@ainetwork/adk-provider-auth-google 0.3.0

package/dist/chunk-HRHLJJ2F.js

@@ -0,0 +1,147 @@
+// implements/google.auth.ts
+import { BaseAuth } from "@ainetwork/adk/modules";
+import jwt from "jsonwebtoken";
+import jwksClient from "jwks-rsa";
+var GOOGLE_ISSUERS = [
+  "https://accounts.google.com",
+  "accounts.google.com"
+];
+var GoogleAuth = class extends BaseAuth {
+  constructor(config) {
+    super();
+    this.config = config;
+    this.jwksClient = jwksClient({
+      jwksUri: "https://www.googleapis.com/oauth2/v3/certs",
+      cache: true,
+      cacheMaxAge: 864e5,
+      // 24 hours
+      rateLimit: true,
+      jwksRequestsPerMinute: 10
+    });
+  }
+  jwksClient;
+  getSigningKey = (header, callback) => {
+    this.jwksClient.getSigningKey(header.kid, (err, key) => {
+      if (err) {
+        callback(err);
+        return;
+      }
+      const signingKey = key?.getPublicKey();
+      callback(null, signingKey);
+    });
+  };
+  verifyGoogleIdToken(token) {
+    return new Promise((resolve, reject) => {
+      jwt.verify(
+        token,
+        this.getSigningKey,
+        {
+          algorithms: ["RS256"],
+          audience: this.config.clientId,
+          issuer: GOOGLE_ISSUERS
+        },
+        (err, decoded) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded);
+        }
+      );
+    });
+  }
+  async verifyGoogleAccessToken(token) {
+    const response = await fetch(
+      `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(token)}`
+    );
+    const data = await response.json();
+    if (data.error) {
+      throw new Error(data.error_description || data.error);
+    }
+    if (data.aud !== this.config.clientId && data.azp !== this.config.clientId) {
+      throw new Error("Token was not issued for this client");
+    }
+    return data;
+  }
+  verifyNextAuthToken(token) {
+    return new Promise((resolve, reject) => {
+      if (!this.config.nextAuthSecret) {
+        reject(new Error("NextAuth secret is required for NextAuth token verification"));
+        return;
+      }
+      jwt.verify(
+        token,
+        this.config.nextAuthSecret,
+        {
+          algorithms: ["HS256"]
+        },
+        (err, decoded) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded);
+        }
+      );
+    });
+  }
+  isGoogleAccessToken(token) {
+    return token.startsWith("ya29.");
+  }
+  async authenticate(req, res) {
+    const token = this.extractBearerToken(req);
+    console.log(token);
+    if (!token) {
+      return { isAuthenticated: false };
+    }
+    try {
+      if (this.config.nextAuthSecret) {
+        try {
+          const payload2 = await this.verifyNextAuthToken(token);
+          if (payload2.sub) {
+            return {
+              isAuthenticated: true,
+              userId: payload2.sub
+            };
+          }
+        } catch {
+        }
+      }
+      if (this.isGoogleAccessToken(token)) {
+        const tokenInfo = await this.verifyGoogleAccessToken(token);
+        if (tokenInfo.sub) {
+          return {
+            isAuthenticated: true,
+            userId: tokenInfo.sub
+          };
+        }
+        console.error("Google auth verification failed: Token does not contain sub claim");
+        return { isAuthenticated: false };
+      }
+      const payload = await this.verifyGoogleIdToken(token);
+      if (!payload.sub) {
+        console.error("Google auth verification failed: Token does not contain sub claim");
+        return { isAuthenticated: false };
+      }
+      return {
+        isAuthenticated: true,
+        userId: payload.sub
+      };
+    } catch (err) {
+      console.error("Google auth verification failed:", err.message);
+      return { isAuthenticated: false };
+    }
+  }
+  extractBearerToken(req) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+      return null;
+    }
+    return authHeader.substring(7);
+  }
+};
+
+export {
+  GoogleAuth
+};
+//# sourceMappingURL=chunk-HRHLJJ2F.js.map

