@ainetwork/adk-provider-auth-m365 0.3.0

package/dist/chunk-D55IH5LY.js

@@ -0,0 +1,119 @@
+// implements/m365.auth.ts
+import { BaseAuth } from "@ainetwork/adk/modules";
+import jwt from "jsonwebtoken";
+import jwksClient from "jwks-rsa";
+var M365Auth = class extends BaseAuth {
+  constructor(config) {
+    super();
+    this.config = config;
+    this.cloudInstance = this.config.cloudInstance || "https://login.microsoftonline.com";
+    this.expectedIssuer = `${this.cloudInstance}/${this.config.tenantId}/v2.0`;
+    this.jwksClient = jwksClient({
+      jwksUri: `${this.cloudInstance}/${this.config.tenantId}/discovery/v2.0/keys`,
+      cache: true,
+      cacheMaxAge: 864e5,
+      // 24 hours
+      rateLimit: true,
+      jwksRequestsPerMinute: 10
+    });
+  }
+  jwksClient;
+  cloudInstance;
+  expectedIssuer;
+  getSigningKey = (header, callback) => {
+    this.jwksClient.getSigningKey(header.kid, (err, key) => {
+      if (err) {
+        callback(err);
+        return;
+      }
+      const signingKey = key?.getPublicKey();
+      callback(null, signingKey);
+    });
+  };
+  verifyAzureADToken(token) {
+    return new Promise((resolve, reject) => {
+      jwt.verify(
+        token,
+        this.getSigningKey,
+        {
+          algorithms: ["RS256"],
+          audience: this.config.clientId,
+          issuer: this.expectedIssuer
+        },
+        (err, decoded) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded);
+        }
+      );
+    });
+  }
+  verifyNextAuthToken(token) {
+    return new Promise((resolve, reject) => {
+      if (!this.config.nextAuthSecret) {
+        reject(new Error("NextAuth secret is required for NextAuth token verification"));
+        return;
+      }
+      jwt.verify(
+        token,
+        this.config.nextAuthSecret,
+        {
+          algorithms: ["HS256"]
+        },
+        (err, decoded) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded);
+        }
+      );
+    });
+  }
+  async authenticate(req, res) {
+    const token = this.extractBearerToken(req);
+    if (!token) {
+      return { isAuthenticated: false };
+    }
+    try {
+      if (this.config.nextAuthSecret) {
+        try {
+          const payload2 = await this.verifyNextAuthToken(token);
+          if (payload2.sub) {
+            return {
+              isAuthenticated: true,
+              userId: payload2.sub
+            };
+          }
+        } catch {
+        }
+      }
+      const payload = await this.verifyAzureADToken(token);
+      if (!payload.oid && !payload.sub) {
+        console.error("M365 auth verification failed: Token does not contain oid or sub claim");
+        return { isAuthenticated: false };
+      }
+      return {
+        isAuthenticated: true,
+        userId: payload.oid || payload.sub
+      };
+    } catch (err) {
+      console.error("M365 auth verification failed:", err.message);
+      return { isAuthenticated: false };
+    }
+  }
+  extractBearerToken(req) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+      return null;
+    }
+    return authHeader.substring(7);
+  }
+};
+
+export {
+  M365Auth
+};
+//# sourceMappingURL=chunk-D55IH5LY.js.map

