@appweaver/core 1.0.0

package/security/helper.d.ts

@@ -0,0 +1,127 @@
+import { AuthScope, AuthSource, AuthType, AuthUser, IResourceService, ResourceModel, ValidationResult } from '@appweaver/common';
+/**
+ * Evaluates and retrieves the resource authentication model from the available resource models.
+ *
+ * The function iterates through the resource models in the given context and returns the first model
+ * that satisfies the `isResourceAuthModel` condition. If no such model is found, it returns undefined.
+ *
+ * @return {ResourceModel | undefined} The resource authentication model if present, otherwise undefined.
+ */
+export declare function resourceAuthModel(): ResourceModel | undefined;
+/**
+ * Provides authentication service for a resource by identifying and injecting
+ * the appropriate resource authentication service if available.
+ *
+ * @return {IResourceService<AuthUser, AuthUser> | undefined} The resource authentication service
+ *         instance if found, otherwise undefined.
+ */
+export declare function resourceAuthService(): IResourceService<AuthUser, AuthUser> | undefined;
+/**
+ * Retrieves the currently authenticated user from the request context.
+ *
+ * @return {AuthUser | null | undefined} The authenticated user object if available,
+ * null if no user is authenticated, or undefined if the context does not contain
+ * authentication information.
+ */
+export declare function currentAuthUser(): AuthUser | null | undefined;
+/**
+ * Retrieves the current authentication type from the request context.
+ *
+ * @return {AuthType | null | undefined} The authentication type if available; otherwise, returns null or undefined.
+ */
+export declare function currentAuthType(): AuthType | null | undefined;
+/**
+ * Retrieves the current authentication source from the request context.
+ *
+ * @return {AuthSource | null | undefined} The authentication source if available; otherwise, null or undefined
+ * if it is not set.
+ */
+export declare function currentAuthSource(): AuthSource | null | undefined;
+/**
+ * Hashes a plain text password using a cryptographic salt.
+ *
+ * @param {string} password - The plain text password to be hashed.
+ * @return {Promise<string>} A promise that resolves to the hashed password.
+ */
+export declare function hashPassword(password: string): Promise<string>;
+/**
+ * Validates a plain text password against a hashed password.
+ *
+ * @param {string} password - The plain text password to validate.
+ * @param {string} passwordHash - The hashed password to compare against.
+ * @return {Promise<boolean>} Returns a promise that resolves to `true` if the password matches the hash,
+ * otherwise `false`.
+ */
+export declare function checkPassword(password: string, passwordHash: string): Promise<boolean>;
+/**
+ * Updates the password hash for a given user and optionally logs the user out by setting a logout timestamp.
+ *
+ * @param {Partial<AuthUser>} authUser - The user object containing authentication details. Only partial fields are
+ * expected.
+ * @param {string} [password] - The new password to hash and set for the user. If not provided, no password update
+ * occurs.
+ * @param {boolean} [logout=false] - Indicates whether to log the user out by setting the logout timestamp.
+ * @return Resolves when the password hash is updated and optional logout processing is complete.
+ * @throws {HttpError} If the provided password does not satisfy password complexity requirements.
+ */
+export declare function updatePasswordHash(authUser: Partial<AuthUser>, password?: string, logout?: boolean): Promise<void>;
+/**
+ * Validates the complexity of a given password based on the configured rules.
+ * @param {string} password - The password to be validated.
+ * @return {ValidationResult} An object with the validation result and message.
+ */
+export declare function validatePasswordComplexity(password: string): ValidationResult;
+/**
+ * Validates a URL and checks if it's allowed based on the configured list of allowed hosts.
+ *
+ * @param {string} url - The URL string to validate.
+ * @return {ValidationResult} An object containing validation result and message.
+ */
+export declare function validateRedirectUrl(url: string): ValidationResult;
+/**
+ * Checks whether the provided URL is accessible based on the user's JWT payload `scope` property.
+ *
+ * @param {string} url - The URL path being accessed.
+ * @param {AuthScope} authScope - The `scope` property from the decoded JWT payload.
+ * @return {boolean} Returns true if the URL is accessible based on the scope; false otherwise.
+ */
+export declare function checkScopeAccess(url: string, authScope: AuthScope): boolean;
+/**
+ * Checks if the given user has a specific role.
+ *
+ * @param {AuthUser} authUser - The authenticated user object containing role information.
+ * @param {string} role - The name of the role to check for.
+ * @return {boolean} True if the user has the specified role; otherwise, false.
+ */
+export declare function hasRole(authUser: AuthUser, role: string): boolean;
+/**
+ * Checks if the authenticated user has the required roles based on the specified operator.
+ *
+ * @param {AuthUser} authUser - The authenticated user whose roles are being checked.
+ * @param {Array<string> | undefined} roles - The list of roles to check against. If undefined, the method returns
+ * true`.
+ * @param {'or' | 'and'} [operator='or'] - The logical operator for role matching. Use 'or' to check if the user has at
+ * least one role, and 'and' to check if the user has all roles.
+ * @return {boolean} Returns `true` if the user satisfies the role check based on the specified operator, otherwise
+ * `false`.
+ */
+export declare function hasRoles(authUser: AuthUser, roles: Array<string> | undefined, operator?: 'or' | 'and'): boolean;
+/**
+ * Determines if the authenticated user has the specified permission.
+ *
+ * @param {AuthUser} authUser - The authenticated user object containing roles and permissions.
+ * @param {string} permission - The name of the permission to check for.
+ * @return {boolean} Returns true if the user has the specified permission, otherwise false.
+ */
+export declare function hasPermission(authUser: AuthUser, permission: string): boolean;
+/**
+ * Checks if the authenticated user has the specified permissions based on the given operator.
+ *
+ * @param {AuthUser} authUser - The authenticated user object.
+ * @param {string[] | undefined} permissions - The list of permissions to check. If undefined, it defaults to granting
+ * access.
+ * @param {'or' | 'and'} [operator='or'] - Determines whether all permissions (and) or at least one permission (or) must
+ * be satisfied.
+ * @return {boolean} Returns true if the user satisfies the permission requirements, false otherwise.
+ */
+export declare function hasPermissions(authUser: AuthUser, permissions: string[] | undefined, operator?: 'or' | 'and'): boolean;