package/dist/chunk-HRHLJJ2F.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../implements/google.auth.ts"],"sourcesContent":["import { BaseAuth } from \"@ainetwork/adk/modules\";\nimport { AuthResponse } from \"@ainetwork/adk/types/auth\";\nimport type { Request } from \"express\";\nimport jwt, { JwtHeader, SigningKeyCallback } from \"jsonwebtoken\";\nimport jwksClient from \"jwks-rsa\";\n\nexport interface GoogleAuthConfig {\n  clientId: string;\n  nextAuthSecret?: string;\n}\n\ninterface GoogleTokenPayload {\n  aud: string;\n  iss: string;\n  iat: number;\n  exp: number;\n  sub: string;\n  email?: string;\n  email_verified?: boolean;\n  name?: string;\n  picture?: string;\n  azp?: string;\n}\n\ninterface GoogleTokenInfoResponse {\n  azp: string;\n  aud: string;\n  sub: string;\n  scope: string;\n  exp: string;\n  expires_in: string;\n  email?: string;\n  email_verified?: string;\n  access_type?: string;\n  error?: string;\n  error_description?: string;\n}\n\ninterface NextAuthJWTPayload {\n  name?: string;\n  email?: string;\n  picture?: string;\n  sub: string;\n  iat: number;\n  exp: number;\n  jti?: string;\n}\n\nconst GOOGLE_ISSUERS: [string, ...string[]] = [\n  \"https://accounts.google.com\",\n  \"accounts.google.com\",\n];\n\nexport class GoogleAuth extends BaseAuth {\n  private readonly jwksClient: jwksClient.JwksClient;\n\n  constructor(private readonly config: GoogleAuthConfig) {\n    super();\n\n    this.jwksClient = jwksClient({\n      jwksUri: \"https://www.googleapis.com/oauth2/v3/certs\",\n      cache: true,\n      cacheMaxAge: 86400000, // 24 hours\n      rateLimit: true,\n      jwksRequestsPerMinute: 10,\n    });\n  }\n\n  private getSigningKey = (header: JwtHeader, callback: SigningKeyCallback): void => {\n    this.jwksClient.getSigningKey(header.kid, (err, key) => {\n      if (err) {\n        callback(err);\n        return;\n      }\n      const signingKey = key?.getPublicKey();\n      callback(null, signingKey);\n    });\n  };\n\n  private verifyGoogleIdToken(token: string): Promise<GoogleTokenPayload> {\n    return new Promise((resolve, reject) => {\n      jwt.verify(\n        token,\n        this.getSigningKey,\n        {\n          algorithms: [\"RS256\"],\n          audience: this.config.clientId,\n          issuer: GOOGLE_ISSUERS,\n        },\n        (err: Error | null, decoded: unknown) => {\n          if (err) {\n            reject(err);\n            return;\n          }\n          resolve(decoded as GoogleTokenPayload);\n        }\n      );\n    });\n  }\n\n  private async verifyGoogleAccessToken(token: string): Promise<GoogleTokenInfoResponse> {\n    const response = await fetch(\n      `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(token)}`\n    );\n\n    const data = await response.json() as GoogleTokenInfoResponse;\n\n    if (data.error) {\n      throw new Error(data.error_description || data.error);\n    }\n\n    // Verify the token is for our client\n    if (data.aud !== this.config.clientId && data.azp !== this.config.clientId) {\n      throw new Error(\"Token was not issued for this client\");\n    }\n\n    return data;\n  }\n\n  private verifyNextAuthToken(token: string): Promise<NextAuthJWTPayload> {\n    return new Promise((resolve, reject) => {\n      if (!this.config.nextAuthSecret) {\n        reject(new Error(\"NextAuth secret is required for NextAuth token verification\"));\n        return;\n      }\n\n      jwt.verify(\n        token,\n        this.config.nextAuthSecret,\n        {\n          algorithms: [\"HS256\"],\n        },\n        (err, decoded) => {\n          if (err) {\n            reject(err);\n            return;\n          }\n          resolve(decoded as NextAuthJWTPayload);\n        }\n      );\n    });\n  }\n\n  private isGoogleAccessToken(token: string): boolean {\n    return token.startsWith(\"ya29.\");\n  }\n\n  public async authenticate(req: any, res: any): Promise<AuthResponse> {\n    const token = this.extractBearerToken(req);\n    console.log(token);\n    if (!token) {\n      return { isAuthenticated: false };\n    }\n\n    try {\n      // First, try to verify as NextAuth JWT token (signed with NEXTAUTH_SECRET)\n      if (this.config.nextAuthSecret) {\n        try {\n          const payload = await this.verifyNextAuthToken(token);\n          if (payload.sub) {\n            return {\n              isAuthenticated: true,\n              userId: payload.sub,\n            };\n          }\n        } catch {\n          // If NextAuth verification fails, try other methods\n        }\n      }\n\n      // Check if it's a Google Access Token (starts with \"ya29.\")\n      if (this.isGoogleAccessToken(token)) {\n        const tokenInfo = await this.verifyGoogleAccessToken(token);\n        if (tokenInfo.sub) {\n          return {\n            isAuthenticated: true,\n            userId: tokenInfo.sub,\n          };\n        }\n        console.error(\"Google auth verification failed: Token does not contain sub claim\");\n        return { isAuthenticated: false };\n      }\n\n      // Try to verify as Google ID token (JWT)\n      const payload = await this.verifyGoogleIdToken(token);\n\n      if (!payload.sub) {\n        console.error(\"Google auth verification failed: Token does not contain sub claim\");\n        return { isAuthenticated: false };\n      }\n\n      return {\n        isAuthenticated: true,\n        userId: payload.sub,\n      };\n    } catch (err) {\n      console.error(\"Google auth verification failed:\", (err as Error).message);\n      return { isAuthenticated: false };\n    }\n  }\n\n  private extractBearerToken(req: Request): string | null {\n    const authHeader = req.headers.authorization;\n    if (!authHeader?.startsWith(\"Bearer \")) {\n      return null;\n    }\n    return authHeader.substring(7);\n  }\n}\n"],"mappings":";AAAA,SAAS,gBAAgB;AAGzB,OAAO,SAA4C;AACnD,OAAO,gBAAgB;AA4CvB,IAAM,iBAAwC;AAAA,EAC5C;AAAA,EACA;AACF;AAEO,IAAM,aAAN,cAAyB,SAAS;AAAA,EAGvC,YAA6B,QAA0B;AACrD,UAAM;AADqB;AAG3B,SAAK,aAAa,WAAW;AAAA,MAC3B,SAAS;AAAA,MACT,OAAO;AAAA,MACP,aAAa;AAAA;AAAA,MACb,WAAW;AAAA,MACX,uBAAuB;AAAA,IACzB,CAAC;AAAA,EACH;AAAA,EAZiB;AAAA,EAcT,gBAAgB,CAAC,QAAmB,aAAuC;AACjF,SAAK,WAAW,cAAc,OAAO,KAAK,CAAC,KAAK,QAAQ;AACtD,UAAI,KAAK;AACP,iBAAS,GAAG;AACZ;AAAA,MACF;AACA,YAAM,aAAa,KAAK,aAAa;AACrC,eAAS,MAAM,UAAU;AAAA,IAC3B,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,OAA4C;AACtE,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI;AAAA,QACF;AAAA,QACA,KAAK;AAAA,QACL;AAAA,UACE,YAAY,CAAC,OAAO;AAAA,UACpB,UAAU,KAAK,OAAO;AAAA,UACtB,QAAQ;AAAA,QACV;AAAA,QACA,CAAC,KAAmB,YAAqB;AACvC,cAAI,KAAK;AACP,mBAAO,GAAG;AACV;AAAA,UACF;AACA,kBAAQ,OAA6B;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,wBAAwB,OAAiD;AACrF,UAAM,WAAW,MAAM;AAAA,MACrB,wDAAwD,mBAAmB,KAAK,CAAC;AAAA,IACnF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,KAAK,OAAO;AACd,YAAM,IAAI,MAAM,KAAK,qBAAqB,KAAK,KAAK;AAAA,IACtD;AAGA,QAAI,KAAK,QAAQ,KAAK,OAAO,YAAY,KAAK,QAAQ,KAAK,OAAO,UAAU;AAC1E,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,oBAAoB,OAA4C;AACtE,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,CAAC,KAAK,OAAO,gBAAgB;AAC/B,eAAO,IAAI,MAAM,6DAA6D,CAAC;AAC/E;AAAA,MACF;AAEA,UAAI;AAAA,QACF;AAAA,QACA,KAAK,OAAO;AAAA,QACZ;AAAA,UACE,YAAY,CAAC,OAAO;AAAA,QACtB;AAAA,QACA,CAAC,KAAK,YAAY;AAChB,cAAI,KAAK;AACP,mBAAO,GAAG;AACV;AAAA,UACF;AACA,kBAAQ,OAA6B;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,OAAwB;AAClD,WAAO,MAAM,WAAW,OAAO;AAAA,EACjC;AAAA,EAEA,MAAa,aAAa,KAAU,KAAiC;AACnE,UAAM,QAAQ,KAAK,mBAAmB,GAAG;AACzC,YAAQ,IAAI,KAAK;AACjB,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,iBAAiB,MAAM;AAAA,IAClC;AAEA,QAAI;AAEF,UAAI,KAAK,OAAO,gBAAgB;AAC9B,YAAI;AACF,gBAAMA,WAAU,MAAM,KAAK,oBAAoB,KAAK;AACpD,cAAIA,SAAQ,KAAK;AACf,mBAAO;AAAA,cACL,iBAAiB;AAAA,cACjB,QAAQA,SAAQ;AAAA,YAClB;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAGA,UAAI,KAAK,oBAAoB,KAAK,GAAG;AACnC,cAAM,YAAY,MAAM,KAAK,wBAAwB,KAAK;AAC1D,YAAI,UAAU,KAAK;AACjB,iBAAO;AAAA,YACL,iBAAiB;AAAA,YACjB,QAAQ,UAAU;AAAA,UACpB;AAAA,QACF;AACA,gBAAQ,MAAM,mEAAmE;AACjF,eAAO,EAAE,iBAAiB,MAAM;AAAA,MAClC;AAGA,YAAM,UAAU,MAAM,KAAK,oBAAoB,KAAK;AAEpD,UAAI,CAAC,QAAQ,KAAK;AAChB,gBAAQ,MAAM,mEAAmE;AACjF,eAAO,EAAE,iBAAiB,MAAM;AAAA,MAClC;AAEA,aAAO;AAAA,QACL,iBAAiB;AAAA,QACjB,QAAQ,QAAQ;AAAA,MAClB;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,oCAAqC,IAAc,OAAO;AACxE,aAAO,EAAE,iBAAiB,MAAM;AAAA,IAClC;AAAA,EACF;AAAA,EAEQ,mBAAmB,KAA6B;AACtD,UAAM,aAAa,IAAI,QAAQ;AAC/B,QAAI,CAAC,YAAY,WAAW,SAAS,GAAG;AACtC,aAAO;AAAA,IACT;AACA,WAAO,WAAW,UAAU,CAAC;AAAA,EAC/B;AACF;","names":["payload"]}