package/dist/chunk-D55IH5LY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../implements/m365.auth.ts"],"sourcesContent":["import { BaseAuth } from \"@ainetwork/adk/modules\";\nimport { AuthResponse } from \"@ainetwork/adk/types/auth\";\nimport type { Request } from \"express\";\nimport jwt, { JwtHeader, SigningKeyCallback } from \"jsonwebtoken\";\nimport jwksClient from \"jwks-rsa\";\n\nexport interface M365AuthConfig {\n  clientId: string;\n  tenantId: string;\n  cloudInstance?: string;\n  nextAuthSecret?: string;\n}\n\ninterface AzureADTokenPayload {\n  aud: string;\n  iss: string;\n  iat: number;\n  nbf: number;\n  exp: number;\n  oid?: string;\n  sub?: string;\n  tid?: string;\n  preferred_username?: string;\n  email?: string;\n  name?: string;\n}\n\ninterface NextAuthJWTPayload {\n  name?: string;\n  email?: string;\n  picture?: string;\n  sub: string;\n  iat: number;\n  exp: number;\n  jti?: string;\n}\n\nexport class M365Auth extends BaseAuth {\n  private readonly jwksClient: jwksClient.JwksClient;\n  private readonly cloudInstance: string;\n  private readonly expectedIssuer: string;\n\n  constructor(private readonly config: M365AuthConfig) {\n    super();\n    this.cloudInstance = this.config.cloudInstance || \"https://login.microsoftonline.com\";\n    this.expectedIssuer = `${this.cloudInstance}/${this.config.tenantId}/v2.0`;\n\n    this.jwksClient = jwksClient({\n      jwksUri: `${this.cloudInstance}/${this.config.tenantId}/discovery/v2.0/keys`,\n      cache: true,\n      cacheMaxAge: 86400000, // 24 hours\n      rateLimit: true,\n      jwksRequestsPerMinute: 10,\n    });\n  }\n\n  private getSigningKey = (header: JwtHeader, callback: SigningKeyCallback): void => {\n    this.jwksClient.getSigningKey(header.kid, (err, key) => {\n      if (err) {\n        callback(err);\n        return;\n      }\n      const signingKey = key?.getPublicKey();\n      callback(null, signingKey);\n    });\n  };\n\n  private verifyAzureADToken(token: string): Promise<AzureADTokenPayload> {\n    return new Promise((resolve, reject) => {\n      jwt.verify(\n        token,\n        this.getSigningKey,\n        {\n          algorithms: [\"RS256\"],\n          audience: this.config.clientId,\n          issuer: this.expectedIssuer,\n        },\n        (err: Error | null, decoded: unknown) => {\n          if (err) {\n            reject(err);\n            return;\n          }\n          resolve(decoded as AzureADTokenPayload);\n        }\n      );\n    });\n  }\n\n  private verifyNextAuthToken(token: string): Promise<NextAuthJWTPayload> {\n    return new Promise((resolve, reject) => {\n      if (!this.config.nextAuthSecret) {\n        reject(new Error(\"NextAuth secret is required for NextAuth token verification\"));\n        return;\n      }\n\n      jwt.verify(\n        token,\n        this.config.nextAuthSecret,\n        {\n          algorithms: [\"HS256\"],\n        },\n        (err: Error | null, decoded: unknown) => {\n          if (err) {\n            reject(err);\n            return;\n          }\n          resolve(decoded as NextAuthJWTPayload);\n        }\n      );\n    });\n  }\n\n  public async authenticate(req: any, res: any): Promise<AuthResponse> {\n    const token = this.extractBearerToken(req);\n    if (!token) {\n      return { isAuthenticated: false };\n    }\n\n    try {\n      // First, try to verify as NextAuth JWT token (signed with NEXTAUTH_SECRET)\n      if (this.config.nextAuthSecret) {\n        try {\n          const payload = await this.verifyNextAuthToken(token);\n          if (payload.sub) {\n            return {\n              isAuthenticated: true,\n              userId: payload.sub,\n            };\n          }\n        } catch {\n          // If NextAuth verification fails, try Azure AD token verification\n        }\n      }\n\n      // Try to verify as Azure AD token\n      const payload = await this.verifyAzureADToken(token);\n\n      if (!payload.oid && !payload.sub) {\n        console.error(\"M365 auth verification failed: Token does not contain oid or sub claim\");\n        return { isAuthenticated: false };\n      }\n\n      return {\n        isAuthenticated: true,\n        userId: (payload.oid || payload.sub) as string,\n      };\n    } catch (err) {\n      console.error(\"M365 auth verification failed:\", (err as Error).message);\n      return { isAuthenticated: false };\n    }\n  }\n\n  private extractBearerToken(req: Request): string | null {\n    const authHeader = req.headers.authorization;\n    if (!authHeader?.startsWith(\"Bearer \")) {\n      return null;\n    }\n    return authHeader.substring(7);\n  }\n}\n"],"mappings":";AAAA,SAAS,gBAAgB;AAGzB,OAAO,SAA4C;AACnD,OAAO,gBAAgB;AAiChB,IAAM,WAAN,cAAuB,SAAS;AAAA,EAKrC,YAA6B,QAAwB;AACnD,UAAM;AADqB;AAE3B,SAAK,gBAAgB,KAAK,OAAO,iBAAiB;AAClD,SAAK,iBAAiB,GAAG,KAAK,aAAa,IAAI,KAAK,OAAO,QAAQ;AAEnE,SAAK,aAAa,WAAW;AAAA,MAC3B,SAAS,GAAG,KAAK,aAAa,IAAI,KAAK,OAAO,QAAQ;AAAA,MACtD,OAAO;AAAA,MACP,aAAa;AAAA;AAAA,MACb,WAAW;AAAA,MACX,uBAAuB;AAAA,IACzB,CAAC;AAAA,EACH;AAAA,EAhBiB;AAAA,EACA;AAAA,EACA;AAAA,EAgBT,gBAAgB,CAAC,QAAmB,aAAuC;AACjF,SAAK,WAAW,cAAc,OAAO,KAAK,CAAC,KAAK,QAAQ;AACtD,UAAI,KAAK;AACP,iBAAS,GAAG;AACZ;AAAA,MACF;AACA,YAAM,aAAa,KAAK,aAAa;AACrC,eAAS,MAAM,UAAU;AAAA,IAC3B,CAAC;AAAA,EACH;AAAA,EAEQ,mBAAmB,OAA6C;AACtE,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI;AAAA,QACF;AAAA,QACA,KAAK;AAAA,QACL;AAAA,UACE,YAAY,CAAC,OAAO;AAAA,UACpB,UAAU,KAAK,OAAO;AAAA,UACtB,QAAQ,KAAK;AAAA,QACf;AAAA,QACA,CAAC,KAAmB,YAAqB;AACvC,cAAI,KAAK;AACP,mBAAO,GAAG;AACV;AAAA,UACF;AACA,kBAAQ,OAA8B;AAAA,QACxC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,OAA4C;AACtE,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,CAAC,KAAK,OAAO,gBAAgB;AAC/B,eAAO,IAAI,MAAM,6DAA6D,CAAC;AAC/E;AAAA,MACF;AAEA,UAAI;AAAA,QACF;AAAA,QACA,KAAK,OAAO;AAAA,QACZ;AAAA,UACE,YAAY,CAAC,OAAO;AAAA,QACtB;AAAA,QACA,CAAC,KAAmB,YAAqB;AACvC,cAAI,KAAK;AACP,mBAAO,GAAG;AACV;AAAA,UACF;AACA,kBAAQ,OAA6B;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAa,aAAa,KAAU,KAAiC;AACnE,UAAM,QAAQ,KAAK,mBAAmB,GAAG;AACzC,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,iBAAiB,MAAM;AAAA,IAClC;AAEA,QAAI;AAEF,UAAI,KAAK,OAAO,gBAAgB;AAC9B,YAAI;AACF,gBAAMA,WAAU,MAAM,KAAK,oBAAoB,KAAK;AACpD,cAAIA,SAAQ,KAAK;AACf,mBAAO;AAAA,cACL,iBAAiB;AAAA,cACjB,QAAQA,SAAQ;AAAA,YAClB;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAGA,YAAM,UAAU,MAAM,KAAK,mBAAmB,KAAK;AAEnD,UAAI,CAAC,QAAQ,OAAO,CAAC,QAAQ,KAAK;AAChC,gBAAQ,MAAM,wEAAwE;AACtF,eAAO,EAAE,iBAAiB,MAAM;AAAA,MAClC;AAEA,aAAO;AAAA,QACL,iBAAiB;AAAA,QACjB,QAAS,QAAQ,OAAO,QAAQ;AAAA,MAClC;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,kCAAmC,IAAc,OAAO;AACtE,aAAO,EAAE,iBAAiB,MAAM;AAAA,IAClC;AAAA,EACF;AAAA,EAEQ,mBAAmB,KAA6B;AACtD,UAAM,aAAa,IAAI,QAAQ;AAC/B,QAAI,CAAC,YAAY,WAAW,SAAS,GAAG;AACtC,aAAO;AAAA,IACT;AACA,WAAO,WAAW,UAAU,CAAC;AAAA,EAC/B;AACF;","names":["payload"]}