package/security/helper.js

@@ -0,0 +1,329 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resourceAuthModel = resourceAuthModel;
+exports.resourceAuthService = resourceAuthService;
+exports.currentAuthUser = currentAuthUser;
+exports.currentAuthType = currentAuthType;
+exports.currentAuthSource = currentAuthSource;
+exports.hashPassword = hashPassword;
+exports.checkPassword = checkPassword;
+exports.updatePasswordHash = updatePasswordHash;
+exports.validatePasswordComplexity = validatePasswordComplexity;
+exports.validateRedirectUrl = validateRedirectUrl;
+exports.checkScopeAccess = checkScopeAccess;
+exports.hasRole = hasRole;
+exports.hasRoles = hasRoles;
+exports.hasPermission = hasPermission;
+exports.hasPermissions = hasPermissions;
+const bcrypt = __importStar(require("bcrypt"));
+const request_context_1 = require("@fastify/request-context");
+const common_1 = require("@appweaver/common");
+const errors_1 = require("../errors");
+const context_1 = require("../context");
+/**
+ * Evaluates and retrieves the resource authentication model from the available resource models.
+ *
+ * The function iterates through the resource models in the given context and returns the first model
+ * that satisfies the `isResourceAuthModel` condition. If no such model is found, it returns undefined.
+ *
+ * @return {ResourceModel | undefined} The resource authentication model if present, otherwise undefined.
+ */
+function resourceAuthModel() {
+    for (const model of context_1.context.resource.models.values()) {
+        if ((0, common_1.isResourceAuthModel)(model)) {
+            return model;
+        }
+    }
+}
+/**
+ * Provides authentication service for a resource by identifying and injecting
+ * the appropriate resource authentication service if available.
+ *
+ * @return {IResourceService<AuthUser, AuthUser> | undefined} The resource authentication service
+ *         instance if found, otherwise undefined.
+ */
+function resourceAuthService() {
+    for (const service of context_1.context.resource.services.values()) {
+        if ((0, common_1.isResourceAuthService)(service)) {
+            return (0, context_1.injectService)(service[common_1.RESOURCE_NAME]);
+        }
+    }
+}
+/**
+ * Retrieves the currently authenticated user from the request context.
+ *
+ * @return {AuthUser | null | undefined} The authenticated user object if available,
+ * null if no user is authenticated, or undefined if the context does not contain
+ * authentication information.
+ */
+function currentAuthUser() {
+    return request_context_1.requestContext.get('authUser');
+}
+/**
+ * Retrieves the current authentication type from the request context.
+ *
+ * @return {AuthType | null | undefined} The authentication type if available; otherwise, returns null or undefined.
+ */
+function currentAuthType() {
+    return request_context_1.requestContext.get('authType');
+}
+/**
+ * Retrieves the current authentication source from the request context.
+ *
+ * @return {AuthSource | null | undefined} The authentication source if available; otherwise, null or undefined
+ * if it is not set.
+ */
+function currentAuthSource() {
+    return request_context_1.requestContext.get('authSource');
+}
+/**
+ * Hashes a plain text password using a cryptographic salt.
+ *
+ * @param {string} password - The plain text password to be hashed.
+ * @return {Promise<string>} A promise that resolves to the hashed password.
+ */
+async function hashPassword(password) {
+    const salt = await bcrypt.genSalt();
+    return bcrypt.hash(password, salt);
+}
+/**
+ * Validates a plain text password against a hashed password.
+ *
+ * @param {string} password - The plain text password to validate.
+ * @param {string} passwordHash - The hashed password to compare against.
+ * @return {Promise<boolean>} Returns a promise that resolves to `true` if the password matches the hash,
+ * otherwise `false`.
+ */
+async function checkPassword(password, passwordHash) {
+    return bcrypt.compare(password, passwordHash);
+}
+/**