package/dist/implements/google.auth.cjs

@@ -0,0 +1,181 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// implements/google.auth.ts
+var google_auth_exports = {};
+__export(google_auth_exports, {
+  GoogleAuth: () => GoogleAuth
+});
+module.exports = __toCommonJS(google_auth_exports);
+var import_modules = require("@ainetwork/adk/modules");
+var import_jsonwebtoken = __toESM(require("jsonwebtoken"), 1);
+var import_jwks_rsa = __toESM(require("jwks-rsa"), 1);
+var GOOGLE_ISSUERS = [
+  "https://accounts.google.com",
+  "accounts.google.com"
+];
+var GoogleAuth = class extends import_modules.BaseAuth {
+  constructor(config) {
+    super();
+    this.config = config;
+    this.jwksClient = (0, import_jwks_rsa.default)({
+      jwksUri: "https://www.googleapis.com/oauth2/v3/certs",
+      cache: true,
+      cacheMaxAge: 864e5,
+      // 24 hours
+      rateLimit: true,
+      jwksRequestsPerMinute: 10
+    });
+  }
+  jwksClient;
+  getSigningKey = (header, callback) => {
+    this.jwksClient.getSigningKey(header.kid, (err, key) => {
+      if (err) {
+        callback(err);
+        return;
+      }
+      const signingKey = key?.getPublicKey();
+      callback(null, signingKey);
+    });
+  };
+  verifyGoogleIdToken(token) {
+    return new Promise((resolve, reject) => {
+      import_jsonwebtoken.default.verify(
+        token,
+        this.getSigningKey,
+        {
+          algorithms: ["RS256"],
+          audience: this.config.clientId,
+          issuer: GOOGLE_ISSUERS
+        },
+        (err, decoded) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded);
+        }
+      );
+    });
+  }
+  async verifyGoogleAccessToken(token) {
+    const response = await fetch(
+      `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(token)}`
+    );
+    const data = await response.json();
+    if (data.error) {
+      throw new Error(data.error_description || data.error);
+    }
+    if (data.aud !== this.config.clientId && data.azp !== this.config.clientId) {
+      throw new Error("Token was not issued for this client");
+    }
+    return data;
+  }
+  verifyNextAuthToken(token) {
+    return new Promise((resolve, reject) => {
+      if (!this.config.nextAuthSecret) {
+        reject(new Error("NextAuth secret is required for NextAuth token verification"));
+        return;
+      }
+      import_jsonwebtoken.default.verify(
+        token,
+        this.config.nextAuthSecret,
+        {
+          algorithms: ["HS256"]
+        },
+        (err, decoded) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded);
+        }
+      );
+    });
+  }
+  isGoogleAccessToken(token) {
+    return token.startsWith("ya29.");
+  }
+  async authenticate(req, res) {
+    const token = this.extractBearerToken(req);
+    console.log(token);
+    if (!token) {
+      return { isAuthenticated: false };
+    }
+    try {
+      if (this.config.nextAuthSecret) {
+        try {
+          const payload2 = await this.verifyNextAuthToken(token);
+          if (payload2.sub) {
+            return {
+              isAuthenticated: true,
+              userId: payload2.sub
+            };
+          }
+        } catch {
+        }
+      }
+      if (this.isGoogleAccessToken(token)) {
+        const tokenInfo = await this.verifyGoogleAccessToken(token);
+        if (tokenInfo.sub) {
+          return {
+            isAuthenticated: true,
+            userId: tokenInfo.sub
+          };
+        }
+        console.error("Google auth verification failed: Token does not contain sub claim");
+        return { isAuthenticated: false };
+      }
+      const payload = await this.verifyGoogleIdToken(token);
+      if (!payload.sub) {
+        console.error("Google auth verification failed: Token does not contain sub claim");
+        return { isAuthenticated: false };
+      }
+      return {
+        isAuthenticated: true,
+        userId: payload.sub
+      };
+    } catch (err) {
+      console.error("Google auth verification failed:", err.message);
+      return { isAuthenticated: false };
+    }
+  }
+  extractBearerToken(req) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+      return null;
+    }
+    return authHeader.substring(7);
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  GoogleAuth
+});
+//# sourceMappingURL=google.auth.cjs.map

