Packages and status

​

Known limits

• SAML is experimental. The verifier is our own code, built on Web Crypto. It passes tests against xmllint and xml-crypto output and has had no independent audit. If you need an audit today, put an audited SAML library in front and pass the identity to your own session code.
• The cookie session cache is experimental and opt in. It can lag a revocation by up to its maxAge. See session hardening.
• MySQL is not supported. provider: "mysql" throws unless you pass experimental: true, and the baseline schema does not apply on a real server yet.
• Postgres is tested by hand, not in CI. The full suite runs against Postgres 14 before each release. Only the pg driver is supported.
• D1 is not tested in CI or by hand yet. The generated SQLite SQL is applied with skipMigrations: true.
• Client ID metadata documents (CIMD) on Workers and Deno. Deno uses node:dns like Node. Workers need createDohResolver(), or "none" with allowedHosts. DNS rebinding cannot be fully closed without allowedHosts. See CIMD.
• No published third party security audit. CI runs tests and CodeQL, which is not a substitute for one.

​

Supported databases

​

Core packages

​

Framework adapters

import { Hono } from "hono";
import { createTheAuth } from "@glinr/theauth";
import { theAuthHono } from "@glinr/theauth-hono";

const auth = await createTheAuth({
  database: { provider: "postgres", url: process.env.DATABASE_URL! },
});

const app = new Hono();
app.route("/api/theauth", theAuthHono(auth, { authenticate }));

​

Other languages

• theauth-go is the Go server library (v2). See the Go library docs.
• A Go REST client and a Python client (source) for the TypeScript server, both checked against the generated openapi.json.
• A Terraform provider (source).

​

Devices and robots

​

By the numbers

• 48 OAuth providers: 22 first class and 26 presets
• 10 framework adapters
• 4 runtime dependencies in core (drizzle-orm, jose, sql.js, zod)
• About 5,277 test cases in 410 test files (a textual count of it( and test( calls, so approximate)