package/dist/implements/m365.auth.cjs

@@ -0,0 +1,153 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// implements/m365.auth.ts
+var m365_auth_exports = {};
+__export(m365_auth_exports, {
+  M365Auth: () => M365Auth
+});
+module.exports = __toCommonJS(m365_auth_exports);
+var import_modules = require("@ainetwork/adk/modules");
+var import_jsonwebtoken = __toESM(require("jsonwebtoken"), 1);
+var import_jwks_rsa = __toESM(require("jwks-rsa"), 1);
+var M365Auth = class extends import_modules.BaseAuth {
+  constructor(config) {
+    super();
+    this.config = config;
+    this.cloudInstance = this.config.cloudInstance || "https://login.microsoftonline.com";
+    this.expectedIssuer = `${this.cloudInstance}/${this.config.tenantId}/v2.0`;
+    this.jwksClient = (0, import_jwks_rsa.default)({
+      jwksUri: `${this.cloudInstance}/${this.config.tenantId}/discovery/v2.0/keys`,
+      cache: true,
+      cacheMaxAge: 864e5,
+      // 24 hours
+      rateLimit: true,
+      jwksRequestsPerMinute: 10
+    });
+  }
+  jwksClient;
+  cloudInstance;
+  expectedIssuer;
+  getSigningKey = (header, callback) => {
+    this.jwksClient.getSigningKey(header.kid, (err, key) => {
+      if (err) {
+        callback(err);
+        return;
+      }
+      const signingKey = key?.getPublicKey();
+      callback(null, signingKey);
+    });
+  };
+  verifyAzureADToken(token) {
+    return new Promise((resolve, reject) => {
+      import_jsonwebtoken.default.verify(
+        token,
+        this.getSigningKey,
+        {
+          algorithms: ["RS256"],
+          audience: this.config.clientId,
+          issuer: this.expectedIssuer
+        },
+        (err, decoded) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded);
+        }
+      );
+    });
+  }
+  verifyNextAuthToken(token) {
+    return new Promise((resolve, reject) => {
+      if (!this.config.nextAuthSecret) {
+        reject(new Error("NextAuth secret is required for NextAuth token verification"));
+        return;
+      }
+      import_jsonwebtoken.default.verify(
+        token,
+        this.config.nextAuthSecret,
+        {
+          algorithms: ["HS256"]
+        },
+        (err, decoded) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded);
+        }
+      );
+    });
+  }
+  async authenticate(req, res) {
+    const token = this.extractBearerToken(req);
+    if (!token) {
+      return { isAuthenticated: false };
+    }
+    try {
+      if (this.config.nextAuthSecret) {
+        try {
+          const payload2 = await this.verifyNextAuthToken(token);
+          if (payload2.sub) {
+            return {
+              isAuthenticated: true,
+              userId: payload2.sub
+            };
+          }
+        } catch {
+        }
+      }
+      const payload = await this.verifyAzureADToken(token);
+      if (!payload.oid && !payload.sub) {
+        console.error("M365 auth verification failed: Token does not contain oid or sub claim");
+        return { isAuthenticated: false };
+      }
+      return {
+        isAuthenticated: true,
+        userId: payload.oid || payload.sub
+      };
+    } catch (err) {
+      console.error("M365 auth verification failed:", err.message);
+      return { isAuthenticated: false };
+    }
+  }
+  extractBearerToken(req) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+      return null;
+    }
+    return authHeader.substring(7);
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  M365Auth
+});
+//# sourceMappingURL=m365.auth.cjs.map