package/dist/implements/google.auth.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../implements/google.auth.ts"],"sourcesContent":["import { BaseAuth } from \"@ainetwork/adk/modules\";\nimport { AuthResponse } from \"@ainetwork/adk/types/auth\";\nimport type { Request } from \"express\";\nimport jwt, { JwtHeader, SigningKeyCallback } from \"jsonwebtoken\";\nimport jwksClient from \"jwks-rsa\";\n\nexport interface GoogleAuthConfig {\n  clientId: string;\n  nextAuthSecret?: string;\n}\n\ninterface GoogleTokenPayload {\n  aud: string;\n  iss: string;\n  iat: number;\n  exp: number;\n  sub: string;\n  email?: string;\n  email_verified?: boolean;\n  name?: string;\n  picture?: string;\n  azp?: string;\n}\n\ninterface GoogleTokenInfoResponse {\n  azp: string;\n  aud: string;\n  sub: string;\n  scope: string;\n  exp: string;\n  expires_in: string;\n  email?: string;\n  email_verified?: string;\n  access_type?: string;\n  error?: string;\n  error_description?: string;\n}\n\ninterface NextAuthJWTPayload {\n  name?: string;\n  email?: string;\n  picture?: string;\n  sub: string;\n  iat: number;\n  exp: number;\n  jti?: string;\n}\n\nconst GOOGLE_ISSUERS: [string, ...string[]] = [\n  \"https://accounts.google.com\",\n  \"accounts.google.com\",\n];\n\nexport class GoogleAuth extends BaseAuth {\n  private readonly jwksClient: jwksClient.JwksClient;\n\n  constructor(private readonly config: GoogleAuthConfig) {\n    super();\n\n    this.jwksClient = jwksClient({\n      jwksUri: \"https://www.googleapis.com/oauth2/v3/certs\",\n      cache: true,\n      cacheMaxAge: 86400000, // 24 hours\n      rateLimit: true,\n      jwksRequestsPerMinute: 10,\n    });\n  }\n\n  private getSigningKey = (header: JwtHeader, callback: SigningKeyCallback): void => {\n    this.jwksClient.getSigningKey(header.kid, (err, key) => {\n      if (err) {\n        callback(err);\n        return;\n      }\n      const signingKey = key?.getPublicKey();\n      callback(null, signingKey);\n    });\n  };\n\n  private verifyGoogleIdToken(token: string): Promise<GoogleTokenPayload> {\n    return new Promise((resolve, reject) => {\n      jwt.verify(\n        token,\n        this.getSigningKey,\n        {\n          algorithms: [\"RS256\"],\n          audience: this.config.clientId,\n          issuer: GOOGLE_ISSUERS,\n        },\n        (err: Error | null, decoded: unknown) => {\n          if (err) {\n            reject(err);\n            return;\n          }\n          resolve(decoded as GoogleTokenPayload);\n        }\n      );\n    });\n  }\n\n  private async verifyGoogleAccessToken(token: string): Promise<GoogleTokenInfoResponse> {\n    const response = await fetch(\n      `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(token)}`\n    );\n\n    const data = await response.json() as GoogleTokenInfoResponse;\n\n    if (data.error) {\n      throw new Error(data.error_description || data.error);\n    }\n\n    // Verify the token is for our client\n    if (data.aud !== this.config.clientId && data.azp !== this.config.clientId) {\n      throw new Error(\"Token was not issued for this client\");\n    }\n\n    return data;\n  }\n\n  private verifyNextAuthToken(token: string): Promise<NextAuthJWTPayload> {\n    return new Promise((resolve, reject) => {\n      if (!this.config.nextAuthSecret) {\n        reject(new Error(\"NextAuth secret is required for NextAuth token verification\"));\n        return;\n      }\n\n      jwt.verify(\n        token,\n        this.config.nextAuthSecret,\n        {\n          algorithms: [\"HS256\"],\n        },\n        (err, decoded) => {\n          if (err) {\n            reject(err);\n            return;\n          }\n          resolve(decoded as NextAuthJWTPayload);\n        }\n      );\n    });\n  }\n\n  private isGoogleAccessToken(token: string): boolean {\n    return token.startsWith(\"ya29.\");\n  }\n\n  public async authenticate(req: any, res: any): Promise<AuthResponse> {\n    const token = this.extractBearerToken(req);\n    console.log(token);\n    if (!token) {\n      return { isAuthenticated: false };\n    }\n\n    try {\n      // First, try to verify as NextAuth JWT token (signed with NEXTAUTH_SECRET)\n      if (this.config.nextAuthSecret) {\n        try {\n          const payload = await this.verifyNextAuthToken(token);\n          if (payload.sub) {\n            return {\n              isAuthenticated: true,\n              userId: payload.sub,\n            };\n          }\n        } catch {\n          // If NextAuth verification fails, try other methods\n        }\n      }\n\n      // Check if it's a Google Access Token (starts with \"ya29.\")\n      if (this.isGoogleAccessToken(token)) {\n        const tokenInfo = await this.verifyGoogleAccessToken(token);\n        if (tokenInfo.sub) {\n          return {\n            isAuthenticated: true,\n            userId: tokenInfo.sub,\n          };\n        }\n        console.error(\"Google auth verification failed: Token does not contain sub claim\");\n        return { isAuthenticated: false };\n      }\n\n      // Try to verify as Google ID token (JWT)\n      const payload = await this.verifyGoogleIdToken(token);\n\n      if (!payload.sub) {\n        console.error(\"Google auth verification failed: Token does not contain sub claim\");\n        return { isAuthenticated: false };\n      }\n\n      return {\n        isAuthenticated: true,\n        userId: payload.sub,\n      };\n    } catch (err) {\n      console.error(\"Google auth verification failed:\", (err as Error).message);\n      return { isAuthenticated: false };\n    }\n  }\n\n  private extractBearerToken(req: Request): string | null {\n    const authHeader = req.headers.authorization;\n    if (!authHeader?.startsWith(\"Bearer \")) {\n      return null;\n    }\n    return authHeader.substring(7);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAAyB;AAGzB,0BAAmD;AACnD,sBAAuB;AA4CvB,IAAM,iBAAwC;AAAA,EAC5C;AAAA,EACA;AACF;AAEO,IAAM,aAAN,cAAyB,wBAAS;AAAA,EAGvC,YAA6B,QAA0B;AACrD,UAAM;AADqB;AAG3B,SAAK,iBAAa,gBAAAA,SAAW;AAAA,MAC3B,SAAS;AAAA,MACT,OAAO;AAAA,MACP,aAAa;AAAA;AAAA,MACb,WAAW;AAAA,MACX,uBAAuB;AAAA,IACzB,CAAC;AAAA,EACH;AAAA,EAZiB;AAAA,EAcT,gBAAgB,CAAC,QAAmB,aAAuC;AACjF,SAAK,WAAW,cAAc,OAAO,KAAK,CAAC,KAAK,QAAQ;AACtD,UAAI,KAAK;AACP,iBAAS,GAAG;AACZ;AAAA,MACF;AACA,YAAM,aAAa,KAAK,aAAa;AACrC,eAAS,MAAM,UAAU;AAAA,IAC3B,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,OAA4C;AACtE,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,0BAAAC,QAAI;AAAA,QACF;AAAA,QACA,KAAK;AAAA,QACL;AAAA,UACE,YAAY,CAAC,OAAO;AAAA,UACpB,UAAU,KAAK,OAAO;AAAA,UACtB,QAAQ;AAAA,QACV;AAAA,QACA,CAAC,KAAmB,YAAqB;AACvC,cAAI,KAAK;AACP,mBAAO,GAAG;AACV;AAAA,UACF;AACA,kBAAQ,OAA6B;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,wBAAwB,OAAiD;AACrF,UAAM,WAAW,MAAM;AAAA,MACrB,wDAAwD,mBAAmB,KAAK,CAAC;AAAA,IACnF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,KAAK,OAAO;AACd,YAAM,IAAI,MAAM,KAAK,qBAAqB,KAAK,KAAK;AAAA,IACtD;AAGA,QAAI,KAAK,QAAQ,KAAK,OAAO,YAAY,KAAK,QAAQ,KAAK,OAAO,UAAU;AAC1E,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,oBAAoB,OAA4C;AACtE,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,CAAC,KAAK,OAAO,gBAAgB;AAC/B,eAAO,IAAI,MAAM,6DAA6D,CAAC;AAC/E;AAAA,MACF;AAEA,0BAAAA,QAAI;AAAA,QACF;AAAA,QACA,KAAK,OAAO;AAAA,QACZ;AAAA,UACE,YAAY,CAAC,OAAO;AAAA,QACtB;AAAA,QACA,CAAC,KAAK,YAAY;AAChB,cAAI,KAAK;AACP,mBAAO,GAAG;AACV;AAAA,UACF;AACA,kBAAQ,OAA6B;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,OAAwB;AAClD,WAAO,MAAM,WAAW,OAAO;AAAA,EACjC;AAAA,EAEA,MAAa,aAAa,KAAU,KAAiC;AACnE,UAAM,QAAQ,KAAK,mBAAmB,GAAG;AACzC,YAAQ,IAAI,KAAK;AACjB,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,iBAAiB,MAAM;AAAA,IAClC;AAEA,QAAI;AAEF,UAAI,KAAK,OAAO,gBAAgB;AAC9B,YAAI;AACF,gBAAMC,WAAU,MAAM,KAAK,oBAAoB,KAAK;AACpD,cAAIA,SAAQ,KAAK;AACf,mBAAO;AAAA,cACL,iBAAiB;AAAA,cACjB,QAAQA,SAAQ;AAAA,YAClB;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAGA,UAAI,KAAK,oBAAoB,KAAK,GAAG;AACnC,cAAM,YAAY,MAAM,KAAK,wBAAwB,KAAK;AAC1D,YAAI,UAAU,KAAK;AACjB,iBAAO;AAAA,YACL,iBAAiB;AAAA,YACjB,QAAQ,UAAU;AAAA,UACpB;AAAA,QACF;AACA,gBAAQ,MAAM,mEAAmE;AACjF,eAAO,EAAE,iBAAiB,MAAM;AAAA,MAClC;AAGA,YAAM,UAAU,MAAM,KAAK,oBAAoB,KAAK;AAEpD,UAAI,CAAC,QAAQ,KAAK;AAChB,gBAAQ,MAAM,mEAAmE;AACjF,eAAO,EAAE,iBAAiB,MAAM;AAAA,MAClC;AAEA,aAAO;AAAA,QACL,iBAAiB;AAAA,QACjB,QAAQ,QAAQ;AAAA,MAClB;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,oCAAqC,IAAc,OAAO;AACxE,aAAO,EAAE,iBAAiB,MAAM;AAAA,IAClC;AAAA,EACF;AAAA,EAEQ,mBAAmB,KAA6B;AACtD,UAAM,aAAa,IAAI,QAAQ;AAC/B,QAAI,CAAC,YAAY,WAAW,SAAS,GAAG;AACtC,aAAO;AAAA,IACT;AACA,WAAO,WAAW,UAAU,CAAC;AAAA,EAC/B;AACF;","names":["jwksClient","jwt","payload"]}

