new NextAuth({
  // ... configuration
});

export default auth.middleware;

Express

// server.js
import express from 'express';
import { ExpressAuthAdapter } from '@authtagon/authtagon/express';

const app = express();
const auth = new ExpressAuthAdapter({
  // ... configuration
});

app.use('/auth', auth.createRouter());

🛡️ Security Features

Multi-Factor Authentication

// Enable MFA for a user
await auth.mfa.enable(userId, {
  method: 'totp', // 'totp' | 'sms' | 'email' | 'webauthn'
  phoneNumber: '+1234567890' // for SMS
});

// Verify MFA token
const isValid = await auth.mfa.verify(userId, token);

Risk Assessment

// Automatic risk scoring
const riskScore = await auth.risk.assess({
  userId,
  ip: request.ip,
  userAgent: request.headers['user-agent'],
  action: 'login'
});

if (riskScore > 0.8) {
  // Require additional verification
  await auth.mfa.challenge(userId);
}

Breach Detection

// Check password against known breaches
const isBreached = await auth.security.checkPasswordBreach(password);
if (isBreached) {
  throw new Error('Password found in known data breaches');
}

📚 API Reference

Core Methods

`auth.signIn(credentials)`

Authenticate a user with email/password.

const auth = createAuthtagon({ database: "..." });
const result = await auth.signIn({
  email: 'user@example.com',
  password: 'securePassword123',
  mfaToken?: '123456' // if MFA enabled
});

`auth.signUp(userData)`

const user = await auth.signUp({
  email: 'user@example.com',
  password: 'securePassword123',
  name: 'John Doe'
});

`auth.signOut(sessionId?)`

Sign out user and invalidate session.

await auth.signOut(); // Current session
await auth.signOut('session_id'); // Specific session

Session Management

`auth.session.get(sessionId)`

Retrieve session information.

const session = await auth.session.get(sessionId);

`auth.session.refresh(sessionId)`

Refresh session and rotate tokens.

const newSession = await auth.session.refresh(sessionId);

🔒 Security Configuration

export const auth = createAuthtagon({
  security: {
    // Rate limiting
    rateLimit: {
      enabled: true,
      maxAttempts: 5,
      windowMs: 15 * 60 * 1000, // 15 minutes
      blockDuration: 60 * 60 * 1000 // 1 hour
    },

    // Password requirements
    password: {
      minLength: 12,
      requireUppercase: false, // OWASP recommends against composition rules
      requireNumbers: false,
      requireSpecialChars: false,
      checkBreaches: true
    },

    // Session security
    session: {
      rotateOnAuth: true,
      sameSite: 'strict',
      secure: true,
      httpOnly: true
    },

    // CSRF protection
    csrf: {
      enabled: true,
      secret: process.env.CSRF_SECRET
    }
  }
});

🗄️ Database Adapters

Drizzle ORM

import { DrizzleAdapter } from '@authtagon/authtagon/adapters/drizzle';
import { db } from './db';

const adapter = new DrizzleAdapter(db);

Prisma

import { PrismaAdapter } from '@authtagon/authtagon/adapters/prisma';
import { prisma } from './prisma';

const adapter = new PrismaAdapter(prisma);

Custom Adapter

import { DatabaseAdapter } from '@authtagon/authtagon/types';

class CustomAdapter implements DatabaseAdapter {
  async createUser(userData) {
    // Implementation
  }

  async getUserByEmail(email) {
    // Implementation
  }

  // ... other required methods
}

🚀 Deployment

Environment Variables

# Required
AUTH_SECRET=your-super-secret-key-here
DATABASE_URL=your-database-connection-string

# Optional
CSRF_SECRET=your-csrf-secret
SMTP_HOST=smtp.example.com
SMTP_USER=your-smtp-user
SMTP_PASS=your-smtp-password
HIBP_API_KEY=your-haveibeenpwned-api-key

Vercel

// vercel.json
{
  "env": {
    "AUTH_SECRET": "@auth-secret",
    "DATABASE_URL": "@database-url"
  }
}

🔄 Migration Guides

From Lucia Auth

// Before (Lucia)
import { lucia } from 'lucia';

// After (Authtagon)
import { createAuthtagon } from '@authtagon/authtagon/sveltekit';

From Better Auth

// Migration helper
import { migrateBetterAuth } from '@authtagon/authtagon/migrate';

await migrateBetterAuth({
  from: betterAuthConfig,
  to: authtagronConfig
});

🤝 Contributing

We welcome contributions! Please see our Contributing Guide for details.

📄 License

MIT License - see LICENSE file for details.

🆚 Comparison

Feature	Authtagon	Supabase	Auth0	Lucia	Better Auth
SvelteKit Native	✅	❌	❌	✅	❌
Framework Agnostic	✅	✅	✅	❌	✅
Self-Hosted	✅	❌	❌	✅	✅
MFA Built-in	✅	✅	✅	❌	❌
Breach Detection	✅	❌	❌	❌	❌
Risk Assessment	✅	❌	✅	❌	❌
Audit Logging	✅	✅	✅	❌	❌
TypeScript First	✅	✅	✅	✅	✅

📞 Support

Authtagon - Authentication that doesn't suck.