package/dist/implements/m365.auth.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../implements/m365.auth.ts"],"sourcesContent":["import { BaseAuth } from \"@ainetwork/adk/modules\";\nimport { AuthResponse } from \"@ainetwork/adk/types/auth\";\nimport type { Request } from \"express\";\nimport jwt, { JwtHeader, SigningKeyCallback } from \"jsonwebtoken\";\nimport jwksClient from \"jwks-rsa\";\n\nexport interface M365AuthConfig {\n  clientId: string;\n  tenantId: string;\n  cloudInstance?: string;\n  nextAuthSecret?: string;\n}\n\ninterface AzureADTokenPayload {\n  aud: string;\n  iss: string;\n  iat: number;\n  nbf: number;\n  exp: number;\n  oid?: string;\n  sub?: string;\n  tid?: string;\n  preferred_username?: string;\n  email?: string;\n  name?: string;\n}\n\ninterface NextAuthJWTPayload {\n  name?: string;\n  email?: string;\n  picture?: string;\n  sub: string;\n  iat: number;\n  exp: number;\n  jti?: string;\n}\n\nexport class M365Auth extends BaseAuth {\n  private readonly jwksClient: jwksClient.JwksClient;\n  private readonly cloudInstance: string;\n  private readonly expectedIssuer: string;\n\n  constructor(private readonly config: M365AuthConfig) {\n    super();\n    this.cloudInstance = this.config.cloudInstance || \"https://login.microsoftonline.com\";\n    this.expectedIssuer = `${this.cloudInstance}/${this.config.tenantId}/v2.0`;\n\n    this.jwksClient = jwksClient({\n      jwksUri: `${this.cloudInstance}/${this.config.tenantId}/discovery/v2.0/keys`,\n      cache: true,\n      cacheMaxAge: 86400000, // 24 hours\n      rateLimit: true,\n      jwksRequestsPerMinute: 10,\n    });\n  }\n\n  private getSigningKey = (header: JwtHeader, callback: SigningKeyCallback): void => {\n    this.jwksClient.getSigningKey(header.kid, (err, key) => {\n      if (err) {\n        callback(err);\n        return;\n      }\n      const signingKey = key?.getPublicKey();\n      callback(null, signingKey);\n    });\n  };\n\n  private verifyAzureADToken(token: string): Promise<AzureADTokenPayload> {\n    return new Promise((resolve, reject) => {\n      jwt.verify(\n        token,\n        this.getSigningKey,\n        {\n          algorithms: [\"RS256\"],\n          audience: this.config.clientId,\n          issuer: this.expectedIssuer,\n        },\n        (err: Error | null, decoded: unknown) => {\n          if (err) {\n            reject(err);\n            return;\n          }\n          resolve(decoded as AzureADTokenPayload);\n        }\n      );\n    });\n  }\n\n  private verifyNextAuthToken(token: string): Promise<NextAuthJWTPayload> {\n    return new Promise((resolve, reject) => {\n      if (!this.config.nextAuthSecret) {\n        reject(new Error(\"NextAuth secret is required for NextAuth token verification\"));\n        return;\n      }\n\n      jwt.verify(\n        token,\n        this.config.nextAuthSecret,\n        {\n          algorithms: [\"HS256\"],\n        },\n        (err: Error | null, decoded: unknown) => {\n          if (err) {\n            reject(err);\n            return;\n          }\n          resolve(decoded as NextAuthJWTPayload);\n        }\n      );\n    });\n  }\n\n  public async authenticate(req: any, res: any): Promise<AuthResponse> {\n    const token = this.extractBearerToken(req);\n    if (!token) {\n      return { isAuthenticated: false };\n    }\n\n    try {\n      // First, try to verify as NextAuth JWT token (signed with NEXTAUTH_SECRET)\n      if (this.config.nextAuthSecret) {\n        try {\n          const payload = await this.verifyNextAuthToken(token);\n          if (payload.sub) {\n            return {\n              isAuthenticated: true,\n              userId: payload.sub,\n            };\n          }\n        } catch {\n          // If NextAuth verification fails, try Azure AD token verification\n        }\n      }\n\n      // Try to verify as Azure AD token\n      const payload = await this.verifyAzureADToken(token);\n\n      if (!payload.oid && !payload.sub) {\n        console.error(\"M365 auth verification failed: Token does not contain oid or sub claim\");\n        return { isAuthenticated: false };\n      }\n\n      return {\n        isAuthenticated: true,\n        userId: (payload.oid || payload.sub) as string,\n      };\n    } catch (err) {\n      console.error(\"M365 auth verification failed:\", (err as Error).message);\n      return { isAuthenticated: false };\n    }\n  }\n\n  private extractBearerToken(req: Request): string | null {\n    const authHeader = req.headers.authorization;\n    if (!authHeader?.startsWith(\"Bearer \")) {\n      return null;\n    }\n    return authHeader.substring(7);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAAyB;AAGzB,0BAAmD;AACnD,sBAAuB;AAiChB,IAAM,WAAN,cAAuB,wBAAS;AAAA,EAKrC,YAA6B,QAAwB;AACnD,UAAM;AADqB;AAE3B,SAAK,gBAAgB,KAAK,OAAO,iBAAiB;AAClD,SAAK,iBAAiB,GAAG,KAAK,aAAa,IAAI,KAAK,OAAO,QAAQ;AAEnE,SAAK,iBAAa,gBAAAA,SAAW;AAAA,MAC3B,SAAS,GAAG,KAAK,aAAa,IAAI,KAAK,OAAO,QAAQ;AAAA,MACtD,OAAO;AAAA,MACP,aAAa;AAAA;AAAA,MACb,WAAW;AAAA,MACX,uBAAuB;AAAA,IACzB,CAAC;AAAA,EACH;AAAA,EAhBiB;AAAA,EACA;AAAA,EACA;AAAA,EAgBT,gBAAgB,CAAC,QAAmB,aAAuC;AACjF,SAAK,WAAW,cAAc,OAAO,KAAK,CAAC,KAAK,QAAQ;AACtD,UAAI,KAAK;AACP,iBAAS,GAAG;AACZ;AAAA,MACF;AACA,YAAM,aAAa,KAAK,aAAa;AACrC,eAAS,MAAM,UAAU;AAAA,IAC3B,CAAC;AAAA,EACH;AAAA,EAEQ,mBAAmB,OAA6C;AACtE,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,0BAAAC,QAAI;AAAA,QACF;AAAA,QACA,KAAK;AAAA,QACL;AAAA,UACE,YAAY,CAAC,OAAO;AAAA,UACpB,UAAU,KAAK,OAAO;AAAA,UACtB,QAAQ,KAAK;AAAA,QACf;AAAA,QACA,CAAC,KAAmB,YAAqB;AACvC,cAAI,KAAK;AACP,mBAAO,GAAG;AACV;AAAA,UACF;AACA,kBAAQ,OAA8B;AAAA,QACxC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,OAA4C;AACtE,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,CAAC,KAAK,OAAO,gBAAgB;AAC/B,eAAO,IAAI,MAAM,6DAA6D,CAAC;AAC/E;AAAA,MACF;AAEA,0BAAAA,QAAI;AAAA,QACF;AAAA,QACA,KAAK,OAAO;AAAA,QACZ;AAAA,UACE,YAAY,CAAC,OAAO;AAAA,QACtB;AAAA,QACA,CAAC,KAAmB,YAAqB;AACvC,cAAI,KAAK;AACP,mBAAO,GAAG;AACV;AAAA,UACF;AACA,kBAAQ,OAA6B;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAa,aAAa,KAAU,KAAiC;AACnE,UAAM,QAAQ,KAAK,mBAAmB,GAAG;AACzC,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,iBAAiB,MAAM;AAAA,IAClC;AAEA,QAAI;AAEF,UAAI,KAAK,OAAO,gBAAgB;AAC9B,YAAI;AACF,gBAAMC,WAAU,MAAM,KAAK,oBAAoB,KAAK;AACpD,cAAIA,SAAQ,KAAK;AACf,mBAAO;AAAA,cACL,iBAAiB;AAAA,cACjB,QAAQA,SAAQ;AAAA,YAClB;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAGA,YAAM,UAAU,MAAM,KAAK,mBAAmB,KAAK;AAEnD,UAAI,CAAC,QAAQ,OAAO,CAAC,QAAQ,KAAK;AAChC,gBAAQ,MAAM,wEAAwE;AACtF,eAAO,EAAE,iBAAiB,MAAM;AAAA,MAClC;AAEA,aAAO;AAAA,QACL,iBAAiB;AAAA,QACjB,QAAS,QAAQ,OAAO,QAAQ;AAAA,MAClC;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,kCAAmC,IAAc,OAAO;AACtE,aAAO,EAAE,iBAAiB,MAAM;AAAA,IAClC;AAAA,EACF;AAAA,EAEQ,mBAAmB,KAA6B;AACtD,UAAM,aAAa,IAAI,QAAQ;AAC/B,QAAI,CAAC,YAAY,WAAW,SAAS,GAAG;AACtC,aAAO;AAAA,IACT;AACA,WAAO,WAAW,UAAU,CAAC;AAAA,EAC/B;AACF;","names":["jwksClient","jwt","payload"]}