package/dist/implements/google.auth.d.cts

@@ -0,0 +1,21 @@
+import { BaseAuth } from '@ainetwork/adk/modules';
+import { AuthResponse } from '@ainetwork/adk/types/auth';
+
+interface GoogleAuthConfig {
+    clientId: string;
+    nextAuthSecret?: string;
+}
+declare class GoogleAuth extends BaseAuth {
+    private readonly config;
+    private readonly jwksClient;
+    constructor(config: GoogleAuthConfig);
+    private getSigningKey;
+    private verifyGoogleIdToken;
+    private verifyGoogleAccessToken;
+    private verifyNextAuthToken;
+    private isGoogleAccessToken;
+    authenticate(req: any, res: any): Promise<AuthResponse>;
+    private extractBearerToken;
+}
+
+export { GoogleAuth, type GoogleAuthConfig };

package/dist/implements/google.auth.d.ts

@@ -0,0 +1,21 @@
+import { BaseAuth } from '@ainetwork/adk/modules';
+import { AuthResponse } from '@ainetwork/adk/types/auth';
+
+interface GoogleAuthConfig {
+    clientId: string;
+    nextAuthSecret?: string;
+}
+declare class GoogleAuth extends BaseAuth {
+    private readonly config;
+    private readonly jwksClient;
+    constructor(config: GoogleAuthConfig);
+    private getSigningKey;
+    private verifyGoogleIdToken;
+    private verifyGoogleAccessToken;
+    private verifyNextAuthToken;
+    private isGoogleAccessToken;
+    authenticate(req: any, res: any): Promise<AuthResponse>;
+    private extractBearerToken;
+}
+
+export { GoogleAuth, type GoogleAuthConfig };

package/dist/implements/google.auth.js

@@ -0,0 +1,7 @@
+import {
+  GoogleAuth
+} from "../chunk-HRHLJJ2F.js";
+export {
+  GoogleAuth
+};
+//# sourceMappingURL=google.auth.js.map

package/dist/implements/google.auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/index.cjs