+ * Updates the password hash for a given user and optionally logs the user out by setting a logout timestamp.
+ *
+ * @param {Partial<AuthUser>} authUser - The user object containing authentication details. Only partial fields are
+ * expected.
+ * @param {string} [password] - The new password to hash and set for the user. If not provided, no password update
+ * occurs.
+ * @param {boolean} [logout=false] - Indicates whether to log the user out by setting the logout timestamp.
+ * @return Resolves when the password hash is updated and optional logout processing is complete.
+ * @throws {HttpError} If the provided password does not satisfy password complexity requirements.
+ */
+async function updatePasswordHash(authUser, password, logout = false) {
+    if (password) {
+        if (!common_1.config.SECURITY_PASSWORD_ENABLED) {
+            throw new errors_1.HttpError('Password creation is not supported', 403);
+        }
+        const result = validatePasswordComplexity(password);
+        if (!result.valid) {
+            throw new errors_1.HttpError(result.message, 400);
+        }
+        authUser.passwordHash = await hashPassword(password);
+        if (logout) {
+            authUser.logoutAt = new Date();
+        }
+    }
+    delete authUser['password'];
+}
+/**
+ * Validates the complexity of a given password based on the configured rules.
+ * @param {string} password - The password to be validated.
+ * @return {ValidationResult} An object with the validation result and message.
+ */
+function validatePasswordComplexity(password) {
+    const minLength = common_1.config.SECURITY_PASSWORD_MIN_LENGTH;
+    if (password.length < minLength) {
+        return {
+            valid: false,
+            message: `Password must be at least ${minLength} characters long`
+        };
+    }
+    const maxLength = common_1.config.SECURITY_PASSWORD_MAX_LENGTH;
+    if (password.length > maxLength) {
+        return {
+            valid: false,
+            message: `Password must not be longer than ${maxLength} characters`
+        };
+    }
+    if (!/[A-Z]/.test(password) && common_1.config.SECURITY_PASSWORD_UPPERCASE) {
+        return {
+            valid: false,
+            message: `Password must have at least one uppercase character`
+        };
+    }
+    if (!/[a-z]/.test(password) && common_1.config.SECURITY_PASSWORD_LOWERCASE) {
+        return {
+            valid: false,
+            message: `Password must have at least one lowercase character`
+        };
+    }
+    if (!/[0-9]/.test(password) && common_1.config.SECURITY_PASSWORD_NUMERIC) {
+        return {
+            valid: false,
+            message: `Password must have at least one numeric character`
+        };
+    }
+    if (!/[^A-Za-z0-9]/.test(password) && common_1.config.SECURITY_PASSWORD_SPECIAL) {
+        return {
+            valid: false,
+            message: `Password must have at least one special character`
+        };
+    }
+    return { valid: true, message: 'OK' };
+}
+/**
+ * Validates a URL and checks if it's allowed based on the configured list of allowed hosts.
+ *
+ * @param {string} url - The URL string to validate.
+ * @return {ValidationResult} An object containing validation result and message.
+ */
+function validateRedirectUrl(url) {
+    try {
+        new URL(url);
+    }
+    catch (e) {
+        return {
+            valid: false,
+            message: `Invalid URL format: ${url}`
+        };
+    }
+    const checkUrl = new URL(url);
+    const allowedHosts = common_1.config.SECURITY_ALLOWED_REDIRECT_HOSTS;
+    if (!allowedHosts.includes('*') &&
+        !allowedHosts.includes(checkUrl.hostname)) {
+        return {
+            valid: false,
+            message: `The URL hostname '${checkUrl.hostname}' is not allowed`
+        };
+    }
+    return {
+        valid: true,
+        message: 'URL is valid and allowed'
+    };
+}
+/**
+ * Checks whether the provided URL is accessible based on the user's JWT payload `scope` property.
+ *
