Skip to content
MountSQLiMountSQLI

Auth Overview

@mountsqli/auth provides a complete authentication system built on top of MountSQLI’s Db. It includes schema tables, password hashing, JWT, sessions, OAuth, TOTP (2FA), RBAC, rate limiting, and middleware for four frameworks.

Create an auth instance

Section titled “Create an auth instance”
import { createAuth, authUsers, authSessions, authAccounts } from "@mountsqli/auth";
import { mountsqli } from "@mountsqli/core";


const db = await mountsqli({
  driver: "sqlite",
  url: "./app.db",
  tables: [authUsers, authSessions, authAccounts],
});


const auth = createAuth({
  db,
  secret: process.env.JWT_SECRET!,
  providers: [],
});

The schema tables are passed to mountsqli along with your app’s tables. Auth auto-discovers them by name — no config needed.

What’s included

Section titled “What’s included”
Piece API
Passwords hashPassword / verifyPassword (scrypt, constant-time)
JWT createToken / verifyToken / decodeToken (HS256 via jose)
TOTP (2FA) generateSecret / generateCode / verifyCode / generateURI
Sessions JWT-strategy built in; database strategy via authSessions
OAuth google, github providers with CSRF state validation
RBAC auth.rbac.createRole / assignRole / authorize
Rate limiting InMemoryRateLimiter (5 req/min per key)
Email sendVerificationEmail / sendPasswordResetEmail
Middleware Express, Next.js, Fastify, Hono — plug in one line

Quick start

Section titled “Quick start”
const auth = createAuth({ db, secret: "my-secret", providers: [] });


// Register
const { user, token } = await auth.register({
  email: "ada@example.com",
  password: "StrongP4ss!",
});


// Authenticate
const session = await auth.getSession({
  headers: { authorization: `Bearer ${token}` },
});

Built-in schema tables

Section titled “Built-in schema tables”
Table Purpose
authUsers users (email, password hash, 2FA secret, etc.)
authSessions database-backed session tokens
authAccounts OAuth provider accounts linked to a user
authVerificationTokens email verification & password reset tokens
authRoles RBAC roles with permission lists
authUserRoles many-to-many user → role assignments

Security

Section titled “Security”
  • Passwords hashed with scrypt N = 2^15, constant-time comparison.
  • JWT algorithm enforced (HS256), no algorithm confusion.
  • OAuth CSRF protection via state validation.
  • Rate limiter on login (5 attempts / minute).
  • Token-based 2FA (TOTP) supported.
Section titled “Related”