mibnekhalid/mbkauthe

How mibnekhalid/mbkauthe works

MBKAuthe is a TypeScript authentication and authorization framework mounted in an Express application. A typical user request enters its router, proceeds through an authentication flow (including optional second factor), and establishes a persisted session; protected application routes then validate that session and evaluate roles or permissions. Separate flows support OAuth/OIDC, passkeys, API tokens, and CLI device login. The graph reflects README-documented capabilities and sampled call relationships; some subsystem wiring is inferred only at the documented feature level, so uncertain links are omitted.

Main entry points: auth.routes.ts Auth routes · OAuthFlowService.ts OAuth flow service · AuthService.ts Authentication service · AuthRepository.ts Auth repository

Components 24

Express entry

Auth package entry src/index.ts
Auth routes src/http/routes/auth.routes.ts
OAuth router src/express/oauth.router.ts
Login completion src/http/session/authFlow.ts
Session middleware src/http/middleware/authMiddleware.ts

Authentication flows

Authentication service src/services/AuthService.ts
Passkey service src/services/PasskeyService.ts
CLI device service src/services/CliAuthService.ts
API token service src/services/ApiTokenService.ts
OAuth flow service src/oauth/OAuthFlowService.ts
OAuth providers src/oauth/providers/loader.ts

Core domain

Token engine src/core/tokens/TokenEngine.ts
Auth context src/core/context/AuthContext.ts
Authorization service src/core/permissions/AuthorizationService.ts
Permission manifest src/core/permissions/manifest.ts

Persistence

Auth repository src/db/repositories/AuthRepository.ts
Domain repositories src/db/repositories/index.ts
Postgres / SQLite src/db/adapters/IDatabaseAdapter.ts
OAuth account repository src/db/repositories/OAuthAccountRepository.ts

Events and diagnostics

Auth event emitter src/core/events/index.ts
Health reporting src/diagnostics/health.ts

Other components

Application user
OAuth provider
Database engine

Connections 29

Application user → Auth package entry: mounts router
Auth package entry → Auth routes: dispatches requests
Auth package entry → OAuth router: mounts routes
Auth routes → Authentication service: authenticates
Auth routes → Passkey service: handles ceremonies
Auth routes → Login completion: completes login
Login completion → Auth repository: persists session
Login completion → Auth context: creates context
Authentication service → Auth repository: loads auth data
Authentication service → Auth context: builds context
Session middleware → Auth repository: validates session
Session middleware → Authorization service: checks access
Authorization service → Auth context: evaluates principal
Authorization service → Permission manifest: matches permissions
OAuth router → OAuth flow service: starts callbacks
OAuth flow service → OAuth providers: loads providers
OAuth flow service → OAuth provider: exchanges tokens
OAuth flow service → OAuth account repository: links accounts
Auth routes → CLI device service: handles device login
CLI device service → API token service: issues tokens
API token service → Token engine: generates tokens
CLI device service → Domain repositories: reads device state
Passkey service → Domain repositories: stores credentials
Auth repository → Domain repositories: delegates queries
Domain repositories → Postgres / SQLite: executes queries
Postgres / SQLite → Database engine: reads and writes
Authentication service → Auth event emitter: emits auth events
OAuth flow service → Auth event emitter: emits OAuth events
Health reporting → Postgres / SQLite: checks database

More TypeScript diagrams: marcisbee/exome · process-analytics/bpmn-visualization-js · raqibnur/quick-waitlist · syv-ai/dash · upstash/rag-chat-component

Drawn by GitDiagram on September 27, 2026 from the repository's file tree, README and source files. Read as Markdown ·