+ * @param {string} url - The URL path being accessed.
+ * @param {AuthScope} authScope - The `scope` property from the decoded JWT payload.
+ * @return {boolean} Returns true if the URL is accessible based on the scope; false otherwise.
+ */
+function checkScopeAccess(url, authScope) {
+    const securityPrefix = common_1.config.SECURITY_ROUTE_PREFIX.replace(/\/$/, '');
+    const accountPrefix = common_1.config.SECURITY_ACCOUNT_ROUTE_PREFIX.replace(/\/$/, '');
+    const refreshPath = `${securityPrefix}/refresh`;
+    const twoFASendPath = `${accountPrefix}/2fa-send-code`;
+    const twoFAVerifyPath = `${accountPrefix}/verify-2fa-code`;
+    const scopeConfigs = [
+        {
+            scope: common_1.AuthScope.Auth,
+            disallowedPaths: [refreshPath, twoFASendPath, twoFAVerifyPath]
+        },
+        {
+            scope: common_1.AuthScope.Refresh,
+            allowedPaths: [refreshPath]
+        },
+        {
+            scope: common_1.AuthScope.TwoFA,
+            allowedPaths: [twoFASendPath, twoFAVerifyPath]
+        }
+    ];
+    const scopeConfig = scopeConfigs.find(({ scope }) => scope === authScope);
+    if (!scopeConfig) {
+        return false;
+    }
+    const { allowedPaths, disallowedPaths } = scopeConfig;
+    return ((allowedPaths !== undefined && allowedPaths.includes(url)) ||
+        (disallowedPaths !== undefined && !disallowedPaths.includes(url)));
+}
+/**
+ * Checks if the given user has a specific role.
+ *
+ * @param {AuthUser} authUser - The authenticated user object containing role information.
+ * @param {string} role - The name of the role to check for.
+ * @return {boolean} True if the user has the specified role; otherwise, false.
+ */
+function hasRole(authUser, role) {
+    return authUser.roles.some((r) => r.name === role);
+}
+/**
+ * Checks if the authenticated user has the required roles based on the specified operator.
+ *
+ * @param {AuthUser} authUser - The authenticated user whose roles are being checked.
+ * @param {Array<string> | undefined} roles - The list of roles to check against. If undefined, the method returns
+ * true`.
+ * @param {'or' | 'and'} [operator='or'] - The logical operator for role matching. Use 'or' to check if the user has at
+ * least one role, and 'and' to check if the user has all roles.
+ * @return {boolean} Returns `true` if the user satisfies the role check based on the specified operator, otherwise
+ * `false`.
+ */
+function hasRoles(authUser, roles, operator = 'or') {
+    if (!roles) {
+        return true;
+    }
+    const predicate = (role) => hasRole(authUser, role);
+    return operator === 'and' ? roles.every(predicate) : roles.some(predicate);
+}
+/**
+ * Determines if the authenticated user has the specified permission.
+ *
+ * @param {AuthUser} authUser - The authenticated user object containing roles and permissions.
+ * @param {string} permission - The name of the permission to check for.
+ * @return {boolean} Returns true if the user has the specified permission, otherwise false.
+ */
+function hasPermission(authUser, permission) {
+    return authUser.roles
+        .flatMap((r) => r.permissions)
+        .some((p) => p.name === permission);
+}
+/**
+ * Checks if the authenticated user has the specified permissions based on the given operator.
+ *
+ * @param {AuthUser} authUser - The authenticated user object.
+ * @param {string[] | undefined} permissions - The list of permissions to check. If undefined, it defaults to granting
+ * access.
+ * @param {'or' | 'and'} [operator='or'] - Determines whether all permissions (and) or at least one permission (or) must
+ * be satisfied.
+ * @return {boolean} Returns true if the user satisfies the permission requirements, false otherwise.
+ */
+function hasPermissions(authUser, permissions, operator = 'or') {
+    if (!permissions) {
+        return true;
+    }
+    const predicate = (perm) => hasPermission(authUser, perm);
+    return operator === 'and'
+        ? permissions.every(predicate)
+        : permissions.some(predicate);
+}