package/dist/implements/m365.auth.d.cts

@@ -0,0 +1,23 @@
+import { BaseAuth } from '@ainetwork/adk/modules';
+import { AuthResponse } from '@ainetwork/adk/types/auth';
+
+interface M365AuthConfig {
+    clientId: string;
+    tenantId: string;
+    cloudInstance?: string;
+    nextAuthSecret?: string;
+}
+declare class M365Auth extends BaseAuth {
+    private readonly config;
+    private readonly jwksClient;
+    private readonly cloudInstance;
+    private readonly expectedIssuer;
+    constructor(config: M365AuthConfig);
+    private getSigningKey;
+    private verifyAzureADToken;
+    private verifyNextAuthToken;
+    authenticate(req: any, res: any): Promise<AuthResponse>;
+    private extractBearerToken;
+}
+
+export { M365Auth, type M365AuthConfig };

package/dist/implements/m365.auth.d.ts

@@ -0,0 +1,23 @@
+import { BaseAuth } from '@ainetwork/adk/modules';
+import { AuthResponse } from '@ainetwork/adk/types/auth';
+
+interface M365AuthConfig {
+    clientId: string;
+    tenantId: string;
+    cloudInstance?: string;
+    nextAuthSecret?: string;
+}
+declare class M365Auth extends BaseAuth {
+    private readonly config;
+    private readonly jwksClient;
+    private readonly cloudInstance;
+    private readonly expectedIssuer;
+    constructor(config: M365AuthConfig);
+    private getSigningKey;
+    private verifyAzureADToken;
+    private verifyNextAuthToken;
+    authenticate(req: any, res: any): Promise<AuthResponse>;
+    private extractBearerToken;
+}
+
+export { M365Auth, type M365AuthConfig };

package/dist/implements/m365.auth.js

@@ -0,0 +1,7 @@
+import {
+  M365Auth
+} from "../chunk-D55IH5LY.js";
+export {
+  M365Auth
+};
+//# sourceMappingURL=m365.auth.js.map

package/dist/implements/m365.auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/index.cjs