@@ -0,0 +1,183 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// index.ts
+var index_exports = {};
+__export(index_exports, {
+  GoogleAuth: () => GoogleAuth
+});
+module.exports = __toCommonJS(index_exports);
+
+// implements/google.auth.ts
+var import_modules = require("@ainetwork/adk/modules");
+var import_jsonwebtoken = __toESM(require("jsonwebtoken"), 1);
+var import_jwks_rsa = __toESM(require("jwks-rsa"), 1);
+var GOOGLE_ISSUERS = [
+  "https://accounts.google.com",
+  "accounts.google.com"
+];
+var GoogleAuth = class extends import_modules.BaseAuth {
+  constructor(config) {
+    super();
+    this.config = config;
+    this.jwksClient = (0, import_jwks_rsa.default)({
+      jwksUri: "https://www.googleapis.com/oauth2/v3/certs",
+      cache: true,
+      cacheMaxAge: 864e5,
+      // 24 hours
+      rateLimit: true,
+      jwksRequestsPerMinute: 10
+    });
+  }
+  jwksClient;
+  getSigningKey = (header, callback) => {
+    this.jwksClient.getSigningKey(header.kid, (err, key) => {
+      if (err) {
+        callback(err);
+        return;
+      }
+      const signingKey = key?.getPublicKey();
+      callback(null, signingKey);
+    });
+  };
+  verifyGoogleIdToken(token) {
+    return new Promise((resolve, reject) => {
+      import_jsonwebtoken.default.verify(
+        token,
+        this.getSigningKey,
+        {
+          algorithms: ["RS256"],
+          audience: this.config.clientId,
+          issuer: GOOGLE_ISSUERS
+        },
+        (err, decoded) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded);
+        }
+      );
+    });
+  }
+  async verifyGoogleAccessToken(token) {
+    const response = await fetch(
+      `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(token)}`
+    );
+    const data = await response.json();
+    if (data.error) {
+      throw new Error(data.error_description || data.error);
+    }
+    if (data.aud !== this.config.clientId && data.azp !== this.config.clientId) {
+      throw new Error("Token was not issued for this client");
+    }
+    return data;
+  }
+  verifyNextAuthToken(token) {
+    return new Promise((resolve, reject) => {
+      if (!this.config.nextAuthSecret) {
+        reject(new Error("NextAuth secret is required for NextAuth token verification"));
+        return;
+      }
+      import_jsonwebtoken.default.verify(
+        token,
+        this.config.nextAuthSecret,
+        {
+          algorithms: ["HS256"]
+        },
+        (err, decoded) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded);
+        }
+      );
+    });
+  }
+  isGoogleAccessToken(token) {
+    return token.startsWith("ya29.");
+  }
+  async authenticate(req, res) {
+    const token = this.extractBearerToken(req);
+    console.log(token);
+    if (!token) {
+      return { isAuthenticated: false };
+    }
+    try {
+      if (this.config.nextAuthSecret) {
+        try {
+          const payload2 = await this.verifyNextAuthToken(token);
+          if (payload2.sub) {
+            return {
+              isAuthenticated: true,
+              userId: payload2.sub
+            };
+          }
+        } catch {
+        }
+      }
+      if (this.isGoogleAccessToken(token)) {
+        const tokenInfo = await this.verifyGoogleAccessToken(token);
+        if (tokenInfo.sub) {
+          return {
+            isAuthenticated: true,
+            userId: tokenInfo.sub
+          };
+        }
+        console.error("Google auth verification failed: Token does not contain sub claim");
+        return { isAuthenticated: false };
+      }
+      const payload = await this.verifyGoogleIdToken(token);
+      if (!payload.sub) {
+        console.error("Google auth verification failed: Token does not contain sub claim");
+        return { isAuthenticated: false };
+      }
+      return {
+        isAuthenticated: true,
+        userId: payload.sub
+      };
+    } catch (err) {
+      console.error("Google auth verification failed:", err.message);
+      return { isAuthenticated: false };
+    }
+  }
+  extractBearerToken(req) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+      return null;
+    }
+    return authHeader.substring(7);
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  GoogleAuth
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../index.ts","../implements/google.auth.ts"],"sourcesContent":["export { GoogleAuth, type GoogleAuthConfig } from \"./implements/google.auth\";\n","import { BaseAuth } from \"@ainetwork/adk/modules\";\nimport { AuthResponse } from \"@ainetwork/adk/types/auth\";\nimport type { Request } from \"express\";\nimport jwt, { JwtHeader, SigningKeyCallback } from \"jsonwebtoken\";\nimport jwksClient from \"jwks-rsa\";\n\nexport interface GoogleAuthConfig {\n  clientId: string;\n  nextAuthSecret?: string;\n}\n\ninterface GoogleTokenPayload {\n  aud: string;\n  iss: string;\n  iat: number;\n  exp: number;\n  sub: string;\n  email?: string;\n  email_verified?: boolean;\n  name?: string;\n  picture?: string;\n  azp?: string;\n}\n\ninterface GoogleTokenInfoResponse {\n  azp: string;\n  aud: string;\n  sub: string;\n  scope: string;\n  exp: string;\n  expires_in: string;\n  email?: string;\n  email_verified?: string;\n  access_type?: string;\n  error?: string;\n  error_description?: string;\n}\n\ninterface NextAuthJWTPayload {\n  name?: string;\n  email?: string;\n  picture?: string;\n  sub: string;\n  iat: number;\n  exp: number;\n  jti?: string;\n}\n\nconst GOOGLE_ISSUERS: [string, ...string[]] = [\n  \"https://accounts.google.com\",\n  \"accounts.google.com\",\n];\n\nexport class GoogleAuth extends BaseAuth {\n  private readonly jwksClient: jwksClient.JwksClient;\n\n  constructor(private readonly config: GoogleAuthConfig) {\n    super();\n\n    this.jwksClient = jwksClient({\n      jwksUri: \"https://www.googleapis.com/oauth2/v3/certs\",\n      cache: true,\n      cacheMaxAge: 86400000, // 24 hours\n      rateLimit: true,\n      jwksRequestsPerMinute: 10,\n    });\n  }\n\n  private getSigningKey = (header: JwtHeader, callback: SigningKeyCallback): void => {\n    this.jwksClient.getSigningKey(header.kid, (err, key) => {\n      if (err) {\n        callback(err);\n        return;\n      }\n      const signingKey = key?.getPublicKey();\n      callback(null, signingKey);\n    });\n  };\n\n  private verifyGoogleIdToken(token: string): Promise<GoogleTokenPayload> {\n    return new Promise((resolve, reject) => {\n      jwt.verify(\n        token,\n        this.getSigningKey,\n        {\n          algorithms: [\"RS256\"],\n          audience: this.config.clientId,\n          issuer: GOOGLE_ISSUERS,\n        },\n        (err: Error | null, decoded: unknown) => {\n          if (err) {\n            reject(err);\n            return;\n          }\n          resolve(decoded as GoogleTokenPayload);\n        }\n      );\n    });\n  }\n\n  private async verifyGoogleAccessToken(token: string): Promise<GoogleTokenInfoResponse> {\n    const response = await fetch(\n      `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(token)}`\n    );\n\n    const data = await response.json() as GoogleTokenInfoResponse;\n\n    if (data.error) {\n      throw new Error(data.error_description || data.error);\n    }\n\n    // Verify the token is for our client\n    if (data.aud !