Aether Auth Kit

Overview

Authentication is the feature where "it works" and "it is safe" look identical from the outside. Hand-rolled auth usually works; what it quietly gets wrong is invisible: hash comparisons that leak timing, error messages that reveal which emails have accounts, reset links that keep working after the password already changed, login forms with no rate limit. This kit is the auth you would write on your best week, finished: every flow is one call returning a typed result, every security decision is commented in place and written down in docs/security.md, and the 19 bundled tests assert the security behaviour — that a used reset link dies, that wrong-password and unknown-email are indistinguishable — not just the happy path. Storage and mail are small interfaces (a complete Prisma store and Next.js routes ship as examples), and the demo runs every flow in your terminal with no database and no mail account.

Key features

• Signup with signed, expiring email-verification links
• Login blocked until verified, rate-limited, timing-safe
• Wrong password and unknown email are indistinguishable — same reason, same time
• Signed httpOnly session cookies (SameSite=Lax, Secure), stateless
• Password reset links self-destruct when used — or when the password changes
• scrypt hashing (OWASP parameters) that silently upgrades old hashes on login
• Typed results, not exceptions — forgetting a failure case is a compile error
• Storage is a 5-method interface; complete Prisma implementation included
• Mailer is a 1-method interface — Resend, SES, nodemailer, anything
• Zero runtime dependencies — node:crypto only

Specifications

Runtime

Node 18 or newer

Language

TypeScript (strict)

Framework

Next.js examples included; core is plain Node

Hashing

scrypt via node:crypto, OWASP parameters

Dependencies

None at runtime

Tests

19, node:test

Licence

Perpetual, unlimited applications

Delivery

ZIP with full source, instant download