@@ -0,0 +1,155 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// index.ts
+var index_exports = {};
+__export(index_exports, {
+  M365Auth: () => M365Auth
+});
+module.exports = __toCommonJS(index_exports);
+
+// implements/m365.auth.ts
+var import_modules = require("@ainetwork/adk/modules");
+var import_jsonwebtoken = __toESM(require("jsonwebtoken"), 1);
+var import_jwks_rsa = __toESM(require("jwks-rsa"), 1);
+var M365Auth = class extends import_modules.BaseAuth {
+  constructor(config) {
+    super();
+    this.config = config;
+    this.cloudInstance = this.config.cloudInstance || "https://login.microsoftonline.com";
+    this.expectedIssuer = `${this.cloudInstance}/${this.config.tenantId}/v2.0`;
+    this.jwksClient = (0, import_jwks_rsa.default)({
+      jwksUri: `${this.cloudInstance}/${this.config.tenantId}/discovery/v2.0/keys`,
+      cache: true,
+      cacheMaxAge: 864e5,
+      // 24 hours
+      rateLimit: true,
+      jwksRequestsPerMinute: 10
+    });
+  }
+  jwksClient;
+  cloudInstance;
+  expectedIssuer;
+  getSigningKey = (header, callback) => {
+    this.jwksClient.getSigningKey(header.kid, (err, key) => {
+      if (err) {
+        callback(err);
+        return;
+      }
+      const signingKey = key?.getPublicKey();
+      callback(null, signingKey);
+    });
+  };
+  verifyAzureADToken(token) {
+    return new Promise((resolve, reject) => {
+      import_jsonwebtoken.default.verify(
+        token,
+        this.getSigningKey,
+        {
+          algorithms: ["RS256"],
+          audience: this.config.clientId,
+          issuer: this.expectedIssuer
+        },
+        (err, decoded) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded);
+        }
+      );
+    });
+  }
+  verifyNextAuthToken(token) {
+    return new Promise((resolve, reject) => {
+      if (!this.config.nextAuthSecret) {
+        reject(new Error("NextAuth secret is required for NextAuth token verification"));
+        return;
+      }
+      import_jsonwebtoken.default.verify(
+        token,
+        this.config.nextAuthSecret,
+        {
+          algorithms: ["HS256"]
+        },
+        (err, decoded) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded);
+        }
+      );
+    });
+  }
+  async authenticate(req, res) {
+    const token = this.extractBearerToken(req);
+    if (!token) {
+      return { isAuthenticated: false };
+    }
+    try {
+      if (this.config.nextAuthSecret) {
+        try {
+          const payload2 = await this.verifyNextAuthToken(token);
+          if (payload2.sub) {
+            return {
+              isAuthenticated: true,
+              userId: payload2.sub
+            };
+          }
+        } catch {
+        }
+      }
+      const payload = await this.verifyAzureADToken(token);
+      if (!payload.oid && !payload.sub) {
+        console.error("M365 auth verification failed: Token does not contain oid or sub claim");
+        return { isAuthenticated: false };
+      }
+      return {
+        isAuthenticated: true,
+        userId: payload.oid || payload.sub
+      };
+    } catch (err) {
+      console.error("M365 auth verification failed:", err.message);
+      return { isAuthenticated: false };
+    }
+  }
+  extractBearerToken(req) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+      return null;
+    }
+    return authHeader.substring(7);
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  M365Auth
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../index.ts","../implements/m365.auth.ts"],"sourcesContent":["export { M365Auth, type M365AuthConfig } from \"./implements/m365.auth\";\n","import { BaseAuth } from \"@ainetwork/adk/modules\";\nimport { AuthResponse } from \"@ainetwork/adk/types/auth\";\nimport type { Request } from \"express\";\nimport jwt, { JwtHeader, SigningKeyCallback } from \"jsonwebtoken\";\nimport jwksClient from \"jwks-rsa\";\n\nexport interface M365AuthConfig {\n  clientId: string;\n  tenantId: string;\n  cloudInstance?: string;\n  nextAuthSecret?: string;\n}\n\ninterface AzureADTokenPayload {\n  aud: string;\n  iss: string;\n  iat: number;\n  nbf: number;\n  exp: number;\n  oid?: string;\n  sub?: string;\n  tid?: string;\n  preferred_username?: string;\n  email?: string;\n  name?: string;\n}\n\ninterface NextAuthJWTPayload {\n  name?: string;\n  email?: string;\n  picture?: string;\n  sub: string;\n  iat: number;\n  exp: number;\n  jti?: string;\n}\n\nexport class M365Auth extends BaseAuth {\n  private readonly jwksClient: jwksClient.JwksClient;\n  private readonly cloudInstance: string;\n  private readonly expectedIssuer: string;\n\n  constructor(private readonly config: M365AuthConfig) {\n    super();\n    this.cloudInstance = this.config.cloudInstance || \"https://login.microsoftonline.com\";\n    this.expectedIssuer = `${this.cloudInstance}/${this.config.tenantId}/v2.0`;\n\n    this.jwksClient = jwksClient({\n      jwksUri: `${this.cloudInstance}/${this.config.tenantId}/discovery/v2.0/keys`,\n      cache: true,\n      cacheMaxAge: 86400000, // 24 hours\n      rateLimit: true,\n      jwksRequestsPerMinute: 10,\n    });\n  }\n\n  private getSigningKey = (header: JwtHeader, callback: SigningKeyCallback): void => {\n    this.jwksClient.getSigningKey(header.kid, (err, key) => {\n      if (err) {\n        callback(err);\n        return;\n      }\n      const signingKey = key?.getPublicKey();\n      callback(null, signingKey);\n    });\n  };\n\n  private verifyAzureADToken(token: string): Promise<AzureADTokenPayload> {\n    return new Promise((resolve, reject) => {\n      jwt.verify(\n        token,\n        this.getSigningKey,\n        {\n          algorithms: [\"RS256\"],\n          audience: this.config.clientId,\n          issuer: this.expectedIssuer,\n        },\n        (err: Error | null, decoded: unknown) => {\n          if (err) {\n            reject(err);\n            return;\n          }\n          resolve(decoded as AzureADTokenPayload);\n        }\n      );\n    });\n  }\n\n  private verifyNextAuthToken(token: string): Promise<NextAuthJWTPayload> {\n    return new Promise((resolve, reject) => {\n      if (!this.config.nextAuthSecret) {\n        reject(new Error(\"NextAuth secret is required for NextAuth token verification\"));\n        return;\n      }\n\n      jwt.verify(\n        token,\n        this.config.nextAuthSecret,\n        {\n          algorithms: [\"HS256\"],\n        },\n        (err: Error | null, decoded: unknown) => {\n          if (err) {\n            reject(err);\n            return;\n          }\n          resolve(decoded as NextAuthJWTPayload);\n        }\n      );\n    });\n  }\n\n  public async authenticate(req: any, res: any): Promise<AuthResponse> {\n    const token = this.extractBearerToken(req);\n    if (!token) {\n      return { isAuthenticated: false };\n    }\n\n    try {\n      // First, try to verify as NextAuth JWT token (signed with NEXTAUTH_SECRET)\n      if (this.config.nextAuthSecret) {\n        try {\n          const payload = await this.verifyNextAuthToken(token);\n          if (payload.sub) {\n            return {\n              isAuthenticated: true,\n              userId: payload.sub,\n            };\n          }\n        } catch {\n          // If NextAuth verification fails, try Azure AD token verification\n        }\n      }\n\n      // Try to verify as Azure AD token\n      const payload = await this.verifyAzureADToken(token);\n\n      if (!payload.oid && !payload.sub) {\n        console.error(\"M365 auth verification failed: Token does not contain oid or sub claim\");\n        return { isAuthenticated: false };\n      }\n\n      return {\n        isAuthenticated: true,\n        userId: (payload.oid || payload.sub) as string,\n      };\n    } catch (err) {\n      console.error(\"M365 auth verification failed:\", (err as Error).message);\n      return { isAuthenticated: false };\n    }\n  }\n\n  private extractBearerToken(req: Request): string | null {\n    const authHeader = req.headers.authorization;\n    if (!authHeader?.startsWith(\"Bearer \")) {\n      return null;\n    }\n    return authHeader.substring(7);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,qBAAyB;AAGzB,0BAAmD;AACnD,sBAAuB;AAiChB,IAAM,WAAN,cAAuB,wBAAS;AAAA,EAKrC,YAA6B,QAAwB;AACnD,UAAM;AADqB;AAE3B,SAAK,gBAAgB,KAAK,OAAO,iBAAiB;AAClD,SAAK,iBAAiB,GAAG,KAAK,aAAa,IAAI,KAAK,OAAO,QAAQ;AAEnE,SAAK,iBAAa,gBAAAA,SAAW;AAAA,MAC3B,SAAS,GAAG,KAAK,aAAa,IAAI,KAAK,OAAO,QAAQ;AAAA,MACtD,OAAO;AAAA,MACP,aAAa;AAAA;AAAA,MACb,WAAW;AAAA,MACX,uBAAuB;AAAA,IACzB,CAAC;AAAA,EACH;AAAA,EAhBiB;AAAA,EACA;AAAA,EACA;AAAA,EAgBT,gBAAgB,CAAC,QAAmB,aAAuC;AACjF,SAAK,WAAW,cAAc,OAAO,KAAK,CAAC,KAAK,QAAQ;AACtD,UAAI,KAAK;AACP,iBAAS,GAAG;AACZ;AAAA,MACF;AACA,YAAM,aAAa,KAAK,aAAa;AACrC,eAAS,MAAM,UAAU;AAAA,IAC3B,CAAC;AAAA,EACH;AAAA,EAEQ,mBAAmB,OAA6C;AACtE,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,0BAAAC,QAAI;AAAA,QACF;AAAA,QACA,KAAK;AAAA,QACL;AAAA,UACE,YAAY,CAAC,OAAO;AAAA,UACpB,UAAU,KAAK,OAAO;AAAA,UACtB,QAAQ,KAAK;AAAA,QACf;AAAA,QACA,CAAC,KAAmB,YAAqB;AACvC,cAAI,KAAK;AACP,mBAAO,GAAG;AACV;AAAA,UACF;AACA,kBAAQ,OAA8B;AAAA,QACxC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,oBAAoB,OAA4C;AACtE,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI,CAAC,KAAK,OAAO,gBAAgB;AAC/B,eAAO,IAAI,MAAM,6DAA6D,CAAC;AAC/E;AAAA,MACF;AAEA,0BAAAA,QAAI;AAAA,QACF;AAAA,QACA,KAAK,OAAO;AAAA,QACZ;AAAA,UACE,YAAY,CAAC,OAAO;AAAA,QACtB;AAAA,QACA,CAAC,KAAmB,YAAqB;AACvC,cAAI,KAAK;AACP,mBAAO,GAAG;AACV;AAAA,UACF;AACA,kBAAQ,OAA6B;AAAA,QACvC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAa,aAAa,KAAU,KAAiC;AACnE,UAAM,QAAQ,KAAK,mBAAmB,GAAG;AACzC,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,iBAAiB,MAAM;AAAA,IAClC;AAEA,QAAI;AAEF,UAAI,KAAK,OAAO,gBAAgB;AAC9B,YAAI;AACF,gBAAMC,WAAU,MAAM,KAAK,oBAAoB,KAAK;AACpD,cAAIA,SAAQ,KAAK;AACf,mBAAO;AAAA,cACL,iBAAiB;AAAA,cACjB,QAAQA,SAAQ;AAAA,YAClB;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAGA,YAAM,UAAU,MAAM,KAAK,mBAAmB,KAAK;AAEnD,UAAI,CAAC,QAAQ,OAAO,CAAC,QAAQ,KAAK;AAChC,gBAAQ,MAAM,wEAAwE;AACtF,eAAO,EAAE,iBAAiB,MAAM;AAAA,MAClC;AAEA,aAAO;AAAA,QACL,iBAAiB;AAAA,QACjB,QAAS,QAAQ,OAAO,QAAQ;AAAA,MAClC;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ,MAAM,kCAAmC,IAAc,OAAO;AACtE,aAAO,EAAE,iBAAiB,MAAM;AAAA,IAClC;AAAA,EACF;AAAA,EAEQ,mBAAmB,KAA6B;AACtD,UAAM,aAAa,IAAI,QAAQ;AAC/B,QAAI,CAAC,YAAY,WAAW,SAAS,GAAG;AACtC,aAAO;AAAA,IACT;AACA,WAAO,WAAW,UAAU,CAAC;AAAA,EAC/B;AACF;","names":["jwksClient","jwt","payload"]}