== this.config.clientId && data.azp !== this.config.clientId) {\n      throw new Error(\"Token was not issued for this client\");\n    }\n\n    return data;\n  }\n\n  private verifyNextAuthToken(token: string): Promise<NextAuthJWTPayload> {\n    return new Promise((resolve, reject) => {\n      if (!this.config.nextAuthSecret) {\n        reject(new Error(\"NextAuth secret is required for NextAuth token verification\"));\n        return;\n      }\n\n      jwt.verify(\n        token,\n        this.config.nextAuthSecret,\n        {\n          algorithms: [\"HS256\"],\n        },\n        (err, decoded) => {\n          if (err) {\n            reject(err);\n            return;\n          }\n          resolve(decoded as NextAuthJWTPayload);\n        }\n      );\n    });\n  }\n\n  private isGoogleAccessToken(token: string): boolean {\n    return token.startsWith(\"ya29.\");\n  }\n\n  public async authenticate(req: any, res: any): Promise<AuthResponse> {\n    const token = this.extractBearerToken(req);\n    console.log(token);\n    if (!token) {\n      return { isAuthenticated: false };\n    }\n\n    try {\n      // First, try to verify as NextAuth JWT token (signed with NEXTAUTH_SECRET)\n      if (this.config.nextAuthSecret) {\n        try {\n          const payload = await this.verifyNextAuthToken(token);\n          if (payload.sub) {\n            return {\n              isAuthenticated: true,\n              userId: payload.sub,\n            };\n          }\n        } catch {\n          // If NextAuth verification fails, try other methods\n        }\n      }\n\n      // Check if it's a Google Access Token (starts with \"ya29.\")\n      if (this.isGoogleAccessToken(token)) {\n        const tokenInfo = await this.verifyGoogleAccessToken(token);\n        if (tokenInfo.sub) {\n          return {\n            isAuthenticated: true,\n            userId: tokenInfo.sub,\n          };\n        }\n        console.error(\"Google auth verification failed: Token does not contain sub claim\");\n        return { isAuthenticated: false };\n      }\n\n      // Try to verify as Google ID token (JWT)\n      const payload = await this.verifyGoogleIdToken(token);\n\n      if (!payload.sub) {\n        console.error(\"Google auth verification failed: Token does not contain sub claim\");\n        return { isAuthenticated: false };\n      }\n\n      return {\n        isAuthenticated: true,\n        userId: payload.sub,\n      };\n    } catch (err) {\n      console.error(\"Google auth verification failed:\", (err as Error).message);\n      return { isAuthenticated: false };\n    }\n  }\n\n  private extractBearerToken(req: Request): string | null {\n    const authHeader = req.headers.authorization;\n    if (!authHeader?.startsWith(\"Bearer \")) {\n      return null;\n    }\n    return authHeader.substring(7);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,qBAAyB;AAGzB,0BAAmD;AACnD,sBAAuB;AA4CvB,IAAM,iBAAwC;AAAA,EAC5C;AAAA,EACA;AACF;AAEO,IAAM,aAAN,cAAyB,wBAAS;AAAA,EAGvC,YAA6B,QAA0B;AACrD,UAAM;AADqB;AAG3B,SAAK,iBAAa,gBAAAA,SAAW;AAAA,MAC3B,SAAS;AAAA,MACT,OAAO;AAAA,MACP,aAAa;AAAA;AAAA,MACb,WAAW;AAAA,MACX,uBAAuB;AAAA,IACzB,CAAC;AAAA,EACH;AAAA,EAZiB;AAAA,EAcT,gBAAgB,CAAC,QAAmB,aAAuC;AACjF,SAAK,WAAW,cAAc,OAAO,KAAK,CAAC,KAAK,QAAQ;AACtD,UAAI,KAAK;AACP,iBAAS,GAAG;AACZ;AAAA,MACF;AACA,YAAM,aAAa,KAAK,aAAa;AACrC,eAAS,MAAM,UAAU;AAAA,IAC3B,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,OAA4C;AACtE,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,0BAAAC,QAAI;AAAA,QACF;AAAA,QACA,KAAK;AAAA,QACL;AAAA,UACE,YAAY,CAAC,OAAO;AAAA,UACpB,UAAU,KAAK,OAAO;AAAA,UACtB,QAAQ;AAAA,QACV;AAAA,QACA,CAAC,KAAmB,YAAqB;AACvC,cAAI,KAAK;AACP,mBAAO,GAAG;AACV;AAAA,UACF;AACA,kBAAQ,OAA6B;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,wBAAwB,OAAiD;AACrF,UAAM,WAAW,MAAM;AAAA,MACrB,wDAAwD,mBAAmB,KAAK,CAAC;AAAA,IACnF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,KAAK,OAAO;AACd,YAAM,IAAI,MAAM,KAAK,qBAAqB,KAAK,KAAK;AAAA,IACtD;AAGA,QAAI,KAAK,QAAQ,KAAK,OAAO,YAAY,KAAK,QAAQ,KAAK,OAAO,UAAU;AAC1E,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,oBAAoB,OAA4C;AACtE,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,CAAC,KAAK,OAAO,gBAAgB;AAC/B,eAAO,IAAI,MAAM,6DAA6D,CAAC;AAC/E;AAAA,MACF;AAEA,0BAAAA,QAAI;AAAA,QACF;AAAA,QACA,KAAK,OAAO;AAAA,QACZ;AAAA,UACE,YAAY,CAAC,OAAO;AAAA,QACtB;AAAA,QACA,CAAC,KAAK,YAAY;AAChB,cAAI,KAAK;AACP,mBAAO,GAAG;AACV;AAAA,UACF;AACA,kBAAQ,OAA6B;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,OAAwB;AAClD,WAAO,MAAM,WAAW,OAAO;AAAA,EACjC;AAAA,EAEA,MAAa,aAAa,KAAU,KAAiC;AACnE,UAAM,QAAQ,KAAK,mBAAmB,GAAG;AACzC,YAAQ,IAAI,KAAK;AACjB,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,iBAAiB,MAAM;AAAA,IAClC;AAEA,QAAI;AAEF,UAAI,KAAK,OAAO,gBAAgB;AAC9B,YAAI;AACF,gBAAMC,WAAU,MAAM,KAAK,oBAAoB,KAAK;AACpD,cAAIA,SAAQ,KAAK;AACf,mBAAO;AAAA,cACL,iBAAiB;AAAA,cACjB,QAAQA,SAAQ;AAAA,YAClB;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAGA,UAAI,KAAK,oBAAoB,KAAK,GAAG;AACnC,cAAM,YAAY,MAAM,KAAK,wBAAwB,KAAK;AAC1D,YAAI,UAAU,KAAK;AACjB,iBAAO;AAAA,YACL,iBAAiB;AAAA,YACjB,QAAQ,UAAU;AAAA,UACpB;AAAA,QACF;AACA,gBAAQ,MAAM,mEAAmE;AACjF,eAAO,EAAE,iBAAiB,MAAM;AAAA,MAClC;AAGA,YAAM,UAAU,MAAM,KAAK,oBAAoB,KAAK;AAEpD,UAAI,CAAC,QAAQ,KAAK;AAChB,gBAAQ,MAAM,mEAAmE;AACjF,eAAO,EAAE,iBAAiB,MAAM;AAAA,MAClC;AAEA,aAAO;AAAA,QACL,iBAAiB;AAAA,QACjB,QAAQ,QAAQ;AAAA,MAClB;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,oCAAqC,IAAc,OAAO;AACxE,aAAO,EAAE,iBAAiB,MAAM;AAAA,IAClC;AAAA,EACF;AAAA,EAEQ,mBAAmB,KAA6B;AACtD,UAAM,aAAa,IAAI,QAAQ;AAC/B,QAAI,CAAC,YAAY,WAAW,SAAS,GAAG;AACtC,aAAO;AAAA,IACT;AACA,WAAO,WAAW,UAAU,CAAC;AAAA,EAC/B;AACF;","names":["jwksClient","jwt","payload"]}