package/security/index.d.ts

@@ -0,0 +1,4 @@
+export * from './oauth2/create-oauth2-plugin';
+export * from './auth-service';
+export * from './auth-schema';
+export * from './helper';

package/security/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./oauth2/create-oauth2-plugin"), exports);
+__exportStar(require("./auth-service"), exports);
+__exportStar(require("./auth-schema"), exports);
+__exportStar(require("./helper"), exports);

package/security/jwt/index.d.ts

@@ -0,0 +1,2 @@
+export * from './jwt-auth';
+export * from './jwt-keys';

package/security/jwt/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./jwt-auth"), exports);
+__exportStar(require("./jwt-keys"), exports);

package/security/jwt/jwt-auth.d.ts

@@ -0,0 +1,4 @@
+import { FastifyRequest } from 'fastify';
+import { Server } from '../../types';
+export declare const jwtAuth: (server: Server) => Promise<void>;
+export declare function hasBearerAuth(request: FastifyRequest): boolean;

package/security/jwt/jwt-auth.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jwtAuth = void 0;
+exports.hasBearerAuth = hasBearerAuth;
+const fastify_plugin_1 = __importDefault(require("fastify-plugin"));
+const jwt_1 = __importDefault(require("@fastify/jwt"));
+const request_context_1 = require("@fastify/request-context");
+const common_1 = require("@appweaver/common");
+const context_1 = require("../../context");
+const auth_service_1 = require("../auth-service");
+const errors_1 = require("../../errors");
+const jwt_keys_1 = require("./jwt-keys");
+exports.jwtAuth = (0, fastify_plugin_1.default)(async (server) => {
+    const authService = (0, context_1.inject)(auth_service_1.AuthService);
+    if (common_1.config.SECURITY_JWT_SECRET) {
+        server.register(jwt_1.default, {
+            secret: common_1.config.SECURITY_JWT_SECRET
+        });
+    }
+    else {
+        const { keysExisted, publicKey, privateKey } = await (0, jwt_keys_1.loadSecurityKeys)(common_1.config.SECURITY_JWT_PUBLIC_KEY_PATH, common_1.config.SECURITY_JWT_PRIVATE_KEY_PATH, common_1.config.SECURITY_JWT_AUTO_GENERATE_KEYS);
+        if (!keysExisted) {
+            common_1.logger.info({
+                publicKeyPath: common_1.config.SECURITY_JWT_PUBLIC_KEY_PATH,
+                privateKeyPath: common_1.config.SECURITY_JWT_PRIVATE_KEY_PATH
+            }, 'Security keys generated');
+        }
+        server.register(jwt_1.default, {
+            secret: {
+                public: publicKey,
+                private: privateKey
+            },
+            sign: { algorithm: 'RS256' }
+        });
+    }
+    server.decorate('authenticateJWT', async (request) => {
+        let payload;
+        let authUser;
+        try {
+            payload = await request.jwtVerify();
+            authUser = await authService.findById(payload.sub);
+        }
+        catch (e) {
+            throw new errors_1.HttpError('Authentication error', 401, e);
+        }
+        authService.authorize(authUser, request.url, request.routeOptions.config, payload);
+        request_context_1.requestContext.set('authUser', authUser);
+        request_context_1.requestContext.set('authType', common_1.AuthType.Jwt);
+        request_context_1.requestContext.set('authSource', payload.source);
+    });
+});
+function hasBearerAuth(request) {
+    return (request.headers.authorization?.toLowerCase().startsWith('bearer') === true);
+}