package/dist/index.d.cts

@@ -0,0 +1,3 @@
+export { M365Auth, M365AuthConfig } from './implements/m365.auth.cjs';
+import '@ainetwork/adk/modules';
+import '@ainetwork/adk/types/auth';

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { M365Auth, M365AuthConfig } from './implements/m365.auth.js';
+import '@ainetwork/adk/modules';
+import '@ainetwork/adk/types/auth';

package/dist/index.js

@@ -0,0 +1,7 @@
+import {
+  M365Auth
+} from "./chunk-D55IH5LY.js";
+export {
+  M365Auth
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/implements/m365.auth.ts

@@ -0,0 +1,160 @@
+import { BaseAuth } from "@ainetwork/adk/modules";
+import { AuthResponse } from "@ainetwork/adk/types/auth";
+import type { Request } from "express";
+import jwt, { JwtHeader, SigningKeyCallback } from "jsonwebtoken";
+import jwksClient from "jwks-rsa";
+
+export interface M365AuthConfig {
+  clientId: string;
+  tenantId: string;
+  cloudInstance?: string;
+  nextAuthSecret?: string;
+}
+
+interface AzureADTokenPayload {
+  aud: string;
+  iss: string;
+  iat: number;
+  nbf: number;
+  exp: number;
+  oid?: string;
+  sub?: string;
+  tid?: string;
+  preferred_username?: string;
+  email?: string;
+  name?: string;
+}
+
+interface NextAuthJWTPayload {
+  name?: string;
+  email?: string;
+  picture?: string;
+  sub: string;
+  iat: number;
+  exp: number;
+  jti?: string;
+}
+
+export class M365Auth extends BaseAuth {
+  private readonly jwksClient: jwksClient.JwksClient;
+  private readonly cloudInstance: string;
+  private readonly expectedIssuer: string;
+
+  constructor(private readonly config: M365AuthConfig) {
+    super();
+    this.cloudInstance = this.config.cloudInstance || "https://login.microsoftonline.com";
+    this.expectedIssuer = `${this.cloudInstance}/${this.config.tenantId}/v2.0`;
+
+    this.jwksClient = jwksClient({
+      jwksUri: `${this.cloudInstance}/${this.config.tenantId}/discovery/v2.0/keys`,
+      cache: true,
+      cacheMaxAge: 86400000, // 24 hours
+      rateLimit: true,
+      jwksRequestsPerMinute: 10,
+    });
+  }
+
+  private getSigningKey = (header: JwtHeader, callback: SigningKeyCallback): void => {
+    this.jwksClient.getSigningKey(header.kid, (err, key) => {
+      if (err) {
+        callback(err);
+        return;
+      }
+      const signingKey = key?.getPublicKey();
+      callback(null, signingKey);
+    });
+  };
+
+  private verifyAzureADToken(token: string): Promise<AzureADTokenPayload> {
+    return new Promise((resolve, reject) => {
+      jwt.verify(
+        token,
+        this.getSigningKey,
+        {
+          algorithms: ["RS256"],
+          audience: this.config.clientId,
+          issuer: this.expectedIssuer,
+        },
+        (err: Error | null, decoded: unknown) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded as AzureADTokenPayload);
+        }
+      );
+    });
+  }
+
+  private verifyNextAuthToken(token: string): Promise<NextAuthJWTPayload> {
+    return new Promise((resolve, reject) => {
+      if (!this.config.nextAuthSecret) {
+        reject(new Error("NextAuth secret is required for NextAuth token verification"));
+        return;
+      }
+
+      jwt.verify(
+        token,
+        this.config.nextAuthSecret,
+        {
+          algorithms: ["HS256"],
+        },
+        (err: Error | null, decoded: unknown) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(decoded as NextAuthJWTPayload);
+        }
+      );
+    });
+  }
+
+  public async authenticate(req: any, res: any): Promise<AuthResponse> {
+    const token = this.extractBearerToken(req);
+    if (!token) {
+      return { isAuthenticated: false };
+    }
+
+    try {
+      // First, try to verify as NextAuth JWT token (signed with NEXTAUTH_SECRET)
+      if (this.config.nextAuthSecret) {
+        try {
+          const payload = await this.verifyNextAuthToken(token);
+          if (payload.sub) {
+            return {
+              isAuthenticated: true,
+              userId: payload.sub,
+            };
+          }
+        } catch {
+          // If NextAuth verification fails, try Azure AD token verification
+        }
+      }
+
+      // Try to verify as Azure AD token
+      const payload = await this.verifyAzureADToken(token);
+
+      if (!payload.oid && !payload.sub) {
+        console.error("M365 auth verification failed: Token does not contain oid or sub claim");
+        return { isAuthenticated: false };
+      }
+
+      return {
+        isAuthenticated: true,
+        userId: (payload.oid || payload.sub) as string,
+      };
+    } catch (err) {
+      console.error("M365 auth verification failed:", (err as Error).message);
+      return { isAuthenticated: false };
+    }
+  }
+
+  private extractBearerToken(req: Request): string | null {
+    const authHeader = req.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+      return null;
+    }
+    return authHeader.substring(7);
+  }
+}

package/index.ts

@@ -0,0 +1 @@
+export { M365Auth, type M365AuthConfig } from "./implements/m365.auth";

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@ainetwork/adk-provider-auth-m365",
+  "version": "0.3.0",
+  "author": "AI Network (https://ainetwork.ai)",
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "scripts": {
+    "build": "tsup",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "@ainetwork/adk": "^0.3.0",
+    "jsonwebtoken": "^9.0.2",
+    "jwks-rsa": "^3.1.0"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.21",
+    "@types/jsonwebtoken": "^9.0.7",
+    "typescript": "^5.0.0"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "gitHead": "741d325b4e2de45b8fe45e11d6a525d6467f5ab6"
+}

package/tsconfig.json

@@ -0,0 +1,9 @@
+{
+	"extends": "../../../tsconfig.json",
+	"compilerOptions": {
+		"outDir": "./dist",
+		"rootDir": ".",
+	},
+	"include": ["index.ts", "implements/**/*.ts"],
+	"exclude": ["node_modules", "dist"]
+}

package/tsup.config.ts

@@ -0,0 +1,9 @@
+import { defineConfig } from 'tsup'
+
+export default defineConfig({
+  entry: ['index.ts', 'implements/**/*.ts'],
+  format: ['cjs', 'esm'],
+  dts: true,
+  sourcemap: true,
+  clean: true,
+})