package/dist/index.d.cts

@@ -0,0 +1,3 @@
+export { GoogleAuth, GoogleAuthConfig } from './implements/google.auth.cjs';
+import '@ainetwork/adk/modules';
+import '@ainetwork/adk/types/auth';

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { GoogleAuth, GoogleAuthConfig } from './implements/google.auth.js';
+import '@ainetwork/adk/modules';
+import '@ainetwork/adk/types/auth';

package/dist/index.js

@@ -0,0 +1,7 @@
+import {
+  GoogleAuth
+} from "./chunk-HRHLJJ2F.js";
+export {
+  GoogleAuth
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/implements/google.auth.ts

@@ -0,0 +1,208 @@
+import { BaseAuth } from "@ainetwork/adk/modules";
+import { AuthResponse } from "@ainetwork/adk/types/auth";
+import type { Request } from "express";
+import jwt, { JwtHeader, SigningKeyCallback } from "jsonwebtoken";
+import jwksClient from "jwks-rsa";
+
+export interface GoogleAuthConfig {
+  clientId: string;
+  nextAuthSecret?: string;
+}
+
+interface GoogleTokenPayload {
+  aud: string;
+  iss: string;
+  iat: number;
+  exp: number;
+  sub: string;
+  email?: string;
+  email_verified?: boolean;
+  name?: string;
+  picture?: string;
+  azp?: string;
+}
+
+interface GoogleTokenInfoResponse {
+  azp: string;
+  aud: string;
+  sub: string;
+  scope: string;
+  exp: string;
+  expires_in: string;
+  email?: string;
+  email_verified?: string;
+  access_type?: string;
+  error?: string;
+  error_description?: string;
+}
+
+interface NextAuthJWTPayload {
+  name?: string;
+  email?: string;
+  picture?: string;
+  sub: string;
+  iat: number;
+  exp: number;
+  jti?: string;
+}
+
+const GOOGLE_ISSUERS: [string, ...string[]] = [
+  "https://accounts.google.com",
+  "accounts.google.com",
+];
+
+export class GoogleAuth extends BaseAuth {
+  private readonly jwksClient: jwksClient.JwksClient;
+
+  constructor(private readonly config: GoogleAuthConfig) {
+    super();
+
+    this.jwksClient = jwksClient({
+      jwksUri: "https://www.googleapis.com/oauth2/v3/certs",
+      cache: true,
+      cacheMaxAge: 86400000, // 24 hours
+      rateLimit: true,
+      jwksRequestsPerMinute: 10,
+    });
+  }
+
+  private getSigningKey = (header: JwtHeader, callback: SigningKeyCallback): void => {
+    this.jwksClient.getSigningKey(header.kid, (err, key) => {
+      if (err) {
+        callback(err);
+        return;
+      }
+      const signingKey = key?.getPublicKey();
+      callback(null, signingKey);
+    });
+  };
+
+  private verifyGoogleIdToken(token: string): Promise<GoogleTokenPayload> {
+    return new Promise((resolve, reject) => {
+      jwt.verify(
+        token,
+        this.getSigningKey,
+        {
+          algorithms: ["RS256"],
+          audience: this.config.clientId,
+          issuer: GOOGLE_ISSUERS,
+        },
+        (err: Error | null, decoded: unknown) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded as GoogleTokenPayload);
+        }
+      );
+    });
+  }
+
+  private async verifyGoogleAccessToken(token: string): Promise<GoogleTokenInfoResponse> {
+    const response = await fetch(
+      `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(token)}`
+    );
+
+    const data = await response.json() as GoogleTokenInfoResponse;
+
+    if (data.error) {
+      throw new Error(data.error_description || data.error);
+    }
+
+    // Verify the token is for our client
+    if (data.aud !== this.config.clientId && data.azp !== this.config.clientId) {
+      throw new Error("Token was not issued for this client");
+    }
+
+    return data;
+  }
+
+  private verifyNextAuthToken(token: string): Promise<NextAuthJWTPayload> {
+    return new Promise((resolve, reject) => {
+      if (!this.config.nextAuthSecret) {
+        reject(new Error("NextAuth secret is required for NextAuth token verification"));
+        return;
+      }
+
+      jwt.verify(
+        token,
+        this.config.nextAuthSecret,
+        {
+          algorithms: ["HS256"],
+        },
+        (err, decoded) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded as NextAuthJWTPayload);
+        }
+      );
+    });
+  }
+
+  private isGoogleAccessToken(token: string): boolean {
+    return token.startsWith("ya29.");
+  }
+
+  public async authenticate(req: any, res: any): Promise<AuthResponse> {
+    const token = this.extractBearerToken(req);
+    if (!token) {
+      return { isAuthenticated: false };
+    }
+
+    try {
+      // First, try to verify as NextAuth JWT token (signed with NEXTAUTH_SECRET)
+      if (this.config.nextAuthSecret) {
+        try {
+          const payload = await this.verifyNextAuthToken(token);
+          if (payload.sub) {
+            return {
+              isAuthenticated: true,
+              userId: payload.sub,
+            };
+          }
+        } catch {
+          // If NextAuth verification fails, try other methods
+        }
+      }
+
+      // Check if it's a Google Access Token (starts with "ya29.")
+      if (this.isGoogleAccessToken(token)) {
+        const tokenInfo = await this.verifyGoogleAccessToken(token);
+        if (tokenInfo.sub) {
+          return {
+            isAuthenticated: true,
+            userId: tokenInfo.sub,
+          };
+        }
+        console.error("Google auth verification failed: Token does not contain sub claim");
+        return { isAuthenticated: false };
+      }
+
+      // Try to verify as Google ID token (JWT)
+      const payload = await this.verifyGoogleIdToken(token);
+
+      if (!payload.sub) {
+        console.error("Google auth verification failed: Token does not contain sub claim");
+        return { isAuthenticated: false };
+      }
+
+      return {
+        isAuthenticated: true,
+        userId: payload.sub,
+      };
+    } catch (err) {
+      console.error("Google auth verification failed:", (err as Error).message);
+      return { isAuthenticated: false };
+    }
+  }
+
+  private extractBearerToken(req: Request): string | null {
+    const authHeader = req.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+      return null;
+    }
+    return authHeader.substring(7);
+  }
+}

package/index.ts

@@ -0,0 +1 @@
+export { GoogleAuth, type GoogleAuthConfig } from "./implements/google.auth";

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@ainetwork/adk-provider-auth-google",
+  "version": "0.3.0",
+  "author": "AI Network (https://ainetwork.ai)",
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "scripts": {
+    "build": "tsup",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "@ainetwork/adk": "^0.3.0",
+    "jsonwebtoken": "^9.0.2",
+    "jwks-rsa": "^3.1.0"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.21",
+    "@types/jsonwebtoken": "^9.0.7",
+    "typescript": "^5.0.0"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "gitHead": "741d325b4e2de45b8fe45e11d6a525d6467f5ab6"
+}

package/tsconfig.json

@@ -0,0 +1,9 @@
+{
+	"extends": "../../../tsconfig.json",
+	"compilerOptions": {
+		"outDir": "./dist",
+		"rootDir": ".",
+	},
+	"include": ["index.ts", "implements/**/*.ts"],
+	"exclude": ["node_modules", "dist"]
+}

package/tsup.config.ts

@@ -0,0 +1,9 @@
+import { defineConfig } from 'tsup'
+
+export default defineConfig({
+  entry: ['index.ts', 'implements/**/*.ts'],
+  format: ['cjs', 'esm'],
+  dts: true,
+  sourcemap: true,
+  clean: true,
+})