package/security/jwt/jwt-keys.d.ts

@@ -0,0 +1,7 @@
+export declare function ensureSecurityKeys(publicKeyPath: string, privateKeyPath: string, generateIfNotExists: boolean): Promise<boolean>;
+export declare function generateSecurityKeys(publicKeyPath: string, privateKeyPath: string): Promise<void>;
+export declare function loadSecurityKeys(publicKeyPath: string, privateKeyPath: string, generateIfNotExists: boolean): Promise<{
+    keysExisted: boolean;
+    publicKey: string;
+    privateKey: string;
+}>;

package/security/jwt/jwt-keys.js

@@ -0,0 +1,43 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureSecurityKeys = ensureSecurityKeys;
+exports.generateSecurityKeys = generateSecurityKeys;
+exports.loadSecurityKeys = loadSecurityKeys;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_util_1 = require("node:util");
+const node_crypto_1 = require("node:crypto");
+async function ensureSecurityKeys(publicKeyPath, privateKeyPath, generateIfNotExists) {
+    try {
+        await promises_1.default.access(publicKeyPath, promises_1.default.constants.F_OK);
+        await promises_1.default.access(privateKeyPath, promises_1.default.constants.F_OK);
+        return true;
+    }
+    catch (e) {
+        if (!generateIfNotExists) {
+            throw e;
+        }
+        await generateSecurityKeys(publicKeyPath, privateKeyPath);
+        return false;
+    }
+}
+async function generateSecurityKeys(publicKeyPath, privateKeyPath) {
+    const { privateKey, publicKey } = await (0, node_util_1.promisify)(node_crypto_1.generateKeyPair)('rsa', {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
+    });
+    await promises_1.default.mkdir(node_path_1.default.dirname(publicKeyPath), { recursive: true });
+    await promises_1.default.writeFile(publicKeyPath, publicKey, 'utf8');
+    await promises_1.default.mkdir(node_path_1.default.dirname(privateKeyPath), { recursive: true });
+    await promises_1.default.writeFile(privateKeyPath, privateKey, 'utf8');
+}
+async function loadSecurityKeys(publicKeyPath, privateKeyPath, generateIfNotExists) {
+    const keysExisted = await ensureSecurityKeys(publicKeyPath, privateKeyPath, generateIfNotExists);
+    const publicKey = await promises_1.default.readFile(publicKeyPath, 'utf8');
+    const privateKey = await promises_1.default.readFile(privateKeyPath, 'utf8');
+    return { keysExisted, publicKey, privateKey };
+}

package/security/oauth2/create-oauth2-plugin.d.ts

@@ -0,0 +1,17 @@
+import { AuthSource } from '@appweaver/common';
+import { Server } from '../../types';
+export type UserInfo = {
+    id: string;
+    email: string;
+    firstName: string;
+    lastName: string;
+};
+export type OAuth2Config = {
+    enabled: boolean;
+    clientId?: string;
+    clientSecret?: string;
+    issuer?: string;
+    scope: string[];
+    extractUserInfo: (accessToken: string) => Promise<UserInfo>;
+};
+export declare function createOAuth2Plugin(authSource: AuthSource, oAuth2Config: OAuth2Config): (server: Server) => Promise<void>;