Auth Server

@rapidrest/auth is a library for implementing a complete authentication server with RapidREST. It provides the data models, persistence adapters, and HTTP routes needed to register and authenticate users via password, TOTP, OTP (email/SMS), WebAuthn passkeys, FIDO2 hardware security keys, multi-factor authentication, and OpenID Connect / OAuth 2.0.

This builds on top of the JWT authentication and RBAC primitives that ship in @rapidrest/service-core itself — read Auth & RBAC first if you haven't. That section covers JWTStrategy, @Auth, @RequiresRole, and ACLs, all of which apply here too. @rapidrest/auth doesn't replace any of that; it adds the strategies, models, and routes needed to actually issue a JWT in the first place (register a user, verify a password, complete an OAuth flow, and so on).

Beta

@rapidrest/auth is currently 1.0.0-beta.1. The API surface, especially around OIDCStrategy and MFA option shapes, may still change before a stable 1.0.0.

Install

npm install @rapidrest/auth

@rapidrest/auth always requires @rapidrest/core and @rapidrest/service-core as peer dependencies. Beyond that, each strategy has its own optional peer dependency, installed only if you use that strategy:

Feature	Optional peer dependency
Password hashing (BasicStrategy, password secrets)	argon2
TOTP / OTP / MFA	otplib
WebAuthn (PasskeyStrategy, FIDO2Strategy)	@simplewebauthn/server
OIDC JWKS signature verification	jwks-rsa

These aren't required at install time. Each strategy import()s its dependency dynamically the first time it's used, and throws a descriptive error naming the missing package if it isn't installed — so you only need to install what you actually use.

Three subpath exports

import {...} from '@rapidrest/auth';       // strategies, interfaces, shared types
import {...} from '@rapidrest/auth/mongo'; // MongoDB model + route implementations
import {...} from '@rapidrest/auth/sql';   // SQL (TypeORM) model + route implementations

The root export is database-agnostic (strategy logic, config types). The /mongo and /sql subpaths export the persisted model classes and the concrete base routes bound to them — pick whichever matches your project's datastore.

How it fits together

1. Strategies (Strategies) implement the actual verification logic for one login method each (password, TOTP, WebAuthn, OIDC, ...).
2. Models (Data Models) — User, Alias, Secret, Profile — persist accounts, credentials, and profile data.
3. Base routes (Base Routes) wire a strategy or a model up to HTTP: subclass a Base*Mongo/Base*SQL route, add @Route(path), and you have a working endpoint.
4. Configuration (Configuration) ties it together via @rapidrest/core's config system — no dedicated config schema is shipped, it's the same @Config decorator you'd use anywhere else in a RapidREST project.

Reference implementation

auth-server is a complete, deployable authorization server built with @rapidrest/auth — every strategy, every model, and every base route wired up and running, with both a MongoDB and a SQL (PostgreSQL) variant of the whole server side by side (src/mongo/routes/ and src/sql/routes/). It's the fastest way to see the pieces documented across this section assembled into a real project, and a reasonable starting point to fork if you're standing up your own auth server. Several of the route and config examples on the following pages closely mirror it.

What's next

• Data Models: User, Alias, Secret, Profile.
• Strategies: the 7 supported login methods.
• Base Routes: wiring strategies and models up to HTTP endpoints.
• Configuration: the auth:* config tree and the session requirement.